diff --git a/.dockerignore b/.dockerignore
index 609a1b746..384ba4b99 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,4 +1,16 @@
+.git
+node_modules
+.venv
 env
+__pycache__
+*.pyc
+*.pyo
 enferno/media
 enferno/imports
 logs
+backups
+.env
+.env.*
+.DS_Store
+*.md
+docs/node_modules
diff --git a/.gitignore b/.gitignore
index fea7c8a77..f63a36744 100644
--- a/.gitignore
+++ b/.gitignore
@@ -30,3 +30,9 @@ backups/*
 cookies.txt
 
 *.egg-info/
+
+# Release signing: NEVER commit secret keys. The pinned public key is baked
+# into the installer/updater, not stored as a loose file in the repo.
+*.key
+bayanat-release.key
+bayanat-release.pub
diff --git a/SAFE_EXPUNGING.md b/SAFE_EXPUNGING.md
new file mode 100644
index 000000000..cdc2eb497
--- /dev/null
+++ b/SAFE_EXPUNGING.md
@@ -0,0 +1,43 @@
+# Safe Expunging Process
+
+This document describes when and how history-altering operations are permitted on the Bayanat source repository, satisfying the SLSA v1.2 Source track "Safe Expunging Process" requirement.
+
+## Scope
+
+Applies to the public repository `sjacorg/bayanat` and the private release repository `sjacorg/bayanat.prod`, specifically to operations that remove or rewrite committed history on protected references (`main`, release tags matching `v*`).
+
+## Default
+
+History on protected references is append-only. Force-push, branch deletion, tag deletion, and retagging are blocked by repository rulesets.
+
+## Permitted Reasons to Expunge
+
+Expunging may be approved only for one of the following reasons:
+
+1. **Secret leak.** An unredacted credential, private key, or access token was committed.
+2. **Personal data leak.** Non-public personal data of an identifiable individual was committed.
+3. **Legal or safety order.** A verified order from counsel or a credible safety concern requires removal of specific content.
+4. **Malicious injection.** Attacker-introduced code or data must be removed as part of incident response.
+
+Bug fixes, style corrections, and cleanup are never valid reasons.
+
+## Approval
+
+Both maintainers must approve in writing, recorded in the security advisory created for the incident.
+
+## Procedure
+
+1. File a private security advisory at https://github.com/sjacorg/bayanat/security/advisories with the reason, affected commits, and proposed action.
+2. Record both maintainer approvals in the advisory.
+3. If the reason involves a secret, rotate it before rewriting.
+4. Rewrite with `git filter-repo` (not `filter-branch`), preserving commit signatures where possible.
+5. Temporarily bypass branch protection, force-update the protected reference, then re-enable protection.
+6. Invalidate and regenerate any affected release tags. Old tags are not reused.
+
+## Consumer Notification
+
+After any expunging action, publish a public security advisory that includes:
+
+- What was removed and why (redacted as needed).
+- New commit hashes and release tags that replace the expunged revisions.
+- Operator guidance (re-clone, re-verify signatures, check deployed commit against the new history).
diff --git a/bayanat b/bayanat
index a89ac1d9f..181be75bd 100755
--- a/bayanat
+++ b/bayanat
@@ -5,7 +5,7 @@
 #
 set -euo pipefail
 
-readonly SCRIPT_VERSION="1.2.0"
+readonly SCRIPT_VERSION="1.3.0"
 readonly BAYANAT_ROOT="/opt/bayanat"
 readonly RELEASES_DIR="$BAYANAT_ROOT/releases"
 readonly SHARED_DIR="$BAYANAT_ROOT/shared"
@@ -13,7 +13,27 @@ readonly LOGS_DIR="$BAYANAT_ROOT/logs"
 readonly CURRENT_LINK="$BAYANAT_ROOT/current"
 readonly DEFAULT_REPO="sjacorg/bayanat"
 readonly GIT_URL="https://github.com/${BAYANAT_REPO:-$DEFAULT_REPO}.git"
+# Pinned SJAC release-signing key (BAY-01-017). Release tarballs are verified
+# against this minisign public key before install; an unsigned or mismatched
+# tarball is refused. Baked into this root-owned script so it cannot be swapped
+# at update time. Rotation needs a fresh install or a documented manual swap
+# (minisign has no revocation); see docs/deployment/release-signing.md.
+readonly RELEASE_PUBKEY="RWS7XvDVF0InHWTCh/86K8sXGcHU/PmzCl4uH9GUDjNnNzHhcX1BvGqZ"
+# Service accounts (BAY-01-032): web and worker run as separate system users.
+# $APP_USER remains the deploy/database identity (PG role name, peer auth for
+# admin operations) and the shared group that grants read access to releases.
 readonly APP_USER="bayanat"
+readonly APP_GROUP="bayanat"
+readonly WEB_USER="bayanat-web"
+readonly CELERY_USER="bayanat-celery"
+# App-writable runtime state shared between web and worker (config.json,
+# reload/restart sentinels, celery beat schedule). Kept separate from
+# $SHARED_DIR itself so .env never lives in a service-writable directory.
+readonly RUNTIME_DIR="$SHARED_DIR/runtime"
+# uv-managed Python interpreters go in a root-owned, world-readable location
+# instead of /root, so the venv stays usable by the service accounts
+# (releases are built by root, BAY-01-032).
+export UV_PYTHON_INSTALL_DIR="/usr/local/share/uv/python"
 
 # --- Logging ---
 
@@ -71,10 +91,13 @@ current_version() {
 }
 
 flask_run() {
+    # --no-sync: releases and their .venv are root-owned (BAY-01-032); deps
+    # are installed by _install_deps as root, so uv must not try to re-sync
+    # the environment while running as $APP_USER.
     local version="$1"; shift
     sudo -u "$APP_USER" \
-        env FLASK_APP=run.py \
-        /usr/local/bin/uv run \
+        env FLASK_APP=run.py UV_PYTHON_INSTALL_DIR="$UV_PYTHON_INSTALL_DIR" \
+        /usr/local/bin/uv run --no-sync \
         --directory "$RELEASES_DIR/$version" \
         flask "$@"
 }
@@ -85,6 +108,487 @@ swap_symlink() {
     mv -Tf "$CURRENT_LINK.tmp" "$CURRENT_LINK"
 }
 
+# --- Snapshot helpers ---
+
+SNAPSHOT_RETENTION_DAYS="${BAYANAT_SNAPSHOT_RETENTION_DAYS:-30}"
+readonly SNAPSHOT_RETENTION_COUNT=5
+
+_pg_load() {
+    # Loads POSTGRES_* / REDIS_PASSWORD from shared/.env into the current
+    # shell env WITHOUT eval. Must be invoked inside a subshell so the
+    # exports do not leak.
+    #
+    # Why no eval: a malicious .env value (writable by the bayanat user)
+    # could smuggle shell commands that would run as root under `bayanat
+    # update`. `export "$key=$val"` treats $val as a literal string, no
+    # interpretation.
+    local env_file="$SHARED_DIR/.env"
+    [[ -f "$env_file" ]] || die "missing $env_file"
+    local key val
+    while IFS='=' read -r key val; do
+        case "$key" in
+            POSTGRES_HOST|POSTGRES_PORT|POSTGRES_USER|POSTGRES_PASSWORD|POSTGRES_DB|REDIS_PASSWORD)
+                # Strip matching surrounding quotes (common .env convention).
+                if [[ ${#val} -ge 2 ]]; then
+                    if [[ "${val:0:1}" == '"' && "${val: -1}" == '"' ]] \
+                        || [[ "${val:0:1}" == "'" && "${val: -1}" == "'" ]]; then
+                        val="${val:1:${#val}-2}"
+                    fi
+                fi
+                export "$key=$val"
+                ;;
+        esac
+    done < "$env_file"
+}
+
+snapshot_pg_dump() {
+    # $1 = previous tag, $2 = target tag
+    # Writes shared/backups/pre-<prev>-to-<target>-<ts>.dump via .partial rename.
+    # Mirrors enferno/utils/backup_utils.py:pg_dump logic: localhost + no
+    # password -> socket peer auth; else TCP with PGPASSWORD.
+    local prev="$1" target="$2"
+    local ts name partial final
+    ts=$(date -u +%Y%m%d-%H%M)
+    name="pre-${prev}-to-${target}-${ts}.dump"
+    partial="$SHARED_DIR/backups/${name}.partial"
+    final="$SHARED_DIR/backups/${name}"
+    # Log goes to stderr so `$(snapshot_pg_dump ...)` captures only the
+    # basename from the trailing `echo "$name"`.
+    log "Taking pre-update snapshot: $name" >&2
+    (
+        _pg_load
+        local user="${POSTGRES_USER:-$APP_USER}"
+        local db="${POSTGRES_DB:-$APP_USER}"
+        local host="${POSTGRES_HOST:-localhost}"
+        if [[ "$host" == "localhost" && -z "${POSTGRES_PASSWORD:-}" ]]; then
+            sudo -u "$user" pg_dump -Fc -f "$partial" "$db"
+        else
+            PGPASSWORD="${POSTGRES_PASSWORD:-}" \
+                pg_dump -Fc \
+                    -h "$host" \
+                    -p "${POSTGRES_PORT:-5432}" \
+                    -U "$user" \
+                    -f "$partial" \
+                    "$db"
+        fi
+    )
+    mv -Tf "$partial" "$final"
+    echo "$name"
+}
+
+prune_snapshots() {
+    # Keep last $SNAPSHOT_RETENTION_COUNT snapshots OR last
+    # $SNAPSHOT_RETENTION_DAYS days, whichever is greater.
+    local backups="$SHARED_DIR/backups"
+    [[ -d "$backups" ]] || return 0
+    # Sweep any leaked .partial snapshot files from interrupted dumps
+    rm -f "$backups"/*.dump.partial 2>/dev/null || true
+    local cutoff_epoch
+    cutoff_epoch=$(date -d "-${SNAPSHOT_RETENTION_DAYS} days" +%s 2>/dev/null \
+        || date -v-"${SNAPSHOT_RETENTION_DAYS}"d +%s)
+    local idx=0 name path mtime
+    while IFS= read -r path; do
+        idx=$((idx + 1))
+        name=$(basename "$path")
+        mtime=$(stat -c %Y "$path" 2>/dev/null || stat -f %m "$path")
+        if [[ "$idx" -le "$SNAPSHOT_RETENTION_COUNT" ]]; then
+            continue
+        fi
+        if [[ "$mtime" -lt "$cutoff_epoch" ]]; then
+            log "Pruning snapshot: $name"
+            rm -f "$path"
+        fi
+    done < <(ls -1t "$backups"/pre-*.dump 2>/dev/null || true)
+}
+
+list_snapshots() {
+    local backups="$SHARED_DIR/backups"
+    [[ -d "$backups" ]] || { echo "No snapshots directory."; return; }
+    printf '%-60s %10s %20s\n' "NAME" "SIZE" "AGE"
+    local name size mtime age
+    while IFS= read -r path; do
+        name=$(basename "$path")
+        size=$(du -h "$path" | cut -f1)
+        mtime=$(stat -c %Y "$path" 2>/dev/null || stat -f %m "$path")
+        age="$(( ($(date +%s) - mtime) / 3600 ))h"
+        printf '%-60s %10s %20s\n' "$name" "$size" "$age"
+    done < <(ls -1t "$backups"/pre-*.dump 2>/dev/null || true)
+}
+
+restore_pg() {
+    # $1 = snapshot basename (no path). Stops services, restores, starts services.
+    local name="$1"
+    local path="$SHARED_DIR/backups/$name"
+    [[ -f "$path" ]] || die "snapshot not found: $path"
+    log "Restoring $name (this will DROP and RECREATE tables)"
+    read -r -p "Type 'yes' to confirm: " reply
+    [[ "$reply" == "yes" ]] || die "aborted"
+    systemctl stop bayanat bayanat-celery
+    if ! (
+        _pg_load
+        local user="${POSTGRES_USER:-$APP_USER}"
+        local db="${POSTGRES_DB:-$APP_USER}"
+        local host="${POSTGRES_HOST:-localhost}"
+        if [[ "$host" == "localhost" && -z "${POSTGRES_PASSWORD:-}" ]]; then
+            sudo -u "$user" pg_restore --clean --if-exists -d "$db" "$path"
+        else
+            PGPASSWORD="${POSTGRES_PASSWORD:-}" \
+                pg_restore --clean --if-exists \
+                    -h "$host" \
+                    -p "${POSTGRES_PORT:-5432}" \
+                    -U "$user" \
+                    -d "$db" \
+                    "$path"
+        fi
+    ); then
+        systemctl start bayanat bayanat-celery
+        die "pg_restore failed; services restarted on existing DB"
+    fi
+    systemctl start bayanat bayanat-celery
+    log "Restore complete"
+}
+
+# --- Update state + lock ---
+
+readonly STATE_DIR="$BAYANAT_ROOT/state"
+readonly STATE_FILE="$STATE_DIR/update.json"
+readonly LOCK_FILE="$STATE_DIR/update.lock"
+
+_now_iso() { date -u +%Y-%m-%dT%H:%M:%SZ; }
+
+write_state() {
+    # write_state <phase> <phase_label>
+    # Reads STATE_TARGET / STATE_PREVIOUS / STATE_SNAPSHOT /
+    # STATE_STARTED_AT / STATE_PROGRESS / STATE_ERROR_JSON from environment.
+    local phase="$1" label="$2"
+    mkdir -p "$STATE_DIR"
+    local tmp="$STATE_FILE.tmp"
+    cat > "$tmp" <<EOF
+{
+  "phase": "$phase",
+  "phase_label": "$label",
+  "target": "${STATE_TARGET:-}",
+  "previous": "${STATE_PREVIOUS:-}",
+  "snapshot": "${STATE_SNAPSHOT:-}",
+  "started_at": "${STATE_STARTED_AT:-$(_now_iso)}",
+  "updated_at": "$(_now_iso)",
+  "progress_text": "${STATE_PROGRESS:-}",
+  "error": ${STATE_ERROR_JSON:-null},
+  "pid": $$,
+  "unit": "${BAYANAT_UPDATE_UNIT:-bayanat-update.service}"
+}
+EOF
+    mv -Tf "$tmp" "$STATE_FILE"
+}
+
+clear_state() {
+    rm -f "$STATE_FILE"
+}
+
+read_phase() {
+    [[ -f "$STATE_FILE" ]] || { echo IDLE; return; }
+    python3 -c "import json,sys; print(json.load(open('$STATE_FILE')).get('phase','IDLE'))" \
+        2>/dev/null || echo IDLE
+}
+
+read_field() {
+    # $1 = field name
+    [[ -f "$STATE_FILE" ]] || return 1
+    python3 -c "import json,sys; print(json.load(open('$STATE_FILE')).get('$1',''))" 2>/dev/null
+}
+
+acquire_lock() {
+    mkdir -p "$STATE_DIR"
+    if [[ -f "$LOCK_FILE" ]]; then
+        local pid
+        pid=$(cat "$LOCK_FILE" 2>/dev/null || echo 0)
+        if [[ "$pid" -gt 0 ]] && kill -0 "$pid" 2>/dev/null; then
+            die "another update is running (pid $pid)"
+        fi
+        log "Removing stale lock (pid $pid)"
+        rm -f "$LOCK_FILE"
+    fi
+    echo $$ > "$LOCK_FILE"
+}
+
+release_lock() {
+    rm -f "$LOCK_FILE"
+}
+
+# --- Recovery dispatch ---
+
+recover_state() {
+    local phase
+    phase=$(read_phase)
+    case "$phase" in
+        IDLE)
+            return 0
+            ;;
+        PREPARE_DONE)
+            log "Recovery: PREPARE_DONE — cleaning partial release and clearing state"
+            local target
+            target=$(read_field target || true)
+            if [[ -n "$target" ]]; then
+                rm -rf "$RELEASES_DIR/$target.partial" "$RELEASES_DIR/$target"
+            fi
+            clear_state
+            release_lock
+            ;;
+        MIGRATE_DONE)
+            log "Recovery: MIGRATE_DONE — starting services on previous release"
+            systemctl start bayanat bayanat-celery
+            if _wait_healthy 60; then
+                log "Recovery OK; operator should re-run update to finish"
+                clear_state
+                release_lock
+            else
+                STATE_ERROR_JSON='"MIGRATE_DONE recovery: previous release unhealthy"'
+                write_state NEEDS_INTERVENTION "Services unhealthy after recovery; restore snapshot manually"
+                exit 2
+            fi
+            ;;
+        SWITCH_DONE)
+            log "Recovery: SWITCH_DONE — running code rollback"
+            rollback_code
+            ;;
+        SUCCESS|ROLLED_BACK)
+            clear_state
+            release_lock
+            ;;
+        NEEDS_INTERVENTION)
+            local snap prev
+            snap=$(read_field snapshot || true)
+            prev=$(read_field previous || true)
+            die "Operator intervention required. Snapshot: $snap  Previous tag: $prev  See: bayanat snapshots"
+            ;;
+        MIGRATE|SWITCH|ROLLBACK)
+            log "Recovery: $phase — attempting to restart services"
+            systemctl start bayanat bayanat-celery 2>/dev/null || true
+            if _wait_healthy 60; then
+                warn "Services healthy but update was interrupted mid-$phase"
+                warn "DB schema state is uncertain; re-run 'bayanat update' to finish"
+                clear_state
+                release_lock
+            else
+                export STATE_ERROR_JSON="\"interrupted during $phase; services unhealthy\""
+                write_state NEEDS_INTERVENTION "Update interrupted mid-$phase; manual recovery required"
+                exit 2
+            fi
+            ;;
+        *)
+            warn "Unknown phase '$phase' — clearing and starting fresh"
+            clear_state
+            release_lock
+            ;;
+    esac
+}
+
+# --- Health probe ---
+
+_socket_path() {
+    # Hardened layout binds in /run/bayanat (releases are read-only,
+    # BAY-01-032); fall back to the legacy in-release socket for installs
+    # that predate it.
+    if [[ -S /run/bayanat/bayanat.sock ]]; then
+        echo /run/bayanat/bayanat.sock
+    else
+        echo "$CURRENT_LINK/bayanat.sock"
+    fi
+}
+
+_socket_health() {
+    # curl the Flask /health over the unix socket. Returns 0 on HTTP 200.
+    curl -s --unix-socket "$(_socket_path)" \
+        --max-time 3 -o /dev/null -w '%{http_code}' \
+        http://localhost/health 2>/dev/null | grep -q '^200$'
+}
+
+_db_ping() {
+    (
+        _pg_load
+        local user="${POSTGRES_USER:-$APP_USER}"
+        local db="${POSTGRES_DB:-$APP_USER}"
+        local host="${POSTGRES_HOST:-localhost}"
+        if [[ "$host" == "localhost" && -z "${POSTGRES_PASSWORD:-}" ]]; then
+            sudo -u "$user" psql -d "$db" -c 'SELECT 1' -t >/dev/null 2>&1
+        else
+            PGPASSWORD="${POSTGRES_PASSWORD:-}" \
+                psql -h "$host" -U "$user" -d "$db" \
+                     -c 'SELECT 1' -t >/dev/null 2>&1
+        fi
+    )
+}
+
+_redis_ping() {
+    # Redis requires auth on hardened installs (BAY-01-027). REDISCLI_AUTH
+    # keeps the password out of the process list, unlike -a.
+    (
+        _pg_load
+        if [[ -n "${REDIS_PASSWORD:-}" ]]; then
+            REDISCLI_AUTH="$REDIS_PASSWORD" redis-cli ping 2>/dev/null | grep -q '^PONG$'
+        else
+            redis-cli ping 2>/dev/null | grep -q '^PONG$'
+        fi
+    )
+}
+
+_wait_healthy() {
+    # $1 = deadline in seconds (default 60)
+    local deadline=$(( $(date +%s) + ${1:-60} ))
+    while (( $(date +%s) < deadline )); do
+        if _socket_health && _db_ping && _redis_ping; then
+            return 0
+        fi
+        sleep 1
+    done
+    return 1
+}
+
+# --- Update pipeline ---
+
+update_preflight() {
+    preflight_checks
+    _verify_service_health
+    command -v pg_dump >/dev/null || die "pg_dump not in PATH"
+    command -v pg_restore >/dev/null || die "pg_restore not in PATH"
+    # pg_dump major version must match Postgres server major version
+    local client_major server_major
+    client_major=$(pg_dump --version | awk '{print $3}' | cut -d. -f1)
+    server_major=$(
+        _pg_load
+        local user="${POSTGRES_USER:-$APP_USER}"
+        local db="${POSTGRES_DB:-$APP_USER}"
+        local host="${POSTGRES_HOST:-localhost}"
+        if [[ "$host" == "localhost" && -z "${POSTGRES_PASSWORD:-}" ]]; then
+            sudo -u "$user" psql -d "$db" \
+                -c 'SHOW server_version_num' -t 2>/dev/null
+        else
+            PGPASSWORD="${POSTGRES_PASSWORD:-}" \
+                psql -h "$host" -U "$user" -d "$db" \
+                     -c 'SHOW server_version_num' -t 2>/dev/null
+        fi | tr -d ' ' | cut -c1-2
+    )
+    [[ -n "$client_major" && -n "$server_major" ]] \
+        || die "could not determine pg_dump/server versions"
+    [[ "$client_major" == "$server_major" ]] \
+        || die "pg_dump major ($client_major) != server major ($server_major)"
+    # Disk in backups (need >= 2 GB for snapshot headroom)
+    local backups_free_kb
+    backups_free_kb=$(df --output=avail "$SHARED_DIR/backups" | tail -1 | tr -d ' ')
+    [[ "$backups_free_kb" -ge 2097152 ]] \
+        || die "need >= 2GB free in $SHARED_DIR/backups for snapshot"
+    # Schema aligned with models
+    flask_run "$(current_version)" check-db-alignment >/dev/null \
+        || die "schema drift detected; run 'flask check-db-alignment' for details"
+    # Flask doctor
+    flask_run "$(current_version)" doctor >/dev/null \
+        || die "flask doctor failed"
+}
+
+do_prepare() {
+    # $1 = target tag
+    local target="$1"
+    local current
+    current=$(current_version || echo 0)
+    [[ "$target" != "$current" ]] || die "already on $target"
+    log "PREPARE: fetching $target"
+    update_preflight
+    _fetch_release "$target"
+    _install_deps "$target"
+    _link_shared "$target"
+    acquire_lock
+    export STATE_TARGET="$target"
+    export STATE_PREVIOUS="$current"
+    export STATE_STARTED_AT
+    STATE_STARTED_AT="$(_now_iso)"
+    export STATE_PROGRESS="Fetched $target, ready to migrate"
+    write_state PREPARE_DONE "Prepared $target, ready to migrate"
+}
+
+do_migrate() {
+    local target="$STATE_TARGET"
+    local prev="$STATE_PREVIOUS"
+    log "MIGRATE: stopping services"
+    export STATE_PROGRESS="Stopping services"
+    write_state MIGRATE "Stopping services for maintenance window"
+    systemctl stop bayanat bayanat-celery
+    log "MIGRATE: pruning old snapshots"
+    prune_snapshots
+    export STATE_PROGRESS="Taking pre-update snapshot"
+    write_state MIGRATE "Taking pre-update snapshot"
+    export STATE_SNAPSHOT
+    if ! STATE_SNAPSHOT=$(snapshot_pg_dump "$prev" "$target"); then
+        export STATE_ERROR_JSON='"snapshot failed"'
+        write_state NEEDS_INTERVENTION "Pre-update snapshot failed; check backups disk and pg_dump"
+        systemctl start bayanat bayanat-celery || true
+        release_lock
+        exit 2
+    fi
+    log "MIGRATE: running migrations"
+    export STATE_PROGRESS="Running migrations"
+    write_state MIGRATE "Running migrations"
+    if ! flask_run "$target" db upgrade; then
+        export STATE_ERROR_JSON='"db upgrade failed"'
+        write_state NEEDS_INTERVENTION "Migration failed; previous release remains linked"
+        systemctl start bayanat bayanat-celery || true
+        release_lock
+        exit 2
+    fi
+    export STATE_PROGRESS="Migration complete"
+    write_state MIGRATE_DONE "Migration complete, switching to new release"
+}
+
+do_switch_verify() {
+    local target="$STATE_TARGET"
+    export STATE_PROGRESS="Swapping to $target"
+    write_state SWITCH "Swapping current -> $target"
+    swap_symlink "$RELEASES_DIR/$target"
+    systemctl start bayanat bayanat-celery
+    write_state SWITCH_DONE "Verifying new release"
+    export STATE_PROGRESS="Waiting for health probe"
+    if _wait_healthy 60; then
+        # Refresh /usr/local/bin/bayanat from the now-active release so the
+        # system CLI stays in lockstep with the deployed code. Done AFTER the
+        # health probe so a bad release never overwrites a working CLI.
+        _install_self "$target"
+        export STATE_PROGRESS="Update successful"
+        write_state SUCCESS "Update to $target complete"
+        clear_state
+        release_lock
+        log "SUCCESS: running $target"
+        return 0
+    else
+        warn "Health probe failed; rolling back code"
+        rollback_code
+        return 1
+    fi
+}
+
+rollback_code() {
+    local prev="$STATE_PREVIOUS"
+    if [[ -z "$prev" ]]; then
+        export STATE_ERROR_JSON='"cannot roll back: no previous tag recorded"'
+        write_state NEEDS_INTERVENTION "Cannot roll back: no previous tag recorded"
+        exit 2
+    fi
+    write_state ROLLBACK "Reverting symlink to $prev"
+    systemctl stop bayanat bayanat-celery || true
+    swap_symlink "$RELEASES_DIR/$prev"
+    systemctl start bayanat bayanat-celery
+    if _wait_healthy 60; then
+        export STATE_PROGRESS="Rolled back to $prev"
+        write_state ROLLED_BACK "Rolled back to $prev; snapshot retained"
+        clear_state
+        release_lock
+        log "ROLLED_BACK: on $prev; snapshot: ${STATE_SNAPSHOT:-none}"
+        exit 1
+    else
+        export STATE_ERROR_JSON='"code rollback failed health probe"'
+        write_state NEEDS_INTERVENTION "Rollback to $prev unhealthy; restore snapshot ${STATE_SNAPSHOT:-} manually"
+        exit 2
+    fi
+}
+
 # --- Step functions (each is idempotent) ---
 
 _install_system_packages() {
@@ -96,7 +600,8 @@ _install_system_packages() {
         git postgresql postgresql-contrib postgis redis-server \
         python3 python3-dev build-essential \
         libpq-dev libxml2-dev libxslt1-dev libssl-dev libffi-dev \
-        libjpeg-dev libzip-dev libimage-exiftool-perl ffmpeg curl wget jq
+        libjpeg-dev libzip-dev libimage-exiftool-perl ffmpeg curl wget jq \
+        minisign
 }
 
 _install_uv() {
@@ -138,59 +643,207 @@ _setup_app_user() {
         fi
         log "Created user $APP_USER"
     fi
-    usermod -aG "$APP_USER" caddy 2>/dev/null || true
+    # Per-service accounts (BAY-01-032): uWSGI and Celery run as separate
+    # nologin users so a compromised worker cannot act as the web app. Both
+    # share $APP_GROUP for read access to releases and shared dirs.
+    local svc_user
+    for svc_user in "$WEB_USER" "$CELERY_USER"; do
+        if ! id "$svc_user" &>/dev/null; then
+            useradd --system --no-create-home -g "$APP_GROUP" \
+                -s /usr/sbin/nologin "$svc_user"
+            log "Created service user $svc_user"
+        fi
+    done
+    usermod -aG "$APP_GROUP" caddy 2>/dev/null || true
 }
 
 _setup_database() {
     systemctl enable --now postgresql redis-server
 
     log "Setting up database..."
-    sudo -u postgres createuser -s "$APP_USER" 2>/dev/null || true
+    # Role is a plain owner with no instance-level privileges (BAY-01-031).
+    # Extensions are created by the postgres superuser below so the app role
+    # doesn't need that privilege. The role keeps table ownership because the
+    # dynamic-fields feature issues ALTER TABLE at runtime; a DML-only
+    # runtime role would break that product feature.
+    sudo -u postgres createuser "$APP_USER" 2>/dev/null || true
+    # Idempotent for upgrades: strip any instance-level privilege a previous
+    # install may have granted.
+    sudo -u postgres psql -c \
+        "ALTER ROLE \"$APP_USER\" NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION;" \
+        2>/dev/null || true
     sudo -u postgres createdb bayanat -O "$APP_USER" 2>/dev/null || true
-
-    # Configure pg_hba trust auth for app user
-    local pg_hba
+    sudo -u postgres psql -d bayanat \
+        -c "CREATE EXTENSION IF NOT EXISTS pg_trgm;" \
+        -c "CREATE EXTENSION IF NOT EXISTS postgis;" >/dev/null
+    # Only the app role (and superuser) may connect to the app database.
+    sudo -u postgres psql \
+        -c "REVOKE CONNECT ON DATABASE bayanat FROM PUBLIC;" \
+        -c "GRANT CONNECT ON DATABASE bayanat TO \"$APP_USER\";" >/dev/null
+
+    # Configure pg_hba peer auth for app user. Peer auth maps the OS user to
+    # the PG role over the local socket, so only mapped processes can connect
+    # as $APP_USER. Replaces the previous 'trust' rule which let any local OS
+    # user connect as the app role. The ident map admits the per-service
+    # accounts (BAY-01-032) plus $APP_USER itself for admin operations.
+    local pg_hba pg_ident
     pg_hba=$(find /etc/postgresql -name pg_hba.conf 2>/dev/null | head -1)
     [[ -n "$pg_hba" ]] || die "Cannot find pg_hba.conf"
+    pg_ident=$(find /etc/postgresql -name pg_ident.conf 2>/dev/null | head -1)
+    [[ -n "$pg_ident" ]] || die "Cannot find pg_ident.conf"
 
-    local rule="local   all             $APP_USER                                 trust"
+    local os_user
+    for os_user in "$APP_USER" "$WEB_USER" "$CELERY_USER"; do
+        if ! grep -qE "^bayanat[[:space:]]+${os_user}[[:space:]]" "$pg_ident"; then
+            printf '%-15s %-23s %s\n' "bayanat" "$os_user" "$APP_USER" >> "$pg_ident"
+        fi
+    done
+
+    local rule="local   all             $APP_USER                                 peer map=bayanat"
     if grep -qF "$rule" "$pg_hba"; then
         log "pg_hba.conf already configured"
     else
         log "Configuring pg_hba.conf for $APP_USER"
+        # Remove any prior rule for this user from a previous install
+        sed -i "/^local[[:space:]]\+all[[:space:]]\+${APP_USER}[[:space:]]/d" "$pg_hba"
         # Insert before the "local all all" catch-all, or append
         if grep -q "^local.*all.*all" "$pg_hba"; then
             sed -i "/^local.*all.*all/i $rule" "$pg_hba"
         else
             echo "$rule" >> "$pg_hba"
         fi
-        systemctl reload postgresql
     fi
+    systemctl reload postgresql
+}
+
+REDIS_PW=""
+
+_setup_redis() {
+    # Require password auth on the loopback Redis listener (BAY-01-027).
+    # The password is generated once, stored in shared/.env (read by the app
+    # via REDIS_PASSWORD), and asserted into redis.conf on every run.
+    local pw=""
+    if [[ -f "$SHARED_DIR/.env" ]]; then
+        pw=$(grep -E '^REDIS_PASSWORD=' "$SHARED_DIR/.env" | head -1 \
+            | cut -d= -f2- | tr -d "'\"") || true
+    fi
+    if [[ -z "$pw" ]]; then
+        pw=$(openssl rand -hex 24)
+        if [[ -f "$SHARED_DIR/.env" ]]; then
+            printf "REDIS_PASSWORD='%s'\n" "$pw" >> "$SHARED_DIR/.env"
+        fi
+    fi
+    REDIS_PW="$pw"
+
+    local conf="/etc/redis/redis.conf"
+    [[ -f "$conf" ]] || die "Cannot find $conf"
+    if grep -qE '^[[:space:]]*requirepass ' "$conf"; then
+        sed -i -E "s|^[[:space:]]*requirepass .*|requirepass $pw|" "$conf"
+    else
+        printf '\n# Managed by bayanat installer (BAY-01-027)\nrequirepass %s\n' "$pw" >> "$conf"
+    fi
+    systemctl restart redis-server
 }
 
 _create_directories() {
-    mkdir -p "$RELEASES_DIR" "$SHARED_DIR/media" "$SHARED_DIR/backups" \
-             "$LOGS_DIR"
+    mkdir -p "$RELEASES_DIR" "$SHARED_DIR/media" "$SHARED_DIR/exports" \
+             "$SHARED_DIR/imports" "$SHARED_DIR/backups" "$RUNTIME_DIR" \
+             "$LOGS_DIR" "$STATE_DIR"
+    # STATE_DIR stays root-owned (BAY-01-013): the updater writes it as root and
+    # the app only reads it. Keeping it out of the service user's reach removes
+    # the symlink-race chown primitive into root-owned files.
+    _secure_state_dir
+}
+
+_secure_state_dir() {
+    # Root-owned updater state dir. World-readable so the app (service user)
+    # can read update.json for the status display, but not writable by it.
+    chown -R root:root "$STATE_DIR"
+    chmod 755 "$STATE_DIR"
+    [[ -f "$STATE_FILE" ]] && chmod 644 "$STATE_FILE"
+    return 0
+}
+
+_set_permissions() {
+    # Least-privilege install layout (BAY-01-030/032). Root owns the tree;
+    # service users reach it only through $APP_GROUP, and "other" is locked
+    # out everywhere. Top-level dirs deny traversal, so files inside need no
+    # recursive sweep (kept non-recursive for media, which can be large).
+    chown root:"$APP_GROUP" "$BAYANAT_ROOT" "$RELEASES_DIR" "$SHARED_DIR"
+    chmod 750 "$BAYANAT_ROOT" "$RELEASES_DIR" "$SHARED_DIR"
+
+    # App-writable shared areas: setgid keeps new files in $APP_GROUP so the
+    # web and worker accounts can read each other's output.
+    local d
+    for d in "$SHARED_DIR/media" "$SHARED_DIR/exports" "$SHARED_DIR/imports" \
+             "$SHARED_DIR/backups" "$RUNTIME_DIR" "$LOGS_DIR"; do
+        chown root:"$APP_GROUP" "$d"
+        chmod 2770 "$d"
+    done
+
+    # Secrets: group-readable only (the services read them), never writable
+    # by the services and never world-readable.
+    local f
+    for f in "$SHARED_DIR/.env" "$SHARED_DIR/uwsgi-prod.ini"; do
+        if [[ -f "$f" ]]; then
+            chown root:"$APP_GROUP" "$f"
+            chmod 640 "$f"
+        fi
+    done
+
+    # Log files created by admin CLI runs (umask 022) must stay appendable
+    # by both service accounts.
+    find "$LOGS_DIR" -type f -exec chgrp "$APP_GROUP" {} + -exec chmod 660 {} + 2>/dev/null || true
+
+    _secure_state_dir
 }
 
-_clone_release() {
+# Fetch a release as a signed tarball and verify it before install (BAY-01-017).
+# Replaces the old unsigned `git clone`: an unsigned or tampered release is
+# refused, so a reachable update trigger can at worst install authentic SJAC
+# code. SJAC attaches `bayanat-<tag>.tar.gz` + `.minisig` to each GitHub
+# release; the signing procedure is in docs/deployment/release-signing.md.
+_fetch_release() {
     local tag="$1"
     local dest="$RELEASES_DIR/$tag"
+    local asset="bayanat-$tag.tar.gz"
+    local url="https://github.com/${BAYANAT_REPO:-$DEFAULT_REPO}/releases/download/$tag/$asset"
 
-    if [[ -d "$dest/.git" ]]; then
-        if sudo -u "$APP_USER" git -C "$dest" rev-parse HEAD &>/dev/null; then
-            log "Release $tag already cloned"
-            return 0
-        fi
-        warn "Partial clone detected, removing $dest"
-        rm -rf "$dest"
-    elif [[ -d "$dest" ]]; then
-        warn "Invalid release directory, removing $dest"
-        rm -rf "$dest"
+    # A complete release is marked done; anything else is a partial fetch.
+    if [[ -f "$dest/.bayanat-release" ]]; then
+        log "Release $tag already fetched"
+        return 0
     fi
-
-    log "Cloning $tag..."
-    git clone --depth 1 --branch "$tag" "$GIT_URL" "$dest"
+    rm -rf "$dest"
+
+    local tmp
+    tmp=$(mktemp -d)
+
+    log "Downloading $tag..."
+    curl -fsSL --max-time 300 -o "$tmp/$asset" "$url" \
+        || die "Could not download $asset from the $tag release" \
+               "Confirm the release exists and ships a signed tarball asset."
+    curl -fsSL --max-time 60 -o "$tmp/$asset.minisig" "$url.minisig" \
+        || die "Release $tag is unsigned (no $asset.minisig)" \
+               "Refusing to install unverified code. Update manually only if you trust this release."
+
+    log "Verifying signature against the SJAC release key..."
+    minisign -Vm "$tmp/$asset" -P "$RELEASE_PUBKEY" \
+        || die "Signature verification FAILED for $tag" \
+               "The tarball does not match SJAC's signing key. Refusing to install."
+
+    log "Extracting $tag..."
+    mkdir -p "$dest"
+    tar -xzf "$tmp/$asset" --strip-components=1 -C "$dest" \
+        || die "Failed to extract $asset"
+    touch "$dest/.bayanat-release"
+    rm -rf "$tmp"
+
+    # Releases are root-owned and read-only for the service accounts
+    # (BAY-01-030/032): group gets read+exec via $APP_GROUP, no write, and
+    # "other" is locked out.
+    chown -R root:"$APP_GROUP" "$dest"
+    chmod -R o-rwx,g-w "$dest"
 }
 
 _generate_env() {
@@ -215,6 +868,15 @@ FORCE_HTTPS=$force_https
 
 LOG_DIR=$LOGS_DIR
 BACKUPS_LOCAL_PATH=$SHARED_DIR/backups
+BAYANAT_CONFIG_FILE=$RUNTIME_DIR/config.json
+
+POSTGRES_HOST=localhost
+POSTGRES_PORT=5432
+POSTGRES_USER=$APP_USER
+POSTGRES_PASSWORD=
+POSTGRES_DB=$APP_USER
+
+REDIS_PASSWORD='$REDIS_PW'
 EOF
 }
 
@@ -224,18 +886,40 @@ _link_shared() {
 
     [[ -f "$SHARED_DIR/.env" ]] && ln -sfn "$SHARED_DIR/.env" "$release/.env"
 
-    if [[ -d "$release/enferno/media" ]] && [[ ! -L "$release/enferno/media" ]]; then
-        rm -rf "$release/enferno/media"
-    fi
-    ln -sfn "$SHARED_DIR/media" "$release/enferno/media"
+    # Releases are read-only for the services (BAY-01-032), so every
+    # app-written path is redirected into shared/.
+    local d
+    for d in media exports imports; do
+        if [[ -d "$release/enferno/$d" ]] && [[ ! -L "$release/enferno/$d" ]]; then
+            rm -rf "$release/enferno/$d"
+        fi
+        ln -sfn "$SHARED_DIR/$d" "$release/enferno/$d"
+    done
+
+    # Sentinels the app touches to request a web reload / worker restart.
+    # uWSGI watches reload.ini (touch-reload); a systemd path unit watches
+    # restart-celery. Both live in the app-writable runtime dir.
+    mkdir -p "$RUNTIME_DIR"
+    local s
+    for s in reload.ini restart-celery; do
+        touch "$RUNTIME_DIR/$s"
+        chown root:"$APP_GROUP" "$RUNTIME_DIR/$s"
+        chmod 660 "$RUNTIME_DIR/$s"
+        ln -sfn "$RUNTIME_DIR/$s" "$release/$s"
+    done
 }
 
 _install_deps() {
+    # Runs as root: releases (including .venv) are read-only for the service
+    # accounts (BAY-01-032).
     local tag="$1"
     log "Installing Python dependencies..."
-    sudo -u "$APP_USER" \
-        /usr/local/bin/uv sync --frozen --python 3.12 \
+    /usr/local/bin/uv sync --frozen --python 3.12 \
         --directory "$RELEASES_DIR/$tag"
+    # The venv is created after _fetch_release's ownership pass, so it needs
+    # its own: group-readable for the service accounts, not writable.
+    chown -R root:"$APP_GROUP" "$RELEASES_DIR/$tag/.venv"
+    chmod -R o-rwx,g-w "$RELEASES_DIR/$tag/.venv"
 }
 
 _init_database() {
@@ -253,7 +937,40 @@ _init_database() {
     fi
 }
 
+ADMIN_USERNAME=""
+ADMIN_PASSWORD=""
+
+_bootstrap_admin() {
+    # Provision the initial admin out-of-band. Replaces the deleted
+    # /api/create-admin wizard endpoint, which was unauthenticated and
+    # claimable by the first network client during the install window.
+    # The password is fed to flask install over stdin (--password-stdin)
+    # so it is never visible in /proc/<pid>/cmdline or `ps`.
+    local tag="$1"
+    local pw
+    pw=$(python3 -c "import secrets; print(secrets.token_urlsafe(20))" 2>/dev/null) || \
+        pw=$(openssl rand -base64 24 | tr -d '/+=' | head -c 24)
+
+    log "Bootstrapping initial admin user..."
+    local out
+    out=$(printf '%s\n' "$pw" \
+        | flask_run "$tag" install --username admin --password-stdin 2>&1) || true
+
+    if echo "$out" | grep -q "already installed"; then
+        log "Admin user already exists, skipping bootstrap"
+    elif echo "$out" | grep -q "installed successfully"; then
+        ADMIN_USERNAME="admin"
+        ADMIN_PASSWORD="$pw"
+    else
+        warn "Admin bootstrap unexpected output:"
+        warn "$out"
+    fi
+}
+
 _install_uwsgi_config() {
+    # Socket lives in /run/bayanat (systemd RuntimeDirectory): the release
+    # dir is read-only for the service user (BAY-01-032). touch-reload
+    # watches the shared runtime sentinel the app can write.
     cat > "$SHARED_DIR/uwsgi-prod.ini" << EOF
 [uwsgi]
 virtualenv=.venv
@@ -261,27 +978,60 @@ module=run:app
 master=true
 processes=1
 threads=2
-http-socket=$CURRENT_LINK/bayanat.sock
+http-socket=/run/bayanat/bayanat.sock
 chmod-socket=660
 vacuum=true
 buffer-size=8192
-touch-reload=reload.ini
+touch-reload=$RUNTIME_DIR/reload.ini
 reload-mercy=5
 worker-reload-mercy=3
 EOF
 }
 
 _install_systemd() {
+    # Sandboxing directives (BAY-01-033): no privilege escalation, read-only
+    # host filesystem outside the explicit shared/log paths, isolated tmp and
+    # devices, restricted /proc and kernel interfaces, no retained
+    # capabilities. HOME points at the per-service cache dir for libraries
+    # that write font/model caches.
+    local hardening
+    hardening="NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=$SHARED_DIR $LOGS_DIR
+PrivateTmp=true
+PrivateDevices=true
+ProtectProc=invisible
+ProcSubset=pid
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+ProtectClock=true
+RestrictNamespaces=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+CapabilityBoundingSet="
+
     cat > /etc/systemd/system/bayanat.service << EOF
 [Unit]
 Description=Bayanat web application
 After=network.target postgresql.service redis.service
 
 [Service]
-User=$APP_USER
-Group=$APP_USER
+User=$WEB_USER
+Group=$APP_GROUP
+UMask=0007
 WorkingDirectory=$CURRENT_LINK
 EnvironmentFile=$SHARED_DIR/.env
+Environment=HOME=/var/cache/bayanat-web
+CacheDirectory=bayanat-web
+RuntimeDirectory=bayanat
+RuntimeDirectoryMode=0750
 ExecStart=$CURRENT_LINK/.venv/bin/uwsgi --ini $SHARED_DIR/uwsgi-prod.ini
 Restart=always
 RestartSec=3
@@ -290,6 +1040,7 @@ KillSignal=SIGQUIT
 TimeoutStopSec=10
 Type=notify
 NotifyAccess=all
+$hardening
 
 [Install]
 WantedBy=multi-user.target
@@ -301,16 +1052,43 @@ Description=Bayanat Celery worker
 After=network.target postgresql.service redis.service
 
 [Service]
-User=$APP_USER
-Group=$APP_USER
+User=$CELERY_USER
+Group=$APP_GROUP
+UMask=0007
 WorkingDirectory=$CURRENT_LINK
 EnvironmentFile=$SHARED_DIR/.env
-ExecStart=$CURRENT_LINK/.venv/bin/celery -A enferno.tasks worker --autoscale 2,5 -B -Q celery,ocr
+Environment=HOME=/var/cache/bayanat-celery
+CacheDirectory=bayanat-celery
+ExecStart=$CURRENT_LINK/.venv/bin/celery -A enferno.tasks worker --autoscale 2,5 -B -Q celery,ocr -s $RUNTIME_DIR/celerybeat-schedule
 Restart=always
 RestartSec=3
+$hardening
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+    # Celery restart requests (BAY-01-032): the web app cannot (and must not)
+    # sudo; it touches the runtime sentinel instead and this path unit
+    # performs the restart as root.
+    cat > /etc/systemd/system/bayanat-celery-restart.path << EOF
+[Unit]
+Description=Watch for Bayanat Celery restart requests
+
+[Path]
+PathChanged=$RUNTIME_DIR/restart-celery
 
 [Install]
 WantedBy=multi-user.target
+EOF
+
+    cat > /etc/systemd/system/bayanat-celery-restart.service << 'EOF'
+[Unit]
+Description=Restart Bayanat Celery worker on request
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/systemctl restart bayanat-celery.service
 EOF
 }
 
@@ -320,7 +1098,7 @@ _configure_caddy() {
     if [[ "$domain" == "localhost" ]]; then
         cat > /etc/caddy/Caddyfile << 'EOF'
 :80 {
-    reverse_proxy unix//opt/bayanat/current/bayanat.sock
+    reverse_proxy unix//run/bayanat/bayanat.sock
     handle_path /static/* {
         root * /opt/bayanat/current/enferno/static
         file_server
@@ -333,7 +1111,7 @@ EOF
     else
         cat > /etc/caddy/Caddyfile << EOF
 $domain {
-    reverse_proxy unix//opt/bayanat/current/bayanat.sock
+    reverse_proxy unix//run/bayanat/bayanat.sock
     handle_path /static/* {
         root * /opt/bayanat/current/enferno/static
         file_server
@@ -346,13 +1124,16 @@ EOF
     fi
 }
 
-_install_sudoers() {
-    cat > /etc/sudoers.d/bayanat << 'EOF'
-bayanat ALL=(root) NOPASSWD: /usr/local/bin/bayanat update
-bayanat ALL=(root) NOPASSWD: /usr/local/bin/bayanat status
-bayanat ALL=(root) NOPASSWD: /usr/bin/systemctl restart bayanat-celery
-EOF
-    chmod 440 /etc/sudoers.d/bayanat
+_install_self() {
+    # Copy the bayanat CLI from the given release directory to
+    # /usr/local/bin/bayanat. Source is $RELEASES_DIR/$tag/bayanat, NOT $0 —
+    # under `curl ... | sudo bash -s install`, $0 is "bash" and readlink
+    # resolves to the shell binary. $1 = tag.
+    local tag="${1:?_install_self requires a tag arg}"
+    local src="$RELEASES_DIR/$tag/bayanat"
+    [[ -f "$src" ]] || die "cannot find CLI source at $src"
+    install -m 0755 -o root -g root "$src" /usr/local/bin/bayanat
+    log "Installed CLI at /usr/local/bin/bayanat"
 }
 
 # --- Install ---
@@ -373,6 +1154,7 @@ cmd_install() {
     # Users and database
     _setup_app_user
     _setup_database
+    _setup_redis
 
     # Application
     _create_directories
@@ -382,18 +1164,19 @@ cmd_install() {
     [[ -n "$tag" ]] || die "No release tags found"
     log "Latest release: $tag"
 
-    _clone_release "$tag"
+    _fetch_release "$tag"
 
     if [[ ! -f "$SHARED_DIR/.env" ]]; then
         log "Generating .env..."
         _generate_env "$domain"
     fi
 
-    chown -R "$APP_USER:$APP_USER" "$BAYANAT_ROOT"
+    _set_permissions
     _link_shared "$tag"
 
     _install_deps "$tag"
     _init_database "$tag"
+    _bootstrap_admin "$tag"
 
     # Activate release
     swap_symlink "$RELEASES_DIR/$tag"
@@ -401,22 +1184,46 @@ cmd_install() {
 
     # System integration
     _install_uwsgi_config
-    _install_systemd
     _configure_caddy "$domain"
-    _install_sudoers
+    _install_systemd
+    _install_self "$tag"
+
+    # Services no longer get any sudo grant (BAY-01-032); drop the file a
+    # previous install may have written.
+    rm -f /etc/sudoers.d/bayanat
 
-    chown -R "$APP_USER:$APP_USER" "$BAYANAT_ROOT"
+    _set_permissions
     systemctl daemon-reload
-    systemctl enable --now bayanat bayanat-celery
+    systemctl enable --now bayanat bayanat-celery bayanat-celery-restart.path
     systemctl restart caddy
 
     _verify_service_health
 
-    log "Installation complete"
+    local access_url
     if [[ "$domain" == "localhost" ]]; then
-        log "Access: http://$(hostname -I | awk '{print $1}')"
+        access_url="http://$(hostname -I | awk '{print $1}')"
     else
-        log "Access: https://$domain"
+        access_url="https://$domain"
+    fi
+
+    log "Installation complete"
+    log "Access: $access_url"
+
+    if [[ -n "$ADMIN_PASSWORD" ]]; then
+        log ""
+        log "============================================================"
+        log " Bayanat is ready. Sign in to finish setup:"
+        log ""
+        log "   URL      : $access_url/login"
+        log "   Username : $ADMIN_USERNAME"
+        log "   Password : $ADMIN_PASSWORD"
+        log ""
+        log " Save these credentials now - the password is not stored"
+        log " in plaintext anywhere. After signing in, the setup wizard"
+        log " will walk you through language, default data, and other"
+        log " configuration. Change the password from your account"
+        log " settings."
+        log "============================================================"
     fi
 }
 
@@ -435,11 +1242,11 @@ _verify_service_health() {
         fi
     done
 
-    # Wait for app to respond on socket
-    local sock="$CURRENT_LINK/bayanat.sock"
+    # Wait for the app's /health (DB + Redis) to go green; a bare / would
+    # pass on a redirect even when the app cannot reach its backends.
     local i
     for ((i=1; i<=retries; i++)); do
-        if curl -sf --unix-socket "$sock" http://localhost/ -o /dev/null 2>/dev/null; then
+        if _socket_health; then
             log "Application responding"
             return 0
         fi
@@ -448,6 +1255,63 @@ _verify_service_health() {
     warn "Application not responding on socket after $((retries * delay))s (may still be starting)"
 }
 
+# --- Update ---
+
+_ensure_runtime_layout() {
+    # Layout migration for installs that predate shared/runtime
+    # (BAY-01-030/032). New releases are root-owned, so config.json must move
+    # out of the release dir before the app loses write access to it.
+    mkdir -p "$RUNTIME_DIR" "$SHARED_DIR/exports" "$SHARED_DIR/imports"
+    local d
+    for d in "$RUNTIME_DIR" "$SHARED_DIR/exports" "$SHARED_DIR/imports"; do
+        chown root:"$APP_GROUP" "$d"
+        chmod 2770 "$d"
+    done
+    if ! grep -q '^BAYANAT_CONFIG_FILE=' "$SHARED_DIR/.env" 2>/dev/null; then
+        if [[ -f "$CURRENT_LINK/config.json" ]]; then
+            cp -p "$CURRENT_LINK/config.json" "$RUNTIME_DIR/config.json"
+        fi
+        echo "BAYANAT_CONFIG_FILE=$RUNTIME_DIR/config.json" >> "$SHARED_DIR/.env"
+    fi
+}
+
+cmd_update() {
+    local flag="${1:-}"
+    case "$flag" in
+        --check)
+            local cur latest
+            cur=$(current_version || echo "not installed")
+            latest=$(latest_remote_tag)
+            echo "current: $cur"
+            echo "latest:  $latest"
+            if [[ "${cur#v}" == "${latest#v}" ]]; then
+                echo "up to date"
+            else
+                echo "update available"
+            fi
+            return 0
+            ;;
+        --recover)
+            require_root
+            recover_state
+            return 0
+            ;;
+    esac
+    require_root
+    recover_state
+    _ensure_runtime_layout
+    local target="${1:-}"
+    if [[ -z "$target" ]]; then
+        target=$(latest_remote_tag)
+    fi
+    # Keep $target verbatim. Tags and release dir names use the v-prefix form
+    # (e.g. v4.0.0), matching the installer's convention in _fetch_release and
+    # _link_shared. Stripping is only for display / comparison.
+    do_prepare "$target"
+    do_migrate
+    do_switch_verify
+}
+
 # --- Status ---
 
 cmd_status() {
@@ -474,6 +1338,17 @@ cmd_status() {
     for svc in bayanat bayanat-celery caddy; do
         printf "  %-20s %s\n" "$svc" "$(systemctl is-active "$svc" 2>/dev/null || echo 'unknown')"
     done
+
+    echo ""
+    local phase
+    phase=$(read_phase)
+    echo "Update state: $phase"
+    if [[ "$phase" != "IDLE" ]]; then
+        echo "  target:     $(read_field target || echo '')"
+        echo "  previous:   $(read_field previous || echo '')"
+        echo "  snapshot:   $(read_field snapshot || echo '')"
+        echo "  updated_at: $(read_field updated_at || echo '')"
+    fi
 }
 
 # --- Usage ---
@@ -486,18 +1361,27 @@ Usage: bayanat <command> [options]
 
 Commands:
   install [domain]    Install Bayanat (default: localhost)
-  status              Show version and service status
+  update [<tag>]      Update Bayanat to <tag> (default: latest release)
+  update --check      Show current vs latest; no changes
+  update --recover    Recover from a stuck update state file
+  snapshots           List pre-update snapshots
+  restore <name>      Restore a pre-update snapshot (prompts confirmation)
+  status              Show version, services, and update state
 
 Environment:
-  BAYANAT_REPO        GitHub repo (default: sjacorg/bayanat)
+  BAYANAT_REPO                        GitHub repo (default: sjacorg/bayanat)
+  BAYANAT_SNAPSHOT_RETENTION_DAYS     Snapshot retention floor (default: 30)
 EOF
 }
 
 # --- Main ---
 
 case "${1:-}" in
-    install) shift; cmd_install "$@" ;;
-    status)  cmd_status ;;
+    install)    shift; cmd_install "$@" ;;
+    update)     shift; cmd_update "$@" ;;
+    snapshots)  require_root; list_snapshots ;;
+    restore)    require_root; [[ -n "${2:-}" ]] || die "usage: bayanat restore <snapshot-name>"; restore_pg "$2" ;;
+    status)     cmd_status ;;
     -h|--help|help) usage ;;
     *) usage; exit 1 ;;
 esac
diff --git a/docker-compose-dev.yml b/docker-compose-dev.yml
index 63a6225c2..1141bb99d 100644
--- a/docker-compose-dev.yml
+++ b/docker-compose-dev.yml
@@ -1,7 +1,10 @@
 services:
   postgres:
     container_name: postgres
-    image: 'postgis/postgis:15-3.3'
+    image: 'postgis/postgis:16-3.5@sha256:a780ff6331b384e4c6d1033d5c42f4fe1270721b3e19260448241fa1b64a7637'
+    # postgis/postgis publishes amd64 only; runs emulated on ARM hosts
+    platform: linux/amd64
+    user: postgres
     environment:
       - POSTGRES_USER=${POSTGRES_USER}
       - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
@@ -14,7 +17,7 @@ services:
     security_opt:
       - no-new-privileges:true
     tmpfs:
-      - /var/run/postgresql 
+      - /var/run/postgresql
     healthcheck:
       test: "pg_isready -d ${POSTGRES_DB} -U ${POSTGRES_USER}"
       interval: 3s
@@ -22,17 +25,23 @@ services:
 
   redis:
     container_name: redis
-    image: 'redis:latest'
+    image: 'redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99'
+    user: redis
     expose:
       - '6379'
-    command: redis-server --requirepass '${REDIS_PASSWORD}'
+    environment:
+      - REDIS_PASSWORD=${REDIS_PASSWORD}
+    # password is written to a config file in-container, never passed via argv
+    command: sh -c 'echo "requirepass $$REDIS_PASSWORD" > /tmp/redis.conf && exec redis-server /tmp/redis.conf'
     read_only: true
     security_opt:
       - no-new-privileges:true
+    tmpfs:
+      - /tmp
     volumes:
-      - 'redis_dev_data:/var/lib/redis/data:rw'
+      - 'redis_dev_data:/data:rw'
     healthcheck:
-      test: [ "CMD", "redis-cli", "--no-auth-warning", "-a", "${REDIS_PASSWORD}", "ping" ]
+      test: [ "CMD-SHELL", "REDISCLI_AUTH=\"$$REDIS_PASSWORD\" redis-cli ping | grep -q PONG" ]
       interval: 3s
       retries: 10
 
@@ -43,7 +52,6 @@ services:
       dockerfile: ./flask/Dockerfile
       args:
         - ROLE=flask
-        - ENV_FILE=${ENV_FILE:-.env.dev}
     volumes:
       - 'bayanat_dev_backups:/app/backups/:rw'
       - 'bayanat_dev_media:/app/enferno/media/:rw'
@@ -67,7 +75,6 @@ services:
       dockerfile: ./flask/Dockerfile
       args:
         - ROLE=celery
-        - ENV_FILE=${ENV_FILE:-.env.dev}
     volumes_from:
       - bayanat
     read_only: true
diff --git a/docker-compose-test.yml b/docker-compose-test.yml
index 31c37a9b5..2364f54f2 100644
--- a/docker-compose-test.yml
+++ b/docker-compose-test.yml
@@ -1,7 +1,10 @@
 services:
   postgres:
     container_name: postgres
-    image: 'postgis/postgis:15-3.3'
+    image: 'postgis/postgis:16-3.5@sha256:a780ff6331b384e4c6d1033d5c42f4fe1270721b3e19260448241fa1b64a7637'
+    # postgis/postgis publishes amd64 only; runs emulated on ARM hosts
+    platform: linux/amd64
+    user: postgres
     environment:
       - POSTGRES_USER=${POSTGRES_USER}
       - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
@@ -22,17 +25,23 @@ services:
 
   redis:
     container_name: redis
-    image: 'redis:latest'
+    image: 'redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99'
+    user: redis
     expose:
       - '6379'
-    command: redis-server --requirepass '${REDIS_PASSWORD}'
+    environment:
+      - REDIS_PASSWORD=${REDIS_PASSWORD}
+    # password is written to a config file in-container, never passed via argv
+    command: sh -c 'echo "requirepass $$REDIS_PASSWORD" > /tmp/redis.conf && exec redis-server /tmp/redis.conf'
     read_only: true
     security_opt:
       - no-new-privileges:true
+    tmpfs:
+      - /tmp
     volumes:
-      - 'redis_test_data:/var/lib/redis/data:rw'
+      - 'redis_test_data:/data:rw'
     healthcheck:
-      test: [ "CMD", "redis-cli", "--no-auth-warning", "-a", "${REDIS_PASSWORD}", "ping" ]
+      test: [ "CMD-SHELL", "REDISCLI_AUTH=\"$$REDIS_PASSWORD\" redis-cli ping | grep -q PONG" ]
       interval: 3s
       retries: 10
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 3d7cf788e..ae9a42b60 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,7 +1,11 @@
 services:
   postgres:
     container_name: postgres
-    image: 'postgis/postgis:15-3.3'
+    # PG major upgrades (15 -> 16) require a dump/restore of postgres_data
+    image: 'postgis/postgis:16-3.5@sha256:a780ff6331b384e4c6d1033d5c42f4fe1270721b3e19260448241fa1b64a7637'
+    # postgis/postgis publishes amd64 only; runs emulated on ARM hosts
+    platform: linux/amd64
+    user: postgres
     environment:
       - POSTGRES_USER=${POSTGRES_USER}
       - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
@@ -22,36 +26,41 @@ services:
 
   redis:
     container_name: redis
-    image: 'redis:latest'
+    image: 'redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99'
+    user: redis
     expose:
       - '6379'
-    command: redis-server --requirepass '${REDIS_PASSWORD}'
+    # password is read from the mounted secret, never passed via argv
+    environment:
+      - REDIS_PASSWORD=${REDIS_PASSWORD}
+    # password is written to a config file in-container, never passed via argv
+    command: sh -c 'echo "requirepass $$REDIS_PASSWORD" > /tmp/redis.conf && exec redis-server /tmp/redis.conf'
     read_only: true
     security_opt:
       - no-new-privileges:true
+    tmpfs:
+      - /tmp
     volumes:
-      - 'redis_data:/var/lib/redis/data:rw'
+      - 'redis_data:/data:rw'
     healthcheck:
-      test: [ "CMD", "redis-cli", "--no-auth-warning", "-a", "${REDIS_PASSWORD}", "ping" ]
+      test: [ "CMD-SHELL", "REDISCLI_AUTH=\"$$REDIS_PASSWORD\" redis-cli ping | grep -q PONG" ]
       interval: 3s
       retries: 10
 
   bayanat:
     container_name: bayanat
-    image: 'bayanat/bayanat:latest'
     build:
       context: .
       dockerfile: ./flask/Dockerfile
       args:
         - ROLE=flask
-        - ENV_FILE=${ENV_FILE:-.env}
     volumes:
       - '${PWD}/backups:/app/backups/:rw'
       - '${MEDIA_PATH:-./enferno/media}:/app/enferno/media/:rw'
       - '${PWD}/enferno/imports:/app/enferno/imports/:rw'
       - '${PWD}/logs/:/app/logs/:rw'
       - '${PWD}/config.json:/app/config.json:rw'
-      - '${PWD}/${ENV_FILE:-.env}:/app/.env:ro'
+      - '${PWD}/${ENV_FILE:-.env.docker}:/app/.env:ro'
     depends_on:
       postgres:
         condition: service_healthy
@@ -72,7 +81,6 @@ services:
       dockerfile: ./flask/Dockerfile
       args:
         - ROLE=celery
-        - ENV_FILE=${ENV_FILE:-.env}
     volumes_from:
       - bayanat
     read_only: true
@@ -93,7 +101,6 @@ services:
       dockerfile: ./flask/Dockerfile
       args:
         - ROLE=celery-ocr
-        - ENV_FILE=${ENV_FILE:-.env}
     volumes_from:
       - bayanat
     read_only: true
@@ -112,9 +119,8 @@ services:
     restart: always
     build:
       context: ./nginx
-      target: prod
     ports:
-      - '80:80'
+      - '80:8080'
     volumes:
       - './enferno/static/:/app/static/:ro'
     depends_on:
@@ -123,13 +129,11 @@ services:
     security_opt:
       - no-new-privileges:true
     tmpfs:
-      - /opt/bitnami/nginx/tmp/
-      - /opt/bitnami/nginx/logs/
-      - /opt/bitnami/nginx/conf/bitnami/certs/
+      - /tmp
     healthcheck:
-      test: [ "CMD", "service", "nginx", "status" ]
-      interval: 3s
-      retries: 10
+      test: [ "CMD", "wget", "-q", "--spider", "http://127.0.0.1:8080/healthz" ]
+      interval: 10s
+      retries: 5
 
 volumes:
   redis_data:
diff --git a/docs/deployment/auto-update-runbook.md b/docs/deployment/auto-update-runbook.md
new file mode 100644
index 000000000..b4c032079
--- /dev/null
+++ b/docs/deployment/auto-update-runbook.md
@@ -0,0 +1,137 @@
+# Bayanat Auto-Update Runbook
+
+Short operator reference for the `bayanat update` flow. Design notes live
+in the development spec (not shipped with the repo).
+
+## Triggering an update
+
+- **One-click from UI:** an admin-role user clicks "Update now" from the
+  "Update available: X.Y.Z" banner in the nav bar.
+- **From the shell (as root):** `sudo bayanat update [<tag>]`
+  (defaults to the latest GitHub release). The CLI requires root to stop
+  / start services, write `/opt/bayanat`, and take snapshots.
+- **Check only (no changes, no root):** `sudo -u bayanat bayanat update --check`.
+
+The update runs as `bayanat-update.service`, a transient systemd unit
+that outlives Flask restarts, SSH disconnects, and browser closes. Tail
+live logs with:
+
+```
+sudo journalctl -u bayanat-update -f
+```
+
+## Opt-in auto-apply for patch releases
+
+In the admin UI under System Administration, toggle "Auto-apply patch
+releases" on. With the toggle on, any bump within the same minor line
+(e.g. `4.1.0` to `4.1.1`) installs silently every 6 hours via the same
+pipeline. Minor and major bumps (e.g. `4.1.x` to `4.2.0`) always notify
+and wait for a manual click.
+
+## Expected timing
+
+| Phase | Duration | Production impact |
+|---|---|---|
+| PREPARE (fetch + deps) | 1-5 min | None, old version serves traffic |
+| Stop services | ~3 s | 502 from Caddy begins |
+| Snapshot (`pg_dump -Fc`) | 10-60 s | 502 |
+| Migrate (`flask db upgrade`) | 1-30 s | 502 |
+| Swap + start services | ~5 s | 502 |
+| Verify (health probe) | 1-10 s | New version serving |
+| **Total visible downtime** | **~30-90 s** | |
+
+Caddy returns `502 Bad Gateway` during the maintenance window. Browsers
+retry automatically; partners see a brief "service unavailable" view.
+
+## Release verification
+
+The updater downloads each release as a signed tarball and verifies it against
+SJAC's pinned minisign key before installing (BAY-01-017). An unsigned or
+tampered release is refused during PREPARE with `Release <tag> is unsigned` or
+`Signature verification FAILED`, and nothing is installed. If you hit this on a
+legitimate release, the release is missing its `.minisig` asset; see
+[release-signing.md](release-signing.md).
+
+## If something goes wrong
+
+### Migration failed (Alembic transaction rolled back)
+
+Nothing to do. Services restart on the previous release automatically.
+The UI shows the `error` field. Report the broken release; the previous
+version keeps running.
+
+### Health probe failed after swap (auto-rollback succeeded)
+
+Nothing to do. The updater reverted the symlink and restarted on the
+previous release. The pre-update snapshot is retained at
+`/opt/bayanat/shared/backups/`.
+
+### NEEDS_INTERVENTION
+
+This state only happens when two independent failures compound: the new
+release was broken AND rolling back did not reach a healthy state. The
+maintenance flag stays up so users see a 502 instead of raw errors.
+Recover:
+
+```
+sudo -u bayanat bayanat status            # read-only; confirm state
+sudo bayanat snapshots                    # list snapshots (needs root)
+sudo bayanat restore pre-<ts>.dump        # restores DB (needs root)
+sudo systemctl start bayanat bayanat-celery
+```
+
+Then file a bug with journal logs from `journalctl -u bayanat-update`.
+
+### Stuck state (process died, state file orphaned)
+
+```
+sudo bayanat update --recover
+```
+
+## Snapshots
+
+- Location: `/opt/bayanat/shared/backups/pre-*.dump`
+- Format: `pg_dump -Fc` (PostgreSQL custom format)
+- Retention: last 5 snapshots OR last 30 days, whichever is greater
+- Override retention: `export BAYANAT_SNAPSHOT_RETENTION_DAYS=60`
+- List: `sudo bayanat snapshots` or visit `/admin/snapshots/` in the UI
+  (read-only)
+- Restore: `sudo bayanat restore <name>` (prompts for confirmation;
+  stops services; pipes through `pg_restore --clean --if-exists`;
+  restarts services). Requires root. Not available from the web UI by
+  design.
+
+## Files
+
+| Path | Purpose |
+|---|---|
+| `/usr/local/bin/bayanat` | The CLI script |
+| `/opt/bayanat/state/update.json` | Current update state (sanitized JSON) |
+| `/opt/bayanat/state/update.lock` | PID lock file |
+| `/opt/bayanat/shared/backups/` | Pre-update snapshots |
+| `/health` (Flask endpoint) | 200 = DB + Redis reachable |
+
+## Admin UI surface
+
+The UI is read-only for updates: it surfaces availability but never applies
+an update. Updates run from the CLI as root (`sudo bayanat update`).
+
+- Nav-bar banner chip: shows when `latest != current`, with the CLI command
+  to run on the server
+- Status: `/admin/api/updates/status` reflects a CLI-initiated update's state
+- Snapshots page: `/admin/snapshots/` (read-only list; restore stays on
+  the CLI)
+
+## Manual CLI reference
+
+Commands marked `(root)` require `sudo bayanat ...`; the others can run
+as the app user via `sudo -u bayanat bayanat ...`.
+
+```
+bayanat update [<tag>]       (root)  default: latest GitHub release
+bayanat update --check               show current vs latest; no changes
+bayanat update --recover     (root)  recover a stuck state file
+bayanat snapshots            (root)  list pre-update snapshots
+bayanat restore <name>       (root)  interactive restore from a snapshot
+bayanat status                       version + services + update state
+```
diff --git a/docs/deployment/docker.md b/docs/deployment/docker.md
index 7652ec481..1a118b8a5 100644
--- a/docs/deployment/docker.md
+++ b/docs/deployment/docker.md
@@ -6,31 +6,53 @@ Docker Compose deployment is still in beta. For production environments, [native
 
 ## Prerequisites
 
-- Docker and Docker Compose installed
-- `.env` file configured (see [Configuration](/deployment/configuration))
+- Docker Engine with the Compose v2 plugin (`docker compose`, not the legacy `docker-compose` binary)
+- `.env.docker` file configured (see [Configuration](/deployment/configuration))
 
 ## Quick Start
 
 ```bash
-docker-compose up -d
+docker compose --env-file .env.docker up -d
 ```
 
 This starts PostgreSQL, Redis, the Flask app, NGINX, and Celery.
 
-## Create Admin User
+::: tip
+The `--env-file .env.docker` flag is required so Compose can substitute `${POSTGRES_USER}`, `${POSTGRES_PASSWORD}`, and `${REDIS_PASSWORD}` placeholders in `docker-compose.yml`. Without it, those services boot with empty credentials and the Flask container fails to connect.
+:::
+
+## First Admin User
+
+The entrypoint creates an `admin` user automatically on the first startup
+(when the database has no schema yet) and prints a one-time random
+password to the container logs. Retrieve it with:
 
 ```bash
-docker-compose exec bayanat uv run flask install
+docker compose --env-file .env.docker logs bayanat | grep -A4 "Generated password"
 ```
 
+Sign in at the Bayanat URL with `admin` and the printed password. The
+setup wizard runs after first login. Change the admin password from your
+account settings afterwards.
+
+If the auto-bootstrap was missed or the admin account was deleted, run
+the CLI directly:
+
+```bash
+docker compose --env-file .env.docker exec bayanat uv run flask install -u admin
+```
+
+It generates a fresh password and prints it. If an admin already exists
+the command exits without changing anything.
+
 ## Development
 
 ```bash
-docker-compose -f docker-compose-dev.yml up
+docker compose -f docker-compose-dev.yml up
 ```
 
 ## Testing
 
 ```bash
-docker-compose -f docker-compose-test.yml up
+docker compose -f docker-compose-test.yml up
 ```
diff --git a/docs/deployment/installation.md b/docs/deployment/installation.md
index 49d20529d..ca918fce0 100644
--- a/docs/deployment/installation.md
+++ b/docs/deployment/installation.md
@@ -34,7 +34,7 @@ This will:
 - Set up systemd services for Bayanat and Celery
 - Start everything
 
-Once complete, open your domain in a browser. The setup wizard will guide you through creating an admin account and configuring the application.
+Once complete, the installer prints the initial `admin` username and a one-time generated password to the terminal. Open your domain in a browser, sign in with those credentials, then the setup wizard will guide you through configuring the application. Change the admin password from your account settings after first login.
 
 **Check status:**
 
@@ -150,7 +150,7 @@ uv run flask install
 uv run flask run
 ```
 
-Access at [http://127.0.0.1:5000](http://127.0.0.1:5000). The setup wizard will guide further configuration.
+Access at [http://127.0.0.1:5000](http://127.0.0.1:5000). Sign in with the credentials printed by `flask install`, then the setup wizard will guide further configuration.
 
 ::: warning
 `flask run` is development mode only. Continue with the steps below for production.
@@ -243,14 +243,19 @@ sudo systemctl enable --now bayanat-celery
 Docker deployment is still in beta. For production, native deployment is recommended.
 :::
 
-After [configuring](/deployment/configuration) and generating a `.env` file:
+After [configuring](/deployment/configuration) and generating a `.env.docker` file:
 
 ```bash
-docker-compose up -d
+docker compose --env-file .env.docker up -d
 ```
 
-Install the admin user:
+The first startup creates an `admin` user and prints a generated
+password to the container logs. Retrieve it with:
 
 ```bash
-docker-compose exec bayanat uv run flask install
+docker compose --env-file .env.docker logs bayanat | grep -A4 "Generated password"
 ```
+
+If the auto-bootstrap was missed or the admin was deleted, run
+`docker compose --env-file .env.docker exec bayanat uv run flask install -u admin`
+to mint a fresh credential.
diff --git a/docs/deployment/release-signing.md b/docs/deployment/release-signing.md
new file mode 100644
index 000000000..0fb8854f5
--- /dev/null
+++ b/docs/deployment/release-signing.md
@@ -0,0 +1,80 @@
+# Release Signing
+
+Bayanat releases are signed with [minisign](https://jedisct1.github.io/minisign/).
+The `bayanat` CLI verifies every release tarball against a pinned public key
+before installing it, so `sudo bayanat update` (and the installer) will refuse
+an unsigned or tampered release. This is the BAY-01-017 control.
+
+## What the updater expects
+
+For each GitHub release tagged `<tag>` (e.g. `v4.1.0`), two assets must be
+attached:
+
+| Asset | What it is |
+|---|---|
+| `bayanat-<tag>.tar.gz` | the release source tree |
+| `bayanat-<tag>.tar.gz.minisig` | its minisign signature |
+
+The updater downloads both, runs `minisign -V` against the pinned key, and only
+extracts the tarball if the signature verifies. A missing `.minisig` is treated
+as unsigned and refused.
+
+## The pinned key
+
+The verifying public key is baked into the `bayanat` script as `RELEASE_PUBKEY`
+(root-owned, not swappable at update time):
+
+```
+RWS7XvDVF0InHWTCh/86K8sXGcHU/PmzCl4uH9GUDjNnNzHhcX1BvGqZ
+```
+
+key ID `1D274217D5F05EBB`.
+
+The matching **secret key is held offline** (never in CI, never in the repo).
+It signs releases on a maintainer's machine. CI and GitHub only ever carry the
+already-made `.minisig`.
+
+## Signing a release
+
+On the machine that holds the secret key, from a clean checkout at the tag:
+
+```bash
+TAG=v4.1.0
+
+# 1. Build the exact tree the tag points at.
+git archive --format=tar.gz --prefix="bayanat-$TAG/" -o "bayanat-$TAG.tar.gz" "$TAG"
+
+# 2. Sign it (prompts for the key password).
+minisign -Sm "bayanat-$TAG.tar.gz"
+
+# 3. Verify locally against the pinned public key before publishing.
+minisign -Vm "bayanat-$TAG.tar.gz" -P RWS7XvDVF0InHWTCh/86K8sXGcHU/PmzCl4uH9GUDjNnNzHhcX1BvGqZ
+```
+
+Then attach `bayanat-$TAG.tar.gz` and `bayanat-$TAG.tar.gz.minisig` to the
+GitHub release for `$TAG`.
+
+`git archive` is deterministic for a given tree, and the signature covers the
+exact bytes you upload, so there is no cross-machine reproducibility
+requirement: the updater verifies the same file you signed.
+
+## Key custody
+
+- Working copy: `~/.config/minisign/bayanat-release.key` (chmod 600).
+- Password: stored in a password manager. minisign cannot regenerate the key
+  from the password alone, so the key file **and** the password must both
+  survive. Keep an encrypted backup.
+- More than one maintainer should hold the key file and password (bus factor).
+
+## Rotation
+
+minisign has no revocation. If the key is lost or compromised, generate a new
+keypair, update `RELEASE_PUBKEY` in the `bayanat` script, and ship the new
+pinned key in a fresh install or a documented manual swap. Until a host runs a
+`bayanat` build carrying the new key, it will keep trusting the old one, so a
+rotation reaches existing hosts only through an update they install with the
+old key still trusted, or through a manual key swap on the host.
+
+The manual update path always remains available, so a lost key never bricks an
+install: an operator can still update the host by hand per
+[upgrading.md](upgrading.md).
diff --git a/e2e-auto-update.sh b/e2e-auto-update.sh
new file mode 100755
index 000000000..8f9b3a5a0
--- /dev/null
+++ b/e2e-auto-update.sh
@@ -0,0 +1,229 @@
+#!/usr/bin/env bash
+#
+# End-to-end test for the `bayanat update` pipeline on a disposable
+# Hetzner VM. Provisions → installs → runs S1-S4 → teardown.
+#
+# Requires:
+#   - hcloud CLI authenticated to the right project (see `hcloud context list`)
+#   - ssh-agent loaded with the private key matching the registered hcloud key
+#   - a public test fork with tags v4.0.0 (baseline), v4.0.1 (additive),
+#     v4.0.2 (bad migration), v4.0.3 (/health 503 at runtime), v4.0.4 (recovery)
+#
+# Usage:
+#   ./e2e-auto-update.sh                    # full run: provision → S1-S4 → destroy
+#   KEEP_VM=1 ./e2e-auto-update.sh          # leave VM running at end
+#   VM_IP=1.2.3.4 ./e2e-auto-update.sh      # reuse an existing VM (skip provision)
+#   SCENARIOS="S1 S2" ./e2e-auto-update.sh  # run a subset
+#   TEST_FORK=you/yourfork ./e2e-auto-update.sh
+#
+set -euo pipefail
+
+# --- Config ---
+TEST_FORK="${TEST_FORK:-level09/bayanat-update-test}"
+SSH_KEY="${SSH_KEY:-level09@Black09}"
+SERVER_TYPE="${SERVER_TYPE:-cpx22}"
+LOCATION="${LOCATION:-nbg1}"
+SCENARIOS="${SCENARIOS:-S1 S2 S3 S4}"
+KEEP_VM="${KEEP_VM:-0}"
+VM_IP="${VM_IP:-}"
+SERVER_NAME=""
+
+SSHOPTS="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=5"
+
+log()  { printf '\n\033[1;34m[%s] %s\033[0m\n' "$(date +%H:%M:%S)" "$*"; }
+pass() { printf '\033[1;32m  ✓ %s\033[0m\n' "$*"; }
+fail() { printf '\033[1;31m  ✗ %s\033[0m\n' "$*" >&2; exit 1; }
+
+on_vm() { ssh $SSHOPTS "root@$VM_IP" "$@"; }
+
+# --- Prereqs ---
+command -v hcloud >/dev/null || { echo "hcloud CLI not found"; exit 2; }
+command -v gh >/dev/null || { echo "gh CLI not found (needed to rewrite tags)"; exit 2; }
+git ls-remote --tags "https://github.com/$TEST_FORK.git" >/dev/null \
+    || { echo "test fork $TEST_FORK not reachable"; exit 2; }
+
+# --- Tag ladder prep: hide upper tags so installer picks v4.0.0 ---
+stash_upper_tags() {
+    log "Hiding upper tags on $TEST_FORK so installer picks v4.0.0"
+    for t in v4.0.1 v4.0.2 v4.0.3 v4.0.4; do
+        gh api -X DELETE "repos/$TEST_FORK/git/refs/tags/$t" 2>&1 \
+            | grep -v '^$' | head -1 || true
+    done
+}
+
+restore_upper_tags() {
+    log "Restoring upper tags v4.0.1..v4.0.4"
+    # Must push via a configured remote (SSH auth), not an HTTPS URL.
+    for t in v4.0.1 v4.0.2 v4.0.3 v4.0.4; do
+        if ! git show-ref --tags --verify --quiet "refs/tags/$t"; then
+            echo "  LOCAL TAG MISSING: $t (run the rebase block in the README)"; continue
+        fi
+        git push test-fork "+refs/tags/$t:refs/tags/$t" 2>&1 | tail -1
+    done
+    # Sanity: confirm remote has them
+    local remote_tags
+    remote_tags=$(git ls-remote --tags test-fork | awk '{print $2}' | grep -E 'v4\.0\.[1-4]$' | wc -l | tr -d ' ')
+    [[ "$remote_tags" == "4" ]] || fail "expected 4 upper tags on remote, found $remote_tags"
+    pass "4 upper tags visible on remote"
+}
+
+# --- Provision ---
+provision() {
+    SERVER_NAME="bayanat-update-test-$(date +%Y%m%d-%H%M%S)"
+    log "Provisioning Hetzner VM $SERVER_NAME ($SERVER_TYPE in $LOCATION)"
+    VM_IP=$(hcloud server create \
+        --name "$SERVER_NAME" \
+        --type "$SERVER_TYPE" \
+        --image ubuntu-24.04 \
+        --ssh-key "$SSH_KEY" \
+        --location "$LOCATION" \
+        -o json | python3 -c 'import json,sys; print(json.load(sys.stdin)["server"]["public_net"]["ipv4"]["ip"])')
+    log "IP: $VM_IP"
+    log "Waiting for SSH..."
+    until on_vm 'true' 2>/dev/null; do sleep 3; done
+    pass "SSH ready"
+}
+
+teardown() {
+    if [[ "$KEEP_VM" == "1" ]]; then
+        log "KEEP_VM=1 — leaving $SERVER_NAME (IP $VM_IP) alive"
+        return
+    fi
+    if [[ -n "$SERVER_NAME" ]]; then
+        log "Destroying $SERVER_NAME"
+        hcloud server delete "$SERVER_NAME" >/dev/null
+        pass "destroyed"
+    fi
+}
+
+# --- Install ---
+install_baseline() {
+    log "Installing v4.0.0 via curl | sudo bash -s install (validates \$0-free install)"
+    on_vm 'echo "BAYANAT_REPO='"$TEST_FORK"'" >> /etc/environment'
+    on_vm 'curl -fsSL https://raw.githubusercontent.com/'"$TEST_FORK"'/v4.0.0/bayanat | BAYANAT_REPO='"$TEST_FORK"' sudo -E bash -s install localhost' \
+        >/tmp/e2e-install.log 2>&1 \
+        || { tail -30 /tmp/e2e-install.log; fail "install failed"; }
+    pass "install succeeded"
+
+    # Work around the SETUP_COMPLETE gating until that lands in installer
+    on_vm 'echo "BAYANAT_CONFIG_FILE=/opt/bayanat/shared/config.json" >> /opt/bayanat/shared/.env
+           echo "{\"SETUP_COMPLETE\": true}" > /opt/bayanat/shared/config.json
+           chown bayanat:bayanat /opt/bayanat/shared/config.json
+           systemctl restart bayanat bayanat-celery'
+    sleep 3
+
+    local health
+    health=$(on_vm 'curl -s --unix-socket /opt/bayanat/current/bayanat.sock http://localhost/health')
+    [[ "$health" == *'"status":"ok"'* ]] || fail "/health not ok: $health"
+    pass "/health OK: $health"
+
+    local cur
+    cur=$(on_vm 'bayanat status | grep "Current version" | awk "{print \$3}"')
+    [[ "$cur" == "v4.0.0" ]] || fail "expected v4.0.0, got $cur"
+    pass "installed version: $cur"
+}
+
+# --- Scenario helpers ---
+assert_version() {
+    local expected="$1"
+    local actual
+    actual=$(on_vm 'bayanat status | grep "Current version" | awk "{print \$3}"')
+    [[ "$actual" == "$expected" ]] || fail "expected version $expected, got $actual"
+    pass "version = $expected"
+}
+
+assert_state() {
+    local expected="$1"
+    local actual
+    actual=$(on_vm 'bayanat status | grep "Update state" | awk "{print \$3}"')
+    [[ "$actual" == "$expected" ]] || fail "expected state $expected, got $actual"
+    pass "update state = $expected"
+}
+
+assert_state_file_phase() {
+    local expected="$1"
+    local phase
+    phase=$(on_vm 'python3 -c "import json; print(json.load(open(\"/opt/bayanat/state/update.json\")).get(\"phase\",\"\"))"' 2>/dev/null || echo "")
+    [[ "$phase" == "$expected" ]] || fail "expected state file phase $expected, got '$phase'"
+    pass "state file phase = $expected"
+}
+
+assert_services_active() {
+    on_vm 'systemctl is-active --quiet bayanat bayanat-celery caddy' \
+        || fail "services not all active"
+    pass "services all active"
+}
+
+clear_state_file() {
+    on_vm 'rm -f /opt/bayanat/state/update.json /opt/bayanat/state/update.lock'
+}
+
+run_update() {
+    local tag="$1"
+    log "  -> bayanat update $tag"
+    on_vm 'sudo BAYANAT_REPO='"$TEST_FORK"' /usr/local/bin/bayanat update '"$tag" \
+        >/tmp/e2e-update.log 2>&1 || true   # we inspect state, exit code is scenario-dependent
+    tail -5 /tmp/e2e-update.log | sed 's/^/    /'
+}
+
+# --- Scenarios ---
+S1() {
+    log "S1: happy path v4.0.0 -> v4.0.1"
+    run_update v4.0.1
+    assert_version v4.0.1
+    assert_state IDLE
+    assert_services_active
+    on_vm 'sudo -u bayanat psql -d bayanat -c "\d bulletin" | grep -q auto_update_test' \
+        || fail "auto_update_test column missing"
+    pass "auto_update_test column present"
+}
+
+S2() {
+    log "S2: bad migration v4.0.1 -> v4.0.2 -> NEEDS_INTERVENTION"
+    run_update v4.0.2
+    assert_version v4.0.1
+    assert_state_file_phase NEEDS_INTERVENTION
+    assert_services_active
+    clear_state_file
+}
+
+S3() {
+    log "S3: bad /health v4.0.1 -> v4.0.3 -> ROLLED_BACK"
+    run_update v4.0.3
+    assert_version v4.0.1
+    assert_state IDLE
+    assert_services_active
+    local health
+    health=$(on_vm 'curl -s --unix-socket /opt/bayanat/current/bayanat.sock http://localhost/health')
+    [[ "$health" == *'"status":"ok"'* ]] || fail "/health not ok after rollback"
+    pass "/health back to OK after rollback"
+}
+
+S4() {
+    log "S4: recovery v4.0.1 -> v4.0.4"
+    run_update v4.0.4
+    assert_version v4.0.4
+    assert_state IDLE
+    assert_services_active
+    on_vm 'sudo -u bayanat psql -d bayanat -c "\d bulletin" | grep -q auto_update_recovery_test' \
+        || fail "auto_update_recovery_test column missing"
+    pass "auto_update_recovery_test column present"
+}
+
+# --- Main ---
+trap 'restore_upper_tags; teardown' EXIT
+
+if [[ -z "$VM_IP" ]]; then
+    stash_upper_tags
+    provision
+    install_baseline
+    restore_upper_tags
+else
+    log "Reusing existing VM at $VM_IP"
+fi
+
+for s in $SCENARIOS; do
+    "$s"
+done
+
+log "ALL PASSED"
diff --git a/enferno/admin/models/Actor.py b/enferno/admin/models/Actor.py
index b0f1ef9a9..14380ccf0 100644
--- a/enferno/admin/models/Actor.py
+++ b/enferno/admin/models/Actor.py
@@ -28,7 +28,7 @@
 )
 from enferno.admin.models.Country import Country
 from enferno.admin.models.Ethnography import Ethnography
-from enferno.admin.models.utils import check_roles
+from enferno.admin.models.utils import check_roles, can_view_media
 from enferno.extensions import db
 from enferno.utils.base import BaseMixin
 from enferno.utils.csv_utils import convert_simple_relation, convert_complex_relation
@@ -452,75 +452,36 @@ def from_json(self, json: dict[str, Any]) -> "Actor":
 
         # Related Actors (actor_relations)
         if "actor_relations" in json:
-            # collect related actors ids (helps with finding removed ones)
-            rel_ids = []
-            for relation in json["actor_relations"]:
-                actor = db.session.get(Actor, relation["actor"]["id"])
-
-                # Extra (check those actors exit)
-
-                if actor:
-                    rel_ids.append(actor.id)
-                    # this will update/create the relationship (will flush to db!)
-                    self.relate_actor(actor, relation=relation)
-
-                # Find out removed relations and remove them
-            # just loop existing relations and remove if the destination actor not in the related ids
-
-            for r in self.actor_relations:
-                # get related actor (in or out)
-                rid = r.get_other_id(self.id)
-                if not (rid in rel_ids):
-                    r.delete()
-
-                    # -revision related
-                    db.session.get(Actor, rid).create_revision()
+            self.sync_relations(
+                json["actor_relations"],
+                Actor,
+                "actor",
+                self.relate_actor,
+                self.actor_relations,
+                lambda r: r.get_other_id(self.id),
+            )
 
         # Related Bulletins (bulletin_relations)
         if "bulletin_relations" in json:
-            # collect related bulletin ids (helps with finding removed ones)
-            rel_ids = []
-            for relation in json["bulletin_relations"]:
-                bulletin = db.session.get(Bulletin, relation["bulletin"]["id"])
-
-                # Extra (check those bulletins exit)
-                if bulletin:
-                    rel_ids.append(bulletin.id)
-                    # this will update/create the relationship (will flush to db!)
-                    self.relate_bulletin(bulletin, relation=relation)
-
-            # Find out removed relations and remove them
-            # just loop existing relations and remove if the destination bulletin not in the related ids
-            for r in self.bulletin_relations:
-                if not (r.bulletin_id in rel_ids):
-                    rel_bulletin = r.bulletin
-                    r.delete()
-
-                    # -revision related
-                    rel_bulletin.create_revision()
-
-        # Related Incidents (incidents_relations)
+            self.sync_relations(
+                json["bulletin_relations"],
+                Bulletin,
+                "bulletin",
+                self.relate_bulletin,
+                self.bulletin_relations,
+                lambda r: r.bulletin_id,
+            )
+
+        # Related Incidents (incident_relations)
         if "incident_relations" in json:
-            # collect related incident ids (helps with finding removed ones)
-            rel_ids = []
-            for relation in json["incident_relations"]:
-                incident = db.session.get(Incident, relation["incident"]["id"])
-                if incident:
-                    rel_ids.append(incident.id)
-                    # helper method to update/create the relationship (will flush to db)
-                    self.relate_incident(incident, relation=relation)
-
-            # Find out removed relations and remove them
-            # just loop existing relations and remove if the destination incident no in the related ids
-
-            for r in self.incident_relations:
-                # get related bulletin (in or out)
-                if not (r.incident_id in rel_ids):
-                    rel_incident = r.incident
-                    r.delete()
-
-                    # -revision related incident
-                    rel_incident.create_revision()
+            self.sync_relations(
+                json["incident_relations"],
+                Incident,
+                "incident",
+                self.relate_incident,
+                self.incident_relations,
+                lambda r: r.incident_id,
+            )
 
         if "comments" in json:
             self.comments = json["comments"]
@@ -763,9 +724,9 @@ def to_dict(self, mode: Optional[str] = None) -> dict[str, Any]:
             for event in self.events:
                 events_json.append(event.to_dict())
 
-        # medias json
+        # medias json (hidden from users without media access, BAY-01-012)
         medias_json = []
-        if self.medias and len(self.medias):
+        if can_view_media() and self.medias and len(self.medias):
             for media in self.medias:
                 medias_json.append(media.to_dict())
 
diff --git a/enferno/admin/models/Bulletin.py b/enferno/admin/models/Bulletin.py
index 3a48fa3d8..296fe0334 100644
--- a/enferno/admin/models/Bulletin.py
+++ b/enferno/admin/models/Bulletin.py
@@ -31,7 +31,7 @@
     bulletin_verlabels,
     bulletin_events,
 )
-from enferno.admin.models.utils import check_roles
+from enferno.admin.models.utils import check_roles, can_view_media
 
 logger = get_logger()
 
@@ -415,74 +415,36 @@ def from_json(self, json: dict[str, Any]) -> "Bulletin":
 
         # Related Bulletins (bulletin_relations)
         if "bulletin_relations" in json:
-            # collect related bulletin ids (helps with finding removed ones)
-            rel_ids = []
-            for relation in json["bulletin_relations"]:
-                bulletin = db.session.get(Bulletin, relation["bulletin"]["id"])
-                # Extra (check those bulletins exit)
-
-                if bulletin:
-                    rel_ids.append(bulletin.id)
-                    # this will update/create the relationship (will flush to db)
-                    self.relate_bulletin(bulletin, relation=relation)
-
-                # Find out removed relations and remove them
-            # just loop existing relations and remove if the destination bulletin no in the related ids
-
-            for r in self.bulletin_relations:
-                # get related bulletin (in or out)
-                rid = r.get_other_id(self.id)
-                if not (rid in rel_ids):
-                    r.delete()
-
-                    # ------- create revision on the other side of the relationship
-                    db.session.get(Bulletin, rid).create_revision()
-
-        # Related Actors (actors_relations)
+            self.sync_relations(
+                json["bulletin_relations"],
+                Bulletin,
+                "bulletin",
+                self.relate_bulletin,
+                self.bulletin_relations,
+                lambda r: r.get_other_id(self.id),
+            )
+
+        # Related Actors (actor_relations)
         if "actor_relations" in json:
-            # collect related bulletin ids (helps with finding removed ones)
-            rel_ids = []
-            for relation in json["actor_relations"]:
-                actor = db.session.get(Actor, relation["actor"]["id"])
-                if actor:
-                    rel_ids.append(actor.id)
-                    # helper method to update/create the relationship (will flush to db)
-                    self.relate_actor(actor, relation=relation)
-
-            # Find out removed relations and remove them
-            # just loop existing relations and remove if the destination actor no in the related ids
-
-            for r in self.actor_relations:
-                # get related bulletin (in or out)
-                if not (r.actor_id in rel_ids):
-                    rel_actor = r.actor
-                    r.delete()
-
-                    # --revision relation
-                    rel_actor.create_revision()
-
-        # Related Incidents (incidents_relations)
+            self.sync_relations(
+                json["actor_relations"],
+                Actor,
+                "actor",
+                self.relate_actor,
+                self.actor_relations,
+                lambda r: r.actor_id,
+            )
+
+        # Related Incidents (incident_relations)
         if "incident_relations" in json:
-            # collect related incident ids (helps with finding removed ones)
-            rel_ids = []
-            for relation in json["incident_relations"]:
-                incident = db.session.get(Incident, relation["incident"]["id"])
-                if incident:
-                    rel_ids.append(incident.id)
-                    # helper method to update/create the relationship (will flush to db)
-                    self.relate_incident(incident, relation=relation)
-
-            # Find out removed relations and remove them
-            # just loop existing relations and remove if the destination incident no in the related ids
-
-            for r in self.incident_relations:
-                # get related bulletin (in or out)
-                if not (r.incident_id in rel_ids):
-                    rel_incident = r.incident
-                    r.delete()
-
-                    # --revision relation
-                    rel_incident.create_revision()
+            self.sync_relations(
+                json["incident_relations"],
+                Incident,
+                "incident",
+                self.relate_incident,
+                self.incident_relations,
+                lambda r: r.incident_id,
+            )
 
         self.publish_date = json.get("publish_date", None)
         if self.publish_date == "":
@@ -755,9 +717,9 @@ def to_dict(self, mode: Optional[str] = None) -> dict[str, Any]:
             for event in self.events:
                 events_json.append(event.to_dict())
 
-        # medias json
+        # medias json (hidden from users without media access, BAY-01-012)
         medias_json = []
-        if self.medias and len(self.medias):
+        if can_view_media() and self.medias and len(self.medias):
             for media in self.medias:
                 medias_json.append(media.to_dict())
 
diff --git a/enferno/admin/models/Incident.py b/enferno/admin/models/Incident.py
index 09bb06fd6..aeba2732e 100644
--- a/enferno/admin/models/Incident.py
+++ b/enferno/admin/models/Incident.py
@@ -283,76 +283,36 @@ def from_json(self, json: dict[str, Any]) -> "Incident":
 
         # Related Actors (actor_relations)
         if "actor_relations" in json and "check_ar" in json:
-            # collect related actors ids (helps with finding removed ones)
-            rel_ids = []
-            for relation in json["actor_relations"]:
-                actor = db.session.get(Actor, relation["actor"]["id"])
-
-                # Extra (check those actors exit)
-
-                if actor:
-                    rel_ids.append(actor.id)
-                    # this will update/create the relationship (will flush to db!)
-                    self.relate_actor(actor, relation=relation)
-
-                # Find out removed relations and remove them
-            # just loop existing relations and remove if the destination actor not in the related ids
-
-            for r in self.actor_relations:
-                if not (r.actor_id in rel_ids):
-                    rel_actor = r.actor
-                    r.delete()
-
-                    # -revision related actor
-                    rel_actor.create_revision()
+            self.sync_relations(
+                json["actor_relations"],
+                Actor,
+                "actor",
+                self.relate_actor,
+                self.actor_relations,
+                lambda r: r.actor_id,
+            )
 
         # Related Bulletins (bulletin_relations)
         if "bulletin_relations" in json and "check_br" in json:
-            # collect related bulletin ids (helps with finding removed ones)
-            rel_ids = []
-            for relation in json["bulletin_relations"]:
-                bulletin = db.session.get(Bulletin, relation["bulletin"]["id"])
-
-                # Extra (check those bulletins exit)
-                if bulletin:
-                    rel_ids.append(bulletin.id)
-                    # this will update/create the relationship (will flush to db!)
-                    self.relate_bulletin(bulletin, relation=relation)
-
-            # Find out removed relations and remove them
-            # just loop existing relations and remove if the destination bulletin not in the related ids
-            for r in self.bulletin_relations:
-                if not (r.bulletin_id in rel_ids):
-                    rel_bulletin = r.bulletin
-                    r.delete()
-
-                    # -revision related bulletin
-                    rel_bulletin.create_revision()
-
-        # Related Incidnets (incident_relations)
+            self.sync_relations(
+                json["bulletin_relations"],
+                Bulletin,
+                "bulletin",
+                self.relate_bulletin,
+                self.bulletin_relations,
+                lambda r: r.bulletin_id,
+            )
+
+        # Related Incidents (incident_relations)
         if "incident_relations" in json and "check_ir" in json:
-            # collect related incident ids (helps with finding removed ones)
-            rel_ids = []
-            for relation in json["incident_relations"]:
-                incident = db.session.get(Incident, relation["incident"]["id"])
-                # Extra (check those incidents exit)
-
-                if incident:
-                    rel_ids.append(incident.id)
-                    # this will update/create the relationship (will flush to db)
-                    self.relate_incident(incident, relation=relation)
-
-                # Find out removed relations and remove them
-            # just loop existing relations and remove if the destination incident no in the related ids
-
-            for r in self.incident_relations:
-                # get related incident (in or out)
-                rid = r.get_other_id(self.id)
-                if not (rid in rel_ids):
-                    r.delete()
-
-                    # - revision related incident
-                    db.session.get(Incident, rid).create_revision()
+            self.sync_relations(
+                json["incident_relations"],
+                Incident,
+                "incident",
+                self.relate_incident,
+                self.incident_relations,
+                lambda r: r.get_other_id(self.id),
+            )
 
         if "comments" in json:
             self.comments = json["comments"]
diff --git a/enferno/admin/models/Media.py b/enferno/admin/models/Media.py
index 61bb3723c..1c6011581 100644
--- a/enferno/admin/models/Media.py
+++ b/enferno/admin/models/Media.py
@@ -1,5 +1,6 @@
 import json
 import pathlib
+import secrets
 from pathlib import Path
 from typing import Any
 from unidecode import unidecode
@@ -147,6 +148,20 @@ def generate_file_name(filename: str) -> str:
         decoded = secure_filename(unidecode(filename)).lower()
         return f"{DateHelper.utcnow().strftime('%Y%m%d-%H%M%S')}-{decoded}"
 
+    @staticmethod
+    def generate_inline_file_name(filename: str) -> str:
+        """Opaque, unguessable name for inline rich-text uploads (BAY-01-020).
+
+        Inline media is served on a session-only route with no per-item access
+        check, so the old timestamp+basename name let any authenticated user
+        reconstruct a filename and fetch media for items they can't access. A
+        random token makes the URL a capability only held by viewers of the
+        (access-controlled) description that embeds it.
+        """
+        decoded = secure_filename(unidecode(filename)).lower().rsplit(".", 1)
+        suffix = f".{decoded[1]}" if len(decoded) == 2 and decoded[1] else ""
+        return f"{secrets.token_urlsafe(24)}{suffix}"
+
     @staticmethod
     def validate_file_extension(filepath: str, allowed_extensions: list[str]) -> bool:
         """
diff --git a/enferno/admin/models/utils.py b/enferno/admin/models/utils.py
index a79857eb5..947841c5c 100644
--- a/enferno/admin/models/utils.py
+++ b/enferno/admin/models/utils.py
@@ -5,6 +5,20 @@
 #  Role based Access Control Decorator for Bulletins / Actors  / Incidents  #
 
 
+def can_view_media():
+    """Whether the current actor may see media metadata in entity payloads.
+
+    CLI/Celery (no request context) are trusted. Otherwise mirror the
+    _require_media_access gate on the direct media endpoints: Admins and users
+    with can_access_media only. Without this, a user blocked from the media
+    endpoints could still read filenames, etags and OCR text embedded in a
+    parent bulletin/actor payload (BAY-01-012).
+    """
+    if not has_request_context():
+        return True
+    return current_user.has_role("Admin") or current_user.can_access_media
+
+
 def check_roles(method):
     """
     Decorator to check if the current user has access to the resource. If the
diff --git a/enferno/admin/templates/admin/snapshots.html b/enferno/admin/templates/admin/snapshots.html
new file mode 100644
index 000000000..71d82847f
--- /dev/null
+++ b/enferno/admin/templates/admin/snapshots.html
@@ -0,0 +1,28 @@
+{% extends 'layout.html' %} {% block content %}
+
+    <v-main>
+        <v-container fluid>
+            <snapshots-list></snapshots-list>
+        </v-container>
+    </v-main>
+
+{% endblock %} {% block js %}
+    <script src="/static/js/components/SnapshotsList.js?v=1"></script>
+    <script nonce="{{ csp_nonce() }}">
+        const {createApp} = Vue;
+        const {createVuetify} = Vuetify;
+        const vuetify = createVuetify(vuetifyConfig);
+
+        const app = createApp({
+            delimiters: delimiters,
+            mixins: [globalMixin],
+            data: () => ({}),
+        });
+        app.component('SnapshotsList', SnapshotsList);
+        app.use(router).use(vuetify);
+        router.isReady().then(() => {
+            app.mount('#app');
+            window.app = app;
+        });
+    </script>
+{% endblock %}
diff --git a/enferno/admin/templates/nav-bar.html b/enferno/admin/templates/nav-bar.html
index 3a724aae3..a6be982fd 100644
--- a/enferno/admin/templates/nav-bar.html
+++ b/enferno/admin/templates/nav-bar.html
@@ -11,6 +11,8 @@
   <v-spacer></v-spacer>
 
   <template v-slot:append>
+    <update-banner @update-started="$refs.progressDialog && $refs.progressDialog.open()"></update-banner>
+    <update-progress-dialog ref="progressDialog"></update-progress-dialog>
     {% if config.OCR_PROVIDER == 'google_vision' %}
     <v-tooltip location="bottom">
       <template v-slot:activator="{ props }">
diff --git a/enferno/admin/validation/models.py b/enferno/admin/validation/models.py
index 7360a3bd7..c03ce2eeb 100644
--- a/enferno/admin/validation/models.py
+++ b/enferno/admin/validation/models.py
@@ -2087,7 +2087,11 @@ def validate_url(cls, v: HttpUrl) -> str:
         if domain.startswith("www."):
             domain = domain[4:]
         allowed_domains = Config.get("YTDLP_ALLOWED_DOMAINS")
-        if not any(domain.endswith(allowed) for allowed in allowed_domains):
+        # Match the registered domain or a real subdomain, not any suffix
+        # (BAY-01-014): plain endswith let "evilyoutube.com" pass "youtube.com".
+        if not any(
+            domain == allowed or domain.endswith("." + allowed) for allowed in allowed_domains
+        ):
             raise ValueError(f"Imports not allowed from {domain}")
 
         return str(v)
diff --git a/enferno/admin/views/__init__.py b/enferno/admin/views/__init__.py
index a50c38de7..915a6dc44 100644
--- a/enferno/admin/views/__init__.py
+++ b/enferno/admin/views/__init__.py
@@ -3,7 +3,7 @@
 import os
 from functools import wraps
 
-from flask import Blueprint, g, request
+from flask import Blueprint, current_app, g, request
 from flask_security.decorators import auth_required, current_user
 
 from enferno.admin.models import Activity
@@ -100,6 +100,45 @@ def has_role_assignment_permission(roles: list) -> bool:
     return True
 
 
+def fresh_auth(func):
+    """Require a freshly-authenticated session for privileged mutations.
+
+    The freshness window is taken from the operator-configured
+    SECURITY_FRESHNESS / SECURITY_FRESHNESS_GRACE_PERIOD settings rather than a
+    hardcoded value (BAY-01-016), so admins re-authenticate before sensitive
+    state changes even on an otherwise-valid but stale session.
+    """
+    return auth_required(
+        within=lambda: current_app.config["SECURITY_FRESHNESS"],
+        grace=lambda: current_app.config["SECURITY_FRESHNESS_GRACE_PERIOD"],
+    )(func)
+
+
+PEER_REVIEW_LOCKED_STATUS = "Peer Review Assigned"
+
+
+def reject_if_review_locked(item, entity: str, item_id):
+    """Block non-Admin edits to an item frozen for peer review (BAY-01-022).
+
+    Once an item enters "Peer Review Assigned" the owner must not modify it via
+    the normal update API; the reviewer acts through the review endpoint and an
+    Admin can override. Returns a forbidden Response when locked, else None.
+    """
+    if getattr(item, "status", None) == PEER_REVIEW_LOCKED_STATUS and not current_user.has_role(
+        "Admin"
+    ):
+        Activity.create(
+            current_user,
+            Activity.ACTION_UPDATE,
+            Activity.STATUS_DENIED,
+            request.json,
+            entity,
+            details=f"Attempt to edit {entity} {item_id} locked for peer review.",
+        )
+        return HTTPResponse.forbidden("Item is locked for peer review")
+    return None
+
+
 @admin.before_request
 @auth_required("session")
 def before_request() -> None:
@@ -119,7 +158,7 @@ def ctx() -> dict:
     Returns:
         - dict of users
     """
-    users = User.query.order_by(User.username).all()
+    users = User.query.order_by(User.username).all()  # noqa: F811
     if current_user and current_user.is_authenticated:
         users = [u.to_compact() for u in users]
         return {"users": users}
diff --git a/enferno/admin/views/actors.py b/enferno/admin/views/actors.py
index d1040072e..becf7256e 100644
--- a/enferno/admin/views/actors.py
+++ b/enferno/admin/views/actors.py
@@ -25,7 +25,7 @@
 from enferno.utils.search_utils import SearchUtils
 from enferno.utils.validation_utils import validate_with
 import enferno.utils.typing as t
-from . import admin, PER_PAGE, REL_PER_PAGE, can_assign_roles
+from . import admin, PER_PAGE, REL_PER_PAGE, can_assign_roles, reject_if_review_locked
 
 
 # Actor fields routes
@@ -154,15 +154,9 @@ def api_actors(validated_data: dict) -> Response:
                     "name": item.name,
                     "name_ar": item.name_ar,
                     "status": item.status,
-                    "assigned_to": (
-                        {"id": item.assigned_to.id, "name": item.assigned_to.name}
-                        if item.assigned_to
-                        else None
-                    ),
+                    "assigned_to": (item.assigned_to.to_compact() if item.assigned_to else None),
                     "first_peer_reviewer": (
-                        {"id": item.first_peer_reviewer.id, "name": item.first_peer_reviewer.name}
-                        if item.first_peer_reviewer
-                        else None
+                        item.first_peer_reviewer.to_compact() if item.first_peer_reviewer else None
                     ),
                     "roles": (
                         [
@@ -293,6 +287,11 @@ def api_actor_update(id: t.id, validated_data: dict) -> Response:
                 is_urgent=True,
             )
             return HTTPResponse.forbidden("Restricted Access")
+
+        review_locked = reject_if_review_locked(actor, "actor", id)
+        if review_locked:
+            return review_locked
+
         actor = actor.from_json(validated_data["item"])
         # Create a revision using latest values
         # this method automatically commits
@@ -404,6 +403,7 @@ def api_actor_bulk_update(
     if not current_user.has_role("Admin"):
         # silently discard access roles
         bulk.pop("roles", None)
+        bulk.pop("rolesReplace", None)
 
     if ids and len(bulk):
         job = bulk_update_actors.delay(ids, bulk, current_user.id)
diff --git a/enferno/admin/views/bulletins.py b/enferno/admin/views/bulletins.py
index f6b9a62a3..feb10afcd 100644
--- a/enferno/admin/views/bulletins.py
+++ b/enferno/admin/views/bulletins.py
@@ -25,7 +25,7 @@
 from enferno.utils.search_utils import SearchUtils
 from enferno.utils.validation_utils import validate_with
 import enferno.utils.typing as t
-from . import admin, PER_PAGE, REL_PER_PAGE, can_assign_roles
+from . import admin, PER_PAGE, REL_PER_PAGE, can_assign_roles, reject_if_review_locked
 
 
 # Bulletin fields routes
@@ -139,15 +139,9 @@ def api_bulletins(validated_data: dict) -> Response:
                     "sjac_title": item.sjac_title,
                     "sjac_title_ar": item.sjac_title_ar,
                     "status": item.status,
-                    "assigned_to": (
-                        {"id": item.assigned_to.id, "name": item.assigned_to.name}
-                        if item.assigned_to
-                        else None
-                    ),
+                    "assigned_to": (item.assigned_to.to_compact() if item.assigned_to else None),
                     "first_peer_reviewer": (
-                        {"id": item.first_peer_reviewer.id, "name": item.first_peer_reviewer.name}
-                        if item.first_peer_reviewer
-                        else None
+                        item.first_peer_reviewer.to_compact() if item.first_peer_reviewer else None
                     ),
                     "roles": (
                         [
@@ -279,6 +273,16 @@ def api_bulletin_update(id: t.id, validated_data: dict) -> Response:
             )
             return HTTPResponse.forbidden("Restricted Access")
 
+        review_locked = reject_if_review_locked(bulletin, "bulletin", id)
+        if review_locked:
+            return review_locked
+
+        # Non-Admin owners cannot reassign or set reviewers via the normal update
+        # (BAY-01-022); assignment goes through the assign endpoint.
+        if not current_user.has_role("Admin"):
+            for field in ("assigned_to", "first_peer_reviewer", "second_peer_reviewer"):
+                validated_data["item"].pop(field, None)
+
         bulletin = bulletin.from_json(validated_data["item"])
 
         bulletin.create_revision()
@@ -397,6 +401,7 @@ def api_bulletin_bulk_update(
     if not current_user.has_role("Admin"):
         # silently discard access roles
         bulk.pop("roles", None)
+        bulk.pop("rolesReplace", None)
 
     if ids and len(bulk):
         job = bulk_update_bulletins.delay(ids, bulk, current_user.id)
diff --git a/enferno/admin/views/history.py b/enferno/admin/views/history.py
index 99c19322b..9d95cd4c1 100644
--- a/enferno/admin/views/history.py
+++ b/enferno/admin/views/history.py
@@ -1,13 +1,38 @@
 from __future__ import annotations
 
 from flask import Response
+from flask_security.decorators import current_user
 from sqlalchemy import desc
 
-from enferno.admin.models import BulletinHistory, ActorHistory, IncidentHistory, LocationHistory
+from enferno.admin.models import (
+    Activity,
+    Actor,
+    ActorHistory,
+    Bulletin,
+    BulletinHistory,
+    Incident,
+    IncidentHistory,
+    LocationHistory,
+)
+from enferno.extensions import db
 from enferno.utils.http_response import HTTPResponse
 import enferno.utils.typing as t
 from . import admin, require_view_history
 
+
+def _deny_history(parent_label: str, parent_id: int) -> Response:
+    """Log a denied history view and return a forbidden response."""
+    Activity.create(
+        current_user,
+        Activity.ACTION_VIEW,
+        Activity.STATUS_DENIED,
+        {"id": parent_id},
+        parent_label,
+        details=f"Unauthorized attempt to view history of restricted {parent_label} {parent_id}.",
+    )
+    return HTTPResponse.forbidden("Restricted Access")
+
+
 # Bulletin History Helpers
 
 
@@ -23,6 +48,12 @@ def api_bulletinhistory(bulletinid: t.id) -> Response:
     Returns:
         - json feed of item's history / error.
     """
+    bulletin = db.session.get(Bulletin, bulletinid)
+    if not bulletin:
+        return HTTPResponse.not_found("Bulletin not found")
+    if not current_user.can_access(bulletin):
+        return _deny_history("bulletin", bulletinid)
+
     result = (
         BulletinHistory.query.filter_by(bulletin_id=bulletinid)
         .order_by(desc(BulletinHistory.created_at))
@@ -49,6 +80,12 @@ def api_actorhistory(actorid: t.id) -> Response:
     Returns:
         - json feed of item's history / error.
     """
+    actor = db.session.get(Actor, actorid)
+    if not actor:
+        return HTTPResponse.not_found("Actor not found")
+    if not current_user.can_access(actor):
+        return _deny_history("actor", actorid)
+
     result = (
         ActorHistory.query.filter_by(actor_id=actorid).order_by(desc(ActorHistory.created_at)).all()
     )
@@ -72,6 +109,12 @@ def api_incidenthistory(incidentid: t.id) -> Response:
     Returns:
         - json feed of item's history / error.
     """
+    incident = db.session.get(Incident, incidentid)
+    if not incident:
+        return HTTPResponse.not_found("Incident not found")
+    if not current_user.can_access(incident):
+        return _deny_history("incident", incidentid)
+
     result = (
         IncidentHistory.query.filter_by(incident_id=incidentid)
         .order_by(desc(IncidentHistory.created_at))
diff --git a/enferno/admin/views/incidents.py b/enferno/admin/views/incidents.py
index 9bff00f73..078c80df4 100644
--- a/enferno/admin/views/incidents.py
+++ b/enferno/admin/views/incidents.py
@@ -25,7 +25,7 @@
 from enferno.utils.search_utils import SearchUtils
 from enferno.utils.validation_utils import validate_with
 import enferno.utils.typing as t
-from . import admin, PER_PAGE, REL_PER_PAGE, can_assign_roles
+from . import admin, PER_PAGE, REL_PER_PAGE, can_assign_roles, reject_if_review_locked
 
 
 # Incident fields routes
@@ -162,15 +162,9 @@ def api_incidents(validated_data: dict) -> Response:
                     "title": item.title,
                     "title_ar": item.title_ar,
                     "status": item.status,
-                    "assigned_to": (
-                        {"id": item.assigned_to.id, "name": item.assigned_to.name}
-                        if item.assigned_to
-                        else None
-                    ),
+                    "assigned_to": (item.assigned_to.to_compact() if item.assigned_to else None),
                     "first_peer_reviewer": (
-                        {"id": item.first_peer_reviewer.id, "name": item.first_peer_reviewer.name}
-                        if item.first_peer_reviewer
-                        else None
+                        item.first_peer_reviewer.to_compact() if item.first_peer_reviewer else None
                     ),
                     "roles": (
                         [
@@ -305,6 +299,10 @@ def api_incident_update(id: t.id, validated_data: dict) -> Response:
             )
             return HTTPResponse.forbidden("Restricted Access")
 
+        review_locked = reject_if_review_locked(incident, "incident", id)
+        if review_locked:
+            return review_locked
+
         incident = incident.from_json(validated_data["item"])
 
         # Create a revision using latest values
diff --git a/enferno/admin/views/media.py b/enferno/admin/views/media.py
index 07e3dfc8a..48d58761b 100644
--- a/enferno/admin/views/media.py
+++ b/enferno/admin/views/media.py
@@ -388,6 +388,7 @@ def api_medias_upload() -> Response:
 
 # return signed url from s3 valid for some time
 @admin.route("/api/media/<filename>")
+@_require_media_access
 def serve_media(
     filename: str,
 ) -> Response:
@@ -475,6 +476,7 @@ def serve_media(
 
 
 @admin.route("/api/serve/media/<filename>")
+@_require_media_access
 def api_local_serve_media(
     filename: str,
 ) -> Response:
@@ -522,6 +524,7 @@ def api_local_serve_media(
 
 @admin.route("/api/media/<int:id>/proxy")
 @auth_required()
+@_require_media_access
 def api_media_proxy(id: int) -> Response:
     """Proxy media file through Flask -- ensures same-origin inline display for PDFs."""
     media = Media.query.get(id)
@@ -573,8 +576,9 @@ def api_inline_medias_upload() -> Response:
                 f"File exceeds maximum allowed size of {max_size_mb} MB", status=413
             )
 
-        # final file
-        filename = Media.generate_file_name(f.filename)
+        # final file: opaque, unguessable name so inline media can't be
+        # enumerated/reconstructed by other users (BAY-01-020)
+        filename = Media.generate_inline_file_name(f.filename)
         filepath = (Media.inline_dir / filename).as_posix()
         f.save(filepath)
 
@@ -604,6 +608,7 @@ def api_local_serve_inline_media(filename: str) -> Response:
 
 @admin.get("/api/media/<int:id>")
 @auth_required("session")
+@_require_media_access
 def api_media_get(id: int):
     """Get a single media item by ID with extraction and bulletin info."""
     media = Media.query.get(id)
@@ -650,14 +655,14 @@ def api_media_update(id: t.id, validated_data: dict) -> Response:
     if media is None:
         return HTTPResponse.not_found("Media not found")
 
-    if not current_user.can_access(media):
+    if not current_user.can_edit(media):
         Activity.create(
             current_user,
             Activity.ACTION_VIEW,
             Activity.STATUS_DENIED,
             validated_data,
             "media",
-            details="Unauthorized attempt to update restricted media.",
+            details="Unauthorized attempt to update media outside edit boundary.",
         )
         return HTTPResponse.forbidden("Restricted Access")
 
@@ -954,6 +959,7 @@ def api_ocr_stats():
 
 @admin.get("/api/extraction/<int:extraction_id>")
 @auth_required("session")
+@_require_media_access
 def api_extraction_get(extraction_id: int):
     """Return full extraction data including text."""
     extraction = Extraction.query.get(extraction_id)
@@ -984,6 +990,14 @@ def api_extraction_update(extraction_id: int):
     if not extraction:
         return HTTPResponse.not_found("Extraction not found")
 
+    media = Media.query.get(extraction.media_id)
+    if not media:
+        return HTTPResponse.not_found("Parent media not found")
+    # Editing extracted text mutates the item: require the assignment edit
+    # boundary, not just visibility (BAY-01-009).
+    if not current_user.can_edit(media):
+        return HTTPResponse.forbidden("Restricted Access")
+
     data = request.json or {}
     action = data.get("action")
 
@@ -1032,7 +1046,7 @@ def api_extraction_update(extraction_id: int):
         details=detail_map.get(action),
     )
 
-    return jsonify(extraction.to_dict())
+    return jsonify(extraction.to_compact_dict())
 
 
 @admin.put("/api/media/<int:id>/orientation")
@@ -1044,7 +1058,9 @@ def api_media_orientation(id: int):
     if not media:
         return HTTPResponse.not_found("Media not found")
 
-    if not current_user.can_access(media):
+    # Rotating media mutates the item: require the assignment edit boundary,
+    # not just visibility (BAY-01-009).
+    if not current_user.can_edit(media):
         return HTTPResponse.forbidden("Restricted Access")
 
     data = request.json or {}
@@ -1107,7 +1123,9 @@ def api_ocr_process(media_id: int):
     media = db.session.get(Media, media_id)
     if not media:
         return HTTPResponse.not_found("Media not found")
-    if not current_user.can_access(media):
+    # Running OCR writes the item's extraction: require the assignment edit
+    # boundary, not just visibility (BAY-01-009).
+    if not current_user.can_edit(media):
         return HTTPResponse.forbidden("Restricted Access")
 
     result = process_media_extraction_task(media_id, force=True)
@@ -1151,12 +1169,13 @@ def api_ocr_bulk():
     ocr_ext = current_app.config.get("OCR_EXT", [])
     ext_filters = [Media.media_file.ilike(f"%.{ext}") for ext in ocr_ext] if ocr_ext else []
 
-    # Build media ID list
+    # Build media ID list. Every path is scoped to the caller's access via
+    # _apply_media_access_filter so a non-admin can't OCR restricted items.
     if process_all and not media_ids:
         stmt = select(Media.id).outerjoin(Extraction).where(Extraction.id.is_(None))
         if ext_filters:
             stmt = stmt.where(or_(*ext_filters))
-        stmt = stmt.limit(limit)
+        stmt = _apply_media_access_filter(stmt).limit(limit)
         media_ids = list(db.session.scalars(stmt))
     elif bulletin_id and not media_ids:
         stmt = (
@@ -1167,8 +1186,20 @@ def api_ocr_bulk():
         )
         if ext_filters:
             stmt = stmt.where(or_(*ext_filters))
-        stmt = stmt.limit(limit)
+        stmt = _apply_media_access_filter(stmt).limit(limit)
         media_ids = list(db.session.scalars(stmt))
+    elif media_ids:
+        # explicit list: drop any the caller can't access
+        stmt = _apply_media_access_filter(select(Media.id).where(Media.id.in_(media_ids)))
+        media_ids = list(db.session.scalars(stmt))
+
+    # OCR writes an extraction, so enforce the assignment edit boundary per
+    # item, matching the single-OCR endpoint (BAY-01-009). The query filter
+    # above only expresses visibility (can_access); can_edit needs the parent's
+    # assignment + status, so post-filter here. Admins always pass.
+    if media_ids and not current_user.has_role("Admin"):
+        candidates = db.session.scalars(select(Media).where(Media.id.in_(media_ids)))
+        media_ids = [m.id for m in candidates if current_user.can_edit(m)]
 
     if not media_ids:
         return HTTPResponse.error("No media to process")
diff --git a/enferno/admin/views/system.py b/enferno/admin/views/system.py
index 5496f1db9..c7e055305 100644
--- a/enferno/admin/views/system.py
+++ b/enferno/admin/views/system.py
@@ -2,10 +2,10 @@
 
 from typing import Any
 
-from flask import Response, request
+from flask import Response, current_app, request
 from flask.templating import render_template
 from flask_babel import gettext
-from flask_security.decorators import auth_required, current_user, roles_required
+from flask_security.decorators import current_user, roles_required
 
 from enferno.admin.constants import Constants
 from enferno.admin.models import (
@@ -23,11 +23,11 @@
 from enferno.utils.config_utils import ConfigManager
 from enferno.utils.http_response import HTTPResponse
 from enferno.utils.validation_utils import validate_with
-from . import admin, PER_PAGE
+from . import admin, PER_PAGE, fresh_auth
 
 
 @admin.get("/system-administration/")
-@auth_required(within=15, grace=0)
+@fresh_auth
 @roles_required("Admin")
 def system_admin() -> str:
     """Endpoint for system administration."""
@@ -76,6 +76,7 @@ def api_config() -> str:
 
 
 @admin.put("/api/configuration/")
+@fresh_auth
 @roles_required("Admin")
 @validate_with(ConfigRequestModel)
 def api_config_write(
@@ -107,6 +108,7 @@ def api_config_write(
 
 
 @admin.post("/api/reload/")
+@fresh_auth
 @roles_required("Admin")
 def api_app_reload() -> Response:
     """
@@ -184,3 +186,105 @@ def get_data(table: str) -> list[dict[str, Any]] | list[dict[str, dict[str, Any
         return [{"en": item.title, "tr": item.title_tr or ""} for item in items]
 
     return None
+
+
+import json
+import time
+from pathlib import Path
+
+from enferno.extensions import rds
+from enferno.tasks.maintenance import UPDATE_CACHE_KEY, _current_version
+
+UPDATE_STATE_FILE = "/opt/bayanat/state/update.json"
+TERMINAL_PHASES = {"SUCCESS", "ROLLED_BACK", "NEEDS_INTERVENTION", "IDLE"}
+
+
+def _idle_status(current):
+    return {
+        "phase": "IDLE",
+        "phase_label": "No update in progress",
+        "running": False,
+        "target": None,
+        "previous": None,
+        "snapshot": None,
+        "started_at": None,
+        "updated_at": None,
+        "progress_text": None,
+        "error": None,
+        "current": current,
+    }
+
+
+@admin.get("/api/updates/available")
+@roles_required("Admin")
+def api_updates_available() -> Response:
+    """Return the latest cached GitHub release info."""
+    raw = rds.get(UPDATE_CACHE_KEY)
+    cached = {}
+    if raw:
+        try:
+            cached = json.loads(raw.decode() if isinstance(raw, (bytes, bytearray)) else raw)
+        except Exception:
+            cached = {}
+    payload = {
+        "current": _current_version(),
+        "latest": cached.get("latest"),
+        "release_notes_url": cached.get("release_notes_url"),
+        "checked_at": cached.get("checked_at"),
+    }
+    return HTTPResponse.success(data=payload)
+
+
+@admin.get("/snapshots/")
+@fresh_auth
+@roles_required("Admin")
+def snapshots_page() -> str:
+    """Render the snapshots list page."""
+    return render_template("admin/snapshots.html")
+
+
+@admin.get("/api/snapshots/")
+@roles_required("Admin")
+def api_snapshots() -> Response:
+    """List pre-update snapshots from the backups directory.
+
+    Reads the directory the updater writes snapshots into instead of shelling
+    `sudo bayanat snapshots`, so the service account needs no sudo grant
+    (BAY-01-032).
+    """
+    backups = Path(current_app.config.get("BACKUPS_LOCAL_PATH", ""))
+    items = []
+    if backups.is_dir():
+        now = time.time()
+        for p in sorted(backups.glob("pre-*.dump"), key=lambda p: p.stat().st_mtime, reverse=True):
+            st = p.stat()
+            size = st.st_size
+            for unit in ("B", "K", "M", "G", "T"):
+                if size < 1024:
+                    break
+                size /= 1024
+            items.append(
+                {
+                    "name": p.name,
+                    "size": f"{size:.0f}{unit}",
+                    "age": f"{int((now - st.st_mtime) // 3600)}h",
+                }
+            )
+    return HTTPResponse.success(data=items)
+
+
+@admin.get("/api/updates/status")
+@roles_required("Admin")
+def api_updates_status() -> Response:
+    """Return the current update state (from the CLI-written JSON file)."""
+    current = _current_version()
+    path = Path(UPDATE_STATE_FILE)
+    if not path.exists():
+        return HTTPResponse.success(data=_idle_status(current))
+    try:
+        state = json.loads(path.read_text())
+    except Exception:
+        return HTTPResponse.success(data=_idle_status(current))
+    state["running"] = state.get("phase") not in TERMINAL_PHASES
+    state["current"] = current
+    return HTTPResponse.success(data=state)
diff --git a/enferno/admin/views/users.py b/enferno/admin/views/users.py
index 3745e0164..3dc6b686d 100644
--- a/enferno/admin/views/users.py
+++ b/enferno/admin/views/users.py
@@ -6,7 +6,7 @@
 from flask import Response, request, current_app, session
 from flask.templating import render_template
 from flask_security import logout_user
-from flask_security.decorators import auth_required, current_user, roles_accepted, roles_required
+from flask_security.decorators import current_user, roles_accepted, roles_required
 from flask_security.twofactor import tf_disable
 from sqlalchemy import or_
 
@@ -26,7 +26,7 @@
 from enferno.utils.logging_utils import get_logger
 from enferno.utils.validation_utils import validate_with
 import enferno.utils.typing as t
-from . import admin, PER_PAGE
+from . import admin, PER_PAGE, fresh_auth
 
 logger = get_logger()
 
@@ -68,7 +68,7 @@ def api_users() -> Response:
 
 @admin.get("/users/", defaults={"id": None})
 @admin.get("/users/<int:id>")
-@auth_required(within=15, grace=0)
+@fresh_auth
 @roles_required("Admin")
 def users(id) -> str:
     """
@@ -158,6 +158,7 @@ def api_user_sessions(id: int) -> Any:
 
 
 @admin.delete("/api/session/logout")
+@fresh_auth
 @roles_required("Admin")
 def logout_session() -> Response:
     """
@@ -201,6 +202,7 @@ def logout_session() -> Response:
 
 
 @admin.delete("/api/user/<int:user_id>/sessions/logout")
+@fresh_auth
 @roles_required("Admin")
 def logout_all_sessions(user_id: int) -> Any:
     """
@@ -246,6 +248,7 @@ def logout_all_sessions(user_id: int) -> Any:
 
 
 @admin.delete("/api/user/revoke_2fa")
+@fresh_auth
 @roles_required("Admin")
 def revoke_2fa() -> Response:
     """
@@ -273,6 +276,7 @@ def revoke_2fa() -> Response:
 
 
 @admin.post("/api/user/")
+@fresh_auth
 @roles_required("Admin")
 @validate_with(UserRequestModel)
 def api_user_create(
@@ -353,6 +357,7 @@ def api_user_check(
 
 
 @admin.put("/api/user/")
+@fresh_auth
 @roles_required("Admin")
 @validate_with(UserRequestModel)
 def api_user_update(
@@ -432,6 +437,7 @@ def api_check_password(
 
 
 @admin.post("/api/user/force-reset")
+@fresh_auth
 @roles_required("Admin")
 @validate_with(UserForceResetRequestModel)
 def api_user_force_reset(validated_data: dict) -> Response:
@@ -459,6 +465,7 @@ def api_user_force_reset(validated_data: dict) -> Response:
 
 
 @admin.post("/api/user/force-reset-all")
+@fresh_auth
 @roles_required("Admin")
 def api_user_force_reset_all() -> Response:
     """
@@ -475,6 +482,7 @@ def api_user_force_reset_all() -> Response:
 
 
 @admin.delete("/api/user/<int:id>")
+@fresh_auth
 @roles_required("Admin")
 def api_user_delete(
     id: t.id,
@@ -513,7 +521,7 @@ def api_user_delete(
 
 # Roles routes
 @admin.route("/roles/")
-@auth_required(within=15, grace=0)
+@fresh_auth
 @roles_required("Admin")
 def roles() -> str:
     """
@@ -554,6 +562,7 @@ def api_roles() -> Response:
 
 
 @admin.post("/api/role/")
+@fresh_auth
 @roles_required("Admin")
 @validate_with(RoleRequestModel)
 def api_role_create(
@@ -588,6 +597,7 @@ def api_role_create(
 
 
 @admin.put("/api/role/<int:id>")
+@fresh_auth
 @roles_required("Admin")
 @validate_with(RoleRequestModel)
 def api_role_update(id: t.id, validated_data: dict) -> Response:
@@ -618,6 +628,7 @@ def api_role_update(id: t.id, validated_data: dict) -> Response:
 
 
 @admin.delete("/api/role/<int:id>")
+@fresh_auth
 @roles_required("Admin")
 def api_role_delete(
     id: t.id,
@@ -659,6 +670,7 @@ def api_role_delete(
 
 
 @admin.post("/api/role/import/")
+@fresh_auth
 @roles_required("Admin")
 def api_role_import() -> Response:
     """
diff --git a/enferno/app.py b/enferno/app.py
index e1c11d819..fb1c87844 100755
--- a/enferno/app.py
+++ b/enferno/app.py
@@ -2,7 +2,7 @@
 
 import pandas as pd
 from urllib.parse import urlparse
-from flask import Flask, render_template, current_app
+from flask import Flask, render_template, current_app, request
 from flask_login import user_logged_in, user_logged_out
 from flask_security import Security, SQLAlchemyUserDatastore
 from flask_security import current_user
@@ -58,7 +58,7 @@
 from enferno.user.models import WebAuthn
 from enferno.user.views import bp_user
 from enferno.utils.logging_utils import get_logger
-from enferno.utils.rate_limit_utils import ratelimit_handler
+from enferno.utils.rate_limit_utils import get_real_ip, ratelimit_handler
 
 logger = get_logger()
 
@@ -163,11 +163,38 @@ def _should_set_storage(self, app, sess):
     mail.init_app(app)
 
     limiter.init_app(app)
+    _apply_login_rate_limit(app)
 
     # Initialize Talisman with security headers
     register_talisman(app)
 
 
+def _apply_login_rate_limit(app):
+    """Stack per-username and per-IP Flask-Limiter limits on POST /login.
+
+    The /login view is owned by Flask-Security; we wrap it post-registration
+    so the same limiter / Redis storage / 429 handler used elsewhere applies.
+    """
+    login_view = app.view_functions.get("security.login")
+    if login_view is None:
+        return
+
+    def _username_key():
+        return f"login:user:{(request.form.get('username') or '').lower().strip()}"
+
+    wrapped = limiter.limit(
+        app.config["LOGIN_RATE_LIMIT_PER_USERNAME"],
+        key_func=_username_key,
+        methods=["POST"],
+    )(login_view)
+    wrapped = limiter.limit(
+        app.config["LOGIN_RATE_LIMIT_PER_IP"],
+        key_func=get_real_ip,
+        methods=["POST"],
+    )(wrapped)
+    app.view_functions["security.login"] = wrapped
+
+
 def register_talisman(app):
     """
     Register Flask-Talisman for security headers including CSP.
diff --git a/enferno/commands.py b/enferno/commands.py
index e8c72c86b..362415c84 100644
--- a/enferno/commands.py
+++ b/enferno/commands.py
@@ -3,6 +3,7 @@
 
 import os
 from datetime import datetime, timezone
+from typing import Optional
 
 import click
 from flask import current_app
@@ -14,8 +15,10 @@
 from pathlib import Path
 
 from enferno.extensions import db
+from enferno.settings import Config
 from enferno.user.models import User, Role
 from enferno.utils.config_utils import ConfigManager
+from enferno.utils.date_helper import DateHelper
 from enferno.utils.data_helpers import (
     import_default_data,
     generate_user_roles,
@@ -31,7 +34,6 @@
 from enferno.admin.models.Media import Media
 from enferno.admin.models.tables import bulletin_labels
 from enferno.admin.models.DynamicFormHistory import DynamicFormHistory
-from enferno.utils.date_helper import DateHelper
 from enferno.utils.form_history_utils import record_form_history
 
 from enferno.utils.validation_utils import validate_password_policy
@@ -120,33 +122,87 @@ def import_data() -> None:
 
 
 @click.command()
+@click.option("-u", "--username", default=None, help="Admin username (prompted if not provided)")
+@click.option("-p", "--password", default=None, help="Admin password (generated if not provided)")
+@click.option(
+    "--password-stdin",
+    "password_stdin",
+    is_flag=True,
+    default=False,
+    help="Read admin password from stdin (avoids argv exposure)",
+)
 @with_appcontext
-def install() -> None:
-    """Install a default Admin user and add an Admin role to it."""
+def install(username: Optional[str], password: Optional[str], password_stdin: bool = False) -> None:
+    """Install a default Admin user and add an Admin role to it.
+
+    Non-interactive use:
+        flask install -u admin                          # generate a password
+        flask install -u admin -p '<password>'          # supply via flag
+        echo '<password>' | flask install -u admin --password-stdin
+    """
+    import secrets
+    import sys
+
+    if password_stdin:
+        if password:
+            click.echo("Cannot combine --password and --password-stdin.")
+            return
+        password = sys.stdin.readline().rstrip("\n")
+        if not password:
+            click.echo("Empty password on stdin.")
+            return
+
     logger.info("Installing admin user.")
     admin_role = Role.query.filter(Role.name == "Admin").first()
 
-    # check if there's an existing admin
     if admin_role.users.all():
         click.echo("An admin user is already installed.")
         logger.error("An admin user is already installed.")
         return
 
-    # to make sure username doesn't already exist
-    while True:
-        u = click.prompt("Admin username?", default="admin")
-        check = User.query.filter(User.username == u.lower()).first()
-        if check is not None:
+    # Resolve username
+    if username:
+        u = username.strip()
+        if User.query.filter(User.username == u.lower()).first() is not None:
+            click.echo(f"Username '{u}' already exists.")
+            logger.error("Install aborted: username already exists.")
+            return
+    else:
+        while True:
+            u = click.prompt("Admin username?", default="admin")
+            if User.query.filter(User.username == u.lower()).first() is None:
+                break
             click.echo("Username already exists.")
-        else:
-            break
-    while True:
-        p = click.prompt("Admin Password?", hide_input=True)
+
+    # Resolve password (generate if not supplied; show it once)
+    generated = False
+    if password:
         try:
-            p = validate_password_policy(p)
-            break
+            p = validate_password_policy(password)
         except ValueError as e:
             click.echo(str(e))
+            logger.error("Install aborted: password failed policy check.")
+            return
+    elif username:
+        # Non-interactive (username supplied, password not) → generate.
+        while True:
+            candidate = secrets.token_urlsafe(20)
+            try:
+                p = validate_password_policy(candidate)
+                generated = True
+                break
+            except ValueError:
+                # token_urlsafe is high-entropy; loop guard for the rare zxcvbn miss
+                continue
+    else:
+        while True:
+            p = click.prompt("Admin Password?", hide_input=True)
+            try:
+                p = validate_password_policy(p)
+                break
+            except ValueError as e:
+                click.echo(str(e))
+
     user = User(
         username=u,
         password=hash_password(p),
@@ -164,7 +220,14 @@ def install() -> None:
     user.roles.append(admin_role)
     check = user.save()
     if check:
-        click.echo("Admin user installed successfully.")
+        if generated:
+            click.echo("=" * 60)
+            click.echo(f"Admin user installed: {u}")
+            click.echo(f"Generated password : {p}")
+            click.echo("Save this now — it is not stored in plaintext anywhere.")
+            click.echo("=" * 60)
+        else:
+            click.echo("Admin user installed successfully.")
         logger.info("Admin user installed successfully.")
     else:
         click.echo("Error installing admin user.")
@@ -546,7 +609,6 @@ def fail(msg):
         fail("Redis not reachable")
 
     try:
-        from celery import current_app as celery_app
         from enferno.tasks import celery
 
         inspector = celery.control.inspect(timeout=2)
@@ -789,7 +851,7 @@ def status() -> None:
     total_extracted = sum(s["count"] for s in status_map.values())
     pending = total_media - total_extracted
 
-    click.echo(f"\nOCR Status Summary")
+    click.echo("\nOCR Status Summary")
     click.echo(f"{'─' * 40}")
     click.echo(f"Total media:          {total_media:,}")
     click.echo(f"Pending (no OCR):     {pending:,}")
diff --git a/enferno/data_import/utils/media_import.py b/enferno/data_import/utils/media_import.py
index 4a1754817..2ccb68c9c 100644
--- a/enferno/data_import/utils/media_import.py
+++ b/enferno/data_import/utils/media_import.py
@@ -9,6 +9,7 @@
 from enferno.admin.models import Media, Bulletin, Source, Label, Location, Activity
 from enferno.data_import.models import DataImport
 from enferno.user.models import User, Role
+from enferno.utils.validation_utils import sanitize_string
 from enferno.utils.data_helpers import get_file_hash, media_check_duplicates
 from enferno.utils.date_helper import DateHelper
 import arrow, shutil
@@ -20,7 +21,6 @@
 import enferno.utils.typing as t
 from enferno.extensions import db
 from sqlalchemy import any_
-from urllib.parse import urlparse
 
 logger = get_logger()
 
@@ -568,6 +568,7 @@ def create_bulletin(self, info: dict) -> None:
         db.session.add(bulletin)
 
         def update_description(description):
+            description = sanitize_string(description or "")
             if bulletin.description:
                 bulletin.description += f"<br />{description}"
             else:
@@ -593,20 +594,19 @@ def update_description(description):
             channel_url = info.get("channel_url")
             channel = info.get("channel")
 
-            domain = info.get("extractor_key")
+            domain = info.get("extractor_key") or info.get("extractor")
             if not domain:
-                url = urlparse(info.get("source_url")).netloc.lower()
-                url = domain[4:] if domain.startswith("www.") else domain
-                domain = url.split(".")[0].first()
-
-            main_source = Source.query.filter(Source.title == domain).first()
-
-            if not main_source:
-                main_source = Source()
-                main_source.title = domain
-                main_source.etl_id = info.get("webpage_url_domain") or url
-                main_source.save()
-            bulletin.sources.append(main_source)
+                self.data_import.add_to_log(
+                    "yt-dlp metadata missing extractor_key; skipping Source linkage."
+                )
+            else:
+                main_source = Source.query.filter(Source.title == domain).first()
+                if not main_source:
+                    main_source = Source()
+                    main_source.title = domain
+                    main_source.etl_id = info.get("webpage_url_domain")
+                    main_source.save()
+                bulletin.sources.append(main_source)
 
             source = None
 
@@ -665,12 +665,12 @@ def update_description(description):
                 bulletin.publish_date = upload_date
 
             if description := info.get("description"):
-                bulletin.description = description
+                bulletin.description = sanitize_string(description)
         else:
             bulletin.source_link = info.get("old_path")
 
         if info.get("text_content"):
-            bulletin.description = info.get("text_content")
+            bulletin.description = sanitize_string(info.get("text_content"))
 
         if info.get("transcription"):
             update_description(info.get("transcription"))
diff --git a/enferno/data_import/utils/sheet_import.py b/enferno/data_import/utils/sheet_import.py
index 10e994af3..1d40d9d31 100644
--- a/enferno/data_import/utils/sheet_import.py
+++ b/enferno/data_import/utils/sheet_import.py
@@ -27,6 +27,7 @@
 
 from enferno.utils.base import DatabaseException
 from enferno.utils.date_helper import DateHelper
+from enferno.utils.validation_utils import sanitize_string
 from enferno.user.models import Role, User
 import enferno.utils.typing as t
 
@@ -144,7 +145,7 @@ def parse_csv(filepath: str) -> dict:
             - A dictionary containing the columns and the head of the file.
         """
         # read the file partially only for parsing purposes
-        df = pd.read_csv(filepath, keep_default_na=False)
+        df = pd.read_csv(filepath, keep_default_na=False, on_bad_lines="skip", index_col=False)
         df.dropna(how="all", axis=1, inplace=True)
         df = df.astype(str)
 
@@ -165,11 +166,13 @@ def parse_excel(filepath: str, sheet: Any) -> dict:
         Returns:
             - A dictionary containing the columns and the head of the file.
         """
-        df = pd.read_excel(filepath, sheet_name=sheet)
+        df = pd.read_excel(filepath, sheet_name=sheet, engine="openpyxl")
         df.dropna(how="all", axis=1, inplace=True)
         df = df.astype(str)
 
-        columns = df.columns.to_list()
+        # XLSX preserves numeric header cells as numeric column labels; coerce so the
+        # API contract (list[str]) holds regardless of header cell types.
+        columns = [str(c) for c in df.columns]
         # drop nan values before generating head rows
         df.fillna("", inplace=True)
         head = df.head().to_dict()
@@ -187,7 +190,7 @@ def get_sheets(filepath: str) -> list:
         Returns:
             - A list of the sheet names in the Excel file.
         """
-        xls = pd.ExcelFile(filepath)
+        xls = pd.ExcelFile(filepath, engine="openpyxl")
         return xls.sheet_names
 
     @staticmethod
@@ -202,8 +205,8 @@ def sheet_to_df(filepath: str, sheet: Optional[list] = None) -> pd.DataFrame:
         Returns:
             - A DataFrame containing the parsed data.
         """
-        if sheet:
-            df = pd.read_excel(filepath, sheet_name=sheet, keep_default_na=False)
+        if isinstance(sheet, (str, int)):
+            df = pd.read_excel(filepath, sheet_name=sheet, keep_default_na=False, engine="openpyxl")
         else:
             df = pd.read_csv(filepath, keep_default_na=False)
 
@@ -369,7 +372,9 @@ def set_details(self, details: str, value: Any) -> None:
                 setattr(self.actor_profile, field, {"opts": [], "details": ""})
             else:
                 setattr(self.actor_profile, field, {"opts": "", "details": ""})
-        getattr(self.actor_profile, field)["details"] = str(value)
+        # Sanitize before persist: these MP detail fields are rendered as HTML
+        # downstream, same stored-XSS sink the report flagged (BAY-01-008/039).
+        getattr(self.actor_profile, field)["details"] = sanitize_string(str(value))
         flag_modified(self.actor_profile, field)
         self.data_import.add_to_log(f"Processed {field}")
 
@@ -554,7 +559,7 @@ def set_description(self, map_item: Any) -> None:
             description += "\n"
 
         if description:
-            self.actor_profile.description = description
+            self.actor_profile.description = sanitize_string(description)
             if old_description:
                 self.actor_profile.description += old_description
         self.data_import.add_to_log("Processed description")
@@ -707,7 +712,10 @@ def handle_mismatch(self, field: str, value: Any) -> None:
             None
         """
         self.data_import.add_to_log(f"Field value mismatch {field}.\n Appending to description.")
-        self.actor_profile.description += f"</p>\n<p>{field}: {str(value)}"
+        # Sanitize untrusted field/value before the v-html sink (BAY-01-039).
+        self.actor_profile.description += (
+            f"</p>\n<p>{sanitize_string(str(field))}: {sanitize_string(str(value))}"
+        )
 
     def gen_value(self, field: str) -> None:
         """
diff --git a/enferno/data_import/views.py b/enferno/data_import/views.py
index d1f3eaf78..cc5940af8 100644
--- a/enferno/data_import/views.py
+++ b/enferno/data_import/views.py
@@ -91,7 +91,7 @@ def api_imports() -> Response:
     per_page = request.args.get("per_page", PER_PAGE, int)
     q = request.json.get("q", None)
 
-    if q and (batch_id := q.get("batch_id")):
+    if isinstance(q, dict) and (batch_id := q.get("batch_id")):
         result = (
             DataImport.query.filter(DataImport.batch_id == batch_id)
             .order_by(-DataImport.id)
@@ -179,8 +179,11 @@ def etl_process() -> Response:
         - response contains the processing result
     """
 
-    files = request.json.pop("files")
-    meta = request.json
+    body = request.json or {}
+    files = body.pop("files", None)
+    if not isinstance(files, list) or not files:
+        return HTTPResponse.error("Missing `files` array", status=417)
+    meta = body
     batch_id = shortuuid.uuid()[:9]
 
     process_files.delay(files=files, meta=meta, user_id=current_user.id, batch_id=batch_id)
@@ -249,15 +252,43 @@ def api_local_csv_delete() -> str:
     return ""
 
 
+def _resolve_import_path(filename: Optional[str]) -> Optional[str]:
+    """
+    Resolve a user-supplied filename to a path inside IMPORT_DIR.
+
+    Returns the resolved POSIX path string, or None if the filename is
+    missing or escapes the import directory (traversal attempt).
+    """
+    if not filename:
+        return None
+    import_dir = Path(current_app.config.get("IMPORT_DIR")).resolve()
+    joined = safe_join(str(import_dir), filename)
+    if joined is None:
+        return None
+    candidate = Path(joined).resolve()
+    try:
+        candidate.relative_to(import_dir)
+    except ValueError:
+        return None
+    return candidate.as_posix()
+
+
 @imports.post("/api/csv/analyze")
 @roles_required("Admin")
 def api_csv_analyze() -> Response:
     """API endpoint to analyze a csv file."""
     # locate file
-    filename = request.json.get("file").get("filename")
-    import_dir = Path(current_app.config.get("IMPORT_DIR"))
+    file_obj = request.json.get("file")
+    if not isinstance(file_obj, dict):
+        return HTTPResponse.error("Missing or malformed `file` field", status=417)
+    filename = file_obj.get("filename")
+    if not isinstance(filename, str) or not filename:
+        return HTTPResponse.error("Missing `file.filename`", status=417)
+    filepath = _resolve_import_path(filename)
+    if filepath is None:
+        logger.warning("Rejected CSV analyze for invalid path: %r", filename)
+        return HTTPResponse.error("Invalid file path", status=400)
 
-    filepath = (import_dir / filename).as_posix()
     result = SheetImport.parse_csv(filepath)
 
     if result:
@@ -271,10 +302,17 @@ def api_csv_analyze() -> Response:
 @roles_required("Admin")
 def api_xls_sheet() -> Response:
     """API endpoint to get sheets from an excel file."""
-    filename = request.json.get("file").get("filename")
-    import_dir = Path(current_app.config.get("IMPORT_DIR"))
+    file_obj = request.json.get("file")
+    if not isinstance(file_obj, dict):
+        return HTTPResponse.error("Missing or malformed `file` field", status=417)
+    filename = file_obj.get("filename")
+    if not isinstance(filename, str) or not filename:
+        return HTTPResponse.error("Missing `file.filename`", status=417)
+    filepath = _resolve_import_path(filename)
+    if filepath is None:
+        logger.warning("Rejected XLS sheets for invalid path: %r", filename)
+        return HTTPResponse.error("Invalid file path", status=400)
 
-    filepath = (import_dir / filename).as_posix()
     sheets = SheetImport.get_sheets(filepath)
 
     return HTTPResponse.success(data=sheets)
@@ -285,11 +323,21 @@ def api_xls_sheet() -> Response:
 def api_xls_analyze() -> Response:
     """API endpoint to analyze an excel file."""
     # locate file
-    filename = request.json.get("file").get("filename")
-    import_dir = Path(current_app.config.get("IMPORT_DIR"))
+    file_obj = request.json.get("file")
+    if not isinstance(file_obj, dict):
+        return HTTPResponse.error("Missing or malformed `file` field", status=417)
+    filename = file_obj.get("filename")
+    if not isinstance(filename, str) or not filename:
+        return HTTPResponse.error("Missing `file.filename`", status=417)
+    filepath = _resolve_import_path(filename)
+    if filepath is None:
+        logger.warning("Rejected XLS analyze for invalid path: %r", filename)
+        return HTTPResponse.error("Invalid file path", status=400)
 
-    filepath = (import_dir / filename).as_posix()
     sheet = request.json.get("sheet")
+    # bool is an int subclass, so exclude it explicitly
+    if isinstance(sheet, bool) or not isinstance(sheet, (str, int)):
+        return HTTPResponse.error("Missing or invalid `sheet` value", status=417)
 
     result = SheetImport.parse_excel(filepath, sheet)
 
@@ -357,6 +405,8 @@ def api_mapping_update(id: t.id) -> Response:
     map = db.session.get(Mapping, id)
     if map:
         data = request.json.get("data")
+        if not isinstance(data, dict):
+            return HTTPResponse.error("Update request missing parameters data", status=417)
         m = data.get("map", None)
         name = request.json.get("name", None)
         if m and name:
@@ -405,10 +455,15 @@ def api_process_sheet() -> Response:
         - success if save is successful, error otherwise.
     """
     files = request.json.get("files")
+    if not isinstance(files, list) or not files:
+        return HTTPResponse.error("Missing `files` array", status=417)
     import_dir = Path(current_app.config.get("IMPORT_DIR"))
     map = request.json.get("map")
     vmap = request.json.get("vmap")
     sheet = request.json.get("sheet")
+    # sheet is optional (CSV has none), but bool/list/etc. would crash the parser
+    if sheet is not None and (isinstance(sheet, bool) or not isinstance(sheet, (str, int))):
+        return HTTPResponse.error("Invalid `sheet` value", status=417)
     lang = request.json.get("lang", "en")
     actor_config = request.json.get("actorConfig")
     roles = request.json.get("roles")
diff --git a/enferno/export/models.py b/enferno/export/models.py
index b1154b349..d795c01ca 100644
--- a/enferno/export/models.py
+++ b/enferno/export/models.py
@@ -1,11 +1,8 @@
-import os
-
 from datetime import datetime as dt
 from pathlib import Path
 from typing import Any, Union
 
 import arrow
-from flask import current_app
 from sqlalchemy import ARRAY
 from flask_security.decorators import current_user
 
@@ -67,6 +64,20 @@ def expired(self):
         else:
             return True
 
+    @staticmethod
+    def _accessible_item_ids(table: str, items: Any) -> list:
+        """Filter requested export item IDs to those the current user may access
+        (BAY-01-026). Admins keep everything; others keep only in-scope items.
+        """
+        from enferno.admin.models import Actor, Bulletin, Incident
+
+        model = {"bulletin": Bulletin, "actor": Actor, "incident": Incident}.get(table)
+        if not model or not isinstance(items, list):
+            return []
+        rows = model.query.filter(model.id.in_(items)).all()
+        allowed = {r.id for r in rows if current_user and current_user.can_access(r)}
+        return [i for i in items if i in allowed]
+
     def from_json(self, table: str, json: dict) -> "Export":
         """
         Export Deserializer.
@@ -78,13 +89,19 @@ def from_json(self, table: str, json: dict) -> "Export":
         Returns:
             - Export object
         """
+        if not isinstance(json, dict):
+            json = {}
         cfg = json.get("config")
-        items = json.get("items")
+        if not isinstance(cfg, dict):
+            cfg = {}
 
         self.requester = current_user
         self.table = table
-        self.items = items
-        self.tags = cfg.get("tags") if "tags" in cfg else []
+        # Store only items the requester can access (BAY-01-026): keep crafted /
+        # out-of-scope IDs from ever being persisted, approved, or exported. The
+        # worker re-validates access at generation time too (BAY-01-003).
+        self.items = self._accessible_item_ids(table, json.get("items"))
+        self.tags = cfg.get("tags", [])
         self.comment = cfg.get("comment")
         self.file_format = cfg.get("format")
         self.include_media = cfg.get("includeMedia")
diff --git a/enferno/export/views.py b/enferno/export/views.py
index 499bef737..97cecbb8e 100644
--- a/enferno/export/views.py
+++ b/enferno/export/views.py
@@ -168,8 +168,10 @@ def api_export_get(id: t.id) -> Response:
 
     if export is None:
         return HTTPResponse.not_found("Export not found")
-    else:
-        return HTTPResponse.success(data=export.to_dict(), message="Export retrieved successfully")
+    # Same ownership guard as the list/download routes (BAY-01-015).
+    if not current_user.has_role("Admin") and current_user.id != export.requester_id:
+        return HTTPResponse.forbidden("Forbidden")
+    return HTTPResponse.success(data=export.to_dict(), message="Export retrieved successfully")
 
 
 @export.post("/api/exports/")
diff --git a/enferno/public/views.py b/enferno/public/views.py
index 23cec85d8..5bee348a2 100755
--- a/enferno/public/views.py
+++ b/enferno/public/views.py
@@ -1,8 +1,12 @@
-from flask import request, redirect, Blueprint, send_from_directory, Response, jsonify
+import os
 from typing import Optional
-from enferno.utils.logging_utils import get_logger
-from enferno.extensions import db, limiter
+
+from flask import Blueprint, Response, jsonify, redirect, request, send_from_directory
 from flask_wtf.csrf import generate_csrf
+from sqlalchemy import text
+
+from enferno.extensions import db, limiter, rds
+from enferno.utils.logging_utils import get_logger
 
 bp_public = Blueprint("public", __name__, static_folder="../static")
 
@@ -29,6 +33,30 @@ def get_csrf_token() -> Response:
     return jsonify({"csrf_token": token})
 
 
+@bp_public.route("/health")
+@limiter.exempt
+def health() -> Response:
+    """Readiness probe used by the bayanat updater. Touches DB and Redis."""
+    try:
+        db.session.execute(text("SELECT 1"))
+        rds.ping()
+    except Exception:
+        logger.error("health check failed", exc_info=True)
+        return jsonify({"status": "error", "error": "Service unavailable"}), 503
+    version = os.environ.get("BAYANAT_VERSION") or _read_version_from_pyproject()
+    return jsonify({"status": "ok", "version": version})
+
+
+def _read_version_from_pyproject() -> Optional[str]:
+    try:
+        import tomllib
+
+        with open("pyproject.toml", "rb") as fh:
+            return tomllib.load(fh).get("project", {}).get("version")
+    except Exception:
+        return None
+
+
 @bp_public.teardown_app_request
 def shutdown_global_session(exception: Optional[Exception] = None) -> None:
     """Remove database session at the end of each request."""
diff --git a/enferno/settings.py b/enferno/settings.py
index a671cc861..bcfaf7835 100644
--- a/enferno/settings.py
+++ b/enferno/settings.py
@@ -1,6 +1,7 @@
 # -*- coding: utf-8 -*-
 import os
 from datetime import timedelta
+from urllib.parse import quote
 
 import bleach
 import redis
@@ -46,8 +47,14 @@ class Config(object):
 
     if (POSTGRES_USER and POSTGRES_PASSWORD) or POSTGRES_HOST != "localhost":
         SQLALCHEMY_DATABASE_URI = (
-            f"postgresql://{POSTGRES_USER}:{POSTGRES_PASSWORD}@{POSTGRES_HOST}/{POSTGRES_DB}"
+            f"postgresql://{quote(POSTGRES_USER, safe='')}:{quote(POSTGRES_PASSWORD, safe='')}"
+            f"@{POSTGRES_HOST}/{POSTGRES_DB}"
         )
+    elif POSTGRES_USER:
+        # Socket connection as an explicit role: peer auth plus a pg_ident
+        # map lets the per-service OS users connect as the shared app role
+        # (BAY-01-032).
+        SQLALCHEMY_DATABASE_URI = f"postgresql://{quote(POSTGRES_USER, safe='')}@/{POSTGRES_DB}"
     else:
         SQLALCHEMY_DATABASE_URI = f"postgresql:///{POSTGRES_DB}"
 
@@ -64,12 +71,13 @@ class Config(object):
     REDIS_HOST = os.environ.get("REDIS_HOST", "localhost")
     REDIS_PORT = int(os.environ.get("REDIS_PORT", 6379))
     REDIS_PASSWORD = os.environ.get("REDIS_PASSWORD", "")
-    REDIS_URL = f"redis://:{REDIS_PASSWORD}@{REDIS_HOST}:{REDIS_PORT}/0"
+    _redis_pw_quoted = quote(REDIS_PASSWORD, safe="")
+    REDIS_URL = f"redis://:{_redis_pw_quoted}@{REDIS_HOST}:{REDIS_PORT}/0"
 
     # Celery
     # Has to be in small case
-    celery_broker_url = f"redis://:{REDIS_PASSWORD}@{REDIS_HOST}:{REDIS_PORT}/2"
-    result_backend = f"redis://:{REDIS_PASSWORD}@{REDIS_HOST}:{REDIS_PORT}/3"
+    celery_broker_url = f"redis://:{_redis_pw_quoted}@{REDIS_HOST}:{REDIS_PORT}/2"
+    result_backend = f"redis://:{_redis_pw_quoted}@{REDIS_HOST}:{REDIS_PORT}/3"
 
     # Security
     SECURITY_REGISTERABLE = manager.get_config("SECURITY_REGISTERABLE")
@@ -109,6 +117,12 @@ class Config(object):
     security_freshness_grace_period = manager.get_config("SECURITY_FRESHNESS_GRACE_PERIOD")
     SECURITY_FRESHNESS_GRACE_PERIOD = timedelta(minutes=security_freshness_grace_period)
 
+    # Login brute-force throttle (Flask-Limiter, applied per-method=POST on /login).
+    LOGIN_RATE_LIMIT_PER_USERNAME = os.environ.get(
+        "LOGIN_RATE_LIMIT_PER_USERNAME", "10 per 15 minutes"
+    )
+    LOGIN_RATE_LIMIT_PER_IP = os.environ.get("LOGIN_RATE_LIMIT_PER_IP", "30 per 15 minutes")
+
     SECURITY_TWO_FACTOR_REQUIRED = manager.get_config("SECURITY_TWO_FACTOR_REQUIRED")
 
     SECURITY_PASSWORD_LENGTH_MIN = manager.get_config("SECURITY_PASSWORD_LENGTH_MIN")
@@ -140,7 +154,7 @@ class Config(object):
 
     # Session
     SESSION_TYPE = "redis"
-    SESSION_REDIS = redis.from_url(f"redis://:{REDIS_PASSWORD}@{REDIS_HOST}:{REDIS_PORT}/1")
+    SESSION_REDIS = redis.from_url(f"redis://:{_redis_pw_quoted}@{REDIS_HOST}:{REDIS_PORT}/1")
     PERMANENT_SESSION_LIFETIME = int(os.environ.get("SESSION_LIFETIME", 3600))
 
     # Google 0Auth
@@ -387,7 +401,7 @@ class TestConfig:
     REDIS_HOST = os.environ.get("REDIS_HOST", "localhost")
     REDIS_PORT = int(os.environ.get("REDIS_PORT", 6379))
     REDIS_PASSWORD = os.environ.get("REDIS_PASSWORD", "")
-    REDIS_URL = f"redis://:{REDIS_PASSWORD}@{REDIS_HOST}:{REDIS_PORT}/0"
+    REDIS_URL = f"redis://:{quote(REDIS_PASSWORD, safe='')}@{REDIS_HOST}:{REDIS_PORT}/0"
 
     # Celery - use in-memory for tests to avoid Redis dependency
     celery_broker_url = "memory://"
@@ -419,6 +433,10 @@ class TestConfig:
     SECURITY_MULTI_FACTOR_RECOVERY_CODES_N = 3
     SECURITY_MULTI_FACTOR_RECOVERY_CODES_KEYS = None
     SECURITY_MULTI_FACTOR_RECOVERY_CODE_TTL = None
+
+    # Login throttle (Flask-Limiter, applied to security.login). Tighter in tests.
+    LOGIN_RATE_LIMIT_PER_USERNAME = "5 per 15 minutes"
+    LOGIN_RATE_LIMIT_PER_IP = "10 per 15 minutes"
     SECURITY_TWO_FACTOR_ENABLED_METHODS = ["authenticator"]
     SECURITY_TWO_FACTOR = True
     SECURITY_TWO_FACTOR_RESCUE_MAIL = "test@example.com"
@@ -487,7 +505,8 @@ class TestConfig:
     # Media & File Upload
     MEDIA_ALLOWED_EXTENSIONS = ["mp4", "webm", "jpg", "gif", "png", "pdf", "doc", "txt"]
     MEDIA_UPLOAD_MAX_FILE_SIZE = 1000
-    SHEETS_ALLOWED_EXTENSIONS = ["csv", "xls", "xlsx"]
+    # legacy binary .xls is unreadable by the pinned openpyxl engine; only xlsx/csv
+    SHEETS_ALLOWED_EXTENSIONS = ["csv", "xlsx"]
 
     # Data Tools
     ETL_TOOL = True
diff --git a/enferno/setup/views.py b/enferno/setup/views.py
index 3cd0f3d3e..1374a6715 100644
--- a/enferno/setup/views.py
+++ b/enferno/setup/views.py
@@ -4,16 +4,14 @@
     request,
     redirect,
     Blueprint,
-    send_from_directory,
     render_template,
     Response,
     current_app,
 )
-from flask_security import hash_password, login_user, roles_required, current_user
+from flask_security import auth_required, roles_required, current_user
 
 from enferno.admin.models import Eventtype, PotentialViolation, ClaimedViolation
-from enferno.extensions import db
-from enferno.user.models import User, Role
+from enferno.user.models import User
 from enferno.utils.config_utils import ConfigManager
 from enferno.utils.data_helpers import import_default_data
 from enferno.utils.http_response import HTTPResponse
@@ -31,15 +29,19 @@ def check_installation() -> bool:
 
 @bp_setup.before_app_request
 def handle_installation_check() -> Optional[Response]:
-    """Redirect to setup wizard if the app is not installed."""
+    """Redirect to setup wizard if the app is not installed.
+
+    The admin user is created out-of-band by the installer's CLI
+    bootstrap (`flask install`), not by this blueprint, so the wizard
+    requires authentication. Pre-auth flow paths are exempted so the
+    operator can sign in.
+    """
     excluded_paths = [
         "/setup_wizard",
         "/static",
         "/assets",
         "/_debug_toolbar",
         "/favicon.ico",
-        "/api/create-admin",
-        "/api/check-admin",
         "/api/default-config",
         "/api/import-data",
         "/api/check-data-imported",
@@ -49,86 +51,29 @@ def handle_installation_check() -> Optional[Response]:
         "/api/complete-setup",
         "/admin/api/reload",
         "/fs-static",
-    ]
-    login_flow_paths = [
+        "/health",
         "/login",
         "/wan-signin",
         "/tf-validate",
         "/tf-select",
+        "/auth",
+        "/logout",
     ]
 
-    # Add /login to excluded paths if users exist
-    if User.query.first() is not None:
-        excluded_paths.extend(login_flow_paths)
-
     if not any(request.path.startswith(path) for path in excluded_paths):
         if check_installation():
             return redirect("/setup_wizard")
 
 
 @bp_setup.route("/setup_wizard")
+@auth_required("session")
 def setup_wizard() -> str:
-    """Render the setup wizard template."""
+    """Render the setup wizard template (admin-only post-install)."""
+    if not current_user.has_role("Admin"):
+        return redirect("/")
     return render_template("setup_wizard.html")
 
 
-@bp_setup.post("/api/create-admin")
-def create_admin() -> Any:
-    """Create an admin user if one doesn't exist."""
-    admin_role = Role.query.filter(Role.name == "Admin").first()
-
-    if admin_role.users.all():
-        return HTTPResponse.error("Admin user already exists")
-
-    data = request.json
-    username = data.get("username")
-    password = data.get("password")
-
-    if not username or not password:
-        return HTTPResponse.error("Username and password are required")
-
-    if User.query.filter(User.username == username.lower()).first():
-        return HTTPResponse.error("Username already exists")
-
-    new_admin = User(
-        username=username,
-        password=hash_password(password),
-        active=1,
-        name="Admin",
-        view_usernames=True,
-        view_simple_history=True,
-        view_full_history=True,
-        can_self_assign=True,
-        can_edit_locations=True,
-        can_export=True,
-        can_import_web=True,
-        can_access_media=True,
-    )
-    new_admin.roles.append(admin_role)
-
-    db.session.add(new_admin)
-    try:
-        db.session.commit()
-        login_user(new_admin)
-        return HTTPResponse.created(
-            message="Admin user installed successfully",
-            data={"item": new_admin.to_dict()},
-        )
-    except Exception as e:
-        db.session.rollback()
-        return HTTPResponse.error("Failed to create admin user", status=500)
-
-
-@bp_setup.get("/api/check-admin")
-def check_admin() -> Dict[str, str]:
-    """Check if an admin user exists."""
-    admin_role = Role.query.filter(Role.name == "Admin").first()
-    if admin_role and admin_role.users.first():
-        return HTTPResponse.success(data={"status": "exists"}, message="Admin user already exists")
-    else:
-        return HTTPResponse.success(data={"status": "not_found"}, message="No admin user found")
-
-
 @bp_setup.post("/api/import-data")
 @roles_required("Admin")
 def import_data() -> Response:
@@ -136,7 +81,7 @@ def import_data() -> Response:
     try:
         import_default_data()
         return HTTPResponse.success(message="Default data imported successfully")
-    except Exception as e:
+    except Exception:
         return HTTPResponse.error("Failed to import default data", status=500)
 
 
diff --git a/enferno/static/js/common/config.js b/enferno/static/js/common/config.js
index 9e0c1ec9e..c8428dfc8 100644
--- a/enferno/static/js/common/config.js
+++ b/enferno/static/js/common/config.js
@@ -118,6 +118,18 @@ function isValidLength(value, limit, type) {
     return type === "max" ? length <= limit : length >= limit;
 }
 
+function escapeHtml(value) {
+  const entityMap = {
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#39;',
+  };
+
+  return String(value ?? '').replace(/[&<>"']/g, char => entityMap[char]);
+}
+
 function scrollToFirstError() {
   const wrapper = document.querySelector(".v-input--error");
   if (!wrapper) return;
@@ -365,8 +377,8 @@ function getInfraMessage(status) {
       return Object.entries(errors).map(([field, message]) => {
         const fieldName = field.startsWith('item.') ? field.slice(5) : field;
         const label = fieldName.includes('__root__') ? 'Validation Error' : fieldName;
-        return `<span class="font-weight-bold text-red">[${label}]</span>: ${message}`;
-      }).join('<br />') || 'An error occurred.';
+        return `[${label}]: ${message}`;
+      }).join('\n') || 'An error occurred.';
     }
 
     if (response?.data?.message) {
@@ -834,4 +846,4 @@ function loadScript(src) {
 
   loadedScripts.set(src, promise);
   return promise;
-}
\ No newline at end of file
+}
diff --git a/enferno/static/js/components/EventsSection.js b/enferno/static/js/components/EventsSection.js
index 5ab1865ba..e0e9f9776 100644
--- a/enferno/static/js/components/EventsSection.js
+++ b/enferno/static/js/components/EventsSection.js
@@ -49,7 +49,7 @@ const EventsSection = Vue.defineComponent({
       if (!hasTitleOrType) missing.push(this.translations.titleOrTypeRequired_);
 
       if (missing.length > 0) {
-        this.$root.showSnack(missing.join('<br />'));
+        this.$root.showSnack(missing.join('\n'));
         return false;
       }
 
diff --git a/enferno/static/js/components/GeoLocations.js b/enferno/static/js/components/GeoLocations.js
index dabfd7e93..1fe4704b8 100644
--- a/enferno/static/js/components/GeoLocations.js
+++ b/enferno/static/js/components/GeoLocations.js
@@ -129,7 +129,7 @@ const GeoLocations = Vue.defineComponent({
                         {{ loc.lat.toFixed(4) }} , {{ loc.lng.toFixed(4) }}
                       </div>
 
-                      <div v-if="loc.comment" class="comments pa-3 mt-2" v-html="loc.comment">
+                      <div v-if="loc.comment" class="comments pa-3 mt-2" v-text="loc.comment">
 
                       </div>
 
diff --git a/enferno/static/js/components/GlobalMap.js b/enferno/static/js/components/GlobalMap.js
index 536d6f09e..47811b50f 100644
--- a/enferno/static/js/components/GlobalMap.js
+++ b/enferno/static/js/components/GlobalMap.js
@@ -75,38 +75,38 @@ const GlobalMap = Vue.defineComponent({
 
       // Dates
       const dates = [];
-      if (loc.from_date) dates.push(`<span class="chip">${this.$root.formatDate(loc.from_date, loc.from_date.includes('T00:00') ? this.$root.dateFormats.standardDate : this.$root.dateFormats.standardDatetime)}</span>`);
+      if (loc.from_date) dates.push(`<span class="chip">${escapeHtml(this.$root.formatDate(loc.from_date, loc.from_date.includes('T00:00') ? this.$root.dateFormats.standardDate : this.$root.dateFormats.standardDatetime))}</span>`);
       if (loc.from_date && loc.to_date) dates.push(`<i class="mdi mdi-arrow-right mr-1">`);
-      if (loc.to_date) dates.push(`<span></i>${this.$root.formatDate(loc.to_date, loc.to_date.includes('T00:00') ? this.$root.dateFormats.standardDate : this.$root.dateFormats.standardDatetime)}</span>`);
+      if (loc.to_date) dates.push(`<span></i>${escapeHtml(this.$root.formatDate(loc.to_date, loc.to_date.includes('T00:00') ? this.$root.dateFormats.standardDate : this.$root.dateFormats.standardDatetime))}</span>`);
 
       const estimated = loc.estimated
-        ? `<i class="mdi mdi-calendar-question mr-1" title="${t.timingForThisEventIsEstimated_}"></i>`
+        ? `<i class="mdi mdi-calendar-question mr-1" title="${escapeHtml(t.timingForThisEventIsEstimated_)}"></i>`
         : '<i class="mdi mdi-calendar-clock mr-1"></i>';
 
       const dateRange = dates.length ? `<div class="d-flex">${estimated} ${dates.join(' ')}</div>` : '';
 
-      const parentId = loc?.parentId && loc?.show_parent_id ? `<div><i class="mdi mdi-link mr-1"></i>${loc.parentId}</div>` : '';
+      const parentId = loc?.parentId && loc?.show_parent_id ? `<div><i class="mdi mdi-link mr-1"></i>${escapeHtml(loc.parentId)}</div>` : '';
 
       // Copy button using data-copy instead of onclick
       const copyCoordsBtn = (Number.isFinite(loc.lat) && Number.isFinite(loc.lng))
-        ? `<button type="button" class="ml-1" title="${t.copyCoordinates_}" data-copy="${loc.lat.toFixed(6)}, ${loc.lng.toFixed(6)}">
+        ? `<button type="button" class="ml-1" title="${escapeHtml(t.copyCoordinates_)}" data-copy="${loc.lat.toFixed(6)}, ${loc.lng.toFixed(6)}">
             <i class="mdi mdi-content-copy" aria-hidden="true"></i>
           </button>`
         : '';
 
-      const eventType = loc.eventtype ? `<div class="d-flex align-center"><i class="mdi mdi-calendar-range mr-1"></i>${loc.eventtype || ''}</div>` : '';
+      const eventType = loc.eventtype ? `<div class="d-flex align-center"><i class="mdi mdi-calendar-range mr-1"></i>${escapeHtml(loc.eventtype)}</div>` : '';
 
-      const locNumber = loc.number ? `<div class="d-flex align-center">#${loc.number || ''}</div>` : '';
+      const locNumber = loc.number ? `<div class="d-flex align-center">#${escapeHtml(loc.number)}</div>` : '';
 
       const html = `<div class="popup-content d-flex flex-column ga-1">
         <div class="d-flex ga-2">${locNumber} ${parentId} ${eventType}</div>
-        <h4>${loc.title || ''}</h4>
+        <h4>${escapeHtml(loc.title)}</h4>
         <div class="d-flex align-center">
           <i class="mdi mdi-map-marker-outline mr-1"></i>
-          ${loc.full_string || ''}
+          ${escapeHtml(loc.full_string)}
           ${copyCoordsBtn}
         </div>
-        ${loc.main ? `<div>${t.mainIncident_}</div>` : ''}
+        ${loc.main ? `<div>${escapeHtml(t.mainIncident_)}</div>` : ''}
         ${dateRange}
       </div>`;
 
diff --git a/enferno/static/js/components/MissingPersonField.js b/enferno/static/js/components/MissingPersonField.js
index dc8522c30..185b7dfb3 100644
--- a/enferno/static/js/components/MissingPersonField.js
+++ b/enferno/static/js/components/MissingPersonField.js
@@ -14,14 +14,18 @@ const MissingPersonField = Vue.defineComponent({
       if (this.type === 1) {
         // type 1 = options + details
         if (!this.field) return '';
-        const { opts = '', details = '-' } = this.field;
-        return `${opts}: ${details}`;
+        const { opts = '', details = '' } = this.field;
+        const optsText = Array.isArray(opts) ? opts.join(', ') : opts;
+
+        if (!optsText) return details;
+        if (!details) return optsText;
+
+        return `${optsText}: ${details}`;
       }
 
       if (this.type === 2) {
         // type 2 = Reporters: list of objects
-        if (!Array.isArray(this.field) || !this.field.length) return '-';
-        return this.field.map(this.formatReporter).join('');
+        return '';
       }
 
       // final case: simple field
@@ -33,25 +37,26 @@ const MissingPersonField = Vue.defineComponent({
       }
       return !!this.field;      
     },
-  },
-  methods: {
-    formatReporter(rep) {
-      const { name, contact, relationship } = rep;
-      const output = [
-        name && `${this.translations.name_}: ${name}`,
-        contact && `${this.translations.contact_}: ${contact}`,
-        relationship && `${this.translations.relationship_}: ${relationship}`,
-      ]
-        .filter(Boolean)
-        .join('<br>');
-
-      return output ? `<div class="elevation-1 my-3 pa-2 yellow lighten-5">${output}</div>` : '';
+    reporters() {
+      if (this.type !== 2 || !Array.isArray(this.field)) return [];
+      return this.field.filter(rep => rep && Object.keys(rep).length);
     },
   },
   template: `
     <v-sheet v-if="show" class="pa-1 pb-2 mb-2" color="transparent">
       <div class="caption grey--text text--darken-1">{{ title }}</div>
-      <span v-html="output"></span>
+      <template v-if="type === 2">
+        <div
+          v-for="(rep, index) in reporters"
+          :key="index"
+          class="elevation-1 my-3 pa-2 yellow lighten-5"
+        >
+          <div v-if="rep.name">{{ translations.name_ }}: {{ rep.name }}</div>
+          <div v-if="rep.contact">{{ translations.contact_ }}: {{ rep.contact }}</div>
+          <div v-if="rep.relationship">{{ translations.relationship_ }}: {{ rep.relationship }}</div>
+        </div>
+      </template>
+      <span v-else v-text="output"></span>
     </v-sheet>
   `,
-});
\ No newline at end of file
+});
diff --git a/enferno/static/js/components/NotificationsList.js b/enferno/static/js/components/NotificationsList.js
index d9524160e..6b78552cf 100644
--- a/enferno/static/js/components/NotificationsList.js
+++ b/enferno/static/js/components/NotificationsList.js
@@ -128,13 +128,13 @@ const NotificationsList = Vue.defineComponent({
                                 :class="{ 'font-weight-bold': (!notification?.read_status || notification?.is_urgent) }"
                                 class="text-body-1"
                                 :style="getLineClampStyles(config.maxTitleLines)"
-                                v-html="notification?.title"
+                                v-text="notification?.title"
                             />
                             <v-list-item-subtitle class="mt-1" opacity="100">
                                 <div
                                 class="text-caption text-high-emphasis"
                                 :style="getLineClampStyles(config.maxSubtitleLines)"
-                                v-html="notification?.message"
+                                v-text="notification?.message"
                                 />
                                 <div class="d-flex justify-space-between align-center mt-2">
                                     <span class="text-caption text-high-emphasis">{{ getDateFromNotification(notification) }}</span>
diff --git a/enferno/static/js/components/SnapshotsList.js b/enferno/static/js/components/SnapshotsList.js
new file mode 100644
index 000000000..e704c199c
--- /dev/null
+++ b/enferno/static/js/components/SnapshotsList.js
@@ -0,0 +1,50 @@
+const SnapshotsList = Vue.defineComponent({
+  data() {
+    return {
+      items: [],
+      loading: false,
+    };
+  },
+  mounted() {
+    this.load();
+  },
+  methods: {
+    async load() {
+      this.loading = true;
+      try {
+        const resp = await axios.get('/admin/api/snapshots/');
+        this.items = resp?.data?.data ?? [];
+      } catch (_e) {
+        this.items = [];
+      } finally {
+        this.loading = false;
+      }
+    },
+  },
+  template: `
+    <v-card>
+      <v-card-title>
+        Pre-update Snapshots
+        <v-spacer />
+        <v-btn icon="mdi-refresh" variant="text" @click="load" :loading="loading"></v-btn>
+      </v-card-title>
+      <v-card-text>
+        <v-alert type="info" variant="tonal" density="compact" class="mb-3">
+          Restore is CLI-only for safety. SSH to the server and run
+          <code>sudo bayanat restore &lt;name&gt;</code> (needs root; it stops
+          services, runs <code>pg_restore</code>, and starts services again).
+        </v-alert>
+        <v-data-table
+          :items="items"
+          :headers="[
+            { title: 'Name', key: 'name' },
+            { title: 'Size', key: 'size' },
+            { title: 'Age', key: 'age' }
+          ]"
+          :loading="loading"
+          no-data-text="No snapshots available yet."
+        ></v-data-table>
+      </v-card-text>
+    </v-card>
+  `,
+});
diff --git a/enferno/static/js/components/Toast.js b/enferno/static/js/components/Toast.js
index e88a4a8d5..8e663f946 100644
--- a/enferno/static/js/components/Toast.js
+++ b/enferno/static/js/components/Toast.js
@@ -56,7 +56,7 @@ const Toast = Vue.defineComponent({
   template: `
     <v-snackbar v-model="open" multi-line v-bind="snackbarProps">
       <v-icon v-if="iconProps" class="mr-2" v-bind="iconProps"></v-icon>
-      <span v-html="message"></span>
+      <span style="white-space: pre-line;" v-text="message"></span>
       <template v-if="!hideActions" #actions>
           <v-btn icon="mdi-close" variant="text" @click="close"></v-btn>
       </template>
diff --git a/enferno/static/js/components/UpdateBanner.js b/enferno/static/js/components/UpdateBanner.js
new file mode 100644
index 000000000..12baa15a0
--- /dev/null
+++ b/enferno/static/js/components/UpdateBanner.js
@@ -0,0 +1,67 @@
+const UpdateBanner = Vue.defineComponent({
+  data() {
+    return {
+      current: null,
+      latest: null,
+      releaseNotesUrl: null,
+      dialog: false,
+    };
+  },
+  computed: {
+    hasUpdate() {
+      return !!(this.latest && this.current && this.latest !== this.current);
+    },
+  },
+  mounted() {
+    this.fetchAvailable();
+    this.pollTimer = setInterval(this.fetchAvailable, 6 * 60 * 60 * 1000);
+  },
+  beforeUnmount() {
+    if (this.pollTimer) clearInterval(this.pollTimer);
+  },
+  methods: {
+    async fetchAvailable() {
+      try {
+        const resp = await axios.get('/admin/api/updates/available');
+        const data = resp?.data?.data ?? {};
+        this.current = data.current ?? null;
+        this.latest = data.latest ?? null;
+        this.releaseNotesUrl = data.release_notes_url ?? null;
+      } catch (_e) {
+        // silent: background poll should never spam the UI
+      }
+    },
+  },
+  template: `
+    <v-chip
+      v-if="hasUpdate"
+      color="amber-accent-4"
+      variant="elevated"
+      prepend-icon="mdi-arrow-up-bold-circle"
+      @click="dialog = true"
+      class="ms-2 me-2"
+    >
+      Update available: {{ latest }}
+      <v-dialog v-model="dialog" max-width="520">
+        <v-card>
+          <v-card-title>Update Bayanat to {{ latest }}</v-card-title>
+          <v-card-text>
+            <p>Current: <strong>{{ current }}</strong></p>
+            <p>Target: <strong>{{ latest }}</strong></p>
+            <p v-if="releaseNotesUrl">
+              <a :href="releaseNotesUrl" target="_blank" rel="noopener">Release notes</a>
+            </p>
+            <v-alert type="info" variant="tonal" density="compact" class="mt-3">
+              To update, run this on the server as an administrator:
+              <pre class="mt-2 mb-0"><code>sudo bayanat update {{ latest }}</code></pre>
+            </v-alert>
+          </v-card-text>
+          <v-card-actions>
+            <v-spacer />
+            <v-btn variant="text" @click="dialog = false">Close</v-btn>
+          </v-card-actions>
+        </v-card>
+      </v-dialog>
+    </v-chip>
+  `,
+});
diff --git a/enferno/static/js/components/UpdateProgressDialog.js b/enferno/static/js/components/UpdateProgressDialog.js
new file mode 100644
index 000000000..590512612
--- /dev/null
+++ b/enferno/static/js/components/UpdateProgressDialog.js
@@ -0,0 +1,98 @@
+const UpdateProgressDialog = Vue.defineComponent({
+  data() {
+    return {
+      open_: false,
+      state: null,
+      timer: null,
+    };
+  },
+  methods: {
+    open() {
+      this.open_ = true;
+      this.poll();
+    },
+    close() {
+      this.open_ = false;
+      if (this.timer) {
+        clearInterval(this.timer);
+        this.timer = null;
+      }
+    },
+    async poll() {
+      await this.fetchState();
+      if (this.timer) clearInterval(this.timer);
+      this.timer = setInterval(this.fetchState, 2000);
+    },
+    async fetchState() {
+      try {
+        const resp = await axios.get('/admin/api/updates/status');
+        const data = resp?.data?.data ?? {};
+        this.state = data;
+        if (!data.running) {
+          if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = null;
+          }
+        }
+      } catch (_e) {
+        // tolerate transient errors; dialog stays visible
+      }
+    },
+    phaseColor() {
+      const phase = (this.state && this.state.phase) || 'IDLE';
+      if (phase === 'SUCCESS') return 'success';
+      if (phase === 'ROLLED_BACK') return 'warning';
+      if (phase === 'NEEDS_INTERVENTION') return 'error';
+      return 'primary';
+    },
+  },
+  beforeUnmount() {
+    if (this.timer) clearInterval(this.timer);
+  },
+  template: `
+    <v-dialog v-model="open_" max-width="520" persistent>
+      <v-card v-if="state">
+        <v-card-title>
+          <v-icon :color="phaseColor()" class="me-2">mdi-autorenew</v-icon>
+          {{ state.phase_label || state.phase }}
+        </v-card-title>
+        <v-card-text>
+          <p v-if="state.target"><strong>Target:</strong> {{ state.target }}</p>
+          <p v-if="state.previous"><strong>Previous:</strong> {{ state.previous }}</p>
+          <v-progress-linear
+            v-if="state.running"
+            indeterminate
+            :color="phaseColor()"
+            class="my-3"
+          />
+          <p v-if="state.progress_text" class="text-body-2">
+            {{ state.progress_text }}
+          </p>
+          <v-alert
+            v-if="state.error"
+            type="error"
+            variant="tonal"
+            density="compact"
+            class="mt-2"
+          >
+            {{ state.error }}
+          </v-alert>
+          <v-alert
+            v-if="state.phase === 'NEEDS_INTERVENTION'"
+            type="error"
+            variant="tonal"
+            class="mt-2"
+          >
+            Operator intervention required. Snapshot:
+            <code>{{ state.snapshot }}</code>. See the update runbook for
+            recovery steps.
+          </v-alert>
+        </v-card-text>
+        <v-card-actions>
+          <v-spacer />
+          <v-btn @click="close" :disabled="state.running">Close</v-btn>
+        </v-card-actions>
+      </v-card>
+    </v-dialog>
+  `,
+});
diff --git a/enferno/static/js/mixins/global-mixin.js b/enferno/static/js/mixins/global-mixin.js
index 622715595..84408732a 100644
--- a/enferno/static/js/mixins/global-mixin.js
+++ b/enferno/static/js/mixins/global-mixin.js
@@ -4,6 +4,8 @@ const globalMixin = {
     'ConfirmDialog': ConfirmDialog,
     'Toast': Toast,
     'ProfileDropdown': ProfileDropdown,
+    'UpdateBanner': UpdateBanner,
+    'UpdateProgressDialog': UpdateProgressDialog,
   },
   data: () => ({
     snackbar: false,
@@ -113,15 +115,15 @@ const globalMixin = {
         },
         parseValidationError(response){
             if (response && response.errors){
-                let message = '';
+                const messages = [];
                 for(const field in response.errors){
                     let fieldName = field;
                     if (fieldName.startsWith('item.')){
                         fieldName = fieldName.substring(5);
                     }
-                    message += `<strong style="color:#b71c1c;">[${!fieldName.includes("__root__") ? fieldName : 'Validation Error'}]:</strong> ${response.errors[field]}<br/>`;
+                    messages.push(`[${!fieldName.includes("__root__") ? fieldName : 'Validation Error'}]: ${response.errors[field]}`);
                 }
-                return message;
+                return messages.join('\n');
             }
             return response;
         },
diff --git a/enferno/tasks/__init__.py b/enferno/tasks/__init__.py
index e96e07b13..b7a7bd309 100644
--- a/enferno/tasks/__init__.py
+++ b/enferno/tasks/__init__.py
@@ -140,6 +140,16 @@ def setup_periodic_tasks(sender: Any, **kwargs: dict[str, Any]) -> None:
             f"Backup periodic task is set up. Backups will run at 3:00 every {cfg.BACKUP_INTERVAL} day(s)."
         )
 
+    # Update-check periodic task (every 6 hours)
+    from enferno.tasks.maintenance import check_for_updates
+
+    sender.add_periodic_task(
+        6 * 60 * 60,
+        check_for_updates.s(),
+        name="Check for Updates",
+    )
+    logger.info("Update-check periodic task is set up (every 6h).")
+
     # session cleanup task
     sender.add_periodic_task(24 * 60 * 60, session_cleanup.s(), name="Session Cleanup Cron")
 
@@ -175,6 +185,7 @@ def setup_periodic_tasks(sender: Any, **kwargs: dict[str, Any]) -> None:
 from enferno.tasks.graph import generate_graph  # noqa: E402
 from enferno.tasks.maintenance import (  # noqa: E402
     activity_cleanup_cron,
+    check_for_updates,
     daily_backup_cron,
     regenerate_locations,
     reload_app,
@@ -224,6 +235,7 @@ def setup_periodic_tasks(sender: Any, **kwargs: dict[str, Any]) -> None:
     "generate_graph",
     # maintenance
     "activity_cleanup_cron",
+    "check_for_updates",
     "daily_backup_cron",
     "regenerate_locations",
     "reload_app",
diff --git a/enferno/tasks/bulk_ops.py b/enferno/tasks/bulk_ops.py
index e42e803d3..8d5162cbf 100644
--- a/enferno/tasks/bulk_ops.py
+++ b/enferno/tasks/bulk_ops.py
@@ -50,13 +50,16 @@ def bulk_update_bulletins(ids: list, bulk: dict, cur_user_id: t.id) -> None:
     first_peer_reviewer_id = bulk.get("first_peer_reviewer_id")
     clear_reviewer = bulk.get("reviewerClear")
 
+    total_updated = 0
     for group in chunks:
         # Fetch bulletins
         bulletins = Bulletin.query.filter(Bulletin.id.in_(group))
+        # Only items the caller may actually modify, so downstream revisions,
+        # activity, notifications and counts never cover skipped items (BAY-01-018).
+        mutated = []
         for bulletin in bulletins:
             # check user can access each bulletin
             if not user.can_access(bulletin):
-                # Log?
                 continue
 
             # get Status initially
@@ -115,27 +118,27 @@ def bulk_update_bulletins(ids: list, bulk: dict, cur_user_id: t.id) -> None:
 
             # add only to session
             db.session.add(bulletin)
+            mutated.append(bulletin)
 
-        revmaps = []
-        bulletins = Bulletin.query.filter(Bulletin.id.in_(group)).all()
-        for bulletin in bulletins:
-            # this commits automatically
-            tmp = {"bulletin_id": bulletin.id, "user_id": cur_user.id, "data": bulletin.to_dict()}
-            revmaps.append(tmp)
+        revmaps = [
+            {"bulletin_id": b.id, "user_id": cur_user.id, "data": b.to_dict()} for b in mutated
+        ]
         db.session.bulk_insert_mappings(BulletinHistory, revmaps)
 
         # commit session when a batch of items and revisions are added
         db.session.commit()
-
-        # Record Activity
-        updated = [b.to_mini() for b in bulletins]
-        Activity.create(
-            cur_user, Activity.ACTION_BULK_UPDATE, Activity.STATUS_SUCCESS, updated, "bulletin"
-        )
+        total_updated += len(mutated)
+
+        # Record Activity only for items actually updated
+        if mutated:
+            updated = [b.to_mini() for b in mutated]
+            Activity.create(
+                cur_user, Activity.ACTION_BULK_UPDATE, Activity.STATUS_SUCCESS, updated, "bulletin"
+            )
         # perhaps allow a little time out
         time.sleep(0.1)
 
-    logger.info(f"Bulletin bulk-update successful. User ID: {cur_user_id} Total: {len(ids)}")
+    logger.info(f"Bulletin bulk-update successful. User ID: {cur_user_id} Total: {total_updated}")
 
     assigner = db.session.get(User, cur_user_id)
     # Notify admin
@@ -143,7 +146,7 @@ def bulk_update_bulletins(ids: list, bulk: dict, cur_user_id: t.id) -> None:
         Constants.NotificationEvent.BULK_OPERATION_STATUS,
         assigner,
         "Bulk Operation Status",
-        f"Bulk update of {len(ids)} Bulletins has been completed successfully.",
+        f"Bulk update of {total_updated} Bulletins has been completed successfully.",
     )
 
     # send notifications for assignments and reviews
@@ -152,7 +155,7 @@ def bulk_update_bulletins(ids: list, bulk: dict, cur_user_id: t.id) -> None:
             Constants.NotificationEvent.NEW_ASSIGNMENT,
             db.session.get(User, assigned_to_id),
             "New Assignment",
-            f"{len(ids)} Bulletins have been assigned to you by {assigner.username} for analysis.",
+            f"{total_updated} Bulletins have been assigned to you by {assigner.username} for analysis.",
         )
 
     if first_peer_reviewer_id:
@@ -160,7 +163,7 @@ def bulk_update_bulletins(ids: list, bulk: dict, cur_user_id: t.id) -> None:
             Constants.NotificationEvent.REVIEW_NEEDED,
             db.session.get(User, first_peer_reviewer_id),
             "Review Needed",
-            f"{len(ids)} Bulletins have been assigned to you by {assigner.username} for review.",
+            f"{total_updated} Bulletins have been assigned to you by {assigner.username} for review.",
         )
 
 
@@ -192,13 +195,15 @@ def bulk_update_actors(ids: list, bulk: dict, cur_user_id: t.id) -> None:
     first_peer_reviewer_id = bulk.get("first_peer_reviewer_id")
     clear_reviewer = bulk.get("reviewerClear")
 
+    total_updated = 0
     for group in chunks:
         # Fetch bulletins
         actors = Actor.query.filter(Actor.id.in_(group))
+        # Only items the caller may actually modify (BAY-01-018).
+        mutated = []
         for actor in actors:
             # check user can access each actor
             if not user.can_access(actor):
-                # Log?
                 continue
 
             # get Status initially
@@ -257,27 +262,25 @@ def bulk_update_actors(ids: list, bulk: dict, cur_user_id: t.id) -> None:
 
             # add only to session
             db.session.add(actor)
+            mutated.append(actor)
 
-        revmaps = []
-        actors = Actor.query.filter(Actor.id.in_(group)).all()
-        for actor in actors:
-            # this commits automatically
-            tmp = {"actor_id": actor.id, "user_id": cur_user.id, "data": actor.to_dict()}
-            revmaps.append(tmp)
+        revmaps = [{"actor_id": a.id, "user_id": cur_user.id, "data": a.to_dict()} for a in mutated]
         db.session.bulk_insert_mappings(ActorHistory, revmaps)
 
         # commit session when a batch of items and revisions are added
         db.session.commit()
-
-        # Record Activity
-        updated = [b.to_mini() for b in actors]
-        Activity.create(
-            cur_user, Activity.ACTION_BULK_UPDATE, Activity.STATUS_SUCCESS, updated, "actor"
-        )
+        total_updated += len(mutated)
+
+        # Record Activity only for items actually updated
+        if mutated:
+            updated = [b.to_mini() for b in mutated]
+            Activity.create(
+                cur_user, Activity.ACTION_BULK_UPDATE, Activity.STATUS_SUCCESS, updated, "actor"
+            )
         # perhaps allow a little time out
         time.sleep(0.25)
 
-    logger.info(f"Actors bulk-update successful. User ID: {cur_user_id} Total: {len(ids)}")
+    logger.info(f"Actors bulk-update successful. User ID: {cur_user_id} Total: {total_updated}")
 
     assigner = db.session.get(User, cur_user_id)
     # Notify admin
@@ -285,7 +288,7 @@ def bulk_update_actors(ids: list, bulk: dict, cur_user_id: t.id) -> None:
         Constants.NotificationEvent.BULK_OPERATION_STATUS,
         assigner,
         "Bulk Operation Status",
-        f"Bulk update of {len(ids)} Actors has been completed successfully.",
+        f"Bulk update of {total_updated} Actors has been completed successfully.",
     )
 
     # send notifications for assignments and reviews
@@ -294,7 +297,7 @@ def bulk_update_actors(ids: list, bulk: dict, cur_user_id: t.id) -> None:
             Constants.NotificationEvent.NEW_ASSIGNMENT,
             db.session.get(User, assigned_to_id),
             "New Assignment",
-            f"{len(ids)} Actors have been assigned to you by {assigner.username} for analysis.",
+            f"{total_updated} Actors have been assigned to you by {assigner.username} for analysis.",
         )
 
     if first_peer_reviewer_id:
@@ -302,7 +305,7 @@ def bulk_update_actors(ids: list, bulk: dict, cur_user_id: t.id) -> None:
             Constants.NotificationEvent.REVIEW_NEEDED,
             db.session.get(User, first_peer_reviewer_id),
             "Review Needed",
-            f"{len(ids)} Actors have been assigned to you by {assigner.username} for review.",
+            f"{total_updated} Actors have been assigned to you by {assigner.username} for review.",
         )
 
 
@@ -340,13 +343,15 @@ def bulk_update_incidents(ids: list, bulk: dict, cur_user_id: t.id) -> None:
     first_peer_reviewer_id = bulk.get("first_peer_reviewer_id")
     clear_reviewer = bulk.get("reviewerClear")
 
+    total_updated = 0
     for group in chunks:
         # Fetch bulletins
         incidents = Incident.query.filter(Incident.id.in_(group))
+        # Only items the caller may actually modify (BAY-01-018).
+        mutated = []
         for incident in incidents:
             # check if user can access incident
             if not user.can_access(incident):
-                # Log?
                 continue
 
             # get Status initially
@@ -403,23 +408,23 @@ def bulk_update_incidents(ids: list, bulk: dict, cur_user_id: t.id) -> None:
 
             # add only to session
             db.session.add(incident)
+            mutated.append(incident)
 
-        revmaps = []
-        incidents = Incident.query.filter(Incident.id.in_(group)).all()
-        for incident in incidents:
-            # this commits automatically
-            tmp = {"incident_id": incident.id, "user_id": cur_user.id, "data": incident.to_dict()}
-            revmaps.append(tmp)
+        revmaps = [
+            {"incident_id": i.id, "user_id": cur_user.id, "data": i.to_dict()} for i in mutated
+        ]
         db.session.bulk_insert_mappings(IncidentHistory, revmaps)
 
         # commit session when a batch of items and revisions are added
         db.session.commit()
+        total_updated += len(mutated)
 
-        # Record Activity
-        updated = [b.to_mini() for b in incidents]
-        Activity.create(
-            cur_user, Activity.ACTION_BULK_UPDATE, Activity.STATUS_SUCCESS, updated, "incident"
-        )
+        # Record Activity only for items actually updated
+        if mutated:
+            updated = [b.to_mini() for b in mutated]
+            Activity.create(
+                cur_user, Activity.ACTION_BULK_UPDATE, Activity.STATUS_SUCCESS, updated, "incident"
+            )
 
         # restrict or assign related items
         if assign_related or restrict_related:
@@ -445,7 +450,7 @@ def bulk_update_incidents(ids: list, bulk: dict, cur_user_id: t.id) -> None:
         # perhaps allow a little time out
         time.sleep(0.25)
 
-    logger.info(f"Incidents bulk-update successful. User ID: {cur_user_id} Total: {len(ids)}")
+    logger.info(f"Incidents bulk-update successful. User ID: {cur_user_id} Total: {total_updated}")
 
     assigner = db.session.get(User, cur_user_id)
     # Notify admin
@@ -453,7 +458,7 @@ def bulk_update_incidents(ids: list, bulk: dict, cur_user_id: t.id) -> None:
         Constants.NotificationEvent.BULK_OPERATION_STATUS,
         assigner,
         "Bulk Operation Status",
-        f"Bulk update of {len(ids)} Incidents has been completed successfully.",
+        f"Bulk update of {total_updated} Incidents has been completed successfully.",
     )
 
     # send notifications for assignments and reviews
@@ -462,7 +467,7 @@ def bulk_update_incidents(ids: list, bulk: dict, cur_user_id: t.id) -> None:
             Constants.NotificationEvent.NEW_ASSIGNMENT,
             db.session.get(User, assigned_to_id),
             "New Assignment",
-            f"{len(ids)} Incidents have been assigned to you by {assigner.username} for analysis.",
+            f"{total_updated} Incidents have been assigned to you by {assigner.username} for analysis.",
         )
 
     if first_peer_reviewer_id:
@@ -470,5 +475,5 @@ def bulk_update_incidents(ids: list, bulk: dict, cur_user_id: t.id) -> None:
             Constants.NotificationEvent.REVIEW_NEEDED,
             db.session.get(User, first_peer_reviewer_id),
             "Review Needed",
-            f"{len(ids)} Incidents have been assigned to you by {assigner.username} for review.",
+            f"{total_updated} Incidents have been assigned to you by {assigner.username} for review.",
         )
diff --git a/enferno/tasks/data_import.py b/enferno/tasks/data_import.py
index 4d4e75ff0..1e0e67fd2 100644
--- a/enferno/tasks/data_import.py
+++ b/enferno/tasks/data_import.py
@@ -3,6 +3,7 @@
 from typing import Any, Literal, Optional
 
 from celery import chord, group
+from celery.exceptions import SoftTimeLimitExceeded
 from werkzeug.utils import safe_join
 
 import enferno.utils.typing as t
@@ -20,7 +21,7 @@
 logger = get_logger("celery.tasks.data_import")
 
 
-@celery.task(rate_limit=10)
+@celery.task(rate_limit=10, soft_time_limit=600, time_limit=660)
 def etl_process_file(
     batch_id: t.id, file: str, meta: Any, user_id: t.id, data_import_id: t.id
 ) -> Optional[Literal["done"]]:
@@ -29,6 +30,10 @@ def etl_process_file(
         di = MediaImport(batch_id, meta, user_id=user_id, data_import_id=data_import_id)
         di.process(file)
         return "done"
+    except SoftTimeLimitExceeded:
+        log = db.session.get(DataImport, data_import_id)
+        log.fail(TimeoutError(f"etl_process_file exceeded soft_time_limit on {file}"))
+        raise
     except Exception as e:
         # Roll back any half-applied transaction so the session is usable below.
         # Without this, errors that poison the session (e.g. dropped DB connection)
diff --git a/enferno/tasks/exports.py b/enferno/tasks/exports.py
index b7faf3921..1032a7363 100644
--- a/enferno/tasks/exports.py
+++ b/enferno/tasks/exports.py
@@ -14,7 +14,7 @@
 from enferno.admin.models import Actor, Bulletin, Incident
 from enferno.export.models import Export
 from enferno.tasks import BULK_CHUNK_SIZE, celery, cfg, chunk_list
-from enferno.utils.csv_utils import convert_list_attributes
+from enferno.utils.csv_utils import convert_list_attributes, escape_csv_formula_cell
 from enferno.utils.date_helper import DateHelper
 from enferno.utils.logging_utils import get_logger
 from enferno.utils.pdf_utils import PDFUtil
@@ -54,6 +54,29 @@ def generate_export(export_id: t.id) -> Any:
         raise NotImplementedError(f"Unsupported export file format: {export_request.file_format!r}")
 
 
+def _accessible_items(requester, query_iter, export_id: t.id):
+    """Yield only the items the export requester is authorised to access.
+
+    Filters here mirror the per-record group check enforced on direct
+    GET endpoints. Without it the Celery export pipeline would happily
+    serialise restricted items the requester cannot open in the UI.
+    """
+    if not requester:
+        logger.warning("Export #%s has no requester; skipping all items", export_id)
+        return
+    for item in query_iter:
+        if requester.can_access(item):
+            yield item
+        else:
+            logger.warning(
+                "Export #%s skipped restricted %s id=%s for requester %s",
+                export_id,
+                item.__tablename__,
+                item.id,
+                requester.id,
+            )
+
+
 def clear_failed_export(export_request: Export) -> None:
     """
     Clear failed export task.
@@ -85,23 +108,27 @@ def generate_pdf_files(export_id: t.id) -> t.id | Literal[False]:
         - export_id if successful, False otherwise.
     """
     export_request = db.session.get(Export, export_id)
+    requester = export_request.requester
 
     chunks = chunk_list(export_request.items, BULK_CHUNK_SIZE)
     dir_id = Export.generate_export_dir()
     try:
         for group in chunks:
             if export_request.table == "bulletin":
-                for bulletin in Bulletin.query.filter(Bulletin.id.in_(group)):
+                rows = Bulletin.query.filter(Bulletin.id.in_(group))
+                for bulletin in _accessible_items(requester, rows, export_id):
                     pdf = PDFUtil(bulletin)
                     pdf.generate_pdf(f"{Export.export_dir}/{dir_id}/{pdf.filename}")
 
             elif export_request.table == "actor":
-                for actor in Actor.query.filter(Actor.id.in_(group)):
+                rows = Actor.query.filter(Actor.id.in_(group))
+                for actor in _accessible_items(requester, rows, export_id):
                     pdf = PDFUtil(actor)
                     pdf.generate_pdf(f"{Export.export_dir}/{dir_id}/{pdf.filename}")
 
             elif export_request.table == "incident":
-                for incident in Incident.query.filter(Incident.id.in_(group)):
+                rows = Incident.query.filter(Incident.id.in_(group))
+                for incident in _accessible_items(requester, rows, export_id):
                     pdf = PDFUtil(incident)
                     pdf.generate_pdf(f"{Export.export_dir}/{dir_id}/{pdf.filename}")
 
@@ -130,6 +157,7 @@ def generate_json_file(export_id: t.id) -> t.id | Literal[False]:
         - export_id if successful, False otherwise.
     """
     export_request = db.session.get(Export, export_id)
+    requester = export_request.requester
     chunks = chunk_list(export_request.items, BULK_CHUNK_SIZE)
     file_path, dir_id = Export.generate_export_file()
     export_type = export_request.table
@@ -139,21 +167,17 @@ def generate_json_file(export_id: t.id) -> t.id | Literal[False]:
             file.write(f'"{export_type}s": [ \n')
             for group in chunks:
                 if export_type == "bulletin":
-                    batch = ",".join(
-                        bulletin.to_json()
-                        for bulletin in Bulletin.query.filter(Bulletin.id.in_(group))
-                    )
-                    file.write(f"{batch}\n")
+                    rows = Bulletin.query.filter(Bulletin.id.in_(group))
                 elif export_type == "actor":
-                    batch = ",".join(
-                        actor.to_json() for actor in Actor.query.filter(Actor.id.in_(group))
-                    )
-                    file.write(f"{batch}\n")
+                    rows = Actor.query.filter(Actor.id.in_(group))
                 elif export_type == "incident":
-                    batch = ",".join(
-                        incident.to_json()
-                        for incident in Incident.query.filter(Incident.id.in_(group))
-                    )
+                    rows = Incident.query.filter(Incident.id.in_(group))
+                else:
+                    rows = []
+                batch = ",".join(
+                    item.to_json() for item in _accessible_items(requester, rows, export_id)
+                )
+                if batch:
                     file.write(f"{batch}\n")
                 # less db overhead
                 time.sleep(0.2)
@@ -181,6 +205,7 @@ def generate_csv_file(export_id: t.id) -> t.id | Literal[False]:
         - export_id if successful, False otherwise.
     """
     export_request = db.session.get(Export, export_id)
+    requester = export_request.requester
     file_path, dir_id = Export.generate_export_file()
     export_type = export_request.table
 
@@ -189,6 +214,14 @@ def generate_csv_file(export_id: t.id) -> t.id | Literal[False]:
         for id in export_request.items:
             if export_type == "bulletin":
                 bulletin = db.session.get(Bulletin, id)
+                if not bulletin or not requester or not requester.can_access(bulletin):
+                    if bulletin:
+                        logger.warning(
+                            "Export #%s skipped restricted bulletin id=%s",
+                            export_id,
+                            bulletin.id,
+                        )
+                    continue
                 # adjust list attributes to normal dicts
                 adjusted = convert_list_attributes(bulletin.to_csv_dict())
                 # normalize
@@ -200,6 +233,14 @@ def generate_csv_file(export_id: t.id) -> t.id | Literal[False]:
 
             elif export_type == "actor":
                 actor = db.session.get(Actor, id)
+                if not actor or not requester or not requester.can_access(actor):
+                    if actor:
+                        logger.warning(
+                            "Export #%s skipped restricted actor id=%s",
+                            export_id,
+                            actor.id,
+                        )
+                    continue
                 # adjust list attributes to normal dicts
                 actor_dict = convert_list_attributes(actor.to_csv_dict())
 
@@ -216,6 +257,8 @@ def generate_csv_file(export_id: t.id) -> t.id | Literal[False]:
                 else:
                     csv_df = pd.concat([csv_df, df], ignore_index=True)
 
+        # Neutralize spreadsheet formula injection before writing (BAY-01-024).
+        csv_df = csv_df.map(escape_csv_formula_cell)
         csv_df.to_csv(f"{file_path}.csv")
 
         export_request.file_id = dir_id
@@ -272,7 +315,7 @@ def generate_export_media(previous_result: int) -> t.id | Literal[False]:
             region_name=cfg.AWS_REGION,
         )
 
-    for item in items:
+    for item in _accessible_items(export_request.requester, items, export_request.id):
         for media in item.medias:
             target_file = f"{Export.export_dir}/{export_request.file_id}/{media.media_file}"
 
diff --git a/enferno/tasks/extraction.py b/enferno/tasks/extraction.py
index c99fd9fa2..27f094f65 100644
--- a/enferno/tasks/extraction.py
+++ b/enferno/tasks/extraction.py
@@ -64,17 +64,14 @@ def process_media_extraction_task(
                 _save_failed_extraction(media_id, "DOCX extraction failed")
                 return {"success": False, "media_id": media_id, "error": "DOCX extraction failed"}
         elif ext == "pdf":
-            page_images = pdf_to_images(file_bytes)
+            # Cap rasterization at the OCR page limit so a crafted high-page-count
+            # PDF can't exhaust resources before the limit applies (BAY-01-023).
+            max_pages = current_app.config.get("PDF_OCR_MAX_PAGES", 20)
+            page_images = pdf_to_images(file_bytes, max_pages=max_pages)
             if not page_images:
                 _save_failed_extraction(media_id, "PDF conversion failed")
                 return {"success": False, "media_id": media_id, "error": "PDF conversion failed"}
 
-            max_pages = current_app.config.get("PDF_OCR_MAX_PAGES", 20)
-            total_pages = len(page_images)
-            if total_pages > max_pages:
-                logger.warning(f"PDF {media_id} has {total_pages} pages, truncating to {max_pages}")
-                page_images = page_images[:max_pages]
-
             page_results = [extract_text(img, hints) for img in page_images]
             page_results = [r for r in page_results if r is not None]
 
diff --git a/enferno/tasks/maintenance.py b/enferno/tasks/maintenance.py
index c3f512085..995d83971 100644
--- a/enferno/tasks/maintenance.py
+++ b/enferno/tasks/maintenance.py
@@ -1,8 +1,13 @@
 # -*- coding: utf-8 -*-
+import json
 import os
-from datetime import date, timedelta
+from datetime import date, datetime, timedelta, timezone
 
+import requests
+
+from enferno.admin.constants import Constants
 from enferno.admin.models import Activity, Location
+from enferno.admin.models.Notification import Notification
 from enferno.extensions import db, rds
 from enferno.tasks import celery, cfg
 from enferno.user.models import Session
@@ -12,6 +17,71 @@
 
 logger = get_logger("celery.tasks.maintenance")
 
+GITHUB_LATEST_URL = "https://api.github.com/repos/sjacorg/bayanat/releases/latest"
+UPDATE_CACHE_KEY = "bayanat:update:available"
+UPDATE_NOTIFIED_KEY = "bayanat:update:available:notified"
+
+
+def _strip_v(tag: str) -> str:
+    return tag[1:] if tag.startswith("v") else tag
+
+
+def _redis_get_str(key: str):
+    val = rds.get(key)
+    if val is None:
+        return None
+    return val.decode() if isinstance(val, (bytes, bytearray)) else val
+
+
+def _current_version() -> str:
+    try:
+        import tomllib
+
+        with open("pyproject.toml", "rb") as fh:
+            return tomllib.load(fh).get("project", {}).get("version", "0.0.0")
+    except Exception:
+        return "0.0.0"
+
+
+@celery.task
+def check_for_updates():
+    """Poll GitHub releases. Cache latest. Notify admins on new tag. Optionally auto-apply patch."""
+    try:
+        resp = requests.get(GITHUB_LATEST_URL, timeout=10)
+        resp.raise_for_status()
+        release = resp.json()
+    except Exception as e:
+        logger.warning(f"update check failed: {e}")
+        return
+
+    latest_tag = _strip_v(release.get("tag_name", ""))
+    if not latest_tag:
+        return
+
+    rds.set(
+        UPDATE_CACHE_KEY,
+        json.dumps(
+            {
+                "latest": latest_tag,
+                "release_notes_url": release.get("html_url"),
+                "checked_at": datetime.now(timezone.utc).isoformat(),
+            }
+        ),
+    )
+
+    current = _current_version()
+    if latest_tag == current:
+        return
+    if _redis_get_str(UPDATE_NOTIFIED_KEY) == latest_tag:
+        return
+
+    Notification.create_for_admins(
+        title=f"Update available: {latest_tag}",
+        message=f"A new Bayanat release is available. {release.get('html_url', '')}",
+        category=Constants.NotificationCategories.UPDATE.value,
+    )
+    rds.set(UPDATE_NOTIFIED_KEY, latest_tag)
+
 
 @celery.task
 def activity_cleanup_cron() -> None:
@@ -106,14 +176,29 @@ def reload_app():
 
 
 def restart_celery():
-    """Restart Celery worker via systemd. Requires sudoers entry.
-    Silently skips in dev mode (no systemd).
+    """Request a Celery worker restart.
+
+    Hardened deployments (BAY-01-032/033) run the services without any sudo
+    grant: the app touches a deploy-layout sentinel and a systemd path unit
+    watching it performs the restart as root. Legacy layouts without the
+    sentinel fall back to the old sudoers-based restart. Dev mode is a no-op.
     """
+    import pathlib
     import subprocess
 
+    sentinel = pathlib.Path(__file__).resolve().parents[2] / "restart-celery"
+    try:
+        if sentinel.exists():
+            sentinel.touch()
+            return
+    except OSError:
+        # Sentinel present but not writable: log and fall through to the sudo restart.
+        logger.warning(
+            "restart-celery sentinel touch failed; using fallback restart", exc_info=True
+        )
     try:
         subprocess.Popen(
-            ["sudo", "/usr/bin/systemctl", "restart", "bayanat-celery"],
+            ["sudo", "-n", "/usr/bin/systemctl", "restart", "bayanat-celery"],
             stdout=subprocess.DEVNULL,
             stderr=subprocess.DEVNULL,
         )
diff --git a/enferno/templates/layout.html b/enferno/templates/layout.html
index 8df04455f..dc577da08 100644
--- a/enferno/templates/layout.html
+++ b/enferno/templates/layout.html
@@ -64,7 +64,7 @@
             {% endblock %}
 
         <v-snackbar v-model="snackbar" multi-line>
-                <span v-html="snackMessage"></span>
+                <span style="white-space: pre-line;" v-text="snackMessage"></span>
             <template #actions>
                 <v-btn icon="mdi-close" variant="text" @click="snackbar = false"></v-btn>
             </template>
@@ -133,6 +133,8 @@
     {%  include 'admin/jsapi.jinja2' %}
 </script>
 <script src="/static/js/components/ProfileDropdown.js"></script>
+<script src="/static/js/components/UpdateBanner.js"></script>
+<script src="/static/js/components/UpdateProgressDialog.js"></script>
 <script src="/static/js/components/NotificationsList.js"></script>
 <script src="/static/js/components/ConfirmDialog.js"></script>
 <script src="/static/js/components/Toast.js"></script>
diff --git a/enferno/templates/security/wan_register.html b/enferno/templates/security/wan_register.html
index 83afaa3a9..219396b46 100644
--- a/enferno/templates/security/wan_register.html
+++ b/enferno/templates/security/wan_register.html
@@ -191,7 +191,9 @@
                             if (result.error_msg) {
 
                                 const error_element = document.getElementById("wan-errors");
-                                error_element.innerHTML = `<em>${result.error_msg}</em>`;
+                                const error_message = document.createElement("em");
+                                error_message.textContent = result.error_msg;
+                                error_element.replaceChildren(error_message);
                             } else {
                                 document.getElementById("credential").value = result.credential;
                                 /* We auto-submit this form - there is a Submit button on the
@@ -231,4 +233,4 @@
 
         app.use(vuetify).mount('#app');
     </script>
-{% endblock %}
\ No newline at end of file
+{% endblock %}
diff --git a/enferno/templates/security/wan_verify.html b/enferno/templates/security/wan_verify.html
index 70a80beac..5dc1e0f6f 100644
--- a/enferno/templates/security/wan_verify.html
+++ b/enferno/templates/security/wan_verify.html
@@ -41,7 +41,9 @@ <h1>{{ _fsdomain("Please re-authenticate using your security key or passkey") }}
             document.forms["wan-signin-response-form"].submit();
           } else {
             const error_element = document.getElementById("wan-errors");
-            error_element.innerHTML = `<em>${result.error_msg}</em>`;
+            const error_message = document.createElement("em");
+            error_message.textContent = result.error_msg;
+            error_element.replaceChildren(error_message);
           }
         });
     </script>
diff --git a/enferno/templates/setup_wizard.html b/enferno/templates/setup_wizard.html
index 1c27f4246..c0cbddbd9 100644
--- a/enferno/templates/setup_wizard.html
+++ b/enferno/templates/setup_wizard.html
@@ -65,42 +65,6 @@
                                         <template v-slot:prev></template>
                                     </v-stepper-vertical-item>
 
-                                    <v-stepper-vertical-item
-                                            :complete="step > 2"
-                                            title="First Admin User"
-                                            value="2"
-                                            :disabled="adminCreated">
-
-                                        <v-card variant="flat" :disabled="adminCreated" class="pa-4">
-                                            <v-form @submit.prevent="createSuperAdmin">
-                                                <div class="mb-5">
-                                                    {{ _('Create your first admin account. This account will have unrestricted
-                                                    access to all features and settings in Bayanat.') }}
-                                                </div>
-
-                                                <v-text-field
-                                                        v-model="username"
-                                                        label="Username"
-                                                        required
-                                                ></v-text-field>
-                                                <v-text-field
-                                                        v-model="password"
-                                                        label="Password"
-                                                        type="password"
-                                                        required
-                                                ></v-text-field>
-                                                <v-btn :loading="loading" :disabled="loading" color="primary" variant="flat" type="submit">
-                                                    {{ _('Create Admin Account') }}
-                                                </v-btn>
-                                            </v-form>
-                                        </v-card>
-
-                                        <template v-slot:next></template>
-                                        <template v-slot:prev="{ prev }">
-                                            <v-btn @click="prev">{{ _('Go Back') }}</v-btn>
-                                        </template>
-                                    </v-stepper-vertical-item>
-
                                     <v-stepper-vertical-item
                                             :complete="step > 3"
                                             title="{{ _('Language') }}"
@@ -437,7 +401,7 @@ <h2 class="mt-1 subtitle-2 mb-2">{{ _('Two Factor Authentication Policies') }}</
 
         <v-snackbar v-model="snackbar" multi-line>
 
-            <span v-html="snackMessage"></span>
+            <span style="white-space: pre-line;" v-text="snackMessage"></span>
 
             <template #actions>
                 <v-btn icon="mdi-close" variant="text" @click="snackbar = false"></v-btn>
@@ -507,8 +471,6 @@ <h2 class="mt-1 subtitle-2 mb-2">{{ _('Two Factor Authentication Policies') }}</
                     loading: false,
                     overlay: false,
                     finished: false,
-                    username: '',
-                    password: '',
                     importData: false,
                     dataImported: false,
                     cfg: {
@@ -518,7 +480,7 @@ <h2 class="mt-1 subtitle-2 mb-2">{{ _('Two Factor Authentication Policies') }}</
                         BABEL_DEFAULT_LOCALE: '{{ config.BABEL_DEFAULT_LOCALE }}',
                         GEO_MAP_DEFAULT_CENTER: null
                     },
-                    adminCreated: false,
+                    adminCreated: true,
                     defaultSettings: {},
 
                     alHeaders: [
@@ -544,22 +506,24 @@ <h2 class="mt-1 subtitle-2 mb-2">{{ _('Two Factor Authentication Policies') }}</
 
                 checkProgress() {
                     this.loading = true;
-                    Promise.all([
-                        api.get('/api/check-admin'),
-                        api.get('/api/check-data-imported')
-                    ]).then(([adminResponse, dataResponse]) => {
-                        this.adminCreated = adminResponse.data.status === 'exists';
-                        this.dataImported = dataResponse.data.status === 'imported';
-                    }).catch(error => {
-                        console.error('Error checking progress:', error);
-                        if (error.response && error.response.status === 403) {
-                            window.location.href = '/login'; // Redirect to login on 403 error
-                        } else {
-                            this.showSnack('Error checking progress. Please try again.');
-                        }
-                    }).finally(() => {
-                        this.loading = false;
-                    });
+                    // Admin always exists at this point (created by the installer
+                    // CLI bootstrap; the wizard requires session auth).
+                    this.adminCreated = true;
+                    api.get('/api/check-data-imported')
+                        .then(dataResponse => {
+                            this.dataImported = dataResponse.data.status === 'imported';
+                        })
+                        .catch(error => {
+                            console.error('Error checking progress:', error);
+                            if (error.response && error.response.status === 403) {
+                                window.location.href = '/login';
+                            } else {
+                                this.showSnack('Error checking progress. Please try again.');
+                            }
+                        })
+                        .finally(() => {
+                            this.loading = false;
+                        });
                 },
 
                 fetchDefaultSettings() {
@@ -593,32 +557,6 @@ <h2 class="mt-1 subtitle-2 mb-2">{{ _('Two Factor Authentication Policies') }}</
                         });
                 },
 
-                createSuperAdmin() {
-                    this.loading = true;
-                    this.error = '';
-
-                    api.post('/api/create-admin', {
-                        username: this.username,
-                        password: this.password
-                    })
-                        .then(response => {
-                            console.log(response.data);
-                            this.adminCreated = true;
-                            this.step = 3;
-                        })
-                        .catch(error => {
-                            console.error('Error creating admin:', error);
-                            if (error.response && error.response.data && error.response.data.description) {
-                                this.error = error.response.data.description;
-                            } else {
-                                this.error = 'Error creating admin. Please try again.';
-                            }
-                        })
-                        .finally(() => {
-                            this.loading = false;
-                        });
-                },
-
                 waitForReload() {
                     setTimeout(() => {
                         api.get('/').then(res => {
diff --git a/enferno/user/models.py b/enferno/user/models.py
index 326fa0fac..19450bc4e 100644
--- a/enferno/user/models.py
+++ b/enferno/user/models.py
@@ -19,6 +19,19 @@
 # Redis key namespace to set flag for forcing password reset
 SECURITY_KEY_NAMESPACE = "security:user"
 
+# Workflow statuses in which the assigned DA may mutate the item.
+# Mirrors the frontend editAllowed() rule. Changes here must match
+# the editAllowed() helper in admin/templates/admin/{bulletins,actors,incidents}.html.
+EDITABLE_STATUSES = frozenset(
+    {
+        "Human Created",
+        "Assigned",
+        "Updated",
+        "Peer Reviewed",
+        "Revisited",
+    }
+)
+
 logger = get_logger()
 
 
@@ -338,6 +351,34 @@ def can_access(self, obj: Any) -> bool:
 
         return False
 
+    def can_edit(self, obj: Any) -> bool:
+        """
+        Check if the user can mutate (create/update) an entity.
+
+        Mirrors the frontend editAllowed() rule:
+          - Admin can always edit.
+          - Otherwise must hold DA role.
+          - For Bulletin/Actor/Incident: must be the assigned analyst AND
+            the item must be in an editable workflow status.
+          - For Media: inherit from the parent Bulletin/Actor.
+          - In all cases the user must first pass can_access() (visibility).
+        """
+        if not self.can_access(obj):
+            return False
+        if self.has_role("Admin"):
+            return True
+        if not self.has_role("DA"):
+            return False
+
+        if obj.__tablename__ == "media":
+            parent = obj.bulletin or obj.actor
+            return parent is not None and self.can_edit(parent)
+
+        if obj.__tablename__ in ("bulletin", "actor", "incident"):
+            return obj.assigned_to_id == self.id and obj.status in EDITABLE_STATUSES
+
+        return False
+
     def from_json(self, item: dict) -> "User":
         """
         Populate the User object from a JSON dictionary.
diff --git a/enferno/user/views.py b/enferno/user/views.py
index 428c41128..84954a2e3 100644
--- a/enferno/user/views.py
+++ b/enferno/user/views.py
@@ -165,10 +165,14 @@ def auth_callback() -> Response:
             "User not found. Ask an administrator to create an account for you."
         )
 
-    # Update the user's Google ID if it doesn't exist
+    # Enforce a durable binding to the Google subject (BAY-01-019). Bind on
+    # first login; on later logins for the same email, refuse if the Google
+    # subject differs instead of silently inheriting the existing identity.
     if u.google_id is None:
         u.google_id = unique_id
         u.save()
+    elif u.google_id != unique_id:
+        return HTTPResponse.forbidden("Google account does not match the linked identity.")
 
     # Check if 2FA is required before completing login
     tf_plugin = current_app.extensions["security"]._tf_plugin
diff --git a/enferno/utils/backup_utils.py b/enferno/utils/backup_utils.py
index 3007ee18b..97c37258b 100644
--- a/enferno/utils/backup_utils.py
+++ b/enferno/utils/backup_utils.py
@@ -18,9 +18,14 @@ def pg_dump(filepath):
     host = Config.get("POSTGRES_HOST")
     password = Config.get("POSTGRES_PASSWORD")
 
-    # localhost with no password set
+    # localhost with no password set: socket connection with peer auth. Pass
+    # the role explicitly; the service OS user maps to it via pg_ident
+    # (BAY-01-032).
     if host == "localhost" and not password:
         cmd = ["pg_dump", "-Fc", db, "-f", filepath]
+        user = Config.get("POSTGRES_USER")
+        if user:
+            cmd += ["-U", user]
         return check_output(cmd, timeout=PG_DUMP_TIMEOUT)
 
     cmd = [
diff --git a/enferno/utils/base.py b/enferno/utils/base.py
index 8ea873b8a..7949e6129 100644
--- a/enferno/utils/base.py
+++ b/enferno/utils/base.py
@@ -134,6 +134,43 @@ def to_dict(self, mode=None):
         data.update(self.get_dynamic_fields())
         return data
 
+    @staticmethod
+    def sync_relations(submitted, model, key, relate, existing, other_id):
+        """
+        Reconcile a set of nested relations against a submitted payload, enforcing
+        per-target access control. Only links to targets the current user can access
+        are created, updated, or deleted; relations to inaccessible items are left
+        untouched in both directions. Single authorization boundary for all
+        Actor/Bulletin/Incident relation paths.
+
+        Args:
+            - submitted: list of relation dicts from the request payload.
+            - model: the target ORM model class (Actor/Bulletin/Incident).
+            - key: nested dict key holding the target item ("actor"/"bulletin"/"incident").
+            - relate: bound relate_* helper used to create/update each link.
+            - existing: iterable of the entity's current relation rows.
+            - other_id: callable mapping a relation row to its target id.
+        """
+        from flask_login import current_user
+
+        seen = []
+        for relation in submitted:
+            target = db.session.get(model, relation[key]["id"])
+            if not target or not current_user.can_access(target):
+                continue
+            seen.append(target.id)
+            relate(target, relation=relation)
+
+        for r in existing:
+            rid = other_id(r)
+            if rid in seen:
+                continue
+            target = db.session.get(model, rid)
+            if not target or not current_user.can_access(target):
+                continue
+            r.delete()
+            target.create_revision()
+
 
 class ComponentDataMixin(BaseMixin):
     __abstract__ = True
diff --git a/enferno/utils/config_utils.py b/enferno/utils/config_utils.py
index 7e40a505d..0d85fe2d6 100644
--- a/enferno/utils/config_utils.py
+++ b/enferno/utils/config_utils.py
@@ -54,7 +54,7 @@ class ConfigManager:
                 "txt",
             ],
             "MEDIA_UPLOAD_MAX_FILE_SIZE": 1000,
-            "SHEETS_ALLOWED_EXTENSIONS": ["csv", "xls", "xlsx"],
+            "SHEETS_ALLOWED_EXTENSIONS": ["csv", "xlsx"],
             "ETL_TOOL": False,
             "ETL_PATH_IMPORT": False,
             "ETL_VID_EXT": [
diff --git a/enferno/utils/csv_utils.py b/enferno/utils/csv_utils.py
index c8a4e8274..1a3a156b9 100644
--- a/enferno/utils/csv_utils.py
+++ b/enferno/utils/csv_utils.py
@@ -1,6 +1,18 @@
 from typing import Iterable, Optional
 
 
+def escape_csv_formula_cell(value):
+    """Neutralize spreadsheet formula injection (BAY-01-024).
+
+    Prefix any string cell starting with =, +, -, or @ with a single quote so
+    Excel/LibreOffice treat it as inert text rather than an executable formula.
+    Non-string values pass through unchanged.
+    """
+    if isinstance(value, str) and value[:1] in ("=", "+", "-", "@"):
+        return "'" + value
+    return value
+
+
 def convert_list_attributes(dictionary: dict) -> dict:
     """
     convert dictionary list attributes into named attributes based on their index.
diff --git a/enferno/utils/ocr/pdf.py b/enferno/utils/ocr/pdf.py
index 852307aa1..e7a362785 100644
--- a/enferno/utils/ocr/pdf.py
+++ b/enferno/utils/ocr/pdf.py
@@ -9,15 +9,21 @@
 MAX_DIMENSION = 4096  # Cap longest side to keep Vision API happy
 
 
-def pdf_to_images(file_bytes: bytes) -> list[bytes]:
+def pdf_to_images(file_bytes: bytes, max_pages: int | None = None) -> list[bytes]:
     """Render each PDF page as a JPEG image.
 
-    Returns a list of JPEG bytes, one per page. Empty list on failure.
+    Returns a list of JPEG bytes, one per page. Empty list on failure. When
+    max_pages is set, rasterization stops after that many pages so a crafted
+    high-page-count PDF cannot exhaust CPU/memory before the OCR cap is applied
+    (BAY-01-023).
     """
     try:
         doc = fitz.open(stream=file_bytes, filetype="pdf")
         result = []
-        for page in doc:
+        for i, page in enumerate(doc):
+            if max_pages is not None and i >= max_pages:
+                logger.warning(f"PDF exceeds max_pages={max_pages}; stopped rasterizing at {i}")
+                break
             pix = page.get_pixmap(dpi=DPI)
             longest = max(pix.width, pix.height)
             if longest > MAX_DIMENSION:
diff --git a/enferno/utils/pdf_utils.py b/enferno/utils/pdf_utils.py
index 8a0992247..c32e749ca 100644
--- a/enferno/utils/pdf_utils.py
+++ b/enferno/utils/pdf_utils.py
@@ -1,7 +1,41 @@
+import os
 from typing import Optional
+from urllib.parse import urlparse, unquote
+
 from flask import render_template, current_app
 
 
+def _safe_url_fetcher(url: str):
+    """Block external/arbitrary-file resource fetching during PDF rendering
+    (BAY-01-025). Untrusted rich-text img[src] would otherwise let WeasyPrint
+    make outbound requests (SSRF) or read local files (file:// disclosure).
+
+    Allow only: data: URIs, the app's own static assets (BASE_URL), and local
+    files under the app root (the logo and rewritten inline media). Everything
+    else is refused, the resource is skipped and PDF generation continues.
+    """
+    from weasyprint import default_url_fetcher
+
+    parsed = urlparse(url)
+    if parsed.scheme == "data":
+        return default_url_fetcher(url)
+    if parsed.scheme == "file":
+        root = os.path.realpath(current_app.root_path)
+        path = os.path.realpath(unquote(parsed.path))
+        if path == root or path.startswith(root + os.sep):
+            return default_url_fetcher(url)
+        raise ValueError(f"PDF export: blocked file URL outside app root: {url}")
+    if parsed.scheme in ("http", "https"):
+        # Match scheme + host exactly. A startswith() prefix check would let
+        # https://<base-host>.evil/ through when BASE_URL has no trailing
+        # slash (BAY-01-025).
+        base = urlparse(current_app.config.get("BASE_URL") or "")
+        if base.netloc and parsed.scheme == base.scheme and parsed.netloc == base.netloc:
+            return default_url_fetcher(url)
+        raise ValueError(f"PDF export: blocked external URL: {url}")
+    raise ValueError(f"PDF export: blocked URL scheme: {url}")
+
+
 class PDFUtil:
     """PDF generation utility class."""
 
@@ -33,7 +67,7 @@ def generate_pdf(self, output: Optional[str] = None) -> None:
         if output:
             from weasyprint import HTML
 
-            HTML(string=html).write_pdf(output)
+            HTML(string=html, url_fetcher=_safe_url_fetcher).write_pdf(output)
 
     @property
     def filename(self):
diff --git a/flask/Dockerfile b/flask/Dockerfile
index 9c11a7995..9f223e39c 100644
--- a/flask/Dockerfile
+++ b/flask/Dockerfile
@@ -1,68 +1,79 @@
-# ---- use a base image to compile requirements / save image size -----
-FROM ubuntu:24.04 as base
-ENV DEBIAN_FRONTEND=noninteractive
+# ---- builder stage: compile python deps with uv -----------------
+FROM ghcr.io/astral-sh/uv:0.5.11-python3.12-bookworm-slim@sha256:096c3761e41782bdb2818381a8202153d39e0618a9e12c757a2c46327c1aa83c AS builder
 
-RUN apt-get update -y && \
-    apt-get install -yq python3.12 python3.12-dev python3.12-venv python3-pip curl \
-    libjpeg8-dev libzip-dev libxml2-dev libssl-dev libffi-dev libxslt1-dev \
-    libmysqlclient-dev libncurses5-dev libpq-dev \
-    libimage-exiftool-perl
+ENV UV_COMPILE_BYTECODE=1 \
+    UV_LINK_MODE=copy \
+    UV_PYTHON_DOWNLOADS=0 \
+    UV_NO_DEV=1 \
+    DEBIAN_FRONTEND=noninteractive
 
 WORKDIR /app
 
-# Sets utf-8 encoding for Python
-ENV LANG=C.UTF-8
-# Turns off writing .pyc files
-ENV PYTHONDONTWRITEBYTECODE=1
-# Seems to speed things up
-ENV PYTHONUNBUFFERED=1
-# Install UV
-RUN curl -LsSf https://astral.sh/uv/install.sh | sh
-ENV PATH="/root/.local/bin:$PATH"
+# Build-time headers only; runtime libs installed in the final stage.
+# libimage-exiftool-perl is needed at build time because pyexifinfo's
+# setup.py probes for the exiftool binary during wheel install.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential \
+    libpq-dev \
+    libffi-dev \
+    libxml2-dev \
+    libxslt1-dev \
+    libjpeg-dev \
+    zlib1g-dev \
+    libopenjp2-7-dev \
+    libimage-exiftool-perl \
+    && rm -rf /var/lib/apt/lists/*
 
 COPY pyproject.toml uv.lock /app/
-
 RUN uv sync --frozen --no-install-project
 
-# ----------------- main container -------------------------
+# ---- runtime stage -----------------------------------------------
+FROM python:3.12-slim-bookworm@sha256:76d4b7b6305788c6b4c6a19d6a22a3921bf802e9af4d5e1e5bd771208dba74bf AS runtime
 
-FROM ubuntu:24.04
+ENV DEBIAN_FRONTEND=noninteractive \
+    LANG=C.UTF-8 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PATH="/app/.venv/bin:$PATH" \
+    XDG_CACHE_HOME=/tmp/.cache
 
-ENV DEBIAN_FRONTEND=noninteractive
 ARG ROLE
 ENV ROLE=${ROLE}
-RUN echo "Building ${ROLE} container."
-RUN if [ "$ROLE" = "flask" ]; then \
-    apt-get update -y && apt-get install -yq python3.12 python3.12-dev python3.12-venv \
-    postgis libpango-1.0-0 libharfbuzz0b libpangoft2-1.0-0 libffi-dev \
-    libjpeg-dev libopenjp2-7-dev; \
-    elif [ "$ROLE" = "celery" ]; then \
-    apt-get update -y && apt-get install -yq python3.12 python3.12-dev python3.12-venv \
-    postgis libimage-exiftool-perl ffmpeg libpango-1.0-0 libharfbuzz0b \
-    libpangoft2-1.0-0 libffi-dev libjpeg-dev libopenjp2-7-dev; \
-    fi
-RUN apt clean
-RUN apt autoremove
+
+# Shared runtime libs: psycopg2 (libpq5), weasyprint (pango/cairo/harfbuzz),
+# pillow (libjpeg, libopenjp2), lxml (libxml2, libxslt).
+# Celery roles also need exiftool + ffmpeg for media processing.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libpq5 \
+    libpango-1.0-0 \
+    libpangoft2-1.0-0 \
+    libharfbuzz0b \
+    libcairo2 \
+    libxml2 \
+    libxslt1.1 \
+    libjpeg62-turbo \
+    libopenjp2-7 \
+    zlib1g \
+    libffi8 \
+    fonts-dejavu-core \
+    && if [ "$ROLE" = "celery" ] || [ "$ROLE" = "celery-ocr" ]; then \
+         apt-get install -y --no-install-recommends \
+           libimage-exiftool-perl \
+           ffmpeg; \
+       fi \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
 
-# Sets utf-8 encoding for Python
-ENV LANG=C.UTF-8
-# Turns off writing .pyc files
-ENV PYTHONDONTWRITEBYTECODE=1
-# Seems to speed things up
-ENV PYTHONUNBUFFERED=1
+RUN useradd --system --create-home --uid 1000 ubuntu
 
 COPY --chown=ubuntu:ubuntu . /app
-# copy UV-built virtualenv
-COPY --from=base /app/.venv /app/.venv
+COPY --from=builder --chown=ubuntu:ubuntu /app/.venv /app/.venv
 
 COPY --chown=ubuntu:ubuntu ./flask/bin/entrypoint.sh /usr/local/bin/entrypoint.sh
-
 RUN chmod 550 /usr/local/bin/entrypoint.sh
 
-ENV PATH="/app/.venv/bin:$PATH"
-
 USER ubuntu
 
 CMD ["/usr/local/bin/entrypoint.sh"]
diff --git a/flask/Dockerfile.test b/flask/Dockerfile.test
index 06cd6741c..7751f0b34 100644
--- a/flask/Dockerfile.test
+++ b/flask/Dockerfile.test
@@ -1,4 +1,4 @@
-FROM ubuntu:24.04
+FROM ubuntu:24.04@sha256:786a8b558f7be160c6c8c4a54f9a57274f3b4fb1491cf65146521ae77ff1dc54
 ENV DEBIAN_FRONTEND=noninteractive
 
 
diff --git a/flask/bin/entrypoint.sh b/flask/bin/entrypoint.sh
index ce36533a0..090aec8ab 100644
--- a/flask/bin/entrypoint.sh
+++ b/flask/bin/entrypoint.sh
@@ -2,10 +2,21 @@
 set -e
 
 if [ "$ROLE" = "flask" ]; then
-  echo ":: Creating Bayanat Database ::"
-  flask create-db --create-exts
-  echo ":: Running migrations ::"
-  flask db upgrade
+  if [ -z "$(flask db current 2>/dev/null | grep -oE '[0-9a-f]{12}')" ]; then
+    echo ":: Fresh DB, creating schema ::"
+    flask create-db --create-exts
+    flask db stamp head
+    # BAY-01-005: bootstrap admin out-of-band (no network-reachable
+    # /api/create-admin route exists). On a fresh DB the wizard would
+    # otherwise be unreachable. flask install with --username and no
+    # --password generates a random password and prints it to stdout;
+    # the operator retrieves it via `docker-compose logs bayanat`.
+    echo ":: Bootstrapping initial admin user ::"
+    flask install --username admin
+  else
+    echo ":: Existing DB, running migrations ::"
+    flask db upgrade
+  fi
   echo ":: Starting Bayanat ::"
   exec uwsgi --http 0.0.0.0:5000 --protocol uwsgi --master --processes 1 --wsgi run:app
 
diff --git a/migrations/versions/f0a3d6c1e8b2_merge_redaction_and_incident_heads.py b/migrations/versions/f0a3d6c1e8b2_merge_redaction_and_incident_heads.py
new file mode 100644
index 000000000..0c6cb73a0
--- /dev/null
+++ b/migrations/versions/f0a3d6c1e8b2_merge_redaction_and_incident_heads.py
@@ -0,0 +1,21 @@
+"""merge redaction and incident heads
+
+Revision ID: f0a3d6c1e8b2
+Revises: c7d2e9f4a1b8, 68396035f041
+Create Date: 2026-07-11
+
+"""
+
+# revision identifiers, used by Alembic.
+revision = "f0a3d6c1e8b2"
+down_revision = ("c7d2e9f4a1b8", "68396035f041")
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    pass
+
+
+def downgrade():
+    pass
diff --git a/nginx/Dockerfile b/nginx/Dockerfile
index 7b602665e..05d2beb18 100644
--- a/nginx/Dockerfile
+++ b/nginx/Dockerfile
@@ -1,9 +1,2 @@
-FROM bitnami/nginx:1.24 as base
-VOLUME /opt/bitnami/nginx/conf
-COPY --chown=1001 nginx.conf /opt/bitnami/nginx/conf/
-
-FROM base as dev
-COPY --chown=1001 bayanat_dev.conf /opt/bitnami/nginx/conf/server_blocks/
-
-FROM base as prod
-COPY --chown=1001 bayanat.conf /opt/bitnami/nginx/conf/server_blocks/
+FROM nginxinc/nginx-unprivileged:1.29-alpine@sha256:0c79d56aee561a1d81c63f00eee5fb5fe29279560cdc55e91425133104c7fbe6
+COPY bayanat.conf /etc/nginx/conf.d/default.conf
diff --git a/nginx/bayanat.conf b/nginx/bayanat.conf
index 0e8d58cba..6b7b4b223 100755
--- a/nginx/bayanat.conf
+++ b/nginx/bayanat.conf
@@ -1,8 +1,9 @@
 server {
 
-    listen 80;
+    listen 8080;
     server_name _;
     charset utf-8;
+    server_tokens off;
 
     # Security headers
     add_header X-Content-Type-Options "nosniff" always;
@@ -13,6 +14,16 @@ server {
     # Limit request body size (match app upload limit)
     client_max_body_size 1024m;
 
+    gzip               on;
+    gzip_comp_level    2;
+    gzip_proxied       any;
+    gzip_types         text/plain text/css application/javascript text/xml application/xml+rss;
+
+    location = /healthz {
+        access_log off;
+        return 200;
+    }
+
     # static assets
     location  /static {
         alias /app/static;
@@ -21,7 +32,7 @@ server {
 
     location / {
         proxy_pass http://bayanat:5000;
-        proxy_set_header Host                $host;
+        proxy_set_header Host                $http_host;
         proxy_set_header X-Real-IP           $remote_addr;
         proxy_set_header X-Forwarded-Proto   $scheme;
         proxy_set_header X-Forwarded-For     $proxy_add_x_forwarded_for;
diff --git a/nginx/nginx.conf b/nginx/nginx.conf
deleted file mode 100644
index 65f9f45e7..000000000
--- a/nginx/nginx.conf
+++ /dev/null
@@ -1,63 +0,0 @@
-# Based on https://www.nginx.com/resources/wiki/start/topics/examples/full/#nginx-conf
-# user              www www;  ## Default: nobody
-
-worker_processes  auto;
-error_log         "/opt/bitnami/nginx/logs/error.log";
-pid               "/opt/bitnami/nginx/tmp/nginx.pid";
-
-events {
-    worker_connections  1024;
-}
-
-http {
-    include       mime.types;
-    default_type  application/octet-stream;
-    log_format    main '$remote_addr - $remote_user [$time_local] '
-                       '"$request" $status  $body_bytes_sent "$http_referer" '
-                       '"$http_user_agent" "$http_x_forwarded_for"';
-    access_log    "/opt/bitnami/nginx/logs/access.log" main;
-    add_header    X-Frame-Options SAMEORIGIN always;
-    add_header    X-Content-Type-Options "nosniff" always;
-    add_header    Referrer-Policy "strict-origin-when-cross-origin" always;
-    add_header    Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
-
-    client_body_temp_path  "/opt/bitnami/nginx/tmp/client_body" 1 2;
-    proxy_temp_path        "/opt/bitnami/nginx/tmp/proxy" 1 2;
-    fastcgi_temp_path      "/opt/bitnami/nginx/tmp/fastcgi" 1 2;
-    scgi_temp_path         "/opt/bitnami/nginx/tmp/scgi" 1 2;
-    uwsgi_temp_path        "/opt/bitnami/nginx/tmp/uwsgi" 1 2;
-
-    sendfile           on;
-    tcp_nopush         on;
-    tcp_nodelay        off;
-    gzip               on;
-    gzip_http_version  1.0;
-    gzip_comp_level    2;
-    gzip_proxied       any;
-    gzip_types         text/plain text/css application/javascript text/xml application/xml+rss;
-    keepalive_timeout  65;
-    ssl_protocols      TLSv1.2 TLSv1.3;
-    ssl_ciphers        HIGH:!aNULL:!MD5;
-    client_max_body_size 500M;
-    server_tokens off;
-
-    absolute_redirect  off;
-    port_in_redirect   off;
-
-    include  "/opt/bitnami/nginx/conf/server_blocks/*.conf";
-
-    # HTTP Server
-    server {
-        # Port to listen on, can also be set in IP:PORT format
-        listen  8080;
-
-        include  "/opt/bitnami/nginx/conf/bitnami/*.conf";
-
-        location /status {
-            stub_status on;
-            access_log   off;
-            allow 127.0.0.1;
-            deny all;
-        }
-    }
-}
diff --git a/tests/conftest.py b/tests/conftest.py
index 97cbfc2dc..817d07e91 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -1,4 +1,3 @@
-import os
 from unittest.mock import patch
 from uuid import uuid4
 
@@ -53,6 +52,19 @@ def isolated_session_store(app, monkeypatch):
     monkeypatch.setattr(app.session_interface, "client", fakeredis.FakeStrictRedis())
 
 
+@pytest.fixture(autouse=True)
+def _bypass_session_freshness(monkeypatch):
+    """Treat every test session as 'fresh'. FlaskLoginClient can't populate the
+    Flask-Security primary-auth timestamp the freshness check reads, so the
+    @fresh_auth gates (BAY-01-016) would otherwise block all privileged-endpoint
+    tests. Tests that assert freshness behaviour re-patch this to return False.
+    """
+    monkeypatch.setattr(
+        "flask_security.decorators.check_and_update_authn_fresh",
+        lambda *a, **k: True,
+    )
+
+
 @pytest.fixture(scope="session")
 def app():
     """Create a Flask app context for testing."""
@@ -168,11 +180,13 @@ def setup_db_uninitialized(uninitialized_app):
     try:
         _db.session.query(IDNumberType).delete()
     except Exception:
+        # best-effort teardown: the table may already be gone if the test dropped the schema
         pass
     try:
         _db.session.remove()
         _db.drop_all()
-    except Exception as e:
+    except Exception:
+        # best-effort teardown: ignore errors tearing down an already-partial schema
         pass
 
 
diff --git a/tests/test_health.py b/tests/test_health.py
new file mode 100644
index 000000000..20121b8ec
--- /dev/null
+++ b/tests/test_health.py
@@ -0,0 +1,13 @@
+def test_health_returns_ok(anonymous_client):
+    resp = anonymous_client.get("/health")
+    assert resp.status_code == 200
+    data = resp.get_json()
+    assert data["status"] == "ok"
+    assert "version" in data
+
+
+def test_health_is_exempt_from_rate_limit(anonymous_client):
+    # 20 rapid requests should all succeed (limiter.exempt).
+    for _ in range(20):
+        resp = anonymous_client.get("/health")
+        assert resp.status_code == 200
diff --git a/tests/test_pentest_fixes.py b/tests/test_pentest_fixes.py
new file mode 100644
index 000000000..563337178
--- /dev/null
+++ b/tests/test_pentest_fixes.py
@@ -0,0 +1,828 @@
+"""
+Regression tests for 7ASecurity BAY-01 pentest findings.
+
+Each test mirrors the auditor's PoC and asserts the patched behaviour.
+Run all of these with:
+    uv run pytest tests/test_pentest_fixes.py -v
+"""
+
+from uuid import uuid4
+
+import pytest
+from flask_security.utils import hash_password
+
+from tests.factories import BulletinFactory
+
+# ---------------------------------------------------------------------------
+# BAY-01-001  Revision history bypasses object-level access
+# ---------------------------------------------------------------------------
+
+
+@pytest.fixture
+def history_viewer_outside_group(app, session, isolated_session_store):
+    """User with view_simple_history but no role intersection on any item."""
+    from enferno.admin.models import Activity
+    from enferno.user.models import User
+
+    u = User(username=f"hv-{uuid4().hex[:8]}", password=hash_password("password"), active=1)
+    u.view_simple_history = True
+    u.fs_uniquifier = uuid4().hex
+    session.add(u)
+    session.commit()
+    user_id = u.id
+    with app.app_context():
+        with app.test_client(user=u) as client:
+            yield client
+    session.query(Activity).filter(Activity.user_id == user_id).delete(synchronize_session=False)
+    session.delete(u)
+    session.commit()
+
+
+def _make_restricted_bulletin(session, role_name="TestRole"):
+    from enferno.user.models import Role
+
+    bulletin = BulletinFactory()
+    session.add(bulletin)
+    session.commit()
+    role = session.query(Role).filter(Role.name == role_name).first()
+    assert role, f"Role {role_name} not found"
+    bulletin.roles.append(role)
+    session.commit()
+    return bulletin
+
+
+def test_bay_01_001_history_blocked_when_outside_group(
+    session, create_test_role, history_viewer_outside_group
+):
+    bulletin = _make_restricted_bulletin(session)
+    resp = history_viewer_outside_group.get(f"/admin/api/bulletinhistory/{bulletin.id}")
+    assert resp.status_code == 403
+
+
+def test_bay_01_001_history_404_for_missing_bulletin(history_viewer_outside_group):
+    resp = history_viewer_outside_group.get("/admin/api/bulletinhistory/99999999")
+    assert resp.status_code == 404
+
+
+# ---------------------------------------------------------------------------
+# BAY-01-002  OCR extraction PUT IDOR
+# ---------------------------------------------------------------------------
+
+
+def _make_media_with_extraction(session, bulletin_role_name=None):
+    from enferno.admin.models import Extraction, Media
+    from enferno.user.models import Role
+
+    bulletin = BulletinFactory()
+    session.add(bulletin)
+    session.commit()
+    if bulletin_role_name:
+        role = session.query(Role).filter(Role.name == bulletin_role_name).first()
+        bulletin.roles.append(role)
+        session.commit()
+
+    media = Media(
+        media_file=f"test-{uuid4().hex}.png",
+        media_file_type="image/png",
+        etag=uuid4().hex,
+        bulletin_id=bulletin.id,
+    )
+    session.add(media)
+    session.commit()
+
+    extraction = Extraction(
+        media_id=media.id,
+        text="original text",
+        status="processed",
+        history=[],
+    )
+    session.add(extraction)
+    session.commit()
+    return media, extraction
+
+
+def test_bay_01_002_extraction_put_blocked_outside_group(session, create_test_role, da_client):
+    """DA without TestRole cannot mutate extraction on a bulletin restricted to TestRole."""
+    _, extraction = _make_media_with_extraction(session, bulletin_role_name="TestRole")
+    resp = da_client.put(
+        f"/admin/api/extraction/{extraction.id}",
+        json={"action": "transcribe", "text": "tampered"},
+    )
+    assert resp.status_code == 403
+
+
+def test_bay_01_002_extraction_put_404_for_missing(da_client):
+    resp = da_client.put(
+        "/admin/api/extraction/99999999",
+        json={"action": "transcribe", "text": "x"},
+    )
+    assert resp.status_code == 404
+
+
+# ---------------------------------------------------------------------------
+# BAY-01-004  Path traversal in CSV/XLS analyze
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "endpoint, payload",
+    [
+        ("/import/api/csv/analyze", {"file": {"filename": "../../../../app/.env"}}),
+        ("/import/api/xls/sheets", {"file": {"filename": "../../../etc/passwd"}}),
+        (
+            "/import/api/xls/analyze",
+            {"file": {"filename": "../../../../app/.env"}, "sheet": "Sheet1"},
+        ),
+    ],
+)
+def test_bay_01_004_path_traversal_rejected(admin_client, endpoint, payload):
+    resp = admin_client.post(endpoint, json=payload)
+    assert resp.status_code == 400
+
+
+# ---------------------------------------------------------------------------
+# BAY-01-003  Export pipeline filters items by requester.can_access
+# ---------------------------------------------------------------------------
+
+
+def test_bay_01_003_accessible_items_skips_restricted(session, create_test_role, users):
+    """Helper drops restricted items the requester cannot access."""
+    from enferno.tasks.exports import _accessible_items
+
+    _, _, _, sa_dict = users
+    da_user = sa_dict["da"]  # DA without TestRole
+
+    accessible = _make_restricted_bulletin(session, role_name="TestRole")
+    accessible.roles = []  # explicitly unrestricted
+    session.commit()
+
+    restricted = _make_restricted_bulletin(session, role_name="TestRole")
+
+    result = list(_accessible_items(da_user, [accessible, restricted], export_id=1))
+    assert accessible in result
+    assert restricted not in result
+
+
+def test_bay_01_003_accessible_items_no_requester_yields_nothing(session):
+    from enferno.tasks.exports import _accessible_items
+
+    bulletin = BulletinFactory()
+    session.add(bulletin)
+    session.commit()
+    assert list(_accessible_items(None, [bulletin], export_id=1)) == []
+
+
+# ---------------------------------------------------------------------------
+# BAY-01-005  /api/create-admin route is gone; admin bootstrap is CLI-only
+# ---------------------------------------------------------------------------
+
+
+def test_bay_01_005_create_admin_endpoint_removed(anonymous_client):
+    resp = anonymous_client.post(
+        "/api/create-admin",
+        json={"username": "rogue", "password": "x" * 12},
+    )
+    assert resp.status_code == 404
+
+
+def test_bay_01_005_check_admin_endpoint_removed(anonymous_client):
+    resp = anonymous_client.get("/api/check-admin")
+    assert resp.status_code == 404
+
+
+# ---------------------------------------------------------------------------
+# BAY-01-007  Login rate limit (Flask-Limiter applied to security.login)
+# ---------------------------------------------------------------------------
+
+
+def test_bay_01_007_login_brute_force_returns_429(app, anonymous_client):
+    """Repeated bad logins from one client trip Flask-Limiter and return 429."""
+    from enferno.extensions import limiter
+
+    limiter.reset()
+    last_status = None
+    for _ in range(15):
+        resp = anonymous_client.post(
+            "/login",
+            data={"username": "noone", "password": "wrong"},
+        )
+        last_status = resp.status_code
+        if last_status == 429:
+            break
+    assert last_status == 429
+
+
+# ---------------------------------------------------------------------------
+# BAY-01-008  Stored XSS via import sanitization gap
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "payload",
+    [
+        "<img src=x onerror=alert(document.domain)>",
+        "<script>steal()</script>safe",
+        "<svg><animate onbegin=alert(1)></svg>",
+        '<a href="javascript:alert(1)">click</a>',
+    ],
+)
+def test_bay_01_008_sanitize_strips_xss(payload):
+    from enferno.utils.validation_utils import sanitize_string
+
+    cleaned = sanitize_string(payload)
+    assert "onerror" not in cleaned
+    assert "<script" not in cleaned
+    assert "javascript:" not in cleaned
+    assert "onbegin" not in cleaned
+
+
+def test_bay_01_008_sanitize_preserves_safe_html():
+    """Allowlisted tags survive so legitimate rich-text imports keep formatting."""
+    from enferno.utils.validation_utils import sanitize_string
+
+    cleaned = sanitize_string("<p>hello <strong>world</strong></p>")
+    assert "<p>" in cleaned
+    assert "<strong>" in cleaned
+
+
+# ---------------------------------------------------------------------------
+# BAY-01-009  Media update must enforce editAllowed (assigned analyst only)
+# ---------------------------------------------------------------------------
+
+
+def test_bay_01_009_media_put_blocked_when_not_assigned(session, da_client):
+    """DA cannot mutate media on a bulletin that isn't assigned to them, even
+    when the bulletin is otherwise accessible. Mirrors the frontend
+    editAllowed() rule."""
+    from enferno.admin.models import Media
+
+    bulletin = BulletinFactory()
+    session.add(bulletin)
+    session.commit()
+    # Intentionally leave assigned_to_id unset and roles empty: the bulletin is
+    # visible to any analyst, but no analyst is the assigned editor.
+
+    media = Media(
+        media_file=f"test-{uuid4().hex}.png",
+        media_file_type="image/png",
+        etag=uuid4().hex,
+        bulletin_id=bulletin.id,
+    )
+    session.add(media)
+    session.commit()
+
+    resp = da_client.put(
+        f"/admin/api/media/{media.id}",
+        json={"item": {"title": "tampered", "fileType": "image/png"}},
+    )
+    assert resp.status_code == 403
+
+
+def test_bay_01_009_media_put_404_for_missing(da_client):
+    resp = da_client.put(
+        "/admin/api/media/99999999",
+        json={"item": {"title": "x"}},
+    )
+    assert resp.status_code == 404
+
+
+def test_bay_01_009_media_derived_actions_blocked_when_not_assigned(session, da_client):
+    """The media edit boundary also covers the mutating siblings: an unassigned
+    DA cannot rotate media or edit extracted text on an accessible-but-
+    unassigned item. (ocr/process shares the identical can_edit guard but sits
+    behind @_require_media_access, which the default DA fixture can't clear.)"""
+    from enferno.admin.models import Media, Extraction
+
+    bulletin = BulletinFactory()
+    session.add(bulletin)
+    session.commit()
+    # Visible to any analyst, assigned to none: passes can_access, fails can_edit.
+
+    media = Media(
+        media_file=f"test-{uuid4().hex}.png",
+        media_file_type="image/png",
+        etag=uuid4().hex,
+        bulletin_id=bulletin.id,
+    )
+    session.add(media)
+    session.commit()
+
+    extraction = Extraction(media_id=media.id, status="pending")
+    session.add(extraction)
+    session.commit()
+    # Capture ids before issuing requests: the first client call expires the
+    # session and detaches these instances.
+    media_id, extraction_id = media.id, extraction.id
+
+    rot = da_client.put(f"/admin/api/media/{media_id}/orientation", json={"orientation": 90})
+    assert rot.status_code == 403
+
+    edit = da_client.put(
+        f"/admin/api/extraction/{extraction_id}",
+        json={"action": "transcribe", "text": "tampered"},
+    )
+    assert edit.status_code == 403
+
+
+# ---------------------------------------------------------------------------
+# BAY-01-039  Sheet import handle_mismatch must not store raw HTML
+# (set_description was already sanitized under BAY-01-008; this covers the
+#  second stored-XSS sink the report flagged)
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "payload",
+    ["<svg/onload=alert(1)>", "<script>alert(1)</script>", "<img src=x onerror=alert(1)>"],
+)
+def test_bay_01_039_handle_mismatch_sanitizes_description(payload):
+    from enferno.data_import.utils.sheet_import import SheetImport
+    from enferno.admin.models import ActorProfile
+
+    si = SheetImport.__new__(SheetImport)
+    si.data_import = type("D", (), {"add_to_log": lambda self, msg: None})()
+    si.actor_profile = ActorProfile()
+    si.actor_profile.description = ""
+
+    si.handle_mismatch("type", payload)
+
+    desc = si.actor_profile.description
+    assert "<svg" not in desc
+    assert "<script" not in desc
+    assert "onerror" not in desc
+    assert "onload" not in desc
+
+
+@pytest.mark.parametrize(
+    "payload",
+    ["<svg/onload=alert(1)>", "<script>alert(1)</script>", "<img src=x onerror=alert(1)>"],
+)
+def test_bay_01_008_set_details_sanitizes_mp_field(payload):
+    """Missing Person detail fields are rendered as HTML downstream, so the
+    sheet import must sanitize them on persist (BAY-01-008 retest follow-up)."""
+    from enferno.data_import.utils.sheet_import import SheetImport
+    from enferno.admin.models import ActorProfile
+
+    si = SheetImport.__new__(SheetImport)
+    si.data_import = type("D", (), {"add_to_log": lambda self, msg: None})()
+    si.actor_profile = ActorProfile()
+
+    si.set_details("injured_details", payload)
+
+    stored = si.actor_profile.injured["details"]
+    assert "<svg" not in stored
+    assert "<script" not in stored
+    assert "onerror" not in stored
+    assert "onload" not in stored
+
+
+# ---------------------------------------------------------------------------
+# BAY-01-024  CSV exports must neutralize spreadsheet formula injection
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "raw,expected",
+    [
+        ("=1+1", "'=1+1"),
+        ('=HYPERLINK("http://x","p")', '\'=HYPERLINK("http://x","p")'),
+        ("+1", "'+1"),
+        ("-2", "'-2"),
+        ("@cmd", "'@cmd"),
+        ("normal text", "normal text"),
+        ("a=b", "a=b"),  # only leading metachar is dangerous
+        ("", ""),
+        (5, 5),  # non-strings pass through
+        (None, None),
+    ],
+)
+def test_bay_01_024_escape_csv_formula_cell(raw, expected):
+    from enferno.utils.csv_utils import escape_csv_formula_cell
+
+    assert escape_csv_formula_cell(raw) == expected
+
+
+def test_bay_01_024_dataframe_map_neutralizes():
+    import pandas as pd
+    from enferno.utils.csv_utils import escape_csv_formula_cell
+
+    df = pd.DataFrame({"title": ["=evil()", "ok"], "n": [1, 2]})
+    out = df.map(escape_csv_formula_cell)
+    assert out["title"].tolist() == ["'=evil()", "ok"]
+    assert out["n"].tolist() == [1, 2]
+
+
+# ---------------------------------------------------------------------------
+# BAY-01-014  Web-import domain allowlist must match registered domain /
+# real subdomain, not any suffix (evilyoutube.com must NOT pass youtube.com)
+# ---------------------------------------------------------------------------
+
+
+def test_bay_01_014_web_import_domain_boundary(monkeypatch):
+    from enferno.admin.validation.models import WebImportValidationModel
+
+    monkeypatch.setattr(
+        "enferno.admin.validation.models.Config.get",
+        staticmethod(lambda *a, **k: ["youtube.com"]),
+    )
+
+    # legitimate domain + real subdomain pass
+    WebImportValidationModel(url="https://www.youtube.com/watch?v=abc")
+    WebImportValidationModel(url="https://m.youtube.com/watch?v=abc")
+
+    # suffix-bypass attempts are rejected
+    for bad in ("http://evilyoutube.com", "http://youtube.com.evil.com"):
+        with pytest.raises(Exception):
+            WebImportValidationModel(url=bad)
+
+
+# ---------------------------------------------------------------------------
+# BAY-01-018  Bulk update must only write revisions/activity for items the
+# caller can actually modify, not the whole submitted batch
+# ---------------------------------------------------------------------------
+
+
+def test_bay_01_018_bulk_update_skips_restricted_revisions(session, users):
+    from enferno.tasks.bulk_ops import bulk_update_bulletins
+    from enferno.admin.models import BulletinHistory
+    from enferno.user.models import Role
+
+    _admin, _da, mod_user, _ = users
+
+    # a role the Mod does NOT hold -> restricts the bulletin from them
+    restrict_role = Role(name=f"Restrict-{uuid4().hex[:6]}")
+    session.add(restrict_role)
+    session.commit()
+
+    open_b = BulletinFactory()  # no roles -> accessible
+    restricted_b = BulletinFactory()
+    session.add_all([open_b, restricted_b])
+    session.commit()
+    restricted_b.roles = [restrict_role]
+    session.add(restricted_b)
+    session.commit()
+
+    bulk_update_bulletins.run(
+        [open_b.id, restricted_b.id],
+        {"comments": "bulk-test", "status": "Assigned"},
+        mod_user.id,
+    )
+
+    open_revs = BulletinHistory.query.filter(BulletinHistory.bulletin_id == open_b.id).count()
+    restricted_revs = BulletinHistory.query.filter(
+        BulletinHistory.bulletin_id == restricted_b.id
+    ).count()
+    assert open_revs >= 1  # accessible item got its revision
+    assert restricted_revs == 0  # restricted item must NOT get a fabricated revision
+
+
+# ---------------------------------------------------------------------------
+# BAY-01-021  Username masking: the list APIs now serialize assignee/reviewer
+# via User.to_compact(), which masks names for users without view_usernames.
+# (End-to-end list-API masking is verified live; the harness can't mutate the
+#  request's current_user. This covers the masking primitive the views use.)
+# ---------------------------------------------------------------------------
+
+
+def test_bay_01_021_to_compact_masks_without_view_usernames(users):
+    from unittest.mock import patch
+
+    admin_user, _da, _mod, _ = users
+
+    class _NoView:
+        view_usernames = False
+
+        def has_role(self, r):
+            return False
+
+    class _CanView:
+        view_usernames = True
+
+        def has_role(self, r):
+            return False
+
+    with patch("enferno.user.models.has_request_context", lambda: True):
+        with patch("enferno.user.models.current_user", _NoView()):
+            c = admin_user.to_compact()
+            assert c["name"] == f"user-{admin_user.id}"
+            assert c["username"] == f"user-{admin_user.id}"
+            assert admin_user.name not in (c["name"], c["username"])
+
+        with patch("enferno.user.models.current_user", _CanView()):
+            c = admin_user.to_compact()
+            assert c["name"] == admin_user.name
+
+
+# ---------------------------------------------------------------------------
+# BAY-01-016  Privileged admin mutation APIs must enforce session freshness
+# (config-driven), not just role membership. conftest bypasses freshness for
+# functional tests; here we restore the REAL freshness check so the positive
+# config window engages. The harness session has no primary-auth timestamp, so
+# real freshness fails on @fresh_auth routes but within=-1 routes still pass.
+# ---------------------------------------------------------------------------
+
+
+def test_bay_01_016_privileged_api_requires_fresh_session(admin_client, monkeypatch):
+    from flask_security.utils import check_and_update_authn_fresh as real_fresh
+
+    monkeypatch.setattr("flask_security.decorators.check_and_update_authn_fresh", real_fresh)
+
+    # Non-gated read still works (its auth uses within<0 -> always fresh).
+    assert admin_client.get("/admin/api/users/").status_code == 200
+
+    # Privileged mutations carry @fresh_auth (positive config window): a session
+    # with no primary-auth timestamp is rejected by the freshness gate.
+    for path, method in [
+        ("/admin/api/user/revoke_2fa", "delete"),
+        ("/admin/api/user/force-reset-all", "post"),
+        ("/admin/api/reload/", "post"),
+        ("/admin/api/configuration/", "put"),
+    ]:
+        resp = getattr(admin_client, method)(path, json={})
+        assert resp.status_code in (302, 401, 403), f"{method} {path} not freshness-gated"
+
+
+# ---------------------------------------------------------------------------
+# BAY-01-026  Export creation must store only items the requester can access,
+# not arbitrary requester-supplied IDs
+# ---------------------------------------------------------------------------
+
+
+def test_bay_01_026_export_filters_inaccessible_items(session, users, monkeypatch):
+    import enferno.export.models as em
+    from enferno.user.models import Role
+
+    _admin, da_user, _mod, _ = users
+
+    restrict_role = Role(name=f"Restrict-{uuid4().hex[:6]}")
+    session.add(restrict_role)
+    session.commit()
+
+    open_b = BulletinFactory()  # no roles -> DA can access
+    restricted_b = BulletinFactory()
+    session.add_all([open_b, restricted_b])
+    session.commit()
+    restricted_b.roles = [restrict_role]  # DA lacks this role
+    session.add(restricted_b)
+    session.commit()
+
+    monkeypatch.setattr(em, "current_user", da_user)
+    ids = em.Export._accessible_item_ids("bulletin", [open_b.id, restricted_b.id])
+    assert open_b.id in ids
+    assert restricted_b.id not in ids
+
+
+# ---------------------------------------------------------------------------
+# BAY-01-023  PDF OCR must cap rasterization at the page limit, not rasterize
+# the whole document and then truncate
+# ---------------------------------------------------------------------------
+
+
+def test_bay_01_023_pdf_to_images_caps_pages():
+    import fitz
+    from enferno.utils.ocr.pdf import pdf_to_images
+
+    doc = fitz.open()
+    for _ in range(10):
+        doc.new_page()
+    pdf_bytes = doc.tobytes()
+    doc.close()
+
+    # without a cap, all pages render
+    assert len(pdf_to_images(pdf_bytes)) == 10
+    # with a cap, rasterization stops early (does not render all 10 then slice)
+    assert len(pdf_to_images(pdf_bytes, max_pages=3)) == 3
+
+
+# ---------------------------------------------------------------------------
+# BAY-01-025  PDF export must not fetch external/arbitrary-file resources
+# (SSRF + file:// disclosure via untrusted rich-text img[src])
+# ---------------------------------------------------------------------------
+
+
+def test_bay_01_025_pdf_url_fetcher_blocks_external(app):
+    import os
+    from enferno.utils.pdf_utils import _safe_url_fetcher
+
+    # External requests (SSRF) and file:// outside the app root are refused.
+    for bad in (
+        "http://169.254.169.254/latest/meta-data/",
+        "https://evil.example/x.png",
+        "file:///etc/passwd",
+    ):
+        with pytest.raises(ValueError):
+            _safe_url_fetcher(bad)
+
+    # data: URIs are allowed (inline, no fetch).
+    _safe_url_fetcher("data:text/plain;base64,SGVsbG8=")
+
+    # Local files under the app root (logo / rewritten inline media) are allowed.
+    logo = os.path.join(os.path.realpath(app.root_path), "static/img/bayanat-h-v2.png")
+    _safe_url_fetcher(f"file://{logo}")
+
+
+def test_bay_01_025_pdf_url_fetcher_host_match_is_exact(app, monkeypatch):
+    import weasyprint
+    from enferno.utils.pdf_utils import _safe_url_fetcher
+
+    sentinel = object()
+    monkeypatch.setattr(weasyprint, "default_url_fetcher", lambda url: sentinel)
+    # No trailing slash: the common production shape that broke startswith().
+    monkeypatch.setitem(app.config, "BASE_URL", "https://bayanat.example.org")
+
+    # Exact scheme + host passes the guard (no network: fetcher is mocked).
+    assert _safe_url_fetcher("https://bayanat.example.org/static/x.png") is sentinel
+
+    # A host that merely shares the prefix, or a scheme mismatch, is refused.
+    for bad in (
+        "https://bayanat.example.org.evil.com/x.png",
+        "http://bayanat.example.org/x.png",
+    ):
+        with pytest.raises(ValueError):
+            _safe_url_fetcher(bad)
+
+
+# ---------------------------------------------------------------------------
+# BAY-01-020  Inline media filenames must be opaque/unguessable, not a
+# reconstructable timestamp+basename
+# ---------------------------------------------------------------------------
+
+
+def test_bay_01_020_inline_filename_is_opaque():
+    from enferno.admin.models import Media
+
+    a = Media.generate_inline_file_name("evidence.png")
+    b = Media.generate_inline_file_name("evidence.png")
+    assert a != b  # random per upload, not deterministic
+    assert a.endswith(".png")  # extension preserved
+    assert "evidence" not in a  # original basename not leaked
+    # no YYYYMMDD-HHMMSS timestamp prefix
+    import re
+
+    assert not re.match(r"^\d{8}-\d{6}-", a)
+
+
+# ---------------------------------------------------------------------------
+# BAY-01-022  Peer-review enforcement on update APIs: owner can't edit a
+# review-locked item; non-Admin can't set assignee/reviewer via normal update
+# ---------------------------------------------------------------------------
+
+
+def _bulletin_update_body(**extra):
+    item = {"title": "edit", "comments": "c", "source_link": "https://example.test/x"}
+    item.update(extra)
+    return {"item": item}
+
+
+def test_bay_01_022_review_locked_blocks_owner_update(session, da_client, users):
+
+    _admin, da_user, _mod, _ = users
+    b = BulletinFactory()
+    session.add(b)
+    session.commit()
+    b.assigned_to_id = da_user.id  # DA owns it
+    b.status = "Peer Review Assigned"  # frozen for review
+    session.add(b)
+    session.commit()
+
+    resp = da_client.put(f"/admin/api/bulletin/{b.id}", json=_bulletin_update_body())
+    assert resp.status_code == 403  # owner cannot edit while reviewer-locked
+
+
+def test_bay_01_022_non_admin_cannot_set_assignee_via_update(session, da_client, users):
+    from enferno.admin.models import Bulletin
+    from enferno.extensions import db
+
+    admin_user, da_user, _mod, _ = users
+    b = BulletinFactory()
+    session.add(b)
+    session.commit()
+    b.assigned_to_id = da_user.id
+    b.status = "Assigned"  # not locked
+    session.add(b)
+    session.commit()
+
+    # DA tries to reassign the bulletin to the admin via the normal update
+    resp = da_client.put(
+        f"/admin/api/bulletin/{b.id}",
+        json=_bulletin_update_body(assigned_to={"id": admin_user.id}),
+    )
+    assert resp.status_code == 200
+    db.session.expire_all()
+    refreshed = db.session.get(Bulletin, b.id)
+    assert refreshed.assigned_to_id == da_user.id  # assignee field was stripped
+
+
+# --- BAY-01-032: snapshots listed without sudo ---
+
+
+def test_bay_01_032_snapshots_listed_from_backups_dir(admin_client, tmp_path):
+    from flask import current_app
+
+    (tmp_path / "pre-v4.0.0-to-v4.0.1-20260101-0000.dump").write_bytes(b"x" * 2048)
+    (tmp_path / "unrelated.txt").write_text("not a snapshot")
+
+    old = current_app.config.get("BACKUPS_LOCAL_PATH")
+    current_app.config["BACKUPS_LOCAL_PATH"] = str(tmp_path)
+    try:
+        resp = admin_client.get("/admin/api/snapshots/")
+    finally:
+        current_app.config["BACKUPS_LOCAL_PATH"] = old
+
+    assert resp.status_code == 200
+    items = resp.json["data"]
+    assert [i["name"] for i in items] == ["pre-v4.0.0-to-v4.0.1-20260101-0000.dump"]
+    assert items[0]["size"] == "2K"
+
+
+# ---------------------------------------------------------------------------
+# BAY-01-036  Drop unsupported legacy .xls from the sheet allowlist
+# (openpyxl, the pinned engine, cannot read the old binary format)
+# ---------------------------------------------------------------------------
+
+
+def test_bay_01_036_xls_not_in_default_allowlist():
+    # Fresh installs seed config.json from DEFAULT_CONFIG, so the shipped
+    # default must not offer .xls (the pinned openpyxl engine cannot read it).
+    # Runtime Config reads the deployment's own config.json, which is
+    # environment-specific and not asserted here.
+    from enferno.settings import TestConfig
+    from enferno.utils.config_utils import ConfigManager
+
+    assert "xls" not in ConfigManager.DEFAULT_CONFIG["SHEETS_ALLOWED_EXTENSIONS"]
+    assert "xlsx" in ConfigManager.DEFAULT_CONFIG["SHEETS_ALLOWED_EXTENSIONS"]
+    assert "xls" not in TestConfig.SHEETS_ALLOWED_EXTENSIONS
+
+
+# ---------------------------------------------------------------------------
+# BAY-01-042  process-sheet must reject a non-list `files`
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize("payload", [{}, {"files": None}, {"files": "x"}, {"files": []}])
+def test_bay_01_042_process_sheet_rejects_bad_files(admin_client, payload):
+    resp = admin_client.post("/import/api/process-sheet", json=payload)
+    assert resp.status_code == 417
+
+
+# ---------------------------------------------------------------------------
+# BAY-01-037  sheet param must reject bool/list (bool is an int subclass, so
+# it has to be excluded explicitly) on both analyze and process-sheet
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "endpoint, payload",
+    [
+        ("/import/api/process-sheet", {"files": ["a.csv"], "sheet": True}),
+        ("/import/api/process-sheet", {"files": ["a.csv"], "sheet": [0]}),
+        ("/import/api/xls/analyze", {"file": {"filename": "x.xlsx"}, "sheet": True}),
+    ],
+)
+def test_bay_01_037_rejects_non_scalar_sheet(admin_client, endpoint, payload):
+    resp = admin_client.post(endpoint, json=payload)
+    assert resp.status_code == 417
+
+
+# ---------------------------------------------------------------------------
+# BAY-01-012  Media metadata (filename, etag, OCR text) embedded in a parent
+# bulletin/actor payload must be hidden from users blocked from media, matching
+# the _require_media_access gate on the direct media endpoints. The harness
+# can't mutate the request's current_user, so this covers the can_view_media
+# primitive the to_dict serializers call.
+# ---------------------------------------------------------------------------
+
+
+def test_bay_01_012_can_view_media_gate():
+    from unittest.mock import patch
+    import enferno.admin.models.utils as mu
+
+    class _NoMedia:
+        can_access_media = False
+
+        def has_role(self, r):
+            return False
+
+    class _HasMedia:
+        can_access_media = True
+
+        def has_role(self, r):
+            return False
+
+    class _Admin:
+        can_access_media = False
+
+        def has_role(self, r):
+            return r == "Admin"
+
+    # CLI/Celery (no request context) are trusted.
+    with patch.object(mu, "has_request_context", lambda: False):
+        assert mu.can_view_media() is True
+
+    with patch.object(mu, "has_request_context", lambda: True):
+        with patch.object(mu, "current_user", _NoMedia()):
+            assert mu.can_view_media() is False
+        with patch.object(mu, "current_user", _HasMedia()):
+            assert mu.can_view_media() is True
+        with patch.object(mu, "current_user", _Admin()):
+            assert mu.can_view_media() is True
diff --git a/tests/test_security.py b/tests/test_security.py
index 9c3669be1..03c5b03b9 100644
--- a/tests/test_security.py
+++ b/tests/test_security.py
@@ -68,8 +68,10 @@ def test_setup_routes_exist_when_uninitialized(self):
             uninit_app = create_app(cfg)
             rules = [r.rule for r in uninit_app.url_map.iter_rules()]
             assert "/setup_wizard" in rules
-            assert "/api/check-admin" in rules
-            assert "/api/create-admin" in rules
+            # /api/create-admin and /api/check-admin removed (BAY-01-005);
+            # admin bootstrap is now CLI-only via `flask install`.
+            assert "/api/create-admin" not in rules
+            assert "/api/check-admin" not in rules
 
 
 class TestInputValidation:
@@ -124,35 +126,6 @@ def test_redirect_to_setup(self, uninitialized_app, setup_db_uninitialized):
         assert resp.status_code == 302
         assert "setup_wizard" in resp.location
 
-    def test_check_admin_not_found(self, uninitialized_app, setup_db_uninitialized):
-        client = uninitialized_app.test_client()
-        resp = client.get("/api/check-admin")
-        assert resp.status_code == 200
-        assert resp.json["data"] == {"status": "not_found"}
-        assert resp.json["message"] == "No admin user found"
-
-    def test_create_admin_user(self, uninitialized_app, session_uninitialized):
-        from enferno.user.models import User
-
-        client = uninitialized_app.test_client()
-        resp = client.post(
-            "/api/create-admin",
-            json={"username": "testAdmin", "password": "password"},
-        )
-        assert resp.status_code == 201
-        assert resp.json["message"] == "Admin user installed successfully"
-        assert resp.json["data"]["item"]["username"] == "testAdmin"
-        admin = User.query.filter(User.username == "testAdmin").first()
-        assert admin is not None
-        assert admin.view_usernames is True
-        assert admin.view_simple_history is True
-        assert admin.view_full_history is True
-        assert admin.can_self_assign is True
-        assert admin.can_edit_locations is True
-        assert admin.can_export is True
-        assert admin.can_import_web is True
-        assert admin.can_access_media is True
-
     @pytest.mark.parametrize(
         "client_fixture, expected",
         [
diff --git a/tests/test_update_check.py b/tests/test_update_check.py
new file mode 100644
index 000000000..ba53db471
--- /dev/null
+++ b/tests/test_update_check.py
@@ -0,0 +1,50 @@
+from unittest.mock import MagicMock, patch
+
+from enferno.tasks.maintenance import _strip_v
+
+
+def test_strip_v_prefix():
+    assert _strip_v("v4.1.0") == "4.1.0"
+    assert _strip_v("4.1.0") == "4.1.0"
+    assert _strip_v("") == ""
+
+
+def _github_response(tag):
+    return MagicMock(
+        raise_for_status=lambda: None,
+        json=lambda: {"tag_name": tag, "html_url": f"https://example/tag/{tag}"},
+    )
+
+
+def test_new_release_notifies_admins():
+    """Update check is notify-only: a new tag caches the latest and notifies
+    admins. It never triggers a privileged update (BAY-01-013)."""
+    from enferno.tasks import maintenance
+
+    fake_redis = MagicMock()
+    fake_redis.get.return_value = None  # nothing notified yet
+    with (
+        patch.object(maintenance, "requests") as req,
+        patch.object(maintenance, "rds", fake_redis),
+        patch.object(maintenance, "_current_version", return_value="4.1.0"),
+        patch.object(maintenance, "Notification") as notif,
+    ):
+        req.get.return_value = _github_response("v4.1.1")
+        maintenance.check_for_updates.run()
+        notif.create_for_admins.assert_called_once()
+
+
+def test_same_version_does_not_notify():
+    from enferno.tasks import maintenance
+
+    fake_redis = MagicMock()
+    fake_redis.get.return_value = None
+    with (
+        patch.object(maintenance, "requests") as req,
+        patch.object(maintenance, "rds", fake_redis),
+        patch.object(maintenance, "_current_version", return_value="4.1.1"),
+        patch.object(maintenance, "Notification") as notif,
+    ):
+        req.get.return_value = _github_response("v4.1.1")
+        maintenance.check_for_updates.run()
+        notif.create_for_admins.assert_not_called()
diff --git a/tests/test_update_endpoints.py b/tests/test_update_endpoints.py
new file mode 100644
index 000000000..8dc74aa35
--- /dev/null
+++ b/tests/test_update_endpoints.py
@@ -0,0 +1,69 @@
+import json
+
+
+def test_available_returns_cached(admin_client):
+    from enferno.extensions import rds
+
+    rds.set(
+        "bayanat:update:available",
+        json.dumps(
+            {
+                "latest": "4.1.1",
+                "release_notes_url": "https://example.com",
+                "checked_at": "2026-04-16T00:00:00+00:00",
+            }
+        ),
+    )
+    resp = admin_client.get("/admin/api/updates/available")
+    assert resp.status_code == 200
+    data = resp.get_json()["data"]
+    assert data["latest"] == "4.1.1"
+    assert data["release_notes_url"] == "https://example.com"
+
+
+def test_available_returns_empty_when_no_cache(admin_client):
+    from enferno.extensions import rds
+
+    rds.delete("bayanat:update:available")
+    resp = admin_client.get("/admin/api/updates/available")
+    assert resp.status_code == 200
+    data = resp.get_json()["data"]
+    assert data["latest"] is None
+
+
+def test_status_idle_when_no_state_file(admin_client, tmp_path, monkeypatch):
+    monkeypatch.setattr(
+        "enferno.admin.views.system.UPDATE_STATE_FILE",
+        str(tmp_path / "missing.json"),
+    )
+    resp = admin_client.get("/admin/api/updates/status")
+    assert resp.status_code == 200
+    data = resp.get_json()["data"]
+    assert data["phase"] == "IDLE"
+    assert data["running"] is False
+
+
+def test_status_running_when_midway(admin_client, tmp_path, monkeypatch):
+    state = tmp_path / "update.json"
+    state.write_text(json.dumps({"phase": "MIGRATE", "target": "4.1.1"}))
+    monkeypatch.setattr("enferno.admin.views.system.UPDATE_STATE_FILE", str(state))
+    resp = admin_client.get("/admin/api/updates/status")
+    data = resp.get_json()["data"]
+    assert data["phase"] == "MIGRATE"
+    assert data["running"] is True
+
+
+def test_status_terminal_when_success(admin_client, tmp_path, monkeypatch):
+    state = tmp_path / "update.json"
+    state.write_text(json.dumps({"phase": "SUCCESS", "target": "4.1.1"}))
+    monkeypatch.setattr("enferno.admin.views.system.UPDATE_STATE_FILE", str(state))
+    resp = admin_client.get("/admin/api/updates/status")
+    data = resp.get_json()["data"]
+    assert data["running"] is False
+
+
+def test_start_endpoint_removed(admin_client):
+    """The privileged web-triggered update endpoint is gone (BAY-01-013).
+    Updates are applied via the root CLI only."""
+    resp = admin_client.post("/admin/api/updates/start")
+    assert resp.status_code == 404