Add migration for legacy profile ownership

Clean up comments
Add migration from legacy tcp to named pipes
2026-07-24 17:31:28 +02:00 · 2026-07-24 15:31:57 +02:00 · 2026-07-24 14:57:21 +02:00 · 2026-07-24 10:58:29 +02:00 · 2026-07-23 20:27:06 +02:00 · 2026-07-23 19:43:58 +02:00
228 changed files with 10014 additions and 1952 deletions
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -237,7 +237,7 @@ task dev
 Pass daemon flags after `--`:

 ```
-task dev -- --daemon-addr=tcp://127.0.0.1:41731
+task dev -- --daemon-addr=npipe://netbird
 ```

 Production build (frontend assets embedded into the binary, output in `client/ui/bin/`):
--- a/agent-network/README.md
+++ b/agent-network/README.md
@@ -1,16 +1,47 @@
 # NetBird Agent Network

-Agent Network is NetBird's access control layer for AI agents and the people who run
-them. It gives every agent a real identity, tied to your identity provider (IdP), and
-governs what it can reach — the LLM APIs and AI gateways it can call, and the internal
-resources it can access. Traffic flows only over the encrypted NetBird tunnel, scoped by
-policy, with no API keys to leak.
+Agent Network is NetBird's access control layer for AI agents and the people who run them. 
+It gives every agent a real identity, tied to an identity provider (IdP), and governs what it can reach: LLM APIs and 
+AI gateways it can call, and the internal resources it can access. Traffic flows only over the encrypted NetBird tunnel, 
+scoped by policy, with no API keys or other credentials to leak. It also gives you control over cost and token usage.

-> **Beta.** Agent Network is open source and can be self-hosted on your own
-> infrastructure.
+Because every LLM request passes through an
+identity-aware proxy, you can:
+
+- **Set spending and rate limits** per agent, per user, or per team — with hard caps
+  that stop requests once a budget is reached.
+- **Restrict models and providers** so agents can only call approved (and cost-appropriate)
+  endpoints, keeping expensive models off-limits unless explicitly allowed.
+- **Attribute usage** by tracking token consumption and cost per identity, group, or cost center so every
+  request is tied back to the agent and person responsible.
+- **Reuse your existing AI gateway** — point the proxy at a gateway you already run,
+  keeping its routing and config in place while it adds identity on top, so you skip
+  API key distribution.
+
+https://github.com/user-attachments/assets/44d18286-d8ab-49f8-a457-98ccd66f3268
+
+> **Beta.** Agent Network is in beta, but it's stable and already running in
+> production environments. It's fully open source and can be self-hosted on your own
+> infrastructure, with no vendor lock-in and no data leaving your environment.

 ## How it works

+Say you have a simple use case: your Engineering or IT team needs access to Claude Code or Codex, and you want visibility into usage plus the ability to enforce budgets.
+How can you do that without creating a dedicated API key for every team?
+
+With Agent Network you get a private endpoint inside your network, for example: https://mirror.netbird.ai
+Teams configure their agents to point to that endpoint instead of using individual API keys directly. 
+
+This endpoint is only reachable when users are connected to your NetBird network and authenticated through your IdP. Otherwise, it is not accessible from the public internet.
+You can then use this private endpoint to configure your AI agents, whether that is Claude Code, Codex, or another tool.
+
+## Quickstart
+
+Full step-by-step setup:
+**https://docs.netbird.io/agent-network/quickstart**
+
+## Architecture 
+
 Agent Network is built on two existing NetBird capabilities:

 - **Overlay network** — the encrypted WireGuard mesh between peers.
@@ -22,6 +53,9 @@ LLM traffic is routed through the proxy's identity-aware pipeline, while interna
 resources (databases, internal APIs, self-hosted models) are reached directly over
 peer-to-peer WireGuard tunnels, governed by the same identities and access policies.

+<img width="4720" height="2218" alt="image" src="https://github.com/user-attachments/assets/1afa5da1-4b82-4f8a-a7a8-f417efadf1eb" />
+
+
 ## Where the code lives

 There is no separate "agent-network" service — it reuses the reverse-proxy and management
--- a/client/android/client.go
+++ b/client/android/client.go
@@ -247,6 +247,9 @@ func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool) (strin
 		deps.SyncResponse = resp

 		if e := cc.Engine(); e != nil {
+			deps.RefreshStatus = func() {
+				e.RunHealthProbes(context.Background(), true)
+			}
 			if cm := e.GetClientMetrics(); cm != nil {
 				deps.ClientMetrics = cm
 			}
--- a/client/android/profile_manager.go
+++ b/client/android/profile_manager.go
@@ -145,7 +145,7 @@ func (pm *ProfileManager) SwitchProfile(id string) error {
 // AddProfile creates a new profile
 func (pm *ProfileManager) AddProfile(profileName string) error {
 	// Use ServiceManager (creates profile in profiles/ directory)
-	profile, err := pm.serviceMgr.AddProfile(profileName, androidUsername)
+	profile, err := pm.serviceMgr.AddProfile(profileName, androidUsername, nil)
 	if err != nil {
 		return fmt.Errorf("failed to add profile: %w", err)
 	}
--- a/client/cmd/login.go
+++ b/client/cmd/login.go
@@ -17,7 +17,9 @@ import (
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	nbnet "github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/client/server"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/util"
 )
@@ -331,6 +333,14 @@ func doForegroundLogin(ctx context.Context, cmd *cobra.Command, setupKey string,
 		return fmt.Errorf("read config file %s: %v", configFilePath, err)
 	}

+	// Mirror runInForegroundMode: recover residual state (DNS, firewall,
+	// ssh config, legacy routing) from a previous unclean shutdown and
+	// enable advanced routing before dialing management.
+	if err := server.RestoreResidualState(ctx, profilemanager.NewServiceManager(configFilePath).GetStatePath()); err != nil {
+		log.Warnf("failed to restore residual state: %v", err)
+	}
+	nbnet.Init()
+
 	err = foregroundLogin(ctx, cmd, config, setupKey, activeProf.ID)
 	if err != nil {
 		return fmt.Errorf("foreground login failed: %v", err)
--- a/client/cmd/owner.go
+++ b/client/cmd/owner.go
@@ -0,0 +1,115 @@
+package cmd
+
+import (
+	"context"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/util"
+)
+
+var ownerCmd = &cobra.Command{
+	Use:   "owner",
+	Short: "Manage who may control the active NetBird profile",
+	Long: `Manage the owners of the active profile's daemon control channel.
+
+Ownership is enforced per profile: an isolated profile can only be controlled by
+its owner principals (plus root/administrator). A new profile is automatically
+owned by its creator; an unowned profile is claimed by the first caller.`,
+}
+
+var ownerAddCmd = &cobra.Command{
+	Use:   "add <principal>",
+	Short: "Add an owner principal to the active profile",
+	Long: `Add an owner principal to the active profile. Principals are typed:
+  uid:1000               a Unix user ID
+  gid:1000               a Unix group ID
+  group:netbird-admins   a Unix group name (resolved via NSS/getent)
+  sid:S-1-5-21-...       a Windows user or group SID
+
+Requires root/administrator or an existing owner.`,
+	Args: cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		return withDaemon(cmd, func(ctx context.Context, c proto.DaemonServiceClient) error {
+			if _, err := c.AddOwner(ctx, &proto.AddOwnerRequest{Principal: args[0]}); err != nil {
+				return err
+			}
+			cmd.Printf("Added owner %q to the active profile\n", args[0])
+			return nil
+		})
+	},
+}
+
+var ownerResetCmd = &cobra.Command{
+	Use:   "reset",
+	Short: "Clear the active profile's owner list (root/administrator only)",
+	Long: `Clear the active profile's owner list, returning it to the unowned
+state. The next caller then claims ownership (trust-on-first-use). Requires
+root/administrator.`,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		return withDaemon(cmd, func(ctx context.Context, c proto.DaemonServiceClient) error {
+			if _, err := c.ResetOwner(ctx, &proto.ResetOwnerRequest{}); err != nil {
+				return err
+			}
+			cmd.Println("Owner list cleared; the next caller will claim ownership")
+			return nil
+		})
+	},
+}
+
+var ownerShareCmd = &cobra.Command{
+	Use:   "share",
+	Short: "Mark the active profile shared (any local user may control it)",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		return withDaemon(cmd, func(ctx context.Context, c proto.DaemonServiceClient) error {
+			if _, err := c.ShareProfile(ctx, &proto.ShareProfileRequest{Shared: true}); err != nil {
+				return err
+			}
+			cmd.Println("Active profile is now shared with all local users")
+			return nil
+		})
+	},
+}
+
+var ownerUnshareCmd = &cobra.Command{
+	Use:   "unshare",
+	Short: "Stop sharing the active profile (restrict to its owners)",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		return withDaemon(cmd, func(ctx context.Context, c proto.DaemonServiceClient) error {
+			if _, err := c.ShareProfile(ctx, &proto.ShareProfileRequest{Shared: false}); err != nil {
+				return err
+			}
+			cmd.Println("Active profile is no longer shared")
+			return nil
+		})
+	},
+}
+
+// withDaemon runs fn with a connected daemon client, handling setup and teardown.
+func withDaemon(cmd *cobra.Command, fn func(context.Context, proto.DaemonServiceClient) error) error {
+	SetFlagsFromEnvVars(rootCmd)
+	cmd.SetOut(cmd.OutOrStdout())
+	if err := util.InitLog(logLevel, util.LogConsole); err != nil {
+		log.Errorf("failed initializing log %v", err)
+		return err
+	}
+
+	ctx, cancel := context.WithTimeout(cmd.Context(), 20*time.Second)
+	defer cancel()
+
+	conn, err := DialClientGRPCServer(ctx, daemonAddr)
+	if err != nil {
+		log.Errorf("failed to connect to service CLI interface %v", err)
+		return err
+	}
+	defer func() {
+		if cerr := conn.Close(); cerr != nil {
+			log.Debugf("close daemon connection: %v", cerr)
+		}
+	}()
+
+	return fn(ctx, proto.NewDaemonServiceClient(conn))
+}
--- a/client/cmd/root.go
+++ b/client/cmd/root.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
+	"net"
 	"os"
 	"os/signal"
 	"path"
@@ -143,10 +144,10 @@ func init() {

 	defaultDaemonAddr := "unix:///var/run/netbird.sock"
 	if runtime.GOOS == "windows" {
-		defaultDaemonAddr = "tcp://127.0.0.1:41731"
+		defaultDaemonAddr = windowsPipeDaemonAddr
 	}

-	rootCmd.PersistentFlags().StringVar(&daemonAddr, "daemon-addr", defaultDaemonAddr, "Daemon service address to serve CLI requests [unix|tcp]://[path|host:port]")
+	rootCmd.PersistentFlags().StringVar(&daemonAddr, "daemon-addr", defaultDaemonAddr, "Daemon service address to serve CLI requests [unix|tcp|npipe]://[path|host:port|name]")
 	rootCmd.PersistentFlags().StringVarP(&managementURL, "management-url", "m", "", fmt.Sprintf("Management Service URL [http|https]://[host]:[port] (default \"%s\")", profilemanager.DefaultManagementURL))
 	rootCmd.PersistentFlags().StringVar(&adminURL, "admin-url", "", fmt.Sprintf("Admin Panel URL [http|https]://[host]:[port] (default \"%s\")", profilemanager.DefaultAdminURL))
 	rootCmd.PersistentFlags().StringVarP(&logLevel, "log-level", "l", "info", "sets NetBird log level")
@@ -172,6 +173,9 @@ func init() {
 	rootCmd.AddCommand(profileCmd)
 	rootCmd.AddCommand(exposeCmd)

+	rootCmd.AddCommand(ownerCmd)
+	ownerCmd.AddCommand(ownerAddCmd, ownerResetCmd, ownerShareCmd, ownerUnshareCmd)
+
 	networksCMD.AddCommand(routesListCmd)
 	networksCMD.AddCommand(routesSelectCmd, routesDeselectCmd)

@@ -264,17 +268,32 @@ func FlagNameToEnvVar(cmdFlag string, prefix string) string {
 	return prefix + upper
 }

+// daemonDialTarget returns the gRPC dial target and base options for the daemon
+// address, handling the npipe scheme (Windows named pipe, via a context dialer)
+// and unix/tcp.
+func daemonDialTarget(addr string) (string, []grpc.DialOption) {
+	opts := []grpc.DialOption{grpc.WithTransportCredentials(insecure.NewCredentials())}
+	target := strings.TrimPrefix(addr, "tcp://")
+	if strings.HasPrefix(addr, "npipe://") {
+		path := pipePath(strings.TrimPrefix(addr, "npipe://"))
+		opts = append(opts, grpc.WithContextDialer(func(dialCtx context.Context, _ string) (net.Conn, error) {
+			return dialNamedPipe(dialCtx, path)
+		}))
+		target = "passthrough:///netbird-daemon-pipe"
+	}
+	return target, opts
+}
+
 // DialClientGRPCServer returns client connection to the daemon server.
-func DialClientGRPCServer(ctx context.Context, addr string) (*grpc.ClientConn, error) {
+func DialClientGRPCServer(ctx context.Context, addr string, opts ...grpc.DialOption) (*grpc.ClientConn, error) {
 	ctx, cancel := context.WithTimeout(ctx, time.Second*10)
 	defer cancel()

-	return grpc.DialContext(
-		ctx,
-		strings.TrimPrefix(addr, "tcp://"),
-		grpc.WithTransportCredentials(insecure.NewCredentials()),
-		grpc.WithBlock(),
-	)
+	target, dialOpts := daemonDialTarget(addr)
+	dialOpts = append(dialOpts, grpc.WithBlock())
+	dialOpts = append(dialOpts, opts...)
+
+	return grpc.DialContext(ctx, target, dialOpts...)
 }

 // WithBackOff execute function in backoff cycle.
--- a/client/cmd/service.go
+++ b/client/cmd/service.go
@@ -54,7 +54,7 @@ func init() {
 	serviceCmd.PersistentFlags().BoolVar(&captureEnabled, "enable-capture", false, "Enables packet capture via 'netbird debug capture'. To persist, use: netbird service install --enable-capture")
 	serviceCmd.PersistentFlags().BoolVar(&networksDisabled, "disable-networks", false, "Disables network selection. If enabled, the client will not allow listing, selecting, or deselecting networks. To persist, use: netbird service install --disable-networks")
 	serviceCmd.PersistentFlags().BoolVar(&enableJSONSocket, "enable-json-socket", false, "Enables the HTTP/JSON API socket served by grpc-gateway. To persist, use: netbird service install --enable-json-socket")
-	serviceCmd.PersistentFlags().StringVar(&jsonSocket, "json-socket", defaultJSONSocket, "HTTP/JSON API socket address [unix|tcp]://[path|host:port]. Requires --enable-json-socket to serve. To persist, use: netbird service install --enable-json-socket --json-socket")
+	serviceCmd.PersistentFlags().StringVar(&jsonSocket, "json-socket", defaultJSONSocket, "HTTP/JSON API socket address [unix|tcp|npipe]://[path|host:port|name]. Requires --enable-json-socket to serve. To persist, use: netbird service install --enable-json-socket --json-socket")

 	rootCmd.PersistentFlags().StringVarP(&serviceName, "service", "s", defaultServiceName, "Netbird system service name")
 	serviceEnvDesc := `Sets extra environment variables for the service. ` +
--- a/client/cmd/service_controller.go
+++ b/client/cmd/service_controller.go
@@ -5,6 +5,7 @@ package cmd
 import (
 	"context"
 	"fmt"
+	"runtime"
 	"time"

 	"github.com/kardianos/service"
@@ -13,12 +14,32 @@ import (
 	"github.com/spf13/cobra"
 	"google.golang.org/grpc"

+	"github.com/netbirdio/netbird/client/internal/ipcauth"
 	"github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/server"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/util"
 )

+// daemonServerOptions installs peer-identity transport credentials and the
+// authorization interceptor on the daemon ipc if supported.
+func daemonServerOptions(network string, interceptor *ipcauth.Interceptor) []grpc.ServerOption {
+	creds := ipcauth.NewTransportCredentials()
+	if creds == nil {
+		log.Warnf("daemon ipc has no peer-identity primitive on %s, per-caller authorization is disabled", runtime.GOOS)
+		return nil
+	}
+	if network == "tcp" {
+		log.Warnf("daemon is listening on TCP (%s), peer identity cannot be authenticated over TCP, per-caller authorization is disabled", daemonAddr)
+		return nil
+	}
+	return []grpc.ServerOption{
+		grpc.Creds(creds),
+		grpc.ChainUnaryInterceptor(interceptor.UnaryServerInterceptor()),
+		grpc.ChainStreamInterceptor(interceptor.StreamServerInterceptor()),
+	}
+}
+
 func validateJSONSocketFlags() error {
 	if serviceCmd.PersistentFlags().Changed("json-socket") && !enableJSONSocket {
 		return fmt.Errorf("--json-socket requires --enable-json-socket to configure the daemon JSON gateway")
@@ -37,8 +58,28 @@ func (p *program) Start(svc service.Service) error {
 	// Collect static system and platform information
 	system.UpdateStaticInfoAsync()

-	// in any case, even if configuration does not exists we run daemon to serve CLI gRPC API.
-	p.serv = grpc.NewServer()
+	// A daemon installed before named-pipe support uses the old loopback-TCP
+	// address as the daemon address. We migrate to a named pipe so an
+	// upgraded daemon enforces per-caller authorization instead of silently
+	// running on identity-less TCP.
+	if migrated, ok := migrateLegacyDaemonAddr(daemonAddr); ok {
+		log.Infof("legacy daemon address %q predates named-pipe support. listening on %q so per-caller authorization is enforced", daemonAddr, migrated)
+		daemonAddr = migrated
+	}
+
+	network, _, err := parseListenAddress(daemonAddr)
+	if err != nil {
+		return fmt.Errorf("parse daemon address: %w", err)
+	}
+
+	// Owner-authorization interceptor. The ConfigAdapter is a lazy bridge: the
+	// gRPC server is built before the daemon server instance exists, so we set
+	// the real policy backend below once serverInstance is created.
+	ownerAdapter := &ipcauth.ConfigAdapter{}
+	authInterceptor := ipcauth.NewInterceptor(ownerAdapter, ipcauth.NewDefaultGroupResolver())
+
+	// in any case, even if configuration does not exist we run daemon to serve the CLI gRPC API.
+	p.serv = grpc.NewServer(daemonServerOptions(network, authInterceptor)...)

 	daemonListener, err := listenOnAddress(daemonAddr)
 	if err != nil {
@@ -77,6 +118,7 @@ func (p *program) Start(svc service.Service) error {
 		if err := serverInstance.Start(); err != nil {
 			log.Fatalf("failed to start daemon: %v", err)
 		}
+		ownerAdapter.SetBackend(serverInstance)
 		proto.RegisterDaemonServiceServer(p.serv, serverInstance)

 		p.serverInstanceMu.Lock()
@@ -84,6 +126,7 @@ func (p *program) Start(svc service.Service) error {
 		p.serverInstanceMu.Unlock()

 		if jsonListener != nil {
+			log.Warnf("JSON gateway (--enable-json-socket) re-dials the daemon locally. The HTTP client's identity is forwarded so per-caller authorization still applies, but restrict access to %s appropriately", jsonSocket)
 			if err := p.startJSONGateway(jsonListener, daemonAddr); err != nil {
 				log.Fatalf("failed to start daemon JSON server: %v", err)
 			}
--- a/client/cmd/service_json_gateway.go
+++ b/client/cmd/service_json_gateway.go
@@ -5,27 +5,58 @@ package cmd
 import (
 	"context"
 	"errors"
+	"fmt"
 	"net"
 	"net/http"
-	"strings"
 	"time"

 	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
 	log "github.com/sirupsen/logrus"
 	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/metadata"

+	"github.com/netbirdio/netbird/client/internal/ipcauth"
 	"github.com/netbirdio/netbird/client/proto"
 )

-func grpcGatewayEndpoint(addr string) string {
-	return strings.TrimPrefix(addr, "tcp://")
+// jsonPeerCtxKey keys the HTTP client's kernel identity in the request context.
+type jsonPeerCtxKey struct{}
+
+// jsonConnContext reads the connecting HTTP client's identity from the JSON
+// socket and stashes it so it can be forwarded to the daemon. The gateway
+// re-dials the daemon as the daemon's own identity, so without this the
+// daemon would see every JSON request as privileged.
+func jsonConnContext(ctx context.Context, c net.Conn) context.Context {
+	id, err := ipcauth.ConnIdentity(c)
+	if err != nil {
+		log.Debugf("json gateway: cannot read HTTP client identity, requests won't carry it: %v", err)
+		return ctx
+	}
+	return context.WithValue(ctx, jsonPeerCtxKey{}, id)
+}
+
+// jsonForwardIdentity injects the stashed HTTP client identity as gRPC metadata
+// on the gateway's re-dial to the daemon. The daemon trusts it only because the
+// dial arrives as the daemon's own (self/privileged) identity.
+func jsonForwardIdentity(ctx context.Context, _ *http.Request) metadata.MD {
+	id, ok := ctx.Value(jsonPeerCtxKey{}).(ipcauth.Identity)
+	if !ok {
+		return nil
+	}
+	return ipcauth.ForwardIdentityMetadata(id)
 }

 func (p *program) startJSONGateway(jsonListener *socketListener, daemonEndpoint string) error {
-	mux := runtime.NewServeMux()
-	opts := []grpc.DialOption{grpc.WithTransportCredentials(insecure.NewCredentials())}
-	if err := proto.RegisterDaemonServiceHandlerFromEndpoint(p.ctx, mux, grpcGatewayEndpoint(daemonEndpoint), opts); err != nil {
+	mux := runtime.NewServeMux(runtime.WithMetadata(jsonForwardIdentity))
+
+	// Lazy client to the daemon, npipe-aware (grpc.NewClient does not connect
+	// until the first request, so this does not block startup before Serve).
+	target, opts := daemonDialTarget(daemonEndpoint)
+	conn, err := grpc.NewClient(target, opts...)
+	if err != nil {
+		return fmt.Errorf("create daemon client for JSON gateway: %w", err)
+	}
+	if err := proto.RegisterDaemonServiceHandler(p.ctx, mux, conn); err != nil {
 		return err
 	}

@@ -35,6 +66,7 @@ func (p *program) startJSONGateway(jsonListener *socketListener, daemonEndpoint
 		BaseContext: func(net.Listener) context.Context {
 			return p.ctx
 		},
+		ConnContext: jsonConnContext,
 	}

 	p.jsonServMu.Lock()
--- a/client/cmd/service_params.go
+++ b/client/cmd/service_params.go
@@ -125,6 +125,10 @@ func applyServiceParams(cmd *cobra.Command, params *serviceParams) {

 	if !rootCmd.PersistentFlags().Changed("daemon-addr") && params.DaemonAddr != "" {
 		daemonAddr = params.DaemonAddr
+		if migrated, ok := migrateLegacyDaemonAddr(daemonAddr); ok {
+			cmd.Printf("Migrating saved daemon address %q to %q so per-caller authorization can be enforced\n", daemonAddr, migrated)
+			daemonAddr = migrated
+		}
 	}

 	if !serviceCmd.PersistentFlags().Changed("json-socket") && params.JSONSocket != "" {
--- a/client/cmd/service_pipe_other.go
+++ b/client/cmd/service_pipe_other.go
@@ -0,0 +1,20 @@
+//go:build !windows
+
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"runtime"
+)
+
+// listenNamedPipe is unsupported off Windows; named pipes are a Windows-only transport.
+func listenNamedPipe(string) (net.Listener, error) {
+	return nil, fmt.Errorf("named pipe daemon socket is only supported on Windows, not %s", runtime.GOOS)
+}
+
+// dialNamedPipe is unsupported off Windows.
+func dialNamedPipe(context.Context, string) (net.Conn, error) {
+	return nil, fmt.Errorf("named pipe daemon socket is only supported on Windows, not %s", runtime.GOOS)
+}
--- a/client/cmd/service_pipe_windows.go
+++ b/client/cmd/service_pipe_windows.go
@@ -0,0 +1,30 @@
+//go:build windows
+
+package cmd
+
+import (
+	"context"
+	"net"
+
+	"github.com/Microsoft/go-winio"
+	"golang.org/x/sys/windows"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+)
+
+// listenNamedPipe creates the daemon control named pipe with a permissive,
+// local-only SDDL. Any local caller may connect, like Unix socket with 0666.
+func listenNamedPipe(path string) (net.Listener, error) {
+	return winio.ListenPipe(path, &winio.PipeConfig{
+		SecurityDescriptor: ipcauth.DefaultPipeSDDL(),
+	})
+}
+
+// dialNamedPipe connects to the daemon ipc named pipe at SECURITY_IDENTIFICATION.
+func dialNamedPipe(ctx context.Context, path string) (net.Conn, error) {
+	access := uint32(windows.GENERIC_READ | windows.GENERIC_WRITE)
+	// winio's plain DialPipe connects at SECURITY_ANONYMOUS, under which the
+	// daemon cannot read the caller's token. Identification lets the daemon
+	// read its SID/groups without granting it the ability to act as the caller.
+	return winio.DialPipeAccessImpLevel(ctx, path, access, winio.PipeImpLevelIdentification)
+}
--- a/client/cmd/service_socket.go
+++ b/client/cmd/service_socket.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"net"
 	"os"
+	"runtime"
 	"strings"
 	"syscall"
 	"time"
@@ -14,6 +15,30 @@ import (
 	log "github.com/sirupsen/logrus"
 )

+const (
+	windowsPipeDaemonAddr = "npipe://netbird"
+
+	// legacyWindowsDaemonAddr is the loopback-TCP address the Windows daemon used
+	// before named-pipe support.
+	legacyWindowsDaemonAddr = "tcp://127.0.0.1:41731"
+)
+
+// migrateLegacyDaemonAddr upgrades the pre-named-pipe Windows daemon address to
+// the pipe. Existing installs persist daemon addr, so on upgrade the daemon
+// would otherwise keep listening on TCP and silently run without IPC
+// authorization. Only the exact legacy default is rewritten, while a
+// deliberately-chosen custom TCP address is left alone.
+func migrateLegacyDaemonAddr(addr string) (string, bool) {
+	return migrateLegacyDaemonAddrForOS(runtime.GOOS, addr)
+}
+
+func migrateLegacyDaemonAddrForOS(goos, addr string) (string, bool) {
+	if goos == "windows" && addr == legacyWindowsDaemonAddr {
+		return windowsPipeDaemonAddr, true
+	}
+	return addr, false
+}
+
 type socketListener struct {
 	net.Listener
 	network string
@@ -26,6 +51,15 @@ func listenOnAddress(addr string) (*socketListener, error) {
 		return nil, err
 	}

+	if network == "npipe" {
+		path := pipePath(address)
+		listener, err := listenNamedPipe(path)
+		if err != nil {
+			return nil, err
+		}
+		return &socketListener{Listener: listener, network: network, address: path}, nil
+	}
+
 	if network == "unix" {
 		removeStaleUnixSocket(address)
 	}
@@ -41,17 +75,26 @@ func listenOnAddress(addr string) (*socketListener, error) {
 func parseListenAddress(addr string) (string, string, error) {
 	network, address, ok := strings.Cut(addr, "://")
 	if !ok || network == "" || address == "" {
-		return "", "", fmt.Errorf("address must be in [unix|tcp]://[path|host:port] format: %q", addr)
+		return "", "", fmt.Errorf("address must be in [unix|tcp|npipe]://[path|host:port|name] format: %q", addr)
 	}

 	switch network {
-	case "unix", "tcp":
+	case "unix", "tcp", "npipe":
 		return network, address, nil
 	default:
 		return "", "", fmt.Errorf("unsupported daemon address protocol: %v", network)
 	}
 }

+// pipePath maps a daemon-addr npipe name ("npipe://netbird") to a Windows
+// named-pipe path (\\.\pipe\netbird).
+func pipePath(name string) string {
+	if strings.HasPrefix(name, `\\`) {
+		return name
+	}
+	return `\\.\pipe\` + name
+}
+
 func removeStaleUnixSocket(path string) {
 	stat, err := os.Lstat(path)
 	if err != nil {
--- a/client/cmd/service_socket_test.go
+++ b/client/cmd/service_socket_test.go
@@ -0,0 +1,63 @@
+//go:build !ios && !android
+
+package cmd
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestMigrateLegacyDaemonAddrForOS(t *testing.T) {
+	cases := []struct {
+		name    string
+		goos    string
+		addr    string
+		want    string
+		migrate bool
+	}{
+		{
+			name:    "windows legacy tcp migrates to pipe",
+			goos:    "windows",
+			addr:    legacyWindowsDaemonAddr,
+			want:    windowsPipeDaemonAddr,
+			migrate: true,
+		},
+		{
+			name:    "windows pipe already migrated stays",
+			goos:    "windows",
+			addr:    windowsPipeDaemonAddr,
+			want:    windowsPipeDaemonAddr,
+			migrate: false,
+		},
+		{
+			name:    "windows custom tcp left alone",
+			goos:    "windows",
+			addr:    "tcp://127.0.0.1:9999",
+			want:    "tcp://127.0.0.1:9999",
+			migrate: false,
+		},
+		{
+			name:    "linux legacy-looking tcp not migrated",
+			goos:    "linux",
+			addr:    legacyWindowsDaemonAddr,
+			want:    legacyWindowsDaemonAddr,
+			migrate: false,
+		},
+		{
+			name:    "linux unix socket untouched",
+			goos:    "linux",
+			addr:    "unix:///var/run/netbird.sock",
+			want:    "unix:///var/run/netbird.sock",
+			migrate: false,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got, ok := migrateLegacyDaemonAddrForOS(tc.goos, tc.addr)
+			assert.Equal(t, tc.want, got)
+			assert.Equal(t, tc.migrate, ok)
+		})
+	}
+}
--- a/client/cmd/up.go
+++ b/client/cmd/up.go
@@ -22,6 +22,8 @@ import (
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/proto"
+	nbnet "github.com/netbirdio/netbird/client/net"
+	"github.com/netbirdio/netbird/client/server"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/shared/management/domain"
 	"github.com/netbirdio/netbird/util"
@@ -54,6 +56,7 @@ var (
 	showQR             bool
 	profileName        string
 	configPath         string
+	claimOwner         bool

 	upCmd = &cobra.Command{
 		Use:   "up",
@@ -65,6 +68,7 @@ var (

 func init() {
 	upCmd.PersistentFlags().BoolVarP(&foregroundMode, "foreground-mode", "F", false, "start service in foreground")
+	upCmd.PersistentFlags().BoolVar(&claimOwner, "owner", false, "claim ownership of this profile for the current user, restricting daemon control of it to you and root/administrator")
 	upCmd.PersistentFlags().StringVar(&interfaceName, interfaceNameFlag, iface.WgInterfaceDefault, "WireGuard interface name")
 	upCmd.PersistentFlags().Uint16Var(&wireguardPort, wireguardPortFlag, iface.DefaultWgPort, "WireGuard interface listening port")
 	upCmd.PersistentFlags().Uint16Var(&mtu, mtuFlag, iface.DefaultMTU, "Set MTU (Maximum Transmission Unit) for the WireGuard interface")
@@ -229,6 +233,24 @@ func runInForegroundMode(ctx context.Context, cmd *cobra.Command, activeProf *pr

 	_, _ = profilemanager.UpdateOldManagementURL(ctx, config, configFilePath)

+	// Restore residual state left by a previous run that did not shut down
+	// cleanly, mirroring what the daemon does before connecting: it recovers
+	// DNS config (a stale resolv.conf takeover can make the management
+	// hostname unresolvable), firewall rules, ssh config and legacy routing.
+	// Route cleanup itself happens at engine start; nbnet.Init() below lets
+	// the management dial bypass a leftover fwmark rule until then.
+	// Foreground mode is particularly exposed in containers: a crashed
+	// container restarts inside the same (pod) network namespace, so stale
+	// state survives while the process does not.
+	if err := server.RestoreResidualState(ctx, profilemanager.NewServiceManager(configPath).GetStatePath()); err != nil {
+		log.Warnf("failed to restore residual state: %v", err)
+	}
+
+	// Enable advanced routing (as the daemon does on startup) so the
+	// management dial bypasses a leftover fwmark rule instead of being
+	// shunted into a stale routing table.
+	nbnet.Init()
+
 	err = foregroundLogin(ctx, cmd, config, providedSetupKey, activeProf.ID)
 	if err != nil {
 		return fmt.Errorf("foreground login failed: %v", err)
@@ -371,6 +393,7 @@ func doDaemonUp(ctx context.Context, cmd *cobra.Command, client proto.DaemonServ
 	if _, err := client.Up(ctx, &proto.UpRequest{
 		ProfileName: &profileID,
 		Username:    &username,
+		ClaimOwner:  claimOwner,
 	}); err != nil {
 		return fmt.Errorf("call service up method: %v", err)
 	}
--- a/client/cmd/up_daemon_test.go
+++ b/client/cmd/up_daemon_test.go
@@ -29,7 +29,7 @@ func TestUpDaemon(t *testing.T) {
 	}

 	sm := profilemanager.ServiceManager{}
-	created, err := sm.AddProfile("test1", currUser.Username)
+	created, err := sm.AddProfile("test1", currUser.Username, nil)
 	if err != nil {
 		t.Fatalf("failed to add profile: %v", err)
 		return
--- a/client/firewall/uspfilter/filter.go
+++ b/client/firewall/uspfilter/filter.go
@@ -121,6 +121,7 @@ type Manager struct {
 	udpTracker     *conntrack.UDPTracker
 	icmpTracker    *conntrack.ICMPTracker
 	tcpTracker     *conntrack.TCPTracker
+	fragments      *fragmentTracker
 	forwarder      atomic.Pointer[forwarder.Forwarder]
 	pendingCapture atomic.Pointer[forwarder.PacketCapture]
 	logger         *nblog.Logger
@@ -183,6 +184,41 @@ func (d *decoder) decodePacket(data []byte) error {
 	}
 }

+// decodeTransport decodes the transport header of a first fragment (which
+// gopacket leaves undecoded) into the decoder and appends its layer type to
+// decoded, so the ACL pipeline can evaluate it like a normal packet. It returns
+// false if the protocol is unsupported or the header is truncated.
+func (d *decoder) decodeTransport(proto layers.IPProtocol, payload []byte) bool {
+	var l4 gopacket.DecodingLayer
+	var layerType gopacket.LayerType
+	var minLen int
+	switch proto {
+	case layers.IPProtocolTCP:
+		l4, layerType, minLen = &d.tcp, layers.LayerTypeTCP, 20
+	case layers.IPProtocolUDP:
+		l4, layerType, minLen = &d.udp, layers.LayerTypeUDP, 8
+	case layers.IPProtocolICMPv4:
+		l4, layerType, minLen = &d.icmp4, layers.LayerTypeICMPv4, 8
+	case layers.IPProtocolICMPv6:
+		l4, layerType, minLen = &d.icmp6, layers.LayerTypeICMPv6, 8
+	default:
+		return false
+	}
+
+	// Reject a fragment too small to hold the full transport header before
+	// decoding: it can't be ACL-evaluated (tiny-fragment attack), and skipping
+	// the decode avoids gopacket allocating an error on the drop path.
+	if len(payload) < minLen {
+		return false
+	}
+
+	if err := l4.DecodeFromBytes(payload, gopacket.NilDecodeFeedback); err != nil {
+		return false
+	}
+	d.decoded = append(d.decoded, layerType)
+	return true
+}
+
 // Create userspace firewall manager constructor
 func Create(iface common.IFaceMapper, disableServerRoutes bool, flowLogger nftypes.FlowLogger, mtu uint16) (*Manager, error) {
 	return create(iface, nil, disableServerRoutes, flowLogger, mtu)
@@ -286,6 +322,8 @@ func create(iface common.IFaceMapper, nativeFirewall firewall.Manager, disableSe
 	if err := m.localipmanager.UpdateLocalIPs(iface); err != nil {
 		return nil, fmt.Errorf("update local IPs: %w", err)
 	}
+	m.fragments = newFragmentTracker(m.logger)
+
 	if disableConntrack {
 		log.Info("conntrack is disabled")
 	} else {
@@ -299,6 +337,7 @@ func create(iface common.IFaceMapper, nativeFirewall firewall.Manager, disableSe
 		}
 	}
 	if err := iface.SetFilter(m); err != nil {
+		m.fragments.Close()
 		return nil, fmt.Errorf("set filter: %w", err)
 	}
 	return m, nil
@@ -694,6 +733,10 @@ func (m *Manager) resetState() {
 		m.tcpTracker.Close()
 	}

+	if m.fragments != nil {
+		m.fragments.Close()
+	}
+
 	if fwder := m.forwarder.Load(); fwder != nil {
 		fwder.SetCapture(nil)
 		fwder.Stop()
@@ -1046,19 +1089,20 @@ func (m *Manager) filterInbound(packetData []byte, size int) bool {
 		return true
 	}

-	// TODO: pass fragments of routed packets to forwarder
+	// gopacket does not decode the transport header of any IP fragment, so
+	// fragments take a dedicated path: the first fragment's header is decoded
+	// and ACL-evaluated here, and the remaining fragments inherit its verdict.
 	if fragment {
-		if m.logger.Enabled(nblog.LevelTrace) {
-			if d.decoded[0] == layers.LayerTypeIPv4 {
-				m.logger.Trace4("packet is a fragment: src=%v dst=%v id=%v flags=%v",
-					srcIP, dstIP, d.ip4.Id, d.ip4.Flags)
-			} else {
-				m.logger.Trace2("packet is an IPv6 fragment: src=%v dst=%v", srcIP, dstIP)
-			}
-		}
-		return false
+		return m.filterInboundFragment(d, srcIP, dstIP, size)
 	}

+	return m.filterInboundDecoded(d, srcIP, dstIP, packetData, size)
+}
+
+// filterInboundDecoded runs the ACL, DNAT and conntrack pipeline on a fully
+// decoded (non-fragment) inbound packet. It returns true if the packet should
+// be dropped.
+func (m *Manager) filterInboundDecoded(d *decoder, srcIP, dstIP netip.Addr, packetData []byte, size int) bool {
 	// TODO: optimize port DNAT by caching matched rules in conntrack
 	if translated := m.translateInboundPortDNAT(packetData, d, srcIP, dstIP); translated {
 		// Re-decode after port DNAT translation to update port information
@@ -1089,33 +1133,226 @@ func (m *Manager) filterInbound(packetData []byte, size int) bool {
 	return m.handleRoutedTraffic(d, srcIP, dstIP, packetData, size)
 }

+// fragmentMeta holds the reassembly identity and layout of an IP fragment,
+// extracted uniformly for IPv4 and IPv6.
+type fragmentMeta struct {
+	key fragmentKey
+	// offset is the fragment offset in 8-byte units (zero for the first
+	// fragment).
+	offset uint16
+	// moreFragments is the More Fragments bit. A first fragment with it unset is
+	// an IPv6 atomic fragment (a complete datagram, RFC 6946): it has no trailing
+	// fragments to inherit a verdict, so it must not be recorded.
+	moreFragments bool
+	proto         layers.IPProtocol
+	// l4payload is the fragmentable payload of this fragment. For the first
+	// fragment it starts with the transport header.
+	l4payload []byte
+	// headerEndOctets is the first fragment's payload length in 8-byte units:
+	// the smallest offset a trailing fragment may start at without overlapping
+	// the inspected transport header.
+	headerEndOctets uint16
+}
+
+// fragmentMetadata extracts the fragment identity and layout from a decoded IP
+// fragment. It returns false for fragments it can't interpret (e.g. an IPv6
+// fragment header shorter than 8 bytes), which are then dropped.
+func fragmentMetadata(d *decoder, srcIP, dstIP netip.Addr) (fragmentMeta, bool) {
+	switch d.decoded[0] {
+	case layers.LayerTypeIPv4:
+		payload := d.ip4.Payload
+		return fragmentMeta{
+			key:             fragmentKey{srcIP: srcIP, dstIP: dstIP, id: uint32(d.ip4.Id), proto: uint8(d.ip4.Protocol)},
+			offset:          d.ip4.FragOffset,
+			moreFragments:   d.ip4.Flags&layers.IPv4MoreFragments != 0,
+			proto:           d.ip4.Protocol,
+			l4payload:       payload,
+			headerEndOctets: octets(len(payload)),
+		}, true
+
+	case layers.LayerTypeIPv6:
+		// IPv6 fragment extension header: 8 bytes, followed by the fragmentable
+		// payload. Layout: next header (1), reserved (1), offset+flags (2), id (4).
+		payload := d.ip6.Payload
+		if len(payload) < 8 {
+			return fragmentMeta{}, false
+		}
+		nextHeader := layers.IPProtocol(payload[0])
+		offsetFlags := binary.BigEndian.Uint16(payload[2:4])
+		id := binary.BigEndian.Uint32(payload[4:8])
+		l4 := payload[8:]
+		return fragmentMeta{
+			key:             fragmentKey{srcIP: srcIP, dstIP: dstIP, id: id, proto: uint8(nextHeader)},
+			offset:          offsetFlags >> 3,
+			moreFragments:   offsetFlags&1 != 0,
+			proto:           nextHeader,
+			l4payload:       l4,
+			headerEndOctets: octets(len(l4)),
+		}, true
+
+	default:
+		return fragmentMeta{}, false
+	}
+}
+
+// octets rounds a byte length up to whole 8-byte units, the granularity of the
+// IP fragment offset field.
+func octets(nbytes int) uint16 {
+	return uint16((nbytes + 7) / 8)
+}
+
+// filterInboundFragment decides the fate of an IP fragment. gopacket stops
+// decoding at the network layer for every fragment, so the first fragment's
+// transport header is decoded and ACL-evaluated here and its verdict recorded;
+// the remaining (headerless) fragments inherit that verdict. Anything that
+// cannot be tied to an allowed, non-overlapping first fragment is dropped.
+func (m *Manager) filterInboundFragment(d *decoder, srcIP, dstIP netip.Addr, size int) bool {
+	meta, ok := fragmentMetadata(d, srcIP, dstIP)
+	if !ok {
+		if m.logger.Enabled(nblog.LevelTrace) {
+			m.logger.Trace2("dropping unsupported fragment: src=%v dst=%v", srcIP, dstIP)
+		}
+		return true
+	}
+
+	if meta.offset != 0 {
+		return m.filterTrailingFragment(meta, srcIP, dstIP)
+	}
+
+	// A new first fragment supersedes any recorded verdict for this datagram, so
+	// a re-sent or overlapping offset-zero fragment can't inherit the old one.
+	m.fragments.poison(meta.key)
+
+	// First fragment: decode its transport header so the ACL can evaluate it. A
+	// decode failure means the fragment is too small to hold the full transport
+	// header (RFC 1858 §3 tiny-fragment attack); it can't be evaluated, so drop it.
+	if !d.decodeTransport(meta.proto, meta.l4payload) {
+		if m.logger.Enabled(nblog.LevelTrace) {
+			m.logger.Trace3("dropping first fragment without full L4 header: src=%v dst=%v id=%v",
+				srcIP, dstIP, meta.key.id)
+		}
+		return true
+	}
+
+	return m.filterFirstFragment(d, meta, srcIP, dstIP, size)
+}
+
+// filterTrailingFragment applies a recorded first-fragment verdict to a
+// non-first fragment.
+func (m *Manager) filterTrailingFragment(meta fragmentMeta, srcIP, dstIP netip.Addr) bool {
+	switch m.fragments.verdict(meta.key, meta.offset) {
+	case fragmentAllow:
+		return false
+	case fragmentOverlap:
+		if m.logger.Enabled(nblog.LevelTrace) {
+			m.logger.Trace3("dropping overlapping fragment rewriting inspected header: src=%v dst=%v id=%v",
+				srcIP, dstIP, meta.key.id)
+		}
+		return true
+	default:
+		if m.logger.Enabled(nblog.LevelTrace) {
+			m.logger.Trace3("dropping fragment with no allowed first fragment: src=%v dst=%v id=%v",
+				srcIP, dstIP, meta.key.id)
+		}
+		return true
+	}
+}
+
+// filterFirstFragment runs the verdict part of the inbound pipeline on a first
+// fragment with its transport header decoded. It mirrors filterInboundDecoded
+// but skips DNAT (port rewriting on fragments is unsupported) and forwarder
+// injection (fragments are left to the stack to reassemble, not forwarded).
+// Allowed fragments have their verdict recorded so the datagram's trailing
+// fragments inherit it.
+func (m *Manager) filterFirstFragment(d *decoder, meta fragmentMeta, srcIP, dstIP netip.Addr, size int) bool {
+	if m.stateful && m.isValidTrackedConnection(d, srcIP, dstIP, size) {
+		m.recordFirstFragment(meta)
+		return false
+	}
+
+	if m.localipmanager.IsLocalIP(dstIP) {
+		ruleID, blocked := m.peerACLsBlock(srcIP, d, nil)
+		if blocked {
+			m.storeDropFlow("Dropping local first fragment (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
+				d, srcIP, dstIP, ruleID, size)
+			return true
+		}
+		m.trackInbound(d, srcIP, dstIP, ruleID, size)
+		m.recordFirstFragment(meta)
+		return false
+	}
+
+	if !m.routingEnabled.Load() {
+		if m.logger.Enabled(nblog.LevelTrace) {
+			m.logger.Trace2("Dropping routed fragment (routing disabled): src=%s dst=%s", srcIP, dstIP)
+		}
+		return true
+	}
+	if m.nativeRouter.Load() {
+		m.trackInbound(d, srcIP, dstIP, nil, size)
+		m.recordFirstFragment(meta)
+		return false
+	}
+
+	// TODO: pass fragments of routed packets to the forwarder; until then
+	// allowed routed fragments go to the native stack.
+	srcPort, dstPort := getPortsFromPacket(d)
+	ruleID, pass := m.routeACLsPass(srcIP, dstIP, d.decoded[1], srcPort, dstPort)
+	if !pass {
+		m.storeDropFlow("Dropping routed first fragment (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
+			d, srcIP, dstIP, ruleID, size)
+		return true
+	}
+
+	m.recordFirstFragment(meta)
+	return false
+}
+
+// recordFirstFragment caches an allowed first fragment's verdict for its
+// trailing fragments to inherit. Atomic fragments (no More Fragments bit) are
+// complete datagrams with no trailing fragments, so they are not cached and
+// cannot exhaust the verdict table.
+func (m *Manager) recordFirstFragment(meta fragmentMeta) {
+	if !meta.moreFragments {
+		return
+	}
+	m.fragments.recordAllowed(meta.key, meta.headerEndOctets)
+}
+
+// storeDropFlow logs and records a netflow drop event for an inbound packet
+// denied by the ACLs. msg is the trace format taking rule id, protocol, source
+// and destination.
+func (m *Manager) storeDropFlow(msg string, d *decoder, srcIP, dstIP netip.Addr, ruleID []byte, size int) {
+	pnum := getProtocolFromPacket(d)
+	srcPort, dstPort := getPortsFromPacket(d)
+
+	if m.logger.Enabled(nblog.LevelTrace) {
+		m.logger.Trace6(msg, ruleID, pnum, srcIP, srcPort, dstIP, dstPort)
+	}
+
+	m.flowLogger.StoreEvent(nftypes.EventFields{
+		FlowID:     uuid.New(),
+		Type:       nftypes.TypeDrop,
+		RuleID:     ruleID,
+		Direction:  nftypes.Ingress,
+		Protocol:   pnum,
+		SourceIP:   srcIP,
+		DestIP:     dstIP,
+		SourcePort: srcPort,
+		DestPort:   dstPort,
+		// TODO: icmp type/code
+		RxPackets: 1,
+		RxBytes:   uint64(size),
+	})
+}
+
 // handleLocalTraffic handles local traffic.
 // If it returns true, the packet should be dropped.
 func (m *Manager) handleLocalTraffic(d *decoder, srcIP, dstIP netip.Addr, packetData []byte, size int) bool {
 	ruleID, blocked := m.peerACLsBlock(srcIP, d, packetData)
 	if blocked {
-		pnum := getProtocolFromPacket(d)
-		srcPort, dstPort := getPortsFromPacket(d)
-
-		if m.logger.Enabled(nblog.LevelTrace) {
-			m.logger.Trace6("Dropping local packet (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
-				ruleID, pnum, srcIP, srcPort, dstIP, dstPort)
-		}
-
-		m.flowLogger.StoreEvent(nftypes.EventFields{
-			FlowID:     uuid.New(),
-			Type:       nftypes.TypeDrop,
-			RuleID:     ruleID,
-			Direction:  nftypes.Ingress,
-			Protocol:   pnum,
-			SourceIP:   srcIP,
-			DestIP:     dstIP,
-			SourcePort: srcPort,
-			DestPort:   dstPort,
-			// TODO: icmp type/code
-			RxPackets: 1,
-			RxBytes:   uint64(size),
-		})
+		m.storeDropFlow("Dropping local packet (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
+			d, srcIP, dstIP, ruleID, size)
 		return true
 	}

@@ -1168,27 +1405,8 @@ func (m *Manager) handleRoutedTraffic(d *decoder, srcIP, dstIP netip.Addr, packe

 	ruleID, pass := m.routeACLsPass(srcIP, dstIP, protoLayer, srcPort, dstPort)
 	if !pass {
-		proto := getProtocolFromPacket(d)
-
-		if m.logger.Enabled(nblog.LevelTrace) {
-			m.logger.Trace6("Dropping routed packet (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
-				ruleID, proto, srcIP, srcPort, dstIP, dstPort)
-		}
-
-		m.flowLogger.StoreEvent(nftypes.EventFields{
-			FlowID:     uuid.New(),
-			Type:       nftypes.TypeDrop,
-			RuleID:     ruleID,
-			Direction:  nftypes.Ingress,
-			Protocol:   proto,
-			SourceIP:   srcIP,
-			DestIP:     dstIP,
-			SourcePort: srcPort,
-			DestPort:   dstPort,
-			// TODO: icmp type/code
-			RxPackets: 1,
-			RxBytes:   uint64(size),
-		})
+		m.storeDropFlow("Dropping routed packet (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
+			d, srcIP, dstIP, ruleID, size)
 		return true
 	}

--- a/client/firewall/uspfilter/forwarder/forwarder.go
+++ b/client/firewall/uspfilter/forwarder/forwarder.go
@@ -5,7 +5,9 @@ import (
 	"fmt"
 	"net"
 	"net/netip"
+	"os"
 	"runtime"
+	"strconv"
 	"sync"
 	"time"

@@ -31,6 +33,11 @@ const (
 	defaultMaxInFlight   = 1024
 	iosReceiveWindow     = 16384
 	iosMaxInFlight       = 256
+
+	// envForceTCPRACK overrides the platform default for gVisor's RACK loss
+	// detection. Set to a truthy value to force RACK on, or a falsy value to
+	// force it off, on any platform.
+	envForceTCPRACK = "NB_FORCE_TCP_RACK"
 )

 type Forwarder struct {
@@ -152,6 +159,8 @@ func New(iface common.IFaceMapper, logger *nblog.Logger, flowLogger nftypes.Flow
 		maxInFlight = iosMaxInFlight
 	}

+	configureTCPRecovery(s)
+
 	tcpForwarder := tcp.NewForwarder(s, receiveWindow, maxInFlight, f.handleTCP)
 	s.SetTransportProtocolHandler(tcp.ProtocolNumber, tcpForwarder.HandlePacket)

@@ -466,3 +475,31 @@ func probeRawICMP(network, addr string, logger *nblog.Logger) bool {
 	logger.Debug1("forwarder: raw %s socket access available", network)
 	return true
 }
+
+// configureTCPRecovery disables gVisor's RACK loss detection on Windows, where
+// it interacts poorly with the host and collapses throughput on routed TCP
+// connections (gVisor issue #9778). Other platforms keep the default. The
+// EnvForceTCPRACK environment variable overrides the platform default.
+func configureTCPRecovery(s *stack.Stack) {
+	disableRACK := runtime.GOOS == "windows"
+
+	if val := os.Getenv(envForceTCPRACK); val != "" {
+		force, err := strconv.ParseBool(val)
+		if err != nil {
+			log.Warnf("parse %s: %v", envForceTCPRACK, err)
+		} else {
+			disableRACK = !force
+		}
+	}
+
+	if !disableRACK {
+		return
+	}
+
+	opt := tcpip.TCPRecovery(0)
+	if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &opt); err != nil {
+		log.Warnf("disable TCP RACK loss detection: %v", err)
+		return
+	}
+	log.Info("forwarder: TCP RACK loss detection disabled")
+}
--- a/client/firewall/uspfilter/fragment.go
+++ b/client/firewall/uspfilter/fragment.go
@@ -0,0 +1,204 @@
+package uspfilter
+
+import (
+	"context"
+	"net/netip"
+	"os"
+	"strconv"
+	"sync"
+	"time"
+
+	nblog "github.com/netbirdio/netbird/client/firewall/uspfilter/log"
+)
+
+const (
+	// defaultFragmentTimeout bounds how long a first-fragment verdict is kept
+	// while the remaining fragments arrive. It mirrors the Linux IP reassembly
+	// timeout (net.ipv4.ipfrag_time).
+	defaultFragmentTimeout = 30 * time.Second
+	// fragmentCleanupInterval is how often expired verdicts are purged.
+	fragmentCleanupInterval = 10 * time.Second
+	// defaultMaxFragmentEntries caps the number of concurrently tracked
+	// fragmented datagrams. The table stays bounded because each datagram is a
+	// single small entry regardless of how many fragments it is split into, and
+	// the 13-bit IPv4 fragment-offset field limits any datagram to 64 KiB.
+	defaultMaxFragmentEntries = 16384
+
+	// EnvFragmentMaxEntries overrides defaultMaxFragmentEntries.
+	EnvFragmentMaxEntries = "NB_FRAGMENT_MAX_ENTRIES"
+)
+
+// fragmentVerdict is the decision for a trailing (headerless) fragment.
+type fragmentVerdict int
+
+const (
+	// fragmentDeny drops the fragment: no allowed first fragment is on record.
+	fragmentDeny fragmentVerdict = iota
+	// fragmentAllow passes the fragment: it belongs to an allowed datagram and
+	// does not overlap the already-inspected transport header.
+	fragmentAllow
+	// fragmentOverlap drops the fragment and poisons its datagram: it overlaps
+	// the transport header the ACL inspected (RFC 1858 §4, RFC 3128; RFC 5722
+	// requires discarding the whole datagram on overlap for IPv6).
+	fragmentOverlap
+)
+
+// fragmentKey identifies a fragmented datagram. It matches the RFC 791 / RFC
+// 8200 reassembly key: source, destination, protocol and identification. The id
+// is 32-bit to hold both the IPv4 (16-bit) and IPv6 (32-bit) identification.
+type fragmentKey struct {
+	srcIP netip.Addr
+	dstIP netip.Addr
+	id    uint32
+	proto uint8
+}
+
+// fragmentEntry records the verdict of an allowed first fragment.
+type fragmentEntry struct {
+	// headerEndOctets is the offset, in 8-byte units, at which the first
+	// fragment's payload ended. A trailing fragment starting before this
+	// overlaps bytes the ACL already inspected and is rejected.
+	headerEndOctets uint16
+	// recordedAt is when the first fragment was accepted. The verdict expires a
+	// fixed timeout later and is not refreshed, mirroring the kernel reassembly
+	// timer so a trailing-fragment flood can't keep a datagram alive.
+	recordedAt time.Time
+}
+
+// fragmentTracker records the ACL verdict of a datagram's first fragment so the
+// remaining fragments, which carry no L4 header, can inherit the decision
+// without reassembling the datagram. Only allowed first fragments are stored;
+// anything that cannot be tied to an allowed, non-overlapping first fragment is
+// dropped (fail closed).
+type fragmentTracker struct {
+	logger  *nblog.Logger
+	mutex   sync.Mutex
+	entries map[fragmentKey]fragmentEntry
+	timeout time.Duration
+	// maxEntries caps the table; atCapacity dedups the capacity warning until
+	// the table drains below the cap again.
+	maxEntries    int
+	atCapacity    bool
+	cleanupTicker *time.Ticker
+	cancel        context.CancelFunc
+}
+
+func newFragmentTracker(logger *nblog.Logger) *fragmentTracker {
+	ctx, cancel := context.WithCancel(context.Background())
+	t := &fragmentTracker{
+		logger:        logger,
+		entries:       make(map[fragmentKey]fragmentEntry),
+		timeout:       defaultFragmentTimeout,
+		maxEntries:    fragmentMaxEntries(logger),
+		cleanupTicker: time.NewTicker(fragmentCleanupInterval),
+		cancel:        cancel,
+	}
+	go t.cleanupRoutine(ctx)
+	return t
+}
+
+func fragmentMaxEntries(logger *nblog.Logger) int {
+	v := os.Getenv(EnvFragmentMaxEntries)
+	if v == "" {
+		return defaultMaxFragmentEntries
+	}
+	n, err := strconv.Atoi(v)
+	if err != nil || n <= 0 {
+		logger.Warn2("invalid %s=%q, using default", EnvFragmentMaxEntries, v)
+		return defaultMaxFragmentEntries
+	}
+	return n
+}
+
+// recordAllowed stores the verdict of an allowed first fragment. headerEndOctets
+// is the first fragment's payload length in 8-byte units. When the table is full
+// the record is dropped, which fails closed: the datagram's trailing fragments
+// will be denied.
+func (t *fragmentTracker) recordAllowed(key fragmentKey, headerEndOctets uint16) {
+	t.mutex.Lock()
+	defer t.mutex.Unlock()
+
+	if t.entries == nil {
+		return
+	}
+	if _, ok := t.entries[key]; !ok && len(t.entries) >= t.maxEntries {
+		if !t.atCapacity {
+			t.atCapacity = true
+			t.logger.Warn2("fragment verdict table at capacity (%d/%d): trailing fragments of new datagrams will be dropped",
+				len(t.entries), t.maxEntries)
+		}
+		return
+	}
+	t.entries[key] = fragmentEntry{
+		headerEndOctets: headerEndOctets,
+		recordedAt:      time.Now(),
+	}
+}
+
+// poison drops any recorded verdict for a datagram, so its later fragments are
+// denied until a new allowed first fragment is recorded. Called on every
+// offset-zero fragment to defeat offset-zero overlap rewrites (RFC 3128).
+func (t *fragmentTracker) poison(key fragmentKey) {
+	t.mutex.Lock()
+	defer t.mutex.Unlock()
+	delete(t.entries, key)
+}
+
+// verdict decides the fate of a trailing fragment at fragOffsetOctets (the IPv4
+// fragment offset, in 8-byte units). A fragment overlapping the inspected
+// header poisons the datagram: the entry is removed so all further fragments of
+// that datagram are denied too.
+func (t *fragmentTracker) verdict(key fragmentKey, fragOffsetOctets uint16) fragmentVerdict {
+	t.mutex.Lock()
+	defer t.mutex.Unlock()
+
+	entry, ok := t.entries[key]
+	if !ok {
+		return fragmentDeny
+	}
+	if time.Since(entry.recordedAt) > t.timeout {
+		delete(t.entries, key)
+		return fragmentDeny
+	}
+	if fragOffsetOctets < entry.headerEndOctets {
+		delete(t.entries, key)
+		return fragmentOverlap
+	}
+	return fragmentAllow
+}
+
+func (t *fragmentTracker) cleanupRoutine(ctx context.Context) {
+	defer t.cleanupTicker.Stop()
+	for {
+		select {
+		case <-t.cleanupTicker.C:
+			t.cleanup()
+		case <-ctx.Done():
+			return
+		}
+	}
+}
+
+func (t *fragmentTracker) cleanup() {
+	t.mutex.Lock()
+	defer t.mutex.Unlock()
+
+	for key, entry := range t.entries {
+		if time.Since(entry.recordedAt) > t.timeout {
+			delete(t.entries, key)
+		}
+	}
+
+	if len(t.entries) < t.maxEntries {
+		t.atCapacity = false
+	}
+}
+
+// Close stops the cleanup routine and releases resources.
+func (t *fragmentTracker) Close() {
+	t.cancel()
+
+	t.mutex.Lock()
+	t.entries = nil
+	t.mutex.Unlock()
+}
--- a/client/firewall/uspfilter/fragment_bench_test.go
+++ b/client/firewall/uspfilter/fragment_bench_test.go
@@ -0,0 +1,115 @@
+package uspfilter
+
+import (
+	"encoding/binary"
+	"testing"
+)
+
+// benchFilterInbound drives filterInbound over a fixed packet in a tight loop.
+// Packets are built once, outside the timed region, so the benchmark measures
+// only pipeline cost, which is what an attacker can amplify.
+func benchFilterInbound(b *testing.B, pkt []byte) {
+	b.Helper()
+	b.ReportAllocs()
+	b.SetBytes(int64(len(pkt)))
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		m := benchManager
+		m.filterInbound(pkt, len(pkt))
+	}
+}
+
+// benchManager is a package-level manager reused across fragment benchmarks so
+// setup cost stays out of the timed region.
+var benchManager *Manager
+
+func setupBenchManager(b *testing.B) *Manager {
+	b.Helper()
+	m := newFragmentTestManager(b)
+	allowUDP(b, m, 8080)
+	// Disable conntrack so the allowed-first-fragment path measures transport
+	// decode + ACL every iteration instead of matching the connection tracked
+	// on the first iteration.
+	m.stateful = false
+	benchManager = m
+	return m
+}
+
+// BenchmarkInbound_NormalPacket is the baseline: a full, non-fragmented UDP
+// packet that passes the ACL. Fragment paths should stay comparable to this.
+func BenchmarkInbound_NormalPacket(b *testing.B) {
+	setupBenchManager(b)
+	pkt := normalUDPPacket(b, 8080, 32)
+	benchFilterInbound(b, pkt)
+}
+
+// BenchmarkInbound_FirstFragmentAllowed measures the first-fragment path:
+// transport decode + ACL evaluation + verdict record.
+func BenchmarkInbound_FirstFragmentAllowed(b *testing.B) {
+	setupBenchManager(b)
+	pkt := firstFragmentUDP(b, 0x2000, 8080, 32)
+	benchFilterInbound(b, pkt)
+}
+
+// BenchmarkInbound_TrailingFragmentAllowed measures the common trailing-fragment
+// path: a single map lookup after the first fragment is on record.
+func BenchmarkInbound_TrailingFragmentAllowed(b *testing.B) {
+	m := setupBenchManager(b)
+	first := firstFragmentUDP(b, 0x3000, 8080, 32)
+	m.filterInbound(first, len(first))
+	pkt := trailingFragment(b, 0x3000, 5, false, 24)
+	benchFilterInbound(b, pkt)
+}
+
+// BenchmarkInbound_TrailingFragmentNoFirst is the primary DoS vector: an
+// attacker floods trailing fragments with no first fragment on record. Each is
+// a map miss and must be cheap.
+func BenchmarkInbound_TrailingFragmentNoFirst(b *testing.B) {
+	setupBenchManager(b)
+	pkt := trailingFragment(b, 0x4000, 185, false, 40)
+	benchFilterInbound(b, pkt)
+}
+
+// BenchmarkInbound_TinyFirstFragment measures the tiny-fragment drop path: a
+// first fragment too small to decode a transport header.
+func BenchmarkInbound_TinyFirstFragment(b *testing.B) {
+	setupBenchManager(b)
+	pkt := trailingFragment(b, 0x5000, 0, true, 4)
+	benchFilterInbound(b, pkt)
+}
+
+// BenchmarkInbound_TrailingFragmentDistinctIDs is the worst case for the
+// verdict table: an attacker varies the datagram id on every packet so no first
+// fragment ever matches. Verdict lookups always miss and nothing is recorded,
+// so the table cannot grow. Each iteration rewrites the id field in place.
+func BenchmarkInbound_TrailingFragmentDistinctIDs(b *testing.B) {
+	setupBenchManager(b)
+	pkt := trailingFragment(b, 0x6000, 185, false, 40)
+	m := benchManager
+
+	b.ReportAllocs()
+	b.SetBytes(int64(len(pkt)))
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		// IPv4 identification field is at bytes 4:6.
+		binary.BigEndian.PutUint16(pkt[4:6], uint16(i))
+		m.filterInbound(pkt, len(pkt))
+	}
+}
+
+// BenchmarkInbound_FirstFragmentDistinctIDs measures sustained first-fragment
+// pressure with distinct ids: transport decode + ACL + verdict insert until the
+// table caps, exercising the map growth and capacity guard.
+func BenchmarkInbound_FirstFragmentDistinctIDs(b *testing.B) {
+	setupBenchManager(b)
+	pkt := firstFragmentUDP(b, 0x7000, 8080, 32)
+	m := benchManager
+
+	b.ReportAllocs()
+	b.SetBytes(int64(len(pkt)))
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		binary.BigEndian.PutUint16(pkt[4:6], uint16(i))
+		m.filterInbound(pkt, len(pkt))
+	}
+}
--- a/client/firewall/uspfilter/fragment_test.go
+++ b/client/firewall/uspfilter/fragment_test.go
@@ -0,0 +1,554 @@
+package uspfilter
+
+import (
+	"encoding/binary"
+	"net"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/google/gopacket"
+	"github.com/google/gopacket/layers"
+	"github.com/stretchr/testify/require"
+
+	fw "github.com/netbirdio/netbird/client/firewall/manager"
+	nbiface "github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/client/iface/device"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
+)
+
+const (
+	fragTestSrc   = "100.10.0.1"
+	fragTestDst   = "100.10.0.100"
+	fragTestSrcV6 = "fd00::1"
+	fragTestDstV6 = "fd00::100"
+)
+
+func newFragmentTestManager(tb testing.TB) *Manager {
+	tb.Helper()
+
+	ifaceMock := &IFaceMock{
+		SetFilterFunc: func(device.PacketFilter) error { return nil },
+		AddressFunc: func() wgaddr.Address {
+			return wgaddr.Address{
+				IP:      netip.MustParseAddr(fragTestDst),
+				Network: netip.MustParsePrefix("100.10.0.0/16"),
+				IPv6:    netip.MustParseAddr(fragTestDstV6),
+				IPv6Net: netip.MustParsePrefix("fd00::/64"),
+			}
+		},
+	}
+
+	m, err := Create(ifaceMock, false, flowLogger, nbiface.DefaultMTU)
+	require.NoError(tb, err)
+	require.NoError(tb, m.UpdateLocalIPs())
+	tb.Cleanup(func() { require.NoError(tb, m.Close(nil)) })
+	return m
+}
+
+// firstFragmentUDPTo builds the first fragment of a fragmented UDP datagram to
+// the given destination: it carries the full UDP header plus payloadLen bytes
+// of data, with the More Fragments flag set and offset zero.
+func firstFragmentUDPTo(tb testing.TB, dst string, id uint16, dstPort uint16, payloadLen int) []byte {
+	tb.Helper()
+
+	ip := &layers.IPv4{
+		Version:  4,
+		TTL:      64,
+		Id:       id,
+		Protocol: layers.IPProtocolUDP,
+		SrcIP:    net.ParseIP(fragTestSrc),
+		DstIP:    net.ParseIP(dst),
+		Flags:    layers.IPv4MoreFragments,
+	}
+	udp := &layers.UDP{SrcPort: 40000, DstPort: layers.UDPPort(dstPort)}
+	require.NoError(tb, udp.SetNetworkLayerForChecksum(ip))
+
+	buf := gopacket.NewSerializeBuffer()
+	opts := gopacket.SerializeOptions{ComputeChecksums: true, FixLengths: true}
+	require.NoError(tb, gopacket.SerializeLayers(buf, opts, ip, udp, gopacket.Payload(make([]byte, payloadLen))))
+	return buf.Bytes()
+}
+
+func firstFragmentUDP(tb testing.TB, id uint16, dstPort uint16, payloadLen int) []byte {
+	tb.Helper()
+	return firstFragmentUDPTo(tb, fragTestDst, id, dstPort, payloadLen)
+}
+
+// firstFragmentTCP builds the first fragment of a fragmented TCP datagram: the
+// full 20-byte TCP header plus 12 bytes of data, with the More Fragments flag
+// set and offset zero.
+func firstFragmentTCP(tb testing.TB, id uint16, dstPort uint16) []byte {
+	tb.Helper()
+
+	ip := &layers.IPv4{
+		Version:  4,
+		TTL:      64,
+		Id:       id,
+		Protocol: layers.IPProtocolTCP,
+		SrcIP:    net.ParseIP(fragTestSrc),
+		DstIP:    net.ParseIP(fragTestDst),
+		Flags:    layers.IPv4MoreFragments,
+	}
+	tcp := &layers.TCP{SrcPort: 40000, DstPort: layers.TCPPort(dstPort), SYN: true, Window: 64240}
+	require.NoError(tb, tcp.SetNetworkLayerForChecksum(ip))
+
+	buf := gopacket.NewSerializeBuffer()
+	opts := gopacket.SerializeOptions{ComputeChecksums: true, FixLengths: true}
+	require.NoError(tb, gopacket.SerializeLayers(buf, opts, ip, tcp, gopacket.Payload(make([]byte, 12))))
+	return buf.Bytes()
+}
+
+// trailingFragmentTo builds a non-first fragment to the given destination: an
+// IPv4 header at the given fragment offset (in 8-byte units) carrying raw
+// payload and no L4 header.
+func trailingFragmentTo(tb testing.TB, dst string, proto layers.IPProtocol, id uint16, fragOffsetOctets uint16, moreFragments bool, payloadLen int) []byte {
+	tb.Helper()
+
+	ip := &layers.IPv4{
+		Version:    4,
+		TTL:        64,
+		Id:         id,
+		Protocol:   proto,
+		SrcIP:      net.ParseIP(fragTestSrc),
+		DstIP:      net.ParseIP(dst),
+		FragOffset: fragOffsetOctets,
+	}
+	if moreFragments {
+		ip.Flags = layers.IPv4MoreFragments
+	}
+
+	buf := gopacket.NewSerializeBuffer()
+	opts := gopacket.SerializeOptions{FixLengths: true}
+	require.NoError(tb, gopacket.SerializeLayers(buf, opts, ip, gopacket.Payload(make([]byte, payloadLen))))
+	return buf.Bytes()
+}
+
+func trailingFragment(tb testing.TB, id uint16, fragOffsetOctets uint16, moreFragments bool, payloadLen int) []byte {
+	tb.Helper()
+	return trailingFragmentTo(tb, fragTestDst, layers.IPProtocolUDP, id, fragOffsetOctets, moreFragments, payloadLen)
+}
+
+// outboundUDPPacket builds a complete outbound UDP packet from the local
+// address, used to establish conntrack state for reply-direction tests.
+func outboundUDPPacket(tb testing.TB, srcPort, dstPort uint16) []byte {
+	tb.Helper()
+
+	ip := &layers.IPv4{
+		Version:  4,
+		TTL:      64,
+		Id:       1,
+		Protocol: layers.IPProtocolUDP,
+		SrcIP:    net.ParseIP(fragTestDst),
+		DstIP:    net.ParseIP(fragTestSrc),
+	}
+	udp := &layers.UDP{SrcPort: layers.UDPPort(srcPort), DstPort: layers.UDPPort(dstPort)}
+	require.NoError(tb, udp.SetNetworkLayerForChecksum(ip))
+
+	buf := gopacket.NewSerializeBuffer()
+	opts := gopacket.SerializeOptions{ComputeChecksums: true, FixLengths: true}
+	require.NoError(tb, gopacket.SerializeLayers(buf, opts, ip, udp, gopacket.Payload(make([]byte, 16))))
+	return buf.Bytes()
+}
+
+// normalUDPPacket builds a complete, non-fragmented UDP packet for baseline
+// comparisons against the fragment paths.
+func normalUDPPacket(tb testing.TB, dstPort uint16, payloadLen int) []byte {
+	tb.Helper()
+
+	ip := &layers.IPv4{
+		Version:  4,
+		TTL:      64,
+		Id:       1,
+		Protocol: layers.IPProtocolUDP,
+		SrcIP:    net.ParseIP(fragTestSrc),
+		DstIP:    net.ParseIP(fragTestDst),
+	}
+	udp := &layers.UDP{SrcPort: 40000, DstPort: layers.UDPPort(dstPort)}
+	require.NoError(tb, udp.SetNetworkLayerForChecksum(ip))
+
+	buf := gopacket.NewSerializeBuffer()
+	opts := gopacket.SerializeOptions{ComputeChecksums: true, FixLengths: true}
+	require.NoError(tb, gopacket.SerializeLayers(buf, opts, ip, udp, gopacket.Payload(make([]byte, payloadLen))))
+	return buf.Bytes()
+}
+
+func allowUDP(tb testing.TB, m *Manager, dstPort uint16) {
+	tb.Helper()
+	_, err := m.AddPeerFiltering(nil, net.ParseIP(fragTestSrc), fw.ProtocolUDP, nil,
+		&fw.Port{Values: []uint16{dstPort}}, fw.ActionAccept, "")
+	require.NoError(tb, err)
+}
+
+// TestFragment_TrailingWithoutFirstDropped is the core bypass repro: a trailing
+// fragment with no allowed first fragment on record must be dropped. Before the
+// fix, filterInbound returned false (allow) for any fragment.
+func TestFragment_TrailingWithoutFirstDropped(t *testing.T) {
+	m := newFragmentTestManager(t)
+
+	frag := trailingFragment(t, 0x1234, 185, false, 40)
+	require.True(t, m.filterInbound(frag, len(frag)),
+		"trailing fragment without an allowed first fragment must be dropped")
+}
+
+// TestFragment_AllowedFirstPassesTrailing verifies that once a first fragment
+// passes the ACL, its trailing fragments inherit the allow verdict.
+func TestFragment_AllowedFirstPassesTrailing(t *testing.T) {
+	m := newFragmentTestManager(t)
+	allowUDP(t, m, 8080)
+
+	// First fragment: UDP header (8) + 32 payload = 40 octets -> headerEnd = 5.
+	first := firstFragmentUDP(t, 0x2222, 8080, 32)
+	require.False(t, m.filterInbound(first, len(first)),
+		"allowed first fragment should pass and be recorded")
+
+	trailing := trailingFragment(t, 0x2222, 5, false, 24)
+	require.False(t, m.filterInbound(trailing, len(trailing)),
+		"trailing fragment of an allowed datagram should pass")
+}
+
+// TestFragment_DeniedFirstDropsTrailing verifies that a first fragment blocked
+// by the ACL leaves no verdict, so its trailing fragments are dropped.
+func TestFragment_DeniedFirstDropsTrailing(t *testing.T) {
+	m := newFragmentTestManager(t)
+	// No accept rule: local traffic defaults to deny.
+
+	first := firstFragmentUDP(t, 0x3333, 9999, 32)
+	require.True(t, m.filterInbound(first, len(first)),
+		"first fragment to a blocked port should be dropped by the ACL")
+
+	trailing := trailingFragment(t, 0x3333, 5, false, 24)
+	require.True(t, m.filterInbound(trailing, len(trailing)),
+		"trailing fragment of a denied datagram must be dropped")
+}
+
+// TestFragment_OverlappingHeaderDropped covers the RFC 1858 §4 / RFC 3128
+// overlapping-fragment rewrite: a trailing fragment starting inside the range
+// the ACL already inspected is dropped and poisons the datagram. TCP is used so
+// the overlap lands on real header bytes (the flags at byte 13).
+func TestFragment_OverlappingHeaderDropped(t *testing.T) {
+	m := newFragmentTestManager(t)
+	_, err := m.AddPeerFiltering(nil, net.ParseIP(fragTestSrc), fw.ProtocolTCP, nil,
+		&fw.Port{Values: []uint16{8080}}, fw.ActionAccept, "")
+	require.NoError(t, err)
+
+	// First fragment: TCP header (20) + 12 data = 32 bytes -> headerEnd = 4 octets.
+	first := firstFragmentTCP(t, 0x4444, 8080)
+	require.False(t, m.filterInbound(first, len(first)))
+
+	// Overlapping fragment at offset 1 (byte 8) falls inside the inspected TCP
+	// header, so it could rewrite the flags or port on reassembly.
+	overlap := trailingFragmentTo(t, fragTestDst, layers.IPProtocolTCP, 0x4444, 1, true, 32)
+	require.True(t, m.filterInbound(overlap, len(overlap)),
+		"fragment overlapping the inspected header must be dropped")
+
+	// The datagram is now poisoned: a later, non-overlapping fragment is also
+	// dropped because the verdict was removed.
+	later := trailingFragmentTo(t, fragTestDst, layers.IPProtocolTCP, 0x4444, 4, false, 24)
+	require.True(t, m.filterInbound(later, len(later)),
+		"fragments after an overlap must be dropped (datagram poisoned)")
+}
+
+// TestFragment_OffsetZeroOverlapPoisons covers the RFC 3128 offset-zero rewrite:
+// an allowed first fragment followed by a denied offset-zero fragment for the
+// same datagram must not leave the earlier allow verdict in place.
+func TestFragment_OffsetZeroOverlapPoisons(t *testing.T) {
+	m := newFragmentTestManager(t)
+	allowUDP(t, m, 8080)
+
+	allowed := firstFragmentUDP(t, 0x5A5A, 8080, 32)
+	require.False(t, m.filterInbound(allowed, len(allowed)),
+		"allowed first fragment should pass and be recorded")
+
+	// A second offset-zero fragment to a denied port supersedes the datagram's
+	// verdict; it is dropped and must not leave the allow in place.
+	denied := firstFragmentUDP(t, 0x5A5A, 9999, 32)
+	require.True(t, m.filterInbound(denied, len(denied)),
+		"denied offset-zero fragment must be dropped")
+
+	trailing := trailingFragment(t, 0x5A5A, 5, false, 24)
+	require.True(t, m.filterInbound(trailing, len(trailing)),
+		"trailing fragment must be denied after the datagram was poisoned")
+}
+
+// TestFragment_TinyFirstDropped covers the tiny-fragment attack: a first
+// fragment too small to contain the full transport header can't be
+// ACL-evaluated and must be dropped.
+func TestFragment_TinyFirstDropped(t *testing.T) {
+	m := newFragmentTestManager(t)
+	allowUDP(t, m, 8080)
+
+	// IPv4 header + 4 raw bytes, MF set, offset 0: too small for the 8-byte UDP
+	// header, so it decodes to L3 only.
+	tiny := trailingFragment(t, 0x5555, 0, true, 4)
+	require.True(t, m.filterInbound(tiny, len(tiny)),
+		"tiny first fragment without a full L4 header must be dropped")
+}
+
+// TestFragment_TCPFirstFragment verifies the TCP arm of the transport decode: a
+// first fragment carrying the full 20-byte TCP header is ACL-evaluated and its
+// trailing fragments inherit the verdict.
+func TestFragment_TCPFirstFragment(t *testing.T) {
+	m := newFragmentTestManager(t)
+	_, err := m.AddPeerFiltering(nil, net.ParseIP(fragTestSrc), fw.ProtocolTCP, nil,
+		&fw.Port{Values: []uint16{8080}}, fw.ActionAccept, "")
+	require.NoError(t, err)
+
+	// TCP header (20) + 12 data = 32 bytes -> headerEnd = 4 octets.
+	first := firstFragmentTCP(t, 0x6666, 8080)
+	require.False(t, m.filterInbound(first, len(first)),
+		"allowed TCP first fragment should pass and be recorded")
+
+	trailing := trailingFragmentTo(t, fragTestDst, layers.IPProtocolTCP, 0x6666, 4, false, 24)
+	require.False(t, m.filterInbound(trailing, len(trailing)),
+		"trailing fragment of an allowed TCP datagram should pass")
+}
+
+// TestFragment_TCPTinyFirstDropped verifies the TCP minimum header length: 12
+// bytes would satisfy a UDP header but falls short of the 20-byte TCP header.
+func TestFragment_TCPTinyFirstDropped(t *testing.T) {
+	m := newFragmentTestManager(t)
+	_, err := m.AddPeerFiltering(nil, net.ParseIP(fragTestSrc), fw.ProtocolTCP, nil,
+		&fw.Port{Values: []uint16{8080}}, fw.ActionAccept, "")
+	require.NoError(t, err)
+
+	tiny := trailingFragmentTo(t, fragTestDst, layers.IPProtocolTCP, 0x7777, 0, true, 12)
+	require.True(t, m.filterInbound(tiny, len(tiny)),
+		"first fragment shorter than the TCP header must be dropped")
+}
+
+// TestFragment_ConntrackAllowsFirstFragment verifies the conntrack branch: reply
+// fragments of an outbound-established UDP flow pass without any inbound rule.
+func TestFragment_ConntrackAllowsFirstFragment(t *testing.T) {
+	m := newFragmentTestManager(t)
+
+	out := outboundUDPPacket(t, 12345, 40000)
+	require.False(t, m.filterOutbound(out, len(out)))
+
+	first := firstFragmentUDP(t, 0x8888, 12345, 32)
+	require.False(t, m.filterInbound(first, len(first)),
+		"reply first fragment should pass via conntrack")
+
+	trailing := trailingFragment(t, 0x8888, 5, false, 24)
+	require.False(t, m.filterInbound(trailing, len(trailing)),
+		"trailing fragment of a tracked flow should pass")
+}
+
+// TestFragment_RoutingDisabledDropsFragment verifies routed first fragments are
+// dropped when routing is disabled.
+func TestFragment_RoutingDisabledDropsFragment(t *testing.T) {
+	m := newFragmentTestManager(t)
+	m.routingEnabled.Store(false)
+
+	first := firstFragmentUDPTo(t, "198.51.100.10", 0x9999, 8080, 32)
+	require.True(t, m.filterInbound(first, len(first)),
+		"routed first fragment must be dropped when routing is disabled")
+}
+
+// TestFragment_RouteACL verifies the route-ACL branch: fragments to a non-local
+// destination follow the route rules, allowed datagrams pass their trailing
+// fragments and denied ones don't.
+func TestFragment_RouteACL(t *testing.T) {
+	m := newFragmentTestManager(t)
+	m.routingEnabled.Store(true)
+	m.nativeRouter.Store(false)
+
+	_, err := m.AddRouteFiltering(
+		[]byte("rt-1"),
+		[]netip.Prefix{netip.MustParsePrefix("100.10.0.0/16")},
+		fw.Network{Prefix: netip.MustParsePrefix("198.51.100.0/24")},
+		fw.ProtocolUDP,
+		nil,
+		&fw.Port{Values: []uint16{8080}},
+		fw.ActionAccept,
+	)
+	require.NoError(t, err)
+
+	first := firstFragmentUDPTo(t, "198.51.100.10", 0xAAAA, 8080, 32)
+	require.False(t, m.filterInbound(first, len(first)),
+		"route-ACL-allowed first fragment should pass")
+	trailing := trailingFragmentTo(t, "198.51.100.10", layers.IPProtocolUDP, 0xAAAA, 5, false, 24)
+	require.False(t, m.filterInbound(trailing, len(trailing)),
+		"trailing fragment of an allowed routed datagram should pass")
+
+	denied := firstFragmentUDPTo(t, "198.51.100.10", 0xBBBB, 9999, 32)
+	require.True(t, m.filterInbound(denied, len(denied)),
+		"route-ACL-denied first fragment must be dropped")
+	deniedTrailing := trailingFragmentTo(t, "198.51.100.10", layers.IPProtocolUDP, 0xBBBB, 5, false, 24)
+	require.True(t, m.filterInbound(deniedTrailing, len(deniedTrailing)),
+		"trailing fragment of a denied routed datagram must be dropped")
+}
+
+// TestFragment_ExpiredVerdictDropsTrailing verifies a verdict older than the
+// tracker timeout no longer admits trailing fragments.
+func TestFragment_ExpiredVerdictDropsTrailing(t *testing.T) {
+	m := newFragmentTestManager(t)
+	allowUDP(t, m, 8080)
+
+	first := firstFragmentUDP(t, 0xCCCC, 8080, 32)
+	require.False(t, m.filterInbound(first, len(first)))
+
+	m.fragments.mutex.Lock()
+	for key, entry := range m.fragments.entries {
+		entry.recordedAt = time.Now().Add(-defaultFragmentTimeout - time.Second)
+		m.fragments.entries[key] = entry
+	}
+	m.fragments.mutex.Unlock()
+
+	trailing := trailingFragment(t, 0xCCCC, 5, false, 24)
+	require.True(t, m.filterInbound(trailing, len(trailing)),
+		"trailing fragment after verdict expiry must be dropped")
+}
+
+// TestFragment_CapacityFailsClosed verifies the table cap: at capacity, new
+// datagram verdicts are not recorded (their trailing fragments are dropped)
+// while already-recorded datagrams keep working.
+func TestFragment_CapacityFailsClosed(t *testing.T) {
+	m := newFragmentTestManager(t)
+	allowUDP(t, m, 8080)
+
+	m.fragments.mutex.Lock()
+	m.fragments.maxEntries = 1
+	m.fragments.mutex.Unlock()
+
+	first1 := firstFragmentUDP(t, 0x0101, 8080, 32)
+	require.False(t, m.filterInbound(first1, len(first1)))
+
+	first2 := firstFragmentUDP(t, 0x0202, 8080, 32)
+	require.False(t, m.filterInbound(first2, len(first2)),
+		"first fragment itself still passes at capacity")
+
+	trailing2 := trailingFragment(t, 0x0202, 5, false, 24)
+	require.True(t, m.filterInbound(trailing2, len(trailing2)),
+		"trailing fragment of an unrecorded datagram must be dropped at capacity")
+
+	trailing1 := trailingFragment(t, 0x0101, 5, false, 24)
+	require.False(t, m.filterInbound(trailing1, len(trailing1)),
+		"already-recorded datagram should keep passing at capacity")
+}
+
+// v6FragmentHeader builds the 8-byte IPv6 fragment extension header for the
+// given inner protocol, offset (8-byte units), More Fragments bit and id.
+func v6FragmentHeader(proto layers.IPProtocol, offsetOctets uint16, moreFragments bool, id uint32) []byte {
+	offsetFlags := offsetOctets << 3
+	if moreFragments {
+		offsetFlags |= 1
+	}
+	hdr := make([]byte, 8)
+	hdr[0] = uint8(proto)
+	binary.BigEndian.PutUint16(hdr[2:4], offsetFlags)
+	binary.BigEndian.PutUint32(hdr[4:8], id)
+	return hdr
+}
+
+func v6UDPHeader(dstPort uint16, dataLen int) []byte {
+	hdr := make([]byte, 8)
+	binary.BigEndian.PutUint16(hdr[0:2], 40000)
+	binary.BigEndian.PutUint16(hdr[2:4], dstPort)
+	binary.BigEndian.PutUint16(hdr[4:6], uint16(8+dataLen))
+	return hdr
+}
+
+// firstFragmentUDPv6 builds the first fragment of a fragmented IPv6 UDP
+// datagram: fragment header (offset 0, More Fragments set) + full UDP header +
+// data.
+func firstFragmentUDPv6(tb testing.TB, id uint32, dstPort uint16, dataLen int) []byte {
+	tb.Helper()
+	return fragmentUDPv6(tb, id, dstPort, dataLen, true)
+}
+
+// fragmentUDPv6 builds an offset-zero IPv6 UDP fragment. With moreFragments
+// false it is an atomic fragment (a complete datagram, RFC 6946).
+func fragmentUDPv6(tb testing.TB, id uint32, dstPort uint16, dataLen int, moreFragments bool) []byte {
+	tb.Helper()
+
+	ip := &layers.IPv6{
+		Version:    6,
+		NextHeader: layers.IPProtocolIPv6Fragment,
+		HopLimit:   64,
+		SrcIP:      net.ParseIP(fragTestSrcV6),
+		DstIP:      net.ParseIP(fragTestDstV6),
+	}
+	payload := append(v6FragmentHeader(layers.IPProtocolUDP, 0, moreFragments, id), v6UDPHeader(dstPort, dataLen)...)
+	payload = append(payload, make([]byte, dataLen)...)
+
+	buf := gopacket.NewSerializeBuffer()
+	require.NoError(tb, gopacket.SerializeLayers(buf, gopacket.SerializeOptions{FixLengths: true}, ip, gopacket.Payload(payload)))
+	return buf.Bytes()
+}
+
+// trailingFragmentV6 builds a non-first IPv6 fragment: fragment header at the
+// given offset carrying raw data and no transport header.
+func trailingFragmentV6(tb testing.TB, id uint32, offsetOctets uint16, moreFragments bool, dataLen int) []byte {
+	tb.Helper()
+
+	ip := &layers.IPv6{
+		Version:    6,
+		NextHeader: layers.IPProtocolIPv6Fragment,
+		HopLimit:   64,
+		SrcIP:      net.ParseIP(fragTestSrcV6),
+		DstIP:      net.ParseIP(fragTestDstV6),
+	}
+	payload := append(v6FragmentHeader(layers.IPProtocolUDP, offsetOctets, moreFragments, id), make([]byte, dataLen)...)
+
+	buf := gopacket.NewSerializeBuffer()
+	require.NoError(tb, gopacket.SerializeLayers(buf, gopacket.SerializeOptions{FixLengths: true}, ip, gopacket.Payload(payload)))
+	return buf.Bytes()
+}
+
+// TestFragmentV6_TrailingWithoutFirstDropped verifies the IPv6 bypass is closed:
+// a trailing fragment with no allowed first fragment is dropped.
+func TestFragmentV6_TrailingWithoutFirstDropped(t *testing.T) {
+	m := newFragmentTestManager(t)
+
+	frag := trailingFragmentV6(t, 0xAABBCCDD, 100, false, 40)
+	require.True(t, m.filterInbound(frag, len(frag)),
+		"IPv6 trailing fragment without an allowed first fragment must be dropped")
+}
+
+// TestFragmentV6_AllowedFirstPassesTrailing verifies IPv6 fragments are
+// evaluated like IPv4: an allowed first fragment lets its trailing fragments
+// through.
+func TestFragmentV6_AllowedFirstPassesTrailing(t *testing.T) {
+	m := newFragmentTestManager(t)
+	_, err := m.AddPeerFiltering(nil, net.ParseIP(fragTestSrcV6), fw.ProtocolUDP, nil,
+		&fw.Port{Values: []uint16{8080}}, fw.ActionAccept, "")
+	require.NoError(t, err)
+
+	// First fragment: UDP header (8) + 32 data = 40 octets -> headerEnd = 5.
+	first := firstFragmentUDPv6(t, 0xAABBCCDD, 8080, 32)
+	require.False(t, m.filterInbound(first, len(first)),
+		"allowed IPv6 first fragment should pass and be recorded")
+
+	trailing := trailingFragmentV6(t, 0xAABBCCDD, 5, false, 24)
+	require.False(t, m.filterInbound(trailing, len(trailing)),
+		"trailing fragment of an allowed IPv6 datagram should pass")
+}
+
+// TestFragmentV6_AtomicNotCached verifies an IPv6 atomic fragment (fragment
+// header with offset 0 and no More Fragments, a complete datagram per RFC 6946)
+// is evaluated but not recorded, so a flood of allowed atomic fragments can't
+// exhaust the verdict table.
+func TestFragmentV6_AtomicNotCached(t *testing.T) {
+	m := newFragmentTestManager(t)
+	_, err := m.AddPeerFiltering(nil, net.ParseIP(fragTestSrcV6), fw.ProtocolUDP, nil,
+		&fw.Port{Values: []uint16{8080}}, fw.ActionAccept, "")
+	require.NoError(t, err)
+
+	atomic := fragmentUDPv6(t, 0xA70301C, 8080, 16, false)
+	require.False(t, m.filterInbound(atomic, len(atomic)),
+		"allowed IPv6 atomic fragment should pass")
+
+	m.fragments.mutex.Lock()
+	n := len(m.fragments.entries)
+	m.fragments.mutex.Unlock()
+	require.Zero(t, n, "atomic fragment must not create a verdict entry")
+
+	// A genuine fragmented datagram (More Fragments set) is still recorded.
+	first := fragmentUDPv6(t, 0xBEEF, 8080, 32, true)
+	require.False(t, m.filterInbound(first, len(first)))
+	m.fragments.mutex.Lock()
+	n = len(m.fragments.entries)
+	m.fragments.mutex.Unlock()
+	require.Equal(t, 1, n, "genuine first fragment must record a verdict")
+}
--- a/client/iface/netstack/env.go
+++ b/client/iface/netstack/env.go
@@ -3,14 +3,31 @@
 package netstack

 import (
-	"fmt"
+	"net"
 	"os"
 	"strconv"

 	log "github.com/sirupsen/logrus"
 )

-const EnvUseNetstackMode = "NB_USE_NETSTACK_MODE"
+const (
+	EnvUseNetstackMode = "NB_USE_NETSTACK_MODE"
+
+	// EnvSocks5ListenerPort overrides the port the SOCKS5 proxy listens on.
+	EnvSocks5ListenerPort = "NB_SOCKS5_LISTENER_PORT"
+
+	// EnvSocks5ListenerAddress overrides the host/IP the SOCKS5 proxy binds to.
+	// The proxy is a bridge for local host applications into the userspace
+	// WireGuard netstack, so it binds to loopback by default. Override this only
+	// when the proxy must be reachable from other hosts (e.g. a container
+	// gateway); doing so exposes an unauthenticated SOCKS5 proxy on that
+	// address.
+	EnvSocks5ListenerAddress = "NB_SOCKS5_LISTENER_ADDRESS"
+
+	// defaultSocks5Host is the loopback address the SOCKS5 proxy binds to unless
+	// overridden via EnvSocks5ListenerAddress.
+	defaultSocks5Host = "127.0.0.1"
+)

 // IsEnabled todo: move these function to cmd layer
 func IsEnabled() bool {
@@ -18,24 +35,40 @@ func IsEnabled() bool {
 }

 func ListenAddr() string {
-	sPort := os.Getenv("NB_SOCKS5_LISTENER_PORT")
+	return net.JoinHostPort(listenHost(), strconv.Itoa(listenPort()))
+}
+
+// listenHost returns the host/IP the SOCKS5 proxy binds to. It defaults to
+// loopback and only honors EnvSocks5ListenerAddress when it holds a valid IP.
+func listenHost() string {
+	addr := os.Getenv(EnvSocks5ListenerAddress)
+	if addr == "" {
+		return defaultSocks5Host
+	}
+	if net.ParseIP(addr) == nil {
+		log.Warnf("invalid socks5 listener address %q, falling back to default: %s", addr, defaultSocks5Host)
+		return defaultSocks5Host
+	}
+	return addr
+}
+
+// listenPort returns the port the SOCKS5 proxy binds to, defaulting to
+// DefaultSocks5Port when EnvSocks5ListenerPort is unset or invalid.
+func listenPort() int {
+	sPort := os.Getenv(EnvSocks5ListenerPort)
 	if sPort == "" {
-		return listenAddr(DefaultSocks5Port)
+		return DefaultSocks5Port
 	}

 	port, err := strconv.Atoi(sPort)
 	if err != nil {
 		log.Warnf("invalid socks5 listener port, unable to convert it to int, falling back to default: %d", DefaultSocks5Port)
-		return listenAddr(DefaultSocks5Port)
+		return DefaultSocks5Port
 	}
 	if port < 1 || port > 65535 {
 		log.Warnf("invalid socks5 listener port, it should be in the range 1-65535, falling back to default: %d", DefaultSocks5Port)
-		return listenAddr(DefaultSocks5Port)
+		return DefaultSocks5Port
 	}

-	return listenAddr(port)
-}
-
-func listenAddr(port int) string {
-	return fmt.Sprintf("0.0.0.0:%d", port)
+	return port
 }
--- a/client/iface/netstack/env_test.go
+++ b/client/iface/netstack/env_test.go
@@ -0,0 +1,63 @@
+//go:build !js
+
+package netstack
+
+import (
+	"net"
+	"strconv"
+	"testing"
+)
+
+func TestListenAddr_DefaultsToLoopback(t *testing.T) {
+	// No env overrides: must bind loopback, never all interfaces.
+	got := ListenAddr()
+	want := net.JoinHostPort("127.0.0.1", strconv.Itoa(DefaultSocks5Port))
+	if got != want {
+		t.Fatalf("ListenAddr() = %q, want %q", got, want)
+	}
+}
+
+func TestListenAddr_AddressOverride(t *testing.T) {
+	tests := []struct {
+		name string
+		env  string
+		want string
+	}{
+		{name: "valid override honored", env: "0.0.0.0", want: "0.0.0.0"},
+		{name: "valid specific ip honored", env: "10.0.0.5", want: "10.0.0.5"},
+		{name: "ipv6 loopback bracketed", env: "::1", want: "::1"},
+		{name: "invalid falls back to loopback", env: "not-an-ip", want: "127.0.0.1"},
+		{name: "empty falls back to loopback", env: "", want: "127.0.0.1"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Setenv(EnvSocks5ListenerAddress, tc.env)
+			want := net.JoinHostPort(tc.want, strconv.Itoa(DefaultSocks5Port))
+			if got := ListenAddr(); got != want {
+				t.Fatalf("ListenAddr() = %q, want %q", got, want)
+			}
+		})
+	}
+}
+
+func TestListenAddr_PortOverride(t *testing.T) {
+	tests := []struct {
+		name string
+		env  string
+		want int
+	}{
+		{name: "valid port honored", env: "1081", want: 1081},
+		{name: "non-numeric falls back", env: "abc", want: DefaultSocks5Port},
+		{name: "out of range falls back", env: "70000", want: DefaultSocks5Port},
+		{name: "zero falls back", env: "0", want: DefaultSocks5Port},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Setenv(EnvSocks5ListenerPort, tc.env)
+			want := net.JoinHostPort("127.0.0.1", strconv.Itoa(tc.want))
+			if got := ListenAddr(); got != want {
+				t.Fatalf("ListenAddr() = %q, want %q", got, want)
+			}
+		})
+	}
+}
--- a/client/internal/auth/device_flow.go
+++ b/client/internal/auth/device_flow.go
@@ -259,12 +259,18 @@ func (d *DeviceAuthorizationFlow) WaitToken(ctx context.Context, info AuthFlowIn
 	ticker := time.NewTicker(interval)
 	defer ticker.Stop()

+	log.Infof("device flow: waiting for user authorization, polling token endpoint every %s, code expires in %s", interval, timeout)
+
+	start := time.Now()
+	polls := 0
+
 	for {
 		select {
 		case <-waitCtx.Done():
 			return TokenInfo{}, waitCtx.Err()
 		case <-ticker.C:

+			polls++
 			tokenResponse, err := d.requestToken(info)
 			if err != nil {
 				return TokenInfo{}, fmt.Errorf("parsing token response failed with error: %v", err)
@@ -272,10 +278,12 @@ func (d *DeviceAuthorizationFlow) WaitToken(ctx context.Context, info AuthFlowIn

 			if tokenResponse.Error != "" {
 				if tokenResponse.Error == "authorization_pending" {
+					log.Tracef("device flow: authorization still pending after poll %d", polls)
 					continue
 				} else if tokenResponse.Error == "slow_down" {
 					interval += (3 * time.Second)
 					ticker.Reset(interval)
+					log.Infof("device flow: IdP requested slow_down, polling interval increased to %s", interval)
 					continue
 				}

@@ -291,11 +299,12 @@ func (d *DeviceAuthorizationFlow) WaitToken(ctx context.Context, info AuthFlowIn
 				UseIDToken:   d.providerConfig.UseIDToken,
 			}

-			err = isValidAccessToken(tokenInfo.GetTokenToUse(), d.providerConfig.Audience)
+			err = validateTokenAudience(tokenInfo.GetTokenToUse(), d.providerConfig.Audience)
 			if err != nil {
 				return TokenInfo{}, fmt.Errorf("validate access token failed with error: %v", err)
 			}

+			log.Infof("device flow: user authorization confirmed after %d polls in %s", polls, time.Since(start).Round(time.Second))
 			return tokenInfo, err
 		}
 	}
--- a/client/internal/auth/pkce_flow.go
+++ b/client/internal/auth/pkce_flow.go
@@ -188,6 +188,8 @@ func (p *PKCEAuthorizationFlow) WaitToken(ctx context.Context, info AuthFlowInfo
 	waitCtx, cancel := context.WithTimeout(ctx, timeout)
 	defer cancel()

+	log.Infof("pkce flow: waiting for authorization callback on %s, timeout %s", p.oAuthConfig.RedirectURL, timeout)
+
 	tokenChan := make(chan *oauth2.Token, 1)
 	errChan := make(chan error, 1)

@@ -221,6 +223,7 @@ func (p *PKCEAuthorizationFlow) WaitToken(ctx context.Context, info AuthFlowInfo
 func (p *PKCEAuthorizationFlow) startServer(server *http.Server, tokenChan chan<- *oauth2.Token, errChan chan<- error) {
 	mux := http.NewServeMux()
 	mux.HandleFunc("/", func(w http.ResponseWriter, req *http.Request) {
+		log.Infof("pkce flow: received authorization callback from IdP")
 		cert := p.providerConfig.ClientCertPair
 		if cert != nil {
 			tr := &http.Transport{
@@ -271,11 +274,18 @@ func (p *PKCEAuthorizationFlow) handleRequest(req *http.Request) (*oauth2.Token,
 		return nil, fmt.Errorf("authentication failed: missing code")
 	}

-	return p.oAuthConfig.Exchange(
+	exchangeStart := time.Now()
+	token, err := p.oAuthConfig.Exchange(
 		req.Context(),
 		code,
 		oauth2.SetAuthURLParam("code_verifier", p.codeVerifier),
 	)
+	if err != nil {
+		return nil, err
+	}
+
+	log.Infof("pkce flow: authorization code exchanged for token in %s", time.Since(exchangeStart).Round(time.Millisecond))
+	return token, nil
 }

 func (p *PKCEAuthorizationFlow) parseOAuthToken(token *oauth2.Token) (TokenInfo, error) {
@@ -296,7 +306,7 @@ func (p *PKCEAuthorizationFlow) parseOAuthToken(token *oauth2.Token) (TokenInfo,
 		audience = p.providerConfig.ClientID
 	}

-	if err := isValidAccessToken(tokenInfo.GetTokenToUse(), audience); err != nil {
+	if err := validateTokenAudience(tokenInfo.GetTokenToUse(), audience); err != nil {
 		return TokenInfo{}, fmt.Errorf("authentication failed: invalid access token - %w", err)
 	}

@@ -310,6 +320,11 @@ func (p *PKCEAuthorizationFlow) parseOAuthToken(token *oauth2.Token) (TokenInfo,
 	return tokenInfo, nil
 }

+// parseEmailFromIDToken extracts the email (or name) claim from an ID token
+// without verifying its signature. The value is best-effort and used only as a
+// UX convenience (login hint prefill and display); it never drives an
+// authorization decision. The authoritative identity is established server-side
+// from the signature-verified token.
 func parseEmailFromIDToken(token string) (string, error) {
 	parts := strings.Split(token, ".")
 	if len(parts) < 2 {
--- a/client/internal/auth/sessionwatch/watcher.go
+++ b/client/internal/auth/sessionwatch/watcher.go
@@ -24,11 +24,7 @@ import (
 )

 const (
-	// Skew tolerates a small clock difference between the management
-	// server and this peer before treating a deadline as "in the past".
-	// Slightly above typical NTP drift; tight enough that the UI doesn't
-	// paint a stale expiry as if it were valid.
-	Skew = 30 * time.Second
+	maxPastHorizon = 30 * 24 * time.Hour

 	// maxDeadlineHorizon caps how far in the future an accepted deadline
 	// can sit. A timestamp beyond this is almost certainly a protocol
@@ -57,7 +53,7 @@ var (
 	ErrDeadlineTooFarFuture = errors.New("session deadline too far in the future")

 	// ErrDeadlineInPast is returned by Update when the supplied deadline
-	// is more than Skew in the past.
+	// is more than maxPastHorizon in the past.
 	ErrDeadlineInPast = errors.New("session deadline in the past")
 )

@@ -66,15 +62,14 @@ var (
 // for deadline change/clear, PublishEvent for the two warnings); tests pass
 // a fake recorder so the same surface is observable without an engine.
 //
-// The watcher is the single owner of the deadline propagated to the
-// recorder: every set, clear, sanity-check rejection and Close routes the
-// value through SetSessionExpiresAt, so the SubscribeStatus snapshot the UI
-// reads can never drift from the watcher's timer state. (SetSessionExpiresAt
-// fans out its own state-change notification, so no separate notify is
-// needed.) The recorder is server-scoped and outlives this engine-scoped
-// watcher — without the Close-time clear a teardown (Down, or the Down+Up of
-// a profile switch) would leave the next session showing the previous one's
-// stale "expires in" value.
+// While the watcher runs, it owns the deadline propagated to the recorder:
+// every set, clear and sanity-check rejection routes the value through
+// SetSessionExpiresAt, so the SubscribeStatus snapshot the UI reads can
+// never drift from the watcher's timer state. (SetSessionExpiresAt fans
+// out its own state-change notification, so no separate notify is needed.)
+// The recorder is server-scoped and outlives this engine-scoped watcher;
+// Close deliberately leaves the recorder value in place so transient engine
+// restarts don't blank it — the client run loop clears it on real teardown.
 //
 // PublishEvent's signature mirrors peer.Status.PublishEvent: the watcher
 // composes the metadata internally so the wire format (MetaSession*) is
@@ -135,10 +130,13 @@ func NewWithLeads(lead, final time.Duration, recorder StatusRecorder) *Watcher {
 // was disabled).
 //
 // Same-value updates are no-ops. A different non-zero value cancels any
-// pending timer, resets the "already fired" guard, and arms a new one.
+// pending timer, resets the "already fired" guards, and — when the
+// deadline lies in the future — arms fresh warning timers. A deadline
+// already in the past (within maxPastHorizon) is recorded as-is with no
+// timers: the session has expired and consumers render it that way.
 //
 // Returns one of the sentinel Err* values when the deadline fails the
-// sanity checks (pre-epoch, far future, or in the past beyond Skew).
+// sanity checks (pre-epoch, far future, or past beyond maxPastHorizon).
 // In every error case the watcher first clears its state so it stays
 // consistent with what the caller will push into its other sinks (e.g.
 // applySessionDeadline forces a zero deadline into the status recorder
@@ -163,7 +161,7 @@ func (w *Watcher) Update(deadline time.Time) error {
 	case deadline.After(now.Add(maxDeadlineHorizon)):
 		w.clearLocked()
 		return fmt.Errorf("%w: %v", ErrDeadlineTooFarFuture, deadline)
-	case deadline.Before(now.Add(-Skew)):
+	case deadline.Before(now.Add(-maxPastHorizon)):
 		w.clearLocked()
 		return fmt.Errorf("%w: %v (now=%v)", ErrDeadlineInPast, deadline, now)
 	}
@@ -183,7 +181,9 @@ func (w *Watcher) Update(deadline time.Time) error {
 	w.finalFiredAt = time.Time{}
 	w.dismissedAt = time.Time{}

-	w.armTimerLocked(deadline)
+	if deadline.After(now) {
+		w.armTimerLocked(deadline)
+	}
 	recorder := w.recorder
 	w.mu.Unlock()
 	if recorder != nil {
@@ -227,30 +227,25 @@ func (w *Watcher) Dismiss() {
 	log.Infof("auth session final-warning dismissed for deadline %s", w.current.Format(time.RFC3339))
 }

-// Close stops any pending timer and drops the deadline on the status
-// recorder. Update calls after Close are ignored. Clearing the recorder
-// here is what keeps a teardown (Down, or the Down+Up of a profile switch)
-// from leaving the next session showing this one's stale "expires in"
-// value — the recorder is server-scoped and outlives this engine-scoped
-// watcher, so nothing else drops the anchor on teardown.
+// Close stops any pending timer. Update calls after Close are ignored.
+// The recorder keeps its deadline: the watcher is engine-scoped and closes
+// on every engine restart (network change, sleep/wake, stream errors)
+// while the SSO deadline stays valid across those, so clearing here would
+// blank the UI's "expires in" row on every transient reconnect. The
+// client run loop clears the server-scoped recorder when it exits for
+// real (Down, profile switch, permanent login failure).
 func (w *Watcher) Close() {
 	w.mu.Lock()
+	defer w.mu.Unlock()
 	if w.closed {
-		w.mu.Unlock()
 		return
 	}
 	w.closed = true
 	w.stopTimerLocked()
-	hadDeadline := !w.current.IsZero()
 	w.current = time.Time{}
 	w.firedAt = time.Time{}
 	w.finalFiredAt = time.Time{}
 	w.dismissedAt = time.Time{}
-	recorder := w.recorder
-	w.mu.Unlock()
-	if recorder != nil && hadDeadline {
-		recorder.SetSessionExpiresAt(time.Time{})
-	}
 }

 // clearLocked drops the tracked deadline and notifies the recorder so
--- a/client/internal/auth/sessionwatch/watcher_test.go
+++ b/client/internal/auth/sessionwatch/watcher_test.go
@@ -224,11 +224,13 @@ func TestNewDeadlineCancelsPriorTimer(t *testing.T) {

 func TestRefreshAfterFireArmsNewWarning(t *testing.T) {
 	r := &fakeRecorder{}
-	lead := 30 * time.Millisecond
+	lead := 150 * time.Millisecond
 	w := newWatcher(lead, r)
 	defer w.Close()

-	first := time.Now().Add(50 * time.Millisecond)
+	// Warning fires ~20ms in; the deadline itself stays 150ms away so the
+	// replacement below lands well before it.
+	first := time.Now().Add(170 * time.Millisecond)
 	_ = w.Update(first)

 	// Wait for stateChange + warning of the first cycle.
@@ -306,7 +308,29 @@ func TestUpdateRejectsTooFarFuture(t *testing.T) {
 	}
 }

-func TestUpdateInPastClearsDeadline(t *testing.T) {
+func TestUpdateRecentPastRecordedAsExpired(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	d := time.Now().Add(-1 * time.Hour)
+	if err := w.Update(d); err != nil {
+		t.Fatalf("recent-past Update should succeed, got %v", err)
+	}
+	if !w.Deadline().Equal(d) {
+		t.Fatalf("expected deadline to be recorded, got %v want %v", w.Deadline(), d)
+	}
+	if got := r.deadline(); !got.Equal(d) {
+		t.Fatalf("recorder deadline = %v, want %v", got, d)
+	}
+
+	time.Sleep(80 * time.Millisecond)
+	if n := countWhere(r.snapshot(), func(e event) bool { return e.kind == publish }); n != 0 {
+		t.Fatalf("no warning events may fire for an already-past deadline, got %+v", r.snapshot())
+	}
+}
+
+func TestUpdateAncientPastRejected(t *testing.T) {
 	r := &fakeRecorder{}
 	w := newWatcher(50*time.Millisecond, r)
 	defer w.Close()
@@ -318,12 +342,12 @@ func TestUpdateInPastClearsDeadline(t *testing.T) {
 	// Drain the stateChange from the seed.
 	waitForEvents(t, r, 1)

-	err := w.Update(time.Now().Add(-1 * time.Hour))
+	err := w.Update(time.Now().Add(-31 * 24 * time.Hour))
 	if !errors.Is(err, ErrDeadlineInPast) {
 		t.Fatalf("want ErrDeadlineInPast, got %v", err)
 	}
 	if !w.Deadline().IsZero() {
-		t.Fatalf("in-past update must clear the deadline, got %v", w.Deadline())
+		t.Fatalf("rejected ancient-past update must clear the deadline, got %v", w.Deadline())
 	}
 	events := waitForEvents(t, r, 2)
 	if events[1].kind != stateChange {
@@ -331,39 +355,25 @@ func TestUpdateInPastClearsDeadline(t *testing.T) {
 	}
 }

-func TestUpdateWithinSkewAccepted(t *testing.T) {
-	r := &fakeRecorder{}
-	w := newWatcher(50*time.Millisecond, r)
-	defer w.Close()
-
-	// 5 seconds in the past is within the 30s Skew tolerance — accept it.
-	d := time.Now().Add(-5 * time.Second)
-	if err := w.Update(d); err != nil {
-		t.Fatalf("within-skew Update should succeed, got %v", err)
-	}
-	if !w.Deadline().Equal(d) {
-		t.Fatalf("expected deadline to be applied, got %v want %v", w.Deadline(), d)
-	}
-}
-
 func TestCloseSilencesUpdates(t *testing.T) {
 	r := &fakeRecorder{}
 	w := newWatcher(50*time.Millisecond, r)
 	w.Close()

-	_ = w.Update(time.Now().Add(time.Hour))
-
-	time.Sleep(20 * time.Millisecond)
+	if err := w.Update(time.Now().Add(time.Hour)); err != nil {
+		t.Fatalf("Update after Close: want nil, got %v", err)
+	}
 	if got := r.snapshot(); len(got) != 0 {
 		t.Fatalf("expected no events after Close, got %+v", got)
 	}
 }

-// TestCloseClearsRecorderDeadline pins the profile-switch fix: a watcher
-// holding a live deadline must zero the recorder on Close so the next
-// engine's watcher (and the UI reading the shared server-scoped recorder)
-// doesn't start out showing the previous session's stale "expires in".
-func TestCloseClearsRecorderDeadline(t *testing.T) {
+// TestCloseKeepsRecorderDeadline pins the reconnect-flap fix: the watcher
+// closes on every engine restart (network change, sleep/wake) while the
+// SSO deadline stays valid across those, so Close must leave the
+// server-scoped recorder's value in place. The client run loop clears the
+// recorder when it exits for real.
+func TestCloseKeepsRecorderDeadline(t *testing.T) {
 	r := &fakeRecorder{}
 	w := newWatcher(time.Hour, r)

@@ -377,8 +387,8 @@ func TestCloseClearsRecorderDeadline(t *testing.T) {

 	w.Close()

-	if got := r.deadline(); !got.IsZero() {
-		t.Fatalf("recorder deadline after Close = %v, want zero", got)
+	if got := r.deadline(); !got.Equal(d) {
+		t.Fatalf("recorder deadline after Close = %v, want %v", got, d)
 	}
 }

--- a/client/internal/auth/util.go
+++ b/client/internal/auth/util.go
@@ -20,14 +20,26 @@ func randomBytesInHex(count int) (string, error) {
 	return hex.EncodeToString(buf), nil
 }

-// isValidAccessToken is a simple validation of the access token
-func isValidAccessToken(token string, audience string) error {
+// validateTokenAudience checks that the token is a well-formed JWT whose
+// audience claim matches the expected audience.
+//
+// It does NOT verify the token's cryptographic signature and therefore must not
+// be treated as an authenticity check. The token is obtained by the client
+// directly from the IdP token endpoint over TLS, and its signature is verified
+// server-side by the management server against the IdP's JWKS
+// (see shared/auth/jwt/validator.go). This function is only a client-side
+// sanity check that the returned token targets the expected audience.
+func validateTokenAudience(token string, audience string) error {
 	if token == "" {
 		return fmt.Errorf("token received is empty")
 	}

-	encodedClaims := strings.Split(token, ".")[1]
-	claimsString, err := base64.RawURLEncoding.DecodeString(encodedClaims)
+	parts := strings.Split(token, ".")
+	if len(parts) != 3 {
+		return fmt.Errorf("token is not a well-formed JWT")
+	}
+
+	claimsString, err := base64.RawURLEncoding.DecodeString(parts[1])
 	if err != nil {
 		return err
 	}
--- a/client/internal/auth/util_test.go
+++ b/client/internal/auth/util_test.go
@@ -0,0 +1,108 @@
+package auth
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"testing"
+)
+
+// makeJWT builds an unsigned JWT-shaped string (header.payload.signature) with
+// the given claims payload. The signature part is arbitrary because
+// validateTokenAudience intentionally does not verify it.
+func makeJWT(t *testing.T, claims map[string]interface{}) string {
+	t.Helper()
+	header := base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"RS256","typ":"JWT"}`))
+	payloadBytes, err := json.Marshal(claims)
+	if err != nil {
+		t.Fatalf("marshal claims: %v", err)
+	}
+	payload := base64.RawURLEncoding.EncodeToString(payloadBytes)
+	return header + "." + payload + ".unverified-signature"
+}
+
+func TestValidateTokenAudience(t *testing.T) {
+	tests := []struct {
+		name     string
+		token    string
+		audience string
+		wantErr  bool
+	}{
+		{
+			name:     "empty token",
+			token:    "",
+			audience: "netbird",
+			wantErr:  true,
+		},
+		{
+			name:     "not a JWT - no dots",
+			token:    "notajwt",
+			audience: "netbird",
+			wantErr:  true,
+		},
+		{
+			name:     "not a JWT - two parts only",
+			token:    "header.payload",
+			audience: "netbird",
+			wantErr:  true,
+		},
+		{
+			name:     "matching string audience",
+			token:    makeJWT(t, map[string]interface{}{"aud": "netbird"}),
+			audience: "netbird",
+			wantErr:  false,
+		},
+		{
+			name:     "mismatching string audience",
+			token:    makeJWT(t, map[string]interface{}{"aud": "other"}),
+			audience: "netbird",
+			wantErr:  true,
+		},
+		{
+			name:     "matching audience in array",
+			token:    makeJWT(t, map[string]interface{}{"aud": []interface{}{"other", "netbird"}}),
+			audience: "netbird",
+			wantErr:  false,
+		},
+		{
+			name:     "mismatching audience array",
+			token:    makeJWT(t, map[string]interface{}{"aud": []interface{}{"a", "b"}}),
+			audience: "netbird",
+			wantErr:  true,
+		},
+		{
+			name:     "missing audience claim",
+			token:    makeJWT(t, map[string]interface{}{"sub": "user"}),
+			audience: "netbird",
+			wantErr:  true,
+		},
+		{
+			name:     "invalid base64 payload",
+			token:    "header.!!!not-base64!!!.sig",
+			audience: "netbird",
+			wantErr:  true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			err := validateTokenAudience(tc.token, tc.audience)
+			if tc.wantErr && err == nil {
+				t.Fatalf("expected error, got nil")
+			}
+			if !tc.wantErr && err != nil {
+				t.Fatalf("expected no error, got %v", err)
+			}
+		})
+	}
+}
+
+// TestValidateTokenAudienceNoPanic guards the regression where a non-empty
+// token without the JWT dot structure caused an index-out-of-range panic.
+func TestValidateTokenAudienceNoPanic(t *testing.T) {
+	inputs := []string{"a", ".", "a.", "aaaa", "no-dots-here"}
+	for _, in := range inputs {
+		if err := validateTokenAudience(in, "netbird"); err == nil {
+			t.Fatalf("expected error for malformed token %q, got nil", in)
+		}
+	}
+}
--- a/client/internal/conn_mgr.go
+++ b/client/internal/conn_mgr.go
@@ -109,7 +109,7 @@ func (e *ConnMgr) UpdatedRemoteFeatureFlag(ctx context.Context, enabled bool) er
 			return nil
 		}

-		log.Warnf("lazy connection manager is enabled by management feature flag")
+		log.Infof("lazy connection manager is enabled by the management feature flag")
 		e.initLazyManager(ctx)
 		e.statusRecorder.UpdateLazyConnection(true)
 		return e.addPeersToLazyConnManager()
--- a/client/internal/connect.go
+++ b/client/internal/connect.go
@@ -257,7 +257,10 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		log.Errorf("failed to clean up temporary installer file: %v", err)
 	}

-	defer c.statusRecorder.ClientStop()
+	defer func() {
+		c.statusRecorder.SetSessionExpiresAt(time.Time{})
+		c.statusRecorder.ClientStop()
+	}()
 	operation := func() error {
 		// if context cancelled we not start new backoff cycle
 		if c.ctx.Err() != nil {
--- a/client/internal/debug/debug.go
+++ b/client/internal/debug/debug.go
@@ -480,7 +480,6 @@ func (g *BundleGenerator) addStatus() error {

 		fullStatus := g.statusRecorder.GetFullStatus()
 		protoFullStatus := nbstatus.ToProtoFullStatus(fullStatus)
-		protoFullStatus.Events = g.statusRecorder.GetEventHistory()
 		overview := nbstatus.ConvertToStatusOutputOverview(protoFullStatus, nbstatus.ConvertOptions{
 			Anonymize:     g.anonymize,
 			ProfileName:   profName,
--- a/client/internal/dns/service_listener.go
+++ b/client/internal/dns/service_listener.go
@@ -292,18 +292,16 @@ func (s *serviceViaListener) generateFreePort() (uint16, error) {
 		return customPort, nil
 	}

-	udpAddr := net.UDPAddrFromAddrPort(netip.MustParseAddrPort("0.0.0.0:0"))
-	probeListener, err := net.ListenUDP("udp", udpAddr)
+	probeListener, err := net.ListenUDP("udp4", &net.UDPAddr{})
 	if err != nil {
 		log.Debugf("failed to bind random port for DNS: %s", err)
 		return 0, err
 	}

-	addrPort := netip.MustParseAddrPort(probeListener.LocalAddr().String()) // might panic if address is incorrect
-	err = probeListener.Close()
-	if err != nil {
+	port := uint16(probeListener.LocalAddr().(*net.UDPAddr).Port)
+	if err = probeListener.Close(); err != nil {
 		log.Debugf("failed to free up DNS port: %s", err)
 		return 0, err
 	}
-	return addrPort.Port(), nil
+	return port, nil
 }
--- a/client/internal/engine.go
+++ b/client/internal/engine.go
@@ -551,7 +551,7 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 		} else {
 			log.Infof("running rosenpass in strict mode")
 		}
-		e.rpManager, err = rosenpass.NewManager(e.config.PreSharedKey, e.config.WgIfaceName)
+		e.rpManager, err = rosenpass.NewManager(e.config.PreSharedKey, e.config.WgIfaceName, publicKey)
 		if err != nil {
 			return fmt.Errorf("create rosenpass manager: %w", err)
 		}
@@ -2605,13 +2605,14 @@ func (e *Engine) updateForwardRules(rules []*mgmProto.ForwardingRule) ([]firewal

 func (e *Engine) toExcludedLazyPeers(rules []firewallManager.ForwardRule, peers []*mgmProto.RemotePeerConfig) map[string]bool {
 	excludedPeers := make(map[string]bool)
+
+	// Ingress forward targets: inbound forwarded traffic is initiated remotely and
+	// cannot wake a lazy connection, so the peer routing the target must stay
+	// permanently connected. AllowedIPs are already parsed on the peer conn, so
+	// reuse those typed prefixes instead of re-parsing the network map strings.
 	for _, r := range rules {
-		ip := r.TranslatedAddress
 		for _, p := range peers {
-			for _, allowedIP := range p.GetAllowedIps() {
-				if allowedIP != ip.String() {
-					continue
-				}
+			if e.peerRoutesAddr(p, r.TranslatedAddress) {
 				log.Infof("exclude forwarder peer from lazy connection: %s", p.GetWgPubKey())
 				excludedPeers[p.GetWgPubKey()] = true
 			}
@@ -2621,6 +2622,27 @@ func (e *Engine) toExcludedLazyPeers(rules []firewallManager.ForwardRule, peers
 	return excludedPeers
 }

+// peerRoutesAddr reports whether the peer is a router for addr, matched against
+// the peer's already-parsed AllowedIPs from the store (the same typed value the
+// lazy manager consumes) rather than re-parsing the network map strings.
+func (e *Engine) peerRoutesAddr(p *mgmProto.RemotePeerConfig, addr netip.Addr) bool {
+	prefixes, ok := e.peerStore.AllowedIPs(p.GetWgPubKey())
+	if !ok {
+		return false
+	}
+	return prefixesContain(prefixes, addr)
+}
+
+// prefixesContain reports whether addr falls within any of the prefixes.
+func prefixesContain(prefixes []netip.Prefix, addr netip.Addr) bool {
+	for _, prefix := range prefixes {
+		if prefix.Contains(addr) {
+			return true
+		}
+	}
+	return false
+}
+
 // isChecksEqual checks if two slices of checks are equal.
 func isChecksEqual(checks1, checks2 []*mgmProto.Checks) bool {
 	normalize := func(checks []*mgmProto.Checks) []string {
--- a/client/internal/engine_lazy_exclude_test.go
+++ b/client/internal/engine_lazy_exclude_test.go
@@ -0,0 +1,87 @@
+package internal
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	firewallManager "github.com/netbirdio/netbird/client/firewall/manager"
+	"github.com/netbirdio/netbird/client/internal/peer"
+	"github.com/netbirdio/netbird/client/internal/peerstore"
+	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func TestPrefixesContain(t *testing.T) {
+	tests := []struct {
+		name     string
+		prefixes []string
+		addr     string
+		want     bool
+	}{
+		{name: "own overlay /32 matches", prefixes: []string{"100.110.8.145/32"}, addr: "100.110.8.145", want: true},
+		{name: "addr inside routed subnet", prefixes: []string{"10.121.0.0/16"}, addr: "10.121.208.4", want: true},
+		{name: "addr outside subnet", prefixes: []string{"10.121.0.0/16"}, addr: "10.122.0.1", want: false},
+		{name: "different /32", prefixes: []string{"100.110.8.145/32"}, addr: "100.110.8.146", want: false},
+		{name: "ipv6 /128 matches", prefixes: []string{"fd00::1/128"}, addr: "fd00::1", want: true},
+		{name: "no prefixes", prefixes: nil, addr: "10.121.208.4", want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			prefixes := make([]netip.Prefix, 0, len(tt.prefixes))
+			for _, p := range tt.prefixes {
+				prefixes = append(prefixes, netip.MustParsePrefix(p))
+			}
+			require.Equal(t, tt.want, prefixesContain(prefixes, netip.MustParseAddr(tt.addr)))
+		})
+	}
+}
+
+// TestToExcludedLazyPeers_ForwardTarget guards a regression: the forward-target
+// peer (the peer routing a ForwardRule.TranslatedAddress) must be excluded from
+// lazy connections, matched via the peer's already-parsed AllowedIPs.
+func TestToExcludedLazyPeers_ForwardTarget(t *testing.T) {
+	const targetPeerKey = "cccccccccccccccccccccccccccccccccccccccccc0="
+	const otherPeerKey = "dddddddddddddddddddddddddddddddddddddddddd0="
+
+	store := peerstore.NewConnStore()
+	store.AddPeerConn(targetPeerKey, newTestConn(t, targetPeerKey, "100.110.8.145/32"))
+	store.AddPeerConn(otherPeerKey, newTestConn(t, otherPeerKey, "100.110.9.10/32"))
+
+	e := &Engine{peerStore: store}
+
+	peers := []*mgmProto.RemotePeerConfig{
+		{WgPubKey: targetPeerKey, AllowedIps: []string{"100.110.8.145/32"}},
+		{WgPubKey: otherPeerKey, AllowedIps: []string{"100.110.9.10/32"}},
+	}
+	rules := []firewallManager.ForwardRule{
+		{TranslatedAddress: netip.MustParseAddr("100.110.8.145")},
+	}
+
+	excluded := e.toExcludedLazyPeers(rules, peers)
+
+	require.True(t, excluded[targetPeerKey], "forward-target peer must be excluded from lazy connections")
+	require.False(t, excluded[otherPeerKey], "non-target peer must not be excluded")
+	require.Len(t, excluded, 1)
+}
+
+func TestToExcludedLazyPeers_NoRules(t *testing.T) {
+	e := &Engine{peerStore: peerstore.NewConnStore()}
+
+	peers := []*mgmProto.RemotePeerConfig{
+		{WgPubKey: "peer-a", AllowedIps: []string{"100.110.8.145/32"}},
+	}
+
+	require.Empty(t, e.toExcludedLazyPeers(nil, peers))
+}
+
+func newTestConn(t *testing.T, key, allowedIP string) *peer.Conn {
+	t.Helper()
+	conn, err := peer.NewConn(peer.ConnConfig{
+		Key:      key,
+		WgConfig: peer.WgConfig{AllowedIps: []netip.Prefix{netip.MustParsePrefix(allowedIP)}},
+	}, peer.ServiceDependencies{})
+	require.NoError(t, err)
+	return conn
+}
--- a/client/internal/engine_session_deadline_test.go
+++ b/client/internal/engine_session_deadline_test.go
@@ -75,4 +75,14 @@ func TestApplySessionDeadline_ThreeState(t *testing.T) {
 		require.True(t, e.statusRecorder.GetSessionExpiresAt().IsZero(),
 			"invalid timestamp must clear the deadline")
 	})
+
+	t.Run("recently expired timestamp stays visible as expired", func(t *testing.T) {
+		e := newEngine()
+		expired := time.Now().Add(-5 * time.Minute).UTC().Truncate(time.Second)
+
+		e.ApplySessionDeadline(timestamppb.New(expired))
+
+		require.True(t, e.statusRecorder.GetSessionExpiresAt().Equal(expired),
+			"recently-expired deadline must stay on the recorder so consumers render it as expired")
+	})
 }
--- a/client/internal/ipcauth/authorize.go
+++ b/client/internal/ipcauth/authorize.go
@@ -0,0 +1,84 @@
+package ipcauth
+
+import (
+	"slices"
+	"strconv"
+)
+
+// Ownership is a profile's access policy: the typed owner principals plus the
+// opt-in shared flag.
+type Ownership struct {
+	Owners []string
+	Shared bool
+}
+
+// GroupResolver resolves a Unix caller's effective group IDs and owner group
+// names to GIDs. A nil resolver disables group matching.
+type GroupResolver interface {
+	// CallerGIDs returns the set of group IDs the caller belongs to.
+	CallerGIDs(id Identity) map[uint32]struct{}
+	// GroupNameGID resolves a group name to its GID.
+	GroupNameGID(name string) (uint32, bool)
+}
+
+// Authorize reports whether the identity may control a profile with the given
+// ownership. Privileged callers and shared profiles are always allowed.
+func Authorize(o Ownership, id Identity, r GroupResolver) bool {
+	if id.IsPrivileged() {
+		return true
+	}
+	if o.Shared {
+		return true
+	}
+	for _, raw := range o.Owners {
+		p, ok := ParsePrincipal(raw)
+		if !ok {
+			continue
+		}
+		if principalMatches(p, id, r) {
+			return true
+		}
+	}
+	return false
+}
+
+func principalMatches(p Principal, id Identity, r GroupResolver) bool {
+	switch p.Kind {
+	case KindUID:
+		if id.IsWindows() {
+			return false
+		}
+		uid, err := strconv.ParseUint(p.Value, 10, 32)
+		return err == nil && uint32(uid) == id.UID
+	case KindGID:
+		if id.IsWindows() {
+			return false
+		}
+		gid, err := strconv.ParseUint(p.Value, 10, 32)
+		return err == nil && callerHasGID(uint32(gid), id, r)
+	case KindGroup:
+		if id.IsWindows() || r == nil {
+			return false
+		}
+		gid, ok := r.GroupNameGID(p.Value)
+		return ok && callerHasGID(gid, id, r)
+	case KindSID:
+		if !id.IsWindows() {
+			return false
+		}
+		return id.SID == p.Value || slices.Contains(id.Groups, p.Value)
+	default:
+		return false
+	}
+}
+
+func callerHasGID(gid uint32, id Identity, r GroupResolver) bool {
+	if id.GID == gid {
+		return true
+	}
+	if r == nil {
+		return false
+	}
+	_, ok := r.CallerGIDs(id)[gid]
+	return ok
+}
--- a/client/internal/ipcauth/creds_stub.go
+++ b/client/internal/ipcauth/creds_stub.go
@@ -0,0 +1,22 @@
+//go:build !linux && !darwin && !freebsd && !windows
+
+package ipcauth
+
+import (
+	"fmt"
+	"net"
+	"runtime"
+
+	"google.golang.org/grpc/credentials"
+)
+
+// NewTransportCredentials returns nil on platforms without a peer-identity
+// primitive.
+func NewTransportCredentials() credentials.TransportCredentials {
+	return nil
+}
+
+// ConnIdentity is unsupported on platforms without a peer-identity primitive.
+func ConnIdentity(net.Conn) (Identity, error) {
+	return Identity{}, fmt.Errorf("peer identity not supported on %s", runtime.GOOS)
+}
--- a/client/internal/ipcauth/creds_unix.go
+++ b/client/internal/ipcauth/creds_unix.go
@@ -0,0 +1,51 @@
+//go:build linux || darwin || freebsd
+
+package ipcauth
+
+import (
+	"context"
+	"net"
+
+	"google.golang.org/grpc/credentials"
+)
+
+// NewTransportCredentials returns gRPC transport credentials that extract the
+// caller's kernel-authenticated identity from a Unix-socket connection and
+// expose it via IdentityFromContext. Non-nil on platforms with a
+// peer-credential primitive.
+func NewTransportCredentials() credentials.TransportCredentials {
+	return unixCreds{}
+}
+
+type unixCreds struct{}
+
+func (unixCreds) ClientHandshake(_ context.Context, _ string, conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	return conn, AuthInfo{}, nil
+}
+
+// ConnIdentity extracts the caller's identity from an accepted local IPC
+// connection. On Unix it reads peer credentials from the socket. It is shared
+// by the gRPC transport credentials and the JSON gateway (which forwards it).
+func ConnIdentity(conn net.Conn) (Identity, error) {
+	return PeerIdentity(conn)
+}
+
+// ServerHandshake extracts the peer identity and fails closed if it cannot be read.
+func (unixCreds) ServerHandshake(conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	id, err := ConnIdentity(conn)
+	if err != nil {
+		return nil, nil, err
+	}
+	return conn, AuthInfo{
+		CommonAuthInfo: credentials.CommonAuthInfo{SecurityLevel: credentials.NoSecurity},
+		Identity:       id,
+	}, nil
+}
+
+func (unixCreds) Info() credentials.ProtocolInfo {
+	return credentials.ProtocolInfo{SecurityProtocol: AuthInfo{}.AuthType()}
+}
+
+func (unixCreds) Clone() credentials.TransportCredentials { return unixCreds{} }
+
+func (unixCreds) OverrideServerName(string) error { return nil }
--- a/client/internal/ipcauth/creds_windows.go
+++ b/client/internal/ipcauth/creds_windows.go
@@ -0,0 +1,135 @@
+//go:build windows
+
+package ipcauth
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"runtime"
+
+	"golang.org/x/sys/windows"
+	"google.golang.org/grpc/credentials"
+)
+
+var (
+	modadvapi32                    = windows.NewLazySystemDLL("advapi32.dll")
+	procImpersonateNamedPipeClient = modadvapi32.NewProc("ImpersonateNamedPipeClient")
+)
+
+// DefaultPipeSDDL keeps the daemon control pipe open to any LOCAL caller,
+// like Unix socket with 0666 permissions.
+//
+//	D:P                 protected DACL, no inheritance
+//	(D;;GA;;;NU)        deny GENERIC_ALL to NETWORK (remote/SMB)
+//	(A;;GA;;;SY)        allow GENERIC_ALL to LocalSystem (the daemon itself)
+//	(A;;GA;;;WD)        allow GENERIC_ALL to Everyone (local, per-RPC ACL gates)
+func DefaultPipeSDDL() string {
+	return "D:P(D;;GA;;;NU)(A;;GA;;;SY)(A;;GA;;;WD)"
+}
+
+// NewTransportCredentials returns gRPC transport credentials that derive the
+// caller's identity from the named-pipe client token.
+//
+// This requires the client to dial at SECURITY_IDENTIFICATION (see dialNamedPipe).
+func NewTransportCredentials() credentials.TransportCredentials {
+	return winpipeCreds{}
+}
+
+type winpipeCreds struct{}
+
+func (winpipeCreds) ClientHandshake(_ context.Context, _ string, conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	return conn, AuthInfo{}, nil
+}
+
+// ConnIdentity extracts the caller's identity from an accepted named-pipe
+// connection by impersonating the pipe client and reading its token. It is
+// shared by the gRPC transport credentials and the JSON gateway (which forwards
+// it). Requires the client to have connected at SECURITY_IDENTIFICATION.
+func ConnIdentity(conn net.Conn) (Identity, error) {
+	// go-winio's pipe connection embeds *win32File, which exposes Fd().
+	fdConn, ok := conn.(interface{ Fd() uintptr })
+	if !ok {
+		return Identity{}, fmt.Errorf("connection %T does not expose a pipe handle", conn)
+	}
+	return pipeClientIdentity(windows.Handle(fdConn.Fd()))
+}
+
+// ServerHandshake extracts the connecting client's identity from the pipe. Fails
+// closed if the handle or token cannot be read.
+func (winpipeCreds) ServerHandshake(conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	id, err := ConnIdentity(conn)
+	if err != nil {
+		return nil, nil, err
+	}
+	return conn, AuthInfo{
+		CommonAuthInfo: credentials.CommonAuthInfo{SecurityLevel: credentials.NoSecurity},
+		Identity:       id,
+	}, nil
+}
+
+func (winpipeCreds) Info() credentials.ProtocolInfo {
+	return credentials.ProtocolInfo{SecurityProtocol: AuthInfo{}.AuthType()}
+}
+
+func (winpipeCreds) Clone() credentials.TransportCredentials { return winpipeCreds{} }
+
+func (winpipeCreds) OverrideServerName(string) error { return nil }
+
+// pipeClientIdentity reads the connecting client's user SID, enabled group SIDs,
+// and elevation by impersonating the pipe client on this thread and reading the
+// impersonation token.
+func pipeClientIdentity(handle windows.Handle) (id Identity, err error) {
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+
+	if err = impersonateNamedPipeClient(handle); err != nil {
+		return Identity{}, fmt.Errorf("impersonate named pipe client: %w", err)
+	}
+	defer func() {
+		// Surface revert error if there are no other errors.
+		revErr := windows.RevertToSelf()
+		if err == nil {
+			err = revErr
+		}
+	}()
+
+	// openAsSelf=true: the token is opened using the daemon's process context
+	// (LocalSystem), not the impersonated client's, so the open always succeeds.
+	var token windows.Token
+	if err = windows.OpenThreadToken(windows.CurrentThread(), windows.TOKEN_QUERY, true, &token); err != nil {
+		return Identity{}, fmt.Errorf("open thread token: %w", err)
+	}
+	defer token.Close()
+
+	tu, err := token.GetTokenUser()
+	if err != nil {
+		return Identity{}, fmt.Errorf("get token user: %w", err)
+	}
+
+	tg, err := token.GetTokenGroups()
+	if err != nil {
+		return Identity{}, fmt.Errorf("get token groups: %w", err)
+	}
+	var groups []string
+	for _, g := range tg.AllGroups() {
+		if g.Attributes&windows.SE_GROUP_ENABLED == 0 || g.Attributes&windows.SE_GROUP_USE_FOR_DENY_ONLY != 0 {
+			continue
+		}
+		groups = append(groups, g.Sid.String())
+	}
+
+	return Identity{
+		SID:      tu.User.Sid.String(),
+		Groups:   groups,
+		Elevated: token.IsElevated(),
+	}, nil
+}
+
+func impersonateNamedPipeClient(h windows.Handle) error {
+	r, _, e := procImpersonateNamedPipeClient.Call(uintptr(h))
+	if r == 0 {
+		return e
+	}
+	return nil
+}
--- a/client/internal/ipcauth/forward.go
+++ b/client/internal/ipcauth/forward.go
@@ -0,0 +1,77 @@
+package ipcauth
+
+import (
+	"context"
+	"strconv"
+
+	"google.golang.org/grpc/metadata"
+)
+
+// Metadata keys used by the local JSON gateway to forward the HTTP client's
+// identity to the daemon.
+const (
+	mdFwdUID      = "x-netbird-fwd-uid"      // Unix
+	mdFwdGID      = "x-netbird-fwd-gid"      // Unix
+	mdFwdSID      = "x-netbird-fwd-sid"      // Windows user SID
+	mdFwdGroup    = "x-netbird-fwd-group"    // Windows group SID (repeated)
+	mdFwdElevated = "x-netbird-fwd-elevated" // Windows, "1" if elevated
+)
+
+// ForwardIdentityMetadata encodes an identity for the gateway to forward to the
+// daemon.
+func ForwardIdentityMetadata(id Identity) metadata.MD {
+	if id.IsWindows() {
+		md := metadata.MD{}
+		md.Set(mdFwdSID, id.SID)
+		if len(id.Groups) > 0 {
+			md.Set(mdFwdGroup, id.Groups...)
+		}
+		if id.Elevated {
+			md.Set(mdFwdElevated, "1")
+		}
+		return md
+	}
+	return metadata.Pairs(
+		mdFwdUID, strconv.FormatUint(uint64(id.UID), 10),
+		mdFwdGID, strconv.FormatUint(uint64(id.GID), 10),
+	)
+}
+
+// forwardedIdentity extracts a forwarded identity from incoming gRPC metadata
+func forwardedIdentity(ctx context.Context) (Identity, bool) {
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		return Identity{}, false
+	}
+
+	if sid := mdFirst(md, mdFwdSID); sid != "" {
+		return Identity{
+			SID:      sid,
+			Groups:   md.Get(mdFwdGroup),
+			Elevated: mdFirst(md, mdFwdElevated) == "1",
+		}, true
+	}
+
+	uidStr := mdFirst(md, mdFwdUID)
+	if uidStr == "" {
+		return Identity{}, false
+	}
+	uid, err := strconv.ParseUint(uidStr, 10, 32)
+	if err != nil {
+		return Identity{}, false
+	}
+	id := Identity{UID: uint32(uid)}
+	if g := mdFirst(md, mdFwdGID); g != "" {
+		if v, err := strconv.ParseUint(g, 10, 32); err == nil {
+			id.GID = uint32(v)
+		}
+	}
+	return id, true
+}
+
+func mdFirst(md metadata.MD, key string) string {
+	if v := md.Get(key); len(v) > 0 {
+		return v[0]
+	}
+	return ""
+}
--- a/client/internal/ipcauth/forward_test.go
+++ b/client/internal/ipcauth/forward_test.go
@@ -0,0 +1,41 @@
+package ipcauth
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"google.golang.org/grpc/metadata"
+)
+
+func TestForwardIdentityRoundTrip(t *testing.T) {
+	cases := []struct {
+		name string
+		id   Identity
+	}{
+		{"unix uid/gid", Identity{UID: 1000, GID: 1000}},
+		{"windows sid+groups+elevated", Identity{
+			SID:      "S-1-5-21-1-2-3-1001",
+			Groups:   []string{"S-1-5-32-544", "S-1-1-0"},
+			Elevated: true,
+		}},
+		{"windows sid only", Identity{SID: "S-1-5-21-9"}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := metadata.NewIncomingContext(context.Background(), ForwardIdentityMetadata(tc.id))
+			got, ok := forwardedIdentity(ctx)
+			assert.True(t, ok)
+			assert.Equal(t, tc.id, got)
+		})
+	}
+}
+
+func TestForwardedIdentity_None(t *testing.T) {
+	_, ok := forwardedIdentity(context.Background())
+	assert.False(t, ok, "no metadata, no forwarded identity")
+
+	ctx := metadata.NewIncomingContext(context.Background(), metadata.Pairs("other", "x"))
+	_, ok = forwardedIdentity(ctx)
+	assert.False(t, ok)
+}
--- a/client/internal/ipcauth/identity.go
+++ b/client/internal/ipcauth/identity.go
@@ -0,0 +1,89 @@
+// Package ipcauth provides the kernel-authenticated identity of a local IPC
+// (gRPC) caller and the transport credentials that surface it into the gRPC
+// context, so the daemon can authorize each RPC by caller identity.
+//
+// On Unix the identity is read from the kernel via SO_PEERCRED (Linux) or
+// LOCAL_PEERCRED (Darwin/FreeBSD). On Windows it is derived from the named-pipe
+// client token. Platforms without a peer-identity primitive get no credentials
+// and therefore no enforcement.
+package ipcauth
+
+import (
+	"context"
+	"fmt"
+
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/peer"
+)
+
+// sidLocalSystem is the well-known Windows SID for the LocalSystem account.
+const sidLocalSystem = "S-1-5-18"
+
+// Identity is the kernel-authenticated identity of a local IPC caller. The zero
+// value is not a valid identity.
+type Identity struct {
+	// UID and GID are the caller's Unix user ID and primary group ID.
+	// Zero on Windows, where SID is authoritative instead.
+	UID uint32
+	GID uint32
+
+	// SID is the caller's Windows security identifier (empty on Unix).
+	SID string
+
+	// Groups holds the caller's Windows group SIDs, captured from the client
+	// token at handshake (empty on Unix, where supplementary group membership is
+	// resolved on demand via NSS/getent by the authorizer).
+	Groups []string
+
+	// Elevated reports whether the Windows client token is elevated (run as
+	// administrator). Always false on Unix, where privilege is uid==0.
+	Elevated bool
+}
+
+// IsWindows reports whether this identity is a Windows principal (SID-based)
+// rather than a Unix uid/gid principal.
+func (i Identity) IsWindows() bool {
+	return i.SID != ""
+}
+
+// IsPrivileged reports whether the caller is the platform's administrative
+// principal.
+func (i Identity) IsPrivileged() bool {
+	if i.IsWindows() {
+		return i.Elevated || i.SID == sidLocalSystem
+	}
+	return i.UID == 0
+}
+
+// String renders the identity for audit logs.
+func (i Identity) String() string {
+	if i.IsWindows() {
+		return fmt.Sprintf("sid=%s elevated=%t", i.SID, i.Elevated)
+	}
+	return fmt.Sprintf("uid=%d gid=%d", i.UID, i.GID)
+}
+
+// AuthInfo carries the peer Identity as a gRPC credentials.AuthInfo so the
+// interceptor can retrieve it from the request context via IdentityFromContext.
+type AuthInfo struct {
+	credentials.CommonAuthInfo
+	Identity Identity
+}
+
+// AuthType identifies the authentication scheme.
+func (AuthInfo) AuthType() string { return "netbird-ipc-peercred" }
+
+// IdentityFromContext extracts the caller's kernel-authenticated identity from
+// the gRPC peer context. The second return value is false when no IPC transport
+// credentials were negotiated, callers MUST fail closed in that case.
+func IdentityFromContext(ctx context.Context) (Identity, bool) {
+	p, ok := peer.FromContext(ctx)
+	if !ok {
+		return Identity{}, false
+	}
+	info, ok := p.AuthInfo.(AuthInfo)
+	if !ok {
+		return Identity{}, false
+	}
+	return info.Identity, true
+}
--- a/client/internal/ipcauth/identity_test.go
+++ b/client/internal/ipcauth/identity_test.go
@@ -0,0 +1,50 @@
+package ipcauth
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/peer"
+)
+
+func TestIdentityFromContext_NoPeer(t *testing.T) {
+	_, ok := IdentityFromContext(context.Background())
+	assert.False(t, ok, "bare context must report no identity (fail closed)")
+}
+
+func TestIdentityFromContext_WrongAuthInfo(t *testing.T) {
+	ctx := peer.NewContext(context.Background(), &peer.Peer{})
+	_, ok := IdentityFromContext(ctx)
+	assert.False(t, ok, "peer without our AuthInfo must report no identity")
+}
+
+func TestIdentityFromContext_Present(t *testing.T) {
+	want := Identity{UID: 1000, GID: 1000}
+	ctx := peer.NewContext(context.Background(), &peer.Peer{
+		AuthInfo: AuthInfo{
+			CommonAuthInfo: credentials.CommonAuthInfo{SecurityLevel: credentials.NoSecurity},
+			Identity:       want,
+		},
+	})
+
+	got, ok := IdentityFromContext(ctx)
+	assert.True(t, ok)
+	assert.Equal(t, want, got)
+}
+
+func TestIdentity_IsPrivileged(t *testing.T) {
+	// Unix
+	assert.True(t, Identity{UID: 0}.IsPrivileged(), "root is privileged")
+	assert.False(t, Identity{UID: 1000}.IsPrivileged(), "non-root is not privileged")
+	// Windows
+	assert.True(t, Identity{SID: "S-1-5-21-1-2-3-1001", Elevated: true}.IsPrivileged(), "elevated admin is privileged")
+	assert.True(t, Identity{SID: "S-1-5-18"}.IsPrivileged(), "LocalSystem is privileged")
+	assert.False(t, Identity{SID: "S-1-5-21-1-2-3-1001"}.IsPrivileged(), "non-elevated admin is NOT privileged")
+}
+
+func TestIdentity_IsWindows(t *testing.T) {
+	assert.True(t, Identity{SID: "S-1-5-18"}.IsWindows())
+	assert.False(t, Identity{UID: 0}.IsWindows())
+}
--- a/client/internal/ipcauth/interceptor.go
+++ b/client/internal/ipcauth/interceptor.go
@@ -0,0 +1,122 @@
+package ipcauth
+
+import (
+	"context"
+	"os"
+
+	log "github.com/sirupsen/logrus"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// Interceptor enforces per-RPC authorization on the daemon IPC, keyed to
+// the caller's kernel-authenticated identity. It is safe-by-default:
+// any RPC without a matching bypass is gated by the active profile's ownership,
+// and a caller without a readable identity is denied.
+type Interceptor struct {
+	policy   ProfilePolicy
+	resolver GroupResolver
+	// selfUID is the daemon's own effective UID. -1 on Windows.
+	selfUID int
+}
+
+// NewInterceptor builds an interceptor over the given policy and group resolver.
+func NewInterceptor(policy ProfilePolicy, resolver GroupResolver) *Interceptor {
+	return &Interceptor{policy: policy, resolver: resolver, selfUID: os.Geteuid()}
+}
+
+// UnaryServerInterceptor authorizes each unary RPC before the handler runs.
+func (i *Interceptor) UnaryServerInterceptor() grpc.UnaryServerInterceptor {
+	return func(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
+		if err := i.authorize(ctx, info.FullMethod); err != nil {
+			return nil, err
+		}
+		return handler(ctx, req)
+	}
+}
+
+// StreamServerInterceptor authorizes each streaming RPC before the handler runs.
+func (i *Interceptor) StreamServerInterceptor() grpc.StreamServerInterceptor {
+	return func(srv any, ss grpc.ServerStream, info *grpc.StreamServerInfo, handler grpc.StreamHandler) error {
+		if err := i.authorize(ss.Context(), info.FullMethod); err != nil {
+			return err
+		}
+		return handler(srv, ss)
+	}
+}
+
+func (i *Interceptor) authorize(ctx context.Context, fullMethod string) error {
+	id, ok := IdentityFromContext(ctx)
+	if !ok {
+		log.Warnf("ipc authz: DENY %s. caller identity unavailable", fullMethod)
+		return status.Error(codes.PermissionDenied, "caller identity could not be verified on the daemon control channel")
+	}
+
+	if i.isSelfOrPrivileged(id) {
+		// The local JSON gateway connects as the daemon itself (self/privileged)
+		// and forwards the real HTTP client's identity. Trust it here, where
+		// the transport peer is already the daemon, then authorize as the
+		// forwarded client. A direct non-privileged caller never reaches this
+		// branch, so it cannot forge the forwarding metadata.
+		fwd, hasFwd := forwardedIdentity(ctx)
+		if !hasFwd {
+			i.auditAllow(id, fullMethod)
+			return nil
+		}
+		log.Infof("ipc authz: gateway-forwarded identity %s", fwd)
+		id = fwd
+		if i.isSelfOrPrivileged(id) {
+			i.auditAllow(id, fullMethod)
+			return nil
+		}
+	}
+
+	// Per-user / per-target-profile RPCs authorize themselves in the handler.
+	if handlerAuthorizedMethods[fullMethod] {
+		return nil
+	}
+
+	o := i.policy.ActiveProfileOwnership()
+
+	// Trust-on-first-use: an unowned, non-shared profile is claimed by the first
+	// caller. The claim is atomic, if we lose the race we re-read and authorize.
+	if len(o.Owners) == 0 && !o.Shared {
+		claimed, err := i.policy.ClaimActiveProfileOwnerIfUnowned(id)
+		if err != nil {
+			log.Errorf("ipc authz: claim active profile for %s: %v", id, err)
+			return status.Error(codes.Internal, "failed to claim profile ownership")
+		}
+		if claimed {
+			log.Infof("ipc authz: %s claimed ownership of the active profile (trust-on-first-use)", id)
+			i.auditAllow(id, fullMethod)
+			return nil
+		}
+		o = i.policy.ActiveProfileOwnership()
+	}
+
+	if Authorize(o, id, i.resolver) {
+		i.auditAllow(id, fullMethod)
+		return nil
+	}
+
+	log.Warnf("ipc authz: DENY %s for %s. active profile owned by another principal", fullMethod, id)
+	return status.Errorf(codes.PermissionDenied,
+		"not authorized to control the active profile (caller %s). ask an owner or run as root/administrator", id)
+}
+
+// isSelfOrPrivileged reports whether the caller is the platform administrator
+// (root / elevated-admin / LocalSystem) or the daemon's own user.
+func (i *Interceptor) isSelfOrPrivileged(id Identity) bool {
+	if id.IsPrivileged() {
+		return true
+	}
+	// Daemon-self: only meaningful on Unix (Windows privilege is covered above).
+	return !id.IsWindows() && i.selfUID >= 0 && int(id.UID) == i.selfUID
+}
+
+func (i *Interceptor) auditAllow(id Identity, fullMethod string) {
+	if auditMethods[fullMethod] {
+		log.Infof("ipc authz: allow %s for %s", fullMethod, id)
+	}
+}
--- a/client/internal/ipcauth/interceptor_test.go
+++ b/client/internal/ipcauth/interceptor_test.go
@@ -0,0 +1,138 @@
+package ipcauth
+
+import (
+	"context"
+	"strconv"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/peer"
+	"google.golang.org/grpc/status"
+)
+
+type mockPolicy struct {
+	o       Ownership
+	claimed bool
+}
+
+func (m *mockPolicy) ActiveProfileOwnership() Ownership { return m.o }
+
+// ClaimActiveProfileOwnerIfUnowned records a claim and marks the profile owned.
+func (m *mockPolicy) ClaimActiveProfileOwnerIfUnowned(id Identity) (bool, error) {
+	if len(m.o.Owners) == 0 && !m.o.Shared {
+		m.o.Owners = []string{OwnerPrincipalForIdentity(id)}
+		m.claimed = true
+		return true, nil
+	}
+	return false, nil
+}
+
+type mockResolver struct {
+	gids  map[uint32]struct{}
+	names map[string]uint32
+}
+
+func (m mockResolver) CallerGIDs(Identity) map[uint32]struct{} { return m.gids }
+func (m mockResolver) GroupNameGID(n string) (uint32, bool)    { g, ok := m.names[n]; return g, ok }
+
+func ctxWith(id Identity) context.Context {
+	return peer.NewContext(context.Background(), &peer.Peer{AuthInfo: AuthInfo{Identity: id}})
+}
+
+const (
+	up    = servicePath + "Up"
+	list  = servicePath + "ListProfiles"
+	unkwn = servicePath + "SomeFutureMethod"
+)
+
+func TestInterceptorAuthorize(t *testing.T) {
+	const selfUID = 4000
+
+	tests := []struct {
+		name     string
+		own      Ownership
+		resolver GroupResolver
+		ctx      context.Context
+		method   string
+		wantErr  bool
+	}{
+		{"no identity denies", Ownership{}, nil, context.Background(), up, true},
+		{"root allowed", Ownership{}, nil, ctxWith(Identity{UID: 0}), up, false},
+		{"daemon-self allowed", Ownership{}, nil, ctxWith(Identity{UID: selfUID}), up, false},
+		{"shared allows any", Ownership{Shared: true}, nil, ctxWith(Identity{UID: 1234}), up, false},
+		{"uid owner allowed", Ownership{Owners: []string{"uid:1000"}}, nil, ctxWith(Identity{UID: 1000}), up, false},
+		{"non-owner denied", Ownership{Owners: []string{"uid:1000"}}, nil, ctxWith(Identity{UID: 2000}), up, true},
+		{"handler-authorized bypass", Ownership{Owners: []string{"uid:1000"}}, nil, ctxWith(Identity{UID: 2000}), list, false},
+		{"unknown method gated", Ownership{Owners: []string{"uid:1000"}}, nil, ctxWith(Identity{UID: 2000}), unkwn, true},
+		{"primary gid owner", Ownership{Owners: []string{"gid:5000"}}, nil, ctxWith(Identity{UID: 2000, GID: 5000}), up, false},
+		{"group-name owner via resolver", Ownership{Owners: []string{"group:admins"}},
+			mockResolver{names: map[string]uint32{"admins": 5000}, gids: map[uint32]struct{}{5000: {}}},
+			ctxWith(Identity{UID: 2000, GID: 42}), up, false},
+		{"windows sid owner", Ownership{Owners: []string{"sid:S-1-5-21-9"}}, nil,
+			ctxWith(Identity{SID: "S-1-5-21-9"}), up, false},
+		{"windows group-sid owner", Ownership{Owners: []string{"sid:S-1-5-32-544"}}, nil,
+			ctxWith(Identity{SID: "S-1-5-21-1", Groups: []string{"S-1-5-32-544"}}), up, false},
+		{"windows elevated privileged", Ownership{}, nil,
+			ctxWith(Identity{SID: "S-1-5-21-1", Elevated: true}), up, false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			i := &Interceptor{policy: &mockPolicy{o: tt.own}, resolver: tt.resolver, selfUID: selfUID}
+			err := i.authorize(tt.ctx, tt.method)
+			if tt.wantErr {
+				assert.Error(t, err)
+				assert.Equal(t, codes.PermissionDenied, status.Code(err))
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
+// TestInterceptorForwardedIdentity verifies the JSON-gateway trust model: a
+// self/privileged transport peer (the loopback gateway) may forward a real
+// client identity, but a non-privileged caller cannot forge it.
+func TestInterceptorForwardedIdentity(t *testing.T) {
+	const selfUID = 4000
+	owners := Ownership{Owners: []string{"uid:1000"}}
+
+	withFwd := func(peerUID, fwdUID uint32) context.Context {
+		ctx := ctxWith(Identity{UID: peerUID})
+		return metadata.NewIncomingContext(ctx, metadata.Pairs(mdFwdUID, itoa(fwdUID)))
+	}
+
+	// Gateway forwards a non-owner client: denied as that client.
+	i := &Interceptor{policy: &mockPolicy{o: owners}, selfUID: selfUID}
+	assert.Error(t, i.authorize(withFwd(selfUID, 2000), up))
+
+	// Gateway forwards the owner: allowed.
+	assert.NoError(t, i.authorize(withFwd(selfUID, 1000), up))
+
+	// A non-privileged direct caller's forwarded metadata: denied
+	assert.Error(t, i.authorize(withFwd(2000, 1000), up))
+}
+
+func itoa(u uint32) string {
+	return strconv.FormatUint(uint64(u), 10)
+}
+
+// TestInterceptorTOFU verifies an unowned, non-shared profile is claimed by the
+// first non-privileged caller, and a different caller is then denied.
+func TestInterceptorTOFU(t *testing.T) {
+	policy := &mockPolicy{o: Ownership{}} // unowned
+	i := &Interceptor{policy: policy, resolver: nil, selfUID: 4000}
+
+	// First caller (uid 1000) claims via TOFU.
+	err := i.authorize(ctxWith(Identity{UID: 1000}), up)
+	assert.NoError(t, err)
+	assert.True(t, policy.claimed, "first caller should claim ownership")
+	assert.Equal(t, []string{"uid:1000"}, policy.o.Owners)
+
+	// A different caller is now denied (profile owned by uid 1000).
+	err = i.authorize(ctxWith(Identity{UID: 2000}), up)
+	assert.Error(t, err)
+	assert.Equal(t, codes.PermissionDenied, status.Code(err))
+}
--- a/client/internal/ipcauth/peercred_bsd.go
+++ b/client/internal/ipcauth/peercred_bsd.go
@@ -0,0 +1,42 @@
+//go:build darwin || freebsd
+
+package ipcauth
+
+import (
+	"fmt"
+	"net"
+
+	"golang.org/x/sys/unix"
+)
+
+// PeerIdentity reads the kernel-authenticated identity of the process on the
+// other end of a Unix socket connection via LOCAL_PEERCRED (xucred). xucred
+// carries the uid and primary group.
+func PeerIdentity(c net.Conn) (Identity, error) {
+	uc, ok := c.(*net.UnixConn)
+	if !ok {
+		return Identity{}, fmt.Errorf("connection is not a unix socket: %T", c)
+	}
+	raw, err := uc.SyscallConn()
+	if err != nil {
+		return Identity{}, fmt.Errorf("raw conn: %w", err)
+	}
+
+	var cred *unix.Xucred
+	var credErr error
+	if err := raw.Control(func(fd uintptr) {
+		cred, credErr = unix.GetsockoptXucred(int(fd), unix.SOL_LOCAL, unix.LOCAL_PEERCRED)
+	}); err != nil {
+		return Identity{}, fmt.Errorf("getsockopt control: %w", err)
+	}
+	if credErr != nil {
+		return Identity{}, fmt.Errorf("LOCAL_PEERCRED: %w", credErr)
+	}
+
+	id := Identity{UID: cred.Uid}
+	// Groups[0] is the effective (primary) GID; guard against an empty list.
+	if cred.Ngroups > 0 {
+		id.GID = cred.Groups[0]
+	}
+	return id, nil
+}
--- a/client/internal/ipcauth/peercred_linux.go
+++ b/client/internal/ipcauth/peercred_linux.go
@@ -0,0 +1,41 @@
+//go:build linux
+
+package ipcauth
+
+import (
+	"fmt"
+	"net"
+
+	"golang.org/x/sys/unix"
+)
+
+// PeerIdentity reads the kernel-authenticated identity of the process on the
+// other end of a Unix socket connection via SO_PEERCRED. The credentials are
+// captured by the kernel at connect() time and cannot be spoofed or changed for
+// the life of the connection.
+func PeerIdentity(c net.Conn) (Identity, error) {
+	uc, ok := c.(*net.UnixConn)
+	if !ok {
+		return Identity{}, fmt.Errorf("connection is not a unix socket: %T", c)
+	}
+	raw, err := uc.SyscallConn()
+	if err != nil {
+		return Identity{}, fmt.Errorf("raw conn: %w", err)
+	}
+
+	var cred *unix.Ucred
+	var credErr error
+	if err := raw.Control(func(fd uintptr) {
+		cred, credErr = unix.GetsockoptUcred(int(fd), unix.SOL_SOCKET, unix.SO_PEERCRED)
+	}); err != nil {
+		return Identity{}, fmt.Errorf("getsockopt control: %w", err)
+	}
+	if credErr != nil {
+		return Identity{}, fmt.Errorf("SO_PEERCRED: %w", credErr)
+	}
+
+	return Identity{
+		UID: cred.Uid,
+		GID: cred.Gid,
+	}, nil
+}
--- a/client/internal/ipcauth/peercred_stub.go
+++ b/client/internal/ipcauth/peercred_stub.go
@@ -0,0 +1,16 @@
+//go:build !linux && !darwin && !freebsd
+
+package ipcauth
+
+import (
+	"fmt"
+	"net"
+	"runtime"
+)
+
+// PeerIdentity is unimplemented on platforms without a Unix-socket peer-credential
+// primitive. Windows derives identity from the named-pipe client token instead
+// (see the Windows transport credentials), so it never calls this.
+func PeerIdentity(net.Conn) (Identity, error) {
+	return Identity{}, fmt.Errorf("peer credential check not supported on %s", runtime.GOOS)
+}
--- a/client/internal/ipcauth/peercred_unix_test.go
+++ b/client/internal/ipcauth/peercred_unix_test.go
@@ -0,0 +1,114 @@
+//go:build linux || darwin || freebsd
+
+package ipcauth
+
+import (
+	"context"
+	"net"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/health"
+	healthpb "google.golang.org/grpc/health/grpc_health_v1"
+)
+
+// TestPeerIdentity_MatchesCurrentProcess connects to a real Unix socket and
+// verifies the extracted UID/GID match the running process (both ends are us).
+func TestPeerIdentity_MatchesCurrentProcess(t *testing.T) {
+	sock := filepath.Join(t.TempDir(), "peer.sock")
+	ln, err := net.Listen("unix", sock)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = ln.Close() })
+
+	type result struct {
+		id  Identity
+		err error
+	}
+	done := make(chan result, 1)
+	go func() {
+		c, aerr := ln.Accept()
+		if aerr != nil {
+			done <- result{err: aerr}
+			return
+		}
+		defer func() { _ = c.Close() }()
+		id, ierr := PeerIdentity(c)
+		done <- result{id: id, err: ierr}
+	}()
+
+	client, err := net.Dial("unix", sock)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = client.Close() })
+
+	res := <-done
+	require.NoError(t, res.err)
+	assert.Equal(t, uint32(os.Getuid()), res.id.UID, "UID should match current process")
+	assert.Equal(t, uint32(os.Getgid()), res.id.GID, "primary GID should match current process")
+}
+
+// TestPeerIdentity_NonUnixConn rejects non-Unix connections (fail closed).
+func TestPeerIdentity_NonUnixConn(t *testing.T) {
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = ln.Close() })
+
+	done := make(chan error, 1)
+	go func() {
+		c, aerr := ln.Accept()
+		if aerr != nil {
+			done <- aerr
+			return
+		}
+		defer func() { _ = c.Close() }()
+		_, ierr := PeerIdentity(c)
+		done <- ierr
+	}()
+
+	client, err := net.Dial("tcp", ln.Addr().String())
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = client.Close() })
+
+	assert.Error(t, <-done, "PeerIdentity must reject a non-Unix connection")
+}
+
+// TestGRPCRoundTrip_ServerCredsClientInsecure proves the transport contract end
+// to end: a gRPC server using the peercred transport credentials still serves a
+// plain insecure client (the CLI never changed), and the caller's kernel
+// identity reaches the handler via IdentityFromContext.
+func TestGRPCRoundTrip_ServerCredsClientInsecure(t *testing.T) {
+	sock := filepath.Join(t.TempDir(), "rt.sock")
+	ln, err := net.Listen("unix", sock)
+	require.NoError(t, err)
+
+	var gotUID uint32
+	var gotOK bool
+	srv := grpc.NewServer(
+		grpc.Creds(NewTransportCredentials()),
+		grpc.UnaryInterceptor(func(ctx context.Context, req any, _ *grpc.UnaryServerInfo, h grpc.UnaryHandler) (any, error) {
+			id, ok := IdentityFromContext(ctx)
+			gotUID, gotOK = id.UID, ok
+			return h(ctx, req)
+		}),
+	)
+	healthpb.RegisterHealthServer(srv, health.NewServer())
+	go func() { _ = srv.Serve(ln) }()
+	t.Cleanup(srv.Stop)
+
+	conn, err := grpc.NewClient("unix://"+sock, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = conn.Close() })
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	_, err = healthpb.NewHealthClient(conn).Check(ctx, &healthpb.HealthCheckRequest{})
+	require.NoError(t, err, "insecure client must reach the peercred server")
+
+	assert.True(t, gotOK, "handler must see a peer identity")
+	assert.Equal(t, uint32(os.Getuid()), gotUID, "handler must see the caller's UID")
+}
--- a/client/internal/ipcauth/policy.go
+++ b/client/internal/ipcauth/policy.go
@@ -0,0 +1,90 @@
+package ipcauth
+
+import "sync"
+
+const servicePath = "/daemon.DaemonService/"
+
+// ProfilePolicy exposes the active profile's ownership to the interceptor. The
+// daemon server implements it. ConfigAdapter bridges the gap because the gRPC
+// server (and its interceptor) is constructed before the server instance exists.
+type ProfilePolicy interface {
+	// ActiveProfileOwnership returns the active profile's ownership policy.
+	ActiveProfileOwnership() Ownership
+
+	// ClaimActiveProfileOwnerIfUnowned atomically claims the active profile for
+	// id when it has no owners and is not shared (trust-on-first-use), and
+	// reports whether id is now an owner. A false return means the profile was
+	// already owned/shared or another caller won the claim.
+	ClaimActiveProfileOwnerIfUnowned(id Identity) (bool, error)
+}
+
+// handlerAuthorizedMethods bypass the active-profile gate: they are per-user or
+// per-target-profile operations whose handler does its own authorization (bound
+// to the caller identity). Peer identity is still required to reach them.
+var handlerAuthorizedMethods = map[string]bool{
+	servicePath + "AddProfile":       true,
+	servicePath + "ListProfiles":     true,
+	servicePath + "GetActiveProfile": true,
+	servicePath + "RemoveProfile":    true,
+	servicePath + "RenameProfile":    true,
+}
+
+// auditMethods are worth an audit log line. Denials are always logged.
+var auditMethods = map[string]bool{
+	servicePath + "GetConfig":          true,
+	servicePath + "SetConfig":          true,
+	servicePath + "Login":              true,
+	servicePath + "WaitSSOLogin":       true,
+	servicePath + "RequestJWTAuth":     true,
+	servicePath + "WaitJWTToken":       true,
+	servicePath + "StartCapture":       true,
+	servicePath + "StartBundleCapture": true,
+	servicePath + "DebugBundle":        true,
+	servicePath + "ExposeService":      true,
+	servicePath + "Up":                 true,
+	servicePath + "Down":               true,
+	servicePath + "SelectNetworks":     true,
+	servicePath + "DeselectNetworks":   true,
+	servicePath + "SwitchProfile":      true,
+	servicePath + "TriggerUpdate":      true,
+	servicePath + "Logout":             true,
+	servicePath + "CleanState":         true,
+	servicePath + "DeleteState":        true,
+}
+
+// ConfigAdapter is a ProfilePolicy whose backend is set lazily, once the daemon
+// server instance is created. Until then it reports an unowned profile
+// (Ownership zero value), so non-privileged callers are denied.
+type ConfigAdapter struct {
+	mu      sync.RWMutex
+	backend ProfilePolicy
+}
+
+// SetBackend installs the real policy. Must be called before serving RPCs.
+func (a *ConfigAdapter) SetBackend(backend ProfilePolicy) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	a.backend = backend
+}
+
+// ActiveProfileOwnership delegates to the backend, or reports an unowned profile
+// when no backend is set yet.
+func (a *ConfigAdapter) ActiveProfileOwnership() Ownership {
+	a.mu.RLock()
+	defer a.mu.RUnlock()
+	if a.backend == nil {
+		return Ownership{}
+	}
+	return a.backend.ActiveProfileOwnership()
+}
+
+// ClaimActiveProfileOwnerIfUnowned delegates to the backend. Before the backend
+// is set it cannot claim, so it reports not-owned (fail closed).
+func (a *ConfigAdapter) ClaimActiveProfileOwnerIfUnowned(id Identity) (bool, error) {
+	a.mu.RLock()
+	defer a.mu.RUnlock()
+	if a.backend == nil {
+		return false, nil
+	}
+	return a.backend.ClaimActiveProfileOwnerIfUnowned(id)
+}
--- a/client/internal/ipcauth/principal.go
+++ b/client/internal/ipcauth/principal.go
@@ -0,0 +1,54 @@
+package ipcauth
+
+import (
+	"strconv"
+	"strings"
+)
+
+// PrincipalKind is the type of an owner principal.
+type PrincipalKind string
+
+const (
+	KindUID   PrincipalKind = "uid"   // Unix user ID
+	KindGID   PrincipalKind = "gid"   // Unix group ID
+	KindGroup PrincipalKind = "group" // Unix group name (NSS-resolved)
+	KindSID   PrincipalKind = "sid"   // Windows user or group SID
+)
+
+// Principal is a parsed owner entry from a profile's Owners list.
+type Principal struct {
+	Kind  PrincipalKind
+	Value string
+}
+
+// ParsePrincipal parses a "kind:value" owner string. Returns false for empty
+// values or unknown kinds so malformed entries are ignored rather than trusted.
+func ParsePrincipal(s string) (Principal, bool) {
+	kind, value, ok := strings.Cut(s, ":")
+	if !ok || value == "" {
+		return Principal{}, false
+	}
+	switch PrincipalKind(kind) {
+	case KindUID, KindGID, KindGroup, KindSID:
+		return Principal{Kind: PrincipalKind(kind), Value: value}, true
+	default:
+		return Principal{}, false
+	}
+}
+
+// UIDPrincipal builds the owner string for a Unix user ID.
+func UIDPrincipal(uid uint32) string {
+	return string(KindUID) + ":" + strconv.FormatUint(uint64(uid), 10)
+}
+
+// SIDPrincipal builds the owner string for a Windows SID.
+func SIDPrincipal(sid string) string { return string(KindSID) + ":" + sid }
+
+// OwnerPrincipalForIdentity returns the self-ownership principal for an identity:
+// the user's UID on Unix, or the user's SID on Windows.
+func OwnerPrincipalForIdentity(id Identity) string {
+	if id.IsWindows() {
+		return SIDPrincipal(id.SID)
+	}
+	return UIDPrincipal(id.UID)
+}
--- a/client/internal/ipcauth/resolver_unix.go
+++ b/client/internal/ipcauth/resolver_unix.go
@@ -0,0 +1,71 @@
+//go:build !windows
+
+package ipcauth
+
+import (
+	"strconv"
+	"sync"
+	"time"
+
+	"github.com/netbirdio/netbird/client/internal/shell"
+)
+
+const groupCacheTTL = 30 * time.Second
+
+// NewDefaultGroupResolver returns an NSS-aware group resolver, owners resolve
+// correctly for LDAP/AD users under CGO_ENABLED=0. Results are cached briefly.
+func NewDefaultGroupResolver() GroupResolver {
+	return &nssResolver{byUID: make(map[uint32]gidCacheEntry)}
+}
+
+type gidCacheEntry struct {
+	gids map[uint32]struct{}
+	at   time.Time
+}
+
+type nssResolver struct {
+	mu    sync.Mutex
+	byUID map[uint32]gidCacheEntry
+}
+
+func (r *nssResolver) CallerGIDs(id Identity) map[uint32]struct{} {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	if e, ok := r.byUID[id.UID]; ok && time.Since(e.at) < groupCacheTTL {
+		return e.gids
+	}
+	gids := resolveGIDs(id.UID)
+	r.byUID[id.UID] = gidCacheEntry{gids: gids, at: time.Now()}
+	return gids
+}
+
+func resolveGIDs(uid uint32) map[uint32]struct{} {
+	out := make(map[uint32]struct{})
+	u, err := shell.GetUserFromGetent(strconv.FormatUint(uint64(uid), 10))
+	if err != nil {
+		return out
+	}
+	ids, err := shell.GroupIdsWithFallback(u)
+	if err != nil {
+		return out
+	}
+	for _, s := range ids {
+		if g, err := strconv.ParseUint(s, 10, 32); err == nil {
+			out[uint32(g)] = struct{}{}
+		}
+	}
+	return out
+}
+
+func (r *nssResolver) GroupNameGID(name string) (uint32, bool) {
+	g, err := shell.LookupGroupWithGetent(name)
+	if err != nil {
+		return 0, false
+	}
+	gid, err := strconv.ParseUint(g.Gid, 10, 32)
+	if err != nil {
+		return 0, false
+	}
+	return uint32(gid), true
+}
--- a/client/internal/ipcauth/resolver_windows.go
+++ b/client/internal/ipcauth/resolver_windows.go
@@ -0,0 +1,10 @@
+//go:build windows
+
+package ipcauth
+
+// NewDefaultGroupResolver returns nil on Windows: group authorization uses the
+// group SIDs carried in the client token (see the Windows transport
+// credentials).
+func NewDefaultGroupResolver() GroupResolver {
+	return nil
+}
--- a/client/internal/netflow/store/event_aggregation_test.go
+++ b/client/internal/netflow/store/event_aggregation_test.go
@@ -175,7 +175,9 @@ func TestFlowAggregationOfUnknownProtocols(t *testing.T) {
 }

 func TestResetAggregationWindow(t *testing.T) {
-	store := NewAggregatingMemoryStore()
+	now := time.Now()
+	nowFunc := func() time.Time { return now }
+	store := NewAggregatingMemoryStoreWithTimeFunc(nowFunc)
 	store.StoreEvent(&types.Event{
 		ID:        uuid.New(),
 		Timestamp: time.Now(),
@@ -198,6 +200,7 @@ func TestResetAggregationWindow(t *testing.T) {
 		},
 	})

+	now = now.Add(1 * time.Second)
 	reset := store.ResetAggregationWindow()
 	previousEvents, ok := reset.(*AggregatingMemory)
 	assert.True(t, ok)
--- a/client/internal/netflow/store/memory.go
+++ b/client/internal/netflow/store/memory.go
@@ -29,6 +29,7 @@ type AggregatingMemory struct {
 	WindowStart time.Time
 	WindowEnd   time.Time
 	rnd         *v2.PCG
+	nowFunc     func() time.Time
 }

 func (m *Memory) StoreEvent(event *types.Event) {
@@ -62,14 +63,19 @@ func (m *Memory) DeleteEvents(ids []uuid.UUID) {
 }

 func NewAggregatingMemoryStore() *AggregatingMemory {
-	return &AggregatingMemory{WindowStart: time.Now(), Memory: Memory{events: make(map[uuid.UUID]*types.Event)}, rnd: v2.NewPCG(rand.Uint64(), rand.Uint64())}
+	return NewAggregatingMemoryStoreWithTimeFunc(defaultNowFunc)
+}
+
+// used in tests when deterministic (less random) time intervals are required
+func NewAggregatingMemoryStoreWithTimeFunc(nowFunc func() time.Time) *AggregatingMemory {
+	return &AggregatingMemory{WindowStart: nowFunc(), Memory: Memory{events: make(map[uuid.UUID]*types.Event)}, nowFunc: nowFunc, rnd: v2.NewPCG(rand.Uint64(), rand.Uint64())}
 }

 func (am *AggregatingMemory) ResetAggregationWindow() types.FlowEventAggregator {
 	am.mux.Lock()
 	defer am.mux.Unlock()

-	now := time.Now()
+	now := am.nowFunc()
 	toret := AggregatingMemory{WindowStart: am.WindowStart, WindowEnd: now, Memory: Memory{events: am.events}, rnd: v2.NewPCG(rand.Uint64(), rand.Uint64())}

 	am.events = make(map[uuid.UUID]*types.Event)
@@ -152,3 +158,7 @@ func (am *AggregatingMemory) GetAggregatedEvents() []*types.Event {

 	return slices.Collect(maps.Values(aggregated)) // could return an iterator instead here
 }
+
+func defaultNowFunc() time.Time {
+	return time.Now()
+}
--- a/client/internal/peer/conn.go
+++ b/client/internal/peer/conn.go
@@ -30,6 +30,11 @@ import (
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
 )

+// wgTimeoutEscalationThreshold is the number of consecutive WireGuard
+// handshake timeouts after which the rosenpass state for the peer is
+// considered desynced and gets reset.
+const wgTimeoutEscalationThreshold = 3
+
 // MetricsRecorder is an interface for recording peer connection metrics
 type MetricsRecorder interface {
 	RecordConnectionStages(
@@ -118,6 +123,9 @@ type Conn struct {
 	wgWatcher       *WGWatcher
 	wgWatcherWg     sync.WaitGroup
 	wgWatcherCancel context.CancelFunc
+	// wgTimeouts counts consecutive WireGuard handshake timeouts without a
+	// successful handshake in between. Guarded by mu.
+	wgTimeouts int

 	// used to store the remote Rosenpass key for Relayed connection in case of connection update from ice
 	rosenpassRemoteKey []byte
@@ -195,7 +203,6 @@ func NewConn(config ConnConfig, services ServiceDependencies) (*Conn, error) {
 		statusICE:          worker.NewAtomicStatus(),
 		dumpState:          dumpState,
 		endpointUpdater:    NewEndpointUpdater(connLog, config.WgConfig, isController(config)),
-		wgWatcher:          NewWGWatcher(connLog, config.WgConfig.WgInterface, config.Key, dumpState),
 		metricsRecorder:    services.MetricsRecorder,
 	}

@@ -663,11 +670,12 @@ func (conn *Conn) onGuardEvent() {
 	}
 }

-func (conn *Conn) onWGDisconnected() {
+func (conn *Conn) onWGDisconnected(watcherCtx context.Context) {
 	conn.mu.Lock()
 	defer conn.mu.Unlock()

-	if conn.ctx.Err() != nil {
+	// watcherCtx guards against a stale watcher tearing down a connection that already superseded it.
+	if conn.ctx.Err() != nil || watcherCtx.Err() != nil {
 		return
 	}

@@ -683,6 +691,29 @@ func (conn *Conn) onWGDisconnected() {
 	default:
 		conn.Log.Debugf("No active connection to close on WG timeout")
 	}
+
+	conn.escalateWGTimeoutLocked()
+}
+
+// escalateWGTimeoutLocked resets the peer's rosenpass state after repeated
+// handshake timeouts. With rosenpass enabled, persistent timeouts mean the
+// preshared keys have desynced; the renewal exchange runs over the dead
+// tunnel and cannot resync them. Reporting the peer disconnected drops its
+// rosenpass state, so the next connection configuration programs the
+// rendezvous key and the tunnel can bootstrap again. Callers must hold mu.
+func (conn *Conn) escalateWGTimeoutLocked() {
+	if conn.config.RosenpassConfig.PubKey == nil {
+		return
+	}
+
+	conn.wgTimeouts++
+	if conn.wgTimeouts < wgTimeoutEscalationThreshold || conn.onDisconnected == nil {
+		return
+	}
+	conn.wgTimeouts = 0
+
+	conn.Log.Warnf("%d consecutive WireGuard handshake timeouts, resetting rosenpass state for peer", wgTimeoutEscalationThreshold)
+	conn.onDisconnected(conn.config.WgConfig.RemoteKey)
 }

 func (conn *Conn) updateRelayStatus(relayServerAddr string, rosenpassPubKey []byte, updateTime time.Time) {
@@ -802,25 +833,39 @@ func (conn *Conn) isConnectedOnAllWay() (status guard.ConnStatus) {
 	})
 }

+// enableWgWatcherIfNeeded starts a fresh watcher instance per connection attempt, so its
+// lifecycle stays bound to conn.mu and enable/disable can't race an old goroutine's shutdown.
+// Caller must hold conn.mu.
 func (conn *Conn) enableWgWatcherIfNeeded(enabledTime time.Time) {
-	if !conn.wgWatcher.PrepareInitialHandshake() {
+	if conn.wgWatcher != nil {
 		return
 	}

+	watcher := NewWGWatcher(conn.Log, conn.config.WgConfig.WgInterface, conn.config.Key, conn.dumpState)
+	watcher.PrepareInitialHandshake()
+
 	wgWatcherCtx, wgWatcherCancel := context.WithCancel(conn.ctx)
+	conn.wgWatcher = watcher
 	conn.wgWatcherCancel = wgWatcherCancel
+
 	conn.wgWatcherWg.Add(1)
 	go func() {
 		defer conn.wgWatcherWg.Done()
-		conn.wgWatcher.EnableWgWatcher(wgWatcherCtx, enabledTime, conn.onWGDisconnected, conn.onWGHandshakeSuccess)
+		onDisconnected := func() { conn.onWGDisconnected(wgWatcherCtx) }
+		watcher.EnableWgWatcher(wgWatcherCtx, enabledTime, onDisconnected, conn.onWGHandshakeSuccess, conn.onWGCheckSuccess)
 	}()
 }

+// disableWgWatcherIfNeeded cancels and drops the watcher once no transport is active. It never
+// waits for the goroutine: the timeout path reentrantly calls back here under conn.mu, so
+// blocking would deadlock. Caller must hold conn.mu.
 func (conn *Conn) disableWgWatcherIfNeeded() {
-	if conn.currentConnPriority == conntype.None && conn.wgWatcherCancel != nil {
-		conn.wgWatcherCancel()
-		conn.wgWatcherCancel = nil
+	if conn.currentConnPriority != conntype.None || conn.wgWatcher == nil {
+		return
 	}
+	conn.wgWatcherCancel()
+	conn.wgWatcher = nil
+	conn.wgWatcherCancel = nil
 }

 func (conn *Conn) newProxy(remoteConn net.Conn) (wgproxy.Proxy, error) {
@@ -843,7 +888,9 @@ func (conn *Conn) resetEndpoint() {
 		return
 	}
 	conn.Log.Infof("reset wg endpoint")
-	conn.wgWatcher.Reset()
+	if conn.wgWatcher != nil {
+		conn.wgWatcher.Reset()
+	}
 	if err := conn.endpointUpdater.RemoveEndpointAddress(); err != nil {
 		conn.Log.Warnf("failed to remove endpoint address before update: %v", err)
 	}
@@ -892,6 +939,15 @@ func (conn *Conn) onWGHandshakeSuccess(when time.Time) {
 	conn.recordConnectionMetrics()
 }

+// onWGCheckSuccess is called for every watcher check that observed a fresh
+// handshake, including handshakes of connections that were already up when
+// the watcher started.
+func (conn *Conn) onWGCheckSuccess() {
+	conn.mu.Lock()
+	conn.wgTimeouts = 0
+	conn.mu.Unlock()
+}
+
 // recordConnectionMetrics records connection stage timestamps as metrics
 func (conn *Conn) recordConnectionMetrics() {
 	if conn.metricsRecorder == nil {
--- a/client/internal/peer/conn_test.go
+++ b/client/internal/peer/conn_test.go
@@ -7,6 +7,7 @@ import (
 	"testing"
 	"time"

+	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"

 	"github.com/netbirdio/netbird/client/iface"
@@ -304,3 +305,84 @@ func TestConn_presharedKey_RosenpassManaged(t *testing.T) {
 		t.Fatalf("expected non-nil presharedKey before Rosenpass manages PSK")
 	}
 }
+
+func newWGTimeoutTestConn(rosenpassEnabled bool, disconnected *[]string) *Conn {
+	cfg := ConnConfig{
+		Key:      "LLHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
+		LocalKey: "RRHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
+		WgConfig: WgConfig{RemoteKey: "LLHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU="},
+	}
+	if rosenpassEnabled {
+		cfg.RosenpassConfig = RosenpassConfig{PubKey: []byte("dummykey")}
+	}
+
+	conn := &Conn{
+		ctx:           context.Background(),
+		config:        cfg,
+		Log:           log.WithField("peer", cfg.Key),
+		metricsStages: &MetricsStages{},
+	}
+	conn.SetOnDisconnected(func(remotePeer string) {
+		*disconnected = append(*disconnected, remotePeer)
+	})
+	return conn
+}
+
+// TestConn_onWGDisconnected_EscalatesToRosenpassReset: repeated handshake
+// timeouts with rosenpass enabled mean the preshared keys have desynced. The
+// renewal exchange runs over the dead tunnel and cannot resync them, so after
+// wgTimeoutEscalationThreshold consecutive timeouts the conn must report the
+// peer disconnected, dropping its rosenpass state so the next configuration
+// programs the rendezvous key.
+func TestConn_onWGDisconnected_EscalatesToRosenpassReset(t *testing.T) {
+	var disconnected []string
+	conn := newWGTimeoutTestConn(true, &disconnected)
+
+	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
+		conn.onWGDisconnected(conn.ctx)
+	}
+	assert.Empty(t, disconnected, "escalation must not fire below the threshold")
+
+	conn.onWGDisconnected(conn.ctx)
+	assert.Equal(t, []string{conn.config.WgConfig.RemoteKey}, disconnected,
+		"reaching the threshold must report the peer disconnected once")
+
+	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
+		conn.onWGDisconnected(conn.ctx)
+	}
+	assert.Len(t, disconnected, 1, "escalation must restart counting after firing")
+
+	conn.onWGDisconnected(conn.ctx)
+	assert.Len(t, disconnected, 2, "continued timeouts must escalate again")
+}
+
+// TestConn_onWGDisconnected_CheckSuccessResetsEscalation: a successful
+// handshake between timeouts means the tunnel recovered; the counter must
+// start over.
+func TestConn_onWGDisconnected_CheckSuccessResetsEscalation(t *testing.T) {
+	var disconnected []string
+	conn := newWGTimeoutTestConn(true, &disconnected)
+
+	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
+		conn.onWGDisconnected(conn.ctx)
+	}
+	conn.onWGCheckSuccess()
+
+	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
+		conn.onWGDisconnected(conn.ctx)
+	}
+	assert.Empty(t, disconnected, "handshake success must reset the timeout count")
+}
+
+// TestConn_onWGDisconnected_NoEscalationWithoutRosenpass: without rosenpass
+// there is no per-peer key state to reset; repeated timeouts must not report
+// disconnects.
+func TestConn_onWGDisconnected_NoEscalationWithoutRosenpass(t *testing.T) {
+	var disconnected []string
+	conn := newWGTimeoutTestConn(false, &disconnected)
+
+	for i := 0; i < wgTimeoutEscalationThreshold*3; i++ {
+		conn.onWGDisconnected(conn.ctx)
+	}
+	assert.Empty(t, disconnected, "escalation must be limited to rosenpass connections")
+}
--- a/client/internal/peer/status.go
+++ b/client/internal/peer/status.go
@@ -813,19 +813,14 @@ func (d *Status) SetSessionExpiresAt(deadline time.Time) {
 }

 // GetSessionExpiresAt returns the most recently recorded SSO session deadline,
-// or the zero value when no deadline is tracked. A deadline that has already
-// slipped into the past reports as "none": once the session has expired it is
-// no longer a meaningful countdown, and the sessionwatch.Watcher does not
-// arm a timer at the deadline itself to clear it (only the two pre-expiry
-// warnings). Without this guard the UI would keep painting a stale
-// "expires in …" against a moment that has passed until the next login,
-// extend, or teardown rewrote the value.
+// or the zero value when no deadline is tracked. A deadline in the past is
+// returned as-is: it means the session has expired, and consumers (tray row,
+// CLI status) render it as "expired" rather than hiding it — masking it as
+// "none" would blank the UI at the exact moment it should say the session
+// ended.
 func (d *Status) GetSessionExpiresAt() time.Time {
 	d.mux.Lock()
 	defer d.mux.Unlock()
-	if !d.sessionExpiresAt.IsZero() && d.sessionExpiresAt.Before(time.Now()) {
-		return time.Time{}
-	}
 	return d.sessionExpiresAt
 }

--- a/client/internal/peer/wg_watcher.go
+++ b/client/internal/peer/wg_watcher.go
@@ -3,7 +3,6 @@ package peer
 import (
 	"context"
 	"fmt"
-	"sync"
 	"time"

 	log "github.com/sirupsen/logrus"
@@ -24,14 +23,14 @@ type WGInterfaceStater interface {
 	GetStats() (map[string]configurer.WGStats, error)
 }

+// WGWatcher is single-shot: one instance per connection attempt, run once, then discarded.
+// Lifecycle is owned by Conn under conn.mu, so it keeps no "enabled" state to go stale.
 type WGWatcher struct {
 	log           *log.Entry
 	wgIfaceStater WGInterfaceStater
 	peerKey       string
 	stateDump     *stateDump

-	enabled   bool
-	muEnabled sync.Mutex
 	// initialHandshake is not thread-safe; never call PrepareInitialHandshake and EnableWgWatcher concurrently.
 	initialHandshake time.Time

@@ -48,36 +47,23 @@ func NewWGWatcher(log *log.Entry, wgIfaceStater WGInterfaceStater, peerKey strin
 	}
 }

-// PrepareInitialHandshake reserves the watcher and reads the peer's current WireGuard
-// handshake time. It must be called before the peer is (re)configured on the WireGuard
-// interface, so the captured baseline reflects the state prior to this connection attempt
-// instead of racing with that configuration. Returns ok=false if the watcher is already
-// running, in which case EnableWgWatcher must not be called.
-func (w *WGWatcher) PrepareInitialHandshake() (ok bool) {
-	w.muEnabled.Lock()
-	if w.enabled {
-		w.muEnabled.Unlock()
-		return false
-	}
-
+// PrepareInitialHandshake reads the peer's current WireGuard handshake time. It must be
+// called before the peer is (re)configured on the WireGuard interface, so the captured
+// baseline reflects the state prior to this connection attempt instead of racing with
+// that configuration.
+func (w *WGWatcher) PrepareInitialHandshake() {
 	w.log.Debugf("enable WireGuard watcher")
-	w.enabled = true
-	w.muEnabled.Unlock()
-
 	handshake, _ := w.wgState()
 	w.initialHandshake = handshake
-	return true
 }

 // EnableWgWatcher runs the WireGuard watcher loop using the handshake baseline captured by
 // PrepareInitialHandshake. The watcher runs until ctx is cancelled. Caller is responsible
-// for context lifecycle management.
-func (w *WGWatcher) EnableWgWatcher(ctx context.Context, enabledTime time.Time, onDisconnectedFn func(), onHandshakeSuccessFn func(when time.Time)) {
-	w.periodicHandshakeCheck(ctx, onDisconnectedFn, onHandshakeSuccessFn, enabledTime, w.initialHandshake)
-
-	w.muEnabled.Lock()
-	w.enabled = false
-	w.muEnabled.Unlock()
+// for context lifecycle management. onHandshakeSuccessFn is called only for the first
+// handshake observed by this run, onCheckSuccessFn for every check that observed a fresh
+// handshake, including the first.
+func (w *WGWatcher) EnableWgWatcher(ctx context.Context, enabledTime time.Time, onDisconnectedFn func(), onHandshakeSuccessFn func(when time.Time), onCheckSuccessFn func()) {
+	w.periodicHandshakeCheck(ctx, onDisconnectedFn, onHandshakeSuccessFn, onCheckSuccessFn, enabledTime, w.initialHandshake)
 }

 // Reset signals the watcher that the WireGuard peer has been reset and a new
@@ -90,7 +76,7 @@ func (w *WGWatcher) Reset() {
 }

 // wgStateCheck help to check the state of the WireGuard handshake and relay connection
-func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, onDisconnectedFn func(), onHandshakeSuccessFn func(when time.Time), enabledTime time.Time, initialHandshake time.Time) {
+func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, onDisconnectedFn func(), onHandshakeSuccessFn func(when time.Time), onCheckSuccessFn func(), enabledTime time.Time, initialHandshake time.Time) {
 	w.log.Infof("WireGuard watcher started")

 	timer := time.NewTimer(wgHandshakeOvertime)
@@ -103,6 +89,7 @@ func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, onDisconnectedFn
 		case <-timer.C:
 			handshake, ok := w.handshakeCheck(lastHandshake)
 			if !ok {
+				// early ctx cancel check return
 				if ctx.Err() != nil {
 					return
 				}
@@ -117,6 +104,10 @@ func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, onDisconnectedFn
 				}
 			}

+			if onCheckSuccessFn != nil && ctx.Err() == nil {
+				onCheckSuccessFn()
+			}
+
 			lastHandshake = *handshake

 			resetTime := time.Until(handshake.Add(checkPeriod))
@@ -147,9 +138,9 @@ func (w *WGWatcher) handshakeCheck(lastHandshake time.Time) (*time.Time, bool) {

 	w.log.Tracef("previous handshake, handshake: %v, %v", lastHandshake, handshake)

-	// the current know handshake did not change
+	// the current known handshake did not change
 	if handshake.Equal(lastHandshake) {
-		w.log.Warnf("WireGuard handshake timed out: %v", handshake)
+		w.log.Warnf("WireGuard handshake not updated: %v", handshake)
 		return nil, false
 	}

--- a/client/internal/peer/wg_watcher_test.go
+++ b/client/internal/peer/wg_watcher_test.go
@@ -7,7 +7,6 @@ import (
 	"time"

 	log "github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/require"

 	"github.com/netbirdio/netbird/client/iface/configurer"
 )
@@ -24,6 +23,72 @@ func (m *MocWgIface) disconnect() {
 	m.stop = true
 }

+type mockHandshakeStats struct {
+	mu        sync.Mutex
+	handshake time.Time
+}
+
+func (m *mockHandshakeStats) GetStats() (map[string]configurer.WGStats, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return map[string]configurer.WGStats{"": {LastHandshake: m.handshake}}, nil
+}
+
+func (m *mockHandshakeStats) advance() {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.handshake = time.Now()
+}
+
+// TestWGWatcher_CheckSuccessCallback: onCheckSuccessFn must fire for a fresh
+// handshake even when the watcher started with an existing handshake baseline,
+// the case where onHandshakeSuccessFn stays silent.
+func TestWGWatcher_CheckSuccessCallback(t *testing.T) {
+	// checkPeriod bounds how stale a handshake may be before the watcher treats it
+	// as a suspended-machine timeout. The first check fires after wgHandshakeOvertime,
+	// so keep checkPeriod well above any scheduling jitter to avoid a false timeout
+	// converting the expected success into a disconnect on a loaded runner.
+	checkPeriod = 1 * time.Minute
+	wgHandshakeOvertime = 1 * time.Second
+
+	mlog := log.WithField("peer", "tet")
+	// Use an old baseline so advance() yields a strictly newer handshake even on
+	// platforms with coarse clock resolution (Windows), where two time.Now() calls
+	// microseconds apart can return the same instant and read as a timed-out handshake.
+	stats := &mockHandshakeStats{handshake: time.Now().Add(-time.Hour)}
+	watcher := NewWGWatcher(mlog, stats, "", newStateDump("peer", mlog, &Status{}))
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	watcher.PrepareInitialHandshake()
+
+	firstHandshake := make(chan struct{}, 1)
+	checkSuccess := make(chan struct{}, 1)
+	go watcher.EnableWgWatcher(ctx, time.Now(), func() {}, func(when time.Time) {
+		firstHandshake <- struct{}{}
+	}, func() {
+		select {
+		case checkSuccess <- struct{}{}:
+		default:
+		}
+	})
+
+	stats.advance()
+
+	select {
+	case <-checkSuccess:
+	case <-time.After(10 * time.Second):
+		t.Errorf("timeout waiting for check success callback")
+	}
+
+	select {
+	case <-firstHandshake:
+		t.Errorf("first-handshake callback must not fire for a non-zero baseline")
+	default:
+	}
+}
+
 func TestWGWatcher_EnableWgWatcher(t *testing.T) {
 	checkPeriod = 5 * time.Second
 	wgHandshakeOvertime = 1 * time.Second
@@ -35,8 +100,7 @@ func TestWGWatcher_EnableWgWatcher(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()

-	ok := watcher.PrepareInitialHandshake()
-	require.True(t, ok, "watcher should not be enabled yet")
+	watcher.PrepareInitialHandshake()

 	onDisconnected := make(chan struct{}, 1)
 	go watcher.EnableWgWatcher(ctx, time.Now(), func() {
@@ -44,7 +108,7 @@ func TestWGWatcher_EnableWgWatcher(t *testing.T) {
 		onDisconnected <- struct{}{}
 	}, func(when time.Time) {
 		mlog.Infof("onHandshakeSuccess: %v", when)
-	})
+	}, nil)

 	// wait for initial reading
 	time.Sleep(2 * time.Second)
@@ -66,14 +130,13 @@ func TestWGWatcher_ReEnable(t *testing.T) {
 	watcher := NewWGWatcher(mlog, mocWgIface, "", newStateDump("peer", mlog, &Status{}))

 	ctx, cancel := context.WithCancel(context.Background())
-	ok := watcher.PrepareInitialHandshake()
-	require.True(t, ok, "watcher should not be enabled yet")
+	watcher.PrepareInitialHandshake()

 	wg := &sync.WaitGroup{}
 	wg.Add(1)
 	go func() {
 		defer wg.Done()
-		watcher.EnableWgWatcher(ctx, time.Now(), func() {}, func(when time.Time) {})
+		watcher.EnableWgWatcher(ctx, time.Now(), func() {}, func(when time.Time) {}, nil)
 	}()
 	cancel()

@@ -83,13 +146,12 @@ func TestWGWatcher_ReEnable(t *testing.T) {
 	ctx, cancel = context.WithCancel(context.Background())
 	defer cancel()

-	ok = watcher.PrepareInitialHandshake()
-	require.True(t, ok, "watcher should be re-enabled after the previous run stopped")
+	watcher.PrepareInitialHandshake()

 	onDisconnected := make(chan struct{}, 1)
 	go watcher.EnableWgWatcher(ctx, time.Now(), func() {
 		onDisconnected <- struct{}{}
-	}, func(when time.Time) {})
+	}, func(when time.Time) {}, nil)

 	time.Sleep(2 * time.Second)
 	mocWgIface.disconnect()
--- a/client/internal/profilemanager/config.go
+++ b/client/internal/profilemanager/config.go
@@ -102,6 +102,11 @@ type ConfigInput struct {
 	DNSLabels domain.List

 	MTU *uint16
+
+	// Owners replaces the profile's owner principal list when non-nil.
+	// Shared replaces the profile's shared flag when non-nil.
+	Owners []string
+	Shared *bool
 }

 // Config Configuration type
@@ -184,6 +189,16 @@ type Config struct {

 	MTU uint16

+	// Owners lists the principals allowed to control this profile over the local
+	// IPC, as typed strings: "uid:1000", "gid:1000", "group:netbird-admins"
+	// (Unix, NSS-resolved) or "sid:S-1-5-..." (Windows user or group SID). Empty
+	// with Shared=false means the profile is owned by nobody yet, until claimed
+	Owners []string `json:"Owners,omitempty"`
+
+	// Shared, when true, lets any authenticated local caller control this profile
+	// (opt-in). Takes precedence over Owners.
+	Shared bool `json:"Shared,omitempty"`
+
 	// policy is the MDM policy that produced the currently-set values for
 	// any MDM-enforced fields. Set by applyMDMPolicy at the tail of apply()
 	// and reset on every apply() invocation. Never persisted to disk.
@@ -642,6 +657,18 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}

+	if input.Owners != nil && !slices.Equal(config.Owners, input.Owners) {
+		log.Infof("updating profile owners to %v", input.Owners)
+		config.Owners = input.Owners
+		updated = true
+	}
+
+	if input.Shared != nil && *input.Shared != config.Shared {
+		log.Infof("updating profile shared flag to %t", *input.Shared)
+		config.Shared = *input.Shared
+		updated = true
+	}
+
 	// MDM is the last override layer: any key present in the policy
 	// supersedes defaults, on-disk config, env vars and CLI input.
 	config.applyMDMPolicy(loadMDMPolicy())
--- a/client/internal/profilemanager/service.go
+++ b/client/internal/profilemanager/service.go
@@ -11,6 +11,7 @@ import (
 	"runtime"
 	"sort"
 	"strings"
+	"syscall"

 	log "github.com/sirupsen/logrus"

@@ -295,7 +296,7 @@ func (s *ServiceManager) DefaultProfilePath() string {
 // The returned Profile carries the freshly-generated ID so callers can
 // show it to the user (and so the gRPC AddProfileResponse can include
 // it).
-func (s *ServiceManager) AddProfile(displayName, username string) (*Profile, error) {
+func (s *ServiceManager) AddProfile(displayName, username string, owners []string) (*Profile, error) {
 	configDir, err := s.getConfigDir(username)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get config directory: %w", err)
@@ -317,6 +318,9 @@ func (s *ServiceManager) AddProfile(displayName, username string) (*Profile, err
 		return nil, fmt.Errorf("failed to create new config: %w", err)
 	}
 	cfg.Name = displayName
+	// owners auto-isolates the new profile to its creator (nil = unowned, so the
+	// eventual first caller claims it via trust-on-first-use).
+	cfg.Owners = owners

 	if err := util.WriteJson(context.Background(), profPath, cfg); err != nil {
 		return nil, fmt.Errorf("failed to write profile config: %w", err)
@@ -439,7 +443,11 @@ func (s *ServiceManager) GetStatePath() string {

 	activeProf, err := s.GetActiveProfileState()
 	if err != nil {
-		log.Warnf("failed to get active profile state: %v", err)
+		if errors.Is(err, syscall.ENOSYS) {
+			log.Debugf("active profile state unavailable on this platform: %v", err)
+		} else {
+			log.Warnf("failed to get active profile state: %v", err)
+		}
 		return defaultStatePath
 	}

--- a/client/internal/profilemanager/service_test.go
+++ b/client/internal/profilemanager/service_test.go
@@ -32,7 +32,7 @@ func withTestSM(t *testing.T, fn func(sm *ServiceManager, username string)) {

 func TestServiceProfile_ExactID(t *testing.T) {
 	withTestSM(t, func(sm *ServiceManager, username string) {
-		created, err := sm.AddProfile("work", username)
+		created, err := sm.AddProfile("work", username, nil)
 		require.NoError(t, err)

 		got, err := sm.ResolveProfile(created.ID.String(), username)
@@ -44,7 +44,7 @@ func TestServiceProfile_ExactID(t *testing.T) {

 func TestServiceProfile_IDPrefix(t *testing.T) {
 	withTestSM(t, func(sm *ServiceManager, username string) {
-		created, err := sm.AddProfile("work", username)
+		created, err := sm.AddProfile("work", username, nil)
 		require.NoError(t, err)

 		prefix := created.ID[:4]
@@ -75,7 +75,7 @@ func TestServiceProfile_AmbiguousPrefix(t *testing.T) {

 func TestServiceProfile_ExactNameUnique(t *testing.T) {
 	withTestSM(t, func(sm *ServiceManager, username string) {
-		_, err := sm.AddProfile("work", username)
+		_, err := sm.AddProfile("work", username, nil)
 		require.NoError(t, err)

 		got, err := sm.ResolveProfile("work", username)
@@ -86,9 +86,9 @@ func TestServiceProfile_ExactNameUnique(t *testing.T) {

 func TestServiceProfile_AmbiguousName(t *testing.T) {
 	withTestSM(t, func(sm *ServiceManager, username string) {
-		_, err := sm.AddProfile("work", username)
+		_, err := sm.AddProfile("work", username, nil)
 		require.NoError(t, err)
-		_, err = sm.AddProfile("work", username)
+		_, err = sm.AddProfile("work", username, nil)
 		require.NoError(t, err)

 		_, err = sm.ResolveProfile("work", username)
@@ -133,10 +133,10 @@ func TestServiceProfile_LegacyFilenameCoexists(t *testing.T) {

 func TestAddProfile_AllowsDuplicateWithFlag(t *testing.T) {
 	withTestSM(t, func(sm *ServiceManager, username string) {
-		first, err := sm.AddProfile("work", username)
+		first, err := sm.AddProfile("work", username, nil)
 		require.NoError(t, err)

-		second, err := sm.AddProfile("work", username)
+		second, err := sm.AddProfile("work", username, nil)
 		require.NoError(t, err)
 		assert.NotEqual(t, first.ID, second.ID)
 		assert.Equal(t, "work", second.Name)
@@ -151,7 +151,7 @@ func TestAddProfile_RejectsInvalidNames(t *testing.T) {
 			strings.Repeat("a", maxProfileNameLen+1), // too long
 		}
 		for _, name := range cases {
-			_, err := sm.AddProfile(name, username)
+			_, err := sm.AddProfile(name, username, nil)
 			assert.Error(t, err, "expected error for %q", name)
 		}
 	})
@@ -215,7 +215,7 @@ func TestIsValidProfileFilenameStem(t *testing.T) {

 func TestRemoveProfile_DeletesStateFile(t *testing.T) {
 	withTestSM(t, func(sm *ServiceManager, username string) {
-		created, err := sm.AddProfile("work", username)
+		created, err := sm.AddProfile("work", username, nil)
 		require.NoError(t, err)

 		configDir, err := sm.getConfigDir(username)
--- a/client/internal/rosenpass/manager.go
+++ b/client/internal/rosenpass/manager.go
@@ -39,6 +39,7 @@ type rpServer interface {

 type Manager struct {
 	ifaceName    string
+	localWgKey   wgtypes.Key
 	spk          []byte
 	ssk          []byte
 	rpKeyHash    string
@@ -51,8 +52,9 @@ type Manager struct {
 	wgIface      PresharedKeySetter
 }

-// NewManager creates a new Rosenpass manager
-func NewManager(preSharedKey *wgtypes.Key, wgIfaceName string) (*Manager, error) {
+// NewManager creates a new Rosenpass manager. localWgKey is the local
+// WireGuard public key, used to derive the per-peer rendezvous key.
+func NewManager(preSharedKey *wgtypes.Key, wgIfaceName string, localWgKey wgtypes.Key) (*Manager, error) {
 	public, secret, err := rp.GenerateKeyPair()
 	if err != nil {
 		return nil, err
@@ -62,6 +64,7 @@ func NewManager(preSharedKey *wgtypes.Key, wgIfaceName string) (*Manager, error)
 	log.Tracef("generated new rosenpass key pair with public key %s", rpKeyHash)
 	return &Manager{
 		ifaceName:    wgIfaceName,
+		localWgKey:   localWgKey,
 		rpKeyHash:    rpKeyHash,
 		spk:          public,
 		ssk:          secret,
@@ -73,7 +76,7 @@ func NewManager(preSharedKey *wgtypes.Key, wgIfaceName string) (*Manager, error)
 		// nil receiver in addPeer -> m.rpWgHandler.AddPeer. generateConfig will
 		// replace it with a fresh handler on each Run() to clear stale peer
 		// state from previous engine sessions.
-		rpWgHandler: NewNetbirdHandler(),
+		rpWgHandler: NewNetbirdHandler((*[32]byte)(preSharedKey), localWgKey),
 		lock:        sync.Mutex{},
 	}, nil
 }
@@ -161,7 +164,7 @@ func (m *Manager) generateConfig() (rp.Config, error) {
 	cfg.Peers = []rp.PeerConfig{}

 	m.lock.Lock()
-	m.rpWgHandler = NewNetbirdHandler()
+	m.rpWgHandler = NewNetbirdHandler(m.preSharedKey, m.localWgKey)
 	if m.wgIface != nil {
 		m.rpWgHandler.SetInterface(m.wgIface)
 	}
--- a/client/internal/rosenpass/manager_test.go
+++ b/client/internal/rosenpass/manager_test.go
@@ -85,7 +85,7 @@ func newTestManager(spkFirstByte byte, mock *mockServer) *Manager {
 		ssk:         make([]byte, 32),
 		rpKeyHash:   "test-hash",
 		rpPeerIDs:   make(map[string]*rp.PeerID),
-		rpWgHandler: NewNetbirdHandler(),
+		rpWgHandler: NewNetbirdHandler(nil, wgtypes.Key{0x01}),
 		server:      mock,
 	}
 }
@@ -255,7 +255,7 @@ func TestAddPeer_NilServer_ReturnsErrorNoCrash(t *testing.T) {
 // issue #4341 cannot occur in the window between NewManager and Run().
 func TestNewManager_PreInitializesHandler(t *testing.T) {
 	psk := wgtypes.Key{}
-	m, err := NewManager(&psk, "wt0")
+	m, err := NewManager(&psk, "wt0", wgtypes.Key{0x01})
 	require.NoError(t, err)
 	require.NotNil(t, m.rpWgHandler, "rpWgHandler must be initialized in NewManager")
 }
@@ -329,10 +329,10 @@ func TestIsPresharedKeyInitialized_AddedButNotHandshaken_ReturnsFalse(t *testing
 	require.False(t, m.IsPresharedKeyInitialized(wgKey))
 }

-// --- NetbirdHandler.outputKey ----------------------------------------------
+// --- NetbirdHandler.applyKey ----------------------------------------------

-func TestHandler_OutputKey_FirstCallUsesUpdateOnlyFalse(t *testing.T) {
-	h := NewNetbirdHandler()
+func TestHandler_ApplyKey_FirstCallUsesUpdateOnlyFalse(t *testing.T) {
+	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
 	iface := &mockIface{}
 	h.SetInterface(iface)

@@ -348,8 +348,8 @@ func TestHandler_OutputKey_FirstCallUsesUpdateOnlyFalse(t *testing.T) {
 	require.Equal(t, wgKey.String(), iface.calls[0].peerKey)
 }

-func TestHandler_OutputKey_SubsequentCallsUseUpdateOnlyTrue(t *testing.T) {
-	h := NewNetbirdHandler()
+func TestHandler_ApplyKey_SubsequentCallsUseUpdateOnlyTrue(t *testing.T) {
+	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
 	iface := &mockIface{}
 	h.SetInterface(iface)

@@ -364,8 +364,8 @@ func TestHandler_OutputKey_SubsequentCallsUseUpdateOnlyTrue(t *testing.T) {
 	require.True(t, iface.calls[1].updateOnly, "subsequent rotations must use updateOnly=true")
 }

-func TestHandler_OutputKey_NilInterface_NoCrashNoCall(t *testing.T) {
-	h := NewNetbirdHandler()
+func TestHandler_ApplyKey_NilInterface_NoCrashNoCall(t *testing.T) {
+	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
 	// no SetInterface — iface remains nil
 	pid := rp.PeerID{0x03}
 	h.AddPeer(pid, "wt0", rp.Key(wgtypes.Key{}))
@@ -374,8 +374,8 @@ func TestHandler_OutputKey_NilInterface_NoCrashNoCall(t *testing.T) {
 	h.HandshakeCompleted(pid, rp.Key{})
 }

-func TestHandler_OutputKey_UnknownPeer_NoCall(t *testing.T) {
-	h := NewNetbirdHandler()
+func TestHandler_ApplyKey_UnknownPeer_NoCall(t *testing.T) {
+	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
 	iface := &mockIface{}
 	h.SetInterface(iface)

@@ -384,7 +384,7 @@ func TestHandler_OutputKey_UnknownPeer_NoCall(t *testing.T) {
 }

 func TestHandler_RemovePeer_ClearsInitializedState(t *testing.T) {
-	h := NewNetbirdHandler()
+	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
 	iface := &mockIface{}
 	h.SetInterface(iface)

@@ -398,7 +398,7 @@ func TestHandler_RemovePeer_ClearsInitializedState(t *testing.T) {
 }

 func TestHandler_SetInterfaceAfterAddPeer_StillReceivesKey(t *testing.T) {
-	h := NewNetbirdHandler()
+	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
 	pid := rp.PeerID{0x05}
 	wgKey := wgtypes.Key{0xEE}
 	h.AddPeer(pid, "wt0", rp.Key(wgKey))
--- a/client/internal/rosenpass/netbird_handler.go
+++ b/client/internal/rosenpass/netbird_handler.go
@@ -18,19 +18,34 @@ type PresharedKeySetter interface {
 type wireGuardPeer struct {
 	Interface string
 	PublicKey rp.Key
+	// initialized is true once a completed exchange has set a
+	// Rosenpass-managed PSK for this peer.
+	initialized bool
+	// chainKey is the key output by the last completed exchange, advanced by
+	// one ratchet step on expiry. Nil until the first exchange completes and
+	// after the peer has fallen back to the rendezvous key.
+	chainKey *wgtypes.Key
+	// expiries counts failed renewals since the last completed exchange.
+	expiries int
 }

 type NetbirdHandler struct {
-	mu               sync.Mutex
-	iface            PresharedKeySetter
-	peers            map[rp.PeerID]wireGuardPeer
-	initializedPeers map[rp.PeerID]bool
+	mu    sync.Mutex
+	iface PresharedKeySetter
+	// preSharedKey is the account-level preshared key, used as the rendezvous
+	// key when set. Nil means the deterministic seed key is used instead.
+	preSharedKey *[32]byte
+	// localWgKey is the local WireGuard public key, one of the two inputs to
+	// the deterministic seed key.
+	localWgKey wgtypes.Key
+	peers      map[rp.PeerID]*wireGuardPeer
 }

-func NewNetbirdHandler() *NetbirdHandler {
+func NewNetbirdHandler(preSharedKey *[32]byte, localWgKey wgtypes.Key) *NetbirdHandler {
 	return &NetbirdHandler{
-		peers:            map[rp.PeerID]wireGuardPeer{},
-		initializedPeers: map[rp.PeerID]bool{},
+		preSharedKey: preSharedKey,
+		localWgKey:   localWgKey,
+		peers:        map[rp.PeerID]*wireGuardPeer{},
 	}
 }

@@ -42,10 +57,16 @@ func (h *NetbirdHandler) SetInterface(iface PresharedKeySetter) {
 	h.iface = iface
 }

+// AddPeer registers a peer with the handler. Re-adding a known peer (every
+// reconnection does) keeps its key recovery state.
 func (h *NetbirdHandler) AddPeer(pid rp.PeerID, intf string, pk rp.Key) {
 	h.mu.Lock()
 	defer h.mu.Unlock()
-	h.peers[pid] = wireGuardPeer{
+	if existing, ok := h.peers[pid]; ok && existing.PublicKey == pk {
+		existing.Interface = intf
+		return
+	}
+	h.peers[pid] = &wireGuardPeer{
 		Interface: intf,
 		PublicKey: pk,
 	}
@@ -55,7 +76,6 @@ func (h *NetbirdHandler) RemovePeer(pid rp.PeerID) {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 	delete(h.peers, pid)
-	delete(h.initializedPeers, pid)
 }

 // IsPeerInitialized returns true if Rosenpass has completed a handshake
@@ -63,50 +83,120 @@ func (h *NetbirdHandler) RemovePeer(pid rp.PeerID) {
 func (h *NetbirdHandler) IsPeerInitialized(pid rp.PeerID) bool {
 	h.mu.Lock()
 	defer h.mu.Unlock()
-	return h.initializedPeers[pid]
+	peer, ok := h.peers[pid]
+	return ok && peer.initialized
 }

+// HandshakeCompleted programs the freshly exchanged output key and resets the
+// peer's key recovery state.
 func (h *NetbirdHandler) HandshakeCompleted(pid rp.PeerID, key rp.Key) {
-	h.outputKey(rp.KeyOutputReasonStale, pid, key)
-}
+	psk := wgtypes.Key(key)

-func (h *NetbirdHandler) HandshakeExpired(pid rp.PeerID) {
-	key, _ := rp.GeneratePresharedKey()
-	h.outputKey(rp.KeyOutputReasonStale, pid, key)
-}
-
-func (h *NetbirdHandler) outputKey(_ rp.KeyOutputReason, pid rp.PeerID, psk rp.Key) {
 	h.mu.Lock()
-	iface := h.iface
-	wg, ok := h.peers[pid]
-	isInitialized := h.initializedPeers[pid]
-	h.mu.Unlock()
+	defer h.mu.Unlock()

-	if iface == nil {
-		log.Warn("rosenpass: interface not set, cannot update preshared key")
+	peer, ok := h.peers[pid]
+	if !ok {
 		return
 	}
+	if peer.expiries > 0 {
+		log.Infof("rosenpass exchange completed for peer %s after %d expired renewals", wgtypes.Key(peer.PublicKey), peer.expiries)
+	}
+	// chainKey tracks the shared exchange output regardless of the local write
+	// outcome, so both ends still converge on the next expiry.
+	peer.chainKey = &psk
+	peer.expiries = 0
+	if !h.applyKeyLocked(pid, psk, peer.initialized) {
+		return
+	}
+	peer.initialized = true
+}

+// HandshakeExpired replaces the expired key. The renewal exchange runs over
+// the tunnel keyed by the PSK itself, so the replacement must be derivable on
+// both ends without communication: the first expiry ratchets the last shared
+// key forward, repeated expiries (and expiries without a completed exchange)
+// fall back to the rendezvous key and drop the peer out of the initialized
+// state so connection reconfigurations reprogram the rendezvous key as well.
+func (h *NetbirdHandler) HandshakeExpired(pid rp.PeerID) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+
+	peer, ok := h.peers[pid]
 	if !ok {
 		return
 	}

-	peerKey := wgtypes.Key(wg.PublicKey).String()
-	pskKey := wgtypes.Key(psk)
+	peer.expiries++

-	// Use updateOnly=true for later rotations (peer already has Rosenpass PSK)
-	// Use updateOnly=false for first rotation (peer has original/empty PSK)
-	if err := iface.SetPresharedKey(peerKey, pskKey, isInitialized); err != nil {
+	var psk wgtypes.Key
+	if peer.chainKey != nil && peer.expiries == 1 {
+		log.Infof("rosenpass key for peer %s expired without renewal, advancing to ratcheted key", wgtypes.Key(peer.PublicKey))
+		psk = RatchetKey(*peer.chainKey)
+		peer.chainKey = &psk
+	} else {
+		rendezvous, err := h.rendezvousKey(peer)
+		if err != nil {
+			// Fail closed: without a rendezvous key the expired key must
+			// still be rotated out, even if the replacement is unusable.
+			log.Errorf("failed to derive rendezvous key, replacing expired key with a random one: %v", err)
+			h.applyRandomKeyLocked(pid)
+			return
+		}
+		log.Warnf("rosenpass key for peer %s expired %d times without renewal, falling back to the rendezvous key", wgtypes.Key(peer.PublicKey), peer.expiries)
+		psk = rendezvous
+		peer.chainKey = nil
+		peer.initialized = false
+	}
+
+	h.applyKeyLocked(pid, psk, true)
+}
+
+// rendezvousKey returns the key both ends converge on without communication:
+// the account-level preshared key when configured, the deterministic seed key
+// otherwise. It mirrors the key that peer connections program when Rosenpass
+// does not manage the peer yet.
+func (h *NetbirdHandler) rendezvousKey(peer *wireGuardPeer) (wgtypes.Key, error) {
+	if h.preSharedKey != nil {
+		return *h.preSharedKey, nil
+	}
+
+	seed, err := DeterministicSeedKey(h.localWgKey.String(), wgtypes.Key(peer.PublicKey).String())
+	if err != nil {
+		return wgtypes.Key{}, err
+	}
+	return *seed, nil
+}
+
+// applyKeyLocked writes the preshared key for the peer to the WireGuard
+// interface and reports whether the write succeeded. Callers must hold h.mu
+// for the whole state-mutation-plus-write so that a concurrent completion and
+// expiry cannot reorder their writes relative to the in-memory chain key.
+func (h *NetbirdHandler) applyKeyLocked(pid rp.PeerID, psk wgtypes.Key, updateOnly bool) bool {
+	peer, ok := h.peers[pid]
+	if !ok {
+		return false
+	}
+
+	if h.iface == nil {
+		log.Warn("rosenpass: interface not set, cannot update preshared key")
+		return false
+	}
+
+	peerKey := wgtypes.Key(peer.PublicKey).String()
+	if err := h.iface.SetPresharedKey(peerKey, psk, updateOnly); err != nil {
 		log.Errorf("Failed to apply rosenpass key: %v", err)
+		return false
+	}
+
+	return true
+}
+
+func (h *NetbirdHandler) applyRandomKeyLocked(pid rp.PeerID) {
+	key, err := rp.GeneratePresharedKey()
+	if err != nil {
+		log.Errorf("failed to generate random preshared key: %v", err)
 		return
 	}
-
-	// Mark peer as isInitialized after the successful first rotation
-	if !isInitialized {
-		h.mu.Lock()
-		if _, exists := h.peers[pid]; exists {
-			h.initializedPeers[pid] = true
-		}
-		h.mu.Unlock()
-	}
+	h.applyKeyLocked(pid, wgtypes.Key(key), true)
 }
--- a/client/internal/rosenpass/netbird_handler_test.go
+++ b/client/internal/rosenpass/netbird_handler_test.go
@@ -0,0 +1,250 @@
+package rosenpass
+
+import (
+	"testing"
+
+	rp "cunicu.li/go-rosenpass"
+	"github.com/stretchr/testify/require"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
+// handlerTestLink wires two NetbirdHandlers as the two ends of a single
+// tunnel: handler A manages the rosenpass peer B and vice versa, the way two
+// NetBird clients see each other.
+type handlerTestLink struct {
+	handlerA, handlerB *NetbirdHandler
+	ifaceA, ifaceB     *mockIface
+	pidA, pidB         rp.PeerID
+	wgKeyA, wgKeyB     wgtypes.Key
+}
+
+func newHandlerTestLink(t *testing.T, preSharedKey *[32]byte) *handlerTestLink {
+	t.Helper()
+
+	link := &handlerTestLink{
+		ifaceA: &mockIface{},
+		ifaceB: &mockIface{},
+	}
+	link.pidA[0] = 0xaa
+	link.pidB[0] = 0xbb
+	link.wgKeyA[31] = 1
+	link.wgKeyB[31] = 2
+
+	link.handlerA = NewNetbirdHandler(preSharedKey, link.wgKeyA)
+	link.handlerB = NewNetbirdHandler(preSharedKey, link.wgKeyB)
+
+	link.handlerA.SetInterface(link.ifaceA)
+	link.handlerB.SetInterface(link.ifaceB)
+
+	link.handlerA.AddPeer(link.pidB, "wt0", rp.Key(link.wgKeyB))
+	link.handlerB.AddPeer(link.pidA, "wt0", rp.Key(link.wgKeyA))
+
+	return link
+}
+
+// complete simulates a completed rosenpass exchange: both ends derive the
+// same output key.
+func (l *handlerTestLink) complete(osk rp.Key) {
+	l.handlerA.HandshakeCompleted(l.pidB, osk)
+	l.handlerB.HandshakeCompleted(l.pidA, osk)
+}
+
+// expire simulates a failed key renewal on both ends.
+func (l *handlerTestLink) expire() {
+	l.handlerA.HandshakeExpired(l.pidB)
+	l.handlerB.HandshakeExpired(l.pidA)
+}
+
+func lastPSK(t *testing.T, m *mockIface) wgtypes.Key {
+	t.Helper()
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	require.NotEmpty(t, m.calls, "expected at least one SetPresharedKey call")
+	return m.calls[len(m.calls)-1].psk
+}
+
+func TestHandshakeCompleted_SetsKeyAndInitializes(t *testing.T) {
+	link := newHandlerTestLink(t, nil)
+
+	var osk rp.Key
+	osk[0] = 0x42
+	link.complete(osk)
+
+	require.Equal(t, wgtypes.Key(osk), lastPSK(t, link.ifaceA), "completed exchange must program the osk")
+	require.False(t, link.ifaceA.calls[0].updateOnly, "first rotation must not be update-only")
+	require.True(t, link.handlerA.IsPeerInitialized(link.pidB), "peer must be initialized after first completed exchange")
+
+	link.complete(osk)
+	require.True(t, link.ifaceA.calls[1].updateOnly, "later rotations must be update-only")
+}
+
+// TestHandshakeExpired_BothSidesConverge encodes the core recovery invariant:
+// rosenpass renewals run over the tunnel that the PSK itself keys, so when a
+// renewal fails on both ends, both ends must fall back to the same key or the
+// tunnel can never handshake again.
+func TestHandshakeExpired_BothSidesConverge(t *testing.T) {
+	link := newHandlerTestLink(t, nil)
+
+	var osk rp.Key
+	osk[0] = 0x42
+	link.complete(osk)
+
+	link.expire()
+	keyA := lastPSK(t, link.ifaceA)
+	keyB := lastPSK(t, link.ifaceB)
+	require.NotEqual(t, wgtypes.Key(osk), keyA, "expired key must be rotated out")
+	require.Equal(t, keyA, keyB, "both ends must converge on the same key after expiry")
+
+	link.expire()
+	require.Equal(t, lastPSK(t, link.ifaceA), lastPSK(t, link.ifaceB),
+		"both ends must still converge after repeated expiries")
+}
+
+// TestHandshakeExpired_ExpiryWithoutCompletionConverges covers the bootstrap
+// case: the initial exchange never completed (the tunnel ran on the rendezvous
+// key), so an expiry must not replace the working key with an unrecoverable
+// one on either end.
+func TestHandshakeExpired_ExpiryWithoutCompletionConverges(t *testing.T) {
+	link := newHandlerTestLink(t, nil)
+
+	link.expire()
+	require.Equal(t, lastPSK(t, link.ifaceA), lastPSK(t, link.ifaceB),
+		"both ends must converge when the exchange never completed")
+}
+
+// TestHandshakeExpired_RepeatedExpiryClearsInitialized: once renewals keep
+// failing, the peer must drop out of the initialized state so the next
+// connection reconfiguration reprograms the rendezvous key instead of
+// preserving a poisoned rosenpass-managed key.
+func TestHandshakeExpired_RepeatedExpiryClearsInitialized(t *testing.T) {
+	link := newHandlerTestLink(t, nil)
+
+	var osk rp.Key
+	osk[0] = 0x42
+	link.complete(osk)
+
+	link.expire()
+	link.expire()
+
+	require.False(t, link.handlerA.IsPeerInitialized(link.pidB),
+		"repeated expiries must clear the initialized state")
+	require.False(t, link.handlerB.IsPeerInitialized(link.pidA),
+		"repeated expiries must clear the initialized state")
+}
+
+// TestHandshakeCompleted_AfterExpiryRecovers: a completed exchange after a
+// desync must fully reset the recovery state.
+func TestHandshakeCompleted_AfterExpiryRecovers(t *testing.T) {
+	link := newHandlerTestLink(t, nil)
+
+	var osk1, osk2 rp.Key
+	osk1[0] = 1
+	osk2[0] = 2
+
+	link.complete(osk1)
+	link.expire()
+	link.expire()
+
+	link.complete(osk2)
+	require.Equal(t, wgtypes.Key(osk2), lastPSK(t, link.ifaceA), "new exchange must program the fresh osk")
+	require.True(t, link.handlerA.IsPeerInitialized(link.pidB), "peer must be initialized again after recovery")
+
+	link.expire()
+	require.Equal(t, lastPSK(t, link.ifaceA), lastPSK(t, link.ifaceB),
+		"recovered link must converge again on the next expiry")
+	require.NotEqual(t, wgtypes.Key(osk2), lastPSK(t, link.ifaceA), "expired key must be rotated out")
+}
+
+// TestHandshakeExpired_FirstExpiryRatchetsLastKey: the first expiry must
+// derive the replacement from the last shared key, so an attacker who only
+// blocks the renewal exchange gains nothing over the previous key.
+func TestHandshakeExpired_FirstExpiryRatchetsLastKey(t *testing.T) {
+	link := newHandlerTestLink(t, nil)
+
+	var osk rp.Key
+	osk[0] = 0x42
+	link.complete(osk)
+
+	link.expire()
+	require.Equal(t, RatchetKey(wgtypes.Key(osk)), lastPSK(t, link.ifaceA),
+		"first expiry must program the ratcheted key")
+	require.True(t, link.handlerA.IsPeerInitialized(link.pidB),
+		"ratchet step must keep the peer initialized so reconfigurations preserve the key")
+}
+
+// TestHandshakeExpired_RepeatedExpiryFallsBackToSeed: once the ratchet key
+// also fails, both ends must land on the same key that peer connections
+// program for uninitialized peers, so a reconnect completes the recovery.
+func TestHandshakeExpired_RepeatedExpiryFallsBackToSeed(t *testing.T) {
+	link := newHandlerTestLink(t, nil)
+
+	var osk rp.Key
+	osk[0] = 0x42
+	link.complete(osk)
+
+	link.expire()
+	link.expire()
+
+	seed, err := DeterministicSeedKey(link.wgKeyA.String(), link.wgKeyB.String())
+	require.NoError(t, err)
+	require.Equal(t, *seed, lastPSK(t, link.ifaceA), "repeated expiry must fall back to the seed key")
+	require.Equal(t, *seed, lastPSK(t, link.ifaceB), "repeated expiry must fall back to the seed key")
+}
+
+// TestHandshakeExpired_ConfiguredPSKUsedAsRendezvous: with an account-level
+// preshared key configured, the fallback must be that key, matching what peer
+// connections program for uninitialized peers.
+func TestHandshakeExpired_ConfiguredPSKUsedAsRendezvous(t *testing.T) {
+	psk := &[32]byte{0x77}
+	link := newHandlerTestLink(t, psk)
+
+	var osk rp.Key
+	osk[0] = 0x42
+	link.complete(osk)
+
+	link.expire()
+	link.expire()
+
+	require.Equal(t, wgtypes.Key(*psk), lastPSK(t, link.ifaceA),
+		"fallback must be the configured preshared key")
+	require.Equal(t, wgtypes.Key(*psk), lastPSK(t, link.ifaceB),
+		"fallback must be the configured preshared key on both ends")
+}
+
+// TestHandshakeExpired_ExpiryWritesAreUpdateOnly: expiry replacements must
+// never create a WireGuard peer that connection management has removed.
+func TestHandshakeExpired_ExpiryWritesAreUpdateOnly(t *testing.T) {
+	link := newHandlerTestLink(t, nil)
+
+	var osk rp.Key
+	osk[0] = 0x42
+	link.complete(osk)
+
+	link.expire()
+	link.expire()
+
+	for _, call := range link.ifaceA.calls[1:] {
+		require.True(t, call.updateOnly, "expiry writes must be update-only")
+	}
+}
+
+// TestAddPeer_ReAddKeepsRecoveryState: reconnections re-add the peer on every
+// OnConnected; that must not reset the expiry chain state.
+func TestAddPeer_ReAddKeepsRecoveryState(t *testing.T) {
+	link := newHandlerTestLink(t, nil)
+
+	var osk rp.Key
+	osk[0] = 0x42
+	link.complete(osk)
+	link.expire()
+
+	link.handlerA.AddPeer(link.pidB, "wt0", rp.Key(link.wgKeyB))
+	require.True(t, link.handlerA.IsPeerInitialized(link.pidB),
+		"re-adding a known peer must keep its state")
+
+	link.expire()
+	seed, err := DeterministicSeedKey(link.wgKeyA.String(), link.wgKeyB.String())
+	require.NoError(t, err)
+	require.Equal(t, *seed, lastPSK(t, link.ifaceA),
+		"second expiry after re-add must continue to the seed fallback")
+}
--- a/client/internal/rosenpass/seed.go
+++ b/client/internal/rosenpass/seed.go
@@ -1,11 +1,28 @@
 package rosenpass

 import (
+	"crypto/sha256"
 	"fmt"

 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )

+// ratchetLabel domain-separates the expiry ratchet from other uses of the
+// rosenpass output key.
+const ratchetLabel = "netbird-rosenpass-expiry-ratchet"
+
+// RatchetKey derives the successor preshared key from the previous Rosenpass
+// output key. When a key expires without a completed renewal, both peers
+// advance their last shared key by one ratchet step: the expired key is
+// rotated out while both ends still converge on an identical, non-public
+// replacement without communicating.
+func RatchetKey(prev wgtypes.Key) wgtypes.Key {
+	input := make([]byte, 0, len(ratchetLabel)+len(prev))
+	input = append(input, ratchetLabel...)
+	input = append(input, prev[:]...)
+	return sha256.Sum256(input)
+}
+
 // DeterministicSeedKey derives a 32-byte WireGuard preshared key from a pair
 // of peer public keys. Both peers, given the same key pair, produce the same
 // output regardless of which side runs the function: the inputs are ordered
--- a/client/internal/routemanager/dynamic/route.go
+++ b/client/internal/routemanager/dynamic/route.go
@@ -185,7 +185,7 @@ func (r *Route) startResolver(ctx context.Context) {
 }

 func (r *Route) update(ctx context.Context) error {
-	resolved, err := r.resolveDomains()
+	resolved, err := r.resolveDomains(ctx)
 	if err != nil {
 		if len(resolved) == 0 {
 			return fmt.Errorf("resolve domains: %w", err)
@@ -199,9 +199,9 @@ func (r *Route) update(ctx context.Context) error {
 	return nil
 }

-func (r *Route) resolveDomains() (domainMap, error) {
+func (r *Route) resolveDomains(ctx context.Context) (domainMap, error) {
 	results := make(chan resolveResult)
-	go r.resolve(results)
+	go r.resolve(ctx, results)

 	resolved := domainMap{}
 	var merr *multierror.Error
@@ -217,7 +217,7 @@ func (r *Route) resolveDomains() (domainMap, error) {
 	return resolved, nberrors.FormatErrorOrNil(merr)
 }

-func (r *Route) resolve(results chan resolveResult) {
+func (r *Route) resolve(ctx context.Context, results chan resolveResult) {
 	var wg sync.WaitGroup

 	for _, d := range r.route.Domains {
@@ -225,10 +225,10 @@ func (r *Route) resolve(results chan resolveResult) {
 		go func(domain domain.Domain) {
 			defer wg.Done()

-			ips, err := r.getIPsFromResolver(domain)
+			ips, err := r.getIPsFromResolver(ctx, domain)
 			if err != nil {
 				log.Tracef("Failed to resolve domain %s with private resolver: %v", domain.SafeString(), err)
-				ips, err = net.LookupIP(domain.PunycodeString())
+				ips, err = lookupHostIPs(ctx, domain)
 				if err != nil {
 					results <- resolveResult{domain: domain, err: fmt.Errorf("resolve d %s: %w", domain.SafeString(), err)}
 					return
@@ -364,6 +364,20 @@ func determinePrefixChanges(oldPrefixes, newPrefixes []netip.Prefix) (toAdd, toR
 	return
 }

+// lookupHostIPs resolves d via the system resolver, honoring ctx cancellation.
+func lookupHostIPs(ctx context.Context, d domain.Domain) ([]net.IP, error) {
+	addrs, err := net.DefaultResolver.LookupIPAddr(ctx, d.PunycodeString())
+	if err != nil {
+		return nil, err
+	}
+
+	ips := make([]net.IP, 0, len(addrs))
+	for _, addr := range addrs {
+		ips = append(ips, addr.IP)
+	}
+	return ips, nil
+}
+
 func combinePrefixes(oldPrefixes, removedPrefixes, addedPrefixes []netip.Prefix) []netip.Prefix {
 	prefixSet := make(map[netip.Prefix]struct{})
 	for _, prefix := range oldPrefixes {
--- a/client/internal/routemanager/dynamic/route_generic.go
+++ b/client/internal/routemanager/dynamic/route_generic.go
@@ -3,11 +3,12 @@
 package dynamic

 import (
+	"context"
 	"net"

 	"github.com/netbirdio/netbird/shared/management/domain"
 )

-func (r *Route) getIPsFromResolver(domain domain.Domain) ([]net.IP, error) {
-	return net.LookupIP(domain.PunycodeString())
+func (r *Route) getIPsFromResolver(ctx context.Context, domain domain.Domain) ([]net.IP, error) {
+	return lookupHostIPs(ctx, domain)
 }
--- a/client/internal/routemanager/dynamic/route_ios.go
+++ b/client/internal/routemanager/dynamic/route_ios.go
@@ -3,6 +3,7 @@
 package dynamic

 import (
+	"context"
 	"fmt"
 	"net"
 	"time"
@@ -16,7 +17,7 @@ import (

 const dialTimeout = 10 * time.Second

-func (r *Route) getIPsFromResolver(domain domain.Domain) ([]net.IP, error) {
+func (r *Route) getIPsFromResolver(ctx context.Context, domain domain.Domain) ([]net.IP, error) {
 	privateClient, err := nbdns.GetClientPrivate(r.wgInterface, r.resolverAddr.Addr(), dialTimeout)
 	if err != nil {
 		return nil, fmt.Errorf("error while creating private client: %s", err)
@@ -32,7 +33,7 @@ func (r *Route) getIPsFromResolver(domain domain.Domain) ([]net.IP, error) {
 		msg := new(dns.Msg)
 		msg.SetQuestion(fqdn, qtype)

-		response, _, err := nbdns.ExchangeWithFallback(nil, privateClient, msg, r.resolverAddr.String())
+		response, _, err := nbdns.ExchangeWithFallback(ctx, privateClient, msg, r.resolverAddr.String())
 		if err != nil {
 			if queryErr == nil {
 				queryErr = fmt.Errorf("DNS query for %s (type %d) after %s: %w", domain.SafeString(), qtype, time.Since(startTime), err)
--- a/client/internal/routemanager/manager.go
+++ b/client/internal/routemanager/manager.go
@@ -12,6 +12,7 @@ import (
 	"strings"
 	"sync"
 	"sync/atomic"
+	"syscall"
 	"time"

 	"github.com/google/uuid"
@@ -264,7 +265,11 @@ func (m *DefaultManager) initSelector() *routeselector.RouteSelector {

 	// restore selector state if it exists
 	if err := m.stateManager.LoadState(state); err != nil {
-		log.Warnf("failed to load state: %v", err)
+		if errors.Is(err, syscall.ENOSYS) {
+			log.Debugf("route selector state unavailable on this platform: %v", err)
+		} else {
+			log.Warnf("failed to load state: %v", err)
+		}
 		return routeselector.NewRouteSelector()
 	}

--- a/client/internal/shell/getent_cgo_unix.go
+++ b/client/internal/shell/getent_cgo_unix.go
@@ -0,0 +1,29 @@
+//go:build cgo && !osusergo && !windows
+
+package shell
+
+import "os/user"
+
+// LookupWithGetent with CGO delegates directly to os/user.Lookup.
+// When CGO is enabled, os/user uses libc (getpwnam_r) which goes through
+// the NSS stack natively. If it fails, the user truly doesn't exist and
+// getent would also fail.
+func LookupWithGetent(username string) (*user.User, error) {
+	return user.Lookup(username)
+}
+
+// CurrentUserWithGetent with CGO delegates directly to os/user.Current.
+func CurrentUserWithGetent() (*user.User, error) {
+	return user.Current()
+}
+
+// LookupGroupWithGetent returns the resolved group from either a gid or groupname.
+func LookupGroupWithGetent(name string) (*user.Group, error) {
+	return user.LookupGroup(name)
+}
+
+// GroupIdsWithFallback with CGO delegates directly to user.GroupIds.
+// libc's getgrouplist handles NSS groups natively.
+func GroupIdsWithFallback(u *user.User) ([]string, error) {
+	return u.GroupIds()
+}
--- a/client/internal/shell/getent_nocgo_unix.go
+++ b/client/internal/shell/getent_nocgo_unix.go
@@ -1,6 +1,6 @@
 //go:build (!cgo || osusergo) && !windows

-package server
+package shell

 import (
 	"os"
@@ -10,10 +10,10 @@ import (
 	log "github.com/sirupsen/logrus"
 )

-// lookupWithGetent looks up a user by name, falling back to getent if os/user fails.
+// LookupWithGetent looks up a user by name, falling back to getent if os/user fails.
 // Without CGO, os/user only reads /etc/passwd and misses NSS-provided users.
 // getent goes through the host's NSS stack.
-func lookupWithGetent(username string) (*user.User, error) {
+func LookupWithGetent(username string) (*user.User, error) {
 	u, err := user.Lookup(username)
 	if err == nil {
 		return u, nil
@@ -22,7 +22,7 @@ func lookupWithGetent(username string) (*user.User, error) {
 	stdErr := err
 	log.Debugf("os/user.Lookup(%q) failed, trying getent: %v", username, err)

-	u, _, getentErr := runGetent(username)
+	u, _, getentErr := runGetentPasswd(username)
 	if getentErr != nil {
 		log.Debugf("getent fallback for %q also failed: %v", username, getentErr)
 		return nil, stdErr
@@ -31,8 +31,26 @@ func lookupWithGetent(username string) (*user.User, error) {
 	return u, nil
 }

-// currentUserWithGetent gets the current user, falling back to getent if os/user fails.
-func currentUserWithGetent() (*user.User, error) {
+// LookupGroupWithGetent returns the resolved group from either a gid or groupname,
+// falling back to getent if os/user fails (NSS groups under nocgo).
+func LookupGroupWithGetent(name string) (*user.Group, error) {
+	g, err := user.LookupGroup(name)
+	if err == nil {
+		return g, nil
+	}
+
+	stdErr := err
+	log.Debugf("os/user.LookupGroup(%q) failed, trying getent: %v", name, err)
+	g, getentErr := runGetentGroup(name)
+	if getentErr != nil {
+		log.Debugf("getent fallback for %q also failed: %v", name, getentErr)
+		return nil, stdErr
+	}
+	return g, nil
+}
+
+// CurrentUserWithGetent gets the current user, falling back to getent if os/user fails.
+func CurrentUserWithGetent() (*user.User, error) {
 	u, err := user.Current()
 	if err == nil {
 		return u, nil
@@ -42,7 +60,7 @@ func currentUserWithGetent() (*user.User, error) {
 	uid := strconv.Itoa(os.Getuid())
 	log.Debugf("os/user.Current() failed, trying getent with UID %s: %v", uid, err)

-	u, _, getentErr := runGetent(uid)
+	u, _, getentErr := runGetentPasswd(uid)
 	if getentErr != nil {
 		return nil, stdErr
 	}
@@ -50,14 +68,14 @@ func currentUserWithGetent() (*user.User, error) {
 	return u, nil
 }

-// groupIdsWithFallback gets group IDs for a user via the id command first,
+// GroupIdsWithFallback gets group IDs for a user via the id command first,
 // falling back to user.GroupIds().
-// NOTE: unlike lookupWithGetent/currentUserWithGetent which try stdlib first,
+// NOTE: unlike LookupWithGetent/CurrentUserWithGetent which try stdlib first,
 // this intentionally tries `id -G` first because without CGO, user.GroupIds()
 // only reads /etc/group and silently returns incomplete results for NSS users
 // (no error, just missing groups). The id command goes through NSS and returns
 // the full set.
-func groupIdsWithFallback(u *user.User) ([]string, error) {
+func GroupIdsWithFallback(u *user.User) ([]string, error) {
 	ids, err := runIdGroups(u.Username)
 	if err == nil {
 		return ids, nil
--- a/client/internal/shell/getent_test.go
+++ b/client/internal/shell/getent_test.go
@@ -1,4 +1,4 @@
-package server
+package shell

 import (
 	"os/user"
@@ -15,7 +15,7 @@ func TestLookupWithGetent_CurrentUser(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)

-	u, err := lookupWithGetent(current.Username)
+	u, err := LookupWithGetent(current.Username)
 	require.NoError(t, err)
 	assert.Equal(t, current.Username, u.Username)
 	assert.Equal(t, current.Uid, u.Uid)
@@ -23,7 +23,7 @@ func TestLookupWithGetent_CurrentUser(t *testing.T) {
 }

 func TestLookupWithGetent_NonexistentUser(t *testing.T) {
-	_, err := lookupWithGetent("nonexistent_user_xyzzy_12345")
+	_, err := LookupWithGetent("nonexistent_user_xyzzy_12345")
 	require.Error(t, err, "should fail for nonexistent user")
 }

@@ -31,7 +31,7 @@ func TestCurrentUserWithGetent(t *testing.T) {
 	stdUser, err := user.Current()
 	require.NoError(t, err)

-	u, err := currentUserWithGetent()
+	u, err := CurrentUserWithGetent()
 	require.NoError(t, err)
 	assert.Equal(t, stdUser.Uid, u.Uid)
 	assert.Equal(t, stdUser.Username, u.Username)
@@ -41,7 +41,7 @@ func TestGroupIdsWithFallback_CurrentUser(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)

-	groups, err := groupIdsWithFallback(current)
+	groups, err := GroupIdsWithFallback(current)
 	require.NoError(t, err)
 	require.NotEmpty(t, groups, "current user should have at least one group")

@@ -56,7 +56,7 @@ func TestGroupIdsWithFallback_CurrentUser(t *testing.T) {
 func TestGetShellFromGetent_CurrentUser(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		// Windows stub always returns empty, which is correct
-		shell := getShellFromGetent("1000")
+		shell := GetShellFromGetent("1000")
 		assert.Empty(t, shell, "Windows stub should return empty")
 		return
 	}
@@ -65,9 +65,9 @@ func TestGetShellFromGetent_CurrentUser(t *testing.T) {
 	require.NoError(t, err)

 	// getent may not be available on all systems (e.g., macOS without Homebrew getent)
-	shell := getShellFromGetent(current.Uid)
+	shell := GetShellFromGetent(current.Uid)
 	if shell == "" {
-		t.Log("getShellFromGetent returned empty, getent may not be available")
+		t.Log("GetShellFromGetent returned empty, getent may not be available")
 		return
 	}
 	assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
@@ -78,7 +78,7 @@ func TestLookupWithGetent_RootUser(t *testing.T) {
 		t.Skip("no root user on Windows")
 	}

-	u, err := lookupWithGetent("root")
+	u, err := LookupWithGetent("root")
 	if err != nil {
 		t.Skip("root user not available on this system")
 	}
@@ -86,25 +86,25 @@ func TestLookupWithGetent_RootUser(t *testing.T) {
 }

 // TestIntegration_FullLookupChain exercises the complete user lookup chain
-// against the real system, testing that all wrappers (lookupWithGetent,
-// currentUserWithGetent, groupIdsWithFallback, getShellFromGetent) produce
+// against the real system, testing that all wrappers (LookupWithGetent,
+// CurrentUserWithGetent, GroupIdsWithFallback, GetShellFromGetent) produce
 // consistent and correct results when composed together.
 func TestIntegration_FullLookupChain(t *testing.T) {
-	// Step 1: currentUserWithGetent must resolve the running user.
-	current, err := currentUserWithGetent()
-	require.NoError(t, err, "currentUserWithGetent must resolve the running user")
+	// Step 1: CurrentUserWithGetent must resolve the running user.
+	current, err := CurrentUserWithGetent()
+	require.NoError(t, err, "CurrentUserWithGetent must resolve the running user")
 	require.NotEmpty(t, current.Uid)
 	require.NotEmpty(t, current.Username)

-	// Step 2: lookupWithGetent by the same username must return matching identity.
-	byName, err := lookupWithGetent(current.Username)
+	// Step 2: LookupWithGetent by the same username must return matching identity.
+	byName, err := LookupWithGetent(current.Username)
 	require.NoError(t, err)
 	assert.Equal(t, current.Uid, byName.Uid, "lookup by name should return same UID")
 	assert.Equal(t, current.Gid, byName.Gid, "lookup by name should return same GID")
 	assert.Equal(t, current.HomeDir, byName.HomeDir, "lookup by name should return same home")

-	// Step 3: groupIdsWithFallback must return at least the primary GID.
-	groups, err := groupIdsWithFallback(current)
+	// Step 3: GroupIdsWithFallback must return at least the primary GID.
+	groups, err := GroupIdsWithFallback(current)
 	require.NoError(t, err)
 	require.NotEmpty(t, groups, "user must have at least one group")

@@ -120,10 +120,10 @@ func TestIntegration_FullLookupChain(t *testing.T) {
 	}
 	assert.True(t, foundPrimary, "primary GID %s should appear in supplementary groups", current.Gid)

-	// Step 4: getShellFromGetent should either return a valid shell path or empty
+	// Step 4: GetShellFromGetent should either return a valid shell path or empty
 	// (empty is OK when getent is not available, e.g. macOS without Homebrew getent).
 	if runtime.GOOS != "windows" {
-		shell := getShellFromGetent(current.Uid)
+		shell := GetShellFromGetent(current.Uid)
 		if shell != "" {
 			assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
 		}
@@ -131,17 +131,17 @@ func TestIntegration_FullLookupChain(t *testing.T) {
 }

 // TestIntegration_LookupAndGroupsConsistency verifies that a user resolved via
-// lookupWithGetent can have their groups resolved via groupIdsWithFallback,
+// LookupWithGetent can have their groups resolved via GroupIdsWithFallback,
 // testing the handoff between the two functions as used by the SSH server.
 func TestIntegration_LookupAndGroupsConsistency(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)

 	// Simulate the SSH server flow: lookup user, then get their groups.
-	resolved, err := lookupWithGetent(current.Username)
+	resolved, err := LookupWithGetent(current.Username)
 	require.NoError(t, err)

-	groups, err := groupIdsWithFallback(resolved)
+	groups, err := GroupIdsWithFallback(resolved)
 	require.NoError(t, err)
 	require.NotEmpty(t, groups, "resolved user must have groups")

@@ -156,7 +156,7 @@ func TestIntegration_LookupAndGroupsConsistency(t *testing.T) {
 }

 // TestIntegration_ShellLookupChain tests the full shell resolution chain
-// (getShellFromPasswd -> getShellFromGetent -> $SHELL -> default) on Unix.
+// (getShellFromPasswd -> GetShellFromGetent -> $SHELL -> default) on Unix.
 func TestIntegration_ShellLookupChain(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		t.Skip("Unix shell lookup not applicable on Windows")
@@ -165,8 +165,8 @@ func TestIntegration_ShellLookupChain(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)

-	// getUserShell is the top-level function used by the SSH server.
-	shell := getUserShell(current.Uid)
-	require.NotEmpty(t, shell, "getUserShell must always return a shell")
+	// GetUserShell is the top-level function used by the SSH server.
+	shell := GetUserShell(current.Uid)
+	require.NotEmpty(t, shell, "GetUserShell must always return a shell")
 	assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
 }
--- a/client/internal/shell/getent_unix.go
+++ b/client/internal/shell/getent_unix.go
@@ -1,6 +1,6 @@
 //go:build !windows

-package server
+package shell

 import (
 	"context"
@@ -14,19 +14,26 @@ import (

 const getentTimeout = 5 * time.Second

-// getShellFromGetent gets a user's login shell via getent by UID.
+// GetShellFromGetent gets a user's login shell via getent by UID.
 // This is needed even with CGO because getShellFromPasswd reads /etc/passwd
 // directly and won't find NSS-provided users there.
-func getShellFromGetent(userID string) string {
-	_, shell, err := runGetent(userID)
+func GetShellFromGetent(userID string) string {
+	_, shell, err := runGetentPasswd(userID)
 	if err != nil {
 		return ""
 	}
 	return shell
 }

-// runGetent executes `getent passwd <query>` and returns the user and login shell.
-func runGetent(query string) (*user.User, string, error) {
+// GetUserFromGetent returns the resolved user from either a uid or username,
+// going through the host's NSS stack.
+func GetUserFromGetent(query string) (*user.User, error) {
+	u, _, err := runGetentPasswd(query)
+	return u, err
+}
+
+// runGetentPasswd executes `getent passwd <query>` and returns the user and login shell.
+func runGetentPasswd(query string) (*user.User, string, error) {
 	if !validateGetentInput(query) {
 		return nil, "", fmt.Errorf("invalid getent input: %q", query)
 	}
@@ -42,7 +49,24 @@ func runGetent(query string) (*user.User, string, error) {
 	return parseGetentPasswd(string(out))
 }

-// parseGetentPasswd parses getent passwd output: "name:x:uid:gid:gecos:home:shell"
+// runGetentGroup executes `getent group <query>` and returns the group.
+func runGetentGroup(query string) (*user.Group, error) {
+	if !validateGetentInput(query) {
+		return nil, fmt.Errorf("invalid getent input: %q", query)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), getentTimeout)
+	defer cancel()
+
+	out, err := exec.CommandContext(ctx, "getent", "group", query).Output()
+	if err != nil {
+		return nil, fmt.Errorf("getent group %s: %w", query, err)
+	}
+
+	return parseGetentGroup(string(out))
+}
+
+// parseGetentPasswd parses getent passwd output: "name:x:uid:gid:gecos:home:shell".
 func parseGetentPasswd(output string) (*user.User, string, error) {
 	fields := strings.SplitN(strings.TrimSpace(output), ":", 8)
 	if len(fields) < 6 {
@@ -67,9 +91,24 @@ func parseGetentPasswd(output string) (*user.User, string, error) {
 	}, shell, nil
 }

+// parseGetentGroup parses getent group output: "group:x:gid:members".
+func parseGetentGroup(output string) (*user.Group, error) {
+	fields := strings.SplitN(strings.TrimSpace(output), ":", 8)
+	if len(fields) < 4 {
+		return nil, fmt.Errorf("unexpected getent output (need 4+ fields): %q", output)
+	}
+
+	if fields[0] == "" || fields[2] == "" {
+		return nil, fmt.Errorf("missing required fields in getent output: %q", output)
+	}
+
+	return &user.Group{Gid: fields[2], Name: fields[0]}, nil
+}
+
 // validateGetentInput checks that the input is safe to pass to getent or id.
 // Allows POSIX usernames, numeric UIDs, and common NSS extensions
-// (@ for Kerberos, $ for Samba, + for NIS compat).
+// (@ for Kerberos, $ for Samba, + for NIS compat). A leading hyphen is
+// rejected so the input can never be parsed as a command-line flag.
 func validateGetentInput(input string) bool {
 	maxLen := 32
 	if runtime.GOOS == "linux" {
@@ -80,6 +119,10 @@ func validateGetentInput(input string) bool {
 		return false
 	}

+	if input[0] == '-' {
+		return false
+	}
+
 	for _, r := range input {
 		if isAllowedGetentChar(r) {
 			continue
--- a/client/internal/shell/getent_unix_test.go
+++ b/client/internal/shell/getent_unix_test.go
@@ -1,6 +1,6 @@
 //go:build !windows

-package server
+package shell

 import (
 	"os/exec"
@@ -157,6 +157,9 @@ func TestValidateGetentInput(t *testing.T) {
 		{"numeric UID", "1001", true},
 		{"dots and underscores", "alice.bob_test", true},
 		{"hyphen", "alice-bob", true},
+		{"leading hyphen rejected", "-i", false},
+		{"leading double hyphen rejected", "--no-idn", false},
+		{"lone hyphen rejected", "-", false},
 		{"kerberos principal", "user@REALM", true},
 		{"samba machine account", "MACHINE$", true},
 		{"NIS compat", "+user", true},
@@ -195,7 +198,7 @@ func TestRunGetent_RootUser(t *testing.T) {
 		t.Skip("getent not available on this system")
 	}

-	u, shell, err := runGetent("root")
+	u, shell, err := runGetentPasswd("root")
 	require.NoError(t, err)
 	assert.Equal(t, "root", u.Username)
 	assert.Equal(t, "0", u.Uid)
@@ -208,7 +211,7 @@ func TestRunGetent_ByUID(t *testing.T) {
 		t.Skip("getent not available on this system")
 	}

-	u, _, err := runGetent("0")
+	u, _, err := runGetentPasswd("0")
 	require.NoError(t, err)
 	assert.Equal(t, "root", u.Username)
 	assert.Equal(t, "0", u.Uid)
@@ -219,15 +222,15 @@ func TestRunGetent_NonexistentUser(t *testing.T) {
 		t.Skip("getent not available on this system")
 	}

-	_, _, err := runGetent("nonexistent_user_xyzzy_12345")
+	_, _, err := runGetentPasswd("nonexistent_user_xyzzy_12345")
 	assert.Error(t, err)
 }

 func TestRunGetent_InvalidInput(t *testing.T) {
-	_, _, err := runGetent("")
+	_, _, err := runGetentPasswd("")
 	assert.Error(t, err)

-	_, _, err = runGetent("user\x00name")
+	_, _, err = runGetentPasswd("user\x00name")
 	assert.Error(t, err)
 }

@@ -236,7 +239,7 @@ func TestRunGetent_NotAvailable(t *testing.T) {
 		t.Skip("getent is available, can't test missing case")
 	}

-	_, _, err := runGetent("root")
+	_, _, err := runGetentPasswd("root")
 	assert.Error(t, err, "should fail when getent is not installed")
 }

@@ -283,7 +286,7 @@ func TestGetentResultsMatchStdlib(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)

-	getentUser, _, err := runGetent(current.Username)
+	getentUser, _, err := runGetentPasswd(current.Username)
 	require.NoError(t, err)

 	assert.Equal(t, current.Username, getentUser.Username, "username should match")
@@ -300,7 +303,7 @@ func TestGetentResultsMatchStdlib_ByUID(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)

-	getentUser, _, err := runGetent(current.Uid)
+	getentUser, _, err := runGetentPasswd(current.Uid)
 	require.NoError(t, err)

 	assert.Equal(t, current.Username, getentUser.Username, "username should match when looked up by UID")
@@ -356,7 +359,7 @@ func TestGetShellFromPasswd_CurrentUser(t *testing.T) {
 	assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)

 	if _, err := exec.LookPath("getent"); err == nil {
-		_, getentShell, getentErr := runGetent(current.Uid)
+		_, getentShell, getentErr := runGetentPasswd(current.Uid)
 		if getentErr == nil && getentShell != "" {
 			assert.Equal(t, getentShell, shell, "shell from /etc/passwd should match getent")
 		}
@@ -400,7 +403,7 @@ func TestGetShellFromPasswd_MatchesGetentForKnownUsers(t *testing.T) {
 			continue
 		}

-		_, getentShell, err := runGetent(uid)
+		_, getentShell, err := runGetentPasswd(uid)
 		if err != nil {
 			continue
 		}
--- a/client/internal/shell/getent_windows.go
+++ b/client/internal/shell/getent_windows.go
@@ -0,0 +1,30 @@
+//go:build windows
+
+package shell
+
+import "os/user"
+
+// LookupWithGetent on Windows just delegates to os/user.Lookup.
+func LookupWithGetent(username string) (*user.User, error) {
+	return user.Lookup(username)
+}
+
+// CurrentUserWithGetent on Windows just delegates to os/user.Current.
+func CurrentUserWithGetent() (*user.User, error) {
+	return user.Current()
+}
+
+// LookupGroupWithGetent on Windows just delegates to os/user.LookupGroup.
+func LookupGroupWithGetent(name string) (*user.Group, error) {
+	return user.LookupGroup(name)
+}
+
+// GetShellFromGetent is a no-op on Windows.
+func GetShellFromGetent(_ string) string {
+	return ""
+}
+
+// GroupIdsWithFallback on Windows just delegates to u.GroupIds().
+func GroupIdsWithFallback(u *user.User) ([]string, error) {
+	return u.GroupIds()
+}
--- a/client/internal/shell/shell.go
+++ b/client/internal/shell/shell.go
@@ -1,17 +1,14 @@
-package server
+package shell

 import (
 	"bufio"
 	"fmt"
-	"net"
 	"os"
 	"os/exec"
 	"os/user"
 	"runtime"
-	"strconv"
 	"strings"

-	"github.com/gliderlabs/ssh"
 	log "github.com/sirupsen/logrus"
 )

@@ -22,9 +19,9 @@ const (
 	powershellExe = "powershell.exe"
 )

-// getUserShell returns the appropriate shell for the given user ID
-// Handles all platform-specific logic and fallbacks consistently
-func getUserShell(userID string) string {
+// GetUserShell returns the appropriate shell for the given user ID.
+// Handles all platform-specific logic and fallbacks consistently.
+func GetUserShell(userID string) string {
 	switch runtime.GOOS {
 	case "windows":
 		return getWindowsUserShell()
@@ -56,7 +53,7 @@ func getUnixUserShell(userID string) string {
 		return shell
 	}

-	if shell := getShellFromGetent(userID); shell != "" {
+	if shell := GetShellFromGetent(userID); shell != "" {
 		return shell
 	}

@@ -67,7 +64,7 @@ func getUnixUserShell(userID string) string {
 	return defaultUnixShell
 }

-// getShellFromPasswd reads the shell from /etc/passwd for the given user ID
+// getShellFromPasswd reads the shell from /etc/passwd for the given user ID.
 func getShellFromPasswd(userID string) string {
 	file, err := os.Open("/etc/passwd")
 	if err != nil {
@@ -101,8 +98,8 @@ func getShellFromPasswd(userID string) string {
 	return ""
 }

-// prepareUserEnv prepares environment variables for user execution
-func prepareUserEnv(user *user.User, shell string) []string {
+// PrepareUserEnv prepares environment variables for user execution.
+func PrepareUserEnv(user *user.User, shell string) []string {
 	pathValue := "/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games"
 	if runtime.GOOS == "windows" {
 		pathValue = `C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0`
@@ -117,9 +114,9 @@ func prepareUserEnv(user *user.User, shell string) []string {
 	}
 }

-// acceptEnv checks if environment variable from SSH client should be accepted
-// This is a whitelist of variables that SSH clients can send to the server
-func acceptEnv(envVar string) bool {
+// AcceptEnv checks if an environment variable from an SSH client should be accepted.
+// This is a whitelist of variables that SSH clients can send to the server.
+func AcceptEnv(envVar string) bool {
 	varName := envVar
 	if idx := strings.Index(envVar, "="); idx != -1 {
 		varName = envVar[:idx]
@@ -156,29 +153,3 @@ func acceptEnv(envVar string) bool {

 	return false
 }
-
-// prepareSSHEnv prepares SSH protocol-specific environment variables
-// These variables provide information about the SSH connection itself
-func prepareSSHEnv(session ssh.Session) []string {
-	remoteAddr := session.RemoteAddr()
-	localAddr := session.LocalAddr()
-
-	remoteHost, remotePort, err := net.SplitHostPort(remoteAddr.String())
-	if err != nil {
-		remoteHost = remoteAddr.String()
-		remotePort = "0"
-	}
-
-	localHost, localPort, err := net.SplitHostPort(localAddr.String())
-	if err != nil {
-		localHost = localAddr.String()
-		localPort = strconv.Itoa(InternalSSHPort)
-	}
-
-	return []string{
-		// SSH_CLIENT format: "client_ip client_port server_port"
-		fmt.Sprintf("SSH_CLIENT=%s %s %s", remoteHost, remotePort, localPort),
-		// SSH_CONNECTION format: "client_ip client_port server_ip server_port"
-		fmt.Sprintf("SSH_CONNECTION=%s %s %s %s", remoteHost, remotePort, localHost, localPort),
-	}
-}
--- a/client/internal/statemanager/manager.go
+++ b/client/internal/statemanager/manager.go
@@ -1,6 +1,7 @@
 package statemanager

 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
@@ -305,6 +306,11 @@ func (m *Manager) loadStateFile(deleteCorrupt bool) (map[string]json.RawMessage,

 	var rawStates map[string]json.RawMessage
 	if err := json.Unmarshal(data, &rawStates); err != nil {
+		if len(bytes.TrimSpace(data)) == 0 {
+			log.Warnf("state file %s is empty (%d bytes)", m.filePath, len(data))
+		} else {
+			log.Warnf("state file %s has malformed content (%d bytes)", m.filePath, len(data))
+		}
 		m.handleCorruptedState(deleteCorrupt)
 		return nil, fmt.Errorf("unmarshal states: %w", err)
 	}
--- a/client/ios/NetBirdSDK/client.go
+++ b/client/ios/NetBirdSDK/client.go
@@ -233,6 +233,9 @@ func (c *Client) DebugBundle(anonymize bool) (string, error) {
 		deps.SyncResponse = resp

 		if e := cc.Engine(); e != nil {
+			deps.RefreshStatus = func() {
+				e.RunHealthProbes(context.Background(), true)
+			}
 			if cm := e.GetClientMetrics(); cm != nil {
 				deps.ClientMetrics = cm
 			}
--- a/client/ios/NetBirdSDK/login.go
+++ b/client/ios/NetBirdSDK/login.go
@@ -44,10 +44,25 @@ type Auth struct {
 // NewAuth instantiate Auth struct and validate the management URL
 func NewAuth(cfgPath string, mgmURL string) (*Auth, error) {
 	inputCfg := profilemanager.ConfigInput{
+		ConfigPath:    cfgPath,
 		ManagementURL: mgmURL,
 	}

-	cfg, err := profilemanager.CreateInMemoryConfig(inputCfg)
+	// Load the existing config when a config file is already present so an
+	// interactive re-login reuses the peer's persisted WireGuard private key
+	// (and thus its identity) instead of generating a fresh one. Generating a
+	// new key registers a brand-new peer on the management server on every
+	// re-auth (named after the fallback hostname). Only fall back to a fresh
+	// in-memory config for the first-time login when no config file exists yet.
+	// DirectUpdateOrCreateConfig uses non-atomic writes so it also works inside
+	// the tvOS App Group sandbox where atomic temp-file+rename is blocked.
+	var cfg *profilemanager.Config
+	var err error
+	if cfgPath != "" {
+		cfg, err = profilemanager.DirectUpdateOrCreateConfig(inputCfg)
+	} else {
+		cfg, err = profilemanager.CreateInMemoryConfig(inputCfg)
+	}
 	if err != nil {
 		return nil, err
 	}
--- a/client/mdm/canonical_loaders.go
+++ b/client/mdm/canonical_loaders.go
@@ -22,6 +22,7 @@ var allKeys = []string{
 	KeyDisableMetricsCollection,
 	KeyAllowServerSSH,
 	KeyDisableAutoConnect,
+	KeyDisableAutostart,
 	KeyPreSharedKey,
 	KeyRosenpassEnabled,
 	KeyRosenpassPermissive,
--- a/client/mdm/policy.go
+++ b/client/mdm/policy.go
@@ -20,10 +20,10 @@ import (
 // names (lowerCamelCase) so the daemon can map a Policy key directly to a
 // configuration field.
 const (
-	KeyManagementURL            = "managementURL"
-	KeyDisableUpdateSettings    = "disableUpdateSettings"
-	KeyDisableProfiles          = "disableProfiles"
-	KeyDisableNetworks          = "disableNetworks"
+	KeyManagementURL         = "managementURL"
+	KeyDisableUpdateSettings = "disableUpdateSettings"
+	KeyDisableProfiles       = "disableProfiles"
+	KeyDisableNetworks       = "disableNetworks"
 	// KeyDisableAdvancedView gates the advanced-view section in the
 	// upcoming UI revision. UI-only: NOT stored on Config, not
 	// applied by applyMDMPolicy, not rejectable via SetConfig. The
@@ -37,10 +37,16 @@ const (
 	KeyDisableMetricsCollection = "disableMetricsCollection"
 	KeyAllowServerSSH           = "allowServerSSH"
 	KeyDisableAutoConnect       = "disableAutoConnect"
-	KeyPreSharedKey             = "preSharedKey"
-	KeyRosenpassEnabled         = "rosenpassEnabled"
-	KeyRosenpassPermissive      = "rosenpassPermissive"
-	KeyWireguardPort            = "wireguardPort"
+	// KeyDisableAutostart suppresses the GUI's fresh-install
+	// launch-on-login default and marks the Settings toggle as
+	// MDM-managed. UI-only: NOT stored on Config and not applied by
+	// applyMDMPolicy; the GUI reads it directly and it appears in
+	// GetConfigResponse.mDMManagedFields when set.
+	KeyDisableAutostart    = "disableAutostart"
+	KeyPreSharedKey        = "preSharedKey"
+	KeyRosenpassEnabled    = "rosenpassEnabled"
+	KeyRosenpassPermissive = "rosenpassPermissive"
+	KeyWireguardPort       = "wireguardPort"

 	// Split tunnel is modeled as a single conceptual policy with two
 	// registry/plist values. KeySplitTunnelMode is the discriminator
--- a/client/proto/daemon.pb.go
+++ b/client/proto/daemon.pb.go
--- a/client/proto/daemon.pb.gw.go
+++ b/client/proto/daemon.pb.gw.go
@@ -791,6 +791,78 @@ func local_request_DaemonService_GetActiveProfile_0(ctx context.Context, marshal
 	return msg, metadata, err
 }

+func request_DaemonService_AddOwner_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq AddOwnerRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.AddOwner(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_AddOwner_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq AddOwnerRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.AddOwner(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_ResetOwner_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ResetOwnerRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.ResetOwner(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_ResetOwner_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ResetOwnerRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.ResetOwner(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_ShareProfile_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ShareProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.ShareProfile(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_ShareProfile_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ShareProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.ShareProfile(ctx, &protoReq)
+	return msg, metadata, err
+}
+
 func request_DaemonService_Logout_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
 	var (
 		protoReq LogoutRequest
@@ -1730,6 +1802,66 @@ func RegisterDaemonServiceHandlerServer(ctx context.Context, mux *runtime.ServeM
 		}
 		forward_DaemonService_GetActiveProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
 	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_AddOwner_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/AddOwner", runtime.WithHTTPPathPattern("/daemon.DaemonService/AddOwner"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_AddOwner_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_AddOwner_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ResetOwner_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/ResetOwner", runtime.WithHTTPPathPattern("/daemon.DaemonService/ResetOwner"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_ResetOwner_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ResetOwner_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ShareProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/ShareProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/ShareProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_ShareProfile_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ShareProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
 	mux.Handle(http.MethodPost, pattern_DaemonService_Logout_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
@@ -2581,6 +2713,57 @@ func RegisterDaemonServiceHandlerClient(ctx context.Context, mux *runtime.ServeM
 		}
 		forward_DaemonService_GetActiveProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
 	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_AddOwner_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/AddOwner", runtime.WithHTTPPathPattern("/daemon.DaemonService/AddOwner"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_AddOwner_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_AddOwner_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ResetOwner_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/ResetOwner", runtime.WithHTTPPathPattern("/daemon.DaemonService/ResetOwner"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_ResetOwner_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ResetOwner_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ShareProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/ShareProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/ShareProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_ShareProfile_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ShareProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
 	mux.Handle(http.MethodPost, pattern_DaemonService_Logout_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
@@ -2855,6 +3038,9 @@ var (
 	pattern_DaemonService_RemoveProfile_0              = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "RemoveProfile"}, ""))
 	pattern_DaemonService_ListProfiles_0               = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "ListProfiles"}, ""))
 	pattern_DaemonService_GetActiveProfile_0           = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "GetActiveProfile"}, ""))
+	pattern_DaemonService_AddOwner_0                   = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "AddOwner"}, ""))
+	pattern_DaemonService_ResetOwner_0                 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "ResetOwner"}, ""))
+	pattern_DaemonService_ShareProfile_0               = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "ShareProfile"}, ""))
 	pattern_DaemonService_Logout_0                     = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "Logout"}, ""))
 	pattern_DaemonService_GetFeatures_0                = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "GetFeatures"}, ""))
 	pattern_DaemonService_TriggerUpdate_0              = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "TriggerUpdate"}, ""))
@@ -2904,6 +3090,9 @@ var (
 	forward_DaemonService_RemoveProfile_0              = runtime.ForwardResponseMessage
 	forward_DaemonService_ListProfiles_0               = runtime.ForwardResponseMessage
 	forward_DaemonService_GetActiveProfile_0           = runtime.ForwardResponseMessage
+	forward_DaemonService_AddOwner_0                   = runtime.ForwardResponseMessage
+	forward_DaemonService_ResetOwner_0                 = runtime.ForwardResponseMessage
+	forward_DaemonService_ShareProfile_0               = runtime.ForwardResponseMessage
 	forward_DaemonService_Logout_0                     = runtime.ForwardResponseMessage
 	forward_DaemonService_GetFeatures_0                = runtime.ForwardResponseMessage
 	forward_DaemonService_TriggerUpdate_0              = runtime.ForwardResponseMessage
--- a/client/proto/daemon.proto
+++ b/client/proto/daemon.proto
@@ -104,6 +104,18 @@ service DaemonService {

  rpc GetActiveProfile(GetActiveProfileRequest) returns (GetActiveProfileResponse) {}

+  // AddOwner adds a principal to the active profile's owner list. Requires the
+  // caller to be privileged (root/administrator) or an existing owner.
+  rpc AddOwner(AddOwnerRequest) returns (AddOwnerResponse) {}
+
+  // ResetOwner clears the active profile's owner list, returning it to the
+  // unowned state (next caller re-claims via trust-on-first-use). Privileged only.
+  rpc ResetOwner(ResetOwnerRequest) returns (ResetOwnerResponse) {}
+
+  // ShareProfile marks the active profile shared (any local caller) or unshared.
+  // Requires the caller to be an owner or privileged.
+  rpc ShareProfile(ShareProfileRequest) returns (ShareProfileResponse) {}
+
  // Logout disconnects from the network and deletes the peer from the management server
  rpc Logout(LogoutRequest) returns (LogoutResponse) {}

@@ -270,6 +282,10 @@ message UpRequest {
  // RPC blocks until the engine is running or gives up, which is the behaviour
  // needed by the CLI.
  bool async = 4;
+
+  // claimOwner, when true, claims ownership of the active profile for the
+  // calling user (adds their kernel principal to the profile's owner list).
+  bool claimOwner = 5;
 }

 message UpResponse {}
@@ -774,6 +790,24 @@ message AddProfileResponse {
  string id = 1;
 }

+message AddOwnerRequest {
+  // principal is a typed owner string: "uid:1000", "gid:1000",
+  // "group:netbird-admins" (Unix, NSS-resolved), or "sid:S-1-5-..." (Windows).
+  string principal = 1;
+}
+
+message AddOwnerResponse {}
+
+message ResetOwnerRequest {}
+
+message ResetOwnerResponse {}
+
+message ShareProfileRequest {
+  bool shared = 1;
+}
+
+message ShareProfileResponse {}
+
 message RenameProfileRequest {
  string username = 1;
  // handle: an exact ID, a unique ID prefix, or a unique display name.
--- a/client/proto/daemon_grpc.pb.go
+++ b/client/proto/daemon_grpc.pb.go
@@ -51,6 +51,9 @@ const (
 	DaemonService_RemoveProfile_FullMethodName              = "/daemon.DaemonService/RemoveProfile"
 	DaemonService_ListProfiles_FullMethodName               = "/daemon.DaemonService/ListProfiles"
 	DaemonService_GetActiveProfile_FullMethodName           = "/daemon.DaemonService/GetActiveProfile"
+	DaemonService_AddOwner_FullMethodName                   = "/daemon.DaemonService/AddOwner"
+	DaemonService_ResetOwner_FullMethodName                 = "/daemon.DaemonService/ResetOwner"
+	DaemonService_ShareProfile_FullMethodName               = "/daemon.DaemonService/ShareProfile"
 	DaemonService_Logout_FullMethodName                     = "/daemon.DaemonService/Logout"
 	DaemonService_GetFeatures_FullMethodName                = "/daemon.DaemonService/GetFeatures"
 	DaemonService_TriggerUpdate_FullMethodName              = "/daemon.DaemonService/TriggerUpdate"
@@ -132,6 +135,15 @@ type DaemonServiceClient interface {
 	RemoveProfile(ctx context.Context, in *RemoveProfileRequest, opts ...grpc.CallOption) (*RemoveProfileResponse, error)
 	ListProfiles(ctx context.Context, in *ListProfilesRequest, opts ...grpc.CallOption) (*ListProfilesResponse, error)
 	GetActiveProfile(ctx context.Context, in *GetActiveProfileRequest, opts ...grpc.CallOption) (*GetActiveProfileResponse, error)
+	// AddOwner adds a principal to the active profile's owner list. Requires the
+	// caller to be privileged (root/administrator) or an existing owner.
+	AddOwner(ctx context.Context, in *AddOwnerRequest, opts ...grpc.CallOption) (*AddOwnerResponse, error)
+	// ResetOwner clears the active profile's owner list, returning it to the
+	// unowned state (next caller re-claims via trust-on-first-use). Privileged only.
+	ResetOwner(ctx context.Context, in *ResetOwnerRequest, opts ...grpc.CallOption) (*ResetOwnerResponse, error)
+	// ShareProfile marks the active profile shared (any local caller) or unshared.
+	// Requires the caller to be an owner or privileged.
+	ShareProfile(ctx context.Context, in *ShareProfileRequest, opts ...grpc.CallOption) (*ShareProfileResponse, error)
 	// Logout disconnects from the network and deletes the peer from the management server
 	Logout(ctx context.Context, in *LogoutRequest, opts ...grpc.CallOption) (*LogoutResponse, error)
 	GetFeatures(ctx context.Context, in *GetFeaturesRequest, opts ...grpc.CallOption) (*GetFeaturesResponse, error)
@@ -528,6 +540,36 @@ func (c *daemonServiceClient) GetActiveProfile(ctx context.Context, in *GetActiv
 	return out, nil
 }

+func (c *daemonServiceClient) AddOwner(ctx context.Context, in *AddOwnerRequest, opts ...grpc.CallOption) (*AddOwnerResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(AddOwnerResponse)
+	err := c.cc.Invoke(ctx, DaemonService_AddOwner_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *daemonServiceClient) ResetOwner(ctx context.Context, in *ResetOwnerRequest, opts ...grpc.CallOption) (*ResetOwnerResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ResetOwnerResponse)
+	err := c.cc.Invoke(ctx, DaemonService_ResetOwner_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *daemonServiceClient) ShareProfile(ctx context.Context, in *ShareProfileRequest, opts ...grpc.CallOption) (*ShareProfileResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ShareProfileResponse)
+	err := c.cc.Invoke(ctx, DaemonService_ShareProfile_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *daemonServiceClient) Logout(ctx context.Context, in *LogoutRequest, opts ...grpc.CallOption) (*LogoutResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(LogoutResponse)
@@ -742,6 +784,15 @@ type DaemonServiceServer interface {
 	RemoveProfile(context.Context, *RemoveProfileRequest) (*RemoveProfileResponse, error)
 	ListProfiles(context.Context, *ListProfilesRequest) (*ListProfilesResponse, error)
 	GetActiveProfile(context.Context, *GetActiveProfileRequest) (*GetActiveProfileResponse, error)
+	// AddOwner adds a principal to the active profile's owner list. Requires the
+	// caller to be privileged (root/administrator) or an existing owner.
+	AddOwner(context.Context, *AddOwnerRequest) (*AddOwnerResponse, error)
+	// ResetOwner clears the active profile's owner list, returning it to the
+	// unowned state (next caller re-claims via trust-on-first-use). Privileged only.
+	ResetOwner(context.Context, *ResetOwnerRequest) (*ResetOwnerResponse, error)
+	// ShareProfile marks the active profile shared (any local caller) or unshared.
+	// Requires the caller to be an owner or privileged.
+	ShareProfile(context.Context, *ShareProfileRequest) (*ShareProfileResponse, error)
 	// Logout disconnects from the network and deletes the peer from the management server
 	Logout(context.Context, *LogoutRequest) (*LogoutResponse, error)
 	GetFeatures(context.Context, *GetFeaturesRequest) (*GetFeaturesResponse, error)
@@ -887,6 +938,15 @@ func (UnimplementedDaemonServiceServer) ListProfiles(context.Context, *ListProfi
 func (UnimplementedDaemonServiceServer) GetActiveProfile(context.Context, *GetActiveProfileRequest) (*GetActiveProfileResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method GetActiveProfile not implemented")
 }
+func (UnimplementedDaemonServiceServer) AddOwner(context.Context, *AddOwnerRequest) (*AddOwnerResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method AddOwner not implemented")
+}
+func (UnimplementedDaemonServiceServer) ResetOwner(context.Context, *ResetOwnerRequest) (*ResetOwnerResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ResetOwner not implemented")
+}
+func (UnimplementedDaemonServiceServer) ShareProfile(context.Context, *ShareProfileRequest) (*ShareProfileResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ShareProfile not implemented")
+}
 func (UnimplementedDaemonServiceServer) Logout(context.Context, *LogoutRequest) (*LogoutResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method Logout not implemented")
 }
@@ -1505,6 +1565,60 @@ func _DaemonService_GetActiveProfile_Handler(srv interface{}, ctx context.Contex
 	return interceptor(ctx, in, info, handler)
 }

+func _DaemonService_AddOwner_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(AddOwnerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServiceServer).AddOwner(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DaemonService_AddOwner_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServiceServer).AddOwner(ctx, req.(*AddOwnerRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _DaemonService_ResetOwner_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ResetOwnerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServiceServer).ResetOwner(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DaemonService_ResetOwner_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServiceServer).ResetOwner(ctx, req.(*ResetOwnerRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _DaemonService_ShareProfile_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ShareProfileRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServiceServer).ShareProfile(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DaemonService_ShareProfile_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServiceServer).ShareProfile(ctx, req.(*ShareProfileRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _DaemonService_Logout_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(LogoutRequest)
 	if err := dec(in); err != nil {
@@ -1873,6 +1987,18 @@ var DaemonService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetActiveProfile",
 			Handler:    _DaemonService_GetActiveProfile_Handler,
 		},
+		{
+			MethodName: "AddOwner",
+			Handler:    _DaemonService_AddOwner_Handler,
+		},
+		{
+			MethodName: "ResetOwner",
+			Handler:    _DaemonService_ResetOwner_Handler,
+		},
+		{
+			MethodName: "ShareProfile",
+			Handler:    _DaemonService_ShareProfile_Handler,
+		},
 		{
 			MethodName: "Logout",
 			Handler:    _DaemonService_Logout_Handler,
--- a/client/server/ownership.go
+++ b/client/server/ownership.go
@@ -0,0 +1,256 @@
+package server
+
+import (
+	"context"
+	"fmt"
+	"slices"
+
+	log "github.com/sirupsen/logrus"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/util"
+)
+
+// Verify that the daemon Server implements ipcauth.ProfilePolicy.
+var _ ipcauth.ProfilePolicy = (*Server)(nil)
+
+// ActiveProfileOwnership returns the active profile's ownership policy. Reads
+// the in-memory active config (kept current by the handlers), falling back to
+// the on-disk active profile when the daemon hasn't loaded one yet.
+func (s *Server) ActiveProfileOwnership() ipcauth.Ownership {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	cfg := s.config
+	if cfg == nil {
+		loaded, err := s.loadActiveProfileConfigLocked()
+		if err != nil {
+			log.Warnf("ownership: cannot load active profile config, treating as unowned: %v", err)
+			return ipcauth.Ownership{}
+		}
+		cfg = loaded
+	}
+	return ipcauth.Ownership{Owners: cfg.Owners, Shared: cfg.Shared}
+}
+
+// ClaimActiveProfileOwnerIfUnowned atomically claims the active profile for id
+// when it has no owners and is not shared (trust-on-first-use). Returns whether
+// id is now an owner. Concurrent first-callers are serialized by s.mutex.
+func (s *Server) ClaimActiveProfileOwnerIfUnowned(id ipcauth.Identity) (bool, error) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	cfg := s.config
+	if cfg == nil {
+		loaded, err := s.loadActiveProfileConfigLocked()
+		if err != nil {
+			return false, fmt.Errorf("load active profile config: %w", err)
+		}
+		cfg = loaded
+	}
+
+	if len(cfg.Owners) > 0 || cfg.Shared {
+		return false, nil // already owned or shared
+	}
+
+	cfg.Owners = []string{ipcauth.OwnerPrincipalForIdentity(id)}
+	if err := s.persistActiveProfileConfigLocked(cfg); err != nil {
+		cfg.Owners = nil // revert in-memory on persistence failure
+		return false, fmt.Errorf("persist claimed ownership: %w", err)
+	}
+	s.config = cfg
+	log.Infof("profile ownership claimed by %s (trust-on-first-use)", id)
+	return true, nil
+}
+
+// activeProfileConfigPathLocked resolves the active profile's config file path.
+func (s *Server) activeProfileConfigPathLocked() (string, error) {
+	activeProf, err := s.profileManager.GetActiveProfileState()
+	if err != nil {
+		return "", fmt.Errorf("get active profile: %w", err)
+	}
+	path, err := activeProf.FilePath()
+	if err != nil {
+		return "", fmt.Errorf("resolve active profile path: %w", err)
+	}
+	return path, nil
+}
+
+// loadActiveProfileConfigLocked reads the active profile's config from disk.
+func (s *Server) loadActiveProfileConfigLocked() (*profilemanager.Config, error) {
+	path, err := s.activeProfileConfigPathLocked()
+	if err != nil {
+		return nil, err
+	}
+	return profilemanager.GetConfig(path)
+}
+
+// persistActiveProfileConfigLocked writes cfg to the active profile's config file.
+func (s *Server) persistActiveProfileConfigLocked(cfg *profilemanager.Config) error {
+	path, err := s.activeProfileConfigPathLocked()
+	if err != nil {
+		return err
+	}
+	return util.WriteJson(context.Background(), path, cfg)
+}
+
+// activeConfigLocked returns the in-memory active config, loading it from disk
+// if the daemon hasn't cached one. Caller must hold s.mutex.
+func (s *Server) activeConfigLocked() (*profilemanager.Config, error) {
+	if s.config != nil {
+		return s.config, nil
+	}
+	return s.loadActiveProfileConfigLocked()
+}
+
+// claimForCallerLocked adds the caller's principal to cfg (if absent) and
+// persists. No-op for privileged callers (they need no ownership entry). Caller
+// must hold s.mutex.
+func (s *Server) claimForCallerLocked(id ipcauth.Identity, cfg *profilemanager.Config) error {
+	if id.IsPrivileged() {
+		return nil
+	}
+	principal := ipcauth.OwnerPrincipalForIdentity(id)
+	if slices.Contains(cfg.Owners, principal) {
+		return nil
+	}
+	cfg.Owners = append(cfg.Owners, principal)
+	if err := s.persistActiveProfileConfigLocked(cfg); err != nil {
+		cfg.Owners = cfg.Owners[:len(cfg.Owners)-1] // revert on failure
+		return err
+	}
+	s.config = cfg
+	return nil
+}
+
+// authorizeTargetProfile authorizes a caller to operate on a specific target
+// profile. It MUST be called after bindCallerUsername, which enforces the legacy
+// per-username-directory guard. this layers the collision-free Owners field on
+// top of it:
+//
+//   - Privileged callers (root / elevated-admin) may operate on any profile.
+//   - If the target has Owners (or is Shared), they are authoritative. This
+//     disambiguates users whose sanitized usernames collide.
+//   - If the target is unowned (a legacy profile predating ownership), passing
+//     the username guard is sufficient and then the profile is claimed.
+//
+// Caller must hold s.mutex (it may persist an ownership claim).
+func (s *Server) authorizeTargetProfile(ctx context.Context, target *profilemanager.Profile, claim bool) error {
+	id, ok := ipcauth.IdentityFromContext(ctx)
+	if !ok {
+		return gstatus.Error(codes.PermissionDenied, "caller identity could not be verified")
+	}
+	if id.IsPrivileged() {
+		return nil
+	}
+
+	path, err := target.FilePath()
+	if err != nil {
+		return fmt.Errorf("resolve target profile path: %w", err)
+	}
+	cfg, err := profilemanager.GetConfig(path)
+	if err != nil {
+		return fmt.Errorf("load target profile config: %w", err)
+	}
+
+	ownership := ipcauth.Ownership{Owners: cfg.Owners, Shared: cfg.Shared}
+
+	// Owned or shared: the Owners field is authoritative (collision-free).
+	if len(ownership.Owners) > 0 || ownership.Shared {
+		if ipcauth.Authorize(ownership, id, s.groupResolver) {
+			return nil
+		}
+		return gstatus.Errorf(codes.PermissionDenied,
+			"not authorized to operate on profile %q (owned by another principal)", target.Name)
+	}
+
+	// Unowned legacy profile: the username guard authorizes. Stamp the caller
+	// as owner so future access is collision-free.
+	if claim {
+		principal := ipcauth.OwnerPrincipalForIdentity(id)
+		cfg.Owners = []string{principal}
+		if err := util.WriteJson(context.Background(), path, cfg); err != nil {
+			return fmt.Errorf("persist profile ownership claim: %w", err)
+		}
+		log.Infof("profile %q (%s) claimed by %s on first access (trust-on-first-use)", target.Name, target.ID, id)
+	}
+	return nil
+}
+
+// AddOwner adds a principal to the active profile's owner list. The interceptor
+// has already confirmed the caller is an owner or privileged, the handler just
+// validates and persists.
+func (s *Server) AddOwner(_ context.Context, msg *proto.AddOwnerRequest) (*proto.AddOwnerResponse, error) {
+	principal := msg.GetPrincipal()
+	if _, ok := ipcauth.ParsePrincipal(principal); !ok {
+		return nil, gstatus.Errorf(codes.InvalidArgument, "invalid owner principal %q (expected uid:/gid:/group:/sid:)", principal)
+	}
+
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	cfg, err := s.activeConfigLocked()
+	if err != nil {
+		return nil, fmt.Errorf("load active profile config: %w", err)
+	}
+	if slices.Contains(cfg.Owners, principal) {
+		return &proto.AddOwnerResponse{}, nil
+	}
+	cfg.Owners = append(cfg.Owners, principal)
+	if err := s.persistActiveProfileConfigLocked(cfg); err != nil {
+		cfg.Owners = cfg.Owners[:len(cfg.Owners)-1]
+		return nil, fmt.Errorf("persist owner: %w", err)
+	}
+	s.config = cfg
+	log.Infof("added owner %q to the active profile", principal)
+	return &proto.AddOwnerResponse{}, nil
+}
+
+// ResetOwner clears the active profile's owner list (and shared flag), returning
+// it to the unowned state so the next caller re-claims via trust-on-first-use.
+// Privileged-only, so co-owners cannot evict each other.
+func (s *Server) ResetOwner(ctx context.Context, _ *proto.ResetOwnerRequest) (*proto.ResetOwnerResponse, error) {
+	id, ok := ipcauth.IdentityFromContext(ctx)
+	if !ok || !id.IsPrivileged() {
+		return nil, gstatus.Error(codes.PermissionDenied, "reset-owner requires root/administrator")
+	}
+
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	cfg, err := s.activeConfigLocked()
+	if err != nil {
+		return nil, fmt.Errorf("load active profile config: %w", err)
+	}
+	cfg.Owners = nil
+	cfg.Shared = false
+	if err := s.persistActiveProfileConfigLocked(cfg); err != nil {
+		return nil, fmt.Errorf("persist owner reset: %w", err)
+	}
+	s.config = cfg
+	log.Infof("active profile owner list reset; next caller will re-claim (trust-on-first-use)")
+	return &proto.ResetOwnerResponse{}, nil
+}
+
+// ShareProfile marks the active profile shared or unshared. The interceptor has
+// already confirmed the caller is an owner or privileged.
+func (s *Server) ShareProfile(_ context.Context, msg *proto.ShareProfileRequest) (*proto.ShareProfileResponse, error) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	cfg, err := s.activeConfigLocked()
+	if err != nil {
+		return nil, fmt.Errorf("load active profile config: %w", err)
+	}
+	cfg.Shared = msg.GetShared()
+	if err := s.persistActiveProfileConfigLocked(cfg); err != nil {
+		return nil, fmt.Errorf("persist shared flag: %w", err)
+	}
+	s.config = cfg
+	log.Infof("active profile shared flag set to %t", msg.GetShared())
+	return &proto.ShareProfileResponse{}, nil
+}
--- a/client/server/ownership_test.go
+++ b/client/server/ownership_test.go
@@ -0,0 +1,88 @@
+package server
+
+import (
+	"context"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/util"
+)
+
+// writeTargetProfile writes a profile JSON with the given ownership and returns
+// a Profile handle pointing at it (Path set, so FilePath() resolves directly).
+func writeTargetProfile(t *testing.T, dir, id string, owners []string, shared bool) *profilemanager.Profile {
+	t.Helper()
+	path := filepath.Join(dir, id+".json")
+	cfg := &profilemanager.Config{Owners: owners, Shared: shared}
+	require.NoError(t, util.WriteJson(context.Background(), path, cfg))
+	return &profilemanager.Profile{ID: profilemanager.ID(id), Name: id, Path: path}
+}
+
+func readOwners(t *testing.T, path string) ([]string, bool) {
+	t.Helper()
+	cfg, err := profilemanager.GetConfig(path)
+	require.NoError(t, err)
+	return cfg.Owners, cfg.Shared
+}
+
+func TestAuthorizeTargetProfile(t *testing.T) {
+	s := &Server{groupResolver: ipcauth.NewDefaultGroupResolver()}
+	owner := ipcauth.Identity{UID: 1000}
+	other := ipcauth.Identity{UID: 1001}
+	root := ipcauth.Identity{UID: 0}
+
+	t.Run("no identity denies", func(t *testing.T) {
+		p := writeTargetProfile(t, t.TempDir(), "p", []string{"uid:1000"}, false)
+		err := s.authorizeTargetProfile(context.Background(), p, true)
+		assert.Equal(t, codes.PermissionDenied, gstatus.Code(err))
+	})
+
+	t.Run("privileged allowed on another's profile", func(t *testing.T) {
+		p := writeTargetProfile(t, t.TempDir(), "p", []string{"uid:1000"}, false)
+		assert.NoError(t, s.authorizeTargetProfile(ctxWithIdentity(root), p, true))
+	})
+
+	t.Run("owner allowed", func(t *testing.T) {
+		p := writeTargetProfile(t, t.TempDir(), "p", []string{"uid:1000"}, false)
+		assert.NoError(t, s.authorizeTargetProfile(ctxWithIdentity(owner), p, true))
+	})
+
+	t.Run("non-owner denied", func(t *testing.T) {
+		p := writeTargetProfile(t, t.TempDir(), "p", []string{"uid:1000"}, false)
+		err := s.authorizeTargetProfile(ctxWithIdentity(other), p, true)
+		assert.Equal(t, codes.PermissionDenied, gstatus.Code(err))
+	})
+
+	t.Run("shared allows any caller", func(t *testing.T) {
+		p := writeTargetProfile(t, t.TempDir(), "p", nil, true)
+		assert.NoError(t, s.authorizeTargetProfile(ctxWithIdentity(other), p, true))
+	})
+
+	t.Run("unowned claim stamps owner", func(t *testing.T) {
+		p := writeTargetProfile(t, t.TempDir(), "p", nil, false)
+		require.NoError(t, s.authorizeTargetProfile(ctxWithIdentity(other), p, true))
+
+		owners, shared := readOwners(t, p.Path)
+		assert.Equal(t, []string{"uid:1001"}, owners)
+		assert.False(t, shared)
+
+		// A different caller is now locked out of the claimed profile.
+		err := s.authorizeTargetProfile(ctxWithIdentity(owner), p, true)
+		assert.Equal(t, codes.PermissionDenied, gstatus.Code(err))
+	})
+
+	t.Run("unowned without claim leaves profile unowned", func(t *testing.T) {
+		p := writeTargetProfile(t, t.TempDir(), "p", nil, false)
+		require.NoError(t, s.authorizeTargetProfile(ctxWithIdentity(other), p, false))
+
+		owners, _ := readOwners(t, p.Path)
+		assert.Empty(t, owners)
+	})
+}
--- a/client/server/profile_authz.go
+++ b/client/server/profile_authz.go
@@ -0,0 +1,51 @@
+package server
+
+import (
+	"context"
+	"runtime"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+)
+
+// bindCallerUsername enforces that a non-privileged caller may only operate on
+// its OWN user's profiles. This binds the client-supplied gRPC field to the
+// caller's kernel identity.
+// Privileged callers (root / elevated-admin) may manage any user's profiles.
+func (s *Server) bindCallerUsername(ctx context.Context, requested string) error {
+	if requested == "" {
+		return nil
+	}
+
+	id, ok := ipcauth.IdentityFromContext(ctx)
+	if !ok {
+		return gstatus.Error(codes.PermissionDenied, "caller identity could not be verified")
+	}
+	if id.IsPrivileged() {
+		return nil
+	}
+
+	caller, err := usernameForIdentity(id)
+	if err != nil {
+		log.Warnf("profile authz: resolve caller username for %s: %v", id, err)
+		return gstatus.Error(codes.PermissionDenied, "could not resolve caller identity to a username")
+	}
+	if !usernamesEqual(requested, caller) {
+		return gstatus.Errorf(codes.PermissionDenied,
+			"not authorized to operate on another user's profiles (caller %q requested %q)", caller, requested)
+	}
+	return nil
+}
+
+// usernamesEqual compares usernames case-insensitively on Windows (domain
+// accounts) and exactly on Unix.
+func usernamesEqual(a, b string) bool {
+	if runtime.GOOS == "windows" {
+		return strings.EqualFold(a, b)
+	}
+	return a == b
+}
--- a/client/server/profile_authz_unix.go
+++ b/client/server/profile_authz_unix.go
@@ -0,0 +1,20 @@
+//go:build !windows
+
+package server
+
+import (
+	"strconv"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+	"github.com/netbirdio/netbird/client/internal/shell"
+)
+
+// usernameForIdentity resolves a Unix caller's UID to its username via NSS
+// (getent), so LDAP/AD users resolve correctly under CGO_ENABLED=0.
+func usernameForIdentity(id ipcauth.Identity) (string, error) {
+	u, err := shell.GetUserFromGetent(strconv.FormatUint(uint64(id.UID), 10))
+	if err != nil {
+		return "", err
+	}
+	return u.Username, nil
+}
--- a/client/server/profile_authz_windows.go
+++ b/client/server/profile_authz_windows.go
@@ -0,0 +1,18 @@
+//go:build windows
+
+package server
+
+import (
+	"os/user"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+)
+
+// usernameForIdentity resolves a Windows caller's SID to its account name.
+func usernameForIdentity(id ipcauth.Identity) (string, error) {
+	u, err := user.LookupId(id.SID)
+	if err != nil {
+		return "", err
+	}
+	return u.Username, nil
+}
--- a/client/server/server.go
+++ b/client/server/server.go
@@ -23,6 +23,7 @@ import (

 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/expose"
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	sleephandler "github.com/netbirdio/netbird/client/internal/sleep/handler"
 	"github.com/netbirdio/netbird/client/mdm"
@@ -126,6 +127,12 @@ type Server struct {
 	updateManager *updater.Manager

 	jwtCache *jwtCache
+
+	// groupResolver resolves a Unix caller's supplementary group membership
+	// (NSS/getent) so gid:/group: owner principals authorize correctly. Nil on
+	// Windows (SID group membership travels in the identity itself); ipcauth
+	// treats a nil resolver as "no group matching".
+	groupResolver ipcauth.GroupResolver
 }

 type oauthAuthFlow struct {
@@ -150,6 +157,7 @@ func New(ctx context.Context, logFile string, configFile string, profilesDisable
 		jwtCache:               newJWTCache(),
 		extendAuthSessionFlow:  auth.NewPendingFlow(),
 		probeThrottle:          newProbeThrottle(probeThreshold),
+		groupResolver:          ipcauth.NewDefaultGroupResolver(),
 	}
 	agent := &serverAgent{s}
 	s.sleepHandler = sleephandler.New(agent)
@@ -181,7 +189,7 @@ func (s *Server) Start() error {
 		log.Warnf("failed to redirect stderr: %v", err)
 	}

-	if err := restoreResidualState(s.rootCtx, s.profileManager.GetStatePath()); err != nil {
+	if err := RestoreResidualState(s.rootCtx, s.profileManager.GetStatePath()); err != nil {
 		log.Warnf(errRestoreResidualState, err)
 	}

@@ -402,6 +410,11 @@ func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigReques
 		}
 	}

+	// SSH root login / disabling SSH auth requires a privileged caller.
+	if err := requirePrivilegedForDangerousSSH(callerCtx, msg.EnableSSHRoot, msg.DisableSSHAuth); err != nil {
+		return nil, err
+	}
+
 	// MDM gate: refuse the whole request if any of its fields is enforced
 	// by the active MDM policy. The error carries an MDMManagedFields-
 	// Violation detail listing the offending key names. Non-conflicting
@@ -537,6 +550,11 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 		}
 	}

+	// SSH root login / disabling SSH auth requires a privileged caller.
+	if err := requirePrivilegedForDangerousSSH(callerCtx, msg.EnableSSHRoot, msg.DisableSSHAuth); err != nil {
+		return nil, err
+	}
+
 	s.mutex.Lock()
 	if s.actCancel != nil {
 		s.actCancel()
@@ -551,7 +569,7 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	s.actCancel = cancel
 	s.mutex.Unlock()

-	if err := restoreResidualState(s.rootCtx, s.profileManager.GetStatePath()); err != nil {
+	if err := RestoreResidualState(s.rootCtx, s.profileManager.GetStatePath()); err != nil {
 		log.Warnf(errRestoreResidualState, err)
 	}

@@ -828,6 +846,7 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin
 		return nil, err
 	}

+	log.Infof("SSO login flow finished, returning success to caller")
 	return &proto.WaitSSOLoginResponse{
 		Email: tokenInfo.Email,
 	}, nil
@@ -835,6 +854,7 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin

 // Up starts engine work in the daemon.
 func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpResponse, error) {
+	log.Infof("up request received")
 	s.mutex.Lock()
 	// clientRunning is the daemon-intent flag (set by previous Up/Start, cleared
 	// by Down). connectionGoroutineRunning() reports whether the previous retry-loop
@@ -856,7 +876,7 @@ func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpR

 		return s.waitForUp(callerCtx)
 	}
-	if err := restoreResidualState(callerCtx, s.profileManager.GetStatePath()); err != nil {
+	if err := RestoreResidualState(callerCtx, s.profileManager.GetStatePath()); err != nil {
 		log.Warnf(errRestoreResidualState, err)
 	}

@@ -941,6 +961,17 @@ func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpR
 	}
 	s.config = config

+	// --owner: explicitly claim ownership of the active profile for the caller.
+	if msg != nil && msg.GetClaimOwner() {
+		if id, ok := ipcauth.IdentityFromContext(callerCtx); ok {
+			if err := s.claimForCallerLocked(id, s.config); err != nil {
+				s.mutex.Unlock()
+				log.Errorf("failed to claim profile ownership: %v", err)
+				return nil, fmt.Errorf("claim owner: %w", err)
+			}
+		}
+	}
+
 	s.statusRecorder.UpdateManagementAddress(s.config.ManagementURL.String())
 	s.statusRecorder.UpdateRosenpass(s.config.RosenpassEnabled, s.config.RosenpassPermissive)

@@ -1046,6 +1077,29 @@ func (s *Server) SwitchProfile(callerCtx context.Context, msg *proto.SwitchProfi
 	}

 	if msg != nil && msg.ProfileName != nil {
+		targetUsername := ""
+		if msg.Username != nil {
+			targetUsername = *msg.Username
+		}
+		// The interceptor already gated this against the CURRENT active profile;
+		// also bind the TARGET profile's username so a caller can't switch into
+		// another user's profile.
+		if err := s.bindCallerUsername(callerCtx, targetUsername); err != nil {
+			return nil, err
+		}
+		// Authorize against the target profile's owners, claiming an unowned
+		// legacy target for the caller.
+		resolveUsername := targetUsername
+		if *msg.ProfileName == profilemanager.DefaultProfileName {
+			resolveUsername = ""
+		}
+		resolvedTarget, err := s.resolveProfileHandle(*msg.ProfileName, resolveUsername)
+		if err != nil {
+			return nil, err
+		}
+		if err := s.authorizeTargetProfile(callerCtx, resolvedTarget, true); err != nil {
+			return nil, err
+		}
 		if _, err := s.switchProfileIfNeeded(*msg.ProfileName, msg.Username, activeProf); err != nil {
 			log.Errorf("failed to switch profile: %v", err)
 			return nil, err
@@ -1079,7 +1133,10 @@ func (s *Server) Down(ctx context.Context, _ *proto.DownRequest) (*proto.DownRes

 	if err := s.cleanupConnection(); err != nil {
 		s.mutex.Unlock()
-		// todo review to update the status in case any type of error
+		if errors.Is(err, ErrServiceNotUp) {
+			log.Debugf("Down called while service not up: %v", err)
+			return nil, err
+		}
 		log.Errorf("failed to shut down properly: %v", err)
 		return nil, err
 	}
@@ -1152,7 +1209,7 @@ func (s *Server) cleanupConnection() error {
 	// making the run loop the sole owner of engine shutdown.
 	if engine != nil {
 		if err := engine.Stop(); err != nil {
-			return err
+			log.Errorf("failed to stop engine during cleanup: %v", err)
 		}
 	}

@@ -2000,7 +2057,18 @@ func (s *Server) AddProfile(ctx context.Context, msg *proto.AddProfileRequest) (
 		return nil, gstatus.Errorf(codes.InvalidArgument, "profile name and username must be provided")
 	}

-	created, err := s.profileManager.AddProfile(msg.ProfileName, msg.Username)
+	if err := s.bindCallerUsername(ctx, msg.Username); err != nil {
+		return nil, err
+	}
+
+	// Auto-isolate the new profile to its creator. When root/admin creates it we
+	// leave it unowned so the intended user claims it via trust-on-first-use.
+	var initialOwners []string
+	if id, ok := ipcauth.IdentityFromContext(ctx); ok && !id.IsPrivileged() {
+		initialOwners = []string{ipcauth.OwnerPrincipalForIdentity(id)}
+	}
+
+	created, err := s.profileManager.AddProfile(msg.ProfileName, msg.Username, initialOwners)
 	if err != nil {
 		log.Errorf("failed to create profile: %v", err)
 		return nil, fmt.Errorf("failed to create profile: %w", err)
@@ -2023,11 +2091,19 @@ func (s *Server) RenameProfile(ctx context.Context, msg *proto.RenameProfileRequ
 		return nil, gstatus.Errorf(codes.InvalidArgument, "profile name, username and new profile name must be provided")
 	}

+	if err := s.bindCallerUsername(ctx, msg.Username); err != nil {
+		return nil, err
+	}
+
 	resolved, err := s.resolveProfileHandle(msg.Handle, msg.Username)
 	if err != nil {
 		return nil, err
 	}

+	if err := s.authorizeTargetProfile(ctx, resolved, true); err != nil {
+		return nil, err
+	}
+
 	err = s.profileManager.RenameProfile(resolved.ID, msg.Username, msg.NewProfileName)
 	if err != nil {
 		log.Errorf("failed to rename profile: %v", err)
@@ -2052,11 +2128,20 @@ func (s *Server) RemoveProfile(ctx context.Context, msg *proto.RemoveProfileRequ
 		return nil, gstatus.Errorf(codes.InvalidArgument, "profile name must be provided")
 	}

+	if err := s.bindCallerUsername(ctx, msg.Username); err != nil {
+		return nil, err
+	}
+
 	resolved, err := s.resolveProfileHandle(msg.ProfileName, msg.Username)
 	if err != nil {
 		return nil, err
 	}

+	// claim=false: don't stamp ownership on a profile we're about to delete.
+	if err := s.authorizeTargetProfile(ctx, resolved, false); err != nil {
+		return nil, err
+	}
+
 	if err := s.logoutFromProfile(ctx, resolved); err != nil {
 		log.Warnf("failed to logout from profile %s before removal: %v", resolved.ID, err)
 	}
@@ -2120,6 +2205,10 @@ func (s *Server) ListProfiles(ctx context.Context, msg *proto.ListProfilesReques
 		return nil, gstatus.Errorf(codes.InvalidArgument, "username must be provided")
 	}

+	if err := s.bindCallerUsername(ctx, msg.Username); err != nil {
+		return nil, err
+	}
+
 	profiles, err := s.profileManager.ListProfiles(msg.Username)
 	if err != nil {
 		log.Errorf("failed to list profiles: %v", err)
--- a/client/server/ssh_gate.go
+++ b/client/server/ssh_gate.go
@@ -0,0 +1,36 @@
+package server
+
+import (
+	"context"
+
+	log "github.com/sirupsen/logrus"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+)
+
+// requirePrivilegedForDangerousSSH enforces admin permissions for SSH config.
+// Enabling SSH root login or disabling SSH authentication turns the
+// root/LocalSystem daemon's SSH server into an unauthenticated root shell
+// (local-to-remote-root escalation), so only a privileged caller  may set
+// these flags to true over the local IPC.
+func requirePrivilegedForDangerousSSH(ctx context.Context, enableSSHRoot, disableSSHAuth *bool) error {
+	dangerous := (enableSSHRoot != nil && *enableSSHRoot) || (disableSSHAuth != nil && *disableSSHAuth)
+	if !dangerous {
+		return nil
+	}
+
+	id, ok := ipcauth.IdentityFromContext(ctx)
+	if !ok {
+		log.Warnf("denying SSH root/no-auth config change: caller identity unavailable on this control channel")
+		return gstatus.Error(codes.PermissionDenied,
+			"enabling SSH root login or disabling SSH authentication requires root/administrator, but the caller identity could not be verified on this daemon control channel")
+	}
+	if !id.IsPrivileged() {
+		log.Warnf("denying SSH root/no-auth config change from non-privileged caller %s", id)
+		return gstatus.Errorf(codes.PermissionDenied,
+			"enabling SSH root login or disabling SSH authentication requires root/administrator (caller %s is not privileged); rerun as root/administrator", id)
+	}
+	return nil
+}
--- a/client/server/ssh_gate_test.go
+++ b/client/server/ssh_gate_test.go
@@ -0,0 +1,52 @@
+package server
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/peer"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+)
+
+func ctxWithIdentity(id ipcauth.Identity) context.Context {
+	return peer.NewContext(context.Background(), &peer.Peer{AuthInfo: ipcauth.AuthInfo{Identity: id}})
+}
+
+func boolPtr(b bool) *bool { return &b }
+
+func TestRequirePrivilegedForDangerousSSH(t *testing.T) {
+	root := ipcauth.Identity{UID: 0}
+	user := ipcauth.Identity{UID: 1000}
+
+	tests := []struct {
+		name           string
+		ctx            context.Context
+		enableSSHRoot  *bool
+		disableSSHAuth *bool
+		wantDenied     bool
+	}{
+		{"no flags, no identity", context.Background(), nil, nil, false},
+		{"flags false, non-priv", ctxWithIdentity(user), boolPtr(false), boolPtr(false), false},
+		{"enableSSHRoot by root", ctxWithIdentity(root), boolPtr(true), nil, false},
+		{"enableSSHRoot by non-priv", ctxWithIdentity(user), boolPtr(true), nil, true},
+		{"disableSSHAuth by non-priv", ctxWithIdentity(user), nil, boolPtr(true), true},
+		{"enableSSHRoot no identity (fail closed)", context.Background(), boolPtr(true), nil, true},
+		{"both by root", ctxWithIdentity(root), boolPtr(true), boolPtr(true), false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := requirePrivilegedForDangerousSSH(tt.ctx, tt.enableSSHRoot, tt.disableSSHAuth)
+			if tt.wantDenied {
+				assert.Error(t, err)
+				assert.Equal(t, codes.PermissionDenied, gstatus.Code(err))
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
--- a/client/server/state.go
+++ b/client/server/state.go
@@ -46,7 +46,7 @@ func (s *Server) CleanState(ctx context.Context, req *proto.CleanStateRequest) (

 	if req.All {
 		// Reuse existing cleanup logic for all states
-		if err := restoreResidualState(ctx, statePath); err != nil {
+		if err := RestoreResidualState(ctx, statePath); err != nil {
 			return nil, status.Errorf(codes.Internal, "failed to clean all states: %v", err)
 		}

@@ -113,9 +113,9 @@ func (s *Server) DeleteState(ctx context.Context, req *proto.DeleteStateRequest)
 	}, nil
 }

-// restoreResidualState checks if the client was not shut down in a clean way and restores residual if required.
+// RestoreResidualState checks if the client was not shut down in a clean way and restores residual if required.
 // Otherwise, we might not be able to connect to the management server to retrieve new config.
-func restoreResidualState(ctx context.Context, statePath string) error {
+func RestoreResidualState(ctx context.Context, statePath string) error {
 	if statePath == "" {
 		return nil
 	}
--- a/client/ssh/config/manager.go
+++ b/client/ssh/config/manager.go
@@ -14,6 +14,7 @@ import (
 	log "github.com/sirupsen/logrus"

 	nbssh "github.com/netbirdio/netbird/client/ssh"
+	"github.com/netbirdio/netbird/shared/management/domain"
 )

 const (
@@ -218,11 +219,20 @@ func (m *Manager) buildHostPatterns(peer PeerSSHInfo) []string {
 	if peer.IPv6.IsValid() {
 		hostPatterns = append(hostPatterns, peer.IPv6.String())
 	}
-	if peer.FQDN != "" {
+	// Peer FQDNs and hostnames originate from remote peers, so they must be
+	// validated as plain DNS names before being embedded in the ssh_config
+	// "Match host" pattern list. This prevents injection of arbitrary
+	// ssh_config directives via embedded quotes, whitespace, newlines, the
+	// comma pattern separator, or the "*"/"?" pattern metacharacters.
+	if domain.IsValidDomainNoWildcard(peer.FQDN) {
 		hostPatterns = append(hostPatterns, peer.FQDN)
+	} else if peer.FQDN != "" {
+		log.Warnf("skipping peer FQDN with invalid characters in SSH config: %q", peer.FQDN)
 	}
-	if peer.Hostname != "" && peer.Hostname != peer.FQDN {
+	if peer.Hostname != peer.FQDN && domain.IsValidDomainNoWildcard(peer.Hostname) {
 		hostPatterns = append(hostPatterns, peer.Hostname)
+	} else if peer.Hostname != "" && peer.Hostname != peer.FQDN {
+		log.Warnf("skipping peer hostname with invalid characters in SSH config: %q", peer.Hostname)
 	}
 	return hostPatterns
 }
--- a/Show More
+++ b/Show More