diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index fa2343c69..bfebbf371 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,143 +9,23 @@ updates:
     labels:
       - "type: dependencies"
   - package-ecosystem: gomod
-    directory: "/plugins/app-json"
+    directories:
+      - "/plugins/*"
     schedule:
       interval: daily
-    open-pull-requests-limit: 2
-    labels:
-      - "type: dependencies"
-  - package-ecosystem: gomod
-    directory: "/plugins/apps"
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 2
-    labels:
-      - "type: dependencies"
-  - package-ecosystem: gomod
-    directory: "/plugins/builder"
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 2
-    labels:
-      - "type: dependencies"
-  - package-ecosystem: gomod
-    directory: "/plugins/buildpacks"
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 2
-    labels:
-      - "type: dependencies"
-  - package-ecosystem: gomod
-    directory: "/plugins/common"
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 2
-    labels:
-      - "type: dependencies"
-  - package-ecosystem: gomod
-    directory: "/plugins/config"
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 2
-    labels:
-      - "type: dependencies"
-  - package-ecosystem: gomod
-    directory: "/plugins/cron"
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 2
-    labels:
-      - "type: dependencies"
-  - package-ecosystem: gomod
-    directory: "/plugins/docker-options"
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 2
-    labels:
-      - "type: dependencies"
-  - package-ecosystem: gomod
-    directory: "/plugins/logs"
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 2
-    labels:
-      - "type: dependencies"
-  - package-ecosystem: gomod
-    directory: "/plugins/network"
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 2
-    labels:
-      - "type: dependencies"
-  - package-ecosystem: gomod
-    directory: "/plugins/nginx-vhosts"
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 2
-    labels:
-      - "type: dependencies"
-  - package-ecosystem: gomod
-    directory: "/plugins/ports"
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 2
-    labels:
-      - "type: dependencies"
-  - package-ecosystem: gomod
-    directory: "/plugins/proxy"
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 2
-    labels:
-      - "type: dependencies"
-  - package-ecosystem: gomod
-    directory: "/plugins/ps"
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 2
-    labels:
-      - "type: dependencies"
-  - package-ecosystem: gomod
-    directory: "/plugins/registry"
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 2
-    labels:
-      - "type: dependencies"
-  - package-ecosystem: gomod
-    directory: "/plugins/repo"
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 2
-    labels:
-      - "type: dependencies"
-  - package-ecosystem: gomod
-    directory: "/plugins/resource"
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 2
-    labels:
-      - "type: dependencies"
-  - package-ecosystem: gomod
-    directory: "/plugins/scheduler-docker-local"
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 2
-    labels:
-      - "type: dependencies"
-  - package-ecosystem: gomod
-    directory: "/plugins/scheduler-k3s"
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 2
-    labels:
-      - "type: dependencies"
-  - package-ecosystem: gomod
-    directory: "/plugins/scheduler"
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 2
+    open-pull-requests-limit: 10
+    groups:
+      kubernetes:
+        patterns:
+          - "k8s.io/*"
+          - "sigs.k8s.io/*"
+          - "helm.sh/*"
+      plugins:
+        group-by: dependency-name
+        exclude-patterns:
+          - "k8s.io/*"
+          - "sigs.k8s.io/*"
+          - "helm.sh/*"
     labels:
       - "type: dependencies"
   - package-ecosystem: "docker"
diff --git a/.github/linters/.markdown-lint.yml b/.github/linters/.markdown-lint.yml
index e16596c0a..5d0e3b14d 100644
--- a/.github/linters/.markdown-lint.yml
+++ b/.github/linters/.markdown-lint.yml
@@ -35,3 +35,8 @@ MD024: false
 # The issue template doesn't have one
 # https://github.com/DavidAnson/markdownlint/blob/main/doc/Rules.md#md041
 MD041: false
+
+# Table column style
+# The docs pad tables loosely rather than aligning every pipe
+# https://github.com/DavidAnson/markdownlint/blob/main/doc/Rules.md#md060
+MD060: false
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 44720039c..4d9642710 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -219,6 +219,19 @@ jobs:
           name: coverage.${{ matrix.index }}
           path: test-results/coverage
 
+  sudo-preserve-env:
+    name: sudo-preserve-env
+    runs-on: ubuntu-26.04
+    needs: check-commit
+    if: ${{ needs.check-commit.outputs.skip != 'true' }}
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: check that the preserved environment survives sudo-rs
+        run: ./tests/ci/sudo_preserve_env.sh
+
   publish-test-results:
     name: publish-test-results
     needs: unit-tests
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 092b9acee..ca9dbeee9 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -38,9 +38,9 @@ jobs:
           cache: 'npm'
           cache-dependency-path: '.github/workflows/lint.yml'
       - name: Install markdownlint-cli
-        run: npm install -g markdownlint-cli@0.35.0
+        run: npm install -g markdownlint-cli@0.50.0
       - name: Run markdown-lint
-        run: markdownlint -c .github/linters/.markdown-lint.yml *.md **/*.md
+        run: markdownlint -c .github/linters/.markdown-lint.yml --ignore tests/apps '**/*.md'
 
   packer:
     name: packer
diff --git a/HISTORY.md b/HISTORY.md
index 09e498cad..48ad2dd60 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,373 @@
 # History
 
+## 0.38.34
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.34/bootstrap.sh
+sudo DOKKU_TAG=v0.38.34 bash bootstrap.sh
+```
+
+### Bug Fixes
+
+- #9223: @josegonzalez Attach every network in attach-post-create
+
+### New Features
+
+- #9225: @josegonzalez Add --no-cache flag to ps:rebuild
+
+## 0.38.33
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.33/bootstrap.sh
+sudo DOKKU_TAG=v0.38.33 bash bootstrap.sh
+```
+
+### Bug Fixes
+
+- #9221: @fatihesergg Add missing wget dependency to Makefile for source installs
+
+### Documentation
+
+- #9212: @zackfern Delimit passed flags in dockerfile-start-cmd example with a double-dash
+
+### Tests
+
+- #9215: @josegonzalez chore(deps): drop unused packages from dockerfile-release lock
+- #9214: @dependabot[bot] chore(deps): bump body-parser from 2.3.0 to 2.4.0 in /tests/apps/checks-root in the npm_and_yarn group across 1 directory
+- #9206: @dependabot[bot] chore(deps): bump ruby from 4.0.7 to 4.0.9 in /tests/apps/dockerfile-entrypoint
+- #9203: @dependabot[bot] chore(deps): bump sass from 1.106.0 to 1.106.1 in /tests/apps/multi
+- #9197: @dependabot[bot] chore(deps): bump golang from 1.27.2 to 1.27.3 in /tests/apps/gogrpc
+- #9193: @dependabot[bot] chore(deps): bump golang from 1.27.2 to 1.27.3 in /tests/apps/go-fail-postdeploy
+- #9195: @dependabot[bot] chore(deps): bump golang from 1.27.2 to 1.27.3 in /tests/apps/go-fail-predeploy
+- #9194: @dependabot[bot] chore(deps): bump golang from 1.27.2 to 1.27.3 in /tests/apps/zombies-dockerfile-no-tini
+- #9192: @dependabot[bot] chore(deps): bump golang from 1.27.2 to 1.27.3 in /tests/apps/zombies-dockerfile-tini
+- #9191: @dependabot[bot] chore(deps-dev): bump heroku/heroku-buildpack-php from 298 to 299 in /tests/apps/php
+
+### Dependencies
+
+- #9220: @dokku-bot chore: bump dokku-update to 0.11.0
+- #9216: @josegonzalez chore(deps): upgrade go-jose to 4.1.6
+- #9210: @dependabot[bot] chore(deps): bump github.com/fluxcd/pkg/kustomize in /plugins/scheduler-k3s
+- #9209: @dependabot[bot] chore(deps): bump mkdocs-material from 9.7.7 to 9.8.0 in /docs/_build
+- #9208: @dependabot[bot] chore(deps): bump importlib-metadata from 9.0.1 to 10.1.0 in /docs/_build
+- #9207: @dependabot[bot] chore(deps): bump dokku/openresty-docker-proxy from 0.13.0 to 0.13.1 in /plugins/openresty-vhosts
+- #9204: @dependabot[bot] chore(deps): bump github.com/cert-manager/cert-manager in /plugins/scheduler-k3s
+- #9199: @dependabot[bot] chore(deps): bump traefik from v3.7.15 to v3.7.16 in /plugins/traefik-vhosts
+- #9202: @dependabot[bot] chore(deps): bump soupsieve from 3.0.3 to 3.0.4 in /docs/_build
+- #9201: @dependabot[bot] chore(deps): bump zipp from 4.1.1 to 4.1.2 in /docs/_build
+- #9198: @dependabot[bot] chore(deps): bump python-dateutil from 2.9.0.post0 to 3.0.0 in /docs/_build
+
+## 0.38.32
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.32/bootstrap.sh
+sudo DOKKU_TAG=v0.38.32 bash bootstrap.sh
+```
+
+### Bug Fixes
+
+- #9189: @josegonzalez Release deploy locks on exit and honor apps:lock
+- #9128: @sean0407 Forward forced cleanup flag (#9127)
+- #9182: @josegonzalez Read alternate image tags from the retired container
+- #9180: @josegonzalez Clean up stale extracted files on deploy
+- #9176: @byjg Haproxy letsencrypt integration and upgrade EasyHAProxy to 6.5.1
+- #9175: @josegonzalez Only clear the requested resource type
+- #9172: @josegonzalez Serialize concurrent property updates
+- #9169: @josegonzalez Accept all docker memory units in resource values
+- #9129: @josegonzalez Respect DOKKU_LIB_HOST_ROOT for storage bind mounts
+- #9130: @josegonzalez Preserve arguments such as --version and -n when running commands over SSH
+- #9148: @josegonzalez Do not retire an image that another app uses as its source image
+- #9131: @josegonzalez Keep the git source-image property in sync and harden the deploy lock
+- #9102: @josegonzalez Allow enabling nginx-vhosts when skipped at install
+
+### New Features
+
+- #9190: @josegonzalez Add a whole-set form and clear for chart overrides
+- #9152: @Schlepptop Make nginx-proxy-http-version configurable per app or globally
+- #9104: @josegonzalez Allow cron-entries to set a per-entry MAILTO
+
+### Documentation
+
+- #9132: @SatvikMishra08 Fix broken internal anchors and links
+- #9119: @fmtappendf Fix some typos in comment
+- #9116: @cevheri Add LibreDB Studio plugin to community plugin list
+
+### Tests
+
+- #9186: @dependabot[bot] chore(deps): bump sass from 1.105.2 to 1.106.0 in /tests/apps/multi
+- #9187: @dependabot[bot] chore(deps-dev): bump heroku/heroku-buildpack-php from 297 to 298 in /tests/apps/php
+- #9181: @josegonzalez Pause the retire timer during source image test
+- #9170: @josegonzalez Fix pre-existing gofmt and markdown lint issues
+- #9155: @dependabot[bot] chore(deps): bump golang from 1.27.1 to 1.27.2 in /tests/apps/zombies-dockerfile-no-tini
+- #9163: @dependabot[bot] chore(deps): bump sass from 1.105.1 to 1.105.2 in /tests/apps/multi
+- #9161: @dependabot[bot] chore(deps): bump golang from 1.27.1 to 1.27.2 in /tests/apps/gogrpc
+- #9160: @dependabot[bot] chore(deps): bump golang from 1.27.1 to 1.27.2 in /tests/apps/go-fail-predeploy
+- #9159: @dependabot[bot] chore(deps): bump golang from 1.27.1 to 1.27.2 in /tests/apps/zombies-dockerfile-tini
+- #9158: @dependabot[bot] chore(deps): bump golang from 1.27.1 to 1.27.2 in /tests/apps/go-fail-postdeploy
+- #9150: @dependabot[bot] chore(deps): bump python from 3.15.0rc3-bookworm to 3.15.0-bookworm in /tests/apps/dockerfile-release
+- #9145: @dependabot[bot] chore(deps): bump djangorestframework from 3.18.1 to 3.18.3 in /tests/apps/dockerfile-release
+- #9144: @dependabot[bot] chore(deps): bump express from 5.2.1 to 5.3.0 in /tests/apps/nodejs-express-noprocfile
+- #9143: @dependabot[bot] chore(deps): bump express from 5.2.1 to 5.3.0 in /tests/apps/nodejs-express-noappjson
+- #9141: @dependabot[bot] chore(deps): bump express from 5.2.1 to 5.3.0 in /tests/apps/nodejs-express
+- #9140: @dependabot[bot] chore(deps): bump express from 5.2.1 to 5.3.0 in /tests/apps/gitsubmodules
+- #9139: @dependabot[bot] chore(deps): bump python from 3.15.0rc2-bookworm to 3.15.0rc3-bookworm in /tests/apps/dockerfile-release
+- #9138: @dependabot[bot] chore(deps): bump express from 5.2.1 to 5.3.0 in /tests/apps/dockerfile-procfile-bad
+- #9135: @dependabot[bot] chore(deps): bump express from 5.2.1 to 5.3.0 in /tests/apps/checks-root
+- #9134: @dependabot[bot] chore(deps): bump express from 5.2.1 to 5.3.0 in /tests/apps/dockerfile-procfile
+- #9133: @dependabot[bot] chore(deps): bump express from 5.2.1 to 5.3.0 in /tests/apps/dockerfile-app-json-formations
+- #9115: @dependabot[bot] chore(deps): bump django from 5.2.17 to 5.2.18 in /tests/apps/dockerfile-release
+- #9113: @dependabot[bot] chore(deps): bump source-map-js from 1.2.1 to 1.2.2 in /tests/apps/multi in the npm_and_yarn group across 1 directory
+- #9112: @dependabot[bot] chore(deps): bump proxy-addr from 2.0.7 to 2.0.8 in /tests/apps/checks-root in the npm_and_yarn group across 1 directory
+- #9110: @dependabot[bot] chore(deps): bump sass from 1.105.0 to 1.105.1 in /tests/apps/multi
+- #9109: @dependabot[bot] chore(deps): bump monolog/monolog from 3.12.0 to 3.12.1 in /tests/apps/php
+- #9106: @dependabot[bot] chore(deps): bump werkzeug from 3.1.8 to 3.1.9 in /tests/apps/python-flask
+- #9091: @dependabot[bot] chore(deps): bump sass from 1.104.1 to 1.105.0 in /tests/apps/multi
+- #9086: @dependabot[bot] chore(deps-dev): bump heroku/heroku-buildpack-php from 295 to 297 in /tests/apps/php
+
+### Dependencies
+
+- #9184: @josegonzalez chore: group kubernetes dependency updates
+- #9183: @dokku-bot chore: bump herokuish to 0.11.21
+- #9177: @dependabot[bot] chore(deps): bump timberio/vector from 0.59.0-debian to 0.60.0-debian in /plugins/logs
+- #9179: @dependabot[bot] chore(deps): bump github.com/traefik/traefik/v2 in /plugins/scheduler-k3s
+- #9178: @dependabot[bot] chore(deps): update markdown requirement from <3.12,>=3.11.1 to >=3.11.2,<3.12 in /docs/_build
+- #9173: @dokku-bot chore: bump herokuish to 0.11.20
+- #9174: @dokku-bot chore: bump pack to 0.40.10
+- #9164: @dependabot[bot] chore(deps): bump github.com/fluxcd/pkg/kustomize in /plugins/scheduler-k3s
+- #9166: @dependabot[bot] chore(deps): bump helm.sh/helm/v3 in /plugins/scheduler-k3s
+- #9157: @dependabot[bot] chore(deps): update markdown requirement from <3.12,>=3.11 to >=3.11.1,<3.12 in /docs/_build
+- #9156: @dependabot[bot] chore(deps): bump pymdown-extensions from 12.2 to 12.3 in /docs/_build
+- #9167: @dependabot[bot] chore(deps): bump python from 3.15.0rc3-alpine to 3.16.0a1-alpine in /docs/_build
+- #9165: @dependabot[bot] chore(deps): bump github.com/traefik/traefik/v2 in /plugins/scheduler-k3s
+- #9162: @dependabot[bot] chore(deps): bump traefik from v3.7.14 to v3.7.15 in /plugins/traefik-vhosts
+- #9149: @dependabot[bot] chore(deps): bump soupsieve from 2.10 to 3.0.3 in /docs/_build
+- #9146: @dependabot[bot] chore(deps): bump golang.org/x/crypto in /plugins/common
+- #9142: @dependabot[bot] chore(deps): bump pymdown-extensions from 12.1 to 12.2 in /docs/_build
+- #9137: @dependabot[bot] chore(deps): bump traefik from v3.7.13 to v3.7.14 in /plugins/traefik-vhosts
+- #9136: @dependabot[bot] chore(deps): bump timberio/vector from 0.58.0-debian to 0.59.0-debian in /plugins/logs
+- #9125: @dokku-bot chore: bump herokuish to 0.11.19
+- #9123: @dependabot[bot] chore(deps): bump python from 3.15.0rc2-alpine to 3.15.0rc3-alpine in /docs/_build
+- #9124: @dependabot[bot] chore(deps): bump golang.org/x/sync in /plugins/common
+- #9121: @dependabot[bot] chore(deps): bump github.com/traefik/traefik/v2 in /plugins/scheduler-k3s
+- #9118: @dependabot[bot] chore(deps): bump zipp from 4.1.0 to 4.1.1 in /docs/_build
+- #9114: @dependabot[bot] chore(deps): bump markupsafe from 3.0.3 to 3.0.4 in /docs/_build
+- #9111: @dependabot[bot] chore(deps): bump sigs.k8s.io/kustomize/api in /plugins/scheduler-k3s
+- #9099: @dependabot[bot] chore(deps): bump k8s.io/kubernetes in /plugins/scheduler-k3s
+- #9098: @dependabot[bot] chore(deps): bump k8s.io/kubectl in /plugins/scheduler-k3s
+- #9094: @dependabot[bot] chore(deps): bump github.com/kedacore/keda/v2 in /plugins/scheduler-k3s
+- #9090: @dependabot[bot] chore(deps): bump soupsieve from 2.9.2 to 2.10 in /docs/_build
+- #9093: @dependabot[bot] chore(deps): bump github.com/go-openapi/jsonpointer in /plugins/scheduler-k3s
+- #9101: @dependabot[bot] chore(deps): bump dokku/openresty-docker-proxy from 0.12.1 to 0.13.0 in /plugins/openresty-vhosts
+- #9092: @dependabot[bot] chore(deps): bump github.com/onsi/gomega in /plugins/buildpacks
+- #9100: @dokku-bot chore: bump herokuish to 0.11.18
+- #9097: @dependabot[bot] chore(deps): bump k8s.io/client-go in /plugins/scheduler-k3s
+- #9089: @dependabot[bot] chore(deps): bump pymdown-extensions from 12.0.1 to 12.1 in /docs/_build
+- #9088: @dependabot[bot] chore(deps): update markdown requirement from <3.11,>=3.10.3 to >=3.11,<3.12 in /docs/_build
+
+## 0.38.31
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.31/bootstrap.sh
+sudo DOKKU_TAG=v0.38.31 bash bootstrap.sh
+```
+
+### Bug Fixes
+
+- #9084: @josegonzalez Report stored node-sysctls images globally
+- #9082: @josegonzalez Verify existing apps in git commands
+- #9081: @josegonzalez Validate run:logs arguments
+- #9080: @josegonzalez Check app directory when creating a new app
+- #9079: @josegonzalez Validate app name in app-scoped commands
+- #9077: @josegonzalez Respect quoting in procfile commands and remove support for bare shell operators
+- #9076: @josegonzalez Validate app.json healthcheck path and scheme
+
+### Dependencies
+
+- #9078: @dependabot[bot] chore(deps): bump pyparsing from 3.3.2 to 3.3.3 in /docs/_build
+
+## 0.38.30
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.30/bootstrap.sh
+sudo DOKKU_TAG=v0.38.30 bash bootstrap.sh
+```
+
+### New Features
+
+- #9074: @josegonzalez Allow storage:mount --replace to vary fields per mount
+- #9075: @josegonzalez Report each node-sysctls scope's stored map
+
+### Tests
+
+- #9071: @dependabot[bot] chore(deps): bump google.golang.org/grpc from 1.83.2 to 1.84.0 in /tests/apps/gogrpc
+
+## 0.38.29
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.29/bootstrap.sh
+sudo DOKKU_TAG=v0.38.29 bash bootstrap.sh
+```
+
+### Bug Fixes
+
+- #9060: @josegonzalez Preserve global flags when sudo is sudo-rs
+- #9055: @josegonzalez Validate nginx templates as the running nginx user
+- #9054: @josegonzalez Honor the pinned chart version when upgrading
+- #9049: @josegonzalez Report config write failures instead of exiting 0
+- #9050: @josegonzalez Reject negative process counts when scaling
+
+### New Features
+
+- #9058: @josegonzalez Add a whole-set form for an app's storage mounts
+- #9057: @josegonzalez Add a way to read back registry login state
+- #9051: @josegonzalez Add a whole-set form for scheduler-k3s metadata
+
+### Documentation
+
+- #9070: @s01ipsist Document Ubuntu 26.04 as a supported installation target
+
+### Tests
+
+- #9062: @josegonzalez Pass force to the datastore command that owns it
+- #9061: @josegonzalez Call the datastore create command the way it is documented
+
+### Dependencies
+
+- #9064: @dependabot[bot] chore: group gomod dependabot updates across all plugins
+- #9066: @dependabot[bot] chore(deps): bump github.com/onsi/gomega from 1.43.0 to 1.43.1 in /plugins/buildpacks
+- #9067: @dependabot[bot] chore(deps): bump github.com/fluxcd/pkg/kustomize from 1.40.0 to 1.41.0 in /plugins/scheduler-k3s
+- #9063: @dependabot[bot] chore(deps): bump pymdown-extensions from 12.0 to 12.0.1 in /docs/_build
+- #9068: @dependabot[bot] chore(deps): bump github.com/onsi/gomega from 1.43.0 to 1.43.1 in /plugins/scheduler-k3s
+- #9052: @dependabot[bot] chore(deps): bump pymdown-extensions from 11.0.2 to 12.0 in /docs/_build
+
+### Other
+
+- #9069: @josegonzalez Honor storage attachment process types at deploy time
+- #9011: @visheshgubrani Propagate command exit code on dokku run
+
+## 0.38.28
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.28/bootstrap.sh
+sudo DOKKU_TAG=v0.38.28 bash bootstrap.sh
+```
+
+### Bug Fixes
+
+- #9033: @mvysny Discard the build record git:sync starts when nothing is built
+- #9035: @vulragrag-star Fix builds:output exiting 0 for unknown build ids
+- #9010: @visheshgubrani Reject scheduler mismatch at mount time
+- #8975: @BetterAndBetterII Treat is_app_listening as a boolean, not a non-empty string
+- #8972: @josegonzalez Validate k3s profile names against derived release name
+- #8937: @josegonzalez Retire cron containers past their active deadline
+
+### New Features
+
+- #9047: @josegonzalez Release dokku on resolute
+- #8791: @akhil-naidu Add Ubuntu 26.04 LTS to bootstrap supported versions
+- #9003: @josegonzalez Distinct git:auth-status exit codes for netrc state
+- #9001: @josegonzalez Add --clear and --replace flags to ps:scale
+- #8996: @josegonzalez Add fingerprint and serial to certs:report
+
+### Documentation
+
+- #9036: @meteozond Add dokku-generic to community plugins
+
+### Tests
+
+- #9046: @dependabot[bot] chore(deps): bump ruby from 4.0.6 to 4.0.7 in /tests/apps/dockerfile-entrypoint
+- #9045: @dependabot[bot] chore(deps): bump sass from 1.104.0 to 1.104.1 in /tests/apps/multi
+- #9032: @dependabot[bot] chore(deps): bump djangorestframework from 3.18.0 to 3.18.1 in /tests/apps/dockerfile-release
+- #9038: @dependabot[bot] chore(deps): bump monolog/monolog from 3.11.0 to 3.12.0 in /tests/apps/php
+- #9040: @dependabot[bot] chore(deps): bump psycopg2-binary from 2.9.12 to 2.9.13 in /tests/apps/dockerfile-release
+- #9014: @dependabot[bot] chore(deps-dev): bump heroku/heroku-buildpack-php from 294 to 295 in /tests/apps/php
+- #9016: @dependabot[bot] chore(deps): bump slim/slim from 4.15.2 to 4.15.3 in /tests/apps/php
+- #9019: @dependabot[bot] chore(deps): bump sass from 1.103.1 to 1.104.0 in /tests/apps/multi
+- #9015: @dependabot[bot] chore(deps): bump monolog/monolog from 3.10.0 to 3.11.0 in /tests/apps/php
+- #9004: @dependabot[bot] chore(deps): bump qs from 6.15.2 to 6.16.0 in /tests/apps/checks-root
+- #9005: @dependabot[bot] chore(deps): bump golang from 1.27.0 to 1.27.1 in /tests/apps/gogrpc
+- #9006: @dependabot[bot] chore(deps): bump golang from 1.27.0 to 1.27.1 in /tests/apps/zombies-dockerfile-no-tini
+- #9007: @dependabot[bot] chore(deps): bump golang from 1.27.0 to 1.27.1 in /tests/apps/zombies-dockerfile-tini
+- #9008: @dependabot[bot] chore(deps): bump golang from 1.27.0 to 1.27.1 in /tests/apps/go-fail-predeploy
+- #9009: @dependabot[bot] chore(deps): bump golang from 1.27.0 to 1.27.1 in /tests/apps/go-fail-postdeploy
+- #8998: @dependabot[bot] chore(deps): bump python from 3.15.0rc1-bookworm to 3.15.0rc2-bookworm in /tests/apps/dockerfile-release
+- #8976: @dependabot[bot] chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /tests/apps/gogrpc
+- #8970: @dependabot[bot] chore(deps): bump gunicorn from 26.1.0 to 26.2.0 in /tests/apps/dockerfile-release
+- #8969: @dependabot[bot] chore(deps): bump gunicorn from 26.1.0 to 26.2.0 in /tests/apps/python-flask
+- #8968: @dependabot[bot] chore(deps): bump gunicorn from 26.1.0 to 26.2.0 in /tests/apps/multi
+- #8965: @dependabot[bot] chore(deps): bump sass from 1.102.0 to 1.103.1 in /tests/apps/multi
+- #8962: @dependabot[bot] chore(deps): bump golang from 1.26.6 to 1.27.0 in /tests/apps/go-fail-predeploy
+- #8961: @dependabot[bot] chore(deps): bump golang from 1.26.6 to 1.27.0 in /tests/apps/go-fail-postdeploy
+- #8960: @dependabot[bot] chore(deps): bump golang from 1.26.6 to 1.27.0 in /tests/apps/gogrpc
+- #8959: @dependabot[bot] chore(deps): bump golang from 1.26.6 to 1.27.0 in /tests/apps/zombies-dockerfile-tini
+- #8958: @dependabot[bot] chore(deps): bump golang from 1.26.6 to 1.27.0 in /tests/apps/zombies-dockerfile-no-tini
+- #8957: @dependabot[bot] chore(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1 in /tests/apps/gogrpc
+- #8954: @dependabot[bot] chore(deps): bump gunicorn from 26.0.0 to 26.1.0 in /tests/apps/dockerfile-release
+- #8952: @dependabot[bot] chore(deps): bump gunicorn from 26.0.0 to 26.1.0 in /tests/apps/multi
+- #8951: @dependabot[bot] chore(deps): bump gunicorn from 26.0.0 to 26.1.0 in /tests/apps/python-flask
+- #8943: @dependabot[bot] chore(deps): bump golang from 1.26.5 to 1.26.6 in /tests/apps/zombies-dockerfile-no-tini
+- #8944: @dependabot[bot] chore(deps): bump golang from 1.26.5 to 1.26.6 in /tests/apps/go-fail-postdeploy
+- #8942: @dependabot[bot] chore(deps): bump golang from 1.26.5 to 1.26.6 in /tests/apps/go-fail-predeploy
+- #8941: @dependabot[bot] chore(deps): bump golang from 1.26.5 to 1.26.6 in /tests/apps/gogrpc
+- #8940: @dependabot[bot] chore(deps): bump golang from 1.26.5 to 1.26.6 in /tests/apps/zombies-dockerfile-tini
+- #8947: @dependabot[bot] chore(deps): bump sqlparse from 0.5.5 to 0.6.0 in /tests/apps/dockerfile-release
+- #8939: @dependabot[bot] chore(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 in /tests/apps/gogrpc
+
+### Dependencies
+
+- #9027: @dependabot[bot] chore(deps): bump mvdan.cc/sh/v3 from 3.14.0 to 3.14.1 in /plugins/docker-options
+- #9039: @dependabot[bot] chore(deps): bump golang.org/x/crypto from 0.56.0 to 0.57.0 in /plugins/common
+- #9041: @dependabot[bot] chore(deps): bump helm.sh/helm/v3 from 3.21.4 to 3.22.0 in /plugins/scheduler-k3s
+- #9042: @dependabot[bot] chore(deps): bump github.com/cert-manager/cert-manager from 1.21.1 to 1.21.2 in /plugins/scheduler-k3s
+- #9028: @dependabot[bot] chore(deps): bump mvdan.cc/sh/v3 from 3.14.0 to 3.14.1 in /plugins/cron
+- #9023: @dependabot[bot] chore(deps): bump golang.org/x/sync from 0.22.0 to 0.23.0 in /plugins/common
+- #9017: @dependabot[bot] chore(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 in /plugins/common
+- #9029: @dependabot[bot] chore(deps): bump mvdan.cc/sh/v3 from 3.14.0 to 3.14.1 in /plugins/scheduler-k3s
+- #9026: @dokku-bot chore: bump herokuish to 0.11.17
+- #9024: @dependabot[bot] chore(deps): bump github.com/go-openapi/jsonpointer from 1.0.0 to 1.0.1 in /plugins/scheduler-k3s
+- #9025: @dependabot[bot] chore(deps): bump golang.org/x/sync from 0.22.0 to 0.23.0 in /plugins/scheduler-k3s
+- #8978: @dependabot[bot] chore(deps): bump github.com/onsi/gomega from 1.42.1 to 1.43.0 in /plugins/common
+- #8987: @dependabot[bot] chore(deps): bump mvdan.cc/sh/v3 from 3.13.1 to 3.14.0 in /plugins/cron
+- #9018: @dependabot[bot] chore(deps): bump traefik from v3.7.12 to v3.7.13 in /plugins/traefik-vhosts
+- #9020: @dependabot[bot] chore(deps): bump github.com/traefik/traefik/v2 from 2.11.56 to 2.11.57 in /plugins/scheduler-k3s
+- #9021: @dependabot[bot] chore(deps): bump github.com/onsi/gomega from 1.42.1 to 1.43.0 in /plugins/scheduler-k3s
+- #8988: @dependabot[bot] chore(deps): bump mvdan.cc/sh/v3 from 3.13.1 to 3.14.0 in /plugins/docker-options
+- #9013: @dependabot[bot] chore(deps): bump github.com/fluxcd/pkg/kustomize from 1.39.0 to 1.40.0 in /plugins/scheduler-k3s
+- #9012: @dependabot[bot] chore(deps): bump github.com/traefik/traefik/v2 from 2.11.55 to 2.11.56 in /plugins/scheduler-k3s
+- #8999: @dependabot[bot] chore(deps): bump k8s.io/kubectl from 0.36.4 to 0.37.0 in /plugins/scheduler-k3s
+- #8997: @dependabot[bot] chore(deps): bump python from 3.15.0rc1-alpine to 3.15.0rc2-alpine in /docs/_build
+- #8977: @dependabot[bot] chore(deps): bump github.com/onsi/gomega from 1.42.1 to 1.43.0 in /plugins/buildpacks
+- #8981: @dependabot[bot] chore(deps): bump timberio/vector from 0.57.0-debian to 0.58.0-debian in /plugins/logs
+- #8982: @dependabot[bot] chore(deps): bump traefik from v3.7.11 to v3.7.12 in /plugins/traefik-vhosts
+- #8980: @dependabot[bot] chore(deps): bump click from 8.4.2 to 8.5.0 in /docs/_build
+- #8983: @dependabot[bot] chore(deps): bump github.com/gofrs/flock from 0.13.0 to 0.13.1 in /plugins/ps
+- #8984: @dependabot[bot] chore(deps): bump k8s.io/kubernetes from 1.36.4 to 1.37.0 in /plugins/scheduler-k3s
+- #8985: @dependabot[bot] chore(deps): bump github.com/gofrs/flock from 0.13.0 to 0.13.1 in /plugins/scheduler-k3s
+- #8986: @dependabot[bot] chore(deps): bump importlib-metadata from 9.0.0 to 9.0.1 in /docs/_build
+- #8967: @dependabot[bot] chore(deps): bump pymdown-extensions from 11.0.1 to 11.0.2 in /docs/_build
+- #8966: @dependabot[bot] chore(deps): bump k8s.io/kubectl from 0.36.3 to 0.36.4 in /plugins/scheduler-k3s
+- #8964: @dependabot[bot] chore(deps): bump k8s.io/kubernetes from 1.36.3 to 1.36.4 in /plugins/scheduler-k3s
+- #8963: @dependabot[bot] chore(deps): bump traefik from v3.7.10 to v3.7.11 in /plugins/traefik-vhosts
+- #8953: @dependabot[bot] chore(deps): bump github.com/traefik/traefik/v2 from 2.11.54 to 2.11.55 in /plugins/scheduler-k3s
+- #8950: @dependabot[bot] chore(deps): bump pygments from 2.20.0 to 2.21.0 in /docs/_build
+- #8945: @dependabot[bot] chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 in /plugins/common
+- #8949: @dokku-bot chore: bump herokuish to 0.11.16
+- #8946: @dependabot[bot] chore(deps): bump helm.sh/helm/v3 from 3.21.3 to 3.21.4 in /plugins/scheduler-k3s
+
 ## 0.38.27
 
 Install/update via the bootstrap script:
@@ -8442,7 +8810,7 @@ sudo DOKKU_TAG=v0.13.1 bash bootstrap.sh
 - #3145: @josegonzalez Add report trigger
 - #3144: @josegonzalez Increase curl max timeout to 600 seconds (10 minutes)
 - #3107: @znz Remove unused password in ssl cert generation
-- #3095: @josegonzalez Migrate env for NGINX_* to PROXY_*
+- #3095: @josegonzalez Migrate env for `NGINX_*` to `PROXY_*`
 - #3140: @josegonzalez Add newline to config:get output
 - #3139: @josegonzalez Add ability to initialize a git repository out of band
 - #3111: @josegonzalez Upgrade herokuish to 0.4.0
@@ -9251,7 +9619,7 @@ Release 0.5.5 is mostly a documentation release, further clarifying how our defa
 
 We've also added a small section to the [dokku homepage](https://dokku.com/docs/) that lists the current core team. Feel free to look at their beautiful faces and imagine yourself contributing to Dokku and joining our core team. There are [quite a few ways to contribute](https://github.com/dokku/dokku/blob/master/CONTRIBUTING.md) - even without code/documentation - so feel more than free to jump on the bandwagon!
 
-Finally, we've started an [Official Dokku Blog](https://dokku.github.io/), where we will post about dokku internals, roadmaps, potential use-cases, etc. An rss feed is available [here](https://dokku.github.io/feed.xml).
+Finally, we've started an [Official Dokku Blog](https://dokku.github.io/), where we will post about dokku internals, roadmaps, potential use-cases, etc. An [rss feed](https://dokku.github.io/feed.xml) is available.
 
 Thanks to all the contributors who helped with this release!
 
@@ -9456,7 +9824,7 @@ Thanks to all the contributors who helped with this release!
 
 ## 0.4.12
 
-This is a small bugfix release, which will be the final release before the 0.5.x line. You can follow along on bugs/features we hope to cleanup for 0.5.x [here](https://github.com/dokku/dokku/milestones/v0.5.0).
+This is a small bugfix release, which will be the final release before the 0.5.x line. You can follow along on bugs/features we hope to cleanup in the [0.5.x milestone](https://github.com/dokku/dokku/milestones/v0.5.0).
 
 Thanks to all the contributors who helped with this release!
 
@@ -9955,7 +10323,7 @@ This release is a bugfix release covering dokku packaging.
 
 ## 0.3.23
 
-This release is a bugfix release mostly covering installation and nginx issues. As well, we launched a nicer documentation site [here](https://dokku.com/docs/). Thanks to all of our contributors for making this a great release!
+This release is a bugfix release mostly covering installation and nginx issues. As well, we launched a [nicer documentation site](https://dokku.com/docs/). Thanks to all of our contributors for making this a great release!
 
 ### Bug Fixes
 
diff --git a/Makefile b/Makefile
index f9d32cc31..60dfe0e14 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 DOKKU_VERSION ?= master
 
-TARGETARCH ?= amd64
+include common.mk
 
 DOCKER_IMAGE_LABELER_URL ?= $(shell jq -r --arg name docker-image-labeler --arg arch $(TARGETARCH) '.dependencies[] | select(.name == $$name) | .urls[$$arch]' contrib/dependencies.json)
 DOCKER_CONTAINER_HEALTHCHECKER_URL ?= $(shell jq -r --arg name docker-container-healthchecker  --arg arch $(TARGETARCH) '.dependencies[] | select(.name == $$name) | .urls[$$arch]' contrib/dependencies.json)
@@ -31,9 +31,7 @@ else
 	BUILD_STACK_TARGETS = build-in-docker
 endif
 
-include common.mk
-
-.PHONY: all apt-update install version copyfiles copyplugin man-db plugins dependencies docker-image-labeler lambda-builder netrc sshcommand procfile-util plugn docker aufs stack count vagrant-acl-add vagrant-dokku go-build
+.PHONY: all apt-update install version copyfiles copyplugin man-db plugins dependencies docker-image-labeler lambda-builder netrc sshcommand procfile-util plugn docker aufs stack count vagrant-acl-add vagrant-dokku go-build wget
 
 include docs.mk
 include tests.mk
@@ -126,17 +124,20 @@ else
 endif
 
 plugin-dependencies: plugn procfile-util
-	sudo -E dokku plugin:install-dependencies --core
+	sudo dokku plugin:install-dependencies --core
 
 plugins: plugn procfile-util docker
-	sudo -E dokku plugin:install --core
+	sudo dokku plugin:install --core
 
-dependencies: apt-update jq docker-image-labeler docker-container-healthchecker lambda-builder netrc sshcommand plugn procfile-util docker help2man man-db sigil dos2unix parallel
+dependencies: apt-update wget jq docker-image-labeler docker-container-healthchecker lambda-builder netrc sshcommand plugn procfile-util docker help2man man-db sigil dos2unix parallel
 	$(MAKE) -e stack
 
 apt-update:
 	apt-get update -qq
 
+wget:
+	apt-get -qq -y --no-install-recommends install wget
+
 parallel:
 	apt-get -qq -y --no-install-recommends install parallel
 
@@ -152,7 +153,7 @@ help2man:
 man-db:
 	apt-get -qq -y --no-install-recommends install man-db
 
-docker-image-labeler:
+docker-image-labeler: wget
 	wget -qO /usr/local/bin/docker-image-labeler ${DOCKER_IMAGE_LABELER_URL}
 	chmod +x /usr/local/bin/docker-image-labeler
 
diff --git a/README.md b/README.md
index 600f2a8ee..e00cad286 100644
--- a/README.md
+++ b/README.md
@@ -74,7 +74,7 @@ Support us with a monthly donation and help us continue our activities. [[Become
 
 A fresh VM running any of the following operating systems:
 
-- Ubuntu 22.04 / 24.04 (amd64/arm64) - Any currently supported release
+- Ubuntu 22.04 / 24.04 / 26.04 (amd64/arm64) - Any currently supported release
 - Debian 11+ (amd64/arm64)
 
 An SSH keypair that can be used for application deployment. If this exists before installation, it will be automatically imported into dokku.
@@ -85,8 +85,8 @@ Otherwise, you will need to import the keypair manually after installation using
 To install the latest stable release, run the following commands as a user who has access to `sudo`:
 
 ```shell
-wget -NP . https://dokku.com/install/v0.38.27/bootstrap.sh
-sudo DOKKU_TAG=v0.38.27 bash bootstrap.sh
+wget -NP . https://dokku.com/install/v0.38.34/bootstrap.sh
+sudo DOKKU_TAG=v0.38.34 bash bootstrap.sh
 ```
 
 You can then proceed to configure your server domain (via `dokku domains:set-global`) and user access (via `dokku ssh-keys:add`) to complete the installation.
diff --git a/Vagrantfile b/Vagrantfile
index 1c4552eaa..543a094be 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -9,7 +9,7 @@ DOKKU_IP = ENV["DOKKU_IP"] || "10.0.0.2"
 PREBUILT_STACK_URL = File.exist?("#{File.dirname(__FILE__)}/stack.tgz") ? 'file:///root/dokku/stack.tgz' : nil
 PUBLIC_KEY_PATH = "#{Dir.home}/.ssh/id_rsa.pub"
 
-make_cmd = "TARGETARCH=$(dpkg --print-architecture) DEBIAN_FRONTEND=noninteractive make -e install"
+make_cmd = "DEBIAN_FRONTEND=noninteractive make -e install"
 if PREBUILT_STACK_URL
   make_cmd = "PREBUILT_STACK_URL='#{PREBUILT_STACK_URL}' #{make_cmd}"
 end
diff --git a/bootstrap.sh b/bootstrap.sh
index b3653a756..cca2e0715 100755
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -1,18 +1,48 @@
 #!/usr/bin/env bash
+# shellcheck disable=SC2329
 set -eo pipefail
 [[ $TRACE ]] && set -x
 
 # A script to bootstrap dokku.
-# It expects to be run on Ubuntu 22.04/24.04 via 'sudo`
+# It expects to be run on Ubuntu 22.04/24.04/26.04 or Debian 11/12/13 via 'sudo'
 # If installing a tag higher than 0.3.13, it may install dokku via a package (so long as the package is higher than 0.3.13)
-# It checks out the dokku source code from GitHub into ~/dokku and then runs 'make install' from dokku source.
+# Otherwise it checks out the dokku source code from GitHub into ~/dokku and then runs 'make install' from dokku source.
+#
+# Output modes:
+# - fancy: stdout is a terminal; shows a spinner and a live tail of command output for the running step
+# - plain: stdout is not a terminal (CI, Vagrant, piping to a file); one line when each step starts and ends
+# - verbose: DOKKU_VERBOSE=1 or TRACE=1; streams all command output
+# All command output is also written to a timestamped log file under /var/log/dokku.
+# Set NO_COLOR=1 to disable colors.
 
 # We wrap this whole script in functions, so that we won't execute
 # until the entire script is downloaded.
 # That's good because it prevents our output overlapping with wget's.
 # It also means that we can't run a partially downloaded script.
 
-SUPPORTED_VERSIONS="Debian [11, 12, 13], Ubuntu [22.04, 24.04]"
+SUPPORTED_VERSIONS="Debian [11, 12, 13], Ubuntu [22.04, 24.04, 26.04]"
+DOKKU_DOCS_URL="https://dokku.com/docs"
+
+UI_MODE="plain"
+UI_COLOR="false"
+UI_UTF8="false"
+UI_WIDTH=80
+UI_TAIL_LINES=4
+UI_TMP=""
+UI_LOG_FILE=""
+UI_NOW=0
+UI_DURATION=""
+UI_SANITIZED=""
+UI_INSTALL_START=0
+UI_STEP_INDEX=0
+UI_STEP_TOTAL=0
+UI_STEP_TITLE=""
+UI_STEP_START=0
+UI_STEP_PID=""
+UI_FRAME=0
+UI_FRAME_DRAWN="false"
+UI_STEP_NAMES=()
+UI_STEP_DURATIONS=()
 
 log-fail() {
   declare desc="log fail formatter"
@@ -20,154 +50,8 @@ log-fail() {
   exit 1
 }
 
-ensure-environment() {
-  local FREE_MEMORY
-  if [[ -z "$DOKKU_TAG" ]]; then
-    echo "Preparing to install $DOKKU_REPO..."
-  else
-    echo "Preparing to install $DOKKU_TAG from $DOKKU_REPO..."
-  fi
-
-  hostname -f &>/dev/null || {
-    log-fail "This installation script requires that you have a hostname set for the instance. Please set a hostname for 127.0.0.1 in your /etc/hosts"
-  }
-
-  FREE_MEMORY=$(grep MemTotal /proc/meminfo | awk '{print $2}')
-  if [[ "$FREE_MEMORY" -lt 1003600 ]]; then
-    echo "For dokku to build containers, it is strongly suggested that you have 1024 megabytes or more of free memory"
-    echo "If necessary, please consult this document to setup swap: https://dokku.com/docs/getting-started/advanced-installation/#vms-with-less-than-1-gb-of-memory"
-  fi
-}
-
-install-requirements() {
-  echo "--> Ensuring we have the proper dependencies"
-
-  case "$DOKKU_DISTRO" in
-    debian)
-      if ! dpkg -l | grep -q gpg-agent; then
-        apt-get update -qq >/dev/null
-        apt-get -qq -y --no-install-recommends install gpg-agent
-      fi
-      if ! command -v lsb_release &>/dev/null; then
-        apt-get update -qq >/dev/null
-        apt-get -qq -y --no-install-recommends install lsb-release
-      fi
-      if [[ "$DOKKU_DISTRO_VERSION" -lt "13" ]]; then
-        if ! dpkg -l | grep -q software-properties-common; then
-          apt-get update -qq >/dev/null
-          apt-get -qq -y --no-install-recommends install software-properties-common
-        fi
-      fi
-      ;;
-    ubuntu)
-      if ! dpkg -l | grep -q gpg-agent; then
-        apt-get update -qq >/dev/null
-        apt-get -qq -y --no-install-recommends install gpg-agent
-      fi
-      if ! dpkg -l | grep -q software-properties-common; then
-        apt-get update -qq >/dev/null
-        apt-get -qq -y --no-install-recommends install software-properties-common
-      fi
-
-      add-apt-repository -y universe >/dev/null
-      apt-get update -qq >/dev/null
-      ;;
-  esac
-}
-
-install-dokku() {
-  if ! command -v dokku &>/dev/null; then
-    echo "--> Note: Installing dokku for the first time will result in removal of"
-    echo "    files in the nginx 'sites-enabled' directory. Please manually"
-    echo "    restore any files that may be removed after the installation and"
-    echo "    web setup is complete."
-    echo ""
-    echo "    Installation will continue in 10 seconds."
-    sleep 10
-  fi
-
-  if [[ -n $DOKKU_BRANCH ]]; then
-    install-dokku-from-source "origin/$DOKKU_BRANCH"
-  elif [[ -n $DOKKU_TAG ]]; then
-    local DOKKU_SEMVER="${DOKKU_TAG//v/}"
-    major=$(echo "$DOKKU_SEMVER" | awk '{split($0,a,"."); print a[1]}')
-    minor=$(echo "$DOKKU_SEMVER" | awk '{split($0,a,"."); print a[2]}')
-    patch=$(echo "$DOKKU_SEMVER" | awk '{split($0,a,"."); print a[3]}')
-
-    use_plugin=false
-    # 0.4.0 implemented a `plugin` plugin
-    if [[ "$major" -eq "0" ]] && [[ "$minor" -ge "4" ]] && [[ "$patch" -ge "0" ]]; then
-      use_plugin=true
-    elif [[ "$major" -ge "1" ]]; then
-      use_plugin=true
-    fi
-
-    # 0.3.13 was the first version with a debian package
-    if [[ "$major" -eq "0" ]] && [[ "$minor" -eq "3" ]] && [[ "$patch" -ge "13" ]]; then
-      install-dokku-from-package "$DOKKU_SEMVER"
-      echo "--> Running post-install dependency installation"
-      dokku plugins-install-dependencies
-    elif [[ "$use_plugin" == "true" ]]; then
-      install-dokku-from-package "$DOKKU_SEMVER"
-      echo "--> Running post-install dependency installation"
-      sudo -E dokku plugin:install-dependencies --core
-    else
-      install-dokku-from-source "$DOKKU_TAG"
-    fi
-  else
-    install-dokku-from-package
-    echo "--> Running post-install dependency installation"
-    sudo -E dokku plugin:install-dependencies --core
-  fi
-}
-
-install-dokku-from-source() {
-  local DOKKU_CHECKOUT="$1"
-
-  if ! command -v apt-get &>/dev/null; then
-    log-fail "This installation script requires apt-get. For manual installation instructions, consult https://dokku.com/docs/getting-started/advanced-installation/"
-  fi
-
-  apt-get -qq -y --no-install-recommends install sudo git make
-  case "$DOKKU_DISTRO" in
-    debian)
-      if [[ "$DOKKU_DISTRO_VERSION" -lt "13" ]]; then
-        if ! dpkg -l | grep -q software-properties-common; then
-          apt-get -qq -y --no-install-recommends install software-properties-common
-        fi
-      fi
-      ;;
-    ubuntu)
-      if ! dpkg -l | grep -q software-properties-common; then
-        apt-get -qq -y --no-install-recommends install software-properties-common
-      fi
-      ;;
-  esac
-
-  cd /root
-  if [[ ! -d /root/dokku ]]; then
-    git clone "$DOKKU_REPO" /root/dokku
-  fi
-
-  cd /root/dokku
-  git fetch origin
-  [[ -n $DOKKU_CHECKOUT ]] && git checkout "$DOKKU_CHECKOUT"
-  make install
-}
-
-install-dokku-from-package() {
-  case "$DOKKU_DISTRO" in
-    debian | ubuntu)
-      install-dokku-from-deb-package "$@"
-      ;;
-    *)
-      log-fail "Unsupported Linux distribution. For manual installation instructions, consult https://dokku.com/docs/getting-started/advanced-installation/"
-      ;;
-  esac
-}
-
 in-array() {
-  declare desc="return true if value ($1) is in list (all other arguments)"
+  declare desc="return true if value (\$1) is in list (all other arguments)"
 
   local e
   for e in "${@:2}"; do
@@ -176,74 +60,998 @@ in-array() {
   return 1
 }
 
-install-dokku-from-deb-package() {
-  local DOKKU_CHECKOUT="$1"
-  local NO_INSTALL_RECOMMENDS=${DOKKU_NO_INSTALL_RECOMMENDS:=""}
-  local OS_ID
-
-  if ! in-array "$DOKKU_DISTRO_VERSION" "22.04" "24.04" "10" "11" "12" "13"; then
-    log-fail "Unsupported Linux distribution. Only the following versions are supported: $SUPPORTED_VERSIONS"
+ui-now() {
+  declare desc="store the current time in microseconds in UI_NOW"
+  UI_NOW="${EPOCHREALTIME/[.,]/}"
+  if [[ -z "$UI_NOW" ]]; then
+    UI_NOW="$(date +%s)000000"
   fi
+}
+
+ui-format-duration() {
+  declare desc="store a human readable form of a microsecond duration in UI_DURATION"
+  local micros="$1" style="$2"
+  local tenths=$((micros / 100000)) seconds=$((micros / 1000000))
+
+  if [[ "$seconds" -lt 60 ]]; then
+    if [[ "$style" == "whole" ]]; then
+      UI_DURATION="${seconds}s"
+    else
+      UI_DURATION="$((tenths / 10)).$((tenths % 10))s"
+    fi
+  elif [[ "$seconds" -lt 3600 ]]; then
+    printf -v UI_DURATION '%dm %02ds' $((seconds / 60)) $((seconds % 60))
+  else
+    printf -v UI_DURATION '%dh %02dm' $((seconds / 3600)) $((seconds % 3600 / 60))
+  fi
+}
+
+ui-color() {
+  declare desc="print the escape sequence for a color role at a color depth"
+  local role="$1" depth="$2" truecolor xterm basic
+
+  case "$role" in
+    primary) truecolor="42;143;189" xterm=31 basic=34 ;;
+    teal) truecolor="7;203;207" xterm=44 basic=36 ;;
+    muted) truecolor="151;166;181" xterm=109 basic=2 ;;
+    success) truecolor="51;204;51" xterm=77 basic=32 ;;
+    warning) truecolor="255;215;0" xterm=220 basic=33 ;;
+    error) truecolor="236;99;80" xterm=203 basic=31 ;;
+  esac
+
+  case "$depth" in
+    24) printf '\033[38;2;%sm' "$truecolor" ;;
+    256) printf '\033[38;5;%sm' "$xterm" ;;
+    *) printf '\033[%sm' "$basic" ;;
+  esac
+}
+
+ui-color-depth() {
+  declare desc="print the color depth supported by the terminal"
+  local colors
+
+  case "$COLORTERM" in
+    truecolor | 24bit)
+      echo 24
+      return
+      ;;
+  esac
+
+  case "$TERM" in
+    *-direct* | xterm-ghostty | xterm-kitty | alacritty* | wezterm* | foot*)
+      echo 24
+      return
+      ;;
+    *256color*)
+      echo 256
+      return
+      ;;
+  esac
+
+  colors="$(tput colors 2>/dev/null || echo 0)"
+  if [[ "$colors" -ge 256 ]]; then
+    echo 256
+  else
+    echo 16
+  fi
+}
+
+ui-init-colors() {
+  declare desc="set the color escape sequences for the current terminal"
+  local depth
+
+  C_RESET="" C_BOLD="" C_PRIMARY="" C_TEAL="" C_MUTED="" C_SUCCESS="" C_WARNING="" C_ERROR=""
+  [[ "$UI_COLOR" == "true" ]] || return 0
+
+  depth="$(ui-color-depth)"
+  C_RESET=$'\033[0m'
+  C_BOLD=$'\033[1m'
+  C_PRIMARY="$(ui-color primary "$depth")"
+  C_TEAL="$(ui-color teal "$depth")"
+  C_MUTED="$(ui-color muted "$depth")"
+  C_SUCCESS="$(ui-color success "$depth")"
+  C_WARNING="$(ui-color warning "$depth")"
+  C_ERROR="$(ui-color error "$depth")"
+}
+
+ui-update-width() {
+  declare desc="store the terminal width in UI_WIDTH"
+  local size
+
+  size="$({ stty size </dev/tty; } 2>/dev/null || true)"
+  UI_WIDTH="${size#* }"
+  if [[ ! "$UI_WIDTH" =~ ^[0-9]+$ ]] || [[ "$UI_WIDTH" -lt 20 ]]; then
+    UI_WIDTH="${COLUMNS:-80}"
+  fi
+}
+
+ui-init() {
+  declare desc="pick the output mode, colors, glyphs, and log file"
+  local mode="$1" charset="${LC_ALL:-${LC_CTYPE:-$LANG}}"
+
+  if [[ -n "$mode" ]]; then
+    UI_MODE="$mode"
+  elif [[ -n "$TRACE" ]] || [[ -n "$DOKKU_VERBOSE" && "$DOKKU_VERBOSE" != "0" && "$DOKKU_VERBOSE" != "false" ]]; then
+    UI_MODE="verbose"
+  elif [[ -t 1 ]] && [[ -n "$TERM" ]] && [[ "$TERM" != "dumb" ]]; then
+    UI_MODE="fancy"
+  fi
+
+  if [[ "$UI_MODE" != "plain" ]] && [[ -t 1 ]] && [[ -z "$NO_COLOR" ]] && [[ "$TERM" != "dumb" ]]; then
+    UI_COLOR="true"
+  fi
+
+  shopt -s nocasematch
+  if [[ "$charset" =~ utf-?8 ]]; then
+    UI_UTF8="true"
+  fi
+  shopt -u nocasematch
+
+  if [[ "$UI_UTF8" == "true" ]]; then
+    UI_SPINNER=("⠋" "⠙" "⠹" "⠸" "⠼" "⠴" "⠦" "⠧" "⠇" "⠏")
+    UI_GLYPH_ELLIPSIS="…"
+  else
+    UI_SPINNER=("|" "/" "-" "\\")
+    UI_GLYPH_ELLIPSIS="..."
+  fi
+
+  ui-init-colors
+  ui-update-width
+  UI_TMP="$(mktemp -d)"
+  ui-init-log
+  ui-now
+  UI_INSTALL_START="$UI_NOW"
+
+  trap ui-cleanup EXIT
+  trap ui-interrupt INT TERM
+  if [[ "$UI_MODE" == "fancy" ]]; then
+    trap ui-update-width WINCH
+  fi
+}
+
+ui-init-log() {
+  declare desc="create the install log file"
+  local name
+
+  name="install-$(date +%Y%m%d-%H%M%S).log"
+  if mkdir -p /var/log/dokku 2>/dev/null && : >"/var/log/dokku/$name" 2>/dev/null; then
+    UI_LOG_FILE="/var/log/dokku/$name"
+  else
+    UI_LOG_FILE="${TMPDIR:-/tmp}/dokku-$name"
+    : >"$UI_LOG_FILE"
+  fi
+}
+
+ui-log() {
+  declare desc="write a timestamped line to the install log"
+  TZ=UTC0 printf '%(%Y-%m-%dT%H:%M:%SZ)T %s\n' -1 "$*" >>"$UI_LOG_FILE"
+}
+
+ui-cleanup() {
+  declare desc="stop any running step and restore the terminal"
+  ui-kill-step
+  if [[ "$UI_MODE" == "fancy" ]]; then
+    printf '\033[?25h'
+  fi
+  if [[ -n "$UI_TMP" ]]; then
+    rm -rf "$UI_TMP"
+  fi
+}
+
+ui-interrupt() {
+  declare desc="handle ctrl-c and termination signals"
+  trap - INT TERM
+  ui-kill-step
+  if [[ "$UI_MODE" == "fancy" ]] && [[ "$UI_FRAME_DRAWN" == "true" ]]; then
+    printf '\r\033[J'
+  fi
+  ui-log "==> install interrupted"
+  ui-error "Installation interrupted"
+  ui-error "Full log: $UI_LOG_FILE"
+  exit 130
+}
+
+ui-process-tree() {
+  declare desc="print a process and all of its descendants"
+  local pid="$1" child children=""
+
+  echo "$pid"
+  children="$(cat /proc/"$pid"/task/*/children 2>/dev/null || pgrep -P "$pid" 2>/dev/null || true)"
+  for child in $children; do
+    ui-process-tree "$child"
+  done
+}
+
+ui-kill-step() {
+  declare desc="kill the running step and everything it started"
+  local pid pids=() child
+
+  [[ -n "$UI_STEP_PID" ]] || return 0
+  for child in $(cat /proc/$$/task/*/children 2>/dev/null || pgrep -P $$ 2>/dev/null || true); do
+    while read -r pid; do
+      pids+=("$pid")
+    done < <(ui-process-tree "$child")
+  done
+  if [[ "${#pids[@]}" -gt 0 ]]; then
+    kill "${pids[@]}" 2>/dev/null || true
+  fi
+  UI_STEP_PID=""
+}
+
+ui-info1() {
+  declare desc="print a step line in the style of dokku_log_info1"
+  printf '%s----->%s %s\n' "$C_PRIMARY" "$C_RESET" "$*"
+}
+
+ui-info2() {
+  declare desc="print a heading in the style of dokku_log_info2"
+  printf '%s=====>%s %s\n' "$C_PRIMARY" "$C_RESET" "$*"
+}
+
+ui-verbose() {
+  declare desc="print an indented line in the style of dokku_log_verbose"
+  printf '       %s\n' "$*"
+}
+
+ui-muted() {
+  declare desc="print an indented, muted line"
+  printf '       %s%s%s\n' "$C_MUTED" "$*" "$C_RESET"
+}
+
+ui-warn() {
+  declare desc="print a warning in the style of dokku_log_warn"
+  printf '%s !     %s%s\n' "$C_WARNING" "$*" "$C_RESET"
+}
+
+ui-error() {
+  declare desc="print an error in the style of dokku_log_fail"
+  printf '%s !     %s%s\n' "$C_ERROR" "$*" "$C_RESET"
+}
+
+ui-header() {
+  declare desc="print the installer header"
+  local target="$1" os="$2"
+
+  ui-info2 "${C_BOLD}Installing $target on $os${C_RESET}"
+  ui-muted "Log file: $UI_LOG_FILE"
+  ui-log "==> installing $target on $os"
+}
+
+ui-truncate() {
+  declare desc="truncate text to a maximum number of characters"
+  local text="$1" max="$2"
+
+  if [[ "$max" -le 0 ]]; then
+    echo ""
+  elif [[ "${#text}" -gt "$max" ]]; then
+    echo "${text:0:max-1}${UI_GLYPH_ELLIPSIS:0:1}"
+  else
+    echo "$text"
+  fi
+}
+
+ui-step-name() {
+  declare desc="print the counter and title of the running step"
+  printf '%s[%s/%s]%s %s%s%s' "$C_MUTED" "$UI_STEP_INDEX" "$UI_STEP_TOTAL" "$C_RESET" "$C_BOLD" "$UI_STEP_TITLE" "$C_RESET"
+}
+
+ui-draw-frame() {
+  declare desc="draw the running step and its live output"
+  local spinner lines=() line width
+
+  ui-now
+  ui-format-duration $((UI_NOW - UI_STEP_START)) whole
+  spinner="${UI_SPINNER[UI_FRAME % ${#UI_SPINNER[@]}]}"
+  UI_FRAME=$((UI_FRAME + 1))
+  width=$((UI_WIDTH - 1))
+
+  if [[ "$UI_TAIL_LINES" -gt 0 ]] && [[ -s "$UI_TMP/step.tail" ]]; then
+    mapfile -t lines < <(tail -n "$UI_TAIL_LINES" "$UI_TMP/step.tail")
+  fi
+
+  printf '\r%s----%s%s  ' "$C_PRIMARY" "$spinner" "$C_RESET"
+  ui-step-name
+  printf ' %s(%s)%s\033[K' "$C_MUTED" "$UI_DURATION" "$C_RESET"
+  for line in "${lines[@]}"; do
+    line="$(ui-truncate "$line" $((width - 7)))"
+    printf '\n       %s%s%s\033[K' "$C_MUTED" "$line" "$C_RESET"
+  done
+  printf '\033[J'
+
+  if [[ "${#lines[@]}" -gt 0 ]]; then
+    printf '\033[%dA' "${#lines[@]}"
+  fi
+  printf '\r'
+  UI_FRAME_DRAWN="true"
+}
+
+ui-stream() {
+  declare desc="timestamp step output into the log, the live tail, and verbose output"
+  local start="$1" line display
+
+  while IFS= read -r line || [[ -n "$line" ]]; do
+    line="${line%$'\r'}"
+    line="${line##*$'\r'}"
+    ui-sanitize "$line"
+    display="$UI_SANITIZED"
+    ui-now
+    ui-format-duration $((UI_NOW - start))
+    TZ=UTC0 printf '%(%Y-%m-%dT%H:%M:%SZ)T %s\n' -1 "$line" >>"$UI_LOG_FILE"
+    printf '%s\n' "$display" >>"$UI_TMP/step.raw"
+    printf '+%s %s\n' "$UI_DURATION" "$display" >>"$UI_TMP/step.tail"
+    if [[ "$UI_MODE" == "verbose" ]]; then
+      printf '       %s+%s%s %s\n' "$C_MUTED" "$UI_DURATION" "$C_RESET" "$display"
+    fi
+  done
+}
+
+ui-sanitize() {
+  declare desc="store a line without escape sequences or control characters in UI_SANITIZED"
+  local line="$1" pattern=$'\033''\[[0-9;?]*[A-Za-z]'
+
+  line="${line//$'\t'/    }"
+  while [[ "$line" =~ $pattern ]]; do
+    line="${line/"${BASH_REMATCH[0]}"/}"
+  done
+  UI_SANITIZED="${line//[[:cntrl:]]/}"
+}
+
+ui-result() {
+  declare desc="record a piece of the finished step's detail text"
+  echo "$*" >>"$UI_TMP/step.result"
+}
+
+ui-note() {
+  declare desc="record a warning shown under the current step"
+  echo "$*" >>"$UI_TMP/step.notes"
+}
+
+ui-summary-note() {
+  declare desc="record a warning shown at the end of the install"
+  local line
+  for line in "$@"; do
+    echo "$line" >>"$UI_TMP/summary.notes"
+  done
+  echo "" >>"$UI_TMP/summary.notes"
+}
+
+ui-run() {
+  declare desc="print a command and run it"
+  echo "\$ $*"
+  "$@"
+}
+
+ui-action() {
+  declare desc="run a command as a timed part of a step"
+  local label="$1" start
+  shift
+
+  ui-now
+  start="$UI_NOW"
+  "$@"
+  ui-now
+  ui-format-duration $((UI_NOW - start))
+  ui-result "$label $UI_DURATION"
+}
+
+ui-join() {
+  declare desc="join lines from a file with commas"
+  local file="$1" line output=""
+
+  [[ -s "$file" ]] || return 0
+  while IFS= read -r line; do
+    if [[ -z "$output" ]]; then
+      output="$line"
+    else
+      output="$output, $line"
+    fi
+  done <"$file"
+  echo "$output"
+}
+
+ui-step() {
+  declare desc="run a function as a numbered install step"
+  local title="$1" detail="$2" rc=1 duration result line
+  shift 2
+
+  UI_STEP_INDEX=$((UI_STEP_INDEX + 1))
+  UI_STEP_TITLE="$title"
+  UI_FRAME=0
+  UI_FRAME_DRAWN="false"
+  : >"$UI_TMP/step.tail"
+  : >"$UI_TMP/step.raw"
+  : >"$UI_TMP/step.result"
+  : >"$UI_TMP/step.notes"
+  rm -f "$UI_TMP/step.rc"
+
+  ui-log "==> step start [$UI_STEP_INDEX/$UI_STEP_TOTAL] $title"
+  if [[ "$UI_MODE" == "fancy" ]]; then
+    printf '\033[?25l'
+  else
+    ui-info1 "$(ui-step-name)"
+  fi
+
+  ui-now
+  UI_STEP_START="$UI_NOW"
+  {
+    set +e
+    (
+      set -e
+      "$@"
+    ) </dev/null 2>&1
+    echo "$?" >"$UI_TMP/step.rc"
+  } | ui-stream "$UI_STEP_START" &
+  UI_STEP_PID="$!"
+
+  if [[ "$UI_MODE" == "fancy" ]]; then
+    while kill -0 "$UI_STEP_PID" 2>/dev/null; do
+      ui-draw-frame
+      sleep 0.1
+    done
+  fi
+  wait "$UI_STEP_PID" || true
+  UI_STEP_PID=""
+  if [[ -s "$UI_TMP/step.rc" ]]; then
+    rc="$(<"$UI_TMP/step.rc")"
+  fi
+
+  ui-now
+  ui-format-duration $((UI_NOW - UI_STEP_START))
+  duration="$UI_DURATION"
+  UI_STEP_NAMES+=("$title")
+  UI_STEP_DURATIONS+=($((UI_NOW - UI_STEP_START)))
+  ui-log "==> step end [$UI_STEP_INDEX/$UI_STEP_TOTAL] $title ($duration, exit $rc)"
+  result="$(ui-join "$UI_TMP/step.result")"
+  result="${result:-$detail}"
+
+  if [[ "$UI_MODE" == "fancy" ]]; then
+    printf '\r\033[J\033[?25h'
+    if [[ "$rc" == "0" ]]; then
+      ui-info1 "$(ui-step-name) $C_MUTED($duration)$C_RESET"
+      [[ -z "$result" ]] || ui-muted "$result"
+    fi
+  elif [[ "$rc" == "0" ]]; then
+    ui-muted "${result:+$result }($duration)"
+  fi
+
+  if [[ -s "$UI_TMP/step.notes" ]]; then
+    while IFS= read -r line; do
+      ui-warn "$line"
+    done <"$UI_TMP/step.notes"
+  fi
+
+  if [[ "$rc" != "0" ]]; then
+    ui-fail "$title" "$duration"
+  fi
+}
+
+ui-fail() {
+  declare desc="print the output of a failed step and exit"
+  local title="$1" duration="$2" line
+
+  ui-error "[$UI_STEP_INDEX/$UI_STEP_TOTAL] $title failed after $duration. Output from this step:"
+  while IFS= read -r line; do
+    ui-verbose "$line"
+  done <"$UI_TMP/step.raw"
+  ui-error "Full log: $UI_LOG_FILE"
+  ui-error "Help: $DOKKU_DOCS_URL/getting-started/troubleshooting/"
+  ui-log "==> install failed"
+  exit 1
+}
+
+ui-countdown() {
+  declare desc="show a warning and wait before continuing"
+  local short="$1" seconds="$2" remaining line count=0
+  shift 2
+
+  ui-log "==> notice: $short (waiting ${seconds}s)"
+  ui-warn "$1"
+  for line in "${@:2}"; do
+    printf '%s       %s%s\n' "$C_WARNING" "$line" "$C_RESET"
+    count=$((count + 1))
+  done
+
+  if [[ "$UI_MODE" != "fancy" ]]; then
+    printf '%s       Continuing in %ss...%s\n' "$C_WARNING" "$seconds" "$C_RESET"
+    sleep "$seconds"
+    return 0
+  fi
+
+  printf '\033[?25l'
+  for ((remaining = seconds; remaining > 0; remaining--)); do
+    printf '\r%s       Continuing in %ss%s%s\033[K' "$C_WARNING" "$remaining" "$UI_GLYPH_ELLIPSIS" "$C_RESET"
+    sleep 1
+  done
+  printf '\033[%dA\r\033[J' $((count + 1))
+  ui-warn "$short Waited ${seconds}s."
+  printf '\033[?25h'
+}
+
+ui-slowest-steps() {
+  declare desc="print the three slowest steps"
+  local i j output="" picked=() slowest
+
+  for ((j = 0; j < 3 && j < ${#UI_STEP_NAMES[@]}; j++)); do
+    slowest=-1
+    for i in "${!UI_STEP_NAMES[@]}"; do
+      in-array "$i" "${picked[@]}" && continue
+      if [[ "$slowest" -lt 0 ]] || [[ "${UI_STEP_DURATIONS[i]}" -gt "${UI_STEP_DURATIONS[slowest]}" ]]; then
+        slowest="$i"
+      fi
+    done
+    picked+=("$slowest")
+    ui-format-duration "${UI_STEP_DURATIONS[slowest]}"
+    [[ -z "$output" ]] || output+=", "
+    output+="${UI_STEP_NAMES[slowest]} $UI_DURATION"
+  done
+  echo "$output"
+}
+
+ui-summary() {
+  declare desc="print the install summary"
+  local version="$1" domain="$2" keys="$3" host="$4" total line first="true"
+
+  ui-now
+  ui-format-duration $((UI_NOW - UI_INSTALL_START))
+  total="$UI_DURATION"
+
+  ui-info2 "${C_TEAL}${C_BOLD}Dokku $version installed in $total${C_RESET}"
+  ui-verbose "$(printf '%-15s %s' "Global domain:" "${domain:-not set}")"
+  ui-verbose "$(printf '%-15s %s' "SSH keys:" "${keys:-none}")"
+  ui-verbose "$(printf '%-15s %s' "Slowest steps:" "$(ui-slowest-steps)")"
+  ui-verbose "$(printf '%-15s %s' "Log file:" "$UI_LOG_FILE")"
+  ui-info2 "Deploy an app"
+  ui-verbose "git remote add dokku dokku@$host:my-app"
+  ui-verbose "git push dokku main"
+
+  if [[ -s "$UI_TMP/summary.notes" ]]; then
+    while IFS= read -r line; do
+      if [[ -z "$line" ]]; then
+        first="true"
+      elif [[ "$first" == "true" ]]; then
+        ui-warn "$line"
+        first="false"
+      else
+        ui-verbose "$line"
+      fi
+    done <"$UI_TMP/summary.notes"
+  fi
+  ui-log "==> install complete ($total)"
+}
+
+fetch-url() {
+  declare desc="download a url to stdout with curl or wget"
+  local url="$1"
+
+  if command -v curl &>/dev/null; then
+    curl -fsSL "$url"
+  elif command -v wget &>/dev/null; then
+    wget -nv -O - "$url"
+  else
+    log-fail "This installation script requires curl or wget"
+  fi
+}
+
+package-installed() {
+  declare desc="return true if a debian package is installed"
+  local package="$1"
+  dpkg-query -W -f='${Status}' "$package" 2>/dev/null | grep -q "ok installed"
+}
+
+docker-version() {
+  declare desc="print the installed docker version"
+  local version
+
+  version="$(docker --version 2>/dev/null || true)"
+  version="${version#Docker version }"
+  version="${version%%,*}"
+  echo "v$version"
+}
+
+dokku-os-id() {
+  declare desc="print the apt codename used for the dokku package repository"
+  local os_id
+
+  os_id="$(lsb_release -cs 2>/dev/null || echo "noble")"
+  if ! in-array "$DOKKU_DISTRO" "debian" "ubuntu" "raspbian"; then
+    echo "noble"
+  elif [[ "$DOKKU_DISTRO" == "ubuntu" ]]; then
+    in-array "$os_id" "jammy" "noble" && echo "$os_id" || echo "noble"
+  else
+    in-array "$os_id" "bullseye" "bookworm" "trixie" && echo "$os_id" || echo "bookworm"
+  fi
+}
+
+required-packages() {
+  declare desc="print the packages the installer needs on this distribution"
+  case "$DOKKU_DISTRO" in
+    debian)
+      if [[ "$DOKKU_DISTRO_VERSION" -lt "13" ]]; then
+        echo "gpg-agent lsb-release software-properties-common"
+      else
+        echo "gpg-agent lsb-release"
+      fi
+      ;;
+    ubuntu)
+      echo "gpg-agent software-properties-common"
+      ;;
+  esac
+}
+
+resolve-install-method() {
+  declare desc="decide whether to install from a package or from source"
+  local semver major minor patch use_plugin=false
+
+  DOKKU_INSTALL_METHOD="package"
+  DOKKU_PACKAGE_VERSION=""
+  DOKKU_SOURCE_CHECKOUT=""
+  DOKKU_DEPENDENCIES_COMMAND="plugin:install-dependencies"
+
+  if [[ -n $DOKKU_BRANCH ]]; then
+    DOKKU_INSTALL_METHOD="source"
+    DOKKU_SOURCE_CHECKOUT="origin/$DOKKU_BRANCH"
+    return 0
+  fi
+
+  [[ -n $DOKKU_TAG ]] || return 0
+
+  semver="${DOKKU_TAG//v/}"
+  major=$(echo "$semver" | awk '{split($0,a,"."); print a[1]}')
+  minor=$(echo "$semver" | awk '{split($0,a,"."); print a[2]}')
+  patch=$(echo "$semver" | awk '{split($0,a,"."); print a[3]}')
+
+  if [[ "$major" -eq "0" ]] && [[ "$minor" -ge "4" ]] && [[ "$patch" -ge "0" ]]; then
+    use_plugin=true
+  elif [[ "$major" -ge "1" ]]; then
+    use_plugin=true
+  fi
+
+  if [[ "$major" -eq "0" ]] && [[ "$minor" -eq "3" ]] && [[ "$patch" -ge "13" ]]; then
+    DOKKU_PACKAGE_VERSION="$semver"
+    DOKKU_DEPENDENCIES_COMMAND="plugins-install-dependencies"
+  elif [[ "$use_plugin" == "true" ]]; then
+    DOKKU_PACKAGE_VERSION="$semver"
+  else
+    DOKKU_INSTALL_METHOD="source"
+    DOKKU_SOURCE_CHECKOUT="$DOKKU_TAG"
+  fi
+}
+
+check-environment() {
+  declare desc="check the host for install requirements"
+  local memory
+
+  hostname -f &>/dev/null || {
+    log-fail "This installation script requires that you have a hostname set for the instance. Please set a hostname for 127.0.0.1 in your /etc/hosts"
+  }
+  echo "hostname: $(hostname -f)"
+
+  if [[ "$DOKKU_INSTALL_METHOD" == "package" ]]; then
+    if ! in-array "$DOKKU_DISTRO_VERSION" "22.04" "24.04" "26.04" "10" "11" "12" "13"; then
+      log-fail "Unsupported Linux distribution. Only the following versions are supported: $SUPPORTED_VERSIONS"
+    fi
+  fi
+
+  memory=$(grep MemTotal /proc/meminfo | awk '{print $2}')
+  echo "memory: $memory kB"
+  if [[ "$memory" -lt 1003600 ]]; then
+    ui-note "Less than 1024MB of memory. Builds may fail without swap."
+    ui-summary-note "Less than 1024MB of memory. Add swap before building apps:" "$DOKKU_DOCS_URL/getting-started/advanced-installation/#vms-with-less-than-1-gb-of-memory"
+  fi
+}
+
+enable-universe() {
+  declare desc="enable the ubuntu universe repository"
+  ui-run add-apt-repository -y universe
+  ui-run apt-get update -qq
+}
+
+install-requirements() {
+  declare desc="install the packages the installer depends on"
+  local missing=() package
+
+  for package in $(required-packages); do
+    if [[ "$package" == "lsb-release" ]]; then
+      command -v lsb_release &>/dev/null || missing+=("$package")
+    elif ! package-installed "$package"; then
+      missing+=("$package")
+    fi
+  done
+
+  if [[ "${#missing[@]}" -gt 0 ]]; then
+    ui-action "apt update" ui-run apt-get update -qq
+    ui-action "packages" ui-run apt-get -qq -y --no-install-recommends install "${missing[@]}"
+  else
+    ui-result "packages already installed"
+  fi
+
+  if [[ "$DOKKU_DISTRO" == "ubuntu" ]]; then
+    ui-action "universe" enable-universe
+  fi
+}
+
+install-docker() {
+  declare desc="install docker via get.docker.com"
+  if command -v docker &>/dev/null; then
+    echo "docker already installed: $(docker --version)"
+    ui-result "already installed $(docker-version)"
+    return 0
+  fi
+
+  export CHANNEL=stable
+  echo "\$ fetch https://get.docker.com/ | sh"
+  fetch-url https://get.docker.com/ | sh
+  ui-result "$(docker-version)"
+  ui-result "get.docker.com"
+}
+
+add-dokku-repository() {
+  declare desc="add the dokku apt repository"
+  local os_id
+
+  case "$DOKKU_DISTRO" in
+    debian | ubuntu) ;;
+    *)
+      log-fail "Unsupported Linux distribution. For manual installation instructions, consult $DOKKU_DOCS_URL/getting-started/advanced-installation/"
+      ;;
+  esac
+
+  os_id="$(dokku-os-id)"
+  echo "\$ fetch https://packagecloud.io/dokku/dokku/gpgkey > /etc/apt/trusted.gpg.d/dokku.asc"
+  fetch-url https://packagecloud.io/dokku/dokku/gpgkey | sudo tee /etc/apt/trusted.gpg.d/dokku.asc
+  echo "deb https://packagecloud.io/dokku/dokku/$DOKKU_DISTRO/ $os_id main" | tee /etc/apt/sources.list.d/dokku.list
+  ui-run apt-get update -qq
+}
+
+install-dokku-package() {
+  declare desc="install the dokku debian package"
+  local version="$1"
+  local NO_INSTALL_RECOMMENDS=${DOKKU_NO_INSTALL_RECOMMENDS:=""}
 
   if [[ -n $DOKKU_DOCKERFILE ]]; then
     NO_INSTALL_RECOMMENDS=" --no-install-recommends "
   fi
 
-  if ! command -v docker &>/dev/null; then
-    echo "--> Installing docker"
-    if uname -r | grep -q linode; then
-      echo "--> NOTE: Using Linode? Docker may complain about missing AUFS support."
-      echo "    You can safely ignore this warning."
-      echo ""
-      echo "    Installation will continue in 10 seconds."
-      sleep 10
-    fi
-    export CHANNEL=stable
-    wget -nv -O - https://get.docker.com/ | sh
+  if [[ -n $DOKKU_VHOST_ENABLE ]]; then
+    echo "dokku dokku/vhost_enable boolean $DOKKU_VHOST_ENABLE" | sudo debconf-set-selections
+  fi
+  if [[ -n $DOKKU_HOSTNAME ]]; then
+    echo "dokku dokku/hostname string $DOKKU_HOSTNAME" | sudo debconf-set-selections
+  fi
+  if [[ -n $DOKKU_SKIP_KEY_FILE ]]; then
+    echo "dokku dokku/skip_key_file boolean $DOKKU_SKIP_KEY_FILE" | sudo debconf-set-selections
+  fi
+  if [[ -n $DOKKU_KEY_FILE ]]; then
+    echo "dokku dokku/key_file string $DOKKU_KEY_FILE" | sudo debconf-set-selections
+  fi
+  if [[ -n $DOKKU_NGINX_ENABLE ]]; then
+    echo "dokku dokku/nginx_enable string $DOKKU_NGINX_ENABLE" | sudo debconf-set-selections
   fi
 
-  OS_ID="$(lsb_release -cs 2>/dev/null || echo "noble")"
-  if ! in-array "$DOKKU_DISTRO" "debian" "ubuntu" "raspbian"; then
-    DOKKU_DISTRO="ubuntu"
-    OS_ID="noble"
-  fi
-
-  if [[ "$DOKKU_DISTRO" == "ubuntu" ]]; then
-    OS_IDS=("jammy" "noble")
-    if ! in-array "$OS_ID" "${OS_IDS[@]}"; then
-      OS_ID="noble"
-    fi
-  elif [[ "$DOKKU_DISTRO" == "debian" ]]; then
-    OS_IDS=("bullseye" "bookworm" "trixie")
-    if ! in-array "$OS_ID" "${OS_IDS[@]}"; then
-      OS_ID="bookworm"
-    fi
-  elif [[ "$DOKKU_DISTRO" == "raspbian" ]]; then
-    OS_IDS=("bullseye" "bookworm" "trixie")
-    if ! in-array "$OS_ID" "${OS_IDS[@]}"; then
-      OS_ID="bookworm"
-    fi
-  fi
-
-  echo "--> Installing dokku"
-  wget -qO- https://packagecloud.io/dokku/dokku/gpgkey | sudo tee /etc/apt/trusted.gpg.d/dokku.asc
-  echo "deb https://packagecloud.io/dokku/dokku/$DOKKU_DISTRO/ $OS_ID main" | tee /etc/apt/sources.list.d/dokku.list
-  apt-get update -qq >/dev/null
-
-  [[ -n $DOKKU_VHOST_ENABLE ]] && echo "dokku dokku/vhost_enable boolean $DOKKU_VHOST_ENABLE" | sudo debconf-set-selections
-  [[ -n $DOKKU_HOSTNAME ]] && echo "dokku dokku/hostname string $DOKKU_HOSTNAME" | sudo debconf-set-selections
-  [[ -n $DOKKU_SKIP_KEY_FILE ]] && echo "dokku dokku/skip_key_file boolean $DOKKU_SKIP_KEY_FILE" | sudo debconf-set-selections
-  [[ -n $DOKKU_KEY_FILE ]] && echo "dokku dokku/key_file string $DOKKU_KEY_FILE" | sudo debconf-set-selections
-  [[ -n $DOKKU_NGINX_ENABLE ]] && echo "dokku dokku/nginx_enable string $DOKKU_NGINX_ENABLE" | sudo debconf-set-selections
-
-  if [[ -n $DOKKU_CHECKOUT ]]; then
-    apt-get -qq -y $NO_INSTALL_RECOMMENDS install "dokku=$DOKKU_CHECKOUT"
+  if [[ -n $version ]]; then
+    ui-run apt-get -qq -y $NO_INSTALL_RECOMMENDS install "dokku=$version"
   else
-    apt-get -qq -y $NO_INSTALL_RECOMMENDS install dokku
+    ui-run apt-get -qq -y $NO_INSTALL_RECOMMENDS install dokku
   fi
 }
 
+install-dokku-dependencies() {
+  declare desc="install the dependencies of the core dokku plugins"
+  if [[ "$DOKKU_DEPENDENCIES_COMMAND" == "plugins-install-dependencies" ]]; then
+    ui-run dokku plugins-install-dependencies
+  else
+    ui-run sudo dokku plugin:install-dependencies --core
+  fi
+}
+
+install-source-requirements() {
+  declare desc="install the packages needed to build dokku from source"
+  if ! command -v apt-get &>/dev/null; then
+    log-fail "This installation script requires apt-get. For manual installation instructions, consult $DOKKU_DOCS_URL/getting-started/advanced-installation/"
+  fi
+
+  ui-run apt-get -qq -y --no-install-recommends install sudo git make
+  case "$DOKKU_DISTRO" in
+    debian)
+      if [[ "$DOKKU_DISTRO_VERSION" -lt "13" ]] && ! package-installed software-properties-common; then
+        ui-run apt-get -qq -y --no-install-recommends install software-properties-common
+      fi
+      ;;
+    ubuntu)
+      if ! package-installed software-properties-common; then
+        ui-run apt-get -qq -y --no-install-recommends install software-properties-common
+      fi
+      ;;
+  esac
+}
+
+clone-dokku-source() {
+  declare desc="clone the dokku repository and check out the requested ref"
+  local checkout="$1"
+
+  cd /root
+  if [[ ! -d /root/dokku ]]; then
+    ui-run git clone "$DOKKU_REPO" /root/dokku
+  fi
+
+  cd /root/dokku
+  ui-run git fetch origin
+  if [[ -n $checkout ]]; then
+    ui-run git checkout "$checkout"
+  fi
+  ui-result "$(git rev-parse --short HEAD)"
+}
+
+build-dokku-source() {
+  declare desc="build and install dokku from source"
+  cd /root/dokku
+  ui-run make install
+}
+
+primary-ip() {
+  declare desc="print the primary ipv4 address of the server"
+  local route
+
+  route="$(ip -4 route get 1.1.1.1 2>/dev/null || true)"
+  if [[ "$route" =~ src\ ([0-9.]+) ]]; then
+    echo "${BASH_REMATCH[1]}"
+    return 0
+  fi
+  route="$(hostname -I 2>/dev/null || true)"
+  echo "${route%% *}"
+}
+
+add-ssh-keys() {
+  declare desc="add the keys from a file as admin keys"
+  local key_file="$1" line key name count=0
+
+  while IFS= read -r line || [[ -n "$line" ]]; do
+    if [[ "$line" =~ ((ssh-(rsa|ed25519|dss)|ecdsa-sha2-[a-z0-9]+|sk-[a-z0-9@.-]+)\ [A-Za-z0-9+/=]+) ]]; then
+      key="${BASH_REMATCH[1]}"
+      count=$((count + 1))
+      name="admin"
+      [[ "$count" -eq 1 ]] || name="admin-$count"
+      echo "\$ dokku ssh-keys:add $name"
+      if ! echo "$key" | dokku ssh-keys:add "$name"; then
+        echo "skipping a key from $key_file that could not be added"
+      fi
+    fi
+  done <"$key_file"
+}
+
+set-global-domain() {
+  declare desc="set the global domain to the server's ip"
+  local ip="$1"
+  ui-run dokku domains:set-global "$ip"
+}
+
+configure-dokku() {
+  declare desc="add ssh keys and a global domain when they are missing"
+  local dokku_root="${DOKKU_ROOT:-/home/dokku}" key_file="/root/.ssh/authorized_keys" ip
+
+  if [[ -s "$dokku_root/.ssh/authorized_keys" ]]; then
+    echo "ssh keys already present, skipping"
+    ui-result "ssh keys already set"
+  elif [[ "$DOKKU_SKIP_KEY_FILE" == "true" ]]; then
+    echo "DOKKU_SKIP_KEY_FILE is set, skipping ssh keys"
+    ui-result "admin key skipped"
+  elif [[ ! -s "$key_file" ]]; then
+    echo "no keys found in $key_file, skipping"
+    ui-result "admin key skipped"
+  else
+    ui-action "admin key" add-ssh-keys "$key_file"
+    echo "$key_file" >"$UI_TMP/ssh-key-source"
+  fi
+
+  if [[ -s "$dokku_root/VHOST" ]]; then
+    echo "global domain already set to $(<"$dokku_root/VHOST")"
+    ui-result "global domain already set"
+  else
+    ip="$(primary-ip)"
+    if [[ -n "$ip" ]]; then
+      ui-action "global domain" set-global-domain "$ip"
+    else
+      ui-result "global domain skipped"
+    fi
+  fi
+}
+
+ssh-key-names() {
+  declare desc="print the names of the keys allowed to push to dokku"
+  local dokku_root="${DOKKU_ROOT:-/home/dokku}" line names=()
+
+  [[ -f "$dokku_root/.ssh/authorized_keys" ]] || return 0
+  while IFS= read -r line; do
+    if [[ "$line" =~ NAME=\\\"([^\\]+)\\\" ]]; then
+      names+=("${BASH_REMATCH[1]}")
+    fi
+  done <"$dokku_root/.ssh/authorized_keys"
+  echo "${names[*]}"
+}
+
+print-summary() {
+  declare desc="print the ready summary with what was configured"
+  local dokku_root="${DOKKU_ROOT:-/home/dokku}" version domain="" keys host
+
+  version="$(dokku version 2>/dev/null || true)"
+  version="v${version##* }"
+  if [[ -s "$dokku_root/VHOST" ]]; then
+    domain="$(<"$dokku_root/VHOST")"
+  fi
+
+  keys="$(ssh-key-names)"
+  if [[ -n "$keys" ]] && [[ -s "$UI_TMP/ssh-key-source" ]]; then
+    keys="$keys (from $(<"$UI_TMP/ssh-key-source"))"
+  elif [[ -z "$keys" ]]; then
+    ui-summary-note "No SSH key was added. Add the key you will deploy with:" "echo 'CONTENTS_OF_ID_RSA_PUB_FILE' | dokku ssh-keys:add admin"
+  fi
+
+  if [[ -z "$domain" ]]; then
+    ui-summary-note "No global domain is set. Set one to route apps by name:" "dokku domains:set-global dokku.me"
+  fi
+
+  host="${domain:-$(primary-ip)}"
+  ui-summary "$version" "$domain" "$keys" "${host:-SERVER_IP}"
+}
+
+nginx-notice() {
+  declare desc="warn that a first time install removes nginx sites"
+  if command -v dokku &>/dev/null; then
+    return 0
+  fi
+  ui-countdown "First install removes nginx sites-enabled files." 10 \
+    "Installing Dokku for the first time removes files in nginx's sites-enabled" \
+    "directory. Restore any removed files after the installation is complete."
+}
+
+linode-notice() {
+  declare desc="warn linode users about aufs messages from docker"
+  if command -v docker &>/dev/null || ! uname -r | grep -q linode; then
+    return 0
+  fi
+  ui-countdown "Docker may warn about missing AUFS support on Linode." 10 \
+    "Using Linode? Docker may complain about missing AUFS support." \
+    "You can safely ignore this warning."
+}
+
+install-target() {
+  declare desc="print what is being installed for the header"
+  if [[ -n $DOKKU_BRANCH ]]; then
+    echo "Dokku from branch $DOKKU_BRANCH"
+  elif [[ -n $DOKKU_TAG ]]; then
+    echo "Dokku $DOKKU_TAG"
+  else
+    echo "the latest Dokku"
+  fi
+}
+
+os-description() {
+  declare desc="print the distribution and architecture"
+  local name arch
+
+  name="$(. /etc/os-release && echo "$NAME $VERSION_ID")"
+  arch="$(dpkg --print-architecture 2>/dev/null || uname -m)"
+  echo "$name ($arch)"
+}
+
+environment-detail() {
+  declare desc="print the detail text for the environment step"
+  local memory arch
+
+  memory=$(grep MemTotal /proc/meminfo | awk '{print $2}')
+  arch="$(dpkg --print-architecture 2>/dev/null || uname -m)"
+  if [[ "$memory" -ge 1048576 ]]; then
+    memory="$(((memory + 524288) / 1048576))GB"
+  else
+    memory="$((memory / 1024))MB"
+  fi
+  echo "$DOKKU_DISTRO $DOKKU_DISTRO_VERSION, $arch, $memory"
+}
+
 main() {
+  declare desc="install dokku"
+  local docker_detail="" version_detail
+
   export DOKKU_DISTRO DOKKU_DISTRO_VERSION
   DOKKU_DISTRO=$(. /etc/os-release && echo "$ID")
   DOKKU_DISTRO_VERSION=$(. /etc/os-release && echo "$VERSION_ID")
@@ -251,13 +1059,40 @@ main() {
   export DEBIAN_FRONTEND=noninteractive
   export DOKKU_REPO=${DOKKU_REPO:-"https://github.com/dokku/dokku.git"}
 
-  ensure-environment
-  install-requirements
-  install-dokku
+  resolve-install-method
+  ui-init
+  ui-header "$(install-target)" "$(os-description)"
 
-  if [[ -f /etc/update-motd.d/99-dokku ]]; then
-    /etc/update-motd.d/99-dokku || true
+  if [[ "$DOKKU_INSTALL_METHOD" == "package" ]]; then
+    UI_STEP_TOTAL=7
+  else
+    UI_STEP_TOTAL=6
   fi
+
+  ui-step "Checking environment" "$(environment-detail)" check-environment
+  ui-step "Installing required packages" "$(required-packages)" install-requirements
+
+  if [[ "$DOKKU_INSTALL_METHOD" == "package" ]]; then
+    command -v docker &>/dev/null || docker_detail="get.docker.com"
+    linode-notice
+    ui-step "Installing Docker Engine" "$docker_detail" install-docker
+    ui-step "Adding Dokku apt repository" "packagecloud, $(dokku-os-id)" add-dokku-repository
+    nginx-notice
+    version_detail="${DOKKU_PACKAGE_VERSION:+v$DOKKU_PACKAGE_VERSION}"
+    ui-step "Installing Dokku" "${version_detail:-latest}" install-dokku-package "$DOKKU_PACKAGE_VERSION"
+    ui-step "Installing plugin dependencies" "core plugins" install-dokku-dependencies
+  else
+    ui-step "Installing build tools" "sudo git make" install-source-requirements
+    ui-step "Cloning Dokku" "${DOKKU_SOURCE_CHECKOUT:-$DOKKU_REPO}" clone-dokku-source "$DOKKU_SOURCE_CHECKOUT"
+    nginx-notice
+    ui-step "Building Dokku" "make install" build-dokku-source
+  fi
+
+  ui-step "Configuring Dokku" "" configure-dokku
+  print-summary
 }
 
-main "$@"
+{
+  main "$@"
+  exit $?
+}
diff --git a/common.mk b/common.mk
index ce25bd997..7d834c81e 100644
--- a/common.mk
+++ b/common.mk
@@ -1,11 +1,14 @@
 GO_ARGS ?=
 GO_PLUGIN_MAKE_TARGET ?= build
 GO_REPO_ROOT := /go/src/github.com/dokku/dokku
-BUILD_IMAGE := hub.diyla.com/golang:1.26.2
+BUILD_IMAGE := hub.diyla.com/golang:1.27.1
 GO_BUILD_CACHE ?= /tmp/dokku-go-build-cache
 GO_MOD_CACHE   ?= /tmp/dokku-go-mod-mod
 GO_ROOT_MOUNT  ?= $$PWD/../..:$(GO_REPO_ROOT)
-GOARCH         ?= amd64
+ifndef TARGETARCH
+TARGETARCH     := $(shell dpkg --print-architecture 2>/dev/null || uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/')
+endif
+GOARCH         ?= $(TARGETARCH)
 
 .PHONY: build-in-docker build clean src-clean
 
diff --git a/contrib/build-dokku.Dockerfile b/contrib/build-dokku.Dockerfile
index 7f08388fa..4a4a80dc8 100644
--- a/contrib/build-dokku.Dockerfile
+++ b/contrib/build-dokku.Dockerfile
@@ -35,8 +35,8 @@ RUN PLUGIN_MAKE_TARGET=${PLUGIN_MAKE_TARGET} \
   DOKKU_GIT_REV=${DOKKU_GIT_REV} \
   IS_RELEASE=${IS_RELEASE} \
   SKIP_GO_CLEAN=true \
-  make version copyfiles \
-  && make deb-dokku
+  GOARCH=amd64 make version copyfiles \
+  && DOKKU_ARCHITECTURE=amd64 GOARCH=amd64 make deb-dokku
 
 FROM builder AS arm64
 
diff --git a/contrib/dependencies.json b/contrib/dependencies.json
index 2168244f6..f3fdf77af 100644
--- a/contrib/dependencies.json
+++ b/contrib/dependencies.json
@@ -1,11 +1,19 @@
 {
   "dependencies": [
     {
-      "name": "docker-container-healthchecker",
-      "version": "0.16.0",
+      "name": "coredns-docker",
+      "version": "0.8.0",
       "urls": {
-        "amd64": "https://hub.diyla.com/https://github.com/dokku/docker-container-healthchecker/releases/download/v0.16.0/docker-container-healthchecker-linux-amd64",
-        "arm64": "https://hub.diyla.com/https://github.com/dokku/docker-container-healthchecker/releases/download/v0.16.0/docker-container-healthchecker-linux-arm64"
+        "amd64": "https://hub.diyla.com/https://github.com/dokku/coredns-docker/releases/download/0.8.0/coredns-docker-linux-amd64",
+        "arm64": "https://hub.diyla.com/https://github.com/dokku/coredns-docker/releases/download/0.8.0/coredns-docker-linux-arm64"
+      }
+    },
+    {
+      "name": "docker-container-healthchecker",
+      "version": "0.16.1",
+      "urls": {
+        "amd64": "https://hub.diyla.com/https://github.com/dokku/docker-container-healthchecker/releases/download/v0.16.1/docker-container-healthchecker-linux-amd64",
+        "arm64": "https://hub.diyla.com/https://github.com/dokku/docker-container-healthchecker/releases/download/v0.16.1/docker-container-healthchecker-linux-arm64"
       }
     },
     {
@@ -34,18 +42,18 @@
     },
     {
       "name": "pack",
-      "version": "0.40.9",
+      "version": "0.40.11",
       "urls": {
-        "amd64": "https://hub.diyla.com/https://github.com/buildpacks/pack/releases/download/v0.40.9/pack-v0.40.9-linux.tgz",
-        "arm64": "https://hub.diyla.com/https://github.com/buildpacks/pack/releases/download/v0.40.9/pack-v0.40.9-linux-arm64.tgz"
+        "amd64": "https://hub.diyla.com/https://github.com/buildpacks/pack/releases/download/v0.40.11/pack-v0.40.11-linux.tgz",
+        "arm64": "https://hub.diyla.com/https://github.com/buildpacks/pack/releases/download/v0.40.11/pack-v0.40.11-linux-arm64.tgz"
       }
     },
     {
       "name": "procfile-util",
-      "version": "0.20.8",
+      "version": "0.20.9",
       "urls": {
-        "amd64": "https://hub.diyla.com/https://github.com/dokku/procfile-util/releases/download/v0.20.8/procfile-util-linux-amd64",
-        "arm64": "https://hub.diyla.com/https://github.com/dokku/procfile-util/releases/download/v0.20.8/procfile-util-linux-arm64"
+        "amd64": "https://hub.diyla.com/https://github.com/dokku/procfile-util/releases/download/v0.20.9/procfile-util-linux-amd64",
+        "arm64": "https://hub.diyla.com/https://github.com/dokku/procfile-util/releases/download/v0.20.9/procfile-util-linux-arm64"
       }
     },
     {
@@ -86,18 +94,18 @@
     },
     {
       "name": "dokku-update",
-      "version": "0.10.0",
+      "version": "0.11.0",
       "urls": {
-        "amd64": "https://hub.diyla.com/https://github.com/dokku/dokku-update/releases/download/v0.10.0/dokku-update",
-        "arm64": "https://hub.diyla.com/https://github.com/dokku/dokku-update/releases/download/v0.10.0/dokku-update"
+        "amd64": "https://hub.diyla.com/https://github.com/dokku/dokku-update/releases/download/v0.11.0/dokku-update",
+        "arm64": "https://hub.diyla.com/https://github.com/dokku/dokku-update/releases/download/v0.11.0/dokku-update"
       }
     },
     {
       "name": "herokuish",
-      "version": "0.11.16",
+      "version": "0.11.25",
       "urls": {
-        "amd64": "https://hub.diyla.com/https://github.com/gliderlabs/herokuish/releases/download/v0.11.16/herokuish_0.11.16_linux_x86_64.tgz",
-        "arm64": "https://hub.diyla.com/https://github.com/gliderlabs/herokuish/releases/download/v0.11.16/herokuish_0.11.16_linux_x86_64.tgz"
+        "amd64": "https://hub.diyla.com/https://github.com/gliderlabs/herokuish/releases/download/v0.11.25/herokuish_0.11.25_linux_x86_64.tgz",
+        "arm64": "https://hub.diyla.com/https://github.com/gliderlabs/herokuish/releases/download/v0.11.25/herokuish_0.11.25_linux_x86_64.tgz"
       }
     }
   ]
diff --git a/contrib/release-dokku b/contrib/release-dokku
index 3f69153e7..92506e154 100755
--- a/contrib/release-dokku
+++ b/contrib/release-dokku
@@ -144,7 +144,7 @@ fn-publish-package() {
       fi
     done
   elif [[ "$DIST" == "ubuntu" ]]; then
-    OS_IDS=("jammy" "noble")
+    OS_IDS=("jammy" "noble" "resolute")
     for OS_ID in "${OS_IDS[@]}"; do
       log-info "(release-dokku) pushing ${RELEASE_TYPE} to packagecloud.com/${REPOSITORY}/${DIST}"
       package_cloud push "${REPOSITORY}/${DIST}/${OS_ID}" "$PACKAGE_NAME"
diff --git a/deb.mk b/deb.mk
index 528c0177e..d9a32909b 100644
--- a/deb.mk
+++ b/deb.mk
@@ -1,7 +1,7 @@
 BUILD_DIRECTORY    ?= /tmp
 DOKKU_DESCRIPTION   = 'Docker powered PaaS that helps you build and manage the lifecycle of applications'
 DOKKU_REPO_NAME    ?= dokku/dokku
-DOKKU_ARCHITECTURE ?= amd64
+DOKKU_ARCHITECTURE ?= $(GOARCH)
 
 ifndef IS_RELEASE
 	IS_RELEASE = true
diff --git a/debian/control b/debian/control
index c89e55434..4d5e30a93 100644
--- a/debian/control
+++ b/debian/control
@@ -1,9 +1,9 @@
 Package: dokku
-Version: 0.38.27
+Version: 0.38.34
 Section: web
 Priority: optional
 Architecture: amd64
-Depends: apache2-utils, locales, git, cpio, cron | cron-daemon, curl, logrotate, man-db, netcat, sshcommand, docker-engine-cs (>= 19.03.0) | docker-engine (>= 19.03.0) | docker-io (>= 19.03.0) | docker.io (>= 19.03.0) | docker-ce (>= 19.03.0) | docker-ee (>= 19.03.0) | moby-engine, docker-compose-plugin | moby-compose | docker-compose, docker-buildx-plugin | moby-buildx | docker-buildx, docker-container-healthchecker, docker-image-labeler, lambda-builder, net-tools, netrc, parallel, procfile-util, rsync, dos2unix, unzip, util-linux
+Depends: apache2-utils, locales, git, cpio, cron | cron-daemon, curl, logrotate, man-db, netcat, sshcommand, docker-engine-cs (>= 19.03.0) | docker-engine (>= 19.03.0) | docker-io (>= 19.03.0) | docker.io (>= 19.03.0) | docker-ce (>= 19.03.0) | docker-ee (>= 19.03.0) | moby-engine, docker-compose-plugin | moby-compose | docker-compose, docker-buildx-plugin | moby-buildx | docker-buildx, coredns-docker, docker-container-healthchecker, docker-image-labeler, lambda-builder, net-tools, netrc, parallel, procfile-util, rsync, dos2unix, unzip, util-linux
 Recommends: herokuish, bash-completion, dokku-update, dokku-event-listener
 Pre-Depends: gliderlabs-sigil, jq, nginx (>= 1.8.0) | openresty, bind9-dnsutils, debconf, plugn, sudo, python3, rsyslog
 Maintainer: Jose Diaz-Gonzalez <dokku@josediazgonzalez.com>
diff --git a/debian/postinst b/debian/postinst
index 6edbbed79..61efedef1 100755
--- a/debian/postinst
+++ b/debian/postinst
@@ -109,14 +109,18 @@ setup-plugins() {
   db_get "dokku/nginx_enable"
   echo "Enabling all core plugins"
   find "${DOKKU_LIB_ROOT}/core-plugins/available" -mindepth 1 -maxdepth 1 -type d -printf '%f\n' | while read -r plugin; do
+    if [ -d "${DOKKU_LIB_ROOT}/plugins/available/$plugin" ]; then
+      continue
+    fi
+
+    ln -s "${DOKKU_LIB_ROOT}/core-plugins/available/$plugin" "${DOKKU_LIB_ROOT}/plugins/available/$plugin"
     if [ "$plugin" = "nginx-vhosts" ] && [ "$RET" = "false" ]; then
       echo "Skipping enable of nginx-vhosts plugin"
       continue
-    elif [ ! -d "${DOKKU_LIB_ROOT}/plugins/available/$plugin" ]; then
-      ln -s "${DOKKU_LIB_ROOT}/core-plugins/available/$plugin" "${DOKKU_LIB_ROOT}/plugins/available/$plugin"
-      PLUGIN_PATH="${DOKKU_LIB_ROOT}/core-plugins" plugn enable "$plugin"
-      PLUGIN_PATH="${DOKKU_LIB_ROOT}/plugins" plugn enable "$plugin"
     fi
+
+    PLUGIN_PATH="${DOKKU_LIB_ROOT}/core-plugins" plugn enable "$plugin"
+    PLUGIN_PATH="${DOKKU_LIB_ROOT}/plugins" plugn enable "$plugin"
   done
   find -L "${DOKKU_LIB_ROOT}/core-plugins" -type l -delete
   find -L "${DOKKU_LIB_ROOT}/plugins" -type l -delete
diff --git a/docker/etc/runit/runsvdir/default/coredns-docker/run b/docker/etc/runit/runsvdir/default/coredns-docker/run
new file mode 100755
index 000000000..312b939d2
--- /dev/null
+++ b/docker/etc/runit/runsvdir/default/coredns-docker/run
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+exec >>/var/log/services/coredns-docker
+exec 2>&1
+
+echo "Running coredns-docker"
+exec /usr/bin/coredns-docker -conf /etc/coredns/Corefile
diff --git a/docs/README.md b/docs/README.md
index 00e8acd4a..8178c6227 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -97,6 +97,7 @@ This documentation covers the installation, configuration, and usage of Dokku -
 - [Registry Management](advanced-usage/registry-management.md) - Docker registry integration
 - [Repository Management](advanced-usage/repository-management.md) - Git repository settings
 - [Build Tracking](advanced-usage/builds.md) - Inspect, cancel, and manage builds
+- [Datastore Management](advanced-usage/datastore-management.md) - Create and link datastore services
 - [Deployment Tasks](advanced-usage/deployment-tasks.md) - Pre/post deploy hooks
 - [Event Logs](advanced-usage/event-logs.md) - Dokku event history
 - [Backup and Recovery](advanced-usage/backup-recovery.md) - Data backup strategies
@@ -122,6 +123,7 @@ This documentation covers the installation, configuration, and usage of Dokku -
 
 ### Migration Guides
 
+- [0.39.0](appendices/0.39.0-migration-guide.md)
 - [0.38.0](appendices/0.38.0-migration-guide.md)
 - [0.37.0](appendices/0.37.0-migration-guide.md)
 - [0.36.0](appendices/0.36.0-migration-guide.md)
diff --git a/docs/_build/Dockerfile b/docs/_build/Dockerfile
index 00066b5cb..30eb3b105 100644
--- a/docs/_build/Dockerfile
+++ b/docs/_build/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.15.0rc1-alpine
+FROM python:3.16.0a1-alpine
 
 WORKDIR /usr/src/app
 
diff --git a/docs/_build/requirements.txt b/docs/_build/requirements.txt
index e69d4ca7c..40640ac44 100644
--- a/docs/_build/requirements.txt
+++ b/docs/_build/requirements.txt
@@ -1,23 +1,23 @@
 beautifulsoup4==4.15.0
-click==8.4.2
+click==8.5.1
 ghp-import==2.1.0
-importlib-metadata==9.0.0
+importlib-metadata==10.2.0
 Jinja2==3.1.6
-Markdown>=3.10.3,<3.11
-MarkupSafe==3.0.3
+Markdown>=3.11.3,<3.12
+MarkupSafe==3.0.4
 mergedeep==1.3.4
 mkdocs==1.6.1
 mkdocs-exclude==1.0.2
-mkdocs-material==9.7.7
+mkdocs-material==9.8.1
 mkdocs-material-extensions==1.3.1
 packaging==26.3
 Pygments==2.21.0
-pymdown-extensions==11.0.1
-pyparsing==3.3.2
-python-dateutil==2.9.0.post0
+pymdown-extensions==13.0
+pyparsing==3.3.3
+python-dateutil==4.0.0
 PyYAML==6.0.3
 pyyaml_env_tag==1.1
 six==1.17.0
-soupsieve==2.9.2
-watchdog==6.0.0
-zipp==4.1.0
+soupsieve==4.1
+watchdog==7.1.0
+zipp==4.1.2
diff --git a/docs/advanced-usage/builds.md b/docs/advanced-usage/builds.md
index 1e80bca43..d94bb51fb 100644
--- a/docs/advanced-usage/builds.md
+++ b/docs/advanced-usage/builds.md
@@ -25,6 +25,10 @@ Every build is identified by a sortable base36 ULID-style id (`DOKKU_BUILD_ID`)
 
 Output is also tagged into syslog as `dokku-<build-id>` so `journalctl -t dokku-<build-id>` continues to work. The on-disk log file is the durable source of truth and is read for `builds:output` even when journald has rotated old entries away.
 
+A deploy that exits early - for example when the build fails - still finalizes its record as `failed` with its exit code.
+
+A run that builds nothing leaves no record behind. This includes a deploy refused because the app was locked via `apps:lock`. `git:sync` has to fetch before it can tell whether there is anything to deploy, so it opens a record up front and discards it again when it turns out there is not - a `git:sync` with no `--build` flag, or a `--build-if-changes` poll that finds the remote unchanged. Without that, an app polled on a timer would accumulate `running` records that are later reaped as spurious failures, pushing real deploys out of the retention window.
+
 ### Record schema
 
 ```json
@@ -186,7 +190,7 @@ Available flags:
 The following flags surface in `builds:report` but are not managed by `builds:set` - they are derived metadata recorded during the build:
 
 | Flag | Description |
-|---|---|
+| --- | --- |
 | `--build-id` | Unique identifier of the most recent build for the app |
 | `--build-kind` | Whether the record was a `build` or a `deploy` |
 | `--build-status` | Display status (`running`, `succeeded`, `failed`, `canceled`, `abandoned`); computed at read time |
diff --git a/docs/advanced-usage/datastore-management.md b/docs/advanced-usage/datastore-management.md
new file mode 100644
index 000000000..4c27f4d85
--- /dev/null
+++ b/docs/advanced-usage/datastore-management.md
@@ -0,0 +1,127 @@
+# Datastore Management
+
+```
+datastore:app-links <datastore-type> [<app>]                                                       # list all datastore service links for a given app
+datastore:backup <datastore-type> <service> <bucket-name> [--id <id>]...                           # create a backup of the datastore service to an existing s3 bucket
+datastore:backup-auth <datastore-type> <service> <aws-access-key-id> <aws-secret-access-key>...    # set up authentication for backups on the datastore service
+datastore:backup-deauth <datastore-type> <service> [--id <id>]                                     # remove backup authentication for the datastore service
+datastore:backup-logs <datastore-type> <service> [-t|--tail [<tail-num>]]                          # print the most recent output of the scheduled backups of the service
+datastore:backup-schedule <datastore-type> <service> <schedule> <bucket-name>...                   # schedule a backup of the datastore service
+datastore:backup-schedule-cat <datastore-type> <service> [--id <id>]                               # cat the crontab line of a scheduled backup for the service
+datastore:backup-set-encryption <datastore-type> <service> <passphrase> [--id <id>]                # set encryption for all future backups of datastore service
+datastore:backup-set-public-key-encryption <datastore-type> <service> <public-key-id> [--id <id>]  # set GPG Public Key encryption for all future backups of datastore service
+datastore:backup-unschedule <datastore-type> <service> [--id <id>|--all]                           # unschedule the backup of the datastore service
+datastore:backup-unset-encryption <datastore-type> <service> [--id <id>]                           # unset encryption for future backups of the datastore service
+datastore:backup-unset-public-key-encryption <datastore-type> <service> [--id <id>]                # unset GPG Public Key encryption for future backups of the datastore service
+datastore:clone <datastore-type> <service> <new-service> [--clone-flags...]                        # create container <new-name> then copy data from <name> into <new-name>
+datastore:connect <datastore-type> <service>                                                       # connect to the service via the <datastore-type> connection tool
+datastore:create <datastore-type> <service> [--create-flags...]                                    # create a datastore service
+datastore:create-database <datastore-type> <service> <database>                                    # create a database in the datastore service
+datastore:create-user <datastore-type> <service> <user> [<password>]                               # create a user in the datastore service
+datastore:destroy <datastore-type> <service> [-f|--force]                                          # delete the datastore service/data/container if there are no links left
+datastore:destroy-database <datastore-type> <service> <database> [-f|--force]                      # destroy a database created in the datastore service
+datastore:destroy-user <datastore-type> <service> <user> [-f|--force]                              # destroy a user created in the datastore service
+datastore:enter <datastore-type> <service>                                                         # enter or run a command in a running datastore service container
+datastore:exists <datastore-type> <service>                                                        # check if the datastore service exists
+datastore:export <datastore-type> <service> [-f|--file <path>] [--force]                           # export a dump of the datastore service database
+datastore:expose <datastore-type> <service> <ports...>                                             # expose a datastore service on custom host:port if provided (random port on the 0.0.0.0 interface if otherwise unspecified)
+datastore:help [<datastore-type> [<command>]]                                                      # print the help for every datastore, one datastore or one of its commands
+datastore:import <datastore-type> <service> [-f|--file <path>]                                     # import a dump into the datastore service database
+datastore:info <datastore-type> [<service>] [--info-flags...]                                      # print the service information
+datastore:label <datastore-type> <service> <key=value>...                                          # add docker labels to the service container
+datastore:link <datastore-type> <service> [<app>] [--link-flags...]                                # link the datastore service to the app
+datastore:linked <datastore-type> <service> [<app>]                                                # check if the datastore service is linked to an app
+datastore:links <datastore-type> <service>                                                         # list all apps linked to the datastore service
+datastore:list <datastore-type>                                                                    # list all datastore services
+datastore:logs <datastore-type> <service> [-t|--tail [<tail-num>]]                                 # print the most recent log(s) for this service
+datastore:mount <datastore-type> [--replace] <service> <source:container-dir[:options]>...         # mount a host path or docker volume into the service container
+datastore:pause <datastore-type> <service>                                                         # pause a running datastore service
+datastore:promote <datastore-type> <service> [<app>]                                               # promote service <service> as DATABASE_URL in <app>
+datastore:reexpose <datastore-type> <service>                                                      # reexpose a datastore service, applying its expose settings
+datastore:reset <datastore-type> <service> [-f|--force]                                            # delete all data in the datastore service, keeping the service and its links
+datastore:restart <datastore-type> <service>                                                       # graceful shutdown and restart of the datastore service container
+datastore:set <datastore-type> <service> <key> [<value>]...                                        # set or clear a property for a service
+datastore:set-user-password <datastore-type> <service> <user> [<password>]...                      # change the password of a user created in the datastore service
+datastore:start <datastore-type> <service>                                                         # start a previously stopped datastore service
+datastore:stop <datastore-type> <service>                                                          # stop a running datastore service
+datastore:unexpose <datastore-type> <service>                                                      # unexpose a previously exposed datastore service
+datastore:unlabel <datastore-type> [--all] <service> [<key>...]                                    # remove one or all docker labels from the service container
+datastore:unlink <datastore-type> <service> [<app>] [-n|--no-restart]                              # unlink the datastore service from the app
+datastore:unmount <datastore-type> [--all] <service> [<source:container-dir>...]                   # remove one or all mounts from the service container
+datastore:upgrade <datastore-type> <service> [--upgrade-flags...]                                  # upgrade service <service> to the specified versions
+datastore:version                                                                                  # print the version of dokku-datastore the plugin runs
+```
+
+The `datastore` plugin manages datastore services such as postgres, mysql and redis, and links them to apps. Every command takes the datastore type as its first argument, and the datastores it serves are the ones the [official datastore plugins](/docs/community/plugins.md#official-plugins) provide: clickhouse, couchdb, elasticsearch, graphite, mariadb, meilisearch, memcached, mongo, mysql, nats, omnisci, postgres, pushpin, rabbitmq, redis, rethinkdb, solr and typesense.
+
+The plugin is built from [dokku-datastore](https://github.com/dokku/dokku-datastore), which the official datastore plugins also run, and keeps its services in the same place they do, under `/var/lib/dokku/services`.
+
+## Usage
+
+### Creating and linking a service
+
+A service is created with `datastore:create` and linked to an app with `datastore:link`, which sets the variable the app connects with, such as `DATABASE_URL` for postgres or `REDIS_URL` for redis, and restarts the app.
+
+```shell
+dokku datastore:create postgres lollipop
+dokku datastore:link postgres lollipop node-js-app
+```
+
+`datastore:unlink` removes the link, and `datastore:destroy` removes a service once nothing is linked to it.
+
+```shell
+dokku datastore:unlink postgres lollipop node-js-app
+dokku datastore:destroy postgres lollipop
+```
+
+Deleting an app unlinks it from every service it is linked to.
+
+### Getting help
+
+`datastore:help` lists the datastore types and the commands they share. Not every datastore implements every command, so the help for one datastore lists only the commands it implements, including ones only it has, such as `connect-admin` for mongo. The help for one of a datastore's commands describes its flags and shows examples.
+
+```shell
+dokku datastore:help
+dokku datastore:help postgres
+dokku datastore:help postgres create
+```
+
+### Scheduled backups
+
+A backup scheduled with `datastore:backup-schedule` is added to the dokku crontab as a `dokku datastore:backup` command, and is managed with the [cron plugin](/docs/processes/scheduled-cron-tasks.md) like any other scheduled task.
+
+```shell
+dokku datastore:backup-auth postgres lollipop AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
+dokku datastore:backup-schedule postgres lollipop "0 3 * * *" my-s3-bucket
+```
+
+### Images
+
+Installing dokku does not pull the image of every datastore. A datastore's images are pulled the first time a command needs them, and on later installs and upgrades once the datastore has a service.
+
+### Official datastore plugins
+
+The official datastore plugins, such as [dokku-postgres](https://github.com/dokku/dokku-postgres), may be installed alongside the `datastore` plugin. While one is enabled, the `datastore` plugin leaves that datastore to it when dokku runs plugin triggers, such as unlinking an app that is being deleted or writing scheduled backups into the crontab. Commands for that datastore should be run through the official plugin until it is removed.
+
+The `datastore` plugin does not read the datastore definitions an official plugin ships, so a host running a modified official plugin should keep using it.
+
+#### Migrating from an official datastore plugin
+
+Moving a datastore from its official plugin to the `datastore` plugin leaves its services, containers, data, settings and links where they are, and does not stop running services or the apps linked to them. Using postgres as an example:
+
+1. Check that `dokku datastore:version` is at least the version dokku-postgres runs, which is printed by `/var/lib/dokku/data/postgres/dokku-datastore version`. If the official plugin runs a newer version, wait for a dokku release that ships it.
+2. Uninstall the official plugin.
+
+    ```shell
+    dokku plugin:uninstall postgres
+    ```
+
+3. Run every plugin's install trigger, which sets the host up for postgres, brings its services up to date and rewrites the crontab so scheduled backups run through `dokku datastore:backup`.
+
+    ```shell
+    dokku plugin:install
+    ```
+
+4. Change anything that runs `dokku postgres:<command> <service>` to run `dokku datastore:<command> postgres <service>`.
+
+To move back, install the official plugin again from a release running at least the version `dokku datastore:version` prints.
diff --git a/docs/advanced-usage/deployment-tasks.md b/docs/advanced-usage/deployment-tasks.md
index 1c278a803..41e3cf372 100644
--- a/docs/advanced-usage/deployment-tasks.md
+++ b/docs/advanced-usage/deployment-tasks.md
@@ -67,7 +67,7 @@ Sometimes it may be desirable to set a different path for a given app, e.g. when
 dokku app-json:set node-js-app appjson-path .dokku/app.json
 ```
 
-The value is the path to the desired file *relative* to the base search directory, and will never be treated as absolute paths in any context. If that file does not exist within the repository, Dokku will continue the build process as if the repository has no `app.json`.
+The value is the path to the desired file _relative_ to the base search directory, and will never be treated as absolute paths in any context. If that file does not exist within the repository, Dokku will continue the build process as if the repository has no `app.json`.
 
 The default value may be set by passing an empty value for the option:
 
@@ -142,7 +142,7 @@ app2.json
 
 #### `app.json` deployment tasks
 
-Dokku provides limited support for the `app.json` manifest from Heroku (documentation available [here](https://devcenter.heroku.com/articles/app-json-schema)). The keys available for use with Deployment Tasks are:
+Dokku provides limited support for the `app.json` manifest from Heroku (see the [app.json schema documentation](https://devcenter.heroku.com/articles/app-json-schema)). The keys available for use with Deployment Tasks are:
 
 - `scripts.dokku.predeploy`: This is run _after_ an app's docker image is built, but _before_ any containers are scheduled. Changes made to your image are committed at this phase.
 - `scripts.dokku.postdeploy`: This is run _after_ an app's containers are scheduled. Changes made to your image are _not_ committed at this phase.
diff --git a/docs/advanced-usage/docker-options.md b/docs/advanced-usage/docker-options.md
index 6469f3878..d938fed73 100644
--- a/docs/advanced-usage/docker-options.md
+++ b/docs/advanced-usage/docker-options.md
@@ -34,7 +34,7 @@ Adding or removing docker-options will not apply to any running containers, and
 
 #### Supported Docker Options
 
-More information on supported Docker options can be found [here](https://docs.docker.com/engine/reference/commandline/run/).
+More information on supported Docker options can be found in the [docker run reference](https://docs.docker.com/engine/reference/commandline/run/).
 
 Container options configured via the `docker-options` plugin are not used to modify the process a container runs. Container options are the `[OPTIONS]` portion of the following, where `[CONTAINER_COMMAND]` and `[ARG]` are the process and the arguments passed to it that are launched in the created container: `docker run [OPTIONS] [CONTAINER_COMMAND] [ARG...]`. Please see the documentation for [customizing the run command](/docs/deployment/builders/dockerfiles.md#customizing-the-run-command) or use a [Procfile](/docs/deployment/builders/dockerfiles.md#procfiles-and-multiple-processes) to modify the command used by a Dockerfile-based container.
 
@@ -288,7 +288,7 @@ dokku docker-options:list node-js-app --phase deploy
 The following properties are recorded internally by the docker-options plugin and are not exposed via `docker-options:report`:
 
 | Property | Scope | Description | Source |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | `migrated-from-files` | global | Global migration sentinel that records that the legacy `DOCKER_OPTIONS_<PHASE>` flat-file store has been drained into plugin properties | `plugins/docker-options/functions.go` writes `"true"` once the install-time migration runs |
 | `migrated-build` | per-app | Per-app marker recording that the app's legacy `DOCKER_OPTIONS_BUILD` file was drained into the `_default_.build` property list. Only set when the legacy file contained non-empty content | `plugins/docker-options/functions.go` writes `"true"` after the per-phase drain |
 | `migrated-deploy` | per-app | Per-app marker recording that the app's legacy `DOCKER_OPTIONS_DEPLOY` file was drained into the `_default_.deploy` property list. Only set when the legacy file contained non-empty content | `plugins/docker-options/functions.go` writes `"true"` after the per-phase drain |
diff --git a/docs/advanced-usage/persistent-storage.md b/docs/advanced-usage/persistent-storage.md
index 6943a9b48..8926b34a9 100644
--- a/docs/advanced-usage/persistent-storage.md
+++ b/docs/advanced-usage/persistent-storage.md
@@ -6,24 +6,23 @@
 The preferred method to attach persistent storage to a Dokku-managed container is the Dokku storage plugin.
 
 ```
-storage:annotations:report [<name>] [<flag>]           # Display annotations for one or more storage entries
-storage:annotations:set <name> <key> [<value>]         # Set or clear a single annotation on a storage entry
-storage:create <name> [<path>] [flags]                 # Register a named storage entry
-storage:destroy <name> [--force] [--destroy-host-dir]  # Remove a named storage entry (must be unmounted from every app first)
-storage:ensure-directory [--chown option] <directory>  # [DEPRECATED] use storage:create instead
-storage:exec <name> [-- <cmd>...]                      # Run a command (or shell) in a temporary container that mounts the entry
-storage:info <name> [--format text|json]               # Show details for one storage entry
-storage:labels:report [<name>] [<flag>]                # Display labels for one or more storage entries
-storage:labels:set <name> <key> [<value>]              # Set or clear a single label on a storage entry
-storage:list <app> [--format text|json]                # List bind mounts for an app's container(s) (legacy host:container view)
-storage:list-entries [--scheduler s] [--format text|json]  # List registered storage entries
-storage:mount <app> <name> --container-dir <path> [flags]  # Mount a named entry into an app
-storage:mount <app> <host-dir:container-dir>           # [LEGACY] colon-form mount, docker-local only
-storage:report [<app>] [<flag>]                        # Display a storage report for one or more apps
-storage:report --global                                # Display a cluster-wide entry inventory
-storage:set <name> <property> [<value>]                # Update a storage entry in place
-storage:unmount <app> <name> [--container-dir <path>]  # Remove an attachment
-storage:wait <name>                                    # Block until a k3s entry's PVC is bound
+storage:annotations:report [<name>] [<flag>]                         # Displays annotations for one or more storage entries
+storage:annotations:set <name> <key> [<value>]                       # Set or clear a single annotation on a storage entry
+storage:create <name> [<path>] [flags]                               # Register a named storage entry
+storage:destroy <name> [--force] [--destroy-host-dir]                # Remove a named storage entry (must be unmounted from every app first)
+storage:ensure-directory [--chown option] <directory>                # [DEPRECATED] use storage:create instead
+storage:exec <name> [-- <cmd>...]                                    # Run a command (or shell) in a temporary container that mounts the entry
+storage:info <name> [--format text|json]                             # Show details for one storage entry
+storage:labels:report [<name>] [<flag>]                              # Displays labels for one or more storage entries
+storage:labels:set <name> <key> [<value>]                            # Set or clear a single label on a storage entry
+storage:list <app> [--format text|json]                              # List bind mounts for an app's container(s) (legacy host:container view)
+storage:list-entries [--scheduler s] [--format text|json]            # List registered storage entries
+storage:migrate [<app>|--all]                                        # Re-run the legacy -v to attachment migration for an app
+storage:mount [--replace] <app> <host-dir:container-dir>... [flags]  # Create or replace bind mounts
+storage:report [<app>|--global] [<flag>]                             # Displays a storage report for one or more apps
+storage:set <name> <property> [<value>]                              # Update a storage entry in place
+storage:unmount [--all] <app> [<host-dir:container-dir>...] [flags]  # Remove one or all bind mounts
+storage:wait <name>                                                  # Wait for a storage entry's PVC to be bound (k3s)
 ```
 
 A storage entry is the source of truth for the underlying volume - a host directory on docker-local, or a PersistentVolumeClaim on k3s. Multiple apps can mount the same entry, and an attachment carries the per-app details (container path, phases, subpath, readonly, process type). Names are globally unique across the install and must be DNS-1123 labels (lowercase letters, digits, dashes) of 45 characters or less so they can be used verbatim as Helm release and PVC names.
@@ -89,6 +88,8 @@ Each entry mirrors the underlying attachment. `readonly` (boolean) and `volume_o
 
 A storage directory can be created with the `storage:ensure-directory` command. This command will create a subdirectory in the recommended `/var/lib/dokku/data/storage` path - created during Dokku installation - and prepare it for use with an app.
 
+When Dokku itself runs in a container with a shared Docker socket, default named storage is still created under `DOKKU_LIB_ROOT` (typically `/var/lib/dokku`) inside the Dokku container. Docker `-v` mounts for `storage:exec` and app deploys rewrite that path to `DOKKU_LIB_HOST_ROOT` so the host Docker daemon binds the directory from the host-visible data volume. See the [Docker installation notes](/docs/getting-started/install/docker.md) for setting `DOKKU_LIB_HOST_ROOT`.
+
 ```shell
 dokku storage:ensure-directory node-js-app
 ```
@@ -171,7 +172,7 @@ dokku storage:set node-js-data chown
 The following properties can be set:
 
 | Property | Description | Unsetting it means |
-|---|---|---|
+| --- | --- | --- |
 | `chown` | Ownership preset or numeric uid for the host directory | no chown is performed |
 | `mode` | Octal permissions for the host directory | permissions are left alone |
 | `namespace` | Namespace holding the PVC (k3s) | the `default` namespace |
@@ -248,7 +249,7 @@ dokku storage:mount node-js-app /var/lib/dokku/data/storage/node-js-app:/app/sto
 dokku storage:mount node-js-app some-docker-volume:/app/storage
 ```
 
-In the first example, Dokku will then mount the shared contents of `/var/lib/dokku/data/storage/node-js-app` to `/app/storage` inside the container.  The mount point is *not* relative to your app's working directory, and is instead relative to the root (`/`) of the container. Mounts are only available for containers created via `run` and by the deploy process, and not during the build process. In addition, the host path is never auto-created by either Dokku or Docker, and should be an explicit path, not one relative to the current working directory.
+In the first example, Dokku will then mount the shared contents of `/var/lib/dokku/data/storage/node-js-app` to `/app/storage` inside the container.  The mount point is *not* relative to your app's working directory, and is instead relative to the root (`/`) of the container. Mounts are only available for containers created via `run` and by the deploy process, and not during the build process. A mount is bound into every process type unless `--process-type` narrows it - see [scoping a mount to a process type](#scoping-a-mount-to-a-process-type). In addition, the host path is never auto-created by either Dokku or Docker, and should be an explicit path, not one relative to the current working directory.
 
 > If the `/storage` path within the container had pre-existing content, the container files will be over-written. This may be an issue for users that create assets at build time but then mount a directory at the same place during runtime. Files are not merged.
 
@@ -269,9 +270,101 @@ Once persistent storage is mounted, the app requires a restart. See the [process
 dokku ps:restart app-name
 ```
 
+#### Scoping a mount to a process type
+
+> [!IMPORTANT]
+> New as of 0.38.29
+
+By default a mount is bound into every one of an app's containers. `--process-type` narrows it to a single Procfile process type, which is how a worker gets a scratch volume the web process has no business seeing:
+
+```shell
+dokku storage:create node-js-scratch
+dokku storage:mount node-js-app node-js-scratch --container-dir /scratch --process-type worker
+```
+
+The magic `_default_` process type is the unscoped case, and it is what a mount gets when `--process-type` is omitted. Default-scoped mounts are bound into every process; a mount scoped to a named process type is bound only into that one.
+
+Some containers belong to no process type at all - a `dokku run` one-off, the ephemeral containers that run `app.json` deploy tasks, and k3s cron jobs. Those receive default-scoped mounts only, since there is no process type for a named scope to match. On k3s this applies to the deploy phase; `--phase run` attachments are not mounted there at all.
+
+A container path can be claimed by only one mount per process type, so `storage:mount` rejects a container path that an overlapping scope already holds. The default scope overlaps every named one:
+
+```shell
+dokku storage:create node-js-data
+dokku storage:create node-js-cache
+
+dokku storage:mount node-js-app node-js-data --container-dir /app/storage
+# fails: the default-scoped mount above also applies to web
+dokku storage:mount node-js-app node-js-cache --container-dir /app/storage --process-type web
+```
+
+Two *named* scopes never apply to the same container, so they may each bind a different entry at the same container path:
+
+```shell
+dokku storage:mount node-js-app node-js-data --container-dir /app/storage --process-type web
+dokku storage:mount node-js-app node-js-cache --container-dir /app/storage --process-type worker
+```
+
+#### Replacing the entire mount set
+
+> [!IMPORTANT]
+> New as of 0.38.29. Per-mount attributes in the option list new as of 0.38.30.
+
+The form above mounts one entry at a time, so matching an app's mounts to a declared set means reading `storage:list`, computing the difference in both directions and issuing one `storage:mount` or `storage:unmount` per addition and removal - with a failure partway through leaving the app holding a mixture of the two sets. The `--replace` flag writes the whole set in a single call, taking `name:container-dir` pairs instead of a single entry and a `--container-dir` flag.
+
+```shell
+dokku storage:mount --replace node-js-app node-js-data:/app/storage node-js-cache:/cache
+```
+
+Anything previously mounted and not named in the call is unmounted. Each pair takes the same optional third field as the legacy colon form, a comma-separated list, and that list carries every mount-time attribute the mount needs, so two mounts declared in one call can differ in all of them:
+
+```shell
+dokku storage:mount --replace node-js-app \
+  node-js-data:/app/storage:ro,Z,volume-subpath=uploads,volume-chown=herokuish \
+  node-js-cache:/cache:phase=deploy,phase=run,noexec
+```
+
+| Token | Meaning |
+| --- | --- |
+| `ro` | Mount the volume read-only |
+| `rw` | Mount it read-write, the explicit opposite of `ro` and the default |
+| `volume-subpath=<path>` | Subpath within the entry |
+| `volume-chown=<option>` | Chown option applied at mount time |
+| `phase=<deploy\|run>` | Phase to mount in, repeated once per phase; both phases when omitted |
+| anything else | A Docker mount option, passed through verbatim in the order given |
+
+Order within the list does not matter, and the keys mirror the flags the single-entry form uses so each attribute has exactly one spelling. Phases are stored in `deploy,run` order however they were written, so re-issuing an equivalent call converges rather than registering a change. A token value cannot contain a comma, since the comma is what separates tokens; a subpath needing one is set with the single-entry form. Note that `storage:list` renders the Docker `-v` view and omits the subpath, chown and phases, so its output does not round-trip into `--replace` - `storage:report` shows every field.
+
+A pair whose first field starts with `/` is a legacy host path rather than an entry name, and registers its `legacy-<hash>` entry the same way the colon form does. Any other first field must name a registered entry, so a mistyped name is rejected rather than taken for a docker volume. A docker volume already mounted through the colon form is named here by the `legacy-<hash>` entry that `storage:list-entries` shows. Only the first field decides which entry a host path resolves to, so adding tokens to a pair never moves it onto a different one.
+
+Because each attribute has exactly one spelling in this form, `--phase`, `--volume-subpath`, `--volume-readonly`, `--volume-chown` and `--volume-options` are rejected with `--replace` rather than acting as call-level defaults a token overrides:
+
+```shell
+dokku storage:mount --replace node-js-app node-js-data:/app/storage --volume-subpath uploads
+```
+
+```
+ !     The --volume-subpath flag cannot be used with --replace; set volume-subpath=<path> in the mount spec instead
+```
+
+The single-entry form keeps all five flags.
+
+`--process-type` is the exception and scopes the replacement the same way it scopes a single mount, since it selects which mounts the call is authoritative over rather than describing any one of them. Omitting it replaces the `_default_` process type, leaving mounts scoped to a named process type in place:
+
+```shell
+dokku storage:mount --replace node-js-app node-js-data:/app/storage
+dokku storage:mount --replace node-js-app node-js-cache:/cache --process-type web
+```
+
+Every pair is parsed and validated before anything is written, so a rejected pair leaves the stored mounts untouched. A pair without a container directory, a container directory that is not absolute, an entry that is not registered, an entry whose scheduler does not match the app's, and a container directory named more than once in one call are all rejected. So are the option list's own mistakes: an unknown key, a key given more than once, an empty value, an empty option, `ro` and `rw` together, a phase that is neither `deploy` nor `run`, and a chown value the plugin does not understand. Rejecting an unknown key is what catches a typo like `volume-subpth=uploads`, which would otherwise be stored as a Docker mount option and surface only when the next deploy failed.
+
+> [!NOTE]
+> An empty pair list is rejected rather than treated as a request to unmount everything, so a generated list that expands to nothing cannot silently drop an app's storage. Use `storage:unmount --all` for that.
+
+As with a single mount, the app requires a restart afterward.
+
 ### Unmounting storage
 
-If an app no longer requires a mounted volume or directory, the `storage:unmount` command can be called. This takes the same arguments as the `storage:mount` command, an app name and a `host-path:container-path` or `docker-volume:container-path` combination.
+If an app no longer requires a mounted volume or directory, the `storage:unmount` command can be called. This takes the same arguments as the `storage:mount` command, an app name and a `host-path:container-path` or `docker-volume:container-path` combination, or a registered entry name.
 
 ```shell
 # unmount the directory from your container's /app/storage directory, relative to the container root (/)
@@ -281,6 +374,39 @@ dokku storage:unmount node-js-app /var/lib/dokku/data/storage/node-js-app:/app/s
 dokku storage:unmount node-js-app some-docker-volume:/app/storage
 ```
 
+> [!IMPORTANT]
+> Removing more than one attachment at a time is new as of 0.38.29
+
+More than one attachment can be removed in a single call, naming each by entry name or by the colon form. Every argument is resolved against the app's attachments before any of them is removed, so an argument naming an attachment the app does not have removes none of them:
+
+```shell
+dokku storage:unmount node-js-app node-js-data node-js-cache
+```
+
+An entry mounted at several container directories is disambiguated with `--container-dir`, which therefore applies only when a single entry is named. Naming the container directory in the argument itself works with any number of attachments:
+
+```shell
+dokku storage:unmount node-js-app node-js-data --container-dir /app/storage
+dokku storage:unmount node-js-app node-js-data:/app/storage node-js-data:/app/uploads
+```
+
+#### Removing every mount
+
+> [!IMPORTANT]
+> New as of 0.38.29
+
+The `--all` flag removes every attachment on an app. This is the empty case `storage:mount --replace` refuses to handle, and it takes no entry arguments:
+
+```shell
+dokku storage:unmount --all node-js-app
+```
+
+`--process-type` narrows what is removed to a single scope, filtering the same way it scopes a replacement. Omitting it removes every scope, and a scope that matches nothing is a no-op rather than an error, so the command is safe to re-run:
+
+```shell
+dokku storage:unmount --all node-js-app --process-type web
+```
+
 Once persistent storage is unmounted, the app requires a restart. See the [process scaling documentation](/docs/processes/process-management.md) for more information.
 
 ```shell
@@ -435,6 +561,8 @@ dokku storage:report node-js-app --format json | jq '. | with_entries(select(.ke
 }
 ```
 
+Indices are assigned in stored order, so `storage:mount --replace` renumbers them: the attachments it leaves in place keep their relative order and the declared ones follow.
+
 A single attachment field can be fetched directly via the info-flag form:
 
 ```shell
diff --git a/docs/advanced-usage/plugin-management.md b/docs/advanced-usage/plugin-management.md
index feb04ed01..b659c1d5a 100644
--- a/docs/advanced-usage/plugin-management.md
+++ b/docs/advanced-usage/plugin-management.md
@@ -36,35 +36,35 @@ dokku plugin:list
 
 ```
 plugn: dev
-  00_dokku-standard    0.38.27 enabled    dokku core standard plugin
-  20_events            0.38.27 enabled    dokku core events logging plugin
-  app-json             0.38.27 enabled    dokku core app-json plugin
-  apps                 0.38.27 enabled    dokku core apps plugin
-  build-env            0.38.27 enabled    dokku core build-env plugin
-  buildpacks           0.38.27 enabled    dokku core buildpacks plugin
-  certs                0.38.27 enabled    dokku core certificate management plugin
-  checks               0.38.27 enabled    dokku core checks plugin
-  common               0.38.27 enabled    dokku core common plugin
-  config               0.38.27 enabled    dokku core config plugin
-  docker-options       0.38.27 enabled    dokku core docker-options plugin
-  domains              0.38.27 enabled    dokku core domains plugin
-  enter                0.38.27 enabled    dokku core enter plugin
-  git                  0.38.27 enabled    dokku core git plugin
-  logs                 0.38.27 enabled    dokku core logs plugin
-  network              0.38.27 enabled    dokku core network plugin
-  nginx-vhosts         0.38.27 enabled    dokku core nginx-vhosts plugin
-  plugin               0.38.27 enabled    dokku core plugin plugin
-  proxy                0.38.27 enabled    dokku core proxy plugin
-  ps                   0.38.27 enabled    dokku core ps plugin
-  repo                 0.38.27 enabled    dokku core repo plugin
-  resource             0.38.27 enabled    dokku core resource plugin
-  scheduler-docker-local 0.38.27 enabled    dokku core scheduler-docker-local plugin
-  shell                0.38.27 enabled    dokku core shell plugin
-  ssh-keys             0.38.27 enabled    dokku core ssh-keys plugin
-  storage              0.38.27 enabled    dokku core storage plugin
-  tags                 0.38.27 enabled    dokku core tags plugin
-  tar                  0.38.27 enabled    dokku core tar plugin
-  trace                0.38.27 enabled    dokku core trace plugin
+  00_dokku-standard    0.38.34 enabled    dokku core standard plugin
+  20_events            0.38.34 enabled    dokku core events logging plugin
+  app-json             0.38.34 enabled    dokku core app-json plugin
+  apps                 0.38.34 enabled    dokku core apps plugin
+  build-env            0.38.34 enabled    dokku core build-env plugin
+  buildpacks           0.38.34 enabled    dokku core buildpacks plugin
+  certs                0.38.34 enabled    dokku core certificate management plugin
+  checks               0.38.34 enabled    dokku core checks plugin
+  common               0.38.34 enabled    dokku core common plugin
+  config               0.38.34 enabled    dokku core config plugin
+  docker-options       0.38.34 enabled    dokku core docker-options plugin
+  domains              0.38.34 enabled    dokku core domains plugin
+  enter                0.38.34 enabled    dokku core enter plugin
+  git                  0.38.34 enabled    dokku core git plugin
+  logs                 0.38.34 enabled    dokku core logs plugin
+  network              0.38.34 enabled    dokku core network plugin
+  nginx-vhosts         0.38.34 enabled    dokku core nginx-vhosts plugin
+  plugin               0.38.34 enabled    dokku core plugin plugin
+  proxy                0.38.34 enabled    dokku core proxy plugin
+  ps                   0.38.34 enabled    dokku core ps plugin
+  repo                 0.38.34 enabled    dokku core repo plugin
+  resource             0.38.34 enabled    dokku core resource plugin
+  scheduler-docker-local 0.38.34 enabled    dokku core scheduler-docker-local plugin
+  shell                0.38.34 enabled    dokku core shell plugin
+  ssh-keys             0.38.34 enabled    dokku core ssh-keys plugin
+  storage              0.38.34 enabled    dokku core storage plugin
+  tags                 0.38.34 enabled    dokku core tags plugin
+  tar                  0.38.34 enabled    dokku core tar plugin
+  trace                0.38.34 enabled    dokku core trace plugin
 ```
 
 The list can also be emitted as JSON via the `--format json` flag. In addition to the name, version, enabled state, and description shown in the default output, the JSON output includes whether a plugin is a core plugin and - for git-based third-party plugins - the install source (the git remote URL, the currently checked-out commit, and the followed branch). This is useful for tooling that reconstructs a server's set of installed plugins:
@@ -77,7 +77,7 @@ dokku plugin:list --format json
 [
   {
     "name": "apps",
-    "version": "0.38.27",
+    "version": "0.38.34",
     "enabled": true,
     "core": true,
     "description": "dokku core apps plugin",
@@ -249,6 +249,8 @@ dokku plugin:enable postgres
 -----> Plugin postgres enabled
 ```
 
+Core plugins that were not enabled at install time - such as the nginx-vhosts plugin when the `dokku/nginx_enable` debconf option is set to `false` - can also be enabled this way. Run `dokku plugin:install --core` afterwards so the plugin's install trigger is executed.
+
 ### Triggering a plugin trigger
 
 The `plugin:trigger` can be used to call any internal plugin trigger. This may have unintended consequences, and thus should only be called for development or debugging purposes.
diff --git a/docs/advanced-usage/registry-management.md b/docs/advanced-usage/registry-management.md
index c483eff37..0bd550b5e 100644
--- a/docs/advanced-usage/registry-management.md
+++ b/docs/advanced-usage/registry-management.md
@@ -4,10 +4,11 @@
 > New as of 0.25.0
 
 ```
-registry:login [--global|--password-stdin] [<app>] <server> <username> [<password>] # Login to a docker registry
-registry:logout [--global] [<app>] <server>                                         # Logout from a docker registry
-registry:report [<app>] [<flag>]                                                    # Displays a registry report for one or more apps
-registry:set <app>|--global <key> (<value>)                                         # Set or clear a registry property for an app
+registry:auth-status [--password-stdin] <app>|--global <server> [<username> [<password>]] # Reports whether the stored registry credential matches the requested state
+registry:login [--global|--password-stdin] [<app>] <server> <username> [<password>]       # Login to a docker registry
+registry:logout [--global] [<app>] <server>                                               # Logout from a docker registry
+registry:report [<app>] [<flag>]                                                          # Displays a registry report for one or more apps
+registry:set <app>|--global <key> (<value>)                                               # Set or clear a registry property for an app
 ```
 
 The registry plugin enables interacting with remote registries, which is useful when either deploying images via `git:from-image` or when interacting with custom schedulers to deploy built image artifacts.
@@ -85,6 +86,52 @@ dokku registry:logout node-js-app docker.io
 
 When an app is destroyed, any per-app registry credentials are automatically removed.
 
+### Checking the configured auth state
+
+> [!IMPORTANT]
+> New as of 0.38.29
+
+The `registry:auth-status` command reports whether a stored registry credential matches a desired state without exposing it. This allows external tooling such as configuration management systems to converge idempotently, rather than re-running `registry:login` on every pass to discover that nothing needed to change.
+
+```shell
+# check whether an app is configured with the expected credentials
+dokku registry:auth-status node-js-app ghcr.io $USERNAME $REGISTRY_PAT_TOKEN
+
+# check whether the global credentials match
+dokku registry:auth-status --global docker.io $USERNAME $PASSWORD
+
+# check whether any credential is configured for a server
+dokku registry:auth-status node-js-app ghcr.io
+```
+
+As with `registry:login`, the password may be provided via `STDIN`. This is the preferred form, as it keeps the password out of the process list:
+
+```shell
+echo "$PASSWORD" | dokku registry:auth-status --password-stdin node-js-app ghcr.io $USERNAME
+```
+
+The result is reported via the exit code, and nothing is printed when the state could be determined:
+
+| Exit code | Description |
+| --------- | ----------- |
+| `0` | The stored credential matches the requested state. |
+| `1` | There is no stored credential for the specified server. |
+| `2` | There is a stored credential for the specified server, but it does not match the requested state. |
+| `3` | The command was called with invalid arguments and the state could not be checked. |
+| `4` | A credential is stored for the specified server, but it cannot be compared. |
+| `20` | The specified app does not exist. |
+
+The distinction between `1` and `2` allows a caller to tell a server that needs a credential created apart from a server whose existing credential would be replaced, without issuing a second call.
+
+When called without a username, the requested state is that no credential exists for the server. An existing credential is therefore reported as `2`, and `1` is never returned. This is the check to perform before deciding whether a `registry:logout` is necessary.
+
+Exit code `4` is returned when a credential exists but Dokku cannot read the secret it holds - either because a docker credential helper is configured for that server and stores the secret outside of `config.json`, or because the registry issued an identity token in place of a password. In both cases a username that differs from the one supplied is still reported as `2`, so `4` means only that an otherwise matching credential could not be confirmed. Callers should treat `4` as "unknown" rather than retrying the login indefinitely.
+
+Unlike `registry:login`, the `--global` flag is required in order to check the global credentials - the deprecated implicit-global form is not accepted. A per-app check reads only the credentials created by `registry:login <app>` and does not fall back to the global credentials, so an app configured with a credential identical to the global one is still reported as needing one of its own. To see which credentials would actually be used for an app, read the `computed-auth-servers` field of `registry:report`.
+
+> [!WARNING]
+> A `0` exit code means the stored credential matches the one supplied, not that it still authenticates against the registry. A password that has been revoked upstream compares equal here and fails at push or pull time.
+
 ### Setting a remote server
 
 To specify a remote server registry for pushes, set the `server` property via the `registry:set` command. The default value for this property is empty string. Setting the value to `docker.io` or `hub.docker.com` will result in the computed value being empty string (as that is the default, implicit registry), while any non-zero length value will have a `/` appended to it if there is not one already.
@@ -196,7 +243,7 @@ dokku registry:set --global push-on-release
 
 When `push-on-release` is enabled, Dokku treats the remote registry as the canonical store for app images. If a local image disappears - for example because a `docker image prune` cron ran, the host rebooted, or an operator removed it manually - subsequent commands that need the image (`ps:restart`, `ps:scale`, `dokku run`, `domains:add`, `certs:add`, etc.) will pull the missing tag back from the registry automatically. Per-app registry credentials configured via `registry:login` are honored during the pull. This recovery covers the deployed numeric tag pushed by the registry plugin - a missing `latest` tag will be ignored.
 
-### Push extra tags 
+### Push extra tags
 
 To push the image on release with extra tags, set the `push-extra-tags` to a comma-separated list of tags via the `registry:set` command. The default value for this property is empty. Setting the property will result in the image being tagged with extra tags every release.
 
@@ -204,6 +251,7 @@ To push the image on release with extra tags, set the `push-extra-tags` to a com
 # multiple-tags
 dokku registry:set node-js-app push-extra-tags foo,bar
 ```
+
 The `push-extra-tags` can be set to a single tag too.
 
 ```shell
@@ -235,9 +283,26 @@ dokku registry:set --global push-extra-tags
 > The `Report flags` column lists the CLI argument names accepted by `registry:report`. The JSON keys emitted by `registry:report --format json` are the same names with the leading `--registry-` stripped (e.g. `image-repo`, `global-server`, `computed-push-on-release`). Legacy keys with the `registry-` prefix (e.g. `registry-image-repo`) are also emitted during the 0.38.x deprecation window and will be removed in a future major release.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `image-repo` | app only | `dokku/<app>` | `--registry-image-repo`, `--registry-computed-image-repo` | Repository name used when pushing the app's image (overrides the global template) |
 | `image-repo-template` | app + global | none | `--registry-image-repo-template`, `--registry-global-image-repo-template`, `--registry-computed-image-repo-template` | Go template used to compute the per-app image repository when `image-repo` is unset |
 | `push-extra-tags` | app + global | none | `--registry-push-extra-tags`, `--registry-global-push-extra-tags`, `--registry-computed-push-extra-tags` | Comma-separated list of additional tags pushed alongside the deploy tag |
 | `push-on-release` | app + global | `false` | `--registry-push-on-release`, `--registry-global-push-on-release`, `--registry-computed-push-on-release` | When `true`, pushes the image to the registry on every successful build |
 | `server` | app + global | none | `--registry-server`, `--registry-global-server`, `--registry-computed-server` | Registry server host (e.g. `ghcr.io`) used when pushing images |
+
+### Read-only report fields
+
+> [!IMPORTANT]
+> New as of 0.38.29
+
+The following `registry:report` fields describe credentials created by `registry:login` and are not settable via `registry:set`.
+
+| Report flag | Scope | Description |
+| --- | --- | --- |
+| `--registry-auth-servers` | app only | Comma-separated list of servers the app has its own credentials for |
+| `--registry-global-auth-servers` | app + global | Comma-separated list of servers the global credentials cover |
+| `--registry-computed-auth-servers` | app + global | Comma-separated list of servers whose credentials would be used for the app |
+
+Servers are listed under the name they would be passed to `registry:login`, so a Docker Hub credential is reported as `docker.io` rather than the index server address docker stores it under. Only the server names are reported; no part of a credential is ever emitted.
+
+Docker is pointed at one config directory or the other rather than a merge of the two, so an app with any credential of its own shadows the global credentials entirely. The computed value is therefore the app's own list when it has one and the global list otherwise, rather than a per-server merge of the two.
diff --git a/docs/advanced-usage/repository-management.md b/docs/advanced-usage/repository-management.md
index 5e1c67ccf..15ec25ae6 100644
--- a/docs/advanced-usage/repository-management.md
+++ b/docs/advanced-usage/repository-management.md
@@ -35,3 +35,5 @@ Building containers with buildpacks currently results in a persistent `cache` di
 ```shell
 dokku repo:purge-cache node-js-app
 ```
+
+To purge the cache and rebuild the app in a single command, see the [rebuilding without the build cache](/docs/processes/process-management.md#rebuilding-without-the-build-cache) documentation.
diff --git a/docs/advanced-usage/resource-management.md b/docs/advanced-usage/resource-management.md
index 804397489..cfffb6b2e 100644
--- a/docs/advanced-usage/resource-management.md
+++ b/docs/advanced-usage/resource-management.md
@@ -5,10 +5,10 @@
 
 ```
 resource:limit [--process-type <process-type>] [RESOURCE_OPTS...] <app>    # Limit resources for a given app/process-type combination
-resource:limit-clear [--process-type <process-type>] <app>                 # Limit resources for a given app/process-type combination
+resource:limit-clear [--process-type <process-type>] <app>                 # Clear resource limits for a given app/process-type combination
 resource:report [<app>] [<flag>]                                           # Displays a resource report for one or more apps
 resource:reserve [--process-type <process-type>] [RESOURCE_OPTS...] <app>  # Reserve resources for a given app/process-type combination
-resource:reserve-clear [--process-type <process-type>] <app>               # Reserve resources for a given app/process-type combination
+resource:reserve-clear [--process-type <process-type>] <app>               # Clear resource reservations for a given app/process-type combination
 ```
 
 The resource plugin is meant to allow users to limit or reserve resources for a given app/process-type combination.
@@ -30,6 +30,8 @@ Valid resource options include:
 - `--network-egress`
 - `--nvidia-gpu`
 
+Values for `--memory` and `--memory-swap` are validated when set, and invalid values are rejected.
+
 See the [Supported Resource Management Properties](/docs/deployment/schedulers/docker-local.md#supported-resource-management-properties) section of the docker local scheduler documentation for more information on how each resource limit maps to Docker.
 
 Resource reservations are applied only during the `run` and `deploy` phases of an application. Resource limits also apply during the `build` phase when explicitly configured against the `build` process type - see [Build-time Resource Limits](#build-time-resource-limits) below.
@@ -156,24 +158,24 @@ Resource keys outside the supported set for a builder are silently ignored. Rese
 
 #### Clearing Resource Limits
 
-In cases where the values are incorrect - or there is no desire to limit resources - resource limits may be cleared using the `resource:limit-clear` command.
+In cases where the values are incorrect - or there is no desire to limit resources - resource limits may be cleared using the `resource:limit-clear` command. When no process type is specified, resource limits are cleared for all process types. Resource reservations are left untouched.
 
 ```shell
 dokku resource:limit-clear node-js-app
 ```
 
 ```
------> Clearing resource limit for node-js-app
+=====> clearing node-js-app limits
 ```
 
-Defaults can also be cleared by leaving the app unspecified.
+Resource limits for a single process type can be cleared by specifying the `--process-type` flag.
 
 ```shell
-dokku resource:limit-clear
+dokku resource:limit-clear --process-type worker node-js-app
 ```
 
 ```
------> Clearing default resource limits
+=====> clearing node-js-app limits (worker)
 ```
 
 ### Resource Reservations
@@ -264,24 +266,24 @@ dokku resource:reserve --process-type web node-js-app
 
 #### Clearing Resource Reservations
 
-In cases where the values are incorrect - or there is no desire to reserve resources - resource reservations may be cleared using the `resource:reserve-clear` command.
+In cases where the values are incorrect - or there is no desire to reserve resources - resource reservations may be cleared using the `resource:reserve-clear` command. When no process type is specified, resource reservations are cleared for all process types. Resource limits are left untouched.
 
 ```shell
 dokku resource:reserve-clear node-js-app
 ```
 
 ```
------> Clearing resource reservation for node-js-app
+=====> clearing node-js-app reservation
 ```
 
-Defaults can also be cleared by leaving the app unspecified.
+Resource reservations for a single process type can be cleared by specifying the `--process-type` flag.
 
 ```shell
-dokku resource:reserve-clear
+dokku resource:reserve-clear --process-type worker node-js-app
 ```
 
 ```
------> Clearing default resource reservation
+=====> clearing node-js-app reservation (worker)
 ```
 
 ### Displaying resource reports for an app
diff --git a/docs/appendices/0.24.0-migration-guide.md b/docs/appendices/0.24.0-migration-guide.md
index 68132a753..97e1d94be 100644
--- a/docs/appendices/0.24.0-migration-guide.md
+++ b/docs/appendices/0.24.0-migration-guide.md
@@ -8,5 +8,5 @@
 ## Deprecations
 
 - The 1.0.0 release of Dokku will no longer select buildpack builders over dockerfile builders if both builders match. Instead, Dokku will choose the first builder that responds to the `builder-detect` trigger. Users that wish to use a specific builder may set a builder using the `builder:set` command, which will force Dokku to use the specified builder regardless of what might be auto-detected.
-- The `tags` plugin is deprecated in favor of the [`git:from-image`](/docs/deployment/methods/git.md#initializing-an-app-repository-from-a-docker-image) command. It will be removed in the next minor release, and is considered unmaintained. Users are highly encouraged to switch their workflows to `git:from-image`.
-- The `tar` plugin is deprecated in favor of the [`git:from-archive`](/docs/deployment/methods/git.md#initializing-an-app-repository-from-an-archive-file) command. It will be removed in the next minor release, and is considered unmaintained. Users are highly encouraged to switch their workflows to `git:from-archive`.
+- The `tags` plugin is deprecated in favor of the [`git:from-image`](/docs/deployment/methods/image.md#initializing-an-app-repository-from-a-docker-image) command. It will be removed in the next minor release, and is considered unmaintained. Users are highly encouraged to switch their workflows to `git:from-image`.
+- The `tar` plugin is deprecated in favor of the [`git:from-archive`](/docs/deployment/methods/archive.md#initializing-an-app-repository-from-an-archive-file) command. It will be removed in the next minor release, and is considered unmaintained. Users are highly encouraged to switch their workflows to `git:from-archive`.
diff --git a/docs/appendices/0.25.0-migration-guide.md b/docs/appendices/0.25.0-migration-guide.md
index c6ebb6609..c8c5a1579 100644
--- a/docs/appendices/0.25.0-migration-guide.md
+++ b/docs/appendices/0.25.0-migration-guide.md
@@ -24,7 +24,7 @@ Before upgrading, uninstall the registry plugin via `dokku plugin:uninstall regi
 
 ### Deprecations
 
-- In previous versions of Dokku, the only way to specify a custom `Dockerfile` was to use the `docker-options` plugin to set the `--file` flag for a docker build. As of 0.25.0, the `builder-dockerfile:set` command should be used instead, as outlined in the [docs here](/docs/deployment/builders/dockerfiles.md#changingthe-dockerfile-location). Usage of the old method should be migrated to the new method.
+- In previous versions of Dokku, the only way to specify a custom `Dockerfile` was to use the `docker-options` plugin to set the `--file` flag for a docker build. As of 0.25.0, the `builder-dockerfile:set` command should be used instead, as outlined in the [docs here](/docs/deployment/builders/dockerfiles.md#changing-the-dockerfile-location). Usage of the old method should be migrated to the new method.
 - The `--rm` and `--rm-container` flags may be specified but no longer have any effect on `dokku run`.
 - The `--detach` flag is deprecated in favor of the `run:detached` command.
 - The `DOKKU_SCALE` file is deprecated. Please see the [process management documentation](/docs/processes/process-management.md#manually-managing-process-scaling) for more information on it's replacement with the `formation` key of the `app.json` file.
diff --git a/docs/appendices/0.35.0-migration-guide.md b/docs/appendices/0.35.0-migration-guide.md
index e12bbc383..2ee7642c7 100644
--- a/docs/appendices/0.35.0-migration-guide.md
+++ b/docs/appendices/0.35.0-migration-guide.md
@@ -6,11 +6,14 @@
 - The default image used for Cloud Native Buildpack builds is now `heroku/builder:24`, and is based on both the `heroku-24` stack as well as Ubuntu 24.04. Users that wish to stick with the old, `heroku-22`/Ubuntu 22.04 builder may specify `heroku/buildpacks:22` as their builder image. Please see the [cloud native buildpack deployment documentation](/docs/deployment/builders/cloud-native-buildpacks.md#customizing-the-buildpack-stack-builder) for more information on how to specify a custom buildpack stack builder.
 - The default image used for Herokuish Buildpack builds is now `gliderlabs/herokuish:latest-24`, and is based on both the `heroku-24` stack as well as Ubuntu 24.04. Users that wish to stick with the old, `heroku-22`/Ubuntu 22.04 builder may specify `gliderlabs/herokuish:latest-22` as their builder image. Please see the [herokuish buildpack deployment documentation](/docs/deployment/builders/herokuish-buildpacks.md#customizing-the-buildpack-stack-builder) for more information on how to specify a custom buildpack stack builder.
 - The `vector` image used by Dokku for enhanced logging support has been upgraded from 0.39.x to 0.41.x. To take advantage of the new image, execute the following commands:
+
     ```
     dokku logs:vector-stop
     dokku logs:vector-start
     ```
+
 - The `openresty` image used by Dokku for proxying via openresty has been upgraded from 0.8.0 to 0.9.0. To take advantage of the new image, execute the following commands:
+
     ```
     dokku openresty:stop
     dokku openresty:start
diff --git a/docs/appendices/0.38.0-migration-guide.md b/docs/appendices/0.38.0-migration-guide.md
index 835a38def..da17e52bb 100644
--- a/docs/appendices/0.38.0-migration-guide.md
+++ b/docs/appendices/0.38.0-migration-guide.md
@@ -45,7 +45,7 @@ A number of `DOKKU_*` config environment variables have been replaced with prope
 Going forward, configure these settings using the property commands listed below. Setting the deprecated env vars via `dokku config:set` will no longer have any effect.
 
 | Deprecated Env Var | Replacement Command |
-|---|---|
+| --- | --- |
 | `DOKKU_APP_PROXY_TYPE` | `dokku proxy:set <app> type <value>` |
 | `DOKKU_APP_RESTORE` | `dokku ps:set <app> restore <true\|false>` |
 | `DOKKU_APP_SHELL` | `dokku scheduler:set <app> shell <value>` |
diff --git a/docs/appendices/0.39.0-migration-guide.md b/docs/appendices/0.39.0-migration-guide.md
new file mode 100644
index 000000000..5d0165bce
--- /dev/null
+++ b/docs/appendices/0.39.0-migration-guide.md
@@ -0,0 +1,38 @@
+# 0.39.0 Migration Guide
+
+## Changes
+
+- The buildpack `stack` property has been split out of the `buildpacks` plugin and into the two builder plugins that consume it. Previously a single `stack` value set via `buildpacks:set-property` was shared by both the herokuish and CNB (`pack`) builders, even though a herokuish stack image is not a valid CNB builder and vice versa. The herokuish stack is now managed via `builder-herokuish:set <app> stack <value>` (default `gliderlabs/herokuish:latest-24`), and the CNB builder is managed via `builder-pack:set <app> stack <value>` (default `heroku/builder:24`). Both support the `--global` scope and expose `stack`, `global-stack`, and `computed-stack` keys via their respective `:report` commands.
+- The `buildpacks:set-property stack` command is deprecated but continues to work. It emits a deprecation warning and forwards the value to the appropriate builder: values referencing a herokuish image (the value contains `herokuish`) are written to `builder-herokuish`, and all other values are written to `builder-pack`. Unsetting (`buildpacks:set-property <app> stack`) clears the value on both builders.
+- The `--buildpacks-stack`, `--buildpacks-global-stack`, and `--buildpacks-computed-stack` report flags (and the corresponding `stack`, `global-stack`, `computed-stack` JSON keys) have been removed from `buildpacks:report`. Use `builder-herokuish:report` and `builder-pack:report` instead. The `buildpacks:report` command continues to report the buildpacks `list`.
+- The internal `buildpack-stack-name` plugin trigger has been removed. Each builder now reads its own `stack` property directly during the build.
+- Changing a builder's `stack` now clears that builder's build cache so the next deploy starts fresh. For herokuish this removes the `cache-<app>` Docker volume; for pack the next `pack build` runs with `--clear-cache`.
+- The `dokku` Debian package now declares `coredns-docker (>= 0.8.0)` as a hard `Depends:`. `apt install dokku` and `apt upgrade dokku` pull it in automatically. The deb ships a default `/etc/coredns/Corefile` that binds `127.0.0.1:1053`, serves the `docker.` zone, and synthesizes `<app>.<process-type>.docker` and `<app>.docker` `A` records from the `com.dokku.app-name` and `com.dokku.process-type` labels Dokku already stamps on every deployed container. The Docker image of Dokku ships coredns-docker preinstalled and runs it under runit on the same port.
+- The bundled `nginx.conf.sigil` can now use an nginx `resolver` directive and a variable-based `proxy_pass` against `<app>.<process-type>.docker` instead of pinning the upstream to a literal IP. This addresses the long-standing post-reboot and post-`apt-upgrade-docker` stale-vhost bug ([#8313](https://github.com/dokku/dokku/issues/8313)) - the rendered upstream re-resolves at request time via coredns-docker, so a host reboot or single-container restart no longer leaves nginx routing to a stale IP. This behavior is opt-in, and upstreams remain IP-based unless `dns-resolver` is set:
+
+    ```shell
+    dokku nginx:set --global dns-resolver 127.0.0.1:1053
+    dokku proxy:build-config --all
+    ```
+
+    See the [nginx documentation](/docs/networking/proxies/nginx.md#upstream-resolution-via-coredns-docker) for details.
+- Three new nginx properties control the resolver path:
+
+    - `dns-resolver` (default: none) - the address nginx talks to. Resolver-based upstreams are only rendered when this is set.
+    - `dns-resolver-timeout` (default: `5s`) - how long nginx waits for a DNS response before giving up and returning 502. The short default keeps clients from waiting on nginx's built-in 30s timeout when coredns-docker is unreachable.
+    - `dns-zone` (default: `docker`) - the suffix appended to `<app>.<process-type>` when constructing the upstream hostname.
+
+    All three can be set per app or globally via `dokku nginx:set`.
+- Vendored `nginx.conf.sigil` templates are unaffected by the change. The existing `DOKKU_APP_<PROC>_LISTENERS` variable continues to be populated with the IP-based listener list exactly as before, so templates that only reference it continue to render IP-based upstreams regardless of the new properties. To opt a vendored template into the resolver path, switch its `proxy_pass` line to use the new `DOKKU_APP_<PROC>_LISTENER_HOST`, `NGINX_DNS_RESOLVER`, `NGINX_DNS_RESOLVER_TIMEOUT`, and `NGINX_DNS_ZONE` sigil variables - see the [nginx.conf.sigil reference](/docs/appendices/file-formats/nginx-conf-sigil.md#upstream-rendering-ip-based-vs-dns-based) for the exact snippet.
+
+### Stack property migrated to builder plugins
+
+Existing `stack` values stored via `buildpacks:set-property` are migrated automatically the first time `dokku` runs the buildpacks plugin install step after the upgrade. Each per-app and global value is moved to `builder-herokuish` or `builder-pack` based on the same herokuish detection used by the deprecated command, and the old `buildpacks` value is removed. No manual action is required.
+
+Going forward, configure the stack using the builder commands:
+
+| Deprecated command | Replacement command |
+|---|---|
+| `dokku buildpacks:set-property <app> stack <herokuish-image>` | `dokku builder-herokuish:set <app> stack <herokuish-image>` |
+| `dokku buildpacks:set-property <app> stack <cnb-builder>` | `dokku builder-pack:set <app> stack <cnb-builder>` |
+| `dokku buildpacks:set-property --global stack <value>` | `dokku builder-herokuish:set --global stack <value>` / `dokku builder-pack:set --global stack <value>` |
diff --git a/docs/appendices/0.5.0-migration-guide.md b/docs/appendices/0.5.0-migration-guide.md
index fe0f1fd6b..fbc69f5e6 100644
--- a/docs/appendices/0.5.0-migration-guide.md
+++ b/docs/appendices/0.5.0-migration-guide.md
@@ -5,11 +5,11 @@
 - The nginx-vhosts template language is now [sigil](https://github.com/gliderlabs/sigil)
     - No need to escape literal `$` characters (or other "bash-isms")
     - Template variables are represented as {{ .VARIABLE_NAME }}
-    - A detailed list of template variables can be found [here](/docs/networking/proxies/nginx.md#available-template-variables)
+    - A detailed list of template variables can be found in the [available template variables documentation](/docs/networking/proxies/nginx.md#available-template-variables)
 - A custom nginx-vhosts template must be named `nginx.conf.sigil`
     - The default path for this custom template is the root of your repo (i.e. `/app` in the container or `WORKDIR` if defined in a dockerfile app)
     - Dokku no longer looks for this file in `/home/dokku/node-js-app` on the Dokku server
-    - Check out an example template [here](/docs/networking/proxies/nginx.md)
+    - Check out an [example template](/docs/networking/proxies/nginx.md)
 - Support for server-wide SSL certs have been dropped in favor of using the `certs` plugin
     - `dokku certs:add node-js-app < certs.tar`
 - All domains for an SSL-enabled app will be redirected to https by default
diff --git a/docs/appendices/file-formats/app-json.md b/docs/appendices/file-formats/app-json.md
index 4146aeb82..8448d85d7 100644
--- a/docs/appendices/file-formats/app-json.md
+++ b/docs/appendices/file-formats/app-json.md
@@ -90,6 +90,7 @@ Environment variables from `app.json` are processed during the first deploy, bef
 4. **Optional variables without a value**: Skipped silently if no TTY is available
 
 On subsequent deploys:
+
 - Variables are NOT re-set unless `sync: true` is specified
 - Variables with `sync: true` are always set to their configured value, overwriting any manual changes
 - Variables that already have values are not modified
@@ -97,6 +98,7 @@ On subsequent deploys:
 ### Examples
 
 **Simple default value:**
+
 ```json
 {
   "env": {
@@ -106,6 +108,7 @@ On subsequent deploys:
 ```
 
 **Generated secret (recommended for API keys, tokens, etc.):**
+
 ```json
 {
   "env": {
@@ -118,6 +121,7 @@ On subsequent deploys:
 ```
 
 **Required variable that must be provided:**
+
 ```json
 {
   "env": {
@@ -130,6 +134,7 @@ On subsequent deploys:
 ```
 
 **Variable that stays in sync with app.json:**
+
 ```json
 {
   "env": {
@@ -158,7 +163,7 @@ On subsequent deploys:
 
 - `autoscaling` (map of string to object, optional) autoscaling rules. See the autoscaling section for more details
 - `max_parallel`: (int, optional) number of instances to deploy in parallel at a given time
-- `quantity`: (int, optional) number of processes to maintain. Default 1 for web processes, 0 for all others.
+- `quantity`: (int, optional) number of processes to maintain. Must be zero or greater. Default 1 for web processes, 0 for all others.
 - `service`: (map of string to oject, optional) governs how non-web processes are exposed as services on the network
 
 ### Autoscaling
@@ -244,9 +249,9 @@ An autoscaling trigger consists of the following properties:
 - `initialDelay`: (int, optional)
 - `listening`: (boolean, optional)
 - `name`: (string, optional)
-- `path`: (string, optional)
+- `path`: (string, optional) Must start with a `/` and must not contain whitespace, control characters, quotes, or backslashes. Deploys with an invalid `path` will fail.
 - `port`: (int, optional)
-- `scheme`: (string, optional)
+- `scheme`: (string, optional) Must be either `http` or `https`. Deploys with an invalid `scheme` will fail.
 - `timeout`: (int, optional)
 - `type`: (string, optional)
 - `uptime`: (int, optional)
diff --git a/docs/appendices/file-formats/nginx-conf-sigil.md b/docs/appendices/file-formats/nginx-conf-sigil.md
index 3de3fdbf6..f8aca1267 100644
--- a/docs/appendices/file-formats/nginx-conf-sigil.md
+++ b/docs/appendices/file-formats/nginx-conf-sigil.md
@@ -1,13 +1,18 @@
 # nginx.conf.sigil
 
-The `nginx.conf.sigil` file is used to configure the nginx server for an application. The default template can be found [here](https://github.com/dokku/dokku/blob/master/plugins/nginx-vhosts/templates/nginx.conf.sigil). Dokku uses a tool named [sigil](https://github.com/gliderlabs/sigil) to generate the nginx configuration based on the template provided.
+The `nginx.conf.sigil` file is used to configure the nginx server for an application. The [default template](https://github.com/dokku/dokku/blob/master/plugins/nginx-vhosts/templates/nginx.conf.sigil) is in the nginx-vhosts plugin. Dokku uses a tool named [sigil](https://github.com/gliderlabs/sigil) to generate the nginx configuration based on the template provided.
 
 ## Validation
 
-A custom `nginx.conf.sigil` is pre-validated at the start of every deploy, immediately after it is extracted from the source tree and before the build phase runs. Pre-validation renders the template via sigil with the same parameters used at deploy time, wraps the rendered config in a minimal `events`/`http` scaffold, and runs `nginx -t` against the result. The deploy is aborted if either the sigil render or the `nginx -t` check fails, so build work is not wasted on a syntactically invalid template. When no app listeners exist yet (typical for first deploys), pre-validation injects a placeholder `127.0.0.1:5000` listener for `DOKKU_APP_WEB_LISTENERS` so that the rendered upstream block has a static server entry and `nginx -t` does not bail out on "host not found in upstream".
+A custom `nginx.conf.sigil` is pre-validated at the start of every deploy, immediately after it is extracted from the source tree and before the build phase runs. Pre-validation renders the template via sigil with the same parameters used at deploy time, wraps the rendered config in a minimal `events`/`http` scaffold, and runs `nginx -t` against the result. The deploy is aborted if either the sigil render or the `nginx -t` check fails, so build work is not wasted on a syntactically invalid template. When no app listeners exist yet (typical for first deploys), pre-validation injects placeholders so the rendered config parses cleanly under `nginx -t`:
+
+- `DOKKU_APP_WEB_LISTENERS` is set to `127.0.0.1:5000` so the legacy `upstream` block has a static server entry.
+- `DOKKU_APP_WEB_LISTENER_HOST` is set to `127.0.0.1` so the resolver-based `set $dokku_upstream "...";` line renders to a syntactically valid value.
 
 Pre-validation is skipped when the proxy type is not `nginx` or when `disable-custom-config` is set to `true` for the app.
 
+The wrapper declares the same `user` directive as the host's main nginx config, exposed to the wrapper template as `$.NGINX_USER`. This matters because `nginx -t` runs as `root` and chowns every directory the config registers - in particular any `proxy_cache_path` - to whichever user the config resolves to, whether or not that directory already exists. Without a matching `user`, validating a template that declares a `proxy_cache_path` would hand the running server's live cache directory to nginx's compile-time default user for the length of the build, and every request served from or stored in that cache would fail with a permission error until the deploy's own nginx reload restored the ownership.
+
 ### Custom nginx modules
 
 Pre-validation runs `nginx -t` against a minimal wrapper config that does _not_ include the top-level `load_module` directives from the global `/etc/nginx/nginx.conf`. A `nginx.conf.sigil` that uses a directive provided by a dynamically loaded module - such as `image_filter`, provided by the [ngx_http_image_filter_module](https://nginx.org/en/docs/http/ngx_http_image_filter_module.html) - therefore fails pre-validation with an `unknown directive` error, even though `nginx -t` succeeds against the real server config where the module is loaded.
@@ -35,6 +40,7 @@ The custom `validate.conf.sigil`, which is the [default wrapper](https://github.
 
 ```
 load_module modules/ngx_http_image_filter_module.so;
+{{ if $.NGINX_USER }}user {{ $.NGINX_USER }};{{ end }}
 events { worker_connections 768; }
 http {
   access_log off;
@@ -43,6 +49,8 @@ http {
 }
 ```
 
+A custom wrapper that omits the `user` line still has one injected before `nginx -t` runs, so wrappers written against older Dokku releases keep working, but declaring it explicitly documents the behavior and keeps the template self-contained.
+
 The same override also governs the standalone `dokku nginx:validate-config` command, which renders the `validate-config` template as well.
 
 ## HTTP/2
@@ -63,3 +71,50 @@ listen      {{ if $.NGINX_BIND_ADDRESS_IP4 }}{{ $.NGINX_BIND_ADDRESS_IP4 }}:{{en
 ```
 
 Dokku logs a deprecation warning during deploys when a custom template still uses the `listen ... http2` form, so the offending template can be located via the deploy output.
+
+## Upstream Rendering: IP-based vs DNS-based
+
+> [!IMPORTANT]
+> New as of 0.39.0
+
+The bundled `nginx.conf.sigil` supports two rendering paths for the upstream, and both sets of sigil variables are populated on every render. Vendored templates can use either path independently of the global `dns-resolver` setting.
+
+### IP-based upstream (legacy path)
+
+The classic form uses `DOKKU_APP_<PROC>_LISTENERS`: a space-separated `<ip>:<port>` list, one entry per scaled instance of the process type. The IPs come from `/home/dokku/<APP>/IP.<proc>.<index>` and the ports from `/home/dokku/<APP>/PORT.<proc>.<index>`. A typical use is an `upstream` block with one `server <ip>:<port>;` per instance:
+
+```nginx
+upstream {{ $.APP }}-{{ $upstream_port }} {
+{{ range $listeners := $.DOKKU_APP_WEB_LISTENERS | split " " }}
+{{ $listener_list := $listeners | split ":" }}
+{{ $listener_ip := index $listener_list 0 }}
+  server {{ $listener_ip }}:{{ $upstream_port }};{{ end }}
+}
+```
+
+This path renders the IP that Dokku saw when the config was last built. After a host reboot, an `apt upgrade docker` without live-restore, or a single container restart, those IPs can become stale until `dokku proxy:build-config` runs again. The DNS-based path below addresses that staleness.
+
+### DNS-based upstream (resolver path)
+
+The new variables (`DOKKU_APP_<PROC>_LISTENER_HOST` + `NGINX_DNS_RESOLVER` + `NGINX_DNS_RESOLVER_TIMEOUT` + `NGINX_DNS_ZONE`) describe a single hostname per process type of the form `<app>.<proctype>.<dns-zone>` (for example, `myapp.web.docker`). The hostname is served by [coredns-docker](https://github.com/dokku/coredns-docker) (>= `0.8.0`), which watches Docker events and collapses every running instance of the process type onto one multi-A record set. Combined with an nginx `resolver` directive and a variable-based `proxy_pass`, the upstream re-resolves at request time honoring DNS TTL - which gives runtime IP refresh on container restarts and DNS round-robin across scaled instances.
+
+The bundled template emits this snippet:
+
+```nginx
+{{ if $.NGINX_DNS_RESOLVER }}
+resolver {{ $.NGINX_DNS_RESOLVER }} valid=10s ipv6=off;
+resolver_timeout {{ $.NGINX_DNS_RESOLVER_TIMEOUT }};
+set $dokku_upstream "{{ $.DOKKU_APP_WEB_LISTENER_HOST }}:{{ $upstream_port }}";
+proxy_pass http://$dokku_upstream;
+{{ else }}
+proxy_pass http://{{ $.APP }}-{{ $upstream_port }};
+{{ end }}
+```
+
+The `$dokku_upstream` variable name is intentionally namespaced (rather than `$upstream`) so vendored templates that already define `$upstream` will not collide if they adopt the resolver branch.
+
+`NGINX_DNS_RESOLVER` is empty by default, `NGINX_DNS_RESOLVER_TIMEOUT` defaults to `5s`, and `NGINX_DNS_ZONE` defaults to `docker`; all three are configurable via `dokku nginx:set --global dns-resolver ...`, `dokku nginx:set --global dns-resolver-timeout ...`, and `dokku nginx:set --global dns-zone ...`. The bundled template only renders the resolver branch when `NGINX_DNS_RESOLVER` is set, for example to `127.0.0.1:1053`. Unsetting `dns-resolver` switches the bundled template back to the IP-based upstream. The short default `dns-resolver-timeout` keeps clients from waiting on nginx's built-in 30s timeout when coredns-docker is unreachable; nginx returns 502 after the configured interval instead.
+
+### Choosing between the two
+
+The IP-based path is the default for the bundled template, and the DNS-based path is used once `dns-resolver` is set. Vendored templates that have not been updated continue to use `DOKKU_APP_<PROC>_LISTENERS` and are unaffected by the `dns-resolver` setting. The `DOKKU_APP_<PROC>_LISTENER_HOST` and `NGINX_DNS_ZONE` variables are populated regardless of whether `dns-resolver` is set, so a vendored template can adopt the resolver path on its own schedule by switching its rendering snippet, even if other apps on the host are still using IP-based upstreams.
diff --git a/docs/assets/favicons/browserconfig.xml b/docs/assets/favicons/browserconfig.xml
index 55222fd91..1070f13cf 100644
--- a/docs/assets/favicons/browserconfig.xml
+++ b/docs/assets/favicons/browserconfig.xml
@@ -2,10 +2,10 @@
 <browserconfig>
   <msapplication>
     <tile>
-      <square70x70logo src="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/mstile-70x70.png"/>
-      <square150x150logo src="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/mstile-150x150.png"/>
-      <square310x310logo src="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/mstile-310x310.png"/>
-      <wide310x150logo src="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/mstile-310x150.png"/>
+      <square70x70logo src="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/mstile-70x70.png"/>
+      <square150x150logo src="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/mstile-150x150.png"/>
+      <square310x310logo src="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/mstile-310x310.png"/>
+      <wide310x150logo src="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/mstile-310x150.png"/>
       <TileColor>#da532c</TileColor>
     </tile>
   </msapplication>
diff --git a/docs/assets/favicons/manifest.json b/docs/assets/favicons/manifest.json
index 390cdac08..c15a91573 100644
--- a/docs/assets/favicons/manifest.json
+++ b/docs/assets/favicons/manifest.json
@@ -2,37 +2,37 @@
     "name": "Dokku",
     "icons": [
         {
-            "src": "https:\/\/cdn.jsdelivr.net\/dokku\/dokku@v0.38.27\/docs\/assets\/favicons\/android-chrome-36x36.png",
+            "src": "https:\/\/cdn.jsdelivr.net\/dokku\/dokku@v0.38.34\/docs\/assets\/favicons\/android-chrome-36x36.png",
             "sizes": "36x36",
             "type": "image\/png",
             "density": "0.75"
         },
         {
-            "src": "https:\/\/cdn.jsdelivr.net\/dokku\/dokku@v0.38.27\/docs\/assets\/favicons\/android-chrome-48x48.png",
+            "src": "https:\/\/cdn.jsdelivr.net\/dokku\/dokku@v0.38.34\/docs\/assets\/favicons\/android-chrome-48x48.png",
             "sizes": "48x48",
             "type": "image\/png",
             "density": "1.0"
         },
         {
-            "src": "https:\/\/cdn.jsdelivr.net\/dokku\/dokku@v0.38.27\/docs\/assets\/favicons\/android-chrome-72x72.png",
+            "src": "https:\/\/cdn.jsdelivr.net\/dokku\/dokku@v0.38.34\/docs\/assets\/favicons\/android-chrome-72x72.png",
             "sizes": "72x72",
             "type": "image\/png",
             "density": "1.5"
         },
         {
-            "src": "https:\/\/cdn.jsdelivr.net\/dokku\/dokku@v0.38.27\/docs\/assets\/favicons\/android-chrome-96x96.png",
+            "src": "https:\/\/cdn.jsdelivr.net\/dokku\/dokku@v0.38.34\/docs\/assets\/favicons\/android-chrome-96x96.png",
             "sizes": "96x96",
             "type": "image\/png",
             "density": "2.0"
         },
         {
-            "src": "https:\/\/cdn.jsdelivr.net\/dokku\/dokku@v0.38.27\/docs\/assets\/favicons\/android-chrome-144x144.png",
+            "src": "https:\/\/cdn.jsdelivr.net\/dokku\/dokku@v0.38.34\/docs\/assets\/favicons\/android-chrome-144x144.png",
             "sizes": "144x144",
             "type": "image\/png",
             "density": "3.0"
         },
         {
-            "src": "https:\/\/cdn.jsdelivr.net\/dokku\/dokku@v0.38.27\/docs\/assets\/favicons\/android-chrome-192x192.png",
+            "src": "https:\/\/cdn.jsdelivr.net\/dokku\/dokku@v0.38.34\/docs\/assets\/favicons\/android-chrome-192x192.png",
             "sizes": "192x192",
             "type": "image\/png",
             "density": "4.0"
diff --git a/docs/assets/style.css b/docs/assets/style.css
index 067832650..99200b4e0 100644
--- a/docs/assets/style.css
+++ b/docs/assets/style.css
@@ -25,9 +25,9 @@
 
   /* Avatar section darkmode fade */
   --avatar-before-gradient: rgba(0, 0, 0, 0) linear-gradient(90deg, white 2.52%, rgba(255, 255, 255, 0) 100%) repeat scroll 0% 0%;
-  --avatar-darkmode-before-gradient: rgba(0, 0, 0, 0) linear-gradient(90deg, #0.38.27 2.52%, rgba(255, 255, 255, 0) 100%) repeat scroll 0% 0%;
+  --avatar-darkmode-before-gradient: rgba(0, 0, 0, 0) linear-gradient(90deg, #0.38.34 2.52%, rgba(255, 255, 255, 0) 100%) repeat scroll 0% 0%;
   --avatar-after-gradient: rgba(0, 0, 0, 0) linear-gradient(270deg, white 2.52%, rgba(255, 255, 255, 0) 100%) repeat scroll 0% 0%;
-  --avatar-darkmode-after-gradient: rgba(0, 0, 0, 0) linear-gradient(270deg, #0.38.27 2.52%, rgba(255, 255, 255, 0) 100%) repeat scroll 0% 0%;
+  --avatar-darkmode-after-gradient: rgba(0, 0, 0, 0) linear-gradient(270deg, #0.38.34 2.52%, rgba(255, 255, 255, 0) 100%) repeat scroll 0% 0%;
 }
 
 body {
@@ -1191,15 +1191,15 @@ ul.fas li .fa-large:before {
 
   .getting-started::after {
     background: linear-gradient(0deg, rgba(52, 52, 87, 0.2) -40.97%, rgba(0, 0, 0, 0) 103.19%),
-      #0.38.27;
+      #0.38.34;
   }
 
   .tab-content {
-    background: #0.38.27;
+    background: #0.38.34;
   }
 
   .nav-tabs {
-    background: #0.38.27;
+    background: #0.38.34;
   }
 
   .powered-by_brands {
diff --git a/docs/assets/versions.json b/docs/assets/versions.json
index 6f6ebf900..3b0a88d4b 100644
--- a/docs/assets/versions.json
+++ b/docs/assets/versions.json
@@ -35,6 +35,6 @@
     "0.35.20",
     "0.36.11",
     "0.37.10",
-    "0.38.27"
+    "0.38.34"
   ]
 }
diff --git a/docs/community/plugins.md b/docs/community/plugins.md
index 85018d0c5..496a5c530 100644
--- a/docs/community/plugins.md
+++ b/docs/community/plugins.md
@@ -22,6 +22,8 @@ Let's take a quick look at the current Dokku nginx plugin that's shipped with Do
 
 The following plugins are available and provided by Dokku maintainers.  Please file issues against their respective issue trackers.
 
+Every datastore below is also served by the `datastore` plugin Dokku ships, as in `dokku datastore:create postgres lollipop`. See the [datastore management documentation](/docs/advanced-usage/datastore-management.md) for more information.
+
 | Plugin                                                                                            | Author                | Compatibility         |
 | ------------------------------------------------------------------------------------------------- | --------------------- | --------------------- |
 | [Clickhouse](https://github.com/dokku/dokku-clickhouse)                                           | [dokku][]             | 0.4.0+                |
@@ -120,6 +122,7 @@ The following plugins are available and provided by Dokku maintainers.  Please f
 | [Dokku Clone](https://github.com/crisward/dokku-clone)                                            | [crisward][]          | 0.4.0+                |
 | [Dokku Copy App Config Files](https://github.com/dokku-community/dokku-supply-config)             | [josegonzalez][]      | 0.4.0+                |
 | [Dokku Require](https://github.com/crisward/dokku-require)<sup>3</sup>                            | [crisward][]          | 0.4.0+                |
+| [Generic (any Docker image)](https://github.com/meteozond/dokku-generic)                          | [meteozond][]         | 0.35.0+               |
 | [Global Certificates](https://github.com/josegonzalez/dokku-global-cert)                          | [josegonzalez][]      | 0.5.0+                |
 | [Graduate (Environment Management)](https://github.com/glassechidna/dokku-graduate)               | [benjamin-dobell][]   | 0.4.0+                |
 | [Host post-build command hook](https://github.com/baikunz/dokku-post-deploy-script)               | [baikunz][]           | 0.4.0+                |
@@ -153,6 +156,7 @@ The following plugins are available and provided by Dokku maintainers.  Please f
 | ------------------------------------------------------------------------------------------------- | --------------------- | --------------------- |
 | [Chef cookbook](https://github.com/nickcharlton/dokku-cookbook)                                   | [nickcharlton][]      |                       |
 | [Discourse](https://github.com/badsyntax/dokku-discourse)                                         | [badsyntax][]         | 0.21.4+               |
+| [LibreDB Studio (database GUI)](https://github.com/libredb/dokku-libredb-studio)                  | [libredb][]           | 0.35.20+              |
 | [Tailscale](https://github.com/andrew-womeldorf/dokku-tailscale)                                  | [andrew-womeldorf][]  | 0.34.4+               |
 | [Wordpress](https://github.com/dokku-community/dokku-wordpress)                                   | [dokku-community][]   | 0.4.0+                |
 
@@ -229,7 +233,7 @@ The following plugins are no longer maintained by their developers.
 | [CouchDB (multi containers)](https://github.com/Flink/dokku-couchdb-multi-containers)             | [flink][]             | 0.4.0+                |
 | [CouchDB](https://github.com/racehub/dokku-couchdb-plugin)                                        | [raceHub][]           | Compatible with 0.2.0 |
 | [Dokku Copy App Config Files](https://github.com/alexkruegger/dokku-app-configfiles)              | [alexkruegger][]      | Compatible with 0.3.17+ |
-| [Dokku Registry](https://github.com/agco-adm/dokku-registry)                                      | [agco-adm][]          | 0.4.0+
+| [Dokku Registry](https://github.com/agco-adm/dokku-registry)                                      | [agco-adm][]          | 0.4.0+                |
 | [Elasticsearch](https://github.com/robv/dokku-elasticsearch)                                      | [robv][]              | Not compatible with >= 0.3.0 (still uses /home/git) |
 | [Elasticsearch](https://github.com/blag/dokku-elasticsearch-plugin)<sup>1</sup>                   | [blag][]              | Compatible with 0.2.0 |
 | [Graphite/statsd](https://github.com/jlachowski/dokku-graphite-plugin)                            | [jlachowski][]        | < 0.4.0               |
@@ -266,7 +270,6 @@ The following plugins are no longer maintained by their developers.
 [calyhre]: https://github.com/calyhre
 [cameron-martin]: https://github.com/cameron-martin
 [candlewaster]: https://notabug.org/candlewaster
-[cedricziel]: https://github.com/cedricziel
 [cef]: https://github.com/cef
 [cheif]: https://github.com/cheif
 [cjblomqvist]: https://github.com/cjblomqvist
@@ -334,3 +337,5 @@ The following plugins are no longer maintained by their developers.
 [lazyatom]: https://github.com/lazyatom
 [ollej]: https://github.com/ollej
 [ignisda]: https://github.com/IgnisDa
+[meteozond]: https://github.com/meteozond
+[libredb]: https://github.com/libredb
diff --git a/docs/configuration/environment-variables.md b/docs/configuration/environment-variables.md
index f294098d3..968c63308 100644
--- a/docs/configuration/environment-variables.md
+++ b/docs/configuration/environment-variables.md
@@ -55,6 +55,8 @@ For multi-line values from a file (such as an SSH private key), `cat` and `base6
 dokku config:set --encoded node-js-app KEY="$(cat ~/.ssh/id_rsa | base64 -w 0)"
 ```
 
+If the environment cannot be written to disk, `config:set`, `config:unset` and `config:clear` report the failure and exit non-zero without restarting the application. The previous environment is left intact, so the command can be retried once the underlying problem - a full disk or the wrong permissions on `$DOKKU_LIB_ROOT/config/<app>` being the usual causes - has been dealt with.
+
 When setting or unsetting environment variables, you may wish to avoid an application restart. This is useful when developing plugins or when setting multiple environment variables in a scripted manner. To do so, use the `--no-restart` flag:
 
 ```shell
@@ -136,6 +138,9 @@ The following config variables have special meanings and can be set in a variety
 | `DOKKU_EVENTS_LOGFILE`         | `$DOKKU_LOGS_DIR/events.log`    | `/etc/environment` <br /> `~dokku/.dokkurc` <br /> `~dokku/.dokkurc/*`                                                                           | Where the events log file is written to. |
 | `DOKKU_APP_NAME`               | none                            | `--app APP` flag                                                                                                                                 | Name of application to work on. Respected by core plugins. |
 | `DOKKU_APPS_FORCE_DELETE`      | none                            | `--force` flag                                                                                                                                   | Whether to force delete an application. Also used by other plugins for destructive actions. |
+| `DOKKU_DISABLE_TTY`            | none                            | `dokku run --no-tty` <br /> environment                                                                                                          | Forces `dokku run` to treat the session as non-interactive. |
+| `DOKKU_FORCE_TTY`              | none                            | `dokku run --force-tty` <br /> environment                                                                                                       | Forces `dokku run` to treat the session as interactive. |
+| `DOKKU_PRESERVE_ENV`           | none                            | `/etc/default/dokku` <br /> `~dokku/.dokkurc` <br /> `~dokku/.dokkurc/*` <br /> environment                                                       | Comma-separated list of extra environment variable names to carry across the privilege drop to the `dokku` user. See [Forwarding environment variables](#forwarding-environment-variables). |
 | `DOKKU_CHECKS_URL`             | `https://dokku.com/docs/deployment/zero-downtime-deploys/` | `/etc/environment` <br /> `~dokku/.dokkurc` <br /> `~dokku/.dokkurc/*`                                                | Url displayed during deployment when no CHECKS file exists. |
 | `DOKKU_QUIET_OUTPUT`           | none                            | `--quiet` flag                                                                                                                                   | Silences certain header output for `dokku` commands. |
 | `DOKKU_RM_CONTAINER`           | none                            | `dokku config:set` <br />                                                                                                                        | Deprecated: Whether to keep `dokku run` containers around or not. |
@@ -143,6 +148,45 @@ The following config variables have special meanings and can be set in a variety
 | `DOKKU_SYSTEM_GROUP`           | `dokku`                         | `/etc/environment` <br /> `~dokku/.dokkurc` <br /> `~dokku/.dokkurc/*`                                                                           | System group to chown files as. |
 | `DOKKU_SYSTEM_USER`            | `dokku`                         | `/etc/environment` <br /> `~dokku/.dokkurc` <br /> `~dokku/.dokkurc/*`                                                                           | System user to chown files as. |
 
+## Forwarding environment variables
+
+When `dokku` is invoked by any user other than `dokku` - `root`, or a member of the `sudo` group - it
+re-executes itself as the `dokku` user. Most configuration does not need to survive that step, since
+`/etc/default/dokku`, `~dokku/dokkurc` and `~dokku/.dokkurc/*` are read again by the re-executed
+process, and `/etc/environment` is applied by PAM.
+
+What cannot be recomputed is state that belongs to the invocation itself, so those variables are
+named explicitly and forwarded:
+
+| Variable | Source |
+| --- | --- |
+| `DOKKU_APP_NAME`, `DOKKU_APPS_FORCE_DELETE`, `DOKKU_QUIET_OUTPUT`, `DOKKU_TRACE` | the `--app`, `--force`, `--quiet` and `--trace` global flags, or the environment |
+| `DOKKU_GLOBAL_FLAGS` | every global flag as given, replayed by plugins that need them |
+| `DOKKU_DISABLE_TTY`, `DOKKU_FORCE_TTY` | the `dokku run` tty flags, or the environment |
+| `DOKKU_PRESERVE_ENV` | the list below |
+| `SSH_USER`, `SSH_NAME`, `NAME`, `FINGERPRINT`, `SSH_ORIGINAL_COMMAND` | the ssh session the command arrived on |
+| `DOCKER_BIN`, `DOKKU_CNB_BUILDER`, `DOKKU_EVENTS_LOGFILE`, `DOKKU_HOST_ROOT`, `DOKKU_IMAGE`, `DOKKU_LIB_PATH`, `DOKKU_LOGS_DIR`, `DOKKU_LOGS_HOST_DIR`, `DOKKU_ROOT`, `DOKKU_SYSTEM_GROUP`, `DOKKU_SYSTEM_USER`, `PLUGIN_PATH`, `PLUGIN_AVAILABLE_PATH`, `PLUGIN_ENABLED_PATH`, `PLUGIN_CORE_PATH`, `PLUGIN_CORE_AVAILABLE_PATH`, `PLUGIN_CORE_ENABLED_PATH` | the environment, so the re-executed process derives the same paths as the caller |
+| `DOKKU_INIT_SYSTEM`, `DOKKU_LIB_HOST_ROOT` | the environment, which is where they live while a Docker image is being built |
+
+`DOKKU_PID` is deliberately not forwarded: it is unset before the privilege drop so the re-executed
+process gets its own.
+
+To forward anything else - a variable read by a third-party plugin, or a one-off override of a
+setting that normally lives in `/etc/default/dokku` - name it in `DOKKU_PRESERVE_ENV`:
+
+```shell
+DOKKU_PRESERVE_ENV=DOCKER_BUILDKIT DOCKER_BUILDKIT=0 dokku ps:rebuild node-js-app
+```
+
+Set it persistently to forward a variable for every invocation:
+
+```shell
+echo "export DOKKU_PRESERVE_ENV=MY_PLUGIN_DEBUG" | sudo tee -a /etc/default/dokku
+```
+
+Variables sudo manages for the target user - `HOME`, `PATH`, `SHELL`, `USER`, `LOGNAME`, `MAIL` and
+`SUDO_*` - are never forwarded, and naming them in `DOKKU_PRESERVE_ENV` is not supported.
+
 ## Properties
 
 ### Internal properties
diff --git a/docs/configuration/ssl.md b/docs/configuration/ssl.md
index a5f492f24..9ad455dc2 100644
--- a/docs/configuration/ssl.md
+++ b/docs/configuration/ssl.md
@@ -85,21 +85,25 @@ dokku certs:report
 ```
 
 ```
-=====> node-js-app
-       Ssl dir:             /home/dokku/node-js-app/tls
-       Ssl enabled:         true
-       Ssl hostnames:       *.node-js-app.org node-js-app.org
-       Ssl expires at:      Oct  5 23:59:59 2019 GMT
-       Ssl issuer:          C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA
-       Ssl starts at:       Oct  5 00:00:00 2016 GMT
-       Ssl subject:         OU=Domain Control Validated; OU=PositiveSSL Wildcard; CN=*.node-js-app.org
-       Ssl verified:        self signed.
-=====> python-app
-       Ssl dir:             /home/dokku/python-app/tls
-       Ssl enabled:         false
-       Ssl hostnames:
+=====> node-js-app ssl information
+       Ssl dir:                       /home/dokku/node-js-app/tls
+       Ssl enabled:                   true
+       Ssl expires at:                Oct  5 23:59:59 2019 GMT
+       Ssl fingerprint:               9E:2F:0B:74:C3:5A:81:D6:4F:AA:12:38:E7:6B:90:5C:D1:47:2E:8A:B3:65:F9:0D:28:C4:71:AE:53:80:6F:12
+       Ssl hostnames:                 *.node-js-app.org node-js-app.org
+       Ssl issuer:                    C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA
+       Ssl serial:                    2F4B8C1D6E9A0357B8C2D4E6F8091A2B
+       Ssl starts at:                 Oct  5 00:00:00 2016 GMT
+       Ssl subject:                   OU=Domain Control Validated; OU=PositiveSSL Wildcard; CN=*.node-js-app.org
+       Ssl verified:                  self signed
+=====> python-app ssl information
+       Ssl dir:                       /home/dokku/python-app/tls
+       Ssl enabled:                   false
        Ssl expires at:
+       Ssl fingerprint:
+       Ssl hostnames:
        Ssl issuer:
+       Ssl serial:
        Ssl starts at:
        Ssl subject:
        Ssl verified:
@@ -113,14 +117,16 @@ dokku certs:report node-js-app
 
 ```
 =====> node-js-app ssl information
-       Ssl dir:             /home/dokku/node-js-app/tls
-       Ssl enabled:         true
-       Ssl hostnames:       *.dokku.org dokku.org
-       Ssl expires at:      Oct  5 23:59:59 2019 GMT
-       Ssl issuer:          C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA
-       Ssl starts at:       Oct  5 00:00:00 2016 GMT
-       Ssl subject:         OU=Domain Control Validated; OU=PositiveSSL Wildcard; CN=*.dokku.org
-       Ssl verified:        self signed.
+       Ssl dir:                       /home/dokku/node-js-app/tls
+       Ssl enabled:                   true
+       Ssl expires at:                Oct  5 23:59:59 2019 GMT
+       Ssl fingerprint:               9E:2F:0B:74:C3:5A:81:D6:4F:AA:12:38:E7:6B:90:5C:D1:47:2E:8A:B3:65:F9:0D:28:C4:71:AE:53:80:6F:12
+       Ssl hostnames:                 *.dokku.org dokku.org
+       Ssl issuer:                    C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA
+       Ssl serial:                    2F4B8C1D6E9A0357B8C2D4E6F8091A2B
+       Ssl starts at:                 Oct  5 00:00:00 2016 GMT
+       Ssl subject:                   OU=Domain Control Validated; OU=PositiveSSL Wildcard; CN=*.dokku.org
+       Ssl verified:                  self signed
 ```
 
 You can pass flags which will output only the value of the specific information you want. For example:
@@ -149,7 +155,7 @@ If an `https:443:*` port mapping already exists when a certificate is installed
 
 ### Running behind a proxy (`X-Forwarded-Ssl`, etc.)
 
-See the [running behind another proxy documentation](/docs/networking/proxies/nginx.md#running-behind-another-proxy--configuring-x-forwarded--headers) for more information on how to configure your Nginx config when your server is running behind a proxy (e.g. load balancer, etc.).
+See the [running behind another proxy documentation](/docs/networking/proxies/nginx.md#running-behind-another-proxy-configuring-x-forwarded-headers) for more information on how to configure your Nginx config when your server is running behind a proxy (e.g. load balancer, etc.).
 
 ## Properties
 
@@ -158,12 +164,14 @@ See the [running behind another proxy documentation](/docs/networking/proxies/ng
 The following flags surface in `certs:report` but are not managed by `certs:set` - they are derived from the on-disk certificate:
 
 | Flag | Description |
-|---|---|
+| --- | --- |
 | `--ssl-enabled` | `true` when an SSL certificate is installed for the app |
 | `--ssl-dir` | Absolute path to the per-app certificate directory |
 | `--ssl-hostnames` | Hostnames the certificate covers (CN plus Subject Alternative Names) |
 | `--ssl-issuer` | Certificate issuer DN |
 | `--ssl-subject` | Certificate subject DN |
-| `--ssl-verified` | `true` if the certificate chain verifies against the system CA bundle |
+| `--ssl-fingerprint` | SHA-256 digest of the leaf certificate's DER encoding, the value `openssl x509 -noout -fingerprint -sha256` prints |
+| `--ssl-serial` | Serial number of the leaf certificate |
+| `--ssl-verified` | `verified by a certificate authority` when the certificate chain verifies against the system CA bundle, `self signed` otherwise |
 | `--ssl-expires-at` | Certificate `notAfter` timestamp |
 | `--ssl-starts-at` | Certificate `notBefore` timestamp |
diff --git a/docs/deployment/application-deployment.md b/docs/deployment/application-deployment.md
index 9f45c4d40..b7bebe89f 100644
--- a/docs/deployment/application-deployment.md
+++ b/docs/deployment/application-deployment.md
@@ -23,7 +23,7 @@ dokku apps:create ruby-getting-started
 
 ### Create the backing services
 
-Dokku by default **does not** provide datastores (e.g. MySQL, PostgreSQL) on a newly created app. You can add datastore support by installing plugins, and the Dokku project [provides official plugins](/docs/community/plugins.md#official-plugins-beta) for common datastores.
+Dokku by default **does not** provide datastores (e.g. MySQL, PostgreSQL) on a newly created app. You can add datastore support by installing plugins, and the Dokku project [provides official plugins](/docs/community/plugins.md#official-plugins) for common datastores.
 
 The Getting Started app requires a PostgreSQL service, so install the plugin and create the related service as follows:
 
@@ -108,7 +108,7 @@ Dokku supports deploying applications in a few ways:
 - [Heroku buildpacks](https://devcenter.heroku.com/articles/buildpacks) via [Herokuish](https://github.com/gliderlabs/herokuish#buildpacks): See the [herokuish buildpacks documentation](/docs/deployment/builders/herokuish-buildpacks.md) to learn about the different ways to specify a buildpack.
     - This is the default method used by Dokku.
 - [Dockerfile](https://docs.docker.com/reference/builder/): See the [dockerfile documentation](/docs/deployment/builders/dockerfiles.md) to learn about the different ways to configure Dockerfile-based deploys.
-- [Docker Image](https://docs.docker.com/get-started/overview/#docker-objects): See the [docker image documentation](/docs/deployment/methods/git.md#initializing-an-app-repository-from-a-docker-image) to learn about how to deploy a Docker Image.
+- [Docker Image](https://docs.docker.com/get-started/overview/#docker-objects): See the [docker image documentation](/docs/deployment/methods/image.md#initializing-an-app-repository-from-a-docker-image) to learn about how to deploy a Docker Image.
 
 ### Setting up SSL
 
@@ -246,7 +246,7 @@ See the [Dockerfile documentation](/docs/deployment/builders/dockerfiles.md) for
 
 ## Image tagging
 
-See the [image tagging documentation](/docs/deployment/methods/git.md#initializing-an-app-repository-from-a-docker-image) for more information on how Docker images can be tagged and deployed for a given application.
+See the [image tagging documentation](/docs/deployment/methods/image.md#initializing-an-app-repository-from-a-docker-image) for more information on how Docker images can be tagged and deployed for a given application.
 
 ## Specifying a custom buildpack
 
diff --git a/docs/deployment/application-management.md b/docs/deployment/application-management.md
index 31812a570..4231329ac 100644
--- a/docs/deployment/application-management.md
+++ b/docs/deployment/application-management.md
@@ -238,6 +238,12 @@ dokku apps:lock node-js-app
 -----> Deploy lock created
 ```
 
+While an app is locked, deploys that build the app - `git push`, `ps:rebuild`, `git:sync`, `git:from-archive`, `git:from-image`, and `git:load-image` - fail without building or fetching any code, and leave no build record behind. A deploy that is already in progress when the lock is created is not interrupted. Commands that redeploy an existing image, such as `ps:restart`, `ps:start`, `config:set`, and `deploy`, are not blocked by the lock.
+
+A locked app cannot be renamed via `apps:rename` until it is unlocked, and an app created via `apps:clone` does not inherit the lock of the app it was cloned from.
+
+The deploy lock taken by a deploy is released when the deploy finishes, including when the build fails or the deploy process exits early.
+
 ### Unlocking app deploys
 
 > [!IMPORTANT]
@@ -263,7 +269,7 @@ dokku apps:unlock node-js-app
 > [!IMPORTANT]
 > New as of 0.13.0
 
-In some cases, you may wish to inspect the state of an app lock. To do so, you can issue an `apps:lock` command. This will exit non-zero if there is no app lock in place.
+In some cases, you may wish to inspect the state of an app lock. To do so, you can issue an `apps:locked` command. This will exit non-zero if there is no app lock in place. An app is considered locked if it was locked via `apps:lock` or if a deploy is currently in progress.
 
 ```shell
 dokku apps:locked node-js-app
@@ -341,7 +347,7 @@ dokku apps:report node-js-app --app-dir
 The following flags surface in `apps:report` but are not managed by `apps:set`:
 
 | Flag | Description |
-|---|---|
+| --- | --- |
 | `--app-created-at` | UNIX timestamp of app creation |
 | `--app-deploy-source` | Source kind of the last deploy (`git`, `archive`, `docker-image`, `git-sync`) |
 | `--app-deploy-source-metadata` | Free-form metadata for the deploy source (commit sha, image ref, URL) |
diff --git a/docs/deployment/builders/builder-management.md b/docs/deployment/builders/builder-management.md
index fd2b43c80..d26cd0081 100644
--- a/docs/deployment/builders/builder-management.md
+++ b/docs/deployment/builders/builder-management.md
@@ -167,6 +167,8 @@ To create a custom builder, the following triggers must be implemented:
     - arguments: `BUILDER_TYPE` `APP` `IMAGE_AG`
     - description: A post-build, pre-release trigger that can be used to post-process the image. Usually simply tags and labels the image appropriately.
 
+When an app is rebuilt via `ps:rebuild --no-cache`, the `DOKKU_BUILD_NO_CACHE` environment variable is set to `true` during the `builder-build` trigger. Custom builders should skip any build cache they use when this variable is set.
+
 Custom plugins names _must_ have the prefix `builder-` or builder overriding via `builder:set` may not function as expected.
 
 Builders can use any tools available on the system to build the docker image, and may even be used to schedule building off-server. The only current requirement is that the image must exist on the server at the end of the `builder-build` command, though this requirement may be relaxed in a future release.
@@ -181,7 +183,7 @@ For a simple example of how to implement this trigger, see `builder-pack`, which
 > The `Report flags` column lists the CLI argument names accepted by `builder:report`. The JSON keys emitted by `builder:report --format json` are the same names with the leading `--builder-` stripped (e.g. `selected`, `global-selected`, `computed-selected`). Legacy keys with the `builder-` prefix are also emitted during the 0.38.x deprecation window and will be removed in a future major release.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `build-dir` | app + global | none | `--builder-build-dir`, `--builder-global-build-dir`, `--builder-computed-build-dir` | Subdirectory within the repository to use as the build context |
 | `selected` | app + global | none | `--builder-selected`, `--builder-global-selected`, `--builder-computed-selected` | Builder plugin to use; overrides automatic detection |
 | `skip-cleanup` | app + global | `false` | `--builder-skip-cleanup`, `--builder-global-skip-cleanup`, `--builder-computed-skip-cleanup` | When `true`, leaves intermediate build artifacts in place after the build |
diff --git a/docs/deployment/builders/buildpack-management.md b/docs/deployment/builders/buildpack-management.md
index 4255960d2..c3cddf540 100644
--- a/docs/deployment/builders/buildpack-management.md
+++ b/docs/deployment/builders/buildpack-management.md
@@ -178,20 +178,11 @@ dokku buildpacks:report
 
 ```
 =====> node-js-app buildpacks information
-       Buildpacks computed stack:  gliderlabs/herokuish:v0.7.0-22
-       Buildpacks global stack:    gliderlabs/herokuish:latest-24
        Buildpacks list:            https://github.com/heroku/heroku-buildpack-nodejs.git
-       Buildpacks stack:           gliderlabs/herokuish:v0.7.0-20
 =====> python-sample buildpacks information
-       Buildpacks computed stack:  gliderlabs/herokuish:latest-24
-       Buildpacks global stack:    gliderlabs/herokuish:latest-24
        Buildpacks list:            https://github.com/heroku/heroku-buildpack-nodejs.git,https://github.com/heroku/heroku-buildpack-python.git
-       Buildpacks stack:
 =====> ruby-sample buildpacks information
-       Buildpacks computed stack:  gliderlabs/herokuish:latest-24
-       Buildpacks global stack:    gliderlabs/herokuish:latest-24
        Buildpacks list:
-       Buildpacks stack:
 ```
 
 You can run the command for a specific app also.
@@ -215,11 +206,7 @@ dokku buildpacks:report node-js-app --buildpacks-list
 
 ### Settable properties
 
-These properties are managed via `buildpacks:set-property` (the legacy command name for this plugin).
+The `buildpacks` plugin has no settable properties of its own. The list of buildpack URLs is managed via the `buildpacks:add`, `buildpacks:set`, `buildpacks:remove`, and `buildpacks:clear` commands.
 
-> [!NOTE]
-> The `Report flags` column lists the CLI argument names accepted by `buildpacks:report`. The JSON keys emitted by `buildpacks:report --format json` are the same names with the leading `--buildpacks-` stripped (e.g. `stack`, `global-stack`, `computed-stack`). Legacy keys with the `buildpacks-` prefix are also emitted during the 0.38.x deprecation window and will be removed in a future major release.
-
-| Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
-| `stack` | app + global | none | `--buildpacks-stack`, `--buildpacks-global-stack`, `--buildpacks-computed-stack` | Herokuish stack image used to compile the app (e.g. `heroku/heroku:24`) |
+> [!WARNING]
+> The `buildpacks:set-property stack` command is deprecated as of 0.39.0. The `stack` property moved to the `builder-herokuish` and `builder-pack` plugins. Set it via `builder-herokuish:set <app> stack <value>` (herokuish) or `builder-pack:set <app> stack <value>` (CNB). The deprecated command still works but emits a warning and forwards the value to the appropriate builder based on whether the value references a herokuish image.
diff --git a/docs/deployment/builders/cloud-native-buildpacks.md b/docs/deployment/builders/cloud-native-buildpacks.md
index 7728978aa..5b7277551 100644
--- a/docs/deployment/builders/cloud-native-buildpacks.md
+++ b/docs/deployment/builders/cloud-native-buildpacks.md
@@ -35,7 +35,7 @@ While pack is well-supported in Dokku, there are a number of caveats. Please not
     - A future release will add support for injecting extra arguments during the build process.
 - The default process type is `web`.
 - Build cache is stored in Docker volumes instead of on disk. As such, `repo:purge-cache` currently has no effect.
-    - A future version will add integration with the `repo` plugin.
+    - The build cache may be cleared for a single rebuild via `ps:rebuild --no-cache`. See the [rebuilding without the build cache](/docs/processes/process-management.md#rebuilding-without-the-build-cache) documentation for more information.
 - `pack` is not currently included with Dokku, nor is it added as a package dependency.
     - A future version will include it as a package dependency.
 
@@ -100,14 +100,23 @@ dokku builder-pack:report
        Builder pack computed projecttoml path: project2.toml
        Builder pack global projecttoml path:
        Builder pack projecttoml path:          project2.toml
+       Builder pack computed stack:            heroku/builder:24
+       Builder pack global stack:
+       Builder pack stack:
 =====> python-sample builder-pack information
        Builder pack computed projecttoml path: project.toml
        Builder pack global projecttoml path:
        Builder pack projecttoml path:
+       Builder pack computed stack:            heroku/builder:24
+       Builder pack global stack:
+       Builder pack stack:
 =====> ruby-sample builder-pack information
        Builder pack computed projecttoml path: project.toml
        Builder pack global projecttoml path:
        Builder pack projecttoml path:
+       Builder pack computed stack:            heroku/builder:24
+       Builder pack global stack:
+       Builder pack stack:
 ```
 
 The `projecttoml-path` and `global-projecttoml-path` keys hold the raw per-app and global value respectively, and are empty when nothing has been set. The `computed-projecttoml-path` key holds the effective value used at build time, falling back to the global value (where one has been set) and then to the built-in default of `project.toml`.
@@ -138,32 +147,35 @@ project2.toml
 ### Customizing the Buildpack stack builder
 
 > [!IMPORTANT]
-> New as of 0.23.0
+> New as of 0.23.0. The `stack` property moved from the `buildpacks` plugin to the `builder-pack` plugin in 0.39.0.
 
-The default stack builder in use by CNB buildpacks in Dokku is based on `heroku/builder:24`. Users may desire to switch the stack builder to a custom version, either to update the operating system or to customize packages included with the stack builder. This can be performed via the `buildpacks:set-property` command.
+The default stack builder in use by CNB buildpacks in Dokku is based on `heroku/builder:24`. Users may desire to switch the stack builder to a custom version, either to update the operating system or to customize packages included with the stack builder. This can be performed via the `builder-pack:set` command.
 
 ```shell
-dokku buildpacks:set-property node-js-app stack paketobuildpacks/build:base-cnb
+dokku builder-pack:set node-js-app stack paketobuildpacks/build:base-cnb
 ```
 
-The specified stack builder can also be unset by omitting the name of the stack builder when calling `buildpacks:set-property`.
+The specified stack builder can also be unset by omitting the name of the stack builder when calling `builder-pack:set`.
 
 ```shell
-dokku buildpacks:set-property node-js-app stack
+dokku builder-pack:set node-js-app stack
 ```
 
-A change in the stack builder value will execute the `post-stack-set` trigger.
+A change in the stack builder value flags the next build to run with `--clear-cache` so a stale pack cache is not reused.
 
 Finally, stack builders can be set or unset globally as a fallback. This will take precedence over a globally set `DOKKU_CNB_BUILDER` environment variable (`heroku/builder:24` by default).
 
 ```shell
 # set globally
-dokku buildpacks:set-property --global stack paketobuildpacks/build:base-cnb
+dokku builder-pack:set --global stack paketobuildpacks/build:base-cnb
 
 # unset globally
-dokku buildpacks:set-property --global stack
+dokku builder-pack:set --global stack
 ```
 
+> [!WARNING]
+> The `buildpacks:set-property stack` command is deprecated. It still works but emits a deprecation warning and forwards the value to `builder-pack` (when the value is a CNB builder) or `builder-herokuish` (when the value references a herokuish image).
+
 ### Specifying commands via Procfile
 
 See the [Procfile documentation](/docs/processes/process-management.md#procfile) for more information on how to specify different processes for your app.
@@ -175,3 +187,12 @@ See the [Procfile documentation](/docs/processes/process-management.md#procfile)
 | Property | Scope | Default | Report flags | Description |
 |---|---|---|---|---|
 | `projecttoml-path` | app + global | `project.toml` | `--builder-pack-projecttoml-path`, `--builder-pack-global-projecttoml-path`, `--builder-pack-computed-projecttoml-path` | Path within the app to the CNB `project.toml` manifest, relative to the build root |
+| `stack` | app + global | `heroku/builder:24` | `--builder-pack-stack`, `--builder-pack-global-stack`, `--builder-pack-computed-stack` | CNB builder image used to build the app (e.g. `paketobuildpacks/build:base-cnb`) |
+
+### Internal properties
+
+The following properties are recorded internally by the builder-pack plugin and are not exposed via `builder-pack:report`:
+
+| Property | Scope | Description | Source |
+|---|---|---|---|
+| `clear-cache` | per-app | Transient flag set when the pack `stack` changes. The next `pack build` runs with `--clear-cache` and then the flag is deleted, ensuring a stack change does not reuse a stale pack cache | `plugins/builder-pack/subcommands/set` sets it on stack change; `plugins/builder-pack/builder-build` consumes and deletes it |
diff --git a/docs/deployment/builders/dockerfiles.md b/docs/deployment/builders/dockerfiles.md
index ce48be6c1..d22d9243d 100644
--- a/docs/deployment/builders/dockerfiles.md
+++ b/docs/deployment/builders/dockerfiles.md
@@ -196,7 +196,7 @@ ENTRYPOINT ["node"]
 You can do:
 
 ```shell
-dokku ps:set node-js-app dockerfile-start-cmd "--harmony server.js"
+dokku ps:set node-js-app dockerfile-start-cmd -- "--harmony server.js"
 ```
 
 To tell Docker what to run. Pass an empty value to clear the override:
diff --git a/docs/deployment/builders/herokuish-buildpacks.md b/docs/deployment/builders/herokuish-buildpacks.md
index c45aa207b..944bfc670 100644
--- a/docs/deployment/builders/herokuish-buildpacks.md
+++ b/docs/deployment/builders/herokuish-buildpacks.md
@@ -46,32 +46,35 @@ dokku builder:set node-js-app selected herokuish
 ### Customizing the Buildpack stack builder
 
 > [!IMPORTANT]
-> New as of 0.23.0
+> New as of 0.23.0. The `stack` property moved from the `buildpacks` plugin to the `builder-herokuish` plugin in 0.39.0.
 
-The default stack builder in use by Herokuish buildpacks in Dokku is based on `gliderlabs/herokuish:latest`. Typically, this is installed via an OS package which pulls the requisite Docker image. Users may desire to switch the stack builder to a custom version, either to update the operating system or to customize packages included with the stack builder. This can be performed via the `buildpacks:set-property` command.
+The default stack builder in use by Herokuish buildpacks in Dokku is based on `gliderlabs/herokuish:latest`. Typically, this is installed via an OS package which pulls the requisite Docker image. Users may desire to switch the stack builder to a custom version, either to update the operating system or to customize packages included with the stack builder. This can be performed via the `builder-herokuish:set` command.
 
 ```shell
-dokku buildpacks:set-property node-js-app stack gliderlabs/herokuish:latest
+dokku builder-herokuish:set node-js-app stack gliderlabs/herokuish:latest
 ```
 
-The specified stack builder can also be unset by omitting the name of the stack builder when calling `buildpacks:set-property`.
+The specified stack builder can also be unset by omitting the name of the stack builder when calling `builder-herokuish:set`.
 
 ```shell
-dokku buildpacks:set-property node-js-app stack
+dokku builder-herokuish:set node-js-app stack
 ```
 
-A change in the stack builder value will execute the `post-stack-set` trigger.
+A change in the stack builder value clears the herokuish build cache so the next deploy starts fresh.
 
 Finally, stack builders can be set or unset globally as a fallback. This will take precedence over a globally set `DOKKU_IMAGE` environment variable (`gliderlabs/herokuish:latest-24` by default).
 
 ```shell
 # set globally
-dokku buildpacks:set-property --global stack gliderlabs/herokuish:latest
+dokku builder-herokuish:set --global stack gliderlabs/herokuish:latest
 
 # unset globally
-dokku buildpacks:set-property --global stack
+dokku builder-herokuish:set --global stack
 ```
 
+> [!WARNING]
+> The `buildpacks:set-property stack` command is deprecated. It still works but emits a deprecation warning and forwards the value to `builder-herokuish` (when the value references a herokuish image) or `builder-pack` (otherwise).
+
 ### Allowing herokuish for non-amd64 platforms
 
 > [!IMPORTANT]
@@ -119,14 +122,23 @@ dokku builder-herokuish:report
        Builder herokuish computed allowed: false
        Builder herokuish global allowed:
        Builder herokuish allowed:          false
+       Builder herokuish computed stack:   gliderlabs/herokuish:latest-24
+       Builder herokuish global stack:
+       Builder herokuish stack:
 =====> python-sample builder-herokuish information
        Builder herokuish computed allowed: true
        Builder herokuish global allowed:
        Builder herokuish allowed:
+       Builder herokuish computed stack:   gliderlabs/herokuish:latest-24
+       Builder herokuish global stack:
+       Builder herokuish stack:
 =====> ruby-sample builder-herokuish information
        Builder herokuish computed allowed: true
        Builder herokuish global allowed:
        Builder herokuish allowed:
+       Builder herokuish computed stack:   gliderlabs/herokuish:latest-24
+       Builder herokuish global stack:
+       Builder herokuish stack:
 ```
 
 The `allowed` and `global-allowed` keys hold the raw per-app and global value respectively, and are empty when nothing has been set. The `computed-allowed` key holds the effective value used at build time, falling back to the global value (where one has been set) and then to the built-in default (`true` on amd64, `false` otherwise).
@@ -177,7 +189,7 @@ dokku config:set --global CURL_CONNECT_TIMEOUT=180
 
 ### Clearing buildpack cache
 
-See the [repository management documentation](/docs/advanced-usage/repository-management.md#clearing-app-cache) for more information on how to clear buildpack build cache for an application.
+See the [repository management documentation](/docs/advanced-usage/repository-management.md#clearing-application-cache) for more information on how to clear buildpack build cache for an application. The cache may also be purged as part of a rebuild via `ps:rebuild --no-cache`. See the [rebuilding without the build cache](/docs/processes/process-management.md#rebuilding-without-the-build-cache) documentation for more information.
 
 ### Specifying commands via Procfile
 
@@ -207,7 +219,6 @@ See the [buildpack management documentation](/docs/deployment/builders/buildpack
 
 See the [buildpack management documentation](/docs/deployment/builders/buildpack-management.md#using-a-specific-buildpack-version) for more information on how to using a specific buildpack version
 
-
 ### Displaying buildpack reports for an app
 
 See the [buildpack management documentation](/docs/deployment/builders/buildpack-management.md#displaying-buildpack-reports-for-an-app) for more information on how to display buildpack reports for an app.
@@ -218,4 +229,5 @@ See the [buildpack management documentation](/docs/deployment/builders/buildpack
 
 | Property | Scope | Default | Report flags | Description |
 |---|---|---|---|---|
-| `allowed` | app + global | `true` | `--builder-herokuish-allowed`, `--builder-herokuish-global-allowed`, `--builder-herokuish-computed-allowed` | When `false`, the herokuish builder is skipped during builder detection for this app |
\ No newline at end of file
+| `allowed` | app + global | `true` | `--builder-herokuish-allowed`, `--builder-herokuish-global-allowed`, `--builder-herokuish-computed-allowed` | When `false`, the herokuish builder is skipped during builder detection for this app |
+| `stack` | app + global | `gliderlabs/herokuish:latest-24` | `--builder-herokuish-stack`, `--builder-herokuish-global-stack`, `--builder-herokuish-computed-stack` | Herokuish stack image used to compile the app (e.g. `gliderlabs/herokuish:latest`) |
diff --git a/docs/deployment/builders/nixpacks.md b/docs/deployment/builders/nixpacks.md
index 2d441c7aa..2cfb668ed 100644
--- a/docs/deployment/builders/nixpacks.md
+++ b/docs/deployment/builders/nixpacks.md
@@ -86,6 +86,8 @@ Disable cache using the [docker-options] plugin:
 dokku docker-options:add node-js-app build "--no-cache"
 ```
 
+To disable the cache for a single rebuild without persisting a setting, see the [rebuilding without the build cache](/docs/processes/process-management.md#rebuilding-without-the-build-cache) documentation.
+
 ### Displaying builder-nixpacks reports for an app
 
 You can get a report about the app's storage status using the `builder-nixpacks:report` command:
diff --git a/docs/deployment/builders/railpack.md b/docs/deployment/builders/railpack.md
index ac289b536..55a20de7a 100644
--- a/docs/deployment/builders/railpack.md
+++ b/docs/deployment/builders/railpack.md
@@ -13,14 +13,17 @@ Before using Railpacks, the following steps must be taken:
 
 - Install the `railpack` cli: The `railpack` cli tool is not included by default with Dokku or as a dependency. It must also be installed as shown on [this page](https://railpack.com/installation).
 - Create a `buildkit` builder: Railpack uses buildkit.
-       ```shell
-       docker run --rm --privileged -d --name buildkit moby/buildkit
-       ```
+
+    ```shell
+    docker run --rm --privileged -d --name buildkit moby/buildkit
+    ```
+
 - Set the buildkit builder: Update the `/etc/default/dokku` file to set `BUILDKIT_HOST`:
-       ```shell
-       touch /etc/default/dokku
-       echo "export BUILDKIT_HOST='docker-container://buildkit'" >> /etc/default/dokku
-       ```
+
+    ```shell
+    touch /etc/default/dokku
+    echo "export BUILDKIT_HOST='docker-container://buildkit'" >> /etc/default/dokku
+    ```
 
 ### Detection
 
@@ -95,6 +98,8 @@ Disable cache using the [docker-options] plugin:
 dokku docker-options:add node-js-app build "--no-cache"
 ```
 
+To disable the cache for a single rebuild without persisting a setting, see the [rebuilding without the build cache](/docs/processes/process-management.md#rebuilding-without-the-build-cache) documentation.
+
 ### Displaying builder-railpack reports for an app
 
 You can get a report about the app's storage status using the `builder-railpack:report` command:
diff --git a/docs/deployment/continuous-integration/woodpecker-ci.md b/docs/deployment/continuous-integration/woodpecker-ci.md
index 4c6fcda6a..cf286f394 100644
--- a/docs/deployment/continuous-integration/woodpecker-ci.md
+++ b/docs/deployment/continuous-integration/woodpecker-ci.md
@@ -26,4 +26,4 @@ steps:
 ```
 
 - The standard `clone` stage is replaced with one that performs a complete clone of the repository (the default is a shallow clone, which dokku would reject).
-- A `GIT_REMOTE_URL` and a `SSH_PRIVATE_KEY` (with help of the `from_secret` directive) suffice to carry out a deployment.
\ No newline at end of file
+- A `GIT_REMOTE_URL` and a `SSH_PRIVATE_KEY` (with help of the `from_secret` directive) suffice to carry out a deployment.
diff --git a/docs/deployment/logs.md b/docs/deployment/logs.md
index dc507e098..4c1f526f1 100644
--- a/docs/deployment/logs.md
+++ b/docs/deployment/logs.md
@@ -316,7 +316,7 @@ dokku logs:set --global vector-cron-sink "console://?encoding[codec]=text"
 Setting a cron sink **moves** cron task output rather than copying it. Vector routes each log line to exactly one of the two sinks:
 
 | Configuration | Where cron output goes | Where all other output goes |
-|---|---|---|
+| --- | --- | --- |
 | `vector-sink` only | `vector-sink` | `vector-sink` |
 | `vector-cron-sink` only | `vector-cron-sink` | nowhere |
 | both | `vector-cron-sink` | `vector-sink` |
@@ -398,7 +398,7 @@ The alias only changes the shipped event. Containers are always discovered by th
 > The `Report flags` column lists the CLI argument names accepted by `logs:report`. The JSON keys emitted by `logs:report --format json` are the same names with the leading `--logs-` stripped (e.g. `max-size`, `global-max-size`, `computed-max-size`). Legacy keys with the `logs-` prefix are also emitted during the 0.38.x deprecation window and will be removed in a future major release.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `app-label-alias` | app + global | `com.dokku.app-name` | `--logs-app-label-alias`, `--logs-global-app-label-alias`, `--logs-computed-app-label-alias` | Field name the app name is shipped under, renamed from `com.dokku.app-name` on the event |
 | `max-size` | app + global | `10m` | `--logs-max-size`, `--logs-global-max-size`, `--logs-computed-max-size` | Maximum size of an individual log file before rotation |
 | `vector-image` | global only | _parsed from `plugins/logs/Dockerfile`_ | `--logs-global-vector-image`, `--logs-computed-vector-image` | Docker image used to run the vector log-shipper container |
diff --git a/docs/deployment/methods/git.md b/docs/deployment/methods/git.md
index 64a7e61c3..fe6a3b687 100644
--- a/docs/deployment/methods/git.md
+++ b/docs/deployment/methods/git.md
@@ -170,6 +170,8 @@ By default, when running `git:sync` with a git branch reference, Dokku will auto
 dokku git:sync --skip-deploy-branch node-js-app https://github.com/heroku/node-js-getting-started.git main
 ```
 
+The `git:sync` command holds the app's deploy lock while fetching, and will fail if a deploy is already in progress or the app has been locked via `apps:lock`. When the fetched code changes the repository or a build is triggered, the `source-image` property set by [image deploys](/docs/deployment/methods/image.md) is cleared. As the synced code is kept even when a build fails, the property is not restored on build failure.
+
 ### Initializing from private repositories
 
 > [!IMPORTANT]
@@ -204,7 +206,7 @@ echo "personal-access-token" | dokku git:auth github.com username
 > [!IMPORTANT]
 > New as of 0.38.0
 
-The `git:auth-status` command reports whether the configured `netrc` entry matches a desired state without exposing the underlying file. It exits `0` when the configured state matches and `1` otherwise. This allows external tooling such as configuration management systems to perform idempotent updates without reading `$DOKKU_ROOT/.netrc` directly.
+The `git:auth-status` command reports whether the configured `netrc` entry matches a desired state without exposing the underlying file. This allows external tooling such as configuration management systems to perform idempotent updates without reading `$DOKKU_ROOT/.netrc` directly.
 
 ```shell
 # check whether github.com is configured with the expected credentials
@@ -214,6 +216,19 @@ dokku git:auth-status github.com username personal-access-token
 dokku git:auth-status github.com
 ```
 
+The result is reported via the exit code:
+
+| Exit code | Description |
+| --------- | ----------- |
+| `0` | The configured `netrc` entry matches the requested state. |
+| `1` | There is no `netrc` entry for the specified host. |
+| `2` | There is a `netrc` entry for the specified host, but it does not match the requested state. |
+| `3` | The command was called with invalid arguments and the state could not be checked. |
+
+The distinction between `1` and `2` allows a caller to tell a host that needs a `netrc` entry created apart from a host whose existing credentials would be replaced, without issuing a second call.
+
+When called without a username, the requested state is that no `netrc` entry exists for the host. An existing entry is therefore reported as `2`, and `1` is never returned.
+
 As with `git:auth`, the password may be provided via `STDIN`:
 
 ```shell
@@ -324,7 +339,7 @@ The `--format` flag cannot be combined with an info flag.
 ### Settable properties
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `archive-max-files` | app + global | none | `--git-global-archive-max-files`, `--git-computed-archive-max-files` | Maximum number of files allowed in an uploaded archive deploy |
 | `archive-max-size` | app + global | none | `--git-global-archive-max-size`, `--git-computed-archive-max-size` | Maximum total size of an uploaded archive deploy |
 | `deploy-branch` | app + global | `master` | `--git-deploy-branch`, `--git-global-deploy-branch`, `--git-computed-deploy-branch` | Branch name pushed by the git remote that triggers a deploy |
@@ -337,6 +352,6 @@ The `--format` flag cannot be combined with an info flag.
 The following flags surface in `git:report` but are not managed by `git:set` - they are derived from repository state:
 
 | Flag | Description |
-|---|---|
+| --- | --- |
 | `--git-sha` | HEAD commit SHA of the app's git repo |
 | `--git-last-updated-at` | UNIX timestamp of the last write to the deploy branch ref |
diff --git a/docs/deployment/methods/image.md b/docs/deployment/methods/image.md
index bc180a9f7..7db846041 100644
--- a/docs/deployment/methods/image.md
+++ b/docs/deployment/methods/image.md
@@ -59,6 +59,8 @@ dokku git:from-image --build-dir path/to/build node-js-app domy-registrykku/node
 
 See the [dockerfile documentation](/docs/deployment/builders/dockerfiles.md) to learn about the different ways to configure Dockerfile-based deploys.
 
+The image used for a `git:from-image` or `git:load-image` deploy is stored in the `source-image` git property, which can be viewed via `dokku git:report node-js-app --git-source-image`. This property is only changed while the app's deploy lock is held. If the deploy fails, the deploy branch is rolled back and the property is restored to its previous value, so it always refers to the image the repository was last successfully deployed from. Deploying via other methods - such as `git push`, `git:from-archive`, or `git:sync` - clears the property.
+
 ## Initializing an app repository from a remote image without a registry
 
 > [!IMPORTANT]
diff --git a/docs/deployment/schedulers/docker-local.md b/docs/deployment/schedulers/docker-local.md
index 089db7113..7039ed4ef 100644
--- a/docs/deployment/schedulers/docker-local.md
+++ b/docs/deployment/schedulers/docker-local.md
@@ -60,6 +60,16 @@ dokku scheduler-docker-local:set --global init-process
 
 All image containers with the label `org.opencontainers.image.vendor=linuxserver.io` will have the automatic init process injection force-disabled without further intervention when neither an app-level nor a global value is set.
 
+### Failed deploys
+
+When a deploy fails - for example, because a new container does not pass its [zero downtime checks](/docs/deployment/zero-downtime-deploys.md) - the previously running containers are left in place. The app's `latest` image tag is restored to the image the previously running containers use, so commands such as `ps:restart`, `ps:start`, and `ps:restore` bring back the previous release instead of the failed one. The image of the failed release is then removed by `ps:retire`.
+
+To support this, the image an app is running is tagged as `dokku/<app>:dokku-previous` while a build and deploy are in progress. This tag is removed once the deploy completes.
+
+The image currently tagged as the app's `latest` image is never removed by `ps:retire`. This allows an app whose first deploy failed to be started once the cause of the failure has been corrected without requiring a rebuild.
+
+When the `registry` plugin's `push-on-release` property is enabled, the incremented image tag is kept after a failed deploy, and restarting the app will deploy that tag.
+
 ### Deploying Process Types in Parallel
 
 > [!IMPORTANT]
@@ -205,16 +215,16 @@ The `docker-local` scheduler supports a minimal list of resource _limits_ and _r
 
 - cpu: (docker option: `--cpus`), is specified in number of CPUs a process can access.
     - See the ["CPU" section](https://docs.docker.com/config/containers/resource_constraints/#cpu) of the Docker Runtime Options documentation for more information.
-- memory: (docker option: `--memory`) should be specified with a suffix of `b` (bytes), `k` (kilobytes), `m` (megabytes), `g` (gigabytes). Default unit is `m` (megabytes).
+- memory: (docker option: `--memory`) should be specified with a suffix of `b` (bytes), `k` (kilobytes), `m` (megabytes), `g` (gigabytes), `t` (terabytes) or `p` (petabytes). Suffixes are case-insensitive and may be followed by `i` and/or `b`, such as `512M`, `1G`, or `1GiB`. Default unit is `m` (megabytes).
     - See the ["Memory" section](https://docs.docker.com/config/containers/resource_constraints/#memory) of the Docker Runtime Options documentation for more information.
-- memory-swap: (docker option: `--memory-swap`) should be specified with a suffix of `b` (bytes), `k` (kilobytes), `m` (megabytes), `g` (gigabytes)
+- memory-swap: (docker option: `--memory-swap`) should be specified with the same suffixes as `memory`, or `-1` for unlimited swap. Values without a suffix are in bytes.
     - See the ["Memory" section](https://docs.docker.com/config/containers/resource_constraints/#memory) of the Docker Runtime Options documentation for more information.
 - nvidia-gpus: (docker option: `--gpus`), is specified in number of Nvidia GPUs a process can access.
     - See the ["GPU" section](https://docs.docker.com/config/containers/resource_constraints/#gpu) of the Docker Runtime Options documentation for more information.
 
 #### Resource Reservations
 
-- memory: (docker option: `--memory-reservation`) should be specified with a suffix of `b` (bytes), `k` (kilobytes), `m` (megabytes), `g` (gigabytes). Default unit is `m` (megabytes).
+- memory: (docker option: `--memory-reservation`) should be specified with the same suffixes as the `memory` limit. Default unit is `m` (megabytes).
     - See the ["Memory" section](https://docs.docker.com/config/containers/resource_constraints/#memory) of the Docker Runtime Options documentation for more information.
 
 ## Properties
@@ -222,6 +232,6 @@ The `docker-local` scheduler supports a minimal list of resource _limits_ and _r
 ### Settable properties
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `init-process` | app + global | `true` | `--scheduler-docker-local-init-process`, `--scheduler-docker-local-global-init-process`, `--scheduler-docker-local-computed-init-process` | When `true`, runs containers with Docker's `--init` flag (reaping zombie processes) |
 | `parallel-schedule-count` | app + global | `1` | `--scheduler-docker-local-parallel-schedule-count`, `--scheduler-docker-local-global-parallel-schedule-count`, `--scheduler-docker-local-computed-parallel-schedule-count` | Maximum number of containers scheduled in parallel during a deploy |
diff --git a/docs/deployment/schedulers/k3s.md b/docs/deployment/schedulers/k3s.md
index 7fb77e6d6..31fd5b552 100644
--- a/docs/deployment/schedulers/k3s.md
+++ b/docs/deployment/schedulers/k3s.md
@@ -4,21 +4,30 @@
 > New as of 0.33.0
 
 ```
+scheduler-k3s:annotations:clear <app|--global> [--process-type PROCESS_TYPE] [--resource-type RESOURCE_TYPE] # Clear all annotations for an app or a single process-type/resource-type scope
 scheduler-k3s:annotations:set <app|--global> <property> (<value>) [--process-type PROCESS_TYPE] <--resource-type RESOURCE_TYPE> # Set or clear an annotation for a given app/process-type/resource-type combination
+scheduler-k3s:annotations:set --replace <app|--global> <key=value> [<key=value> ...] [--process-type PROCESS_TYPE] <--resource-type RESOURCE_TYPE> # Replace the entire annotation map for a given app/process-type/resource-type combination
 scheduler-k3s:annotations:report [<app>|--global] [--format stdout|json] [--process-type PROCESS_TYPE] [--resource-type RESOURCE_TYPE] # Displays a scheduler-k3s annotations report for one or more apps
 scheduler-k3s:autoscaling-auth:set <app|--global> <trigger> [<--metadata key=value>...] # Set or clear a scheduler-k3s autoscaling keda trigger authentication resource for an app
+scheduler-k3s:autoscaling-auth:set --replace <app|--global> <trigger> <--metadata key=value> [<--metadata key=value>...] # Replace the entire metadata map for a scheduler-k3s autoscaling keda trigger authentication resource
 scheduler-k3s:autoscaling-auth:report [<app>|--global] [--format stdout|json] [--include-metadata] # Displays a scheduler-k3s autoscaling auth report for one or more apps
+scheduler-k3s:charts:clear <chart> # Clear all chart-specific helm values for a chart
 scheduler-k3s:charts:report [<chart>] [--format stdout|json] # Displays a scheduler-k3s chart override report
 scheduler-k3s:charts:set <chart-name.property> (<value>) # Set or clear a chart-specific helm value
+scheduler-k3s:charts:set --replace <chart> <property=value> [<property=value> ...] # Replace the entire helm value override map for a chart
 scheduler-k3s:cluster:add [--profile PROFILE] [--role ROLE] [--insecure-allow-unknown-hosts] [--server-ip SERVER_IP] [--taint-scheduling] [--kubelet-args KUBELET_ARGS] <ssh://user@host:port> # Adds a server node to a Dokku-managed cluster
 scheduler-k3s:cluster:list [--format json|stdout] # Lists all nodes in a Dokku-managed cluster
 scheduler-k3s:cluster:remove [node-id] # Removes client node to a Dokku-managed cluster
-scheduler-k3s:ensure-charts # Ensures the k3s charts are installed
-scheduler-k3s:initialize [--server-ip SERVER_IP] [--taint-scheduling] [--kubelet-args KUBELET_ARGS] # Initializes a cluster
+scheduler-k3s:ensure-charts [--force] [--charts CHART_NAMES] # Ensures the k3s charts are installed
+scheduler-k3s:initialize [--server-ip SERVER_IP] [--ingress-class INGRESS_CLASS] [--taint-scheduling] [--kubelet-args KUBELET_ARGS] # Initializes a cluster
+scheduler-k3s:labels:clear <app|--global> [--process-type PROCESS_TYPE] [--resource-type RESOURCE_TYPE] # Clear all labels for an app or a single process-type/resource-type scope
 scheduler-k3s:labels:set <app|--global> <property> (<value>) [--process-type PROCESS_TYPE] <--resource-type RESOURCE_TYPE> # Set or clear a label for a given app/process-type/resource-type combination
+scheduler-k3s:labels:set --replace <app|--global> <key=value> [<key=value> ...] [--process-type PROCESS_TYPE] <--resource-type RESOURCE_TYPE> # Replace the entire label map for a given app/process-type/resource-type combination
 scheduler-k3s:labels:report [<app>|--global] [--format stdout|json] [--process-type PROCESS_TYPE] [--resource-type RESOURCE_TYPE] # Displays a scheduler-k3s labels report for one or more apps
+scheduler-k3s:node-sysctls:clear [--global|--profile PROFILE] # Clear all node-level kernel sysctls for unprofiled nodes or a single node profile
 scheduler-k3s:node-sysctls:set <sysctl> (<value>) [--global|--profile PROFILE] # Set or clear a node-level kernel sysctl for unprofiled nodes or a single node profile
-scheduler-k3s:node-sysctls:report [--format stdout|json] # Displays the node-level kernel sysctls applied to each scope
+scheduler-k3s:node-sysctls:set --replace <sysctl=value> [<sysctl=value> ...] [--global|--profile PROFILE] # Replace the entire node-level kernel sysctl map for unprofiled nodes or a single node profile
+scheduler-k3s:node-sysctls:report [--format stdout|json] [--stored] [--global|--profile PROFILE] # Displays the node-level kernel sysctls for each scope
 scheduler-k3s:preview <app> [--context N] [--show-secrets] [--show-secrets-decoded] # Displays a diff between the current and next deployment for an app
 scheduler-k3s:profiles:add <profile> [--role ROLE] [--insecure-allow-unknown-hosts] [--taint-scheduling] [--kubelet-args KUBELET_ARGS] # Adds a node profile to the k3s cluster
 scheduler-k3s:profiles:list [--format json|stdout] # Lists all node profiles in the k3s cluster
@@ -204,7 +213,7 @@ dokku scheduler-k3s:profiles:add edge-workers \
   --kubelet-args protect-kernel-defaults=true,eviction-hard=memory.available<200Mi
 ```
 
-Profile names must be alphanumeric, may include internal dashes, cannot start/end with a dash, and must be ≤32 characters. Other than the `--server-ip` flag, all flags used for `scheduler-k3s:cluster:add` are valid for the `scheduler-k3s:profiles:add` command.
+Profile names must be lowercase alphanumeric, may include internal dashes, cannot start/end with a dash, and must be ≤26 characters. The limit is not arbitrary: the name becomes part of the helm release backing that profile's [non-namespaced sysctls](#non-namespaced-sysctls), and helm caps a release name at 53 characters. Other than the `--server-ip` flag, all flags used for `scheduler-k3s:cluster:add` are valid for the `scheduler-k3s:profiles:add` command.
 
 #### scheduler-k3s:profiles:remove
 
@@ -595,6 +604,49 @@ dokku scheduler-k3s:annotations:set node-js-app annotation.key --resource-type d
 
 A `ps:restart` is required after removing annotations in order to remove them from running resources.
 
+#### Replacing the entire annotation set
+
+The per-key form above changes one annotation at a time, so matching the stored annotations to a declared set means computing the difference and issuing one command per added, changed and removed key. The `--replace` flag writes the whole map for a scope in a single call, taking `key=value` pairs instead of a single key and value.
+
+```shell
+dokku scheduler-k3s:annotations:set --replace node-js-app --resource-type deployment annotation.key=annotation.value other.key=other.value
+```
+
+Anything previously stored for that scope and not named in the call is removed. `--resource-type` is still required, and `--process-type` scopes the replacement the same way it scopes a single key.
+
+```shell
+dokku scheduler-k3s:annotations:set --replace node-js-app --resource-type deployment --process-type web annotation.key=annotation.value
+```
+
+Every pair is parsed before anything is written, so a rejected pair leaves the stored annotations untouched. A pair without a `=`, a pair with an empty key, and a key named more than once are all rejected.
+
+A pair ending in `=` stores an empty value, which the per-key form cannot express - there, an empty value deletes the key instead.
+
+```shell
+dokku scheduler-k3s:annotations:set --replace node-js-app --resource-type deployment annotation.key=
+```
+
+> [!NOTE]
+> An empty pair list is rejected rather than treated as a request to remove everything, so a generated list that expands to nothing cannot silently drop an app's annotations. Use `scheduler-k3s:annotations:clear` for that.
+
+#### Clearing annotations
+
+The `scheduler-k3s:annotations:clear` command removes every annotation configured for an app.
+
+```shell
+dokku scheduler-k3s:annotations:clear node-js-app
+```
+
+The `--process-type` and `--resource-type` flags narrow what is cleared, and filter the same way they do for `scheduler-k3s:annotations:report`. Omitting both clears every scope.
+
+```shell
+dokku scheduler-k3s:annotations:clear node-js-app --resource-type deployment
+dokku scheduler-k3s:annotations:clear node-js-app --process-type web --resource-type deployment
+dokku scheduler-k3s:annotations:clear --global --resource-type deployment
+```
+
+A `ps:restart` is required after clearing annotations in order to remove them from running resources.
+
 #### Displaying annotations
 
 Configured annotations can be inspected with the `scheduler-k3s:annotations:report` command. Without arguments, it iterates every app and prints all annotations. Passing an app name (or `--global`) scopes the report:
@@ -658,15 +710,38 @@ A `ps:restart` is required after setting labels in order to have them apply to r
 
 #### Removing a label
 
-To unset an label, pass an empty value:
+To unset a label, pass an empty value:
 
 ```shell
-dokku scheduler-k3s:annotations:set node-js-app label.key --resource-type deployment
+dokku scheduler-k3s:labels:set node-js-app label.key --resource-type deployment
 dokku scheduler-k3s:labels:set node-js-app label.key --resource-type deployment --process-type web
 ```
 
 A `ps:restart` is required after removing labels in order to remove them from running resources.
 
+#### Replacing the entire label set
+
+As with annotations, the `--replace` flag writes the whole map for a scope in a single call, taking `key=value` pairs instead of a single key and value.
+
+```shell
+dokku scheduler-k3s:labels:set --replace node-js-app --resource-type deployment label.key=label.value other.key=other.value
+```
+
+Anything previously stored for that scope and not named in the call is removed. `--resource-type` is still required, `--process-type` scopes the replacement, every pair is parsed before anything is written, and a pair ending in `=` stores an empty value. An empty pair list is rejected; use `scheduler-k3s:labels:clear` to remove everything.
+
+#### Clearing labels
+
+The `scheduler-k3s:labels:clear` command removes every label configured for an app, with the same optional `--process-type` and `--resource-type` filters as `scheduler-k3s:labels:report`.
+
+```shell
+dokku scheduler-k3s:labels:clear node-js-app
+dokku scheduler-k3s:labels:clear node-js-app --resource-type deployment
+dokku scheduler-k3s:labels:clear node-js-app --process-type web --resource-type deployment
+dokku scheduler-k3s:labels:clear --global --resource-type deployment
+```
+
+A `ps:restart` is required after clearing labels in order to remove them from running resources.
+
 #### Displaying labels
 
 Configured labels can be inspected with the `scheduler-k3s:labels:report` command. The surface mirrors `scheduler-k3s:annotations:report`:
@@ -809,9 +884,19 @@ After execution, Dokku will include the following resources for each specified t
 
 If the `--global` flag is specified instead of an app name, a custom helm chart is created on the fly with the above resources.
 
+##### Replacing Authentication Metadata
+
+Without `--replace`, the metadata supplied is merged into whatever is already stored for the trigger, so a key that is no longer named stays behind. The `--replace` flag drops the trigger's existing metadata before writing, making the stored set exactly what was specified.
+
+```shell
+dokku scheduler-k3s:autoscaling-auth:set --replace node-js-app datadog --metadata apiKey=1234567890 --metadata appKey=asdfghjkl
+```
+
+In the example above, a `datadogSite` key configured earlier is removed rather than left in place. At least one `--metadata` flag is required with `--replace`; omit the flag entirely to remove everything, as below.
+
 ##### Removing Authentication Resources
 
-To remove a configured authenticatin resource, run the `scheduler-k3s:autoscaling-auth:set` command with no metadata specified. Subsequent deploys will not include these resources.
+To remove a configured authentication resource, run the `scheduler-k3s:autoscaling-auth:set` command with no metadata specified. Subsequent deploys will not include these resources.
 
 ```shell
 dokku scheduler-k3s:autoscaling-auth:set $APP $TRIGGER_TYPE
@@ -874,7 +959,7 @@ dokku docker-options:add node-js-app deploy "--sysctl net.ipv4.ip_unprivileged_p
 
 Passing a non-namespaced sysctl this way fails the deploy rather than silently dropping the value, since it provably cannot take effect within a pod. Note this differs from the `docker-local` scheduler, where such an option is passed straight through to `docker run`.
 
-Kubernetes further splits namespaced sysctls into a *safe* list that any pod may set, and everything else. A sysctl outside the safe list - `net.core.somaxconn`, for example - is rejected at pod admission unless the node's kubelet was started with a matching `allowed-unsafe-sysctls` value, which can be supplied at cluster initialization or when joining a node.
+Kubernetes further splits namespaced sysctls into a _safe_ list that any pod may set, and everything else. A sysctl outside the safe list - `net.core.somaxconn`, for example - is rejected at pod admission unless the node's kubelet was started with a matching `allowed-unsafe-sysctls` value, which can be supplied at cluster initialization or when joining a node.
 
 ```shell
 dokku scheduler-k3s:initialize --kubelet-args allowed-unsafe-sysctls=net.core.somaxconn
@@ -906,16 +991,70 @@ dokku scheduler-k3s:node-sysctls:set --profile edge-workers vm.max_map_count 524
 
 A profile scope inherits everything set globally and overrides it on conflict, so each node is covered by exactly one DaemonSet and no two ever write the same value. Note that the server node created by `scheduler-k3s:initialize` never carries a profile label, so only globally-scoped sysctls reach it.
 
-Use `node-sysctls:report` to see the resolved set for every scope.
+A profile created by an older Dokku may carry a name outside the [current rules](#adding-profiles), such as one containing uppercase or longer than 26 characters. Dokku cannot name a helm release after such a profile, so it is skipped with a warning and `node-sysctls:set --profile` refuses it. Recreate the profile under a valid name to give it sysctls; `scheduler-k3s:profiles:remove` still removes the old one.
+
+The `--replace` flag writes the whole set for a scope in one call, taking `sysctl=value` pairs instead of a single name and value. Anything previously set for that scope and not named in the call is cleared, with the same caveat about the value staying on affected nodes until they reboot.
+
+```shell
+dokku scheduler-k3s:node-sysctls:set --replace --global vm.max_map_count=262144 vm.swappiness=10
+```
+
+Every pair is parsed before anything is written, so a rejected pair leaves the stored sysctls untouched. A pair without a `=`, a pair with an empty key, and a key named more than once are all rejected. An empty pair list is rejected rather than treated as a request to remove everything.
+
+To remove every sysctl for a scope, use `scheduler-k3s:node-sysctls:clear`.
+
+```shell
+dokku scheduler-k3s:node-sysctls:clear --global
+dokku scheduler-k3s:node-sysctls:clear --profile edge-workers
+```
+
+Clearing a scope removes its DaemonSet. As with clearing a single sysctl, the values it last wrote stay in place on affected nodes until they reboot.
+
+Use `node-sysctls:report` to see the resolved set every scope's DaemonSet applies. A profile's entry therefore includes everything it inherits from the global scope.
 
 ```shell
 dokku scheduler-k3s:node-sysctls:report
 ```
 
+```
+scope         sysctl                value
+--global      vm.overcommit_memory  1
+--global      vm.swappiness         20
+edge-workers  vm.overcommit_memory  1
+edge-workers  vm.swappiness         60
+```
+
 ```shell
 dokku scheduler-k3s:node-sysctls:report --format json
 ```
 
+Because that report resolves each scope, a profile's entry does not distinguish a sysctl the profile sets itself from one it inherits. To report only the map each scope stores - the map its own `node-sysctls:set` and `node-sysctls:clear` calls write - add the `--stored` flag:
+
+```shell
+dokku scheduler-k3s:node-sysctls:report --stored
+```
+
+```
+scope         sysctl                value
+--global      vm.overcommit_memory  1
+--global      vm.swappiness         20
+edge-workers  vm.swappiness         60
+```
+
+The global scope stores exactly what it applies, so `--stored` reports the same thing for `--global` either way.
+
+A configuration tool holding a declared map for a scope should compare it against `--stored`. Comparing against the resolved set never converges a profile, since a profile that stores nothing of its own still reports every globally-set sysctl.
+
+The report covers every scope unless `--global` or `--profile` narrows it to one, the same way those flags scope `node-sysctls:set` and `node-sysctls:clear`. Only one of the two may be given.
+
+```shell
+dokku scheduler-k3s:node-sysctls:report --stored --profile edge-workers --format json
+```
+
+```json
+{"edge-workers":{"vm.swappiness":"60"}}
+```
+
 The DaemonSet pulls `busybox` and `registry.k8s.io/pause` by default. On an air-gapped cluster or one behind a registry mirror, point them elsewhere:
 
 ```shell
@@ -953,7 +1092,7 @@ See the [Kustomize](https://kustomize.io/) website for more details on how to us
 ### Using kubectl remotely
 
 > [!WARNING]
-> Certain ports must be open for interacting with the remote kubernets api. Refer to the [K3s networking documentation](https://docs.k3s.io/installation/requirements?os=debian#networking) for the required open ports between servers prior to running the command.
+> Certain ports must be open for interacting with the remote kubernetes api. Refer to the [K3s networking documentation](https://docs.k3s.io/installation/requirements?os=debian#networking) for the required open ports between servers prior to running the command.
 
 By default, Dokku assumes that all it controls all actions on the cluster, and thus does not expose the `kubectl` binary for administrators. To interact with kubectl, you will need to retrieve the `kubeconfig` for the cluster and configure your client to use that configuration.
 
@@ -998,18 +1137,20 @@ The default value for the `kube-context` is an empty string, and will result in
 Dokku includes a number of helm charts by default with settings that are optimized for Dokku. That said, it may be useful to further customize the charts for a given environment. Chart overrides are managed via the `scheduler-k3s:charts:set` command, which takes a `<chart-name>.<property>` argument and a value. Chart overrides are always global because helm charts are not managed on a per-app basis.
 
 ```shell
-dokku scheduler-k3s:charts:set cert-manager.version 1.13.3
+dokku scheduler-k3s:charts:set cert-manager.installCRDs false
 ```
 
 > [!NOTE]
 > Properties follow dot-notation, and are expanded according to Helm's internal logic. See the [Helm documentation](https://helm.sh/docs/helm/helm_install/#helm-install) for `helm install` for further details.
 
+Chart overrides are values passed to a chart, not the version of the chart itself. Dokku pins the version of every chart it manages, and those versions are not user-configurable. The `scheduler-k3s:ensure-charts` command reconciles each installed release back to the pinned version, upgrading or downgrading a release that has drifted away from it.
+
 Property names may contain `/` (e.g. for Kubernetes-style annotation keys such as `service.annotations.prometheus.io/scrape`) and values may span multiple lines; both are preserved verbatim.
 
 To unset a chart property, omit the value from the `scheduler-k3s:charts:set` call:
 
 ```shell
-dokku scheduler-k3s:charts:set cert-manager.version
+dokku scheduler-k3s:charts:set cert-manager.installCRDs
 ```
 
 Configured chart overrides can be inspected with the `scheduler-k3s:charts:report` command. Without an argument, it lists every chart known to Dokku along with any configured overrides; passing a chart name scopes the report to that chart:
@@ -1035,6 +1176,37 @@ Alternatively, a comma separated list of chart names can be specified to only fo
 dokku scheduler-k3s:ensure-charts --charts cert-manager
 ```
 
+#### Replacing the entire chart override set
+
+The per-property form above changes one chart override at a time, so matching the stored overrides for a chart to a declared set means computing the difference and issuing one command per added, changed and removed property. The `--replace` flag writes the whole override map for a chart in a single call, taking the chart name followed by `property=value` pairs instead of a single `<chart-name>.<property>` argument and value.
+
+```shell
+dokku scheduler-k3s:charts:set --replace cert-manager installCRDs=false replicaCount=2
+```
+
+Anything previously stored for that chart and not named in the call is removed. Overrides for other charts are left untouched.
+
+Every pair is parsed before anything is written, so a rejected pair leaves the stored overrides untouched. A pair without a `=`, a pair with an empty property, and a property named more than once are all rejected. Only the first `=` in a pair separates the property from the value, so values may themselves contain `=`.
+
+A pair ending in `=` stores an empty value, which the per-property form cannot express - there, an empty value deletes the property instead.
+
+```shell
+dokku scheduler-k3s:charts:set --replace cert-manager installCRDs=
+```
+
+> [!NOTE]
+> An empty pair list is rejected rather than treated as a request to remove everything, so a generated list that expands to nothing cannot silently drop a chart's overrides. Use `scheduler-k3s:charts:clear` for that.
+
+#### Clearing chart overrides
+
+The `scheduler-k3s:charts:clear` command removes every override configured for a chart.
+
+```shell
+dokku scheduler-k3s:charts:clear cert-manager
+```
+
+As with any other chart property change, a `scheduler-k3s:ensure-charts --force` or `scheduler-k3s:ensure-charts --charts <chart>` call is required after replacing or clearing chart overrides in order to have them apply.
+
 ### Persistent storage
 
 K3s apps mount persistent volumes through the Dokku storage plugin. A `storage:create --scheduler k3s` call provisions a PersistentVolumeClaim through a small per-entry helm release; `storage:mount <app> <name> --container-dir <path>` then attaches it to an app. Because storage entries are global, the same PVC can be mounted into multiple apps (for `ReadWriteMany` workloads) or into the same app at multiple subpaths.
@@ -1054,6 +1226,8 @@ git push dokku master
 
 For a hostPath-backed PV (no StorageClass), pass `<path>` as the second positional argument and omit `--storage-class-name`. The plugin renders both the PV and the PVC into the entry's helm release. The `--reclaim-policy` flag (`Retain` or `Delete`) controls whether the underlying PV survives `storage:destroy`. Annotations and labels set via `storage:annotations:set` and `storage:labels:set` propagate to both the PVC and the PV so backup tools (Velero, Longhorn snapshots) can find them.
 
+`storage:mount --process-type <proc>` scopes a volume to a single process type, so only that deployment's pods mount the PVC; a mount left in the default `_default_` scope is mounted by every deployment. Cron jobs are keyed by a generated cron ID rather than a Procfile process type, so they mount default-scoped volumes only. Only deploy-phase attachments are mounted on k3s - `--phase run` has no effect here.
+
 The legacy `storage:mount <app> <host>:<container>` colon form is rejected on k3s apps; create a named entry instead. See [Persistent Storage](/docs/advanced-usage/persistent-storage.md) for the full command reference.
 
 ### Chart upgrade callbacks
@@ -1152,7 +1326,7 @@ Two differences are worth noting:
 The `k3s` scheduler supports a minimal list of resource _limits_ and _reservations_:
 
 - cpu: is specified in number of CPUs a process can access.
-- memory: should be specified with a suffix of `b` (bytes), `Ki` (kilobytes), `Mi` (megabytes), `Gi` (gigabytes). Default unit is `Mi` (megabytes).
+- memory: should be specified with a suffix of `b` (bytes), `k` (kilobytes), `m` (megabytes), `g` (gigabytes), `t` (terabytes) or `p` (petabytes). Suffixes are case-insensitive and may be followed by `i` and/or `b`, such as `512Mi`, `1G`, or `1GiB`. Units are binary, so `1G` and `1Gi` are equivalent. Default unit is `Mi` (megabytes).
 
 If unspecified for any task, the default reservation will be `.1` CPU and `128Mi` RAM, with no limit set for either CPU or RAM. This is to avoid issues with overscheduling pods on a cluster. To avoid issues, set more specific values for at least resource reservations. If unbounded utilization is desired, set CPU and Memory to `0m` and `0Mi`, respectively.
 
@@ -1167,7 +1341,7 @@ If unspecified for any task, the default reservation will be `.1` CPU and `128Mi
 > The `Report flags` column lists the CLI argument names accepted by `scheduler-k3s:report`. The JSON keys emitted by `scheduler-k3s:report --format json` are the same names with the leading `--scheduler-k3s-` stripped (e.g. `deploy-timeout`, `global-deploy-timeout`, `computed-deploy-timeout`). Legacy keys with the `scheduler-k3s-` prefix are also emitted during the 0.38.x deprecation window and will be removed in a future major release.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `cert-issuer-kind` | app + global | `ClusterIssuer` | `--scheduler-k3s-cert-issuer-kind`, `--scheduler-k3s-global-cert-issuer-kind`, `--scheduler-k3s-computed-cert-issuer-kind` | Kind of the manually managed cert-manager issuer referenced by `cert-issuer-name`, either `Issuer` or `ClusterIssuer` |
 | `cert-issuer-name` | app + global | none | `--scheduler-k3s-cert-issuer-name`, `--scheduler-k3s-global-cert-issuer-name`, `--scheduler-k3s-computed-cert-issuer-name` | Name of a manually managed cert-manager issuer to request certificates from, taking precedence over the letsencrypt integration. Set to `false` to opt an app out of a global value |
 | `deploy-timeout` | app + global | `300s` | `--scheduler-k3s-deploy-timeout`, `--scheduler-k3s-global-deploy-timeout`, `--scheduler-k3s-computed-deploy-timeout` | Timeout for a single helm install/upgrade cycle |
@@ -1181,8 +1355,8 @@ If unspecified for any task, the default reservation will be `.1` CPU and `128Mi
 | `letsencrypt-server` | app + global | `prod` | `--scheduler-k3s-letsencrypt-server`, `--scheduler-k3s-global-letsencrypt-server`, `--scheduler-k3s-computed-letsencrypt-server` | ACME directory (`prod` or `staging`) used for app certificates, or `false` to disable all automatic certificate issuance |
 | `namespace` | app + global | `default` | `--scheduler-k3s-namespace`, `--scheduler-k3s-global-namespace`, `--scheduler-k3s-computed-namespace` | Kubernetes namespace into which the app's resources are installed |
 | `network-interface` | global only | `eth0` | `--scheduler-k3s-global-network-interface`, `--scheduler-k3s-computed-network-interface` | Host network interface used by k3s |
-| `node-sysctls-image` | global only | `busybox:1.36` | `--scheduler-k3s-global-node-sysctls-image` | Image used to apply node-level sysctls, override for air-gapped clusters |
-| `node-sysctls-pause-image` | global only | `registry.k8s.io/pause:3.9` | `--scheduler-k3s-global-node-sysctls-pause-image` | Image keeping the node sysctls daemonset pods running |
+| `node-sysctls-image` | global only | `busybox:1.36` | `--scheduler-k3s-global-node-sysctls-image`, `--scheduler-k3s-computed-node-sysctls-image` | Image used to apply node-level sysctls, override for air-gapped clusters |
+| `node-sysctls-pause-image` | global only | `registry.k8s.io/pause:3.9` | `--scheduler-k3s-global-node-sysctls-pause-image`, `--scheduler-k3s-computed-node-sysctls-pause-image` | Image keeping the node sysctls daemonset pods running |
 | `rollback-on-failure` | app + global | `false` | `--scheduler-k3s-rollback-on-failure`, `--scheduler-k3s-global-rollback-on-failure`, `--scheduler-k3s-computed-rollback-on-failure` | When `true`, helm rolls back the release if a deploy fails |
 | `shm-size` | app + global | none | `--scheduler-k3s-shm-size`, `--scheduler-k3s-global-shm-size`, `--scheduler-k3s-computed-shm-size` | `/dev/shm` size override applied to app containers |
 | `token` | global only | none | `--scheduler-k3s-global-token` (masked as `*******` in default stdout output; the raw value is returned when queried via `--format json` or when this flag is requested explicitly) | Cluster join token used by `scheduler-k3s:cluster-add` |
diff --git a/docs/deployment/schedulers/null.md b/docs/deployment/schedulers/null.md
index eeb9bb6ab..d515e029e 100644
--- a/docs/deployment/schedulers/null.md
+++ b/docs/deployment/schedulers/null.md
@@ -3,7 +3,7 @@
 > [!IMPORTANT]
 > New as of 0.25.0
 
-The `null` scheduler does nothing, and is useful for routing to services not managed by Dokku. It should not be used in normal operation. Please see the [network documentation](/docs/networking/network.md#routing-an-app-to-a-known-ip:port-combination) for more information on the aforementioned use case.
+The `null` scheduler does nothing, and is useful for routing to services not managed by Dokku. It should not be used in normal operation. Please see the [network documentation](/docs/networking/network.md#routing-an-app-to-a-known-ipport-combination) for more information on the aforementioned use case.
 
 ## Usage
 
diff --git a/docs/deployment/schedulers/scheduler-management.md b/docs/deployment/schedulers/scheduler-management.md
index ca20b4539..53dcfe490 100644
--- a/docs/deployment/schedulers/scheduler-management.md
+++ b/docs/deployment/schedulers/scheduler-management.md
@@ -123,7 +123,7 @@ At this time, the following dokku commands are used to implement a complete sche
     - triggers: post-app-clone-setup
 - `cron`: generates cron tasks for the app
     - triggers: scheduler-uses-host-cron, scheduler-cron-write
-- `deploy`: deploys app proceses and checks the status of a deploy
+- `deploy`: deploys app processes and checks the status of a deploy
     - triggers: scheduler-app-status, scheduler-deploy, scheduler-is-deployed, scheduler-logs-failed
 - `enter`: enters a running container
     - triggers: scheduler-enter
@@ -156,6 +156,6 @@ Deployment tasks are currently executed directly on the primary Dokku server.
 > The `Report flags` column lists the CLI argument names accepted by `scheduler:report`. The JSON keys emitted by `scheduler:report --format json` are the same names with the leading `--scheduler-` stripped (e.g. `selected`, `global-selected`, `computed-selected`). Legacy keys with the `scheduler-` prefix are also emitted during the 0.38.x deprecation window and will be removed in a future major release.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `selected` | app + global | `docker-local` | `--scheduler-selected`, `--scheduler-global-selected`, `--scheduler-computed-selected` | Scheduler plugin used to deploy this app (`docker-local`, `k3s`, etc.) |
 | `shell` | app + global | none | `--scheduler-shell`, `--scheduler-global-shell`, `--scheduler-computed-shell` | Shell used by `enter`/`run` commands when entering a container |
diff --git a/docs/deployment/user-management.md b/docs/deployment/user-management.md
index 27922f67c..f9597dac3 100644
--- a/docs/deployment/user-management.md
+++ b/docs/deployment/user-management.md
@@ -135,3 +135,9 @@ Use `visudo /etc/sudoers.d/dokku-users`, or `visudo /etc/sudoers` to add the fol
 ```
 %dokku ALL=(ALL:ALL) NOPASSWD:SETENV: /usr/bin/dokku
 ```
+
+The `SETENV:` tag is required. When a user other than `dokku` runs the `dokku` binary, it re-executes
+itself as the `dokku` user and names the environment variables that have to survive that step via
+`sudo --preserve-env=`. Without `SETENV:` those variables are filtered out, and global flags such as
+`--quiet`, `--trace` and `--force` stop taking effect. See
+[Forwarding environment variables](/docs/configuration/environment-variables.md#forwarding-environment-variables).
diff --git a/docs/deployment/zero-downtime-deploys.md b/docs/deployment/zero-downtime-deploys.md
index c737f56e1..f7a9a9a02 100644
--- a/docs/deployment/zero-downtime-deploys.md
+++ b/docs/deployment/zero-downtime-deploys.md
@@ -180,6 +180,18 @@ A healthcheck entry takes the following properties:
 
 See the [docker-container-healthchecker](https://github.com/dokku/docker-container-healthchecker) documentation for more details on how healthchecks are interpreted.
 
+### Healthchecks and label-based proxies
+
+When using the `docker-local` scheduler, the `nginx` proxy only routes traffic to new containers once healthchecks have passed. The `caddy`, `haproxy`, `openresty`, and `traefik` proxies instead discover containers via docker labels, which are attached when a container is created, and will route requests to a new container as soon as it is running. As Dokku's healthchecks are run from the host, these proxies are not aware of their result.
+
+To reduce the number of requests routed to a container that is not yet ready, the first `readiness` healthcheck with a `path` for the `web` process is translated into proxy-specific configuration:
+
+- [Caddy](/docs/networking/proxies/caddy.md#healthchecks): Active healthchecks against the `path`, and retries of failed requests against other containers.
+- [OpenResty](/docs/networking/proxies/openresty.md#healthchecks): Active healthchecks against the `path`, and retries of failed requests against other containers.
+- [Traefik](/docs/networking/proxies/traefik.md#healthchecks): Active healthchecks against the `path`.
+
+Haproxy does not support this configuration. Healthchecks of other types are not translated, as proxy healthchecks run for the lifetime of a container. Translating a `startup` healthcheck would turn it into a `readiness` healthcheck.
+
 ## Manually invoking checks
 
 Checks can also be manually invoked via the `checks:run` command. This can be used to check the status of an application via cron to provide integration with external healthchecking software.
diff --git a/docs/development/architecture.md b/docs/development/architecture.md
index 2e8cdf9eb..e53cec10f 100644
--- a/docs/development/architecture.md
+++ b/docs/development/architecture.md
@@ -141,7 +141,7 @@ Plugins communicate through the **trigger system** powered by [plugn](https://gi
 **Key trigger categories:**
 
 | Category | Examples | Purpose |
-|----------|----------|---------|
+| ---------- | ---------- | --------- |
 | App lifecycle | `post-create`, `pre-delete`, `post-deploy` | React to app events |
 | Build | `builder-detect`, `pre-build`, `builder-build` | Control build process |
 | Deploy | `scheduler-deploy`, `check-deploy` | Manage deployments |
@@ -260,7 +260,7 @@ Dokku uses a file-based state system for simplicity and transparency.
 Plugin-specific configuration is stored in the property system:
 
 ```
-/var/lib/dokku/data/<plugin>/<app>/<property>
+/var/lib/dokku/config/<plugin>/<app>/<property>
 ```
 
 Properties are managed via helper functions:
@@ -277,6 +277,40 @@ common.PropertyWrite("git", appName, "deploy-branch", "main")
 common.PropertyGet("git", appName, "deploy-branch")
 ```
 
+Property writes for a given plugin and app are serialized by a lock on that app's property directory, and each write replaces the file atomically, so readers never see a partially written value. The list and map helpers, such as `PropertyListAdd` and `PropertyMapSet`, hold the lock while they read, change, and write a property.
+
+Code that reads a property and writes a value derived from it must hold the lock for the whole operation, or concurrent commands for the same app will overwrite each other's changes:
+
+```go
+// Go: update a single list property
+common.PropertyListUpdate("my-plugin", appName, "items", func(lines []string) ([]string, error) {
+    return append(lines, "new-item"), nil
+})
+
+// Go: read and write several properties together
+common.PropertyLock("my-plugin", appName, func(p *common.LockedProperties) error {
+    current := common.PropertyGet("my-plugin", appName, "current")
+    if err := p.Write("previous", current); err != nil {
+        return err
+    }
+    return p.Write("current", "new-value")
+})
+```
+
+```bash
+# Shell
+fn-my-plugin-rotate() {
+  declare desc="moves the current value to previous, expecting the caller to hold the my-plugin property lock"
+  declare APP="$1" VALUE="$2"
+  fn-plugin-property-write "my-plugin" "$APP" "previous" "$(fn-plugin-property-get "my-plugin" "$APP" "current")"
+  fn-plugin-property-write "my-plugin" "$APP" "current" "$VALUE"
+}
+
+fn-plugin-property-lock "my-plugin" "$APP" fn-my-plugin-rotate "$APP" "new-value"
+```
+
+Inside a `PropertyLock` callback, writes must go through the `LockedProperties` handle, as the public writers take the same lock. Shell callbacks may call the regular `fn-plugin-property-*` helpers.
+
 ### Per-App Data
 
 Application-specific data sometimes lives in `$DOKKU_ROOT/<app>/`:
@@ -299,7 +333,7 @@ Global settings can be configured via:
 ## Key Design Decisions
 
 | Decision | Rationale |
-|----------|-----------|
+| ---------- | ----------- |
 | **Plugin-based architecture** | Enables extensibility without modifying core code. Community plugins can add databases, caching, and other services. |
 | **Bash + Go hybrid** | Bash for orchestration and simple commands; Go for performance-critical operations and complex logic. |
 | **Trigger system** | Loose coupling between plugins. Plugins don't need to know about each other; they just fire and respond to events. |
diff --git a/docs/development/plugin-triggers.md b/docs/development/plugin-triggers.md
index c9aff33df..5501b996b 100644
--- a/docs/development/plugin-triggers.md
+++ b/docs/development/plugin-triggers.md
@@ -598,7 +598,7 @@ plugn trigger config-migrate-env
 
 ### `config-set`
 
-- Description: Sets one or more config values for an app without restarting (when --no-restart flag is specified)
+- Description: Sets one or more config values for an app without restarting (when --no-restart flag is specified). Exits non-zero without restarting the app when the config cannot be persisted.
 - Invoked by: app-json plugin
 - Arguments: `[--no-restart] $APP $KEY1=VALUE1 [$KEY2=VALUE2 ...]`
 - Example:
@@ -611,6 +611,21 @@ set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 # TODO
 ```
 
+### `config-unset`
+
+- Description: Unsets a single config value for an app. Exits non-zero without restarting the app when the config cannot be persisted.
+- Invoked by: `common` when migrating deprecated config vars to plugin properties
+- Arguments: `$APP $KEY $RESTART`, or `--global $KEY $RESTART` when the `--global` flag is given
+- Example:
+
+```shell
+#!/usr/bin/env bash
+
+set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
+
+plugn trigger config-unset node-js-app DEPRECATED_VAR false
+```
+
 ### `core-post-deploy`
 
 > To avoid issues with community plugins, this plugin trigger should be used _only_ for core plugins. Please avoid using this trigger in your own plugins.
@@ -673,8 +688,10 @@ APP="$1"; PROPERTY="$2"
 ### `cron-entries`
 
 - Description: Allows injecting cron tasks into the written out scheduled cron task list. Each entry is newline delimited, and individual tasks come in the form `$SCHEDULE;$FULL_COMMAND;$ARBITRARY_DATA`. Individual implementations of cron writing can decide whether and how to include these cron tasks. The `ARBITRARY_DATA` includes the log file path for the basic `docker-local` cron implementation.
-- Invoked by:
-- Arguments: `$DOKKU_SCHEDULER`
+
+    When `$CRON_ENTRY_FORMAT` is `json`, each entry may instead be printed as a json object on its own line, with the keys `schedule`, `command`, `log-file` and `mailto`. Only `schedule` and `command` are required. A task with a `mailto` value is written to the crontab after a `MAILTO` line of its own and followed by one resetting `MAILTO` to the global value, or to the `dokku` user when no global value is set, so the value only applies to that task. Its output is mailed to that address in addition to being appended to its `log-file`. Json entries and `;` delimited entries may be printed together. Older versions of Dokku do not pass `$CRON_ENTRY_FORMAT`, and fail to write the crontab if a json entry is printed, so a json entry should only be printed when the argument is `json`.
+- Invoked by: `dokku cron:list --global`, and when the `dokku` user crontab is written
+- Arguments: `$DOKKU_SCHEDULER $CRON_ENTRY_FORMAT`
 - Example:
 
 ```shell
@@ -684,8 +701,13 @@ set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 
 DOKKU_SCHEDULER="$1"
+CRON_ENTRY_FORMAT="$2"
 
-# TODO
+if [[ "$CRON_ENTRY_FORMAT" == "json" ]]; then
+  echo '{"schedule":"@daily","command":"/usr/local/bin/some-task","log-file":"/var/log/dokku/some-task.log","mailto":"ops@example.com"}'
+else
+  echo "@daily;/usr/local/bin/some-task;/var/log/dokku/some-task.log"
+fi
 ```
 
 ### `dependencies`
@@ -860,7 +882,7 @@ APP="$1"; IMAGE_SOURCE_TYPE="$2"
 
 ### `docker-args-process-deploy`
 
-- Description: emits docker arguments scoped to a specific Procfile process type. The `docker-options` plugin implements this trigger to surface options registered via `docker-options:add --process <PROC>`. `$PROC_TYPE` may be empty (or set to the magic `_default_` value) to signify default-scope docker deploy options.
+- Description: emits docker arguments scoped to a specific Procfile process type. The `docker-options` plugin implements this trigger to surface options registered via `docker-options:add --process <PROC>`, and the `storage` plugin implements it to emit the `-v` flags for mounts made with `storage:mount --process-type <PROC>`. `$PROC_TYPE` may be empty (or set to the magic `_default_` value) to signify default-scope docker deploy options. Note that the two plugins split the work differently: `docker-options` emits only its process-specific scope here and its default scope through `docker-args-deploy`, while `storage` emits both scopes here and does not implement `docker-args-deploy` at all. A handler that exits non-zero aborts the deploy, including the ephemeral containers that run `app.json` deploy tasks, so a handler that has nothing to contribute for an app should emit nothing and exit zero rather than fail.
 - Invoked by: `dokku deploy`
 - Arguments: `$APP $IMAGE_SOURCE_TYPE $IMAGE_TAG [$PROC_TYPE $CONTAINER_INDEX]`
 - Example:
@@ -1331,6 +1353,7 @@ set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 - Invoked by: `nginx-vhosts#build-config`
 - Arguments: `$APP $TEMPLATE_TYPE`
     - The `TEMPLATE_TYPE` argument can be one of: `[app-config, hsts-config, validate-config]`
+    - The `validate-config` template can make use of the following variables: `$.NGINX_CONF $.NGINX_USER`
 - Example:
 
 ```shell
@@ -2349,6 +2372,24 @@ set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 # TODO
 ```
 
+### `proxy-routes-list`
+
+- Description: Emits one `process|port|path|strip` line per path-based route declared via `proxy:route:set`, sorted by descending path length. Backends use this to render path-based routes in their config or container labels.
+- Invoked by: `nginx-vhosts`, `traefik-vhosts`, `caddy-vhosts`, `scheduler-k3s`
+- Arguments: `$APP`
+- Example:
+
+```shell
+#!/usr/bin/env bash
+
+set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
+
+APP="$1"
+while IFS='|' read -r proc port path strip; do
+  echo "Route ${path} -> ${proc}:${port} (strip=${strip})"
+done < <(plugn trigger proxy-routes-list "$APP")
+```
+
 ### `proxy-type`
 
 - Description: Returns the proxy type for an app
@@ -2396,7 +2437,7 @@ set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 
 ### `ps-set-scale`
 
-- Description: Sets the scale for an app based on a specified formation (process-type=quantity). Any unspecified process types will be left as is.
+- Description: Sets the scale for an app based on a specified formation (process-type=quantity). Any unspecified process types will be left as is, or have their process count set to zero when `$CLEAR_EXISTING` is `true`. Each process tuple must name a process type, and process counts must be zero or greater.
 - Invoked by:
 - Arguments: `$APP $SKIP_DEPLOY $CLEAR_EXISTING [$PROCESS_TUPLE...]`
 - Example:
@@ -2467,6 +2508,22 @@ APP="$1";
 # TODO
 ```
 
+### `repo-purge-cache`
+
+- Description: Deletes the contents of the build cache stored in the repository for an app
+- Invoked by: `builder-herokuish` when rebuilding with `ps:rebuild --no-cache`
+- Arguments: `$APP`
+- Example:
+
+```shell
+#!/usr/bin/env bash
+
+set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
+APP="$1";
+
+# TODO
+```
+
 ### `report`
 
 - Description: Allows you to report on any custom configuration in use by your application
diff --git a/docs/development/release-process.md b/docs/development/release-process.md
index d79c28639..f09d3c618 100644
--- a/docs/development/release-process.md
+++ b/docs/development/release-process.md
@@ -29,7 +29,7 @@ The workflow looks like this:
 ```shell
 # having dokku-arch in ../dokku-arch
 vagrant up build-arch
-# wait for "==> build-arch: ==> Finished making: dokku 0.38.27-2 (Mon Feb 22 23:20:37 CET 2016)"
+# wait for "==> build-arch: ==> Finished making: dokku 0.38.34-2 (Mon Feb 22 23:20:37 CET 2016)"
 cd ../dokku-arch
 git add PKGBUILD .SRCINFO
 git commit -m 'Update to dokku 0.9.9'
diff --git a/docs/development/testing.md b/docs/development/testing.md
index 1daaca2be..9d9bb76ec 100644
--- a/docs/development/testing.md
+++ b/docs/development/testing.md
@@ -13,7 +13,7 @@ All pull requests have tests run against them on [GitHub Actions](https://github
 
 If you wish to skip tests for a particular commit, e.g. documentation changes, you may add the `[ci skip]` designator to your commit message. Commits that _should_ be tested but have the above designator will not be merged.
 
-While we do provide official packages for a variety of platforms, as our test suite currently runs on Ubuntu Noble 24.04, we only provide official installation support for that platform and the supported LTS releases of Ubuntu (currently 22.04, and 24.04).
+While we do provide official packages for a variety of platforms, as our test suite currently runs on Ubuntu Noble 24.04, we only provide official installation support for that platform and the supported LTS releases of Ubuntu (currently 22.04, 24.04, and 26.04).
 
 ## Local Test Execution
 
diff --git a/docs/getting-started/advanced-installation.md b/docs/getting-started/advanced-installation.md
index 36e83f685..34ebcf986 100644
--- a/docs/getting-started/advanced-installation.md
+++ b/docs/getting-started/advanced-installation.md
@@ -36,6 +36,12 @@ cd dokku
 sudo make install
 ```
 
+The `Makefile` installs dependencies and builds plugins for the architecture of the host it runs on. The `TARGETARCH` environment variable overrides the architecture used for both the downloaded dependencies and the plugin builds, while the `GOARCH` environment variable overrides the architecture used for the plugin builds only. Example:
+
+```shell
+sudo TARGETARCH=arm64 make install
+```
+
 The `Makefile` allows source URLs to be overridden to include customizations from your own repositories. The `DOCKER_URL`, `PLUGN_URL`, `SSHCOMMAND_URL` and `STACK_URL` environment variables may be set to override the defaults (see the `Makefile` for how these apply). Example:
 
 ```shell
@@ -52,6 +58,31 @@ chmod +x bootstrap.sh
 sudo DOKKU_REPO=https://github.com/yourusername/dokku.git DOKKU_BRANCH=master ./bootstrap.sh
 ```
 
+## Bootstrap script output and logs
+
+When run from a terminal, the bootstrap script shows each install step with a spinner and the last few lines of output from the running step. When the output is not a terminal - such as in CI, Vagrant, or when piping to a file - it prints one line when each step starts and one when it finishes.
+
+All command output is written to a log file at `/var/log/dokku/install-<timestamp>.log`, with a timestamp on every line. If a step fails, the full output of the failed step is printed along with the path to the full log.
+
+The following environment variables change the output:
+
+- `DOKKU_VERBOSE=1`: Stream the full output of every command instead of the condensed view.
+- `TRACE=1`: Same as `DOKKU_VERBOSE=1`, and also enables `set -x`.
+- `NO_COLOR=1`: Disable colors.
+
+```shell
+sudo DOKKU_TAG=v0.38.32 DOKKU_VERBOSE=1 bash bootstrap.sh
+```
+
+## Automatic configuration by the bootstrap script
+
+After installing, the bootstrap script fills in configuration that is still missing:
+
+- SSH keys: If no SSH keys have been added to Dokku, `DOKKU_SKIP_KEY_FILE` is not `true`, and `/root/.ssh/authorized_keys` contains keys, each key is added via `dokku ssh-keys:add`. The first key is named `admin`, and any others are named `admin-2`, `admin-3`, and so on.
+- Global domain: If no global domain is set, it is set to the server's primary IPv4 address via `dokku domains:set-global`. On a server behind NAT, this is the private address.
+
+Anything already configured - for example via the `DOKKU_KEY_FILE` or `DOKKU_HOSTNAME` debconf settings - is left as is. The summary at the end of the install shows what was configured, along with the commands to configure anything that was not.
+
 ## Custom Herokuish build
 
 Dokku ships with a pre-built version of the [Herokuish](https://github.com/gliderlabs/herokuish) component by default. If you want to build your own version you can specify that with an environment variable.
@@ -97,6 +128,7 @@ free
 
 echo "/var/swap.img    none    swap    sw    0    0" >> /etc/fstab
 ```
+
 Note: it may be necessary to call swapoff, mkswap and swapon explicitly: `sudo /sbin/swapoff /var/swap.img`, etc.
 
 [Reference](https://www.digitalocean.com/community/tutorials/how-to-configure-virtual-memory-swap-file-on-a-vps)
diff --git a/docs/getting-started/install/debian.md b/docs/getting-started/install/debian.md
index 72224c38c..189251277 100644
--- a/docs/getting-started/install/debian.md
+++ b/docs/getting-started/install/debian.md
@@ -37,4 +37,14 @@ After setting the desired options, proceed with the installation as described ab
 | dokku/hostname     | string  | dokku.me              | Hostname, used as vhost domain and for showing app URL after deploy      |
 | dokku/skip_key_file| boolean | false                 | Don't check for the existence of the dokku/key_file. Warning: Setting this to true, will require you to manually add an SSH key later on. |
 | dokku/key_file     | string  | /root/.ssh/id_rsa.pub | Path on disk to an SSH key to add to the Dokku user (Will be ignored on `dpkg-reconfigure`) |
-| dokku/nginx_enable | boolean | true                  | Enable nginx-vhosts plugin |
+| dokku/nginx_enable | boolean | true                  | Enable nginx-vhosts plugin. When `false`, the plugin is installed but left disabled, and the `nginx:*` commands are unavailable. |
+| dokku/install_default_site | boolean | true          | Install a catch-all nginx default site on fresh install |
+
+### Enabling the nginx-vhosts plugin after installation
+
+If Dokku was installed with `dokku/nginx_enable` set to `false`, the nginx-vhosts plugin can be enabled later. The `plugin:install --core` call runs the plugin's install trigger, which sets up the nginx configuration required by Dokku.
+
+```shell
+sudo dokku plugin:enable nginx-vhosts
+sudo dokku plugin:install --core
+```
diff --git a/docs/getting-started/install/docker.md b/docs/getting-started/install/docker.md
index e14013934..e79a841d7 100644
--- a/docs/getting-started/install/docker.md
+++ b/docs/getting-started/install/docker.md
@@ -3,7 +3,7 @@
 Pull the dokku/dokku image:
 
 ```shell
-docker pull dokku/dokku:0.38.27
+docker pull dokku/dokku:0.38.34
 ```
 
 Next, run the image.
@@ -19,7 +19,7 @@ docker container run -d \
   --publish 8443:443 \
   --volume /var/lib/dokku:/mnt/dokku \
   --volume /var/run/docker.sock:/var/run/docker.sock \
-  dokku/dokku:0.38.27
+  dokku/dokku:0.38.34
 ```
 
 Alternatively, you can use `docker-compose.yml`:
@@ -27,7 +27,7 @@ Alternatively, you can use `docker-compose.yml`:
 ```yaml
 services:
   dokku:
-    image: dokku/dokku:0.38.27
+    image: dokku/dokku:0.38.34
     container_name: dokku
     network_mode: bridge
     ports:
@@ -67,7 +67,7 @@ Compose dependents can gate on the healthcheck via `depends_on` with `condition:
 ```yaml
 services:
   dokku:
-    image: dokku/dokku:0.38.27
+    image: dokku/dokku:0.38.34
     # ...
   bootstrap:
     image: alpine:3.20
@@ -87,8 +87,10 @@ Dokku is run in the following configuration:
 - Data within the container is stored on the host within the `/var/lib/dokku` directory.
 - Image build cache is set to the data dir + `/home/dokku`.
 - The docker socket is mounted into container.
+- `DOKKU_HOST_ROOT` and `DOKKU_LIB_HOST_ROOT` tell Dokku how the host Docker daemon sees those same trees when creating bind mounts (app repos and plugin data such as named storage).
+- `coredns-docker` (a CoreDNS plugin that serves DNS records for sibling Docker containers) is installed transitively via the dokku deb's `Depends:`, runs under runit on `127.0.0.1:1053` inside the container, and is what the `nginx-vhosts` `dns-resolver` property can point at to enable `<app>.<process-type>.docker` upstream resolution - see the [nginx proxy doc](/docs/networking/proxies/nginx.md#upstream-resolution-via-coredns-docker) for the operator-facing behavior.
 
-Application repositories, plugin config, as well as plugin data are persisted to disk within the specified host directory for `/var/lib/dokku`.
+Application repositories, plugin config, as well as plugin data are persisted to disk within the specified host directory for `/var/lib/dokku`. `DOKKU_LIB_HOST_ROOT` must point at that host path's `var/lib/dokku` subtree so Docker `-v` mounts resolve under the data volume rather than under the host's own `/var/lib/dokku`.
 
 Other docker container options can also be used when running Dokku, though the specific outcome will depend upon the specified options. For example, the Dokku container's nginx port can be bound to a specific host ip by specifying `--publish $HOST_IP:8080:80`, where `$HOST_IP` is the IP desired. Please see the [docker container run documentation](https://docs.docker.com/engine/reference/commandline/run/) for further explanation for various docker arguments.
 
@@ -114,7 +116,7 @@ redis: https://github.com/dokku/dokku-redis.git
 The alternative is to build a custom docker image via a custom Dockerfile. This Dockerfile can run any `plugin:install` command, though the `install` trigger must be skipped via the `--skip-install-trigger`. The version installed at that time will be the one that persists. Below is an example Dockerfile showing this method.
 
 ```Dockerfile
-FROM dokku/dokku:0.38.27
+FROM dokku/dokku:0.38.34
 RUN dokku plugin:install https://github.com/dokku/dokku-postgres.git --skip-install-trigger
 RUN dokku plugin:install https://github.com/dokku/dokku-redis.git --skip-install-trigger
 ```
diff --git a/docs/getting-started/installation/index.md b/docs/getting-started/installation/index.md
index 802e65e12..177b1556a 100644
--- a/docs/getting-started/installation/index.md
+++ b/docs/getting-started/installation/index.md
@@ -8,7 +8,7 @@ Dokku is an extensible, open source Platform as a Service that runs on a single
 
 To start using Dokku, you'll need a system that meets the following minimum requirements:
 
-- Operating Systems: [Ubuntu 22.04/24.04](https://www.ubuntu.com/download) or [Debian 11+ x64](https://www.debian.org/distrib/)
+- Operating Systems: [Ubuntu 22.04/24.04/26.04](https://www.ubuntu.com/download) or [Debian 11+ x64](https://www.debian.org/distrib/)
 - Supported Architectures: `AMD64` (`x86_64`) and `arm64` (`armv8`)
 - Minimum Memory:
     - Docker Scheduler: 1GB of system memory, or [add swap memory](/docs/getting-started/advanced-installation.md#vms-with-less-than-1-gb-of-memory)
@@ -23,7 +23,7 @@ Please see the [dns documentation](/docs/networking/dns.md) and [domains documen
 
 ## Installing the latest stable version
 
-This is the simple method of installing Dokku. For alternative methods of installation, see the [advanced install guide](/docs/getting-started/advanced-installation.md#configuring).
+This is the simple method of installing Dokku. For alternative methods of installation, see the [advanced install guide](/docs/getting-started/advanced-installation.md#installing-via-other-methods).
 
 ### 1. Install Dokku
 
@@ -31,15 +31,17 @@ To install the latest stable version of Dokku, you can run the following shell c
 
 ```shell
 # for debian systems, installs Dokku via apt-get
-wget -NP . https://dokku.com/install/v0.38.27/bootstrap.sh
-sudo DOKKU_TAG=v0.38.27 bash bootstrap.sh
+wget -NP . https://dokku.com/install/v0.38.34/bootstrap.sh
+sudo DOKKU_TAG=v0.38.34 bash bootstrap.sh
 ```
 
 The installation process takes about 5-10 minutes, depending upon internet connection speed.
 
 ### 2. Setup SSH key and Virtualhost Settings
 
-Once the installation is complete, you should configure an ssh key and set your global domain.
+The bootstrap script adds the keys in root's `~/.ssh/authorized_keys` and sets the server's IP as the global domain when those are not already configured. The summary at the end of the install shows what was set. See the [advanced installation documentation](/docs/getting-started/advanced-installation.md#automatic-configuration-by-the-bootstrap-script) for details.
+
+Otherwise, once the installation is complete, you should configure an ssh key and set your global domain.
 
 ```shell
 # usually your key is already available under the current user's `~/.ssh/authorized_keys` file
diff --git a/docs/getting-started/troubleshooting.md b/docs/getting-started/troubleshooting.md
index e95c1ebbc..8bd5fb7a3 100644
--- a/docs/getting-started/troubleshooting.md
+++ b/docs/getting-started/troubleshooting.md
@@ -226,22 +226,20 @@ sudo ufw disable
 
 ### I can't connect to my application because the server is sending an invalid response, or can't provide a secure connection
 
-This is normally a config problem with your app, rather than an issue with Dokku. 
+This is normally a config problem with your app, rather than an issue with Dokku.
 
 One common cause is an application configured to enforce secure connections/HSTS, but SSL is not set up. In Ruby on Rails, if your `application.rb` or `config/environments/production.rb` include the line `configure.force_ssl = true`, try commenting that line out and redeploying. If this solves the issue temporarily, longer-term you should consider [configuring SSL](/docs/configuration/ssl.md).
 
-
 ### I deployed a new application, but an existing application is being served when I visit it
 
 This problem has the same cause as the previous issue: your application is attempting to enforce SSL, but SSL is not configured. Disabling SSL enforcement should solve the problem.
 
-The underlying cause is best understood with an example. Let's say you already have `https://apples.example.com/` working, and you're trying to deploy `bananas.example.com/`. But whenever you visit `bananas.example.com` you see `apples.example.com` instead. This is caused by `bananas.example.com` forcing SSL: 
+The underlying cause is best understood with an example. Let's say you already have `https://apples.example.com/` working, and you're trying to deploy `bananas.example.com/`. But whenever you visit `bananas.example.com` you see `apples.example.com` instead. This is caused by `bananas.example.com` forcing SSL:
 
 1. Your browser sends a request to `http://bananas.example.com`.
 1. `bananas.example.com` issues a redirect to `https://bananas.example.com`.
 1. Your browser sends a request to `https://bananas.example.com`. But you haven't configured SSL for `bananas.example.com` yet! So this request ends up routed to `https://apples.example.com`, which _does_ have an SSL config.
 
-
 ### My application deploys properly, but won't load in browser "connection refused"
 
 This could be a result of a bad proxy configuration (`http:5000:5000` may be incorrect). Run `dokku ports:report node-js-app` to check if your app has the correct proxy configuration. It should show something like the following.
diff --git a/docs/getting-started/where-to-get-help.md b/docs/getting-started/where-to-get-help.md
index 5edd1c372..907330d93 100644
--- a/docs/getting-started/where-to-get-help.md
+++ b/docs/getting-started/where-to-get-help.md
@@ -4,7 +4,7 @@ If you’re stuck, there are a number of places you can get help:
 
 ## The Official Dokku Website
 
-- [https://dokku.com/docs/getting-started/installation/](/docs/getting-started/installation/)
+- [https://dokku.com/docs/getting-started/installation/](/docs/getting-started/installation/index.md)
 
 The Official Dokku website is always a great place to visit. It features links to oft-used developer tools, community plugins, and guides on using Dokku.
 
diff --git a/docs/home.html b/docs/home.html
index 4924cd5e1..b4d73ea6d 100644
--- a/docs/home.html
+++ b/docs/home.html
@@ -10,26 +10,26 @@
     <meta name="author" content="">
     <title>Dokku - The smallest PaaS implementation you've ever seen</title>
 
-    <link rel="apple-touch-icon" sizes="57x57" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-57x57.png">
-    <link rel="apple-touch-icon" sizes="60x60" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-60x60.png">
-    <link rel="apple-touch-icon" sizes="72x72" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-72x72.png">
-    <link rel="apple-touch-icon" sizes="76x76" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-76x76.png">
-    <link rel="apple-touch-icon" sizes="114x114" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-114x114.png">
-    <link rel="apple-touch-icon" sizes="120x120" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-120x120.png">
-    <link rel="apple-touch-icon" sizes="144x144" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-144x144.png">
-    <link rel="apple-touch-icon" sizes="152x152" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-152x152.png">
-    <link rel="apple-touch-icon" sizes="180x180" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-180x180.png">
-    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/favicon-32x32.png" sizes="32x32">
-    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/android-chrome-192x192.png" sizes="192x192">
-    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/favicon-96x96.png" sizes="96x96">
-    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/favicon-16x16.png" sizes="16x16">
-    <link rel="manifest" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/manifest.json">
-    <link rel="shortcut icon" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/favicon.ico">
+    <link rel="apple-touch-icon" sizes="57x57" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/apple-touch-icon-57x57.png">
+    <link rel="apple-touch-icon" sizes="60x60" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/apple-touch-icon-60x60.png">
+    <link rel="apple-touch-icon" sizes="72x72" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/apple-touch-icon-72x72.png">
+    <link rel="apple-touch-icon" sizes="76x76" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/apple-touch-icon-76x76.png">
+    <link rel="apple-touch-icon" sizes="114x114" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/apple-touch-icon-114x114.png">
+    <link rel="apple-touch-icon" sizes="120x120" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/apple-touch-icon-120x120.png">
+    <link rel="apple-touch-icon" sizes="144x144" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/apple-touch-icon-144x144.png">
+    <link rel="apple-touch-icon" sizes="152x152" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/apple-touch-icon-152x152.png">
+    <link rel="apple-touch-icon" sizes="180x180" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/apple-touch-icon-180x180.png">
+    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/favicon-32x32.png" sizes="32x32">
+    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/android-chrome-192x192.png" sizes="192x192">
+    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/favicon-96x96.png" sizes="96x96">
+    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/favicon-16x16.png" sizes="16x16">
+    <link rel="manifest" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/manifest.json">
+    <link rel="shortcut icon" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/favicon.ico">
     <meta name="apple-mobile-web-app-title" content="Dokku">
     <meta name="application-name" content="Dokku">
     <meta name="msapplication-TileColor" content="#da532c">
-    <meta name="msapplication-TileImage" content="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/mstile-144x144.png">
-    <meta name="msapplication-config" content="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/browserconfig.xml">
+    <meta name="msapplication-TileImage" content="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/mstile-144x144.png">
+    <meta name="msapplication-config" content="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/browserconfig.xml">
     <meta name="theme-color" content="#ffffff">
 
     <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.2.0-beta1/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-0evHe/X+R7YkIZDRvuzKMRqM+OrBnVFBL6DOitfPri4tjfHxaWutUpFmBp4vmVor" crossorigin="anonymous">
@@ -38,7 +38,7 @@
     <link rel="preconnect" href="https://fonts.googleapis.com">
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link href="https://fonts.googleapis.com/css2?family=Lato:wght@400;700;900&display=swap" rel="stylesheet">
-    <link href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/style.css" rel="stylesheet">
+    <link href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/style.css" rel="stylesheet">
     <!-- <link href="./assets/style.css" rel="stylesheet"> -->
 </head>
 
@@ -98,7 +98,7 @@
         <main class="container px-4 px-lg-5">
             <div class="row">
                 <div class="col-lg-7">
-                    <a class="badge-link" href="https://github.com/dokku/dokku/releases"><span class="badge py-2 d-flex fit-content"><div class="circle align-self-center me-2"></div>Latest release <span id="releaseVersion" class="ms-1">v0.38.27</span></span></a>
+                    <a class="badge-link" href="https://github.com/dokku/dokku/releases"><span class="badge py-2 d-flex fit-content"><div class="circle align-self-center me-2"></div>Latest release <span id="releaseVersion" class="ms-1">v0.38.34</span></span></a>
                     <h1 class="text-white hero-heading mt-5">An open source PAAS alternative to Heroku.</h1>
                     <h4 class="text-white mt-5">Dokku helps you build and manage the lifecycle of applications from building to scaling.</h4>
                     <div class="d-flex mt-5">
@@ -125,7 +125,7 @@
                             </p>
                             <p class="line">
                                 <span class="prompt">$</span>
-                                <span class="command">sudo DOKKU_TAG=v0.38.27 bash bootstrap.sh</span>
+                                <span class="command">sudo DOKKU_TAG=v0.38.34 bash bootstrap.sh</span>
                             </p>
                             <br>
 
diff --git a/docs/networking/network.md b/docs/networking/network.md
index aba7edf78..fa9cf84e4 100644
--- a/docs/networking/network.md
+++ b/docs/networking/network.md
@@ -534,7 +534,7 @@ dokku network:report node-js-app --network-bind-all-interfaces
 > The `Report flags` column lists the CLI argument names accepted by `network:report`. The JSON keys emitted by `network:report --format json` are the same names with the leading `--network-` stripped (e.g. `attach-post-create`, `global-attach-post-create`, `computed-attach-post-create`). Legacy keys with the `network-` prefix (e.g. `network-attach-post-create`) are also emitted during the 0.38.x deprecation window and will be removed in a future major release.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `attach-post-create` | app + global | none | `--network-attach-post-create`, `--network-global-attach-post-create`, `--network-computed-attach-post-create` | Networks attached to a container immediately after creation, before the deploy phase |
 | `attach-post-deploy` | app + global | none | `--network-attach-post-deploy`, `--network-global-attach-post-deploy`, `--network-computed-attach-post-deploy` | Networks attached to a container after it passes healthchecks |
 | `bind-all-interfaces` | app + global | `false` | `--network-bind-all-interfaces`, `--network-global-bind-all-interfaces`, `--network-computed-bind-all-interfaces` | When `true`, binds containers to `0.0.0.0` instead of the default Docker network address |
diff --git a/docs/networking/port-management.md b/docs/networking/port-management.md
index bdd179677..4a64633db 100644
--- a/docs/networking/port-management.md
+++ b/docs/networking/port-management.md
@@ -272,7 +272,7 @@ dokku ports:report node-js-app --ports-map-detected-json | jq '.[0].container_po
 The following flags surface configured port mappings managed by `ports:set` / `ports:add` / `ports:remove` / `ports:clear`:
 
 | Flag | Description |
-|---|---|
+| --- | --- |
 | `--ports-map` | Configured port mappings as space-separated `scheme:host-port:container-port` values |
 | `--ports-map-json` | Configured port mappings as a JSON array of `{scheme, host_port, container_port}` objects |
 
@@ -281,6 +281,6 @@ The following flags surface configured port mappings managed by `ports:set` / `p
 The following flags surface in `ports:report` but are not managed by `ports:set` - they are derived from the deploy:
 
 | Flag | Description |
-|---|---|
+| --- | --- |
 | `--ports-map-detected` | Port mapping inferred from `EXPOSE` directives or the running container |
 | `--ports-map-detected-json` | Detected port mappings as a JSON array of `{scheme, host_port, container_port}` objects |
diff --git a/docs/networking/proxies/caddy.md b/docs/networking/proxies/caddy.md
index e126dd7d8..0a5f2243a 100644
--- a/docs/networking/proxies/caddy.md
+++ b/docs/networking/proxies/caddy.md
@@ -32,7 +32,55 @@ The Caddy plugin has specific rules for routing requests:
 - If no `http:80` mapping is found, the first `http` port mapping is used for http requests.
 - If no `https:443` mapping is found, the first `https` port mapping is used for https requests.
 - If no `https` mapping is found, the container port from `http:80` will be used for https requests.
-- Requests are routed as soon as the container is running and passing healthchecks.
+- Requests are routed as soon as the container is running, before Dokku's healthchecks have passed. See the [healthchecks](#healthchecks) section for how Caddy avoids routing to containers that are not yet ready.
+
+### Healthchecks
+
+When an app has a readiness healthcheck defined in its `app.json` file with a `path` property, Dokku automatically generates Caddy healthcheck and retry labels. These configure Caddy to periodically check each container, stop routing traffic to containers that fail the check, and retry requests that fail to connect against another container.
+
+The following `app.json` healthcheck properties are mapped to Caddy labels:
+
+| app.json Property | Caddy Label | Description |
+|-------------------|-------------|-------------|
+| `path`            | `caddy.reverse_proxy.health_uri`      | The HTTP path to check (required) |
+| `port`            | `caddy.reverse_proxy.health_port`     | The port to check |
+| `timeout`         | `caddy.reverse_proxy.health_timeout`  | Timeout in seconds (formatted as `Xs`, defaults to `5s`) |
+| `wait`            | `caddy.reverse_proxy.health_interval` | Interval between checks in seconds (formatted as `Xs`, defaults to `5s`) |
+| `attempts`        | `caddy.reverse_proxy.health_fails`    | Number of successive failed checks before a container is taken out of rotation (defaults to `3`) |
+| `httpHeaders`     | `caddy.reverse_proxy.health_headers.<name>` | Headers to send with the check |
+
+Additionally, the following labels are generated:
+
+| Caddy Label | Value | Description |
+|-------------|-------|-------------|
+| `caddy.reverse_proxy.health_headers.Host` | the first app domain | The `Host` header sent with the healthcheck, matching the header Dokku sends during deploy checks. A `Host` header in `httpHeaders` takes precedence |
+| `caddy.reverse_proxy.lb_try_duration` | `5s` | How long a request that fails to connect is retried against other containers |
+| `caddy.reverse_proxy.lb_try_interval` | `250ms` | How long to wait between retries |
+
+Example `app.json` configuration:
+
+```json
+{
+  "healthchecks": {
+    "web": [
+      {
+        "name": "web readiness check",
+        "path": "/health",
+        "timeout": 5,
+        "type": "readiness",
+        "wait": 10
+      }
+    ]
+  }
+}
+```
+
+Caddy considers a new container healthy until its first check fails. The first check runs as soon as Caddy picks up the new container, and requests that reach the container before then and fail to connect are retried against the still-running old container.
+
+Headers with values containing quotes, backslashes, or control characters are skipped, as are headers whose names contain a `.` or end in an `_<number>` suffix, as these cannot be represented as Caddy labels. The `scheme` property is not mapped, as Caddy uses the same transport for healthchecks as for proxied requests. Any of the generated labels may be overridden via the `caddy:labels:add` command.
+
+> [!NOTE]
+> Only the first readiness healthcheck with a `path` property is used. Apps without one are routed as soon as the container is running. See the [zero downtime deploys documentation](/docs/deployment/zero-downtime-deploys.md#healthchecks-and-label-based-proxies) for more information.
 
 ### Switching to Caddy
 
@@ -197,6 +245,8 @@ To switch to Caddy's internal TLS server for certificate provisioning, set the `
 dokku caddy:set node-js-app tls-internal true
 ```
 
+As Caddy only serves https when the `letsencrypt-email` property is set, the internal TLS server is only used for apps when that property is also set. Apps will need to be rebuilt after changing this property.
+
 The default value may also be configured globally with the `--global` flag. Per-app values take precedence over the global value when set.
 
 ```shell
@@ -271,7 +321,7 @@ dokku caddy:report node-js-app --caddy-computed-image
 ### Settable properties
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `image` | global only | _parsed from `plugins/caddy-vhosts/Dockerfile`_ | `--caddy-global-image`, `--caddy-computed-image` | Docker image used to run the Caddy container |
 | `letsencrypt-email` | global only | none | `--caddy-global-letsencrypt-email`, `--caddy-computed-letsencrypt-email` | Contact email enabling letsencrypt; empty disables https issuance |
 | `letsencrypt-server` | global only | `https://acme-v02.api.letsencrypt.org/directory` | `--caddy-global-letsencrypt-server`, `--caddy-computed-letsencrypt-server` | ACME directory used when requesting certificates |
diff --git a/docs/networking/proxies/haproxy.md b/docs/networking/proxies/haproxy.md
index 4f393ca18..93afa317f 100644
--- a/docs/networking/proxies/haproxy.md
+++ b/docs/networking/proxies/haproxy.md
@@ -28,7 +28,7 @@ The Haproxy plugin has specific rules for routing requests:
 - Haproxy integration is exposed via docker labels attached to containers. Changes in labels require either app deploys or rebuilds.
 - While Haproxy will respect labels associated with other containers, only `web` containers have Haproxy labels injected by the plugin.
 - Only `http:80` and `https:443` port mappings are supported at this time.
-- Requests are routed as soon as the container is running and passing healthchecks.
+- Requests are routed as soon as the container is running, before Dokku's healthchecks have passed. Haproxy does not support healthcheck configuration via container labels, so `app.json` healthchecks are not used for routing.
 
 ### Switching to Haproxy
 
@@ -185,6 +185,8 @@ dokku haproxy:set --global letsencrypt-email automated@dokku.sh
 
 After enabling, the Haproxy container will need to be restarted and apps will need to be rebuilt. All http requests will then be redirected to https.
 
+Certificates are requested over http-01 on port 80, so each domain must resolve to the server. They are kept in `/var/lib/dokku/data/haproxy` and renewed automatically.
+
 #### Customizing the letsencrypt server
 
 The letsencrypt integration is set to the production letsencrypt server by default. To change this, set the `letsencrypt-server` property with the `--global` flag:
@@ -252,7 +254,7 @@ dokku haproxy:report node-js-app --haproxy-computed-image
 All haproxy properties are global only. Set with `haproxy:set --global <property> <value>`.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `image` | global only | _parsed from `plugins/haproxy-vhosts/Dockerfile`_ | `--haproxy-global-image`, `--haproxy-computed-image` | Docker image used to run the Haproxy container |
 | `letsencrypt-email` | global only | none | `--haproxy-global-letsencrypt-email`, `--haproxy-computed-letsencrypt-email` | Contact email enabling letsencrypt; empty disables https issuance |
 | `letsencrypt-server` | global only | `https://acme-v02.api.letsencrypt.org/directory` | `--haproxy-global-letsencrypt-server`, `--haproxy-computed-letsencrypt-server` | ACME directory used when requesting certificates |
diff --git a/docs/networking/proxies/nginx.md b/docs/networking/proxies/nginx.md
index 70843947f..c4530c31e 100644
--- a/docs/networking/proxies/nginx.md
+++ b/docs/networking/proxies/nginx.md
@@ -28,6 +28,42 @@ Nginx will proxy the requests in a [round-robin balancing fashion](http://nginx.
 > [!NOTE]
 > Due to how the plugin is implemented, if an app successfully starts up `web` containers but fails to deploy some other containers, nginx may eventually stop routing requests. Users should revert their code in these cases, or manually trigger `dokku proxy:build-config $APP` in order to ensure requests route to the new web containers.
 
+### Upstream Resolution via coredns-docker
+
+> [!IMPORTANT]
+> New as of 0.39.0
+
+Dokku can resolve nginx upstreams through [coredns-docker](https://github.com/dokku/coredns-docker), a CoreDNS plugin that watches the Docker daemon and serves fresh `A` records keyed off container labels. When enabled, the nginx `resolver` directive points at coredns-docker's local socket (`127.0.0.1:1053`) and the rendered upstream is a variable-based `proxy_pass`, which forces nginx to re-resolve at request time honoring DNS TTL. This is how nginx avoids serving the wrong vhost after a host reboot, after `apt upgrade docker`, or after a single container restarts mid-runtime: the on-disk nginx config no longer pins a stale IP. This behavior is opt-in, and nginx uses IP-based `upstream` blocks by default.
+
+`coredns-docker` (>= `0.8.0`) is installed automatically as a transitive `Depends:` of the `dokku` Debian package, so `apt install dokku` and `apt upgrade dokku` pull it in without operator action. The shipped `/etc/coredns/Corefile` already binds `127.0.0.1:1053`, serves the `docker.` zone, and synthesizes `<app>.<process-type>.docker` and `<app>.docker` `A` records from Dokku's existing `com.dokku.app-name` and `com.dokku.process-type` container labels. Multiple containers for the same process type collapse onto one multi-A record set, so scaled apps load-balance across instances via DNS without any per-container configuration. The bundled Docker image of Dokku ships coredns-docker preinstalled and runs it under runit on the same port.
+
+No `systemd-resolved` or `/etc/resolv.conf` change is required - nginx talks to `coredns-docker` directly via the `resolver` directive in each app's `nginx.conf`.
+
+To enable resolver-based upstreams:
+
+```shell
+dokku nginx:set --global dns-resolver 127.0.0.1:1053
+dokku proxy:build-config --all
+```
+
+To revert to the IP-based upstream block, unset the property and rebuild the config:
+
+```shell
+dokku nginx:set --global dns-resolver
+dokku proxy:build-config --all
+```
+
+The behavior is controlled by three nginx properties, each settable per app or globally:
+
+- `dns-resolver` (default: none) - the resolver address nginx talks to. Resolver-based upstreams are only rendered when this is set.
+- `dns-resolver-timeout` (default: `5s`) - how long nginx waits for a DNS response before giving up and returning 502. The default is short so requests fail fast when coredns-docker is unreachable rather than hanging on the nginx built-in default (30s).
+- `dns-zone` (default: `docker`) - the suffix appended to `<app>.<process-type>` when constructing the upstream hostname.
+
+> [!NOTE]
+> When `dns-resolver` is set, no `upstream` block is rendered for the `web` process, so `proxy-keepalive` has no effect on it. Upstreams for [proxy routes](/docs/networking/proxy-management.md#path-based-routing-to-non-web-processes) to other process types remain IP-based.
+
+See [the `nginx.conf.sigil` reference](/docs/appendices/file-formats/nginx-conf-sigil.md) for the sigil variables that drive the resolver-based render, and how vendored templates can adopt or skip it.
+
 ### Nginx Configuration for Undeployed Apps
 
 > [!IMPORTANT]
@@ -123,6 +159,8 @@ App-supplied `nginx.conf.sigil` files are pre-validated automatically at the sta
 
 The wrapper config used for validation does not include the top-level `load_module` directives from the global nginx config, so a `nginx.conf.sigil` that relies on a directive from a dynamically loaded module will fail this validation even when `nginx -t` passes against the real server config. See [Custom nginx modules](/docs/appendices/file-formats/nginx-conf-sigil.md#custom-nginx-modules) for how to supply a custom validation wrapper via the `nginx-app-template-source` trigger's `validate-config` template type.
 
+The wrapper does declare the same `user` directive as the host's main nginx config, so that validating a template which declares a `proxy_cache_path` does not take the running server's cache directory away from the user its workers run as.
+
 It may also be desired to validate an nginx config outside of the deployment process. To do so, run the `nginx:validate-config` command. With no arguments, this will validate all app nginx configs, one at a time. A minimal wrapper nginx config is generated for each app's nginx config, upon which `nginx -t` will be run.
 
 ```shell
@@ -453,6 +491,8 @@ Changing these value globally or on a per-app basis will require rebuilding the
 | proxy-buffering           | `on`                                  | string  | Enables or disables buffering of responses from the proxied server                  |
 | proxy-buffers             | `8 8k`                                | string  | Number and size of the buffers used for reading the proxied server response, for a single connection |
 | proxy-busy-buffers-size   | `16k`                                 | string  | Limits the total size of buffers that can be busy sending a response to the client while the response is not yet fully read. |
+| proxy-http-version     | `1.1`                                 | string  | The HTTP version to use for establishing a connection to your backend server. Ensure that your backend server supports this.           |
+
 | proxy-connect-timeout     | `60s`                                 | string  | Timeout (with units) for establishing a connection to your backend server           |
 | proxy-keepalive           | empty (disabled)                      | integer | Number of idle keepalive connections to upstream servers (disabled by default)      |
 | proxy-read-timeout        | `60s`                                 | string  | Timeout (with units) for reading response from your backend server                  |
@@ -630,7 +670,7 @@ See the [proxy documentation](/docs/networking/proxy-management.md#regenerating-
 All nginx-vhosts properties are settable at both the app and global scope.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `access-log-format` | app + global | none | `--nginx-access-log-format`, `--nginx-global-access-log-format`, `--nginx-computed-access-log-format` | Custom nginx `log_format` directive used for the access log |
 | `access-log-path` | app + global | _`{nginx-log-root}/{app}-access.log`_ | `--nginx-access-log-path`, `--nginx-global-access-log-path`, `--nginx-computed-access-log-path` | Path inside the nginx container where access logs are written |
 | `bind-address-ipv4` | app + global | none | `--nginx-bind-address-ipv4`, `--nginx-global-bind-address-ipv4`, `--nginx-computed-bind-address-ipv4` | IPv4 address the nginx server block binds to |
@@ -639,6 +679,9 @@ All nginx-vhosts properties are settable at both the app and global scope.
 | `client-header-timeout` | app + global | `60s` | `--nginx-client-header-timeout`, `--nginx-global-client-header-timeout`, `--nginx-computed-client-header-timeout` | Time allowed to read the request header from the client |
 | `client-max-body-size` | app + global | `1m` | `--nginx-client-max-body-size`, `--nginx-global-client-max-body-size`, `--nginx-computed-client-max-body-size` | Maximum allowed request body size |
 | `disable-custom-config` | app + global | `false` | `--nginx-disable-custom-config`, `--nginx-global-disable-custom-config`, `--nginx-computed-disable-custom-config` | When `true`, ignores app-supplied `nginx.conf.d/*.conf` snippets |
+| `dns-resolver` | app + global | none | `--nginx-dns-resolver`, `--nginx-global-dns-resolver`, `--nginx-computed-dns-resolver` | Resolver address used for DNS-based upstreams. When unset, upstreams are IP-based |
+| `dns-resolver-timeout` | app + global | `5s` | `--nginx-dns-resolver-timeout`, `--nginx-global-dns-resolver-timeout`, `--nginx-computed-dns-resolver-timeout` | Time nginx waits for a DNS response from the resolver |
+| `dns-zone` | app + global | `docker` | `--nginx-dns-zone`, `--nginx-global-dns-zone`, `--nginx-computed-dns-zone` | Zone appended to `<app>.<process-type>` for DNS-based upstream hostnames |
 | `error-log-path` | app + global | _`{nginx-log-root}/{app}-error.log`_ | `--nginx-error-log-path`, `--nginx-global-error-log-path`, `--nginx-computed-error-log-path` | Path inside the nginx container where error logs are written |
 | `hsts` | app + global | `true` | `--nginx-hsts`, `--nginx-global-hsts`, `--nginx-computed-hsts` | When `true`, emits a `Strict-Transport-Security` header on HTTPS responses |
 | `hsts-include-subdomains` | app + global | `true` | `--nginx-hsts-include-subdomains`, `--nginx-global-hsts-include-subdomains`, `--nginx-computed-hsts-include-subdomains` | Adds the `includeSubDomains` directive to the HSTS header |
@@ -652,6 +695,7 @@ All nginx-vhosts properties are settable at both the app and global scope.
 | `proxy-buffering` | app + global | `on` | `--nginx-proxy-buffering`, `--nginx-global-proxy-buffering`, `--nginx-computed-proxy-buffering` | Whether nginx buffers upstream responses (`on` or `off`) |
 | `proxy-buffers` | app + global | _`8 {pagesize}`_ | `--nginx-proxy-buffers`, `--nginx-global-proxy-buffers`, `--nginx-computed-proxy-buffers` | Number and size of buffers used for an upstream response |
 | `proxy-busy-buffers-size` | app + global | _`2 * pagesize`_ | `--nginx-proxy-busy-buffers-size`, `--nginx-global-proxy-busy-buffers-size`, `--nginx-computed-proxy-busy-buffers-size` | Maximum buffer size that can be busy sending a response to the client |
+| `proxy-http-version` | app + global | `1.1` | `--nginx-proxy-http-version`, `--nginx-global-proxy-http-version`, `--nginx-computed-proxy-http-version` | HTTP version to use for a connection to the upstream |
 | `proxy-connect-timeout` | app + global | `60s` | `--nginx-proxy-connect-timeout`, `--nginx-global-proxy-connect-timeout`, `--nginx-computed-proxy-connect-timeout` | Time to establish a connection to the upstream |
 | `proxy-keepalive` | app + global | none | `--nginx-proxy-keepalive`, `--nginx-global-proxy-keepalive`, `--nginx-computed-proxy-keepalive` | Number of idle keep-alive connections to upstream servers held open per worker |
 | `proxy-read-timeout` | app + global | `60s` | `--nginx-proxy-read-timeout`, `--nginx-global-proxy-read-timeout`, `--nginx-computed-proxy-read-timeout` | Time to read a response from the upstream |
@@ -676,6 +720,6 @@ The following flag surfaces in `nginx:report` but is not managed by `nginx:set`:
 The following properties are recorded internally by the plugin and are not exposed via `nginx:report`:
 
 | Property | Description | Source |
-|---|---|---|
+| --- | --- | --- |
 | `proxy-status` | `started`/`stopped` state of the nginx system service | `cmd-nginx-start`/`cmd-nginx-stop` |
 | `nginx-conf-sigil-migrated` | Migration sentinel set the first time a v1 template is rewritten to the current schema | `plugins/nginx-vhosts/install` writes `"true"` once the install-time migration runs |
diff --git a/docs/networking/proxies/openresty.md b/docs/networking/proxies/openresty.md
index ea8d0272b..3c62eb9fe 100644
--- a/docs/networking/proxies/openresty.md
+++ b/docs/networking/proxies/openresty.md
@@ -28,7 +28,44 @@ The OpenResty plugin has specific rules for routing requests:
 - OpenResty integration is exposed via docker labels attached to containers. Changes in labels require either app deploys or rebuilds.
 - While OpenResty will respect labels associated with other containers, only `web` containers have OpenResty labels injected by the plugin.
 - Only `http:80` and `https:443` port mappings are supported at this time.
-- Requests are routed as soon as the container is running and passing healthchecks.
+- Requests are routed as soon as the container is running, before Dokku's healthchecks have passed. See the [healthchecks](#healthchecks) section for how failed requests to a container that is not yet listening are handled.
+
+### Healthchecks
+
+When an app has a readiness healthcheck defined in its `app.json` file with a `path` property, Dokku automatically generates OpenResty healthcheck labels. These configure OpenResty to periodically check each container and stop routing traffic to containers that fail the check until they pass again.
+
+The following `app.json` healthcheck properties are mapped to OpenResty labels:
+
+| app.json Property | OpenResty Label | Description |
+|-------------------|-----------------|-------------|
+| `path`            | `openresty.healthcheck-path`      | The HTTP path to check (required) |
+| `port`            | `openresty.healthcheck-port`      | The port to check |
+| `scheme`          | `openresty.healthcheck-scheme`    | The scheme to use (`http` or `https`) |
+| `timeout`         | `openresty.healthcheck-timeout`   | Timeout in seconds (defaults to `5`) |
+| `wait`            | `openresty.healthcheck-interval`  | Interval between checks in seconds (defaults to `5`) |
+| `attempts`        | `openresty.healthcheck-fall`      | Number of successive failed checks before a container is taken out of rotation (defaults to `3`) |
+| `httpHeaders`     | `openresty.healthcheck-header.<name>` | Headers to send with the check. A `Host` header is set via `openresty.healthcheck-host` instead |
+
+If no `Host` header is specified, the first app domain is used, matching the header Dokku sends during deploy checks. Headers with invalid names or values containing quotes, backslashes, or control characters are skipped.
+
+Additionally, the following labels are generated so that a request that fails to connect to a container is retried against another container, and the failing container is immediately taken out of rotation:
+
+| OpenResty Label | Value | Description |
+|-----------------|-------|-------------|
+| `openresty.upstream-max-fails` | `1` | Number of failed requests before a container is taken out of rotation |
+| `openresty.upstream-fail-timeout` | the healthcheck `wait` value, or `5s` | How long a container is taken out of rotation after a failed request |
+| `openresty.proxy-next-upstream-timeout` | `5s` | How long a failed request may be retried against other containers |
+
+OpenResty considers a new container healthy until it fails a check or a request to it fails to connect, and healthcheck state is reset whenever the OpenResty configuration is reloaded. Responses with a `2xx` or `3xx` status are considered healthy, and the `content` property is not supported.
+
+The status of all checked upstreams can be viewed from within the OpenResty container:
+
+```shell
+docker exec openresty-openresty-1 wget -qO- http://127.0.0.1:8999/upstream-healthcheck-status
+```
+
+> [!NOTE]
+> Only the first readiness healthcheck with a `path` property is used. Apps without one are routed as soon as the container is running, though requests that fail to connect to a container are still retried against other containers. See the [zero downtime deploys documentation](/docs/deployment/zero-downtime-deploys.md#healthchecks-and-label-based-proxies) for more information.
 
 ### Switching to OpenResty
 
@@ -291,7 +328,7 @@ Global-only properties expose two report flags: `--openresty-global-<property>`
 App-or-global properties expose three report flags: `--openresty-<property>` returns the raw per-app value (empty when unset), `--openresty-global-<property>` returns the raw global value (empty when unset), and `--openresty-computed-<property>` returns the effective value, resolving the per-app value first, then the global value, then the built-in default.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `access-log-format` | app or global | none | `--openresty-access-log-format`, `--openresty-global-access-log-format`, `--openresty-computed-access-log-format` | Custom nginx `log_format` directive used for the access log |
 | `access-log-path` | app or global | _`/var/log/nginx/{app}-access.log`_ | `--openresty-access-log-path`, `--openresty-global-access-log-path`, `--openresty-computed-access-log-path` | Path inside the openresty container where access logs are written |
 | `allowed-letsencrypt-domains-func-base64` | global only | _allow-all stub_ | `--openresty-global-allowed-letsencrypt-domains-func-base64`, `--openresty-computed-allowed-letsencrypt-domains-func-base64` | Base64-encoded Lua function deciding which domains may request a letsencrypt certificate |
diff --git a/docs/networking/proxies/traefik.md b/docs/networking/proxies/traefik.md
index 580ea5e18..425760152 100644
--- a/docs/networking/proxies/traefik.md
+++ b/docs/networking/proxies/traefik.md
@@ -31,12 +31,12 @@ The Traefik plugin has specific rules for routing requests:
 - If no `http:80` mapping is found, the first `http` port mapping is used for http requests.
 - If no `https:443` mapping is found, the first `https` port mapping is used for https requests.
 - If no `https` mapping is found, the container port from `http:80` will be used for https requests.
-- Requests are routed as soon as the container is running and passing healthchecks.
+- Requests are routed as soon as the container is running, before Dokku's healthchecks have passed.
 - Readiness healthchecks defined in `app.json` with a `path` property are automatically transformed into Traefik healthcheck labels.
 
 ### Healthchecks
 
-When an app has a readiness healthcheck defined in its `app.json` file with a `path` property, Dokku automatically generates Traefik healthcheck labels. These labels configure Traefik to perform health checks on the container before routing traffic to it.
+When an app has a readiness healthcheck defined in its `app.json` file with a `path` property, Dokku automatically generates Traefik healthcheck labels. These labels configure Traefik to periodically check each container and stop routing traffic to containers that fail the check. Traefik considers a new container healthy until its first check fails, so requests may reach a container before its first check runs.
 
 The following `app.json` healthcheck properties are mapped to Traefik labels:
 
@@ -67,7 +67,7 @@ Example `app.json` configuration:
 ```
 
 > [!NOTE]
-> Only the first readiness healthcheck with a `path` property is used. Liveness, startup, and command-based healthchecks are not transformed into Traefik labels.
+> Only the first readiness healthcheck with a `path` property is used. Liveness, startup, and command-based healthchecks are not transformed into Traefik labels. See the [zero downtime deploys documentation](/docs/deployment/zero-downtime-deploys.md#healthchecks-and-label-based-proxies) for more information.
 
 ### Switching to Traefik
 
@@ -241,22 +241,22 @@ By default, Traefik uses TLS-ALPN-01 challenge for obtaining certificates. To sw
 
 1. Set the challenge mode to `dns`:
 
-```shell
-dokku traefik:set --global challenge-mode dns
-```
+    ```shell
+    dokku traefik:set --global challenge-mode dns
+    ```
 
 2. Set your DNS provider:
 
-```shell
-dokku traefik:set --global dns-provider cloudflare
-```
+    ```shell
+    dokku traefik:set --global dns-provider cloudflare
+    ```
 
 3. Configure the required environment variables for your DNS provider. Each DNS provider requires specific environment variables. The variable names should be prefixed with `dns-provider-`:
 
-```shell
-dokku traefik:set --global dns-provider-cf_api_email user@example.com
-dokku traefik:set --global dns-provider-cf_api_key your-api-key
-```
+    ```shell
+    dokku traefik:set --global dns-provider-cf_api_email user@example.com
+    dokku traefik:set --global dns-provider-cf_api_key your-api-key
+    ```
 
 The `dns-provider-` prefix will be stripped and the variable name will be uppercased when passed to the Traefik container. For example, `dns-provider-cf_api_email` becomes `CF_API_EMAIL`.
 
@@ -408,7 +408,7 @@ dokku traefik:report node-js-app --traefik-computed-api-enabled
 All traefik properties are global only. Set with `traefik:set --global <property> <value>`.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `api-enabled` | global only | `false` | `--traefik-global-api-enabled`, `--traefik-computed-api-enabled` | When `true`, enables the Traefik HTTP API |
 | `api-entry-point` | global only | none | `--traefik-global-api-entry-point`, `--traefik-computed-api-entry-point` | Name of the entry point used by the Traefik API |
 | `api-entry-point-address` | global only | none | `--traefik-global-api-entry-point-address`, `--traefik-computed-api-entry-point-address` | Address (`host:port`) the Traefik API listens on |
diff --git a/docs/networking/proxy-management.md b/docs/networking/proxy-management.md
index cda6ad6a1..2e28861b1 100644
--- a/docs/networking/proxy-management.md
+++ b/docs/networking/proxy-management.md
@@ -188,6 +188,95 @@ See the [port scheme documentation](/docs/networking/port-management.md#port-sch
 
 See the [port management documentation](/docs/networking/port-management.md) for more information on how port mappings are managed for an application.
 
+### Path-based routing to non-web processes
+
+> [!IMPORTANT]
+> New as of 0.39.0
+
+By default, every HTTP/HTTPS request is routed to the `web` process declared in the app's `Procfile`. Use `proxy:route:*` to route specific path prefixes to a different process within the same app - for example, sending `/api/v0/*` to an `api` process or `/ws` to a `websocket` process. The `web` process always handles every other path as an implicit catch-all.
+
+> [!NOTE]
+> Path-based routing is rendered by the `nginx`, `traefik`, `caddy`, `openresty`, and `k3s` proxy backends. The `haproxy` backend accepts and stores route declarations but the routes are inert (no labels are emitted) because the `byjg/easy-haproxy` sidecar image only supports host-based routing. Routes stored ahead of a backend switch will activate automatically once the proxy is changed to a rendering backend.
+
+#### Adding a route
+
+```shell
+# Route /api/v0/* to the api process on container port 5000
+dokku proxy:route:set node-js-app api /api/v0
+```
+
+The `--port` flag overrides the default upstream port of `5000`:
+
+```shell
+dokku proxy:route:set node-js-app api /api/v0 --port 5001
+```
+
+The `--strip-prefix` flag strips the matched prefix before forwarding the request upstream. Use this when the process is written assuming it is mounted at root (`/users/42` instead of `/api/v0/users/42`):
+
+```shell
+dokku proxy:route:set node-js-app api /api/v0 --port 5001 --strip-prefix
+```
+
+`proxy:route:set` uses set semantics: the resulting route is fully described by its arguments. Omitting `--port` resets the port to `5000`; omitting `--strip-prefix` resets the flag to off. This makes the command safely re-runnable from declarative config tools such as [dokku/docket](https://github.com/dokku/docket).
+
+The `web` process cannot be a route target since it serves the implicit `/` catch-all.
+
+#### Removing a route
+
+```shell
+dokku proxy:route:remove node-js-app /api/v0
+```
+
+Removing a path that is not registered is a successful no-op.
+
+#### Clearing all routes
+
+```shell
+dokku proxy:route:clear node-js-app
+```
+
+#### Listing routes
+
+```shell
+dokku proxy:route:report node-js-app
+```
+
+```
+=====> node-js-app proxy routes information
+       Route /api/v0/admin -> api:5001
+       Route /api/v0 -> api:5001
+       Route /ws -> websocket:8080
+       Route /internal -> tools:5000 (strip)
+```
+
+The report supports JSON output for scripting:
+
+```shell
+dokku proxy:route:report node-js-app --format json
+```
+
+#### Matching semantics
+
+Routes are matched longest-prefix-first. When two prefixes overlap, the longer one wins:
+
+```shell
+dokku proxy:route:set node-js-app api /api/v0
+dokku proxy:route:set node-js-app api /api/v0/admin
+```
+
+- `GET /api/v0/admin/users` -> matches `/api/v0/admin`
+- `GET /api/v0/anything-else` -> matches `/api/v0`
+- `GET /home` -> falls through to the `web` catch-all
+
+#### Caveats per backend
+
+- **nginx**: route changes take effect immediately on the next `proxy-build-config` reload (which `proxy:route:*` invokes automatically).
+- **traefik**, **caddy**, and **openresty**: routes are applied via Docker labels on the target containers. Containers must be recreated for new or removed labels to take effect. The command prints a notice instructing you to run `dokku ps:rebuild <app>` to recreate containers.
+- **k3s**: route changes take effect on the next deploy when the chart is re-rendered.
+- **haproxy**: routes are stored but inert under this backend. They activate automatically if you switch to a rendering backend (`nginx`, `traefik`, `caddy`, `openresty`, or `k3s`).
+- **WebSocket** traffic is forwarded transparently on `nginx`, `traefik`, `caddy`, and `k3s` backends - no additional configuration is required.
+- A route to a process that is scaled to `0` will resolve to no upstream until the process is scaled up (`dokku ps:scale <app> <process>=1`). `proxy:route:set` warns when this is the case.
+
 ### Container network interface binding
 
 > Changed as of 0.11.0
@@ -245,7 +334,7 @@ Finally, proxy implementations _may_ install extra software needed for the proxy
 > The `Report flags` column lists the CLI argument names accepted by `proxy:report`. The JSON keys emitted by `proxy:report --format json` are the same names with the leading `--proxy-` stripped (e.g. `type`, `global-type`, `computed-type`). Legacy keys with the `proxy-` prefix (e.g. `proxy-type`) are also emitted during the 0.38.x deprecation window and will be removed in a future major release.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `disabled` | app only | `false` | `--proxy-disabled`, `--proxy-computed-disabled` (also exposed inverted as `--proxy-enabled`) | When `true`, disables proxy integration for this app (`proxy:enable`/`proxy:disable` write this) |
 | `proxy-port` | app + global | none | `--proxy-proxy-port`, `--proxy-global-proxy-port`, `--proxy-computed-proxy-port` | Override port used for the HTTP listener in the generated proxy config |
 | `proxy-ssl-port` | app + global | none | `--proxy-proxy-ssl-port`, `--proxy-global-proxy-ssl-port`, `--proxy-computed-proxy-ssl-port` | Override port used for the HTTPS listener in the generated proxy config |
diff --git a/docs/processes/one-off-tasks.md b/docs/processes/one-off-tasks.md
index f3f699111..1cc10d526 100644
--- a/docs/processes/one-off-tasks.md
+++ b/docs/processes/one-off-tasks.md
@@ -31,7 +31,6 @@ One off containers are removed at the end of process execution.
 
 In addition, one-off containers also run for a max of 24 hours (86400 seconds) by default, after which they are reaped. This can be changed by setting the `--ttl-seconds` argument:
 
-
 ```shell
 # runs for 10 minutes
 dokku run --ttl-seconds 600 node-js-app npm run mytask
@@ -52,6 +51,8 @@ console: bundle exec racksh
 dokku run my-app console
 ```
 
+The Procfile command is split into arguments using the same shell quoting rules used when deploying the app. See the [Procfile documentation](/docs/processes/process-management.md#procfile) for more details.
+
 #### Specifying container labels
 
 Containers may have specific labels attached. In order to avoid issues with dokku internals, do not use any labels beginning with either `com.dokku` or `org.label-schema`.
diff --git a/docs/processes/process-management.md b/docs/processes/process-management.md
index 80e219291..6a76059fa 100644
--- a/docs/processes/process-management.md
+++ b/docs/processes/process-management.md
@@ -4,15 +4,17 @@
 > New as of 0.3.14, Enhanced in 0.7.0
 
 ```
-ps:inspect <app>                                                          # Displays a sanitized version of docker inspect for an app
-ps:rebuild [--parallel count] [--all|<app>]                               # Rebuilds an app from source
-ps:report [<app>] [<flag>]                                                # Displays a process report for one or more apps
-ps:restart [--parallel count] [--all|<app>]  [<process-name>]             # Restart an app
-ps:restore [<app>]                                                        # Start previously running apps e.g. after reboot
-ps:scale [--skip-deploy] [--format stdout|json] <app> [<proc>=<count>...] # Get/Set how many instances of a given process to run
-ps:set <app> <key> <value>                                                # Set or clear a ps property for an app
-ps:start [--parallel count] [--all|<app>]                                 # Start an app
-ps:stop [--parallel count] [--all|<app>]                                  # Stop an app
+ps:inspect <app>                                                             # Displays a sanitized version of docker inspect for an app
+ps:rebuild [--parallel count] [--no-cache] [--all|<app>]                     # Rebuilds an app from source
+ps:report [<app>] [<flag>]                                                   # Displays a process report for one or more apps
+ps:restart [--parallel count] [--all|<app>]  [<process-name>]                # Restart an app
+ps:restore [<app>]                                                           # Start previously running apps e.g. after reboot
+ps:scale [--skip-deploy] [--format stdout|json] <app> [<proc>=<count>...]    # Get/Set how many instances of a given process to run
+ps:scale --replace [--skip-deploy] <app> <proc>=<count> [<proc>=<count>...]  # Replace the formation and scale unspecified process types to zero
+ps:scale --clear [--skip-deploy] <app>                                       # Reset the formation to the default scale
+ps:set <app> <key> <value>                                                   # Set or clear a ps property for an app
+ps:start [--parallel count] [--all|<app>]                                    # Start an app
+ps:stop [--parallel count] [--all|<app>]                                     # Stop an app
 ```
 
 ## Usage
@@ -56,6 +58,29 @@ Finally, the number of parallel workers may be automatically set to the number o
 dokku ps:rebuild --all --parallel -1
 ```
 
+#### Rebuilding without the build cache
+
+> [!IMPORTANT]
+> New as of 0.38.34
+
+An app may be rebuilt without using the build cache by specifying the `--no-cache` flag. This applies only to the triggered rebuild, and no setting is persisted for later deploys.
+
+```shell
+dokku ps:rebuild --no-cache node-js-app
+```
+
+The `--no-cache` flag may also be combined with the `--all` and `--parallel` flags.
+
+```shell
+dokku ps:rebuild --all --no-cache
+```
+
+The effect of the flag depends on the builder in use:
+
+- `dockerfile`, `nixpacks`, and `railpack`: The build is run with `--no-cache`. For the `dockerfile` builder, [BuildKit directory caches](/docs/deployment/builders/dockerfiles.md#buildkit-directory-caching) are not cleared.
+- `pack`: The build is run with `--clear-cache`.
+- `herokuish`: The build cache is purged before the build, in the same way as `repo:purge-cache`.
+
 A missing linked container will result in failure to boot apps. Services should all be started for apps being rebuilt.
 
 ### Restarting apps
@@ -125,7 +150,7 @@ The `ps` plugin provides a number of settings that can be used to managed deploy
 
 | Name                  | Description                                       | Global Default     |
 |-----------------------|---------------------------------------------------|--------------------|
-| `stop-timeout`        | Configurable grace period given to the `docker stop` command. If a container has not stopped by this time, a `kill -9` signal or equivalent is sent in order to force-terminate the container. Both the `ps:stop` and `apps:destroy` commands *also* respect this value. If not specified, the Docker defaults for the [`docker stop` command](https://docs.docker.com/engine/reference/commandline/stop/) will be used. | `30`             |
+| `stop-timeout`        | Configurable grace period given to the `docker stop` command. If a container has not stopped by this time, a `kill -9` signal or equivalent is sent in order to force-terminate the container. Both the `ps:stop` and `apps:destroy` commands _also_ respect this value. If not specified, the Docker defaults for the [`docker stop` command](https://docs.docker.com/engine/reference/commandline/stop/) will be used. | `30`             |
 
 All settings can be set via the `ps:set` command. Using `stop-timeout` as an example:
 
@@ -177,6 +202,12 @@ importantworker:  env QUEUE=important bundle exec rake resque:work
 
 If the app build declares an `ENTRYPOINT`, the command defined in the `Procfile` is passed as an argument to that entrypoint. This is the case for all Dockerfile-based, Docker Image, and Cloud Native Buildpack deployments.
 
+When deploying via the `docker-local` scheduler, for all builders other than Herokuish, the command is split into arguments using shell quoting rules, but is not otherwise interpreted by a shell. Environment variable references such as `$PORT` are substituted before the command is split. Single quotes, double quotes, and backslash escapes then group and escape arguments, and any other special characters are passed to the container verbatim. Shell operators such as `&&`, `|`, `;`, and redirections are not supported and will fail the deploy, and a trailing `#` comment is ignored. If shell features are required, invoke a shell explicitly:
+
+```Procfile
+web: sh -c "bin/migrate && exec bin/server --port $PORT"
+```
+
 The `web` process type holds some significance in that it is the only process type that is automatically scaled to `1` on the initial application deploy. See the [web process scaling documentation](/docs/processes/process-management.md#the-web-process) for more details around scaling individual processes.
 
 See the [Procfile location documentation](/docs/processes/process-management.md#changing-the-procfile-location) for more information on where to place your `Procfile` file.
@@ -208,7 +239,7 @@ Sometimes it may be desirable to set a different path for a given app, e.g. when
 dokku ps:set node-js-app procfile-path .dokku/Procfile
 ```
 
-The value is the path to the desired file *relative* to the base search directory, and will never be treated as absolute paths in any context. If that file does not exist within the repository, Dokku will continue the build process as if the repository has no `Procfile`.
+The value is the path to the desired file _relative_ to the base search directory, and will never be treated as absolute paths in any context. If that file does not exist within the repository, Dokku will continue the build process as if the repository has no `Procfile`.
 
 The default value may be set by passing an empty value for the option:
 
@@ -246,12 +277,41 @@ Multiple process types can be scaled at once:
 dokku ps:scale node-js-app web=1 worker=1
 ```
 
+> [!NOTE]
+> Each argument must name a process type, and process counts must be zero or greater. Scaling a process type to `0` stops all of its containers, while a negative count is rejected.
+
 If desired, the corresponding deploy will be skipped by using the `--skip-deploy` flag:
 
 ```shell
 dokku ps:scale --skip-deploy node-js-app web=1
 ```
 
+#### Replacing the formation
+
+By default, `ps:scale` merges the specified process types into the existing formation, leaving any unspecified process type at its current count. The `--replace` flag instead treats the specified process types as the entire formation, setting the process count for every unspecified process type to zero:
+
+```shell
+dokku ps:scale --replace node-js-app web=1
+```
+
+An app scaled to `web=2 worker=3` before the above command will be scaled to `web=1 worker=0` after it, with the `worker` containers stopped as part of the same command.
+
+> [!NOTE]
+> At least one process type must be specified when using the `--replace` flag. Use the `--clear` flag to reset the formation instead.
+
+#### Clearing the formation
+
+The `--clear` flag resets the formation to the scale a newly created app has, a single `web` process, with the process count for every other process type set to zero:
+
+```shell
+dokku ps:scale --clear node-js-app
+```
+
+Apps with a `Procfile` that does not specify a `web` process type will have the process count for every process type set to zero.
+
+> [!NOTE]
+> Process types cannot be specified when using the `--clear` flag, nor can it be combined with the `--replace` flag.
+
 #### Manually managing process scaling
 
 > Using a `formation` key in an `app.json` file with _any_ `quantity` specified disables the ability to use `ps:scale` for scaling. All processes not specified in the `app.json` will have their process count set to zero.
@@ -506,11 +566,11 @@ dokku ps:set node-js-app restore
 > The `Report flags` column lists the CLI argument names accepted by `ps:report`. The JSON keys emitted by `ps:report --format json` are the same names with the leading `--ps-` stripped (e.g. `procfile-path`, `global-procfile-path`, `computed-procfile-path`). Legacy keys with the `ps-` prefix (e.g. `ps-procfile-path`) are also emitted during the 0.38.x deprecation window and will be removed in a future major release.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `dockerfile-start-cmd` | app only | none | `--ps-dockerfile-start-cmd`, `--ps-computed-dockerfile-start-cmd` | Override `CMD` for Dockerfile-based apps |
 | `procfile-path` | app + global | `Procfile` | `--ps-procfile-path`, `--ps-global-procfile-path`, `--ps-computed-procfile-path` | Path to the app's Procfile, relative to the build root |
 | `restart-policy` | app + global | `on-failure:10` | `--ps-restart-policy`, `--ps-global-restart-policy`, `--ps-computed-restart-policy` | Docker restart policy applied to deployed containers (`no`, `always`, `unless-stopped`, `on-failure[:max-retries]`) |
-| `restore` | app only | `true` | `--restore` | When `true`, the app is restarted automatically by `ps:retire` after a host reboot |
+| `restore` | app only | `true` | `--restore` | When `true`, the app is restarted automatically by `ps:restore` after a host reboot |
 | `skip-deploy` | app + global | `false` | `--ps-skip-deploy`, `--ps-global-skip-deploy`, `--ps-computed-skip-deploy` | When `true`, skips the deploy phase after a successful build |
 | `start-cmd` | app only | none | `--ps-start-cmd`, `--ps-computed-start-cmd` | Override start command for buildpack apps |
 | `stop-timeout-seconds` | app + global | `30` | `--ps-stop-timeout-seconds`, `--ps-global-stop-timeout-seconds`, `--ps-computed-stop-timeout-seconds` | Seconds Docker waits before SIGKILLing a container on stop |
@@ -520,7 +580,7 @@ dokku ps:set node-js-app restore
 The following flags surface in `ps:report` but are not managed by `ps:set` - they are derived from the running process state:
 
 | Flag | Description |
-|---|---|
+| --- | --- |
 | `--ps-can-scale` | `false` when the app's procfile or builder forbids horizontal scaling |
 | `--deployed` | `true` after the first successful deploy |
 | `--running` | `true` while any container for the app is running |
diff --git a/docs/processes/scheduled-cron-tasks.md b/docs/processes/scheduled-cron-tasks.md
index a54fcd24c..77b983a8e 100644
--- a/docs/processes/scheduled-cron-tasks.md
+++ b/docs/processes/scheduled-cron-tasks.md
@@ -40,7 +40,6 @@ A cron task takes the following properties:
 - `schedule`: A [cron-compatible](https://en.wikipedia.org/wiki/Cron#Overview) scheduling definition upon which to run the command. Seconds are generally not supported.
 - `concurrency_policy`: A string (default: `allow`), that controls whether the cron task can be run concurrently with another invocation of itself. Valid options are `allow` (allow concurrency), `forbid` (exit the new cron task if there is an existing one), `replace` (delete any existing cron task and start the new one).
 
-
 Zero or more cron tasks can be specified per app. Cron tasks are validated after the build artifact is created but before the app is deployed, and the cron schedule is updated during the post-deploy phase.
 
 Cron tasks can run for a maximum of 24 hours, after which they are reaped from the system. The `docker-local` scheduler reaps expired tasks via the `dokku ps:retire` pass that runs every 5 minutes, so a task may overrun its deadline by up to 5 minutes. The `k3s` scheduler enforces the deadline directly through the job's `activeDeadlineSeconds`.
@@ -56,6 +55,7 @@ When running scheduled cron tasks, there are a few items to be aware of:
 - At this time, only the `PATH` and `SHELL` environment variables are specified in the cron template.
     - A `MAILTO` value can be set via the `cron:set` command.
     - A `MAILFROM` value can be set via the `cron:set` command.
+    - Tasks injected by plugins via the [`cron-entries` trigger](/docs/development/plugin-triggers.md#cron-entries) may set a `MAILTO` value of their own, which is used for that task instead of the global value. `MAILTO` is reset after the task to the global value, or to the `dokku` user when no global value is set, so no other task is mailed to that address. The output of such a task is mailed to that address as well as appended to the task's log file.
 - Each scheduled task is executed within a one-off `run` container, and thus inherit any docker-options specified for `run` containers. Resources are never shared between scheduled tasks.
 - Scheduled cron tasks are supported on a per-scheduler basis. Schedulers that use the host crontab - such as `docker-local` - have their `app.json` cron tasks written to the `dokku` user crontab, while schedulers that manage their own cron backend - such as `k3s` - schedule them natively.
 - Tasks for _all_ apps managed by a host-crontab scheduler such as `docker-local` are written to a single crontab file owned by the `dokku` user. The `dokku` user's crontab should be considered reserved for this purpose.
@@ -338,7 +338,7 @@ SHELL=/bin/bash
 > The `Report flags` column lists the CLI argument names accepted by `cron:report`. The JSON keys emitted by `cron:report --format json` are the same names with the leading `--cron-` stripped (e.g. `global-mailto`, `computed-mailto`, `maintenance`). Legacy keys with the `cron-` prefix (e.g. `cron-global-mailto`) are also emitted during the 0.38.x deprecation window and will be removed in a future major release.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `mailfrom` | global only | none | `--cron-global-mailfrom`, `--cron-computed-mailfrom` | `From:` address used in cron failure emails |
 | `mailto` | global only | none | `--cron-global-mailto`, `--cron-computed-mailto` | Recipient address for cron failure emails; empty disables email |
 | `maintenance` | app + global | `false` | `--cron-maintenance`, `--cron-global-maintenance`, `--cron-computed-maintenance` | When `true`, suspends all cron tasks for the app (or globally) |
diff --git a/docs/template.html b/docs/template.html
index aa01d40e6..40409b09a 100644
--- a/docs/template.html
+++ b/docs/template.html
@@ -9,26 +9,26 @@
     <meta name="author" content="">
     <title>Dokku - {{DOC_TITLE}}</title>
 
-    <link rel="apple-touch-icon" sizes="57x57" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-57x57.png">
-    <link rel="apple-touch-icon" sizes="60x60" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-60x60.png">
-    <link rel="apple-touch-icon" sizes="72x72" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-72x72.png">
-    <link rel="apple-touch-icon" sizes="76x76" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-76x76.png">
-    <link rel="apple-touch-icon" sizes="114x114" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-114x114.png">
-    <link rel="apple-touch-icon" sizes="120x120" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-120x120.png">
-    <link rel="apple-touch-icon" sizes="144x144" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-144x144.png">
-    <link rel="apple-touch-icon" sizes="152x152" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-152x152.png">
-    <link rel="apple-touch-icon" sizes="180x180" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-180x180.png">
-    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/favicon-32x32.png" sizes="32x32">
-    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/android-chrome-192x192.png" sizes="192x192">
-    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/favicon-96x96.png" sizes="96x96">
-    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/favicon-16x16.png" sizes="16x16">
-    <link rel="manifest" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/manifest.json">
-    <link rel="shortcut icon" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/favicon.ico">
+    <link rel="apple-touch-icon" sizes="57x57" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/apple-touch-icon-57x57.png">
+    <link rel="apple-touch-icon" sizes="60x60" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/apple-touch-icon-60x60.png">
+    <link rel="apple-touch-icon" sizes="72x72" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/apple-touch-icon-72x72.png">
+    <link rel="apple-touch-icon" sizes="76x76" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/apple-touch-icon-76x76.png">
+    <link rel="apple-touch-icon" sizes="114x114" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/apple-touch-icon-114x114.png">
+    <link rel="apple-touch-icon" sizes="120x120" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/apple-touch-icon-120x120.png">
+    <link rel="apple-touch-icon" sizes="144x144" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/apple-touch-icon-144x144.png">
+    <link rel="apple-touch-icon" sizes="152x152" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/apple-touch-icon-152x152.png">
+    <link rel="apple-touch-icon" sizes="180x180" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/apple-touch-icon-180x180.png">
+    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/favicon-32x32.png" sizes="32x32">
+    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/android-chrome-192x192.png" sizes="192x192">
+    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/favicon-96x96.png" sizes="96x96">
+    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/favicon-16x16.png" sizes="16x16">
+    <link rel="manifest" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/manifest.json">
+    <link rel="shortcut icon" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/favicon.ico">
     <meta name="apple-mobile-web-app-title" content="Dokku">
     <meta name="application-name" content="Dokku">
     <meta name="msapplication-TileColor" content="#da532c">
-    <meta name="msapplication-TileImage" content="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/mstile-144x144.png">
-    <meta name="msapplication-config" content="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/browserconfig.xml">
+    <meta name="msapplication-TileImage" content="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/mstile-144x144.png">
+    <meta name="msapplication-config" content="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/favicons/browserconfig.xml">
     <meta name="theme-color" content="#ffffff">
 
     <script>
@@ -48,7 +48,7 @@
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link href="https://fonts.googleapis.com/css2?family=Lato:wght@400;700;900&display=swap" rel="stylesheet">
 
-    <link href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/style.css" rel="stylesheet">
+    <link href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.34/docs/assets/style.css" rel="stylesheet">
     <!-- <link href="./assets/style.css" rel="stylesheet"> -->
     <link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.5.0/css/font-awesome.min.css" rel="stylesheet">
   </head>
@@ -190,6 +190,7 @@
 
             <a href="/{{NAME}}/advanced-usage/backup-recovery/" class="list-group-item">Backup and Recovery</a>
             <a href="/{{NAME}}/advanced-usage/builds/" class="list-group-item">Build Tracking</a>
+            <a href="/{{NAME}}/advanced-usage/datastore-management/" class="list-group-item">Datastore Management</a>
             <a href="/{{NAME}}/advanced-usage/deployment-tasks/" class="list-group-item">Deployment Tasks</a>
             <a href="/{{NAME}}/advanced-usage/docker-options/" class="list-group-item">Docker Container Options</a>
             <a href="/{{NAME}}/advanced-usage/registry-management/" class="list-group-item">Docker Registry Management</a>
diff --git a/dokku b/dokku
index 82fa1e574..bd0c367cb 100755
--- a/dokku
+++ b/dokku
@@ -67,6 +67,9 @@ export DOKKU_GLOBAL_RUN_ARGS="--label=org.label-schema.schema-version=1.0 --labe
 
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 
+# the original argv is kept so the re-exec as the dokku user can replay it verbatim
+# and let the child re-parse the global flags for itself. parse_args and the
+# flag-stripping loop below must therefore stay pure functions of argv.
 parse_args "$@"
 args=("$@")
 skip_arg=false
@@ -91,7 +94,9 @@ if [[ $(id -un) != "dokku" ]]; then
   if [[ ! $1 =~ plugin:* ]] && [[ $1 != "ssh-keys:add" ]] && [[ $1 != "ssh-keys:remove" ]] && [[ $1 != "scheduler-k3s:initialize" ]] && [[ $1 != "scheduler-k3s:uninstall" ]]; then
     unset DOKKU_PID TMP TMPDIR TEMP TEMPDIR
     export SSH_USER=$(id -un)
-    sudo -u dokku -E -H "$0" "$@"
+    read -ra preserved_env_names <<<"$(fn-cli-preserved-env-names)"
+    preserve_env_flag="$(fn-sudo-preserve-env-flag "${preserved_env_names[@]}")"
+    sudo -u dokku "$preserve_env_flag" -H "$0" "${args[@]}"
     exit $?
   fi
 fi
@@ -113,7 +118,7 @@ if [[ -n "$SSH_ORIGINAL_COMMAND" ]]; then
     exit_code=$?
     set +f
   else
-    readarray -t -O "${#ssh_arg_array[@]}" ssh_arg_array < <(printf '%s' "$SSH_ORIGINAL_COMMAND" | xargs -n 1)
+    readarray -d '' -O "${#ssh_arg_array[@]}" ssh_arg_array < <(printf '%s' "$SSH_ORIGINAL_COMMAND" | xargs -r printf '%s\0')
     set -f
     $0 "${ssh_arg_array[@]}"
     exit_code=$?
@@ -189,7 +194,7 @@ execute_dokku_cmd() {
   fi
 
   if [[ "$PLUGIN_NAME" == "git-hook" ]] || [[ "$PLUGIN_NAME" == "ps:rebuild" ]] || [[ "$PLUGIN_NAME" == "ps:restart" ]]; then
-    dokku_setup_build_capture "$2" "$PLUGIN_NAME"
+    dokku_setup_build_capture "$(fn-build-capture-app-name "$@")" "$PLUGIN_NAME"
   fi
 
   if [[ -x $PLUGIN_ENABLED_PATH/$PLUGIN_NAME/subcommands/default ]]; then
diff --git a/go.work b/go.work
index d8b8e65f5..48a0a82e8 100644
--- a/go.work
+++ b/go.work
@@ -1,4 +1,4 @@
-go 1.26.2
+go 1.27.1
 
 use (
 	./plugins/app-json
@@ -11,12 +11,14 @@ use (
 	./plugins/builder-pack
 	./plugins/builder-railpack
 	./plugins/buildpacks
+	./plugins/builds
 	./plugins/caddy-vhosts
 	./plugins/certs
 	./plugins/checks
 	./plugins/common
 	./plugins/config
 	./plugins/cron
+	./plugins/datastore
 	./plugins/docker-options
 	./plugins/domains
 	./plugins/git
diff --git a/plugins/00_dokku-standard/plugin.toml b/plugins/00_dokku-standard/plugin.toml
index 17b353ae1..9e0a58579 100644
--- a/plugins/00_dokku-standard/plugin.toml
+++ b/plugins/00_dokku-standard/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core standard plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/00_dokku-standard/subcommands/cleanup b/plugins/00_dokku-standard/subcommands/cleanup
index 42918a2b4..c73eaebdc 100755
--- a/plugins/00_dokku-standard/subcommands/cleanup
+++ b/plugins/00_dokku-standard/subcommands/cleanup
@@ -13,6 +13,8 @@ cmd-cleanup() {
     APP="--global"
   fi
 
+  [[ "$APP" == "--global" ]] || verify_app_name "$APP"
+
   docker_cleanup "$APP" "true"
 }
 
diff --git a/plugins/20_events/plugin.toml b/plugins/20_events/plugin.toml
index e99080385..49c66281d 100644
--- a/plugins/20_events/plugin.toml
+++ b/plugins/20_events/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core events logging plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/app-json/.gitignore b/plugins/app-json/.gitignore
index d39fdc622..029dc59e8 100644
--- a/plugins/app-json/.gitignore
+++ b/plugins/app-json/.gitignore
@@ -7,5 +7,6 @@
 /triggers
 /triggers/*
 /app-json-get-content
+/app-json-is-valid
 /app-json-process-deploy-parallelism
 /core-*
diff --git a/plugins/app-json/Makefile b/plugins/app-json/Makefile
index 5283fc5db..bcd0530ae 100644
--- a/plugins/app-json/Makefile
+++ b/plugins/app-json/Makefile
@@ -1,5 +1,5 @@
 SUBCOMMANDS = subcommands/report subcommands/set
-TRIGGERS = triggers/app-json-process-deploy-parallelism triggers/app-json-get-content triggers/core-post-deploy triggers/core-post-extract triggers/install triggers/post-app-clone-setup triggers/post-app-rename triggers/post-app-rename-setup triggers/post-create triggers/post-delete triggers/post-deploy triggers/post-release-builder triggers/pre-release-builder triggers/report
+TRIGGERS = triggers/app-json-process-deploy-parallelism triggers/app-json-get-content triggers/app-json-is-valid triggers/core-post-deploy triggers/core-post-extract triggers/install triggers/post-app-clone-setup triggers/post-app-rename triggers/post-app-rename-setup triggers/post-create triggers/post-delete triggers/post-deploy triggers/post-release-builder triggers/pre-release-builder triggers/report
 BUILD = commands subcommands triggers
 PLUGIN_NAME = app-json
 
diff --git a/plugins/app-json/appjson.go b/plugins/app-json/appjson.go
index 2aff5c217..7bace19aa 100644
--- a/plugins/app-json/appjson.go
+++ b/plugins/app-json/appjson.go
@@ -5,7 +5,9 @@ import (
 	"fmt"
 	"math"
 	"os"
+	"sort"
 	"strings"
+	"unicode"
 
 	"github.com/dokku/dokku/plugins/common"
 	"github.com/tailscale/hujson"
@@ -234,6 +236,67 @@ const (
 	HealthcheckType_Startup HealthcheckType = "startup"
 )
 
+// validateHealthchecks ensures healthcheck fields that are passed to schedulers and proxies are well-formed
+func validateHealthchecks(appJSON AppJSON) error {
+	processTypes := make([]string, 0, len(appJSON.Healthchecks))
+	for processType := range appJSON.Healthchecks {
+		processTypes = append(processTypes, processType)
+	}
+	sort.Strings(processTypes)
+
+	for _, processType := range processTypes {
+		for index, healthcheck := range appJSON.Healthchecks[processType] {
+			name := healthcheck.Name
+			if name == "" {
+				name = fmt.Sprintf("#%d", index+1)
+			}
+
+			if err := validateHealthcheckScheme(healthcheck.Scheme); err != nil {
+				return fmt.Errorf("Invalid app.json healthcheck %s for process type %s: %w", name, processType, err)
+			}
+
+			if err := validateHealthcheckPath(healthcheck.Path); err != nil {
+				return fmt.Errorf("Invalid app.json healthcheck %s for process type %s: %w", name, processType, err)
+			}
+		}
+	}
+
+	return nil
+}
+
+// validateHealthcheckPath ensures a healthcheck path is absolute and contains no whitespace, control, or quote characters
+func validateHealthcheckPath(path string) error {
+	if path == "" {
+		return nil
+	}
+
+	if !strings.HasPrefix(path, "/") {
+		return fmt.Errorf("path %q must start with a /", path)
+	}
+
+	for _, r := range path {
+		if unicode.IsSpace(r) || unicode.IsControl(r) || strings.ContainsRune(`"'\`, r) {
+			return fmt.Errorf("path %q must not contain whitespace, control characters, quotes, or backslashes", path)
+		}
+	}
+
+	return nil
+}
+
+// validateHealthcheckScheme ensures a healthcheck scheme is either http or https
+func validateHealthcheckScheme(scheme string) error {
+	if scheme == "" {
+		return nil
+	}
+
+	switch strings.ToLower(scheme) {
+	case "http", "https":
+		return nil
+	}
+
+	return fmt.Errorf("scheme %q must be one of http or https", scheme)
+}
+
 // HTTPHeader is a struct that represents a single HTTP header associated with a healthcheck
 type HTTPHeader struct {
 	// Name is the name of the HTTP header
diff --git a/plugins/app-json/appjson_test.go b/plugins/app-json/appjson_test.go
new file mode 100644
index 000000000..b7005fb2c
--- /dev/null
+++ b/plugins/app-json/appjson_test.go
@@ -0,0 +1,85 @@
+package appjson
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestValidateHealthchecksAcceptsWellFormedValues(t *testing.T) {
+	tests := []struct {
+		name        string
+		healthcheck Healthcheck
+	}{
+		{name: "empty", healthcheck: Healthcheck{}},
+		{name: "root path", healthcheck: Healthcheck{Path: "/"}},
+		{name: "nested path", healthcheck: Healthcheck{Path: "/health/ready"}},
+		{name: "query string", healthcheck: Healthcheck{Path: "/health?full=1&verbose=true"}},
+		{name: "percent encoded", healthcheck: Healthcheck{Path: "/health%20check"}},
+		{name: "http scheme", healthcheck: Healthcheck{Path: "/", Scheme: "http"}},
+		{name: "https scheme", healthcheck: Healthcheck{Path: "/", Scheme: "https"}},
+		{name: "uppercase scheme", healthcheck: Healthcheck{Path: "/", Scheme: "HTTPS"}},
+		{name: "command check", healthcheck: Healthcheck{Command: []string{"/bin/sh", "-c", "echo ok"}}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			appJSON := AppJSON{Healthchecks: map[string][]Healthcheck{"web": {tt.healthcheck}}}
+			if err := validateHealthchecks(appJSON); err != nil {
+				t.Errorf("validateHealthchecks() returned unexpected error: %v", err)
+			}
+		})
+	}
+}
+
+func TestValidateHealthchecksRejectsMalformedValues(t *testing.T) {
+	tests := []struct {
+		name        string
+		healthcheck Healthcheck
+		wantField   string
+	}{
+		{name: "relative path", healthcheck: Healthcheck{Path: "health"}, wantField: "path"},
+		{name: "space", healthcheck: Healthcheck{Path: "/health check"}, wantField: "path"},
+		{name: "tab", healthcheck: Healthcheck{Path: "/health\tcheck"}, wantField: "path"},
+		{name: "newline", healthcheck: Healthcheck{Path: "/health\ncheck"}, wantField: "path"},
+		{name: "control character", healthcheck: Healthcheck{Path: "/health\x00"}, wantField: "path"},
+		{name: "double quote", healthcheck: Healthcheck{Path: `/health"`}, wantField: "path"},
+		{name: "single quote", healthcheck: Healthcheck{Path: `/health'`}, wantField: "path"},
+		{name: "backslash", healthcheck: Healthcheck{Path: `/health\ check`}, wantField: "path"},
+		{name: "unknown scheme", healthcheck: Healthcheck{Path: "/", Scheme: "tcp"}, wantField: "scheme"},
+		{name: "scheme with whitespace", healthcheck: Healthcheck{Path: "/", Scheme: "http s"}, wantField: "scheme"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			appJSON := AppJSON{Healthchecks: map[string][]Healthcheck{"web": {tt.healthcheck}}}
+			err := validateHealthchecks(appJSON)
+			if err == nil {
+				t.Fatalf("validateHealthchecks() returned nil, want error for %s", tt.wantField)
+			}
+
+			if !strings.Contains(err.Error(), tt.wantField) {
+				t.Errorf("validateHealthchecks() error = %q, want it to mention %q", err.Error(), tt.wantField)
+			}
+		})
+	}
+}
+
+func TestValidateHealthchecksNamesTheOffendingCheck(t *testing.T) {
+	appJSON := AppJSON{Healthchecks: map[string][]Healthcheck{
+		"web": {
+			{Name: "ok", Path: "/ready"},
+			{Path: "/health check"},
+		},
+	}}
+
+	err := validateHealthchecks(appJSON)
+	if err == nil {
+		t.Fatal("validateHealthchecks() returned nil, want error")
+	}
+
+	for _, want := range []string{"#2", "web"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("validateHealthchecks() error = %q, want it to mention %q", err.Error(), want)
+		}
+	}
+}
diff --git a/plugins/app-json/functions.go b/plugins/app-json/functions.go
index 5beeb3bda..8fa148b51 100644
--- a/plugins/app-json/functions.go
+++ b/plugins/app-json/functions.go
@@ -182,34 +182,39 @@ func executeScript(appName string, image string, imageTag string, phase string)
 		imageSourceType = "pack"
 	}
 
+	// Both triggers are fatal here, the same way they are on the scheduler's
+	// own deploy path. Swallowing the error meant a plugin refusing to describe
+	// the container - a storage entry belonging to another scheduler, say -
+	// silently produced a deploy task running without the arguments it asked
+	// for, while the identical failure aborted the deploy a moment later.
 	var dockerArgs []string
 	results, err := common.CallPlugnTrigger(common.PlugnTriggerInput{
 		Trigger: "docker-args-deploy",
 		Args:    []string{appName, imageTag},
 		Stdin:   strings.NewReader(""),
 	})
-	if err == nil {
-		words, err := shellquote.Split(results.StdoutContents())
-		if err != nil {
-			return err
-		}
-
-		dockerArgs = append(dockerArgs, words...)
+	if err != nil {
+		return fmt.Errorf("Error getting deploy docker args for %s task: %w", phase, err)
 	}
+	words, err := shellquote.Split(results.StdoutContents())
+	if err != nil {
+		return err
+	}
+	dockerArgs = append(dockerArgs, words...)
 
 	results, err = common.CallPlugnTrigger(common.PlugnTriggerInput{
 		Trigger: "docker-args-process-deploy",
 		Args:    []string{appName, imageSourceType, imageTag},
 		Stdin:   strings.NewReader(""),
 	})
-	if err == nil {
-		words, err := shellquote.Split(results.StdoutContents())
-		if err != nil {
-			return err
-		}
-
-		dockerArgs = append(dockerArgs, words...)
+	if err != nil {
+		return fmt.Errorf("Error getting process deploy docker args for %s task: %w", phase, err)
 	}
+	words, err = shellquote.Split(results.StdoutContents())
+	if err != nil {
+		return err
+	}
+	dockerArgs = append(dockerArgs, words...)
 
 	filteredArgs := []string{
 		"--cpus",
@@ -431,6 +436,10 @@ func setScale(appName string) error {
 	args := []string{appName, strconv.FormatBool(skipDeploy), strconv.FormatBool(clearExisting)}
 	for processType, formation := range appJSON.Formation {
 		if formation.Quantity != nil {
+			if *formation.Quantity < 0 {
+				return fmt.Errorf("Invalid quantity for process type %s in app.json: value must be zero or greater", processType)
+			}
+
 			args = append(args, fmt.Sprintf("%s=%d", processType, *formation.Quantity))
 		}
 	}
diff --git a/plugins/app-json/go.mod b/plugins/app-json/go.mod
index 3ac939757..e5f23ded9 100644
--- a/plugins/app-json/go.mod
+++ b/plugins/app-json/go.mod
@@ -1,20 +1,20 @@
 module github.com/dokku/dokku/plugins/app-json
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
 	github.com/mattn/go-isatty v0.0.24
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 	github.com/tailscale/hujson v0.0.0-20250605163823-992244df8c5a
-	k8s.io/utils v0.0.0-20240102154912-e7106e64919e
+	k8s.io/utils v0.0.0-20260626114624-be93311217bd
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
@@ -24,9 +24,9 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/app-json/go.sum b/plugins/app-json/go.sum
index cb57a8c85..fc873e9ff 100644
--- a/plugins/app-json/go.sum
+++ b/plugins/app-json/go.sum
@@ -1,13 +1,12 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
@@ -20,8 +19,8 @@ github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsRe
 github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -30,31 +29,27 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/tailscale/hujson v0.0.0-20250605163823-992244df8c5a h1:a6TNDN9CgG+cYjaeN8l2mc4kSz2iMiCDQxPEyltUV/I=
 github.com/tailscale/hujson v0.0.0-20250605163823-992244df8c5a/go.mod h1:EbW0wDK/qEUYI0A5bqq0C2kF8JTQwWONmGDBbzsxxHo=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/utils v0.0.0-20240102154912-e7106e64919e h1:eQ/4ljkx21sObifjzXwlPKpdGLrCfRziVtos3ofG/sQ=
-k8s.io/utils v0.0.0-20240102154912-e7106e64919e/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd h1:Ea7fgQ5we8Y9T0OX5o0dAHzQOBRI07D/dEYRaB9ZZEs=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
diff --git a/plugins/app-json/plugin.toml b/plugins/app-json/plugin.toml
index dfd8ea823..9c24a8b30 100644
--- a/plugins/app-json/plugin.toml
+++ b/plugins/app-json/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core app-json plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/app-json/src/triggers/triggers.go b/plugins/app-json/src/triggers/triggers.go
index 862982ac5..3243db5b2 100644
--- a/plugins/app-json/src/triggers/triggers.go
+++ b/plugins/app-json/src/triggers/triggers.go
@@ -22,6 +22,10 @@ func main() {
 		appName := flag.Arg(0)
 		processType := flag.Arg(1)
 		err = appjson.TriggerAppJSONProcessDeployParallelism(appName, processType)
+	case "app-json-is-valid":
+		appName := flag.Arg(0)
+		appJSONPath := flag.Arg(1)
+		err = appjson.TriggerAppJSONIsValid(appName, appJSONPath)
 	case "app-json-get-content":
 		appName := flag.Arg(0)
 		err = appjson.TriggerAppJSONGetContent(appName)
diff --git a/plugins/app-json/triggers.go b/plugins/app-json/triggers.go
index 6d78ce53d..6318203ed 100644
--- a/plugins/app-json/triggers.go
+++ b/plugins/app-json/triggers.go
@@ -35,6 +35,20 @@ func TriggerAppJSONProcessDeployParallelism(appName string, processType string)
 	return nil
 }
 
+// TriggerAppJSONIsValid validates the healthchecks in an extracted app.json file
+func TriggerAppJSONIsValid(appName string, appJSONPath string) error {
+	if !common.FileExists(appJSONPath) {
+		return nil
+	}
+
+	appJSON, err := ReadAppJSON(appJSONPath)
+	if err != nil {
+		return err
+	}
+
+	return validateHealthchecks(appJSON)
+}
+
 // TriggerAppJSONGetContent outputs the contents of the app-json file, if any
 func TriggerAppJSONGetContent(appName string) error {
 	if !hasAppJSON(appName) {
diff --git a/plugins/apps/functions.go b/plugins/apps/functions.go
index f146dec1f..5d271d4f7 100644
--- a/plugins/apps/functions.go
+++ b/plugins/apps/functions.go
@@ -4,6 +4,7 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"syscall"
 	"time"
 
 	"github.com/dokku/dokku/plugins/common"
@@ -14,11 +15,14 @@ func appExists(appName string) error {
 	return common.VerifyAppName(appName)
 }
 
-// checks if an app is locked
+// checks if an app directory already exists, regardless of app visibility
+func appNameTaken(appName string) bool {
+	return common.DirectoryExists(common.AppRoot(appName))
+}
+
+// checks if an app is locked via apps:lock or by an in-progress deploy
 func appIsLocked(appName string) bool {
-	lockPath := getLockPath(appName)
-	_, err := os.Stat(lockPath)
-	return !os.IsNotExist(err)
+	return appIsManuallyLocked(appName) || deployLockHeld(appName)
 }
 
 // verifies app name and creates an app
@@ -27,7 +31,7 @@ func createApp(appName string) error {
 		return err
 	}
 
-	if err := appExists(appName); err == nil {
+	if appNameTaken(appName) {
 		return errors.New("Name is already taken")
 	}
 
@@ -126,6 +130,38 @@ func getLockPath(appName string) string {
 	return fmt.Sprintf("%v/.deploy.lock", common.GetAppDataDirectory("apps", appName))
 }
 
+// returns the path of the lock created by apps:lock
+func getManualLockPath(appName string) string {
+	return fmt.Sprintf("%v/.manual-deploy.lock", common.GetAppDataDirectory("apps", appName))
+}
+
+// checks if an app has been locked via apps:lock
+func appIsManuallyLocked(appName string) bool {
+	_, err := os.Stat(getManualLockPath(appName))
+	return err == nil
+}
+
+// checks if a deploy currently holds the flock on the deploy lock file
+//
+// a shared lock is attempted and immediately released. Deploys taking the
+// lock exclusively wait briefly before failing, so this check does not make
+// a concurrent deploy fail.
+func deployLockHeld(appName string) bool {
+	lockFile, err := os.Open(getLockPath(appName))
+	if err != nil {
+		return false
+	}
+	defer lockFile.Close()
+
+	fd := int(lockFile.Fd())
+	if err := syscall.Flock(fd, syscall.LOCK_SH|syscall.LOCK_NB); err != nil {
+		return errors.Is(err, syscall.EWOULDBLOCK)
+	}
+
+	_ = syscall.Flock(fd, syscall.LOCK_UN)
+	return false
+}
+
 // creates an app if allowed
 func maybeCreateApp(appName string) error {
 	if err := appExists(appName); err == nil {
diff --git a/plugins/apps/go.mod b/plugins/apps/go.mod
index 2fbc6e1ba..2007ebfb5 100644
--- a/plugins/apps/go.mod
+++ b/plugins/apps/go.mod
@@ -1,29 +1,29 @@
 module github.com/dokku/dokku/plugins/apps
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/apps/go.sum b/plugins/apps/go.sum
index 14bf42b1c..9ada61068 100644
--- a/plugins/apps/go.sum
+++ b/plugins/apps/go.sum
@@ -1,25 +1,24 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -28,28 +27,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/apps/plugin.toml b/plugins/apps/plugin.toml
index b08152a82..44a8bdbde 100644
--- a/plugins/apps/plugin.toml
+++ b/plugins/apps/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core apps plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/apps/subcommands.go b/plugins/apps/subcommands.go
index 4538f81d6..93bdaf7b1 100644
--- a/plugins/apps/subcommands.go
+++ b/plugins/apps/subcommands.go
@@ -27,7 +27,7 @@ func CommandClone(oldAppName string, newAppName string, skipDeploy bool, ignoreE
 		return err
 	}
 
-	if err := appExists(newAppName); err == nil {
+	if appNameTaken(newAppName) {
 		if ignoreExisting {
 			common.LogWarn("Name is already taken")
 			return nil
@@ -137,8 +137,11 @@ func CommandLock(appName string) error {
 		return err
 	}
 
-	lockPath := getLockPath(appName)
-	if _, err := os.Create(lockPath); err != nil {
+	lockFile, err := os.OpenFile(getManualLockPath(appName), os.O_CREATE|os.O_WRONLY, 0644)
+	if err != nil {
+		return errors.New("Unable to create deploy lock")
+	}
+	if err := lockFile.Close(); err != nil {
 		return errors.New("Unable to create deploy lock")
 	}
 
@@ -178,10 +181,14 @@ func CommandRename(oldAppName string, newAppName string, skipDeploy bool) error
 		return err
 	}
 
-	if err := appExists(newAppName); err == nil {
+	if appNameTaken(newAppName) {
 		return errors.New("Name is already taken")
 	}
 
+	if appIsManuallyLocked(oldAppName) {
+		return errors.New("Unable to rename a locked app, run apps:unlock first")
+	}
+
 	common.LogInfo1Quiet(fmt.Sprintf("Renaming %s to %s", oldAppName, newAppName))
 	if err := createApp(newAppName); err != nil {
 		return err
@@ -259,13 +266,12 @@ func CommandUnlock(appName string) error {
 		return err
 	}
 
-	lockfilePath := getLockPath(appName)
-	if _, err := os.Stat(lockfilePath); !os.IsNotExist(err) {
+	if deployLockHeld(appName) {
 		common.LogWarn("A deploy may be in progress.")
 		common.LogWarn("Removing the app lock will not stop in progress deploys.")
 	}
 
-	if err := os.Remove(lockfilePath); err != nil {
+	if err := removeLockFiles(getManualLockPath(appName), getLockPath(appName)); err != nil {
 		return errors.New("Unable to remove deploy lock")
 	}
 
diff --git a/plugins/apps/triggers.go b/plugins/apps/triggers.go
index 78526e8a8..6a579e593 100644
--- a/plugins/apps/triggers.go
+++ b/plugins/apps/triggers.go
@@ -83,6 +83,40 @@ func TriggerInstall() error {
 		}
 	}
 
+	for _, appName := range apps {
+		if err := migrateManualLock(appName); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// migrateManualLock converts a lock created by apps:lock before manual locks
+// had their own file. Deploys write their build id into the deploy lock file,
+// so an empty one that no deploy holds was created by apps:lock.
+func migrateManualLock(appName string) error {
+	lockPath := getLockPath(appName)
+	fi, err := os.Stat(lockPath)
+	if err != nil || fi.Size() != 0 || deployLockHeld(appName) {
+		return nil
+	}
+
+	if err := os.Rename(lockPath, getManualLockPath(appName)); err != nil {
+		return fmt.Errorf("Unable to migrate the deploy lock for %s: %w", appName, err)
+	}
+
+	return nil
+}
+
+// removeLockFiles removes the given lock files, ignoring ones that do not exist
+func removeLockFiles(lockPaths ...string) error {
+	for _, lockPath := range lockPaths {
+		if err := os.Remove(lockPath); err != nil && !os.IsNotExist(err) {
+			return err
+		}
+	}
+
 	return nil
 }
 
@@ -93,7 +127,11 @@ func TriggerPostAppCloneSetup(oldAppName string, newAppName string) error {
 		return err
 	}
 
-	return common.CloneAppData("apps", oldAppName, newAppName)
+	if err := common.CloneAppData("apps", oldAppName, newAppName); err != nil {
+		return err
+	}
+
+	return removeLockFiles(getManualLockPath(newAppName), getLockPath(newAppName))
 }
 
 // TriggerPostAppRename removes the old app data
@@ -111,7 +149,11 @@ func TriggerPostAppRenameSetup(oldAppName string, newAppName string) error {
 		return err
 	}
 
-	return common.CloneAppData("apps", oldAppName, newAppName)
+	if err := common.CloneAppData("apps", oldAppName, newAppName); err != nil {
+		return err
+	}
+
+	return removeLockFiles(getLockPath(newAppName))
 }
 
 // TriggerPostCreate ensures apps have the correct data directory structure
diff --git a/plugins/builder-dockerfile/Makefile b/plugins/builder-dockerfile/Makefile
index be9dbcce5..753d42334 100644
--- a/plugins/builder-dockerfile/Makefile
+++ b/plugins/builder-dockerfile/Makefile
@@ -1,4 +1,3 @@
-GOARCH ?= amd64
 TRIGGERS = triggers/report
 BUILD = report-subcommand triggers
 PLUGIN_NAME = builder-dockerfile
diff --git a/plugins/builder-dockerfile/builder-build b/plugins/builder-dockerfile/builder-build
index 7bb83d31a..5a8ce65bc 100755
--- a/plugins/builder-dockerfile/builder-build
+++ b/plugins/builder-dockerfile/builder-build
@@ -279,6 +279,10 @@ trigger-builder-dockerfile-builder-build() {
     esac
   done
 
+  if [[ "$DOKKU_BUILD_NO_CACHE" == "true" ]] && ! fn-in-array "--no-cache" "${DOCKERFILE_ARGS[@]}"; then
+    DOCKERFILE_ARGS+=("--no-cache")
+  fi
+
   eval "$(config_export app "$APP")"
   local DOCKER_CONFIG
   DOCKER_CONFIG="$(fn-registry-docker-config-dir "$APP")"
diff --git a/plugins/builder-dockerfile/go.mod b/plugins/builder-dockerfile/go.mod
index 61e5b91a5..1fff44a21 100644
--- a/plugins/builder-dockerfile/go.mod
+++ b/plugins/builder-dockerfile/go.mod
@@ -1,29 +1,29 @@
 module github.com/dokku/dokku/plugins/builder-dockerfile
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/builder-dockerfile/go.sum b/plugins/builder-dockerfile/go.sum
index 14bf42b1c..9ada61068 100644
--- a/plugins/builder-dockerfile/go.sum
+++ b/plugins/builder-dockerfile/go.sum
@@ -1,25 +1,24 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -28,28 +27,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/builder-dockerfile/plugin.toml b/plugins/builder-dockerfile/plugin.toml
index 1ae98caad..0b1c698ab 100644
--- a/plugins/builder-dockerfile/plugin.toml
+++ b/plugins/builder-dockerfile/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core builder-dockerfile plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/builder-herokuish/Makefile b/plugins/builder-herokuish/Makefile
index 716f94f54..4a9688fd8 100644
--- a/plugins/builder-herokuish/Makefile
+++ b/plugins/builder-herokuish/Makefile
@@ -1,4 +1,3 @@
-GOARCH ?= amd64
 TRIGGERS = triggers/report
 BUILD = report-subcommand triggers
 PLUGIN_NAME = builder-herokuish
diff --git a/plugins/builder-herokuish/builder-build b/plugins/builder-herokuish/builder-build
index 2a800bbf8..ba5f2da1e 100755
--- a/plugins/builder-herokuish/builder-build
+++ b/plugins/builder-herokuish/builder-build
@@ -2,6 +2,7 @@
 set -eo pipefail
 [[ $DOKKU_TRACE ]] && set -x
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
+source "$PLUGIN_AVAILABLE_PATH/builder-herokuish/internal-functions"
 source "$PLUGIN_AVAILABLE_PATH/config/functions"
 
 fn-builder-herokuish-ensure-cache() {
@@ -23,7 +24,8 @@ trigger-builder-herokuish-builder-build() {
     return
   fi
 
-  local stack="$(plugn trigger buildpack-stack-name "$APP")"
+  local stack="$(fn-builder-herokuish-stack "$APP")"
+  [[ -z "$stack" ]] && stack="$(fn-builder-herokuish-global-stack "$APP")"
   if [[ -n "$stack" ]]; then
     dokku_log_info1 "Building $APP from $stack"
     DOKKU_IMAGE="$stack"
@@ -77,6 +79,10 @@ trigger-builder-herokuish-builder-build() {
   done < <(fn-docker-args-split "$DOCKER_ARGS")
 
   local DOKKU_CONTAINER_EXIT_CODE=0
+  if [[ "$DOKKU_BUILD_NO_CACHE" == "true" ]]; then
+    dokku_log_info1 "Clearing build cache"
+    plugn trigger repo-purge-cache "$APP"
+  fi
   fn-builder-herokuish-ensure-cache "$APP"
   if ! CID=$("$DOCKER_BIN" container create "${DOCKER_RUN_LABEL_ARGS[@]}" $DOKKU_GLOBAL_RUN_ARGS -v "cache-$APP:/cache" --env=CACHE_PATH=/cache "${ARG_ARRAY[@]}" "$IMAGE" /build); then
     plugn trigger scheduler-register-retired "$APP" "$CID"
diff --git a/plugins/builder-herokuish/go.mod b/plugins/builder-herokuish/go.mod
index b7f06cd6d..ec8e51a18 100644
--- a/plugins/builder-herokuish/go.mod
+++ b/plugins/builder-herokuish/go.mod
@@ -1,29 +1,29 @@
 module github.com/dokku/dokku/plugins/builder-herokuish
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/builder-herokuish/go.sum b/plugins/builder-herokuish/go.sum
index 14bf42b1c..9ada61068 100644
--- a/plugins/builder-herokuish/go.sum
+++ b/plugins/builder-herokuish/go.sum
@@ -1,25 +1,24 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -28,28 +27,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/builder-herokuish/internal-functions b/plugins/builder-herokuish/internal-functions
index 395f146fd..1fb64ad70 100644
--- a/plugins/builder-herokuish/internal-functions
+++ b/plugins/builder-herokuish/internal-functions
@@ -28,3 +28,27 @@ fn-builder-herokuish-allowed() {
 
   fn-plugin-property-get-default "builder-herokuish" "$APP" "allowed" ""
 }
+
+fn-builder-herokuish-computed-stack() {
+  declare APP="$1"
+
+  stack="$(fn-builder-herokuish-stack "$APP")"
+  if [[ -z "$stack" ]]; then
+    stack="$(fn-builder-herokuish-global-stack "$APP")"
+  fi
+  if [[ -z "$stack" ]]; then
+    stack="${DOKKU_IMAGE:-gliderlabs/herokuish:latest-24}"
+  fi
+
+  echo "$stack"
+}
+
+fn-builder-herokuish-global-stack() {
+  fn-plugin-property-get-default "builder-herokuish" "--global" "stack" ""
+}
+
+fn-builder-herokuish-stack() {
+  declare APP="$1"
+
+  fn-plugin-property-get-default "builder-herokuish" "$APP" "stack" ""
+}
diff --git a/plugins/builder-herokuish/plugin.toml b/plugins/builder-herokuish/plugin.toml
index 8575f08e3..582c3c6d2 100644
--- a/plugins/builder-herokuish/plugin.toml
+++ b/plugins/builder-herokuish/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core builder-herokuish plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/builder-herokuish/report.go b/plugins/builder-herokuish/report.go
index b5ab0b347..a2f6e809f 100644
--- a/plugins/builder-herokuish/report.go
+++ b/plugins/builder-herokuish/report.go
@@ -1,6 +1,8 @@
 package builderherokuish
 
 import (
+	"os"
+
 	"github.com/dokku/dokku/plugins/common"
 )
 
@@ -17,12 +19,17 @@ func ReportSingleApp(appName string, format string, infoFlag string) error {
 		flags = map[string]common.ReportFunc{
 			"--builder-herokuish-computed-allowed": reportComputedAllowed,
 			"--builder-herokuish-global-allowed":   reportGlobalAllowed,
+			"--builder-herokuish-computed-stack":   reportComputedStack,
+			"--builder-herokuish-global-stack":     reportGlobalStack,
 		}
 	} else {
 		flags = map[string]common.ReportFunc{
 			"--builder-herokuish-computed-allowed": reportComputedAllowed,
 			"--builder-herokuish-global-allowed":   reportGlobalAllowed,
 			"--builder-herokuish-allowed":          reportAllowed,
+			"--builder-herokuish-computed-stack":   reportComputedStack,
+			"--builder-herokuish-global-stack":     reportGlobalStack,
+			"--builder-herokuish-stack":            reportStack,
 		}
 	}
 
@@ -68,6 +75,29 @@ func reportComputedAllowed(appName string) string {
 	return allowed
 }
 
+func reportStack(appName string) string {
+	return common.PropertyGet("builder-herokuish", appName, "stack")
+}
+
+func reportGlobalStack(appName string) string {
+	return common.PropertyGet("builder-herokuish", "--global", "stack")
+}
+
+func reportComputedStack(appName string) string {
+	stack := reportStack(appName)
+	if stack == "" {
+		stack = reportGlobalStack(appName)
+	}
+	if stack == "" {
+		stack = os.Getenv("DOKKU_IMAGE")
+	}
+	if stack == "" {
+		stack = "gliderlabs/herokuish:latest-24"
+	}
+
+	return stack
+}
+
 // hostArchitecture returns the dpkg architecture of the host, or an empty string
 // when it cannot be determined (matching the bash `dpkg --print-architecture` check)
 func hostArchitecture() string {
diff --git a/plugins/builder-herokuish/subcommands/set b/plugins/builder-herokuish/subcommands/set
index 777fbb07f..e157a5f57 100755
--- a/plugins/builder-herokuish/subcommands/set
+++ b/plugins/builder-herokuish/subcommands/set
@@ -9,13 +9,13 @@ cmd-builder-herokuish-set() {
   declare cmd="builder-herokuish:set"
   [[ "$1" == "$cmd" ]] && shift 1
   declare APP="$1" KEY="$2" VALUE="$3"
-  local VALID_KEYS=("allowed")
+  local VALID_KEYS=("allowed" "stack")
   [[ "$APP" == "--global" ]] || verify_app_name "$APP"
 
   [[ -z "$KEY" ]] && dokku_log_fail "No key specified"
 
   if ! fn-in-array "$KEY" "${VALID_KEYS[@]}"; then
-    dokku_log_fail "Invalid key specified, valid keys include: allowed"
+    dokku_log_fail "Invalid key specified, valid keys include: allowed, stack"
   fi
 
   if [[ -n "$VALUE" ]]; then
@@ -25,6 +25,14 @@ cmd-builder-herokuish-set() {
     dokku_log_info2_quiet "Unsetting ${KEY}"
     fn-plugin-property-delete "builder-herokuish" "$APP" "$KEY"
   fi
+
+  if [[ "$KEY" == "stack" ]]; then
+    if [[ "$APP" == "--global" ]]; then
+      for app in $(dokku_apps 2>/dev/null || true); do plugn trigger post-stack-set "$app" "$VALUE"; done
+    else
+      plugn trigger post-stack-set "$APP" "$VALUE"
+    fi
+  fi
 }
 
 cmd-builder-herokuish-set "$@"
diff --git a/plugins/builder-lambda/Makefile b/plugins/builder-lambda/Makefile
index 7c29679a8..03457bab8 100644
--- a/plugins/builder-lambda/Makefile
+++ b/plugins/builder-lambda/Makefile
@@ -1,4 +1,3 @@
-GOARCH ?= amd64
 TRIGGERS = triggers/report
 BUILD = report-subcommand triggers
 PLUGIN_NAME = builder-lambda
diff --git a/plugins/builder-lambda/go.mod b/plugins/builder-lambda/go.mod
index ff418fc23..a3cec8352 100644
--- a/plugins/builder-lambda/go.mod
+++ b/plugins/builder-lambda/go.mod
@@ -1,29 +1,29 @@
 module github.com/dokku/dokku/plugins/builder-lambda
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/builder-lambda/go.sum b/plugins/builder-lambda/go.sum
index 14bf42b1c..9ada61068 100644
--- a/plugins/builder-lambda/go.sum
+++ b/plugins/builder-lambda/go.sum
@@ -1,25 +1,24 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -28,28 +27,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/builder-lambda/plugin.toml b/plugins/builder-lambda/plugin.toml
index 975ee6c59..9f1300b79 100644
--- a/plugins/builder-lambda/plugin.toml
+++ b/plugins/builder-lambda/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core builder-lambda plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/builder-nixpacks/Makefile b/plugins/builder-nixpacks/Makefile
index 79979a35e..0d7811801 100644
--- a/plugins/builder-nixpacks/Makefile
+++ b/plugins/builder-nixpacks/Makefile
@@ -1,4 +1,3 @@
-GOARCH ?= amd64
 TRIGGERS = triggers/report
 BUILD = report-subcommand triggers
 PLUGIN_NAME = builder-nixpacks
diff --git a/plugins/builder-nixpacks/builder-build b/plugins/builder-nixpacks/builder-build
index 413f91617..9aad925d4 100755
--- a/plugins/builder-nixpacks/builder-build
+++ b/plugins/builder-nixpacks/builder-build
@@ -244,6 +244,10 @@ trigger-builder-nixpacks-builder-build() {
     esac
   done
 
+  if [[ "$DOKKU_BUILD_NO_CACHE" == "true" ]] && ! fn-in-array "--no-cache" "${NIXPACKS_ARGS[@]}"; then
+    NIXPACKS_ARGS+=("--no-cache")
+  fi
+
   eval "$(config_export app "$APP" --merged)"
 
   local DOCKER_CONFIG
diff --git a/plugins/builder-nixpacks/go.mod b/plugins/builder-nixpacks/go.mod
index f77f2cf25..a0a2f0050 100644
--- a/plugins/builder-nixpacks/go.mod
+++ b/plugins/builder-nixpacks/go.mod
@@ -1,29 +1,29 @@
 module github.com/dokku/dokku/plugins/builder-nixpacks
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/builder-nixpacks/go.sum b/plugins/builder-nixpacks/go.sum
index 14bf42b1c..9ada61068 100644
--- a/plugins/builder-nixpacks/go.sum
+++ b/plugins/builder-nixpacks/go.sum
@@ -1,25 +1,24 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -28,28 +27,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/builder-nixpacks/plugin.toml b/plugins/builder-nixpacks/plugin.toml
index 2a6daddd2..ab1c8334d 100644
--- a/plugins/builder-nixpacks/plugin.toml
+++ b/plugins/builder-nixpacks/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core builder-nixpacks plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/builder-null/plugin.toml b/plugins/builder-null/plugin.toml
index 69e9ef6f1..7ec09917d 100644
--- a/plugins/builder-null/plugin.toml
+++ b/plugins/builder-null/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core builder-null plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/builder-pack/Makefile b/plugins/builder-pack/Makefile
index ab09df0e2..c287d59ec 100644
--- a/plugins/builder-pack/Makefile
+++ b/plugins/builder-pack/Makefile
@@ -1,4 +1,3 @@
-GOARCH ?= amd64
 TRIGGERS = triggers/report
 BUILD = report-subcommand triggers
 PLUGIN_NAME = builder-pack
diff --git a/plugins/builder-pack/builder-build b/plugins/builder-pack/builder-build
index f3a9213ad..2f7e060c0 100755
--- a/plugins/builder-pack/builder-build
+++ b/plugins/builder-pack/builder-build
@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
+source "$PLUGIN_AVAILABLE_PATH/builder-pack/internal-functions"
 source "$PLUGIN_AVAILABLE_PATH/config/functions"
 set -eo pipefail
 [[ $DOKKU_TRACE ]] && set -x
@@ -13,7 +14,8 @@ trigger-builder-pack-builder-build() {
     return
   fi
 
-  local stack="$(plugn trigger buildpack-stack-name "$APP")"
+  local stack="$(fn-builder-pack-stack "$APP")"
+  [[ -z "$stack" ]] && stack="$(fn-builder-pack-global-stack "$APP")"
   if [[ -n "$stack" ]]; then
     DOKKU_CNB_BUILDER="$stack"
   fi
@@ -282,6 +284,10 @@ trigger-builder-pack-builder-build() {
     esac
   done
 
+  if [[ "$DOKKU_BUILD_NO_CACHE" == "true" ]] && ! fn-in-array "--clear-cache" "${PACK_ARGS[@]}"; then
+    PACK_ARGS+=("--clear-cache")
+  fi
+
   if [ -n "$BUILDPACK_URL" ]; then
     PACK_ARGS+=("--builder")
     PACK_ARGS+=("$BUILDPACK_URL")
@@ -299,6 +305,10 @@ trigger-builder-pack-builder-build() {
   local DOCKER_CONFIG
   DOCKER_CONFIG="$(fn-registry-docker-config-dir "$APP")"
   [[ -n "$DOCKER_CONFIG" ]] && export DOCKER_CONFIG
+  if [[ "$(fn-plugin-property-get-default "builder-pack" "$APP" "clear-cache" "false")" == "true" ]]; then
+    fn-in-array "--clear-cache" "${PACK_ARGS[@]}" || PACK_ARGS+=("--clear-cache")
+    fn-plugin-property-delete "builder-pack" "$APP" "clear-cache"
+  fi
   pack build "$IMAGE" --builder "$DOKKU_CNB_BUILDER" --path "$SOURCECODE_WORK_DIR" --default-process web "${PACK_ARGS[@]}" "${ENV_ARGS[@]}"
   docker-image-labeler relabel --label=dokku --label=org.label-schema.schema-version=1.0 --label=org.label-schema.vendor=dokku --label=com.dokku.image-stage=build --label=com.dokku.builder-type=pack --label=com.dokku.app-name=$APP "$IMAGE"
 
diff --git a/plugins/builder-pack/go.mod b/plugins/builder-pack/go.mod
index 6452d6069..90fe41948 100644
--- a/plugins/builder-pack/go.mod
+++ b/plugins/builder-pack/go.mod
@@ -1,29 +1,29 @@
 module github.com/dokku/dokku/plugins/builder-pack
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/builder-pack/go.sum b/plugins/builder-pack/go.sum
index 14bf42b1c..9ada61068 100644
--- a/plugins/builder-pack/go.sum
+++ b/plugins/builder-pack/go.sum
@@ -1,25 +1,24 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -28,28 +27,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/builder-pack/internal-functions b/plugins/builder-pack/internal-functions
index f81f131ea..56359a371 100644
--- a/plugins/builder-pack/internal-functions
+++ b/plugins/builder-pack/internal-functions
@@ -29,3 +29,29 @@ fn-builder-pack-projecttoml-path() {
 
   fn-plugin-property-get-default "builder-pack" "$APP" "projecttoml-path" ""
 }
+
+fn-builder-pack-computed-stack() {
+  declare APP="$1"
+
+  stack="$(fn-builder-pack-stack "$APP")"
+  if [[ "$stack" == "" ]]; then
+    stack="$(fn-builder-pack-global-stack "$APP")"
+  fi
+  if [[ "$stack" == "" ]]; then
+    stack="${DOKKU_CNB_BUILDER:-heroku/builder:24}"
+  fi
+
+  echo "$stack"
+}
+
+fn-builder-pack-global-stack() {
+  declare APP="$1"
+
+  fn-plugin-property-get-default "builder-pack" "--global" "stack" ""
+}
+
+fn-builder-pack-stack() {
+  declare APP="$1"
+
+  fn-plugin-property-get-default "builder-pack" "$APP" "stack" ""
+}
diff --git a/plugins/builder-pack/plugin.toml b/plugins/builder-pack/plugin.toml
index 1bc7def5c..c1b394bab 100644
--- a/plugins/builder-pack/plugin.toml
+++ b/plugins/builder-pack/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core builder-pack plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/builder-pack/report.go b/plugins/builder-pack/report.go
index c1949c457..c87245477 100644
--- a/plugins/builder-pack/report.go
+++ b/plugins/builder-pack/report.go
@@ -1,6 +1,8 @@
 package builderpack
 
 import (
+	"os"
+
 	"github.com/dokku/dokku/plugins/common"
 )
 
@@ -17,12 +19,17 @@ func ReportSingleApp(appName string, format string, infoFlag string) error {
 		flags = map[string]common.ReportFunc{
 			"--builder-pack-computed-projecttoml-path": reportComputedProjecttomlPath,
 			"--builder-pack-global-projecttoml-path":   reportGlobalProjecttomlPath,
+			"--builder-pack-computed-stack":            reportComputedStack,
+			"--builder-pack-global-stack":              reportGlobalStack,
 		}
 	} else {
 		flags = map[string]common.ReportFunc{
 			"--builder-pack-computed-projecttoml-path": reportComputedProjecttomlPath,
 			"--builder-pack-global-projecttoml-path":   reportGlobalProjecttomlPath,
 			"--builder-pack-projecttoml-path":          reportProjecttomlPath,
+			"--builder-pack-computed-stack":            reportComputedStack,
+			"--builder-pack-global-stack":              reportGlobalStack,
+			"--builder-pack-stack":                     reportStack,
 		}
 	}
 
@@ -64,3 +71,26 @@ func reportComputedProjecttomlPath(appName string) string {
 
 	return value
 }
+
+func reportStack(appName string) string {
+	return common.PropertyGet("builder-pack", appName, "stack")
+}
+
+func reportGlobalStack(appName string) string {
+	return common.PropertyGet("builder-pack", "--global", "stack")
+}
+
+func reportComputedStack(appName string) string {
+	value := reportStack(appName)
+	if value == "" {
+		value = reportGlobalStack(appName)
+	}
+	if value == "" {
+		value = os.Getenv("DOKKU_CNB_BUILDER")
+	}
+	if value == "" {
+		value = "heroku/builder:24"
+	}
+
+	return value
+}
diff --git a/plugins/builder-pack/subcommands/set b/plugins/builder-pack/subcommands/set
index 8642d829c..b8021b911 100755
--- a/plugins/builder-pack/subcommands/set
+++ b/plugins/builder-pack/subcommands/set
@@ -9,13 +9,13 @@ cmd-builder-pack-set() {
   declare cmd="builder-pack:set"
   [[ "$1" == "$cmd" ]] && shift 1
   declare APP="$1" KEY="$2" VALUE="$3"
-  local VALID_KEYS=("projecttoml-path")
+  local VALID_KEYS=("projecttoml-path" "stack")
   [[ "$APP" == "--global" ]] || verify_app_name "$APP"
 
   [[ -z "$KEY" ]] && dokku_log_fail "No key specified"
 
   if ! fn-in-array "$KEY" "${VALID_KEYS[@]}"; then
-    dokku_log_fail "Invalid key specified, valid keys include: projecttoml-path"
+    dokku_log_fail "Invalid key specified, valid keys include: projecttoml-path, stack"
   fi
 
   if [[ -n "$VALUE" ]]; then
@@ -25,6 +25,14 @@ cmd-builder-pack-set() {
     dokku_log_info2_quiet "Unsetting ${KEY}"
     fn-plugin-property-delete "builder-pack" "$APP" "$KEY"
   fi
+
+  if [[ "$KEY" == "stack" ]]; then
+    if [[ "$APP" == "--global" ]]; then
+      for app in $(dokku_apps 2>/dev/null || true); do fn-plugin-property-write "builder-pack" "$app" "clear-cache" "true"; done
+    else
+      fn-plugin-property-write "builder-pack" "$APP" "clear-cache" "true"
+    fi
+  fi
 }
 
 cmd-builder-pack-set "$@"
diff --git a/plugins/builder-railpack/Makefile b/plugins/builder-railpack/Makefile
index 73f557fa4..4a82e7a28 100644
--- a/plugins/builder-railpack/Makefile
+++ b/plugins/builder-railpack/Makefile
@@ -1,4 +1,3 @@
-GOARCH ?= amd64
 TRIGGERS = triggers/report
 BUILD = report-subcommand triggers
 PLUGIN_NAME = builder-railpack
diff --git a/plugins/builder-railpack/builder-build b/plugins/builder-railpack/builder-build
index 278a74d52..256a9a0d1 100755
--- a/plugins/builder-railpack/builder-build
+++ b/plugins/builder-railpack/builder-build
@@ -112,7 +112,7 @@ trigger-builder-railpack-builder-build() {
         RAILPACK_ARGS+=("--start-cmd" "${1#--start-cmd=}")
         shift 1
         ;;
-      ---show-plan | --error-missing-start)
+      ---show-plan | --error-missing-start | --no-cache)
         RAILPACK_ARGS+=("$1")
         shift 1
         ;;
@@ -126,6 +126,10 @@ trigger-builder-railpack-builder-build() {
     esac
   done
 
+  if [[ "$DOKKU_BUILD_NO_CACHE" == "true" ]] && ! fn-in-array "--no-cache" "${RAILPACK_ARGS[@]}"; then
+    RAILPACK_ARGS+=("--no-cache")
+  fi
+
   eval "$(config_export app "$APP" --merged)"
 
   local DOCKER_CONFIG
diff --git a/plugins/builder-railpack/go.mod b/plugins/builder-railpack/go.mod
index b0b60a393..fa026d307 100644
--- a/plugins/builder-railpack/go.mod
+++ b/plugins/builder-railpack/go.mod
@@ -1,29 +1,29 @@
 module github.com/dokku/dokku/plugins/builder-railpack
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/builder-railpack/go.sum b/plugins/builder-railpack/go.sum
index 14bf42b1c..9ada61068 100644
--- a/plugins/builder-railpack/go.sum
+++ b/plugins/builder-railpack/go.sum
@@ -1,25 +1,24 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -28,28 +27,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/builder-railpack/plugin.toml b/plugins/builder-railpack/plugin.toml
index 40825daf3..46968136a 100644
--- a/plugins/builder-railpack/plugin.toml
+++ b/plugins/builder-railpack/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core builder-railpack plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/builder/go.mod b/plugins/builder/go.mod
index cf0e242a3..0457e412a 100644
--- a/plugins/builder/go.mod
+++ b/plugins/builder/go.mod
@@ -1,29 +1,29 @@
 module github.com/dokku/dokku/plugins/builder
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/builder/go.sum b/plugins/builder/go.sum
index 14bf42b1c..9ada61068 100644
--- a/plugins/builder/go.sum
+++ b/plugins/builder/go.sum
@@ -1,25 +1,24 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -28,28 +27,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/builder/plugin.toml b/plugins/builder/plugin.toml
index c56f18468..8491a5a4a 100644
--- a/plugins/builder/plugin.toml
+++ b/plugins/builder/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core builder plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/builder/report.go b/plugins/builder/report.go
index f7d2d263d..10a1ba48a 100644
--- a/plugins/builder/report.go
+++ b/plugins/builder/report.go
@@ -15,10 +15,10 @@ func ReportSingleApp(appName string, format string, infoFlag string) error {
 	var flags map[string]common.ReportFunc
 	if appName == "--global" {
 		flags = map[string]common.ReportFunc{
-			"--builder-global-selected":        reportGlobalSelected,
-			"--builder-global-build-dir":       reportGlobalBuildDir,
-			"--builder-global-skip-cleanup":    reportGlobalSkipCleanup,
-			"--builder-computed-skip-cleanup":  reportComputedSkipCleanup,
+			"--builder-global-selected":       reportGlobalSelected,
+			"--builder-global-build-dir":      reportGlobalBuildDir,
+			"--builder-global-skip-cleanup":   reportGlobalSkipCleanup,
+			"--builder-computed-skip-cleanup": reportComputedSkipCleanup,
 		}
 	} else {
 		flags = map[string]common.ReportFunc{
diff --git a/plugins/buildpacks/.gitignore b/plugins/buildpacks/.gitignore
index 9929fd526..291036bd4 100644
--- a/plugins/buildpacks/.gitignore
+++ b/plugins/buildpacks/.gitignore
@@ -2,7 +2,6 @@
 /subcommands/*
 /triggers/*
 /triggers
-/buildpack-stack-name
 /install
 /post-*
 /report
diff --git a/plugins/buildpacks/Makefile b/plugins/buildpacks/Makefile
index 70ed37a5f..f6fe7c51d 100644
--- a/plugins/buildpacks/Makefile
+++ b/plugins/buildpacks/Makefile
@@ -1,5 +1,5 @@
 SUBCOMMANDS = subcommands/add subcommands/clear subcommands/detect subcommands/list subcommands/remove subcommands/report subcommands/set subcommands/set-property
-TRIGGERS = triggers/buildpack-stack-name triggers/install triggers/post-app-clone-setup triggers/post-app-rename-setup triggers/post-delete triggers/post-extract triggers/report
+TRIGGERS = triggers/install triggers/post-app-clone-setup triggers/post-app-rename-setup triggers/post-delete triggers/post-extract triggers/report
 BUILD = commands subcommands triggers
 PLUGIN_NAME = buildpacks
 
diff --git a/plugins/buildpacks/buildpacks.go b/plugins/buildpacks/buildpacks.go
index 8f4e3b956..078f7c3f1 100644
--- a/plugins/buildpacks/buildpacks.go
+++ b/plugins/buildpacks/buildpacks.go
@@ -1,13 +1,24 @@
 package buildpacks
 
+import "strings"
+
 var (
 	// DefaultProperties is a map of all valid buildpacks properties with corresponding default property values
-	DefaultProperties = map[string]string{
-		"stack": "",
-	}
+	DefaultProperties = map[string]string{}
 
 	// GlobalProperties is a map of all valid global buildpacks properties
-	GlobalProperties = map[string]bool{
-		"stack": true,
-	}
+	GlobalProperties = map[string]bool{}
 )
+
+// isHerokuishStack reports whether a stack value targets the herokuish builder
+func isHerokuishStack(value string) bool {
+	return strings.Contains(value, "herokuish")
+}
+
+// builderForStack returns the builder plugin name a stack value should be written to
+func builderForStack(value string) string {
+	if isHerokuishStack(value) {
+		return "builder-herokuish"
+	}
+	return "builder-pack"
+}
diff --git a/plugins/buildpacks/go.mod b/plugins/buildpacks/go.mod
index 316f6f6da..fa3f7f886 100644
--- a/plugins/buildpacks/go.mod
+++ b/plugins/buildpacks/go.mod
@@ -1,19 +1,19 @@
 module github.com/dokku/dokku/plugins/buildpacks
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/app-json v0.0.0-00010101000000-000000000000
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
-	github.com/onsi/gomega v1.42.1
-	github.com/spf13/pflag v1.0.10
+	github.com/onsi/gomega v1.44.0
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/kr/fs v0.1.0 // indirect
@@ -26,13 +26,13 @@ require (
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
 	github.com/tailscale/hujson v0.0.0-20250605163823-992244df8c5a // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/net v0.57.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/text v0.41.0 // indirect
-	k8s.io/utils v0.0.0-20240102154912-e7106e64919e // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/net v0.60.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/text v0.43.0 // indirect
+	k8s.io/utils v0.0.0-20260626114624-be93311217bd // indirect
 )
 
 replace github.com/dokku/dokku/plugins/app-json => ../app-json
diff --git a/plugins/buildpacks/go.sum b/plugins/buildpacks/go.sum
index 920122a03..fc873e9ff 100644
--- a/plugins/buildpacks/go.sum
+++ b/plugins/buildpacks/go.sum
@@ -1,13 +1,12 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
@@ -20,8 +19,8 @@ github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsRe
 github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -30,33 +29,27 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/tailscale/hujson v0.0.0-20250605163823-992244df8c5a h1:a6TNDN9CgG+cYjaeN8l2mc4kSz2iMiCDQxPEyltUV/I=
 github.com/tailscale/hujson v0.0.0-20250605163823-992244df8c5a/go.mod h1:EbW0wDK/qEUYI0A5bqq0C2kF8JTQwWONmGDBbzsxxHo=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/utils v0.0.0-20240102154912-e7106e64919e h1:eQ/4ljkx21sObifjzXwlPKpdGLrCfRziVtos3ofG/sQ=
-k8s.io/utils v0.0.0-20240102154912-e7106e64919e/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd h1:Ea7fgQ5we8Y9T0OX5o0dAHzQOBRI07D/dEYRaB9ZZEs=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
diff --git a/plugins/buildpacks/plugin.toml b/plugins/buildpacks/plugin.toml
index 2550919c6..637a3a274 100644
--- a/plugins/buildpacks/plugin.toml
+++ b/plugins/buildpacks/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core buildpacks plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/buildpacks/report.go b/plugins/buildpacks/report.go
index a2a2221a6..31510db78 100644
--- a/plugins/buildpacks/report.go
+++ b/plugins/buildpacks/report.go
@@ -1,7 +1,6 @@
 package buildpacks
 
 import (
-	"os"
 	"strings"
 
 	"github.com/dokku/dokku/plugins/common"
@@ -17,15 +16,10 @@ func ReportSingleApp(appName string, format string, infoFlag string) error {
 
 	var flags map[string]common.ReportFunc
 	if appName == "--global" {
-		flags = map[string]common.ReportFunc{
-			"--buildpacks-global-stack": reportGlobalStack,
-		}
+		flags = map[string]common.ReportFunc{}
 	} else {
 		flags = map[string]common.ReportFunc{
-			"--buildpacks-computed-stack": reportComputedStack,
-			"--buildpacks-global-stack":   reportGlobalStack,
-			"--buildpacks-list":           reportList,
-			"--buildpacks-stack":          reportStack,
+			"--buildpacks-list": reportList,
 		}
 	}
 
@@ -48,31 +42,6 @@ func ReportSingleApp(appName string, format string, infoFlag string) error {
 	})
 }
 
-func reportComputedStack(appName string) string {
-	if stack := common.PropertyGetDefault("buildpacks", appName, "stack", ""); stack != "" {
-		return stack
-	}
-
-	if stack := common.PropertyGetDefault("buildpacks", "--global", "stack", ""); stack != "" {
-		return stack
-	}
-
-	results, _ := common.CallPlugnTrigger(common.PlugnTriggerInput{
-		Trigger: "config-get",
-		Args:    []string{appName, "DOKKU_IMAGE"},
-	})
-	if dokkuImage := results.StdoutContents(); dokkuImage != "" {
-		common.LogWarn("Deprecated: use buildpacks:set-property instead of specifying DOKKU_IMAGE environment variable")
-		return dokkuImage
-	}
-
-	return os.Getenv("DOKKU_IMAGE")
-}
-
-func reportGlobalStack(appName string) string {
-	return common.PropertyGetDefault("buildpacks", "--global", "stack", "")
-}
-
 func reportList(appName string) string {
 	buildpacks, err := common.PropertyListGet("buildpacks", appName, "buildpacks")
 	if err != nil {
@@ -81,7 +50,3 @@ func reportList(appName string) string {
 
 	return strings.Join(buildpacks, ",")
 }
-
-func reportStack(appName string) string {
-	return common.PropertyGetDefault("buildpacks", appName, "stack", "")
-}
diff --git a/plugins/buildpacks/src/subcommands/subcommands.go b/plugins/buildpacks/src/subcommands/subcommands.go
index 8f110e20b..0e25c029f 100644
--- a/plugins/buildpacks/src/subcommands/subcommands.go
+++ b/plugins/buildpacks/src/subcommands/subcommands.go
@@ -36,7 +36,7 @@ func main() {
 		args.Parse(os.Args[2:])
 		appName := args.Arg(0)
 		if *branch == "" {
-            *branch = common.PropertyGet("git", appName, "deploy-branch")
+			*branch = common.PropertyGet("git", appName, "deploy-branch")
 		}
 		err = buildpacks.CommandDetect(appName, *branch)
 	case "list":
diff --git a/plugins/buildpacks/src/triggers/triggers.go b/plugins/buildpacks/src/triggers/triggers.go
index cf33fd006..b6df0961f 100644
--- a/plugins/buildpacks/src/triggers/triggers.go
+++ b/plugins/buildpacks/src/triggers/triggers.go
@@ -18,9 +18,6 @@ func main() {
 
 	var err error
 	switch trigger {
-	case "buildpack-stack-name":
-		appName := flag.Arg(0)
-		err = buildpacks.TriggerBuildpackStackName(appName)
 	case "install":
 		err = buildpacks.TriggerInstall()
 	case "post-app-clone-setup":
diff --git a/plugins/buildpacks/subcommands.go b/plugins/buildpacks/subcommands.go
index f57b97c17..ef579429d 100644
--- a/plugins/buildpacks/subcommands.go
+++ b/plugins/buildpacks/subcommands.go
@@ -39,9 +39,9 @@ func CommandDetect(appName string, branch string) (err error) {
 
 	workDir := common.AppRoot(appName)
 	checkedOutDir, err := checkoutBareGitRepo(workDir, branch)
-    if err != nil {
-        return err
-    }
+	if err != nil {
+		return err
+	}
 	defer func() {
 		if err := os.RemoveAll(checkedOutDir); err != nil {
 			common.LogWarn(fmt.Sprintf("Failed to remove temporary directory %s: %v", checkedOutDir, err))
@@ -215,35 +215,64 @@ func setBuildpackList(appName string, buildpacks []string, index int) error {
 
 // CommandSetProperty implements buildpacks:set-property
 func CommandSetProperty(appName string, property string, value string) error {
-	oldStack := ""
-	if property == "stack" {
-		oldStack = common.PropertyGet("buildpacks", appName, "stack")
+	if property != "stack" {
+		common.CommandPropertySet("buildpacks", appName, property, value, DefaultProperties, GlobalProperties)
+		return nil
 	}
 
-	common.CommandPropertySet("buildpacks", appName, property, value, DefaultProperties, GlobalProperties)
-	if property == "stack" && oldStack != value {
-		if appName != "--global" {
-			_, err := common.CallPlugnTrigger(common.PlugnTriggerInput{
-				Trigger:     "post-stack-set",
-				Args:        []string{appName, value},
-				StreamStdio: true,
-			})
+	if value != "" {
+		builder := builderForStack(value)
+		common.LogWarn(fmt.Sprintf("Deprecated: buildpacks:set-property stack is deprecated, use %s:set stack instead", builder))
+		if err := common.PropertyWrite(builder, appName, "stack", value); err != nil {
 			return err
 		}
+		return clearBuilderCache(builder, appName)
+	}
 
-		apps, err := common.DokkuApps()
-		if err != nil && !errors.Is(err, common.NoAppsExist) {
+	common.LogWarn("Deprecated: buildpacks:set-property stack is deprecated, use builder-herokuish:set stack or builder-pack:set stack instead")
+	for _, builder := range []string{"builder-herokuish", "builder-pack"} {
+		if err := common.PropertyDelete(builder, appName, "stack"); err != nil {
 			return err
 		}
-		for _, app := range apps {
-			_, err := common.CallPlugnTrigger(common.PlugnTriggerInput{
-				Trigger:     "post-stack-set",
-				Args:        []string{app, value},
-				StreamStdio: true,
-			})
-			if err != nil {
-				return err
-			}
+		if err := clearBuilderCache(builder, appName); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// clearBuilderCache clears the build cache for the given builder after a stack
+// change. The herokuish cache is the cache-$APP volume removed by repo via the
+// post-stack-set trigger, while the pack cache lives in pack-managed volumes and
+// is cleared by flagging the next build to run with --clear-cache.
+func clearBuilderCache(builder string, appName string) error {
+	apps := []string{appName}
+	if appName == "--global" {
+		dokkuApps, err := common.DokkuApps()
+		if err != nil {
+			if errors.Is(err, common.NoAppsExist) {
+				return nil
+			}
+			return err
+		}
+		apps = dokkuApps
+	}
+
+	for _, app := range apps {
+		if builder == "builder-herokuish" {
+			if _, err := common.CallPlugnTrigger(common.PlugnTriggerInput{
+				Trigger:     "post-stack-set",
+				Args:        []string{app, ""},
+				StreamStdio: true,
+			}); err != nil {
+				return err
+			}
+			continue
+		}
+
+		if err := common.PropertyWrite("builder-pack", app, "clear-cache", "true"); err != nil {
+			return err
 		}
 	}
 
diff --git a/plugins/buildpacks/triggers.go b/plugins/buildpacks/triggers.go
index fce9ecd5d..a107961b0 100644
--- a/plugins/buildpacks/triggers.go
+++ b/plugins/buildpacks/triggers.go
@@ -2,6 +2,7 @@ package buildpacks
 
 import (
 	"bufio"
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -9,38 +10,46 @@ import (
 	"github.com/dokku/dokku/plugins/common"
 )
 
-// TriggerBuildpackStackName echos the stack name for the app
-func TriggerBuildpackStackName(appName string) error {
-	if stack := common.PropertyGetDefault("buildpacks", appName, "stack", ""); stack != "" {
-		fmt.Println(stack)
-		return nil
-	}
-
-	if stack := common.PropertyGetDefault("buildpacks", "--global", "stack", ""); stack != "" {
-		fmt.Println(stack)
-		return nil
-	}
-
-	results, _ := common.CallPlugnTrigger(common.PlugnTriggerInput{
-		Trigger: "config-get",
-		Args:    []string{appName, "DOKKU_IMAGE"},
-	})
-	dokkuImage := results.StdoutContents()
-	if dokkuImage != "" {
-		common.LogWarn("Deprecated: use buildpacks:set-property instead of specifying DOKKU_IMAGE environment variable")
-		fmt.Println(dokkuImage)
-		return nil
-	}
-
-	return nil
-}
-
 // TriggerInstall runs the install step for the buildpacks plugin
 func TriggerInstall() error {
 	if err := common.PropertySetup("buildpacks"); err != nil {
 		return fmt.Errorf("Unable to install the buildpacks plugin: %s", err.Error())
 	}
 
+	return migrateStackProperty()
+}
+
+// migrateStackProperty moves any legacy buildpacks stack values to the
+// appropriate builder plugin, detecting herokuish vs pack stacks. It is
+// idempotent: once a value is migrated the buildpacks stack key is removed.
+func migrateStackProperty() error {
+	appNames := []string{"--global"}
+	apps, err := common.DokkuApps()
+	if err != nil && !errors.Is(err, common.NoAppsExist) {
+		return err
+	}
+	appNames = append(appNames, apps...)
+
+	for _, appName := range appNames {
+		if !common.PropertyExists("buildpacks", appName, "stack") {
+			continue
+		}
+
+		value := common.PropertyGet("buildpacks", appName, "stack")
+		if value != "" {
+			builder := builderForStack(value)
+			if !common.PropertyExists(builder, appName, "stack") {
+				if err := common.PropertyWrite(builder, appName, "stack", value); err != nil {
+					return err
+				}
+			}
+		}
+
+		if err := common.PropertyDelete("buildpacks", appName, "stack"); err != nil {
+			return err
+		}
+	}
+
 	return nil
 }
 
diff --git a/plugins/builds/.gitignore b/plugins/builds/.gitignore
index ec242ac8a..f245b5926 100644
--- a/plugins/builds/.gitignore
+++ b/plugins/builds/.gitignore
@@ -3,6 +3,7 @@
 /triggers/*
 /triggers
 /builds-generate-id
+/builds-record-discard
 /builds-record-finalize
 /builds-record-start
 /install
diff --git a/plugins/builds/Makefile b/plugins/builds/Makefile
index f1ce6dc1f..6d47f2e6e 100644
--- a/plugins/builds/Makefile
+++ b/plugins/builds/Makefile
@@ -1,5 +1,5 @@
 SUBCOMMANDS = subcommands/cancel subcommands/info subcommands/list subcommands/output subcommands/prune subcommands/report subcommands/set
-TRIGGERS = triggers/builds-generate-id triggers/builds-record-finalize triggers/builds-record-start triggers/install triggers/post-app-rename-setup triggers/post-delete
+TRIGGERS = triggers/builds-generate-id triggers/builds-record-discard triggers/builds-record-finalize triggers/builds-record-start triggers/install triggers/post-app-rename-setup triggers/post-delete
 BUILD = commands subcommands triggers
 PLUGIN_NAME = builds
 
diff --git a/plugins/builds/builds.go b/plugins/builds/builds.go
index 80b0bed4b..826c82a6a 100644
--- a/plugins/builds/builds.go
+++ b/plugins/builds/builds.go
@@ -436,6 +436,30 @@ func PruneAppBuilds(appName string) error {
 	return nil
 }
 
+// DiscardBuild removes a build record and its log outright. It exists for
+// callers that start a record and then discover there was nothing to build:
+// leaving such a record at status=running means it is later reaped as a
+// spurious failure, and counts against retention in the meantime.
+//
+// It is a no-op for a record that is missing or already terminal - discarding
+// a finalized build would delete real history.
+func DiscardBuild(appName, buildID string) error {
+	b, err := ReadBuild(appName, buildID)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+
+	if b.Status.IsTerminal() {
+		return nil
+	}
+
+	removeBuildFiles(appName, buildID)
+	return nil
+}
+
 func removeBuildFiles(appName, buildID string) {
 	if err := os.Remove(RecordPath(appName, buildID)); err != nil && !os.IsNotExist(err) {
 		common.LogWarn(fmt.Sprintf("Could not remove build record %s/%s: %s", appName, buildID, err))
diff --git a/plugins/builds/builds_test.go b/plugins/builds/builds_test.go
index 235a1315c..79d4d9bd5 100644
--- a/plugins/builds/builds_test.go
+++ b/plugins/builds/builds_test.go
@@ -553,6 +553,72 @@ func TestRecordStartFinalizeIdempotency(t *testing.T) {
 	}
 }
 
+func TestRecordDiscardRemovesRunningRecord(t *testing.T) {
+	setupTestRoot(t)
+	app := "discard"
+	id := GenerateBuildID()
+
+	if err := TriggerBuildsRecordStart(app, id, strconv.Itoa(os.Getpid()), string(BuildSourceGitSync)); err != nil {
+		t.Fatalf("record-start: %v", err)
+	}
+	if err := os.WriteFile(LogPathFor(app, id), []byte("fetch chatter\n"), 0644); err != nil {
+		t.Fatalf("write log: %v", err)
+	}
+
+	if err := TriggerBuildsRecordDiscard(app, id); err != nil {
+		t.Fatalf("record-discard: %v", err)
+	}
+
+	if _, err := os.Stat(RecordPath(app, id)); !os.IsNotExist(err) {
+		t.Errorf("record still present after discard, stat err = %v", err)
+	}
+	if _, err := os.Stat(LogPathFor(app, id)); !os.IsNotExist(err) {
+		t.Errorf("log still present after discard, stat err = %v", err)
+	}
+}
+
+func TestRecordDiscardLeavesTerminalRecordsAlone(t *testing.T) {
+	setupTestRoot(t)
+	app := "discard-terminal"
+	id := GenerateBuildID()
+
+	if err := TriggerBuildsRecordStart(app, id, strconv.Itoa(os.Getpid()), string(BuildSourceGitSync)); err != nil {
+		t.Fatalf("record-start: %v", err)
+	}
+	if err := TriggerBuildsRecordFinalize(app, id, "0"); err != nil {
+		t.Fatalf("finalize: %v", err)
+	}
+
+	if err := TriggerBuildsRecordDiscard(app, id); err != nil {
+		t.Fatalf("record-discard: %v", err)
+	}
+
+	got, err := ReadBuild(app, id)
+	if err != nil {
+		t.Fatalf("read after discard: %v", err)
+	}
+	if got.Status != BuildStatusSucceeded {
+		t.Errorf("Status = %v, want succeeded (discard must not touch finalized history)", got.Status)
+	}
+}
+
+func TestRecordDiscardMissingRecordIsNoop(t *testing.T) {
+	setupTestRoot(t)
+	if err := TriggerBuildsRecordDiscard("discard-missing", GenerateBuildID()); err != nil {
+		t.Errorf("discard of missing record = %v, want nil", err)
+	}
+}
+
+func TestRecordDiscardValidatesArguments(t *testing.T) {
+	setupTestRoot(t)
+	if err := TriggerBuildsRecordDiscard("", "abc"); err == nil {
+		t.Error("discard with empty app = nil, want error")
+	}
+	if err := TriggerBuildsRecordDiscard("app", ""); err == nil {
+		t.Error("discard with empty build id = nil, want error")
+	}
+}
+
 func TestRecordStartUnknownSourceCoercedToUnknown(t *testing.T) {
 	setupTestRoot(t)
 	app := "src"
@@ -609,3 +675,53 @@ func TestBuildJSONShape(t *testing.T) {
 		t.Errorf("kind not serialized as enum string: %s", string(raw))
 	}
 }
+
+func setupTestAppRoot(t *testing.T, libRoot, appName string) {
+	t.Helper()
+	dokkuRoot := filepath.Join(libRoot, "dokku-root")
+	if err := os.MkdirAll(filepath.Join(dokkuRoot, appName), 0755); err != nil {
+		t.Fatalf("mkdir app root: %v", err)
+	}
+	t.Setenv("DOKKU_ROOT", dokkuRoot)
+}
+
+func TestCommandOutputRejectsUnknownBuildID(t *testing.T) {
+	tmp := setupTestRoot(t)
+	app := "demo"
+	setupTestAppRoot(t, tmp, app)
+
+	err := CommandOutput(app, "not-a-real-build-id")
+	if err == nil {
+		t.Fatal("expected error for unknown build id")
+	}
+	want := "no such build not-a-real-build-id for app demo"
+	if err.Error() != want {
+		t.Fatalf("got %q, want %q", err.Error(), want)
+	}
+}
+
+func TestCommandOutputMissingLogWithRecordDoesNotClaimUnknown(t *testing.T) {
+	tmp := setupTestRoot(t)
+	app := "demo"
+	setupTestAppRoot(t, tmp, app)
+
+	b := Build{
+		ID:        "abc123xyz00001",
+		App:       app,
+		Kind:      BuildKindBuild,
+		PID:       1,
+		StartedAt: time.Now().UTC().Truncate(time.Second),
+		Status:    BuildStatusSucceeded,
+		Source:    BuildSourceGitHook,
+	}
+	if err := WriteBuild(b); err != nil {
+		t.Fatalf("WriteBuild: %v", err)
+	}
+
+	err := CommandOutput(app, b.ID)
+	if err != nil && strings.Contains(err.Error(), "no such build") {
+		t.Fatalf("existing record should not be reported unknown: %v", err)
+	}
+	// Without a log file, the next step is journalctl (or a clear "not available"
+	// error). Either outcome is fine; the regression is the false "success".
+}
diff --git a/plugins/builds/go.mod b/plugins/builds/go.mod
index 7fabe1668..0d1956738 100644
--- a/plugins/builds/go.mod
+++ b/plugins/builds/go.mod
@@ -1,30 +1,30 @@
 module github.com/dokku/dokku/plugins/builds
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
 	github.com/multiformats/go-base36 v0.2.0
 	github.com/ryanuber/columnize v2.1.2+incompatible
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/builds/go.sum b/plugins/builds/go.sum
index 154d9f466..8015b2798 100644
--- a/plugins/builds/go.sum
+++ b/plugins/builds/go.sum
@@ -1,27 +1,26 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
 github.com/multiformats/go-base36 v0.2.0 h1:lFsAbNOGeKtuKozrtBsAkSVhv1p9D0/qedU9rQyccr0=
 github.com/multiformats/go-base36 v0.2.0/go.mod h1:qvnKE++v+2MWCfePClUEjE78Z7P2a1UV0xHgWc0hkp4=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -30,28 +29,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/builds/src/triggers/triggers.go b/plugins/builds/src/triggers/triggers.go
index 9f283bd4e..fcdf2343d 100644
--- a/plugins/builds/src/triggers/triggers.go
+++ b/plugins/builds/src/triggers/triggers.go
@@ -19,6 +19,10 @@ func main() {
 	switch trigger {
 	case "builds-generate-id":
 		err = builds.TriggerBuildsGenerateID()
+	case "builds-record-discard":
+		appName := flag.Arg(0)
+		buildID := flag.Arg(1)
+		err = builds.TriggerBuildsRecordDiscard(appName, buildID)
 	case "builds-record-finalize":
 		appName := flag.Arg(0)
 		buildID := flag.Arg(1)
diff --git a/plugins/builds/subcommands.go b/plugins/builds/subcommands.go
index 390d0d97d..e9f321e11 100644
--- a/plugins/builds/subcommands.go
+++ b/plugins/builds/subcommands.go
@@ -319,15 +319,12 @@ func CommandCancel(appName string) error {
 		if err := WriteBuild(b); err != nil {
 			return err
 		}
-		_ = os.Remove(lockPath)
+		removeLockForBuild(lockPath, buildID)
 		return nil
 	}
 
-	common.LogInfo1("Killing app deploy")
-	if err := killProcessGroup(b.PID); err != nil {
-		common.LogWarn(fmt.Sprintf("Failed to signal process group %d: %s", b.PID, err))
-	}
-
+	// the record is finalized before the signal is sent so that a deploy
+	// finalizing itself on exit leaves it as canceled
 	current, err := ReadBuild(appName, buildID)
 	if err == nil && current.Status == BuildStatusRunning {
 		now := time.Now().UTC()
@@ -340,10 +337,30 @@ func CommandCancel(appName string) error {
 		}
 	}
 
-	_ = os.Remove(lockPath)
+	common.LogInfo1("Killing app deploy")
+	if err := killProcessGroup(b.PID); err != nil {
+		common.LogWarn(fmt.Sprintf("Failed to signal process group %d: %s", b.PID, err))
+	}
+
+	removeLockForBuild(lockPath, buildID)
 	return nil
 }
 
+// removeLockForBuild removes the deploy lock file if it still holds the given
+// build id, leaving a lock taken by a newer deploy in place
+func removeLockForBuild(lockPath string, buildID string) {
+	body, err := os.ReadFile(lockPath)
+	if err != nil {
+		return
+	}
+
+	if strings.TrimSpace(string(body)) != buildID {
+		return
+	}
+
+	_ = os.Remove(lockPath)
+}
+
 func killProcessGroup(pid int) error {
 	pgid, err := syscall.Getpgid(pid)
 	if err != nil {
@@ -381,6 +398,14 @@ func CommandOutput(appName, buildID string) error {
 	logPath := LogPathFor(appName, buildID)
 	if _, err := os.Stat(logPath); err != nil {
 		if os.IsNotExist(err) {
+			// A missing log is normal after prune/rotation, but a typo'd or
+			// never-recorded id must not fall through to journalctl and exit 0.
+			if _, err := ReadBuild(appName, buildID); err != nil {
+				if os.IsNotExist(err) {
+					return fmt.Errorf("no such build %s for app %s", buildID, appName)
+				}
+				return err
+			}
 			return outputViaJournalctl(buildID)
 		}
 		return err
diff --git a/plugins/builds/triggers.go b/plugins/builds/triggers.go
index 2b44a16bf..54e2a7e6f 100644
--- a/plugins/builds/triggers.go
+++ b/plugins/builds/triggers.go
@@ -96,6 +96,23 @@ func TriggerBuildsRecordStart(appName, buildID, pidStr, sourceStr string) error
 	return WriteBuild(b)
 }
 
+// TriggerBuildsRecordDiscard drops a record that was started before the caller
+// knew whether it would build anything - the git:sync no-op paths, which fetch
+// first and only then discover there is nothing to deploy. Records that are
+// missing or already terminal are left alone.
+//
+// Args: <app> <build-id>
+func TriggerBuildsRecordDiscard(appName, buildID string) error {
+	if appName == "" {
+		return errors.New("builds-record-discard: missing app name")
+	}
+	if buildID == "" {
+		return errors.New("builds-record-discard: missing build id")
+	}
+
+	return DiscardBuild(appName, buildID)
+}
+
 // TriggerBuildsRecordFinalize writes the terminal status onto an existing
 // build record. It is idempotent: records that are already terminal (or have
 // been overwritten by an earlier finalize) are left untouched.
diff --git a/plugins/caddy-vhosts/Makefile b/plugins/caddy-vhosts/Makefile
index f0ee8b444..596187a1a 100644
--- a/plugins/caddy-vhosts/Makefile
+++ b/plugins/caddy-vhosts/Makefile
@@ -1,4 +1,3 @@
-GOARCH ?= amd64
 TRIGGERS = triggers/report
 BUILD = report-subcommand triggers
 PLUGIN_NAME = caddy-vhosts
diff --git a/plugins/caddy-vhosts/docker-args-process-deploy b/plugins/caddy-vhosts/docker-args-process-deploy
index 829eee944..8d0076f0e 100755
--- a/plugins/caddy-vhosts/docker-args-process-deploy
+++ b/plugins/caddy-vhosts/docker-args-process-deploy
@@ -14,11 +14,27 @@ trigger-caddy-vhosts-docker-args-process-deploy() {
   local proxy_container_https_port proxy_container_https_port_candidate proxy_host_https_port_candidate
   local STDIN=$(cat)
 
-  if [[ "$PROC_TYPE" != "web" ]]; then
+  if [[ "$(plugn trigger proxy-type "$APP")" != "caddy" ]]; then
     return
   fi
 
-  if [[ "$(plugn trigger proxy-type "$APP")" != "caddy" ]]; then
+  if [[ "$PROC_TYPE" != "web" ]]; then
+    # Non-web processes are only labeled when at least one path-based route
+    # targets the process. Otherwise caddy-docker-proxy should ignore the
+    # container entirely.
+    local route_proc
+    local has_route=false
+    while IFS='|' read -r route_proc _ _ _; do
+      if [[ "$route_proc" == "$PROC_TYPE" ]]; then
+        has_route=true
+        break
+      fi
+    done < <(plugn trigger proxy-routes-list "$APP")
+    if [[ "$has_route" != "true" ]]; then
+      echo -n "$STDIN"
+      return
+    fi
+    fn-caddy-route-labels "$APP" "$PROC_TYPE" "$STDIN"
     return
   fi
 
@@ -84,9 +100,24 @@ trigger-caddy-vhosts-docker-args-process-deploy() {
     caddy_domains="${caddy_domains// /, }"
   fi
 
+  # If any path-based route exists for this app, the route emission on the
+  # non-web container puts a `handle @<slug>` block in the site. For caddy to
+  # honor that, web's `reverse_proxy` must also be wrapped in a `handle`
+  # block (both at directive order ~210) so caddy's mutually-exclusive
+  # handle logic picks the route handle for matched paths and falls through
+  # to the catch-all handle for everything else. Without this, web's bare
+  # reverse_proxy (~190) catches every request before any handle runs.
+  local has_routes=false
+  while IFS='|' read -r route_proc _ _ _; do
+    if [[ -n "$route_proc" ]]; then
+      has_routes=true
+      break
+    fi
+  done < <(plugn trigger proxy-routes-list "$APP")
+
   # add the labels for caddy here
   # prefer the https:443 mapping to http:80 mapping
-  if [[ -n "$is_app_listening" ]] && [[ -n "$caddy_domains" ]]; then
+  if [[ "$is_app_listening" == "true" ]] && [[ -n "$caddy_domains" ]]; then
     has_443_mapping=false
     tls_internal="$(fn-caddy-computed-tls-internal "$APP")"
     if [[ -n "$proxy_container_https_port" ]] || [[ -n "$proxy_container_https_port_candidate" ]]; then
@@ -95,7 +126,6 @@ trigger-caddy-vhosts-docker-args-process-deploy() {
 
     ssl_warning_mapping="https:443"
     if [[ "$tls_internal" == "true" ]]; then
-      output="--label caddy.tls=internal"
       if [[ "$has_443_mapping" == "false" ]]; then
         ssl_warning_mapping="http:80"
         proxy_host_https_port_candidate="$proxy_host_http_port_candidate"
@@ -107,6 +137,9 @@ trigger-caddy-vhosts-docker-args-process-deploy() {
     scheme="http"
     if [[ -n "$letsencrypt_email" ]] && [[ "$has_443_mapping" == "true" ]]; then
       output="--label 'caddy=${caddy_domains}'"
+      if [[ "$tls_internal" == "true" ]]; then
+        output="$output --label caddy.tls=internal"
+      fi
       scheme="https"
       if [[ -z "$proxy_container_https_port" ]]; then
         warning_scheme="$(awk -F ':' '{ print $1 }' <<<"$ssl_warning_mapping")"
@@ -115,7 +148,14 @@ trigger-caddy-vhosts-docker-args-process-deploy() {
         proxy_container_https_port="$proxy_container_https_port_candidate"
       fi
 
-      output="$output --label \"caddy.reverse_proxy={{ upstreams $proxy_container_https_port }}\""
+      if [[ "$has_routes" == "true" ]]; then
+        # The "9_" prefix orders web's catch-all handle after the route
+        # handles (which the non-web container emits with "0_") in the
+        # docker-proxy generated Caddyfile.
+        output="$output --label \"caddy.9_handle.0_reverse_proxy={{ upstreams $proxy_container_https_port }}\""
+      else
+        output="$output --label \"caddy.reverse_proxy={{ upstreams $proxy_container_https_port }}\""
+      fi
     elif [[ -n "$proxy_container_http_port" ]] || [[ -n "$proxy_container_http_port_candidate" ]]; then
       caddy_domains="${caddy_domains//, /:80, }"
       output="--label 'caddy=${caddy_domains}:80'"
@@ -125,7 +165,15 @@ trigger-caddy-vhosts-docker-args-process-deploy() {
         proxy_container_http_port="$proxy_container_http_port_candidate"
       fi
 
-      output="$output --label \"caddy.reverse_proxy={{ upstreams $proxy_container_http_port }}\""
+      if [[ "$has_routes" == "true" ]]; then
+        output="$output --label \"caddy.9_handle.0_reverse_proxy={{ upstreams $proxy_container_http_port }}\""
+      else
+        output="$output --label \"caddy.reverse_proxy={{ upstreams $proxy_container_http_port }}\""
+      fi
+    fi
+
+    if [[ "$output" == *"caddy.reverse_proxy="* ]]; then
+      output="$output$(fn-caddy-healthcheck-labels "$APP")"
     fi
   fi
 
@@ -140,4 +188,58 @@ trigger-caddy-vhosts-docker-args-process-deploy() {
   echo -n "$STDIN $output"
 }
 
+fn-caddy-healthcheck-labels() {
+  declare desc="outputs caddy reverse_proxy health check and retry labels derived from the app's web readiness healthcheck"
+  declare APP="$1"
+  local healthcheck hc_path hc_port hc_timeout hc_interval hc_attempts hc_host name value
+
+  healthcheck="$(fn-proxy-get-readiness-healthcheck "$APP")"
+  if [[ -z "$healthcheck" ]]; then
+    return
+  fi
+
+  hc_path="$(echo "$healthcheck" | jq -r ".path // empty")"
+  hc_port="$(echo "$healthcheck" | jq -r ".port // empty")"
+  hc_timeout="$(echo "$healthcheck" | jq -r ".timeout // 5")"
+  hc_interval="$(echo "$healthcheck" | jq -r ".wait // 5")"
+  hc_attempts="$(echo "$healthcheck" | jq -r ".attempts // 3")"
+
+  if ! fn-proxy-healthcheck-path-is-valid "$hc_path"; then
+    dokku_log_fail "Invalid app.json healthcheck path for caddy: path must start with a / and must not contain whitespace, control characters, quotes, or backslashes"
+  fi
+
+  hc_host="$(fn-proxy-get-healthcheck-host "$APP" "$healthcheck")"
+
+  echo -n " --label \"caddy.reverse_proxy.health_uri=$hc_path\""
+  [[ -n "$hc_port" ]] && echo -n " --label caddy.reverse_proxy.health_port=$hc_port"
+  echo -n " --label caddy.reverse_proxy.health_interval=${hc_interval}s"
+  echo -n " --label caddy.reverse_proxy.health_timeout=${hc_timeout}s"
+  echo -n " --label caddy.reverse_proxy.health_fails=$hc_attempts"
+  if [[ -n "$hc_host" ]] && fn-proxy-healthcheck-header-is-valid "Host" "$hc_host" && [[ "$hc_host" != *[[:space:]]* ]]; then
+    echo -n " --label caddy.reverse_proxy.health_headers.Host=$hc_host"
+  fi
+
+  while IFS=$'\t' read -r name value; do
+    [[ -z "$name" ]] && continue
+    if ! fn-caddy-healthcheck-header-name-is-valid "$name" || ! fn-proxy-healthcheck-header-is-valid "$name" "$value"; then
+      dokku_log_warn "Skipping invalid app.json healthcheck header for caddy: $name"
+      continue
+    fi
+
+    echo -n " --label 'caddy.reverse_proxy.health_headers.$name=\"$value\"'"
+  done < <(fn-proxy-get-healthcheck-headers "$healthcheck")
+
+  echo -n " --label caddy.reverse_proxy.lb_try_duration=5s"
+  echo -n " --label caddy.reverse_proxy.lb_try_interval=250ms"
+}
+
+fn-caddy-healthcheck-header-name-is-valid() {
+  declare desc="checks that a healthcheck header name can be used as a caddy label segment, which may not contain dots or end in an _<number> ordering suffix"
+  declare NAME="$1"
+
+  [[ "$NAME" == *.* ]] && return 1
+  [[ "$NAME" =~ _[0-9]+$ ]] && return 1
+  return 0
+}
+
 trigger-caddy-vhosts-docker-args-process-deploy "$@"
diff --git a/plugins/caddy-vhosts/go.mod b/plugins/caddy-vhosts/go.mod
index 4e76b2faa..ef716cdc8 100644
--- a/plugins/caddy-vhosts/go.mod
+++ b/plugins/caddy-vhosts/go.mod
@@ -1,29 +1,29 @@
 module github.com/dokku/dokku/plugins/caddy-vhosts
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/caddy-vhosts/go.sum b/plugins/caddy-vhosts/go.sum
index 14bf42b1c..9ada61068 100644
--- a/plugins/caddy-vhosts/go.sum
+++ b/plugins/caddy-vhosts/go.sum
@@ -1,25 +1,24 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -28,28 +27,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/caddy-vhosts/internal-functions b/plugins/caddy-vhosts/internal-functions
index 8a4ee43c3..003ea1d37 100755
--- a/plugins/caddy-vhosts/internal-functions
+++ b/plugins/caddy-vhosts/internal-functions
@@ -4,6 +4,90 @@ source "$PLUGIN_CORE_AVAILABLE_PATH/common/property-functions"
 set -eo pipefail
 [[ $DOKKU_TRACE ]] && set -x
 
+fn-caddy-route-labels() {
+  declare desc="emits per-route caddy labels for a non-web container"
+  declare APP="$1" PROC_TYPE="$2" STDIN="$3"
+  local caddy_domains app_domains output route_proc route_port route_path route_strip
+  local matcher_name route_index=0
+
+  app_domains="$(plugn trigger domains-list "$APP")"
+  if [[ -n "$app_domains" ]]; then
+    caddy_domains="$(echo "$app_domains" | xargs)"
+    caddy_domains="${caddy_domains// /, }"
+  fi
+
+  output=""
+  if [[ -n "$caddy_domains" ]]; then
+    # Mirror web's site-declarator computation in docker-args-process-deploy so
+    # both containers join the same Caddyfile site block. caddy treats DOMAIN
+    # and DOMAIN:80 as separate sites - if web declares DOMAIN:80 and we
+    # declare DOMAIN, caddy-docker-proxy renders two unrelated site blocks
+    # and the route's handle never sees port-80 traffic.
+    local letsencrypt_email port_map scheme host_port
+    local has_443_mapping=false
+    letsencrypt_email="$(fn-caddy-computed-letsencrypt-email)"
+    while read -r port_map; do
+      scheme="$(awk -F ':' '{ print $1 }' <<<"$port_map")"
+      host_port="$(awk -F ':' '{ print $2 }' <<<"$port_map")"
+      if [[ "$scheme" == "https" ]] || [[ "$host_port" == "443" ]]; then
+        has_443_mapping=true
+      fi
+    done < <(plugn trigger ports-get "$APP")
+
+    if [[ -n "$letsencrypt_email" ]] && [[ "$has_443_mapping" == "true" ]]; then
+      output="--label 'caddy=${caddy_domains}'"
+    else
+      output="--label 'caddy=${caddy_domains//, /:80, }:80'"
+    fi
+  fi
+
+  while IFS='|' read -r route_proc route_port route_path route_strip; do
+    [[ -z "$route_proc" ]] && continue
+    [[ "$route_proc" != "$PROC_TYPE" ]] && continue
+
+    local route_slug
+    route_slug="$(fn-caddy-route-slug "$route_path")"
+    matcher_name="@${route_slug}"
+    # The named matcher accepts both the bare prefix and the prefix-glob form
+    # so requests like /api/v0 and /api/v0/users/42 both match.
+    output="$output --label 'caddy.${matcher_name}.path=${route_path} ${route_path}/*'"
+    # Use handle (not route) so the directive terminates the matched request.
+    # Otherwise web's bare `reverse_proxy` (at default-order ~190) runs before
+    # this route block (~210) and catches everything including /api/v0/*.
+    output="$output --label 'caddy.${route_index}_handle=${matcher_name}'"
+    local sub_index=0
+    if [[ "$route_strip" == "1" ]]; then
+      output="$output --label 'caddy.${route_index}_handle.${sub_index}_uri=strip_prefix ${route_path}'"
+      sub_index=$((sub_index + 1))
+    fi
+    output="$output --label \"caddy.${route_index}_handle.${sub_index}_reverse_proxy={{upstreams ${route_port}}}\""
+    route_index=$((route_index + 1))
+  done < <(plugn trigger proxy-routes-list "$APP")
+
+  local proxy_labels_file_path=$(fn-proxy-get-labels-file-path "caddy" "$APP")
+  if [[ -f "$proxy_labels_file_path" ]]; then
+    while read -r line; do
+      [[ -z "$line" ]] && continue
+      output="$output --label '$line'"
+    done <"$proxy_labels_file_path"
+  fi
+
+  echo -n "$STDIN $output"
+}
+
+fn-caddy-route-slug() {
+  declare desc="returns a deterministic kebab-case slug for a route path"
+  declare ROUTE_PATH="$1"
+  local s="${ROUTE_PATH#/}"
+  s="${s%/}"
+  s="${s//\//-}"
+  s="${s,,}"
+  if [[ -z "$s" ]]; then
+    s="root"
+  fi
+  echo "$s"
+}
+
 fn-caddy-logs() {
   declare desc="shows the logs for the caddy container"
   declare TAIL="$1" NUM="$2"
diff --git a/plugins/caddy-vhosts/plugin.toml b/plugins/caddy-vhosts/plugin.toml
index 6f6a0d9ec..16b626a75 100644
--- a/plugins/caddy-vhosts/plugin.toml
+++ b/plugins/caddy-vhosts/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core caddy-vhosts plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/caddy-vhosts/subcommands/set b/plugins/caddy-vhosts/subcommands/set
index 16238acee..f62fb660a 100755
--- a/plugins/caddy-vhosts/subcommands/set
+++ b/plugins/caddy-vhosts/subcommands/set
@@ -19,17 +19,16 @@ cmd-caddy-set() {
     dokku_log_fail "Invalid key specified, valid keys include: image letsencrypt-email letsencrypt-server log-level polling-interval tls-internal"
   fi
 
-  if ! fn-in-array "$KEY" "${GLOBAL_KEYS[@]}"; then
-    if [[ "$APP" == "--global" ]]; then
-      dokku_log_fail "The key '$KEY' cannot be set globally"
-    fi
-    verify_app_name "$APP"
+  if ! fn-in-array "$KEY" "${GLOBAL_KEYS[@]}" && [[ "$APP" == "--global" ]]; then
+    dokku_log_fail "The key '$KEY' cannot be set globally"
   fi
 
   if fn-in-array "$KEY" "${GLOBAL_ONLY_KEYS[@]}" && [[ "$APP" != "--global" ]]; then
     dokku_log_fail "The key '$KEY' can only be set globally"
   fi
 
+  [[ "$APP" == "--global" ]] || verify_app_name "$APP"
+
   if [[ -n "$VALUE" ]]; then
     dokku_log_info2_quiet "Setting ${KEY} to ${VALUE}"
     fn-plugin-property-write "caddy" "$APP" "$KEY" "$VALUE"
diff --git a/plugins/certs/Makefile b/plugins/certs/Makefile
index 92ef9be66..275146a7a 100644
--- a/plugins/certs/Makefile
+++ b/plugins/certs/Makefile
@@ -1,4 +1,3 @@
-GOARCH ?= amd64
 TRIGGERS = triggers/report
 BUILD = report-subcommand triggers
 PLUGIN_NAME = certs
diff --git a/plugins/certs/go.mod b/plugins/certs/go.mod
index 52dd27a02..866367ef9 100644
--- a/plugins/certs/go.mod
+++ b/plugins/certs/go.mod
@@ -1,29 +1,29 @@
 module github.com/dokku/dokku/plugins/certs
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/certs/go.sum b/plugins/certs/go.sum
index 14bf42b1c..9ada61068 100644
--- a/plugins/certs/go.sum
+++ b/plugins/certs/go.sum
@@ -1,25 +1,24 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -28,28 +27,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/certs/plugin.toml b/plugins/certs/plugin.toml
index ab4a0da5c..d11762a6f 100644
--- a/plugins/certs/plugin.toml
+++ b/plugins/certs/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core certificate management plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/certs/report.go b/plugins/certs/report.go
index 6bf3f2392..206656c5e 100644
--- a/plugins/certs/report.go
+++ b/plugins/certs/report.go
@@ -20,14 +20,16 @@ func ReportSingleApp(appName string, format string, infoFlag string) error {
 			return err
 		}
 		flags = map[string]common.ReportFunc{
-			"--ssl-dir":        reportSSLDir,
-			"--ssl-enabled":    reportSSLEnabled,
-			"--ssl-hostnames":  reportSSLHostnames,
-			"--ssl-expires-at": reportSSLExpiresAt,
-			"--ssl-issuer":     reportSSLIssuer,
-			"--ssl-starts-at":  reportSSLStartsAt,
-			"--ssl-subject":    reportSSLSubject,
-			"--ssl-verified":   reportSSLVerified,
+			"--ssl-dir":         reportSSLDir,
+			"--ssl-enabled":     reportSSLEnabled,
+			"--ssl-hostnames":   reportSSLHostnames,
+			"--ssl-expires-at":  reportSSLExpiresAt,
+			"--ssl-fingerprint": reportSSLFingerprint,
+			"--ssl-issuer":      reportSSLIssuer,
+			"--ssl-serial":      reportSSLSerial,
+			"--ssl-starts-at":   reportSSLStartsAt,
+			"--ssl-subject":     reportSSLSubject,
+			"--ssl-verified":    reportSSLVerified,
 		}
 	}
 
@@ -78,6 +80,21 @@ func opensslCertText(appName string) string {
 	return result.Stdout
 }
 
+// opensslCertOption runs "openssl x509 -in <server.crt> -noout" with the given
+// output options and returns the trimmed stdout, or an empty string when openssl
+// cannot read the certificate.
+func opensslCertOption(appName string, args ...string) string {
+	result, err := common.CallExecCommand(common.ExecCommandInput{
+		Command: "openssl",
+		Args:    append([]string{"x509", "-in", filepath.Join(certTLSPath(appName), "server.crt"), "-noout"}, args...),
+	})
+	if err != nil {
+		return ""
+	}
+
+	return result.StdoutContents()
+}
+
 func reportSSLDir(appName string) string {
 	return certTLSPath(appName)
 }
@@ -124,6 +141,37 @@ func reportSSLStartsAt(appName string) string {
 	return ""
 }
 
+func reportSSLFingerprint(appName string) string {
+	if !isSSLEnabled(appName) {
+		return ""
+	}
+
+	return formatSSLHexField(opensslCertOption(appName, "-fingerprint", "-sha256"))
+}
+
+func reportSSLSerial(appName string) string {
+	if !isSSLEnabled(appName) {
+		return ""
+	}
+
+	return formatSSLHexField(opensslCertOption(appName, "-serial"))
+}
+
+// formatSSLHexField extracts the value from an openssl "key=HEX" output line, as
+// printed by "-fingerprint" and "-serial". The key is discarded rather than
+// matched against a literal: OpenSSL 3.x labels the digest "sha256" where
+// OpenSSL 1.x and LibreSSL label it "SHA256". Neither a fingerprint nor a serial
+// can contain an "=", so cutting at the first one is unambiguous. Only hex
+// values may be passed through here, as uppercasing would corrupt a subject.
+func formatSSLHexField(out string) string {
+	_, value, found := strings.Cut(strings.TrimSpace(out), "=")
+	if !found {
+		return ""
+	}
+
+	return strings.ToUpper(strings.TrimSpace(value))
+}
+
 func reportSSLIssuer(appName string) string {
 	if !isSSLEnabled(appName) {
 		return ""
@@ -144,15 +192,7 @@ func reportSSLSubject(appName string) string {
 		return ""
 	}
 
-	result, err := common.CallExecCommand(common.ExecCommandInput{
-		Command: "openssl",
-		Args:    []string{"x509", "-in", filepath.Join(certTLSPath(appName), "server.crt"), "-noout", "-subject", "-nameopt", "compat"},
-	})
-	if err != nil {
-		return ""
-	}
-
-	return formatSSLSubject(result.StdoutContents())
+	return formatSSLSubject(opensslCertOption(appName, "-subject", "-nameopt", "compat"))
 }
 
 // formatSSLSubject normalizes an openssl "-subject -nameopt compat" line into a
@@ -203,14 +243,7 @@ func reportSSLHostnames(appName string) string {
 		return ""
 	}
 
-	subject := ""
-	subjectResult, err := common.CallExecCommand(common.ExecCommandInput{
-		Command: "openssl",
-		Args:    []string{"x509", "-in", filepath.Join(certTLSPath(appName), "server.crt"), "-noout", "-subject", "-nameopt", "RFC2253"},
-	})
-	if err == nil {
-		subject = subjectResult.StdoutContents()
-	}
+	subject := opensslCertOption(appName, "-subject", "-nameopt", "RFC2253")
 
 	return strings.Join(sslHostnames(subject, opensslCertText(appName)), " ")
 }
diff --git a/plugins/certs/report_test.go b/plugins/certs/report_test.go
index e5182d097..e293b99f6 100644
--- a/plugins/certs/report_test.go
+++ b/plugins/certs/report_test.go
@@ -112,3 +112,30 @@ func TestFormatSSLSubject(t *testing.T) {
 		})
 	}
 }
+
+func TestFormatSSLHexField(t *testing.T) {
+	cases := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{"fingerprint openssl 1.x label", "SHA256 Fingerprint=B7:DF:D5:84:C6:2E:27:BF", "B7:DF:D5:84:C6:2E:27:BF"},
+		{"fingerprint openssl 3.x label", "sha256 Fingerprint=B7:DF:D5:84:C6:2E:27:BF", "B7:DF:D5:84:C6:2E:27:BF"},
+		{"fingerprint lowercase digest", "sha256 Fingerprint=b7:df:d5:84:c6:2e:27:bf", "B7:DF:D5:84:C6:2E:27:BF"},
+		{"serial", "serial=322844AD8CD6D4FF76B05C50833AB91DEEDA2AD1", "322844AD8CD6D4FF76B05C50833AB91DEEDA2AD1"},
+		{"serial shorter", "serial=C46823E5D7C09FC9", "C46823E5D7C09FC9"},
+		{"serial lowercase", "serial=c46823e5d7c09fc9", "C46823E5D7C09FC9"},
+		{"serial negative", "serial=-1F2E", "-1F2E"},
+		{"surrounding whitespace", "  serial=C46823E5D7C09FC9  \n", "C46823E5D7C09FC9"},
+		{"no separator", "unable to load certificate", ""},
+		{"empty", "", ""},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := formatSSLHexField(tc.in); got != tc.want {
+				t.Errorf("formatSSLHexField(%q) = %q, want %q", tc.in, got, tc.want)
+			}
+		})
+	}
+}
diff --git a/plugins/checks/Makefile b/plugins/checks/Makefile
index 0cfaa38e7..ba54cfa35 100644
--- a/plugins/checks/Makefile
+++ b/plugins/checks/Makefile
@@ -1,4 +1,3 @@
-GOARCH ?= amd64
 TRIGGERS = triggers/report
 BUILD = report-subcommand triggers
 PLUGIN_NAME = checks
diff --git a/plugins/checks/go.mod b/plugins/checks/go.mod
index eb6ba99df..da1e3fa63 100644
--- a/plugins/checks/go.mod
+++ b/plugins/checks/go.mod
@@ -1,29 +1,29 @@
 module github.com/dokku/dokku/plugins/checks
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/checks/go.sum b/plugins/checks/go.sum
index 14bf42b1c..9ada61068 100644
--- a/plugins/checks/go.sum
+++ b/plugins/checks/go.sum
@@ -1,25 +1,24 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -28,28 +27,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/checks/plugin.toml b/plugins/checks/plugin.toml
index 0845b3a27..a0faf1875 100644
--- a/plugins/checks/plugin.toml
+++ b/plugins/checks/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core checks plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/checks/subcommands/disable b/plugins/checks/subcommands/disable
index 6f0971ed6..ab131feb6 100755
--- a/plugins/checks/subcommands/disable
+++ b/plugins/checks/subcommands/disable
@@ -12,6 +12,12 @@ cmd-checks-disable() {
 
   verify_app_name "$APP"
   local PROCTYPES="${2:-_all_}"
+  fn-plugin-property-lock "checks" "$APP" fn-checks-disable "$APP" "$PROCTYPES"
+}
+
+fn-checks-disable() {
+  declare desc="disables zero-downtime checks for app/proctypes, expecting the caller to hold the checks property lock"
+  declare APP="$1" PROCTYPES="$2"
   local DOKKU_CHECKS_DISABLED=$(fn-plugin-property-get-default "checks" "$APP" "disabled" "")
   local DOKKU_CHECKS_SKIPPED=$(fn-plugin-property-get-default "checks" "$APP" "skipped" "")
 
diff --git a/plugins/checks/subcommands/enable b/plugins/checks/subcommands/enable
index 858bf389c..8d59665bc 100755
--- a/plugins/checks/subcommands/enable
+++ b/plugins/checks/subcommands/enable
@@ -12,7 +12,12 @@ cmd-checks-enable() {
 
   verify_app_name "$APP"
   local PROCTYPES="${2:-_all_}"
+  fn-plugin-property-lock "checks" "$APP" fn-checks-enable "$APP" "$PROCTYPES"
+}
 
+fn-checks-enable() {
+  declare desc="enables zero-downtime checks for app/proctypes, expecting the caller to hold the checks property lock"
+  declare APP="$1" PROCTYPES="$2"
   local DOKKU_CHECKS_DISABLED=$(fn-plugin-property-get-default "checks" "$APP" "disabled" "")
   local DOKKU_CHECKS_SKIPPED=$(fn-plugin-property-get-default "checks" "$APP" "skipped" "")
 
diff --git a/plugins/checks/subcommands/skip b/plugins/checks/subcommands/skip
index 7a242b6c9..f8e98a0db 100755
--- a/plugins/checks/subcommands/skip
+++ b/plugins/checks/subcommands/skip
@@ -12,6 +12,12 @@ cmd-checks-skip() {
 
   verify_app_name "$APP"
   local PROCTYPES="${2:-_all_}"
+  fn-plugin-property-lock "checks" "$APP" fn-checks-skip "$APP" "$PROCTYPES"
+}
+
+fn-checks-skip() {
+  declare desc="skips zero-downtime checks for app/proctypes, expecting the caller to hold the checks property lock"
+  declare APP="$1" PROCTYPES="$2"
   local DOKKU_CHECKS_DISABLED=$(fn-plugin-property-get-default "checks" "$APP" "disabled" "")
   local DOKKU_CHECKS_SKIPPED=$(fn-plugin-property-get-default "checks" "$APP" "skipped" "")
 
diff --git a/plugins/common/Makefile b/plugins/common/Makefile
index 7fa54b840..f2c4686ce 100644
--- a/plugins/common/Makefile
+++ b/plugins/common/Makefile
@@ -1,4 +1,3 @@
-GOARCH ?= amd64
 TRIGGERS = triggers/app-list triggers/core-post-deploy triggers/install triggers/post-delete
 BUILD = prop common triggers
 PLUGIN_NAME = common
diff --git a/plugins/common/common.go b/plugins/common/common.go
index 0c5929dc1..889bac2c7 100644
--- a/plugins/common/common.go
+++ b/plugins/common/common.go
@@ -153,8 +153,8 @@ func CorePostDeploy(input CorePostDeployInput) error {
 				if err := os.Rename(processSpecificPath, existingPath); err != nil {
 					return err
 				}
-			} else if DirectoryExists(fmt.Sprintf("%s.missing", processSpecificPath)) {
-				if err := os.RemoveAll(fmt.Sprintf("%s.missing", processSpecificPath)); err != nil {
+			} else if FileExists(fmt.Sprintf("%s.missing", processSpecificPath)) {
+				if err := os.Remove(fmt.Sprintf("%s.missing", processSpecificPath)); err != nil {
 					return err
 				}
 
@@ -306,7 +306,7 @@ func CorePostExtract(input CorePostExtractInput) error {
 			return err
 		}
 		for _, f := range files {
-			if err := os.Remove(f); err != nil {
+			if err := os.RemoveAll(f); err != nil {
 				return err
 			}
 		}
@@ -371,13 +371,18 @@ func CorePostExtract(input CorePostExtractInput) error {
 			}
 		} else {
 			if toExtract.IsDirectory {
-
 				if err := CopyDirFromImage(input.AppName, sourceImage, imageSourcePath, processSpecificDestination); err != nil {
-					return TouchFile(missingDestination)
+					if err := TouchFile(missingDestination); err != nil {
+						return err
+					}
+					continue
 				}
 			} else {
 				if err := CopyFromImage(input.AppName, sourceImage, imageSourcePath, processSpecificDestination); err != nil {
-					return TouchFile(missingDestination)
+					if err := TouchFile(missingDestination); err != nil {
+						return err
+					}
+					continue
 				}
 			}
 		}
diff --git a/plugins/common/functions b/plugins/common/functions
index aec97aeb4..d03b8f708 100755
--- a/plugins/common/functions
+++ b/plugins/common/functions
@@ -251,6 +251,12 @@ fn-docker-args-split() {
   printf "%s" "$DOCKER_ARGS" | xargs -r printf "%s\0"
 }
 
+fn-split-command() {
+  declare desc="tokenizes a command string into NUL-delimited fields using shell quoting rules without shell expansion"
+  declare COMMAND="$1"
+  "$PLUGIN_CORE_AVAILABLE_PATH/common/common" split-command -- "$COMMAND"
+}
+
 is_valid_app_name() {
   declare desc="verify that the app name matches naming restrictions"
   local APP="$1"
@@ -476,6 +482,56 @@ is_abs_path() {
   fi
 }
 
+fn-cli-preserved-env-names() {
+  declare desc="names the environment variables the re-exec as the dokku user must carry"
+
+  # every variable dokku honours from the environment has to be listed, or the child
+  # derives different values than the parent - during the docker image build these only
+  # ever exist in the environment. DOKKU_PID is the one exclusion: it is unset above so
+  # the child gets its own. DOKKU_PRESERVE_ENV carries anything else
+  echo "DOKKU_APP_NAME DOKKU_APPS_FORCE_DELETE DOKKU_DISABLE_TTY DOKKU_FORCE_TTY" \
+    "DOKKU_GLOBAL_FLAGS DOKKU_PRESERVE_ENV DOKKU_QUIET_OUTPUT DOKKU_TRACE" \
+    "FINGERPRINT NAME SSH_NAME SSH_ORIGINAL_COMMAND SSH_USER" \
+    "DOCKER_BIN DOKKU_CNB_BUILDER DOKKU_EVENTS_LOGFILE DOKKU_HOST_ROOT DOKKU_IMAGE" \
+    "DOKKU_INIT_SYSTEM DOKKU_LIB_HOST_ROOT DOKKU_LIB_PATH DOKKU_LOGS_DIR" \
+    "DOKKU_LOGS_HOST_DIR DOKKU_ROOT DOKKU_SYSTEM_GROUP DOKKU_SYSTEM_USER" \
+    "PLUGIN_AVAILABLE_PATH PLUGIN_CORE_AVAILABLE_PATH PLUGIN_CORE_ENABLED_PATH" \
+    "PLUGIN_CORE_PATH PLUGIN_ENABLED_PATH PLUGIN_PATH"
+}
+
+fn-sudo-preserve-env-flag() {
+  declare desc="prints the sudo flag that carries environment variables across a privilege drop"
+  local names=("$@")
+  local extra_names=()
+  local joined name
+
+  # sudo-rs, the default sudo on ubuntu 25.10 and later, ignores -E and bare
+  # --preserve-env, so every variable that has to survive must be named
+  if [[ "${#names[@]}" -eq 0 ]]; then
+    for name in $(compgen -e); do
+      # preserving these would defeat -H and override the sudoers secure_path
+      case "$name" in
+        HOME | LOGNAME | MAIL | PATH | SHELL | USER | _ | SUDO_*)
+          continue
+          ;;
+      esac
+      names+=("$name")
+    done
+  fi
+
+  if [[ -n "$DOKKU_PRESERVE_ENV" ]]; then
+    read -ra extra_names <<<"${DOKKU_PRESERVE_ENV//,/ }"
+    names+=("${extra_names[@]}")
+  fi
+
+  if [[ "${#names[@]}" -eq 0 ]]; then
+    return 0
+  fi
+
+  printf -v joined "%s," "${names[@]}"
+  echo "--preserve-env=${joined%,}"
+}
+
 parse_args() {
   declare desc="top-level cli arg parser"
   local next_index=1
@@ -619,24 +675,97 @@ is_container_status() {
   return 1
 }
 
+fn-app-previous-image-id() {
+  declare desc="returns the image id the app is currently running, if it can be unambiguously determined"
+  declare APP="$1"
+  local CID IMAGE_ID
+  local -a IMAGE_IDS=()
+
+  for CID in $(get_app_container_ids "$APP"); do
+    IMAGE_ID="$("$DOCKER_BIN" container inspect --format "{{.Image}}" "$CID" 2>/dev/null || true)"
+    [[ -z "$IMAGE_ID" ]] && continue
+    fn-in-array "$IMAGE_ID" "${IMAGE_IDS[@]}" && continue
+    IMAGE_IDS+=("$IMAGE_ID")
+  done
+
+  if [[ "${#IMAGE_IDS[@]}" -eq 0 ]]; then
+    while read -r IMAGE_ID; do
+      [[ -z "$IMAGE_ID" ]] && continue
+      fn-in-array "$IMAGE_ID" "${IMAGE_IDS[@]}" && continue
+      IMAGE_IDS+=("$IMAGE_ID")
+    done < <("$DOCKER_BIN" image ls --no-trunc --filter "label=com.dokku.image-stage=release" --filter "label=com.dokku.app-name=$APP" --format "{{.ID}}" 2>/dev/null || true)
+  fi
+
+  if [[ "${#IMAGE_IDS[@]}" -eq 1 ]]; then
+    echo "${IMAGE_IDS[0]}"
+  fi
+}
+
+fn-app-previous-image-pin() {
+  declare desc="returns the image tag used to keep the previous app image available during a build and deploy"
+  declare APP="$1"
+
+  echo "$(get_app_image_repo "$APP"):dokku-previous"
+}
+
+fn-app-pin-previous-image() {
+  declare desc="tags the image the app is currently running so it survives the build moving the latest tag"
+  declare APP="$1"
+  local PREVIOUS_IMAGE_ID
+
+  fn-app-unpin-previous-image "$APP"
+  PREVIOUS_IMAGE_ID="$(fn-app-previous-image-id "$APP")"
+  if [[ -z "$PREVIOUS_IMAGE_ID" ]]; then
+    return
+  fi
+
+  "$DOCKER_BIN" image tag "$PREVIOUS_IMAGE_ID" "$(fn-app-previous-image-pin "$APP")" &>/dev/null || true
+}
+
+fn-app-unpin-previous-image() {
+  declare desc="removes the tag keeping the previous app image available"
+  declare APP="$1"
+
+  "$DOCKER_BIN" image remove --force --no-prune "$(fn-app-previous-image-pin "$APP")" &>/dev/null || true
+}
+
+fn-app-restore-previous-image() {
+  declare desc="retags the app image to the pinned previous image, returning 1 if there is no pinned image"
+  declare APP="$1"
+  local IMAGE PIN_IMAGE PREVIOUS_IMAGE_ID CURRENT_IMAGE_ID
+
+  IMAGE="$(get_app_image_repo "$APP"):latest"
+  PIN_IMAGE="$(fn-app-previous-image-pin "$APP")"
+  PREVIOUS_IMAGE_ID="$("$DOCKER_BIN" image inspect --format "{{.Id}}" "$PIN_IMAGE" 2>/dev/null || true)"
+  if [[ -z "$PREVIOUS_IMAGE_ID" ]]; then
+    return 1
+  fi
+
+  CURRENT_IMAGE_ID="$("$DOCKER_BIN" image inspect --format "{{.Id}}" "$IMAGE" 2>/dev/null || true)"
+  if [[ "$CURRENT_IMAGE_ID" == "$PREVIOUS_IMAGE_ID" ]]; then
+    return 0
+  fi
+
+  dokku_log_warn "Retagging old image $PREVIOUS_IMAGE_ID as $IMAGE"
+  "$DOCKER_BIN" image tag "$PIN_IMAGE" "$IMAGE" 2>/dev/null
+}
+
 dokku_build() {
   declare desc="build phase"
   declare APP="$1" IMAGE_SOURCE_TYPE="$2" SOURCECODE_WORK_DIR="$3"
 
   local IMAGE=$(get_app_image_name "$APP")
-  local RELEASED_IMAGE_ID="$(docker image ls --filter "label=com.dokku.image-stage=release" --filter "label=com.dokku.app-name=$APP" --format "{{.ID}}")"
+  fn-app-pin-previous-image "$APP"
   if plugn trigger builder-build "$IMAGE_SOURCE_TYPE" "$APP" "$SOURCECODE_WORK_DIR"; then
     return
   fi
 
-  if [[ -n "$RELEASED_IMAGE_ID" ]]; then
-    dokku_log_warn "Retagging old image $RELEASED_IMAGE_ID as $IMAGE"
-    "$DOCKER_BIN" image tag "$RELEASED_IMAGE_ID" "$IMAGE" 2>/dev/null || true
-  else
+  if ! fn-app-restore-previous-image "$APP"; then
     dokku_log_warn "Removing invalid image tag $IMAGE"
     "$DOCKER_BIN" image remove --force --no-prune "$IMAGE" &>/dev/null || true
   fi
 
+  fn-app-unpin-previous-image "$APP"
   dokku_log_fail "App build failed"
 }
 
@@ -725,7 +854,14 @@ dokku_receive() {
   if ! dokku_build "$APP" "$IMAGE_SOURCE_TYPE" "$TMP_WORK_DIR"; then
     return 1
   fi
-  plugn trigger release-and-deploy "$APP"
+
+  if ! plugn trigger release-and-deploy "$APP"; then
+    fn-app-restore-previous-image "$APP" || true
+    fn-app-unpin-previous-image "$APP"
+    return 1
+  fi
+
+  fn-app-unpin-previous-image "$APP"
 }
 
 docker_cleanup() {
@@ -733,7 +869,7 @@ docker_cleanup() {
   declare APP="$1" FORCE_CLEANUP="$2"
   local DOKKU_APP_SKIP_CLEANUP
 
-  "$PLUGIN_CORE_AVAILABLE_PATH/common/common" --quiet docker-cleanup "$APP"
+  "$PLUGIN_CORE_AVAILABLE_PATH/common/common" --quiet docker-cleanup "$APP" "$FORCE_CLEANUP"
 }
 
 dokku_auth() {
@@ -886,6 +1022,30 @@ merge_dedupe_list() {
   echo "$merged_list"
 }
 
+fn-build-capture-app-name() {
+  declare desc="outputs the app name from the arguments of a build-capturing command, skipping any flags"
+  shift 1
+
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --all)
+        return 0
+        ;;
+      --parallel)
+        shift 1
+        [[ $# -gt 0 ]] && shift 1
+        ;;
+      -*)
+        shift 1
+        ;;
+      *)
+        echo "$1"
+        return 0
+        ;;
+    esac
+  done
+}
+
 dokku_setup_build_capture() {
   declare desc="generate a build-id, write a record, and redirect output to log + journald"
   declare APP="$1" SOURCE="${2:-unknown}"
@@ -910,14 +1070,55 @@ dokku_setup_build_capture() {
   exec &> >(tee -a "$LOG" >(logger -i -t "dokku-${DOKKU_BUILD_ID}"))
 }
 
-acquire_app_deploy_lock() {
-  declare desc="acquire advisory lock for use in deploys"
-  local APP="$1"
-  local LOCK_TYPE="${2:-waiting}"
-  local APP_DEPLOY_LOCK_FILE="$DOKKU_LIB_ROOT/data/apps/$APP/.deploy.lock"
+dokku_discard_build_capture() {
+  declare desc="drop the build record started by dokku_setup_build_capture when nothing ended up being built"
+  declare APP="$1"
+  if [[ -z "$APP" ]] || [[ -z "$DOKKU_BUILD_ID" ]]; then
+    return 0
+  fi
+
+  plugn trigger builds-record-discard "$APP" "$DOKKU_BUILD_ID" || true
+  # forget the id so a later finalize does not warn about the missing record.
+  # output stays redirected: the tee keeps the now-unlinked log open until the
+  # process exits, and stdout still reaches the operator.
+  unset DOKKU_BUILD_ID DOKKU_BUILD_LOG_FILE DOKKU_BUILD_SOURCE
+}
+
+app_deploy_lock_file() {
+  declare desc="outputs the path to the deploy lock file for an app"
+  declare APP="$1"
+  echo "$DOKKU_LIB_ROOT/data/apps/$APP/.deploy.lock"
+}
+
+app_manual_lock_file() {
+  declare desc="outputs the path to the manual lock file created by apps:lock for an app"
+  declare APP="$1"
+  echo "$DOKKU_LIB_ROOT/data/apps/$APP/.manual-deploy.lock"
+}
+
+acquire_app_advisory_lock() {
+  declare desc="acquire the advisory lock for an app's deploys, failing if the app was locked via apps:lock"
+  declare APP="$1" LOCK_TYPE="${2:-waiting}"
+  local APP_DEPLOY_LOCK_FILE="$(app_deploy_lock_file "$APP")"
   local LOCK_WAITING_MSG="$APP currently has a deploy lock in place. Waiting..."
   local LOCK_FAILED_MSG="$APP currently has a deploy lock in place. Exiting..."
 
+  acquire_advisory_lock "$APP_DEPLOY_LOCK_FILE" "$LOCK_TYPE" "$LOCK_WAITING_MSG" "$LOCK_FAILED_MSG"
+  if [[ ! -f "$(app_manual_lock_file "$APP")" ]]; then
+    return 0
+  fi
+
+  release_advisory_lock "$APP_DEPLOY_LOCK_FILE"
+  dokku_discard_build_capture "$APP"
+  dokku_log_warn "$APP has been locked via apps:lock"
+  dokku_log_fail "Run 'apps:unlock' to allow deploys"
+}
+
+acquire_app_deploy_lock() {
+  declare desc="acquire advisory lock for use in deploys, releasing it and finalizing the build record when the shell exits"
+  local APP="$1"
+  local LOCK_TYPE="${2:-waiting}"
+
   if [[ -z "$DOKKU_BUILD_ID" ]]; then
     DOKKU_BUILD_ID="$(plugn trigger builds-generate-id 2>/dev/null)"
     if [[ -z "$DOKKU_BUILD_ID" ]]; then
@@ -926,14 +1127,15 @@ acquire_app_deploy_lock() {
     export DOKKU_BUILD_ID
   fi
 
-  acquire_advisory_lock "$APP_DEPLOY_LOCK_FILE" "$LOCK_TYPE" "$LOCK_WAITING_MSG" "$LOCK_FAILED_MSG"
+  acquire_app_advisory_lock "$APP" "$LOCK_TYPE"
+  trap "release_app_deploy_lock '$APP' \"\$?\"" EXIT
 }
 
 release_app_deploy_lock() {
   declare desc="release advisory lock used in deploys"
   local APP="$1"
   local EXIT_CODE="${2:-0}"
-  local APP_DEPLOY_LOCK_FILE="$DOKKU_LIB_ROOT/data/apps/$APP/.deploy.lock"
+  local APP_DEPLOY_LOCK_FILE="$(app_deploy_lock_file "$APP")"
 
   if [[ -n "$DOKKU_BUILD_ID" ]]; then
     plugn trigger builds-record-finalize "$APP" "$DOKKU_BUILD_ID" "$EXIT_CODE" || true
@@ -948,25 +1150,39 @@ acquire_advisory_lock() {
   local LOCK_FD="200"
   local SHOW_MSG=true
 
-  eval "exec $LOCK_FD>$LOCK_FILE"
-  if [[ "$LOCK_TYPE" == "waiting" ]]; then
-    while [[ $(
-      flock -n "$LOCK_FD" &>/dev/null
-      echo $?
-    ) -ne 0 ]]; do
-      if [[ "$SHOW_MSG" == "true" ]]; then
-        echo "$LOCK_WAITING_MSG"
-        SHOW_MSG=false
+  while true; do
+    # opened for appending so a failed attempt does not truncate the build id
+    # written by the current lock holder
+    eval "exec $LOCK_FD>>$LOCK_FILE"
+    if [[ "$LOCK_TYPE" == "waiting" ]]; then
+      while [[ $(
+        flock -n "$LOCK_FD" &>/dev/null
+        echo $?
+      ) -ne 0 ]]; do
+        if [[ "$SHOW_MSG" == "true" ]]; then
+          echo "$LOCK_WAITING_MSG"
+          SHOW_MSG=false
+        fi
+        sleep 1
+      done
+    else
+      # the short wait lets an apps:locked check that briefly takes the lock
+      # finish instead of failing the deploy
+      if ! flock -w 1 "$LOCK_FD" &>/dev/null; then
+        dokku_log_warn "$LOCK_FAILED_MSG"
+        dokku_log_fail "Run 'apps:unlock' to release the existing deploy lock"
       fi
-      sleep 1
-    done
-  else
-    if ! flock -n "$LOCK_FD" &>/dev/null; then
-      dokku_log_warn "$LOCK_FAILED_MSG"
-      dokku_log_fail "Run 'apps:unlock' to release the existing deploy lock"
     fi
-  fi
+
+    # the previous holder removes the lock file on release, so the file locked
+    # above may no longer be the one at the lock path
+    if [[ "/proc/self/fd/$LOCK_FD" -ef "$LOCK_FILE" ]]; then
+      break
+    fi
+    eval "exec $LOCK_FD>&-"
+  done
   echo "${DOKKU_BUILD_ID:-$DOKKU_PID}" >"$LOCK_FILE"
+  trap "release_advisory_lock '$LOCK_FILE'" EXIT
 }
 
 release_advisory_lock() {
@@ -974,7 +1190,15 @@ release_advisory_lock() {
   local LOCK_FILE="$1"
   local LOCK_FD="200"
 
-  flock -u "$LOCK_FD" && rm -f "$LOCK_FILE" &>/dev/null
+  trap - EXIT
+
+  # the file is removed before unlocking so a waiter that locks it afterwards
+  # can tell that its lock is stale. It is only removed if it is still the file
+  # this process locked, as apps:unlock may have handed the path to another deploy
+  if [[ "/proc/self/fd/$LOCK_FD" -ef "$LOCK_FILE" ]]; then
+    rm -f "$LOCK_FILE" &>/dev/null
+  fi
+  flock -u "$LOCK_FD"
 }
 
 suppress_output() {
diff --git a/plugins/common/go.mod b/plugins/common/go.mod
index 11b70ae2f..a51055e45 100644
--- a/plugins/common/go.mod
+++ b/plugins/common/go.mod
@@ -1,31 +1,33 @@
 module github.com/dokku/dokku/plugins/common
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1
 	github.com/fatih/color v1.19.0
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/melbahja/goph v1.5.2
-	github.com/onsi/gomega v1.42.1
+	github.com/onsi/gomega v1.44.0
 	github.com/otiai10/copy v1.14.1
 	github.com/ryanuber/columnize v2.1.2+incompatible
-	github.com/spf13/pflag v1.0.10
-	golang.org/x/crypto v0.55.0
-	golang.org/x/sync v0.22.0
+	github.com/spf13/pflag v1.1.0
+	golang.org/x/crypto v0.58.0
+	golang.org/x/sync v0.25.0
+	golang.org/x/sys v0.49.0
+	mvdan.cc/sh/v3 v3.14.1
 )
 
 require (
 	github.com/google/go-cmp v0.7.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/net v0.57.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/text v0.41.0 // indirect
+	github.com/stretchr/testify v1.12.1 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/net v0.60.0 // indirect
+	golang.org/x/text v0.43.0 // indirect
 )
diff --git a/plugins/common/go.sum b/plugins/common/go.sum
index cc49337c1..7e089b416 100644
--- a/plugins/common/go.sum
+++ b/plugins/common/go.sum
@@ -1,25 +1,30 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
+github.com/go-quicktest/qt v1.102.0 h1:HSQxCeh5YZH3EL3W39ixjtyaEhcWSXQHtHnMBzSs474=
+github.com/go-quicktest/qt v1.102.0/go.mod h1:p4lGIVX+8Wa6ZPNDvqcxq36XpUDLh42FLetFU7odllI=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -28,30 +33,27 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.15.0 h1:D0RCU5rMAp+SpgkiNdrjfJ+LX4J1M32V2NeCY7EJ6hc=
+github.com/rogpeppe/go-internal v1.15.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
+mvdan.cc/sh/v3 v3.14.1 h1:bXkhQWNHCs0KZEChF8hYS6FC+T2N9mUZLbQv9blditI=
+mvdan.cc/sh/v3 v3.14.1/go.mod h1:syYCoFET8w9tvevxiXUtY8/ICrU+l26jHmhJDra3Vwo=
diff --git a/plugins/common/lock.go b/plugins/common/lock.go
new file mode 100644
index 000000000..f65a67f95
--- /dev/null
+++ b/plugins/common/lock.go
@@ -0,0 +1,49 @@
+package common
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// LockedDirectoriesEnvVar names the environment variable a caller holding a
+// directory lock exports to its child processes. It holds a newline-separated
+// list of directories, and LockDirectory runs its callback without locking a
+// directory found in that list, so a subprocess spawned while the lock is held
+// does not deadlock waiting on its own parent.
+const LockedDirectoriesEnvVar = "DOKKU_LOCKED_DIRECTORIES"
+
+// LockDirectory holds an exclusive lock on dir for the duration of fn. The
+// directory must already exist. On unix the lock is a flock on the directory
+// itself, and on windows it is a LockFileEx lock on a lock file inside the
+// directory. The lock is advisory: it serializes callers that go through
+// LockDirectory, and does not block plain reads. Locks are taken per open
+// file, so goroutines in a single process exclude each other as well as
+// separate processes do.
+//
+// A directory listed in DOKKU_LOCKED_DIRECTORIES is treated as already held by
+// a parent process, and fn runs without taking the lock again. LockDirectory is
+// not reentrant otherwise: fn must not call LockDirectory on the same
+// directory, as that would block forever.
+func LockDirectory(dir string, fn func() error) error {
+	dir = filepath.Clean(dir)
+	if isDirectoryLockHeld(dir) {
+		return fn()
+	}
+
+	return lockDirectory(dir, fn)
+}
+
+// isDirectoryLockHeld reports whether dir is listed in DOKKU_LOCKED_DIRECTORIES
+func isDirectoryLockHeld(dir string) bool {
+	for _, held := range strings.Split(os.Getenv(LockedDirectoriesEnvVar), "\n") {
+		held = strings.TrimSpace(held)
+		if held == "" {
+			continue
+		}
+		if filepath.Clean(held) == dir {
+			return true
+		}
+	}
+	return false
+}
diff --git a/plugins/common/lock_unix.go b/plugins/common/lock_unix.go
new file mode 100644
index 000000000..d28bb922f
--- /dev/null
+++ b/plugins/common/lock_unix.go
@@ -0,0 +1,25 @@
+//go:build !windows
+
+package common
+
+import (
+	"fmt"
+	"os"
+	"syscall"
+)
+
+// lockDirectory holds an exclusive flock on dir for the duration of fn
+func lockDirectory(dir string, fn func() error) error {
+	file, err := os.Open(dir)
+	if err != nil {
+		return fmt.Errorf("Unable to open %s for locking: %w", dir, err)
+	}
+	defer file.Close()
+
+	if err := syscall.Flock(int(file.Fd()), syscall.LOCK_EX); err != nil {
+		return fmt.Errorf("Unable to lock %s: %w", dir, err)
+	}
+	defer syscall.Flock(int(file.Fd()), syscall.LOCK_UN)
+
+	return fn()
+}
diff --git a/plugins/common/lock_windows.go b/plugins/common/lock_windows.go
new file mode 100644
index 000000000..68155d52a
--- /dev/null
+++ b/plugins/common/lock_windows.go
@@ -0,0 +1,35 @@
+//go:build windows
+
+package common
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"golang.org/x/sys/windows"
+)
+
+// directoryLockFile names the file inside a locked directory that holds the
+// lock on windows, where a directory handle cannot be locked directly. The
+// file is left in place after unlocking, as removing it would race other
+// callers waiting on the lock.
+const directoryLockFile = ".dokku.lock"
+
+// lockDirectory holds an exclusive LockFileEx lock on the lock file inside dir
+// for the duration of fn
+func lockDirectory(dir string, fn func() error) error {
+	file, err := os.OpenFile(filepath.Join(dir, directoryLockFile), os.O_RDWR|os.O_CREATE, 0600)
+	if err != nil {
+		return fmt.Errorf("Unable to open %s for locking: %w", dir, err)
+	}
+	defer file.Close()
+
+	handle := windows.Handle(file.Fd())
+	if err := windows.LockFileEx(handle, windows.LOCKFILE_EXCLUSIVE_LOCK, 0, 1, 0, &windows.Overlapped{}); err != nil {
+		return fmt.Errorf("Unable to lock %s: %w", dir, err)
+	}
+	defer windows.UnlockFileEx(handle, 0, 1, 0, &windows.Overlapped{})
+
+	return fn()
+}
diff --git a/plugins/common/log.go b/plugins/common/log.go
index 9e67287b4..63e6dcd93 100644
--- a/plugins/common/log.go
+++ b/plugins/common/log.go
@@ -16,6 +16,30 @@ type ErrWithExitCode interface {
 	ExitCode() int
 }
 
+// ExitCodeError carries an explicit exit code for a command failure. A blank
+// Message exits with the code without printing anything, which suits commands
+// that report their result through the exit code alone.
+type ExitCodeError struct {
+	// Code is the exit code to terminate with
+	Code int
+
+	// Message is the error text printed to stderr, if any
+	Message string
+}
+
+var _ ErrWithExitCode = (*ExitCodeError)(nil)
+
+// Error returns the error text to print to stderr
+func (e *ExitCodeError) Error() string {
+	return e.Message
+}
+
+// ExitCode returns an exit code to use in case this error bubbles
+// up into an os.Exit() call
+func (e *ExitCodeError) ExitCode() int {
+	return e.Code
+}
+
 type writer struct {
 	mu     *sync.Mutex
 	source string
diff --git a/plugins/common/memory.go b/plugins/common/memory.go
new file mode 100644
index 000000000..7a8463209
--- /dev/null
+++ b/plugins/common/memory.go
@@ -0,0 +1,61 @@
+package common
+
+import (
+	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+// memoryValueRegex matches a docker-compatible memory value: a number with an
+// optional unit (b, k, m, g, t, p in either case) optionally followed by i and/or b
+var memoryValueRegex = regexp.MustCompile(`^(\d+(?:\.\d+)?)(?:([kKmMgGtTpP])[iI]?)?([bB])?$`)
+
+// IsValidMemoryValue returns true if the value is a docker-compatible memory value
+func IsValidMemoryValue(value string) bool {
+	return memoryValueRegex.MatchString(value)
+}
+
+// IsUnitlessMemoryValue returns true if the value is a valid memory value without any unit suffix
+func IsUnitlessMemoryValue(value string) bool {
+	matches := memoryValueRegex.FindStringSubmatch(value)
+	if matches == nil {
+		return false
+	}
+
+	return matches[2] == "" && matches[3] == ""
+}
+
+// ParseMemoryBytes converts a docker-compatible memory value into bytes.
+// Units are binary, and a value without a unit is treated as megabytes
+func ParseMemoryBytes(value string) (int64, error) {
+	matches := memoryValueRegex.FindStringSubmatch(value)
+	if matches == nil {
+		return 0, fmt.Errorf("Invalid memory value '%s'", value)
+	}
+
+	size, err := strconv.ParseFloat(matches[1], 64)
+	if err != nil {
+		return 0, fmt.Errorf("Invalid memory value '%s': %w", value, err)
+	}
+
+	multipliers := map[string]float64{
+		"k": 1 << 10,
+		"m": 1 << 20,
+		"g": 1 << 30,
+		"t": 1 << 40,
+		"p": 1 << 50,
+	}
+
+	unit := strings.ToLower(matches[2])
+	if unit == "" && matches[3] == "" {
+		unit = "m"
+	}
+
+	multiplier := float64(1)
+	if unit != "" {
+		multiplier = multipliers[unit]
+	}
+
+	return int64(size * multiplier), nil
+}
diff --git a/plugins/common/memory_test.go b/plugins/common/memory_test.go
new file mode 100644
index 000000000..402bec165
--- /dev/null
+++ b/plugins/common/memory_test.go
@@ -0,0 +1,66 @@
+package common
+
+import (
+	"testing"
+
+	. "github.com/onsi/gomega"
+)
+
+func TestCommonIsValidMemoryValue(t *testing.T) {
+	RegisterTestingT(t)
+
+	valid := []string{"0", "100", "1.5", "100b", "100B", "512k", "512K", "512kb", "512m", "512M", "512MB", "512Mi", "512MiB", "1g", "1G", "1GB", "1Gi", "1gib", "1t", "1T", "1p", "1P"}
+	for _, value := range valid {
+		Expect(IsValidMemoryValue(value)).To(BeTrue(), value)
+	}
+
+	invalid := []string{"", "-1", "abc", "1x", "1Gm", "1i", "1ib", "1 G", "1.2.3", ".5g", "100G --foo", "1E", "1e9"}
+	for _, value := range invalid {
+		Expect(IsValidMemoryValue(value)).To(BeFalse(), value)
+	}
+}
+
+func TestCommonIsUnitlessMemoryValue(t *testing.T) {
+	RegisterTestingT(t)
+
+	Expect(IsUnitlessMemoryValue("100")).To(BeTrue())
+	Expect(IsUnitlessMemoryValue("1.5")).To(BeTrue())
+	Expect(IsUnitlessMemoryValue("100b")).To(BeFalse())
+	Expect(IsUnitlessMemoryValue("1G")).To(BeFalse())
+	Expect(IsUnitlessMemoryValue("1Gi")).To(BeFalse())
+	Expect(IsUnitlessMemoryValue("abc")).To(BeFalse())
+}
+
+func TestCommonParseMemoryBytes(t *testing.T) {
+	RegisterTestingT(t)
+
+	expected := map[string]int64{
+		"0":      0,
+		"512":    536870912,
+		"512m":   536870912,
+		"512M":   536870912,
+		"512MB":  536870912,
+		"512Mi":  536870912,
+		"512MiB": 536870912,
+		"1g":     1073741824,
+		"1G":     1073741824,
+		"1GB":    1073741824,
+		"1Gi":    1073741824,
+		"1.5g":   1610612736,
+		"1024K":  1048576,
+		"100b":   100,
+		"100B":   100,
+		"1t":     1099511627776,
+		"1p":     1125899906842624,
+	}
+	for value, bytes := range expected {
+		parsed, err := ParseMemoryBytes(value)
+		Expect(err).NotTo(HaveOccurred(), value)
+		Expect(parsed).To(Equal(bytes), value)
+	}
+
+	for _, value := range []string{"", "-1", "1x", "1Gm", "100G --foo"} {
+		_, err := ParseMemoryBytes(value)
+		Expect(err).To(HaveOccurred(), value)
+	}
+}
diff --git a/plugins/common/plugin.toml b/plugins/common/plugin.toml
index f97a2876a..e8d320ef5 100644
--- a/plugins/common/plugin.toml
+++ b/plugins/common/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core common plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/common/properties.go b/plugins/common/properties.go
index 9e1da22d1..a477c2fec 100644
--- a/plugins/common/properties.go
+++ b/plugins/common/properties.go
@@ -129,7 +129,7 @@ func PropertyGetAll(pluginName string, appName string) (map[string]string, error
 	}
 
 	for _, file := range files {
-		if file.IsDir() {
+		if file.IsDir() || strings.HasPrefix(file.Name(), ".") {
 			continue
 		}
 		property := file.Name()
@@ -159,7 +159,7 @@ func PropertyGetAllByPrefix(pluginName string, appName string, prefix string) (m
 	}
 
 	for _, file := range files {
-		if file.IsDir() {
+		if file.IsDir() || strings.HasPrefix(file.Name(), ".") {
 			continue
 		}
 		property := file.Name()
@@ -192,64 +192,49 @@ func PropertyGetDefault(pluginName, appName, property, defaultValue string) (val
 
 // PropertyListAdd adds a property to a list at an optionally specified index
 func PropertyListAdd(pluginName string, appName string, property string, value string, index int) error {
-	if err := propertyTouch(pluginName, appName, property); err != nil {
-		return err
-	}
-
-	scannedLines, err := PropertyListGet(pluginName, appName, property)
-	if err != nil {
-		return err
-	}
-
 	value = strings.TrimSpace(value)
+	return PropertyListUpdate(pluginName, appName, property, func(scannedLines []string) ([]string, error) {
+		var lines []string
+		for i, line := range scannedLines {
+			if index != 0 && i == (index-1) {
+				lines = append(lines, value)
+			}
+			lines = append(lines, line)
+		}
 
-	var lines []string
-	for i, line := range scannedLines {
-		if index != 0 && i == (index-1) {
+		if index == 0 || index > len(scannedLines) {
 			lines = append(lines, value)
 		}
-		lines = append(lines, line)
-	}
 
-	if index == 0 || index > len(scannedLines) {
-		lines = append(lines, value)
-	}
+		return lines, nil
+	})
+}
 
-	return PropertyListWrite(pluginName, appName, property, lines)
+// PropertyListUpdate reads a list property, passes it to fn and writes back the
+// list fn returns, holding the plugin/app property lock throughout so a
+// concurrent update cannot be lost between the read and the write. Nothing is
+// written when fn returns an error.
+func PropertyListUpdate(pluginName string, appName string, property string, fn func(lines []string) ([]string, error)) error {
+	return PropertyLock(pluginName, appName, func(p *LockedProperties) error {
+		lines, err := PropertyListGet(pluginName, appName, property)
+		if err != nil {
+			return err
+		}
+
+		lines, err = fn(lines)
+		if err != nil {
+			return err
+		}
+
+		return p.ListWrite(property, lines)
+	})
 }
 
 // PropertyListWrite completely rewrites a list property
 func PropertyListWrite(pluginName string, appName string, property string, values []string) error {
-	if err := propertyTouch(pluginName, appName, property); err != nil {
-		return err
-	}
-
-	propertyPath := getPropertyPath(pluginName, appName, property)
-	file, err := os.OpenFile(propertyPath, os.O_RDWR|os.O_TRUNC, 0600)
-	if err != nil {
-		return err
-	}
-
-	w := bufio.NewWriter(file)
-	for _, line := range values {
-		fmt.Fprintln(w, line)
-	}
-	if err = w.Flush(); err != nil {
-		return fmt.Errorf("Unable to write %s config value %s.%s: %s", pluginName, appName, property, err.Error())
-	}
-
-	if err := file.Close(); err != nil {
-		return fmt.Errorf("Unable to close %s config value %s.%s: %s", pluginName, appName, property, err.Error())
-	}
-
-	if err := SetPermissions(SetPermissionInput{
-		Filename: propertyPath,
-		Mode:     os.FileMode(0600),
-	}); err != nil {
-		return fmt.Errorf("Unable to set permissions for %s config value %s.%s: %s", pluginName, appName, property, err.Error())
-	}
-
-	return nil
+	return PropertyLock(pluginName, appName, func(p *LockedProperties) error {
+		return p.ListWrite(property, values)
+	})
 }
 
 // PropertyListGet returns a property list
@@ -350,71 +335,142 @@ func PropertyListGetByValue(pluginName string, appName string, property string,
 
 // PropertyListRemove removes a value from a property list
 func PropertyListRemove(pluginName string, appName string, property string, value string) error {
-	lines, err := PropertyListGet(pluginName, appName, property)
-	if err != nil {
-		return err
-	}
-
-	propertyPath := getPropertyPath(pluginName, appName, property)
-	file, err := os.OpenFile(propertyPath, os.O_RDWR|os.O_TRUNC, 0600)
-	if err != nil {
-		return err
-	}
-
-	found := false
-	w := bufio.NewWriter(file)
-	for _, line := range lines {
-		if line == value {
-			found = true
-			continue
-		}
-		fmt.Fprintln(w, line)
-	}
-	if err = w.Flush(); err != nil {
-		return fmt.Errorf("Unable to write %s config value %s.%s: %s", pluginName, appName, property, err.Error())
-	}
-
-	if err := file.Close(); err != nil {
-		return fmt.Errorf("Unable to close %s config value %s.%s: %s", pluginName, appName, property, err.Error())
-	}
-
-	if err := SetPermissions(SetPermissionInput{
-		Filename: propertyPath,
-		Mode:     os.FileMode(0600),
-	}); err != nil {
-		return fmt.Errorf("Unable to set permissions for %s config value %s.%s: %s", pluginName, appName, property, err.Error())
-	}
-
-	if !found {
-		return errors.New("Property not found, nothing was removed")
-	}
-
-	return nil
+	return propertyListRemoveMatching(pluginName, appName, property, func(line string) bool {
+		return line == value
+	})
 }
 
 // PropertyListRemoveByPrefix removes a value by prefix from a property list
 func PropertyListRemoveByPrefix(pluginName string, appName string, property string, prefix string) error {
-	lines, err := PropertyListGet(pluginName, appName, property)
-	if err != nil {
-		return err
+	return propertyListRemoveMatching(pluginName, appName, property, func(line string) bool {
+		return strings.HasPrefix(line, prefix)
+	})
+}
+
+// propertyListRemoveMatching drops every line of a list property that matches,
+// returning an error when nothing matched. A missing property is reported as
+// not found without taking the lock, so removing from an app with no
+// properties does not create its property directory.
+func propertyListRemoveMatching(pluginName string, appName string, property string, matches func(line string) bool) error {
+	errNotFound := errors.New("Property not found, nothing was removed")
+	if !PropertyExists(pluginName, appName, property) {
+		return errNotFound
 	}
 
-	propertyPath := getPropertyPath(pluginName, appName, property)
-	file, err := os.OpenFile(propertyPath, os.O_RDWR|os.O_TRUNC, 0600)
-	if err != nil {
-		return err
-	}
-
-	found := false
-	w := bufio.NewWriter(file)
-	for _, line := range lines {
-		if strings.HasPrefix(line, prefix) {
-			found = true
-			continue
+	return PropertyListUpdate(pluginName, appName, property, func(lines []string) ([]string, error) {
+		found := false
+		kept := []string{}
+		for _, line := range lines {
+			if matches(line) {
+				found = true
+				continue
+			}
+			kept = append(kept, line)
 		}
-		fmt.Fprintln(w, line)
+
+		if !found {
+			return nil, errNotFound
+		}
+		return kept, nil
+	})
+}
+
+// PropertyListSet sets a value within a property list at a specified index
+func PropertyListSet(pluginName string, appName string, property string, value string, index int) error {
+	value = strings.TrimSpace(value)
+	return PropertyListUpdate(pluginName, appName, property, func(scannedLines []string) ([]string, error) {
+		var lines []string
+		if index >= len(scannedLines) {
+			lines = append(lines, scannedLines...)
+			lines = append(lines, value)
+		} else {
+			for i, line := range scannedLines {
+				if i == index {
+					lines = append(lines, value)
+				} else {
+					lines = append(lines, line)
+				}
+			}
+		}
+
+		return lines, nil
+	})
+}
+
+// LockedProperties writes the properties of one plugin/app pair while the
+// caller holds that pair's property lock. It is handed to the PropertyLock
+// callback and is only valid until the callback returns.
+type LockedProperties struct {
+	pluginName string
+	appName    string
+}
+
+// Write writes a value for a property
+func (p *LockedProperties) Write(property string, value string) error {
+	return writePropertyFile(p.pluginName, p.appName, property, []byte(value))
+}
+
+// Delete deletes a property
+func (p *LockedProperties) Delete(property string) error {
+	return PropertyDelete(p.pluginName, p.appName, property)
+}
+
+// ListWrite completely rewrites a list property
+func (p *LockedProperties) ListWrite(property string, values []string) error {
+	var b strings.Builder
+	for _, line := range values {
+		b.WriteString(line)
+		b.WriteString("\n")
 	}
-	if err = w.Flush(); err != nil {
+	return writePropertyFile(p.pluginName, p.appName, property, []byte(b.String()))
+}
+
+// MapWrite persists a string→string map for a property as a single JSON file.
+// A nil map is persisted as "{}".
+func (p *LockedProperties) MapWrite(property string, m map[string]string) error {
+	if m == nil {
+		m = map[string]string{}
+	}
+
+	b, err := json.Marshal(m)
+	if err != nil {
+		return fmt.Errorf("Unable to marshal %s map property %s.%s: %w", p.pluginName, p.appName, property, err)
+	}
+
+	return writePropertyFile(p.pluginName, p.appName, property, b)
+}
+
+// PropertyLock runs fn while holding an exclusive lock on the properties of a
+// plugin/app pair, creating the property directory when it does not exist yet.
+// Use it to read properties and write values derived from them without a
+// concurrent writer slipping in between. Reads inside fn go through the normal
+// getters; writes must go through the LockedProperties handle, since the public
+// writers take this same lock and would block forever. Locks for other
+// plugin/app pairs may be taken inside fn.
+func PropertyLock(pluginName string, appName string, fn func(p *LockedProperties) error) error {
+	if err := makePluginAppPropertyPath(pluginName, appName); err != nil {
+		return fmt.Errorf("Unable to create %s config directory for %s: %s", pluginName, appName, err.Error())
+	}
+
+	return LockDirectory(getPluginAppPropertyPath(pluginName, appName), func() error {
+		return fn(&LockedProperties{pluginName: pluginName, appName: appName})
+	})
+}
+
+// writePropertyFile atomically replaces a property's contents. The data is
+// written to a hidden temporary file in the property directory and renamed
+// into place, so a concurrent reader sees either the old or the new contents
+// and never a truncated file.
+func writePropertyFile(pluginName string, appName string, property string, data []byte) error {
+	propertyPath := getPropertyPath(pluginName, appName, property)
+	file, err := os.CreateTemp(filepath.Dir(propertyPath), fmt.Sprintf(".%s.tmp-*", property))
+	if err != nil {
+		return fmt.Errorf("Unable to write %s config value %s.%s: %s", pluginName, appName, property, err.Error())
+	}
+	defer os.Remove(file.Name())
+
+	if _, err := file.Write(data); err != nil {
+		file.Close()
 		return fmt.Errorf("Unable to write %s config value %s.%s: %s", pluginName, appName, property, err.Error())
 	}
 
@@ -423,96 +479,24 @@ func PropertyListRemoveByPrefix(pluginName string, appName string, property stri
 	}
 
 	if err := SetPermissions(SetPermissionInput{
-		Filename: propertyPath,
+		Filename: file.Name(),
 		Mode:     os.FileMode(0600),
 	}); err != nil {
 		return fmt.Errorf("Unable to set permissions for %s config value %s.%s: %s", pluginName, appName, property, err.Error())
 	}
 
-	if !found {
-		return errors.New("Property not found, nothing was removed")
-	}
-
-	return nil
-}
-
-// PropertyListSet sets a value within a property list at a specified index
-func PropertyListSet(pluginName string, appName string, property string, value string, index int) error {
-	if err := propertyTouch(pluginName, appName, property); err != nil {
-		return err
-	}
-
-	scannedLines, err := PropertyListGet(pluginName, appName, property)
-	if err != nil {
-		return err
-	}
-
-	value = strings.TrimSpace(value)
-
-	var lines []string
-	if index >= len(scannedLines) {
-		lines = append(lines, scannedLines...)
-		lines = append(lines, value)
-	} else {
-		for i, line := range scannedLines {
-			if i == index {
-				lines = append(lines, value)
-			} else {
-				lines = append(lines, line)
-			}
-		}
-	}
-
-	return PropertyListWrite(pluginName, appName, property, lines)
-}
-
-// propertyTouch ensures a given application property file exists
-func propertyTouch(pluginName string, appName string, property string) error {
-	if err := makePluginAppPropertyPath(pluginName, appName); err != nil {
-		return fmt.Errorf("Unable to create %s config directory for %s: %s", pluginName, appName, err.Error())
-	}
-
-	propertyPath := getPropertyPath(pluginName, appName, property)
-	if PropertyExists(pluginName, appName, property) {
-		return nil
-	}
-
-	file, err := os.Create(propertyPath)
-	if err != nil {
+	if err := os.Rename(file.Name(), propertyPath); err != nil {
 		return fmt.Errorf("Unable to write %s config value %s.%s: %s", pluginName, appName, property, err.Error())
 	}
-	defer file.Close()
 
 	return nil
 }
 
 // PropertyWrite writes a value for a given application property
 func PropertyWrite(pluginName string, appName string, property string, value string) error {
-	if err := propertyTouch(pluginName, appName, property); err != nil {
-		return err
-	}
-
-	propertyPath := getPropertyPath(pluginName, appName, property)
-	file, err := os.Create(propertyPath)
-	if err != nil {
-		return fmt.Errorf("Unable to write %s config value %s.%s: %s", pluginName, appName, property, err.Error())
-	}
-	defer file.Close()
-
-	fmt.Fprint(file, value)
-
-	if err := file.Close(); err != nil {
-		return fmt.Errorf("Unable to close %s config value %s.%s: %s", pluginName, appName, property, err.Error())
-	}
-
-	if err := SetPermissions(SetPermissionInput{
-		Filename: propertyPath,
-		Mode:     os.FileMode(0600),
-	}); err != nil {
-		return fmt.Errorf("Unable to set permissions for %s config value %s.%s: %s", pluginName, appName, property, err.Error())
-	}
-
-	return nil
+	return PropertyLock(pluginName, appName, func(p *LockedProperties) error {
+		return p.Write(property, value)
+	})
 }
 
 // PropertyMapWrite persists a string→string map for a given property as a single
@@ -520,32 +504,9 @@ func PropertyWrite(pluginName string, appName string, property string, value str
 // bytes (including '/' or '\n') because they live inside file content rather
 // than in the on-disk filename. A nil map is persisted as "{}".
 func PropertyMapWrite(pluginName string, appName string, property string, m map[string]string) error {
-	if err := propertyTouch(pluginName, appName, property); err != nil {
-		return err
-	}
-
-	if m == nil {
-		m = map[string]string{}
-	}
-
-	b, err := json.Marshal(m)
-	if err != nil {
-		return fmt.Errorf("Unable to marshal %s map property %s.%s: %w", pluginName, appName, property, err)
-	}
-
-	propertyPath := getPropertyPath(pluginName, appName, property)
-	if err := os.WriteFile(propertyPath, b, 0600); err != nil {
-		return fmt.Errorf("Unable to write %s map property %s.%s: %w", pluginName, appName, property, err)
-	}
-
-	if err := SetPermissions(SetPermissionInput{
-		Filename: propertyPath,
-		Mode:     os.FileMode(0600),
-	}); err != nil {
-		return fmt.Errorf("Unable to set permissions for %s map property %s.%s: %w", pluginName, appName, property, err)
-	}
-
-	return nil
+	return PropertyLock(pluginName, appName, func(p *LockedProperties) error {
+		return p.MapWrite(property, m)
+	})
 }
 
 // PropertyMapGet returns the string→string map persisted for a property. A
@@ -573,12 +534,14 @@ func PropertyMapGet(pluginName string, appName string, property string) (map[str
 
 // PropertyMapSet reads the current map, sets one key, and writes the map back.
 func PropertyMapSet(pluginName string, appName string, property string, key string, value string) error {
-	m, err := PropertyMapGet(pluginName, appName, property)
-	if err != nil {
-		return err
-	}
-	m[key] = value
-	return PropertyMapWrite(pluginName, appName, property, m)
+	return PropertyLock(pluginName, appName, func(p *LockedProperties) error {
+		m, err := PropertyMapGet(pluginName, appName, property)
+		if err != nil {
+			return err
+		}
+		m[key] = value
+		return p.MapWrite(property, m)
+	})
 }
 
 // PropertyMapDelete reads the current map, removes one key, and writes the map
@@ -587,15 +550,17 @@ func PropertyMapDelete(pluginName string, appName string, property string, key s
 	if !PropertyExists(pluginName, appName, property) {
 		return nil
 	}
-	m, err := PropertyMapGet(pluginName, appName, property)
-	if err != nil {
-		return err
-	}
-	if _, ok := m[key]; !ok {
-		return nil
-	}
-	delete(m, key)
-	return PropertyMapWrite(pluginName, appName, property, m)
+	return PropertyLock(pluginName, appName, func(p *LockedProperties) error {
+		m, err := PropertyMapGet(pluginName, appName, property)
+		if err != nil {
+			return err
+		}
+		if _, ok := m[key]; !ok {
+			return nil
+		}
+		delete(m, key)
+		return p.MapWrite(property, m)
+	})
 }
 
 // PropertyMapLength returns the number of entries in the map persisted for a
diff --git a/plugins/common/properties_test.go b/plugins/common/properties_test.go
index cdf44a052..429c730eb 100644
--- a/plugins/common/properties_test.go
+++ b/plugins/common/properties_test.go
@@ -1,9 +1,15 @@
 package common
 
 import (
+	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
+	"strconv"
+	"sync"
+	"sync/atomic"
 	"testing"
+	"time"
 
 	. "github.com/onsi/gomega"
 )
@@ -168,3 +174,193 @@ func TestPropertyMapMalformedJSONReturnsError(t *testing.T) {
 	_, err := PropertyMapGet(propertyTestPlugin, propertyTestApp, propertyTestName)
 	Expect(err).To(HaveOccurred())
 }
+
+func TestPropertyListAddConcurrent(t *testing.T) {
+	setupPropertyMapTest(t)
+
+	Expect(runConcurrently(50, func(i int) error {
+		return PropertyListAdd(propertyTestPlugin, propertyTestApp, "list", fmt.Sprintf("value-%d", i), 0)
+	})).To(Succeed())
+
+	lines, err := PropertyListGet(propertyTestPlugin, propertyTestApp, "list")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(lines).To(HaveLen(50))
+	for i := 0; i < 50; i++ {
+		Expect(lines).To(ContainElement(fmt.Sprintf("value-%d", i)))
+	}
+}
+
+func TestPropertyListRemoveConcurrent(t *testing.T) {
+	setupPropertyMapTest(t)
+
+	values := []string{}
+	for i := 0; i < 50; i++ {
+		values = append(values, fmt.Sprintf("value-%d", i))
+	}
+	Expect(PropertyListWrite(propertyTestPlugin, propertyTestApp, "list", values)).To(Succeed())
+
+	Expect(runConcurrently(len(values), func(i int) error {
+		return PropertyListRemove(propertyTestPlugin, propertyTestApp, "list", values[i])
+	})).To(Succeed())
+
+	lines, err := PropertyListGet(propertyTestPlugin, propertyTestApp, "list")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(lines).To(BeEmpty())
+}
+
+func TestPropertyListRemoveMissingDoesNotCreateDirectory(t *testing.T) {
+	setupPropertyMapTest(t)
+
+	Expect(PropertyListRemove(propertyTestPlugin, "missing-app", "list", "value")).NotTo(Succeed())
+	Expect(PropertyListRemoveByPrefix(propertyTestPlugin, "missing-app", "list", "value")).NotTo(Succeed())
+	Expect(PropertyMapDelete(propertyTestPlugin, "missing-app", "map", "key")).To(Succeed())
+	Expect(DirectoryExists(getPluginAppPropertyPath(propertyTestPlugin, "missing-app"))).To(BeFalse())
+}
+
+func TestPropertyListRemoveNotFoundLeavesList(t *testing.T) {
+	setupPropertyMapTest(t)
+
+	Expect(PropertyListWrite(propertyTestPlugin, propertyTestApp, "list", []string{"a", "b"})).To(Succeed())
+	Expect(PropertyListRemove(propertyTestPlugin, propertyTestApp, "list", "c")).To(MatchError("Property not found, nothing was removed"))
+
+	lines, err := PropertyListGet(propertyTestPlugin, propertyTestApp, "list")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(lines).To(Equal([]string{"a", "b"}))
+}
+
+func TestPropertyListUpdateErrorLeavesListUnchanged(t *testing.T) {
+	setupPropertyMapTest(t)
+
+	Expect(PropertyListWrite(propertyTestPlugin, propertyTestApp, "list", []string{"a", "b"})).To(Succeed())
+	err := PropertyListUpdate(propertyTestPlugin, propertyTestApp, "list", func(lines []string) ([]string, error) {
+		return nil, errors.New("boom")
+	})
+	Expect(err).To(MatchError("boom"))
+
+	lines, err := PropertyListGet(propertyTestPlugin, propertyTestApp, "list")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(lines).To(Equal([]string{"a", "b"}))
+}
+
+func TestPropertyMapSetConcurrent(t *testing.T) {
+	setupPropertyMapTest(t)
+
+	Expect(runConcurrently(50, func(i int) error {
+		return PropertyMapSet(propertyTestPlugin, propertyTestApp, propertyTestName, fmt.Sprintf("key-%d", i), "value")
+	})).To(Succeed())
+
+	got, err := PropertyMapGet(propertyTestPlugin, propertyTestApp, propertyTestName)
+	Expect(err).NotTo(HaveOccurred())
+	Expect(got).To(HaveLen(50))
+}
+
+func TestPropertyLockSerializesReadModifyWrite(t *testing.T) {
+	setupPropertyMapTest(t)
+
+	Expect(runConcurrently(50, func(i int) error {
+		return PropertyLock(propertyTestPlugin, propertyTestApp, func(p *LockedProperties) error {
+			current, err := strconv.Atoi(PropertyGetDefault(propertyTestPlugin, propertyTestApp, "counter", "0"))
+			if err != nil {
+				return err
+			}
+			return p.Write("counter", strconv.Itoa(current+1))
+		})
+	})).To(Succeed())
+
+	Expect(PropertyGet(propertyTestPlugin, propertyTestApp, "counter")).To(Equal("50"))
+}
+
+func TestLockDirectorySerializesConcurrentCallers(t *testing.T) {
+	RegisterTestingT(t)
+	t.Setenv(LockedDirectoriesEnvVar, "")
+
+	dir := t.TempDir()
+	var active atomic.Int32
+	var overlapped atomic.Bool
+	Expect(runConcurrently(20, func(i int) error {
+		return LockDirectory(dir, func() error {
+			if active.Add(1) > 1 {
+				overlapped.Store(true)
+			}
+			defer active.Add(-1)
+			time.Sleep(5 * time.Millisecond)
+			return nil
+		})
+	})).To(Succeed())
+
+	Expect(overlapped.Load()).To(BeFalse())
+}
+
+func TestLockDirectorySkipsDirectoriesHeldByParent(t *testing.T) {
+	setupPropertyMapTest(t)
+
+	dir := getPluginAppPropertyPath(propertyTestPlugin, propertyTestApp)
+	Expect(makePluginAppPropertyPath(propertyTestPlugin, propertyTestApp)).To(Succeed())
+	t.Setenv(LockedDirectoriesEnvVar, "/some/other/dir\n"+dir+"/")
+
+	done := make(chan error, 1)
+	go func() {
+		done <- LockDirectory(dir, func() error {
+			return PropertyWrite(propertyTestPlugin, propertyTestApp, "nested", "value")
+		})
+	}()
+
+	select {
+	case err := <-done:
+		Expect(err).NotTo(HaveOccurred())
+	case <-time.After(5 * time.Second):
+		t.Fatal("nested lock on a directory listed in DOKKU_LOCKED_DIRECTORIES blocked")
+	}
+	Expect(PropertyGet(propertyTestPlugin, propertyTestApp, "nested")).To(Equal("value"))
+}
+
+func TestPropertyWritesLeaveNoTemporaryFiles(t *testing.T) {
+	setupPropertyMapTest(t)
+
+	Expect(PropertyWrite(propertyTestPlugin, propertyTestApp, "plain", "value")).To(Succeed())
+	Expect(PropertyListWrite(propertyTestPlugin, propertyTestApp, "list", []string{"a"})).To(Succeed())
+	Expect(PropertyMapSet(propertyTestPlugin, propertyTestApp, propertyTestName, "key", "value")).To(Succeed())
+
+	entries, err := os.ReadDir(getPluginAppPropertyPath(propertyTestPlugin, propertyTestApp))
+	Expect(err).NotTo(HaveOccurred())
+	names := []string{}
+	for _, entry := range entries {
+		names = append(names, entry.Name())
+	}
+	Expect(names).To(ConsistOf("plain", "list", propertyTestName))
+}
+
+func TestPropertyGetAllIgnoresHiddenFiles(t *testing.T) {
+	setupPropertyMapTest(t)
+
+	Expect(PropertyWrite(propertyTestPlugin, propertyTestApp, "plain", "value")).To(Succeed())
+	stray := filepath.Join(getPluginAppPropertyPath(propertyTestPlugin, propertyTestApp), ".plain.tmp-123")
+	Expect(os.WriteFile(stray, []byte("partial"), 0600)).To(Succeed())
+
+	all, err := PropertyGetAll(propertyTestPlugin, propertyTestApp)
+	Expect(err).NotTo(HaveOccurred())
+	Expect(all).To(Equal(map[string]string{"plain": "value"}))
+
+	byPrefix, err := PropertyGetAllByPrefix(propertyTestPlugin, propertyTestApp, "")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(byPrefix).To(Equal(map[string]string{"plain": "value"}))
+}
+
+// runConcurrently calls fn with 0 through n-1 from n goroutines started
+// together, returning the joined errors of every call.
+func runConcurrently(n int, fn func(i int) error) error {
+	var wg sync.WaitGroup
+	start := make(chan struct{})
+	errs := make([]error, n)
+	for i := 0; i < n; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			<-start
+			errs[i] = fn(i)
+		}(i)
+	}
+	close(start)
+	wg.Wait()
+	return errors.Join(errs...)
+}
diff --git a/plugins/common/property-functions b/plugins/common/property-functions
index b273ddfa4..0b1c1645a 100755
--- a/plugins/common/property-functions
+++ b/plugins/common/property-functions
@@ -116,3 +116,43 @@ fn-plugin-property-setup-app() {
   declare PLUGIN="$1" APP="$2"
   "$PLUGIN_CORE_AVAILABLE_PATH/common/prop" "setup-app" "$PLUGIN" "$APP"
 }
+
+fn-plugin-property-lock() {
+  declare desc="runs a callback while holding the exclusive property lock for an app"
+  declare PLUGIN="$1" APP="$2" CALLBACK="$3"
+  shift 3
+  local lock_dir="${DOKKU_LIB_ROOT}/config/${PLUGIN}/${APP}"
+  local lock_fd previous_locked_directories="$DOKKU_LOCKED_DIRECTORIES"
+
+  if fn-plugin-property-lock-held "$lock_dir"; then
+    "$CALLBACK" "$@"
+    return
+  fi
+
+  fn-plugin-property-setup-app "$PLUGIN" "$APP"
+  exec {lock_fd}<"$lock_dir"
+  flock "$lock_fd"
+
+  export DOKKU_LOCKED_DIRECTORIES="${previous_locked_directories:+$previous_locked_directories$'\n'}$lock_dir"
+  "$CALLBACK" "$@"
+  local status=$?
+
+  if [[ -n "$previous_locked_directories" ]]; then
+    export DOKKU_LOCKED_DIRECTORIES="$previous_locked_directories"
+  else
+    unset DOKKU_LOCKED_DIRECTORIES
+  fi
+  exec {lock_fd}<&-
+  return "$status"
+}
+
+fn-plugin-property-lock-held() {
+  declare desc="returns whether a property lock directory is already held by a parent process"
+  declare LOCK_DIR="$1"
+  local held
+
+  while IFS= read -r held; do
+    [[ -n "$held" ]] && [[ "$held" == "$LOCK_DIR" ]] && return 0
+  done <<<"$DOKKU_LOCKED_DIRECTORIES"
+  return 1
+}
diff --git a/plugins/common/report_test.go b/plugins/common/report_test.go
index 747d58d68..9759367f1 100644
--- a/plugins/common/report_test.go
+++ b/plugins/common/report_test.go
@@ -208,8 +208,8 @@ func TestReportSingleAppJSONNonPluginPrefixKey(t *testing.T) {
 	// Keys that don't start with --<reportType>- should pass through with
 	// only the leading "--" stripped, regardless of TrimPrefix.
 	infoFlags := map[string]string{
-		"--build-id":          "abc123",
-		"--builds-retention":  "5",
+		"--build-id":         "abc123",
+		"--builds-retention": "5",
 	}
 
 	out := captureStdout(t, func() {
diff --git a/plugins/common/shellwords/shellwords.go b/plugins/common/shellwords/shellwords.go
new file mode 100644
index 000000000..93091ec7a
--- /dev/null
+++ b/plugins/common/shellwords/shellwords.go
@@ -0,0 +1,91 @@
+package shellwords
+
+import (
+	"strings"
+
+	"mvdan.cc/sh/v3/syntax"
+)
+
+// Split splits input into shell words using the parser directly, so quotes
+// delimit words and are stripped from the returned value, but nothing is
+// expanded. Parameter expansions, command substitutions, and other
+// metacharacters are preserved verbatim. Malformed input, such as an unbalanced
+// quote, returns the parser error.
+func Split(input string) ([]string, error) {
+	fields, _, err := SplitWithEnd(input)
+	return fields, err
+}
+
+// SplitWithEnd is Split plus the byte offset just past the last word the
+// parser consumed. Callers that must not lose data compare the offset against
+// the length of the input to detect a tail the parser skipped, such as a shell
+// comment.
+func SplitWithEnd(input string) ([]string, int, error) {
+	parser := syntax.NewParser()
+	var fields []string
+	end := 0
+	for word, err := range parser.WordsSeq(strings.NewReader(input)) {
+		if err != nil {
+			return nil, 0, err
+		}
+		fields = append(fields, literalWordValue(input, word.Parts))
+		end = int(word.End().Offset())
+	}
+	return fields, end, nil
+}
+
+// literalWordValue reconstructs the unquoted, unexpanded value of a shell word.
+// Literal and single-quoted parts contribute their literal text; double-quoted
+// parts have their surrounding quotes dropped while their contents stay
+// literal; every other part - parameter expansions, command substitutions,
+// arithmetic expansions - contributes its original source text unchanged.
+// Backslash escapes are removed the same way the shell removes them during
+// quote removal so a value such as `Host(\`app\`)` round-trips to `Host(`app`)`.
+func literalWordValue(input string, parts []syntax.WordPart) string {
+	var sb strings.Builder
+	for _, part := range parts {
+		switch p := part.(type) {
+		case *syntax.Lit:
+			sb.WriteString(unquoteBackslashes(p.Value, false))
+		case *syntax.SglQuoted:
+			sb.WriteString(p.Value)
+		case *syntax.DblQuoted:
+			for _, inner := range p.Parts {
+				if lit, ok := inner.(*syntax.Lit); ok {
+					sb.WriteString(unquoteBackslashes(lit.Value, true))
+					continue
+				}
+				sb.WriteString(input[inner.Pos().Offset():inner.End().Offset()])
+			}
+		default:
+			sb.WriteString(input[part.Pos().Offset():part.End().Offset()])
+		}
+	}
+	return sb.String()
+}
+
+// unquoteBackslashes removes backslashes the way the shell does during quote
+// removal. Inside double quotes only \$, \`, \", \\, and an escaped newline
+// lose their backslash; unquoted, a backslash escapes any following character.
+func unquoteBackslashes(s string, inDblQuotes bool) string {
+	if !strings.Contains(s, "\\") {
+		return s
+	}
+	var sb strings.Builder
+	for i := 0; i < len(s); i++ {
+		if s[i] == '\\' && i+1 < len(s) {
+			next := s[i+1]
+			if next == '\n' {
+				i++
+				continue
+			}
+			if !inDblQuotes || next == '$' || next == '`' || next == '"' || next == '\\' {
+				sb.WriteByte(next)
+				i++
+				continue
+			}
+		}
+		sb.WriteByte(s[i])
+	}
+	return sb.String()
+}
diff --git a/plugins/common/shellwords/shellwords_test.go b/plugins/common/shellwords/shellwords_test.go
new file mode 100644
index 000000000..6d4def3d5
--- /dev/null
+++ b/plugins/common/shellwords/shellwords_test.go
@@ -0,0 +1,107 @@
+package shellwords
+
+import (
+	"slices"
+	"testing"
+)
+
+func TestSplit(t *testing.T) {
+	cases := []struct {
+		name    string
+		input   string
+		want    []string
+		wantErr bool
+	}{
+		{
+			name:  "empty input",
+			input: "",
+		},
+		{
+			name:  "plain words",
+			input: "python -m http.server 5000",
+			want:  []string{"python", "-m", "http.server", "5000"},
+		},
+		{
+			name:  "double quoted word",
+			input: `sh -c "echo hi"`,
+			want:  []string{"sh", "-c", "echo hi"},
+		},
+		{
+			name:  "single quoted word",
+			input: `sh -c 'echo hi'`,
+			want:  []string{"sh", "-c", "echo hi"},
+		},
+		{
+			name:  "escaped quotes inside double quotes",
+			input: `sh -c "echo \"hi\""`,
+			want:  []string{"sh", "-c", `echo "hi"`},
+		},
+		{
+			name:  "escaped single quote outside quotes",
+			input: `echo it\'s`,
+			want:  []string{"echo", "it's"},
+		},
+		{
+			name:  "parameter expansion kept verbatim",
+			input: `sh -c "echo $PORT"`,
+			want:  []string{"sh", "-c", "echo $PORT"},
+		},
+		{
+			name:  "command substitution kept verbatim",
+			input: `echo $(date)`,
+			want:  []string{"echo", "$(date)"},
+		},
+		{
+			name:  "backticks kept verbatim",
+			input: "echo `date`",
+			want:  []string{"echo", "`date`"},
+		},
+		{
+			name:  "escaped backticks inside double quotes",
+			input: "echo \"\\`date\\`\"",
+			want:  []string{"echo", "`date`"},
+		},
+		{
+			name:    "unterminated quote",
+			input:   `sh -c "echo hi`,
+			wantErr: true,
+		},
+		{
+			name:    "bare operator",
+			input:   `a && b`,
+			wantErr: true,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := Split(tc.input)
+			if tc.wantErr {
+				if err == nil {
+					t.Fatalf("Split(%q) expected error, got %q", tc.input, got)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("Split(%q) unexpected error: %v", tc.input, err)
+			}
+			if !slices.Equal(got, tc.want) {
+				t.Fatalf("Split(%q) = %q, want %q", tc.input, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestSplitWithEndReportsSkippedComment(t *testing.T) {
+	input := "a # comment"
+	fields, end, err := SplitWithEnd(input)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !slices.Equal(fields, []string{"a"}) {
+		t.Fatalf("fields = %q, want [a]", fields)
+	}
+	if end != 1 {
+		t.Fatalf("end = %d, want 1", end)
+	}
+}
diff --git a/plugins/common/src/common/common.go b/plugins/common/src/common/common.go
index 58412f591..0dd33298c 100644
--- a/plugins/common/src/common/common.go
+++ b/plugins/common/src/common/common.go
@@ -5,6 +5,7 @@ import (
 	"os"
 
 	"github.com/dokku/dokku/plugins/common"
+	"github.com/dokku/dokku/plugins/common/shellwords"
 	flag "github.com/spf13/pflag"
 )
 
@@ -92,6 +93,16 @@ func main() {
 	case "is-valid-app-name-old":
 		appName := flag.Arg(1)
 		err = common.IsValidAppNameOld(appName)
+	case "split-command":
+		var fields []string
+		fields, err = shellwords.Split(flag.Arg(1))
+		if err != nil {
+			err = fmt.Errorf("Unable to parse command %q: %w", flag.Arg(1), err)
+			break
+		}
+		for _, field := range fields {
+			fmt.Printf("%s\x00", field)
+		}
 	case "verify-app-name":
 		appName := flag.Arg(1)
 		err = common.VerifyAppName(appName)
diff --git a/plugins/config/Makefile b/plugins/config/Makefile
index a27152cf4..70a3d3cfd 100644
--- a/plugins/config/Makefile
+++ b/plugins/config/Makefile
@@ -1,4 +1,3 @@
-GOARCH ?= amd64
 SUBCOMMANDS = subcommands/bundle subcommands/clear subcommands/export subcommands/get subcommands/import subcommands/keys subcommands/show subcommands/set subcommands/unset
 TRIGGERS = triggers/config-export triggers/config-get triggers/config-get-global triggers/config-migrate-env triggers/install triggers/config-set triggers/config-unset triggers/post-app-clone-setup triggers/post-app-rename-setup triggers/post-create triggers/post-delete
 BUILD = commands config_sub subcommands triggers
diff --git a/plugins/config/concurrency_test.go b/plugins/config/concurrency_test.go
new file mode 100644
index 000000000..d807b971e
--- /dev/null
+++ b/plugins/config/concurrency_test.go
@@ -0,0 +1,62 @@
+package config
+
+import (
+	"errors"
+	"fmt"
+	"sync"
+	"testing"
+
+	. "github.com/onsi/gomega"
+)
+
+func TestConfigSetManyConcurrent(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t)
+
+	const count = 20
+	var wg sync.WaitGroup
+	errs := make([]error, count)
+	for i := 0; i < count; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			errs[i] = SetMany(testAppName, map[string]string{fmt.Sprintf("KEY%d", i): "value"}, false, false)
+		}(i)
+	}
+	wg.Wait()
+	Expect(errors.Join(errs...)).NotTo(HaveOccurred())
+
+	for i := 0; i < count; i++ {
+		expectValue(testAppName, fmt.Sprintf("KEY%d", i), "value")
+	}
+	expectValue(testAppName, "testKey", "TESTING")
+}
+
+func TestConfigUnsetManyConcurrent(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t)
+
+	const count = 20
+	entries := map[string]string{}
+	for i := 0; i < count; i++ {
+		entries[fmt.Sprintf("KEY%d", i)] = "value"
+	}
+	Expect(SetMany(testAppName, entries, false, false)).To(Succeed())
+
+	var wg sync.WaitGroup
+	errs := make([]error, count)
+	for i := 0; i < count; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			errs[i] = UnsetMany(testAppName, []string{fmt.Sprintf("KEY%d", i)}, false)
+		}(i)
+	}
+	wg.Wait()
+	Expect(errors.Join(errs...)).NotTo(HaveOccurred())
+
+	for i := 0; i < count; i++ {
+		expectNoValue(testAppName, fmt.Sprintf("KEY%d", i))
+	}
+	expectValue(testAppName, "testKey", "TESTING")
+}
diff --git a/plugins/config/config.go b/plugins/config/config.go
index 5b898370d..1ebbb94c5 100644
--- a/plugins/config/config.go
+++ b/plugins/config/config.go
@@ -3,6 +3,7 @@ package config
 import (
 	"fmt"
 	"os"
+	"path/filepath"
 	"regexp"
 
 	"github.com/dokku/dokku/plugins/common"
@@ -32,10 +33,6 @@ func GetWithDefault(appName string, key string, defaultValue string) (value stri
 // SetMany variables in the environment. If appName is empty the global config is used. If restart is true the app is restarted.
 func SetMany(appName string, entries map[string]string, replace bool, restart bool) (err error) {
 	global := appName == "" || appName == "--global"
-	env, err := loadAppOrGlobalEnv(appName)
-	if err != nil {
-		return
-	}
 	keys := make([]string, 0, len(entries))
 	for k := range entries {
 		if err = validateKey(k); err != nil {
@@ -43,23 +40,28 @@ func SetMany(appName string, entries map[string]string, replace bool, restart bo
 		}
 	}
 
-	if replace {
-		env.Clear()
-	}
-	for k, v := range entries {
-		env.Set(k, v)
-		keys = append(keys, k)
-	}
-	if len(entries) != 0 {
+	changed, err := updateAppOrGlobalEnv(appName, func(env *Env) bool {
+		if replace {
+			env.Clear()
+		}
+		for k, v := range entries {
+			env.Set(k, v)
+			keys = append(keys, k)
+		}
+		if len(entries) == 0 {
+			return false
+		}
+
 		common.LogInfo1Quiet("Setting config vars")
 		if os.Getenv("DOKKU_QUIET_OUTPUT") == "" {
 			fmt.Println(prettyPrintEnvEntries("       ", entries))
 		}
-		env.Write()
-		common.SetPermissions(common.SetPermissionInput{
-			Filename: env.Filename(),
-			Mode:     os.FileMode(0600),
-		})
+		return true
+	})
+	if err != nil {
+		return err
+	}
+	if changed {
 		triggerUpdate(appName, "set", keys)
 	}
 	if !global && restart && shouldRestart(appName) {
@@ -71,31 +73,28 @@ func SetMany(appName string, entries map[string]string, replace bool, restart bo
 // UnsetMany a value in a config. If appName is empty the global config is used. If restart is true the app is restarted.
 func UnsetMany(appName string, keys []string, restart bool) (err error) {
 	global := appName == "" || appName == "--global"
-	env, err := loadAppOrGlobalEnv(appName)
-	if err != nil {
-		return
-	}
-	var changed = false
 	for _, k := range keys {
 		if err = validateKey(k); err != nil {
 			return
 		}
 	}
-	for _, k := range keys {
-		if _, hasKey := env.Map()[k]; hasKey {
-			common.LogInfo1Quiet(fmt.Sprintf("Unsetting %s", k))
-			env.Unset(k)
-			changed = true
-		} else {
-			common.LogInfo1Quiet(fmt.Sprintf("Skipping %s, it is not set in the environment", k))
+	changed, err := updateAppOrGlobalEnv(appName, func(env *Env) bool {
+		changed := false
+		for _, k := range keys {
+			if _, hasKey := env.Map()[k]; hasKey {
+				common.LogInfo1Quiet(fmt.Sprintf("Unsetting %s", k))
+				env.Unset(k)
+				changed = true
+			} else {
+				common.LogInfo1Quiet(fmt.Sprintf("Skipping %s, it is not set in the environment", k))
+			}
 		}
+		return changed
+	})
+	if err != nil {
+		return err
 	}
 	if changed {
-		env.Write()
-		common.SetPermissions(common.SetPermissionInput{
-			Filename: env.Filename(),
-			Mode:     os.FileMode(0600),
-		})
 		triggerUpdate(appName, "unset", keys)
 	}
 	if !global && restart && shouldRestart(appName) {
@@ -107,22 +106,19 @@ func UnsetMany(appName string, keys []string, restart bool) (err error) {
 // UnsetAll removes all config keys
 func UnsetAll(appName string, restart bool) (err error) {
 	global := appName == "" || appName == "--global"
-	env, err := loadAppOrGlobalEnv(appName)
+	changed, err := updateAppOrGlobalEnv(appName, func(env *Env) bool {
+		changed := false
+		for k := range env.Map() {
+			common.LogInfo1Quiet(fmt.Sprintf("Unsetting %s", k))
+			env.Unset(k)
+			changed = true
+		}
+		return changed
+	})
 	if err != nil {
-		return
-	}
-	var changed = false
-	for k := range env.Map() {
-		common.LogInfo1Quiet(fmt.Sprintf("Unsetting %s", k))
-		env.Unset(k)
-		changed = true
+		return err
 	}
 	if changed {
-		env.Write()
-		common.SetPermissions(common.SetPermissionInput{
-			Filename: env.Filename(),
-			Mode:     os.FileMode(0600),
-		})
 		triggerUpdate(appName, "clear", []string{})
 	}
 	if !global && restart && shouldRestart(appName) {
@@ -131,6 +127,48 @@ func UnsetAll(appName string, restart bool) (err error) {
 	return
 }
 
+// updateAppOrGlobalEnv loads the app or global environment, passes it to
+// update and writes it back when update reports a change, returning whether it
+// did. The directory holding the environment file stays locked from the load
+// to the write, so concurrent config changes cannot drop each other's keys.
+// Triggers reacting to the change must run after this returns, as a trigger
+// that changes the same environment would otherwise wait on the lock forever.
+func updateAppOrGlobalEnv(appName string, update func(env *Env) bool) (bool, error) {
+	filename := getGlobalFile()
+	if appName != "" && appName != "--global" {
+		var err error
+		if filename, err = getAppFile(appName); err != nil {
+			return false, err
+		}
+	}
+
+	changed := false
+	apply := func() error {
+		env, err := loadAppOrGlobalEnv(appName)
+		if err != nil {
+			return err
+		}
+
+		if !update(env) {
+			return nil
+		}
+
+		if err := env.Write(); err != nil {
+			return fmt.Errorf("Unable to write config vars: %s", err.Error())
+		}
+		changed = true
+		return nil
+	}
+
+	dir := filepath.Dir(filename)
+	if !common.DirectoryExists(dir) {
+		return changed, apply()
+	}
+
+	err := common.LockDirectory(dir, apply)
+	return changed, err
+}
+
 func shouldRestart(appName string) bool {
 	results, _ := common.CallPlugnTrigger(common.PlugnTriggerInput{
 		Trigger: "ps-get-property",
diff --git a/plugins/config/config_test.go b/plugins/config/config_test.go
index ef8b48d29..b82a00ff7 100644
--- a/plugins/config/config_test.go
+++ b/plugins/config/config_test.go
@@ -6,68 +6,47 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/dokku/dokku/plugins/common"
-
 	. "github.com/onsi/gomega"
 )
 
-var (
-	testAppName      = "test-app-1"
-	dokkuRoot        = common.MustGetEnv("DOKKU_ROOT")
-	dokkuLibRoot     = common.MustGetEnv("DOKKU_LIB_ROOT")
-	testAppRoot      = filepath.Join(dokkuRoot, testAppName)
-	testAppDir       = filepath.Join(dokkuLibRoot, "config", testAppName)
-	globalConfigFile = filepath.Join(dokkuLibRoot, "config", "--global", "ENV")
-)
+const testAppName = "test-app-1"
 
-func setupTests() (err error) {
-	if err := os.Setenv("PLUGIN_PATH", "/var/lib/dokku/plugins"); err != nil {
-		return err
-	}
+// setupTestApp points the dokku environment at temporary directories and seeds
+// the app and global config the tests read, returning the app's config
+// directory. Nothing is written to a real dokku installation and no dokku user
+// needs to exist, which matters now that a failure to apply ownership is
+// reported rather than discarded. The directories are removed with the test.
+func setupTestApp(t *testing.T) (testAppDir string) {
+	t.Helper()
 
-	if err := os.Setenv("PLUGIN_ENABLED_PATH", "/var/lib/dokku/plugins/enabled"); err != nil {
-		return err
-	}
+	dokkuRoot, libRoot := setupIsolatedEnv(t)
+	t.Setenv("PLUGIN_ENABLED_PATH", filepath.Join(libRoot, "plugins", "enabled"))
+	t.Setenv("PLUGIN_CORE_AVAILABLE_PATH", filepath.Join(libRoot, "core-plugins", "available"))
 
-	return os.Setenv("PLUGIN_CORE_AVAILABLE_PATH", "/var/lib/dokku/core-plugins/available")
-}
+	Expect(os.MkdirAll(filepath.Join(dokkuRoot, testAppName), 0755)).To(Succeed())
 
-func setupTestApp() (err error) {
-	Expect(os.MkdirAll(testAppRoot, 0766)).To(Succeed())
-	Expect(os.MkdirAll(testAppDir, 0766)).To(Succeed())
-	b := []byte("export testKey=TESTING\n")
-	if err = os.WriteFile(strings.Join([]string{testAppDir, "/ENV"}, ""), b, 0644); err != nil {
-		return
-	}
+	testAppDir = filepath.Join(libRoot, "config", testAppName)
+	Expect(os.MkdirAll(testAppDir, 0755)).To(Succeed())
+	Expect(os.WriteFile(filepath.Join(testAppDir, "ENV"), []byte("export testKey=TESTING\n"), 0600)).To(Succeed())
 
-	Expect(os.MkdirAll(filepath.Dir(globalConfigFile), 0766)).To(Succeed())
-	b = []byte("export testKey=GLOBAL_TESTING\nexport globalKey=GLOBAL_VALUE")
-	if err = os.WriteFile(globalConfigFile, b, 0644); err != nil {
-		return
-	}
-	return
-}
+	globalConfigFile := filepath.Join(libRoot, "config", "--global", "ENV")
+	Expect(os.MkdirAll(filepath.Dir(globalConfigFile), 0755)).To(Succeed())
+	Expect(os.WriteFile(globalConfigFile, []byte("export testKey=GLOBAL_TESTING\nexport globalKey=GLOBAL_VALUE"), 0600)).To(Succeed())
 
-func teardownTestApp() {
-	os.RemoveAll(testAppRoot)
-	os.RemoveAll(testAppDir)
+	return testAppDir
 }
 
 func TestConfigGetWithDefault(t *testing.T) {
 	RegisterTestingT(t)
-	Expect(setupTests()).To(Succeed())
-	Expect(setupTestApp()).To(Succeed())
+	setupTestApp(t)
 	Expect(GetWithDefault(testAppName, "unknownKey", "UNKNOWN")).To(Equal("UNKNOWN"))
 	Expect(GetWithDefault(testAppName, "testKey", "testKey")).To(Equal("TESTING"))
 	Expect(GetWithDefault(testAppName+"-nonexistent", "testKey", "default")).To(Equal("default"))
-	teardownTestApp()
 }
 
 func TestConfigGet(t *testing.T) {
 	RegisterTestingT(t)
-	Expect(setupTests()).To(Succeed())
-	Expect(setupTestApp()).To(Succeed())
-	defer teardownTestApp()
+	setupTestApp(t)
 
 	expectValue(testAppName, "testKey", "TESTING")
 	expectValue("", "testKey", "GLOBAL_TESTING")
@@ -78,9 +57,7 @@ func TestConfigGet(t *testing.T) {
 
 func TestConfigSetMany(t *testing.T) {
 	RegisterTestingT(t)
-	Expect(setupTests()).To(Succeed())
-	Expect(setupTestApp()).To(Succeed())
-	defer teardownTestApp()
+	setupTestApp(t)
 
 	expectValue(testAppName, "testKey", "TESTING")
 
@@ -102,9 +79,7 @@ func TestConfigSetMany(t *testing.T) {
 
 func TestConfigUnsetAll(t *testing.T) {
 	RegisterTestingT(t)
-	Expect(setupTests()).To(Succeed())
-	Expect(setupTestApp()).To(Succeed())
-	defer teardownTestApp()
+	setupTestApp(t)
 
 	expectValue(testAppName, "testKey", "TESTING")
 	expectValue("", "testKey", "GLOBAL_TESTING")
@@ -119,9 +94,7 @@ func TestConfigUnsetAll(t *testing.T) {
 
 func TestConfigUnsetMany(t *testing.T) {
 	RegisterTestingT(t)
-	Expect(setupTests()).To(Succeed())
-	Expect(setupTestApp()).To(Succeed())
-	defer teardownTestApp()
+	setupTestApp(t)
 
 	expectValue(testAppName, "testKey", "TESTING")
 	expectValue("", "testKey", "GLOBAL_TESTING")
@@ -140,9 +113,7 @@ func TestConfigUnsetMany(t *testing.T) {
 
 func TestConfigImport(t *testing.T) {
 	RegisterTestingT(t)
-	Expect(setupTests()).To(Succeed())
-	Expect(setupTestApp()).To(Succeed())
-	defer teardownTestApp()
+	setupTestApp(t)
 
 	tempFile, err := os.CreateTemp("", "test-config-import-*.env")
 	Expect(err).To(Succeed())
@@ -164,7 +135,7 @@ testKey2=TESTING-updated2
 	env.Set("testKey", "TESTING-original1")
 	env.Set("testKey2", "TESTING-original2")
 	env.Set("testKey3", "TESTING-original3")
-	env.Write()
+	Expect(env.Write()).To(Succeed())
 
 	Expect(CommandImport(testAppName, false, false, true, "envfile", tempFile.Name())).To(Succeed())
 	expectValue(testAppName, "testKey", "TESTING-updated1")
@@ -179,9 +150,7 @@ testKey2=TESTING-updated2
 
 func TestConfigImportJSON(t *testing.T) {
 	RegisterTestingT(t)
-	Expect(setupTests()).To(Succeed())
-	Expect(setupTestApp()).To(Succeed())
-	defer teardownTestApp()
+	setupTestApp(t)
 
 	tempFile, err := os.CreateTemp("", "test-config-import-*.json")
 	Expect(err).To(Succeed())
@@ -201,7 +170,7 @@ func TestConfigImportJSON(t *testing.T) {
 	env.Set("testKey", "TESTING-original1")
 	env.Set("testKey2", "TESTING-original2")
 	env.Set("testKey3", "TESTING-original3")
-	env.Write()
+	Expect(env.Write()).To(Succeed())
 
 	Expect(CommandImport(testAppName, false, false, true, "json", tempFile.Name())).To(Succeed())
 	expectValue(testAppName, "testKey", "TESTING-updated1")
@@ -216,9 +185,7 @@ func TestConfigImportJSON(t *testing.T) {
 
 func TestEnvironmentLoading(t *testing.T) {
 	RegisterTestingT(t)
-	Expect(setupTests()).To(Succeed())
-	Expect(setupTestApp()).To(Succeed())
-	defer teardownTestApp()
+	setupTestApp(t)
 
 	env, err := LoadMergedAppEnv(testAppName)
 	Expect(err).To(Succeed())
@@ -231,7 +198,7 @@ func TestEnvironmentLoading(t *testing.T) {
 	env, err = LoadAppEnv(testAppName)
 	env.Set("testKey", "TESTING-updated")
 	env.Set("testKey2", "TESTING-'\n'-updated")
-	env.Write()
+	Expect(env.Write()).To(Succeed())
 
 	expectValue(testAppName, "testKey", "TESTING-updated")
 	expectValue(testAppName, "testKey2", "TESTING-'\n'-updated")
@@ -241,9 +208,7 @@ func TestEnvironmentLoading(t *testing.T) {
 
 func TestInvalidKeys(t *testing.T) {
 	RegisterTestingT(t)
-	Expect(setupTests()).To(Succeed())
-	Expect(setupTestApp()).To(Succeed())
-	defer teardownTestApp()
+	setupTestApp(t)
 
 	invalidKeys := []string{"0invalidKey", "invalid:key", "invalid=Key", "!invalidKey"}
 	for _, key := range invalidKeys {
@@ -259,11 +224,9 @@ func TestInvalidKeys(t *testing.T) {
 
 func TestInvalidEnvOnDisk(t *testing.T) {
 	RegisterTestingT(t)
-	Expect(setupTests()).To(Succeed())
-	Expect(setupTestApp()).To(Succeed())
-	defer teardownTestApp()
+	testAppDir := setupTestApp(t)
 
-	appConfigFile := strings.Join([]string{testAppDir, "/ENV"}, "")
+	appConfigFile := filepath.Join(testAppDir, "ENV")
 	b := []byte("export --invalid-key=TESTING\nexport valid_key=value\n")
 	if err := os.WriteFile(appConfigFile, b, 0644); err != nil {
 		return
@@ -284,6 +247,67 @@ func TestInvalidEnvOnDisk(t *testing.T) {
 
 }
 
+// TestConfigSetManyReportsWriteFailure covers the reported bug: a write that
+// never lands used to print "Setting config vars", fire the update trigger and
+// exit successfully. The app's config directory path is occupied by a regular
+// file so the write fails with ENOTDIR, which root cannot bypass; the read
+// treats the same path as an empty environment and succeeds.
+func TestConfigSetManyReportsWriteFailure(t *testing.T) {
+	RegisterTestingT(t)
+	_, libRoot := setupIsolatedEnv(t)
+
+	Expect(os.MkdirAll(filepath.Join(libRoot, "config"), 0755)).To(Succeed())
+	Expect(os.WriteFile(filepath.Join(libRoot, "config", "alpha"), []byte(""), 0600)).To(Succeed())
+
+	Expect(SetMany("alpha", map[string]string{"testKey": "value"}, false, false)).ToNot(Succeed())
+	expectNoValue("alpha", "testKey")
+}
+
+// TestConfigUnsetManyReportsWriteFailure and its UnsetAll counterpart cover the
+// same bug for the removal paths. No filesystem state lets the read load a
+// non-empty environment and still fail the write for root, because both go
+// through one path resolved once at load, so the permission step inside Write
+// is made to fail instead. That step runs against the staged temporary file, so
+// the environment on disk is left untouched.
+func TestConfigUnsetManyReportsWriteFailure(t *testing.T) {
+	RegisterTestingT(t)
+	setupIsolatedEnv(t)
+	setupIsolatedApp(t, "alpha")
+
+	t.Setenv("DOKKU_SYSTEM_USER", "dokku-no-such-user")
+	Expect(UnsetMany("alpha", []string{"testKey"}, false)).ToNot(Succeed())
+	expectValue("alpha", "testKey", "TESTING")
+}
+
+func TestConfigUnsetAllReportsWriteFailure(t *testing.T) {
+	RegisterTestingT(t)
+	setupIsolatedEnv(t)
+	setupIsolatedApp(t, "alpha")
+
+	t.Setenv("DOKKU_SYSTEM_USER", "dokku-no-such-user")
+	Expect(UnsetAll("alpha", false)).ToNot(Succeed())
+	expectValue("alpha", "testKey", "TESTING")
+}
+
+// TestTriggerConfigUnsetReportsFailure covers the config-unset plugin trigger,
+// which discarded the error it was handed and always exited successfully. An
+// invalid key fails validation before anything is read or written.
+func TestTriggerConfigUnsetReportsFailure(t *testing.T) {
+	RegisterTestingT(t)
+	setupIsolatedEnv(t)
+
+	Expect(TriggerConfigUnset("alpha", "invalid-key", false)).ToNot(Succeed())
+}
+
+// setupIsolatedApp creates the config directory for an app inside an isolated
+// environment and seeds it with a value to remove
+func setupIsolatedApp(t *testing.T, appName string) {
+	t.Helper()
+
+	Expect(setupAppConfigDir(appName)).To(Succeed())
+	Expect(SetMany(appName, map[string]string{"testKey": "TESTING"}, false, false)).To(Succeed())
+}
+
 func expectValue(appName string, key string, expected string) {
 	v, ok := Get(appName, key)
 	Expect(ok).To(Equal(true))
diff --git a/plugins/config/environment.go b/plugins/config/environment.go
index 3e9d5313d..bb4f6166f 100644
--- a/plugins/config/environment.go
+++ b/plugins/config/environment.go
@@ -164,12 +164,77 @@ func (e *Env) Merge(other *Env) {
 	}
 }
 
-// Write an Env back to the file it was read from as an exportfile
+// Write an Env back to the file it was read from as an exportfile. The contents
+// are written to a temporary file in the same directory and renamed into place,
+// so a failed write leaves the previous environment intact rather than
+// truncating it. The temporary file is created at 0600, so the values are never
+// on disk in a mode other users can read.
 func (e *Env) Write() error {
 	if e.filename == "" {
 		return errors.New("this Env was created unbound to a file")
 	}
-	return godotenv.Write(e.Map(), e.filename)
+
+	contents, err := godotenv.Marshal(e.Map())
+	if err != nil {
+		return fmt.Errorf("Unable to serialize environment: %s", err.Error())
+	}
+
+	target := resolveEnvPath(e.filename)
+	file, err := os.CreateTemp(filepath.Dir(target), ".ENV-*")
+	if err != nil {
+		return fmt.Errorf("Unable to create temporary environment file: %s", err.Error())
+	}
+	defer os.Remove(file.Name())
+
+	if err := writeEnvFile(file, contents); err != nil {
+		return err
+	}
+
+	if err := common.SetPermissions(common.SetPermissionInput{
+		Filename: file.Name(),
+		Mode:     os.FileMode(0600),
+	}); err != nil {
+		return fmt.Errorf("Unable to set permissions on environment file: %s", err.Error())
+	}
+
+	if err := os.Rename(file.Name(), target); err != nil {
+		return fmt.Errorf("Unable to move environment file into place: %s", err.Error())
+	}
+
+	return nil
+}
+
+// resolveEnvPath follows any symlink at filename so the environment is written
+// through the symlink rather than replacing it with a regular file, and so the
+// temporary file is created on the same filesystem as the real target. A path
+// that cannot be resolved - a file that does not exist yet being the common
+// case - is returned unchanged.
+func resolveEnvPath(filename string) string {
+	resolved, err := filepath.EvalSymlinks(filename)
+	if err != nil {
+		return filename
+	}
+
+	return resolved
+}
+
+// writeEnvFile writes contents to file, flushes it to disk and closes it
+func writeEnvFile(file *os.File, contents string) error {
+	if _, err := file.WriteString(contents + "\n"); err != nil {
+		file.Close()
+		return fmt.Errorf("Unable to write environment file: %s", err.Error())
+	}
+
+	if err := file.Sync(); err != nil {
+		file.Close()
+		return fmt.Errorf("Unable to flush environment file: %s", err.Error())
+	}
+
+	if err := file.Close(); err != nil {
+		return fmt.Errorf("Unable to close environment file: %s", err.Error())
+	}
+
+	return nil
 }
 
 // Export the Env in the given format
@@ -331,20 +396,28 @@ func prettyPrintEnvEntries(prefix string, entries map[string]string) string {
 
 func loadFromFile(name string, filename string) (env *Env, err error) {
 	envMap := make(map[string]string)
+	dirty := false
 	if filename == "-" {
 		envMap, err = godotenv.Parse(os.Stdin)
 		if err != nil {
 			return nil, err
 		}
 	}
-	if _, err := os.Stat(filename); err == nil {
-		envMap, err = godotenv.Read(filename)
-		if err != nil {
-			return nil, err
+	if _, statErr := os.Stat(filename); statErr == nil {
+		contents, readErr := os.ReadFile(filename)
+		if readErr != nil {
+			return nil, readErr
 		}
+
+		parsed, parseErr := godotenv.Unmarshal(string(contents))
+		if parseErr != nil {
+			common.LogInfo1(fmt.Sprintf("Discarding unparseable entries from config for %s: %s", name, parseErr))
+			parsed = parseLineByLine(string(contents))
+			dirty = true
+		}
+		envMap = parsed
 	}
 
-	dirty := false
 	for k := range envMap {
 		if err := validateKey(k); err != nil {
 			common.LogInfo1(fmt.Sprintf("Deleting invalid key %s from config for %s", k, name))
@@ -366,6 +439,23 @@ func loadFromFile(name string, filename string) (env *Env, err error) {
 	return
 }
 
+// parseLineByLine parses ENVFILE contents a line at a time, discarding the
+// lines the parser rejects, so that a single malformed entry does not make the
+// rest of the environment unreadable
+func parseLineByLine(contents string) map[string]string {
+	envMap := make(map[string]string)
+	for _, line := range strings.Split(contents, "\n") {
+		lineMap, err := godotenv.Unmarshal(line)
+		if err != nil {
+			continue
+		}
+		for key, value := range lineMap {
+			envMap[key] = value
+		}
+	}
+	return envMap
+}
+
 func loadFromFileJSON(name string, filename string) (env *Env, err error) {
 	envMap := make(map[string]string)
 	if filename == "-" {
diff --git a/plugins/config/environment_test.go b/plugins/config/environment_test.go
index dbe0bf744..fd1dd2a22 100644
--- a/plugins/config/environment_test.go
+++ b/plugins/config/environment_test.go
@@ -1,6 +1,8 @@
 package config
 
 import (
+	"os"
+	"path/filepath"
 	"testing"
 
 	. "github.com/onsi/gomega"
@@ -44,14 +46,16 @@ func TestMerge(t *testing.T) {
 	e.Merge(e2)
 	Expect(e.Map()).To(Equal(pairs("BAR", "baz", "FOO", "bar")))
 
-	e3, _ := newEnvFromString("FOO='ba \\nz'")
+	e3, err := newEnvFromString("FOO=\"ba \\nz\"")
+	Expect(err).NotTo(HaveOccurred())
 	e.Merge(e3)
 	Expect(e.Map()).To(Equal(pairs("BAR", "baz", "FOO", "ba \nz")))
 }
 
 func TestExport(t *testing.T) {
 	RegisterTestingT(t)
-	e, _ := newEnvFromString("BAR='BAZ'\nFOO='b'ar '\nBAZ='a\\nb'")
+	e, err := newEnvFromString("BAR='BAZ'\nFOO=\"b'ar \"\nBAZ=\"a\\nb\"")
+	Expect(err).NotTo(HaveOccurred())
 	Expect(e.Export(ExportFormatEnvfile)).To(Equal("BAR=\"BAZ\"\nBAZ=\"a\\nb\"\nFOO=\"b'ar \""))
 	Expect(e.Export(ExportFormatDockerArgs)).To(Equal("--env=BAR='BAZ' --env=BAZ='a\nb' --env=FOO='b'\\''ar '"))
 	Expect(e.Export(ExportFormatDockerArgsKeys)).To(Equal("--env=BAR --env=BAZ --env=FOO"))
@@ -91,6 +95,96 @@ func TestGet(t *testing.T) {
 	Expect(b).To(Equal(true)) //anything but "0" is true
 }
 
+// TestWriteSetsRestrictivePermissions covers an Env written over a file left
+// behind at a mode other users can read, which is what every app ENV file
+// created before this was fixed looks like on disk.
+func TestWriteSetsRestrictivePermissions(t *testing.T) {
+	RegisterTestingT(t)
+	setupIsolatedEnv(t)
+
+	filename := filepath.Join(t.TempDir(), "ENV")
+	Expect(os.WriteFile(filename, []byte("export testKey=TESTING\n"), 0644)).To(Succeed())
+
+	env, err := loadFromFile("alpha", filename)
+	Expect(err).To(Succeed())
+	env.Set("testKey", "updated")
+	Expect(env.Write()).To(Succeed())
+
+	info, err := os.Stat(filename)
+	Expect(err).To(Succeed())
+	Expect(info.Mode().Perm()).To(Equal(os.FileMode(0600)))
+	expectFileValue(filename, "testKey", "updated")
+}
+
+func TestWriteFailsWhenDirectoryIsMissing(t *testing.T) {
+	RegisterTestingT(t)
+	setupIsolatedEnv(t)
+
+	env, err := loadFromFile("alpha", filepath.Join(t.TempDir(), "missing", "ENV"))
+	Expect(err).To(Succeed())
+	env.Set("testKey", "value")
+	Expect(env.Write()).ToNot(Succeed())
+}
+
+// TestWriteLeavesFileIntactOnFailure covers the guarantee that makes a reported
+// failure safe to act on: the environment is staged in a temporary file and
+// renamed into place, so a failure never leaves a truncated ENV file behind.
+// The permission step is what is made to fail here, because it is the last
+// thing that happens before the rename.
+func TestWriteLeavesFileIntactOnFailure(t *testing.T) {
+	RegisterTestingT(t)
+	setupIsolatedEnv(t)
+
+	filename := filepath.Join(t.TempDir(), "ENV")
+	Expect(os.WriteFile(filename, []byte("export testKey=TESTING\n"), 0600)).To(Succeed())
+	original, err := os.ReadFile(filename)
+	Expect(err).To(Succeed())
+
+	env, err := loadFromFile("alpha", filename)
+	Expect(err).To(Succeed())
+	env.Set("testKey", "updated")
+
+	t.Setenv("DOKKU_SYSTEM_USER", "dokku-no-such-user")
+	Expect(env.Write()).ToNot(Succeed())
+
+	Expect(os.ReadFile(filename)).To(Equal(original))
+}
+
+// TestWriteFollowsSymlinks covers an ENV file an operator has pointed at
+// storage of their own. Renaming the staged file over the symlink would replace
+// it with a regular file and orphan the original.
+func TestWriteFollowsSymlinks(t *testing.T) {
+	RegisterTestingT(t)
+	setupIsolatedEnv(t)
+
+	dir := t.TempDir()
+	target := filepath.Join(dir, "elsewhere", "ENV")
+	Expect(os.MkdirAll(filepath.Dir(target), 0755)).To(Succeed())
+	Expect(os.WriteFile(target, []byte("export testKey=TESTING\n"), 0600)).To(Succeed())
+
+	filename := filepath.Join(dir, "ENV")
+	Expect(os.Symlink(target, filename)).To(Succeed())
+
+	env, err := loadFromFile("alpha", filename)
+	Expect(err).To(Succeed())
+	env.Set("testKey", "updated")
+	Expect(env.Write()).To(Succeed())
+
+	info, err := os.Lstat(filename)
+	Expect(err).To(Succeed())
+	Expect(info.Mode() & os.ModeSymlink).ToNot(Equal(os.FileMode(0)))
+	expectFileValue(target, "testKey", "updated")
+}
+
+// expectFileValue asserts the ENV file at filename holds the given value
+func expectFileValue(filename string, key string, expected string) {
+	env, err := loadFromFile("expected", filename)
+	Expect(err).To(Succeed())
+	value, ok := env.Get(key)
+	Expect(ok).To(Equal(true))
+	Expect(value).To(Equal(expected))
+}
+
 func pairs(vars ...string) map[string]string {
 	res := map[string]string{}
 	var i = 0
diff --git a/plugins/config/go.mod b/plugins/config/go.mod
index ac47ab97b..e68a11137 100644
--- a/plugins/config/go.mod
+++ b/plugins/config/go.mod
@@ -1,35 +1,35 @@
 module github.com/dokku/dokku/plugins/config
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
 	github.com/joho/godotenv v1.5.1
-	github.com/onsi/gomega v1.42.1
+	github.com/onsi/gomega v1.44.0
 	github.com/ryanuber/columnize v2.1.2+incompatible
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/net v0.57.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/text v0.41.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/net v0.60.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/text v0.43.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/config/go.sum b/plugins/config/go.sum
index bf1f596fa..a0d684f1c 100644
--- a/plugins/config/go.sum
+++ b/plugins/config/go.sum
@@ -1,13 +1,12 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
@@ -16,12 +15,12 @@ github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -30,30 +29,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/config/migrate.go b/plugins/config/migrate.go
index 588f8761b..0e593061d 100644
--- a/plugins/config/migrate.go
+++ b/plugins/config/migrate.go
@@ -54,12 +54,14 @@ func migrateGlobalEnv() error {
 	}
 
 	oldGlobalEnvFile := filepath.Join(common.MustGetEnv("DOKKU_ROOT"), "ENV")
-	globalEnv, err := LoadGlobalEnv()
-	if err != nil {
-		return fmt.Errorf("Unable to load global environment: %s", err.Error())
-	}
+	return common.LockDirectory(filepath.Dir(getGlobalFile()), func() error {
+		globalEnv, err := LoadGlobalEnv()
+		if err != nil {
+			return fmt.Errorf("Unable to load global environment: %s", err.Error())
+		}
 
-	return drainLegacyEnvFile("--global", oldGlobalEnvFile, globalEnv)
+		return drainLegacyEnvFile("--global", oldGlobalEnvFile, globalEnv)
+	})
 }
 
 // migrateAppEnv drains $DOKKU_ROOT/<app>/ENV into the app's config property path.
@@ -72,13 +74,20 @@ func migrateAppEnv(appName string) error {
 		return fmt.Errorf("Unable to setup app config directory: %s", err.Error())
 	}
 
-	env, err := LoadAppEnv(appName)
+	appFile, err := getAppFile(appName)
 	if err != nil {
-		return fmt.Errorf("Unable to load app environment: %s", err.Error())
+		return err
 	}
 
 	oldEnvFile := filepath.Join(common.AppRoot(appName), "ENV")
-	return drainLegacyEnvFile(appName, oldEnvFile, env)
+	return common.LockDirectory(filepath.Dir(appFile), func() error {
+		env, err := LoadAppEnv(appName)
+		if err != nil {
+			return fmt.Errorf("Unable to load app environment: %s", err.Error())
+		}
+
+		return drainLegacyEnvFile(appName, oldEnvFile, env)
+	})
 }
 
 // drainLegacyEnvFile merges the legacy ENV file at oldEnvFile into env, records
@@ -115,13 +124,6 @@ func drainLegacyEnvFile(name string, oldEnvFile string, env *Env) error {
 		return fmt.Errorf("Unable to write environment: %s", err.Error())
 	}
 
-	if err := common.SetPermissions(common.SetPermissionInput{
-		Filename: env.Filename(),
-		Mode:     os.FileMode(0600),
-	}); err != nil {
-		return fmt.Errorf("Unable to set permissions on environment: %s", err.Error())
-	}
-
 	if err := writeEnvMigrated(name); err != nil {
 		return err
 	}
diff --git a/plugins/config/migrate_test.go b/plugins/config/migrate_test.go
index cf0bb202b..163b4581e 100644
--- a/plugins/config/migrate_test.go
+++ b/plugins/config/migrate_test.go
@@ -9,11 +9,12 @@ import (
 	"github.com/dokku/dokku/plugins/common"
 )
 
-// setupMigrateEnv points the dokku env at temporary directories and tells the
+// setupIsolatedEnv points the dokku env at temporary directories and tells the
 // permission helpers to chown files to the current user (a no-op) so the test
-// works without root. The package-level paths in config_test.go are captured at
-// init against the real dokku directories, so these tests must not use them.
-func setupMigrateEnv(t *testing.T) (dokkuRoot string, libRoot string) {
+// works without root and without a dokku user existing. Every test in this
+// package goes through it, directly or via setupTestApp, so none of them touch
+// a real dokku installation.
+func setupIsolatedEnv(t *testing.T) (dokkuRoot string, libRoot string) {
 	t.Helper()
 
 	libRoot = t.TempDir()
@@ -79,7 +80,7 @@ func expectEnvValue(t *testing.T, appName, key, want string) {
 }
 
 func TestMigrateEnvFiles_DrainsAndRemovesAppFile(t *testing.T) {
-	dokkuRoot, _ := setupMigrateEnv(t)
+	dokkuRoot, _ := setupIsolatedEnv(t)
 
 	legacy := writeLegacyAppEnv(t, dokkuRoot, "alpha", "export DOKKU_CHECKS_SKIPPED=worker\nexport MY_VAR=value\n")
 
@@ -99,7 +100,7 @@ func TestMigrateEnvFiles_DrainsAndRemovesAppFile(t *testing.T) {
 }
 
 func TestMigrateEnvFiles_DrainsAndRemovesGlobalFile(t *testing.T) {
-	dokkuRoot, _ := setupMigrateEnv(t)
+	dokkuRoot, _ := setupIsolatedEnv(t)
 
 	legacy := filepath.Join(dokkuRoot, "ENV")
 	if err := os.WriteFile(legacy, []byte("export DOKKU_WAIT_TO_RETIRE=30\n"), 0600); err != nil {
@@ -124,7 +125,7 @@ func TestMigrateEnvFiles_DrainsAndRemovesGlobalFile(t *testing.T) {
 // that is still there once the migration has been recorded. Nothing it holds is
 // imported, and it is moved aside so the values remain recoverable.
 func TestMigrateEnvFiles_PreservesStaleFileWithoutImporting(t *testing.T) {
-	dokkuRoot, _ := setupMigrateEnv(t)
+	dokkuRoot, _ := setupIsolatedEnv(t)
 
 	writeLegacyAppEnv(t, dokkuRoot, "alpha", "export FIRST=one\n")
 	if err := MigrateEnvFiles(); err != nil {
@@ -152,7 +153,7 @@ func TestMigrateEnvFiles_PreservesStaleFileWithoutImporting(t *testing.T) {
 // left the legacy file in place, so draining it a second time replayed the
 // environment as it stood at that upgrade over every config:set made since.
 func TestMigrateEnvFiles_KeepsConfigSetAfterMigration(t *testing.T) {
-	dokkuRoot, _ := setupMigrateEnv(t)
+	dokkuRoot, _ := setupIsolatedEnv(t)
 
 	writeLegacyAppEnv(t, dokkuRoot, "alpha", "export DATABASE_URL=value-A\n")
 	if err := MigrateEnvFiles(); err != nil {
@@ -176,7 +177,7 @@ func TestMigrateEnvFiles_KeepsConfigSetAfterMigration(t *testing.T) {
 // key unset after the migration was recorded came back when the legacy file was
 // drained again, which for a rotated secret meant putting it back into service.
 func TestMigrateEnvFiles_DoesNotResurrectUnsetKeys(t *testing.T) {
-	dokkuRoot, _ := setupMigrateEnv(t)
+	dokkuRoot, _ := setupIsolatedEnv(t)
 
 	writeLegacyAppEnv(t, dokkuRoot, "alpha", "export DOKKU_PROXY_PORT=80\n")
 	if err := MigrateEnvFiles(); err != nil {
@@ -201,7 +202,7 @@ func TestMigrateEnvFiles_DoesNotResurrectUnsetKeys(t *testing.T) {
 // upgrade: the leftover file still agrees with the current config, so there is
 // nothing to preserve and no reason to say anything about it.
 func TestMigrateEnvFiles_RemovesStaleFileMatchingCurrentConfig(t *testing.T) {
-	dokkuRoot, _ := setupMigrateEnv(t)
+	dokkuRoot, _ := setupIsolatedEnv(t)
 
 	writeLegacyAppEnv(t, dokkuRoot, "alpha", "export MY_VAR=value\n")
 	if err := MigrateEnvFiles(); err != nil {
@@ -226,7 +227,7 @@ func TestMigrateEnvFiles_RemovesStaleFileMatchingCurrentConfig(t *testing.T) {
 // releases 0.38.0 through 0.38.25 never removed at all, so every host upgraded
 // through that range still has one.
 func TestMigrateEnvFiles_PreservesStaleGlobalFile(t *testing.T) {
-	dokkuRoot, _ := setupMigrateEnv(t)
+	dokkuRoot, _ := setupIsolatedEnv(t)
 
 	legacy := filepath.Join(dokkuRoot, "ENV")
 	if err := os.WriteFile(legacy, []byte("export DOKKU_WAIT_TO_RETIRE=30\n"), 0600); err != nil {
@@ -255,7 +256,7 @@ func TestMigrateEnvFiles_PreservesStaleGlobalFile(t *testing.T) {
 // that does import: before the migration is recorded the legacy file is the
 // source of truth, so it overwrites the value already held at the config path.
 func TestMigrateEnvFiles_LegacyValueWins(t *testing.T) {
-	dokkuRoot, _ := setupMigrateEnv(t)
+	dokkuRoot, _ := setupIsolatedEnv(t)
 
 	if err := os.MkdirAll(filepath.Join(dokkuRoot, "alpha"), 0755); err != nil {
 		t.Fatalf("MkdirAll: %v", err)
@@ -279,7 +280,7 @@ func TestMigrateEnvFiles_LegacyValueWins(t *testing.T) {
 }
 
 func TestMigrateEnvFiles_MarksAppsWithoutLegacyFile(t *testing.T) {
-	dokkuRoot, _ := setupMigrateEnv(t)
+	dokkuRoot, _ := setupIsolatedEnv(t)
 
 	if err := os.MkdirAll(filepath.Join(dokkuRoot, "alpha"), 0755); err != nil {
 		t.Fatalf("MkdirAll: %v", err)
@@ -297,7 +298,7 @@ func TestMigrateEnvFiles_MarksAppsWithoutLegacyFile(t *testing.T) {
 // TestMigrateEnvFiles_KeepsLegacyFileWhenWriteFails verifies the legacy file
 // survives a failure to write the merged environment, so nothing is lost.
 func TestMigrateEnvFiles_KeepsLegacyFileWhenWriteFails(t *testing.T) {
-	dokkuRoot, libRoot := setupMigrateEnv(t)
+	dokkuRoot, libRoot := setupIsolatedEnv(t)
 
 	legacy := writeLegacyAppEnv(t, dokkuRoot, "alpha", "export MY_VAR=value\n")
 
diff --git a/plugins/config/plugin.toml b/plugins/config/plugin.toml
index 98a22542b..6e353822c 100644
--- a/plugins/config/plugin.toml
+++ b/plugins/config/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core config plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/config/triggers.go b/plugins/config/triggers.go
index 98ac0c434..1bedc1f39 100644
--- a/plugins/config/triggers.go
+++ b/plugins/config/triggers.go
@@ -56,8 +56,7 @@ func TriggerConfigSet(appName string, noRestart bool, pairs ...string) error {
 
 // TriggerConfigUnset unsets an app config value by key
 func TriggerConfigUnset(appName string, key string, restart bool) error {
-	UnsetMany(appName, []string{key}, restart)
-	return nil
+	return UnsetMany(appName, []string{key}, restart)
 }
 
 func setupAppConfigDir(appName string) error {
diff --git a/plugins/cron/cron.go b/plugins/cron/cron.go
index 845abfbff..ba23e4c78 100644
--- a/plugins/cron/cron.go
+++ b/plugins/cron/cron.go
@@ -3,7 +3,6 @@ package cron
 import (
 	"fmt"
 	"strconv"
-	"strings"
 
 	appjson "github.com/dokku/dokku/plugins/app-json"
 	"github.com/dokku/dokku/plugins/common"
@@ -85,6 +84,9 @@ type CronTask struct {
 	// LogFile is the log file to write to
 	LogFile string `json:"-"`
 
+	// Mailto is the MAILTO value cron uses for this task instead of the global one
+	Mailto string `json:"mailto,omitempty"`
+
 	// AppInMaintenance is whether the app's cron is in maintenance mode
 	AppInMaintenance bool `json:"app-in-maintenance"`
 
@@ -98,6 +100,10 @@ type CronTask struct {
 // DokkuRunCommand returns the dokku run command to execute for a given cron task
 func (t CronTask) DokkuRunCommand() string {
 	if t.AltCommand != "" {
+		if t.LogFile != "" && t.Mailto != "" {
+			// keep the output on stdout so cron mails it to the task's MAILTO
+			return fmt.Sprintf("%s 2>&1 | tee -a %s", t.AltCommand, t.LogFile)
+		}
 		if t.LogFile != "" {
 			return fmt.Sprintf("%s &>> %s", t.AltCommand, t.LogFile)
 		}
@@ -210,37 +216,17 @@ func FetchCronTasks(input FetchCronTasksInput) ([]CronTask, error) {
 // This function should only be used for the cron:list --global command
 // and not internally by the cron plugin
 func FetchGlobalCronTasks() ([]CronTask, error) {
-	tasks := []CronTask{}
 	response, _ := common.CallPlugnTrigger(common.PlugnTriggerInput{
 		Trigger: "cron-entries",
-		Args:    []string{"docker-local"},
+		Args:    []string{"docker-local", CronEntryFormat},
 	})
-	for _, line := range strings.Split(response.StdoutContents(), "\n") {
-		if strings.TrimSpace(line) == "" {
-			continue
-		}
 
-		parts := strings.Split(line, ";")
-		if len(parts) != 2 && len(parts) != 3 {
-			common.LogWarn(fmt.Sprintf("Invalid injected cron task: %v", line))
-			continue
-		}
-
-		id := base36.EncodeToStringLc([]byte(strings.Join(parts, ";;;")))
-		task := CronTask{
-			ID:                id,
-			Schedule:          parts[0],
-			Command:           parts[1],
-			AltCommand:        parts[1],
-			Global:            true,
-			Maintenance:       false,
-			TaskInMaintenance: false,
-			AppInMaintenance:  false,
-		}
-		if len(parts) == 3 {
-			task.LogFile = parts[2]
-		}
-		tasks = append(tasks, task)
+	tasks, invalid := parseInjectedCronEntries(response.StdoutContents())
+	for _, line := range invalid {
+		common.LogWarn(fmt.Sprintf("Invalid injected cron task: %v", line))
+	}
+	for i := range tasks {
+		tasks[i].Global = true
 	}
 	return tasks, nil
 }
diff --git a/plugins/cron/cron_test.go b/plugins/cron/cron_test.go
index 2f9767415..31f9799a9 100644
--- a/plugins/cron/cron_test.go
+++ b/plugins/cron/cron_test.go
@@ -101,6 +101,38 @@ func TestDokkuRunCommandAltCommandWithLogFile(t *testing.T) {
 	}
 }
 
+// TestDokkuRunCommandAltCommandWithMailto pins that an injected task with its
+// own MAILTO keeps its output on stdout, where cron mails it from, while still
+// appending it to the log file.
+func TestDokkuRunCommandAltCommandWithMailto(t *testing.T) {
+	task := CronTask{
+		ID:         "abc123",
+		AltCommand: "/usr/bin/some-internal-task",
+		LogFile:    "/var/log/dokku/internal-task.log",
+		Mailto:     "ops@example.com",
+	}
+
+	got := task.DokkuRunCommand()
+	want := "/usr/bin/some-internal-task 2>&1 | tee -a /var/log/dokku/internal-task.log"
+	if got != want {
+		t.Errorf("DokkuRunCommand() = %q, want %q", got, want)
+	}
+}
+
+func TestDokkuRunCommandAltCommandWithMailtoAndNoLogFile(t *testing.T) {
+	task := CronTask{
+		ID:         "abc123",
+		AltCommand: "/usr/bin/some-internal-task",
+		Mailto:     "ops@example.com",
+	}
+
+	got := task.DokkuRunCommand()
+	want := "/usr/bin/some-internal-task"
+	if got != want {
+		t.Errorf("DokkuRunCommand() = %q, want %q", got, want)
+	}
+}
+
 // TestDokkuRunCommandAppTaskIgnoresLogFile pins that LogFile is honored only
 // for internally injected tasks from the cron-entries trigger. App tasks never
 // interpolate a path into the crontab line - their output is shipped by the
diff --git a/plugins/cron/crontab.go b/plugins/cron/crontab.go
index a2b229f32..6d03e4b14 100644
--- a/plugins/cron/crontab.go
+++ b/plugins/cron/crontab.go
@@ -2,6 +2,7 @@ package cron
 
 import (
 	_ "embed"
+	"encoding/json"
 	"fmt"
 	"os"
 	"strings"
@@ -16,6 +17,9 @@ import (
 //go:embed templates/cron.tmpl
 var cronTemplate string
 
+// crontabUser is the user whose crontab the host-cron tasks are written to
+const crontabUser = "dokku"
+
 // usesHostCron reports whether the given scheduler writes its cron tasks to the
 // host crontab (as opposed to managing its own cron backend). An empty scheduler
 // or an unimplemented scheduler-uses-host-cron trigger is treated as false.
@@ -50,36 +54,114 @@ func hostCronSchedulers(appSchedulers []string) map[string]bool {
 	return schedulers
 }
 
-// injectedCronTasks parses the tasks injected via the cron-entries trigger for a
-// given scheduler. Each entry is newline delimited in the form
-// $SCHEDULE;$COMMAND[;$LOGFILE].
-func injectedCronTasks(scheduler string) ([]CronTask, error) {
+// CronEntryFormat is passed to the cron-entries trigger to signal that each
+// entry may be printed as a json object on its own line. Implementations that
+// do not know it keep printing $SCHEDULE;$COMMAND[;$LOGFILE] lines, which are
+// still read.
+const CronEntryFormat = "json"
+
+// injectedCronEntry is a task printed as a json line by the cron-entries trigger
+type injectedCronEntry struct {
+	// Schedule is the cron schedule
+	Schedule string `json:"schedule"`
+
+	// Command is the command to run
+	Command string `json:"command"`
+
+	// LogFile is the log file the command's output is appended to
+	LogFile string `json:"log-file"`
+
+	// Mailto is the MAILTO value cron uses for the task instead of the global one
+	Mailto string `json:"mailto"`
+}
+
+// parseInjectedCronEntry parses a single line printed by the cron-entries
+// trigger, either a json object or in the form $SCHEDULE;$COMMAND[;$LOGFILE].
+// The fields the task id is generated from are returned alongside the task.
+func parseInjectedCronEntry(line string) (injectedCronEntry, []string, bool) {
+	if strings.HasPrefix(strings.TrimSpace(line), "{") {
+		entry := injectedCronEntry{}
+		if err := json.Unmarshal([]byte(line), &entry); err != nil {
+			return injectedCronEntry{}, nil, false
+		}
+		if entry.Schedule == "" || entry.Command == "" {
+			return injectedCronEntry{}, nil, false
+		}
+
+		// json can encode a newline, which would add a line to the crontab
+		fields := []string{entry.Schedule, entry.Command, entry.LogFile, entry.Mailto}
+		for _, field := range fields {
+			if strings.ContainsAny(field, "\r\n") {
+				return injectedCronEntry{}, nil, false
+			}
+		}
+
+		fields = []string{entry.Schedule, entry.Command}
+		if entry.LogFile != "" {
+			fields = append(fields, entry.LogFile)
+		}
+		if entry.Mailto != "" {
+			fields = append(fields, entry.Mailto)
+		}
+		return entry, fields, true
+	}
+
+	parts := strings.Split(line, ";")
+	if len(parts) != 2 && len(parts) != 3 {
+		return injectedCronEntry{}, nil, false
+	}
+
+	entry := injectedCronEntry{
+		Schedule: parts[0],
+		Command:  parts[1],
+	}
+	if len(parts) == 3 {
+		entry.LogFile = parts[2]
+	}
+	return entry, parts, true
+}
+
+// parseInjectedCronEntries parses the newline delimited output of the
+// cron-entries trigger, returning the tasks and any lines that are not valid
+// entries
+func parseInjectedCronEntries(output string) ([]CronTask, []string) {
 	tasks := []CronTask{}
+	invalid := []string{}
+	for _, line := range strings.Split(output, "\n") {
+		if strings.TrimSpace(line) == "" {
+			continue
+		}
+
+		entry, fields, ok := parseInjectedCronEntry(line)
+		if !ok {
+			invalid = append(invalid, line)
+			continue
+		}
+
+		tasks = append(tasks, CronTask{
+			ID:          base36.EncodeToStringLc([]byte(strings.Join(fields, ";;;"))),
+			Schedule:    entry.Schedule,
+			Command:     entry.Command,
+			AltCommand:  entry.Command,
+			LogFile:     entry.LogFile,
+			Mailto:      entry.Mailto,
+			Maintenance: false,
+		})
+	}
+	return tasks, invalid
+}
+
+// injectedCronTasks parses the tasks injected via the cron-entries trigger for a
+// given scheduler
+func injectedCronTasks(scheduler string) ([]CronTask, error) {
 	response, _ := common.CallPlugnTrigger(common.PlugnTriggerInput{
 		Trigger: "cron-entries",
-		Args:    []string{scheduler},
+		Args:    []string{scheduler, CronEntryFormat},
 	})
-	for _, line := range strings.Split(response.StdoutContents(), "\n") {
-		if strings.TrimSpace(line) == "" {
-			return []CronTask{}, nil
-		}
 
-		parts := strings.Split(line, ";")
-		if len(parts) != 2 && len(parts) != 3 {
-			return []CronTask{}, fmt.Errorf("Invalid injected cron task: %v", line)
-		}
-
-		id := base36.EncodeToStringLc([]byte(strings.Join(parts, ";;;")))
-		task := CronTask{
-			ID:          id,
-			Schedule:    parts[0],
-			AltCommand:  parts[1],
-			Maintenance: false,
-		}
-		if len(parts) == 3 {
-			task.LogFile = parts[2]
-		}
-		tasks = append(tasks, task)
+	tasks, invalid := parseInjectedCronEntries(response.StdoutContents())
+	if len(invalid) > 0 {
+		return []CronTask{}, fmt.Errorf("Invalid injected cron task: %v", invalid[0])
 	}
 	return tasks, nil
 }
@@ -179,12 +261,7 @@ func writeCronTab() error {
 
 	mailfrom := common.PropertyGetDefault("cron", "--global", "mailfrom", DefaultProperties["mailfrom"])
 	mailto := common.PropertyGetDefault("cron", "--global", "mailto", DefaultProperties["mailto"])
-
-	data := map[string]interface{}{
-		"Tasks":    tasks,
-		"Mailfrom": mailfrom,
-		"Mailto":   mailto,
-	}
+	data := cronTemplateData(tasks, mailfrom, mailto)
 
 	t, err := getCronTemplate()
 	if err != nil {
@@ -205,7 +282,7 @@ func writeCronTab() error {
 
 	result, err := common.CallExecCommand(common.ExecCommandInput{
 		Command: "crontab",
-		Args:    []string{"-u", "dokku", tmpFile.Name()},
+		Args:    []string{"-u", crontabUser, tmpFile.Name()},
 	})
 	if err != nil {
 		return fmt.Errorf("Unable to update schedule file: %w", err)
@@ -219,11 +296,30 @@ func writeCronTab() error {
 	return nil
 }
 
+// cronTemplateData builds the data the cron template is executed with. A task
+// that sets its own MAILTO is written between a MAILTO line of its own and one
+// resetting it, so every task after it goes back to the global MAILTO. Without
+// a global MAILTO it is reset to the crontab's owner, which is who cron mails
+// when MAILTO is unset - an empty MAILTO would stop cron mailing anyone.
+func cronTemplateData(tasks []CronTask, mailfrom string, mailto string) map[string]interface{} {
+	resetMailto := mailto
+	if resetMailto == "" {
+		resetMailto = crontabUser
+	}
+
+	return map[string]interface{}{
+		"Tasks":       tasks,
+		"Mailfrom":    mailfrom,
+		"Mailto":      mailto,
+		"ResetMailto": resetMailto,
+	}
+}
+
 // deleteCrontab removes the dokku user crontab
 func deleteCrontab() error {
 	result, err := common.CallExecCommand(common.ExecCommandInput{
 		Command: "crontab",
-		Args:    []string{"-l", "-u", "dokku"},
+		Args:    []string{"-l", "-u", crontabUser},
 	})
 	if err != nil || result.ExitCode != 0 {
 		return nil
@@ -231,7 +327,7 @@ func deleteCrontab() error {
 
 	result, err = common.CallExecCommand(common.ExecCommandInput{
 		Command: "crontab",
-		Args:    []string{"-r", "-u", "dokku"},
+		Args:    []string{"-r", "-u", crontabUser},
 	})
 	if err != nil {
 		return fmt.Errorf("Unable to remove schedule file: %w", err)
diff --git a/plugins/cron/crontab_test.go b/plugins/cron/crontab_test.go
new file mode 100644
index 000000000..8949ec39c
--- /dev/null
+++ b/plugins/cron/crontab_test.go
@@ -0,0 +1,253 @@
+package cron
+
+import (
+	"bytes"
+	"reflect"
+	"strings"
+	"testing"
+
+	base36 "github.com/multiformats/go-base36"
+)
+
+func TestParseInjectedCronEntries(t *testing.T) {
+	cases := []struct {
+		name        string
+		output      string
+		wantTasks   []CronTask
+		wantInvalid []string
+	}{
+		{
+			name:   "text entry without a log file",
+			output: "@daily;/bin/true",
+			wantTasks: []CronTask{
+				{Schedule: "@daily", Command: "/bin/true", AltCommand: "/bin/true"},
+			},
+		},
+		{
+			name:   "text entry with a log file",
+			output: "@daily;/bin/true;/var/log/dokku/log.log",
+			wantTasks: []CronTask{
+				{Schedule: "@daily", Command: "/bin/true", AltCommand: "/bin/true", LogFile: "/var/log/dokku/log.log"},
+			},
+		},
+		{
+			name:   "json entry without a log file or mailto",
+			output: `{"schedule":"@daily","command":"/bin/true"}`,
+			wantTasks: []CronTask{
+				{Schedule: "@daily", Command: "/bin/true", AltCommand: "/bin/true"},
+			},
+		},
+		{
+			name:   "json entry with a log file and mailto",
+			output: `{"schedule":"@daily","command":"/bin/true","log-file":"/var/log/dokku/log.log","mailto":"ops@example.com"}`,
+			wantTasks: []CronTask{
+				{Schedule: "@daily", Command: "/bin/true", AltCommand: "/bin/true", LogFile: "/var/log/dokku/log.log", Mailto: "ops@example.com"},
+			},
+		},
+		{
+			name:   "json entry whose command holds a semicolon",
+			output: `{"schedule":"@daily","command":"/bin/true; /bin/false"}`,
+			wantTasks: []CronTask{
+				{Schedule: "@daily", Command: "/bin/true; /bin/false", AltCommand: "/bin/true; /bin/false"},
+			},
+		},
+		{
+			name:   "json and text entries printed together, with blank lines",
+			output: "@daily;/bin/true\n\n" + `{"schedule":"@hourly","command":"/bin/false","mailto":"ops@example.com"}` + "\n",
+			wantTasks: []CronTask{
+				{Schedule: "@daily", Command: "/bin/true", AltCommand: "/bin/true"},
+				{Schedule: "@hourly", Command: "/bin/false", AltCommand: "/bin/false", Mailto: "ops@example.com"},
+			},
+		},
+		{
+			name:        "text entry with too many fields",
+			output:      "@daily;/bin/true;/var/log/dokku/log.log;ops@example.com",
+			wantTasks:   []CronTask{},
+			wantInvalid: []string{"@daily;/bin/true;/var/log/dokku/log.log;ops@example.com"},
+		},
+		{
+			name:        "text entry with too few fields",
+			output:      "@daily",
+			wantTasks:   []CronTask{},
+			wantInvalid: []string{"@daily"},
+		},
+		{
+			name:        "json entry that does not decode",
+			output:      `{"schedule":"@daily",`,
+			wantTasks:   []CronTask{},
+			wantInvalid: []string{`{"schedule":"@daily",`},
+		},
+		{
+			name:        "json entry without a schedule",
+			output:      `{"command":"/bin/true"}`,
+			wantTasks:   []CronTask{},
+			wantInvalid: []string{`{"command":"/bin/true"}`},
+		},
+		{
+			name:        "json entry without a command",
+			output:      `{"schedule":"@daily"}`,
+			wantTasks:   []CronTask{},
+			wantInvalid: []string{`{"schedule":"@daily"}`},
+		},
+		{
+			name:        "json entry whose mailto holds a newline",
+			output:      `{"schedule":"@daily","command":"/bin/true","mailto":"ops@example.com\n* * * * * /bin/evil"}`,
+			wantTasks:   []CronTask{},
+			wantInvalid: []string{`{"schedule":"@daily","command":"/bin/true","mailto":"ops@example.com\n* * * * * /bin/evil"}`},
+		},
+		{
+			name:        "json entry whose command holds a carriage return",
+			output:      `{"schedule":"@daily","command":"/bin/true\r/bin/evil"}`,
+			wantTasks:   []CronTask{},
+			wantInvalid: []string{`{"schedule":"@daily","command":"/bin/true\r/bin/evil"}`},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			tasks, invalid := parseInjectedCronEntries(tc.output)
+			for i := range tasks {
+				if tasks[i].ID == "" {
+					t.Errorf("task %d has no id", i)
+				}
+				tasks[i].ID = ""
+			}
+
+			if !reflect.DeepEqual(tasks, tc.wantTasks) {
+				t.Errorf("parseInjectedCronEntries() tasks = %#v, want %#v", tasks, tc.wantTasks)
+			}
+
+			wantInvalid := tc.wantInvalid
+			if wantInvalid == nil {
+				wantInvalid = []string{}
+			}
+			if !reflect.DeepEqual(invalid, wantInvalid) {
+				t.Errorf("parseInjectedCronEntries() invalid = %#v, want %#v", invalid, wantInvalid)
+			}
+		})
+	}
+}
+
+// TestParseInjectedCronEntriesKeepsTextIDs pins that the id of a text entry is
+// generated as it was before json entries were read, and that a json entry
+// without a mailto gets the same id as the text entry it replaces.
+func TestParseInjectedCronEntriesKeepsTextIDs(t *testing.T) {
+	want := base36.EncodeToStringLc([]byte("@daily;;;/bin/true;;;/var/log/dokku/log.log"))
+
+	for _, output := range []string{
+		"@daily;/bin/true;/var/log/dokku/log.log",
+		`{"schedule":"@daily","command":"/bin/true","log-file":"/var/log/dokku/log.log"}`,
+	} {
+		tasks, _ := parseInjectedCronEntries(output)
+		if len(tasks) != 1 {
+			t.Fatalf("parseInjectedCronEntries(%q) returned %d tasks, want 1", output, len(tasks))
+		}
+		if tasks[0].ID != want {
+			t.Errorf("parseInjectedCronEntries(%q) id = %q, want %q", output, tasks[0].ID, want)
+		}
+	}
+
+	withMailto, _ := parseInjectedCronEntries(`{"schedule":"@daily","command":"/bin/true","log-file":"/var/log/dokku/log.log","mailto":"ops@example.com"}`)
+	if len(withMailto) != 1 || withMailto[0].ID == want {
+		t.Errorf("a json entry with a mailto should not share the id of the entry without one")
+	}
+}
+
+// renderCronTemplate renders the cron template for the given tasks and global
+// MAILTO
+func renderCronTemplate(t *testing.T, tasks []CronTask, mailto string) string {
+	t.Helper()
+
+	tmpl, err := getCronTemplate()
+	if err != nil {
+		t.Fatalf("getCronTemplate() returned an error: %v", err)
+	}
+
+	var got bytes.Buffer
+	if err := tmpl.Execute(&got, cronTemplateData(tasks, "", mailto)); err != nil {
+		t.Fatalf("Execute() returned an error: %v", err)
+	}
+
+	return got.String()
+}
+
+// TestCronTemplateResetsMailtoAfterATaskWithItsOwn pins that a task with its own
+// MAILTO is written in place between a MAILTO line of its own and one resetting
+// it to the global MAILTO, so no task after it is mailed to its recipient.
+func TestCronTemplateResetsMailtoAfterATaskWithItsOwn(t *testing.T) {
+	tasks := []CronTask{
+		{Schedule: "@daily", AltCommand: "/bin/true", LogFile: "/var/log/dokku/log.log"},
+		{Schedule: "@hourly", AltCommand: "/bin/alpha", LogFile: "/var/log/dokku/alpha.log", Mailto: "alpha@example.com"},
+		{Schedule: "@daily", AltCommand: "/bin/false"},
+		{Schedule: "@daily", AltCommand: "/bin/zeta", LogFile: "/var/log/dokku/zeta.log", Mailto: "zeta@example.com"},
+		{Schedule: "@weekly", AltCommand: "/bin/zeta-weekly", Mailto: "zeta@example.com"},
+	}
+
+	want := strings.Join([]string{
+		"MAILTO=global@example.com",
+		"PATH=/usr/local/bin:/usr/bin:/bin",
+		"SHELL=/bin/bash",
+		"",
+		"@daily /bin/true &>> /var/log/dokku/log.log",
+		"MAILTO=alpha@example.com",
+		"@hourly /bin/alpha 2>&1 | tee -a /var/log/dokku/alpha.log",
+		"MAILTO=global@example.com",
+		"@daily /bin/false",
+		"MAILTO=zeta@example.com",
+		"@daily /bin/zeta 2>&1 | tee -a /var/log/dokku/zeta.log",
+		"MAILTO=global@example.com",
+		"MAILTO=zeta@example.com",
+		"@weekly /bin/zeta-weekly",
+		"MAILTO=global@example.com",
+		"",
+	}, "\n")
+	if got := renderCronTemplate(t, tasks, "global@example.com"); got != want {
+		t.Errorf("rendered crontab =\n%s\nwant\n%s", got, want)
+	}
+}
+
+// TestCronTemplateResetsMailtoToTheCrontabOwner pins that without a global
+// MAILTO, a task with its own is followed by a MAILTO naming the crontab's
+// owner, who cron mails when MAILTO is unset. An empty MAILTO would stop cron
+// mailing anyone about the tasks after it.
+func TestCronTemplateResetsMailtoToTheCrontabOwner(t *testing.T) {
+	tasks := []CronTask{
+		{Schedule: "@hourly", AltCommand: "/bin/alpha", LogFile: "/var/log/dokku/alpha.log", Mailto: "alpha@example.com"},
+		{Schedule: "@daily", AltCommand: "/bin/true", LogFile: "/var/log/dokku/log.log"},
+	}
+
+	want := strings.Join([]string{
+		"PATH=/usr/local/bin:/usr/bin:/bin",
+		"SHELL=/bin/bash",
+		"",
+		"MAILTO=alpha@example.com",
+		"@hourly /bin/alpha 2>&1 | tee -a /var/log/dokku/alpha.log",
+		"MAILTO=dokku",
+		"@daily /bin/true &>> /var/log/dokku/log.log",
+		"",
+	}, "\n")
+	if got := renderCronTemplate(t, tasks, ""); got != want {
+		t.Errorf("rendered crontab =\n%s\nwant\n%s", got, want)
+	}
+}
+
+// TestCronTemplateWithoutTaskMailto pins that a crontab without tasks that set
+// their own MAILTO renders as it did before per-task MAILTO values existed.
+func TestCronTemplateWithoutTaskMailto(t *testing.T) {
+	tasks := []CronTask{
+		{Schedule: "@daily", AltCommand: "/bin/true", LogFile: "/var/log/dokku/log.log"},
+	}
+
+	got := renderCronTemplate(t, tasks, "")
+
+	want := strings.Join([]string{
+		"PATH=/usr/local/bin:/usr/bin:/bin",
+		"SHELL=/bin/bash",
+		"",
+		"@daily /bin/true &>> /var/log/dokku/log.log",
+		"",
+	}, "\n")
+	if got != want {
+		t.Errorf("rendered crontab =\n%s\nwant\n%s", got, want)
+	}
+}
diff --git a/plugins/cron/go.mod b/plugins/cron/go.mod
index 7b5459174..da6c15aff 100644
--- a/plugins/cron/go.mod
+++ b/plugins/cron/go.mod
@@ -1,6 +1,6 @@
 module github.com/dokku/dokku/plugins/cron
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/app-json v0.0.0-00010101000000-000000000000
@@ -8,15 +8,15 @@ require (
 	github.com/multiformats/go-base36 v0.2.0
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/ryanuber/columnize v2.1.2+incompatible
-	github.com/spf13/pflag v1.0.10
-	golang.org/x/sync v0.22.0
-	mvdan.cc/sh/v3 v3.13.1
+	github.com/spf13/pflag v1.1.0
+	golang.org/x/sync v0.25.0
+	mvdan.cc/sh/v3 v3.14.1
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/kr/fs v0.1.0 // indirect
@@ -28,9 +28,9 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/tailscale/hujson v0.0.0-20250605163823-992244df8c5a // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	k8s.io/utils v0.0.0-20240102154912-e7106e64919e // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	k8s.io/utils v0.0.0-20260626114624-be93311217bd // indirect
 )
 
 replace github.com/dokku/dokku/plugins/app-json => ../app-json
diff --git a/plugins/cron/go.sum b/plugins/cron/go.sum
index 04e818bbb..862186d3c 100644
--- a/plugins/cron/go.sum
+++ b/plugins/cron/go.sum
@@ -1,15 +1,14 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
-github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
-github.com/go-quicktest/qt v1.101.0/go.mod h1:14Bz/f7NwaXPtdYEgzsx46kqSxVwTbzVZsDC26tQJow=
+github.com/go-quicktest/qt v1.102.0 h1:HSQxCeh5YZH3EL3W39ixjtyaEhcWSXQHtHnMBzSs474=
+github.com/go-quicktest/qt v1.102.0/go.mod h1:p4lGIVX+8Wa6ZPNDvqcxq36XpUDLh42FLetFU7odllI=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
@@ -28,8 +27,8 @@ github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
 github.com/multiformats/go-base36 v0.2.0 h1:lFsAbNOGeKtuKozrtBsAkSVhv1p9D0/qedU9rQyccr0=
 github.com/multiformats/go-base36 v0.2.0/go.mod h1:qvnKE++v+2MWCfePClUEjE78Z7P2a1UV0xHgWc0hkp4=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -38,37 +37,33 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
 github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rogpeppe/go-internal v1.15.0 h1:D0RCU5rMAp+SpgkiNdrjfJ+LX4J1M32V2NeCY7EJ6hc=
+github.com/rogpeppe/go-internal v1.15.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/tailscale/hujson v0.0.0-20250605163823-992244df8c5a h1:a6TNDN9CgG+cYjaeN8l2mc4kSz2iMiCDQxPEyltUV/I=
 github.com/tailscale/hujson v0.0.0-20250605163823-992244df8c5a/go.mod h1:EbW0wDK/qEUYI0A5bqq0C2kF8JTQwWONmGDBbzsxxHo=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/utils v0.0.0-20240102154912-e7106e64919e h1:eQ/4ljkx21sObifjzXwlPKpdGLrCfRziVtos3ofG/sQ=
-k8s.io/utils v0.0.0-20240102154912-e7106e64919e/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-mvdan.cc/sh/v3 v3.13.1 h1:DP3TfgZhDkT7lerUdnp6PTGKyxxzz6T+cOlY/xEvfWk=
-mvdan.cc/sh/v3 v3.13.1/go.mod h1:lXJ8SexMvEVcHCoDvAGLZgFJ9Wsm2sulmoNEXGhYZD0=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd h1:Ea7fgQ5we8Y9T0OX5o0dAHzQOBRI07D/dEYRaB9ZZEs=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
+mvdan.cc/sh/v3 v3.14.1 h1:bXkhQWNHCs0KZEChF8hYS6FC+T2N9mUZLbQv9blditI=
+mvdan.cc/sh/v3 v3.14.1/go.mod h1:syYCoFET8w9tvevxiXUtY8/ICrU+l26jHmhJDra3Vwo=
diff --git a/plugins/cron/plugin.toml b/plugins/cron/plugin.toml
index 8a376cce5..633060a76 100644
--- a/plugins/cron/plugin.toml
+++ b/plugins/cron/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core cron plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/cron/templates/cron.tmpl b/plugins/cron/templates/cron.tmpl
index 75577e6ee..34648f3e6 100644
--- a/plugins/cron/templates/cron.tmpl
+++ b/plugins/cron/templates/cron.tmpl
@@ -8,5 +8,11 @@ PATH=/usr/local/bin:/usr/bin:/bin
 SHELL=/bin/bash
 
 {{ range $task := .Tasks -}}
-{{ $task.Schedule }} {{ $task.DokkuRunCommand }}
+{{ if $task.Mailto -}}
+MAILTO={{ $task.Mailto }}
+{{ end -}}
+{{ $task.Schedule }} {{ $task.DokkuRunCommand }}
+{{ if $task.Mailto -}}
+MAILTO={{ $.ResetMailto }}
+{{ end -}}
 {{ end -}}
diff --git a/plugins/datastore/.gitignore b/plugins/datastore/.gitignore
new file mode 100644
index 000000000..ffa8e85d9
--- /dev/null
+++ b/plugins/datastore/.gitignore
@@ -0,0 +1,10 @@
+/commands
+/subcommands/*
+/triggers/*
+/triggers
+/cron-entries
+/install
+/post-*
+/pre-*
+/service-list
+/update
diff --git a/plugins/datastore/Makefile b/plugins/datastore/Makefile
new file mode 100644
index 000000000..43ba00ef5
--- /dev/null
+++ b/plugins/datastore/Makefile
@@ -0,0 +1,6 @@
+SUBCOMMANDS = subcommands/app-links subcommands/backup subcommands/backup-auth subcommands/backup-deauth subcommands/backup-logs subcommands/backup-schedule subcommands/backup-schedule-cat subcommands/backup-set-encryption subcommands/backup-set-public-key-encryption subcommands/backup-unschedule subcommands/backup-unset-encryption subcommands/backup-unset-public-key-encryption subcommands/clone subcommands/connect subcommands/create subcommands/create-database subcommands/create-user subcommands/destroy subcommands/destroy-database subcommands/destroy-user subcommands/enter subcommands/exists subcommands/export subcommands/expose subcommands/import subcommands/info subcommands/label subcommands/link subcommands/linked subcommands/links subcommands/list subcommands/logs subcommands/mount subcommands/pause subcommands/promote subcommands/reexpose subcommands/reset subcommands/restart subcommands/set subcommands/set-user-password subcommands/start subcommands/stop subcommands/unexpose subcommands/unlabel subcommands/unlink subcommands/unmount subcommands/upgrade
+TRIGGERS = triggers/cron-entries triggers/install triggers/post-app-clone-setup triggers/post-app-rename-setup triggers/post-container-create triggers/post-extract triggers/pre-build triggers/pre-delete triggers/pre-release-builder triggers/pre-restore triggers/pre-start triggers/service-list triggers/update
+BUILD = commands subcommands triggers
+PLUGIN_NAME = datastore
+
+include ../../common.mk
diff --git a/plugins/datastore/datastore.go b/plugins/datastore/datastore.go
new file mode 100644
index 000000000..a61582c3f
--- /dev/null
+++ b/plugins/datastore/datastore.go
@@ -0,0 +1,5 @@
+// Package datastore is the dokku plugin serving every datastore under a single
+// command, as in `dokku datastore:create postgres lollipop`. Its commands,
+// subcommands and triggers are dokku-datastore's, reached through its sdk
+// package.
+package datastore
diff --git a/plugins/datastore/datastore_test.go b/plugins/datastore/datastore_test.go
new file mode 100644
index 000000000..b46f0393e
--- /dev/null
+++ b/plugins/datastore/datastore_test.go
@@ -0,0 +1,55 @@
+package datastore
+
+import (
+	"os"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/dokku/dokku-datastore/sdk"
+)
+
+// makefileList returns the names a Makefile variable links, without the
+// directory each is listed under
+func makefileList(t *testing.T, variable string) []string {
+	t.Helper()
+
+	contents, err := os.ReadFile("Makefile")
+	if err != nil {
+		t.Fatalf("unable to read the Makefile: %s", err)
+	}
+
+	for _, line := range strings.Split(string(contents), "\n") {
+		value, found := strings.CutPrefix(line, variable+" = ")
+		if !found {
+			continue
+		}
+
+		names := []string{}
+		for _, entry := range strings.Fields(value) {
+			names = append(names, entry[strings.Index(entry, "/")+1:])
+		}
+
+		slices.Sort(names)
+		return names
+	}
+
+	t.Fatalf("the Makefile does not set %s", variable)
+	return nil
+}
+
+// Every command a datastore may implement needs a subcommand linked, or dokku
+// has nothing to run when it is asked for
+func TestEverySubcommandIsLinked(t *testing.T) {
+	if linked, expected := makefileList(t, "SUBCOMMANDS"), sdk.SubcommandNames(); !slices.Equal(linked, expected) {
+		t.Errorf("expected the Makefile to link the subcommands %v, got %v", expected, linked)
+	}
+}
+
+// Every trigger a datastore implements needs a trigger linked, or dokku never
+// runs it
+func TestEveryTriggerIsLinked(t *testing.T) {
+	if linked, expected := makefileList(t, "TRIGGERS"), sdk.TriggerNames(); !slices.Equal(linked, expected) {
+		t.Errorf("expected the Makefile to link the triggers %v, got %v", expected, linked)
+	}
+}
diff --git a/plugins/datastore/go.mod b/plugins/datastore/go.mod
new file mode 100644
index 000000000..dcee4d6f2
--- /dev/null
+++ b/plugins/datastore/go.mod
@@ -0,0 +1,79 @@
+module github.com/dokku/dokku/plugins/datastore
+
+go 1.27.3
+
+require github.com/dokku/dokku-datastore v0.12.0
+
+require (
+	dario.cat/mergo v1.0.2 // indirect
+	github.com/Masterminds/goutils v1.1.1 // indirect
+	github.com/Masterminds/semver/v3 v3.4.0 // indirect
+	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
+	github.com/armon/go-radix v1.0.0 // indirect
+	github.com/bgentry/speakeasy v0.2.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/compose-spec/compose-go/v2 v2.16.2 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/distribution/reference v0.6.0 // indirect
+	github.com/docker/go-connections v0.8.2 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
+	github.com/dokku/docker-port-forward v0.0.0-20261105051345-e35b7af5a11c // indirect
+	github.com/dokku/dokku/plugins/common v0.0.0-20261102053158-1910c3fb682a // indirect
+	github.com/dokku/dokku/plugins/docker-options v0.0.0-20261102053158-1910c3fb682a // indirect
+	github.com/fatih/color v1.19.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/huandu/xstrings v1.5.0 // indirect
+	github.com/josegonzalez/cli-skeleton v0.25.0 // indirect
+	github.com/kr/fs v0.1.0 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
+	github.com/mattn/go-shellwords v1.0.12 // indirect
+	github.com/melbahja/goph v1.5.2 // indirect
+	github.com/mitchellh/cli v1.1.5 // indirect
+	github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
+	github.com/mitchellh/copystructure v1.2.0 // indirect
+	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
+	github.com/moby/moby/api v1.56.1 // indirect
+	github.com/moby/moby/client v0.6.2 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/otiai10/copy v1.14.1 // indirect
+	github.com/otiai10/mint v1.6.3 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pkg/sftp v1.13.11 // indirect
+	github.com/posener/complete v1.2.3 // indirect
+	github.com/robfig/cron/v3 v3.0.1 // indirect
+	github.com/rs/zerolog v1.35.1 // indirect
+	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.1 // indirect
+	github.com/shopspring/decimal v1.4.0 // indirect
+	github.com/sirupsen/logrus v1.10.1 // indirect
+	github.com/spf13/cast v1.10.0 // indirect
+	github.com/spf13/pflag v1.1.0 // indirect
+	github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect
+	go.opentelemetry.io/otel v1.43.0 // indirect
+	go.opentelemetry.io/otel/metric v1.43.0 // indirect
+	go.opentelemetry.io/otel/trace v1.43.0 // indirect
+	go.yaml.in/yaml/v4 v4.0.0-rc.4 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/term v0.47.0 // indirect
+	golang.org/x/text v0.43.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	mvdan.cc/sh/v3 v3.14.1 // indirect
+)
+
+replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/datastore/go.sum b/plugins/datastore/go.sum
new file mode 100644
index 000000000..077da3631
--- /dev/null
+++ b/plugins/datastore/go.sum
@@ -0,0 +1,211 @@
+dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
+dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
+github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
+github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
+github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
+github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
+github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Masterminds/sprig/v3 v3.2.1/go.mod h1:UoaO7Yp8KlPnJIYWTFkMaqPUYKTfGFPhxNuwnnxkKlk=
+github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=
+github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0=
+github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
+github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
+github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
+github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
+github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
+github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
+github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
+github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
+github.com/bgentry/speakeasy v0.2.0 h1:tgObeVOf8WAvtuAX6DhJ4xks4CFNwPDZiqzGqIHE51E=
+github.com/bgentry/speakeasy v0.2.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/compose-spec/compose-go/v2 v2.16.2 h1:pTp1DqQwJzFd85GzlWsSszKA1ABrV/ySqsClujIcWA8=
+github.com/compose-spec/compose-go/v2 v2.16.2/go.mod h1:Q1+qtN4vhzEjGrnqRtzx1xa8raDZQlMUe3WJxndYNiQ=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
+github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
+github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
+github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
+github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
+github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/docker/go-connections v0.8.2 h1:9d9DEokx5W7qlr0shkFXIxEA7+TTD+llwzcykSlxMNc=
+github.com/docker/go-connections v0.8.2/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
+github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
+github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/dokku/docker-port-forward v0.0.0-20261105051345-e35b7af5a11c h1:vxd+GOgpi6lSuijQrzLL8FUFIoJ2+SNlVpfDaOYG/wk=
+github.com/dokku/docker-port-forward v0.0.0-20261105051345-e35b7af5a11c/go.mod h1:c80UNGZOYX7stZUgzaMpjC7PKo16sJGo5wNcbkOUfzs=
+github.com/dokku/dokku-datastore v0.12.0 h1:XL3gULntpz0L5KchMbSLZnZUg7m9q/Nsmz2gwdDJOHI=
+github.com/dokku/dokku-datastore v0.12.0/go.mod h1:dTKF/yZXC7FBvtd3DyIW5vN0Zzhhkgo1Ptg+xgsLwMI=
+github.com/dokku/dokku/plugins/docker-options v0.0.0-20261102053158-1910c3fb682a h1:pwA8IIBDrGtjyhXwoVPEV8+p8rDEv7JLK/SFc6zxW1g=
+github.com/dokku/dokku/plugins/docker-options v0.0.0-20261102053158-1910c3fb682a/go.mod h1:sQpHfMRDTaHQ8m0JMaN6DAuHuSwwvw69AT6DPBgiCl4=
+github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
+github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
+github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-quicktest/qt v1.102.0 h1:HSQxCeh5YZH3EL3W39ixjtyaEhcWSXQHtHnMBzSs474=
+github.com/go-quicktest/qt v1.102.0/go.mod h1:p4lGIVX+8Wa6ZPNDvqcxq36XpUDLh42FLetFU7odllI=
+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
+github.com/huandu/xstrings v1.3.1/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
+github.com/huandu/xstrings v1.3.2/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
+github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI=
+github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
+github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
+github.com/josegonzalez/cli-skeleton v0.25.0 h1:pxBBuAIO7ALvfXrhnvmaTvo1cWv34RKONccEpw+2UN4=
+github.com/josegonzalez/cli-skeleton v0.25.0/go.mod h1:eFc5CRWq4w3NwRRt4pJw85IEV/Bp4H+aIFQ50e6sYFY=
+github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
+github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
+github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk=
+github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
+github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
+github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
+github.com/mitchellh/cli v1.1.5 h1:OxRIeJXpAMztws/XHlN2vu6imG5Dpq+j61AzAX5fLng=
+github.com/mitchellh/cli v1.1.5/go.mod h1:v8+iFts2sPIKUV1ltktPXMCC8fumSKFItNcD2cLtRR4=
+github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db h1:62I3jR2EmQ4l5rM/4FEfDWcRD+abF5XlKShorW5LRoQ=
+github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db/go.mod h1:l0dey0ia/Uv7NcFFVbCLtqEBQbrT4OCwCSKTEv6enCw=
+github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
+github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
+github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
+github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
+github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
+github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
+github.com/moby/moby/api v1.56.1 h1:PpWkvVPB7Fr/No8w+TfyJ/I6rWZ2YPZhT3JorIg+06c=
+github.com/moby/moby/api v1.56.1/go.mod h1:sZ+THbVWkjOmBPPfbnzdD/G1LuIexWhqlSHHPTDQ1Uk=
+github.com/moby/moby/client v0.6.2 h1:ekSPlMccrZGcw6Scb8T9D39qE0mB+XupU/yS0zNw9N4=
+github.com/moby/moby/client v0.6.2/go.mod h1:DGcnO7qmPJrqobx/ggQgQ/AUk+2wgVdQv7uxB0/mEsc=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
+github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
+github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
+github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
+github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
+github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
+github.com/otiai10/mint v1.6.3/go.mod h1:MJm72SBthJjz8qhefc4z1PYEieWmy8Bku7CjcAqyUSM=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
+github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
+github.com/posener/complete v1.2.3 h1:NP0eAhjcjImqslEwo/1hq7gpajME0fTLTezBKDqfXqo=
+github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
+github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
+github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
+github.com/rogpeppe/go-internal v1.15.0 h1:D0RCU5rMAp+SpgkiNdrjfJ+LX4J1M32V2NeCY7EJ6hc=
+github.com/rogpeppe/go-internal v1.15.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
+github.com/rs/zerolog v1.35.1 h1:m7xQeoiLIiV0BCEY4Hs+j2NG4Gp2o2KPKmhnnLiazKI=
+github.com/rs/zerolog v1.35.1/go.mod h1:EjML9kdfa/RMA7h/6z6pYmq1ykOuA8/mjWaEvGI+jcw=
+github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
+github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.1 h1:PKK9DyHxif4LZo+uQSgXNqs0jj5+xZwwfKHgph2lxBw=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.1/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
+github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
+github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
+github.com/sirupsen/logrus v1.10.1 h1:xi4336Zh11WpU14fXR6I67V3yaTPQYwRx2WEtHbRg4Q=
+github.com/sirupsen/logrus v1.10.1/go.mod h1:vsQHnG7xzNsxk3NrwboUiWPnIC3dmbjcGPykD7+tiHk=
+github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
+github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
+github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+github.com/xhit/go-str2duration/v2 v2.1.0 h1:lxklc02Drh6ynqX+DdPyp5pCKLUQpRT8bp8Ydu2Bstc=
+github.com/xhit/go-str2duration/v2 v2.1.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtXVyJfNt1+BlmyAsU=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 h1:CqXxU8VOmDefoh0+ztfGaymYbhdB/tT3zs79QaZTNGY=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0/go.mod h1:BuhAPThV8PBHBvg8ZzZ/Ok3idOdhWIodywz2xEcRbJo=
+go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
+go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
+go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
+go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
+go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
+go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
+go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
+go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
+go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
+go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+go.yaml.in/yaml/v4 v4.0.0-rc.4 h1:UP4+v6fFrBIb1l934bDl//mmnoIZEDK0idg1+AIvX5U=
+go.yaml.in/yaml/v4 v4.0.0-rc.4/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20200414173820-0848c9571904/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
+gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
+mvdan.cc/sh/v3 v3.14.1 h1:bXkhQWNHCs0KZEChF8hYS6FC+T2N9mUZLbQv9blditI=
+mvdan.cc/sh/v3 v3.14.1/go.mod h1:syYCoFET8w9tvevxiXUtY8/ICrU+l26jHmhJDra3Vwo=
+pgregory.net/rapid v1.2.0 h1:keKAYRcjm+e1F0oAuU5F5+YPAWcyxNNRK2wud503Gnk=
+pgregory.net/rapid v1.2.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=
diff --git a/plugins/datastore/plugin.toml b/plugins/datastore/plugin.toml
new file mode 100644
index 000000000..2c7aed34a
--- /dev/null
+++ b/plugins/datastore/plugin.toml
@@ -0,0 +1,4 @@
+[plugin]
+description = "dokku core datastore plugin"
+version = "0.38.33"
+[plugin.config]
diff --git a/plugins/datastore/src/commands/commands.go b/plugins/datastore/src/commands/commands.go
new file mode 100644
index 000000000..4e5ba2784
--- /dev/null
+++ b/plugins/datastore/src/commands/commands.go
@@ -0,0 +1,14 @@
+package main
+
+import (
+	"os"
+
+	"github.com/dokku/dokku-datastore/sdk"
+)
+
+// main answers the help dokku asks every plugin for, and runs any datastore
+// command dokku found no subcommand for, which is what a datastore's own
+// commands are
+func main() {
+	os.Exit(sdk.RunCommands(os.Args[1:]))
+}
diff --git a/plugins/datastore/src/subcommands/subcommands.go b/plugins/datastore/src/subcommands/subcommands.go
new file mode 100644
index 000000000..bad928ea0
--- /dev/null
+++ b/plugins/datastore/src/subcommands/subcommands.go
@@ -0,0 +1,21 @@
+package main
+
+import (
+	"os"
+	"strings"
+
+	"github.com/dokku/dokku-datastore/sdk"
+)
+
+// main entrypoint to all subcommands
+func main() {
+	parts := strings.Split(os.Args[0], "/")
+	subcommand := parts[len(parts)-1]
+
+	args := []string{}
+	if len(os.Args) > 2 {
+		args = os.Args[2:]
+	}
+
+	os.Exit(sdk.RunSubcommand(subcommand, args))
+}
diff --git a/plugins/datastore/src/triggers/triggers.go b/plugins/datastore/src/triggers/triggers.go
new file mode 100644
index 000000000..a502bb846
--- /dev/null
+++ b/plugins/datastore/src/triggers/triggers.go
@@ -0,0 +1,16 @@
+package main
+
+import (
+	"os"
+	"strings"
+
+	"github.com/dokku/dokku-datastore/sdk"
+)
+
+// main entrypoint to all triggers
+func main() {
+	parts := strings.Split(os.Args[0], "/")
+	trigger := parts[len(parts)-1]
+
+	os.Exit(sdk.RunTrigger(trigger, os.Args[1:]))
+}
diff --git a/plugins/docker-options/concurrency_test.go b/plugins/docker-options/concurrency_test.go
new file mode 100644
index 000000000..10c53ae8c
--- /dev/null
+++ b/plugins/docker-options/concurrency_test.go
@@ -0,0 +1,72 @@
+package dockeroptions
+
+import (
+	"errors"
+	"fmt"
+	"sync"
+	"testing"
+)
+
+func TestAddDockerOptionToPhasesConcurrent(t *testing.T) {
+	const appName = "race-test"
+	setupReportEnv(t, appName)
+
+	const count = 20
+	var wg sync.WaitGroup
+	errs := make([]error, count)
+	for i := 0; i < count; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			errs[i] = AddDockerOptionToPhases(appName, []string{"deploy", "run"}, fmt.Sprintf("--label=race%d", i))
+		}(i)
+	}
+	wg.Wait()
+	if err := errors.Join(errs...); err != nil {
+		t.Fatalf("AddDockerOptionToPhases: %v", err)
+	}
+
+	for _, phase := range []string{"deploy", "run"} {
+		options, err := GetDockerOptionsForPhase(appName, phase)
+		if err != nil {
+			t.Fatalf("GetDockerOptionsForPhase(%s): %v", phase, err)
+		}
+		if len(options) != count {
+			t.Fatalf("%s phase has %d options, want %d: %v", phase, len(options), count, options)
+		}
+	}
+}
+
+func TestRemoveDockerOptionFromPhasesConcurrent(t *testing.T) {
+	const appName = "race-test"
+	setupReportEnv(t, appName)
+
+	const count = 20
+	for i := 0; i < count; i++ {
+		if err := AddDockerOptionToPhases(appName, []string{"deploy"}, fmt.Sprintf("--label=race%d", i)); err != nil {
+			t.Fatalf("AddDockerOptionToPhases: %v", err)
+		}
+	}
+
+	var wg sync.WaitGroup
+	errs := make([]error, count)
+	for i := 0; i < count; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			errs[i] = RemoveDockerOptionFromPhases(appName, []string{"deploy"}, fmt.Sprintf("--label=race%d", i))
+		}(i)
+	}
+	wg.Wait()
+	if err := errors.Join(errs...); err != nil {
+		t.Fatalf("RemoveDockerOptionFromPhases: %v", err)
+	}
+
+	options, err := GetDockerOptionsForPhase(appName, "deploy")
+	if err != nil {
+		t.Fatalf("GetDockerOptionsForPhase: %v", err)
+	}
+	if len(options) != 0 {
+		t.Fatalf("deploy phase still has options: %v", options)
+	}
+}
diff --git a/plugins/docker-options/dockeroptions.go b/plugins/docker-options/dockeroptions.go
index a2ee067e8..7000a04b4 100644
--- a/plugins/docker-options/dockeroptions.go
+++ b/plugins/docker-options/dockeroptions.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 
 	"github.com/dokku/dokku/plugins/common"
-	"mvdan.cc/sh/v3/syntax"
+	"github.com/dokku/dokku/plugins/common/shellwords"
 )
 
 // DefaultProcessType is the sentinel process-type key used for options that
@@ -32,7 +32,7 @@ func SplitOptionString(input string) (options []string, processes []string, err
 		return nil, nil, nil
 	}
 
-	fields, err := literalFields(input)
+	fields, err := shellwords.Split(input)
 	if err != nil {
 		return nil, nil, fmt.Errorf("Unable to parse docker option: %s", err.Error())
 	}
@@ -93,7 +93,7 @@ func groupOptionTokens(fields []string) [][]string {
 // stops before consuming all of it - a line whose tail begins with an unquoted
 // `#` reads as a shell comment, and dropping it would lose stored data.
 func canonicalOptionsFromLine(line string) []string {
-	fields, end, err := literalFieldsWithEnd(line)
+	fields, end, err := shellwords.SplitWithEnd(line)
 	if err != nil || end < len(strings.TrimRight(line, " \t")) {
 		return []string{line}
 	}
@@ -118,12 +118,12 @@ func optionsEqual(stored string, option string) bool {
 		return true
 	}
 
-	storedFields, err := literalFields(stored)
+	storedFields, err := shellwords.Split(stored)
 	if err != nil {
 		return false
 	}
 
-	optionFields, err := literalFields(option)
+	optionFields, err := shellwords.Split(option)
 	if err != nil {
 		return false
 	}
@@ -131,90 +131,6 @@ func optionsEqual(stored string, option string) bool {
 	return slices.Equal(storedFields, optionFields)
 }
 
-// literalFields splits input into shell words using the parser directly, so
-// quotes delimit words and are stripped from the stored value, but nothing is
-// expanded. Parameter expansions, command substitutions, and other
-// metacharacters are preserved verbatim. Malformed input, such as an unbalanced
-// quote, returns the parser error.
-func literalFields(input string) ([]string, error) {
-	fields, _, err := literalFieldsWithEnd(input)
-	return fields, err
-}
-
-// literalFieldsWithEnd is literalFields plus the byte offset just past the last
-// word the parser consumed. Callers that must not lose data compare the offset
-// against the length of the input to detect a tail the parser skipped, such as
-// a shell comment.
-func literalFieldsWithEnd(input string) ([]string, int, error) {
-	parser := syntax.NewParser()
-	var fields []string
-	end := 0
-	for word, err := range parser.WordsSeq(strings.NewReader(input)) {
-		if err != nil {
-			return nil, 0, err
-		}
-		fields = append(fields, literalWordValue(input, word.Parts))
-		end = int(word.End().Offset())
-	}
-	return fields, end, nil
-}
-
-// literalWordValue reconstructs the unquoted, unexpanded value of a shell word.
-// Literal and single-quoted parts contribute their literal text; double-quoted
-// parts have their surrounding quotes dropped while their contents stay
-// literal; every other part - parameter expansions, command substitutions,
-// arithmetic expansions - contributes its original source text unchanged.
-// Backslash escapes are removed the same way the shell removes them during
-// quote removal so a value such as `Host(\`app\`)` round-trips to `Host(`app`)`.
-func literalWordValue(input string, parts []syntax.WordPart) string {
-	var sb strings.Builder
-	for _, part := range parts {
-		switch p := part.(type) {
-		case *syntax.Lit:
-			sb.WriteString(unquoteBackslashes(p.Value, false))
-		case *syntax.SglQuoted:
-			sb.WriteString(p.Value)
-		case *syntax.DblQuoted:
-			for _, inner := range p.Parts {
-				if lit, ok := inner.(*syntax.Lit); ok {
-					sb.WriteString(unquoteBackslashes(lit.Value, true))
-					continue
-				}
-				sb.WriteString(input[inner.Pos().Offset():inner.End().Offset()])
-			}
-		default:
-			sb.WriteString(input[part.Pos().Offset():part.End().Offset()])
-		}
-	}
-	return sb.String()
-}
-
-// unquoteBackslashes removes backslashes the way the shell does during quote
-// removal. Inside double quotes only \$, \`, \", \\, and an escaped newline
-// lose their backslash; unquoted, a backslash escapes any following character.
-func unquoteBackslashes(s string, inDblQuotes bool) string {
-	if !strings.Contains(s, "\\") {
-		return s
-	}
-	var sb strings.Builder
-	for i := 0; i < len(s); i++ {
-		if s[i] == '\\' && i+1 < len(s) {
-			next := s[i+1]
-			if next == '\n' {
-				i++
-				continue
-			}
-			if !inDblQuotes || next == '$' || next == '`' || next == '"' || next == '\\' {
-				sb.WriteByte(next)
-				i++
-				continue
-			}
-		}
-		sb.WriteByte(s[i])
-	}
-	return sb.String()
-}
-
 // isFlagToken reports whether tok looks like a CLI flag (long or short) rather
 // than a value. Treating any token that begins with `-` and has more than one
 // character as a flag matches docker's flag conventions and avoids the need
@@ -238,9 +154,12 @@ func joinShellTokens(tokens []string) string {
 // quoteShellArg returns s wrapped in single quotes when it contains characters
 // the shell would otherwise interpret (whitespace, quotes, expansion sigils,
 // globs, redirections, etc.). Embedded single quotes are escaped with the
-// standard `'\''` close-escape-open sequence. Tokens free of such characters
-// are returned verbatim so the stored representation stays human-readable for
-// the common case.
+// standard close-escape-open sequence:
+//
+//	'\''
+//
+// Tokens free of such characters are returned verbatim so the stored
+// representation stays human-readable for the common case.
 func quoteShellArg(s string) string {
 	if s == "" {
 		return "''"
@@ -279,32 +198,17 @@ func SetDockerOptionForPhases(appName string, phases []string, name string, valu
 // SetDockerOptionForProcessPhases sets a `--name=value` option for the specified
 // process types and phases, replacing any existing entry with the same name.
 func SetDockerOptionForProcessPhases(appName string, processTypes []string, phases []string, name string, value string) error {
-	if len(processTypes) == 0 {
-		processTypes = []string{DefaultProcessType}
-	}
-	for _, processType := range processTypes {
-		for _, phase := range phases {
-			options, err := GetDockerOptionsForProcessPhase(appName, processType, phase)
-			if err != nil {
-				return err
-			}
-
-			newOptions := []string{}
-			for _, option := range options {
-				if strings.HasPrefix(option, fmt.Sprintf("--%s=", name)) {
-					continue
-				}
-				newOptions = append(newOptions, option)
-			}
-
-			newOptions = append(newOptions, fmt.Sprintf("--%s=%s", name, value))
-			sort.Strings(newOptions)
-			if err := writeDockerOptionsForProcessPhase(appName, processType, phase, newOptions); err != nil {
-				return err
+	return updateDockerOptionsForProcessPhases(appName, processTypes, phases, func(options []string) []string {
+		newOptions := []string{}
+		for _, option := range options {
+			if strings.HasPrefix(option, fmt.Sprintf("--%s=", name)) {
+				continue
 			}
+			newOptions = append(newOptions, option)
 		}
-	}
-	return nil
+
+		return append(newOptions, fmt.Sprintf("--%s=%s", name, value))
+	})
 }
 
 // AddDockerOptionToPhases adds an option to the default scope for the specified phases.
@@ -314,24 +218,9 @@ func AddDockerOptionToPhases(appName string, phases []string, option string) err
 
 // AddDockerOptionToProcessPhases adds an option to the specified process types and phases.
 func AddDockerOptionToProcessPhases(appName string, processTypes []string, phases []string, option string) error {
-	if len(processTypes) == 0 {
-		processTypes = []string{DefaultProcessType}
-	}
-	for _, processType := range processTypes {
-		for _, phase := range phases {
-			options, err := GetDockerOptionsForProcessPhase(appName, processType, phase)
-			if err != nil {
-				return err
-			}
-
-			options = append(options, option)
-			sort.Strings(options)
-			if err := writeDockerOptionsForProcessPhase(appName, processType, phase, options); err != nil {
-				return err
-			}
-		}
-	}
-	return nil
+	return updateDockerOptionsForProcessPhases(appName, processTypes, phases, func(options []string) []string {
+		return append(options, option)
+	})
 }
 
 // GetDockerOptionsForPhase returns the docker options stored under the default
@@ -371,30 +260,15 @@ func RemoveDockerOptionFromPhases(appName string, phases []string, option string
 // non-canonical form still matches the canonically re-serialized string the
 // CLI hands down.
 func RemoveDockerOptionFromProcessPhases(appName string, processTypes []string, phases []string, option string) error {
-	if len(processTypes) == 0 {
-		processTypes = []string{DefaultProcessType}
-	}
-	for _, processType := range processTypes {
-		for _, phase := range phases {
-			options, err := GetDockerOptionsForProcessPhase(appName, processType, phase)
-			if err != nil {
-				return err
-			}
-
-			newOptions := []string{}
-			for _, opt := range options {
-				if !optionsEqual(opt, option) {
-					newOptions = append(newOptions, opt)
-				}
-			}
-
-			sort.Strings(newOptions)
-			if err := writeDockerOptionsForProcessPhase(appName, processType, phase, newOptions); err != nil {
-				return err
+	return updateDockerOptionsForProcessPhases(appName, processTypes, phases, func(options []string) []string {
+		newOptions := []string{}
+		for _, opt := range options {
+			if !optionsEqual(opt, option) {
+				newOptions = append(newOptions, opt)
 			}
 		}
-	}
-	return nil
+		return newOptions
+	})
 }
 
 // GetSpecifiedDockerOptionsForPhase returns the docker options for the specified
@@ -491,6 +365,31 @@ func splitPropertyKey(key string) (processType, phase string, ok bool) {
 	return processType, phase, true
 }
 
-func writeDockerOptionsForProcessPhase(appName, processType, phase string, options []string) error {
-	return common.PropertyListWrite("docker-options", appName, propertyKey(processType, phase), options)
+// updateDockerOptionsForProcessPhases rewrites the stored options of every
+// process type and phase combination with the sorted result of update, holding
+// the app's docker-options property lock across every read and write so
+// concurrent updates to the same app cannot drop each other's options. An
+// empty processTypes list is treated as the default scope.
+func updateDockerOptionsForProcessPhases(appName string, processTypes []string, phases []string, update func(options []string) []string) error {
+	if len(processTypes) == 0 {
+		processTypes = []string{DefaultProcessType}
+	}
+
+	return common.PropertyLock("docker-options", appName, func(p *common.LockedProperties) error {
+		for _, processType := range processTypes {
+			for _, phase := range phases {
+				options, err := GetDockerOptionsForProcessPhase(appName, processType, phase)
+				if err != nil {
+					return err
+				}
+
+				options = update(options)
+				sort.Strings(options)
+				if err := p.ListWrite(propertyKey(processType, phase), options); err != nil {
+					return err
+				}
+			}
+		}
+		return nil
+	})
 }
diff --git a/plugins/docker-options/functions.go b/plugins/docker-options/functions.go
index 33ba8bfa4..17a55b7f1 100644
--- a/plugins/docker-options/functions.go
+++ b/plugins/docker-options/functions.go
@@ -390,36 +390,42 @@ func migrateTraefikLabelBackticks() error {
 	}
 
 	for _, appName := range apps {
-		properties, err := common.PropertyGetAll("docker-options", appName)
-		if err != nil {
-			return err
-		}
-
-		for key := range properties {
-			processType, phase, ok := splitPropertyKey(key)
-			if !ok {
-				continue
-			}
-
-			options, err := GetDockerOptionsForProcessPhase(appName, processType, phase)
+		err := common.PropertyLock("docker-options", appName, func(p *common.LockedProperties) error {
+			properties, err := common.PropertyGetAll("docker-options", appName)
 			if err != nil {
 				return err
 			}
 
-			changed := false
-			for i, option := range options {
-				if fixed, ok := repairTraefikLabelBackticks(option); ok {
-					options[i] = fixed
-					changed = true
+			for key := range properties {
+				processType, phase, ok := splitPropertyKey(key)
+				if !ok {
+					continue
 				}
-			}
 
-			if changed {
-				if err := writeDockerOptionsForProcessPhase(appName, processType, phase, options); err != nil {
+				options, err := GetDockerOptionsForProcessPhase(appName, processType, phase)
+				if err != nil {
 					return err
 				}
-				common.LogInfo1(fmt.Sprintf("Repaired docker-options label backticks for %s (%s %s)", appName, processType, phase))
+
+				changed := false
+				for i, option := range options {
+					if fixed, ok := repairTraefikLabelBackticks(option); ok {
+						options[i] = fixed
+						changed = true
+					}
+				}
+
+				if changed {
+					if err := p.ListWrite(key, options); err != nil {
+						return err
+					}
+					common.LogInfo1(fmt.Sprintf("Repaired docker-options label backticks for %s (%s %s)", appName, processType, phase))
+				}
 			}
+			return nil
+		})
+		if err != nil {
+			return err
 		}
 	}
 
@@ -494,31 +500,37 @@ func migrateNonCanonicalOptions() error {
 	}
 
 	for _, appName := range apps {
-		properties, err := common.PropertyGetAll("docker-options", appName)
-		if err != nil {
-			return err
-		}
-
-		for key := range properties {
-			processType, phase, ok := splitPropertyKey(key)
-			if !ok {
-				continue
-			}
-
-			options, err := GetDockerOptionsForProcessPhase(appName, processType, phase)
+		err := common.PropertyLock("docker-options", appName, func(p *common.LockedProperties) error {
+			properties, err := common.PropertyGetAll("docker-options", appName)
 			if err != nil {
 				return err
 			}
 
-			canonical := canonicalizeOptionLines(options)
-			if slices.Equal(canonical, options) {
-				continue
-			}
+			for key := range properties {
+				processType, phase, ok := splitPropertyKey(key)
+				if !ok {
+					continue
+				}
 
-			if err := writeDockerOptionsForProcessPhase(appName, processType, phase, canonical); err != nil {
-				return err
+				options, err := GetDockerOptionsForProcessPhase(appName, processType, phase)
+				if err != nil {
+					return err
+				}
+
+				canonical := canonicalizeOptionLines(options)
+				if slices.Equal(canonical, options) {
+					continue
+				}
+
+				if err := p.ListWrite(key, canonical); err != nil {
+					return err
+				}
+				common.LogInfo1(fmt.Sprintf("Rewrote docker-options into canonical form for %s (%s %s)", appName, processType, phase))
 			}
-			common.LogInfo1(fmt.Sprintf("Rewrote docker-options into canonical form for %s (%s %s)", appName, processType, phase))
+			return nil
+		})
+		if err != nil {
+			return err
 		}
 	}
 
diff --git a/plugins/docker-options/go.mod b/plugins/docker-options/go.mod
index 52fb3ac06..2ab5efb34 100644
--- a/plugins/docker-options/go.mod
+++ b/plugins/docker-options/go.mod
@@ -1,30 +1,30 @@
 module github.com/dokku/dokku/plugins/docker-options
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
-	github.com/spf13/pflag v1.0.10
-	mvdan.cc/sh/v3 v3.13.1
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	mvdan.cc/sh/v3 v3.14.1 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/docker-options/go.sum b/plugins/docker-options/go.sum
index d9166f047..7e089b416 100644
--- a/plugins/docker-options/go.sum
+++ b/plugins/docker-options/go.sum
@@ -1,15 +1,14 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
-github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
-github.com/go-quicktest/qt v1.101.0/go.mod h1:14Bz/f7NwaXPtdYEgzsx46kqSxVwTbzVZsDC26tQJow=
+github.com/go-quicktest/qt v1.102.0 h1:HSQxCeh5YZH3EL3W39ixjtyaEhcWSXQHtHnMBzSs474=
+github.com/go-quicktest/qt v1.102.0/go.mod h1:p4lGIVX+8Wa6ZPNDvqcxq36XpUDLh42FLetFU7odllI=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
@@ -20,12 +19,12 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -34,32 +33,27 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rogpeppe/go-internal v1.15.0 h1:D0RCU5rMAp+SpgkiNdrjfJ+LX4J1M32V2NeCY7EJ6hc=
+github.com/rogpeppe/go-internal v1.15.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-mvdan.cc/sh/v3 v3.13.1 h1:DP3TfgZhDkT7lerUdnp6PTGKyxxzz6T+cOlY/xEvfWk=
-mvdan.cc/sh/v3 v3.13.1/go.mod h1:lXJ8SexMvEVcHCoDvAGLZgFJ9Wsm2sulmoNEXGhYZD0=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
+mvdan.cc/sh/v3 v3.14.1 h1:bXkhQWNHCs0KZEChF8hYS6FC+T2N9mUZLbQv9blditI=
+mvdan.cc/sh/v3 v3.14.1/go.mod h1:syYCoFET8w9tvevxiXUtY8/ICrU+l26jHmhJDra3Vwo=
diff --git a/plugins/docker-options/plugin.toml b/plugins/docker-options/plugin.toml
index 60c83872d..b995d2e0b 100644
--- a/plugins/docker-options/plugin.toml
+++ b/plugins/docker-options/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core docker-options plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/domains/Makefile b/plugins/domains/Makefile
index c4698f30c..9612a5c2c 100644
--- a/plugins/domains/Makefile
+++ b/plugins/domains/Makefile
@@ -1,4 +1,3 @@
-GOARCH ?= amd64
 TRIGGERS = triggers/report
 BUILD = report-subcommand triggers
 PLUGIN_NAME = domains
diff --git a/plugins/domains/go.mod b/plugins/domains/go.mod
index bd71c14a0..5b62ee402 100644
--- a/plugins/domains/go.mod
+++ b/plugins/domains/go.mod
@@ -1,29 +1,29 @@
 module github.com/dokku/dokku/plugins/domains
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/domains/go.sum b/plugins/domains/go.sum
index 14bf42b1c..9ada61068 100644
--- a/plugins/domains/go.sum
+++ b/plugins/domains/go.sum
@@ -1,25 +1,24 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -28,28 +27,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/domains/internal-functions b/plugins/domains/internal-functions
index 04f68bef6..dfcfbb77a 100644
--- a/plugins/domains/internal-functions
+++ b/plugins/domains/internal-functions
@@ -38,9 +38,11 @@ fn-domains-global-vhosts() {
 fn-domains-generate-urls() {
   declare APP="$1" DEFAULT_SCHEME="$2" DEFAULT_LISTEN_PORT="$3"
 
-  local app_vhosts="$(plugn trigger domains-list "$APP")"
-  if [[ -n "$app_vhosts" ]]; then
-    for app_vhost in $app_vhosts; do
+  local app_vhost
+  local -a app_vhosts
+  read -r -d '' -a app_vhosts <<<"$(plugn trigger domains-list "$APP")" || true
+  if [[ "${#app_vhosts[@]}" -gt 0 ]]; then
+    for app_vhost in "${app_vhosts[@]}"; do
       fn-domains-generate-urls-from-config "$APP" "$DEFAULT_SCHEME" "$app_vhost" "$DEFAULT_LISTEN_PORT"
     done
   else
diff --git a/plugins/domains/plugin.toml b/plugins/domains/plugin.toml
index 3b2d832b0..15bd15526 100644
--- a/plugins/domains/plugin.toml
+++ b/plugins/domains/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core domains plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/domains/subcommands/disable b/plugins/domains/subcommands/disable
index 69b14b528..30baf3a32 100755
--- a/plugins/domains/subcommands/disable
+++ b/plugins/domains/subcommands/disable
@@ -10,7 +10,7 @@ cmd-domains-disable() {
   [[ "$1" == "$cmd" ]] && shift 1
   declare APP="$1"
 
-  [[ "$APP" == "--all" ]] && verify_app_name "$APP"
+  [[ "$APP" == "--all" ]] || verify_app_name "$APP"
   fn-domains-disable "$APP"
 }
 
diff --git a/plugins/domains/subcommands/enable b/plugins/domains/subcommands/enable
index d996db25a..466d3c58a 100755
--- a/plugins/domains/subcommands/enable
+++ b/plugins/domains/subcommands/enable
@@ -10,7 +10,7 @@ cmd-domains-enable() {
   [[ "$1" == "$cmd" ]] && shift 1
   declare APP="$1"
 
-  [[ "$APP" == "--all" ]] && verify_app_name "$APP"
+  [[ "$APP" == "--all" ]] || verify_app_name "$APP"
   fn-domains-enable "$APP"
 }
 
diff --git a/plugins/enter/plugin.toml b/plugins/enter/plugin.toml
index da046903b..6cf3be3c2 100644
--- a/plugins/enter/plugin.toml
+++ b/plugins/enter/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core enter plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/git/Makefile b/plugins/git/Makefile
index 4a17c4b2a..1888e3dd8 100644
--- a/plugins/git/Makefile
+++ b/plugins/git/Makefile
@@ -1,4 +1,3 @@
-GOARCH ?= amd64
 TRIGGERS = triggers/report
 BUILD = report-subcommand triggers
 PLUGIN_NAME = git
diff --git a/plugins/git/functions b/plugins/git/functions
index 9c9b9206c..277017369 100755
--- a/plugins/git/functions
+++ b/plugins/git/functions
@@ -56,6 +56,17 @@ git_trigger_build() {
   dokku_receive "$APP" "$BUILDER" "$TMP_WORK_DIR"
 }
 
+fn-git-verify-app() {
+  declare desc="verifies an existing app, or validates the name of a new app"
+  declare APP="$1"
+
+  if [[ -d "$DOKKU_ROOT/$APP" ]]; then
+    verify_app_name "$APP"
+  else
+    is_valid_app_name "$APP"
+  fi
+}
+
 cmd-git-hook() {
   declare desc="kick off receive-app trigger from git prereceive hook"
   declare cmd="git-hook"
@@ -63,7 +74,7 @@ cmd-git-hook() {
   declare APP="$1"
   local DOKKU_DEPLOY_BRANCH
 
-  plugn trigger app-exists "$APP" 2>/dev/null || is_valid_app_name "$APP"
+  fn-git-verify-app "$APP"
 
   DOKKU_DEPLOY_BRANCH="$(fn-git-computed-deploy-branch "$APP")"
   if ! git check-ref-format --branch "$DOKKU_DEPLOY_BRANCH" &>/dev/null; then
@@ -77,12 +88,12 @@ cmd-git-hook() {
     # Only run this script for the master branch. You can remove this
     # if block if you wish to run it for others as well.
     if [[ $refname == "refs/heads/${DOKKU_DEPLOY_BRANCH}" ]] || [[ $refname == "refs/tags/${DOKKU_DEPLOY_BRANCH}" ]]; then
-      git_receive_app "$APP" "$newrev"
+      DOKKU_GIT_SOURCE_IMAGE="" git_receive_app "$APP" "$newrev"
       plugn trigger deploy-source-set "$APP" "git-push" "$newrev"
     else
       # broken out into plugin so we might support other methods to receive an app
       if [[ $(find "$PLUGIN_PATH"/enabled/*/receive-branch 2>/dev/null | wc -l) != 1 ]]; then
-        plugn trigger receive-branch "$APP" "$newrev" "$refname"
+        DOKKU_GIT_SOURCE_IMAGE="" plugn trigger receive-branch "$APP" "$newrev" "$refname"
         plugn trigger deploy-source-set "$APP" "git-push" "$newrev"
       elif [[ -z "$(fn-git-computed-deploy-branch "$APP" "")" ]]; then
         local deploy_branch="${refname/refs\/heads\//}"
@@ -90,7 +101,7 @@ cmd-git-hook() {
 
         echo $'\e[1G\e[K'"-----> Set ${deploy_branch} as deploy-branch"
         fn-plugin-property-write "git" "$APP" "deploy-branch" "${deploy_branch}"
-        git_receive_app "$APP" "$newrev"
+        DOKKU_GIT_SOURCE_IMAGE="" git_receive_app "$APP" "$newrev"
         plugn trigger deploy-source-set "$APP" "git-push" "$newrev"
       else
         echo $'\e[1G\e[K'"-----> WARNING: deploy did not complete, you must push to ${DOKKU_DEPLOY_BRANCH}."
@@ -141,12 +152,45 @@ git_receive_app() {
   else
     local exit_code=0
     acquire_app_deploy_lock "$APP" "exclusive"
-    git_build "$APP" "$REV" || exit_code="$?"
+    fn-git-build-with-lock-held "$APP" "$REV" || exit_code="$?"
     release_app_deploy_lock "$APP" "$exit_code"
     return "$exit_code"
   fi
 }
 
+fn-git-build-with-lock-held() {
+  declare desc="builds an app at a revision, expecting the caller to hold the app deploy lock"
+  declare APP="$1" REV="$2"
+  local exit_code=0 has_source_image=false source_image previous_source_image
+
+  # DOKKU_GIT_SOURCE_IMAGE is only applied while the deploy lock is held. An
+  # empty value clears the property, while an unset variable leaves it as-is.
+  if [[ -n "${DOKKU_GIT_SOURCE_IMAGE+x}" ]]; then
+    has_source_image=true
+    source_image="$DOKKU_GIT_SOURCE_IMAGE"
+    unset DOKKU_GIT_SOURCE_IMAGE
+    previous_source_image="$(fn-git-source-image "$APP")"
+    fn-plugin-property-write "git" "$APP" "source-image" "$source_image"
+  fi
+
+  (git_build "$APP" "$REV") || exit_code="$?"
+  if [[ "$exit_code" -ne 0 ]] && [[ "$has_source_image" == "true" ]]; then
+    fn-plugin-property-lock "git" "$APP" fn-git-restore-source-image "$APP" "$source_image" "$previous_source_image"
+  fi
+  return "$exit_code"
+}
+
+fn-git-restore-source-image() {
+  declare desc="restores the previous source-image unless it was changed since the failed build set it, expecting the caller to hold the git property lock"
+  declare APP="$1" BUILD_SOURCE_IMAGE="$2" PREVIOUS_SOURCE_IMAGE="$3"
+
+  if [[ "$(fn-git-source-image "$APP")" != "$BUILD_SOURCE_IMAGE" ]]; then
+    return
+  fi
+
+  fn-plugin-property-write "git" "$APP" "source-image" "$PREVIOUS_SOURCE_IMAGE"
+}
+
 cmd-git-upload-pack() {
   declare desc="executes git-upload-pack"
   declare cmd="git-upload-pack"
@@ -154,7 +198,7 @@ cmd-git-upload-pack() {
   declare APP="$1"
 
   APP="$(echo "$APP" | perl -pe 's/(?<!\\)'\''//g' | sed 's/\\'\''/'\''/g' | sed 's/^\///g')"
-  is_valid_app_name "$APP"
+  fn-git-verify-app "$APP"
   ! plugn trigger app-exists "$APP" &>/dev/null && plugn trigger app-maybe-create "$APP"
 
   plugn trigger git-pre-pull "$APP"
@@ -168,7 +212,7 @@ cmd-git-glob() {
   local APP="$(echo "$2" | perl -pe 's/(?<!\\)'\''//g' | sed 's/\\'\''/'\''/g' | sed 's/^\///g')"
   local APP_PATH=$DOKKU_ROOT/$APP
 
-  plugn trigger app-exists "$APP" 2>/dev/null || is_valid_app_name "$APP"
+  fn-git-verify-app "$APP"
   if [[ $1 == "git-receive-pack" && ! -d "$APP_PATH/refs" ]]; then
     ! plugn trigger app-exists "$APP" &>/dev/null && plugn trigger app-maybe-create "$APP"
 
diff --git a/plugins/git/git-from-archive b/plugins/git/git-from-archive
index 3fe833fee..b2788f464 100755
--- a/plugins/git/git-from-archive
+++ b/plugins/git/git-from-archive
@@ -51,7 +51,7 @@ trigger-git-git-from-archive() {
     popd &>/dev/null || pushd "/tmp" >/dev/null
   fi
 
-  plugn trigger git-from-directory "$APP" "$TMP_WORK_DIR" "$USER_NAME" "$USER_EMAIL"
+  DOKKU_GIT_SOURCE_IMAGE="" plugn trigger git-from-directory "$APP" "$TMP_WORK_DIR" "$USER_NAME" "$USER_EMAIL"
 }
 
 trigger-git-git-from-archive "$@"
diff --git a/plugins/git/git-from-directory b/plugins/git/git-from-directory
index 87dddadd3..25210ff0a 100755
--- a/plugins/git/git-from-directory
+++ b/plugins/git/git-from-directory
@@ -5,20 +5,19 @@ source "$PLUGIN_AVAILABLE_PATH/git/internal-functions"
 set -eo pipefail
 [[ $DOKKU_TRACE ]] && set -x
 
-trigger-git-git-from-directory() {
-  declare desc="updates a repository from a directory"
-  declare trigger="git-from-directory"
-  declare APP="$1" SOURCECODE_WORK_DIR="$2" USER_NAME="${3:-Dokku}" USER_EMAIL="${4:-automated@dokku.sh}"
+fn-git-from-directory-with-lock-held() {
+  declare desc="updates a repository from a directory and builds it, expecting the caller to hold the app deploy lock"
+  declare APP="$1" SOURCECODE_WORK_DIR="$2" USER_NAME="$3" USER_EMAIL="$4"
 
   local APP_ROOT="$DOKKU_ROOT/$APP"
   local DOKKU_DEPLOY_BRANCH="$(fn-git-computed-deploy-branch "$APP")"
-  local REV
+  local REV PREVIOUS_REV
   local TMP_WORK_DIR=$(mktemp -d "/tmp/dokku-${DOKKU_PID}-${FUNCNAME[0]}.XXXXXX")
   local TMP_WORK_DIR_2=$(mktemp -d "/tmp/dokku-${DOKKU_PID}-${FUNCNAME[0]}.XXXXXX")
   trap "rm -rf '$TMP_WORK_DIR' '$TMP_WORK_DIR_2' >/dev/null" RETURN INT TERM EXIT
 
   local has_code=false
-  if fn-git-cmd "$APP_ROOT" rev-parse "$DOKKU_DEPLOY_BRANCH" &>/dev/null; then
+  if PREVIOUS_REV="$(fn-git-cmd "$APP_ROOT" rev-parse "$DOKKU_DEPLOY_BRANCH" 2>/dev/null)"; then
     has_code=true
   fi
 
@@ -60,18 +59,39 @@ trigger-git-git-from-directory() {
   fi
 
   rm -rf "$TMP_WORK_DIR" "$TMP_WORK_DIR_2" >/dev/null
-  if git_receive_app "$APP" "$REV"; then
+  if fn-git-build-with-lock-held "$APP" "$REV"; then
     return
   else
     local exit_code=$?
     local DOKKU_DEPLOY_BRANCH="$(fn-git-computed-deploy-branch "$APP")"
+    # only roll back the deploy branch if it still points at the commit created above
     if [[ "$has_code" == "false" ]]; then
-      fn-git-cmd "$APP_ROOT" update-ref -d HEAD
+      fn-git-cmd "$APP_ROOT" update-ref -d "refs/heads/$DOKKU_DEPLOY_BRANCH" "$REV" || dokku_log_warn "Unable to roll back the $DOKKU_DEPLOY_BRANCH branch"
     else
-      fn-git-cmd "$APP_ROOT" update-ref "refs/heads/$DOKKU_DEPLOY_BRANCH" "$DOKKU_DEPLOY_BRANCH^"
+      fn-git-cmd "$APP_ROOT" update-ref "refs/heads/$DOKKU_DEPLOY_BRANCH" "$PREVIOUS_REV" "$REV" || dokku_log_warn "Unable to roll back the $DOKKU_DEPLOY_BRANCH branch"
     fi
     return "$exit_code"
   fi
 }
 
+trigger-git-git-from-directory() {
+  declare desc="updates a repository from a directory"
+  declare trigger="git-from-directory"
+  declare APP="$1" SOURCECODE_WORK_DIR="$2" USER_NAME="${3:-Dokku}" USER_EMAIL="${4:-automated@dokku.sh}"
+  local exit_code=0
+
+  # the lock is held from before the deploy branch is updated until after it is
+  # rolled back, and the subshell ensures it is released on any failure
+  acquire_app_deploy_lock "$APP" "exclusive"
+  set +e
+  (
+    set -e
+    fn-git-from-directory-with-lock-held "$APP" "$SOURCECODE_WORK_DIR" "$USER_NAME" "$USER_EMAIL"
+  )
+  exit_code="$?"
+  set -e
+  release_app_deploy_lock "$APP" "$exit_code"
+  return "$exit_code"
+}
+
 trigger-git-git-from-directory "$@"
diff --git a/plugins/git/git-from-image b/plugins/git/git-from-image
index 52109ba88..22c0d3cca 100755
--- a/plugins/git/git-from-image
+++ b/plugins/git/git-from-image
@@ -44,8 +44,7 @@ trigger-git-git-from-image() {
     dokku_log_info1 "Image exists on host, skipping pull"
   fi
 
-  fn-plugin-property-write "git" "$APP" "source-image" "$DOCKER_IMAGE"
-  plugn trigger git-from-directory "$APP" "$TMP_WORK_DIR" "$USER_NAME" "$USER_EMAIL"
+  DOKKU_GIT_SOURCE_IMAGE="$DOCKER_IMAGE" plugn trigger git-from-directory "$APP" "$TMP_WORK_DIR" "$USER_NAME" "$USER_EMAIL"
 }
 
 trigger-git-git-from-image "$@"
diff --git a/plugins/git/go.mod b/plugins/git/go.mod
index 0fe821276..96e0582ce 100644
--- a/plugins/git/go.mod
+++ b/plugins/git/go.mod
@@ -1,29 +1,29 @@
 module github.com/dokku/dokku/plugins/git
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/git/go.sum b/plugins/git/go.sum
index 14bf42b1c..9ada61068 100644
--- a/plugins/git/go.sum
+++ b/plugins/git/go.sum
@@ -1,25 +1,24 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -28,28 +27,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/git/internal-functions b/plugins/git/internal-functions
index 7fcca2bf4..5a4a95104 100644
--- a/plugins/git/internal-functions
+++ b/plugins/git/internal-functions
@@ -108,25 +108,30 @@ cmd-git-auth-status() {
   declare desc="reports whether netrc authentication matches the requested state"
   local cmd="git:auth-status"
   [[ "$1" == "$cmd" ]] && shift 1
+  local exit_code_missing_entry=1 exit_code_differing_entry=2 exit_code_invalid_arguments=3
   declare HOST="$1" USERNAME="$2" PASSWORD="$3"
-  [[ -z "$HOST" ]] && dokku_log_fail "Please supply a git host"
+  [[ -z "$HOST" ]] && DOKKU_FAIL_EXIT_CODE="$exit_code_invalid_arguments" dokku_log_fail "Please supply a git host"
 
   PASSWORD="$(fn-git-auth-read-password "$USERNAME" "$PASSWORD")"
 
   if [[ -n "$USERNAME" ]] && [[ -z "$PASSWORD" ]]; then
-    dokku_log_fail "Missing password for netrc auth entry"
+    DOKKU_FAIL_EXIT_CODE="$exit_code_invalid_arguments" dokku_log_fail "Missing password for netrc auth entry"
   fi
 
   local current
   current="$(netrc get "$HOST" 2>/dev/null)" || current=""
 
+  if [[ -z "$current" ]]; then
+    [[ -z "$USERNAME" ]] && return 0
+    return "$exit_code_missing_entry"
+  fi
+
   if [[ -z "$USERNAME" ]]; then
-    [[ -z "$current" ]] && return 0
-    return 1
+    return "$exit_code_differing_entry"
   fi
 
   [[ "$current" == "${USERNAME}:${PASSWORD}" ]] && return 0
-  return 1
+  return "$exit_code_differing_entry"
 }
 
 fn-git-auth-read-password() {
@@ -274,32 +279,59 @@ cmd-git-sync() {
   fi
 
   local APP_ROOT="$DOKKU_ROOT/$APP"
-  DOKKU_DEPLOY_BRANCH="$(fn-git-computed-deploy-branch "$APP")"
-  CURRENT_REF="$(fn-git-cmd "$APP_ROOT" rev-parse "$DOKKU_DEPLOY_BRANCH" 2>/dev/null || true)"
+  local APP_DEPLOY_LOCK_FILE="$(app_deploy_lock_file "$APP")"
+  local fetch_exit_code=0
 
   dokku_setup_build_capture "$APP" "git:sync"
 
-  if ! fn-git-cmd "$APP_ROOT" rev-parse "$DOKKU_DEPLOY_BRANCH" &>/dev/null; then
-    dokku_log_info1_quiet "Cloning $APP from $GIT_REMOTE#$GIT_REF"
-    fn-git-clone "$APP" "$GIT_REMOTE" "$GIT_REF" "$SKIP_DEPLOY_BRANCH"
-  else
-    dokku_log_verbose "Fetching remote code for $APP from $GIT_REMOTE#$GIT_REF"
-    fn-git-fetch "$APP" "$GIT_REMOTE" "$GIT_REF"
+  # acquire_app_deploy_lock is not used as releasing it would finalize the
+  # build record before the build starts
+  acquire_app_advisory_lock "$APP" "exclusive"
+
+  DOKKU_DEPLOY_BRANCH="$(fn-git-computed-deploy-branch "$APP")"
+  CURRENT_REF="$(fn-git-cmd "$APP_ROOT" rev-parse "$DOKKU_DEPLOY_BRANCH" 2>/dev/null || true)"
+
+  # the subshell keeps set -e active and ensures the lock is released on failure
+  set +e
+  (
+    set -e
+    if ! fn-git-cmd "$APP_ROOT" rev-parse "$DOKKU_DEPLOY_BRANCH" &>/dev/null; then
+      dokku_log_info1_quiet "Cloning $APP from $GIT_REMOTE#$GIT_REF"
+      fn-git-clone "$APP" "$GIT_REMOTE" "$GIT_REF" "$SKIP_DEPLOY_BRANCH"
+    else
+      dokku_log_verbose "Fetching remote code for $APP from $GIT_REMOTE#$GIT_REF"
+      fn-git-fetch "$APP" "$GIT_REMOTE" "$GIT_REF"
+    fi
+  )
+  fetch_exit_code="$?"
+  set -e
+
+  if [[ "$fetch_exit_code" -ne 0 ]]; then
+    release_advisory_lock "$APP_DEPLOY_LOCK_FILE"
+    return "$fetch_exit_code"
   fi
 
   UPDATED_REF="$(fn-git-cmd "$APP_ROOT" rev-parse "$DOKKU_DEPLOY_BRANCH" 2>/dev/null || true)"
   local SHOULD_BUILD=false
   if [[ "$FLAG" == "--build" ]]; then
     SHOULD_BUILD=true
-  elif [[ "$FLAG" == "--build-if-changes" ]]; then
-    if [[ "$CURRENT_REF" == "$UPDATED_REF" ]]; then
-      dokku_log_verbose "Skipping build as no changes were detected"
-      return
-    fi
-
+  elif [[ "$FLAG" == "--build-if-changes" ]] && [[ "$CURRENT_REF" != "$UPDATED_REF" ]]; then
     SHOULD_BUILD=true
   fi
 
+  # the synced code is kept even if the build fails, so the source-image is
+  # cleared rather than restored on failure
+  if [[ "$CURRENT_REF" != "$UPDATED_REF" ]] || [[ "$SHOULD_BUILD" == "true" ]]; then
+    fn-plugin-property-write "git" "$APP" "source-image"
+  fi
+  release_advisory_lock "$APP_DEPLOY_LOCK_FILE"
+
+  if [[ "$FLAG" == "--build-if-changes" ]] && [[ "$SHOULD_BUILD" == "false" ]]; then
+    dokku_log_verbose "Skipping build as no changes were detected"
+    dokku_discard_build_capture "$APP"
+    return
+  fi
+
   if [[ "$SHOULD_BUILD" == "true" ]]; then
     if [[ -n "$GIT_REF" ]]; then
       GIT_REF="$(fn-git-cmd "$APP_ROOT" rev-parse "$GIT_REF")"
@@ -309,6 +341,11 @@ cmd-git-sync() {
 
     plugn trigger receive-app "$APP" "$GIT_REF"
     plugn trigger deploy-source-set "$APP" "git-sync" "${GIT_REMOTE}#${GIT_REF}"
+  else
+    # nothing was built, so the record opened before the fetch has no build to
+    # describe. Left in place it stays at status=running, is later reaped as a
+    # spurious failure, and evicts real history from the retention window.
+    dokku_discard_build_capture "$APP"
   fi
 }
 
diff --git a/plugins/git/plugin.toml b/plugins/git/plugin.toml
index 2c1a1ef83..05a3ec74c 100644
--- a/plugins/git/plugin.toml
+++ b/plugins/git/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core git plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/haproxy-vhosts/Dockerfile b/plugins/haproxy-vhosts/Dockerfile
index 6063196ae..d1377b30a 100644
--- a/plugins/haproxy-vhosts/Dockerfile
+++ b/plugins/haproxy-vhosts/Dockerfile
@@ -1 +1 @@
-FROM byjg/easy-haproxy:6.1.1
+FROM byjg/easy-haproxy:6.5.2
diff --git a/plugins/haproxy-vhosts/Makefile b/plugins/haproxy-vhosts/Makefile
index b727ed3b4..e402aded8 100644
--- a/plugins/haproxy-vhosts/Makefile
+++ b/plugins/haproxy-vhosts/Makefile
@@ -1,4 +1,3 @@
-GOARCH ?= amd64
 TRIGGERS = triggers/report
 BUILD = report-subcommand triggers
 PLUGIN_NAME = haproxy-vhosts
diff --git a/plugins/haproxy-vhosts/docker-args-process-deploy b/plugins/haproxy-vhosts/docker-args-process-deploy
index 0c19f32c4..559027dd8 100755
--- a/plugins/haproxy-vhosts/docker-args-process-deploy
+++ b/plugins/haproxy-vhosts/docker-args-process-deploy
@@ -103,22 +103,11 @@ trigger-haproxy-vhosts-docker-args-process-deploy() {
       fi
     fi
 
-    if [[ -n "$proxy_container_https_port" ]] || [[ -n "$proxy_container_https_port_candidate" ]]; then
-      if [[ -z "$proxy_container_https_port" ]]; then
-        dokku_log_warn "Warning: https:443 port mapping not found"
-        dokku_log_warn "Utilizing first https port mapping, http:$proxy_host_https_port_candidate:$proxy_container_https_port_candidate"
-        proxy_container_https_port="$proxy_container_https_port_candidate"
-      fi
-
+    # EasyHAProxy serves https itself: it requests the certificate (certbot), terminates
+    # TLS on 443 and forwards to the same container port as http
+    if [[ -n "$letsencrypt_email" ]] && { [[ -n "$proxy_container_https_port" ]] || [[ -n "$proxy_container_https_port_candidate" ]]; }; then
       output="$output --label haproxy.$APP-$PROC_TYPE.redirect_ssl=true"
-      output="$output --label haproxy.$APP-$PROC_TYPE-https.localport=$proxy_container_https_port"
-      output="$output --label haproxy.$APP-$PROC_TYPE-https.letsencrypt=true"
-      output="$output --label haproxy.$APP-$PROC_TYPE-https.mode=http"
-      output="$output --label haproxy.$APP-$PROC_TYPE-https.port=443"
-
-      if [[ -n "$haproxy_domains" ]]; then
-        output="$output --label haproxy.$APP-$PROC_TYPE-https.host=$haproxy_domains"
-      fi
+      output="$output --label haproxy.$APP-$PROC_TYPE.certbot=true"
     else
       output="$output --label haproxy.$APP-$PROC_TYPE.redirect_ssl=false"
     fi
diff --git a/plugins/haproxy-vhosts/go.mod b/plugins/haproxy-vhosts/go.mod
index 112ea1723..e684fac26 100644
--- a/plugins/haproxy-vhosts/go.mod
+++ b/plugins/haproxy-vhosts/go.mod
@@ -1,29 +1,29 @@
 module github.com/dokku/dokku/plugins/haproxy-vhosts
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/haproxy-vhosts/go.sum b/plugins/haproxy-vhosts/go.sum
index 14bf42b1c..9ada61068 100644
--- a/plugins/haproxy-vhosts/go.sum
+++ b/plugins/haproxy-vhosts/go.sum
@@ -1,25 +1,24 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -28,28 +27,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/haproxy-vhosts/internal-functions b/plugins/haproxy-vhosts/internal-functions
index 3ee7d43a5..9f34d8975 100755
--- a/plugins/haproxy-vhosts/internal-functions
+++ b/plugins/haproxy-vhosts/internal-functions
@@ -39,7 +39,8 @@ fn-haproxy-template-compose-file() {
   HAPROXY_LOG_LEVEL="$(fn-haproxy-computed-log-level)"
   HAPROXY_LETSENCRYPT_EMAIL="$(fn-haproxy-computed-letsencrypt-email)"
   HAPROXY_LETSENCRYPT_SERVER="$(fn-haproxy-computed-letsencrypt-server)"
-  HAPROXY_REFRESH_CONF="$(fn-haproxy-computed-refresh-conf)")
+  HAPROXY_REFRESH_CONF="$(fn-haproxy-computed-refresh-conf)"
+  HAPROXY_DATA_DIR="${DOKKU_LIB_ROOT}/data/haproxy")
 
   sigil -f "$COMPOSE_TEMPLATE" "${SIGIL_PARAMS[@]}" | cat -s >"$OUTPUT_PATH"
 }
diff --git a/plugins/haproxy-vhosts/plugin.toml b/plugins/haproxy-vhosts/plugin.toml
index a7e090be1..80c23468a 100644
--- a/plugins/haproxy-vhosts/plugin.toml
+++ b/plugins/haproxy-vhosts/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core haproxy-vhosts plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/haproxy-vhosts/subcommands/set b/plugins/haproxy-vhosts/subcommands/set
index 3dafa0dc4..e3a800e74 100755
--- a/plugins/haproxy-vhosts/subcommands/set
+++ b/plugins/haproxy-vhosts/subcommands/set
@@ -19,17 +19,16 @@ cmd-haproxy-set() {
     dokku_log_fail "Invalid key specified, valid keys include: image log-level letsencrypt-email letsencrypt-server refresh-conf"
   fi
 
-  if ! fn-in-array "$KEY" "${GLOBAL_KEYS[@]}"; then
-    if [[ "$APP" == "--global" ]]; then
-      dokku_log_fail "The key '$KEY' cannot be set globally"
-    fi
-    verify_app_name "$APP"
+  if ! fn-in-array "$KEY" "${GLOBAL_KEYS[@]}" && [[ "$APP" == "--global" ]]; then
+    dokku_log_fail "The key '$KEY' cannot be set globally"
   fi
 
   if fn-in-array "$KEY" "${GLOBAL_ONLY_KEYS[@]}" && [[ "$APP" != "--global" ]]; then
     dokku_log_fail "The key '$KEY' can only be set globally"
   fi
 
+  [[ "$APP" == "--global" ]] || verify_app_name "$APP"
+
   if [[ -n "$VALUE" ]]; then
     dokku_log_info2_quiet "Setting ${KEY} to ${VALUE}"
     fn-plugin-property-write "haproxy" "$APP" "$KEY" "$VALUE"
diff --git a/plugins/haproxy-vhosts/templates/compose.yml.sigil b/plugins/haproxy-vhosts/templates/compose.yml.sigil
index 49146677c..74e0dba00 100644
--- a/plugins/haproxy-vhosts/templates/compose.yml.sigil
+++ b/plugins/haproxy-vhosts/templates/compose.yml.sigil
@@ -11,10 +11,10 @@ services:
       - CERTBOT_LOG_LEVEL={{ $.HAPROXY_LOG_LEVEL }}
       - HAPROXY_LOG_LEVEL={{ $.HAPROXY_LOG_LEVEL }}
       {{ if $.HAPROXY_LETSENCRYPT_EMAIL }}
-      - EASYHAPROXY_LETSENCRYPT_EMAIL={{ $.HAPROXY_LETSENCRYPT_EMAIL }}"
-      - EASYHAPROXY_LETSENCRYPT_SERVER={{ $.HAPROXY_LETSENCRYPT_SERVER }}
+      - EASYHAPROXY_CERTBOT_EMAIL={{ $.HAPROXY_LETSENCRYPT_EMAIL }}
+      - EASYHAPROXY_CERTBOT_SERVER={{ $.HAPROXY_LETSENCRYPT_SERVER }}
       {{ end }}
-      - HAPROXY_STATS_PORT=false
+      - HAPROXY_STATS_ENABLE=false
 
     network_mode: bridge
 
@@ -28,3 +28,4 @@ services:
 
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
+      - "{{ $.HAPROXY_DATA_DIR }}:/etc/easyhaproxy/certs/certbot"
diff --git a/plugins/logs/Dockerfile b/plugins/logs/Dockerfile
index 0581d3a16..a888ccffa 100644
--- a/plugins/logs/Dockerfile
+++ b/plugins/logs/Dockerfile
@@ -1 +1 @@
-FROM timberio/vector:0.57.0-debian
+FROM timberio/vector:0.61.0-debian
diff --git a/plugins/logs/go.mod b/plugins/logs/go.mod
index 89fcc9e29..f05e6e525 100644
--- a/plugins/logs/go.mod
+++ b/plugins/logs/go.mod
@@ -1,32 +1,32 @@
 module github.com/dokku/dokku/plugins/logs
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
 	github.com/dokku/dokku/plugins/docker-options v0.0.0-00010101000000-000000000000
 	github.com/fastfishio/qson v1.0.2
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	mvdan.cc/sh/v3 v3.13.1 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	mvdan.cc/sh/v3 v3.14.1 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/logs/go.sum b/plugins/logs/go.sum
index 8a20f64a3..fc3f69be2 100644
--- a/plugins/logs/go.sum
+++ b/plugins/logs/go.sum
@@ -1,17 +1,16 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fastfishio/qson v1.0.1 h1:w+QEKeOZOXPsAJSGPxF1/V5+NhHycvPog8D9xnAhSJM=
 github.com/fastfishio/qson v1.0.1/go.mod h1:u2Poc2D8P8hB2pgZTv+l5UDd8QgVVKPZfED/04nAuFs=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
-github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
-github.com/go-quicktest/qt v1.101.0/go.mod h1:14Bz/f7NwaXPtdYEgzsx46kqSxVwTbzVZsDC26tQJow=
+github.com/go-quicktest/qt v1.102.0 h1:HSQxCeh5YZH3EL3W39ixjtyaEhcWSXQHtHnMBzSs474=
+github.com/go-quicktest/qt v1.102.0/go.mod h1:p4lGIVX+8Wa6ZPNDvqcxq36XpUDLh42FLetFU7odllI=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
@@ -22,12 +21,12 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -36,32 +35,27 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rogpeppe/go-internal v1.15.0 h1:D0RCU5rMAp+SpgkiNdrjfJ+LX4J1M32V2NeCY7EJ6hc=
+github.com/rogpeppe/go-internal v1.15.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-mvdan.cc/sh/v3 v3.13.1 h1:DP3TfgZhDkT7lerUdnp6PTGKyxxzz6T+cOlY/xEvfWk=
-mvdan.cc/sh/v3 v3.13.1/go.mod h1:lXJ8SexMvEVcHCoDvAGLZgFJ9Wsm2sulmoNEXGhYZD0=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
+mvdan.cc/sh/v3 v3.14.1 h1:bXkhQWNHCs0KZEChF8hYS6FC+T2N9mUZLbQv9blditI=
+mvdan.cc/sh/v3 v3.14.1/go.mod h1:syYCoFET8w9tvevxiXUtY8/ICrU+l26jHmhJDra3Vwo=
diff --git a/plugins/logs/plugin.toml b/plugins/logs/plugin.toml
index 85e1303e4..8119e889a 100644
--- a/plugins/logs/plugin.toml
+++ b/plugins/logs/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core logs plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/network/go.mod b/plugins/network/go.mod
index 968f32a01..10b26e7d8 100644
--- a/plugins/network/go.mod
+++ b/plugins/network/go.mod
@@ -1,29 +1,29 @@
 module github.com/dokku/dokku/plugins/network
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/network/go.sum b/plugins/network/go.sum
index 14bf42b1c..9ada61068 100644
--- a/plugins/network/go.sum
+++ b/plugins/network/go.sum
@@ -1,25 +1,24 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -28,28 +27,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/network/plugin.toml b/plugins/network/plugin.toml
index d8b241382..81935aec2 100644
--- a/plugins/network/plugin.toml
+++ b/plugins/network/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core network plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/network/src/subcommands/subcommands.go b/plugins/network/src/subcommands/subcommands.go
index 83fe37f98..278fec0ee 100644
--- a/plugins/network/src/subcommands/subcommands.go
+++ b/plugins/network/src/subcommands/subcommands.go
@@ -50,7 +50,7 @@ func main() {
 		args := flag.NewFlagSet("network:rebuild", flag.ExitOnError)
 		args.Parse(os.Args[2:])
 		appName := args.Arg(0)
-		err = network.BuildConfig(appName)
+		err = network.CommandRebuild(appName)
 	case "rebuildall":
 		args := flag.NewFlagSet("network:rebuildall", flag.ExitOnError)
 		args.Parse(os.Args[2:])
diff --git a/plugins/network/subcommands.go b/plugins/network/subcommands.go
index 3c28e15dd..86545bddc 100644
--- a/plugins/network/subcommands.go
+++ b/plugins/network/subcommands.go
@@ -148,6 +148,15 @@ func CommandList(format string, dokkuManaged bool) error {
 	return nil
 }
 
+// CommandRebuild rebuilds network settings for an app
+func CommandRebuild(appName string) error {
+	if err := common.VerifyAppName(appName); err != nil {
+		return err
+	}
+
+	return BuildConfig(appName)
+}
+
 // CommandRebuildall rebuilds network settings for all apps
 func CommandRebuildall() error {
 	apps, err := common.DokkuApps()
diff --git a/plugins/network/triggers.go b/plugins/network/triggers.go
index 2d6354661..fc2e905d6 100644
--- a/plugins/network/triggers.go
+++ b/plugins/network/triggers.go
@@ -216,7 +216,9 @@ func TriggerPostContainerCreate(containerType string, containerID string, appNam
 			return fmt.Errorf("Network %v does not exist", networkName)
 		}
 
-		return attachAppToNetwork(containerID, networkName, appName, phase, processType)
+		if err := attachAppToNetwork(containerID, networkName, appName, phase, processType); err != nil {
+			return err
+		}
 	}
 
 	return nil
diff --git a/plugins/nginx-vhosts/Makefile b/plugins/nginx-vhosts/Makefile
index 8c14028f8..31da02481 100644
--- a/plugins/nginx-vhosts/Makefile
+++ b/plugins/nginx-vhosts/Makefile
@@ -1,4 +1,3 @@
-GOARCH ?= amd64
 TRIGGERS = triggers/report
 BUILD = pagesize nginx-property report-subcommand triggers
 PLUGIN_NAME = nginx-vhosts
diff --git a/plugins/nginx-vhosts/core-post-extract b/plugins/nginx-vhosts/core-post-extract
index 036facb9b..3d1a67424 100755
--- a/plugins/nginx-vhosts/core-post-extract
+++ b/plugins/nginx-vhosts/core-post-extract
@@ -8,8 +8,6 @@ set -eo pipefail
 fn-nginx-vhosts-copy-from-image() {
   declare APP="$1" IMAGE_NAME="$2" CONF_SIGIL_PATH="$3"
 
-  mkdir -p "${DOKKU_LIB_ROOT}/data/nginx-vhosts/app-$APP"
-  find "${DOKKU_LIB_ROOT}/data/nginx-vhosts/app-$APP/" -maxdepth 1 -type f -name 'nginx.conf.sigil.*' -delete
   copy_from_image "$IMAGE_NAME" "$CONF_SIGIL_PATH" "${DOKKU_LIB_ROOT}/data/nginx-vhosts/app-$APP/nginx.conf.sigil.$DOKKU_PID" 2>/dev/null || true
   if [[ ! -f "${DOKKU_LIB_ROOT}/data/nginx-vhosts/app-$APP/nginx.conf.sigil.$DOKKU_PID" ]]; then
     touch "${DOKKU_LIB_ROOT}/data/nginx-vhosts/app-$APP/nginx.conf.sigil.$DOKKU_PID.missing"
@@ -20,7 +18,6 @@ fn-nginx-vhosts-copy-from-directory() {
   declare APP="$1" SOURCECODE_WORK_DIR="$2" CONF_SIGIL_PATH="$3"
 
   pushd "$SOURCECODE_WORK_DIR" >/dev/null
-  mkdir -p "${DOKKU_LIB_ROOT}/data/nginx-vhosts/app-$APP"
 
   if [[ -z "$CONF_SIGIL_PATH" ]]; then
     touch "${DOKKU_LIB_ROOT}/data/nginx-vhosts/app-$APP/nginx.conf.sigil.$DOKKU_PID.missing"
@@ -32,7 +29,6 @@ fn-nginx-vhosts-copy-from-directory() {
     return
   fi
 
-  find "${DOKKU_LIB_ROOT}/data/nginx-vhosts/app-$APP/" -maxdepth 1 -type f -name 'nginx.conf.sigil.*' -delete
   cp -f "$CONF_SIGIL_PATH" "${DOKKU_LIB_ROOT}/data/nginx-vhosts/app-$APP/nginx.conf.sigil.$DOKKU_PID"
   popd &>/dev/null || pushd "/tmp" >/dev/null
 }
@@ -44,6 +40,9 @@ trigger-nginx-vhosts-core-post-extract() {
   local CONF_SIGIL_PATH="$(fn-nginx-computed-nginx-conf-sigil-path "$APP")"
   local app_source_image
 
+  mkdir -p "${DOKKU_LIB_ROOT}/data/nginx-vhosts/app-$APP"
+  find "${DOKKU_LIB_ROOT}/data/nginx-vhosts/app-$APP/" -maxdepth 1 -type f -name 'nginx.conf.sigil.*' -delete
+
   app_source_image="$(plugn trigger git-get-property "$APP" "source-image")"
   if [[ -n "$app_source_image" ]]; then
     fn-nginx-vhosts-copy-from-image "$APP" "$app_source_image" "$CONF_SIGIL_PATH"
diff --git a/plugins/nginx-vhosts/functions b/plugins/nginx-vhosts/functions
index 730edba72..747f45bdd 100755
--- a/plugins/nginx-vhosts/functions
+++ b/plugins/nginx-vhosts/functions
@@ -37,7 +37,7 @@ validate_nginx() {
     verify_app_name "$APP"
     nginx_vhosts_validate_single_func "$APP" "$FLAG"
   else
-    for app in $(dokku_apps "false"); do
+    for app in $(dokku_apps); do
       nginx_vhosts_validate_single_func "$app" "$FLAG"
     done
   fi
@@ -236,6 +236,33 @@ fn-nginx-vhosts-render-template() {
   PROXY_PORT_MAP="$(echo "$proxy_port_map" | xargs)" # trailing spaces mess up default template
   PROXY_UPSTREAM_PORTS="$(echo "$PROXY_UPSTREAM_PORTS" | xargs)"
 
+  # Path-based routes (proxy:route:set). Format the storage representation
+  # into space-separated sigil variables: PROXY_ROUTES holds the route triples
+  # (process|port|path|strip), PROXY_ROUTE_LISTENERS holds one
+  # (process|port|listener-ip,listener-ip,...) entry per unique process+port
+  # pair so the template can render per-route upstream blocks.
+  local PROXY_ROUTES="" PROXY_ROUTE_LISTENERS=""
+  local route_pair_seen=" "
+  while IFS='|' read -r route_proc route_port route_path route_strip; do
+    [[ -z "$route_proc" ]] && continue
+    PROXY_ROUTES="${PROXY_ROUTES} ${route_proc}|${route_port}|${route_path}|${route_strip}"
+    local route_pair="${route_proc}|${route_port}"
+    if [[ "$route_pair_seen" != *" ${route_pair} "* ]]; then
+      route_pair_seen="${route_pair_seen}${route_pair} "
+      local route_listeners="$(plugn trigger network-get-listeners "$APP" "$route_proc" | xargs)"
+      if [[ -z "$route_listeners" ]]; then
+        # No live containers for this process yet; emit a stub so nginx -t
+        # still passes during pre-validate and the upstream block renders
+        # without a host-not-found error at reload time.
+        route_listeners="127.0.0.1:${route_port}"
+      fi
+      local route_listener_csv="${route_listeners// /,}"
+      PROXY_ROUTE_LISTENERS="${PROXY_ROUTE_LISTENERS} ${route_proc}|${route_port}|${route_listener_csv}"
+    fi
+  done < <(plugn trigger proxy-routes-list "$APP")
+  PROXY_ROUTES="$(echo "$PROXY_ROUTES" | xargs)"
+  PROXY_ROUTE_LISTENERS="$(echo "$PROXY_ROUTE_LISTENERS" | xargs)"
+
   local SSL_INUSE=
   local NONSSL_VHOSTS=$(plugn trigger domains-list "$APP")
   local NOSSL_SERVER_NAME=$(echo "$NONSSL_VHOSTS" | xargs)
@@ -252,7 +279,9 @@ fn-nginx-vhosts-render-template() {
       SSL_VHOSTS=$(<"$DOKKU_ROOT/VHOST")
     fi
     local host
-    for host in $SSL_VHOSTS; do
+    local -a ssl_vhosts
+    read -r -d '' -a ssl_vhosts <<<"$SSL_VHOSTS" || true
+    for host in "${ssl_vhosts[@]}"; do
       if [[ ! $NOSSL_SERVER_NAME =~ (^|[[:space:]])$host($|[[:space:]]) ]]; then
         SSL_SERVER_NAME="${host}${SSL_SERVER_NAME:+ $SSL_SERVER_NAME}"
       fi
@@ -282,6 +311,7 @@ fn-nginx-vhosts-render-template() {
   local CLIENT_MAX_BODY_SIZE="$(fn-nginx-computed-client-max-body-size "$APP")"
   local KEEPALIVE_TIMEOUT="$(fn-nginx-computed-keepalive-timeout "$APP")"
   local LINGERING_TIMEOUT="$(fn-nginx-computed-lingering-timeout "$APP")"
+  local PROXY_HTTP_VERSION="$(fn-nginx-computed-proxy-http-version "$APP")"
   local PROXY_CONNECT_TIMEOUT="$(fn-nginx-computed-proxy-connect-timeout "$APP")"
   local PROXY_READ_TIMEOUT="$(fn-nginx-computed-proxy-read-timeout "$APP")"
   local PROXY_SEND_TIMEOUT="$(fn-nginx-computed-proxy-send-timeout "$APP")"
@@ -294,6 +324,9 @@ fn-nginx-vhosts-render-template() {
 
   local NGINX_BIND_ADDRESS_IP4="$(fn-nginx-computed-bind-address-ipv4 "$APP")"
   local NGINX_BIND_ADDRESS_IP6="$(fn-nginx-computed-bind-address-ipv6 "$APP")"
+  local NGINX_DNS_RESOLVER="$(fn-nginx-computed-dns-resolver "$APP")"
+  local NGINX_DNS_RESOLVER_TIMEOUT="$(fn-nginx-computed-dns-resolver-timeout "$APP")"
+  local NGINX_DNS_ZONE="$(fn-nginx-computed-dns-zone "$APP")"
   local NGINX_UNDERSCORE_IN_HEADERS="$(fn-nginx-computed-underscore-in-headers "$APP")"
   local PROXY_X_FORWARDED_FOR="$(fn-nginx-computed-x-forwarded-for-value "$APP")"
   local PROXY_X_FORWARDED_PORT="$(fn-nginx-computed-x-forwarded-port-value "$APP")"
@@ -324,6 +357,9 @@ fn-nginx-vhosts-render-template() {
     NGINX_ERROR_LOG_PATH="$NGINX_ERROR_LOG_PATH"
     NGINX_BIND_ADDRESS_IP4="$NGINX_BIND_ADDRESS_IP4"
     NGINX_BIND_ADDRESS_IP6="$NGINX_BIND_ADDRESS_IP6"
+    NGINX_DNS_RESOLVER="$NGINX_DNS_RESOLVER"
+    NGINX_DNS_RESOLVER_TIMEOUT="$NGINX_DNS_RESOLVER_TIMEOUT"
+    NGINX_DNS_ZONE="$NGINX_DNS_ZONE"
     HTTP2_DIRECTIVE_SUPPORTED="$HTTP2_DIRECTIVE_SUPPORTED"
     HTTP2_PUSH_SUPPORTED="$HTTP2_PUSH_SUPPORTED"
     GRPC_SUPPORTED="$GRPC_SUPPORTED"
@@ -334,6 +370,7 @@ fn-nginx-vhosts-render-template() {
     CLIENT_MAX_BODY_SIZE="$CLIENT_MAX_BODY_SIZE"
     KEEPALIVE_TIMEOUT="$KEEPALIVE_TIMEOUT"
     LINGERING_TIMEOUT="$LINGERING_TIMEOUT"
+    PROXY_HTTP_VERSION="$PROXY_HTTP_VERSION"
     PROXY_CONNECT_TIMEOUT="$PROXY_CONNECT_TIMEOUT"
     PROXY_READ_TIMEOUT="$PROXY_READ_TIMEOUT"
     PROXY_SEND_TIMEOUT="$PROXY_SEND_TIMEOUT"
@@ -348,27 +385,36 @@ fn-nginx-vhosts-render-template() {
     NGINX_PORT="$PROXY_PORT" NGINX_SSL_PORT="$PROXY_SSL_PORT"
     PROXY_PORT="$PROXY_PORT" PROXY_SSL_PORT="$PROXY_SSL_PORT"
     PROXY_PORT_MAP="$PROXY_PORT_MAP" PROXY_UPSTREAM_PORTS="$PROXY_UPSTREAM_PORTS"
+    PROXY_ROUTES="$PROXY_ROUTES" PROXY_ROUTE_LISTENERS="$PROXY_ROUTE_LISTENERS"
     PROXY_X_FORWARDED_FOR="$PROXY_X_FORWARDED_FOR"
     PROXY_X_FORWARDED_PORT="$PROXY_X_FORWARDED_PORT"
     PROXY_X_FORWARDED_PROTO="$PROXY_X_FORWARDED_PROTO"
     PROXY_X_FORWARDED_SSL="$PROXY_X_FORWARDED_SSL")
 
   if [[ "$IS_DEPLOYED_WITH_LISTENERS" == "true" ]]; then
-    local line PROC_TYPE LISTENERS UPP_PROC_TYPE
+    local line PROC_TYPE LISTENERS UPP_PROC_TYPE LISTENER_HOST
     while read -r line || [[ -n "$line" ]]; do
       PROC_TYPE=${line%%=*}
       LISTENERS="$(plugn trigger network-get-listeners "$APP" "$PROC_TYPE" | xargs)"
       UPP_PROC_TYPE="${PROC_TYPE^^}"
       UPP_PROC_TYPE="${UPP_PROC_TYPE//-/_}"
       SIGIL_PARAMS+=("DOKKU_APP_${UPP_PROC_TYPE}_LISTENERS=$LISTENERS")
+      LISTENER_HOST=""
+      if [[ -n "$NGINX_DNS_ZONE" ]]; then
+        LISTENER_HOST="${APP}.${PROC_TYPE}.${NGINX_DNS_ZONE}"
+      fi
+      SIGIL_PARAMS+=("DOKKU_APP_${UPP_PROC_TYPE}_LISTENER_HOST=$LISTENER_HOST")
     done < <(plugn trigger ps-current-scale "$APP")
   elif [[ "$PRE_VALIDATE" == "true" ]]; then
-    # During pre-validation no listeners exist yet; supply a placeholder so
-    # any upstream block in the template renders with a static server entry
-    # and nginx -t does not bail out on "host not found in upstream".
+    # During pre-validation no listeners exist yet; supply placeholders so
+    # both the legacy IP-based upstream block and the DNS-based resolver
+    # branch render syntactically valid nginx config that nginx -t can
+    # parse (no "host not found in upstream" and no empty set $var).
     SIGIL_PARAMS+=(DOKKU_APP_WEB_LISTENERS="127.0.0.1:5000")
+    SIGIL_PARAMS+=(DOKKU_APP_WEB_LISTENER_HOST="127.0.0.1")
   else
     SIGIL_PARAMS+=(DOKKU_APP_WEB_LISTENERS="")
+    SIGIL_PARAMS+=(DOKKU_APP_WEB_LISTENER_HOST="")
   fi
 
   sigil "${SIGIL_PARAMS[@]}" | cat -s >"$OUTPUT_PATH"
@@ -409,12 +455,6 @@ fn-nginx-vhosts-pre-validate-custom-template() {
 
   local TMP_RENDERED="$TMP_WORK_DIR/nginx.conf"
   local TMP_WRAPPER="$TMP_WORK_DIR/wrapper.conf"
-  local VALIDATE_TEMPLATE="$PLUGIN_AVAILABLE_PATH/nginx-vhosts/templates/validate.conf.sigil"
-  local CUSTOM_VALIDATE_TEMPLATE
-  CUSTOM_VALIDATE_TEMPLATE="$(plugn trigger nginx-app-template-source "$APP" "validate-config")"
-  if [[ -n "$CUSTOM_VALIDATE_TEMPLATE" ]]; then
-    VALIDATE_TEMPLATE="$CUSTOM_VALIDATE_TEMPLATE"
-  fi
 
   dokku_log_info1 "Pre-validating custom nginx.conf.sigil"
 
@@ -424,7 +464,7 @@ fn-nginx-vhosts-pre-validate-custom-template() {
     dokku_log_fail "Custom nginx.conf.sigil failed to render via sigil"
   fi
 
-  sigil -f "$VALIDATE_TEMPLATE" NGINX_CONF="$TMP_RENDERED" | cat -s >"$TMP_WRAPPER"
+  fn-nginx-vhosts-render-validate-wrapper "$APP" "$TMP_RENDERED" "$TMP_WRAPPER"
 
   if ! sudo "$NGINX_LOCATION" -t -c "$TMP_WRAPPER" 2>/dev/null; then
     dokku_log_warn "Failed to validate custom nginx.conf.sigil. Rendered output below..."
@@ -434,6 +474,20 @@ fn-nginx-vhosts-pre-validate-custom-template() {
   fi
 }
 
+fn-nginx-vhosts-install-config() {
+  declare desc="atomically replaces the nginx.conf for an app with a rendered config"
+  declare APP="$1" RENDERED_CONF="$2"
+  local STAGED_CONF
+
+  STAGED_CONF="$(mktemp "$DOKKU_ROOT/$APP/.nginx.conf.XXXXXX")"
+  if ! cat "$RENDERED_CONF" >"$STAGED_CONF"; then
+    rm -f "$STAGED_CONF"
+    return 1
+  fi
+  mv -f "$STAGED_CONF" "$DOKKU_ROOT/$APP/nginx.conf"
+  rm -f "$RENDERED_CONF"
+}
+
 nginx_build_config() {
   declare desc="build nginx config to proxy app containers using sigil"
   declare APP="$1" DOKKU_APP_LISTEN_PORT="$2" DOKKU_APP_LISTEN_IP="$3"
@@ -551,7 +605,7 @@ nginx_build_config() {
 
       dokku_log_info1 "Creating $SCHEME nginx.conf"
       mkdir -p "$DOKKU_ROOT/$APP/nginx.conf.d"
-      mv "$NGINX_CONF" "$DOKKU_ROOT/$APP/nginx.conf"
+      fn-nginx-vhosts-install-config "$APP" "$NGINX_CONF"
 
       if [[ "$IS_DEPLOYED_WITH_LISTENERS" == "true" ]]; then
         fn-nginx-vhosts-manage-hsts "$APP" "$SSL_INUSE"
diff --git a/plugins/nginx-vhosts/go.mod b/plugins/nginx-vhosts/go.mod
index b4d517346..5368510fb 100644
--- a/plugins/nginx-vhosts/go.mod
+++ b/plugins/nginx-vhosts/go.mod
@@ -1,36 +1,41 @@
 module github.com/dokku/dokku/plugins/nginx-vhosts
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
 	github.com/gliderlabs/sigil v0.12.1
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/dustin/go-jsonpointer v0.0.0-20160814072949-ba0abeacc3dc // indirect
 	github.com/dustin/gojson v0.0.0-20160307161227-2e71ec9dd5ad // indirect
 	github.com/fatih/color v1.19.0 // indirect
 	github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/joho/godotenv v1.5.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
+	github.com/kr/pretty v0.3.1 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/mgood/go-posix v0.0.0-20150821180505-948c005421f5 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/rogpeppe/go-internal v1.15.0 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 )
 
diff --git a/plugins/nginx-vhosts/go.sum b/plugins/nginx-vhosts/go.sum
index 1881a9dd5..64d3190f9 100644
--- a/plugins/nginx-vhosts/go.sum
+++ b/plugins/nginx-vhosts/go.sum
@@ -1,8 +1,9 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dustin/go-jsonpointer v0.0.0-20160814072949-ba0abeacc3dc h1:tP7tkU+vIsEOKiK+l/NSLN4uUtkyuxc6hgYpQeCWAeI=
 github.com/dustin/go-jsonpointer v0.0.0-20160814072949-ba0abeacc3dc/go.mod h1:ORH5Qp2bskd9NzSfKqAF7tKfONsEkCarTE5ESr/RVBw=
 github.com/dustin/gojson v0.0.0-20160307161227-2e71ec9dd5ad h1:Qk76DOWdOp+GlyDKBAG3Klr9cn7N+LcYc82AZ2S7+cA=
@@ -15,8 +16,9 @@ github.com/gliderlabs/sigil v0.12.1 h1:LaKToA28BSi3F9V79+4NsyupS4/iawyX0jNtbhsR5
 github.com/gliderlabs/sigil v0.12.1/go.mod h1:O6TGDuYPPHoiMad4W2FDsHgK39tNBYZRfhhUGOKgzRE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
@@ -27,52 +29,62 @@ github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
 github.com/mgood/go-posix v0.0.0-20150821180505-948c005421f5 h1:AutzcJSqc7ROMqcjPKmxwLl//YrzDPb4tLSBlH3Irdc=
 github.com/mgood/go-posix v0.0.0-20150821180505-948c005421f5/go.mod h1:irVTeKOI2GrudEK6/mqR4dDlGH91lCZIZM34YKSKH7M=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
 github.com/otiai10/mint v1.6.3/go.mod h1:MJm72SBthJjz8qhefc4z1PYEieWmy8Bku7CjcAqyUSM=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/rogpeppe/go-internal v1.15.0 h1:D0RCU5rMAp+SpgkiNdrjfJ+LX4J1M32V2NeCY7EJ6hc=
+github.com/rogpeppe/go-internal v1.15.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/plugins/nginx-vhosts/install b/plugins/nginx-vhosts/install
index 94bb56442..b18a3e128 100755
--- a/plugins/nginx-vhosts/install
+++ b/plugins/nginx-vhosts/install
@@ -37,12 +37,11 @@ trigger-nginx-vhosts-install() {
   fn-plugin-property-setup "nginx"
 
   NGINX_BIN="$(fn-nginx-vhosts-nginx-location)"
-  NGINX_ROOT="/etc/nginx"
+  NGINX_ROOT="$(fn-nginx-vhosts-nginx-conf-root)"
   NGINX_LOG_ROOT="/var/log/nginx"
   NGINX_INIT_NAME="nginx"
   NGINX_SUDOERS_FILE="/etc/sudoers.d/dokku-nginx"
   if fn-nginx-vhosts-uses-openresty; then
-    NGINX_ROOT="/usr/local/openresty/nginx/conf"
     NGINX_LOG_ROOT="/var/log/openresty"
     NGINX_INIT_NAME="openresty"
     NGINX_SUDOERS_FILE="/etc/sudoers.d/dokku-openresty"
diff --git a/plugins/nginx-vhosts/internal-functions b/plugins/nginx-vhosts/internal-functions
index 19186c4dd..63f63aa35 100755
--- a/plugins/nginx-vhosts/internal-functions
+++ b/plugins/nginx-vhosts/internal-functions
@@ -172,6 +172,69 @@ fn-nginx-global-disable-custom-config() {
   fn-get-property --app "$APP" --global "disable-custom-config"
 }
 
+fn-nginx-dns-resolver() {
+  declare desc="get the configured dns-resolver value"
+  declare APP="$1"
+
+  fn-get-property --app "$APP" "dns-resolver"
+}
+
+fn-nginx-computed-dns-resolver() {
+  declare desc="get the computed dns-resolver value"
+  declare APP="$1"
+
+  fn-get-property --app "$APP" --computed "dns-resolver"
+}
+
+fn-nginx-global-dns-resolver() {
+  declare desc="get the global dns-resolver value"
+  declare APP="$1"
+
+  fn-get-property --app "$APP" --global "dns-resolver"
+}
+
+fn-nginx-dns-resolver-timeout() {
+  declare desc="get the configured dns-resolver-timeout value"
+  declare APP="$1"
+
+  fn-get-property --app "$APP" "dns-resolver-timeout"
+}
+
+fn-nginx-computed-dns-resolver-timeout() {
+  declare desc="get the computed dns-resolver-timeout value"
+  declare APP="$1"
+
+  fn-get-property --app "$APP" --computed "dns-resolver-timeout"
+}
+
+fn-nginx-global-dns-resolver-timeout() {
+  declare desc="get the global dns-resolver-timeout value"
+  declare APP="$1"
+
+  fn-get-property --app "$APP" --global "dns-resolver-timeout"
+}
+
+fn-nginx-dns-zone() {
+  declare desc="get the configured dns-zone value"
+  declare APP="$1"
+
+  fn-get-property --app "$APP" "dns-zone"
+}
+
+fn-nginx-computed-dns-zone() {
+  declare desc="get the computed dns-zone value"
+  declare APP="$1"
+
+  fn-get-property --app "$APP" --computed "dns-zone"
+}
+
+fn-nginx-global-dns-zone() {
+  declare desc="get the global dns-zone value"
+  declare APP="$1"
+
+  fn-get-property --app "$APP" --global "dns-zone"
+}
+
 fn-nginx-error-log-path() {
   declare desc="get the configured error log path"
   declare APP="$1"
@@ -425,6 +488,27 @@ fn-nginx-global-proxy-busy-buffers-size() {
   fn-get-property --app "$APP" --global "proxy-busy-buffers-size"
 }
 
+fn-nginx-proxy-http-version() {
+  declare desc="get the configured proxy http version"
+  declare APP="$1"
+
+  fn-get-property --app "$APP" "proxy-http-version"
+}
+
+fn-nginx-computed-proxy-http-version() {
+  declare desc="get the computed proxy http version"
+  declare APP="$1"
+
+  fn-get-property --app "$APP" --computed "proxy-http-version"
+}
+
+fn-nginx-global-proxy-http-version() {
+  declare desc="get the global proxy http version"
+  declare APP="$1"
+
+  fn-get-property --app "$APP" --global "proxy-http-version"
+}
+
 fn-nginx-proxy-connect-timeout() {
   declare desc="get the configured proxy connect timeout"
   declare APP="$1"
@@ -686,6 +770,58 @@ fn-nginx-vhosts-uses-openresty() {
   return 1
 }
 
+fn-nginx-vhosts-nginx-conf-root() {
+  declare desc="returns the directory holding the main nginx config"
+  local NGINX_CONF_ROOT="/etc/nginx"
+
+  fn-nginx-vhosts-uses-openresty && NGINX_CONF_ROOT="/usr/local/openresty/nginx/conf"
+  echo "$NGINX_CONF_ROOT"
+}
+
+fn-nginx-vhosts-nginx-user() {
+  declare desc="returns the user declared by an nginx config, if any"
+  declare NGINX_CONF_PATH="$1"
+
+  if [[ ! -r "$NGINX_CONF_PATH" ]]; then
+    return 0
+  fi
+
+  awk '
+    { sub(/#.*/, "") }
+    $1 == "user" && NF >= 2 {
+      value = $2
+      sub(/;.*$/, "", value)
+      gsub(/"/, "", value)
+      if (value != "") {
+        print value
+        exit
+      }
+    }
+  ' "$NGINX_CONF_PATH"
+}
+
+fn-nginx-vhosts-validation-user() {
+  declare desc="returns the user to declare in the wrapper config used for nginx -t validation"
+  local NGINX_CONF_PATH NGINX_USER
+
+  NGINX_CONF_PATH="$(fn-nginx-vhosts-nginx-conf-root)/nginx.conf"
+  if [[ -r "$NGINX_CONF_PATH" ]]; then
+    NGINX_USER="$(fn-nginx-vhosts-nginx-user "$NGINX_CONF_PATH")"
+  else
+    NGINX_USER="www-data"
+  fi
+
+  if [[ ! "$NGINX_USER" =~ ^[a-zA-Z_][a-zA-Z0-9_.-]*$ ]]; then
+    return 0
+  fi
+
+  if ! id -u "$NGINX_USER" &>/dev/null; then
+    return 0
+  fi
+
+  echo "$NGINX_USER"
+}
+
 fn-nginx-vhosts-nginx-location() {
   declare desc="check that nginx is at the expected location and return it"
   local NGINX_LOCATION
@@ -839,19 +975,48 @@ nginx_vhosts_validate_single_func() {
   fi
 }
 
-nginx_vhosts_is_valid_nginx_config_func() {
-  declare desc="checks if an app has a valid nginx config"
-  declare APP="$1"
+fn-nginx-vhosts-backfill-validate-user() {
+  declare desc="adds a user directive to a rendered wrapper config that declares none"
+  declare OUTPUT_PATH="$1" NGINX_USER="$2"
+  local WRAPPER_CONTENTS
+
+  if [[ -z "$NGINX_USER" ]]; then
+    return 0
+  fi
+
+  if [[ -n "$(fn-nginx-vhosts-nginx-user "$OUTPUT_PATH")" ]]; then
+    return 0
+  fi
+
+  WRAPPER_CONTENTS="$(cat "$OUTPUT_PATH")"
+  printf 'user %s;\n%s\n' "$NGINX_USER" "$WRAPPER_CONTENTS" >"$OUTPUT_PATH"
+}
+
+fn-nginx-vhosts-render-validate-wrapper() {
+  declare desc="renders the wrapper config used to run nginx -t against an app nginx config"
+  declare APP="$1" NGINX_CONF="$2" OUTPUT_PATH="$3"
   local VALIDATE_TEMPLATE="$PLUGIN_AVAILABLE_PATH/nginx-vhosts/templates/validate.conf.sigil"
-  local TMP_OUTPUT=$(mktemp "/tmp/dokku-${DOKKU_PID}-${FUNCNAME[0]}.XXXXXX")
-  trap "rm -rf '$TMP_OUTPUT' >/dev/null" RETURN INT TERM EXIT
+  local CUSTOM_VALIDATE_TEMPLATE NGINX_USER
 
   CUSTOM_VALIDATE_TEMPLATE="$(plugn trigger nginx-app-template-source "$APP" "validate-config")"
   if [[ -n "$CUSTOM_VALIDATE_TEMPLATE" ]]; then
     VALIDATE_TEMPLATE="$CUSTOM_VALIDATE_TEMPLATE"
   fi
 
-  sigil -f "$VALIDATE_TEMPLATE" NGINX_CONF="$DOKKU_ROOT/$APP/nginx.conf" | cat -s >"$TMP_OUTPUT"
+  NGINX_USER="$(fn-nginx-vhosts-validation-user)"
+  sigil -f "$VALIDATE_TEMPLATE" NGINX_CONF="$NGINX_CONF" NGINX_USER="$NGINX_USER" | cat -s >"$OUTPUT_PATH"
+  fn-nginx-vhosts-backfill-validate-user "$OUTPUT_PATH" "$NGINX_USER"
+}
+
+nginx_vhosts_is_valid_nginx_config_func() {
+  declare desc="checks if an app has a valid nginx config"
+  declare APP="$1"
+  local NGINX_LOCATION
+  local TMP_OUTPUT=$(mktemp "/tmp/dokku-${DOKKU_PID}-${FUNCNAME[0]}.XXXXXX")
+  trap "rm -rf '$TMP_OUTPUT' >/dev/null" RETURN INT TERM EXIT
+
+  NGINX_LOCATION="$(fn-nginx-vhosts-nginx-location)"
+  fn-nginx-vhosts-render-validate-wrapper "$APP" "$DOKKU_ROOT/$APP/nginx.conf" "$TMP_OUTPUT"
   sudo "$NGINX_LOCATION" -t -c "$TMP_OUTPUT" 2>/dev/null
 }
 
diff --git a/plugins/nginx-vhosts/nginx_vhosts.go b/plugins/nginx-vhosts/nginx_vhosts.go
index 097314212..7a78c84f1 100644
--- a/plugins/nginx-vhosts/nginx_vhosts.go
+++ b/plugins/nginx-vhosts/nginx_vhosts.go
@@ -150,6 +150,57 @@ func AppDisableCustomConfig(appName string) string {
 	return common.PropertyGet("nginx", appName, "disable-custom-config")
 }
 
+func AppDnsResolver(appName string) string {
+	return common.PropertyGet("nginx", appName, "dns-resolver")
+}
+
+func ComputedDnsResolver(appName string) string {
+	appValue := AppDnsResolver(appName)
+	if appValue != "" {
+		return appValue
+	}
+
+	return GlobalDnsResolver()
+}
+
+func GlobalDnsResolver() string {
+	return common.PropertyGet("nginx", "--global", "dns-resolver")
+}
+
+func AppDnsResolverTimeout(appName string) string {
+	return common.PropertyGet("nginx", appName, "dns-resolver-timeout")
+}
+
+func ComputedDnsResolverTimeout(appName string) string {
+	appValue := AppDnsResolverTimeout(appName)
+	if appValue != "" {
+		return appValue
+	}
+
+	return GlobalDnsResolverTimeout()
+}
+
+func GlobalDnsResolverTimeout() string {
+	return common.PropertyGetDefault("nginx", "--global", "dns-resolver-timeout", "5s")
+}
+
+func AppDnsZone(appName string) string {
+	return common.PropertyGet("nginx", appName, "dns-zone")
+}
+
+func ComputedDnsZone(appName string) string {
+	appValue := AppDnsZone(appName)
+	if appValue != "" {
+		return appValue
+	}
+
+	return GlobalDnsZone()
+}
+
+func GlobalDnsZone() string {
+	return common.PropertyGetDefault("nginx", "--global", "dns-zone", "docker")
+}
+
 func ComputedDisableCustomConfig(appName string) string {
 	appValue := AppDisableCustomConfig(appName)
 	if appValue != "" {
@@ -436,6 +487,27 @@ func GlobalProxyBusyBuffersSize() string {
 	return common.PropertyGet("nginx", "--global", "proxy-busy-buffers-size")
 }
 
+func AppProxyHttpVersion(appName string) string {
+	return common.PropertyGet("nginx", appName, "proxy-http-version")
+}
+
+func ComputedProxyHttpVersion(appName string) string {
+	appValue := AppProxyHttpVersion(appName)
+	if appValue != "" {
+		return appValue
+	}
+
+	value := GlobalProxyHttpVersion()
+	if value == "" {
+		value = "1.1"
+	}
+	return value
+}
+
+func GlobalProxyHttpVersion() string {
+	return common.PropertyGet("nginx", "--global", "proxy-http-version")
+}
+
 func AppProxyConnectTimeout(appName string) string {
 	return common.PropertyGet("nginx", appName, "proxy-connect-timeout")
 }
diff --git a/plugins/nginx-vhosts/plugin.toml b/plugins/nginx-vhosts/plugin.toml
index 1987c1b76..01863cc1a 100644
--- a/plugins/nginx-vhosts/plugin.toml
+++ b/plugins/nginx-vhosts/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core nginx-vhosts plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/nginx-vhosts/report.go b/plugins/nginx-vhosts/report.go
index 7434118ff..327d819e8 100644
--- a/plugins/nginx-vhosts/report.go
+++ b/plugins/nginx-vhosts/report.go
@@ -29,6 +29,9 @@ func nginxReportProps() []nginxReportProp {
 		{"client-header-timeout", AppClientHeaderTimeout, ComputedClientHeaderTimeout, wrapGlobal(GlobalClientHeaderTimeout)},
 		{"client-max-body-size", AppClientMaxBodySize, ComputedClientMaxBodySize, wrapGlobal(GlobalClientMaxBodySize)},
 		{"disable-custom-config", AppDisableCustomConfig, ComputedDisableCustomConfig, wrapGlobal(GlobalDisableCustomConfig)},
+		{"dns-resolver", AppDnsResolver, ComputedDnsResolver, wrapGlobal(GlobalDnsResolver)},
+		{"dns-resolver-timeout", AppDnsResolverTimeout, ComputedDnsResolverTimeout, wrapGlobal(GlobalDnsResolverTimeout)},
+		{"dns-zone", AppDnsZone, ComputedDnsZone, wrapGlobal(GlobalDnsZone)},
 		{"error-log-path", AppErrorLogPath, ComputedErrorLogPath, wrapGlobal(GlobalErrorLogPath)},
 		{"hsts-include-subdomains", AppHSTSIncludeSubdomains, ComputedHSTSIncludeSubdomains, wrapGlobal(GlobalHSTSIncludeSubdomains)},
 		{"hsts-max-age", AppHSTSMaxAge, ComputedHSTSMaxAge, wrapGlobal(GlobalHSTSMaxAge)},
@@ -43,6 +46,7 @@ func nginxReportProps() []nginxReportProp {
 		{"proxy-buffers", AppProxyBuffers, ComputedProxyBuffers, wrapGlobal(GlobalProxyBuffers)},
 		{"proxy-busy-buffers-size", AppProxyBusyBuffersSize, ComputedProxyBusyBuffersSize, wrapGlobal(GlobalProxyBusyBuffersSize)},
 		{"proxy-connect-timeout", AppProxyConnectTimeout, ComputedProxyConnectTimeout, wrapGlobal(GlobalProxyConnectTimeout)},
+		{"proxy-http-version", AppProxyHttpVersion, ComputedProxyHttpVersion, wrapGlobal(GlobalProxyHttpVersion)},
 		{"proxy-keepalive", AppProxyKeepalive, ComputedProxyKeepalive, wrapGlobal(GlobalProxyKeepalive)},
 		{"proxy-read-timeout", AppProxyReadTimeout, ComputedProxyReadTimeout, wrapGlobal(GlobalProxyReadTimeout)},
 		{"proxy-send-timeout", AppProxySendTimeout, ComputedProxySendTimeout, wrapGlobal(GlobalProxySendTimeout)},
diff --git a/plugins/nginx-vhosts/src/nginx-property/nginx-property.go b/plugins/nginx-vhosts/src/nginx-property/nginx-property.go
index 84d041a36..167185ec5 100644
--- a/plugins/nginx-vhosts/src/nginx-property/nginx-property.go
+++ b/plugins/nginx-vhosts/src/nginx-property/nginx-property.go
@@ -51,6 +51,12 @@ func appValue(appName string, property string) string {
 		value = nginx_vhosts.AppClientHeaderTimeout(appName)
 	case "disable-custom-config":
 		value = nginx_vhosts.AppDisableCustomConfig(appName)
+	case "dns-resolver":
+		value = nginx_vhosts.AppDnsResolver(appName)
+	case "dns-resolver-timeout":
+		value = nginx_vhosts.AppDnsResolverTimeout(appName)
+	case "dns-zone":
+		value = nginx_vhosts.AppDnsZone(appName)
 	case "error-log-path":
 		value = nginx_vhosts.AppErrorLogPath(appName)
 	case "hsts-include-subdomains":
@@ -77,6 +83,8 @@ func appValue(appName string, property string) string {
 		value = nginx_vhosts.AppProxyBuffers(appName)
 	case "proxy-busy-buffers-size":
 		value = nginx_vhosts.AppProxyBusyBuffersSize(appName)
+	case "proxy-http-version":
+		value = nginx_vhosts.AppProxyHttpVersion(appName)
 	case "proxy-connect-timeout":
 		value = nginx_vhosts.AppProxyConnectTimeout(appName)
 	case "proxy-read-timeout":
@@ -121,6 +129,12 @@ func computedValue(appName string, property string) string {
 		value = nginx_vhosts.ComputedClientMaxBodySize(appName)
 	case "disable-custom-config":
 		value = nginx_vhosts.ComputedDisableCustomConfig(appName)
+	case "dns-resolver":
+		value = nginx_vhosts.ComputedDnsResolver(appName)
+	case "dns-resolver-timeout":
+		value = nginx_vhosts.ComputedDnsResolverTimeout(appName)
+	case "dns-zone":
+		value = nginx_vhosts.ComputedDnsZone(appName)
 	case "error-log-path":
 		value = nginx_vhosts.ComputedErrorLogPath(appName)
 	case "hsts-include-subdomains":
@@ -147,6 +161,8 @@ func computedValue(appName string, property string) string {
 		value = nginx_vhosts.ComputedProxyBuffers(appName)
 	case "proxy-busy-buffers-size":
 		value = nginx_vhosts.ComputedProxyBusyBuffersSize(appName)
+	case "proxy-http-version":
+		value = nginx_vhosts.ComputedProxyHttpVersion(appName)
 	case "proxy-connect-timeout":
 		value = nginx_vhosts.ComputedProxyConnectTimeout(appName)
 	case "proxy-read-timeout":
@@ -191,6 +207,12 @@ func globalValue(appName string, property string) string {
 		value = nginx_vhosts.GlobalClientMaxBodySize()
 	case "disable-custom-config":
 		value = nginx_vhosts.GlobalDisableCustomConfig()
+	case "dns-resolver":
+		value = nginx_vhosts.GlobalDnsResolver()
+	case "dns-resolver-timeout":
+		value = nginx_vhosts.GlobalDnsResolverTimeout()
+	case "dns-zone":
+		value = nginx_vhosts.GlobalDnsZone()
 	case "error-log-path":
 		value = nginx_vhosts.GlobalErrorLogPath()
 	case "hsts-include-subdomains":
@@ -217,6 +239,8 @@ func globalValue(appName string, property string) string {
 		value = nginx_vhosts.GlobalProxyBuffers()
 	case "proxy-busy-buffers-size":
 		value = nginx_vhosts.GlobalProxyBusyBuffersSize()
+	case "proxy-http-version":
+		value = nginx_vhosts.GlobalProxyHttpVersion()
 	case "proxy-connect-timeout":
 		value = nginx_vhosts.GlobalProxyConnectTimeout()
 	case "proxy-read-timeout":
diff --git a/plugins/nginx-vhosts/subcommands/set b/plugins/nginx-vhosts/subcommands/set
index e3118c4c7..4685bc030 100755
--- a/plugins/nginx-vhosts/subcommands/set
+++ b/plugins/nginx-vhosts/subcommands/set
@@ -9,22 +9,21 @@ cmd-nginx-set() {
   declare cmd="nginx:set"
   [[ "$1" == "$cmd" ]] && shift 1
   declare APP="$1" KEY="$2" VALUE="$3"
-  local VALID_KEYS=("access-log-format" "access-log-path" "bind-address-ipv4" "bind-address-ipv6" "client-body-timeout" "client-header-timeout" "client-max-body-size" "disable-custom-config" "error-log-path" "hsts" "hsts-include-subdomains" "hsts-preload" "hsts-max-age" "keepalive-timeout" "lingering-timeout" "nginx-conf-sigil-path" "nginx-service-command" "proxy-buffer-size" "proxy-buffering" "proxy-buffers" "proxy-busy-buffers-size" "proxy-connect-timeout" "proxy-read-timeout" "proxy-send-timeout" "proxy-keepalive" "send-timeout" "underscore-in-headers" "x-forwarded-for-value" "x-forwarded-port-value" "x-forwarded-proto-value" "x-forwarded-ssl")
-  local GLOBAL_KEYS=("access-log-format" "access-log-path" "bind-address-ipv4" "bind-address-ipv6" "client-body-timeout" "client-header-timeout" "client-max-body-size" "disable-custom-config" "error-log-path" "hsts-include-subdomains" "hsts-max-age" "hsts-preload" "hsts" "keepalive-timeout" "lingering-timeout" "nginx-conf-sigil-path" "nginx-service-command" "proxy-buffer-size" "proxy-buffering" "proxy-buffers" "proxy-busy-buffers-size" "proxy-connect-timeout" "proxy-read-timeout" "proxy-send-timeout" "proxy-keepalive" "send-timeout" "underscore-in-headers" "x-forwarded-for-value" "x-forwarded-port-value" "x-forwarded-proto-value" "x-forwarded-ssl")
+  local VALID_KEYS=("access-log-format" "access-log-path" "bind-address-ipv4" "bind-address-ipv6" "client-body-timeout" "client-header-timeout" "client-max-body-size" "disable-custom-config" "dns-resolver" "dns-resolver-timeout" "dns-zone" "error-log-path" "hsts" "hsts-include-subdomains" "hsts-preload" "hsts-max-age" "keepalive-timeout" "lingering-timeout" "nginx-conf-sigil-path" "nginx-service-command" "proxy-buffer-size" "proxy-buffering" "proxy-buffers" "proxy-busy-buffers-size" "proxy-http-version" "proxy-connect-timeout" "proxy-read-timeout" "proxy-send-timeout" "proxy-keepalive" "send-timeout" "underscore-in-headers" "x-forwarded-for-value" "x-forwarded-port-value" "x-forwarded-proto-value" "x-forwarded-ssl")
+  local GLOBAL_KEYS=("access-log-format" "access-log-path" "bind-address-ipv4" "bind-address-ipv6" "client-body-timeout" "client-header-timeout" "client-max-body-size" "disable-custom-config" "dns-resolver" "dns-resolver-timeout" "dns-zone" "error-log-path" "hsts-include-subdomains" "hsts-max-age" "hsts-preload" "hsts" "keepalive-timeout" "lingering-timeout" "nginx-conf-sigil-path" "nginx-service-command" "proxy-buffer-size" "proxy-buffering" "proxy-buffers" "proxy-busy-buffers-size" "proxy-http-version" "proxy-connect-timeout" "proxy-read-timeout" "proxy-send-timeout" "proxy-keepalive" "send-timeout" "underscore-in-headers" "x-forwarded-for-value" "x-forwarded-port-value" "x-forwarded-proto-value" "x-forwarded-ssl")
 
   [[ -z "$KEY" ]] && dokku_log_fail "No key specified"
 
   if ! fn-in-array "$KEY" "${VALID_KEYS[@]}"; then
-    dokku_log_fail "Invalid key specified, valid keys include: access-log-format, access-log-path, bind-address-ipv4, bind-address-ipv6, client-body-timeout, client-header-timeout, client-max-body-size, disable-custom-config, error-log-path, hsts, hsts-include-subdomains, hsts-preload, hsts-max-age, keepalive-timeout, lingering-timeout, nginx-conf-sigil-path, nginx-service-command, proxy-buffer-size, proxy-buffering, proxy-buffers, proxy-busy-buffers-size, proxy-connect-timeout, proxy-read-timeout, proxy-send-timeout, proxy-keepalive, send-timeout, underscore-in-headers, x-forwarded-for-value, x-forwarded-port-value, x-forwarded-proto-value, x-forwarded-ssl"
+    dokku_log_fail "Invalid key specified, valid keys include: access-log-format, access-log-path, bind-address-ipv4, bind-address-ipv6, client-body-timeout, client-header-timeout, client-max-body-size, disable-custom-config, dns-resolver, dns-resolver-timeout, dns-zone, error-log-path, hsts, hsts-include-subdomains, hsts-preload, hsts-max-age, keepalive-timeout, lingering-timeout, nginx-conf-sigil-path, nginx-service-command, proxy-buffer-size, proxy-buffering, proxy-buffers, proxy-busy-buffers-size, proxy-http-version, proxy-connect-timeout, proxy-read-timeout, proxy-send-timeout, proxy-keepalive, send-timeout, underscore-in-headers, x-forwarded-for-value, x-forwarded-port-value, x-forwarded-proto-value, x-forwarded-ssl"
   fi
 
-  if ! fn-in-array "$KEY" "${GLOBAL_KEYS[@]}"; then
-    if [[ "$APP" == "--global" ]]; then
-      dokku_log_fail "The key '$KEY' cannot be set globally"
-    fi
-    verify_app_name "$APP"
+  if ! fn-in-array "$KEY" "${GLOBAL_KEYS[@]}" && [[ "$APP" == "--global" ]]; then
+    dokku_log_fail "The key '$KEY' cannot be set globally"
   fi
 
+  [[ "$APP" == "--global" ]] || verify_app_name "$APP"
+
   if [[ "$KEY" == "proxy-keepalive" ]] && [[ -n "$VALUE" ]]; then
     if ! is_number "$VALUE"; then
       dokku_log_fail "Invalid value for proxy-keepalive: must be an integer"
diff --git a/plugins/nginx-vhosts/template_test.go b/plugins/nginx-vhosts/template_test.go
index 5e7817357..7d9927743 100644
--- a/plugins/nginx-vhosts/template_test.go
+++ b/plugins/nginx-vhosts/template_test.go
@@ -22,43 +22,50 @@ func templatePath(t *testing.T) string {
 
 func defaultVars() map[string]interface{} {
 	return map[string]interface{}{
-		"APP":                          "app",
-		"DOKKU_ROOT":                   "/home/dokku",
-		"DOKKU_LIB_ROOT":               "/var/lib/dokku",
-		"NOSSL_SERVER_NAME":            "app.example.com",
-		"SSL_SERVER_NAME":              "",
-		"SSL_INUSE":                    "",
-		"APP_SSL_PATH":                 "/home/dokku/app/tls",
-		"DOKKU_APP_WEB_LISTENERS":      "127.0.0.1:5000",
-		"PROXY_PORT_MAP":               "http:80:5000",
-		"PROXY_UPSTREAM_PORTS":         "5000",
-		"PROXY_PORT":                   "80",
-		"PROXY_SSL_PORT":               "443",
-		"PROXY_KEEPALIVE":              "",
-		"NGINX_BIND_ADDRESS_IP4":       "",
-		"NGINX_BIND_ADDRESS_IP6":       "::",
-		"NGINX_ACCESS_LOG_PATH":        "/var/log/nginx/app-access.log",
-		"NGINX_ACCESS_LOG_FORMAT":      "",
-		"NGINX_ERROR_LOG_PATH":         "/var/log/nginx/app-error.log",
-		"NGINX_UNDERSCORE_IN_HEADERS":  "off",
-		"CLIENT_BODY_TIMEOUT":          "60s",
-		"CLIENT_HEADER_TIMEOUT":        "60s",
-		"CLIENT_MAX_BODY_SIZE":         "1m",
-		"KEEPALIVE_TIMEOUT":            "75s",
-		"LINGERING_TIMEOUT":            "5s",
-		"SEND_TIMEOUT":                 "60s",
-		"PROXY_CONNECT_TIMEOUT":        "60s",
-		"PROXY_READ_TIMEOUT":           "60s",
-		"PROXY_SEND_TIMEOUT":           "60s",
-		"PROXY_BUFFER_SIZE":            "4k",
-		"PROXY_BUFFERING":              "on",
-		"PROXY_BUFFERS":                "8 4k",
-		"PROXY_BUSY_BUFFERS_SIZE":      "8k",
-		"PROXY_X_FORWARDED_FOR":        "$remote_addr",
-		"PROXY_X_FORWARDED_PORT":       "$server_port",
-		"PROXY_X_FORWARDED_PROTO":      "$scheme",
-		"PROXY_X_FORWARDED_SSL":        "",
-		"HTTP2_DIRECTIVE_SUPPORTED":    "true",
+		"APP":                         "app",
+		"DOKKU_ROOT":                  "/home/dokku",
+		"DOKKU_LIB_ROOT":              "/var/lib/dokku",
+		"NOSSL_SERVER_NAME":           "app.example.com",
+		"SSL_SERVER_NAME":             "",
+		"SSL_INUSE":                   "",
+		"APP_SSL_PATH":                "/home/dokku/app/tls",
+		"DOKKU_APP_WEB_LISTENERS":     "127.0.0.1:5000",
+		"DOKKU_APP_WEB_LISTENER_HOST": "app.web.docker",
+		"PROXY_PORT_MAP":              "http:80:5000",
+		"PROXY_UPSTREAM_PORTS":        "5000",
+		"PROXY_PORT":                  "80",
+		"PROXY_SSL_PORT":              "443",
+		"PROXY_KEEPALIVE":             "",
+		"NGINX_BIND_ADDRESS_IP4":      "",
+		"NGINX_BIND_ADDRESS_IP6":      "::",
+		"NGINX_DNS_RESOLVER":          "",
+		"NGINX_DNS_RESOLVER_TIMEOUT":  "5s",
+		"NGINX_DNS_ZONE":              "docker",
+		"NGINX_ACCESS_LOG_PATH":       "/var/log/nginx/app-access.log",
+		"NGINX_ACCESS_LOG_FORMAT":     "",
+		"NGINX_ERROR_LOG_PATH":        "/var/log/nginx/app-error.log",
+		"NGINX_UNDERSCORE_IN_HEADERS": "off",
+		"CLIENT_BODY_TIMEOUT":         "60s",
+		"CLIENT_HEADER_TIMEOUT":       "60s",
+		"CLIENT_MAX_BODY_SIZE":        "1m",
+		"KEEPALIVE_TIMEOUT":           "75s",
+		"LINGERING_TIMEOUT":           "5s",
+		"SEND_TIMEOUT":                "60s",
+		"PROXY_HTTP_VERSION":          "1.1",
+		"PROXY_CONNECT_TIMEOUT":       "60s",
+		"PROXY_READ_TIMEOUT":          "60s",
+		"PROXY_SEND_TIMEOUT":          "60s",
+		"PROXY_BUFFER_SIZE":           "4k",
+		"PROXY_BUFFERING":             "on",
+		"PROXY_BUFFERS":               "8 4k",
+		"PROXY_BUSY_BUFFERS_SIZE":     "8k",
+		"PROXY_X_FORWARDED_FOR":       "$remote_addr",
+		"PROXY_X_FORWARDED_PORT":      "$server_port",
+		"PROXY_X_FORWARDED_PROTO":     "$scheme",
+		"PROXY_X_FORWARDED_SSL":       "",
+		"HTTP2_DIRECTIVE_SUPPORTED":   "true",
+		"PROXY_ROUTES":                "",
+		"PROXY_ROUTE_LISTENERS":       "",
 	}
 }
 
@@ -93,6 +100,9 @@ func TestTemplate_HTTPOnlyBasicProxy(t *testing.T) {
 	out := renderTemplate(t, defaultVars())
 	mustContain(t, out, "listen      [::]:80;")
 	mustContain(t, out, "proxy_pass  http://app-5000;")
+	mustContain(t, out, "upstream app-5000 {")
+	mustNotContain(t, out, "resolver ")
+	mustNotContain(t, out, "$dokku_upstream")
 	mustContain(t, out, "error_page 500 501 502 503")
 	mustContain(t, out, "server_name app.example.com;")
 	mustNotContain(t, out, "ssl_certificate")
@@ -100,6 +110,27 @@ func TestTemplate_HTTPOnlyBasicProxy(t *testing.T) {
 	mustNotContain(t, out, "http2_push_preload")
 }
 
+func TestTemplate_ResolverTimeoutOverride(t *testing.T) {
+	v := defaultVars()
+	v["NGINX_DNS_RESOLVER"] = "127.0.0.1:1053"
+	v["NGINX_DNS_RESOLVER_TIMEOUT"] = "2s"
+	out := renderTemplate(t, v)
+	mustContain(t, out, "resolver_timeout 2s;")
+	mustNotContain(t, out, "resolver_timeout 5s;")
+}
+
+func TestTemplate_HTTPOnlyBasicProxyWithResolver(t *testing.T) {
+	v := defaultVars()
+	v["NGINX_DNS_RESOLVER"] = "127.0.0.1:1053"
+	out := renderTemplate(t, v)
+	mustContain(t, out, "listen      [::]:80;")
+	mustContain(t, out, "resolver 127.0.0.1:1053 valid=10s ipv6=off;")
+	mustContain(t, out, "resolver_timeout 5s;")
+	mustContain(t, out, `set $dokku_upstream "app.web.docker:5000";`)
+	mustContain(t, out, "proxy_pass http://$dokku_upstream;")
+	mustNotContain(t, out, "upstream app-5000 {")
+}
+
 func TestTemplate_HTTPSEmitsPushPreloadWhenSupported(t *testing.T) {
 	v := defaultVars()
 	v["PROXY_PORT_MAP"] = "https:443:5000"
@@ -167,6 +198,7 @@ func TestTemplate_NoWebListenersReturns502(t *testing.T) {
 	v["DOKKU_APP_WEB_LISTENERS"] = ""
 	out := renderTemplate(t, v)
 	mustContain(t, out, "return 502;")
+	mustNotContain(t, out, "proxy_pass http://$dokku_upstream;")
 	mustNotContain(t, out, "proxy_pass  http://app-5000;")
 }
 
@@ -180,6 +212,17 @@ func TestTemplate_GRPCNoSSL(t *testing.T) {
 	mustNotContain(t, out, "ssl_certificate")
 }
 
+func TestTemplate_GRPCNoSSLWithResolver(t *testing.T) {
+	v := defaultVars()
+	v["NGINX_DNS_RESOLVER"] = "127.0.0.1:1053"
+	v["PROXY_PORT_MAP"] = "grpc:50051:50051"
+	v["PROXY_UPSTREAM_PORTS"] = "50051"
+	out := renderTemplate(t, v)
+	mustContain(t, out, "resolver 127.0.0.1:1053 valid=10s ipv6=off;")
+	mustContain(t, out, `set $dokku_upstream "app.web.docker:50051";`)
+	mustContain(t, out, "grpc_pass grpc://$dokku_upstream;")
+}
+
 func TestTemplate_GRPCS(t *testing.T) {
 	v := defaultVars()
 	v["PROXY_PORT_MAP"] = "grpcs:443:50051"
@@ -227,6 +270,18 @@ func TestTemplate_UpstreamBlock(t *testing.T) {
 	mustContain(t, out, "server 10.0.0.2:5001;")
 }
 
+func TestTemplate_UpstreamBlockOmittedInResolverMode(t *testing.T) {
+	v := defaultVars()
+	v["NGINX_DNS_RESOLVER"] = "127.0.0.1:1053"
+	v["PROXY_PORT_MAP"] = "http:80:5000 http:8080:5001"
+	v["PROXY_UPSTREAM_PORTS"] = "5000 5001"
+	v["DOKKU_APP_WEB_LISTENERS"] = "10.0.0.1:5000 10.0.0.2:5000"
+	out := renderTemplate(t, v)
+	mustNotContain(t, out, "upstream app-5000 {")
+	mustNotContain(t, out, "upstream app-5001 {")
+	mustNotContain(t, out, "server 10.0.0.1:5000;")
+}
+
 func TestTemplate_UpstreamWithKeepalive(t *testing.T) {
 	v := defaultVars()
 	v["PROXY_KEEPALIVE"] = "16"
@@ -264,10 +319,66 @@ func TestTemplate_XForwardedSSL(t *testing.T) {
 	mustNotContain(t, out2, "X-Forwarded-Ssl")
 }
 
+func TestTemplate_RouteLocationAndUpstream(t *testing.T) {
+	v := defaultVars()
+	v["PROXY_ROUTES"] = "api|5001|/api/v0|0"
+	v["PROXY_ROUTE_LISTENERS"] = "api|5001|10.0.0.3:5001,10.0.0.4:5001"
+	out := renderTemplate(t, v)
+	mustContain(t, out, "location /api/v0 {")
+	mustContain(t, out, "proxy_pass http://app-api-5001;")
+	mustNotContain(t, out, "proxy_pass http://app-api-5001/;")
+	mustContain(t, out, "upstream app-api-5001 {")
+	mustContain(t, out, "server 10.0.0.3:5001;")
+	mustContain(t, out, "server 10.0.0.4:5001;")
+}
+
+func TestTemplate_RouteUpstreamRenderedInResolverMode(t *testing.T) {
+	v := defaultVars()
+	v["NGINX_DNS_RESOLVER"] = "127.0.0.1:1053"
+	v["PROXY_ROUTES"] = "api|5001|/api/v0|0"
+	v["PROXY_ROUTE_LISTENERS"] = "api|5001|10.0.0.3:5001"
+	out := renderTemplate(t, v)
+	mustContain(t, out, "proxy_pass http://$dokku_upstream;")
+	mustContain(t, out, "proxy_pass http://app-api-5001;")
+	mustContain(t, out, "upstream app-api-5001 {")
+	mustNotContain(t, out, "upstream app-5000 {")
+}
+
+func TestTemplate_RouteStripPrefix(t *testing.T) {
+	v := defaultVars()
+	v["PROXY_ROUTES"] = "api|5001|/api/v0|1"
+	v["PROXY_ROUTE_LISTENERS"] = "api|5001|10.0.0.3:5001"
+	out := renderTemplate(t, v)
+	mustContain(t, out, "proxy_pass http://app-api-5001/;")
+}
+
+func TestTemplate_RouteOmittedOnRedirect(t *testing.T) {
+	v := defaultVars()
+	v["PROXY_PORT_MAP"] = "http:80:5000 https:443:5000"
+	v["SSL_INUSE"] = "true"
+	v["SSL_SERVER_NAME"] = "app.example.com"
+	v["PROXY_ROUTES"] = "api|5001|/api/v0|0"
+	v["PROXY_ROUTE_LISTENERS"] = "api|5001|10.0.0.3:5001"
+	out := renderTemplate(t, v)
+
+	port80, port443, ok := strings.Cut(out, "listen      [::]:443")
+	if !ok {
+		t.Fatalf("expected an https server block in output:\n%s", out)
+	}
+	mustNotContain(t, port80, "location /api/v0")
+	mustContain(t, port443, "location /api/v0 {")
+}
+
+func TestTemplate_NoRoutesRendersNoRouteBlocks(t *testing.T) {
+	out := renderTemplate(t, defaultVars())
+	mustNotContain(t, out, "upstream app-api-")
+	mustNotContain(t, out, "location /api/v0")
+}
+
 func TestTemplate_NginxConfDIncludeAlways(t *testing.T) {
 	cases := []struct {
-		name    string
-		mutate  func(map[string]interface{})
+		name   string
+		mutate func(map[string]interface{})
 	}{
 		{"http", func(v map[string]interface{}) {}},
 		{"http_redirect", func(v map[string]interface{}) {
diff --git a/plugins/nginx-vhosts/templates/nginx.conf.sigil b/plugins/nginx-vhosts/templates/nginx.conf.sigil
index 9687e6a56..ad0bb149c 100644
--- a/plugins/nginx-vhosts/templates/nginx.conf.sigil
+++ b/plugins/nginx-vhosts/templates/nginx.conf.sigil
@@ -46,6 +46,34 @@ server {
     return 301 https://$host:{{ $.PROXY_SSL_PORT }}$request_uri;
   }
 {{ else }}
+{{ range $route := $.PROXY_ROUTES | split " " }}
+{{ if $route }}
+{{ $r := $route | split "|" }}
+{{ $route_proc := index $r 0 }}
+{{ $route_port := index $r 1 }}
+{{ $route_path := index $r 2 }}
+{{ $route_strip := index $r 3 }}
+  location {{ $route_path }} {
+    proxy_pass http://{{ $.APP }}-{{ $route_proc }}-{{ $route_port }}{{ if eq $route_strip "1" }}/{{ end }};
+    proxy_http_version 1.1;
+    proxy_connect_timeout {{ $.PROXY_CONNECT_TIMEOUT }};
+    proxy_read_timeout {{ $.PROXY_READ_TIMEOUT }};
+    proxy_send_timeout {{ $.PROXY_SEND_TIMEOUT }};
+    proxy_buffer_size {{ $.PROXY_BUFFER_SIZE }};
+    proxy_buffering {{ $.PROXY_BUFFERING }};
+    proxy_buffers {{ $.PROXY_BUFFERS }};
+    proxy_busy_buffers_size {{ $.PROXY_BUSY_BUFFERS_SIZE }};
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $http_connection;
+    proxy_set_header Host $http_host;
+    proxy_set_header X-Forwarded-For {{ $.PROXY_X_FORWARDED_FOR }};
+    proxy_set_header X-Forwarded-Port {{ $.PROXY_X_FORWARDED_PORT }};
+    proxy_set_header X-Forwarded-Proto {{ $.PROXY_X_FORWARDED_PROTO }};
+    proxy_set_header X-Request-Start $msec;
+    {{ if $.PROXY_X_FORWARDED_SSL }}proxy_set_header X-Forwarded-Ssl {{ $.PROXY_X_FORWARDED_SSL }};{{ end }}
+  }
+{{ end }}
+{{ end }}
   location    / {
 {{ if $.DOKKU_APP_WEB_LISTENERS }}
 
@@ -56,9 +84,16 @@ server {
     gzip_vary on;
     gzip_comp_level  6;
 
+{{ if $.NGINX_DNS_RESOLVER }}
+    resolver {{ $.NGINX_DNS_RESOLVER }} valid=10s ipv6=off;
+    resolver_timeout {{ $.NGINX_DNS_RESOLVER_TIMEOUT }};
+    set $dokku_upstream "{{ $.DOKKU_APP_WEB_LISTENER_HOST }}:{{ $upstream_port }}";
+    proxy_pass http://$dokku_upstream;
+{{ else }}
     proxy_pass  http://{{ $.APP }}-{{ $upstream_port }};
+{{ end }}
     {{ if and $is_ssl (eq $.HTTP2_PUSH_SUPPORTED "true") }}http2_push_preload on; {{ end }}
-    proxy_http_version 1.1;
+    proxy_http_version {{ $.PROXY_HTTP_VERSION }};
     proxy_connect_timeout {{ $.PROXY_CONNECT_TIMEOUT }};
     proxy_read_timeout {{ $.PROXY_READ_TIMEOUT }};
     proxy_send_timeout {{ $.PROXY_SEND_TIMEOUT }};
@@ -138,7 +173,14 @@ server {
   {{ end }}
 
   location    / {
+{{ if $.NGINX_DNS_RESOLVER }}
+    resolver {{ $.NGINX_DNS_RESOLVER }} valid=10s ipv6=off;
+    resolver_timeout {{ $.NGINX_DNS_RESOLVER_TIMEOUT }};
+    set $dokku_upstream "{{ $.DOKKU_APP_WEB_LISTENER_HOST }}:{{ $upstream_port }}";
+    grpc_pass grpc://$dokku_upstream;
+{{ else }}
     grpc_pass  grpc://{{ $.APP }}-{{ $upstream_port }};
+{{ end }}
   }
 
   client_max_body_size {{ $.CLIENT_MAX_BODY_SIZE }};
@@ -148,6 +190,7 @@ server {
 {{ end }}
 {{ end }}
 
+{{ if not $.NGINX_DNS_RESOLVER }}
 {{ if $.DOKKU_APP_WEB_LISTENERS }}
 {{ range $upstream_port := $.PROXY_UPSTREAM_PORTS | split " " }}
 upstream {{ $.APP }}-{{ $upstream_port }} {
@@ -157,4 +200,20 @@ upstream {{ $.APP }}-{{ $upstream_port }} {
 {{ $listener_ip := index $listener_list 0 }}
   server {{ $listener_ip }}:{{ $upstream_port }};{{ end }}
 }
-{{ end }}{{ end }}
+{{ end }}{{ end }}{{ end }}
+
+{{ range $entry := $.PROXY_ROUTE_LISTENERS | split " " }}
+{{ if $entry }}
+{{ $e := $entry | split "|" }}
+{{ $route_proc := index $e 0 }}
+{{ $route_port := index $e 1 }}
+{{ $route_csv := index $e 2 }}
+upstream {{ $.APP }}-{{ $route_proc }}-{{ $route_port }} {
+{{ if $.PROXY_KEEPALIVE }}  keepalive {{ $.PROXY_KEEPALIVE }};{{ end }}
+{{ range $listener := $route_csv | split "," }}
+{{ $listener_list := $listener | split ":" }}
+{{ $listener_ip := index $listener_list 0 }}
+  server {{ $listener_ip }}:{{ $route_port }};{{ end }}
+}
+{{ end }}
+{{ end }}
diff --git a/plugins/nginx-vhosts/templates/validate.conf.sigil b/plugins/nginx-vhosts/templates/validate.conf.sigil
index cb6a556c5..719b1a3da 100644
--- a/plugins/nginx-vhosts/templates/validate.conf.sigil
+++ b/plugins/nginx-vhosts/templates/validate.conf.sigil
@@ -1,3 +1,4 @@
+{{ if $.NGINX_USER }}user {{ $.NGINX_USER }};{{ end }}
 events { worker_connections 768; }
 http {
   access_log off;
diff --git a/plugins/nginx-vhosts/validate_template_test.go b/plugins/nginx-vhosts/validate_template_test.go
new file mode 100644
index 000000000..438064fbd
--- /dev/null
+++ b/plugins/nginx-vhosts/validate_template_test.go
@@ -0,0 +1,57 @@
+package nginxvhosts
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+
+	"github.com/gliderlabs/sigil"
+	_ "github.com/gliderlabs/sigil/builtin"
+)
+
+func validateTemplatePath(t *testing.T) string {
+	t.Helper()
+	_, file, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("runtime.Caller failed")
+	}
+	return filepath.Join(filepath.Dir(file), "templates", "validate.conf.sigil")
+}
+
+func renderValidateTemplate(t *testing.T, nginxUser string) string {
+	t.Helper()
+	data, err := os.ReadFile(validateTemplatePath(t))
+	if err != nil {
+		t.Fatalf("read template: %v", err)
+	}
+
+	vars := map[string]interface{}{
+		"NGINX_CONF": "/home/dokku/app/nginx.conf",
+		"NGINX_USER": nginxUser,
+	}
+	buf, err := sigil.Execute(data, vars, "validate.conf.sigil")
+	if err != nil {
+		t.Fatalf("sigil.Execute: %v", err)
+	}
+	return buf.String()
+}
+
+func TestValidateTemplate_DeclaresNginxUser(t *testing.T) {
+	out := renderValidateTemplate(t, "www-data")
+	mustContain(t, out, "user www-data;")
+	mustContain(t, out, "include /home/dokku/app/nginx.conf;")
+
+	userIndex := strings.Index(out, "user www-data;")
+	eventsIndex := strings.Index(out, "events {")
+	if userIndex > eventsIndex {
+		t.Errorf("expected the user directive before the events block\n--- output ---\n%s", out)
+	}
+}
+
+func TestValidateTemplate_OmitsEmptyNginxUser(t *testing.T) {
+	out := renderValidateTemplate(t, "")
+	mustNotContain(t, out, "user ")
+	mustContain(t, out, "include /home/dokku/app/nginx.conf;")
+}
diff --git a/plugins/openresty-vhosts/Dockerfile b/plugins/openresty-vhosts/Dockerfile
index 024c51a25..69941e22c 100644
--- a/plugins/openresty-vhosts/Dockerfile
+++ b/plugins/openresty-vhosts/Dockerfile
@@ -1 +1 @@
-FROM dokku/openresty-docker-proxy:0.12.1
+FROM dokku/openresty-docker-proxy:0.13.1
diff --git a/plugins/openresty-vhosts/Makefile b/plugins/openresty-vhosts/Makefile
index b300b082d..aec3151a8 100644
--- a/plugins/openresty-vhosts/Makefile
+++ b/plugins/openresty-vhosts/Makefile
@@ -1,4 +1,3 @@
-GOARCH ?= amd64
 TRIGGERS = triggers/report
 BUILD = report-subcommand triggers
 PLUGIN_NAME = openresty-vhosts
diff --git a/plugins/openresty-vhosts/core-post-deploy b/plugins/openresty-vhosts/core-post-deploy
index b33a6dffa..69c6766a8 100755
--- a/plugins/openresty-vhosts/core-post-deploy
+++ b/plugins/openresty-vhosts/core-post-deploy
@@ -4,25 +4,34 @@ source "$PLUGIN_AVAILABLE_PATH/openresty-vhosts/internal-functions"
 set -eo pipefail
 [[ $DOKKU_TRACE ]] && set -x
 
+fn-openresty-vhosts-promote-includes-dir() {
+  declare desc="moves the process-specific includes dir into place or removes the stored one"
+  declare APP="$1" INCLUDES_NAME="$2"
+  local includes_dir="${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/$INCLUDES_NAME"
+
+  if [[ -d "$includes_dir.$DOKKU_PID" ]]; then
+    rm -rf "$includes_dir"
+    mv "$includes_dir.$DOKKU_PID" "$includes_dir"
+  elif [[ -f "$includes_dir.$DOKKU_PID.missing" ]]; then
+    rm -f "$includes_dir.$DOKKU_PID.missing"
+    rm -rf "$includes_dir"
+  fi
+}
+
 trigger-openresty-vhosts-core-post-deploy() {
   declare desc="openresty-vhosts core-post-deploy plugin trigger"
   declare trigger="core-post-deploy"
   declare APP="$1"
   local tls_internal
 
+  fn-openresty-vhosts-promote-includes-dir "$APP" "openresty-http-includes"
+  fn-openresty-vhosts-promote-includes-dir "$APP" "openresty-location-includes"
+
   if [[ "$(plugn trigger proxy-type "$APP")" != "openresty" ]]; then
     return
   fi
 
   dokku_log_info1 "Routing app via openresty"
-  if [[ -f "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-http-includes.$DOKKU_PID.missing" ]]; then
-    rm -f "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-http-includes.$DOKKU_PID.missing"
-    rm -f "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-http-includes"
-  fi
-  if [[ -f "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-location-includes.$DOKKU_PID.missing" ]]; then
-    rm -f "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-location-includes.$DOKKU_PID.missing"
-    rm -f "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-location-includes"
-  fi
 }
 
 trigger-openresty-vhosts-core-post-deploy "$@"
diff --git a/plugins/openresty-vhosts/core-post-extract b/plugins/openresty-vhosts/core-post-extract
index 6e5b40c97..062e1957e 100755
--- a/plugins/openresty-vhosts/core-post-extract
+++ b/plugins/openresty-vhosts/core-post-extract
@@ -45,18 +45,15 @@ fn-openresty-vhosts-copy-from-image() {
   local CONF_PATH="openresty/http-includes"
   local LOCATION_CONF_PATH="openresty/http-location-includes"
 
-  mkdir -p "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP"
-  find "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/" -maxdepth 1 -name 'openresty-http-includes.*' -type d -exec rm -r {} +
   copy_dir_from_image "$IMAGE_NAME" "$CONF_PATH" "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-http-includes.$DOKKU_PID" 2>/dev/null || true
   fn-openresty-vhosts-sanitize-extracted-includes "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-http-includes.$DOKKU_PID"
-  if [[ ! -f "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-http-includes.$DOKKU_PID" ]]; then
+  if [[ ! -d "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-http-includes.$DOKKU_PID" ]]; then
     touch "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-http-includes.$DOKKU_PID.missing"
   fi
 
-  find "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/" -maxdepth 1 -name 'openresty-location-includes.*' -type d -exec rm -r {} +
   copy_dir_from_image "$IMAGE_NAME" "$LOCATION_CONF_PATH" "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-location-includes.$DOKKU_PID" 2>/dev/null || true
   fn-openresty-vhosts-sanitize-extracted-includes "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-location-includes.$DOKKU_PID"
-  if [[ ! -f "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-location-includes.$DOKKU_PID" ]]; then
+  if [[ ! -d "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-location-includes.$DOKKU_PID" ]]; then
     touch "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-location-includes.$DOKKU_PID.missing"
   fi
 }
@@ -66,25 +63,21 @@ fn-openresty-vhosts-copy-from-directory() {
   local CONF_PATH="openresty/http-includes"
   local LOCATION_CONF_PATH="openresty/http-location-includes"
 
+  pushd "$SOURCECODE_WORK_DIR" >/dev/null
   if [[ -d "$CONF_PATH" ]]; then
-    pushd "$SOURCECODE_WORK_DIR" >/dev/null
-    find "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/" -maxdepth 1 -name 'openresty-http-includes.*' -type d -exec rm -r {} +
     mkdir -p "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-http-includes.$DOKKU_PID/"
     fn-openresty-vhosts-copy-includes-from-source "$CONF_PATH" "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-http-includes.$DOKKU_PID"
-    popd &>/dev/null || pushd "/tmp" >/dev/null
   else
     touch "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-http-includes.$DOKKU_PID.missing"
   fi
 
   if [[ -d "$LOCATION_CONF_PATH" ]]; then
-    pushd "$SOURCECODE_WORK_DIR" >/dev/null
-    find "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/" -maxdepth 1 -name 'openresty-location-includes.*' -type d -exec rm -r {} +
     mkdir -p "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-location-includes.$DOKKU_PID/"
     fn-openresty-vhosts-copy-includes-from-source "$LOCATION_CONF_PATH" "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-location-includes.$DOKKU_PID"
-    popd &>/dev/null || pushd "/tmp" >/dev/null
   else
     touch "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-location-includes.$DOKKU_PID.missing"
   fi
+  popd &>/dev/null || pushd "/tmp" >/dev/null
 }
 
 trigger-openresty-vhosts-core-post-extract() {
@@ -94,6 +87,7 @@ trigger-openresty-vhosts-core-post-extract() {
   local app_source_image
 
   mkdir -p "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP"
+  find "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/" -maxdepth 1 \( -name 'openresty-http-includes.*' -o -name 'openresty-location-includes.*' \) -exec rm -rf {} +
 
   app_source_image="$(plugn trigger git-get-property "$APP" "source-image")"
   if [[ -n "$app_source_image" ]]; then
diff --git a/plugins/openresty-vhosts/docker-args-process-deploy b/plugins/openresty-vhosts/docker-args-process-deploy
index 3488f4c52..efd9fd57a 100755
--- a/plugins/openresty-vhosts/docker-args-process-deploy
+++ b/plugins/openresty-vhosts/docker-args-process-deploy
@@ -12,11 +12,26 @@ trigger-openresty-vhosts-docker-args-process-deploy() {
   local include_dir output value DATA
   local STDIN=$(cat)
 
-  if [[ "$PROC_TYPE" != "web" ]]; then
+  if [[ "$(plugn trigger proxy-type "$APP")" != "openresty" ]] && [[ "$(plugn trigger proxy-type "$APP")" != "nginx" ]]; then
     return
   fi
 
-  if [[ "$(plugn trigger proxy-type "$APP")" != "openresty" ]] && [[ "$(plugn trigger proxy-type "$APP")" != "nginx" ]]; then
+  if [[ "$PROC_TYPE" != "web" ]]; then
+    # Non-web processes are only labeled when at least one path-based route
+    # targets the process. Otherwise openresty should ignore the container.
+    local route_proc
+    local has_route=false
+    while IFS='|' read -r route_proc _ _ _; do
+      if [[ "$route_proc" == "$PROC_TYPE" ]]; then
+        has_route=true
+        break
+      fi
+    done < <(plugn trigger proxy-routes-list "$APP")
+    if [[ "$has_route" != "true" ]]; then
+      echo -n "$STDIN"
+      return
+    fi
+    fn-openresty-route-labels "$APP" "$PROC_TYPE" "$STDIN"
     return
   fi
 
@@ -206,6 +221,8 @@ trigger-openresty-vhosts-docker-args-process-deploy() {
   value="$(fn-openresty-computed-x-forwarded-ssl "$APP")"
   [[ -n "$value" ]] && output="$output '--label=openresty.x-forwarded-ssl=$value'"
 
+  output="$output$(fn-openresty-healthcheck-labels "$APP")"
+
   local proxy_labels_file_path=$(fn-proxy-get-labels-file-path "openresty" "$APP")
   if [[ -f "$proxy_labels_file_path" ]]; then
     while read -r line; do
@@ -217,4 +234,55 @@ trigger-openresty-vhosts-docker-args-process-deploy() {
   echo -n "$STDIN $output"
 }
 
+fn-openresty-healthcheck-labels() {
+  declare desc="outputs openresty upstream healthcheck and failover labels derived from the app's web readiness healthcheck"
+  declare APP="$1"
+  local healthcheck hc_path hc_port hc_scheme hc_timeout hc_interval hc_attempts hc_host name value
+
+  healthcheck="$(fn-proxy-get-readiness-healthcheck "$APP")"
+  if [[ -z "$healthcheck" ]]; then
+    return
+  fi
+
+  hc_path="$(echo "$healthcheck" | jq -r ".path // empty")"
+  hc_port="$(echo "$healthcheck" | jq -r ".port // empty")"
+  hc_scheme="$(echo "$healthcheck" | jq -r ".scheme // empty")"
+  hc_timeout="$(echo "$healthcheck" | jq -r ".timeout // 5")"
+  hc_interval="$(echo "$healthcheck" | jq -r ".wait // 5")"
+  hc_attempts="$(echo "$healthcheck" | jq -r ".attempts // 3")"
+
+  if ! fn-proxy-healthcheck-path-is-valid "$hc_path"; then
+    dokku_log_fail "Invalid app.json healthcheck path for openresty: path must start with a / and must not contain whitespace, control characters, quotes, or backslashes"
+  fi
+
+  if ! fn-proxy-healthcheck-scheme-is-valid "$hc_scheme"; then
+    dokku_log_fail "Invalid app.json healthcheck scheme for openresty: scheme must be one of http or https"
+  fi
+
+  hc_host="$(fn-proxy-get-healthcheck-host "$APP" "$healthcheck")"
+
+  echo -n " '--label=openresty.upstream-max-fails=1'"
+  echo -n " '--label=openresty.upstream-fail-timeout=${hc_interval}s'"
+  echo -n " '--label=openresty.proxy-next-upstream-timeout=5s'"
+  echo -n " '--label=openresty.healthcheck-path=$hc_path'"
+  [[ -n "$hc_port" ]] && echo -n " '--label=openresty.healthcheck-port=$hc_port'"
+  [[ -n "$hc_scheme" ]] && echo -n " '--label=openresty.healthcheck-scheme=${hc_scheme,,}'"
+  echo -n " '--label=openresty.healthcheck-timeout=$hc_timeout'"
+  echo -n " '--label=openresty.healthcheck-interval=$hc_interval'"
+  echo -n " '--label=openresty.healthcheck-fall=$hc_attempts'"
+  if [[ -n "$hc_host" ]] && fn-proxy-healthcheck-header-is-valid "Host" "$hc_host"; then
+    echo -n " '--label=openresty.healthcheck-host=$hc_host'"
+  fi
+
+  while IFS=$'\t' read -r name value; do
+    [[ -z "$name" ]] && continue
+    if ! fn-proxy-healthcheck-header-is-valid "$name" "$value"; then
+      dokku_log_warn "Skipping invalid app.json healthcheck header for openresty: $name"
+      continue
+    fi
+
+    echo -n " '--label=openresty.healthcheck-header.$name=$value'"
+  done < <(fn-proxy-get-healthcheck-headers "$healthcheck")
+}
+
 trigger-openresty-vhosts-docker-args-process-deploy "$@"
diff --git a/plugins/openresty-vhosts/go.mod b/plugins/openresty-vhosts/go.mod
index f1da90bcd..09268a707 100644
--- a/plugins/openresty-vhosts/go.mod
+++ b/plugins/openresty-vhosts/go.mod
@@ -1,29 +1,29 @@
 module github.com/dokku/dokku/plugins/openresty-vhosts
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/openresty-vhosts/go.sum b/plugins/openresty-vhosts/go.sum
index 14bf42b1c..9ada61068 100644
--- a/plugins/openresty-vhosts/go.sum
+++ b/plugins/openresty-vhosts/go.sum
@@ -1,25 +1,24 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -28,28 +27,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/openresty-vhosts/internal-functions b/plugins/openresty-vhosts/internal-functions
index cfd1490be..d555dacb9 100755
--- a/plugins/openresty-vhosts/internal-functions
+++ b/plugins/openresty-vhosts/internal-functions
@@ -11,6 +11,35 @@ fn-get-pagesize() {
   "$PLUGIN_CORE_AVAILABLE_PATH/nginx-vhosts/pagesize"
 }
 
+fn-openresty-route-labels() {
+  declare desc="emits per-route openresty labels for a non-web container"
+  declare APP="$1" PROC_TYPE="$2" STDIN="$3"
+  local output route_proc route_port route_path route_strip route_index=0
+
+  output=""
+  while IFS='|' read -r route_proc route_port route_path route_strip; do
+    [[ -z "$route_proc" ]] && continue
+    [[ "$route_proc" != "$PROC_TYPE" ]] && continue
+
+    output="$output --label 'openresty.route.${route_index}.path-prefix=${route_path}'"
+    output="$output --label 'openresty.route.${route_index}.port=${route_port}'"
+    if [[ "$route_strip" == "1" ]]; then
+      output="$output --label 'openresty.route.${route_index}.strip-prefix=true'"
+    fi
+    route_index=$((route_index + 1))
+  done < <(plugn trigger proxy-routes-list "$APP")
+
+  local proxy_labels_file_path=$(fn-proxy-get-labels-file-path "openresty" "$APP")
+  if [[ -f "$proxy_labels_file_path" ]]; then
+    while read -r line; do
+      [[ -z "$line" ]] && continue
+      output="$output --label '$line'"
+    done <"$proxy_labels_file_path"
+  fi
+
+  echo -n "$STDIN $output"
+}
+
 fn-openresty-access-log-format() {
   declare desc="get the raw per-app access log format"
   declare APP="$1"
@@ -221,7 +250,7 @@ fn-openresty-get-http-includes-dir() {
   declare desc="get any include dir if available"
   declare APP="$1"
 
-  if [[ -d "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-http-includes.$DOKKU_PID.missing" ]]; then
+  if [[ -f "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-http-includes.$DOKKU_PID.missing" ]]; then
     return
   fi
 
@@ -236,7 +265,7 @@ fn-openresty-get-location-includes-dir() {
   declare desc="get any include dir if available"
   declare APP="$1"
 
-  if [[ -d "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-location-includes.$DOKKU_PID.missing" ]]; then
+  if [[ -f "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-location-includes.$DOKKU_PID.missing" ]]; then
     return
   fi
 
diff --git a/plugins/openresty-vhosts/plugin.toml b/plugins/openresty-vhosts/plugin.toml
index e867fb1c6..64d7597e6 100644
--- a/plugins/openresty-vhosts/plugin.toml
+++ b/plugins/openresty-vhosts/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core openresty-vhosts plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/openresty-vhosts/subcommands/set b/plugins/openresty-vhosts/subcommands/set
index 8fc21a322..1a9142f4e 100755
--- a/plugins/openresty-vhosts/subcommands/set
+++ b/plugins/openresty-vhosts/subcommands/set
@@ -19,17 +19,16 @@ cmd-openresty-set() {
     dokku_log_fail "Invalid key specified, valid keys include: access-log-format, access-log-path, allowed-letsencrypt-domains-func-base64, bind-address-ipv4, bind-address-ipv6, client-body-timeout, client-header-timeout, client-max-body-size, error-log-path, hsts, hsts-include-subdomains, hsts-preload, hsts-max-age, image, keepalive-timeout, log-level, letsencrypt-email, letsencrypt-server, lingering-timeout, proxy-connect-timeout, proxy-connect-timeout, proxy-read-timeout, proxy-send-timeout, send-timeout, underscore-in-headers, x-forwarded-for-value, x-forwarded-port-value, x-forwarded-proto-value, x-forwarded-ssl"
   fi
 
-  if ! fn-in-array "$KEY" "${GLOBAL_KEYS[@]}"; then
-    if [[ "$APP" == "--global" ]]; then
-      dokku_log_fail "The key '$KEY' cannot be set globally"
-    fi
-    verify_app_name "$APP"
+  if ! fn-in-array "$KEY" "${GLOBAL_KEYS[@]}" && [[ "$APP" == "--global" ]]; then
+    dokku_log_fail "The key '$KEY' cannot be set globally"
   fi
 
   if fn-in-array "$KEY" "${GLOBAL_ONLY_KEYS[@]}" && [[ "$APP" != "--global" ]]; then
     dokku_log_fail "The key '$KEY' can only be set globally"
   fi
 
+  [[ "$APP" == "--global" ]] || verify_app_name "$APP"
+
   if [[ -n "$VALUE" ]]; then
     dokku_log_info2_quiet "Setting ${KEY} to ${VALUE}"
     fn-plugin-property-write "openresty" "$APP" "$KEY" "$VALUE"
diff --git a/plugins/plugin/Makefile b/plugins/plugin/Makefile
index d3455e6be..35dcf9889 100644
--- a/plugins/plugin/Makefile
+++ b/plugins/plugin/Makefile
@@ -1,4 +1,3 @@
-GOARCH ?= amd64
 BUILD = plugin-list
 PLUGIN_NAME = plugin
 
diff --git a/plugins/plugin/functions b/plugins/plugin/functions
index fc5290c80..252e89ea5 100755
--- a/plugins/plugin/functions
+++ b/plugins/plugin/functions
@@ -18,6 +18,9 @@ enable_plugin() {
   local PLUGIN="$1"
   [[ -e $PLUGIN_ENABLED_PATH/$PLUGIN ]] && dokku_log_fail "Plugin already enabled"
   [[ ! -e $PLUGIN_AVAILABLE_PATH/$PLUGIN ]] && dokku_log_fail "Plugin does not exist"
+  if [[ -e $PLUGIN_CORE_AVAILABLE_PATH/$PLUGIN ]] && [[ ! -e $PLUGIN_CORE_ENABLED_PATH/$PLUGIN ]]; then
+    PLUGIN_PATH="$PLUGIN_CORE_PATH" plugn enable "$PLUGIN"
+  fi
   plugn enable "$PLUGIN"
   dokku_log_info1_quiet "Plugin $PLUGIN enabled"
 }
diff --git a/plugins/plugin/go.mod b/plugins/plugin/go.mod
index b28ba4cb5..04ad03d8b 100644
--- a/plugins/plugin/go.mod
+++ b/plugins/plugin/go.mod
@@ -1,29 +1,29 @@
 module github.com/dokku/dokku/plugins/plugin
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
-	github.com/spf13/pflag v1.0.10
-	golang.org/x/sync v0.22.0
+	github.com/spf13/pflag v1.1.0
+	golang.org/x/sync v0.25.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/plugin/go.sum b/plugins/plugin/go.sum
index 14bf42b1c..9ada61068 100644
--- a/plugins/plugin/go.sum
+++ b/plugins/plugin/go.sum
@@ -1,25 +1,24 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -28,28 +27,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/plugin/plugin.toml b/plugins/plugin/plugin.toml
index d3701521a..23b714256 100644
--- a/plugins/plugin/plugin.toml
+++ b/plugins/plugin/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core plugin plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/plugin/subcommands/trigger b/plugins/plugin/subcommands/trigger
index 81065f147..4d9ac5989 100755
--- a/plugins/plugin/subcommands/trigger
+++ b/plugins/plugin/subcommands/trigger
@@ -1,13 +1,22 @@
 #!/usr/bin/env bash
 set -eo pipefail
 [[ $DOKKU_TRACE ]] && set -x
+source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 
 cmd-plugin-trigger() {
   declare desc="trigger an arbitrary plugin hook"
   declare cmd="plugin:trigger"
   [[ "$1" == "$cmd" ]] && shift 1
 
-  sudo -u dokku -E -H plugn trigger "$@"
+  local sudo_args=(-u dokku)
+  local preserve_env_flag
+  preserve_env_flag="$(fn-sudo-preserve-env-flag)"
+  if [[ -n "$preserve_env_flag" ]]; then
+    sudo_args+=("$preserve_env_flag")
+  fi
+  sudo_args+=(-H)
+
+  sudo "${sudo_args[@]}" plugn trigger "$@"
 }
 
 cmd-plugin-trigger "$@"
diff --git a/plugins/ports/functions.go b/plugins/ports/functions.go
index afeaf7120..3462ec2e0 100644
--- a/plugins/ports/functions.go
+++ b/plugins/ports/functions.go
@@ -15,10 +15,18 @@ import (
 
 // addPortMaps adds port mappings to an app
 func addPortMaps(appName string, portMaps []PortMap) error {
+	return common.PropertyLock("ports", appName, func(p *common.LockedProperties) error {
+		return addPortMapsWithLock(p, appName, portMaps)
+	})
+}
+
+// addPortMapsWithLock adds port mappings to an app. The caller must hold the
+// app's ports property lock.
+func addPortMapsWithLock(p *common.LockedProperties, appName string, portMaps []PortMap) error {
 	allPortMaps := getPortMaps(appName)
 	allPortMaps = append(allPortMaps, portMaps...)
 
-	return setPortMaps(appName, allPortMaps)
+	return writePortMaps(p, allPortMaps)
 }
 
 // clearPorts clears all port mappings for an app
@@ -365,6 +373,14 @@ func parsePortMapString(stringPortMap string) ([]PortMap, error) {
 
 // removePortMaps removes specific port mappings from an app
 func removePortMaps(appName string, portMaps []PortMap) error {
+	return common.PropertyLock("ports", appName, func(p *common.LockedProperties) error {
+		return removePortMapsWithLock(p, appName, portMaps)
+	})
+}
+
+// removePortMapsWithLock removes specific port mappings from an app. The caller
+// must hold the app's ports property lock.
+func removePortMapsWithLock(p *common.LockedProperties, appName string, portMaps []PortMap) error {
 	toRemove := map[string]bool{}
 	toRemoveByPort := map[int]bool{}
 
@@ -390,10 +406,10 @@ func removePortMaps(appName string, portMaps []PortMap) error {
 	}
 
 	if len(toSet) == 0 {
-		return common.PropertyDelete("ports", appName, "map")
+		return p.Delete("map")
 	}
 
-	return setPortMaps(appName, toSet)
+	return writePortMaps(p, toSet)
 }
 
 // reusesSchemeHostPort returns true if the port maps reuse the same scheme:host-port
@@ -413,6 +429,14 @@ func reusesSchemeHostPort(portMaps []PortMap) error {
 
 // setPortMaps sets the port maps for an app
 func setPortMaps(appName string, portMaps []PortMap) error {
+	return common.PropertyLock("ports", appName, func(p *common.LockedProperties) error {
+		return writePortMaps(p, portMaps)
+	})
+}
+
+// writePortMaps writes the port maps for an app. The caller must hold the
+// app's ports property lock.
+func writePortMaps(p *common.LockedProperties, portMaps []PortMap) error {
 	if err := reusesSchemeHostPort(portMaps); err != nil {
 		return fmt.Errorf("Error validating port mappings: %s", err)
 	}
@@ -427,7 +451,7 @@ func setPortMaps(appName string, portMaps []PortMap) error {
 	}
 
 	sort.Strings(value)
-	return common.PropertyListWrite("ports", appName, "map", value)
+	return p.ListWrite("map", value)
 }
 
 // setProxyPort sets the proxy port for an app
diff --git a/plugins/ports/go.mod b/plugins/ports/go.mod
index 39ee7252e..c75a08f76 100644
--- a/plugins/ports/go.mod
+++ b/plugins/ports/go.mod
@@ -1,29 +1,29 @@
 module github.com/dokku/dokku/plugins/ports
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
 	github.com/ryanuber/columnize v2.1.2+incompatible
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/ports/go.sum b/plugins/ports/go.sum
index 14bf42b1c..9ada61068 100644
--- a/plugins/ports/go.sum
+++ b/plugins/ports/go.sum
@@ -1,25 +1,24 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -28,28 +27,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/ports/plugin.toml b/plugins/ports/plugin.toml
index 56da28484..e8bbf8e87 100644
--- a/plugins/ports/plugin.toml
+++ b/plugins/ports/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core ports plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/ports/proxy.go b/plugins/ports/proxy.go
index c8855b6e4..8daf37c43 100644
--- a/plugins/ports/proxy.go
+++ b/plugins/ports/proxy.go
@@ -4,7 +4,6 @@ import (
 	"fmt"
 )
 
-
 // PortMap is a struct that contains a scheme:host-port:container-port mapping
 type PortMap struct {
 	// ContainerPort is the port on the container
diff --git a/plugins/ports/triggers.go b/plugins/ports/triggers.go
index 9596ae174..9a9b2a60a 100644
--- a/plugins/ports/triggers.go
+++ b/plugins/ports/triggers.go
@@ -160,11 +160,21 @@ func TriggerPostCertsRemove(appName string) error {
 		return err
 	}
 
-	return removePortMaps(appName, filterAppPortMaps(appName, "https", 443))
+	return common.PropertyLock("ports", appName, func(p *common.LockedProperties) error {
+		return removePortMapsWithLock(p, appName, filterAppPortMaps(appName, "https", 443))
+	})
 }
 
 // TriggerPostCertsUpdate sets port properties after SSL cert is added
 func TriggerPostCertsUpdate(appName string) error {
+	return common.PropertyLock("ports", appName, func(p *common.LockedProperties) error {
+		return postCertsUpdateWithLock(p, appName)
+	})
+}
+
+// postCertsUpdateWithLock adds https:443 port maps mirroring the app's http:80
+// port maps. The caller must hold the app's ports property lock.
+func postCertsUpdateWithLock(p *common.LockedProperties, appName string) error {
 	port := common.PropertyGet("proxy", appName, "proxy-port")
 	sslPort := common.PropertyGet("proxy", appName, "proxy-ssl-port")
 	portMaps := getPortMaps(appName)
@@ -201,7 +211,7 @@ func TriggerPostCertsUpdate(appName string) error {
 			})
 		}
 
-		if err := addPortMaps(appName, toAdd); err != nil {
+		if err := addPortMapsWithLock(p, appName, toAdd); err != nil {
 			return err
 		}
 	}
diff --git a/plugins/proxy/Makefile b/plugins/proxy/Makefile
index 3ddf822fb..2e640eb78 100644
--- a/plugins/proxy/Makefile
+++ b/plugins/proxy/Makefile
@@ -1,5 +1,5 @@
-SUBCOMMANDS = subcommands/build-config subcommands/clear-config subcommands/disable subcommands/enable subcommands/ports subcommands/ports-add subcommands/ports-clear subcommands/ports-remove subcommands/ports-set subcommands/report subcommands/set
-TRIGGERS = triggers/install triggers/proxy-is-enabled triggers/proxy-type triggers/post-app-clone-setup triggers/post-app-rename-setup triggers/post-delete triggers/report
+SUBCOMMANDS = subcommands/build-config subcommands/clear-config subcommands/disable subcommands/enable subcommands/ports subcommands/ports-add subcommands/ports-clear subcommands/ports-remove subcommands/ports-set subcommands/report subcommands/route:clear subcommands/route:remove subcommands/route:report subcommands/route:set subcommands/set
+TRIGGERS = triggers/install triggers/proxy-is-enabled triggers/proxy-routes-list triggers/proxy-type triggers/post-app-clone-setup triggers/post-app-rename-setup triggers/post-delete triggers/report
 BUILD = commands subcommands triggers
 PLUGIN_NAME = proxy
 
diff --git a/plugins/proxy/command-functions b/plugins/proxy/command-functions
index 6343b3bf8..b46f9a409 100755
--- a/plugins/proxy/command-functions
+++ b/plugins/proxy/command-functions
@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
+source "$PLUGIN_CORE_AVAILABLE_PATH/common/property-functions"
 source "$PLUGIN_AVAILABLE_PATH/proxy/functions"
 set -eo pipefail
 [[ $DOKKU_TRACE ]] && set -x
@@ -32,12 +33,7 @@ cmd-proxy-labels-add() {
   [[ -z "$PASSED_LABEL_VALUE" ]] && dokku_log_fail "Please specify a value for the container label"
   verify_app_name "$APP"
 
-  local proxy_labels_file_path="$(fn-proxy-get-labels-file-path "$PROXY" "$APP")"
-  touch "$proxy_labels_file_path"
-  cmd-proxy-labels-remove "$PROXY" "$APP" "$PASSED_LABEL_NAME" >/dev/null
-  echo "${PASSED_LABEL_NAME}=${PASSED_LABEL_VALUE}" >>"$proxy_labels_file_path"
-  local all_proxy_labels="$(<"$proxy_labels_file_path")"
-  echo -e "${all_proxy_labels}" | sed '/^$/d' | sort -u >"$proxy_labels_file_path"
+  fn-plugin-property-lock "$PROXY" "$APP" fn-proxy-labels-add "$PROXY" "$APP" "$PASSED_LABEL_NAME" "$PASSED_LABEL_VALUE"
 }
 
 cmd-proxy-labels-remove() {
@@ -55,8 +51,5 @@ cmd-proxy-labels-remove() {
     return
   fi
 
-  local all_proxy_labels="$(<"$proxy_labels_file_path")"
-  local escaped_label_name="$(fn-proxy-escape-extended-sed "$PASSED_LABEL_NAME")"
-  local all_proxy_labels="$(echo -e "${all_proxy_labels}" | sed -E "s/^${escaped_label_name}=.*\$//")"
-  echo -e "${all_proxy_labels}" | sed '/^$/d' | sort -u >"$proxy_labels_file_path"
+  fn-plugin-property-lock "$PROXY" "$APP" fn-proxy-labels-remove "$PROXY" "$APP" "$PASSED_LABEL_NAME"
 }
diff --git a/plugins/proxy/functions b/plugins/proxy/functions
index f73692b1d..b235a0d2a 100755
--- a/plugins/proxy/functions
+++ b/plugins/proxy/functions
@@ -17,6 +17,71 @@ fn-proxy-get-labels-file-path() {
   echo "$PROXY_FILE"
 }
 
+fn-proxy-get-readiness-healthcheck() {
+  declare desc="outputs the first web readiness healthcheck with a path from the app's app.json as json"
+  declare APP="$1"
+  local app_json
+
+  app_json="$(plugn trigger app-json-get-content "$APP" 2>/dev/null || echo "{}")"
+  echo "$app_json" | jq -c '.healthchecks.web // [] | map(select(.type == "readiness" and .path != null and .path != "")) | .[0] // empty'
+}
+
+fn-proxy-healthcheck-path-is-valid() {
+  declare desc="checks that an app.json healthcheck path is absolute and free of whitespace, control, quote, and backslash characters"
+  declare HC_PATH="$1"
+
+  [[ "$HC_PATH" == /* ]] || return 1
+  [[ "$HC_PATH" =~ [[:space:][:cntrl:]\"\'\\] ]] && return 1
+  return 0
+}
+
+fn-proxy-healthcheck-header-is-valid() {
+  declare desc="checks that an app.json healthcheck header name is a token and its value is free of control, quote, and backslash characters"
+  declare NAME="$1" VALUE="$2"
+
+  [[ "$NAME" =~ ^[A-Za-z0-9!#$%\&*+.^_\`\|~-]+$ ]] || return 1
+  [[ "$VALUE" =~ [[:cntrl:]\"\'\\] ]] && return 1
+  return 0
+}
+
+fn-proxy-get-healthcheck-host() {
+  declare desc="outputs the host header for a healthcheck, preferring an app.json Host header over the first app domain"
+  declare APP="$1" HEALTHCHECK="$2"
+  local domain hc_host
+  local -a domains
+
+  hc_host="$(echo "$HEALTHCHECK" | jq -r '.httpHeaders // [] | map(select((.name | ascii_downcase) == "host")) | .[0].value // empty')"
+  if [[ -n "$hc_host" ]]; then
+    echo "$hc_host"
+    return
+  fi
+
+  read -r -d '' -a domains <<<"$(plugn trigger domains-list "$APP")" || true
+  for domain in "${domains[@]}"; do
+    if [[ "$domain" == "localhost" ]] || [[ "$domain" == '*' ]]; then
+      continue
+    fi
+
+    echo "$domain"
+    return
+  done
+}
+
+fn-proxy-get-healthcheck-headers() {
+  declare desc="outputs the tab-separated name and value of each non-Host app.json healthcheck header"
+  declare HEALTHCHECK="$1"
+
+  echo "$HEALTHCHECK" | jq -r '.httpHeaders // [] | map(select((.name | ascii_downcase) != "host")) | .[] | [.name, .value] | @tsv'
+}
+
+fn-proxy-healthcheck-scheme-is-valid() {
+  declare desc="checks that an app.json healthcheck scheme is either http or https"
+  declare HC_SCHEME="$1"
+
+  [[ -z "$HC_SCHEME" ]] && return 0
+  [[ "${HC_SCHEME,,}" == "http" ]] || [[ "${HC_SCHEME,,}" == "https" ]]
+}
+
 fn-proxy-display-labels() {
   declare desc="print user-set app container labels for specified proxy"
   declare PROXY="$1" APP="$2"
@@ -56,3 +121,57 @@ fn-proxy-show-label() {
 
   echo "$proxy_label_value"
 }
+
+fn-proxy-labels-add() {
+  declare desc="adds a container label for the specified proxy, expecting the caller to hold the proxy property lock"
+  declare PROXY="$1" APP="$2" LABEL_NAME="$3" LABEL_VALUE="$4"
+  local proxy_labels_file_path="$(fn-proxy-get-labels-file-path "$PROXY" "$APP")"
+  local all_proxy_labels=""
+
+  if [[ -s "$proxy_labels_file_path" ]]; then
+    all_proxy_labels="$(fn-proxy-labels-without "$proxy_labels_file_path" "$LABEL_NAME")"
+  fi
+
+  all_proxy_labels="${all_proxy_labels}"$'\n'"${LABEL_NAME}=${LABEL_VALUE}"
+  echo -e "${all_proxy_labels}" | sed '/^$/d' | sort -u | fn-proxy-write-labels-file "$proxy_labels_file_path"
+}
+
+fn-proxy-labels-remove() {
+  declare desc="removes a container label for the specified proxy, expecting the caller to hold the proxy property lock"
+  declare PROXY="$1" APP="$2" LABEL_NAME="$3"
+  local proxy_labels_file_path="$(fn-proxy-get-labels-file-path "$PROXY" "$APP")"
+
+  if [[ ! -s "$proxy_labels_file_path" ]]; then
+    return
+  fi
+
+  fn-proxy-labels-without "$proxy_labels_file_path" "$LABEL_NAME" | fn-proxy-write-labels-file "$proxy_labels_file_path"
+}
+
+fn-proxy-labels-without() {
+  declare desc="prints the sorted labels in a proxy labels file without the named label"
+  declare LABELS_FILE="$1" LABEL_NAME="$2"
+  local all_proxy_labels="$(<"$LABELS_FILE")"
+  local escaped_label_name="$(fn-proxy-escape-extended-sed "$LABEL_NAME")"
+
+  echo -e "${all_proxy_labels}" | sed -E "s/^${escaped_label_name}=.*\$//" | sed '/^$/d' | sort -u
+}
+
+fn-proxy-write-labels-file() {
+  declare desc="atomically replaces a proxy labels file with the contents of stdin"
+  declare LABELS_FILE="$1"
+  local tmp_file
+
+  tmp_file="$(mktemp "$(dirname "$LABELS_FILE")/.labels.XXXXXX")"
+  if ! cat >"$tmp_file"; then
+    rm -f "$tmp_file"
+    return 1
+  fi
+
+  if [[ -f "$LABELS_FILE" ]]; then
+    chmod --reference="$LABELS_FILE" "$tmp_file"
+  else
+    chmod 0644 "$tmp_file"
+  fi
+  mv -f "$tmp_file" "$LABELS_FILE"
+}
diff --git a/plugins/proxy/go.mod b/plugins/proxy/go.mod
index f10d0c262..d58f46caf 100644
--- a/plugins/proxy/go.mod
+++ b/plugins/proxy/go.mod
@@ -1,29 +1,29 @@
 module github.com/dokku/dokku/plugins/proxy
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/proxy/go.sum b/plugins/proxy/go.sum
index 14bf42b1c..9ada61068 100644
--- a/plugins/proxy/go.sum
+++ b/plugins/proxy/go.sum
@@ -1,25 +1,24 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -28,28 +27,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/proxy/plugin.toml b/plugins/proxy/plugin.toml
index d99387efe..674e0aba9 100644
--- a/plugins/proxy/plugin.toml
+++ b/plugins/proxy/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core proxy plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/proxy/route_subcommands.go b/plugins/proxy/route_subcommands.go
new file mode 100644
index 000000000..8238569c6
--- /dev/null
+++ b/plugins/proxy/route_subcommands.go
@@ -0,0 +1,203 @@
+package proxy
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"sort"
+
+	"github.com/dokku/dokku/plugins/common"
+)
+
+// CommandRouteSet handles `dokku proxy:route:set <app> <process> <path>
+// [--port <port>] [--strip-prefix]`. Uses set semantics: a given invocation
+// produces a fully-determined state from its arguments (omitted flags reset
+// to defaults), and the command is a no-op when the resulting state is
+// byte-identical to current storage.
+func CommandRouteSet(appName string, processName string, path string, port int, stripPrefix bool) error {
+	if err := common.VerifyAppName(appName); err != nil {
+		return err
+	}
+
+	if processName == "" || path == "" {
+		return errors.New("Usage: dokku proxy:route:set <app> <process> <path> [--port <port>] [--strip-prefix]")
+	}
+
+	if port == 0 {
+		port = DefaultRoutePort
+	}
+
+	route := Route{
+		Path:        path,
+		Process:     processName,
+		Port:        port,
+		StripPrefix: stripPrefix,
+	}
+	changed, err := AddRoute(appName, route)
+	if err != nil {
+		return err
+	}
+
+	if scale := getProcessScale(appName, processName); scale == 0 {
+		common.LogWarn(fmt.Sprintf(
+			"Process %q is currently scaled to 0; route %s -> %s will resolve to no upstream until the process is scaled up",
+			processName, path, processName,
+		))
+	}
+
+	if !changed {
+		return nil
+	}
+	if err := BuildConfig(appName); err != nil {
+		return err
+	}
+	warnIfRebuildRequired(appName)
+	return nil
+}
+
+// CommandRouteRemove handles `dokku proxy:route:remove <app> <path>`.
+// Removing a path that does not exist is a successful no-op.
+func CommandRouteRemove(appName string, path string) error {
+	if err := common.VerifyAppName(appName); err != nil {
+		return err
+	}
+	if path == "" {
+		return errors.New("Usage: dokku proxy:route:remove <app> <path>")
+	}
+
+	changed, err := RemoveRoute(appName, path)
+	if err != nil {
+		return err
+	}
+	if !changed {
+		return nil
+	}
+	if err := BuildConfig(appName); err != nil {
+		return err
+	}
+	warnIfRebuildRequired(appName)
+	return nil
+}
+
+// CommandRouteClear handles `dokku proxy:route:clear <app>`. Clearing an
+// empty route set is a successful no-op.
+func CommandRouteClear(appName string) error {
+	if err := common.VerifyAppName(appName); err != nil {
+		return err
+	}
+
+	changed, err := ClearRoutes(appName)
+	if err != nil {
+		return err
+	}
+	if !changed {
+		return nil
+	}
+	if err := BuildConfig(appName); err != nil {
+		return err
+	}
+	warnIfRebuildRequired(appName)
+	return nil
+}
+
+// warnIfRebuildRequired prints a notice for label-based proxy backends where
+// the new route state is only fully applied on the next container start (the
+// labels are baked in at create-time).
+func warnIfRebuildRequired(appName string) {
+	switch getComputedProxyType(appName) {
+	case "traefik", "caddy", "openresty":
+		common.LogWarn(fmt.Sprintf(
+			"Routes are applied via container labels under the %s proxy backend; run `dokku ps:rebuild %s` to recreate containers and pick up the change",
+			getComputedProxyType(appName), appName,
+		))
+	}
+}
+
+// CommandRouteReport handles `dokku proxy:route:report [<app>] [--format
+// stdout|json]`. With no app, iterates every dokku app.
+func CommandRouteReport(appName string, format string) error {
+	if appName == "" {
+		apps, err := common.DokkuApps()
+		if err != nil {
+			if errors.Is(err, common.NoAppsExist) {
+				common.LogWarn(err.Error())
+				return nil
+			}
+			return err
+		}
+		for _, name := range apps {
+			if err := reportRoutesSingleApp(name, format); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+
+	if err := common.VerifyAppName(appName); err != nil {
+		return err
+	}
+	return reportRoutesSingleApp(appName, format)
+}
+
+type routeReport struct {
+	Path        string `json:"path"`
+	Process     string `json:"process"`
+	Port        int    `json:"port"`
+	StripPrefix bool   `json:"strip_prefix"`
+}
+
+type routeAppReport struct {
+	App    string        `json:"app"`
+	Routes []routeReport `json:"routes"`
+}
+
+func reportRoutesSingleApp(appName string, format string) error {
+	routes, err := GetRoutes(appName)
+	if err != nil {
+		return err
+	}
+
+	if format == "json" {
+		report := routeAppReport{App: appName, Routes: make([]routeReport, 0, len(routes))}
+		for _, r := range routes {
+			report.Routes = append(report.Routes, routeReport{
+				Path:        r.Path,
+				Process:     r.Process,
+				Port:        r.Port,
+				StripPrefix: r.StripPrefix,
+			})
+		}
+		b, err := json.MarshalIndent(report, "", "  ")
+		if err != nil {
+			return err
+		}
+		fmt.Println(string(b))
+		return nil
+	}
+
+	common.LogInfo2Quiet(appName + " proxy routes information")
+	if len(routes) == 0 {
+		common.LogVerbose("Routes: (none)")
+		return nil
+	}
+
+	keys := make([]string, 0, len(routes))
+	for _, r := range routes {
+		keys = append(keys, r.Path)
+	}
+	sort.Strings(keys)
+	for _, key := range keys {
+		for _, r := range routes {
+			if r.Path != key {
+				continue
+			}
+			strip := ""
+			if r.StripPrefix {
+				strip = " (strip)"
+			}
+			common.LogVerbose(fmt.Sprintf("Route %s -> %s:%d%s", r.Path, r.Process, r.Port, strip))
+			break
+		}
+	}
+	return nil
+}
diff --git a/plugins/proxy/routes.go b/plugins/proxy/routes.go
new file mode 100644
index 000000000..571b0f5b4
--- /dev/null
+++ b/plugins/proxy/routes.go
@@ -0,0 +1,242 @@
+package proxy
+
+import (
+	"fmt"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+
+	"github.com/dokku/dokku/plugins/common"
+)
+
+// DefaultRoutePort is the upstream container port assumed when --port is
+// omitted on proxy:route:set. It matches the existing default container port
+// for the web process.
+const DefaultRoutePort = 5000
+
+// Route describes a single path-prefix routing rule.
+type Route struct {
+	Path        string
+	Process     string
+	Port        int
+	StripPrefix bool
+}
+
+// Encode returns the colon-delimited storage representation:
+// "<process>:<port>:<strip>" where <strip> is 0 or 1.
+func (r Route) Encode() string {
+	strip := "0"
+	if r.StripPrefix {
+		strip = "1"
+	}
+	return fmt.Sprintf("%s:%d:%s", r.Process, r.Port, strip)
+}
+
+// Slug returns a deterministic kebab-case identifier derived from the route's
+// path. Used as a stable name fragment for generated labels and CRDs.
+// Example: "/api/v0" -> "api-v0".
+func (r Route) Slug() string {
+	s := strings.Trim(r.Path, "/")
+	s = strings.ReplaceAll(s, "/", "-")
+	s = strings.ToLower(s)
+	if s == "" {
+		return "root"
+	}
+	return s
+}
+
+// DecodeRoute parses the storage representation into a Route. The third
+// (strip) field is optional and defaults to 0 (no strip) when absent.
+func DecodeRoute(path string, value string) (Route, error) {
+	parts := strings.SplitN(value, ":", 3)
+	if len(parts) < 2 {
+		return Route{}, fmt.Errorf("invalid route value %q for path %s", value, path)
+	}
+	port, err := strconv.Atoi(parts[1])
+	if err != nil {
+		return Route{}, fmt.Errorf("invalid port %q for path %s: %v", parts[1], path, err)
+	}
+	strip := false
+	if len(parts) == 3 && parts[2] == "1" {
+		strip = true
+	}
+	return Route{
+		Path:        path,
+		Process:     parts[0],
+		Port:        port,
+		StripPrefix: strip,
+	}, nil
+}
+
+var processNameRE = regexp.MustCompile(`^[a-zA-Z0-9_-]+$`)
+
+// ValidatePath enforces the path constraints documented in the proposal:
+// - must start with "/"
+// - cannot be "/" (reserved for web)
+// - cannot end with "/" (other than root, already rejected above)
+func ValidatePath(path string) error {
+	if !strings.HasPrefix(path, "/") {
+		return fmt.Errorf("path must start with /")
+	}
+	if path == "/" {
+		return fmt.Errorf("path / is reserved for the web process")
+	}
+	if strings.HasSuffix(path, "/") {
+		return fmt.Errorf("path must not end with /")
+	}
+	return nil
+}
+
+// ValidateProcess enforces process-name constraints:
+// - cannot be empty
+// - cannot be "web" (which is the implicit catch-all)
+// - must match Procfile name syntax
+func ValidateProcess(process string) error {
+	if process == "" {
+		return fmt.Errorf("process name is required")
+	}
+	if process == "web" {
+		return fmt.Errorf("web cannot be a route target; web is the implicit catch-all")
+	}
+	if !processNameRE.MatchString(process) {
+		return fmt.Errorf("process name %q contains invalid characters", process)
+	}
+	return nil
+}
+
+// ValidatePort ensures the port is in the legal TCP range.
+func ValidatePort(port int) error {
+	if port < 1 || port > 65535 {
+		return fmt.Errorf("port %d out of range (1-65535)", port)
+	}
+	return nil
+}
+
+// GetRoutes returns the route set for an app, sorted by descending path
+// length (longest-prefix-first), then alphabetically as a tiebreaker.
+func GetRoutes(appName string) ([]Route, error) {
+	m, err := common.PropertyMapGet("proxy", appName, "routes")
+	if err != nil {
+		return nil, err
+	}
+	routes := make([]Route, 0, len(m))
+	for path, value := range m {
+		route, err := DecodeRoute(path, value)
+		if err != nil {
+			return nil, err
+		}
+		routes = append(routes, route)
+	}
+	sort.SliceStable(routes, func(i, j int) bool {
+		if len(routes[i].Path) != len(routes[j].Path) {
+			return len(routes[i].Path) > len(routes[j].Path)
+		}
+		return routes[i].Path < routes[j].Path
+	})
+	return routes, nil
+}
+
+// GetRoutesByProcess returns the subset of routes targeting a specific
+// process, preserving the longest-prefix-first ordering.
+func GetRoutesByProcess(appName string, processName string) ([]Route, error) {
+	all, err := GetRoutes(appName)
+	if err != nil {
+		return nil, err
+	}
+	filtered := make([]Route, 0, len(all))
+	for _, route := range all {
+		if route.Process == processName {
+			filtered = append(filtered, route)
+		}
+	}
+	return filtered, nil
+}
+
+// RoutedProcessTypes returns the unique process types referenced by any route.
+func RoutedProcessTypes(appName string) ([]string, error) {
+	routes, err := GetRoutes(appName)
+	if err != nil {
+		return nil, err
+	}
+	seen := map[string]bool{}
+	out := []string{}
+	for _, route := range routes {
+		if !seen[route.Process] {
+			seen[route.Process] = true
+			out = append(out, route.Process)
+		}
+	}
+	sort.Strings(out)
+	return out, nil
+}
+
+// AddRoute upserts a route. Returns whether the stored state changed.
+func AddRoute(appName string, route Route) (bool, error) {
+	if err := ValidatePath(route.Path); err != nil {
+		return false, err
+	}
+	if err := ValidateProcess(route.Process); err != nil {
+		return false, err
+	}
+	if err := ValidatePort(route.Port); err != nil {
+		return false, err
+	}
+
+	existing, err := common.PropertyMapGet("proxy", appName, "routes")
+	if err != nil {
+		return false, err
+	}
+	next := route.Encode()
+	if existing[route.Path] == next {
+		return false, nil
+	}
+	return true, common.PropertyMapSet("proxy", appName, "routes", route.Path, next)
+}
+
+// RemoveRoute removes a route by path. Returns whether the stored state
+// changed (false when the path was absent - removal is idempotent).
+func RemoveRoute(appName string, path string) (bool, error) {
+	existing, err := common.PropertyMapGet("proxy", appName, "routes")
+	if err != nil {
+		return false, err
+	}
+	if _, ok := existing[path]; !ok {
+		return false, nil
+	}
+	return true, common.PropertyMapDelete("proxy", appName, "routes", path)
+}
+
+// ClearRoutes removes every route for an app. Returns whether anything was
+// removed (false when the route set was already empty).
+func ClearRoutes(appName string) (bool, error) {
+	existing, err := common.PropertyMapGet("proxy", appName, "routes")
+	if err != nil {
+		return false, err
+	}
+	if len(existing) == 0 {
+		return false, nil
+	}
+	return true, common.PropertyDelete("proxy", appName, "routes")
+}
+
+// getProcessScale returns the configured replica count for a process, or 0
+// when no scale entry exists. The ps plugin stores scale as a property list
+// of "<proc>=<count>" entries.
+func getProcessScale(appName string, processName string) int {
+	lines, err := common.PropertyListGet("ps", appName, "scale")
+	if err != nil {
+		return 0
+	}
+	prefix := processName + "="
+	for _, line := range lines {
+		if strings.HasPrefix(line, prefix) {
+			n, err := strconv.Atoi(strings.TrimPrefix(line, prefix))
+			if err != nil {
+				return 0
+			}
+			return n
+		}
+	}
+	return 0
+}
diff --git a/plugins/proxy/src/commands/commands.go b/plugins/proxy/src/commands/commands.go
index b34748be4..cfa514975 100644
--- a/plugins/proxy/src/commands/commands.go
+++ b/plugins/proxy/src/commands/commands.go
@@ -23,6 +23,10 @@ Additional commands:`
     proxy:disable <app>, Disable proxy for app
     proxy:enable <app>, Enable proxy for app
     proxy:report [<app>] [<flag>], Displays a proxy report for one or more apps
+    proxy:route:clear <app>, Removes every path-based route for an app
+    proxy:route:remove <app> <path>, Removes a path-based route from an app
+    proxy:route:report [<app>] [--format json], Displays the path-based routes for an app
+    proxy:route:set <app> <process> <path> [--port port] [--strip-prefix], Adds or updates a path-based route to a non-web process
     proxy:set <app> <proxy-type>, Set proxy type for app`
 )
 
diff --git a/plugins/proxy/src/subcommands/subcommands.go b/plugins/proxy/src/subcommands/subcommands.go
index 07b1a5655..d1ef26f4c 100644
--- a/plugins/proxy/src/subcommands/subcommands.go
+++ b/plugins/proxy/src/subcommands/subcommands.go
@@ -70,6 +70,32 @@ func main() {
 			value = args.Arg(1)
 		}
 		err = proxy.CommandSet(appName, property, value)
+	case "route:set":
+		args := flag.NewFlagSet("proxy:route:set", flag.ExitOnError)
+		port := args.Int("port", proxy.DefaultRoutePort, "--port: container port of the target process")
+		stripPrefix := args.Bool("strip-prefix", false, "--strip-prefix: strip the matched prefix before forwarding")
+		args.Parse(os.Args[2:])
+		appName := args.Arg(0)
+		processName := args.Arg(1)
+		path := args.Arg(2)
+		err = proxy.CommandRouteSet(appName, processName, path, *port, *stripPrefix)
+	case "route:remove":
+		args := flag.NewFlagSet("proxy:route:remove", flag.ExitOnError)
+		args.Parse(os.Args[2:])
+		appName := args.Arg(0)
+		path := args.Arg(1)
+		err = proxy.CommandRouteRemove(appName, path)
+	case "route:clear":
+		args := flag.NewFlagSet("proxy:route:clear", flag.ExitOnError)
+		args.Parse(os.Args[2:])
+		appName := args.Arg(0)
+		err = proxy.CommandRouteClear(appName)
+	case "route:report":
+		args := flag.NewFlagSet("proxy:route:report", flag.ExitOnError)
+		format := args.String("format", "stdout", "format: [ stdout | json ]")
+		args.Parse(os.Args[2:])
+		appName := args.Arg(0)
+		err = proxy.CommandRouteReport(appName, *format)
 	default:
 		err = fmt.Errorf("Invalid plugin subcommand call: %s", subcommand)
 	}
diff --git a/plugins/proxy/src/triggers/triggers.go b/plugins/proxy/src/triggers/triggers.go
index e8acb3b6c..fac9d13c5 100644
--- a/plugins/proxy/src/triggers/triggers.go
+++ b/plugins/proxy/src/triggers/triggers.go
@@ -26,6 +26,9 @@ func main() {
 	case "proxy-type":
 		appName := flag.Arg(0)
 		err = proxy.TriggerProxyType(appName)
+	case "proxy-routes-list":
+		appName := flag.Arg(0)
+		err = proxy.TriggerProxyRoutesList(appName)
 	case "post-app-clone-setup":
 		oldAppName := flag.Arg(0)
 		newAppName := flag.Arg(1)
diff --git a/plugins/proxy/triggers.go b/plugins/proxy/triggers.go
index 935e63d77..cd6f11df8 100644
--- a/plugins/proxy/triggers.go
+++ b/plugins/proxy/triggers.go
@@ -64,6 +64,24 @@ func TriggerProxyType(appName string) error {
 	return nil
 }
 
+// TriggerProxyRoutesList prints one "process|port|path|strip" line per route,
+// sorted by descending path length. Backends use this to render path-based
+// routes in their config or labels.
+func TriggerProxyRoutesList(appName string) error {
+	routes, err := GetRoutes(appName)
+	if err != nil {
+		return err
+	}
+	for _, r := range routes {
+		strip := "0"
+		if r.StripPrefix {
+			strip = "1"
+		}
+		fmt.Printf("%s|%d|%s|%s\n", r.Process, r.Port, r.Path, strip)
+	}
+	return nil
+}
+
 // TriggerPostAppCloneSetup creates new proxy files
 func TriggerPostAppCloneSetup(oldAppName string, newAppName string) error {
 	return common.PropertyClone("proxy", oldAppName, newAppName)
diff --git a/plugins/ps/concurrency_test.go b/plugins/ps/concurrency_test.go
new file mode 100644
index 000000000..a544ae3db
--- /dev/null
+++ b/plugins/ps/concurrency_test.go
@@ -0,0 +1,51 @@
+package ps
+
+import (
+	"errors"
+	"fmt"
+	"os/user"
+	"sync"
+	"testing"
+
+	"github.com/dokku/dokku/plugins/common"
+)
+
+func TestUpdateScaleConcurrent(t *testing.T) {
+	t.Setenv("DOKKU_LIB_ROOT", t.TempDir())
+	current, err := user.Current()
+	if err != nil {
+		t.Fatalf("user.Current: %v", err)
+	}
+	group, err := user.LookupGroupId(current.Gid)
+	if err != nil {
+		t.Fatalf("user.LookupGroupId: %v", err)
+	}
+	t.Setenv("DOKKU_SYSTEM_USER", current.Username)
+	t.Setenv("DOKKU_SYSTEM_GROUP", group.Name)
+
+	const appName = "race-test"
+	const count = 20
+	var wg sync.WaitGroup
+	errs := make([]error, count)
+	for i := 0; i < count; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			errs[i] = updateScale(appName, false, FormationSlice{
+				{ProcessType: fmt.Sprintf("worker%d", i), Quantity: 1},
+			})
+		}(i)
+	}
+	wg.Wait()
+	if err := errors.Join(errs...); err != nil {
+		t.Fatalf("updateScale: %v", err)
+	}
+
+	tuples, err := common.PropertyListGet("ps", appName, "scale")
+	if err != nil {
+		t.Fatalf("PropertyListGet: %v", err)
+	}
+	if len(tuples) != count {
+		t.Fatalf("scale has %d process types, want %d: %v", len(tuples), count, tuples)
+	}
+}
diff --git a/plugins/ps/functions.go b/plugins/ps/functions.go
index a32e0b38d..c64224354 100644
--- a/plugins/ps/functions.go
+++ b/plugins/ps/functions.go
@@ -14,11 +14,54 @@ import (
 	dockeroptions "github.com/dokku/dokku/plugins/docker-options"
 )
 
+// appendClearedFormations appends a zero quantity formation for every existing
+// process type that was not specified, ensuring cleared process types are both
+// persisted and scaled down instead of being silently dropped
+func appendClearedFormations(formations FormationSlice, existingFormations FormationSlice) FormationSlice {
+	specifiedProcessTypes := map[string]bool{}
+	for _, formation := range formations {
+		specifiedProcessTypes[formation.ProcessType] = true
+	}
+
+	for _, existingFormation := range existingFormations {
+		if specifiedProcessTypes[existingFormation.ProcessType] {
+			continue
+		}
+
+		specifiedProcessTypes[existingFormation.ProcessType] = true
+		formations = append(formations, &Formation{
+			ProcessType: existingFormation.ProcessType,
+			Quantity:    0,
+		})
+	}
+
+	return formations
+}
+
 func canScaleApp(appName string) bool {
 	canScale := common.PropertyGetDefault("ps", appName, "can-scale", "true")
 	return common.ToBool(canScale)
 }
 
+// defaultProcessTuples returns the process tuples an app is created with, scaling
+// the web process to one when it is valid for the app and nothing otherwise
+func defaultProcessTuples(appName string) ([]string, error) {
+	if !hasProcfile(appName) {
+		return []string{"web=1"}, nil
+	}
+
+	validProcessTypes, err := processesInProcfile(getProcessSpecificProcfilePath(appName))
+	if err != nil {
+		return []string{}, err
+	}
+
+	if !validProcessTypes["web"] {
+		return []string{}, nil
+	}
+
+	return []string{"web=1"}, nil
+}
+
 func getProcfileCommand(appName string, procfilePath string, processType string, port int) (string, error) {
 	if !common.FileExists(procfilePath) {
 		return "", errors.New("No procfile found")
@@ -153,7 +196,7 @@ func parseProcessTuples(processTuples []string) (FormationSlice, error) {
 		processType := strings.TrimSpace(s[0])
 		quantity, err := strconv.Atoi(strings.TrimSpace(s[1]))
 		if err != nil {
-			return formations, fmt.Errorf("Invalid count for process type %s", s[0])
+			return formations, fmt.Errorf("Invalid count for process type %s", processType)
 		}
 
 		if foundFormations[processType] {
@@ -308,6 +351,14 @@ func scaleSet(input scaleSetInput) error {
 		return err
 	}
 
+	if err := validateFormations(formations); err != nil {
+		return err
+	}
+
+	if input.clearExisting {
+		formations = appendClearedFormations(formations, existingFormations)
+	}
+
 	if err := updateScale(input.appName, input.clearExisting, formations); err != nil {
 		return err
 	}
@@ -360,7 +411,18 @@ func scaleSet(input scaleSetInput) error {
 	return nil
 }
 
+// updateScale merges formationUpdates into the stored formation, holding the
+// app's ps property lock from the read of the stored formation to the write of
+// the merged one so concurrent scale changes cannot drop each other.
 func updateScale(appName string, clearExisting bool, formationUpdates FormationSlice) error {
+	return common.PropertyLock("ps", appName, func(p *common.LockedProperties) error {
+		return updateScaleWithLock(p, appName, clearExisting, formationUpdates)
+	})
+}
+
+// updateScaleWithLock merges formationUpdates into the stored formation. The
+// caller must hold the app's ps property lock.
+func updateScaleWithLock(p *common.LockedProperties, appName string, clearExisting bool, formationUpdates FormationSlice) error {
 	formations := FormationSlice{}
 	if !clearExisting {
 		processTuples, err := common.PropertyListGet("ps", appName, "scale")
@@ -431,9 +493,26 @@ func updateScale(appName string, clearExisting bool, formationUpdates FormationS
 		values = append(values, fmt.Sprintf("%s=%d", formation.ProcessType, formation.Quantity))
 	}
 
-	if err := common.PropertyListWrite("ps", appName, "scale.old", oldValues); err != nil {
+	if err := p.ListWrite("scale.old", oldValues); err != nil {
 		return err
 	}
 
-	return common.PropertyListWrite("ps", appName, "scale", values)
+	return p.ListWrite("scale", values)
+}
+
+// validateFormations returns an error when a user specified formation cannot be scaled to.
+// Formations read back from the scale property are deliberately not validated so that a value
+// persisted by an older dokku version remains visible and repairable via ps:scale.
+func validateFormations(formations FormationSlice) error {
+	for _, formation := range formations {
+		if formation.ProcessType == "" {
+			return fmt.Errorf("Missing process type for count %d", formation.Quantity)
+		}
+
+		if formation.Quantity < 0 {
+			return fmt.Errorf("Invalid count for process type %s: value must be zero or greater", formation.ProcessType)
+		}
+	}
+
+	return nil
 }
diff --git a/plugins/ps/functions_test.go b/plugins/ps/functions_test.go
new file mode 100644
index 000000000..fc2634353
--- /dev/null
+++ b/plugins/ps/functions_test.go
@@ -0,0 +1,249 @@
+package ps
+
+import (
+	"os"
+	"testing"
+)
+
+// assertFormations fails the test when the specified formations do not match
+// the expected process type and quantity pairs, in order
+func assertFormations(t *testing.T, formations FormationSlice, expected []Formation) {
+	t.Helper()
+
+	if len(formations) != len(expected) {
+		t.Fatalf("expected %d formations, got %d", len(expected), len(formations))
+	}
+
+	for i, formation := range formations {
+		if formation.ProcessType != expected[i].ProcessType || formation.Quantity != expected[i].Quantity {
+			t.Fatalf("expected %s=%d at index %d, got %s=%d", expected[i].ProcessType, expected[i].Quantity, i, formation.ProcessType, formation.Quantity)
+		}
+	}
+}
+
+func TestAppendClearedFormations(t *testing.T) {
+	testCases := []struct {
+		name          string
+		processTuples []string
+		existingTuple []string
+		expected      []Formation
+	}{
+		{
+			name:          "no existing formations",
+			processTuples: []string{"web=1"},
+			existingTuple: []string{},
+			expected:      []Formation{{ProcessType: "web", Quantity: 1}},
+		},
+		{
+			name:          "zeroes out unspecified process types",
+			processTuples: []string{"web=1"},
+			existingTuple: []string{"web=2", "worker=3"},
+			expected:      []Formation{{ProcessType: "web", Quantity: 1}, {ProcessType: "worker", Quantity: 0}},
+		},
+		{
+			name:          "does not overwrite specified process types",
+			processTuples: []string{"web=1", "worker=2"},
+			existingTuple: []string{"web=4", "worker=5"},
+			expected:      []Formation{{ProcessType: "web", Quantity: 1}, {ProcessType: "worker", Quantity: 2}},
+		},
+		{
+			name:          "zeroes out every process type when none are specified",
+			processTuples: []string{},
+			existingTuple: []string{"web=2", "worker=3"},
+			expected:      []Formation{{ProcessType: "web", Quantity: 0}, {ProcessType: "worker", Quantity: 0}},
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			formations, err := parseProcessTuples(testCase.processTuples)
+			if err != nil {
+				t.Fatalf("unexpected error parsing process tuples: %v", err)
+			}
+
+			existingFormations, err := parseProcessTuples(testCase.existingTuple)
+			if err != nil {
+				t.Fatalf("unexpected error parsing existing process tuples: %v", err)
+			}
+
+			assertFormations(t, appendClearedFormations(formations, existingFormations), testCase.expected)
+		})
+	}
+}
+
+func TestDefaultProcessTuplesWithoutProcfile(t *testing.T) {
+	tmpDir, err := os.MkdirTemp("", "ps-test")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(tmpDir)
+
+	t.Setenv("DOKKU_LIB_ROOT", tmpDir)
+	t.Setenv("DOKKU_PID", "")
+
+	processTuples, err := defaultProcessTuples("test-app")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if len(processTuples) != 1 || processTuples[0] != "web=1" {
+		t.Fatalf("expected [web=1], got %v", processTuples)
+	}
+}
+
+func TestParseProcessTuples(t *testing.T) {
+	testCases := []struct {
+		name          string
+		processTuples []string
+		expected      []Formation
+		expectedError string
+	}{
+		{
+			name:          "no process tuples",
+			processTuples: []string{},
+			expected:      []Formation{},
+		},
+		{
+			name:          "single process type",
+			processTuples: []string{"web=1"},
+			expected:      []Formation{{ProcessType: "web", Quantity: 1}},
+		},
+		{
+			name:          "multiple process types",
+			processTuples: []string{"web=1", "worker=2"},
+			expected:      []Formation{{ProcessType: "web", Quantity: 1}, {ProcessType: "worker", Quantity: 2}},
+		},
+		{
+			name:          "trims surrounding whitespace",
+			processTuples: []string{" web = 2 "},
+			expected:      []Formation{{ProcessType: "web", Quantity: 2}},
+		},
+		{
+			name:          "first specified quantity wins",
+			processTuples: []string{"web=1", "web=3"},
+			expected:      []Formation{{ProcessType: "web", Quantity: 1}},
+		},
+		{
+			// persisted formations are parsed without validation so that a negative
+			// quantity written by an older dokku version remains readable
+			name:          "negative quantities are parsed",
+			processTuples: []string{"web=-1"},
+			expected:      []Formation{{ProcessType: "web", Quantity: -1}},
+		},
+		{
+			name:          "missing count",
+			processTuples: []string{"web"},
+			expectedError: "Missing count for process type web",
+		},
+		{
+			name:          "non-numeric count",
+			processTuples: []string{"web=one"},
+			expectedError: "Invalid count for process type web",
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			formations, err := parseProcessTuples(testCase.processTuples)
+			if testCase.expectedError != "" {
+				if err == nil {
+					t.Fatalf("expected error %q, got none", testCase.expectedError)
+				}
+
+				if err.Error() != testCase.expectedError {
+					t.Fatalf("expected error %q, got %q", testCase.expectedError, err.Error())
+				}
+
+				return
+			}
+
+			if err != nil {
+				t.Fatalf("unexpected error parsing process tuples: %v", err)
+			}
+
+			assertFormations(t, formations, testCase.expected)
+		})
+	}
+}
+
+func TestValidateFormations(t *testing.T) {
+	testCases := []struct {
+		name          string
+		processTuples []string
+		expectedError string
+	}{
+		{
+			name:          "zero is a valid quantity",
+			processTuples: []string{"web=0"},
+		},
+		{
+			name:          "positive quantities are valid",
+			processTuples: []string{"web=1", "worker=10"},
+		},
+		{
+			name:          "negative quantity",
+			processTuples: []string{"web=-1"},
+			expectedError: "Invalid count for process type web: value must be zero or greater",
+		},
+		{
+			name:          "names the offending process type",
+			processTuples: []string{"web=1", "worker=-2"},
+			expectedError: "Invalid count for process type worker: value must be zero or greater",
+		},
+		{
+			name:          "missing process type",
+			processTuples: []string{"=1"},
+			expectedError: "Missing process type for count 1",
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			formations, err := parseProcessTuples(testCase.processTuples)
+			if err != nil {
+				t.Fatalf("unexpected error parsing process tuples: %v", err)
+			}
+
+			err = validateFormations(formations)
+			if testCase.expectedError == "" {
+				if err != nil {
+					t.Fatalf("unexpected error: %v", err)
+				}
+
+				return
+			}
+
+			if err == nil {
+				t.Fatalf("expected error %q, got none", testCase.expectedError)
+			}
+
+			if err.Error() != testCase.expectedError {
+				t.Fatalf("expected error %q, got %q", testCase.expectedError, err.Error())
+			}
+		})
+	}
+}
+
+func TestScaleSetRejectsNegativeQuantity(t *testing.T) {
+	tmpDir, err := os.MkdirTemp("", "ps-test")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(tmpDir)
+
+	t.Setenv("DOKKU_LIB_ROOT", tmpDir)
+	t.Setenv("DOKKU_PID", "")
+
+	err = scaleSet(scaleSetInput{
+		appName:       "test-app",
+		skipDeploy:    true,
+		processTuples: []string{"web=-1"},
+	})
+	if err == nil {
+		t.Fatal("expected an error scaling to a negative quantity, got none")
+	}
+
+	if err.Error() != "Invalid count for process type web: value must be zero or greater" {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
diff --git a/plugins/ps/go.mod b/plugins/ps/go.mod
index 6424dbf54..acc1c456f 100644
--- a/plugins/ps/go.mod
+++ b/plugins/ps/go.mod
@@ -1,32 +1,32 @@
 module github.com/dokku/dokku/plugins/ps
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
 	github.com/dokku/dokku/plugins/docker-options v0.0.0-00010101000000-000000000000
-	github.com/gofrs/flock v0.13.0
-	github.com/spf13/pflag v1.0.10
+	github.com/gofrs/flock v0.13.1
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	mvdan.cc/sh/v3 v3.13.1 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	mvdan.cc/sh/v3 v3.14.1 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/ps/go.sum b/plugins/ps/go.sum
index d0471825d..f5f81354f 100644
--- a/plugins/ps/go.sum
+++ b/plugins/ps/go.sum
@@ -1,17 +1,16 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
-github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
-github.com/go-quicktest/qt v1.101.0/go.mod h1:14Bz/f7NwaXPtdYEgzsx46kqSxVwTbzVZsDC26tQJow=
-github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
-github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8P+Z0=
+github.com/go-quicktest/qt v1.102.0 h1:HSQxCeh5YZH3EL3W39ixjtyaEhcWSXQHtHnMBzSs474=
+github.com/go-quicktest/qt v1.102.0/go.mod h1:p4lGIVX+8Wa6ZPNDvqcxq36XpUDLh42FLetFU7odllI=
+github.com/gofrs/flock v0.13.1 h1:jjREztyBeSKBZYAC+mgc1laB+xsgy4kYMf3FbKF2UBo=
+github.com/gofrs/flock v0.13.1/go.mod h1:sf4BFiHwnvgxa25DlQoDqXQnwRMEOwqxRq37P6MzzmE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
@@ -22,12 +21,12 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -36,32 +35,27 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rogpeppe/go-internal v1.15.0 h1:D0RCU5rMAp+SpgkiNdrjfJ+LX4J1M32V2NeCY7EJ6hc=
+github.com/rogpeppe/go-internal v1.15.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-mvdan.cc/sh/v3 v3.13.1 h1:DP3TfgZhDkT7lerUdnp6PTGKyxxzz6T+cOlY/xEvfWk=
-mvdan.cc/sh/v3 v3.13.1/go.mod h1:lXJ8SexMvEVcHCoDvAGLZgFJ9Wsm2sulmoNEXGhYZD0=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
+mvdan.cc/sh/v3 v3.14.1 h1:bXkhQWNHCs0KZEChF8hYS6FC+T2N9mUZLbQv9blditI=
+mvdan.cc/sh/v3 v3.14.1/go.mod h1:syYCoFET8w9tvevxiXUtY8/ICrU+l26jHmhJDra3Vwo=
diff --git a/plugins/ps/plugin.toml b/plugins/ps/plugin.toml
index 644f0e33b..df3ba12b3 100644
--- a/plugins/ps/plugin.toml
+++ b/plugins/ps/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core ps plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/ps/report.go b/plugins/ps/report.go
index cc1842527..0ca8a69ba 100644
--- a/plugins/ps/report.go
+++ b/plugins/ps/report.go
@@ -30,27 +30,27 @@ func ReportSingleApp(appName string, format string, infoFlag string) error {
 		}
 	} else {
 		flags = map[string]common.ReportFunc{
-			"--deployed":                           reportDeployed,
-			"--processes":                          reportProcesses,
-			"--ps-can-scale":                       reportCanScale,
-			"--ps-computed-dockerfile-start-cmd":   reportComputedDockerfileStartCmd,
-			"--ps-computed-procfile-path":          reportComputedProcfilePath,
-			"--ps-computed-restart-policy":         reportComputedRestartPolicy,
-			"--ps-computed-skip-deploy":            reportComputedSkipDeploy,
-			"--ps-computed-start-cmd":              reportComputedStartCmd,
-			"--ps-computed-stop-timeout-seconds":   reportComputedStopTimeoutSeconds,
-			"--ps-dockerfile-start-cmd":            reportDockerfileStartCmd,
-			"--ps-global-procfile-path":            reportGlobalProcfilePath,
-			"--ps-global-restart-policy":           reportGlobalRestartPolicy,
-			"--ps-global-skip-deploy":              reportGlobalSkipDeploy,
-			"--ps-global-stop-timeout-seconds":     reportGlobalStopTimeoutSeconds,
-			"--ps-procfile-path":                   reportProcfilePath,
-			"--ps-restart-policy":                  reportRestartPolicy,
-			"--ps-skip-deploy":                     reportSkipDeploy,
-			"--ps-start-cmd":                       reportStartCmd,
-			"--ps-stop-timeout-seconds":            reportStopTimeoutSeconds,
-			"--restore":                            reportRestore,
-			"--running":                            reportRunningState,
+			"--deployed":                         reportDeployed,
+			"--processes":                        reportProcesses,
+			"--ps-can-scale":                     reportCanScale,
+			"--ps-computed-dockerfile-start-cmd": reportComputedDockerfileStartCmd,
+			"--ps-computed-procfile-path":        reportComputedProcfilePath,
+			"--ps-computed-restart-policy":       reportComputedRestartPolicy,
+			"--ps-computed-skip-deploy":          reportComputedSkipDeploy,
+			"--ps-computed-start-cmd":            reportComputedStartCmd,
+			"--ps-computed-stop-timeout-seconds": reportComputedStopTimeoutSeconds,
+			"--ps-dockerfile-start-cmd":          reportDockerfileStartCmd,
+			"--ps-global-procfile-path":          reportGlobalProcfilePath,
+			"--ps-global-restart-policy":         reportGlobalRestartPolicy,
+			"--ps-global-skip-deploy":            reportGlobalSkipDeploy,
+			"--ps-global-stop-timeout-seconds":   reportGlobalStopTimeoutSeconds,
+			"--ps-procfile-path":                 reportProcfilePath,
+			"--ps-restart-policy":                reportRestartPolicy,
+			"--ps-skip-deploy":                   reportSkipDeploy,
+			"--ps-start-cmd":                     reportStartCmd,
+			"--ps-stop-timeout-seconds":          reportStopTimeoutSeconds,
+			"--restore":                          reportRestore,
+			"--running":                          reportRunningState,
 		}
 
 		extraFlags := addStatusFlags(appName, infoFlag)
diff --git a/plugins/ps/src/commands/commands.go b/plugins/ps/src/commands/commands.go
index 6063bfcf5..525924a27 100644
--- a/plugins/ps/src/commands/commands.go
+++ b/plugins/ps/src/commands/commands.go
@@ -19,15 +19,16 @@ Additional commands:`
 
 	helpContent = `
     ps:inspect <app>, Displays a sanitized version of docker inspect for an app
-    ps:rebuild [--parallel count] [--all|<app>], Rebuilds an app from source
+    ps:rebuild [--parallel count] [--no-cache] [--all|<app>], Rebuilds an app from source
     ps:report [<app>] [<flag>], Displays a process report for one or more apps
     ps:restart [--parallel count] [--all|<app>] [<process-name>], Restart an app
     ps:restore [<app>], Start previously running apps e.g. after reboot
     ps:scale [--skip-deploy] [--format stdout|json] <app> [<proc>=<count>...], Get/Set how many instances of a given process to run
+    ps:scale --replace [--skip-deploy] <app> <proc>=<count> [<proc>=<count>...], Replace the formation and scale unspecified process types to zero
+    ps:scale --clear [--skip-deploy] <app>, Reset the formation to the default scale
     ps:set <app> <key> <value>, Set or clear a ps property for an app
     ps:start [--parallel count] [--all|<app>], Start an app
-    ps:stop [--parallel count] [--all|<app>], Stop an app
-`
+    ps:stop [--parallel count] [--all|<app>], Stop an app`
 )
 
 func main() {
diff --git a/plugins/ps/src/subcommands/subcommands.go b/plugins/ps/src/subcommands/subcommands.go
index 91e41c5cb..f88fc967a 100644
--- a/plugins/ps/src/subcommands/subcommands.go
+++ b/plugins/ps/src/subcommands/subcommands.go
@@ -27,9 +27,10 @@ func main() {
 		args := flag.NewFlagSet("ps:rebuild", flag.ExitOnError)
 		allApps := args.Bool("all", false, "--all: rebuild all apps")
 		parallelCount := args.Int("parallel", ps.RunInSerial, "--parallel: number of apps to rebuild in parallel, -1 to match cpu count")
+		noCache := args.Bool("no-cache", false, "--no-cache: rebuild without using the build cache")
 		args.Parse(os.Args[2:])
 		appName := args.Arg(0)
-		err = ps.CommandRebuild(appName, *allApps, *parallelCount)
+		err = ps.CommandRebuild(appName, *allApps, *parallelCount, *noCache)
 	case "report":
 		args := flag.NewFlagSet("ps:report", flag.ExitOnError)
 		format := args.String("format", "stdout", "format: [ stdout | json ]")
@@ -65,11 +66,20 @@ func main() {
 	case "scale":
 		args := flag.NewFlagSet("ps:scale", flag.ExitOnError)
 		skipDeploy := args.Bool("skip-deploy", false, "--skip-deploy: skip deploy of the app")
+		clearFormation := args.Bool("clear", false, "--clear: reset the formation to the default scale")
+		replace := args.Bool("replace", false, "--replace: replace the formation and scale unspecified process types to zero")
 		format := args.String("format", "stdout", "format: [ stdout | json ]")
 		args.Parse(os.Args[2:])
 		appName := args.Arg(0)
 		_, processTuples := common.ShiftString(args.Args())
-		err = ps.CommandScale(appName, *skipDeploy, *format, processTuples)
+		err = ps.CommandScale(ps.CommandScaleInput{
+			AppName:       appName,
+			Clear:         *clearFormation,
+			Format:        *format,
+			ProcessTuples: processTuples,
+			Replace:       *replace,
+			SkipDeploy:    *skipDeploy,
+		})
 	case "set":
 		args := flag.NewFlagSet("ps:set", flag.ExitOnError)
 		global := args.Bool("global", false, "--global: set a global property")
diff --git a/plugins/ps/subcommands.go b/plugins/ps/subcommands.go
index a1bfaf2e2..89489c6fb 100644
--- a/plugins/ps/subcommands.go
+++ b/plugins/ps/subcommands.go
@@ -3,6 +3,7 @@ package ps
 import (
 	"errors"
 	"fmt"
+	"os"
 	"path/filepath"
 	"strings"
 
@@ -26,7 +27,11 @@ func CommandInspect(appName string) error {
 }
 
 // CommandRebuild rebuilds an app from source
-func CommandRebuild(appName string, allApps bool, parallelCount int) error {
+func CommandRebuild(appName string, allApps bool, parallelCount int, noCache bool) error {
+	if noCache {
+		os.Setenv("DOKKU_BUILD_NO_CACHE", "true")
+	}
+
 	if allApps {
 		return common.RunCommandAgainstAllApps(Rebuild, "rebuild", parallelCount)
 	}
@@ -121,6 +126,9 @@ func CommandRetire(appName string) error {
 	if appName == "" {
 		scheduler = common.GetGlobalScheduler()
 	} else {
+		if err := common.VerifyAppName(appName); err != nil {
+			return err
+		}
 		scheduler = common.GetAppScheduler(appName)
 	}
 
@@ -157,25 +165,70 @@ func CommandRetire(appName string) error {
 	return err
 }
 
+// CommandScaleInput is the input for the CommandScale function
+type CommandScaleInput struct {
+	// AppName is the name of the app to scale
+	AppName string
+
+	// Clear is a flag to reset the formation to the default scale
+	Clear bool
+
+	// Format is the format to display the formation in
+	Format string
+
+	// ProcessTuples is a list of process tuples to scale
+	ProcessTuples []string
+
+	// Replace is a flag to replace the formation with the specified process tuples
+	Replace bool
+
+	// SkipDeploy is a flag to skip the deploy phase
+	SkipDeploy bool
+}
+
 // CommandScale gets or sets how many instances of a given process to run
-func CommandScale(appName string, skipDeploy bool, format string, processTuples []string) error {
-	if err := common.VerifyAppName(appName); err != nil {
+func CommandScale(input CommandScaleInput) error {
+	if err := common.VerifyAppName(input.AppName); err != nil {
 		return err
 	}
 
-	if len(processTuples) == 0 {
-		return scaleReport(appName, format)
+	if input.Clear && input.Replace {
+		return errors.New("The --clear and --replace flags cannot be specified together")
 	}
 
-	if !canScaleApp(appName) {
-		return fmt.Errorf("App %s contains an app.json file with a formations key and cannot be manually scaled", appName)
+	if input.Clear && len(input.ProcessTuples) > 0 {
+		return errors.New("Process types cannot be specified when using the --clear flag, use --replace to set the entire formation")
+	}
+
+	if input.Replace && len(input.ProcessTuples) == 0 {
+		return errors.New("Must specify at least one process type when using the --replace flag, use --clear to reset the formation")
+	}
+
+	if !input.Clear && len(input.ProcessTuples) == 0 {
+		return scaleReport(input.AppName, input.Format)
+	}
+
+	if !canScaleApp(input.AppName) {
+		return fmt.Errorf("App %s contains an app.json file with a formations key and cannot be manually scaled", input.AppName)
+	}
+
+	processTuples := input.ProcessTuples
+	if input.Clear {
+		var err error
+		processTuples, err = defaultProcessTuples(input.AppName)
+		if err != nil {
+			return err
+		}
+
+		common.LogInfo1(fmt.Sprintf("Resetting %s processes to the default scale", input.AppName))
+	} else {
+		common.LogInfo1(fmt.Sprintf("Scaling %s processes: %s", input.AppName, strings.Join(processTuples, " ")))
 	}
 
-	common.LogInfo1(fmt.Sprintf("Scaling %s processes: %s", appName, strings.Join(processTuples, " ")))
 	return scaleSet(scaleSetInput{
-		appName:           appName,
-		skipDeploy:        skipDeploy,
-		clearExisting:     false,
+		appName:           input.AppName,
+		skipDeploy:        input.SkipDeploy,
+		clearExisting:     input.Clear || input.Replace,
 		processTuples:     processTuples,
 		deployOnlyChanged: true,
 	})
diff --git a/plugins/registry/Makefile b/plugins/registry/Makefile
index 82ab1be61..4a76547d5 100644
--- a/plugins/registry/Makefile
+++ b/plugins/registry/Makefile
@@ -1,4 +1,4 @@
-SUBCOMMANDS = subcommands/login subcommands/logout subcommands/report subcommands/set
+SUBCOMMANDS = subcommands/auth-status subcommands/login subcommands/logout subcommands/report subcommands/set
 TRIGGERS = triggers/deployed-app-image-repo triggers/deployed-app-image-tag triggers/deployed-app-repository triggers/install triggers/post-app-clone-setup triggers/post-app-rename-setup triggers/post-create triggers/post-delete triggers/post-release-builder triggers/report
 BUILD = commands subcommands triggers
 PLUGIN_NAME = registry
diff --git a/plugins/registry/auth_status.go b/plugins/registry/auth_status.go
new file mode 100644
index 000000000..90e0b0889
--- /dev/null
+++ b/plugins/registry/auth_status.go
@@ -0,0 +1,219 @@
+package registry
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strings"
+)
+
+// exit codes reported by registry:auth-status. Codes 0 through 3 match the
+// codes git:auth-status reports for the equivalent netrc states.
+const (
+	// authStatusMatch means the stored credential matches the requested state
+	authStatusMatch = 0
+
+	// authStatusMissing means no credential is stored for the server
+	authStatusMissing = 1
+
+	// authStatusDiffers means a credential is stored but does not match
+	authStatusDiffers = 2
+
+	// authStatusInvalidArguments means the state could not be checked
+	authStatusInvalidArguments = 3
+
+	// authStatusUnknown means a credential is stored but its secret is unreadable
+	authStatusUnknown = 4
+)
+
+// dockerAuthEntry is the subset of a docker config.json auths entry dokku reads
+type dockerAuthEntry struct {
+	Auth          string `json:"auth"`
+	Username      string `json:"username"`
+	Password      string `json:"password"`
+	IdentityToken string `json:"identitytoken"`
+}
+
+// dockerConfigFile is the subset of a docker config.json dokku reads
+type dockerConfigFile struct {
+	Auths       map[string]dockerAuthEntry `json:"auths"`
+	CredsStore  string                     `json:"credsStore"`
+	CredHelpers map[string]string          `json:"credHelpers"`
+}
+
+// authStatusInput describes the credential state a caller is asking about
+type authStatusInput struct {
+	// ConfigBytes is the contents of the docker config.json, nil when absent
+	ConfigBytes []byte
+
+	// Server is the registry server being asked about
+	Server string
+
+	// Username is the expected username, empty to assert no credential exists
+	Username string
+
+	// Password is the expected password
+	Password string
+}
+
+// parseDockerConfig unmarshals the subset of a docker config.json dokku reads
+func parseDockerConfig(b []byte) (dockerConfigFile, error) {
+	var config dockerConfigFile
+	if len(b) == 0 {
+		return config, nil
+	}
+
+	if err := json.Unmarshal(b, &config); err != nil {
+		return config, err
+	}
+
+	return config, nil
+}
+
+// lookupAuthEntry returns the auths entry docker would use for a server. The
+// exact key is tried first, then every stored key is compared in hostname form,
+// which is how docker matches credentials written under a legacy key.
+func lookupAuthEntry(config dockerConfigFile, server string) (dockerAuthEntry, bool) {
+	key := dockerAuthKey(server)
+	if entry, ok := config.Auths[key]; ok {
+		return entry, true
+	}
+
+	// map iteration order is random, so the keys are sorted to keep the answer
+	// stable when more than one of them resolves to the same server
+	storedKeys := make([]string, 0, len(config.Auths))
+	for storedKey := range config.Auths {
+		storedKeys = append(storedKeys, storedKey)
+	}
+	sort.Strings(storedKeys)
+
+	for _, storedKey := range storedKeys {
+		if convertToHostname(storedKey) == key {
+			return config.Auths[storedKey], true
+		}
+	}
+
+	return dockerAuthEntry{}, false
+}
+
+// credentialHelperFor returns the credential helper docker would consult for a
+// server, preferring a server-specific helper over the global store
+func credentialHelperFor(config dockerConfigFile, server string) string {
+	key := dockerAuthKey(server)
+	if helper, ok := config.CredHelpers[key]; ok && helper != "" {
+		return helper
+	}
+
+	hostname := convertToHostname(normalizeRegistryServer(server))
+	if helper, ok := config.CredHelpers[hostname]; ok && helper != "" {
+		return helper
+	}
+
+	return config.CredsStore
+}
+
+// decodeAuthEntry returns the username and password stored in an auths entry.
+// The secret is unreadable when a helper holds it or the registry issued an
+// identity token, in which case a username may still be available.
+func decodeAuthEntry(entry dockerAuthEntry) (string, string, bool) {
+	if entry.Auth == "" {
+		if entry.Username != "" && entry.Password != "" {
+			return entry.Username, entry.Password, true
+		}
+
+		return entry.Username, "", false
+	}
+
+	decoded, err := base64.StdEncoding.DecodeString(entry.Auth)
+	if err != nil {
+		return "", "", false
+	}
+
+	username, password, found := strings.Cut(string(decoded), ":")
+	if !found {
+		// without a separator there is no username to read either
+		return "", "", false
+	}
+
+	if password == "" {
+		return username, "", false
+	}
+
+	return username, password, true
+}
+
+// checkAuthStatus reports how a stored docker credential compares to the
+// requested state. It returns the exit code to terminate with and, when the
+// credential cannot be compared, the reason to print to stderr.
+func checkAuthStatus(input authStatusInput) (int, string) {
+	config, err := parseDockerConfig(input.ConfigBytes)
+	if err != nil {
+		return authStatusUnknown, fmt.Sprintf("Unable to parse the docker config for %s: %s", input.Server, err.Error())
+	}
+
+	entry, ok := lookupAuthEntry(config, input.Server)
+	if !ok {
+		if input.Username == "" {
+			return authStatusMatch, ""
+		}
+
+		return authStatusMissing, ""
+	}
+
+	// that a credential exists is the whole answer an empty username asks for,
+	// and needs no access to the secret it holds
+	if input.Username == "" {
+		return authStatusDiffers, ""
+	}
+
+	// a helper keeps the secret outside of the file, leaving nothing to compare
+	// against in the entry docker blanked when it stored the credential
+	if helper := credentialHelperFor(config, input.Server); helper != "" {
+		return authStatusUnknown, fmt.Sprintf("Unable to compare the credential for %s: the %s credential helper holds it", input.Server, helper)
+	}
+
+	username, password, readable := decodeAuthEntry(entry)
+	if readable {
+		if username != input.Username || password != input.Password {
+			return authStatusDiffers, ""
+		}
+
+		return authStatusMatch, ""
+	}
+
+	// a username that differs settles the comparison without the secret, so
+	// only an otherwise matching credential is left indeterminate
+	if username != "" && username != input.Username {
+		return authStatusDiffers, ""
+	}
+
+	if entry.IdentityToken != "" {
+		return authStatusUnknown, fmt.Sprintf("Unable to compare the credential for %s: it is stored as an identity token", input.Server)
+	}
+
+	return authStatusUnknown, fmt.Sprintf("Unable to compare the credential for %s: no password is stored for it", input.Server)
+}
+
+// authServersFromConfig returns the sorted registry servers a docker config
+// holds credentials for, named as they would be passed to registry:login
+func authServersFromConfig(config dockerConfigFile) []string {
+	servers := []string{}
+	seen := map[string]bool{}
+	for key := range config.Auths {
+		server := convertToHostname(key)
+		if dockerAuthKey(key) == dockerIndexServer {
+			server = "docker.io"
+		}
+
+		if server == "" || seen[server] {
+			continue
+		}
+
+		seen[server] = true
+		servers = append(servers, server)
+	}
+
+	sort.Strings(servers)
+	return servers
+}
diff --git a/plugins/registry/auth_status_test.go b/plugins/registry/auth_status_test.go
new file mode 100644
index 000000000..921a3b87a
--- /dev/null
+++ b/plugins/registry/auth_status_test.go
@@ -0,0 +1,138 @@
+package registry
+
+import (
+	"encoding/base64"
+	"fmt"
+	"reflect"
+	"strings"
+	"testing"
+)
+
+func encodeAuth(value string) string {
+	return base64.StdEncoding.EncodeToString([]byte(value))
+}
+
+func hubConfig() string {
+	return fmt.Sprintf(`{"auths":{"https://index.docker.io/v1/":{"auth":%q}}}`, encodeAuth("user:pass"))
+}
+
+func TestCheckAuthStatus(t *testing.T) {
+	cases := []struct {
+		name     string
+		config   string
+		server   string
+		username string
+		password string
+		want     int
+	}{
+		{"no config with credential", "", "docker.io", "user", "pass", authStatusMissing},
+		{"no config without credential", "", "docker.io", "", "", authStatusMatch},
+		{"empty auths after logout", `{"auths":{}}`, "docker.io", "user", "pass", authStatusMissing},
+		{"empty auths without credential", `{"auths":{}}`, "docker.io", "", "", authStatusMatch},
+
+		{"hub via docker.io", hubConfig(), "docker.io", "user", "pass", authStatusMatch},
+		{"hub via hub.docker.com", hubConfig(), "hub.docker.com", "user", "pass", authStatusMatch},
+		{"hub via docker.com", hubConfig(), "docker.com", "user", "pass", authStatusMatch},
+		{"hub via index.docker.io", hubConfig(), "index.docker.io", "user", "pass", authStatusMatch},
+		{"hub via index server address", hubConfig(), dockerIndexServer, "user", "pass", authStatusMatch},
+		// docker stores registry-1.docker.io under its own key, so a hub
+		// credential must not be reported as covering it
+		{"registry-1.docker.io is not hub", hubConfig(), "registry-1.docker.io", "user", "pass", authStatusMissing},
+		{"wrong password", hubConfig(), "docker.io", "user", "wrong", authStatusDiffers},
+		{"wrong username", hubConfig(), "docker.io", "other", "pass", authStatusDiffers},
+		{"no username with credential stored", hubConfig(), "docker.io", "", "", authStatusDiffers},
+		{"unrelated server", hubConfig(), "ghcr.io", "user", "pass", authStatusMissing},
+
+		{"other registry exact key", fmt.Sprintf(`{"auths":{"ghcr.io":{"auth":%q}}}`, encodeAuth("user:pass")), "ghcr.io", "user", "pass", authStatusMatch},
+		{"other registry legacy key", fmt.Sprintf(`{"auths":{"https://ghcr.io/v1/":{"auth":%q}}}`, encodeAuth("user:pass")), "ghcr.io", "user", "pass", authStatusMatch},
+		{"registry with port", fmt.Sprintf(`{"auths":{"localhost:5000":{"auth":%q}}}`, encodeAuth("user:pass")), "localhost:5000", "user", "pass", authStatusMatch},
+		{"password containing a colon", fmt.Sprintf(`{"auths":{"ghcr.io":{"auth":%q}}}`, encodeAuth("user:pa:ss")), "ghcr.io", "user", "pa:ss", authStatusMatch},
+		{"plaintext username and password fields", `{"auths":{"ghcr.io":{"username":"user","password":"pass"}}}`, "ghcr.io", "user", "pass", authStatusMatch},
+
+		{"identity token with matching username", fmt.Sprintf(`{"auths":{"ghcr.io":{"auth":%q,"identitytoken":"token"}}}`, encodeAuth("user:")), "ghcr.io", "user", "pass", authStatusUnknown},
+		{"identity token with differing username", fmt.Sprintf(`{"auths":{"ghcr.io":{"auth":%q,"identitytoken":"token"}}}`, encodeAuth("user:")), "ghcr.io", "other", "pass", authStatusDiffers},
+		{"identity token without credential", fmt.Sprintf(`{"auths":{"ghcr.io":{"auth":%q,"identitytoken":"token"}}}`, encodeAuth("user:")), "ghcr.io", "", "", authStatusDiffers},
+
+		{"credsStore holds the secret", `{"auths":{"ghcr.io":{}},"credsStore":"secretservice"}`, "ghcr.io", "user", "pass", authStatusUnknown},
+		{"credsStore without credential", `{"auths":{"ghcr.io":{}},"credsStore":"secretservice"}`, "ghcr.io", "", "", authStatusDiffers},
+		{"credHelpers for this server", fmt.Sprintf(`{"auths":{"ghcr.io":{"auth":%q}},"credHelpers":{"ghcr.io":"ecr-login"}}`, encodeAuth("user:pass")), "ghcr.io", "user", "pass", authStatusUnknown},
+		{"credHelpers for another server", fmt.Sprintf(`{"auths":{"ghcr.io":{"auth":%q}},"credHelpers":{"other.io":"ecr-login"}}`, encodeAuth("user:pass")), "ghcr.io", "user", "pass", authStatusMatch},
+		{"credHelpers keyed by hub index server", `{"auths":{"https://index.docker.io/v1/":{}},"credHelpers":{"https://index.docker.io/v1/":"desktop"}}`, "docker.io", "user", "pass", authStatusUnknown},
+
+		{"empty entry", `{"auths":{"ghcr.io":{}}}`, "ghcr.io", "user", "pass", authStatusUnknown},
+		{"undecodable auth", `{"auths":{"ghcr.io":{"auth":"!!!not base64!!!"}}}`, "ghcr.io", "user", "pass", authStatusUnknown},
+		{"auth without a separator", fmt.Sprintf(`{"auths":{"ghcr.io":{"auth":%q}}}`, encodeAuth("nocolon")), "ghcr.io", "user", "pass", authStatusUnknown},
+		{"invalid json", `{`, "ghcr.io", "user", "pass", authStatusUnknown},
+		{"auths is not an object", `{"auths":"nope"}`, "ghcr.io", "user", "pass", authStatusUnknown},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			var contents []byte
+			if tc.config != "" {
+				contents = []byte(tc.config)
+			}
+
+			got, message := checkAuthStatus(authStatusInput{
+				ConfigBytes: contents,
+				Server:      tc.server,
+				Username:    tc.username,
+				Password:    tc.password,
+			})
+			if got != tc.want {
+				t.Errorf("checkAuthStatus() = %d, want %d", got, tc.want)
+			}
+			if got == authStatusUnknown && message == "" {
+				t.Error("checkAuthStatus() returned no reason for an unreadable credential")
+			}
+			if got != authStatusUnknown && message != "" {
+				t.Errorf("checkAuthStatus() returned an unexpected message: %s", message)
+			}
+		})
+	}
+}
+
+func TestCheckAuthStatusDoesNotLeakCredentials(t *testing.T) {
+	_, message := checkAuthStatus(authStatusInput{
+		ConfigBytes: []byte(`{"auths":{"ghcr.io":{}},"credsStore":"secretservice"}`),
+		Server:      "ghcr.io",
+		Username:    "user",
+		Password:    "supersecret",
+	})
+	if message == "" {
+		t.Fatal("expected a reason to be reported")
+	}
+	for _, secret := range []string{"supersecret", "user"} {
+		if strings.Contains(message, secret) {
+			t.Errorf("message %q leaks %q", message, secret)
+		}
+	}
+}
+
+func TestAuthServersFromConfig(t *testing.T) {
+	cases := []struct {
+		name   string
+		config string
+		want   []string
+	}{
+		{"no config", "", []string{}},
+		{"no credentials", `{"auths":{}}`, []string{}},
+		{"hub rendered as docker.io", hubConfig(), []string{"docker.io"}},
+		{"sorted across registries", `{"auths":{"quay.io":{},"ghcr.io":{},"https://index.docker.io/v1/":{}}}`, []string{"docker.io", "ghcr.io", "quay.io"}},
+		{"legacy keys reduced to hostnames", `{"auths":{"https://ghcr.io/v1/":{}}}`, []string{"ghcr.io"}},
+		{"duplicate hub keys collapsed", `{"auths":{"https://index.docker.io/v1/":{},"docker.io":{}}}`, []string{"docker.io"}},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			config, err := parseDockerConfig([]byte(tc.config))
+			if err != nil {
+				t.Fatalf("parseDockerConfig() errored: %s", err)
+			}
+
+			if got := authServersFromConfig(config); !reflect.DeepEqual(got, tc.want) {
+				t.Errorf("authServersFromConfig() = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
diff --git a/plugins/registry/concurrency_test.go b/plugins/registry/concurrency_test.go
new file mode 100644
index 000000000..561e98631
--- /dev/null
+++ b/plugins/registry/concurrency_test.go
@@ -0,0 +1,46 @@
+package registry
+
+import (
+	"errors"
+	"os/user"
+	"sort"
+	"sync"
+	"testing"
+)
+
+func TestIncrementTagVersionConcurrent(t *testing.T) {
+	t.Setenv("DOKKU_LIB_ROOT", t.TempDir())
+	current, err := user.Current()
+	if err != nil {
+		t.Fatalf("user.Current: %v", err)
+	}
+	group, err := user.LookupGroupId(current.Gid)
+	if err != nil {
+		t.Fatalf("user.LookupGroupId: %v", err)
+	}
+	t.Setenv("DOKKU_SYSTEM_USER", current.Username)
+	t.Setenv("DOKKU_SYSTEM_GROUP", group.Name)
+
+	const count = 20
+	var wg sync.WaitGroup
+	versions := make([]int, count)
+	errs := make([]error, count)
+	for i := 0; i < count; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			versions[i], errs[i] = incrementTagVersion("race-test")
+		}(i)
+	}
+	wg.Wait()
+	if err := errors.Join(errs...); err != nil {
+		t.Fatalf("incrementTagVersion: %v", err)
+	}
+
+	sort.Ints(versions)
+	for i, version := range versions {
+		if version != i+1 {
+			t.Fatalf("versions = %v, want 1 through %d with no duplicates", versions, count)
+		}
+	}
+}
diff --git a/plugins/registry/functions.go b/plugins/registry/functions.go
index bad7f668b..7e531f41d 100644
--- a/plugins/registry/functions.go
+++ b/plugins/registry/functions.go
@@ -2,7 +2,6 @@ package registry
 
 import (
 	"bytes"
-	"encoding/json"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -15,6 +14,9 @@ import (
 
 const registryConfigDir = "/var/lib/dokku/config/registry"
 
+// dockerIndexServer is the auths key docker stores Docker Hub credentials under
+const dockerIndexServer = "https://index.docker.io/v1/"
+
 // GetAppRegistryConfigDir returns the per-app registry config directory
 func GetAppRegistryConfigDir(appName string) string {
 	return filepath.Join(registryConfigDir, appName)
@@ -30,9 +32,19 @@ func GetComputedAppRegistryConfigDir(appName string) string {
 		return GetAppRegistryConfigDir(appName)
 	}
 
+	return GetGlobalRegistryConfigDir()
+}
+
+// GetGlobalRegistryConfigDir returns the docker config directory global logins write to
+func GetGlobalRegistryConfigDir() string {
 	return filepath.Join(os.Getenv("DOKKU_ROOT"), ".docker")
 }
 
+// GetGlobalRegistryConfigPath returns the path to the global docker config.json
+func GetGlobalRegistryConfigPath() string {
+	return filepath.Join(GetGlobalRegistryConfigDir(), "config.json")
+}
+
 // HasAppRegistryAuth checks if an app has registry credentials configured
 func HasAppRegistryAuth(appName string) bool {
 	configPath := GetAppRegistryConfigPath(appName)
@@ -45,13 +57,12 @@ func HasAppRegistryAuth(appName string) bool {
 		return false
 	}
 
-	var config map[string]interface{}
-	if err := json.Unmarshal(content, &config); err != nil {
+	config, err := parseDockerConfig(content)
+	if err != nil {
 		return false
 	}
 
-	auths, ok := config["auths"].(map[string]interface{})
-	return ok && len(auths) > 0
+	return len(config.Auths) > 0
 }
 
 // GetDockerConfigArgs returns docker --config arguments if per-app config exists
@@ -112,21 +123,28 @@ func isPushEnabled(appName string) bool {
 	return reportComputedPushOnRelease(appName) == "true"
 }
 
+// incrementTagVersion bumps the app's tag version and returns the new value,
+// holding the app's registry property lock across the read and the write so
+// concurrent releases never hand out the same version.
 func incrementTagVersion(appName string) (int, error) {
-	tag := common.PropertyGet("registry", appName, "tag-version")
-	if tag == "" {
-		tag = "0"
-	}
+	version := 0
+	err := common.PropertyLock("registry", appName, func(p *common.LockedProperties) error {
+		tag := common.PropertyGet("registry", appName, "tag-version")
+		if tag == "" {
+			tag = "0"
+		}
 
-	tag = strings.TrimSpace(tag)
-	version, err := strconv.Atoi(tag)
+		tag = strings.TrimSpace(tag)
+		current, err := strconv.Atoi(tag)
+		if err != nil {
+			return fmt.Errorf("Unable to convert existing tag version (%s) to integer: %v", tag, err)
+		}
+
+		version = current + 1
+		common.LogVerboseQuiet(fmt.Sprintf("Bumping tag to %d", version))
+		return p.Write("tag-version", strconv.Itoa(version))
+	})
 	if err != nil {
-		return 0, fmt.Errorf("Unable to convert existing tag version (%s) to integer: %v", tag, err)
-	}
-
-	version++
-	common.LogVerboseQuiet(fmt.Sprintf("Bumping tag to %d", version))
-	if err = common.PropertyWrite("registry", appName, "tag-version", strconv.Itoa(version)); err != nil {
 		return 0, err
 	}
 
@@ -245,3 +263,38 @@ func imageCleanup(appName string, imageRepo string, imageTag string, tag int) {
 	imagesToRemove = append(imagesToRemove, imageIDs...)
 	common.RemoveImages(imagesToRemove)
 }
+
+// normalizeRegistryServer applies the dokku-level aliases for a registry server
+func normalizeRegistryServer(server string) string {
+	if server == "hub.docker.com" || server == "docker.com" {
+		return "docker.io"
+	}
+
+	return server
+}
+
+// convertToHostname strips any scheme and path from a registry server, matching
+// the rule docker applies before storing or looking up a credential
+func convertToHostname(server string) string {
+	stripped := server
+	if strings.HasPrefix(stripped, "http://") {
+		stripped = strings.TrimPrefix(stripped, "http://")
+	} else if strings.HasPrefix(stripped, "https://") {
+		stripped = strings.TrimPrefix(stripped, "https://")
+	}
+
+	return strings.SplitN(stripped, "/", 2)[0]
+}
+
+// dockerAuthKey returns the key docker uses for a registry server in the auths
+// map of a config.json. Docker Hub is stored under the index server address
+// rather than the hostname the user logged in with, and is also the only server
+// docker treats that way: registry-1.docker.io gets a key of its own.
+func dockerAuthKey(server string) string {
+	hostname := convertToHostname(normalizeRegistryServer(server))
+	if hostname == "" || hostname == "docker.io" || hostname == "index.docker.io" {
+		return dockerIndexServer
+	}
+
+	return hostname
+}
diff --git a/plugins/registry/functions_test.go b/plugins/registry/functions_test.go
new file mode 100644
index 000000000..0a8812f90
--- /dev/null
+++ b/plugins/registry/functions_test.go
@@ -0,0 +1,79 @@
+package registry
+
+import "testing"
+
+func TestNormalizeRegistryServer(t *testing.T) {
+	cases := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{"hub.docker.com alias", "hub.docker.com", "docker.io"},
+		{"docker.com alias", "docker.com", "docker.io"},
+		{"docker.io untouched", "docker.io", "docker.io"},
+		{"other registry untouched", "ghcr.io", "ghcr.io"},
+		{"empty untouched", "", ""},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := normalizeRegistryServer(tc.in); got != tc.want {
+				t.Errorf("normalizeRegistryServer(%q) = %q, want %q", tc.in, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestConvertToHostname(t *testing.T) {
+	cases := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{"bare hostname", "ghcr.io", "ghcr.io"},
+		{"https scheme", "https://ghcr.io", "ghcr.io"},
+		{"http scheme", "http://ghcr.io", "ghcr.io"},
+		{"scheme and path", "https://index.docker.io/v1/", "index.docker.io"},
+		{"trailing slash", "ghcr.io/", "ghcr.io"},
+		{"port preserved", "localhost:5000", "localhost:5000"},
+		{"port with scheme and path", "https://localhost:5000/v2/", "localhost:5000"},
+		{"empty", "", ""},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := convertToHostname(tc.in); got != tc.want {
+				t.Errorf("convertToHostname(%q) = %q, want %q", tc.in, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestDockerAuthKey(t *testing.T) {
+	cases := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{"docker.io", "docker.io", dockerIndexServer},
+		{"hub.docker.com", "hub.docker.com", dockerIndexServer},
+		{"docker.com", "docker.com", dockerIndexServer},
+		{"index.docker.io", "index.docker.io", dockerIndexServer},
+		{"index server address", dockerIndexServer, dockerIndexServer},
+		{"empty server", "", dockerIndexServer},
+		// docker does not treat registry-1.docker.io as the official index and
+		// stores it under a key of its own
+		{"registry-1.docker.io is not the index", "registry-1.docker.io", "registry-1.docker.io"},
+		{"other registry", "ghcr.io", "ghcr.io"},
+		{"other registry with scheme", "https://ghcr.io/v2/", "ghcr.io"},
+		{"registry with port", "localhost:5000", "localhost:5000"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := dockerAuthKey(tc.in); got != tc.want {
+				t.Errorf("dockerAuthKey(%q) = %q, want %q", tc.in, got, tc.want)
+			}
+		})
+	}
+}
diff --git a/plugins/registry/go.mod b/plugins/registry/go.mod
index faac5eae2..ca382c6ad 100644
--- a/plugins/registry/go.mod
+++ b/plugins/registry/go.mod
@@ -1,29 +1,29 @@
 module github.com/dokku/dokku/plugins/registry
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/registry/go.sum b/plugins/registry/go.sum
index 14bf42b1c..9ada61068 100644
--- a/plugins/registry/go.sum
+++ b/plugins/registry/go.sum
@@ -1,25 +1,24 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -28,28 +27,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/registry/plugin.toml b/plugins/registry/plugin.toml
index 0bb17dba5..c4480961f 100644
--- a/plugins/registry/plugin.toml
+++ b/plugins/registry/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core registry plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/registry/report.go b/plugins/registry/report.go
index c63387940..824134970 100644
--- a/plugins/registry/report.go
+++ b/plugins/registry/report.go
@@ -1,6 +1,8 @@
 package registry
 
 import (
+	"os"
+	"path/filepath"
 	"strings"
 
 	"github.com/dokku/dokku/plugins/common"
@@ -17,6 +19,8 @@ func ReportSingleApp(appName string, format string, infoFlag string) error {
 	var flags map[string]common.ReportFunc
 	if appName == "--global" {
 		flags = map[string]common.ReportFunc{
+			"--registry-computed-auth-servers":        reportComputedAuthServers,
+			"--registry-global-auth-servers":          reportGlobalAuthServers,
 			"--registry-computed-push-on-release":     reportComputedPushOnRelease,
 			"--registry-global-push-on-release":       reportGlobalPushOnRelease,
 			"--registry-computed-server":              reportComputedServer,
@@ -28,6 +32,9 @@ func ReportSingleApp(appName string, format string, infoFlag string) error {
 		}
 	} else {
 		flags = map[string]common.ReportFunc{
+			"--registry-auth-servers":                 reportAuthServers,
+			"--registry-computed-auth-servers":        reportComputedAuthServers,
+			"--registry-global-auth-servers":          reportGlobalAuthServers,
 			"--registry-computed-image-repo":          reportComputedImageRepo,
 			"--registry-image-repo":                   reportImageRepo,
 			"--registry-computed-push-on-release":     reportComputedPushOnRelease,
@@ -156,3 +163,36 @@ func reportComputedPushExtraTags(appName string) string {
 	}
 	return value
 }
+
+// reportAuthServers lists the servers the app has its own credentials for
+func reportAuthServers(appName string) string {
+	return authServersFromConfigPath(GetAppRegistryConfigPath(appName))
+}
+
+// reportGlobalAuthServers lists the servers the global config has credentials for
+func reportGlobalAuthServers(appName string) string {
+	return authServersFromConfigPath(GetGlobalRegistryConfigPath())
+}
+
+// reportComputedAuthServers lists the servers whose credentials dokku would use
+// for the app. Docker is pointed at one config directory or the other rather
+// than a merge of both, so an app with any credential of its own shadows the
+// global config entirely.
+func reportComputedAuthServers(appName string) string {
+	return authServersFromConfigPath(filepath.Join(GetComputedAppRegistryConfigDir(appName), "config.json"))
+}
+
+// authServersFromConfigPath lists the servers a docker config holds credentials for
+func authServersFromConfigPath(configPath string) string {
+	contents, err := os.ReadFile(configPath)
+	if err != nil {
+		return ""
+	}
+
+	config, err := parseDockerConfig(contents)
+	if err != nil {
+		return ""
+	}
+
+	return strings.Join(authServersFromConfig(config), ",")
+}
diff --git a/plugins/registry/src/commands/commands.go b/plugins/registry/src/commands/commands.go
index 247acee0a..b1a67ce6f 100644
--- a/plugins/registry/src/commands/commands.go
+++ b/plugins/registry/src/commands/commands.go
@@ -18,6 +18,7 @@ Manage registry settings for an app
 Additional commands:`
 
 	helpContent = `
+    registry:auth-status [--password-stdin] <app>|--global <server> [<username> [<password>]], Reports whether the stored registry credential matches the requested state (exit 0 if matches)
     registry:login [--global|--password-stdin] [<app>] <server> <username> [<password>], Login to a docker registry
     registry:logout [--global] [<app>] <server>, Logout from a docker registry
     registry:report [<app>] [<flag>], Displays a registry report for one or more apps
diff --git a/plugins/registry/src/subcommands/subcommands.go b/plugins/registry/src/subcommands/subcommands.go
index c8fa06479..f43186060 100644
--- a/plugins/registry/src/subcommands/subcommands.go
+++ b/plugins/registry/src/subcommands/subcommands.go
@@ -1,7 +1,9 @@
 package main
 
 import (
+	"errors"
 	"fmt"
+	"io"
 	"os"
 	"strings"
 
@@ -18,6 +20,40 @@ func main() {
 
 	var err error
 	switch subcommand {
+	case "auth-status":
+		// the result of this command is its exit code, so parse errors must not
+		// be left to pflag: ExitOnError exits 2 on an unknown flag, which this
+		// command defines as a differing credential, and 0 on --help
+		args := flag.NewFlagSet("registry:auth-status", flag.ContinueOnError)
+		args.SetOutput(io.Discard)
+		passwordStdin := args.Bool("password-stdin", false, "--password-stdin: read password from stdin")
+		global := args.Bool("global", false, "--global: check the global registry credentials")
+		if parseErr := args.Parse(os.Args[2:]); parseErr != nil {
+			message := parseErr.Error()
+			if errors.Is(parseErr, flag.ErrHelp) {
+				message = "Usage: dokku registry:auth-status [--password-stdin] <app>|--global <server> [<username> [<password>]]"
+			}
+
+			common.LogFailWithError(registry.InvalidAuthStatusArguments(message))
+		}
+
+		var appName, server, username, password string
+		offset := 0
+		if !*global {
+			appName = args.Arg(0)
+			offset = 1
+			if appName == "" {
+				common.LogFailWithError(registry.InvalidAuthStatusArguments("Please specify an app or the --global flag"))
+			}
+		}
+
+		server = args.Arg(offset)
+		username = args.Arg(offset + 1)
+		if !*passwordStdin {
+			password = args.Arg(offset + 2)
+		}
+
+		err = registry.CommandAuthStatus(appName, server, username, password, *passwordStdin)
 	case "login":
 		args := flag.NewFlagSet("registry:login", flag.ExitOnError)
 		passwordStdin := args.Bool("password-stdin", false, "--password-stdin: read password from stdin")
diff --git a/plugins/registry/subcommands.go b/plugins/registry/subcommands.go
index 6c97ebd2f..9d13d86ce 100644
--- a/plugins/registry/subcommands.go
+++ b/plugins/registry/subcommands.go
@@ -11,15 +11,92 @@ import (
 	"github.com/dokku/dokku/plugins/common"
 )
 
+// readPasswordFromStdin reads a registry password from stdin
+func readPasswordFromStdin() (string, error) {
+	stdin, err := io.ReadAll(os.Stdin)
+	if err != nil {
+		return "", err
+	}
+
+	return strings.TrimSpace(string(stdin)), nil
+}
+
+// CommandAuthStatus reports whether the stored registry credential matches the
+// requested state, communicating the result via the exit code alone
+func CommandAuthStatus(appName string, server string, username string, password string, passwordStdin bool) error {
+	if passwordStdin {
+		if username == "" {
+			return InvalidAuthStatusArguments("Missing username argument")
+		}
+
+		stdin, err := readPasswordFromStdin()
+		if err != nil {
+			return InvalidAuthStatusArguments(err.Error())
+		}
+
+		password = stdin
+	}
+
+	if server == "" {
+		return InvalidAuthStatusArguments("Missing server argument")
+	}
+	if username != "" && password == "" {
+		return InvalidAuthStatusArguments("Missing password argument")
+	}
+	if username == "" && password != "" {
+		return InvalidAuthStatusArguments("Missing username argument")
+	}
+
+	configPath := GetGlobalRegistryConfigPath()
+	if appName != "" {
+		if err := common.VerifyAppName(appName); err != nil {
+			// a missing app carries its own exit code, while an invalid name is
+			// a malformed call and must not be reported as a missing credential
+			if _, ok := err.(common.ErrWithExitCode); ok {
+				return err
+			}
+
+			return InvalidAuthStatusArguments(err.Error())
+		}
+
+		configPath = GetAppRegistryConfigPath(appName)
+	}
+
+	contents, err := os.ReadFile(configPath)
+	if err != nil && !os.IsNotExist(err) {
+		return &common.ExitCodeError{
+			Code:    authStatusUnknown,
+			Message: fmt.Sprintf("Unable to read the docker config: %s", err.Error()),
+		}
+	}
+
+	code, message := checkAuthStatus(authStatusInput{
+		ConfigBytes: contents,
+		Server:      server,
+		Username:    username,
+		Password:    password,
+	})
+	if code == authStatusMatch {
+		return nil
+	}
+
+	return &common.ExitCodeError{Code: code, Message: message}
+}
+
+// InvalidAuthStatusArguments reports a registry:auth-status call that could not be checked
+func InvalidAuthStatusArguments(message string) error {
+	return &common.ExitCodeError{Code: authStatusInvalidArguments, Message: message}
+}
+
 // CommandLogin logs a user into the specified server
 func CommandLogin(appName string, server string, username string, password string, passwordStdin bool) error {
 	if passwordStdin {
-		stdin, err := io.ReadAll(os.Stdin)
+		stdin, err := readPasswordFromStdin()
 		if err != nil {
 			return err
 		}
 
-		password = strings.TrimSpace(string(stdin))
+		password = stdin
 	}
 
 	if server == "" {
@@ -32,9 +109,7 @@ func CommandLogin(appName string, server string, username string, password strin
 		return errors.New("Missing password argument")
 	}
 
-	if server == "hub.docker.com" || server == "docker.com" {
-		server = "docker.io"
-	}
+	server = normalizeRegistryServer(server)
 
 	buffer := bytes.Buffer{}
 	buffer.Write([]byte(password + "\n"))
@@ -51,7 +126,7 @@ func CommandLogin(appName string, server string, username string, password strin
 		env["DOCKER_CONFIG"] = GetAppRegistryConfigDir(appName)
 	}
 
-	result, err := common.CallExecCommand(common.ExecCommandInput{
+	result, err := execDockerConfigCommand(env["DOCKER_CONFIG"], common.ExecCommandInput{
 		Command: common.DockerBin(),
 		Args:    []string{"login", "--username", username, "--password-stdin", server},
 		Env:     env,
@@ -92,9 +167,10 @@ func CommandLogout(appName string, server string) error {
 		return errors.New("Missing server argument")
 	}
 
-	if server == "hub.docker.com" || server == "docker.com" {
-		server = "docker.io"
-	}
+	// docker only erases the exact auths key it is given, and stores Docker Hub
+	// under the index server address rather than the hostname logged in with, so
+	// a logout for docker.io has to name that address to remove anything
+	server = dockerAuthKey(server)
 
 	env := map[string]string{}
 	if appName != "" {
@@ -108,7 +184,7 @@ func CommandLogout(appName string, server string) error {
 		env["DOCKER_CONFIG"] = GetAppRegistryConfigDir(appName)
 	}
 
-	result, err := common.CallExecCommand(common.ExecCommandInput{
+	result, err := execDockerConfigCommand(env["DOCKER_CONFIG"], common.ExecCommandInput{
 		Command: common.DockerBin(),
 		Args:    []string{"logout", server},
 		Env:     env,
@@ -150,3 +226,22 @@ func CommandSet(appName string, property string, value string) error {
 	common.CommandPropertySet("registry", appName, property, value, DefaultProperties, GlobalProperties)
 	return nil
 }
+
+// execDockerConfigCommand runs a docker command that rewrites the credentials
+// file in configDir. docker merges the file it reads with the change it makes,
+// so the directory stays locked for the whole command to keep concurrent logins
+// and logouts for one app from dropping each other's credentials. An empty
+// configDir means docker's own config, which is left unlocked.
+func execDockerConfigCommand(configDir string, input common.ExecCommandInput) (common.ExecCommandResponse, error) {
+	if configDir == "" {
+		return common.CallExecCommand(input)
+	}
+
+	var result common.ExecCommandResponse
+	err := common.LockDirectory(configDir, func() error {
+		var err error
+		result, err = common.CallExecCommand(input)
+		return err
+	})
+	return result, err
+}
diff --git a/plugins/repo/Makefile b/plugins/repo/Makefile
index 0af946983..0bee4827b 100644
--- a/plugins/repo/Makefile
+++ b/plugins/repo/Makefile
@@ -1,5 +1,5 @@
 SUBCOMMANDS = subcommands/gc subcommands/purge-cache
-TRIGGERS = triggers/post-stack-set triggers/post-delete
+TRIGGERS = triggers/post-stack-set triggers/post-delete triggers/repo-purge-cache
 BUILD = commands subcommands triggers
 PLUGIN_NAME = repo
 
diff --git a/plugins/repo/go.mod b/plugins/repo/go.mod
index 0da9b1e0d..e361db679 100644
--- a/plugins/repo/go.mod
+++ b/plugins/repo/go.mod
@@ -1,29 +1,29 @@
 module github.com/dokku/dokku/plugins/repo
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/repo/go.sum b/plugins/repo/go.sum
index 14bf42b1c..9ada61068 100644
--- a/plugins/repo/go.sum
+++ b/plugins/repo/go.sum
@@ -1,25 +1,24 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -28,28 +27,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/repo/plugin.toml b/plugins/repo/plugin.toml
index 6170e9264..e7c8616f6 100644
--- a/plugins/repo/plugin.toml
+++ b/plugins/repo/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core repo plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/repo/src/triggers/triggers.go b/plugins/repo/src/triggers/triggers.go
index 63c4b468b..b9bd1e82e 100644
--- a/plugins/repo/src/triggers/triggers.go
+++ b/plugins/repo/src/triggers/triggers.go
@@ -24,6 +24,9 @@ func main() {
 	case "post-delete":
 		appName := flag.Arg(0)
 		err = repo.PurgeCache(appName)
+	case "repo-purge-cache":
+		appName := flag.Arg(0)
+		err = repo.PurgeCache(appName)
 	default:
 		err = fmt.Errorf("Invalid plugin trigger call: %s", trigger)
 	}
diff --git a/plugins/resource/functions.go b/plugins/resource/functions.go
index ef382605d..ff593f994 100644
--- a/plugins/resource/functions.go
+++ b/plugins/resource/functions.go
@@ -7,20 +7,45 @@ import (
 	"github.com/dokku/dokku/plugins/common"
 )
 
-func addMemorySuffixForDocker(key string, value string) string {
-	if key == "memory" {
-		hasSuffix := false
-		suffixes := []string{"b", "k", "m", "g", "KB", "MB", "GB", "B"}
-		for _, suffix := range suffixes {
-			if strings.HasSuffix(value, suffix) {
-				hasSuffix = true
-			}
+// validateResourceValue returns an error if the value is not valid for the given resource key
+func validateResourceValue(key string, value string) error {
+	switch key {
+	case "memory":
+		if !common.IsValidMemoryValue(value) {
+			return fmt.Errorf("Invalid memory value '%s': must be a number with an optional unit suffix of b, k, m, g, t or p", value)
 		}
-		if !hasSuffix {
-			value = value + "m"
+	case "memory-swap":
+		if value != "-1" && !common.IsValidMemoryValue(value) {
+			return fmt.Errorf("Invalid memory-swap value '%s': must be -1 or a number with an optional unit suffix of b, k, m, g, t or p", value)
 		}
 	}
-	return value
+
+	return nil
+}
+
+// formatResourceValueForDocker validates a resource value and formats it for use as a docker flag value.
+// Memory values without a unit default to megabytes
+func formatResourceValueForDocker(key string, value string) (string, error) {
+	if err := validateResourceValue(key, value); err != nil {
+		return "", err
+	}
+
+	if key == "memory" && common.IsUnitlessMemoryValue(value) {
+		value = value + "m"
+	}
+
+	return value, nil
+}
+
+// isResourceTypeKey returns true if the property key is a `<process>.<resource-type>.<resource>` key
+// for the given resource type. The process type may contain dots, so the key is matched from the right
+func isResourceTypeKey(key string, resourceType string) bool {
+	parts := strings.Split(key, ".")
+	if len(parts) < 3 {
+		return false
+	}
+
+	return parts[len(parts)-2] == resourceType
 }
 
 func clearByResourceType(appName string, processType string, resourceType string) {
@@ -41,6 +66,9 @@ func clearByResourceType(appName string, processType string, resourceType string
 			return
 		}
 		for key := range resources {
+			if !isResourceTypeKey(key, resourceType) {
+				continue
+			}
 			common.PropertyDelete("resource", appName, key)
 		}
 	} else {
@@ -88,6 +116,16 @@ func setResourceType(appName string, processType string, r Resource, resourceTyp
 		return nil
 	}
 
+	for key, value := range resources {
+		if value == "" || value == "clear" {
+			continue
+		}
+
+		if err := validateResourceValue(key, value); err != nil {
+			return err
+		}
+	}
+
 	noun := "limits"
 	if resourceType == "reserve" {
 		noun = "reservation"
diff --git a/plugins/resource/functions_test.go b/plugins/resource/functions_test.go
new file mode 100644
index 000000000..ebac769fc
--- /dev/null
+++ b/plugins/resource/functions_test.go
@@ -0,0 +1,82 @@
+package resource
+
+import (
+	"testing"
+)
+
+func TestFormatResourceValueForDocker(t *testing.T) {
+	testCases := []struct {
+		name     string
+		key      string
+		value    string
+		expected string
+		wantErr  bool
+	}{
+		{name: "unitless memory defaults to megabytes", key: "memory", value: "100", expected: "100m"},
+		{name: "unitless decimal memory defaults to megabytes", key: "memory", value: "1.5", expected: "1.5m"},
+		{name: "lowercase memory unit", key: "memory", value: "512m", expected: "512m"},
+		{name: "uppercase megabyte unit", key: "memory", value: "512M", expected: "512M"},
+		{name: "uppercase gigabyte unit", key: "memory", value: "1G", expected: "1G"},
+		{name: "uppercase kilobyte unit", key: "memory", value: "1024K", expected: "1024K"},
+		{name: "terabyte unit", key: "memory", value: "1t", expected: "1t"},
+		{name: "two letter unit", key: "memory", value: "512MB", expected: "512MB"},
+		{name: "binary unit", key: "memory", value: "1GiB", expected: "1GiB"},
+		{name: "byte unit", key: "memory", value: "100b", expected: "100b"},
+		{name: "memory rejects negative values", key: "memory", value: "-1", wantErr: true},
+		{name: "memory rejects extra arguments", key: "memory", value: "100G --foo", wantErr: true},
+		{name: "memory rejects invalid units", key: "memory", value: "1Gm", wantErr: true},
+		{name: "unlimited memory-swap", key: "memory-swap", value: "-1", expected: "-1"},
+		{name: "unitless memory-swap stays in bytes", key: "memory-swap", value: "512", expected: "512"},
+		{name: "uppercase memory-swap unit", key: "memory-swap", value: "2G", expected: "2G"},
+		{name: "memory-swap rejects invalid units", key: "memory-swap", value: "1x", wantErr: true},
+		{name: "memory-swap rejects other negative values", key: "memory-swap", value: "-2", wantErr: true},
+		{name: "other keys are passed through", key: "cpus", value: "1.5", expected: "1.5"},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			value, err := formatResourceValueForDocker(testCase.key, testCase.value)
+			if testCase.wantErr {
+				if err == nil {
+					t.Fatalf("expected an error for %s=%s, got %s", testCase.key, testCase.value, value)
+				}
+				return
+			}
+
+			if err != nil {
+				t.Fatalf("unexpected error for %s=%s: %v", testCase.key, testCase.value, err)
+			}
+
+			if value != testCase.expected {
+				t.Fatalf("expected %s, got %s", testCase.expected, value)
+			}
+		})
+	}
+}
+
+func TestIsResourceTypeKey(t *testing.T) {
+	testCases := []struct {
+		name         string
+		key          string
+		resourceType string
+		expected     bool
+	}{
+		{name: "default limit key", key: "_default_.limit.memory", resourceType: "limit", expected: true},
+		{name: "process limit key", key: "web.limit.cpu", resourceType: "limit", expected: true},
+		{name: "process reserve key", key: "web.reserve.memory", resourceType: "reserve", expected: true},
+		{name: "dotted process type", key: "foo.bar.limit.memory", resourceType: "limit", expected: true},
+		{name: "reserve key does not match limit", key: "_default_.reserve.memory", resourceType: "limit", expected: false},
+		{name: "limit key does not match reserve", key: "web.limit.memory", resourceType: "reserve", expected: false},
+		{name: "key without process type", key: "limit.memory", resourceType: "limit", expected: false},
+		{name: "key with a single part", key: "limit", resourceType: "limit", expected: false},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			value := isResourceTypeKey(testCase.key, testCase.resourceType)
+			if value != testCase.expected {
+				t.Fatalf("expected %v for %s/%s, got %v", testCase.expected, testCase.key, testCase.resourceType, value)
+			}
+		})
+	}
+}
diff --git a/plugins/resource/go.mod b/plugins/resource/go.mod
index 98ed3e233..b2983601e 100644
--- a/plugins/resource/go.mod
+++ b/plugins/resource/go.mod
@@ -1,29 +1,29 @@
 module github.com/dokku/dokku/plugins/resource
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/resource/go.sum b/plugins/resource/go.sum
index 14bf42b1c..9ada61068 100644
--- a/plugins/resource/go.sum
+++ b/plugins/resource/go.sum
@@ -1,25 +1,24 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -28,28 +27,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/resource/plugin.toml b/plugins/resource/plugin.toml
index 446100db1..963e943dd 100644
--- a/plugins/resource/plugin.toml
+++ b/plugins/resource/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core resource plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/resource/src/commands/commands.go b/plugins/resource/src/commands/commands.go
index 7789eb583..83a0048fd 100644
--- a/plugins/resource/src/commands/commands.go
+++ b/plugins/resource/src/commands/commands.go
@@ -19,10 +19,10 @@ Additional commands:`
 
 	helpContent = `
     resource:limit [--process-type <process-type>] [RESOURCE_OPTS...] <app>, Limit resources for a given app/process-type combination
-    resource:limit-clear [--process-type <process-type>] <app>, Limit resources for a given app/process-type combination
+    resource:limit-clear [--process-type <process-type>] <app>, Clear resource limits for a given app/process-type combination
     resource:report [<app>] [<flag>], Displays a resource report for one or more apps
     resource:reserve [--process-type <process-type>] [RESOURCE_OPTS...] <app>, Reserve resources for a given app/process-type combination
-    resource:reserve-clear [--process-type <process-type>] <app>, Reserve resources for a given app/process-type combination`
+    resource:reserve-clear [--process-type <process-type>] <app>, Clear resource reservations for a given app/process-type combination`
 )
 
 func main() {
diff --git a/plugins/resource/triggers.go b/plugins/resource/triggers.go
index 6994c69d1..7a45dd28f 100644
--- a/plugins/resource/triggers.go
+++ b/plugins/resource/triggers.go
@@ -71,22 +71,30 @@ func TriggerDockerArgsProcessDeploy(appName string, processType string) error {
 		}
 	}
 
+	var args strings.Builder
 	for key, value := range limits {
 		if value == "" {
 			continue
 		}
-		value = addMemorySuffixForDocker(key, value)
-		fmt.Printf(" --%s=%s ", key, value)
+		value, err := formatResourceValueForDocker(key, value)
+		if err != nil {
+			return fmt.Errorf("Unable to apply resource limits for %s: %w", appName, err)
+		}
+		fmt.Fprintf(&args, " --%s=%s ", key, value)
 	}
 
 	for key, value := range reservations {
 		if value == "" {
 			continue
 		}
-		value = addMemorySuffixForDocker(key, value)
-		fmt.Printf(" --%s-reservation=%s ", key, value)
+		value, err := formatResourceValueForDocker(key, value)
+		if err != nil {
+			return fmt.Errorf("Unable to apply resource reservations for %s: %w", appName, err)
+		}
+		fmt.Fprintf(&args, " --%s-reservation=%s ", key, value)
 	}
 
+	fmt.Print(args.String())
 	fmt.Print(string(stdin))
 	return nil
 }
@@ -136,14 +144,19 @@ func TriggerDockerArgsProcessBuild(appName string, builderType string) error {
 		limits[flagName] = value
 	}
 
+	var args strings.Builder
 	for key, value := range limits {
 		if value == "" {
 			continue
 		}
-		value = addMemorySuffixForDocker(key, value)
-		fmt.Printf(" --%s=%s ", key, value)
+		value, err := formatResourceValueForDocker(key, value)
+		if err != nil {
+			return fmt.Errorf("Unable to apply build resource limits for %s: %w", appName, err)
+		}
+		fmt.Fprintf(&args, " --%s=%s ", key, value)
 	}
 
+	fmt.Print(args.String())
 	fmt.Print(string(stdin))
 	return nil
 }
diff --git a/plugins/run/internal-functions b/plugins/run/internal-functions
index 2a15e60ef..2561b9601 100755
--- a/plugins/run/internal-functions
+++ b/plugins/run/internal-functions
@@ -206,13 +206,17 @@ cmd-run-logs() {
     dokku_log_fail "No container or app specified"
   fi
 
+  if ! is_number "$NUM"; then
+    dokku_log_fail "Invalid value for num: must be an integer"
+  fi
+
   if [[ -n "$CONTAINER_NAME" ]]; then
     if [[ "$(echo "$CONTAINER_NAME" | grep -o '\.' | wc -l)" -ne 2 ]]; then
       dokku_log_fail "Invalid container name specified: $CONTAINER_NAME"
     fi
 
     if [[ -n "$APP" ]] && [[ "$APP" != "$(echo "$CONTAINER_NAME" | cut -d'.' -f1)" ]]; then
-      dokku_log_fail "Specified app does not app in container name"
+      dokku_log_fail "Specified app does not match app in container name"
     fi
 
     APP="$(echo "$CONTAINER_NAME" | cut -d'.' -f1)"
@@ -269,6 +273,19 @@ cmd-run-stop() {
     esac
   done
 
+  if [[ -n "$CONTAINER_NAME" ]]; then
+    local CONTAINER_APP="$(echo "$CONTAINER_NAME" | cut -d'.' -f1)"
+    if [[ -n "$APP" ]] && [[ "$APP" != "$CONTAINER_APP" ]]; then
+      dokku_log_fail "Specified app does not match app in container name"
+    fi
+    APP="$CONTAINER_APP"
+  fi
+
+  if [[ -z "$APP" ]]; then
+    dokku_log_fail "No container or app specified"
+  fi
+
+  verify_app_name "$APP"
   local DOKKU_SCHEDULER=$(get_app_scheduler "$APP")
   plugn trigger scheduler-run-stop "$DOKKU_SCHEDULER" "$APP" "$CONTAINER_NAME"
 }
diff --git a/plugins/run/plugin.toml b/plugins/run/plugin.toml
index 46f411379..f24bdd83e 100644
--- a/plugins/run/plugin.toml
+++ b/plugins/run/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core run plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/scheduler-docker-local/bin/scheduler-deploy-process-container b/plugins/scheduler-docker-local/bin/scheduler-deploy-process-container
index 9c6a33039..354e82ab6 100755
--- a/plugins/scheduler-docker-local/bin/scheduler-deploy-process-container
+++ b/plugins/scheduler-docker-local/bin/scheduler-deploy-process-container
@@ -65,12 +65,15 @@ main() {
 
   START_CMD=$(fn-scheduler-docker-local-extract-start-cmd "$APP" "$PROC_TYPE" "$START_CMD" "$DOKKU_HEROKUISH" "$DOKKU_PORT")
   DOCKER_ARGS+=" $IMAGE"
-  DOCKER_ARGS+=" $START_CMD"
+  fn-split-command "$START_CMD" >/dev/null
 
   declare -a ARG_ARRAY=()
   while IFS= read -r -d '' arg; do
     ARG_ARRAY+=("$arg")
   done < <(fn-docker-args-split "$DOCKER_ARGS")
+  while IFS= read -r -d '' arg; do
+    ARG_ARRAY+=("$arg")
+  done < <(fn-split-command "$START_CMD")
   cid=$(fn-scheduler-docker-local-start-app-container "$APP" "${ARG_ARRAY[@]}")
 
   plugn trigger post-container-create "app" "$cid" "$APP" "deploy" "$PROC_TYPE"
@@ -80,7 +83,7 @@ main() {
 
   kill_new() {
     declare desc="wrapper function to kill newly started app container"
-    declare CID="$1" PROC_TYPE="$2" CONTAINER_INDEX="$3"
+    declare APP="$1" CID="$2" PROC_TYPE="$3" CONTAINER_INDEX="$4"
 
     plugn trigger scheduler-register-retired "$APP" "$CID" "$DOKKU_WAIT_TO_RETIRE"
     mkdir -p "${DOKKU_LIB_ROOT}/data/scheduler-docker-local/$APP"
@@ -95,7 +98,7 @@ main() {
   }
 
   # run checks first, then post-deploy hooks, which switches proxy traffic
-  trap "kill_new $cid $PROC_TYPE $CONTAINER_INDEX" INT TERM EXIT
+  trap "kill_new $APP $cid $PROC_TYPE $CONTAINER_INDEX" INT TERM EXIT
   if [[ "$DOKKU_CHECKS_DISABLED" == "false" ]]; then
     dokku_log_verbose "Attempting pre-flight checks ($PROC_TYPE.$CONTAINER_INDEX)"
     plugn trigger check-deploy "$APP" "$cid" "$PROC_TYPE" "$DOKKU_PORT" "$ipaddr" "$CONTAINER_INDEX"
diff --git a/plugins/scheduler-docker-local/check-deploy b/plugins/scheduler-docker-local/check-deploy
index 8772aefd6..b9bdb1645 100755
--- a/plugins/scheduler-docker-local/check-deploy
+++ b/plugins/scheduler-docker-local/check-deploy
@@ -145,9 +145,11 @@ trigger-scheduler-docker-local-check-deploy() {
     ARG_ARRAY+=("$DOKKU_APP_LISTEN_PORT")
   fi
 
-  local app_vhosts="$(plugn trigger domains-list "$APP")"
-  if [[ -n "$app_vhosts" ]]; then
-    for app_vhost in $app_vhosts; do
+  local app_vhost
+  local -a app_vhosts
+  read -r -d '' -a app_vhosts <<<"$(plugn trigger domains-list "$APP")" || true
+  if [[ "${#app_vhosts[@]}" -gt 0 ]]; then
+    for app_vhost in "${app_vhosts[@]}"; do
       if [[ "$app_vhost" == "localhost" ]] || [[ "$app_vhost" == '*' ]]; then
         continue
       fi
diff --git a/plugins/scheduler-docker-local/core-post-deploy b/plugins/scheduler-docker-local/core-post-deploy
index 0b881bdd8..4f8dfb3c8 100755
--- a/plugins/scheduler-docker-local/core-post-deploy
+++ b/plugins/scheduler-docker-local/core-post-deploy
@@ -10,11 +10,6 @@ trigger-scheduler-docker-local-core-post-deploy() {
   declare APP="$1"
   local APP_ROOT="$DOKKU_ROOT/$APP"
 
-  local DOKKU_SCHEDULER=$(get_app_scheduler "$APP")
-  if [[ "$DOKKU_SCHEDULER" != "docker-local" ]]; then
-    return
-  fi
-
   # move over the checks file appropriately
   checks_file="${DOKKU_LIB_ROOT}/data/scheduler-docker-local/$APP/CHECKS"
   process_specific_checks_file="${DOKKU_LIB_ROOT}/data/scheduler-docker-local/$APP/CHECKS.$DOKKU_PID"
@@ -27,6 +22,11 @@ trigger-scheduler-docker-local-core-post-deploy() {
     fi
   fi
 
+  local DOKKU_SCHEDULER=$(get_app_scheduler "$APP")
+  if [[ "$DOKKU_SCHEDULER" != "docker-local" ]]; then
+    return
+  fi
+
   dokku_log_info1 "Renaming containers"
   local PROCTYPES="$(plugn trigger ps-current-scale "$APP" | awk -F '=' '{ print $1 }' | xargs)"
   local CONTAINER_FILES="$(find "$DOKKU_ROOT/$APP" -maxdepth 1 -name "CONTAINER.*" -printf "%f\n" 2>/dev/null | sort -t . -k 3 -n | xargs)"
diff --git a/plugins/scheduler-docker-local/core-post-extract b/plugins/scheduler-docker-local/core-post-extract
index d0a130ac8..b70ddb00a 100755
--- a/plugins/scheduler-docker-local/core-post-extract
+++ b/plugins/scheduler-docker-local/core-post-extract
@@ -8,8 +8,6 @@ source "$PLUGIN_AVAILABLE_PATH/scheduler-docker-local/internal-functions"
 fn-scheduler-docker-local-copy-from-image() {
   declare APP="$1" IMAGE_NAME="$2" CHECKS_PATH="$3"
 
-  mkdir -p "${DOKKU_LIB_ROOT}/data/scheduler-docker-local/$APP"
-  find "${DOKKU_LIB_ROOT}/data/scheduler-docker-local/$APP/" -maxdepth 1 -type f -name 'CHECKS.*' -delete
   copy_from_image "$IMAGE_NAME" "$CHECKS_PATH" "${DOKKU_LIB_ROOT}/data/scheduler-docker-local/$APP/CHECKS.$DOKKU_PID" 2>/dev/null || true
   if [[ ! -f "${DOKKU_LIB_ROOT}/data/scheduler-docker-local/$APP/CHECKS.$DOKKU_PID" ]]; then
     touch "${DOKKU_LIB_ROOT}/data/scheduler-docker-local/$APP/CHECKS.$DOKKU_PID.missing"
@@ -20,7 +18,6 @@ fn-scheduler-docker-local-copy-from-directory() {
   declare APP="$1" SOURCECODE_WORK_DIR="$2" CHECKS_PATH="$3"
 
   pushd "$SOURCECODE_WORK_DIR" >/dev/null
-  mkdir -p "${DOKKU_LIB_ROOT}/data/scheduler-docker-local/$APP"
 
   if [[ -z "$CHECKS_PATH" ]]; then
     touch "${DOKKU_LIB_ROOT}/data/scheduler-docker-local/$APP/CHECKS.$DOKKU_PID.missing"
@@ -32,7 +29,6 @@ fn-scheduler-docker-local-copy-from-directory() {
     return
   fi
 
-  find "${DOKKU_LIB_ROOT}/data/scheduler-docker-local/$APP/" -maxdepth 1 -type f -name 'CHECKS.*' -delete
   cp -f "$CHECKS_PATH" "${DOKKU_LIB_ROOT}/data/scheduler-docker-local/$APP/CHECKS.$DOKKU_PID"
   popd &>/dev/null || pushd "/tmp" >/dev/null
 }
@@ -44,6 +40,9 @@ trigger-scheduler-docker-local-core-post-extract() {
   local CHECKS_PATH="CHECKS" CHECKS_FILENAME="${DOKKU_LIB_ROOT}/data/scheduler-docker-local/$APP/CHECKS.$DOKKU_PID"
   local app_source_image
 
+  mkdir -p "${DOKKU_LIB_ROOT}/data/scheduler-docker-local/$APP"
+  find "${DOKKU_LIB_ROOT}/data/scheduler-docker-local/$APP/" -maxdepth 1 -type f -name 'CHECKS.*' -delete
+
   app_source_image="$(plugn trigger git-get-property "$APP" "source-image")"
   if [[ -n "$app_source_image" ]]; then
     fn-scheduler-docker-local-copy-from-image "$APP" "$app_source_image" "$CHECKS_PATH"
diff --git a/plugins/scheduler-docker-local/go.mod b/plugins/scheduler-docker-local/go.mod
index 96d0a23c1..81361f306 100644
--- a/plugins/scheduler-docker-local/go.mod
+++ b/plugins/scheduler-docker-local/go.mod
@@ -1,18 +1,18 @@
 module github.com/dokku/dokku/plugins/scheduler-docker-local
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
 	github.com/dokku/dokku/plugins/storage v0.0.0-00010101000000-000000000000
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/dokku/dokku/plugins/docker-options v0.0.0-00010101000000-000000000000 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
@@ -23,10 +23,10 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	mvdan.cc/sh/v3 v3.13.1 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	mvdan.cc/sh/v3 v3.14.1 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/scheduler-docker-local/go.sum b/plugins/scheduler-docker-local/go.sum
index 2a65439b1..7e089b416 100644
--- a/plugins/scheduler-docker-local/go.sum
+++ b/plugins/scheduler-docker-local/go.sum
@@ -1,15 +1,14 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
-github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
-github.com/go-quicktest/qt v1.101.0/go.mod h1:14Bz/f7NwaXPtdYEgzsx46kqSxVwTbzVZsDC26tQJow=
+github.com/go-quicktest/qt v1.102.0 h1:HSQxCeh5YZH3EL3W39ixjtyaEhcWSXQHtHnMBzSs474=
+github.com/go-quicktest/qt v1.102.0/go.mod h1:p4lGIVX+8Wa6ZPNDvqcxq36XpUDLh42FLetFU7odllI=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
@@ -24,8 +23,8 @@ github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsRe
 github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -34,31 +33,27 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rogpeppe/go-internal v1.15.0 h1:D0RCU5rMAp+SpgkiNdrjfJ+LX4J1M32V2NeCY7EJ6hc=
+github.com/rogpeppe/go-internal v1.15.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-mvdan.cc/sh/v3 v3.13.1 h1:DP3TfgZhDkT7lerUdnp6PTGKyxxzz6T+cOlY/xEvfWk=
-mvdan.cc/sh/v3 v3.13.1/go.mod h1:lXJ8SexMvEVcHCoDvAGLZgFJ9Wsm2sulmoNEXGhYZD0=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
+mvdan.cc/sh/v3 v3.14.1 h1:bXkhQWNHCs0KZEChF8hYS6FC+T2N9mUZLbQv9blditI=
+mvdan.cc/sh/v3 v3.14.1/go.mod h1:syYCoFET8w9tvevxiXUtY8/ICrU+l26jHmhJDra3Vwo=
diff --git a/plugins/scheduler-docker-local/internal-functions b/plugins/scheduler-docker-local/internal-functions
index e429438f5..bc1c29d30 100644
--- a/plugins/scheduler-docker-local/internal-functions
+++ b/plugins/scheduler-docker-local/internal-functions
@@ -187,6 +187,15 @@ fn-scheduler-docker-local-retire-images() {
     return
   fi
 
+  local -A SOURCE_IMAGE_APPS=()
+  local source_app source_image source_image_id
+  for source_app in $(dokku_apps "false" 2>/dev/null); do
+    source_image="$(plugn trigger git-get-property "$source_app" "source-image" 2>/dev/null || true)"
+    [[ -z "$source_image" ]] && continue
+    source_image_id="$("$DOCKER_BIN" image inspect --format '{{ .Id }}' "$source_image" 2>/dev/null | cut -d: -f2 || true)"
+    [[ -n "$source_image_id" ]] && SOURCE_IMAGE_APPS["$source_image_id"]="$source_app"
+  done
+
   DEAD_IMAGES=()
   while read line; do
     [[ -z "$line" ]] && continue
@@ -209,6 +218,17 @@ fn-scheduler-docker-local-retire-images() {
       continue
     fi
 
+    if [[ -n "${SOURCE_IMAGE_APPS[$IMAGE_ID]}" ]]; then
+      dokku_log_warn "Image ${IMAGE_ID} is the source image for ${SOURCE_IMAGE_APPS[$IMAGE_ID]}, removing from retire list"
+      DEAD_IMAGES+=("$IMAGE_ID")
+      continue
+    fi
+
+    if fn-scheduler-docker-local-image-is-app-latest "$RETIRE_APP" "$STATE"; then
+      dokku_log_warn "Image ${IMAGE_ID} is the current image for ${RETIRE_APP}, skipping rm"
+      continue
+    fi
+
     dokku_log_verbose_quiet "Attempting to retire $RETIRE_APP image $IMAGE_ID"
     if RM_OUTPUT="$("$DOCKER_BIN" image remove "$IMAGE_ID" 2>&1)"; then
       DEAD_IMAGES+=("$IMAGE_ID")
@@ -247,6 +267,15 @@ fn-scheduler-docker-local-retire-images() {
   sort -o "$DEAD_IMAGE_FILE" -r "$DEAD_IMAGE_FILE"
 }
 
+fn-scheduler-docker-local-image-is-app-latest() {
+  declare desc="returns 0 if IMAGE_ID is the image currently tagged as the app's latest image"
+  declare APP="$1" IMAGE_ID="$2"
+  local LATEST_IMAGE_ID
+
+  LATEST_IMAGE_ID="$("$DOCKER_BIN" image inspect --format "{{ .Id }}" "$(get_app_image_repo "$APP"):latest" 2>/dev/null || true)"
+  [[ -n "$LATEST_IMAGE_ID" ]] && [[ "$LATEST_IMAGE_ID" == "$IMAGE_ID" ]]
+}
+
 fn-scheduler-docker-local-register-retired() {
   declare TYPE="$1" APP="$2" DOCKER_ID="$3" WAIT="$4"
   local DEAD_FILE="${DOKKU_LIB_ROOT}/data/scheduler-docker-local/dead-containers"
diff --git a/plugins/scheduler-docker-local/plugin.toml b/plugins/scheduler-docker-local/plugin.toml
index ffaca9c7f..2fff89a08 100644
--- a/plugins/scheduler-docker-local/plugin.toml
+++ b/plugins/scheduler-docker-local/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core scheduler-docker-local plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/scheduler-docker-local/scheduler-logs b/plugins/scheduler-docker-local/scheduler-logs
index 83a6a0ff8..d7131ab36 100755
--- a/plugins/scheduler-docker-local/scheduler-logs
+++ b/plugins/scheduler-docker-local/scheduler-logs
@@ -3,18 +3,31 @@ set -eo pipefail
 [[ $DOKKU_TRACE ]] && set -x
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 
+fn-scheduler-docker-local-container-logs() {
+  declare desc="outputs logs for a single app container"
+  declare CID="$1" DYNO="$2" PRETTY_PRINT="$3" COLOR="$4"
+  shift 4
+
+  if [[ "$PRETTY_PRINT" == "true" ]]; then
+    "$DOCKER_BIN" logs "$@" "$CID" 2>&1
+    return
+  fi
+
+  "$DOCKER_BIN" logs -t "$@" "$CID" 2>&1 | sed -u -r "s/^([^Z]+Z )/\x1b[${COLOR}m\1app[${DYNO}]:\x1b[0m /gm"
+}
+
 trigger-scheduler-docker-local-scheduler-logs() {
   declare desc="scheduler-docker-local scheduler-logs plugin trigger"
   declare trigger="scheduler-logs"
   declare DOKKU_SCHEDULER="$1" APP="$2" PROCESS_TYPE="$3" TAIL="$4" PRETTY_PRINT="$5" NUM="$6"
-  local DOKKU_LOGS_ARGS=""
+  local DOCKER_LOGS_ARGS=("--tail" "$NUM")
 
   if [[ "$DOKKU_SCHEDULER" != "docker-local" ]]; then
     return
   fi
 
   if [[ "$TAIL" == "true" ]]; then
-    DOKKU_LOGS_ARGS="--follow "
+    DOCKER_LOGS_ARGS+=("--follow")
   fi
 
   local APP_ROOT="$DOKKU_ROOT/$APP"
@@ -26,25 +39,19 @@ trigger-scheduler-docker-local-scheduler-logs() {
   fi
   [[ -z $(stat -t "${CONTAINERS[0]}" 2>/dev/null) ]] && exit 0
 
-  local DOKKU_LOGS_ARGS+="--tail $NUM"
-  ((MAX_INDEX = ${#CONTAINERS[*]} - 1)) || true
-  for i in ${!CONTAINERS[*]}; do
-    local DYNO=$(echo "${CONTAINERS[i]}" | sed -r 's/.*CONTAINER\.(.*)/\1/')
-    local CID=$(<"${CONTAINERS[i]}")
-    local COLOR=${COLORS[i % ${#COLORS[*]}]}
-    if [[ $PRETTY_PRINT == "true" ]]; then
-      local DOKKU_LOGS_CMD+="($DOCKER_BIN logs $DOKKU_LOGS_ARGS $CID 2>&1)"
+  local MAX_INDEX
+  ((MAX_INDEX = ${#CONTAINERS[@]} - 1)) || true
+  for i in "${!CONTAINERS[@]}"; do
+    local DYNO="$(echo "${CONTAINERS[i]}" | sed -r 's/.*CONTAINER\.(.*)/\1/')"
+    local CID="$(<"${CONTAINERS[i]}")"
+    local COLOR="${COLORS[i % ${#COLORS[@]}]}"
+    if [[ "$i" != "$MAX_INDEX" ]]; then
+      fn-scheduler-docker-local-container-logs "$CID" "$DYNO" "$PRETTY_PRINT" "$COLOR" "${DOCKER_LOGS_ARGS[@]}" &
     else
-      local DOKKU_LOGS_PRETTY_PRINT_CMD="sed -u -r 's/^([^Z]+Z )/\x1b[${COLOR}m\1app[$DYNO]:\x1b[0m /gm'"
-      local DOKKU_LOGS_CMD+="($DOCKER_BIN logs -t $DOKKU_LOGS_ARGS $CID 2>&1 | $DOKKU_LOGS_PRETTY_PRINT_CMD)"
-    fi
-    if [[ $i != "$MAX_INDEX" ]]; then
-      local DOKKU_LOGS_CMD+="& "
-    else
-      local DOKKU_LOGS_CMD+="; "
+      fn-scheduler-docker-local-container-logs "$CID" "$DYNO" "$PRETTY_PRINT" "$COLOR" "${DOCKER_LOGS_ARGS[@]}"
     fi
   done
-  bash -c "($DOKKU_LOGS_CMD)"
+  wait
 }
 
 trigger-scheduler-docker-local-scheduler-logs "$@"
diff --git a/plugins/scheduler-docker-local/scheduler-logs-failed b/plugins/scheduler-docker-local/scheduler-logs-failed
index d3cc93346..660f14f97 100755
--- a/plugins/scheduler-docker-local/scheduler-logs-failed
+++ b/plugins/scheduler-docker-local/scheduler-logs-failed
@@ -8,7 +8,7 @@ trigger-scheduler-docker-local-scheduler-logs-failed() {
   declare trigger="scheduler-logs-failed"
   declare DOKKU_SCHEDULER="$1" APP="$2"
   local FAILED_CONTAINERS_FILE="${DOKKU_LIB_ROOT}/data/scheduler-docker-local/$APP/failed-containers"
-  local DEAD_CONTAINERS=() DOKKU_LOGS_CMD=() RUNNING_CONTAINERS=()
+  local DEAD_CONTAINERS=() RUNNING_CONTAINERS=()
   local CID LINE PREFIX
   shift 2
 
@@ -41,17 +41,16 @@ trigger-scheduler-docker-local-scheduler-logs-failed() {
     return
   fi
 
-  ((MAX_INDEX = ${#RUNNING_CONTAINERS[*]} - 1)) || true
-  for i in ${!RUNNING_CONTAINERS[*]}; do
-    local CID="${RUNNING_CONTAINERS[i]}"
-    DOKKU_LOGS_CMD+="($DOCKER_BIN logs $DOKKU_LOGS_ARGS $CID 2>&1)"
-    if [[ $i != "$MAX_INDEX" ]]; then
-      local DOKKU_LOGS_CMD+="& "
+  local MAX_INDEX
+  ((MAX_INDEX = ${#RUNNING_CONTAINERS[@]} - 1)) || true
+  for i in "${!RUNNING_CONTAINERS[@]}"; do
+    if [[ "$i" != "$MAX_INDEX" ]]; then
+      "$DOCKER_BIN" logs "${RUNNING_CONTAINERS[i]}" 2>&1 &
     else
-      local DOKKU_LOGS_CMD+="; "
+      "$DOCKER_BIN" logs "${RUNNING_CONTAINERS[i]}" 2>&1
     fi
   done
-  bash -c "($DOKKU_LOGS_CMD)"
+  wait
 }
 
 trigger-scheduler-docker-local-scheduler-logs-failed "$@"
diff --git a/plugins/scheduler-docker-local/scheduler-register-retired b/plugins/scheduler-docker-local/scheduler-register-retired
index 3d16d7fbc..81df621d9 100755
--- a/plugins/scheduler-docker-local/scheduler-register-retired
+++ b/plugins/scheduler-docker-local/scheduler-register-retired
@@ -19,7 +19,7 @@ trigger-scheduler-docker-local-scheduler-register-retired() {
   fn-scheduler-docker-local-register-retired "container" "$APP" "$CONTAINER_ID" "$WAIT"
 
   if [[ -n "$IMAGE_ID" ]] && [[ -z "$DOKKU_SKIP_IMAGE_CLEANUP_REGISTRATION" ]]; then
-    ALT_IMAGE_TAGS="$("$DOCKER_BIN" image inspect --format '{{ index .Config.Labels "com.dokku.docker-image-labeler/alternate-tags" }}' "$IMAGE_ID" 2>/dev/null || true)"
+    ALT_IMAGE_TAGS="$("$DOCKER_BIN" container inspect --format '{{ index .Config.Labels "com.dokku.docker-image-labeler/alternate-tags" }}' "$CONTAINER_ID" 2>/dev/null || true)"
 
     if ! fn-scheduler-docker-local-image-in-use-by-app "$APP" "$IMAGE_ID" "$CONTAINER_ID"; then
       fn-scheduler-docker-local-register-retired "image" "$APP" "$IMAGE_ID" "$WAIT"
diff --git a/plugins/scheduler-docker-local/scheduler-run b/plugins/scheduler-docker-local/scheduler-run
index d184b0954..224dfc05a 100755
--- a/plugins/scheduler-docker-local/scheduler-run
+++ b/plugins/scheduler-docker-local/scheduler-run
@@ -111,7 +111,11 @@ trigger-scheduler-docker-local-scheduler-run() {
     if [[ -n "$PROC_CMD" ]]; then
       dokku_log_info1_quiet "Found '$POTENTIAL_PROCFILE_KEY' in Procfile, running that command"
       DOCKER_ARGS+=" --label=com.dokku.process-type=$POTENTIAL_PROCFILE_KEY"
-      read -ra proc_array <<<"$PROC_CMD"
+      fn-split-command "$PROC_CMD" >/dev/null
+      local -a proc_array=()
+      while IFS= read -r -d '' arg; do
+        proc_array+=("$arg")
+      done < <(fn-split-command "$PROC_CMD")
       set -- "${proc_array[@]}" "${@:2}"
     fi
   fi
diff --git a/plugins/scheduler-docker-local/scheduler-run-logs b/plugins/scheduler-docker-local/scheduler-run-logs
index b657729f3..9fa30c66a 100755
--- a/plugins/scheduler-docker-local/scheduler-run-logs
+++ b/plugins/scheduler-docker-local/scheduler-run-logs
@@ -3,51 +3,59 @@ set -eo pipefail
 [[ $DOKKU_TRACE ]] && set -x
 source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 
+fn-scheduler-docker-local-run-container-logs() {
+  declare desc="outputs logs for a single run container"
+  declare CONTAINER_NAME="$1" PRETTY_PRINT="$2" COLOR="$3"
+  shift 3
+  local DYNO="$(echo "$CONTAINER_NAME" | cut -d. -f3)"
+
+  if [[ "$PRETTY_PRINT" == "true" ]]; then
+    "$DOCKER_BIN" logs "$@" "$CONTAINER_NAME" 2>&1
+    return
+  fi
+
+  "$DOCKER_BIN" logs -t "$@" "$CONTAINER_NAME" 2>&1 | sed -u -r "s/^([^Z]+Z )/\x1b[${COLOR}m\1app[${DYNO}]:\x1b[0m /gm"
+}
+
 trigger-scheduler-docker-local-scheduler-logs() {
   declare desc="scheduler-docker-local scheduler-logs plugin trigger"
   declare trigger="scheduler-logs"
   declare DOKKU_SCHEDULER="$1" APP="$2" CONTAINER_NAME="$3" TAIL="$4" PRETTY_PRINT="$5" NUM="$6"
-  local DOKKU_LOGS_ARGS=""
+  local DOCKER_LOGS_ARGS=("--tail" "$NUM")
+  local COLORS=(36 33 32 35 31)
+  local CONTAINERS=() NAME NAMES
 
   if [[ "$DOKKU_SCHEDULER" != "docker-local" ]]; then
     return
   fi
 
   if [[ "$TAIL" == "true" ]]; then
-    DOKKU_LOGS_ARGS="--follow "
+    DOCKER_LOGS_ARGS+=("--follow")
   fi
 
-  local COLORS=(36 33 32 35 31)
-
-  if [[ -n "$CONTAINER_NAME" ]]; then
-    local CONTAINERS=("$CONTAINER_NAME")
-  else
-    local CONTAINERS=()
-    NAMES="$("$DOCKER_BIN" container ls --all --filter "label=com.dokku.app-name=$APP" --filter "label=com.dokku.container-type=run" --format '{{ .Names }}')"
-    while IFS= read -r CONTAINER_NAME; do
-      CONTAINERS+=("$CONTAINER_NAME")
-    done <<<"$NAMES"
-  fi
-
-  local DOKKU_LOGS_ARGS+="--tail $NUM"
-  ((MAX_INDEX = ${#CONTAINERS[*]} - 1)) || true
-  for i in ${!CONTAINERS[*]}; do
-    local DYNO="$(echo "${CONTAINERS[i]}" | cut -d. -f3)"
-    local CID="${CONTAINERS[i]}"
-    local COLOR=${COLORS[i % ${#COLORS[*]}]}
-    if [[ $PRETTY_PRINT == "true" ]]; then
-      local DOKKU_LOGS_CMD+="($DOCKER_BIN logs $DOKKU_LOGS_ARGS $CID 2>&1)"
-    else
-      local DOKKU_LOGS_PRETTY_PRINT_CMD="sed -u -r 's/^([^Z]+Z )/\x1b[${COLOR}m\1app[$DYNO]:\x1b[0m /gm'"
-      local DOKKU_LOGS_CMD+="($DOCKER_BIN logs -t $DOKKU_LOGS_ARGS $CID 2>&1 | $DOKKU_LOGS_PRETTY_PRINT_CMD)"
+  NAMES="$("$DOCKER_BIN" container ls --all --filter "label=com.dokku.app-name=$APP" --filter "label=com.dokku.container-type=run" --format '{{ .Names }}')"
+  while IFS= read -r NAME; do
+    [[ -z "$NAME" ]] && continue
+    if [[ -z "$CONTAINER_NAME" ]] || [[ "$NAME" == "$CONTAINER_NAME" ]]; then
+      CONTAINERS+=("$NAME")
     fi
-    if [[ $i != "$MAX_INDEX" ]]; then
-      local DOKKU_LOGS_CMD+="& "
+  done <<<"$NAMES"
+
+  if [[ -n "$CONTAINER_NAME" ]] && [[ ${#CONTAINERS[@]} -eq 0 ]]; then
+    dokku_log_fail "Specified container does not exist"
+  fi
+
+  local MAX_INDEX
+  ((MAX_INDEX = ${#CONTAINERS[@]} - 1)) || true
+  for i in "${!CONTAINERS[@]}"; do
+    local COLOR="${COLORS[i % ${#COLORS[@]}]}"
+    if [[ "$i" != "$MAX_INDEX" ]]; then
+      fn-scheduler-docker-local-run-container-logs "${CONTAINERS[i]}" "$PRETTY_PRINT" "$COLOR" "${DOCKER_LOGS_ARGS[@]}" &
     else
-      local DOKKU_LOGS_CMD+="; "
+      fn-scheduler-docker-local-run-container-logs "${CONTAINERS[i]}" "$PRETTY_PRINT" "$COLOR" "${DOCKER_LOGS_ARGS[@]}"
     fi
   done
-  bash -c "($DOKKU_LOGS_CMD)"
+  wait
 }
 
 trigger-scheduler-docker-local-scheduler-logs "$@"
diff --git a/plugins/scheduler-docker-local/scheduler-run-stop b/plugins/scheduler-docker-local/scheduler-run-stop
index 6eb6eb7e9..0fc24d3e8 100755
--- a/plugins/scheduler-docker-local/scheduler-run-stop
+++ b/plugins/scheduler-docker-local/scheduler-run-stop
@@ -25,6 +25,21 @@ fn-scheduler-docker-local-stop-container() {
   return 1
 }
 
+fn-scheduler-docker-local-stop-app-run-container() {
+  declare desc="stops a named run container belonging to an app"
+  declare APP="$1" CONTAINER_NAME="$2" DOCKER_STOP_TIMEOUT="$3"
+  local NAME
+
+  while IFS= read -r NAME; do
+    if [[ "$NAME" == "$CONTAINER_NAME" ]]; then
+      fn-scheduler-docker-local-stop-container "$CONTAINER_NAME" "$DOCKER_STOP_TIMEOUT"
+      return $?
+    fi
+  done < <("$DOCKER_BIN" container ls --filter "label=com.dokku.app-name=$APP" --filter "label=com.dokku.container-type=run" --format '{{ .Names }}')
+
+  dokku_log_warn "Specified container does not exist"
+}
+
 trigger-scheduler-docker-local-scheduler-run-stop() {
   declare desc="stops an app run container"
   declare trigger="scheduler-run-stop"
@@ -34,15 +49,21 @@ trigger-scheduler-docker-local-scheduler-run-stop() {
     return
   fi
 
-  if [[ -z "$APP" ]]; then
-    if [[ -z "$CONTAINER_NAME" ]]; then
-      dokku_log_fail "No container or app specified"
-    fi
+  if [[ -z "$APP" ]] && [[ -z "$CONTAINER_NAME" ]]; then
+    dokku_log_fail "No container or app specified"
+  fi
+
+  if [[ -n "$CONTAINER_NAME" ]]; then
     if [[ "$(echo "$CONTAINER_NAME" | grep -o '\.' | wc -l)" -ne 2 ]]; then
       dokku_log_fail "Invalid container name specified: $CONTAINER_NAME"
     fi
 
-    APP="$(echo "$CONTAINER_NAME" | cut -d'.' -f1)"
+    local CONTAINER_APP="$(echo "$CONTAINER_NAME" | cut -d'.' -f1)"
+    if [[ -n "$APP" ]] && [[ "$APP" != "$CONTAINER_APP" ]]; then
+      dokku_log_fail "Specified app does not match app in container name"
+    fi
+
+    APP="$CONTAINER_APP"
     STATE="$(echo "$CONTAINER_NAME" | cut -d'.' -f2)"
     if [[ "$STATE" != "run" ]]; then
       dokku_log_fail "Specified container must be a run container"
@@ -53,7 +74,7 @@ trigger-scheduler-docker-local-scheduler-run-stop() {
 
   DOKKU_DOCKER_STOP_TIMEOUT="$(plugn trigger ps-get-property "$APP" stop-timeout-seconds || true)"
   if [[ -n "$CONTAINER_NAME" ]]; then
-    fn-scheduler-docker-local-stop-container "$CONTAINER_NAME" "$DOKKU_DOCKER_STOP_TIMEOUT"
+    fn-scheduler-docker-local-stop-app-run-container "$APP" "$CONTAINER_NAME" "$DOKKU_DOCKER_STOP_TIMEOUT"
     return $?
   fi
 
diff --git a/plugins/scheduler-docker-local/storage_exec.go b/plugins/scheduler-docker-local/storage_exec.go
index 4db397e29..c2d8629dd 100644
--- a/plugins/scheduler-docker-local/storage_exec.go
+++ b/plugins/scheduler-docker-local/storage_exec.go
@@ -137,7 +137,7 @@ func buildDockerExecArgs(entry *storage.Entry, input StorageExecInput) ([]string
 		args = append(args, "--user", user)
 	}
 
-	args = append(args, "-v", fmt.Sprintf("%s:/data", entry.HostPath))
+	args = append(args, "-v", fmt.Sprintf("%s:/data", storage.HostPathForDocker(entry.HostPath)))
 	args = append(args, input.Image)
 	args = append(args, cmd...)
 	return args, nil
diff --git a/plugins/scheduler-docker-local/storage_exec_test.go b/plugins/scheduler-docker-local/storage_exec_test.go
index 110bab0eb..79556de30 100644
--- a/plugins/scheduler-docker-local/storage_exec_test.go
+++ b/plugins/scheduler-docker-local/storage_exec_test.go
@@ -116,3 +116,25 @@ func TestBuildDockerExecArgsMountsHostPath(t *testing.T) {
 		t.Fatalf("expected -v /srv/demo:/data, got: %s", joined)
 	}
 }
+
+func TestBuildDockerExecArgsRewritesLibHostRoot(t *testing.T) {
+	t.Setenv("DOKKU_LIB_ROOT", "/var/lib/dokku")
+	t.Setenv("DOKKU_LIB_HOST_ROOT", "/host/var/lib/dokku")
+
+	entry := &storage.Entry{
+		Name:      "demo-data",
+		Scheduler: storage.SchedulerDockerLocal,
+		HostPath:  "/var/lib/dokku/data/storage/demo-data",
+	}
+	args, err := buildDockerExecArgs(entry, StorageExecInput{
+		Image:   "alpine:3",
+		Command: []string{"ls"},
+	})
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	joined := strings.Join(args, " ")
+	if !strings.Contains(joined, "-v /host/var/lib/dokku/data/storage/demo-data:/data") {
+		t.Fatalf("expected rewritten -v host path, got: %s", joined)
+	}
+}
diff --git a/plugins/scheduler-k3s/Makefile b/plugins/scheduler-k3s/Makefile
index 340975586..fd83593a9 100644
--- a/plugins/scheduler-k3s/Makefile
+++ b/plugins/scheduler-k3s/Makefile
@@ -1,4 +1,4 @@
-SUBCOMMANDS = subcommands/annotations:set subcommands/annotations:report subcommands/autoscaling-auth:set subcommands/autoscaling-auth:report subcommands/charts:report subcommands/charts:set subcommands/cluster:add subcommands/cluster:list subcommands/cluster:remove subcommands/ensure-charts subcommands/initialize subcommands/labels:set subcommands/labels:report subcommands/node-sysctls:set subcommands/node-sysctls:report subcommands/preview subcommands/profiles:add subcommands/profiles:list subcommands/profiles:remove subcommands/report subcommands/set subcommands/show-kubeconfig subcommands/uninstall
+SUBCOMMANDS = subcommands/annotations:clear subcommands/annotations:set subcommands/annotations:report subcommands/autoscaling-auth:set subcommands/autoscaling-auth:report subcommands/charts:clear subcommands/charts:report subcommands/charts:set subcommands/cluster:add subcommands/cluster:list subcommands/cluster:remove subcommands/ensure-charts subcommands/initialize subcommands/labels:clear subcommands/labels:set subcommands/labels:report subcommands/node-sysctls:clear subcommands/node-sysctls:set subcommands/node-sysctls:report subcommands/preview subcommands/profiles:add subcommands/profiles:list subcommands/profiles:remove subcommands/report subcommands/set subcommands/show-kubeconfig subcommands/uninstall
 TRIGGERS = triggers/core-post-deploy triggers/core-post-extract triggers/install triggers/post-app-clone-setup triggers/post-app-rename-setup triggers/post-certs-update triggers/post-certs-remove triggers/post-create triggers/post-delete triggers/report triggers/scheduler-app-status triggers/scheduler-deploy triggers/scheduler-enter triggers/scheduler-is-deployed triggers/scheduler-logs triggers/scheduler-proxy-config triggers/scheduler-proxy-logs triggers/scheduler-post-delete triggers/scheduler-run triggers/scheduler-run-list triggers/scheduler-stop triggers/scheduler-cron-write triggers/scheduler-uses-host-cron triggers/storage-create triggers/storage-destroy triggers/storage-status triggers/scheduler-storage-exec
 BUILD = commands subcommands triggers
 PLUGIN_NAME = scheduler-k3s
diff --git a/plugins/scheduler-k3s/chart.go b/plugins/scheduler-k3s/chart.go
index 414f46265..eeac88cc2 100644
--- a/plugins/scheduler-k3s/chart.go
+++ b/plugins/scheduler-k3s/chart.go
@@ -16,6 +16,7 @@ import (
 	"github.com/dokku/dokku/plugins/config"
 	"github.com/dokku/dokku/plugins/cron"
 	"github.com/dokku/dokku/plugins/registry"
+	"github.com/dokku/dokku/plugins/storage"
 	"github.com/kballard/go-shellquote"
 )
 
@@ -291,6 +292,12 @@ func BuildAppChart(ctx context.Context, appName, imageTag string, opts BuildOpti
 		return cleanup(fmt.Errorf("Error getting security context: %w", err))
 	}
 
+	appRoutes, err := GetAppRoutes(appName)
+	if err != nil {
+		return cleanup(fmt.Errorf("Error getting app routes: %w", err))
+	}
+	routedPorts := RoutedProcessPorts(appRoutes)
+
 	values := &AppValues{
 		Global: GlobalValues{
 			Annotations:  globalAnnotations,
@@ -310,6 +317,7 @@ func BuildAppChart(ctx context.Context, appName, imageTag string, opts BuildOpti
 				IngressClass:       getComputedIngressClass(),
 				PrimaryPort:        primaryPort,
 				PrimaryServicePort: primaryServicePort,
+				Routes:             appRoutes,
 			},
 			SecurityContext: securityContext,
 		},
@@ -335,9 +343,12 @@ func BuildAppChart(ctx context.Context, appName, imageTag string, opts BuildOpti
 		}
 	}
 
-	processVolumes := []ProcessVolume{}
+	// Volumes every workload in the app receives, whichever process type it
+	// belongs to. Storage attachments are layered on top per process type
+	// inside the loops below.
+	baseVolumes := []ProcessVolume{}
 	if shmSize := getComputedShmSize(appName); shmSize != "" {
-		processVolumes = append(processVolumes, ProcessVolume{
+		baseVolumes = append(baseVolumes, ProcessVolume{
 			Name:      "shmem",
 			MountPath: "/dev/shm",
 			EmptyDir: &ProcessVolumeEmptyDir{
@@ -351,11 +362,18 @@ func BuildAppChart(ctx context.Context, appName, imageTag string, opts BuildOpti
 	if err != nil {
 		return cleanup(fmt.Errorf("error loading storage app mounts: %w", err))
 	}
-	deployVolumes, err := ToProcessVolumes(deployMountPairs)
-	if err != nil {
+	if err := ValidateMountPairs(deployMountPairs); err != nil {
 		return cleanup(err)
 	}
-	processVolumes = append(processVolumes, deployVolumes...)
+
+	// Every cron job gets the same volumes: a cron ID is a hash of the app
+	// name, command and schedule, so it is not something an operator can name
+	// in --process-type and it churns whenever the task changes. Cron jobs
+	// therefore sit with `dokku run` and app.json tasks: default scope only.
+	cronVolumes, err := processVolumesFor(baseVolumes, deployMountPairs, storage.DefaultProcessType)
+	if err != nil {
+		return cleanup(fmt.Errorf("Error building volumes for cron tasks: %w", err))
+	}
 
 	for processType, processCount := range processes {
 		healthchecks, ok := appJSON.Healthchecks[processType]
@@ -401,6 +419,11 @@ func BuildAppChart(ctx context.Context, appName, imageTag string, opts BuildOpti
 			return cleanup(fmt.Errorf("Error getting autoscaling: %w", err))
 		}
 
+		processVolumes, err := processVolumesFor(baseVolumes, deployMountPairs, processType)
+		if err != nil {
+			return cleanup(fmt.Errorf("Error building volumes for process type %s: %w", processType, err))
+		}
+
 		processValues := ProcessValues{
 			Annotations:  annotations,
 			Autoscaling:  autoscaling,
@@ -492,13 +515,32 @@ func BuildAppChart(ctx context.Context, appName, imageTag string, opts BuildOpti
 				Protocol:      PortmapProtocol_TCP,
 				Scheme:        "http",
 			})
+		} else if ports := SortedRoutedPorts(routedPorts, processType); len(ports) > 0 {
+			processValues.Web = ProcessWeb{
+				Domains:  []ProcessDomains{},
+				PortMaps: []ProcessPortMap{},
+				TLS: ProcessTls{
+					Enabled: false,
+				},
+			}
+			for _, port := range ports {
+				processValues.Web.PortMaps = append(processValues.Web.PortMaps, ProcessPortMap{
+					ContainerPort: port,
+					HostPort:      port,
+					Name:          fmt.Sprintf("http-%d-%d", port, port),
+					Protocol:      PortmapProtocol_TCP,
+					Scheme:        "http",
+				})
+			}
 		}
 
 		values.Processes[processType] = processValues
 
 		templateFiles := []string{"deployment", "keda-scaled-object"}
 		if processType == "web" {
-			templateFiles = append(templateFiles, "service", "certificate", "issuer", "ingress", "ingress-route", "compression-middleware", "https-redirect-middleware", "keda-http-scaled-object", "keda-interceptor-proxy-service")
+			templateFiles = append(templateFiles, "service", "certificate", "issuer", "ingress", "ingress-route", "compression-middleware", "https-redirect-middleware", "strip-prefix-middleware", "keda-http-scaled-object", "keda-interceptor-proxy-service")
+		} else if _, routed := routedPorts[processType]; routed {
+			templateFiles = append(templateFiles, "service")
 		}
 		for _, templateName := range templateFiles {
 			b, err := templates.ReadFile(fmt.Sprintf("templates/chart/%s.yaml", templateName))
@@ -589,7 +631,7 @@ func BuildAppChart(ctx context.Context, appName, imageTag string, opts BuildOpti
 			ProcessType: ProcessType_Cron,
 			Replicas:    1,
 			Resources:   processResources,
-			Volumes:     processVolumes,
+			Volumes:     cronVolumes,
 		}
 		values.Processes[cronTask.ID] = processValues
 	}
diff --git a/plugins/scheduler-k3s/chart_render_test.go b/plugins/scheduler-k3s/chart_render_test.go
new file mode 100644
index 000000000..b280bfb69
--- /dev/null
+++ b/plugins/scheduler-k3s/chart_render_test.go
@@ -0,0 +1,240 @@
+package scheduler_k3s
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/dokku/dokku/plugins/storage"
+	"gopkg.in/yaml.v3"
+	"helm.sh/helm/v3/pkg/chart"
+	"helm.sh/helm/v3/pkg/chartutil"
+	"helm.sh/helm/v3/pkg/engine"
+)
+
+func storageEntryK3s(name string) *storage.Entry {
+	return &storage.Entry{Name: name, Scheduler: storage.SchedulerK3s}
+}
+
+func storageAttachment(containerPath string, subpath string) *storage.Attachment {
+	return &storage.Attachment{ContainerPath: containerPath, Subpath: subpath}
+}
+
+// renderProcessChart renders one of the chart templates against the given
+// process values, going through YAML the same way a real deploy does. That
+// round trip is the point: it exercises the struct's yaml tags against the
+// keys the template actually reads, so a rename on one side without the other
+// fails here instead of at helm upgrade time.
+func renderProcessChart(t *testing.T, templateName string, processName string, values ProcessValues) string {
+	t.Helper()
+
+	appValues := AppValues{
+		Global: GlobalValues{
+			AppName:      "demo",
+			DeploymentID: "1",
+			Namespace:    "default",
+			Image: GlobalImage{
+				Name: "dokku/demo:latest",
+				Type: "herokuish",
+			},
+		},
+		Processes: map[string]ProcessValues{processName: values},
+	}
+
+	encoded, err := yaml.Marshal(appValues)
+	if err != nil {
+		t.Fatalf("marshal values: %v", err)
+	}
+	rendered := map[string]interface{}{}
+	if err := yaml.Unmarshal(encoded, &rendered); err != nil {
+		t.Fatalf("unmarshal values: %v", err)
+	}
+
+	templateBody, err := templates.ReadFile("templates/chart/" + templateName)
+	if err != nil {
+		t.Fatalf("read template: %v", err)
+	}
+	helpers, err := templates.ReadFile("templates/chart/_helpers.tpl")
+	if err != nil {
+		t.Fatalf("read helpers: %v", err)
+	}
+
+	c := &chart.Chart{
+		Metadata: &chart.Metadata{APIVersion: chart.APIVersionV2, Name: "demo", Version: "0.0.1"},
+		Templates: []*chart.File{
+			{Name: "templates/" + templateName, Data: templateBody},
+			{Name: "templates/_helpers.tpl", Data: helpers},
+		},
+	}
+
+	top, err := chartutil.ToRenderValues(c, rendered, chartutil.ReleaseOptions{Name: "demo", Namespace: "default"}, nil)
+	if err != nil {
+		t.Fatalf("render values: %v", err)
+	}
+	out, err := engine.Render(c, top)
+	if err != nil {
+		t.Fatalf("render chart: %v", err)
+	}
+
+	return out["demo/templates/"+templateName]
+}
+
+// podSpecFrom decodes the rendered manifest and returns the pod spec at the
+// given path, so the assertions below read the same structure the API server
+// would rather than counting indentation.
+func podSpecFrom(t *testing.T, manifest string, path ...string) map[string]interface{} {
+	t.Helper()
+
+	decoder := yaml.NewDecoder(strings.NewReader(manifest))
+	doc := map[string]interface{}{}
+	for {
+		candidate := map[string]interface{}{}
+		if err := decoder.Decode(&candidate); err != nil {
+			break
+		}
+		if len(candidate) > 0 {
+			doc = candidate
+			break
+		}
+	}
+	if len(doc) == 0 {
+		t.Fatalf("no document decoded from manifest:\n%s", manifest)
+	}
+
+	current := doc
+	for _, key := range path {
+		next, ok := current[key].(map[string]interface{})
+		if !ok {
+			t.Fatalf("key %q missing while walking %v in manifest:\n%s", key, path, manifest)
+		}
+		current = next
+	}
+	return current
+}
+
+// volumeNamesFrom returns the pod-level volume names, and mountsFrom the
+// container-level mounts, of a decoded pod spec.
+func volumeNamesFrom(t *testing.T, podSpec map[string]interface{}) []string {
+	t.Helper()
+
+	names := []string{}
+	volumes, _ := podSpec["volumes"].([]interface{})
+	for _, entry := range volumes {
+		volume, ok := entry.(map[string]interface{})
+		if !ok {
+			t.Fatalf("unexpected volume entry %#v", entry)
+		}
+		names = append(names, volume["name"].(string))
+	}
+	return names
+}
+
+func mountsFrom(t *testing.T, podSpec map[string]interface{}) []map[string]interface{} {
+	t.Helper()
+
+	containers, _ := podSpec["containers"].([]interface{})
+	if len(containers) == 0 {
+		t.Fatalf("no containers in pod spec %#v", podSpec)
+	}
+	container, ok := containers[0].(map[string]interface{})
+	if !ok {
+		t.Fatalf("unexpected container entry %#v", containers[0])
+	}
+
+	mounts := []map[string]interface{}{}
+	raw, _ := container["volumeMounts"].([]interface{})
+	for _, entry := range raw {
+		mount, ok := entry.(map[string]interface{})
+		if !ok {
+			t.Fatalf("unexpected volumeMount entry %#v", entry)
+		}
+		mounts = append(mounts, mount)
+	}
+	return mounts
+}
+
+// TestDeploymentRendersOneVolumePerNameAndOneMountPerPath is the regression
+// for a storage entry mounted at two container paths. Kubernetes requires pod
+// volume names to be unique, so the pod must declare the PVC once and bind it
+// twice - emitting it twice is rejected with "Duplicate value".
+func TestDeploymentRendersOneVolumePerNameAndOneMountPerPath(t *testing.T) {
+	pairs := []AppMountPair{
+		{
+			Entry:      storageEntryK3s("demo-pvc"),
+			Attachment: storageAttachment("/one", ""),
+		},
+		{
+			Entry:      storageEntryK3s("demo-pvc"),
+			Attachment: storageAttachment("/two", "sub"),
+		},
+	}
+
+	manifest := renderProcessChart(t, "deployment.yaml", "web", ProcessValues{
+		ProcessType: ProcessType_Worker,
+		Replicas:    1,
+		Volumes:     ToProcessVolumes(pairs, "web"),
+	})
+
+	podSpec := podSpecFrom(t, manifest, "spec", "template", "spec")
+
+	names := volumeNamesFrom(t, podSpec)
+	if len(names) != 1 || names[0] != "demo-pvc" {
+		t.Fatalf("expected a single pod volume named demo-pvc, got %v\n%s", names, manifest)
+	}
+
+	mounts := mountsFrom(t, podSpec)
+	if len(mounts) != 2 {
+		t.Fatalf("expected 2 volume mounts, got %d\n%s", len(mounts), manifest)
+	}
+	if mounts[0]["mountPath"] != "/one" || mounts[1]["mountPath"] != "/two" {
+		t.Errorf("expected mounts at /one and /two, got %v and %v", mounts[0]["mountPath"], mounts[1]["mountPath"])
+	}
+	if mounts[1]["subPath"] != "sub" {
+		t.Errorf("expected subPath sub on the second mount, got %v", mounts[1]["subPath"])
+	}
+	if !strings.Contains(manifest, "claimName: demo-pvc") {
+		t.Errorf("expected the PVC to be referenced, got:\n%s", manifest)
+	}
+}
+
+// TestCronJobRendersOneVolumePerName covers the same rule in the cron-job
+// template, which renders its volumes from the same two lists.
+func TestCronJobRendersOneVolumePerName(t *testing.T) {
+	pairs := []AppMountPair{
+		{
+			Entry:      storageEntryK3s("demo-pvc"),
+			Attachment: storageAttachment("/one", ""),
+		},
+		{
+			Entry:      storageEntryK3s("demo-pvc"),
+			Attachment: storageAttachment("/two", ""),
+		},
+	}
+
+	manifest := renderProcessChart(t, "cron-job.yaml", "cron-1", ProcessValues{
+		ProcessType: ProcessType_Cron,
+		Replicas:    1,
+		Cron: ProcessCron{
+			ID:       "abc123",
+			Hash:     "abc123",
+			Schedule: "*/5 * * * *",
+			Suffix:   "aaaaa",
+		},
+		Volumes: ToProcessVolumes(pairs, ""),
+	})
+
+	podSpec := podSpecFrom(t, manifest, "spec", "jobTemplate", "spec", "template", "spec")
+
+	if names := volumeNamesFrom(t, podSpec); len(names) != 1 || names[0] != "demo-pvc" {
+		t.Fatalf("expected a single pod volume named demo-pvc, got %v\n%s", names, manifest)
+	}
+	if mounts := mountsFrom(t, podSpec); len(mounts) != 2 {
+		t.Fatalf("expected 2 volume mounts, got %d\n%s", len(mounts), manifest)
+	}
+
+	// A cron expression starting with `*` is not a valid plain YAML scalar, so
+	// the schedule has to render quoted or the whole manifest fails to parse.
+	spec := podSpecFrom(t, manifest, "spec")
+	if spec["schedule"] != "*/5 * * * *" {
+		t.Errorf("expected the schedule to survive rendering, got %v", spec["schedule"])
+	}
+}
diff --git a/plugins/scheduler-k3s/functions.go b/plugins/scheduler-k3s/functions.go
index c1164d813..ff13cf359 100644
--- a/plugins/scheduler-k3s/functions.go
+++ b/plugins/scheduler-k3s/functions.go
@@ -12,6 +12,7 @@ import (
 	"os"
 	"path/filepath"
 	"regexp"
+	"slices"
 	"sort"
 	"strconv"
 	"strings"
@@ -36,6 +37,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/validation"
 	"k8s.io/apimachinery/pkg/util/wait"
+	utilexec "k8s.io/client-go/util/exec"
 	"k8s.io/kubernetes/pkg/client/conditions"
 	"k8s.io/utils/ptr"
 	"mvdan.cc/sh/v3/shell"
@@ -409,6 +411,24 @@ func createKubernetesNamespace(ctx context.Context, namespaceName string) error
 	return nil
 }
 
+// attachExitError surfaces the exit code of the remote command from a
+// kubernetes exec stream as an ExitCodeError, so that attached sessions
+// (dokku run in interactive mode, dokku enter) exit with the command's own
+// status rather than a generic failure, matching docker-local scheduler
+// behavior. Other errors pass through unchanged.
+func attachExitError(err error) error {
+	if err == nil {
+		return nil
+	}
+
+	var coded utilexec.CodeExitError
+	if errors.As(err, &coded) && coded.Code > 0 {
+		return &ExitCodeError{Code: coded.Code, Message: coded.Error()}
+	}
+
+	return err
+}
+
 func enterPod(ctx context.Context, input EnterPodInput) error {
 	labelSelector := []string{}
 	for k, v := range input.SelectedPod.Labels {
@@ -440,13 +460,13 @@ func enterPod(ctx context.Context, input EnterPodInput) error {
 		return fmt.Errorf("No container specified and no default container found")
 	}
 
-	return input.Clientset.ExecCommand(ctx, ExecCommandInput{
+	return attachExitError(input.Clientset.ExecCommand(ctx, ExecCommandInput{
 		Command:       input.Command,
 		ContainerName: input.SelectedContainerName,
 		Entrypoint:    input.Entrypoint,
 		Name:          input.SelectedPod.Name,
 		Namespace:     input.SelectedPod.Namespace,
-	})
+	}))
 }
 
 func extractStartCommand(input StartCommandInput) string {
@@ -800,6 +820,20 @@ func getComputedDeployTimeout(appName string) string {
 	return deployTimeout
 }
 
+// getHelmChart returns the helm chart managed by dokku with the given release name
+func getHelmChart(chartName string) (HelmChart, error) {
+	knownCharts := []string{}
+	for _, chart := range HelmCharts {
+		if chart.ReleaseName == chartName {
+			return chart, nil
+		}
+		knownCharts = append(knownCharts, chart.ReleaseName)
+	}
+
+	sort.Strings(knownCharts)
+	return HelmChart{}, fmt.Errorf("Invalid chart name %q, valid charts: %s", chartName, strings.Join(knownCharts, ", "))
+}
+
 func getImagePullSecrets(appName string) string {
 	return common.PropertyGet("scheduler-k3s", appName, "image-pull-secrets")
 }
@@ -1024,6 +1058,10 @@ func getIngressAnnotations(appName string, processType string) (map[string]strin
 				return fmt.Sprintf("proxy_busy_buffers_size %s;", value)
 			},
 		},
+		"proxy-http-version": {
+			annotation: "nginx.ingress.kubernetes.io/proxy-http-version",
+			getter:     nginxvhosts.ComputedProxyHttpVersion,
+		},
 		"proxy-connect-timeout": {
 			annotation: "nginx.ingress.kubernetes.io/proxy-connect-timeout",
 			getter:     nginxvhosts.ComputedProxyConnectTimeout,
@@ -1626,8 +1664,12 @@ func getComputedKustomizeRootPath(appName string) string {
 	return kustomizeRootPath
 }
 
+func getGlobalNodeSysctlsImage() string {
+	return common.PropertyGet("scheduler-k3s", "--global", "node-sysctls-image")
+}
+
 func getComputedNodeSysctlsImage() string {
-	image := common.PropertyGet("scheduler-k3s", "--global", "node-sysctls-image")
+	image := getGlobalNodeSysctlsImage()
 	if image == "" {
 		image = DefaultNodeSysctlsImage
 	}
@@ -1635,8 +1677,12 @@ func getComputedNodeSysctlsImage() string {
 	return image
 }
 
+func getGlobalNodeSysctlsPauseImage() string {
+	return common.PropertyGet("scheduler-k3s", "--global", "node-sysctls-pause-image")
+}
+
 func getComputedNodeSysctlsPauseImage() string {
-	image := common.PropertyGet("scheduler-k3s", "--global", "node-sysctls-pause-image")
+	image := getGlobalNodeSysctlsPauseImage()
 	if image == "" {
 		image = DefaultNodeSysctlsPauseImage
 	}
@@ -1918,7 +1964,7 @@ func getProcessResources(appName string, processType string) (ProcessResourcesMa
 		if err != nil {
 			return ProcessResourcesMap{}, fmt.Errorf("Error parsing memory limit: %w", err)
 		}
-		if quantity != "0Mi" {
+		if quantity != "0" {
 			processResources.Limits.Memory = quantity
 		} else {
 			processResources.Limits.Memory = ""
@@ -1949,7 +1995,7 @@ func getProcessResources(appName string, processType string) (ProcessResourcesMa
 		if err != nil {
 			return ProcessResourcesMap{}, fmt.Errorf("Error parsing memory request: %w", err)
 		}
-		if quantity != "0Mi" {
+		if quantity != "0" {
 			processResources.Requests.Memory = quantity
 		} else {
 			processResources.Requests.Memory = ""
@@ -2112,7 +2158,7 @@ func getProcessSpecificKustomizeRootPath(appName string) string {
 func hasKustomizeDirectory(appName string) bool {
 	directory := getKustomizeDirectory(appName)
 
-	if common.DirectoryExists(fmt.Sprintf("%s.%s.missing", directory, os.Getenv("DOKKU_PID"))) {
+	if common.FileExists(fmt.Sprintf("%s.%s.missing", directory, os.Getenv("DOKKU_PID"))) {
 		return false
 	}
 
@@ -2123,19 +2169,68 @@ func hasKustomizeDirectory(appName string) bool {
 	return common.DirectoryExists(directory)
 }
 
-func installHelmCharts(ctx context.Context, clientset KubernetesClient, shouldInstall func(HelmChart) bool) error {
-	for _, repo := range HelmRepositories {
-		helmAgent, err := NewHelmAgent("default", DeployLogPrinter)
-		if err != nil {
-			return fmt.Errorf("Error creating helm agent: %w", err)
-		}
+// ChartInstallDecisionInput is the input for the chartInstallDecision function
+type ChartInstallDecisionInput struct {
+	// Chart is the chart being evaluated
+	Chart HelmChart
 
-		err = helmAgent.AddRepository(ctx, AddRepositoryInput(repo))
-		if err != nil {
-			return fmt.Errorf("Error adding helm repository %s: %w", repo.Name, err)
+	// ForceChartNames is the list of release names to install regardless of state
+	ForceChartNames []string
+
+	// ForceInstall is whether every chart should be installed regardless of state
+	ForceInstall bool
+
+	// IngressClass is the ingress class configured for the cluster
+	IngressClass string
+
+	// InstalledRevision is the helm release currently installed for the chart
+	InstalledRevision Release
+}
+
+// ChartInstallDecision reports whether a chart should be installed and why
+type ChartInstallDecision struct {
+	// Install is whether the chart should be installed
+	Install bool
+
+	// Reason describes why the chart is being installed or skipped
+	Reason string
+}
+
+// chartInstallDecision reports whether a chart should be installed, and why. A
+// chart whose installed release has drifted from the pinned version is
+// reinstalled so that the pinned version is what ends up on the cluster.
+func chartInstallDecision(input ChartInstallDecisionInput) ChartInstallDecision {
+	if input.Chart.ChartPath == "traefik" && input.IngressClass == "nginx" {
+		return ChartInstallDecision{Install: false, Reason: "Skipping chart due to ingress-class mismatch"}
+	}
+
+	if input.Chart.ChartPath == "ingress-nginx" && input.IngressClass == "traefik" {
+		return ChartInstallDecision{Install: false, Reason: "Skipping chart due to ingress-class mismatch"}
+	}
+
+	if input.ForceInstall {
+		return ChartInstallDecision{Install: true, Reason: "Force installing chart"}
+	}
+
+	if slices.Contains(input.ForceChartNames, input.Chart.ReleaseName) {
+		return ChartInstallDecision{Install: true, Reason: "Force installing chart due to flag"}
+	}
+
+	if input.InstalledRevision.Name == "" {
+		return ChartInstallDecision{Install: true, Reason: "Installing missing chart"}
+	}
+
+	if input.InstalledRevision.Version != input.Chart.Version {
+		return ChartInstallDecision{
+			Install: true,
+			Reason:  fmt.Sprintf("Installing chart due to version mismatch: %s != %s", input.InstalledRevision.Version, input.Chart.Version),
 		}
 	}
 
+	return ChartInstallDecision{Install: false, Reason: "Skipping chart: already installed"}
+}
+
+func installHelmCharts(ctx context.Context, clientset KubernetesClient, shouldInstall func(HelmChart) bool) error {
 	for _, chart := range HelmCharts {
 		if !shouldInstall(chart) {
 			continue
@@ -2643,17 +2738,14 @@ func cronIDLabelValue(cronID string) string {
 	return hex.EncodeToString(sum[:])
 }
 
-// parseMemoryQuantity parses a string into a valid memory quantity
+// parseMemoryQuantity parses a docker-compatible memory value into a binary memory quantity
 func parseMemoryQuantity(input string) (string, error) {
-	if _, err := strconv.ParseInt(input, 10, 64); err == nil {
-		input = fmt.Sprintf("%sMi", input)
-	}
-	quantity, err := resource.ParseQuantity(input)
+	bytes, err := common.ParseMemoryBytes(input)
 	if err != nil {
 		return "", err
 	}
 
-	return quantity.String(), nil
+	return resource.NewQuantity(bytes, resource.BinarySI).String(), nil
 }
 
 func uninstallHelperCommands(ctx context.Context) error {
diff --git a/plugins/scheduler-k3s/functions_test.go b/plugins/scheduler-k3s/functions_test.go
index aad7ab8c6..e17926fd6 100644
--- a/plugins/scheduler-k3s/functions_test.go
+++ b/plugins/scheduler-k3s/functions_test.go
@@ -1,11 +1,14 @@
 package scheduler_k3s
 
 import (
+	"errors"
+	"fmt"
 	"strings"
 	"testing"
 
 	"github.com/dokku/dokku/plugins/common"
 	corev1 "k8s.io/api/core/v1"
+	utilexec "k8s.io/client-go/util/exec"
 )
 
 func TestNeedsImagePullSecretsPrune(t *testing.T) {
@@ -430,6 +433,38 @@ func TestValidateCertIssuerName(t *testing.T) {
 	}
 }
 
+func TestGetHelmChart(t *testing.T) {
+	for _, chart := range HelmCharts {
+		got, err := getHelmChart(chart.ReleaseName)
+		if err != nil {
+			t.Fatalf("getHelmChart(%q) unexpected error: %v", chart.ReleaseName, err)
+		}
+		if got.ReleaseName != chart.ReleaseName {
+			t.Fatalf("getHelmChart(%q) returned chart %q", chart.ReleaseName, got.ReleaseName)
+		}
+	}
+
+	for _, name := range []string{"", "not-a-chart", "Traefik"} {
+		_, err := getHelmChart(name)
+		if err == nil {
+			t.Fatalf("getHelmChart(%q) expected an error", name)
+		}
+		if !strings.HasPrefix(err.Error(), fmt.Sprintf("Invalid chart name %q, valid charts: ", name)) {
+			t.Fatalf("getHelmChart(%q) unexpected error: %v", name, err)
+		}
+
+		listed := strings.Split(strings.SplitN(err.Error(), "valid charts: ", 2)[1], ", ")
+		if len(listed) != len(HelmCharts) {
+			t.Fatalf("getHelmChart(%q) listed %d charts, want %d", name, len(listed), len(HelmCharts))
+		}
+		for i := 1; i < len(listed); i++ {
+			if listed[i-1] > listed[i] {
+				t.Fatalf("getHelmChart(%q) listed charts out of order: %v", name, listed)
+			}
+		}
+	}
+}
+
 func TestValidateLetsencryptServer(t *testing.T) {
 	cases := []struct {
 		name    string
@@ -484,6 +519,47 @@ func TestDomainSlug(t *testing.T) {
 	}
 }
 
+func TestParseMemoryQuantity(t *testing.T) {
+	cases := []struct {
+		name    string
+		input   string
+		want    string
+		wantErr bool
+	}{
+		{name: "unitless value defaults to megabytes", input: "512", want: "512Mi"},
+		{name: "lowercase megabytes are not millibytes", input: "256m", want: "256Mi"},
+		{name: "uppercase gigabytes are binary", input: "1G", want: "1Gi"},
+		{name: "lowercase gigabytes", input: "1g", want: "1Gi"},
+		{name: "kubernetes binary unit", input: "1Gi", want: "1Gi"},
+		{name: "two letter unit", input: "512MB", want: "512Mi"},
+		{name: "decimal value", input: "1.5g", want: "1536Mi"},
+		{name: "bytes", input: "100b", want: "100"},
+		{name: "zero", input: "0Mi", want: "0"},
+		{name: "invalid unit", input: "1x", wantErr: true},
+		{name: "kubernetes exponent", input: "1e9", wantErr: true},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			got, err := parseMemoryQuantity(tc.input)
+			if tc.wantErr {
+				if err == nil {
+					t.Fatalf("parseMemoryQuantity(%q) = %q, want error", tc.input, got)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("parseMemoryQuantity(%q) unexpected error: %v", tc.input, err)
+			}
+			if got != tc.want {
+				t.Errorf("parseMemoryQuantity(%q) = %q, want %q", tc.input, got, tc.want)
+			}
+		})
+	}
+}
+
 func TestDomainSlugDistinguishesWildcardFromApex(t *testing.T) {
 	// A kubernetes wildcard host matches exactly one label, so *.example.com does not
 	// cover example.com and both are commonly added to the same app. The generated
@@ -681,3 +757,170 @@ func TestResolveAppTLSConfig(t *testing.T) {
 		})
 	}
 }
+
+func TestAttachExitError(t *testing.T) {
+	plainErr := errors.New("boom")
+	codedErr := utilexec.CodeExitError{
+		Err:  fmt.Errorf("command terminated with exit code 3"),
+		Code: 3,
+	}
+
+	if err := attachExitError(nil); err != nil {
+		t.Errorf("attachExitError(nil) = %v, want nil", err)
+	}
+
+	if err := attachExitError(plainErr); err != plainErr {
+		t.Errorf("attachExitError(plain error) = %v, want the original error", err)
+	}
+
+	err := attachExitError(codedErr)
+	if err == nil {
+		t.Fatal("attachExitError(CodeExitError) = nil, want ExitCodeError")
+	}
+	exitErr, ok := err.(*ExitCodeError)
+	if !ok {
+		t.Fatalf("attachExitError(CodeExitError) returned %T, want *ExitCodeError", err)
+	}
+	if exitErr.Code != 3 {
+		t.Errorf("Code = %d, want 3", exitErr.Code)
+	}
+	if err.Error() != "command terminated with exit code 3" {
+		t.Errorf("Error() = %q, want %q", err.Error(), "command terminated with exit code 3")
+	}
+
+	zeroCodeErr := utilexec.CodeExitError{
+		Err:  fmt.Errorf("command terminated with exit code 0"),
+		Code: 0,
+	}
+	if err := attachExitError(zeroCodeErr); err != zeroCodeErr {
+		t.Errorf("attachExitError(zero code error) = %v, want the original error", err)
+	}
+}
+
+func TestChartInstallDecision(t *testing.T) {
+	traefik := HelmChart{ChartPath: "traefik", ReleaseName: "traefik", Version: "26.0.0"}
+	ingressNginx := HelmChart{ChartPath: "ingress-nginx", ReleaseName: "ingress-nginx", Version: "4.15.1"}
+	installed := Release{Name: "traefik", Version: "26.0.0"}
+
+	cases := []struct {
+		name        string
+		input       ChartInstallDecisionInput
+		wantInstall bool
+		wantReason  string
+	}{
+		{
+			name: "traefik is skipped when the ingress class is nginx",
+			input: ChartInstallDecisionInput{
+				Chart:        traefik,
+				ForceInstall: true,
+				IngressClass: "nginx",
+			},
+			wantInstall: false,
+			wantReason:  "Skipping chart due to ingress-class mismatch",
+		},
+		{
+			name: "ingress-nginx is skipped when the ingress class is traefik",
+			input: ChartInstallDecisionInput{
+				Chart:        ingressNginx,
+				ForceInstall: true,
+				IngressClass: "traefik",
+			},
+			wantInstall: false,
+			wantReason:  "Skipping chart due to ingress-class mismatch",
+		},
+		{
+			name: "force installs an up to date chart",
+			input: ChartInstallDecisionInput{
+				Chart:             traefik,
+				ForceInstall:      true,
+				IngressClass:      "traefik",
+				InstalledRevision: installed,
+			},
+			wantInstall: true,
+			wantReason:  "Force installing chart",
+		},
+		{
+			name: "a named chart installs even when up to date",
+			input: ChartInstallDecisionInput{
+				Chart:             traefik,
+				ForceChartNames:   []string{"traefik"},
+				IngressClass:      "traefik",
+				InstalledRevision: installed,
+			},
+			wantInstall: true,
+			wantReason:  "Force installing chart due to flag",
+		},
+		{
+			name: "a chart named for another release is left alone",
+			input: ChartInstallDecisionInput{
+				Chart:             traefik,
+				ForceChartNames:   []string{"vector"},
+				IngressClass:      "traefik",
+				InstalledRevision: installed,
+			},
+			wantInstall: false,
+			wantReason:  "Skipping chart: already installed",
+		},
+		{
+			name: "a missing release is installed",
+			input: ChartInstallDecisionInput{
+				Chart:        traefik,
+				IngressClass: "traefik",
+			},
+			wantInstall: true,
+			wantReason:  "Installing missing chart",
+		},
+		{
+			name: "a release behind the pinned version is upgraded",
+			input: ChartInstallDecisionInput{
+				Chart:             traefik,
+				IngressClass:      "traefik",
+				InstalledRevision: Release{Name: "traefik", Version: "25.0.0"},
+			},
+			wantInstall: true,
+			wantReason:  "Installing chart due to version mismatch: 25.0.0 != 26.0.0",
+		},
+		{
+			name: "a release ahead of the pinned version is reconciled back",
+			input: ChartInstallDecisionInput{
+				Chart:             traefik,
+				IngressClass:      "traefik",
+				InstalledRevision: Release{Name: "traefik", Version: "41.6.0"},
+			},
+			wantInstall: true,
+			wantReason:  "Installing chart due to version mismatch: 41.6.0 != 26.0.0",
+		},
+		{
+			name: "the mismatch reason reports the chart version, not the app version",
+			input: ChartInstallDecisionInput{
+				Chart:             traefik,
+				IngressClass:      "traefik",
+				InstalledRevision: Release{Name: "traefik", AppVersion: "v2.11.0", Version: "41.6.0"},
+			},
+			wantInstall: true,
+			wantReason:  "Installing chart due to version mismatch: 41.6.0 != 26.0.0",
+		},
+		{
+			name: "a release at the pinned version is skipped",
+			input: ChartInstallDecisionInput{
+				Chart:             traefik,
+				IngressClass:      "traefik",
+				InstalledRevision: installed,
+			},
+			wantInstall: false,
+			wantReason:  "Skipping chart: already installed",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := chartInstallDecision(tc.input)
+			if got.Install != tc.wantInstall {
+				t.Errorf("Install = %t, want %t", got.Install, tc.wantInstall)
+			}
+			if got.Reason != tc.wantReason {
+				t.Errorf("Reason = %q, want %q", got.Reason, tc.wantReason)
+			}
+		})
+	}
+}
diff --git a/plugins/scheduler-k3s/go.mod b/plugins/scheduler-k3s/go.mod
index 5cd351051..7d5a6d3bf 100644
--- a/plugins/scheduler-k3s/go.mod
+++ b/plugins/scheduler-k3s/go.mod
@@ -1,11 +1,11 @@
 module github.com/dokku/dokku/plugins/scheduler-k3s
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/Masterminds/semver/v3 v3.5.0
 	github.com/aryann/difflib v0.0.0-20210328193216-ff5ff6dc229b
-	github.com/cert-manager/cert-manager v1.21.1
+	github.com/cert-manager/cert-manager v1.21.3
 	github.com/dokku/dokku/plugins/app-json v0.0.0-00010101000000-000000000000
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
 	github.com/dokku/dokku/plugins/config v0.0.0-00010101000000-000000000000
@@ -16,30 +16,29 @@ require (
 	github.com/dokku/dokku/plugins/registry v0.0.0-00010101000000-000000000000
 	github.com/dokku/dokku/plugins/storage v0.0.0-00010101000000-000000000000
 	github.com/fatih/color v1.19.0
-	github.com/fluxcd/pkg/kustomize v1.39.0
-	github.com/go-openapi/jsonpointer v1.0.0
+	github.com/fluxcd/pkg/kustomize v1.44.0
+	github.com/go-openapi/jsonpointer v1.0.2
 	github.com/go-resty/resty/v2 v2.17.2
-	github.com/gofrs/flock v0.13.0
 	github.com/gosimple/slug v1.15.0
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
-	github.com/kedacore/keda/v2 v2.20.2
+	github.com/kedacore/keda/v2 v2.21.0
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d
-	github.com/onsi/gomega v1.42.1
+	github.com/onsi/gomega v1.44.0
 	github.com/ryanuber/columnize v2.1.2+incompatible
-	github.com/spf13/pflag v1.0.10
-	github.com/traefik/traefik/v2 v2.11.55
-	golang.org/x/sync v0.22.0
+	github.com/spf13/pflag v1.1.0
+	github.com/traefik/traefik/v2 v2.11.61
+	golang.org/x/sync v0.25.0
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
-	helm.sh/helm/v3 v3.21.4
-	k8s.io/api v0.36.3
-	k8s.io/apimachinery v0.36.3
-	k8s.io/client-go v0.36.3
-	k8s.io/kubectl v0.36.3
-	k8s.io/kubernetes v1.36.3
-	k8s.io/utils v0.0.0-20260626114624-be93311217bd
-	mvdan.cc/sh/v3 v3.13.1
-	sigs.k8s.io/kustomize/api v0.21.1
+	helm.sh/helm/v3 v3.22.1
+	k8s.io/api v0.37.2
+	k8s.io/apimachinery v0.37.2
+	k8s.io/client-go v0.37.2
+	k8s.io/kubectl v0.37.2
+	k8s.io/kubernetes v1.37.2
+	k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3
+	mvdan.cc/sh/v3 v3.14.1
+	sigs.k8s.io/kustomize/api v0.21.2
 )
 
 require (
@@ -70,26 +69,26 @@ require (
 	github.com/expr-lang/expr v1.17.8 // indirect
 	github.com/fastfishio/qson v1.0.2 // indirect
 	github.com/fsnotify/fsnotify v1.10.1 // indirect
-	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.3 // indirect
 	github.com/go-acme/lego/v5 v5.2.2 // indirect
 	github.com/go-errors/errors v1.5.1 // indirect
 	github.com/go-gorp/gorp/v3 v3.1.0 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
-	github.com/go-openapi/jsonreference v0.21.5 // indirect
-	github.com/go-openapi/swag v0.26.0 // indirect
-	github.com/go-openapi/swag/cmdutils v0.26.0 // indirect
-	github.com/go-openapi/swag/conv v0.26.0 // indirect
-	github.com/go-openapi/swag/fileutils v0.26.0 // indirect
-	github.com/go-openapi/swag/jsonname v0.26.1 // indirect
-	github.com/go-openapi/swag/jsonutils v0.26.0 // indirect
-	github.com/go-openapi/swag/loading v0.26.0 // indirect
-	github.com/go-openapi/swag/mangling v0.26.0 // indirect
-	github.com/go-openapi/swag/netutils v0.26.0 // indirect
-	github.com/go-openapi/swag/stringutils v0.26.0 // indirect
-	github.com/go-openapi/swag/typeutils v0.26.0 // indirect
-	github.com/go-openapi/swag/yamlutils v0.26.0 // indirect
-	github.com/gobwas/glob v0.2.3 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.6 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
+	github.com/go-openapi/jsonreference v1.0.1 // indirect
+	github.com/go-openapi/swag v0.29.1 // indirect
+	github.com/go-openapi/swag/cmdutils v0.29.1 // indirect
+	github.com/go-openapi/swag/conv v0.29.1 // indirect
+	github.com/go-openapi/swag/fileutils v0.29.1 // indirect
+	github.com/go-openapi/swag/jsonutils v0.29.1 // indirect
+	github.com/go-openapi/swag/loading v0.29.1 // indirect
+	github.com/go-openapi/swag/mangling v0.29.1 // indirect
+	github.com/go-openapi/swag/netutils v0.29.1 // indirect
+	github.com/go-openapi/swag/pools v0.29.1 // indirect
+	github.com/go-openapi/swag/stringutils v0.29.1 // indirect
+	github.com/go-openapi/swag/typeutils v0.29.1 // indirect
+	github.com/go-openapi/swag/yamlutils v0.29.1 // indirect
+	github.com/gobwas/glob v1.0.0 // indirect
 	github.com/google/btree v1.1.3 // indirect
 	github.com/google/gnostic-models v0.7.1 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
@@ -110,9 +109,9 @@ require (
 	github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect
 	github.com/lib/pq v1.12.3 // indirect
 	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
-	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-colorable v0.1.15 // indirect
 	github.com/mattn/go-isatty v0.0.24 // indirect
-	github.com/mattn/go-runewidth v0.0.20 // indirect
+	github.com/mattn/go-runewidth v0.0.28 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/miekg/dns v1.1.72 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
@@ -134,16 +133,16 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/prometheus/client_golang v1.23.2 // indirect
-	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.67.5 // indirect
-	github.com/prometheus/procfs v0.20.1 // indirect
+	github.com/prometheus/client_golang v1.24.1 // indirect
+	github.com/prometheus/client_model v0.6.3 // indirect
+	github.com/prometheus/common v0.71.0 // indirect
+	github.com/prometheus/procfs v0.22.0 // indirect
 	github.com/robfig/cron/v3 v3.0.1 // indirect
 	github.com/rubenv/sql-migrate v1.8.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
-	github.com/sirupsen/logrus v1.9.4 // indirect
+	github.com/sirupsen/logrus v1.10.2 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/spf13/cobra v1.10.2 // indirect
 	github.com/tailscale/hujson v0.0.0-20250605163823-992244df8c5a // indirect
@@ -151,34 +150,34 @@ require (
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/mod v0.40.0 // indirect
-	golang.org/x/net v0.58.0 // indirect
-	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/term v0.45.0 // indirect
-	golang.org/x/text v0.41.0 // indirect
-	golang.org/x/time v0.15.0 // indirect
-	golang.org/x/tools v0.49.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/mod v0.41.0 // indirect
+	golang.org/x/net v0.62.0 // indirect
+	golang.org/x/oauth2 v0.37.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/term v0.47.0 // indirect
+	golang.org/x/text v0.43.0 // indirect
+	golang.org/x/time v0.16.0 // indirect
+	golang.org/x/tools v0.51.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
-	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
+	google.golang.org/protobuf v1.36.12 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	k8s.io/apiextensions-apiserver v0.36.2 // indirect
-	k8s.io/apiserver v0.36.2 // indirect
-	k8s.io/cli-runtime v0.36.3 // indirect
-	k8s.io/component-base v0.36.3 // indirect
+	k8s.io/apiextensions-apiserver v0.37.1 // indirect
+	k8s.io/apiserver v0.37.1 // indirect
+	k8s.io/cli-runtime v0.37.2 // indirect
+	k8s.io/component-base v0.37.2 // indirect
 	k8s.io/klog/v2 v2.140.0 // indirect
-	k8s.io/kube-openapi v0.0.0-20260603220949-865597e52e25 // indirect
-	k8s.io/streaming v0.36.3 // indirect
+	k8s.io/kube-openapi v0.0.0-20260821135717-be32def86098 // indirect
+	k8s.io/streaming v0.37.2 // indirect
 	oras.land/oras-go/v2 v2.6.2 // indirect
-	sigs.k8s.io/controller-runtime v0.24.1 // indirect
+	sigs.k8s.io/controller-runtime v0.25.2 // indirect
 	sigs.k8s.io/gateway-api v1.6.0 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
-	sigs.k8s.io/kustomize/kyaml v0.21.1 // indirect
+	sigs.k8s.io/kustomize/kyaml v0.21.2 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.4.2 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 	software.sslmate.com/src/go-pkcs12 v0.7.3 // indirect
 )
@@ -201,6 +200,4 @@ replace github.com/dokku/dokku/plugins/registry => ../registry
 
 replace github.com/dokku/dokku/plugins/storage => ../storage
 
-replace github.com/joho/godotenv => github.com/joho/godotenv v1.2.0
-
 replace github.com/imdario/mergo => github.com/imdario/mergo v0.3.16
diff --git a/plugins/scheduler-k3s/go.sum b/plugins/scheduler-k3s/go.sum
index bc6040dd7..900e8142b 100644
--- a/plugins/scheduler-k3s/go.sum
+++ b/plugins/scheduler-k3s/go.sum
@@ -35,14 +35,12 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
-github.com/bshuster-repo/logrus-logstash-hook v1.1.0 h1:o2FzZifLg+z/DN1OFmzTWzZZx/roaqt8IPZCIVco8r4=
-github.com/bshuster-repo/logrus-logstash-hook v1.1.0/go.mod h1:Q2aXOe7rNuPgbBtPCOzYyWDvKX7+FpxE5sRdvcPoui0=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
 github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
-github.com/cert-manager/cert-manager v1.21.1 h1:0LttV37Q5c2CBNoHkjuI8sLKTXWZDC2SwQkxrBMKV9w=
-github.com/cert-manager/cert-manager v1.21.1/go.mod h1:sVwmLBWoiB1BRd0rJElBGQuiu94z4k7p3Kd0FRQyfgw=
+github.com/cert-manager/cert-manager v1.21.3 h1:s5xNJPfWSiBWLAxMmXw8runfcXMVVWM4kcMpZ1OODbY=
+github.com/cert-manager/cert-manager v1.21.3/go.mod h1:Y0beWPQTPpBNIdxwDX2EAL24ONep1H4jGOmSKPvoa0I=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/chai2010/gettext-go v1.0.3 h1:9liNh8t+u26xl5ddmWLmsOsdNLwkdRTg5AG+JnTiM80=
@@ -62,8 +60,8 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/distribution/distribution/v3 v3.1.1 h1:KUbk7C8CfaLXy8kbf/hGq9cad/wCoLB6dbWH6DMbmX0=
-github.com/distribution/distribution/v3 v3.1.1/go.mod h1:d7lXwZpph0bVcOj4Aqn0nMrWHIwRQGdiV5TLeI+/w6Y=
+github.com/distribution/distribution/v3 v3.1.2 h1:/Bv2YIqqSR00HiO49FT93hovy6r9IlrzwUDsJjCN5qg=
+github.com/distribution/distribution/v3 v3.1.2/go.mod h1:Oz0Drs2Tx3iTXzK3DhUD4otfTfqlCxlWVC7QJeXWBP0=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
@@ -72,8 +70,8 @@ github.com/docker/docker-credential-helpers v0.9.5 h1:EFNN8DHvaiK8zVqFA2DT6BjXE0
 github.com/docker/docker-credential-helpers v0.9.5/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c=
 github.com/docker/go-events v0.0.0-20250808211157-605354379745 h1:yOn6Ze6IbYI/KAw2lw/83ELYvZh6hvsygTVkD0dzMC4=
 github.com/docker/go-events v0.0.0-20250808211157-605354379745/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
-github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
-github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw=
+github.com/docker/go-metrics v0.1.0 h1:r76KPNpstz+IvQKSWpYegSkkyzex0V3A1ZGVx6bhGlY=
+github.com/docker/go-metrics v0.1.0/go.mod h1:PciI3sONtB051kXALN1JoIlpcu54E1FuPh+4DuqEzyw=
 github.com/dustin/go-jsonpointer v0.0.0-20160814072949-ba0abeacc3dc h1:tP7tkU+vIsEOKiK+l/NSLN4uUtkyuxc6hgYpQeCWAeI=
 github.com/dustin/go-jsonpointer v0.0.0-20160814072949-ba0abeacc3dc/go.mod h1:ORH5Qp2bskd9NzSfKqAF7tKfONsEkCarTE5ESr/RVBw=
 github.com/dustin/gojson v0.0.0-20160307161227-2e71ec9dd5ad h1:Qk76DOWdOp+GlyDKBAG3Klr9cn7N+LcYc82AZ2S7+cA=
@@ -92,10 +90,10 @@ github.com/fastfishio/qson v1.0.2 h1:AY1E9RjVQ9iNPP6G9NQcEXtHXBBq204zUR0tsNFIxFY
 github.com/fastfishio/qson v1.0.2/go.mod h1:QHBKJuWMgwEGYxdK3s1JKiRKwm5VgJx6vU3+kQa/kOU=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
-github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
-github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/fluxcd/pkg/kustomize v1.39.0 h1:NIlAJtm1lyBP7i8gHf0zQ1crH8OLuLA2C8G/uWiWhEY=
-github.com/fluxcd/pkg/kustomize v1.39.0/go.mod h1:OCKAb5Tc0bFVpeclk/W0uWjjlB9dcLm/6XMvx69zu/4=
+github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=
+github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=
+github.com/fluxcd/pkg/kustomize v1.44.0 h1:S9ExtSX/wuuqQpvpzuRewM+PTeBVD6IHymnVQE1vFhg=
+github.com/fluxcd/pkg/kustomize v1.44.0/go.mod h1:aCvOkEPXgo/35EmlBf3XiA4KPLQAbgNZ/xH22+B5Ols=
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568 h1:BHsljHzVlRcyQhjrss6TZTdY2VfCqZPbv5k3iBFa2ZQ=
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
 github.com/foxcpp/go-mockdns v1.2.0 h1:omK3OrHRD1IWJz1FuFBCFquhXslXoF17OvBS6JPzZF0=
@@ -104,8 +102,8 @@ github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHk
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
 github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
-github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ=
-github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/fxamacker/cbor/v2 v2.9.3 h1:oQBnFATpNdY8gJHTndDDv5Xl4QqNaz51G5LLEPhng3Q=
+github.com/fxamacker/cbor/v2 v2.9.3/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/gliderlabs/sigil v0.12.1 h1:LaKToA28BSi3F9V79+4NsyupS4/iawyX0jNtbhsR5TU=
 github.com/gliderlabs/sigil v0.12.1/go.mod h1:O6TGDuYPPHoiMad4W2FDsHgK39tNBYZRfhhUGOKgzRE=
 github.com/go-acme/lego/v5 v5.2.2 h1:KqFas/Ak2QDdU+Qm7MO9OEnS35zC000kPmM+5tLdZKk=
@@ -114,61 +112,59 @@ github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8b
 github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
 github.com/go-gorp/gorp/v3 v3.1.0 h1:ItKF/Vbuj31dmV4jxA1qblpSwkl9g1typ24xoe70IGs=
 github.com/go-gorp/gorp/v3 v3.1.0/go.mod h1:dLEjIyyRNiXvNZ8PSmzpt1GsWAUK8kjVhEpjH8TixEw=
-github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
-github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-jose/go-jose/v4 v4.1.6 h1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=
+github.com/go-jose/go-jose/v4 v4.1.6/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
 github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
-github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s=
-github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y=
-github.com/go-openapi/jsonreference v0.21.5 h1:6uCGVXU/aNF13AQNggxfysJ+5ZcU4nEAe+pJyVWRdiE=
-github.com/go-openapi/jsonreference v0.21.5/go.mod h1:u25Bw85sX4E2jzFodh1FOKMTZLcfifd1Q+iKKOUxExw=
-github.com/go-openapi/swag v0.26.0 h1:GVDXCmfvhfu1BxiHo8/FA+BbKmhecHnG3varjON5/RI=
-github.com/go-openapi/swag v0.26.0/go.mod h1:82g3193sZJRbocs7bNCqGfIgq8pkuwVwCfhKIRlEQF0=
-github.com/go-openapi/swag/cmdutils v0.26.0 h1:iowihOcvq7y4egO8cOq0dmfohz6wfeQ63U1EnuhO2TU=
-github.com/go-openapi/swag/cmdutils v0.26.0/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM=
-github.com/go-openapi/swag/conv v0.26.0 h1:5yGGsPYI1ZCva93U0AoKi/iZrNhaJEjr324YVsiD89I=
-github.com/go-openapi/swag/conv v0.26.0/go.mod h1:tpAmIL7X58VPnHHiSO4uE3jBeRamGsFsfdDeDtb5ECE=
-github.com/go-openapi/swag/fileutils v0.26.0 h1:WJoPRvsA7QRiiWluowkLJa9jaYR7FCuxmDvnCgaRRxU=
-github.com/go-openapi/swag/fileutils v0.26.0/go.mod h1:0WDJ7lp67eNjPMO50wAWYlKvhOb6CQ37rzR7wrgI8Tc=
-github.com/go-openapi/swag/jsonname v0.26.1 h1:VReupaV6WxlAsCn0e4DUfgV6bPmINnPpyJDLqSfNPcE=
-github.com/go-openapi/swag/jsonname v0.26.1/go.mod h1:OvdW6BoWoj33pTfi7x9vFrgmT+fk7aw0BRwvCE0YOuc=
-github.com/go-openapi/swag/jsonutils v0.26.0 h1:FawFML2iAXsPqmERscuMPIHmFsoP1tOqWkxBaKNMsnA=
-github.com/go-openapi/swag/jsonutils v0.26.0/go.mod h1:2VmA0CJlyFqgawOaPI9psnjFDqzyivIqLYN34t9p91E=
-github.com/go-openapi/swag/jsonutils/fixtures_test v0.26.0 h1:apqeINu/ICHouqiRZbyFvuDge5jCmmLTqGQ9V95EaOM=
-github.com/go-openapi/swag/jsonutils/fixtures_test v0.26.0/go.mod h1:AyM6QT8uz5IdKxk5akv0y6u4QvcL9GWERt0Jx/F/R8Y=
-github.com/go-openapi/swag/loading v0.26.0 h1:Apg6zaKhCJurpJer0DCxq99qwmhFddBhaMX7kilDcko=
-github.com/go-openapi/swag/loading v0.26.0/go.mod h1:dBxQ/6V2uBaAQdevN18VELE6xSpJWZxLX4txe12JwDg=
-github.com/go-openapi/swag/mangling v0.26.0 h1:Du2YC4YLA/Y5m/YKQd7AnY5qq0wRKSFZTTt8ktFaXcQ=
-github.com/go-openapi/swag/mangling v0.26.0/go.mod h1:jifS7W9vbg+pw63bT+GI53otluMQL3CeemuyCHKwVx0=
-github.com/go-openapi/swag/netutils v0.26.0 h1:CmZp+ZT7HrmFwrC3GdGsXBq2+42T1bjKBapcqVpIs3c=
-github.com/go-openapi/swag/netutils v0.26.0/go.mod h1:5iK+Ok3ZohWWex1C50BFTPexi03UaPwjW4Oj8kgrpwo=
-github.com/go-openapi/swag/stringutils v0.26.0 h1:qZQngLxs5s7SLijc3N2ZO+fUq2o8LjuWAASSrJuh+xg=
-github.com/go-openapi/swag/stringutils v0.26.0/go.mod h1:sWn5uY+QIIspwPhvgnqJsH8xqFT2ZbYcvbcFanRyhFE=
-github.com/go-openapi/swag/typeutils v0.26.0 h1:2kdEwdiNWy+JJdOvu5MA2IIg2SylWAFuuyQIKYybfq4=
-github.com/go-openapi/swag/typeutils v0.26.0/go.mod h1:oovDuIUvTrEHVMqWilQzKzV4YlSKgyZmFh7AlfABNVE=
-github.com/go-openapi/swag/yamlutils v0.26.0 h1:H7O8l/8NJJQ/oiReEN+oMpnGMyt8G0hl460nRZxhLMQ=
-github.com/go-openapi/swag/yamlutils v0.26.0/go.mod h1:1evKEGAtP37Pkwcc7EWMF0hedX0/x3Rkvei2wtG/TbU=
-github.com/go-openapi/testify/enable/yaml/v2 v2.4.2 h1:5zRca5jw7lzVREKCZVNBpysDNBjj74rBh0N2BGQbSR0=
-github.com/go-openapi/testify/enable/yaml/v2 v2.4.2/go.mod h1:XVevPw5hUXuV+5AkI1u1PeAm27EQVrhXTTCPAF85LmE=
-github.com/go-openapi/testify/v2 v2.6.0 h1:5PKH2HE7YJ/LuRPQGvSxBRlFXNQhSetBLlGAgUEu3ug=
-github.com/go-openapi/testify/v2 v2.6.0/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
-github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
-github.com/go-quicktest/qt v1.101.0/go.mod h1:14Bz/f7NwaXPtdYEgzsx46kqSxVwTbzVZsDC26tQJow=
+github.com/go-openapi/jsonpointer v1.0.2 h1:NbW7xT2b+l7x+JefiPGDsZWsrLk1ogrz4AHK1TTzMt8=
+github.com/go-openapi/jsonpointer v1.0.2/go.mod h1:N0rI4MbNKD7xAFTiHtB+5Nhrg2j/wwYg7m7Fmb4/jk8=
+github.com/go-openapi/jsonreference v1.0.1 h1:4zJ7AmYDKNmD3aSpfPnFNCFA5E80/xMHUNKgydaLh38=
+github.com/go-openapi/jsonreference v1.0.1/go.mod h1:dYplQXa6p5lXprLcJ8LE2iU7vNpXsAHDQ5ZAgL+Qx3A=
+github.com/go-openapi/swag v0.29.1 h1:C6EeWzUwQtcWEhE9eqBdUubGXxhWY4PlzHMLD7kLaiQ=
+github.com/go-openapi/swag v0.29.1/go.mod h1:BzxEXKiPlSXRsRTv1KSBF/BpGKHxA/YciCnr4tv9bvA=
+github.com/go-openapi/swag/cmdutils v0.29.1 h1:3DorPGfUdE80BogKY22EzoHBcHMrkVomZMoV7kS4ANY=
+github.com/go-openapi/swag/cmdutils v0.29.1/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM=
+github.com/go-openapi/swag/conv v0.29.1 h1:AC4Eh/5c/eUDOUCzzsRC9ghmFgOSBHeRMGIngY0ZUGA=
+github.com/go-openapi/swag/conv v0.29.1/go.mod h1:S1X7/ZrBEZOC0Wc8AGxjbcGS92l3WEjA7aPtpl+RaqM=
+github.com/go-openapi/swag/fileutils v0.29.1 h1:ZcPzMceVhU1WPbK6N1G6sNQKdd1CWJlf3cA08UHuoM0=
+github.com/go-openapi/swag/fileutils v0.29.1/go.mod h1:/wofKYckbtRl2p3+EwQsosie5CT1B38+dQ+PS579BzI=
+github.com/go-openapi/swag/jsonutils v0.29.1 h1:AFCxs0eQZ24/QyfhVHM2t49rMz7Vv3XCsZQI6yrNy+c=
+github.com/go-openapi/swag/jsonutils v0.29.1/go.mod h1:u3+sCfJpttDpcmS5kpm0yxL6GK0eWgODsx8Yw8fcqNM=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.29.1 h1:BiiXE31Bx9SfpsMmOQj5KYpUhTZBpLVriVhJDuLuY2o=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.29.1/go.mod h1:julgTUKZ9/D0j6O7GKajmRs+812FWxQg/mMpGunWSjg=
+github.com/go-openapi/swag/loading v0.29.1 h1:FCv5fG8UhTdDJa2R7w+5O9Ekpcbw7tt0nFWvmDKGBjc=
+github.com/go-openapi/swag/loading v0.29.1/go.mod h1:N0ESuem4p2oedKal8EJhciqnJ9Q9Wmt83L1CRB3Fouw=
+github.com/go-openapi/swag/mangling v0.29.1 h1:lHALtvYCdxVnRl4GrHmFPwfBTZYIObqdGNSKyu/8D6I=
+github.com/go-openapi/swag/mangling v0.29.1/go.mod h1:SAop9pB7PUjQ/CGCNf/JmCKTRK+GDO+RqE9UHqC/N6s=
+github.com/go-openapi/swag/netutils v0.29.1 h1:IjIvdEP5duKcghFqJEPSUraRnkKYHoM65kTluTu+Jb4=
+github.com/go-openapi/swag/netutils v0.29.1/go.mod h1:DUde7x4Bx00k5jYl2AdRpNAO0m7atUvD2x6X+bWkbno=
+github.com/go-openapi/swag/pools v0.29.1 h1:NRogYxdEW9SjRM4mkAOji9iefO4MRXq3p/ZJcoQbUKg=
+github.com/go-openapi/swag/pools v0.29.1/go.mod h1:leDcaghjkRAhCuCRv9NfJU5f0mjoU3cT/XZObhMk3pc=
+github.com/go-openapi/swag/stringutils v0.29.1 h1:1ykunK7iJQk1uOO7+oUH1ukbsK85fFCOiCFMOVSY+F0=
+github.com/go-openapi/swag/stringutils v0.29.1/go.mod h1:7fSqZ+z8Qc0tOfAAK0jVa5qFGrnIlRi6n7NeGGrr1vc=
+github.com/go-openapi/swag/typeutils v0.29.1 h1:Nzv9nhnlLCRBPQqfOX+7lB6Guju370or8StT+lIOf6M=
+github.com/go-openapi/swag/typeutils v0.29.1/go.mod h1:hxpgDZJVBkBsi/d3MIUosafoFdE5exaQRmVp0zwu3YE=
+github.com/go-openapi/swag/yamlutils v0.29.1 h1:69w3tsBajm7MR/fejLy7HD/3J68Ys1SeeZMEzZ3w2sk=
+github.com/go-openapi/swag/yamlutils v0.29.1/go.mod h1:rgsp3vT/QdWzKwn43CigDwjOGIenPyTZMKnxEM8jZOA=
+github.com/go-openapi/testify/enable/yaml/v2 v2.6.1 h1:Jm+/ze2rMtbD98yen92AhATGLGREDYXG56Xr4gMjEtE=
+github.com/go-openapi/testify/enable/yaml/v2 v2.6.1/go.mod h1:YDPnwCRDu38/oJBVMBVXOUDiJ9cIeBHWvfImHaXqnv4=
+github.com/go-openapi/testify/v2 v2.8.0 h1:19QDx5b57p8KjO2E4sgs/woL4Akp+FGLRlVm2xn0Rho=
+github.com/go-openapi/testify/v2 v2.8.0/go.mod h1:4gUN8jC+RqOE2qjW/vDmfyTvl5BCht4qL7oca0odrak=
+github.com/go-quicktest/qt v1.102.0 h1:HSQxCeh5YZH3EL3W39ixjtyaEhcWSXQHtHnMBzSs474=
+github.com/go-quicktest/qt v1.102.0/go.mod h1:p4lGIVX+8Wa6ZPNDvqcxq36XpUDLh42FLetFU7odllI=
 github.com/go-resty/resty/v2 v2.17.2 h1:FQW5oHYcIlkCNrMD2lloGScxcHJ0gkjshV3qcQAyHQk=
 github.com/go-resty/resty/v2 v2.17.2/go.mod h1:kCKZ3wWmwJaNc7S29BRtUhJwy7iqmn+2mLtQrOyQlVA=
 github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
-github.com/go-sql-driver/mysql v1.10.0 h1:Q+1LV8DkHJvSYAdR83XzuhDaTykuDx0l6fkXxoWCWfw=
-github.com/go-sql-driver/mysql v1.10.0/go.mod h1:M+cqaI7+xxXGG9swrdeUIoPG3Y3KCkF0pZej+SK+nWk=
+github.com/go-sql-driver/mysql v1.10.1 h1:arlSnNLq6a5yxGxV7qg9lF4j0C+KwD6NbQyKr9QL6ME=
+github.com/go-sql-driver/mysql v1.10.1/go.mod h1:M+cqaI7+xxXGG9swrdeUIoPG3Y3KCkF0pZej+SK+nWk=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
-github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
-github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
-github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
-github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8P+Z0=
+github.com/gobwas/glob v1.0.0 h1:p+FKbLEIsK1yZ39/OINwFvqNb5oyPY4H8xcy6uYu8dg=
+github.com/gobwas/glob v1.0.0/go.mod h1:oWCdo522i2P1n/hMXGNWs7yoV4wy/ciZuUIbvKj5rkc=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
 github.com/google/gnostic-models v0.7.1 h1:SisTfuFKJSKM5CPZkffwi6coztzzeYUhc3v4yxLWH8c=
@@ -178,8 +174,8 @@ github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 h1:EwtI+Al+DeppwYX2oXJCETMO23COyaKGP6fHVpkpWpg=
-github.com/google/pprof v0.0.0-20260402051712-545e8a4df936/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
+github.com/google/pprof v0.0.0-20260903180319-d6c3cb2f37ec h1:ZhR4jlKRUmzPEPd2RLiJRUi25rUrdKBrhQNVIbqpTNE=
+github.com/google/pprof v0.0.0-20260903180319-d6c3cb2f37ec/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/handlers v1.5.2 h1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=
@@ -194,8 +190,8 @@ github.com/gosimple/unidecode v1.0.1 h1:hZzFTMMqSswvf0LBJZCZgThIZrpDHFXux9KeGmn6
 github.com/gosimple/unidecode v1.0.1/go.mod h1:CP0Cr1Y1kogOtx0bJblKzsVWrqYaqfNOnHzpgWw4Awc=
 github.com/gosuri/uitable v0.0.4 h1:IG2xLKRvErL3uhY6e1BylFzG+aJiwQviDDTfOKeKTpY=
 github.com/gosuri/uitable v0.0.4/go.mod h1:tKR86bXuXPZazfOTG1FIzvjIdXzd0mo4Vtn16vt0PJo=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 h1:HWRh5R2+9EifMyIHV7ZV+MIZqgz+PMpZ14Jynv3O2Zs=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0/go.mod h1:JfhWUomR1baixubs02l85lZYYOm7LV6om4ceouMv45c=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 h1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0/go.mod h1:zOBXOsUaBSjKgmH4OGzV1esUpR3oUSCPYVd2cUBjKYY=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -214,16 +210,16 @@ github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9Y
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmoiron/sqlx v1.4.0 h1:1PLqN7S1UYp5t4SrVVnt4nUVNemrDAtxlulVe+Qgm3o=
 github.com/jmoiron/sqlx v1.4.0/go.mod h1:ZrZ7UsYB/weZdl2Bxg6jCRO9c3YHl8r3ahlKmRT4JLY=
-github.com/joho/godotenv v1.2.0 h1:vGTvz69FzUFp+X4/bAkb0j5BoLC+9bpqTWY8mjhA9pc=
-github.com/joho/godotenv v1.2.0/go.mod h1:7hK45KPybAkOC6peb+G5yklZfMxEjkZhHbwpqxOKXbg=
+github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
+github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
 github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12 h1:9Nu54bhS/H/Kgo2/7xNSUuC5G28VR8ljfrLKU2G4IjU=
 github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12/go.mod h1:TBzl5BIHNXfS9+C35ZyJaklL7mLDbgUkcgXzSLa8Tk0=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
-github.com/kedacore/keda/v2 v2.20.2 h1:SR60v8uIcelbveS8n/1jcl8tLdBBIbHMxmdOHw8tKqA=
-github.com/kedacore/keda/v2 v2.20.2/go.mod h1:wrV1MP6buZQ1S5/J/R7UyBeJr857x92E43LADVoSajs=
-github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw=
-github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/kedacore/keda/v2 v2.21.0 h1:R6z2HZvstK4RLUMxroNACzBj74xGxt3kG59b5Xc+Xps=
+github.com/kedacore/keda/v2 v2.21.0/go.mod h1:djq9CnH0OT9Wis6jwtc02oiUstN081M81Amk8JtkbVo=
+github.com/klauspost/compress v1.20.0 h1:a3C1ke2ohxFymNlb2HWAHjDeKCI90scRskErZkR0ezA=
+github.com/klauspost/compress v1.20.0/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -241,12 +237,12 @@ github.com/lib/pq v1.12.3 h1:tTWxr2YLKwIvK90ZXEw8GP7UFHtcbTtty8zsI+YjrfQ=
 github.com/lib/pq v1.12.3/go.mod h1:/p+8NSbOcwzAEI7wiMXFlgydTwcgTr3OSKMsD2BitpA=
 github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0=
 github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9B/r2mtpb6U+EI2rYA5OAXxsYw6wTamcNW+zcE=
-github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
-github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=
+github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
 github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
-github.com/mattn/go-runewidth v0.0.20 h1:WcT52H91ZUAwy8+HUkdM3THM6gXqXuLJi9O3rjcQQaQ=
-github.com/mattn/go-runewidth v0.0.20/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
+github.com/mattn/go-runewidth v0.0.28 h1:rPyg2ybwEKPebvpzVWe1gKBkH8EQFkxO4Y0hjBeLaBU=
+github.com/mattn/go-runewidth v0.0.28/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8=
 github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
 github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
@@ -280,10 +276,10 @@ github.com/multiformats/go-base36 v0.2.0/go.mod h1:qvnKE++v+2MWCfePClUEjE78Z7P2a
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
-github.com/onsi/ginkgo/v2 v2.29.0 h1:rfh+ZFjgJhYWRoIqVf3Uwx/W20yLrcrE2h2GmYVRaag=
-github.com/onsi/ginkgo/v2 v2.29.0/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/ginkgo/v2 v2.33.0 h1:C8gBA6Uc2ZEubiV+SXiu5tZnMTwEmXHgkJwGozKtZf8=
+github.com/onsi/ginkgo/v2 v2.33.0/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
@@ -296,8 +292,6 @@ github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaR
 github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
 github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI=
 github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
-github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5 h1:Ii+DKncOVM8Cu1Hc+ETb5K+23HdAMvESYE3ZJ5b5cMI=
-github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5/go.mod h1:iIss55rKnNBTvrwdmkUpLnDpZoAHvWaiq5+iMmen4AE=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
@@ -307,47 +301,47 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/poy/onpar v1.1.2 h1:QaNrNiZx0+Nar5dLgTVp5mXkyoVFIbepjyEoGSnhbAY=
 github.com/poy/onpar v1.1.2/go.mod h1:6X8FLNoxyr9kkmnlqpK6LSoiOtrO6MICtWwEuWkLjzg=
-github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
-github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
-github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
-github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=
-github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
+github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=
+github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE=
+github.com/prometheus/client_model v0.6.3 h1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=
+github.com/prometheus/client_model v0.6.3/go.mod h1:gpN5P9S7Rr6Yr92PiQ+Ixvhf6JZEkF1dnxsYL2aPBEM=
+github.com/prometheus/common v0.71.0 h1:9KDAKb7Mj3HEVKyFCK6Dc/HIwlBzZIN2l7/lrHl3KK8=
+github.com/prometheus/common v0.71.0/go.mod h1:CLJ5H8TEsGX8bl31BdMkfhIZ+QmZ9tBPPotUxUbfcmk=
 github.com/prometheus/otlptranslator v1.0.0 h1:s0LJW/iN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos=
 github.com/prometheus/otlptranslator v1.0.0/go.mod h1:vRYWnXvI6aWGpsdY/mOT/cbeVRBlPWtBNDb7kGR3uKM=
-github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
-github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
+github.com/prometheus/procfs v0.22.0 h1:6q9+/JL9IKAPbCmBrv9n5O5Ty3NKnciV5X7YGw0oics=
+github.com/prometheus/procfs v0.22.0/go.mod h1:CvmFr/GVhIjIvWJZW3tgkODBQMRIf0EyWMQLHCHab58=
 github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5 h1:EaDatTxkdHG+U3Bk4EUr+DZ7fOGwTfezUiUJMaIcaho=
 github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5/go.mod h1:fyalQWdtzDBECAQFBJuQe5bzQ02jGd5Qcbgb97Flm7U=
 github.com/redis/go-redis/extra/redisotel/v9 v9.0.5 h1:EfpWLLCyXw8PSM2/XNJLjI3Pb27yVE+gIAfeqp8LUCc=
 github.com/redis/go-redis/extra/redisotel/v9 v9.0.5/go.mod h1:WZjPDy7VNzn77AAfnAfVjZNvfJTYfPetfZk5yoSTLaQ=
-github.com/redis/go-redis/v9 v9.19.0 h1:XPVaaPSnG6RhYf7p+rmSa9zZfeVAnWsH5h3lxthOm/k=
-github.com/redis/go-redis/v9 v9.19.0/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA=
+github.com/redis/go-redis/v9 v9.22.0 h1:laDvpYXTJtZLloinw1fA5Kqd6HAEH2XKxOkG/PDq2F0=
+github.com/redis/go-redis/v9 v9.22.0/go.mod h1:y2g0Wj8rQvuK0ELM+oxSudcLtC09JScs98I/X9gRWY4=
 github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
 github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rogpeppe/go-internal v1.15.0 h1:D0RCU5rMAp+SpgkiNdrjfJ+LX4J1M32V2NeCY7EJ6hc=
+github.com/rogpeppe/go-internal v1.15.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
 github.com/rubenv/sql-migrate v1.8.1 h1:EPNwCvjAowHI3TnZ+4fQu3a915OpnQoPAjTXCGOy2U0=
 github.com/rubenv/sql-migrate v1.8.1/go.mod h1:BTIKBORjzyxZDS6dzoiw6eAFYJ1iNlGAtjn4LGeVjS8=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
 github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
 github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
-github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
-github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
+github.com/sirupsen/logrus v1.10.2 h1:G2SED73/qrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=
+github.com/sirupsen/logrus v1.10.2/go.mod h1:SLEg8TqYulVKKfIGHldVp2K2aYz2DKSVBq4g/H5bR7Q=
 github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
 github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
@@ -357,14 +351,14 @@ github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/tailscale/hujson v0.0.0-20250605163823-992244df8c5a h1:a6TNDN9CgG+cYjaeN8l2mc4kSz2iMiCDQxPEyltUV/I=
 github.com/tailscale/hujson v0.0.0-20250605163823-992244df8c5a/go.mod h1:EbW0wDK/qEUYI0A5bqq0C2kF8JTQwWONmGDBbzsxxHo=
 github.com/traefik/paerser v0.2.2 h1:cpzW/ZrQrBh3mdwD/jnp6aXASiUFKOVr6ldP+keJTcQ=
 github.com/traefik/paerser v0.2.2/go.mod h1:7BBDd4FANoVgaTZG+yh26jI6CA2nds7D/4VTEdIsh24=
-github.com/traefik/traefik/v2 v2.11.55 h1:6nZcku031xcMsYqg8cXKOq6Y9+qyK7VL//LBUF7xmWM=
-github.com/traefik/traefik/v2 v2.11.55/go.mod h1:jVtqw8HY7okUAH8LiqmbG8xcjzgY5v/dz+zK51lhBPs=
+github.com/traefik/traefik/v2 v2.11.61 h1:u8s2pE7Ck4VCYoVbW9JRtzz4QJ3iGMqpZ2tXuzsBgdM=
+github.com/traefik/traefik/v2 v2.11.61/go.mod h1:jj0mKHVCWL7EboxVPxW7HnAE16LFryv2Nq/kNh9ueis=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
@@ -375,48 +369,48 @@ go.opentelemetry.io/contrib/bridges/prometheus v0.67.0 h1:dkBzNEAIKADEaFnuESzcXv
 go.opentelemetry.io/contrib/bridges/prometheus v0.67.0/go.mod h1:Z5RIwRkZgauOIfnG5IpidvLpERjhTninpP1dTG2jTl4=
 go.opentelemetry.io/contrib/exporters/autoexport v0.67.0 h1:4fnRcNpc6YFtG3zsFw9achKn3XgmxPxuMuqIL5rE8e8=
 go.opentelemetry.io/contrib/exporters/autoexport v0.67.0/go.mod h1:qTvIHMFKoxW7HXg02gm6/Wofhq5p3Ib/A/NNt1EoBSQ=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 h1:CqXxU8VOmDefoh0+ztfGaymYbhdB/tT3zs79QaZTNGY=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0/go.mod h1:BuhAPThV8PBHBvg8ZzZ/Ok3idOdhWIodywz2xEcRbJo=
-go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
-go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 h1:Dn8rkudDzY6KV9dr/D/bTUuWgqDf9xe0rr4G2elrn0Y=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0/go.mod h1:gMk9F0xDgyN9M/3Ed5Y1wKcx/9mlU91NXY2SNq7RQuU=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0 h1:HIBTQ3VO5aupLKjC90JgMqpezVXwFuq6Ryjn0/izoag=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0/go.mod h1:ji9vId85hMxqfvICA0Jt8JqEdrXaAkcpkI9HPXya0ro=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0 h1:8UQVDcZxOJLtX6gxtDt3vY2WTgvZqMQRzjsqiIHQdkc=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0/go.mod h1:2lmweYCiHYpEjQ/lSJBYhj9jP1zvCvQW4BqL9dnT7FQ=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 h1:w1K+pCJoPpQifuVpsKamUdn9U0zM3xUziVOqsGksUrY=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0/go.mod h1:HBy4BjzgVE8139ieRI75oXm3EcDN+6GhD88JT1Kjvxg=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 h1:RAE+JPfvEmvy+0LzyUA25/SGawPwIUbZ6u0Wug54sLc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0/go.mod h1:AGmbycVGEsRx9mXMZ75CsOyhSP6MFIcj/6dnG+vhVjk=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 h1:3g7B90UzBltIDKq1/5mrTGxTnOFDV0ICOhLoxiZ8jlg=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0/go.mod h1:Ef8SuTh59BT7+ofpDxN9z+yOlc4t2GjLmKDgYNJL/NU=
+go.opentelemetry.io/otel v1.46.0 h1:FHt5/CDyVxi/8IM1CH7VE/rRgq3kLHa2mSTVMO8AWyc=
+go.opentelemetry.io/otel v1.46.0/go.mod h1:Gj3SEScelsNC45tp4nSxRYlS+f5iez7W8XPMCt905kE=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.21.0 h1:WseeVYf5dJZTsyPiyW5L14k5qsSibqXAMTSiFEDiWr0=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.21.0/go.mod h1:SiLZnQS6Qk2eCpvr2CH/XMAOa64TWGXxEZJZCpD2Lmc=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.21.0 h1:fvNHGyo3CdRv/DQveXqhqBxnKTDyRaC5sMSQxilX/A0=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.21.0/go.mod h1:zyGrjRKL2B/6+Jc/m4/otPoZqV2MY9ZjC/aBraRO7zc=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.46.0 h1:qkDYCAFiZXLcs1L4aY+tP2wguQ4kURANqHOQMA2et2s=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.46.0/go.mod h1:tkipS4DRzmpAmvg+Gw4++O1IdDq6TVDnvnYU6cmbQVs=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.46.0 h1:AP23h/mFgb/lc7tdck1Kfn9qxsM8TAeNPCU5C3pzaps=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.46.0/go.mod h1:K4EqCe1b4kGk5WR690ntg9LaBfsPoV32FwthbyoptuA=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0 h1:OFnwLJr+pF3iHrlGSzbxyuo6/6HyBlnlN1CWEJmBVcw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0/go.mod h1:716wFneO0ov19A2beH5hjfh9AK5z/VWNAtDijp1Y0/g=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0 h1:w53CDeOA/Kurp7yRsegSr6pbbr759dOvJ+yNmWM6Hxs=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0/go.mod h1:BOmGMCbAtvcJiSJ+hLuhgPLdDbimnraSl8irz3iY8sY=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0 h1:QBajQ2SrwQijzHyZbQlPsuIzpl/ll8DY6wPWsajeGcI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0/go.mod h1:08ZQLjrPLQ6R4kAXvuOvODEer5Yh4CoFvll5qB2BCI8=
 go.opentelemetry.io/otel/exporters/prometheus v0.65.0 h1:jOveH/b4lU9HT7y+Gfamf18BqlOuz2PWEvs8yM7Q6XE=
 go.opentelemetry.io/otel/exporters/prometheus v0.65.0/go.mod h1:i1P8pcumauPtUI4YNopea1dhzEMuEqWP1xoUZDylLHo=
-go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.19.0 h1:GJkybS+crDMdExT/BUNCEgfrmfboztcS6PhvSo88HKM=
-go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.19.0/go.mod h1:NuAyxRYIG2lKX3YQkB+83StTxM7s52PUUkRRiC0wnYI=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.21.0 h1:2lpf4hnrasYIsUyEXwnTZq5lsxrMm4T2Bwb06IctAZQ=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.21.0/go.mod h1:YWOW6h7jwApz9Pl76ie/izUsSPj0s2MdIlpqbPqaf3U=
 go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0 h1:TC+BewnDpeiAmcscXbGMfxkO+mwYUwE/VySwvw88PfA=
 go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0/go.mod h1:J/ZyF4vfPwsSr9xJSPyQ4LqtcTPULFR64KwTikGLe+A=
 go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0 h1:mS47AX77OtFfKG4vtp+84kuGSFZHTyxtXIN269vChY0=
 go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0/go.mod h1:PJnsC41lAGncJlPUniSwM81gc80GkgWJWr3cu2nKEtU=
-go.opentelemetry.io/otel/log v0.19.0 h1:KUZs/GOsw79TBBMfDWsXS+KZ4g2Ckzksd1ymzsIEbo4=
-go.opentelemetry.io/otel/log v0.19.0/go.mod h1:5DQYeGmxVIr4n0/BcJvF4upsraHjg6vudJJpnkL6Ipk=
-go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
-go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
-go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
-go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
-go.opentelemetry.io/otel/sdk/log v0.19.0 h1:scYVLqT22D2gqXItnWiocLUKGH9yvkkeql5dBDiXyko=
-go.opentelemetry.io/otel/sdk/log v0.19.0/go.mod h1:vFBowwXGLlW9AvpuF7bMgnNI95LiW10szrOdvzBHlAg=
-go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
-go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
-go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
-go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
-go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
-go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
-go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
-go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
+go.opentelemetry.io/otel/log v0.21.0 h1:SLsVDGmtyBrdw8/a2Z0bOIxou/+bN4z56GebH7T0LvA=
+go.opentelemetry.io/otel/log v0.21.0/go.mod h1:iReetQrZL9Wyg84cCkOoCmqDHS5RCFfyxC7J+r8fn8g=
+go.opentelemetry.io/otel/metric v1.46.0 h1:yBnkXvgV7AXFILZc5K6IZe/CBFF3OS7BJ8ov6/lj0K8=
+go.opentelemetry.io/otel/metric v1.46.0/go.mod h1:iPmdWqifKUdzziPkvvzIJXITl56fQx2mGM/DHLB3/2o=
+go.opentelemetry.io/otel/sdk v1.46.0 h1:h5CNQQjEbuQXY/JfZtgt3i7HVFV3aHPO2OAwO2eTYPI=
+go.opentelemetry.io/otel/sdk v1.46.0/go.mod h1:GAERFXFt5SYCEB+YiKUbMBeza6UaDH7GmGOZEfh2gSM=
+go.opentelemetry.io/otel/sdk/log v0.21.0 h1:QsE7XSR0ktQdKmRKGnR+f1ObGF32WG+7MER/P9KgmYc=
+go.opentelemetry.io/otel/sdk/log v0.21.0/go.mod h1:m9mApjCoD2/1QuKCAptjv+BrG9WKOvQLVdNx+iBldTo=
+go.opentelemetry.io/otel/sdk/metric v1.46.0 h1:0piZ26EG4RBfebb2jhDH6ERCYHoVWduc3kLgPCwSnSE=
+go.opentelemetry.io/otel/sdk/metric v1.46.0/go.mod h1:I1PbKrdVc8Qu8HYVDNtqVIwLwjNrhsV/uFuxfwg8mO4=
+go.opentelemetry.io/otel/trace v1.46.0 h1:OULy7ccdJnZtJ0UDYFOIGaCmiWzJ8Vi2G/Rsu60qs1c=
+go.opentelemetry.io/otel/trace v1.46.0/go.mod h1:J7GAXweO77XSFkB/rmAqk9D6ihszhFjLU+d9WuUxDLI=
+go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk=
+go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E=
+go.uber.org/atomic v1.12.0 h1:BvcXdFKuviU4fTL/f+SxdQ5qJX/Jix8pAkgdUcb3XOE=
+go.uber.org/atomic v1.12.0/go.mod h1:I6c4cg+6HCxRjfjSsYtApoFILnpc0CGUdGkXVqbYVNk=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
@@ -425,40 +419,41 @@ go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo=
 go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=
-golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=
-golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
-golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
-golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
-golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
+golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
+golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY=
+golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
+golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
+golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
-golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
-golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
-golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
+golang.org/x/time v0.16.0 h1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q/6gY2hDM6VDE=
+golang.org/x/time v0.16.0/go.mod h1:rVKOqvZeKvrDKTQiAHJ7wmwP0RzleSphoEA9RcdLA0s=
+golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI=
+golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA=
 gomodules.xyz/jsonpatch/v2 v2.5.0 h1:JELs8RLM12qJGXU4u/TO3V25KW8GreMKl9pdkk14RM0=
 gomodules.xyz/jsonpatch/v2 v2.5.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
-google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 h1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0=
-google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 h1:yQugLulqltosq0B/f8l4w9VryjV+N/5gcW0jQ3N8Qec=
-google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478/go.mod h1:C6ADNqOxbgdUUeRTU+LCHDPB9ttAMCTff6auwCVa4uc=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad h1:45WmJvIV6C2+O/jjLkPUH+F3aOj/1miDoU2DD0+NWbg=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
-google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
-google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
-google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/genproto v0.0.0-20260904194346-d0f1323225a4 h1:6QRNo34FxJcE1LG6XfnmaQ17m6w21oXaKlKoBaF+UqE=
+google.golang.org/genproto/googleapis/api v0.0.0-20260904194346-d0f1323225a4 h1:NCe/UiklGd/9xjT+ROBVhJ1kf6TRQaFedsR+z7u1gvo=
+google.golang.org/genproto/googleapis/api v0.0.0-20260904194346-d0f1323225a4/go.mod h1:fJ2lYaWjqNknJyQBOCd0fA3HnEElJqGplH71a2txi+g=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260904194346-d0f1323225a4 h1:5t+ZydAFj5kGVLrgCvLmpmCf9ylGRd64hpEronfRaws=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260904194346-d0f1323225a4/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA=
+google.golang.org/grpc v1.84.0 h1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=
+google.golang.org/grpc v1.84.0/go.mod h1:ljCht0DrxQrXBDRTZp52Qxh3Ffk8CdYm2sj4O2QN2C0=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
@@ -471,52 +466,52 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-helm.sh/helm/v3 v3.21.4 h1:T/GcIEXU/gNjJnkITlIZ3e9xqkZjhFTmISuStTZ6+Qg=
-helm.sh/helm/v3 v3.21.4/go.mod h1:cS2FBb+xfLuaSqvEmbqIeKUVFgHdHVHtVeXb2epof3M=
-k8s.io/api v0.36.3 h1:NxB+05W2UGqXWFXcLO0RB5cnqnUPP5v5sVlaOH0Iz4w=
-k8s.io/api v0.36.3/go.mod h1:JzLQKqRHC5+I8RVj/lS3lCg0mg6nWI9Fo/Sk3ElxHzg=
-k8s.io/apiextensions-apiserver v0.36.2 h1:3O5gqOj/dt2XWWbpMe+TXWpE9yU6pjM/tXxtHHJT/K4=
-k8s.io/apiextensions-apiserver v0.36.2/go.mod h1:cL1tBWe8XSaP1H30iWKGo7hf6iAUUUJPEU70dskmAnA=
-k8s.io/apimachinery v0.36.3 h1:PkzMRBRG8joFD8EhCuQAtNPvJlxb82FwplP26HIzvAM=
-k8s.io/apimachinery v0.36.3/go.mod h1:cTSjBWgPe/6CQyBKzY/hDIRWCQQQeK0mfLbml0UYFHE=
-k8s.io/apiserver v0.36.2 h1:6vMnkmHZPeBloNkHUhmZYq7Ylv8WIB8xjyEl+eSt26E=
-k8s.io/apiserver v0.36.2/go.mod h1:9PoQ2ikCytrZyZg11mGhLEF5m8Rgsb5FJmYJ4Wvnl1k=
-k8s.io/cli-runtime v0.36.3 h1:g+eJ+M1sYpnNYp/q5fzaw2KejIL0Q7DH+xFl6YVoL4U=
-k8s.io/cli-runtime v0.36.3/go.mod h1:hZpAqK8nSFXvvLaVCbzUPVp8e9TRLSTCfpNzMt7s3tE=
-k8s.io/client-go v0.36.3 h1:M4JdVzXxYcZk4fGpfDdYnxSwhLKWCFoQsHW6t+z8Hfg=
-k8s.io/client-go v0.36.3/go.mod h1:gcPwr0c87vjjG6HB6pWEqOeuYVoXSsREjzux2j6GF30=
-k8s.io/component-base v0.36.3 h1:vc/UFvPCkW0irPz84LAodAL1j3f4xktPM6dDJIEheAY=
-k8s.io/component-base v0.36.3/go.mod h1:hZbNFG+gCMl9EbykDGEu73feKP9/Cq6JsV4pTo9GTO8=
+helm.sh/helm/v3 v3.22.1 h1:uo2SouzAxMkKZTNzZ1lLP/c/Bu7xfUJKYDaYMxMHvk8=
+helm.sh/helm/v3 v3.22.1/go.mod h1:FNQoawxnIIReGrTytJc55tKakylfpaC3pGf64BGo1rI=
+k8s.io/api v0.37.2 h1:PnxqnUFy93jr2GcpWDkKOm8wfy25kT9wa572MuQS8oc=
+k8s.io/api v0.37.2/go.mod h1:+NVRLft99kx+Jg9v34GmHw867Dapim89TSyCsn2hK+M=
+k8s.io/apiextensions-apiserver v0.37.1 h1:7fIQG8eThDSTVYBWg/DOpI8v5wYfKCo0N8/TDMjj+zY=
+k8s.io/apiextensions-apiserver v0.37.1/go.mod h1:1Q3ujWwHgnhBoGsdmGORflwK1sDFmuaqH1OsMDWk2Gs=
+k8s.io/apimachinery v0.37.2 h1:G4t9RGoPDbQML38hz/kQQiltttgd3egg2ODCR8aIc2o=
+k8s.io/apimachinery v0.37.2/go.mod h1:qaAvSNvgU2x07wRM95MSHSJTPQ/ob/LeNAGbeDgqQJg=
+k8s.io/apiserver v0.37.1 h1:dUsNwjsvItyVKNpC1N0AhQ0OBSiUJKfWz004vPifOe0=
+k8s.io/apiserver v0.37.1/go.mod h1:EWXW6PntGfOC2uD9GGVobnOExgFoX1z0hZo7f7Rs7Ng=
+k8s.io/cli-runtime v0.37.2 h1:EpE50B2FmXz8SxkYqoS2q0piDk1qe7g9dGZGIW+apws=
+k8s.io/cli-runtime v0.37.2/go.mod h1:0IDMrrzVnj1cqBlCll8oGSOb2js6mSy0ALtbh0MsYyc=
+k8s.io/client-go v0.37.2 h1:sgFtyRZukGkOrsu+QgS7LYnbFFJ5ut3MchdBNduD//E=
+k8s.io/client-go v0.37.2/go.mod h1:bo3LFC8YbCtKFPX21Yj8puMsoJLAv/+SvuOODma0s54=
+k8s.io/component-base v0.37.2 h1:Ia9IKTg1yWrUntJU5lVetapkC9pXlLg9L6P3R1IkbcY=
+k8s.io/component-base v0.37.2/go.mod h1:qq+ueHZyLfzRJzxyDoyxHWNhF1JPv4zm3hcaddXWDvY=
 k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
 k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
-k8s.io/kube-openapi v0.0.0-20260603220949-865597e52e25 h1:mPMaPMpBij2V1Wv/fR+HW124vVGXXvOSS9ver/9yjWs=
-k8s.io/kube-openapi v0.0.0-20260603220949-865597e52e25/go.mod h1:V/QaCUYDa+0QpcHhVVc5l99Uz56wEMEXBSj9oCDkNDY=
-k8s.io/kubectl v0.36.3 h1:TesKp+XYQEjPYoFvuobcVnuvira2+/xAVlq//+kksaI=
-k8s.io/kubectl v0.36.3/go.mod h1:W+NEb1CzBGmoaI1Nrpn2ETo9omNBl0AsyxnnMT40N6E=
-k8s.io/kubernetes v1.36.3 h1:qDQdoMiluAE2Eab6Fa52YV+WjiGz9mZFFoagEA6cI+o=
-k8s.io/kubernetes v1.36.3/go.mod h1:6oChkQeI7Yf6lV9lFpSdRzODdbY/ECp/4zUeBk8ONaw=
-k8s.io/streaming v0.36.3 h1:9rAaqBk0C0Pc7+/fqGekj07NV+/Xrew58p647A0JT8w=
-k8s.io/streaming v0.36.3/go.mod h1:z6fV3D+NVkoeqRMtWwlUZK6U17SY/LqNzOxWL6GyR/s=
-k8s.io/utils v0.0.0-20260626114624-be93311217bd h1:Ea7fgQ5we8Y9T0OX5o0dAHzQOBRI07D/dEYRaB9ZZEs=
-k8s.io/utils v0.0.0-20260626114624-be93311217bd/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
-mvdan.cc/sh/v3 v3.13.1 h1:DP3TfgZhDkT7lerUdnp6PTGKyxxzz6T+cOlY/xEvfWk=
-mvdan.cc/sh/v3 v3.13.1/go.mod h1:lXJ8SexMvEVcHCoDvAGLZgFJ9Wsm2sulmoNEXGhYZD0=
+k8s.io/kube-openapi v0.0.0-20260821135717-be32def86098 h1:z5+pcu1jTyKK5mNTe2/+x+U6Uuv9jRVOJQLaBJJMpeI=
+k8s.io/kube-openapi v0.0.0-20260821135717-be32def86098/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I=
+k8s.io/kubectl v0.37.2 h1:AGGIhrGSsXtrL6BZWf7Hp2K9yB+2qdx7wovsOP1MiCg=
+k8s.io/kubectl v0.37.2/go.mod h1:0nyX9up426PgGMcGkWjF1DeipLkd41eKZHoLDgop20k=
+k8s.io/kubernetes v1.37.2 h1:A2VDEiObzkYqFTKhSsn0ZEb0RlLEXpHWj93gi2HqEwE=
+k8s.io/kubernetes v1.37.2/go.mod h1:zAK7e3i5feyBL/bhucQnA5VRKuyrS8F+ijHJkZzQaWw=
+k8s.io/streaming v0.37.2 h1:xmzp9nbqIbjvsRcqrBYa+K5XPQ6Jy/Dm3zZ8mN916AI=
+k8s.io/streaming v0.37.2/go.mod h1:APlJR26ZWRcVy5bIEj0QRrKUXROtBHPcxl2NT7EAzPU=
+k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3 h1:jVkFFVfXdXP74B/zbO3hM3hpSFD0xvhQ5U686DPurkE=
+k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3/go.mod h1:M2s5JB1lIYP3jzZdorPLHXIPJzt9vv2muW5a6L9DtNM=
+mvdan.cc/sh/v3 v3.14.1 h1:bXkhQWNHCs0KZEChF8hYS6FC+T2N9mUZLbQv9blditI=
+mvdan.cc/sh/v3 v3.14.1/go.mod h1:syYCoFET8w9tvevxiXUtY8/ICrU+l26jHmhJDra3Vwo=
 oras.land/oras-go/v2 v2.6.2 h1:N04RXngAp1LJKTG6ifz3xHPipasEkWr+hFmInja5YKo=
 oras.land/oras-go/v2 v2.6.2/go.mod h1:PlTtg4JTDJkDe8yVHpM2wz7/YDc00GVas+i4jAW2TZ4=
-sigs.k8s.io/controller-runtime v0.24.1 h1:miPEwrmirImAvgME1L9qebGHrOnGJoVmVdtOU9fRfo4=
-sigs.k8s.io/controller-runtime v0.24.1/go.mod h1:vFkfY5fGt5xAC/sKb8IBFKgWPNKG9OUG29dR8Y2wImw=
+sigs.k8s.io/controller-runtime v0.25.2 h1:bEkK3PVOIVK9X8QWLGVhJgmFc++47vfT6wakSzAOLsQ=
+sigs.k8s.io/controller-runtime v0.25.2/go.mod h1:4QqLdT6z/L6Olj8JJCtvztid4/fnIiYsfaTFScegctc=
 sigs.k8s.io/gateway-api v1.6.0 h1:735YBRj5NXFrOGX0GoSjwzUIzbz8kiEOfADsqHFmHgE=
 sigs.k8s.io/gateway-api v1.6.0/go.mod h1:FVfx3t389ybeXOqvDghLbdvJdSCfI/PReqCUI3lu3mY=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
-sigs.k8s.io/kustomize/api v0.21.1 h1:lzqbzvz2CSvsjIUZUBNFKtIMsEw7hVLJp0JeSIVmuJs=
-sigs.k8s.io/kustomize/api v0.21.1/go.mod h1:f3wkKByTrgpgltLgySCntrYoq5d3q7aaxveSagwTlwI=
-sigs.k8s.io/kustomize/kyaml v0.21.1 h1:IVlbmhC076nf6foyL6Taw4BkrLuEsXUXNpsE+ScX7fI=
-sigs.k8s.io/kustomize/kyaml v0.21.1/go.mod h1:hmxADesM3yUN2vbA5z1/YTBnzLJ1dajdqpQonwBL1FQ=
+sigs.k8s.io/kustomize/api v0.21.2 h1:MRyw+zLnFBP+G40gZJoKZErAuRiOPEPao+ddS9L6xt4=
+sigs.k8s.io/kustomize/api v0.21.2/go.mod h1:inubcVvQjJR/BjUti22YVBWr4EX+XlurEWhB81v2JV4=
+sigs.k8s.io/kustomize/kyaml v0.21.2 h1:1javwStFk7cgOeLU7yJtPmXcgMEhQgC2X0WjFT6U0p0=
+sigs.k8s.io/kustomize/kyaml v0.21.2/go.mod h1:zX3qwtuouXd2K1fMiCV0VSFReX06a+CY1rhyf5Dy7hQ=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v6 v6.4.0 h1:qmp2e3ZfFi1/jJbDGpD4mt3wyp6PE1NfKHCYLqgNQJo=
-sigs.k8s.io/structured-merge-diff/v6 v6.4.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2 h1:qdOxHwrl2Kaag1aQEarlYcOA9vSyGCp3CIki3aW8c4Q=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
 sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
 sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
 software.sslmate.com/src/go-pkcs12 v0.7.3 h1:JBQD3FDqYjTeyDAeZQklj2ar88ykBLtALloPJHyAauU=
diff --git a/plugins/scheduler-k3s/helm.go b/plugins/scheduler-k3s/helm.go
index aa7ff9496..25087dd5b 100644
--- a/plugins/scheduler-k3s/helm.go
+++ b/plugins/scheduler-k3s/helm.go
@@ -5,7 +5,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"log"
 	"os"
 	"path/filepath"
 	"sort"
@@ -15,16 +14,13 @@ import (
 
 	"github.com/dokku/dokku/plugins/common"
 	"github.com/fluxcd/pkg/kustomize/filesys"
-	"github.com/gofrs/flock"
-	"gopkg.in/yaml.v3"
 	"helm.sh/helm/v3/pkg/action"
 	"helm.sh/helm/v3/pkg/chart/loader"
 	"helm.sh/helm/v3/pkg/cli"
-	"helm.sh/helm/v3/pkg/getter"
+	"helm.sh/helm/v3/pkg/helmpath"
 	"helm.sh/helm/v3/pkg/kube"
 	"helm.sh/helm/v3/pkg/postrender"
 	"helm.sh/helm/v3/pkg/release"
-	"helm.sh/helm/v3/pkg/repo"
 	"helm.sh/helm/v3/pkg/storage/driver"
 	"sigs.k8s.io/kustomize/api/konfig"
 	"sigs.k8s.io/kustomize/api/krusty"
@@ -93,6 +89,73 @@ type Release struct {
 	Version    string
 }
 
+// applyChartPathOptions pins the repository and the version from input onto the
+// chart path options used to locate a chart. Both the install and the upgrade
+// path must do this, otherwise helm resolves the newest chart published to the
+// repository instead of the version dokku pins.
+func applyChartPathOptions(options *action.ChartPathOptions, input ChartInput) {
+	if input.RepoURL != "" {
+		options.RepoURL = input.RepoURL
+	}
+	if input.Version != "" {
+		options.Version = input.Version
+	}
+}
+
+// helmHomeEnvVars are the environment variables helm resolves its cache, config
+// and data homes from, mapped to the scratch subdirectory each one gets.
+var helmHomeEnvVars = map[string]string{
+	helmpath.CacheHomeEnvVar:  "cache",
+	helmpath.ConfigHomeEnvVar: "config",
+	helmpath.DataHomeEnvVar:   "data",
+}
+
+// newHelmSettings returns helm settings backed by a private scratch directory,
+// along with a function that removes it and restores the environment.
+//
+// helm otherwise resolves its cache, config and data homes from $HOME. Dokku
+// runs scheduler-k3s:initialize as root and every other subcommand as the dokku
+// user, so $HOME is not always readable by the user a command ends up as, and
+// helm treats a repositories file it cannot read as a fatal error rather than
+// an absent one. Nothing dokku keeps there needs to outlive a command: every
+// chart carries its own repository url, and helm re-fetches both the repository
+// index and the chart archive on every call.
+func newHelmSettings() (*cli.EnvSettings, func(), error) {
+	directory, err := os.MkdirTemp("", "dokku-helm-")
+	if err != nil {
+		return nil, nil, fmt.Errorf("Error creating helm scratch directory: %w", err)
+	}
+
+	restore := map[string]*string{}
+	cleanup := func() {
+		for envVar, previous := range restore {
+			if previous == nil {
+				os.Unsetenv(envVar) // nolint: errcheck
+				continue
+			}
+
+			os.Setenv(envVar, *previous) // nolint: errcheck
+		}
+
+		os.RemoveAll(directory) // nolint: errcheck
+	}
+
+	for envVar, subdirectory := range helmHomeEnvVars {
+		if previous, ok := os.LookupEnv(envVar); ok {
+			restore[envVar] = &previous
+		} else {
+			restore[envVar] = nil
+		}
+
+		if err := os.Setenv(envVar, filepath.Join(directory, subdirectory)); err != nil {
+			cleanup()
+			return nil, nil, fmt.Errorf("Error setting %s: %w", envVar, err)
+		}
+	}
+
+	return cli.New(), cleanup, nil
+}
+
 type HelmAgent struct {
 	Configuration *action.Configuration
 	Namespace     string
@@ -121,69 +184,6 @@ func NewHelmAgent(namespace string, logger action.DebugLog) (*HelmAgent, error)
 	}, nil
 }
 
-type AddRepositoryInput struct {
-	Name string
-	URL  string
-}
-
-func (h *HelmAgent) AddRepository(ctx context.Context, helmRepo AddRepositoryInput) error {
-	settings := cli.New()
-	repoFile := settings.RepositoryConfig
-
-	err := os.MkdirAll(filepath.Dir(repoFile), os.ModePerm)
-	if err != nil && !os.IsExist(err) {
-		return fmt.Errorf("Error creating repository directory: %w", err)
-	}
-
-	fileLock := flock.New(strings.Replace(repoFile, filepath.Ext(repoFile), ".lock", 1))
-	locked, err := fileLock.TryLockContext(ctx, time.Second)
-	if err != nil {
-		return fmt.Errorf("Error acquiring file lock: %w", err)
-	}
-
-	if !locked {
-		return fmt.Errorf("Could not acquire file lock")
-	}
-
-	defer fileLock.Unlock() // nolint: errcheck
-
-	b, err := os.ReadFile(repoFile)
-	if err != nil && !os.IsNotExist(err) {
-		return fmt.Errorf("Error reading repository file: %w", err)
-	}
-
-	var f repo.File
-	if err := yaml.Unmarshal(b, &f); err != nil {
-		return fmt.Errorf("Error unmarshalling yaml: %w", err)
-	}
-
-	if f.Has(helmRepo.Name) {
-		return nil
-	}
-
-	c := repo.Entry{
-		Name: helmRepo.Name,
-		URL:  helmRepo.URL,
-	}
-
-	r, err := repo.NewChartRepository(&c, getter.All(settings))
-	if err != nil {
-		return fmt.Errorf("Error creating chart repository: %w", err)
-	}
-
-	if _, err := r.DownloadIndexFile(); err != nil {
-		return fmt.Errorf("Specified repository '%q' is not a valid chart repository or cannot be reached: %w", helmRepo.URL, err)
-	}
-
-	f.Update(&c)
-
-	if err := f.WriteFile(repoFile, 0644); err != nil {
-		log.Fatal(err)
-	}
-
-	return nil
-}
-
 func (h *HelmAgent) ChartExists(releaseName string) (bool, error) {
 	if releaseName == "" {
 		return false, fmt.Errorf("Release name is required")
@@ -270,7 +270,6 @@ func (h *HelmAgent) InstallChart(ctx context.Context, input ChartInput) error {
 
 	client := action.NewInstall(h.Configuration)
 	client.Atomic = false
-	client.ChartPathOptions = action.ChartPathOptions{}
 	client.CreateNamespace = true
 	client.DryRun = false
 	if os.Getenv("DOKKU_TRACE") == "1" {
@@ -285,13 +284,13 @@ func (h *HelmAgent) InstallChart(ctx context.Context, input ChartInput) error {
 	client.Timeout = input.Timeout
 	client.Wait = input.Wait
 
-	settings := cli.New()
-	if input.RepoURL != "" {
-		client.ChartPathOptions.RepoURL = input.RepoURL
-	}
-	if input.Version != "" {
-		client.ChartPathOptions.Version = input.Version
+	applyChartPathOptions(&client.ChartPathOptions, input)
+
+	settings, cleanup, err := newHelmSettings()
+	if err != nil {
+		return err
 	}
+	defer cleanup()
 
 	chart, err := client.ChartPathOptions.LocateChart(input.ChartPath, settings)
 	if err != nil {
@@ -324,7 +323,7 @@ func (h *HelmAgent) InstalledRevision(releaseName string) (Release, error) {
 		return Release{}, nil
 	}
 
-	return revisions[0], nil
+	return revisions[len(revisions)-1], nil
 }
 
 type ListRevisionsInput struct {
@@ -332,11 +331,24 @@ type ListRevisionsInput struct {
 	Max         int
 }
 
+// selectRevisions sorts releases ascending by revision and keeps at most the
+// most recent max entries. A max of zero keeps every revision. helm's history
+// action ignores its own Max field and hands back the entire ledger unsorted,
+// so both the ordering and the truncation happen here.
+func selectRevisions(releases []Release, max int) []Release {
+	sort.Slice(releases, func(i, j int) bool {
+		return releases[i].Revision < releases[j].Revision
+	})
+
+	if max > 0 && len(releases) > max {
+		return releases[len(releases)-max:]
+	}
+
+	return releases
+}
+
 func (h *HelmAgent) ListRevisions(input ListRevisionsInput) ([]Release, error) {
 	client := action.NewHistory(h.Configuration)
-	if input.Max > 0 {
-		client.Max = input.Max
-	}
 
 	releases := []Release{}
 	response, err := client.Run(input.ReleaseName)
@@ -364,11 +376,7 @@ func (h *HelmAgent) ListRevisions(input ListRevisionsInput) ([]Release, error) {
 		})
 	}
 
-	sort.Slice(releases, func(i, j int) bool {
-		return releases[i].Revision < releases[j].Revision
-	})
-
-	return releases, nil
+	return selectRevisions(releases, input.Max), nil
 }
 
 func (h *HelmAgent) UpgradeChart(ctx context.Context, input ChartInput) error {
@@ -394,7 +402,6 @@ func (h *HelmAgent) UpgradeChart(ctx context.Context, input ChartInput) error {
 
 	client := action.NewUpgrade(h.Configuration)
 	client.Atomic = input.RollbackOnFailure
-	client.ChartPathOptions = action.ChartPathOptions{}
 	client.CleanupOnFail = true
 	client.MaxHistory = 10
 	if os.Getenv("DOKKU_TRACE") == "1" {
@@ -407,11 +414,15 @@ func (h *HelmAgent) UpgradeChart(ctx context.Context, input ChartInput) error {
 	client.Namespace = namespace
 	client.Timeout = input.Timeout
 	client.Wait = input.Wait
-	if input.RepoURL != "" {
-		client.RepoURL = input.RepoURL
-	}
 
-	settings := cli.New()
+	applyChartPathOptions(&client.ChartPathOptions, input)
+
+	settings, cleanup, err := newHelmSettings()
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
 	chart, err := client.ChartPathOptions.LocateChart(input.ChartPath, settings)
 	if err != nil {
 		return fmt.Errorf("Error locating chart: %w", err)
diff --git a/plugins/scheduler-k3s/helm_test.go b/plugins/scheduler-k3s/helm_test.go
new file mode 100644
index 000000000..c550ed010
--- /dev/null
+++ b/plugins/scheduler-k3s/helm_test.go
@@ -0,0 +1,226 @@
+package scheduler_k3s
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"helm.sh/helm/v3/pkg/action"
+	"helm.sh/helm/v3/pkg/helmpath"
+)
+
+func TestApplyChartPathOptions(t *testing.T) {
+	cases := []struct {
+		name        string
+		options     action.ChartPathOptions
+		input       ChartInput
+		wantRepoURL string
+		wantVersion string
+	}{
+		{
+			name:        "pins both the repository and the version",
+			input:       ChartInput{RepoURL: "https://helm.traefik.io/traefik", Version: "26.0.0"},
+			wantRepoURL: "https://helm.traefik.io/traefik",
+			wantVersion: "26.0.0",
+		},
+		{
+			name:        "an empty version leaves the field unset",
+			input:       ChartInput{RepoURL: "https://helm.traefik.io/traefik"},
+			wantRepoURL: "https://helm.traefik.io/traefik",
+			wantVersion: "",
+		},
+		{
+			name:        "an empty repository leaves the field unset",
+			input:       ChartInput{Version: "26.0.0"},
+			wantRepoURL: "",
+			wantVersion: "26.0.0",
+		},
+		{
+			name:        "an empty input leaves both fields unset",
+			input:       ChartInput{},
+			wantRepoURL: "",
+			wantVersion: "",
+		},
+		{
+			name:        "existing values are preserved when the input is empty",
+			options:     action.ChartPathOptions{RepoURL: "https://charts.jetstack.io", Version: "v1.13.3"},
+			input:       ChartInput{},
+			wantRepoURL: "https://charts.jetstack.io",
+			wantVersion: "v1.13.3",
+		},
+		{
+			name:        "existing values are overridden by the input",
+			options:     action.ChartPathOptions{RepoURL: "https://charts.jetstack.io", Version: "v1.13.3"},
+			input:       ChartInput{RepoURL: "https://helm.traefik.io/traefik", Version: "26.0.0"},
+			wantRepoURL: "https://helm.traefik.io/traefik",
+			wantVersion: "26.0.0",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			options := tc.options
+			applyChartPathOptions(&options, tc.input)
+
+			if options.RepoURL != tc.wantRepoURL {
+				t.Errorf("RepoURL = %q, want %q", options.RepoURL, tc.wantRepoURL)
+			}
+			if options.Version != tc.wantVersion {
+				t.Errorf("Version = %q, want %q", options.Version, tc.wantVersion)
+			}
+		})
+	}
+}
+
+func makeRevisions(revisions ...int) []Release {
+	out := make([]Release, 0, len(revisions))
+	for _, revision := range revisions {
+		out = append(out, Release{Name: "traefik", Revision: revision})
+	}
+	return out
+}
+
+func revisionNumbers(releases []Release) []int {
+	out := make([]int, 0, len(releases))
+	for _, release := range releases {
+		out = append(out, release.Revision)
+	}
+	return out
+}
+
+func equalInts(a, b []int) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if a[i] != b[i] {
+			return false
+		}
+	}
+	return true
+}
+
+func TestSelectRevisions(t *testing.T) {
+	cases := []struct {
+		name     string
+		releases []Release
+		max      int
+		want     []int
+	}{
+		{
+			name:     "sorts an unordered ledger ascending",
+			releases: makeRevisions(3, 1, 2),
+			max:      0,
+			want:     []int{1, 2, 3},
+		},
+		{
+			name:     "a max of one keeps the newest revision",
+			releases: makeRevisions(3, 1, 2),
+			max:      1,
+			want:     []int{3},
+		},
+		{
+			name:     "a max below the ledger size keeps the newest revisions",
+			releases: makeRevisions(4, 1, 3, 2),
+			max:      2,
+			want:     []int{3, 4},
+		},
+		{
+			name:     "a max above the ledger size keeps everything",
+			releases: makeRevisions(2, 1),
+			max:      10,
+			want:     []int{1, 2},
+		},
+		{
+			name:     "an empty ledger stays empty",
+			releases: []Release{},
+			max:      1,
+			want:     []int{},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := revisionNumbers(selectRevisions(tc.releases, tc.max))
+			if !equalInts(got, tc.want) {
+				t.Errorf("selectRevisions() = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestNewHelmSettings(t *testing.T) {
+	sentinel := map[string]string{
+		helmpath.CacheHomeEnvVar:  "/sentinel/cache",
+		helmpath.ConfigHomeEnvVar: "/sentinel/config",
+		helmpath.DataHomeEnvVar:   "/sentinel/data",
+	}
+	for envVar, value := range sentinel {
+		t.Setenv(envVar, value)
+	}
+
+	settings, cleanup, err := newHelmSettings()
+	if err != nil {
+		t.Fatalf("newHelmSettings() returned an error: %v", err)
+	}
+
+	directory := os.Getenv(helmpath.CacheHomeEnvVar)
+	if directory == sentinel[helmpath.CacheHomeEnvVar] {
+		t.Fatalf("%s was not overridden", helmpath.CacheHomeEnvVar)
+	}
+	scratch := filepath.Dir(directory)
+
+	if _, err := os.Stat(scratch); err != nil {
+		t.Fatalf("scratch directory %q is not usable: %v", scratch, err)
+	}
+
+	for envVar, subdirectory := range helmHomeEnvVars {
+		want := filepath.Join(scratch, subdirectory)
+		if got := os.Getenv(envVar); got != want {
+			t.Errorf("%s = %q, want %q", envVar, got, want)
+		}
+	}
+
+	paths := map[string]string{
+		"RepositoryConfig": settings.RepositoryConfig,
+		"RepositoryCache":  settings.RepositoryCache,
+		"RegistryConfig":   settings.RegistryConfig,
+	}
+	for name, path := range paths {
+		if !strings.HasPrefix(path, scratch+string(os.PathSeparator)) {
+			t.Errorf("%s = %q, want a path under %q", name, path, scratch)
+		}
+	}
+
+	cleanup()
+
+	if _, err := os.Stat(scratch); !os.IsNotExist(err) {
+		t.Errorf("scratch directory %q still exists after cleanup", scratch)
+	}
+
+	for envVar, want := range sentinel {
+		if got := os.Getenv(envVar); got != want {
+			t.Errorf("%s = %q after cleanup, want the prior value %q", envVar, got, want)
+		}
+	}
+}
+
+func TestNewHelmSettingsUnsetsVariablesThatWereNotSet(t *testing.T) {
+	for envVar := range helmHomeEnvVars {
+		t.Setenv(envVar, "")
+		os.Unsetenv(envVar) // nolint: errcheck
+	}
+
+	_, cleanup, err := newHelmSettings()
+	if err != nil {
+		t.Fatalf("newHelmSettings() returned an error: %v", err)
+	}
+	cleanup()
+
+	for envVar := range helmHomeEnvVars {
+		if value, ok := os.LookupEnv(envVar); ok {
+			t.Errorf("%s = %q after cleanup, want it to be unset", envVar, value)
+		}
+	}
+}
diff --git a/plugins/scheduler-k3s/k8s_test.go b/plugins/scheduler-k3s/k8s_test.go
index 8ac3ad35c..a5028c98c 100644
--- a/plugins/scheduler-k3s/k8s_test.go
+++ b/plugins/scheduler-k3s/k8s_test.go
@@ -41,11 +41,11 @@ func TestGetLowestNodeVersion(t *testing.T) {
 	}
 
 	cases := []struct {
-		name        string
-		nodes       []*corev1.Node
-		selector    string
-		want        string
-		wantErr     string
+		name     string
+		nodes    []*corev1.Node
+		selector string
+		want     string
+		wantErr  string
 	}{
 		{
 			name: "single control-plane node returns its kubelet version",
diff --git a/plugins/scheduler-k3s/metadata.go b/plugins/scheduler-k3s/metadata.go
new file mode 100644
index 000000000..6db2fd577
--- /dev/null
+++ b/plugins/scheduler-k3s/metadata.go
@@ -0,0 +1,275 @@
+package scheduler_k3s
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/dokku/dokku/plugins/common"
+)
+
+// metadataField selects which of the scheduler-k3s metadata maps a command
+// operates on, so the annotations and labels commands can share one
+// implementation the way the storage plugin does.
+type metadataField struct {
+	// Name is the plural noun used in user-facing messages.
+	Name string
+	// Singular is the singular noun used in user-facing messages.
+	Singular string
+	// ClearCommand is the command an empty --replace list points the user at.
+	ClearCommand string
+	// PropertyPrefix namespaces the property names this field owns. Annotations
+	// are stored unprefixed, which is why annotations alone must skip the
+	// property names reserved by other scheduler-k3s features.
+	PropertyPrefix string
+	// SkipReserved drops property names owned by other scheduler-k3s features.
+	SkipReserved bool
+	// ResourceTypes lists the kubernetes resource types this field supports.
+	ResourceTypes []string
+}
+
+var annotationsField = metadataField{
+	Name:          "annotations",
+	Singular:      "annotation",
+	ClearCommand:  "scheduler-k3s:annotations:clear",
+	SkipReserved:  true,
+	ResourceTypes: AnnotationResourceTypes,
+}
+
+var labelsField = metadataField{
+	Name:           "labels",
+	Singular:       "label",
+	ClearCommand:   "scheduler-k3s:labels:clear",
+	PropertyPrefix: "labels.",
+	ResourceTypes:  LabelResourceTypes,
+}
+
+// MetadataSetInput captures the inputs accepted by annotations:set and labels:set.
+// Key/Value and Pairs are mutually exclusive: Pairs is populated only under
+// --replace, where the positional arguments are key=value pairs rather than a
+// single key and value.
+type MetadataSetInput struct {
+	AppName      string
+	ProcessType  string
+	ResourceType string
+	Key          string
+	Value        string
+	Pairs        []string
+	Replace      bool
+}
+
+// MetadataClearInput captures the inputs accepted by annotations:clear and labels:clear.
+// An empty ProcessType or ResourceType filters nothing, matching the report commands.
+type MetadataClearInput struct {
+	AppName      string
+	ProcessType  string
+	ResourceType string
+}
+
+// metadataPropertyName returns the property a field stores one scope's map under.
+func metadataPropertyName(field metadataField, processType string, resourceType string) string {
+	return fmt.Sprintf("%s%s.%s", field.PropertyPrefix, processType, resourceType)
+}
+
+// verifyMetadataAppName applies the standard app name check, exempting the global scope.
+func verifyMetadataAppName(appName string) error {
+	if appName == "--global" {
+		return nil
+	}
+
+	return common.VerifyAppName(appName)
+}
+
+// validateResourceType reports whether a resource type is one the field supports.
+// An empty resource type passes, as the clear commands treat it as an absent filter;
+// callers that require one check for it separately.
+func validateResourceType(field metadataField, resourceType string) error {
+	if resourceType == "" {
+		return nil
+	}
+
+	for _, valid := range field.ResourceTypes {
+		if valid == resourceType {
+			return nil
+		}
+	}
+
+	valid := make([]string, len(field.ResourceTypes))
+	copy(valid, field.ResourceTypes)
+	sort.Strings(valid)
+	return fmt.Errorf("Invalid resource-type specified, valid resource types include: %s", strings.Join(valid, ", "))
+}
+
+// parseMetadataPairs turns key=value arguments into a map. A pair without a '='
+// or with an empty key is rejected, as is a key specified more than once, since
+// a repeated key leaves the declared map ambiguous. A pair ending in '=' stores
+// an empty value, which the per-key form cannot express.
+func parseMetadataPairs(pairs []string) (map[string]string, error) {
+	parsed := map[string]string{}
+	for _, pair := range pairs {
+		parts := strings.SplitN(pair, "=", 2)
+		if len(parts) != 2 || parts[0] == "" {
+			return nil, fmt.Errorf("Invalid key=value pair: %s", pair)
+		}
+
+		if _, ok := parsed[parts[0]]; ok {
+			return nil, fmt.Errorf("Duplicate key specified: %s", parts[0])
+		}
+
+		parsed[parts[0]] = parts[1]
+	}
+
+	return parsed, nil
+}
+
+// setMetadataKey writes a single key on one of the metadata maps. An empty value
+// deletes just that key, leaving its siblings in place.
+func setMetadataKey(field metadataField, input MetadataSetInput) error {
+	property := metadataPropertyName(field, input.ProcessType, input.ResourceType)
+	if input.Value == "" {
+		if err := common.PropertyMapDelete("scheduler-k3s", input.AppName, property, input.Key); err != nil {
+			return fmt.Errorf("Unable to delete property map entry: %w", err)
+		}
+		return nil
+	}
+
+	if err := common.PropertyMapSet("scheduler-k3s", input.AppName, property, input.Key, input.Value); err != nil {
+		return fmt.Errorf("Unable to set property map entry: %w", err)
+	}
+
+	return nil
+}
+
+// replaceMetadata swaps one scope's whole map for the declared one in a single write.
+// Every pair is parsed before anything is written, so a rejected pair leaves the
+// stored map untouched.
+func replaceMetadata(field metadataField, input MetadataSetInput) error {
+	if len(input.Pairs) == 0 {
+		return fmt.Errorf("Must specify at least one key=value pair, use %s to remove all %s", field.ClearCommand, field.Name)
+	}
+
+	parsed, err := parseMetadataPairs(input.Pairs)
+	if err != nil {
+		return err
+	}
+
+	property := metadataPropertyName(field, input.ProcessType, input.ResourceType)
+	if err := common.PropertyMapWrite("scheduler-k3s", input.AppName, property, parsed); err != nil {
+		return fmt.Errorf("Unable to write property map: %w", err)
+	}
+
+	return nil
+}
+
+// clearMetadata removes every metadata property matching the given filters.
+func clearMetadata(field metadataField, input MetadataClearInput) error {
+	properties, err := matchingMetadataProperties(field, input.AppName, input.ProcessType, input.ResourceType)
+	if err != nil {
+		return err
+	}
+
+	for _, property := range properties {
+		if err := common.PropertyDelete("scheduler-k3s", input.AppName, property.PropertyName); err != nil {
+			return fmt.Errorf("Unable to delete property: %w", err)
+		}
+	}
+
+	return nil
+}
+
+// metadataProperty is one stored metadata scope, as found by scanning the property store.
+type metadataProperty struct {
+	// PropertyName is the name the scope is stored under, prefix included.
+	PropertyName string
+	ProcessType  string
+	ResourceType string
+}
+
+// matchingMetadataProperties scans the property store for the scopes a field owns on
+// appName, optionally filtered by processType/resourceType. Both the report commands
+// and the clear commands read through this, so they cannot disagree about what is in scope.
+func matchingMetadataProperties(field metadataField, appName string, processType string, resourceType string) ([]metadataProperty, error) {
+	properties, err := common.PropertyGetAllByPrefix("scheduler-k3s", appName, field.PropertyPrefix)
+	if err != nil {
+		return nil, fmt.Errorf("Unable to get property list: %w", err)
+	}
+
+	knownResourceTypes := map[string]bool{}
+	for _, rt := range field.ResourceTypes {
+		knownResourceTypes[rt] = true
+	}
+
+	matching := []metadataProperty{}
+	for propertyName := range properties {
+		if field.SkipReserved && isReservedAnnotationProperty(propertyName) {
+			continue
+		}
+
+		suffix := strings.TrimPrefix(propertyName, field.PropertyPrefix)
+		dot := strings.LastIndex(suffix, ".")
+		if dot <= 0 || dot == len(suffix)-1 {
+			continue
+		}
+
+		propProcessType := suffix[:dot]
+		propResourceType := suffix[dot+1:]
+		if !knownResourceTypes[propResourceType] {
+			continue
+		}
+
+		if processType != "" && propProcessType != processType {
+			continue
+		}
+		if resourceType != "" && propResourceType != resourceType {
+			continue
+		}
+
+		matching = append(matching, metadataProperty{
+			PropertyName: propertyName,
+			ProcessType:  propProcessType,
+			ResourceType: propResourceType,
+		})
+	}
+
+	return matching, nil
+}
+
+// commandMetadataSet implements the annotations:set and labels:set commands.
+func commandMetadataSet(field metadataField, input MetadataSetInput) error {
+	if err := verifyMetadataAppName(input.AppName); err != nil {
+		return err
+	}
+
+	if input.ResourceType == "" {
+		return fmt.Errorf("Missing resource-type")
+	}
+
+	if err := validateResourceType(field, input.ResourceType); err != nil {
+		return err
+	}
+
+	if input.ProcessType == "" {
+		input.ProcessType = GlobalProcessType
+	}
+
+	if input.Replace {
+		return replaceMetadata(field, input)
+	}
+
+	return setMetadataKey(field, input)
+}
+
+// commandMetadataClear implements the annotations:clear and labels:clear commands.
+// Unlike the set commands, an omitted process-type or resource-type is an absent
+// filter rather than a default scope, matching the report commands.
+func commandMetadataClear(field metadataField, input MetadataClearInput) error {
+	if err := verifyMetadataAppName(input.AppName); err != nil {
+		return err
+	}
+
+	if err := validateResourceType(field, input.ResourceType); err != nil {
+		return err
+	}
+
+	return clearMetadata(field, input)
+}
diff --git a/plugins/scheduler-k3s/metadata_test.go b/plugins/scheduler-k3s/metadata_test.go
new file mode 100644
index 000000000..ccfea0e41
--- /dev/null
+++ b/plugins/scheduler-k3s/metadata_test.go
@@ -0,0 +1,188 @@
+package scheduler_k3s
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+)
+
+func TestParseMetadataPairs(t *testing.T) {
+	tests := []struct {
+		name  string
+		pairs []string
+		want  map[string]string
+	}{
+		{
+			name:  "empty list",
+			pairs: []string{},
+			want:  map[string]string{},
+		},
+		{
+			name:  "multiple pairs",
+			pairs: []string{"foo=bar", "baz=qux"},
+			want:  map[string]string{"foo": "bar", "baz": "qux"},
+		},
+		{
+			name:  "trailing equals stores an empty value",
+			pairs: []string{"foo="},
+			want:  map[string]string{"foo": ""},
+		},
+		{
+			name:  "value containing equals is kept whole",
+			pairs: []string{"foo=a=b"},
+			want:  map[string]string{"foo": "a=b"},
+		},
+		{
+			name:  "kubernetes style key",
+			pairs: []string{"prometheus.io/scrape=true"},
+			want:  map[string]string{"prometheus.io/scrape": "true"},
+		},
+		{
+			name:  "multi-line value",
+			pairs: []string{"foo=line one\nline two"},
+			want:  map[string]string{"foo": "line one\nline two"},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			got, err := parseMetadataPairs(test.pairs)
+			if err != nil {
+				t.Fatalf("parseMetadataPairs(%q) returned error: %s", test.pairs, err)
+			}
+			if !reflect.DeepEqual(got, test.want) {
+				t.Errorf("parseMetadataPairs(%q) = %v, want %v", test.pairs, got, test.want)
+			}
+		})
+	}
+}
+
+func TestParseMetadataPairsErrors(t *testing.T) {
+	tests := []struct {
+		name  string
+		pairs []string
+		want  string
+	}{
+		{
+			name:  "missing equals",
+			pairs: []string{"foo"},
+			want:  "Invalid key=value pair: foo",
+		},
+		{
+			name:  "empty key",
+			pairs: []string{"=bar"},
+			want:  "Invalid key=value pair: =bar",
+		},
+		{
+			name:  "empty pair",
+			pairs: []string{""},
+			want:  "Invalid key=value pair: ",
+		},
+		{
+			name:  "duplicate key",
+			pairs: []string{"foo=bar", "foo=qux"},
+			want:  "Duplicate key specified: foo",
+		},
+		{
+			name:  "duplicate key with identical value",
+			pairs: []string{"foo=bar", "foo=bar"},
+			want:  "Duplicate key specified: foo",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			got, err := parseMetadataPairs(test.pairs)
+			if err == nil {
+				t.Fatalf("parseMetadataPairs(%q) = %v, want error", test.pairs, got)
+			}
+			if err.Error() != test.want {
+				t.Errorf("parseMetadataPairs(%q) error = %q, want %q", test.pairs, err.Error(), test.want)
+			}
+		})
+	}
+}
+
+func TestValidateResourceType(t *testing.T) {
+	tests := []struct {
+		name         string
+		field        metadataField
+		resourceType string
+		wantErr      bool
+	}{
+		{
+			name:         "valid annotation resource type",
+			field:        annotationsField,
+			resourceType: "deployment",
+		},
+		{
+			name:         "valid label resource type",
+			field:        labelsField,
+			resourceType: "deployment",
+		},
+		{
+			// An empty resource type is an absent filter for the clear commands.
+			// The set commands reject it separately.
+			name:         "empty resource type passes",
+			field:        annotationsField,
+			resourceType: "",
+		},
+		{
+			name:         "unknown resource type",
+			field:        annotationsField,
+			resourceType: "deploymnet",
+			wantErr:      true,
+		},
+		{
+			// Keda resources do not flow user labels through, so they are
+			// annotation-only resource types.
+			name:         "keda resource type is valid for annotations",
+			field:        annotationsField,
+			resourceType: "keda_scaled_object",
+		},
+		{
+			name:         "keda resource type is invalid for labels",
+			field:        labelsField,
+			resourceType: "keda_scaled_object",
+			wantErr:      true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			err := validateResourceType(test.field, test.resourceType)
+			if test.wantErr {
+				if err == nil {
+					t.Fatalf("validateResourceType(%s, %q) = nil, want error", test.field.Name, test.resourceType)
+				}
+				if !strings.Contains(err.Error(), "Invalid resource-type specified, valid resource types include: ") {
+					t.Errorf("validateResourceType(%s, %q) error = %q, want the valid type list", test.field.Name, test.resourceType, err.Error())
+				}
+				for _, valid := range test.field.ResourceTypes {
+					if !strings.Contains(err.Error(), valid) {
+						t.Errorf("validateResourceType(%s, %q) error = %q, missing valid type %s", test.field.Name, test.resourceType, err.Error(), valid)
+					}
+				}
+				return
+			}
+
+			if err != nil {
+				t.Errorf("validateResourceType(%s, %q) returned error: %s", test.field.Name, test.resourceType, err)
+			}
+		})
+	}
+}
+
+func TestMetadataPropertyName(t *testing.T) {
+	// Annotations are stored unprefixed and labels under a labels. prefix, which is
+	// what getAnnotation and getLabel already build.
+	if got := metadataPropertyName(annotationsField, "web", "deployment"); got != "web.deployment" {
+		t.Errorf("metadataPropertyName(annotations, web, deployment) = %q, want web.deployment", got)
+	}
+	if got := metadataPropertyName(labelsField, "web", "deployment"); got != "labels.web.deployment" {
+		t.Errorf("metadataPropertyName(labels, web, deployment) = %q, want labels.web.deployment", got)
+	}
+	if got := metadataPropertyName(annotationsField, GlobalProcessType, "pod"); got != "--global.pod" {
+		t.Errorf("metadataPropertyName(annotations, --global, pod) = %q, want --global.pod", got)
+	}
+}
diff --git a/plugins/scheduler-k3s/node_profiles.go b/plugins/scheduler-k3s/node_profiles.go
new file mode 100644
index 000000000..5a722c823
--- /dev/null
+++ b/plugins/scheduler-k3s/node_profiles.go
@@ -0,0 +1,75 @@
+package scheduler_k3s
+
+import (
+	"errors"
+	"fmt"
+	"regexp"
+
+	"helm.sh/helm/v3/pkg/chartutil"
+)
+
+// helmMaxReleaseNameLength mirrors the release name cap chartutil.ValidateReleaseName
+// enforces, which helm does not export
+const helmMaxReleaseNameLength = 53
+
+// maxNodeProfileNameLength is the longest node profile name that still derives a helm
+// release name for its node sysctls chart that helm will accept
+const maxNodeProfileNameLength = helmMaxReleaseNameLength - len(nodeSysctlsProfileReleasePrefix)
+
+// legacyMaxNodeProfileNameLength is the length limit node profiles were created under
+// before their names were validated against the helm release name they derive
+const legacyMaxNodeProfileNameLength = 32
+
+// nodeProfileNamePattern matches the node profile names dokku can derive every downstream
+// name from. It is lowercase-only because a helm release name is, and dokku appends a
+// profile name to a release name prefix verbatim.
+var nodeProfileNamePattern = regexp.MustCompile(`^[a-z0-9]([a-z0-9-]*[a-z0-9])?$`)
+
+// legacyNodeProfileNamePattern matches the node profile names dokku accepted before it
+// validated them against the helm release name they derive
+var legacyNodeProfileNamePattern = regexp.MustCompile(`^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$`)
+
+// validateNodeProfileName rejects node profile names dokku cannot derive a valid helm
+// release name from. The node sysctls release is the tightest constraint a profile name
+// feeds, so the name is checked against that rather than on its own: a name accepted here
+// but rejected by helm would create a profile that only fails later, on commands with no
+// obvious relationship to it.
+func validateNodeProfileName(profileName string) error {
+	if profileName == "" {
+		return errors.New("Missing profile name")
+	}
+
+	if !nodeProfileNamePattern.MatchString(profileName) {
+		return fmt.Errorf("Invalid profile name, must only contain lowercase alphanumeric characters and dashes and cannot start or end with a dash: %s", profileName)
+	}
+
+	if len(profileName) > maxNodeProfileNameLength {
+		return fmt.Errorf("Profile name is too long, must be at most %d characters: %s", maxNodeProfileNameLength, profileName)
+	}
+
+	if err := chartutil.ValidateReleaseName(getNodeSysctlsReleaseName(profileName)); err != nil {
+		return fmt.Errorf("Invalid profile name %s, unable to derive a node sysctls release name from it: %w", profileName, err)
+	}
+
+	return nil
+}
+
+// validateStoredNodeProfileName checks a node profile name against the rules it may have
+// been stored under. It stays looser than validateNodeProfileName so a profile created
+// before names were validated against their helm release name is still removable by the
+// command that created it.
+func validateStoredNodeProfileName(profileName string) error {
+	if profileName == "" {
+		return errors.New("Missing profile name")
+	}
+
+	if !legacyNodeProfileNamePattern.MatchString(profileName) {
+		return fmt.Errorf("Invalid profile name, must only contain alphanumeric characters and dashes and cannot start or end with a dash: %s", profileName)
+	}
+
+	if len(profileName) > legacyMaxNodeProfileNameLength {
+		return fmt.Errorf("Profile name is too long, must be at most %d characters: %s", legacyMaxNodeProfileNameLength, profileName)
+	}
+
+	return nil
+}
diff --git a/plugins/scheduler-k3s/node_profiles_test.go b/plugins/scheduler-k3s/node_profiles_test.go
new file mode 100644
index 000000000..4a83d6ce0
--- /dev/null
+++ b/plugins/scheduler-k3s/node_profiles_test.go
@@ -0,0 +1,99 @@
+package scheduler_k3s
+
+import (
+	"strings"
+	"testing"
+
+	"helm.sh/helm/v3/pkg/chartutil"
+)
+
+func TestValidateNodeProfileName(t *testing.T) {
+	tests := []struct {
+		name        string
+		profileName string
+		wantErr     bool
+	}{
+		{name: "typical name", profileName: "edge-workers"},
+		{name: "single character", profileName: "a"},
+		{name: "digits", profileName: "pool0"},
+		{name: "maximum length", profileName: strings.Repeat("a", maxNodeProfileNameLength)},
+		{name: "empty", profileName: "", wantErr: true},
+		{name: "uppercase", profileName: "EdgePool", wantErr: true},
+		{name: "one over the maximum length", profileName: strings.Repeat("a", maxNodeProfileNameLength+1), wantErr: true},
+		{name: "twenty seven characters", profileName: "a-twenty-seven-char-profile", wantErr: true},
+		{name: "leading dash", profileName: "-edge", wantErr: true},
+		{name: "trailing dash", profileName: "edge-", wantErr: true},
+		{name: "dot", profileName: "edge.workers", wantErr: true},
+		{name: "underscore", profileName: "edge_workers", wantErr: true},
+		{name: "space", profileName: "edge workers", wantErr: true},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			err := validateNodeProfileName(test.profileName)
+			if test.wantErr && err == nil {
+				t.Errorf("validateNodeProfileName(%q) = nil, want an error", test.profileName)
+			}
+			if !test.wantErr && err != nil {
+				t.Errorf("validateNodeProfileName(%q) = %v, want nil", test.profileName, err)
+			}
+		})
+	}
+}
+
+// TestMaxNodeProfileNameLengthMatchesHelm asserts the limit validateNodeProfileName
+// reports is the same one helm enforces. Without it the local arithmetic could drift
+// from chartutil.ValidateReleaseName, which is the failure this limit exists to prevent.
+func TestMaxNodeProfileNameLengthMatchesHelm(t *testing.T) {
+	longest := getNodeSysctlsReleaseName(strings.Repeat("a", maxNodeProfileNameLength))
+	if err := chartutil.ValidateReleaseName(longest); err != nil {
+		t.Errorf("chartutil.ValidateReleaseName(%q) = %v, want nil", longest, err)
+	}
+
+	tooLong := getNodeSysctlsReleaseName(strings.Repeat("a", maxNodeProfileNameLength+1))
+	if err := chartutil.ValidateReleaseName(tooLong); err == nil {
+		t.Errorf("chartutil.ValidateReleaseName(%q) = nil, want an error", tooLong)
+	}
+}
+
+// TestValidateStoredNodeProfileNameAcceptsLegacyNames asserts profiles:remove can still
+// address a profile stored before names were validated against their helm release name
+func TestValidateStoredNodeProfileNameAcceptsLegacyNames(t *testing.T) {
+	tests := []struct {
+		name        string
+		profileName string
+		wantErr     bool
+	}{
+		{name: "uppercase", profileName: "EdgePool"},
+		{name: "twenty seven characters", profileName: "a-twenty-seven-char-profile"},
+		{name: "legacy maximum length", profileName: strings.Repeat("a", legacyMaxNodeProfileNameLength)},
+		{name: "empty", profileName: "", wantErr: true},
+		{name: "one over the legacy maximum length", profileName: strings.Repeat("a", legacyMaxNodeProfileNameLength+1), wantErr: true},
+		{name: "underscore", profileName: "edge_workers", wantErr: true},
+		{name: "path traversal", profileName: "../config", wantErr: true},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			err := validateStoredNodeProfileName(test.profileName)
+			if test.wantErr && err == nil {
+				t.Errorf("validateStoredNodeProfileName(%q) = nil, want an error", test.profileName)
+			}
+			if !test.wantErr && err != nil {
+				t.Errorf("validateStoredNodeProfileName(%q) = %v, want nil", test.profileName, err)
+			}
+		})
+	}
+}
+
+// TestVerifyNodeProfileSysctlsSupported asserts node-sysctls:set refuses a legacy profile
+// name rather than storing sysctls the reconcile loop would have to skip
+func TestVerifyNodeProfileSysctlsSupported(t *testing.T) {
+	if err := verifyNodeProfileSysctlsSupported("edge-workers"); err != nil {
+		t.Errorf("verifyNodeProfileSysctlsSupported(\"edge-workers\") = %v, want nil", err)
+	}
+
+	if err := verifyNodeProfileSysctlsSupported("EdgePool"); err == nil {
+		t.Error("verifyNodeProfileSysctlsSupported(\"EdgePool\") = nil, want an error")
+	}
+}
diff --git a/plugins/scheduler-k3s/node_sysctls.go b/plugins/scheduler-k3s/node_sysctls.go
index 0250e266e..7fdc1d6d5 100644
--- a/plugins/scheduler-k3s/node_sysctls.go
+++ b/plugins/scheduler-k3s/node_sysctls.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 
 	"github.com/dokku/dokku/plugins/common"
+	"helm.sh/helm/v3/pkg/chartutil"
 )
 
 // NodeSysctlsValues contains the values for a dokku-managed node sysctls helm chart
@@ -34,6 +35,9 @@ type nodeSysctlScope struct {
 	ReleaseName string
 	// Sysctls are the fully resolved sysctls for this scope
 	Sysctls []Sysctl
+	// StoredSysctls are only the sysctls this scope stores itself, with nothing
+	// inherited from the global scope
+	StoredSysctls []Sysctl
 }
 
 // getNodeSysctlsProperty returns the property name backing a node sysctls scope
@@ -45,13 +49,18 @@ func getNodeSysctlsProperty(profileName string) string {
 	return fmt.Sprintf("node-sysctls.profile.%s", profileName)
 }
 
+// nodeSysctlsProfileReleasePrefix prefixes the helm release name of every profile-scoped
+// node sysctls chart. A profile name is appended to it verbatim, so this is what bounds
+// how long a profile name may be.
+const nodeSysctlsProfileReleasePrefix = "dokku-node-sysctls-profile-"
+
 // getNodeSysctlsReleaseName returns the helm release name for a node sysctls scope
 func getNodeSysctlsReleaseName(profileName string) string {
 	if profileName == "" {
 		return "dokku-node-sysctls-global"
 	}
 
-	return fmt.Sprintf("dokku-node-sysctls-profile-%s", profileName)
+	return nodeSysctlsProfileReleasePrefix + profileName
 }
 
 // getNodeSysctls returns the sysctls stored against a single scope
@@ -124,17 +133,20 @@ func mergeNodeSysctls(global map[string]string, profile map[string]string) []Sys
 // profile scopes carrying the global sysctls merged underneath their own. Every
 // node matches exactly one scope: profiled nodes match their profile's DaemonSet,
 // and unprofiled nodes match the global one, so no two DaemonSets ever write the
-// same sysctl on the same node.
+// same sysctl on the same node. Each scope also carries the map it stores on its
+// own, which is what that scope's set and clear commands write.
 func resolveNodeSysctlScopes() ([]nodeSysctlScope, error) {
 	globalSysctls, err := getNodeSysctls("")
 	if err != nil {
 		return nil, err
 	}
 
+	global := sortedSysctls(globalSysctls)
 	scopes := []nodeSysctlScope{
 		{
-			ReleaseName: getNodeSysctlsReleaseName(""),
-			Sysctls:     sortedSysctls(globalSysctls),
+			ReleaseName:   getNodeSysctlsReleaseName(""),
+			Sysctls:       global,
+			StoredSysctls: global,
 		},
 	}
 
@@ -150,15 +162,45 @@ func resolveNodeSysctlScopes() ([]nodeSysctlScope, error) {
 		}
 
 		scopes = append(scopes, nodeSysctlScope{
-			ProfileName: profileName,
-			ReleaseName: getNodeSysctlsReleaseName(profileName),
-			Sysctls:     mergeNodeSysctls(globalSysctls, profileSysctls),
+			ProfileName:   profileName,
+			ReleaseName:   getNodeSysctlsReleaseName(profileName),
+			Sysctls:       mergeNodeSysctls(globalSysctls, profileSysctls),
+			StoredSysctls: sortedSysctls(profileSysctls),
 		})
 	}
 
 	return scopes, nil
 }
 
+// reportSysctls returns the sysctls a report should render for this scope: the map
+// the scope stores on its own when stored is set, and otherwise the resolved set its
+// DaemonSet applies.
+func (scope nodeSysctlScope) reportSysctls(stored bool) []Sysctl {
+	if stored {
+		return scope.StoredSysctls
+	}
+
+	return scope.Sysctls
+}
+
+// filterNodeSysctlScopes narrows resolved scopes to the single scope a report asked
+// for, with global selecting the scope no profile owns. A report naming neither gets
+// every scope.
+func filterNodeSysctlScopes(scopes []nodeSysctlScope, global bool, profileName string) []nodeSysctlScope {
+	if !global && profileName == "" {
+		return scopes
+	}
+
+	filtered := []nodeSysctlScope{}
+	for _, scope := range scopes {
+		if scope.ProfileName == profileName {
+			filtered = append(filtered, scope)
+		}
+	}
+
+	return filtered
+}
+
 // CreateOrUpdateNodeSysctls reconciles every node sysctls DaemonSet against the
 // stored properties. All scopes are reconciled on every call rather than only the
 // mutated one, since profile scopes inherit the global sysctls at render time and
@@ -175,6 +217,11 @@ func CreateOrUpdateNodeSysctls(ctx context.Context) error {
 	}
 
 	for _, scope := range scopes {
+		if err := chartutil.ValidateReleaseName(scope.ReleaseName); err != nil {
+			common.LogWarn(fmt.Sprintf("Skipping node sysctls for %s, its name predates profile name validation and cannot back a helm release: %s", nodeSysctlsScopeLabel(scope.ProfileName), err))
+			continue
+		}
+
 		if len(scope.Sysctls) == 0 {
 			if err := deleteNodeSysctlsRelease(scope.ReleaseName); err != nil {
 				return err
@@ -278,6 +325,11 @@ func installNodeSysctlsChart(ctx context.Context, scope nodeSysctlScope) error {
 // to an empty set. The kernel values it wrote are not reverted; they persist on the
 // affected nodes until those nodes reboot.
 func deleteNodeSysctlsRelease(releaseName string) error {
+	if err := chartutil.ValidateReleaseName(releaseName); err != nil {
+		common.LogDebug(fmt.Sprintf("skipping node sysctls release deletion, helm could never have installed %s: %s", releaseName, err))
+		return nil
+	}
+
 	helmAgent, err := NewHelmAgent(NodeSysctlsNamespace, DeployLogPrinter)
 	if err != nil {
 		return fmt.Errorf("error creating helm agent: %w", err)
@@ -314,6 +366,16 @@ func DeleteNodeSysctls(ctx context.Context, profileName string) error {
 	return deleteNodeSysctlsRelease(getNodeSysctlsReleaseName(profileName))
 }
 
+// nodeSysctlsScopeKey returns the key a report addresses a node sysctls scope by,
+// matching the flag that scope is set and cleared with
+func nodeSysctlsScopeKey(profileName string) string {
+	if profileName == "" {
+		return "--global"
+	}
+
+	return profileName
+}
+
 // nodeSysctlsScopeLabel returns a human readable name for a node sysctls scope
 func nodeSysctlsScopeLabel(profileName string) string {
 	if profileName == "" {
diff --git a/plugins/scheduler-k3s/node_sysctls_test.go b/plugins/scheduler-k3s/node_sysctls_test.go
index 00f2e54da..38960f113 100644
--- a/plugins/scheduler-k3s/node_sysctls_test.go
+++ b/plugins/scheduler-k3s/node_sysctls_test.go
@@ -303,3 +303,122 @@ func TestMergeNodeSysctlsDoesNotMutateInputs(t *testing.T) {
 		t.Errorf("mergeNodeSysctls() mutated the profile map: %v", profile)
 	}
 }
+
+func TestNodeSysctlsScopeKey(t *testing.T) {
+	if got := nodeSysctlsScopeKey(""); got != "--global" {
+		t.Errorf("nodeSysctlsScopeKey(\"\") = %q, want --global", got)
+	}
+	if got := nodeSysctlsScopeKey("edge-workers"); got != "edge-workers" {
+		t.Errorf("nodeSysctlsScopeKey(\"edge-workers\") = %q, want edge-workers", got)
+	}
+}
+
+// TestNodeSysctlScopeReportSysctls asserts a report can read back the map a scope
+// stores. A profile storing nothing of its own still resolves to every global sysctl,
+// so the resolved set alone cannot tell a stored value from an inherited one.
+func TestNodeSysctlScopeReportSysctls(t *testing.T) {
+	global := []Sysctl{{Name: "vm.max_map_count", Value: "262144"}}
+	profile := nodeSysctlScope{
+		ProfileName: "edge-workers",
+		Sysctls: []Sysctl{
+			{Name: "vm.max_map_count", Value: "262144"},
+			{Name: "vm.swappiness", Value: "10"},
+		},
+		StoredSysctls: []Sysctl{{Name: "vm.swappiness", Value: "10"}},
+	}
+
+	cases := []struct {
+		name   string
+		scope  nodeSysctlScope
+		stored bool
+		want   []Sysctl
+	}{
+		{
+			name:   "profile resolved set includes inherited sysctls",
+			scope:  profile,
+			stored: false,
+			want:   profile.Sysctls,
+		},
+		{
+			name:   "profile stored map excludes inherited sysctls",
+			scope:  profile,
+			stored: true,
+			want:   profile.StoredSysctls,
+		},
+		{
+			name:   "global scope resolves to what it stores",
+			scope:  nodeSysctlScope{Sysctls: global, StoredSysctls: global},
+			stored: true,
+			want:   global,
+		},
+		{
+			name:   "profile storing nothing reports an empty map",
+			scope:  nodeSysctlScope{ProfileName: "edge-workers", Sysctls: global, StoredSysctls: []Sysctl{}},
+			stored: true,
+			want:   []Sysctl{},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := tc.scope.reportSysctls(tc.stored)
+			if len(got) != len(tc.want) {
+				t.Fatalf("reportSysctls(%t) = %v, want %v", tc.stored, got, tc.want)
+			}
+			for i := range got {
+				if got[i] != tc.want[i] {
+					t.Errorf("reportSysctls(%t)[%d] = %v, want %v", tc.stored, i, got[i], tc.want[i])
+				}
+			}
+		})
+	}
+}
+
+func TestFilterNodeSysctlScopes(t *testing.T) {
+	scopes := []nodeSysctlScope{
+		{ReleaseName: "dokku-node-sysctls-global"},
+		{ProfileName: "edge-workers", ReleaseName: "dokku-node-sysctls-profile-edge-workers"},
+		{ProfileName: "gpu-workers", ReleaseName: "dokku-node-sysctls-profile-gpu-workers"},
+	}
+
+	cases := []struct {
+		name        string
+		global      bool
+		profileName string
+		want        []string
+	}{
+		{
+			name: "no filter keeps every scope",
+			want: []string{"", "edge-workers", "gpu-workers"},
+		},
+		{
+			name:   "global keeps only the unprofiled scope",
+			global: true,
+			want:   []string{""},
+		},
+		{
+			name:        "profile keeps only its own scope",
+			profileName: "edge-workers",
+			want:        []string{"edge-workers"},
+		},
+		{
+			name:        "unknown profile keeps nothing",
+			profileName: "missing-profile",
+			want:        []string{},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := filterNodeSysctlScopes(scopes, tc.global, tc.profileName)
+			if len(got) != len(tc.want) {
+				t.Fatalf("filterNodeSysctlScopes() returned %d scopes, want %d", len(got), len(tc.want))
+			}
+			for i := range got {
+				if got[i].ProfileName != tc.want[i] {
+					t.Errorf("filterNodeSysctlScopes()[%d].ProfileName = %q, want %q", i, got[i].ProfileName, tc.want[i])
+				}
+			}
+		})
+	}
+}
diff --git a/plugins/scheduler-k3s/plugin.toml b/plugins/scheduler-k3s/plugin.toml
index 2b6edca19..6af65e2ab 100644
--- a/plugins/scheduler-k3s/plugin.toml
+++ b/plugins/scheduler-k3s/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core scheduler-k3s plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/scheduler-k3s/preview.go b/plugins/scheduler-k3s/preview.go
index e0283da53..14be6e6ee 100644
--- a/plugins/scheduler-k3s/preview.go
+++ b/plugins/scheduler-k3s/preview.go
@@ -15,7 +15,6 @@ import (
 	"helm.sh/helm/v3/pkg/action"
 	"helm.sh/helm/v3/pkg/chart"
 	"helm.sh/helm/v3/pkg/chart/loader"
-	"helm.sh/helm/v3/pkg/cli"
 	"helm.sh/helm/v3/pkg/release"
 	"helm.sh/helm/v3/pkg/storage/driver"
 )
@@ -108,7 +107,12 @@ func CommandPreview(appName string, diffContext int, showSecrets bool, showSecre
 }
 
 func loadChartForPreview(chartPath string) (*chart.Chart, error) {
-	settings := cli.New()
+	settings, cleanup, err := newHelmSettings()
+	if err != nil {
+		return nil, err
+	}
+	defer cleanup()
+
 	opts := action.ChartPathOptions{}
 	located, err := opts.LocateChart(chartPath, settings)
 	if err != nil {
diff --git a/plugins/scheduler-k3s/report.go b/plugins/scheduler-k3s/report.go
index d88f0177d..8beeebc04 100644
--- a/plugins/scheduler-k3s/report.go
+++ b/plugins/scheduler-k3s/report.go
@@ -40,85 +40,89 @@ func ReportSingleApp(appName string, format string, infoFlag string) error {
 		}
 
 		flags = map[string]common.ReportFunc{
-			"--scheduler-k3s-computed-cert-issuer-kind":       reportComputedCertIssuerKind,
-			"--scheduler-k3s-global-cert-issuer-kind":         reportGlobalCertIssuerKind,
-			"--scheduler-k3s-computed-cert-issuer-name":       reportComputedCertIssuerName,
-			"--scheduler-k3s-global-cert-issuer-name":         reportGlobalCertIssuerName,
-			"--scheduler-k3s-computed-deploy-timeout":         reportComputedDeployTimeout,
-			"--scheduler-k3s-global-deploy-timeout":           reportGlobalDeployTimeout,
-			"--scheduler-k3s-computed-image-pull-secrets":     reportComputedImagePullSecrets,
-			"--scheduler-k3s-global-image-pull-secrets":       reportGlobalImagePullSecrets,
-			"--scheduler-k3s-computed-ingress-class":          reportComputedIngressClass,
-			"--scheduler-k3s-global-ingress-class":            reportGlobalIngressClass,
-			"--scheduler-k3s-computed-kubeconfig-path":        reportComputedKubeconfigPath,
-			"--scheduler-k3s-global-kubeconfig-path":          reportGlobalKubeconfigPath,
-			"--scheduler-k3s-computed-kube-context":           reportComputedKubeContext,
-			"--scheduler-k3s-global-kube-context":             reportGlobalKubeContext,
-			"--scheduler-k3s-computed-kustomize-root-path":    reportComputedKustomizeRootPath,
-			"--scheduler-k3s-global-kustomize-root-path":      reportGlobalKustomizeRootPath,
-			"--scheduler-k3s-computed-letsencrypt-server":     reportComputedLetsencryptServer,
-			"--scheduler-k3s-global-letsencrypt-server":       reportGlobalLetsencryptServer,
-			"--scheduler-k3s-computed-letsencrypt-email-prod": reportComputedLetsencryptEmailProd,
-			"--scheduler-k3s-global-letsencrypt-email-prod":   reportGlobalLetsencryptEmailProd,
-			"--scheduler-k3s-computed-letsencrypt-email-stag": reportComputedLetsencryptEmailStag,
-			"--scheduler-k3s-global-letsencrypt-email-stag":   reportGlobalLetsencryptEmailStag,
-			"--scheduler-k3s-computed-namespace":              reportComputedNamespace,
-			"--scheduler-k3s-global-namespace":                reportGlobalNamespace,
-			"--scheduler-k3s-computed-network-interface":      reportComputedNetworkInterface,
-			"--scheduler-k3s-global-network-interface":        reportGlobalNetworkInterface,
-			"--scheduler-k3s-global-node-sysctls-image":       reportGlobalNodeSysctlsImage,
-			"--scheduler-k3s-global-node-sysctls-pause-image": reportGlobalNodeSysctlsPauseImage,
-			"--scheduler-k3s-computed-rollback-on-failure":    reportComputedRollbackOnFailure,
-			"--scheduler-k3s-global-rollback-on-failure":      reportGlobalRollbackOnFailure,
-			"--scheduler-k3s-computed-shm-size":               reportComputedShmSize,
-			"--scheduler-k3s-global-shm-size":                 reportGlobalShmSize,
-			tokenFlag:                                         tokenReportFunc,
+			"--scheduler-k3s-computed-cert-issuer-kind":         reportComputedCertIssuerKind,
+			"--scheduler-k3s-global-cert-issuer-kind":           reportGlobalCertIssuerKind,
+			"--scheduler-k3s-computed-cert-issuer-name":         reportComputedCertIssuerName,
+			"--scheduler-k3s-global-cert-issuer-name":           reportGlobalCertIssuerName,
+			"--scheduler-k3s-computed-deploy-timeout":           reportComputedDeployTimeout,
+			"--scheduler-k3s-global-deploy-timeout":             reportGlobalDeployTimeout,
+			"--scheduler-k3s-computed-image-pull-secrets":       reportComputedImagePullSecrets,
+			"--scheduler-k3s-global-image-pull-secrets":         reportGlobalImagePullSecrets,
+			"--scheduler-k3s-computed-ingress-class":            reportComputedIngressClass,
+			"--scheduler-k3s-global-ingress-class":              reportGlobalIngressClass,
+			"--scheduler-k3s-computed-kubeconfig-path":          reportComputedKubeconfigPath,
+			"--scheduler-k3s-global-kubeconfig-path":            reportGlobalKubeconfigPath,
+			"--scheduler-k3s-computed-kube-context":             reportComputedKubeContext,
+			"--scheduler-k3s-global-kube-context":               reportGlobalKubeContext,
+			"--scheduler-k3s-computed-kustomize-root-path":      reportComputedKustomizeRootPath,
+			"--scheduler-k3s-global-kustomize-root-path":        reportGlobalKustomizeRootPath,
+			"--scheduler-k3s-computed-letsencrypt-server":       reportComputedLetsencryptServer,
+			"--scheduler-k3s-global-letsencrypt-server":         reportGlobalLetsencryptServer,
+			"--scheduler-k3s-computed-letsencrypt-email-prod":   reportComputedLetsencryptEmailProd,
+			"--scheduler-k3s-global-letsencrypt-email-prod":     reportGlobalLetsencryptEmailProd,
+			"--scheduler-k3s-computed-letsencrypt-email-stag":   reportComputedLetsencryptEmailStag,
+			"--scheduler-k3s-global-letsencrypt-email-stag":     reportGlobalLetsencryptEmailStag,
+			"--scheduler-k3s-computed-namespace":                reportComputedNamespace,
+			"--scheduler-k3s-global-namespace":                  reportGlobalNamespace,
+			"--scheduler-k3s-computed-network-interface":        reportComputedNetworkInterface,
+			"--scheduler-k3s-global-network-interface":          reportGlobalNetworkInterface,
+			"--scheduler-k3s-computed-node-sysctls-image":       reportComputedNodeSysctlsImage,
+			"--scheduler-k3s-global-node-sysctls-image":         reportGlobalNodeSysctlsImage,
+			"--scheduler-k3s-computed-node-sysctls-pause-image": reportComputedNodeSysctlsPauseImage,
+			"--scheduler-k3s-global-node-sysctls-pause-image":   reportGlobalNodeSysctlsPauseImage,
+			"--scheduler-k3s-computed-rollback-on-failure":      reportComputedRollbackOnFailure,
+			"--scheduler-k3s-global-rollback-on-failure":        reportGlobalRollbackOnFailure,
+			"--scheduler-k3s-computed-shm-size":                 reportComputedShmSize,
+			"--scheduler-k3s-global-shm-size":                   reportGlobalShmSize,
+			tokenFlag:                                           tokenReportFunc,
 		}
 	} else {
 		flags = map[string]common.ReportFunc{
-			"--scheduler-k3s-computed-cert-issuer-kind":       reportComputedCertIssuerKind,
-			"--scheduler-k3s-cert-issuer-kind":                reportCertIssuerKind,
-			"--scheduler-k3s-global-cert-issuer-kind":         reportGlobalCertIssuerKind,
-			"--scheduler-k3s-computed-cert-issuer-name":       reportComputedCertIssuerName,
-			"--scheduler-k3s-cert-issuer-name":                reportCertIssuerName,
-			"--scheduler-k3s-global-cert-issuer-name":         reportGlobalCertIssuerName,
-			"--scheduler-k3s-computed-deploy-timeout":         reportComputedDeployTimeout,
-			"--scheduler-k3s-deploy-timeout":                  reportDeployTimeout,
-			"--scheduler-k3s-global-deploy-timeout":           reportGlobalDeployTimeout,
-			"--scheduler-k3s-computed-image-pull-secrets":     reportComputedImagePullSecrets,
-			"--scheduler-k3s-image-pull-secrets":              reportImagePullSecrets,
-			"--scheduler-k3s-global-image-pull-secrets":       reportGlobalImagePullSecrets,
-			"--scheduler-k3s-computed-ingress-class":          reportComputedIngressClass,
-			"--scheduler-k3s-global-ingress-class":            reportGlobalIngressClass,
-			"--scheduler-k3s-computed-kubeconfig-path":        reportComputedKubeconfigPath,
-			"--scheduler-k3s-global-kubeconfig-path":          reportGlobalKubeconfigPath,
-			"--scheduler-k3s-computed-kube-context":           reportComputedKubeContext,
-			"--scheduler-k3s-global-kube-context":             reportGlobalKubeContext,
-			"--scheduler-k3s-computed-kustomize-root-path":    reportComputedKustomizeRootPath,
-			"--scheduler-k3s-kustomize-root-path":             reportKustomizeRootPath,
-			"--scheduler-k3s-global-kustomize-root-path":      reportGlobalKustomizeRootPath,
-			"--scheduler-k3s-computed-letsencrypt-server":     reportComputedLetsencryptServer,
-			"--scheduler-k3s-letsencrypt-server":              reportLetsencryptServer,
-			"--scheduler-k3s-global-letsencrypt-server":       reportGlobalLetsencryptServer,
-			"--scheduler-k3s-computed-letsencrypt-email-prod": reportComputedLetsencryptEmailProd,
-			"--scheduler-k3s-letsencrypt-email-prod":          reportLetsencryptEmailProd,
-			"--scheduler-k3s-global-letsencrypt-email-prod":   reportGlobalLetsencryptEmailProd,
-			"--scheduler-k3s-computed-letsencrypt-email-stag": reportComputedLetsencryptEmailStag,
-			"--scheduler-k3s-letsencrypt-email-stag":          reportLetsencryptEmailStag,
-			"--scheduler-k3s-global-letsencrypt-email-stag":   reportGlobalLetsencryptEmailStag,
-			"--scheduler-k3s-computed-namespace":              reportComputedNamespace,
-			"--scheduler-k3s-namespace":                       reportNamespace,
-			"--scheduler-k3s-global-namespace":                reportGlobalNamespace,
-			"--scheduler-k3s-computed-network-interface":      reportComputedNetworkInterface,
-			"--scheduler-k3s-global-network-interface":        reportGlobalNetworkInterface,
-			"--scheduler-k3s-global-node-sysctls-image":       reportGlobalNodeSysctlsImage,
-			"--scheduler-k3s-global-node-sysctls-pause-image": reportGlobalNodeSysctlsPauseImage,
-			"--scheduler-k3s-computed-rollback-on-failure":    reportComputedRollbackOnFailure,
-			"--scheduler-k3s-rollback-on-failure":             reportRollbackOnFailure,
-			"--scheduler-k3s-global-rollback-on-failure":      reportGlobalRollbackOnFailure,
-			"--scheduler-k3s-computed-shm-size":               reportComputedShmSize,
-			"--scheduler-k3s-global-shm-size":                 reportGlobalShmSize,
-			"--scheduler-k3s-shm-size":                        reportShmSize,
+			"--scheduler-k3s-computed-cert-issuer-kind":         reportComputedCertIssuerKind,
+			"--scheduler-k3s-cert-issuer-kind":                  reportCertIssuerKind,
+			"--scheduler-k3s-global-cert-issuer-kind":           reportGlobalCertIssuerKind,
+			"--scheduler-k3s-computed-cert-issuer-name":         reportComputedCertIssuerName,
+			"--scheduler-k3s-cert-issuer-name":                  reportCertIssuerName,
+			"--scheduler-k3s-global-cert-issuer-name":           reportGlobalCertIssuerName,
+			"--scheduler-k3s-computed-deploy-timeout":           reportComputedDeployTimeout,
+			"--scheduler-k3s-deploy-timeout":                    reportDeployTimeout,
+			"--scheduler-k3s-global-deploy-timeout":             reportGlobalDeployTimeout,
+			"--scheduler-k3s-computed-image-pull-secrets":       reportComputedImagePullSecrets,
+			"--scheduler-k3s-image-pull-secrets":                reportImagePullSecrets,
+			"--scheduler-k3s-global-image-pull-secrets":         reportGlobalImagePullSecrets,
+			"--scheduler-k3s-computed-ingress-class":            reportComputedIngressClass,
+			"--scheduler-k3s-global-ingress-class":              reportGlobalIngressClass,
+			"--scheduler-k3s-computed-kubeconfig-path":          reportComputedKubeconfigPath,
+			"--scheduler-k3s-global-kubeconfig-path":            reportGlobalKubeconfigPath,
+			"--scheduler-k3s-computed-kube-context":             reportComputedKubeContext,
+			"--scheduler-k3s-global-kube-context":               reportGlobalKubeContext,
+			"--scheduler-k3s-computed-kustomize-root-path":      reportComputedKustomizeRootPath,
+			"--scheduler-k3s-kustomize-root-path":               reportKustomizeRootPath,
+			"--scheduler-k3s-global-kustomize-root-path":        reportGlobalKustomizeRootPath,
+			"--scheduler-k3s-computed-letsencrypt-server":       reportComputedLetsencryptServer,
+			"--scheduler-k3s-letsencrypt-server":                reportLetsencryptServer,
+			"--scheduler-k3s-global-letsencrypt-server":         reportGlobalLetsencryptServer,
+			"--scheduler-k3s-computed-letsencrypt-email-prod":   reportComputedLetsencryptEmailProd,
+			"--scheduler-k3s-letsencrypt-email-prod":            reportLetsencryptEmailProd,
+			"--scheduler-k3s-global-letsencrypt-email-prod":     reportGlobalLetsencryptEmailProd,
+			"--scheduler-k3s-computed-letsencrypt-email-stag":   reportComputedLetsencryptEmailStag,
+			"--scheduler-k3s-letsencrypt-email-stag":            reportLetsencryptEmailStag,
+			"--scheduler-k3s-global-letsencrypt-email-stag":     reportGlobalLetsencryptEmailStag,
+			"--scheduler-k3s-computed-namespace":                reportComputedNamespace,
+			"--scheduler-k3s-namespace":                         reportNamespace,
+			"--scheduler-k3s-global-namespace":                  reportGlobalNamespace,
+			"--scheduler-k3s-computed-network-interface":        reportComputedNetworkInterface,
+			"--scheduler-k3s-global-network-interface":          reportGlobalNetworkInterface,
+			"--scheduler-k3s-computed-node-sysctls-image":       reportComputedNodeSysctlsImage,
+			"--scheduler-k3s-global-node-sysctls-image":         reportGlobalNodeSysctlsImage,
+			"--scheduler-k3s-computed-node-sysctls-pause-image": reportComputedNodeSysctlsPauseImage,
+			"--scheduler-k3s-global-node-sysctls-pause-image":   reportGlobalNodeSysctlsPauseImage,
+			"--scheduler-k3s-computed-rollback-on-failure":      reportComputedRollbackOnFailure,
+			"--scheduler-k3s-rollback-on-failure":               reportRollbackOnFailure,
+			"--scheduler-k3s-global-rollback-on-failure":        reportGlobalRollbackOnFailure,
+			"--scheduler-k3s-computed-shm-size":                 reportComputedShmSize,
+			"--scheduler-k3s-global-shm-size":                   reportGlobalShmSize,
+			"--scheduler-k3s-shm-size":                          reportShmSize,
 		}
 	}
 
@@ -396,101 +400,34 @@ func ReportLabelsSingleApp(appName string, format string, processType string, re
 // collectAnnotationsEntries scans the property store for annotation entries on appName,
 // optionally filtered by processType/resourceType.
 func collectAnnotationsEntries(appName string, processType string, resourceType string) ([]annotationsLabelsReportEntry, error) {
-	properties, err := common.PropertyGetAllByPrefix("scheduler-k3s", appName, "")
-	if err != nil {
-		return nil, fmt.Errorf("Unable to get property list: %w", err)
-	}
-
-	knownResourceTypes := map[string]bool{}
-	for _, rt := range AnnotationResourceTypes {
-		knownResourceTypes[rt] = true
-	}
-
-	entries := []annotationsLabelsReportEntry{}
-	for propertyName := range properties {
-		if isReservedAnnotationProperty(propertyName) {
-			continue
-		}
-
-		dot := strings.LastIndex(propertyName, ".")
-		if dot <= 0 || dot == len(propertyName)-1 {
-			continue
-		}
-
-		propProcessType := propertyName[:dot]
-		propResourceType := propertyName[dot+1:]
-		if !knownResourceTypes[propResourceType] {
-			continue
-		}
-
-		if processType != "" && propProcessType != processType {
-			continue
-		}
-		if resourceType != "" && propResourceType != resourceType {
-			continue
-		}
-
-		annotationMap, err := getAnnotation(appName, propProcessType, propResourceType)
-		if err != nil {
-			return nil, fmt.Errorf("Unable to read annotation %s: %w", propertyName, err)
-		}
-
-		for key, value := range annotationMap {
-			entries = append(entries, annotationsLabelsReportEntry{
-				ProcessType:  propProcessType,
-				ResourceType: propResourceType,
-				Key:          key,
-				Value:        value,
-			})
-		}
-	}
-
-	return entries, nil
+	return collectMetadataEntries(annotationsField, appName, processType, resourceType, getAnnotation)
 }
 
 // collectLabelsEntries scans the property store for label entries on appName,
 // optionally filtered by processType/resourceType.
 func collectLabelsEntries(appName string, processType string, resourceType string) ([]annotationsLabelsReportEntry, error) {
-	properties, err := common.PropertyGetAllByPrefix("scheduler-k3s", appName, "labels.")
-	if err != nil {
-		return nil, fmt.Errorf("Unable to get property list: %w", err)
-	}
+	return collectMetadataEntries(labelsField, appName, processType, resourceType, getLabel)
+}
 
-	knownResourceTypes := map[string]bool{}
-	for _, rt := range LabelResourceTypes {
-		knownResourceTypes[rt] = true
+// collectMetadataEntries flattens every stored scope a field owns on appName into
+// report entries, reading the scopes through the same scan the clear commands use.
+func collectMetadataEntries(field metadataField, appName string, processType string, resourceType string, read func(string, string, string) (map[string]string, error)) ([]annotationsLabelsReportEntry, error) {
+	properties, err := matchingMetadataProperties(field, appName, processType, resourceType)
+	if err != nil {
+		return nil, err
 	}
 
 	entries := []annotationsLabelsReportEntry{}
-	for propertyName := range properties {
-		suffix := strings.TrimPrefix(propertyName, "labels.")
-		dot := strings.LastIndex(suffix, ".")
-		if dot <= 0 || dot == len(suffix)-1 {
-			continue
-		}
-
-		propProcessType := suffix[:dot]
-		propResourceType := suffix[dot+1:]
-		if !knownResourceTypes[propResourceType] {
-			continue
-		}
-
-		if processType != "" && propProcessType != processType {
-			continue
-		}
-		if resourceType != "" && propResourceType != resourceType {
-			continue
-		}
-
-		labelMap, err := getLabel(appName, propProcessType, propResourceType)
+	for _, property := range properties {
+		values, err := read(appName, property.ProcessType, property.ResourceType)
 		if err != nil {
-			return nil, fmt.Errorf("Unable to read label %s: %w", propertyName, err)
+			return nil, fmt.Errorf("Unable to read %s %s: %w", field.Singular, property.PropertyName, err)
 		}
 
-		for key, value := range labelMap {
+		for key, value := range values {
 			entries = append(entries, annotationsLabelsReportEntry{
-				ProcessType:  propProcessType,
-				ResourceType: propResourceType,
+				ProcessType:  property.ProcessType,
+				ResourceType: property.ResourceType,
 				Key:          key,
 				Value:        value,
 			})
@@ -753,14 +690,22 @@ func reportGlobalNetworkInterface(appName string) string {
 	return getGlobalNetworkInterface()
 }
 
-func reportGlobalNodeSysctlsImage(appName string) string {
+func reportComputedNodeSysctlsImage(appName string) string {
 	return getComputedNodeSysctlsImage()
 }
 
-func reportGlobalNodeSysctlsPauseImage(appName string) string {
+func reportGlobalNodeSysctlsImage(appName string) string {
+	return getGlobalNodeSysctlsImage()
+}
+
+func reportComputedNodeSysctlsPauseImage(appName string) string {
 	return getComputedNodeSysctlsPauseImage()
 }
 
+func reportGlobalNodeSysctlsPauseImage(appName string) string {
+	return getGlobalNodeSysctlsPauseImage()
+}
+
 func reportComputedRollbackOnFailure(appName string) string {
 	return getComputedRollbackOnFailure(appName)
 }
diff --git a/plugins/scheduler-k3s/routes.go b/plugins/scheduler-k3s/routes.go
new file mode 100644
index 000000000..466ae9e67
--- /dev/null
+++ b/plugins/scheduler-k3s/routes.go
@@ -0,0 +1,100 @@
+package scheduler_k3s
+
+import (
+	"fmt"
+	"sort"
+	"strconv"
+	"strings"
+
+	"github.com/dokku/dokku/plugins/common"
+)
+
+// GetAppRoutes loads the proxy:route:set route set for an app via the
+// proxy-routes-list plugin trigger. The trigger emits one
+// "process|port|path|strip" line per route, sorted by descending path length.
+// Returns an empty slice when no routes are configured.
+func GetAppRoutes(appName string) ([]GlobalRoute, error) {
+	result, err := common.CallPlugnTrigger(common.PlugnTriggerInput{
+		Trigger: "proxy-routes-list",
+		Args:    []string{appName},
+	})
+	if err != nil {
+		return nil, fmt.Errorf("error reading proxy routes for %s: %w", appName, err)
+	}
+
+	stdout := result.StdoutContents()
+	if stdout == "" {
+		return nil, nil
+	}
+
+	routes := []GlobalRoute{}
+	for _, line := range strings.Split(stdout, "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		fields := strings.SplitN(line, "|", 4)
+		if len(fields) < 3 {
+			return nil, fmt.Errorf("invalid route line %q for %s", line, appName)
+		}
+		// Bound to uint16 (1-65535) so the int32 chart-values field can never
+		// overflow regardless of host integer width. The proxy plugin already
+		// enforces the same range on set, but parse defensively because the
+		// trigger output is a string boundary.
+		port, err := strconv.ParseUint(fields[1], 10, 16)
+		if err != nil {
+			return nil, fmt.Errorf("invalid port %q in route line %q for %s: %w", fields[1], line, appName, err)
+		}
+		strip := false
+		if len(fields) == 4 && fields[3] == "1" {
+			strip = true
+		}
+		routes = append(routes, GlobalRoute{
+			Process:     fields[0],
+			Path:        fields[2],
+			Port:        int32(port),
+			StripPrefix: strip,
+			Slug:        routeSlug(fields[2]),
+		})
+	}
+	return routes, nil
+}
+
+// routeSlug returns a deterministic kebab-case identifier derived from a
+// route path. Example: "/api/v0" -> "api-v0".
+func routeSlug(path string) string {
+	s := strings.Trim(path, "/")
+	s = strings.ReplaceAll(s, "/", "-")
+	s = strings.ToLower(s)
+	if s == "" {
+		return "root"
+	}
+	return s
+}
+
+// RoutedProcessPorts returns, per process type, the set of upstream container
+// ports referenced by any route targeting that process. The chart-values
+// builder uses this to synthesize port_maps on routed non-web processes so
+// their Kubernetes Services expose the right port.
+func RoutedProcessPorts(routes []GlobalRoute) map[string]map[int32]bool {
+	out := map[string]map[int32]bool{}
+	for _, route := range routes {
+		if _, ok := out[route.Process]; !ok {
+			out[route.Process] = map[int32]bool{}
+		}
+		out[route.Process][route.Port] = true
+	}
+	return out
+}
+
+// SortedRoutedPorts returns the ports for a process in deterministic order
+// so the resulting Service has a stable port list across renders.
+func SortedRoutedPorts(routedPorts map[string]map[int32]bool, processType string) []int32 {
+	set := routedPorts[processType]
+	ports := make([]int32, 0, len(set))
+	for port := range set {
+		ports = append(ports, port)
+	}
+	sort.Slice(ports, func(i, j int) bool { return ports[i] < ports[j] })
+	return ports
+}
diff --git a/plugins/scheduler-k3s/scheduler_k3s.go b/plugins/scheduler-k3s/scheduler_k3s.go
index dd3783436..cd87e681c 100644
--- a/plugins/scheduler-k3s/scheduler_k3s.go
+++ b/plugins/scheduler-k3s/scheduler_k3s.go
@@ -219,26 +219,6 @@ var HelmCharts = []HelmChart{
 	},
 }
 
-type HelmRepository struct {
-	Name string
-	URL  string
-}
-
-var HelmRepositories = []HelmRepository{
-	{
-		Name: "jetstack",
-		URL:  "https://charts.jetstack.io",
-	},
-	{
-		Name: "longhorn",
-		URL:  "https://charts.longhorn.io",
-	},
-	{
-		Name: "traefik",
-		URL:  "https://helm.traefik.io/traefik",
-	},
-}
-
 // NodeProfile is a profile for a node in the k3s cluster
 type NodeProfile struct {
 	// Name is the name of the node profile
diff --git a/plugins/scheduler-k3s/src/commands/commands.go b/plugins/scheduler-k3s/src/commands/commands.go
index 8c7d33678..32a39951a 100644
--- a/plugins/scheduler-k3s/src/commands/commands.go
+++ b/plugins/scheduler-k3s/src/commands/commands.go
@@ -17,21 +17,30 @@ Manage scheduler-k3s settings for an app
 Additional commands:`
 
 	helpContent = `
+    scheduler-k3s:annotations:clear <app|--global> [--process-type PROCESS_TYPE] [--resource-type RESOURCE_TYPE], Clear all annotations for an app or a single process-type/resource-type scope
     scheduler-k3s:annotations:set <app|--global> <property> (<value>) [--process-type PROCESS_TYPE] <--resource-type RESOURCE_TYPE>, Set or clear an annotation for a given app/process-type/resource-type combination
+    scheduler-k3s:annotations:set --replace <app|--global> <key=value> [<key=value> ...] [--process-type PROCESS_TYPE] <--resource-type RESOURCE_TYPE>, Replace the entire annotation map for a given app/process-type/resource-type combination
     scheduler-k3s:annotations:report [<app>|--global] [--format stdout|json] [--process-type PROCESS_TYPE] [--resource-type RESOURCE_TYPE], Displays a scheduler-k3s annotations report for one or more apps
     scheduler-k3s:autoscaling-auth:set <app|--global> <trigger> [<--metadata key=value>...], Set or clear a scheduler-k3s autoscaling keda trigger authentication resource for an app
+    scheduler-k3s:autoscaling-auth:set --replace <app|--global> <trigger> <--metadata key=value> [<--metadata key=value>...], Replace the entire metadata map for a scheduler-k3s autoscaling keda trigger authentication resource
     scheduler-k3s:autoscaling-auth:report [<app>|--global] [--format stdout|json] [--include-metadata], Displays a scheduler-k3s autoscaling auth report for one or more apps
+    scheduler-k3s:charts:clear <chart>, Clear all chart-specific helm values for a chart
     scheduler-k3s:charts:report [<chart>] [--format stdout|json], Displays a scheduler-k3s chart override report
     scheduler-k3s:charts:set <chart-name.property> (<value>), Set or clear a chart-specific helm value
+    scheduler-k3s:charts:set --replace <chart> <property=value> [<property=value> ...], Replace the entire helm value override map for a chart
     scheduler-k3s:cluster:add [--profile PROFILE] [--role ROLE] [--insecure-allow-unknown-hosts] [--server-ip SERVER_IP] [--taint-scheduling] [--kubelet-args KUBELET_ARGS] <ssh://user@host:port>, Adds a server node to a Dokku-managed cluster
     scheduler-k3s:cluster:list [--format json|stdout], Lists all nodes in a Dokku-managed cluster
     scheduler-k3s:cluster:remove [node-id], Removes client node to a Dokku-managed cluster
-    scheduler-k3s:ensure-charts, Ensures the k3s charts are installed
-    scheduler-k3s:initialize [--server-ip SERVER_IP] [--taint-scheduling] [--kubelet-args KUBELET_ARGS], Initializes a cluster
+    scheduler-k3s:ensure-charts [--force] [--charts CHART_NAMES], Ensures the k3s charts are installed
+    scheduler-k3s:initialize [--server-ip SERVER_IP] [--ingress-class INGRESS_CLASS] [--taint-scheduling] [--kubelet-args KUBELET_ARGS], Initializes a cluster
+    scheduler-k3s:labels:clear <app|--global> [--process-type PROCESS_TYPE] [--resource-type RESOURCE_TYPE], Clear all labels for an app or a single process-type/resource-type scope
     scheduler-k3s:labels:set <app|--global> <property> (<value>) [--process-type PROCESS_TYPE] <--resource-type RESOURCE_TYPE>, Set or clear a label for a given app/process-type/resource-type combination
+    scheduler-k3s:labels:set --replace <app|--global> <key=value> [<key=value> ...] [--process-type PROCESS_TYPE] <--resource-type RESOURCE_TYPE>, Replace the entire label map for a given app/process-type/resource-type combination
     scheduler-k3s:labels:report [<app>|--global] [--format stdout|json] [--process-type PROCESS_TYPE] [--resource-type RESOURCE_TYPE], Displays a scheduler-k3s labels report for one or more apps
+    scheduler-k3s:node-sysctls:clear [--global|--profile PROFILE], Clear all node-level kernel sysctls for unprofiled nodes or a single node profile
     scheduler-k3s:node-sysctls:set <sysctl> (<value>) [--global|--profile PROFILE], Set or clear a node-level kernel sysctl for unprofiled nodes or a single node profile
-    scheduler-k3s:node-sysctls:report [--format stdout|json], Displays the node-level kernel sysctls applied to each scope
+    scheduler-k3s:node-sysctls:set --replace <sysctl=value> [<sysctl=value> ...] [--global|--profile PROFILE], Replace the entire node-level kernel sysctl map for unprofiled nodes or a single node profile
+    scheduler-k3s:node-sysctls:report [--format stdout|json] [--stored] [--global|--profile PROFILE], Displays the node-level kernel sysctls for each scope
     scheduler-k3s:preview <app> [--context N] [--show-secrets] [--show-secrets-decoded], Displays a diff between the current and next deployment for an app
     scheduler-k3s:profiles:add <profile> [--role ROLE] [--insecure-allow-unknown-hosts] [--taint-scheduling] [--kubelet-args KUBELET_ARGS], Adds a node profile to the k3s cluster
     scheduler-k3s:profiles:list [--format json|stdout], Lists all node profiles in the k3s cluster
diff --git a/plugins/scheduler-k3s/src/subcommands/subcommands.go b/plugins/scheduler-k3s/src/subcommands/subcommands.go
index 24631400c..15aa5d301 100644
--- a/plugins/scheduler-k3s/src/subcommands/subcommands.go
+++ b/plugins/scheduler-k3s/src/subcommands/subcommands.go
@@ -18,22 +18,50 @@ func main() {
 
 	var err error
 	switch subcommand {
+	case "annotations:clear":
+		args := flag.NewFlagSet("scheduler-k3s:annotations:clear", flag.ExitOnError)
+		global := args.Bool("global", false, "--global: clear global annotations")
+		processType := args.String("process-type", "", "--process-type: filter by process-type")
+		resourceType := args.String("resource-type", "", "--resource-type: filter by resource-type")
+		args.Parse(os.Args[2:])
+		appName := args.Arg(0)
+		if *global {
+			appName = "--global"
+		}
+
+		err = scheduler_k3s.CommandAnnotationsClear(scheduler_k3s.MetadataClearInput{
+			AppName:      appName,
+			ProcessType:  *processType,
+			ResourceType: *resourceType,
+		})
 	case "annotations:set":
 		args := flag.NewFlagSet("scheduler-k3s:annotations:set", flag.ExitOnError)
 		global := args.Bool("global", false, "--global: set a global property")
 		processType := args.String("process-type", "", "--process-type: scope to process-type")
 		resourceType := args.String("resource-type", "", "--resource-type: scope to resource-type")
+		replace := args.Bool("replace", false, "--replace: replace the entire annotation map for the scope")
 		args.Parse(os.Args[2:])
-		appName := args.Arg(0)
-		property := args.Arg(1)
-		value := args.Arg(2)
-		if *global {
-			appName = "--global"
-			property = args.Arg(0)
-			value = args.Arg(1)
+		input := scheduler_k3s.MetadataSetInput{
+			AppName:      args.Arg(0),
+			ProcessType:  *processType,
+			ResourceType: *resourceType,
+			Replace:      *replace,
 		}
 
-		err = scheduler_k3s.CommandAnnotationsSet(appName, *processType, *resourceType, property, value)
+		skip := 1
+		if *global {
+			input.AppName = "--global"
+			skip = 0
+		}
+
+		if *replace {
+			input.Pairs = common.VarArgs(args.Args(), skip)
+		} else {
+			input.Key = args.Arg(skip)
+			input.Value = args.Arg(skip + 1)
+		}
+
+		err = scheduler_k3s.CommandAnnotationsSet(input)
 	case "annotations:report":
 		args := flag.NewFlagSet("scheduler-k3s:annotations:report", flag.ExitOnError)
 		global := args.Bool("global", false, "--global: show the global report")
@@ -55,6 +83,7 @@ func main() {
 		args := flag.NewFlagSet("scheduler-k3s:autoscaling-auth:set", flag.ExitOnError)
 		global := args.Bool("global", false, "--global: set a global property")
 		metadata := args.StringToString("metadata", map[string]string{}, "--metadata: a key=value map of parameter metadata")
+		replace := args.Bool("replace", false, "--replace: replace the entire metadata map for the trigger")
 		args.Parse(os.Args[2:])
 		appName := args.Arg(0)
 		trigger := args.Arg(1)
@@ -62,7 +91,7 @@ func main() {
 			appName = "--global"
 			trigger = args.Arg(0)
 		}
-		err = scheduler_k3s.CommandAutoscalingAuthSet(appName, trigger, *metadata, *global)
+		err = scheduler_k3s.CommandAutoscalingAuthSet(appName, trigger, *metadata, *global, *replace)
 	case "autoscaling-auth:report":
 		args := flag.NewFlagSet("scheduler-k3s:autoscaling-auth:report", flag.ExitOnError)
 		global := args.Bool("global", false, "--global: show the global report")
@@ -79,12 +108,28 @@ func main() {
 			appName = "--global"
 		}
 		err = scheduler_k3s.CommandAutoscalingAuthReport(appName, *format, *includeMetadata, infoFlag)
+	case "charts:clear":
+		args := flag.NewFlagSet("scheduler-k3s:charts:clear", flag.ExitOnError)
+		args.Parse(os.Args[2:])
+		chartName := args.Arg(0)
+		err = scheduler_k3s.CommandChartsClear(chartName)
 	case "charts:set":
 		args := flag.NewFlagSet("scheduler-k3s:charts:set", flag.ExitOnError)
+		replace := args.Bool("replace", false, "--replace: replace the entire override map for the chart")
 		args.Parse(os.Args[2:])
-		property := args.Arg(0)
-		value := args.Arg(1)
-		err = scheduler_k3s.CommandChartsSet(property, value)
+		input := scheduler_k3s.ChartsSetInput{
+			Replace: *replace,
+		}
+
+		if *replace {
+			input.ChartName = args.Arg(0)
+			input.Pairs = common.VarArgs(args.Args(), 1)
+		} else {
+			input.Property = args.Arg(0)
+			input.Value = args.Arg(1)
+		}
+
+		err = scheduler_k3s.CommandChartsSet(input)
 	case "charts:report":
 		args := flag.NewFlagSet("scheduler-k3s:charts:report", flag.ExitOnError)
 		format := args.String("format", "stdout", "format: [ stdout | json ]")
@@ -131,22 +176,50 @@ func main() {
 		kubeletArgs := args.StringSlice("kubelet-args", []string{}, "kubelet-args: repeatable key=value kubelet arguments (e.g., --kubelet-args key=value)")
 		args.Parse(os.Args[2:])
 		err = scheduler_k3s.CommandInitialize(*ingressClass, *serverIP, *taintScheduling, *kubeletArgs)
+	case "labels:clear":
+		args := flag.NewFlagSet("scheduler-k3s:labels:clear", flag.ExitOnError)
+		global := args.Bool("global", false, "--global: clear global labels")
+		processType := args.String("process-type", "", "--process-type: filter by process-type")
+		resourceType := args.String("resource-type", "", "--resource-type: filter by resource-type")
+		args.Parse(os.Args[2:])
+		appName := args.Arg(0)
+		if *global {
+			appName = "--global"
+		}
+
+		err = scheduler_k3s.CommandLabelsClear(scheduler_k3s.MetadataClearInput{
+			AppName:      appName,
+			ProcessType:  *processType,
+			ResourceType: *resourceType,
+		})
 	case "labels:set":
 		args := flag.NewFlagSet("scheduler-k3s:labels:set", flag.ExitOnError)
 		global := args.Bool("global", false, "--global: set a global property")
 		processType := args.String("process-type", "", "--process-type: scope to process-type")
 		resourceType := args.String("resource-type", "", "--resource-type: scope to resource-type")
+		replace := args.Bool("replace", false, "--replace: replace the entire label map for the scope")
 		args.Parse(os.Args[2:])
-		appName := args.Arg(0)
-		property := args.Arg(1)
-		value := args.Arg(2)
-		if *global {
-			appName = "--global"
-			property = args.Arg(0)
-			value = args.Arg(1)
+		input := scheduler_k3s.MetadataSetInput{
+			AppName:      args.Arg(0),
+			ProcessType:  *processType,
+			ResourceType: *resourceType,
+			Replace:      *replace,
 		}
 
-		err = scheduler_k3s.CommandLabelsSet(appName, *processType, *resourceType, property, value)
+		skip := 1
+		if *global {
+			input.AppName = "--global"
+			skip = 0
+		}
+
+		if *replace {
+			input.Pairs = common.VarArgs(args.Args(), skip)
+		} else {
+			input.Key = args.Arg(skip)
+			input.Value = args.Arg(skip + 1)
+		}
+
+		err = scheduler_k3s.CommandLabelsSet(input)
 	case "labels:report":
 		args := flag.NewFlagSet("scheduler-k3s:labels:report", flag.ExitOnError)
 		global := args.Bool("global", false, "--global: show the global report")
@@ -164,23 +237,57 @@ func main() {
 			appName = "--global"
 		}
 		err = scheduler_k3s.CommandLabelsReport(appName, *format, *processType, *resourceType, infoFlag)
-	case "node-sysctls:set":
-		args := flag.NewFlagSet("scheduler-k3s:node-sysctls:set", flag.ExitOnError)
+	case "node-sysctls:clear":
+		args := flag.NewFlagSet("scheduler-k3s:node-sysctls:clear", flag.ExitOnError)
 		global := args.Bool("global", false, "--global: scope to all nodes without a node profile")
 		profileName := args.String("profile", "", "--profile: scope to a node profile instead of all unprofiled nodes")
 		args.Parse(os.Args[2:])
-		key := args.Arg(0)
-		value := args.Arg(1)
 		if *global && *profileName != "" {
 			err = fmt.Errorf("Only one of --global and --profile may be specified")
 			break
 		}
-		err = scheduler_k3s.CommandNodeSysctlsSet(*profileName, key, value)
+		err = scheduler_k3s.CommandNodeSysctlsClear(*profileName)
+	case "node-sysctls:set":
+		args := flag.NewFlagSet("scheduler-k3s:node-sysctls:set", flag.ExitOnError)
+		global := args.Bool("global", false, "--global: scope to all nodes without a node profile")
+		profileName := args.String("profile", "", "--profile: scope to a node profile instead of all unprofiled nodes")
+		replace := args.Bool("replace", false, "--replace: replace the entire sysctl map for the scope")
+		args.Parse(os.Args[2:])
+		if *global && *profileName != "" {
+			err = fmt.Errorf("Only one of --global and --profile may be specified")
+			break
+		}
+
+		input := scheduler_k3s.NodeSysctlsSetInput{
+			ProfileName: *profileName,
+			Replace:     *replace,
+		}
+		if *replace {
+			input.Pairs = args.Args()
+		} else {
+			input.Key = args.Arg(0)
+			input.Value = args.Arg(1)
+		}
+
+		err = scheduler_k3s.CommandNodeSysctlsSet(input)
 	case "node-sysctls:report":
 		args := flag.NewFlagSet("scheduler-k3s:node-sysctls:report", flag.ExitOnError)
 		format := args.String("format", "stdout", "format: [ stdout | json ]")
+		global := args.Bool("global", false, "--global: report only on all nodes without a node profile")
+		profileName := args.String("profile", "", "--profile: report only on a node profile instead of every scope")
+		stored := args.Bool("stored", false, "--stored: report the sysctls each scope stores itself rather than the resolved set it applies")
 		args.Parse(os.Args[2:])
-		err = scheduler_k3s.CommandNodeSysctlsReport(*format)
+		if *global && *profileName != "" {
+			err = fmt.Errorf("Only one of --global and --profile may be specified")
+			break
+		}
+
+		err = scheduler_k3s.CommandNodeSysctlsReport(scheduler_k3s.NodeSysctlsReportInput{
+			Format:      *format,
+			Global:      *global,
+			ProfileName: *profileName,
+			Stored:      *stored,
+		})
 	case "preview":
 		args := flag.NewFlagSet("scheduler-k3s:preview", flag.ExitOnError)
 		context := args.Int("context", 3, "--context: number of unchanged lines of context around each change (-1 for full output)")
diff --git a/plugins/scheduler-k3s/storage.go b/plugins/scheduler-k3s/storage.go
index 9cf0e29ce..72d150d4c 100644
--- a/plugins/scheduler-k3s/storage.go
+++ b/plugins/scheduler-k3s/storage.go
@@ -275,18 +275,38 @@ func LoadAppMounts(appName string, phase string) ([]AppMountPair, error) {
 	return pairs, nil
 }
 
-// ToProcessVolumes converts each AppMountPair into a ProcessVolume. K3s
-// app deployments reference the PVC by name; the PVC itself is owned by
-// the storage entry's separate helm release. Any docker-local entries
-// found here are an error - they cannot be mounted on a k3s app.
-func ToProcessVolumes(pairs []AppMountPair) ([]ProcessVolume, error) {
+// ValidateMountPairs rejects any pair whose entry belongs to another
+// scheduler. Kept separate from ToProcessVolumes so the chart builder can run
+// it once over the whole set: folding it into the per-process conversion would
+// make it reachable only for apps that have at least one scaled process or
+// cron task, and an app scaled to zero would stop reporting the mismatch.
+func ValidateMountPairs(pairs []AppMountPair) error {
+	for _, pair := range pairs {
+		if pair.Entry == nil || pair.Attachment == nil {
+			continue
+		}
+		if pair.Entry.Scheduler != storage.SchedulerK3s {
+			return fmt.Errorf("storage entry %q is scheduler=%s but is mounted on a k3s app; recreate it with --scheduler k3s", pair.Entry.Name, pair.Entry.Scheduler)
+		}
+	}
+	return nil
+}
+
+// ToProcessVolumes converts the AppMountPairs that apply to processType into
+// ProcessVolumes, one per container mount. K3s app deployments reference the
+// PVC by name; the PVC itself is owned by the storage entry's separate helm
+// release.
+//
+// An empty processType names a workload that belongs to no process type - a
+// cron job - and so receives default-scoped attachments only.
+func ToProcessVolumes(pairs []AppMountPair, processType string) []ProcessVolume {
 	volumes := []ProcessVolume{}
 	for _, pair := range pairs {
 		if pair.Entry == nil || pair.Attachment == nil {
 			continue
 		}
-		if pair.Entry.Scheduler == storage.SchedulerDockerLocal {
-			return nil, fmt.Errorf("storage entry %q is scheduler=docker-local but is mounted on a k3s app; recreate it with --scheduler k3s", pair.Entry.Name)
+		if !pair.Attachment.AppliesToProcessType(processType) {
+			continue
 		}
 		volumes = append(volumes, ProcessVolume{
 			Name:      pair.Entry.Name,
@@ -298,11 +318,57 @@ func ToProcessVolumes(pairs []AppMountPair) ([]ProcessVolume, error) {
 			},
 		})
 	}
+	return volumes
+}
+
+// processVolumesFor returns the volumes one process type's pods receive: what
+// every workload in the app gets, plus the storage attachments scoped to that
+// process type. The slice is freshly allocated rather than appended onto base,
+// so one workload's volumes can never alias another's.
+//
+// Entries repeat a Name once per container path, which is what the chart wants:
+// it renders a volumeMounts entry per element and a pod volume per distinct
+// Name. Two different sources claiming one Name cannot be rendered that way, so
+// they are rejected rather than silently collapsed to whichever came first.
+func processVolumesFor(base []ProcessVolume, pairs []AppMountPair, processType string) ([]ProcessVolume, error) {
+	scoped := ToProcessVolumes(pairs, processType)
+
+	volumes := make([]ProcessVolume, 0, len(base)+len(scoped))
+	volumes = append(volumes, base...)
+	volumes = append(volumes, scoped...)
+
+	sources := map[string]ProcessVolume{}
+	for _, volume := range volumes {
+		existing, seen := sources[volume.Name]
+		if seen && !sameVolumeSource(existing, volume) {
+			return nil, fmt.Errorf("volume name %q is claimed by two different sources in one pod", volume.Name)
+		}
+		sources[volume.Name] = volume
+	}
+
 	return volumes, nil
 }
 
-// asK8sVolumeMount is a small helper used by tests / other callers that
-// want a corev1.VolumeMount from a ProcessVolume.
+// sameVolumeSource reports whether two same-named volumes resolve to the same
+// backing source and can therefore share one pod volume.
+func sameVolumeSource(first ProcessVolume, second ProcessVolume) bool {
+	if (first.PersistentClaim == nil) != (second.PersistentClaim == nil) {
+		return false
+	}
+	if first.PersistentClaim != nil && *first.PersistentClaim != *second.PersistentClaim {
+		return false
+	}
+	if (first.EmptyDir == nil) != (second.EmptyDir == nil) {
+		return false
+	}
+	if first.EmptyDir != nil && *first.EmptyDir != *second.EmptyDir {
+		return false
+	}
+	return true
+}
+
+// asK8sVolumeMount converts a ProcessVolume into the corev1 mount shape for
+// callers that work against the Kubernetes API types directly.
 func asK8sVolumeMount(v ProcessVolume) corev1.VolumeMount {
 	return corev1.VolumeMount{
 		Name:      v.Name,
diff --git a/plugins/scheduler-k3s/storage_test.go b/plugins/scheduler-k3s/storage_test.go
new file mode 100644
index 000000000..566163754
--- /dev/null
+++ b/plugins/scheduler-k3s/storage_test.go
@@ -0,0 +1,260 @@
+package scheduler_k3s
+
+import (
+	"testing"
+
+	"github.com/dokku/dokku/plugins/storage"
+)
+
+func TestValidateMountPairsRejectsDockerLocalEntry(t *testing.T) {
+	pairs := []AppMountPair{
+		{
+			Entry: &storage.Entry{
+				Name:      "demo-data",
+				Scheduler: storage.SchedulerDockerLocal,
+			},
+			Attachment: &storage.Attachment{
+				ContainerPath: "/data",
+			},
+		},
+	}
+
+	err := ValidateMountPairs(pairs)
+	if err == nil {
+		t.Fatal("expected error for docker-local entry, got nil")
+	}
+	expected := `storage entry "demo-data" is scheduler=docker-local but is mounted on a k3s app; recreate it with --scheduler k3s`
+	if err.Error() != expected {
+		t.Fatalf("expected error %q, got %q", expected, err.Error())
+	}
+}
+
+func TestValidateMountPairsRejectsNonK3sEntry(t *testing.T) {
+	pairs := []AppMountPair{
+		{
+			Entry: &storage.Entry{
+				Name:      "demo-custom",
+				Scheduler: "nomad",
+			},
+			Attachment: &storage.Attachment{
+				ContainerPath: "/data",
+			},
+		},
+	}
+
+	err := ValidateMountPairs(pairs)
+	if err == nil {
+		t.Fatal("expected error for non-k3s entry, got nil")
+	}
+	expected := `storage entry "demo-custom" is scheduler=nomad but is mounted on a k3s app; recreate it with --scheduler k3s`
+	if err.Error() != expected {
+		t.Fatalf("expected error %q, got %q", expected, err.Error())
+	}
+}
+
+// TestValidateMountPairsRejectsOutOfScopeEntry pins the reason validation is a
+// separate pass: a mismatched entry scoped to a process type the caller is not
+// currently building still has to fail the deploy.
+func TestValidateMountPairsRejectsOutOfScopeEntry(t *testing.T) {
+	pairs := []AppMountPair{
+		{
+			Entry: &storage.Entry{
+				Name:      "demo-data",
+				Scheduler: storage.SchedulerDockerLocal,
+			},
+			Attachment: &storage.Attachment{
+				ContainerPath: "/data",
+				ProcessType:   "worker",
+			},
+		},
+	}
+
+	if err := ValidateMountPairs(pairs); err == nil {
+		t.Fatal("expected error for docker-local entry scoped to another process, got nil")
+	}
+}
+
+func TestToProcessVolumesAcceptsK3sEntry(t *testing.T) {
+	pairs := []AppMountPair{
+		{
+			Entry: &storage.Entry{
+				Name:      "demo-pvc",
+				Scheduler: storage.SchedulerK3s,
+			},
+			Attachment: &storage.Attachment{
+				ContainerPath: "/app/data",
+				Subpath:       "sub",
+				Readonly:      true,
+			},
+		},
+	}
+
+	volumes := ToProcessVolumes(pairs, "web")
+	if len(volumes) != 1 {
+		t.Fatalf("expected 1 volume, got %d", len(volumes))
+	}
+	v := volumes[0]
+	if v.Name != "demo-pvc" {
+		t.Errorf("expected volume name demo-pvc, got %s", v.Name)
+	}
+	if v.MountPath != "/app/data" {
+		t.Errorf("expected mount path /app/data, got %s", v.MountPath)
+	}
+	if v.SubPath != "sub" {
+		t.Errorf("expected subpath sub, got %s", v.SubPath)
+	}
+	if !v.ReadOnly {
+		t.Errorf("expected read only true, got %v", v.ReadOnly)
+	}
+	if v.PersistentClaim == nil || v.PersistentClaim.ClaimName != "demo-pvc" {
+		t.Errorf("expected persistent claim name demo-pvc, got %+v", v.PersistentClaim)
+	}
+}
+
+// TestToProcessVolumesCollapsesOneEntryMountedTwice covers the pod-volume
+// uniqueness rule: mounting one storage entry at two container paths has to
+// produce two volumeMounts and a single volume, or the API server rejects the
+// chart with a duplicate volume name.
+func TestToProcessVolumesCollapsesOneEntryMountedTwice(t *testing.T) {
+	pairs := []AppMountPair{
+		{
+			Entry:      &storage.Entry{Name: "demo-pvc", Scheduler: storage.SchedulerK3s},
+			Attachment: &storage.Attachment{ContainerPath: "/one", Subpath: "one"},
+		},
+		{
+			Entry:      &storage.Entry{Name: "demo-pvc", Scheduler: storage.SchedulerK3s},
+			Attachment: &storage.Attachment{ContainerPath: "/two", Subpath: "two", Readonly: true},
+		},
+	}
+
+	volumes := ToProcessVolumes(pairs, "web")
+	if len(volumes) != 2 {
+		t.Fatalf("expected 2 entries, got %d", len(volumes))
+	}
+	if volumes[0].Name != volumes[1].Name {
+		t.Fatalf("expected both entries to name one volume, got %q and %q", volumes[0].Name, volumes[1].Name)
+	}
+	if volumes[0].MountPath != "/one" || volumes[1].MountPath != "/two" {
+		t.Fatalf("expected mounts at /one and /two, got %q and %q", volumes[0].MountPath, volumes[1].MountPath)
+	}
+	if !volumes[1].ReadOnly || volumes[0].ReadOnly {
+		t.Errorf("expected only the second mount to be read only")
+	}
+}
+
+// TestProcessVolumesForRejectsSameNameDifferentSource guards the name collapse
+// the chart performs: the pod volume is emitted from the first entry with a
+// given name, so two different sources sharing one name would silently mount
+// whichever came first. An app with a storage entry called "shmem" alongside a
+// configured shm size is the way to reach it.
+func TestProcessVolumesForRejectsSameNameDifferentSource(t *testing.T) {
+	base := []ProcessVolume{
+		{
+			Name:      "shmem",
+			MountPath: "/dev/shm",
+			EmptyDir:  &ProcessVolumeEmptyDir{Medium: "Memory", SizeLimit: "64Mi"},
+		},
+	}
+
+	pairs := []AppMountPair{
+		{
+			Entry:      &storage.Entry{Name: "shmem", Scheduler: storage.SchedulerK3s},
+			Attachment: &storage.Attachment{ContainerPath: "/data"},
+		},
+	}
+
+	if _, err := processVolumesFor(base, pairs, "web"); err == nil {
+		t.Fatal("expected an error for two sources claiming one volume name, got nil")
+	}
+}
+
+func TestToProcessVolumesSkipsNilPairs(t *testing.T) {
+	pairs := []AppMountPair{
+		{Entry: nil, Attachment: nil},
+		{Entry: &storage.Entry{Name: "demo", Scheduler: storage.SchedulerK3s}, Attachment: nil},
+		{Entry: nil, Attachment: &storage.Attachment{ContainerPath: "/data"}},
+	}
+
+	if volumes := ToProcessVolumes(pairs, "web"); len(volumes) != 0 {
+		t.Fatalf("expected 0 volumes, got %d", len(volumes))
+	}
+}
+
+// TestToProcessVolumesScopesToProcessType is the k3s half of #9059: a mount
+// scoped to a named process type reaches that process and no other, while a
+// default-scoped mount reaches all of them.
+func TestToProcessVolumesScopesToProcessType(t *testing.T) {
+	pairs := []AppMountPair{
+		{
+			Entry:      &storage.Entry{Name: "shared", Scheduler: storage.SchedulerK3s},
+			Attachment: &storage.Attachment{ContainerPath: "/shared", ProcessType: storage.DefaultProcessType},
+		},
+		{
+			Entry:      &storage.Entry{Name: "web-only", Scheduler: storage.SchedulerK3s},
+			Attachment: &storage.Attachment{ContainerPath: "/web", ProcessType: "web"},
+		},
+		{
+			Entry:      &storage.Entry{Name: "legacy", Scheduler: storage.SchedulerK3s},
+			Attachment: &storage.Attachment{ContainerPath: "/legacy"},
+		},
+	}
+
+	for _, tc := range []struct {
+		processType string
+		expected    []string
+	}{
+		{processType: "web", expected: []string{"shared", "web-only", "legacy"}},
+		{processType: "worker", expected: []string{"shared", "legacy"}},
+		{processType: "", expected: []string{"shared", "legacy"}},
+	} {
+		names := []string{}
+		for _, volume := range ToProcessVolumes(pairs, tc.processType) {
+			names = append(names, volume.Name)
+		}
+		if len(names) != len(tc.expected) {
+			t.Fatalf("process type %q: expected %v, got %v", tc.processType, tc.expected, names)
+		}
+		for i, name := range tc.expected {
+			if names[i] != name {
+				t.Fatalf("process type %q: expected %v, got %v", tc.processType, tc.expected, names)
+			}
+		}
+	}
+}
+
+// TestProcessVolumesForDoesNotAliasBase pins that each process type gets its
+// own slice: appending onto a shared backing array would leak one process's
+// storage mounts into another's pod spec.
+func TestProcessVolumesForDoesNotAliasBase(t *testing.T) {
+	base := make([]ProcessVolume, 0, 8)
+	base = append(base, ProcessVolume{Name: "shmem", MountPath: "/dev/shm", EmptyDir: &ProcessVolumeEmptyDir{Medium: "Memory"}})
+
+	pairs := []AppMountPair{
+		{
+			Entry:      &storage.Entry{Name: "web-only", Scheduler: storage.SchedulerK3s},
+			Attachment: &storage.Attachment{ContainerPath: "/web", ProcessType: "web"},
+		},
+	}
+
+	web, err := processVolumesFor(base, pairs, "web")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	worker, err := processVolumesFor(base, pairs, "worker")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if len(web) != 2 {
+		t.Fatalf("expected web to get 2 volumes, got %d", len(web))
+	}
+	if len(worker) != 1 {
+		t.Fatalf("expected worker to get 1 volume, got %d", len(worker))
+	}
+	if worker[0].Name != "shmem" {
+		t.Fatalf("expected worker to keep only the base volume, got %s", worker[0].Name)
+	}
+	if len(base) != 1 {
+		t.Fatalf("expected base to be left untouched, got %d volumes", len(base))
+	}
+}
diff --git a/plugins/scheduler-k3s/subcommands.go b/plugins/scheduler-k3s/subcommands.go
index 65f40ca0b..d654cdd4e 100644
--- a/plugins/scheduler-k3s/subcommands.go
+++ b/plugins/scheduler-k3s/subcommands.go
@@ -9,8 +9,6 @@ import (
 	"net/url"
 	"os"
 	"os/signal"
-	"regexp"
-	"slices"
 	"sort"
 	"strings"
 	"syscall"
@@ -18,54 +16,73 @@ import (
 	"github.com/dokku/dokku/plugins/common"
 	resty "github.com/go-resty/resty/v2"
 	"github.com/ryanuber/columnize"
+	"helm.sh/helm/v3/pkg/chartutil"
 )
 
-// CommandAnnotationsSet set or clear a scheduler-k3s annotation for an app
-func CommandAnnotationsSet(appName string, processType string, resourceType string, key string, value string) error {
-	if resourceType == "" {
-		return fmt.Errorf("Missing resource-type")
-	}
-
-	if processType == "" {
-		processType = GlobalProcessType
-	}
-
-	property := fmt.Sprintf("%s.%s", processType, resourceType)
-	if value == "" {
-		if err := common.PropertyMapDelete("scheduler-k3s", appName, property, key); err != nil {
-			return fmt.Errorf("Unable to delete property map entry: %w", err)
-		}
-		return nil
-	}
-
-	if err := common.PropertyMapSet("scheduler-k3s", appName, property, key, value); err != nil {
-		return fmt.Errorf("Unable to set property map entry: %w", err)
-	}
-
-	return nil
+// CommandAnnotationsSet sets, clears or replaces scheduler-k3s annotations for an app
+func CommandAnnotationsSet(input MetadataSetInput) error {
+	return commandMetadataSet(annotationsField, input)
 }
 
-// CommandNodeSysctlsSet sets or clears a node-level kernel sysctl for a scope
-func CommandNodeSysctlsSet(profileName string, key string, value string) error {
-	if key == "" {
+// CommandAnnotationsClear clears scheduler-k3s annotations for an app
+func CommandAnnotationsClear(input MetadataClearInput) error {
+	return commandMetadataClear(annotationsField, input)
+}
+
+// NodeSysctlsSetInput captures the inputs accepted by node-sysctls:set.
+// Key/Value and Pairs are mutually exclusive: Pairs is populated only under
+// --replace, where the positional arguments are key=value pairs rather than a
+// single sysctl name and value.
+type NodeSysctlsSetInput struct {
+	ProfileName string
+	Key         string
+	Value       string
+	Pairs       []string
+	Replace     bool
+}
+
+// CommandNodeSysctlsSet sets, clears or replaces node-level kernel sysctls for a scope
+func CommandNodeSysctlsSet(input NodeSysctlsSetInput) error {
+	if err := verifyNodeSysctlsScope(input.ProfileName); err != nil {
+		return err
+	}
+
+	property := getNodeSysctlsProperty(input.ProfileName)
+	if input.Replace {
+		if len(input.Pairs) == 0 {
+			return fmt.Errorf("Must specify at least one key=value pair, use scheduler-k3s:node-sysctls:clear to remove all sysctls")
+		}
+
+		parsed, err := parseMetadataPairs(input.Pairs)
+		if err != nil {
+			return err
+		}
+
+		removed, err := removedSysctlNames(property, parsed)
+		if err != nil {
+			return err
+		}
+
+		if err := common.PropertyMapWrite("scheduler-k3s", "--global", property, parsed); err != nil {
+			return fmt.Errorf("Unable to write property map: %w", err)
+		}
+
+		warnUnmanagedSysctls(removed)
+		return CreateOrUpdateNodeSysctls(context.Background())
+	}
+
+	if input.Key == "" {
 		return fmt.Errorf("Missing sysctl name")
 	}
 
-	if profileName != "" {
-		if err := verifyNodeProfileExists(profileName); err != nil {
-			return err
-		}
-	}
-
-	property := getNodeSysctlsProperty(profileName)
-	if value == "" {
-		if err := common.PropertyMapDelete("scheduler-k3s", "--global", property, key); err != nil {
+	if input.Value == "" {
+		if err := common.PropertyMapDelete("scheduler-k3s", "--global", property, input.Key); err != nil {
 			return fmt.Errorf("Unable to delete property map entry: %w", err)
 		}
 
-		common.LogWarn(fmt.Sprintf("Removing %s stops dokku managing it, but does not restore the previous value on affected nodes until they reboot", key))
+		warnUnmanagedSysctls([]string{input.Key})
 	} else {
-		if err := common.PropertyMapSet("scheduler-k3s", "--global", property, key, value); err != nil {
+		if err := common.PropertyMapSet("scheduler-k3s", "--global", property, input.Key, input.Value); err != nil {
 			return fmt.Errorf("Unable to set property map entry: %w", err)
 		}
 	}
@@ -73,10 +90,91 @@ func CommandNodeSysctlsSet(profileName string, key string, value string) error {
 	return CreateOrUpdateNodeSysctls(context.Background())
 }
 
-// CommandNodeSysctlsReport displays the configured node-level kernel sysctls
-func CommandNodeSysctlsReport(format string) error {
-	if format != "stdout" && format != "json" {
-		return fmt.Errorf("Invalid format: %s", format)
+// CommandNodeSysctlsClear clears every node-level kernel sysctl for a scope
+func CommandNodeSysctlsClear(profileName string) error {
+	if err := verifyNodeSysctlsScope(profileName); err != nil {
+		return err
+	}
+
+	property := getNodeSysctlsProperty(profileName)
+	removed, err := removedSysctlNames(property, map[string]string{})
+	if err != nil {
+		return err
+	}
+
+	if err := common.PropertyDelete("scheduler-k3s", "--global", property); err != nil {
+		return fmt.Errorf("Unable to delete property: %w", err)
+	}
+
+	warnUnmanagedSysctls(removed)
+	return CreateOrUpdateNodeSysctls(context.Background())
+}
+
+// verifyNodeSysctlsScope returns an error when a profile-scoped command names a profile
+// that does not exist or cannot back a helm release.
+func verifyNodeSysctlsScope(profileName string) error {
+	if profileName == "" {
+		return nil
+	}
+
+	if err := verifyNodeProfileExists(profileName); err != nil {
+		return err
+	}
+
+	return verifyNodeProfileSysctlsSupported(profileName)
+}
+
+// removedSysctlNames returns the sysctls a scope currently manages that the next
+// stored map no longer will, so they can be warned about before the write happens.
+func removedSysctlNames(property string, next map[string]string) ([]string, error) {
+	current, err := common.PropertyMapGet("scheduler-k3s", "--global", property)
+	if err != nil {
+		return nil, fmt.Errorf("Unable to get property map: %w", err)
+	}
+
+	removed := []string{}
+	for key := range current {
+		if _, ok := next[key]; !ok {
+			removed = append(removed, key)
+		}
+	}
+
+	sort.Strings(removed)
+	return removed, nil
+}
+
+// warnUnmanagedSysctls notes that dokku has stopped managing a sysctl. The last
+// value written stays on affected nodes until they reboot, which is how sysctl -w
+// behaves everywhere else.
+func warnUnmanagedSysctls(names []string) {
+	for _, name := range names {
+		common.LogWarn(fmt.Sprintf("Removing %s stops dokku managing it, but does not restore the previous value on affected nodes until they reboot", name))
+	}
+}
+
+// NodeSysctlsReportInput captures the inputs accepted by node-sysctls:report.
+// Global and ProfileName are mutually exclusive, and naming neither reports every
+// scope rather than the global one.
+type NodeSysctlsReportInput struct {
+	Format      string
+	Global      bool
+	ProfileName string
+	Stored      bool
+}
+
+// CommandNodeSysctlsReport displays the configured node-level kernel sysctls. A named
+// profile only has to exist to be reported on, unlike one being written to: a profile
+// whose legacy name cannot back a helm release still resolves to a scope, and the map
+// it stores is worth reading back even though nothing applies it.
+func CommandNodeSysctlsReport(input NodeSysctlsReportInput) error {
+	if input.Format != "stdout" && input.Format != "json" {
+		return fmt.Errorf("Invalid format: %s", input.Format)
+	}
+
+	if input.ProfileName != "" {
+		if err := verifyNodeProfileExists(input.ProfileName); err != nil {
+			return err
+		}
 	}
 
 	scopes, err := resolveNodeSysctlScopes()
@@ -84,19 +182,16 @@ func CommandNodeSysctlsReport(format string) error {
 		return err
 	}
 
-	if format == "json" {
+	scopes = filterNodeSysctlScopes(scopes, input.Global, input.ProfileName)
+
+	if input.Format == "json" {
 		output := map[string]map[string]string{}
 		for _, scope := range scopes {
-			key := scope.ProfileName
-			if key == "" {
-				key = "--global"
-			}
-
 			entries := map[string]string{}
-			for _, sysctl := range scope.Sysctls {
+			for _, sysctl := range scope.reportSysctls(input.Stored) {
 				entries[sysctl.Name] = sysctl.Value
 			}
-			output[key] = entries
+			output[nodeSysctlsScopeKey(scope.ProfileName)] = entries
 		}
 
 		b, err := json.Marshal(output)
@@ -110,12 +205,8 @@ func CommandNodeSysctlsReport(format string) error {
 
 	lines := []string{"scope|sysctl|value"}
 	for _, scope := range scopes {
-		scopeName := scope.ProfileName
-		if scopeName == "" {
-			scopeName = "--global"
-		}
-
-		for _, sysctl := range scope.Sysctls {
+		scopeName := nodeSysctlsScopeKey(scope.ProfileName)
+		for _, sysctl := range scope.reportSysctls(input.Stored) {
 			lines = append(lines, fmt.Sprintf("%s|%s|%s", scopeName, sysctl.Name, sysctl.Value))
 		}
 	}
@@ -134,8 +225,19 @@ func verifyNodeProfileExists(profileName string) error {
 	return nil
 }
 
-// CommandAutoscalingAuthSet set or clear a scheduler-k3s autoscaling keda trigger authentication object for an app
-func CommandAutoscalingAuthSet(appName string, trigger string, metadata map[string]string, global bool) error {
+// verifyNodeProfileSysctlsSupported returns an error when a node profile is stored under a
+// name dokku cannot derive a node sysctls release name from. Such a profile predates the
+// validation in profiles:add and must be recreated before it can carry node sysctls.
+func verifyNodeProfileSysctlsSupported(profileName string) error {
+	if err := chartutil.ValidateReleaseName(getNodeSysctlsReleaseName(profileName)); err != nil {
+		return fmt.Errorf("Node profile %s cannot carry node sysctls, recreate it with a name of at most %d lowercase alphanumeric characters and dashes: %w", profileName, maxNodeProfileNameLength, err)
+	}
+
+	return nil
+}
+
+// CommandAutoscalingAuthSet sets, clears or replaces a scheduler-k3s autoscaling keda trigger authentication object for an app
+func CommandAutoscalingAuthSet(appName string, trigger string, metadata map[string]string, global bool, replace bool) error {
 	if global {
 		appName = "--global"
 	}
@@ -150,18 +252,29 @@ func CommandAutoscalingAuthSet(appName string, trigger string, metadata map[stri
 		return fmt.Errorf("Missing trigger type argument")
 	}
 
-	if len(metadata) == 0 {
-		properties, err := common.PropertyGetAllByPrefix("scheduler-k3s", appName, fmt.Sprintf("%s%s.", TriggerAuthPropertyPrefix, trigger))
-		if err != nil {
-			return fmt.Errorf("Unable to get property list: %w", err)
-		}
+	if replace && len(metadata) == 0 {
+		return fmt.Errorf("Must specify at least one --metadata flag, omit --replace to remove all metadata for the trigger")
+	}
 
-		for key := range properties {
-			if err := common.PropertyDelete("scheduler-k3s", appName, key); err != nil {
-				return fmt.Errorf("Unable to delete property: %w", err)
+	err := common.PropertyLock("scheduler-k3s", appName, func(p *common.LockedProperties) error {
+		if len(metadata) == 0 || replace {
+			if err := deleteTriggerAuthProperties(p, appName, trigger); err != nil {
+				return err
 			}
 		}
 
+		for key, value := range metadata {
+			if err := p.Write(fmt.Sprintf("%s%s.%s", TriggerAuthPropertyPrefix, trigger, key), value); err != nil {
+				return fmt.Errorf("Unable to set property: %w", err)
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return err
+	}
+
+	if len(metadata) == 0 {
 		if appName == "--global" {
 			helmAgent, err := NewHelmAgent("keda", DeployLogPrinter)
 			if err != nil {
@@ -177,14 +290,8 @@ func CommandAutoscalingAuthSet(appName string, trigger string, metadata map[stri
 		return nil
 	}
 
-	for key, value := range metadata {
-		if err := common.PropertyWrite("scheduler-k3s", appName, fmt.Sprintf("%s%s.%s", TriggerAuthPropertyPrefix, trigger, key), value); err != nil {
-			return fmt.Errorf("Unable to set property: %w", err)
-		}
-
-		common.LogInfo1("Trigger authentication settings saved")
-		common.LogVerbose("Resources will be created or updated on next deploy")
-	}
+	common.LogInfo1("Trigger authentication settings saved")
+	common.LogVerbose("Resources will be created or updated on next deploy")
 
 	if appName == "--global" {
 		err := applyKedaClusterTriggerAuthentications(context.Background(), trigger, metadata)
@@ -196,6 +303,23 @@ func CommandAutoscalingAuthSet(appName string, trigger string, metadata map[stri
 	return nil
 }
 
+// deleteTriggerAuthProperties removes every stored metadata key for one
+// trigger. The caller must hold the app's scheduler-k3s property lock.
+func deleteTriggerAuthProperties(p *common.LockedProperties, appName string, trigger string) error {
+	properties, err := common.PropertyGetAllByPrefix("scheduler-k3s", appName, fmt.Sprintf("%s%s.", TriggerAuthPropertyPrefix, trigger))
+	if err != nil {
+		return fmt.Errorf("Unable to get property list: %w", err)
+	}
+
+	for key := range properties {
+		if err := p.Delete(key); err != nil {
+			return fmt.Errorf("Unable to delete property: %w", err)
+		}
+	}
+
+	return nil
+}
+
 // CommandAutoscalingAuthReport displays a scheduler-k3s autoscaling keda trigger authentication report for one or more apps
 func CommandAutoscalingAuthReport(appName string, format string, includeMetadata bool, infoFlag string) error {
 	if len(appName) == 0 {
@@ -466,15 +590,11 @@ func CommandInitialize(ingressClass string, serverIP string, taintScheduling boo
 
 	common.LogInfo2Quiet("Installing helm charts")
 	err = installHelmCharts(ctx, clientset, func(chart HelmChart) bool {
-		if chart.ChartPath == "traefik" && ingressClass == "nginx" {
-			return false
-		}
-
-		if chart.ChartPath == "ingress-nginx" && ingressClass == "traefik" {
-			return false
-		}
-
-		return true
+		return chartInstallDecision(ChartInstallDecisionInput{
+			Chart:        chart,
+			ForceInstall: true,
+			IngressClass: ingressClass,
+		}).Install
 	})
 	if err != nil {
 		return fmt.Errorf("Unable to install helm charts: %w", err)
@@ -496,8 +616,44 @@ func CommandInitialize(ingressClass string, serverIP string, taintScheduling boo
 	return nil
 }
 
-// CommandChartsSet sets or clears a chart-specific helm value for the scheduler
-func CommandChartsSet(propertyArg string, value string) error {
+// ChartsSetInput captures the inputs accepted by charts:set.
+// Property/Value and ChartName/Pairs are mutually exclusive: ChartName and
+// Pairs are populated only under --replace, where the positional arguments are
+// a chart name followed by property=value pairs rather than a single
+// <chart-name>.<property> argument and value.
+type ChartsSetInput struct {
+	ChartName string
+	Property  string
+	Value     string
+	Pairs     []string
+	Replace   bool
+}
+
+// CommandChartsClear clears every chart-specific helm value for a chart
+func CommandChartsClear(chartName string) error {
+	if chartName == "" {
+		return fmt.Errorf("Missing chart name")
+	}
+
+	chart, err := getHelmChart(chartName)
+	if err != nil {
+		return err
+	}
+
+	common.LogInfo2Quiet(fmt.Sprintf("Clearing chart overrides for %s", chart.ReleaseName))
+	if err := common.PropertyDelete("scheduler-k3s", "--global", "chart-overrides."+chart.ReleaseName); err != nil {
+		return fmt.Errorf("Unable to delete property: %w", err)
+	}
+	return nil
+}
+
+// CommandChartsSet sets, clears or replaces chart-specific helm values for the scheduler
+func CommandChartsSet(input ChartsSetInput) error {
+	if input.Replace {
+		return replaceChartOverrides(input.ChartName, input.Pairs)
+	}
+
+	propertyArg := input.Property
 	if propertyArg == "" {
 		return fmt.Errorf("Invalid property, expected format: <chart-name>.<property>")
 	}
@@ -509,25 +665,15 @@ func CommandChartsSet(propertyArg string, value string) error {
 
 	chartName := propertyArg[:dotIndex]
 	chartProperty := propertyArg[dotIndex+1:]
-
-	knownCharts := []string{}
-	chartFound := false
-	for _, chart := range HelmCharts {
-		knownCharts = append(knownCharts, chart.ReleaseName)
-		if chart.ReleaseName == chartName {
-			chartFound = true
-		}
-	}
-	if !chartFound {
-		sort.Strings(knownCharts)
-		return fmt.Errorf("Invalid chart name %q, valid charts: %s", chartName, strings.Join(knownCharts, ", "))
+	if _, err := getHelmChart(chartName); err != nil {
+		return err
 	}
 
 	key := fmt.Sprintf("chart.%s.%s", chartName, chartProperty)
 	mapProperty := "chart-overrides." + chartName
-	if value != "" {
-		common.LogInfo2Quiet(fmt.Sprintf("Setting %s to %s", key, value))
-		if err := common.PropertyMapSet("scheduler-k3s", "--global", mapProperty, chartProperty, value); err != nil {
+	if input.Value != "" {
+		common.LogInfo2Quiet(fmt.Sprintf("Setting %s to %s", key, input.Value))
+		if err := common.PropertyMapSet("scheduler-k3s", "--global", mapProperty, chartProperty, input.Value); err != nil {
 			return fmt.Errorf("Unable to write property: %w", err)
 		}
 		return nil
@@ -540,6 +686,33 @@ func CommandChartsSet(propertyArg string, value string) error {
 	return nil
 }
 
+// replaceChartOverrides replaces every chart-specific helm value for a chart in a single write
+func replaceChartOverrides(chartName string, pairs []string) error {
+	if chartName == "" {
+		return fmt.Errorf("Missing chart name")
+	}
+
+	chart, err := getHelmChart(chartName)
+	if err != nil {
+		return err
+	}
+
+	if len(pairs) == 0 {
+		return fmt.Errorf("Must specify at least one key=value pair, use scheduler-k3s:charts:clear to remove all chart overrides")
+	}
+
+	parsed, err := parseMetadataPairs(pairs)
+	if err != nil {
+		return err
+	}
+
+	common.LogInfo2Quiet(fmt.Sprintf("Replacing chart overrides for %s", chart.ReleaseName))
+	if err := common.PropertyMapWrite("scheduler-k3s", "--global", "chart-overrides."+chart.ReleaseName, parsed); err != nil {
+		return fmt.Errorf("Unable to write property map: %w", err)
+	}
+	return nil
+}
+
 // CommandChartsReport displays a scheduler-k3s chart override report
 func CommandChartsReport(chartName string, format string, infoFlag string) error {
 	if format != "stdout" && format != "json" {
@@ -552,22 +725,11 @@ func CommandChartsReport(chartName string, format string, infoFlag string) error
 
 	charts := []HelmChart{}
 	if chartName != "" {
-		found := false
-		for _, chart := range HelmCharts {
-			if chart.ReleaseName == chartName {
-				charts = append(charts, chart)
-				found = true
-				break
-			}
-		}
-		if !found {
-			knownCharts := []string{}
-			for _, chart := range HelmCharts {
-				knownCharts = append(knownCharts, chart.ReleaseName)
-			}
-			sort.Strings(knownCharts)
-			return fmt.Errorf("Invalid chart name %q, valid charts: %s", chartName, strings.Join(knownCharts, ", "))
+		chart, err := getHelmChart(chartName)
+		if err != nil {
+			return err
 		}
+		charts = append(charts, chart)
 	} else {
 		charts = append(charts, HelmCharts...)
 	}
@@ -1163,25 +1325,6 @@ func CommandEnsureCharts(forceInstall bool, forceChartNames []string) error {
 	common.LogInfo2Quiet("Installing helm charts")
 	err = installHelmCharts(ctx, clientset, func(chart HelmChart) bool {
 		common.LogInfo1(fmt.Sprintf("Processing chart %s@%s", chart.ReleaseName, chart.Version))
-		if chart.ChartPath == "traefik" && ingressClass == "nginx" {
-			common.LogVerbose("Skipping chart due to ingress-class mismatch")
-			return false
-		}
-
-		if chart.ChartPath == "ingress-nginx" && ingressClass == "traefik" {
-			common.LogVerbose("Skipping chart due to ingress-class mismatch")
-			return false
-		}
-
-		if forceInstall {
-			common.LogVerbose("Force installing chart")
-			return true
-		}
-
-		if len(forceChartNames) > 0 && slices.Contains(forceChartNames, chart.ReleaseName) {
-			common.LogVerbose("Force installing chart due to flag")
-			return true
-		}
 
 		helmAgent := namespacedHelmAgents[chart.Namespace]
 		latestRevision, err := helmAgent.InstalledRevision(chart.ReleaseName)
@@ -1190,18 +1333,16 @@ func CommandEnsureCharts(forceInstall bool, forceChartNames []string) error {
 			return false
 		}
 
-		if latestRevision.Name == "" {
-			common.LogVerbose("Installing missing chart")
-			return true
-		}
+		decision := chartInstallDecision(ChartInstallDecisionInput{
+			Chart:             chart,
+			ForceChartNames:   forceChartNames,
+			ForceInstall:      forceInstall,
+			IngressClass:      ingressClass,
+			InstalledRevision: latestRevision,
+		})
+		common.LogVerbose(decision.Reason)
 
-		if latestRevision.Version != chart.Version {
-			common.LogVerbose(fmt.Sprintf("Installing chart due to version mismatch: %s != %s", latestRevision.AppVersion, chart.Version))
-			return false
-		}
-
-		common.LogVerbose("Skipping chart: already installed")
-		return false
+		return decision.Install
 	})
 	if err != nil {
 		return fmt.Errorf("Unable to install helm charts: %w", err)
@@ -1222,29 +1363,14 @@ func CommandEnsureCharts(forceInstall bool, forceChartNames []string) error {
 	return nil
 }
 
-// CommandLabelsSet set or clear a scheduler-k3s label for an app
-func CommandLabelsSet(appName string, processType string, resourceType string, key string, value string) error {
-	if resourceType == "" {
-		return fmt.Errorf("Missing resource-type")
-	}
+// CommandLabelsSet sets, clears or replaces scheduler-k3s labels for an app
+func CommandLabelsSet(input MetadataSetInput) error {
+	return commandMetadataSet(labelsField, input)
+}
 
-	if processType == "" {
-		processType = GlobalProcessType
-	}
-
-	property := fmt.Sprintf("labels.%s.%s", processType, resourceType)
-	if value == "" {
-		if err := common.PropertyMapDelete("scheduler-k3s", appName, property, key); err != nil {
-			return fmt.Errorf("Unable to delete property map entry: %w", err)
-		}
-		return nil
-	}
-
-	if err := common.PropertyMapSet("scheduler-k3s", appName, property, key, value); err != nil {
-		return fmt.Errorf("Unable to set property map entry: %w", err)
-	}
-
-	return nil
+// CommandLabelsClear clears scheduler-k3s labels for an app
+func CommandLabelsClear(input MetadataClearInput) error {
+	return commandMetadataClear(labelsField, input)
 }
 
 // CommandProfilesAdd adds a node profile to the k3s cluster
@@ -1253,18 +1379,8 @@ func CommandProfilesAdd(profileName string, role string, allowUknownHosts bool,
 		return fmt.Errorf("Invalid role: %s", role)
 	}
 
-	if profileName == "" {
-		return fmt.Errorf("Missing profile name")
-	}
-
-	// profile names must only contain alphanumeric characters and dashes and cannot start with a dash
-	if !regexp.MustCompile(`^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$`).MatchString(profileName) {
-		return fmt.Errorf("Invalid profile name, must only contain alphanumeric characters and dashes and cannot start with a dash: %s", profileName)
-	}
-
-	// ensure profile names are no longer than 32 characters
-	if len(profileName) > 32 {
-		return fmt.Errorf("Profile name is too long, must be less than 32 characters: %s", profileName)
+	if err := validateNodeProfileName(profileName); err != nil {
+		return err
 	}
 
 	profile := NodeProfile{
@@ -1338,18 +1454,8 @@ func CommandProfilesList(format string) error {
 
 // CommandProfilesRemove removes a node profile from the k3s cluster
 func CommandProfilesRemove(profileName string) error {
-	if profileName == "" {
-		return fmt.Errorf("Missing profile name")
-	}
-
-	// profile names must only contain alphanumeric characters and dashes and cannot start with a dash
-	if !regexp.MustCompile(`^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$`).MatchString(profileName) {
-		return fmt.Errorf("Invalid profile name, must only contain alphanumeric characters and dashes and cannot start with a dash: %s", profileName)
-	}
-
-	// ensure profile names are no longer than 32 characters
-	if len(profileName) > 32 {
-		return fmt.Errorf("Profile name is too long, must be less than 32 characters: %s", profileName)
+	if err := validateStoredNodeProfileName(profileName); err != nil {
+		return err
 	}
 
 	if err := common.PropertyDelete("scheduler-k3s", "--global", fmt.Sprintf("node-profile-%s.json", profileName)); err != nil {
diff --git a/plugins/scheduler-k3s/template.go b/plugins/scheduler-k3s/template.go
index c506bfb40..b2d02bed8 100644
--- a/plugins/scheduler-k3s/template.go
+++ b/plugins/scheduler-k3s/template.go
@@ -70,6 +70,31 @@ type GlobalNetwork struct {
 
 	// PrimaryServicePort is the primary service port to use
 	PrimaryServicePort int32 `yaml:"primary_service_port"`
+
+	// Routes are the path-based routes declared via proxy:route:set
+	Routes []GlobalRoute `yaml:"routes,omitempty"`
+}
+
+// GlobalRoute is one path-based route declared via proxy:route:set. The
+// chart templates iterate this slice to emit additional Ingress paths /
+// IngressRoute Rules per route.
+type GlobalRoute struct {
+	// Process is the Procfile process type the route targets.
+	Process string `yaml:"process"`
+
+	// Path is the URL path prefix to match.
+	Path string `yaml:"path"`
+
+	// Port is the upstream container port the route forwards to.
+	Port int32 `yaml:"port"`
+
+	// StripPrefix controls whether the matched prefix is stripped before
+	// forwarding the request upstream.
+	StripPrefix bool `yaml:"strip_prefix"`
+
+	// Slug is a deterministic kebab-case identifier derived from Path. It is
+	// used as a stable name fragment for generated CRDs.
+	Slug string `yaml:"slug"`
 }
 
 // GlobalKedaValues contains the global keda configuration
@@ -115,9 +140,18 @@ type ProcessValues struct {
 	Replicas     int32               `yaml:"replicas"`
 	Resources    ProcessResourcesMap `yaml:"resources,omitempty"`
 	Web          ProcessWeb          `yaml:"web,omitempty"`
-	Volumes      []ProcessVolume     `yaml:"volumes,omitempty"`
+
+	// Volumes holds one entry per container mount. The chart renders a
+	// volumeMounts entry for each of them and a pod volume for each distinct
+	// Name, so mounting one storage entry at two container paths belongs here
+	// twice: Kubernetes allows repeated volumeMounts names but requires pod
+	// volume names to be unique.
+	Volumes []ProcessVolume `yaml:"volumes,omitempty"`
 }
 
+// ProcessVolume is one container mount together with the source backing it.
+// Entries sharing a Name must agree on their source - they describe one pod
+// volume bound at several paths.
 type ProcessVolume struct {
 	Name            string                        `yaml:"name"`
 	MountPath       string                        `yaml:"mount_path"`
diff --git a/plugins/scheduler-k3s/templates/chart/cron-job.yaml b/plugins/scheduler-k3s/templates/chart/cron-job.yaml
index 2076ca590..765a020f4 100644
--- a/plugins/scheduler-k3s/templates/chart/cron-job.yaml
+++ b/plugins/scheduler-k3s/templates/chart/cron-job.yaml
@@ -163,7 +163,10 @@ spec:
           serviceAccountName: {{ $.Values.global.app_name }}
           {{- if $config.volumes }}
           volumes:
+            {{- $seen := dict }}
             {{- range $volume := $config.volumes }}
+            {{- if not (hasKey $seen $volume.name) }}
+            {{- $_ := set $seen $volume.name true }}
             - name: {{ $volume.name }}
               {{- if $volume.empty_dir }}
               emptyDir:
@@ -179,8 +182,9 @@ spec:
                 claimName: {{ $volume.persistent_claim.claim_name }}
               {{- end }}
             {{- end }}
+            {{- end }}
           {{- end }}
-  schedule: {{ $config.cron.schedule }}
+  schedule: {{ $config.cron.schedule | quote }}
   startingDeadlineSeconds: 60
   successfulJobsHistoryLimit: 10
   suspend: {{ $config.cron.suspend }}
diff --git a/plugins/scheduler-k3s/templates/chart/deployment.yaml b/plugins/scheduler-k3s/templates/chart/deployment.yaml
index b8a25c3dc..45151e564 100644
--- a/plugins/scheduler-k3s/templates/chart/deployment.yaml
+++ b/plugins/scheduler-k3s/templates/chart/deployment.yaml
@@ -179,7 +179,10 @@ spec:
       serviceAccountName: {{ $.Values.global.app_name }}
       {{- if $config.volumes }}
       volumes:
+        {{- $seen := dict }}
         {{- range $volume := $config.volumes }}
+        {{- if not (hasKey $seen $volume.name) }}
+        {{- $_ := set $seen $volume.name true }}
         - name: {{ $volume.name }}
           {{- if $volume.empty_dir }}
           emptyDir:
@@ -195,5 +198,6 @@ spec:
             claimName: {{ $volume.persistent_claim.claim_name }}
           {{- end }}
         {{- end }}
+        {{- end }}
       {{- end }}
 {{- end }}
diff --git a/plugins/scheduler-k3s/templates/chart/ingress-route.yaml b/plugins/scheduler-k3s/templates/chart/ingress-route.yaml
index 8fbb76c7f..55ef5f0ea 100644
--- a/plugins/scheduler-k3s/templates/chart/ingress-route.yaml
+++ b/plugins/scheduler-k3s/templates/chart/ingress-route.yaml
@@ -38,6 +38,30 @@ spec:
   - {{ $entryPoint }}
   routes:
     {{- range $ddx, $domain := $config.web.domains }}
+    {{- range $rdx, $route := $.Values.global.network.routes }}
+    - kind: Rule
+      match: Host(`{{ $domain.name }}`) && PathPrefix(`{{ $route.path }}`)
+      # No explicit priority - traefik's default (rule length) gives
+      # longest-prefix-wins because Host(...) && PathPrefix(...) is always
+      # longer than web's bare Host(...) rule below.
+      middlewares:
+        - name: {{ $.Values.global.app_name}}-{{ $processName }}-compression
+          namespace: {{ $.Values.global.namespace }}
+        {{- if and (eq $entryPoint "web") $config.web.tls.enabled }}
+        - name: {{ $.Values.global.app_name}}-{{ $processName }}-redirect-to-https
+          namespace: {{ $.Values.global.namespace }}
+        {{- end }}
+        {{- if $route.strip_prefix }}
+        - name: {{ $.Values.global.app_name }}-{{ $route.process }}-{{ $route.slug }}-strip
+          namespace: {{ $.Values.global.namespace }}
+        {{- end }}
+      services:
+      - name: {{ $.Values.global.app_name }}-{{ $route.process }}
+        namespace: {{ $.Values.global.namespace }}
+        passHostHeader: true
+        port: {{ $route.port }}
+        scheme: http
+    {{- end }}
     - kind: Rule
       match: {{ include "traefik.host.match" $domain.name }}
       {{- if hasPrefix "*." $domain.name }}
diff --git a/plugins/scheduler-k3s/templates/chart/ingress.yaml b/plugins/scheduler-k3s/templates/chart/ingress.yaml
index 3644fd2b8..53756e975 100644
--- a/plugins/scheduler-k3s/templates/chart/ingress.yaml
+++ b/plugins/scheduler-k3s/templates/chart/ingress.yaml
@@ -65,6 +65,76 @@ spec:
             {{- end }}
             path: /
           {{- end }}
+          {{- range $rdx, $route := $.Values.global.network.routes }}
+          {{- if not $route.strip_prefix }}
+          - backend:
+              service:
+                name: {{ $.Values.global.app_name }}-{{ $route.process }}
+                port:
+                  number: {{ $route.port }}
+            pathType: Prefix
+            path: {{ $route.path }}
+          {{- end }}
+          {{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- /* Strip-prefix routes need their own Ingress objects because the
+       rewrite-target annotation is Ingress-level. */}}
+{{- range $processName, $config := .Values.processes }}
+{{- if not (hasKey $config "web") }}
+{{- continue }}
+{{- end }}
+{{- if and $config.web.domains (eq $.Values.global.network.ingress_class "nginx") }}
+{{- range $pdx, $domain := $config.web.domains }}
+{{- range $rdx, $route := $.Values.global.network.routes }}
+{{- if $route.strip_prefix }}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    dokku.com/managed: "true"
+    dokku.com/ingress-method: "routes"
+    nginx.ingress.kubernetes.io/rewrite-target: /$2
+    {{- if $config.web.tls.enabled }}
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    {{- end }}
+    {{ include "print.annotations" (dict "config" $.Values.global "key" "ingress") | indent 4 }}
+    {{ include "print.annotations" (dict "config" $config "key" "ingress") | indent 4 }}
+  labels:
+    app.kubernetes.io/instance: {{ $.Values.global.app_name }}-{{ $route.process }}
+    app.kubernetes.io/name: {{ $route.process }}
+    app.kubernetes.io/part-of: {{ $.Values.global.app_name }}
+    {{ include "print.labels" (dict "config" $.Values.global "key" "ingress") | indent 4 }}
+    {{ include "print.labels" (dict "config" $config "key" "ingress") | indent 4 }}
+  name: {{ $.Values.global.app_name }}-{{ $route.process }}-{{ $route.slug }}-strip-{{ $domain.slug }}
+  namespace: {{ $.Values.global.namespace }}
+spec:
+  ingressClassName: nginx
+  {{- if $config.web.tls.enabled }}
+  tls:
+    - hosts:
+      - {{ $domain.name | quote }}
+      {{- if $config.web.tls.use_imported_cert }}
+      secretName: tls-{{ $.Values.global.app_name }}
+      {{- else }}
+      secretName: tls-{{ $.Values.global.app_name }}-{{ $processName }}
+      {{- end }}
+  {{- end }}
+  rules:
+    - host: {{ $domain.name | quote }}
+      http:
+        paths:
+          - backend:
+              service:
+                name: {{ $.Values.global.app_name }}-{{ $route.process }}
+                port:
+                  number: {{ $route.port }}
+            pathType: ImplementationSpecific
+            path: {{ $route.path }}(/|$)(.*)
+{{- end }}
+{{- end }}
 {{- end }}
 {{- end }}
 {{- end }}
diff --git a/plugins/scheduler-k3s/templates/chart/strip-prefix-middleware.yaml b/plugins/scheduler-k3s/templates/chart/strip-prefix-middleware.yaml
new file mode 100644
index 000000000..9d563fb87
--- /dev/null
+++ b/plugins/scheduler-k3s/templates/chart/strip-prefix-middleware.yaml
@@ -0,0 +1,35 @@
+{{- /* Emit a StripPrefix Middleware CRD per route that uses --strip-prefix
+       when the ingress class is traefik. Referenced from the IngressRoute
+       Rule rendered in ingress-route.yaml. */}}
+{{- range $processName, $config := .Values.processes }}
+{{- if not (hasKey $config "web") }}
+{{- continue }}
+{{- end }}
+
+{{- if and $config.web.domains (eq $.Values.global.network.ingress_class "traefik") }}
+{{- range $rdx, $route := $.Values.global.network.routes }}
+{{- if $route.strip_prefix }}
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  annotations:
+    dokku.com/managed: "true"
+    {{ include "print.annotations" (dict "config" $.Values.global "key" "traefik_middleware") | indent 4 }}
+    {{ include "print.annotations" (dict "config" $config "key" "traefik_middleware") | indent 4 }}
+  labels:
+    app.kubernetes.io/instance: {{ $.Values.global.app_name }}-{{ $route.process }}-{{ $route.slug }}-strip
+    app.kubernetes.io/name: {{ $route.process }}
+    app.kubernetes.io/part-of: {{ $.Values.global.app_name }}
+    {{ include "print.labels" (dict "config" $.Values.global "key" "traefik_middleware") | indent 4 }}
+    {{ include "print.labels" (dict "config" $config "key" "traefik_middleware") | indent 4 }}
+  name: {{ $.Values.global.app_name }}-{{ $route.process }}-{{ $route.slug }}-strip
+  namespace: {{ $.Values.global.namespace }}
+spec:
+  stripPrefix:
+    prefixes:
+      - {{ $route.path }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/plugins/scheduler-k3s/triggers.go b/plugins/scheduler-k3s/triggers.go
index 89d31cea9..1aeb345a2 100644
--- a/plugins/scheduler-k3s/triggers.go
+++ b/plugins/scheduler-k3s/triggers.go
@@ -103,36 +103,38 @@ func TriggerInstall() error {
 // chart, and legacy values take precedence over any partial pre-existing
 // entries on re-runs.
 func migrateChartPropertiesToMapFormat() error {
-	for _, chart := range HelmCharts {
-		prefix := "chart." + chart.ReleaseName + "."
-		legacy, err := common.PropertyGetAllByPrefix("scheduler-k3s", "--global", prefix)
-		if err != nil {
-			return fmt.Errorf("Unable to read legacy chart properties for %s: %w", chart.ReleaseName, err)
-		}
-		if len(legacy) == 0 {
-			continue
-		}
+	return common.PropertyLock("scheduler-k3s", "--global", func(p *common.LockedProperties) error {
+		for _, chart := range HelmCharts {
+			prefix := "chart." + chart.ReleaseName + "."
+			legacy, err := common.PropertyGetAllByPrefix("scheduler-k3s", "--global", prefix)
+			if err != nil {
+				return fmt.Errorf("Unable to read legacy chart properties for %s: %w", chart.ReleaseName, err)
+			}
+			if len(legacy) == 0 {
+				continue
+			}
 
-		mapProperty := "chart-overrides." + chart.ReleaseName
-		merged, err := common.PropertyMapGet("scheduler-k3s", "--global", mapProperty)
-		if err != nil {
-			return fmt.Errorf("Unable to read existing chart-overrides for %s: %w", chart.ReleaseName, err)
-		}
-		for fullKey, value := range legacy {
-			merged[strings.TrimPrefix(fullKey, prefix)] = value
-		}
+			mapProperty := "chart-overrides." + chart.ReleaseName
+			merged, err := common.PropertyMapGet("scheduler-k3s", "--global", mapProperty)
+			if err != nil {
+				return fmt.Errorf("Unable to read existing chart-overrides for %s: %w", chart.ReleaseName, err)
+			}
+			for fullKey, value := range legacy {
+				merged[strings.TrimPrefix(fullKey, prefix)] = value
+			}
 
-		if err := common.PropertyMapWrite("scheduler-k3s", "--global", mapProperty, merged); err != nil {
-			return fmt.Errorf("Unable to write chart-overrides for %s: %w", chart.ReleaseName, err)
-		}
+			if err := p.MapWrite(mapProperty, merged); err != nil {
+				return fmt.Errorf("Unable to write chart-overrides for %s: %w", chart.ReleaseName, err)
+			}
 
-		for fullKey := range legacy {
-			if err := common.PropertyDelete("scheduler-k3s", "--global", fullKey); err != nil {
-				return fmt.Errorf("Unable to remove legacy chart property %s: %w", fullKey, err)
+			for fullKey := range legacy {
+				if err := p.Delete(fullKey); err != nil {
+					return fmt.Errorf("Unable to remove legacy chart property %s: %w", fullKey, err)
+				}
 			}
 		}
-	}
-	return nil
+		return nil
+	})
 }
 
 // migrateAnnotationsLabelsToMapFormat converts the legacy line-formatted
@@ -207,31 +209,33 @@ func migrateAnnotationsLabelsToMapFormat() error {
 // file as a JSON map. It is a no-op when the file is already valid JSON or
 // empty (idempotent).
 func migrateAnnotationLabelProperty(scope string, propertyName string) error {
-	if _, err := common.PropertyMapGet("scheduler-k3s", scope, propertyName); err == nil {
+	return common.PropertyLock("scheduler-k3s", scope, func(p *common.LockedProperties) error {
+		if _, err := common.PropertyMapGet("scheduler-k3s", scope, propertyName); err == nil {
+			return nil
+		}
+
+		lines, err := common.PropertyListGet("scheduler-k3s", scope, propertyName)
+		if err != nil {
+			return fmt.Errorf("Unable to read legacy property %s/%s: %w", scope, propertyName, err)
+		}
+
+		m := map[string]string{}
+		for _, line := range lines {
+			if line == "" {
+				continue
+			}
+			parts := strings.SplitN(line, ": ", 2)
+			if len(parts) != 2 {
+				return fmt.Errorf("Invalid legacy entry in %s/%s: %s", scope, propertyName, line)
+			}
+			m[parts[0]] = parts[1]
+		}
+
+		if err := p.MapWrite(propertyName, m); err != nil {
+			return fmt.Errorf("Unable to write %s/%s as map: %w", scope, propertyName, err)
+		}
 		return nil
-	}
-
-	lines, err := common.PropertyListGet("scheduler-k3s", scope, propertyName)
-	if err != nil {
-		return fmt.Errorf("Unable to read legacy property %s/%s: %w", scope, propertyName, err)
-	}
-
-	m := map[string]string{}
-	for _, line := range lines {
-		if line == "" {
-			continue
-		}
-		parts := strings.SplitN(line, ": ", 2)
-		if len(parts) != 2 {
-			return fmt.Errorf("Invalid legacy entry in %s/%s: %s", scope, propertyName, line)
-		}
-		m[parts[0]] = parts[1]
-	}
-
-	if err := common.PropertyMapWrite("scheduler-k3s", scope, propertyName, m); err != nil {
-		return fmt.Errorf("Unable to write %s/%s as map: %w", scope, propertyName, err)
-	}
-	return nil
+	})
 }
 
 // TriggerPostCertsUpdate handles post-certs-update trigger
@@ -916,6 +920,55 @@ func TriggerSchedulerProxyLogs(scheduler string, appName string, proxyType strin
 	})
 }
 
+// ExitCodeError carries the exit code of a failed user command so that the
+// scheduler trigger can exit with the command's own status rather than a
+// generic failure. It implements common.ErrWithExitCode, which
+// common.LogFailWithError honors, matching docker-local scheduler behavior.
+type ExitCodeError struct {
+	// Code is the exit code of the failed command or container
+	Code int
+
+	// Message is the error text printed to stderr
+	Message string
+}
+
+var _ common.ErrWithExitCode = (*ExitCodeError)(nil)
+
+// Error returns the error text to print to stderr
+func (e *ExitCodeError) Error() string {
+	return e.Message
+}
+
+// ExitCode returns the exit code to use in case this error bubbles up into an
+// os.Exit() call
+func (e *ExitCodeError) ExitCode() int {
+	return e.Code
+}
+
+// failedRunContainerError builds an ExitCodeError from the terminated run
+// container of a failed run pod. The container's exit code is the exit code of
+// the command the run pod executed, so it can be propagated to the caller.
+// When no terminated container with a nonzero exit code exists, a generic
+// failure error is returned instead.
+func failedRunContainerError(appName string, processType string, pod v1.Pod) error {
+	containerName := fmt.Sprintf("%s-%s", appName, processType)
+	for _, status := range pod.Status.ContainerStatuses {
+		if status.Name != containerName || status.State.Terminated == nil {
+			continue
+		}
+		exitCode := int(status.State.Terminated.ExitCode)
+		if exitCode > 0 {
+			message := fmt.Sprintf("Unable to attach as the pod has already exited with a failed exit code: %d", exitCode)
+			if messageDetail := status.State.Terminated.Message; messageDetail != "" {
+				message = fmt.Sprintf("%s (%s)", message, messageDetail)
+			}
+			return &ExitCodeError{Code: exitCode, Message: message}
+		}
+	}
+
+	return fmt.Errorf("Unable to attach as the pod has already exited with a failed exit code")
+}
+
 // TriggerSchedulerRun runs a command in an ephemeral container
 func TriggerSchedulerRun(scheduler string, appName string, envCount int, args []string) error {
 	if scheduler != "k3s" {
@@ -1240,16 +1293,7 @@ func TriggerSchedulerRun(scheduler string, appName string, envCount int, args []
 		case v1.PodSucceeded:
 			return nil
 		case v1.PodFailed:
-			for _, status := range selectedPod.Status.ContainerStatuses {
-				if status.Name != fmt.Sprintf("%s-%s", appName, processType) {
-					continue
-				}
-				if status.State.Terminated == nil {
-					continue
-				}
-				return fmt.Errorf("Unable to attach as the pod has already exited with a failed exit code: %s", status.State.Terminated.Message)
-			}
-			return fmt.Errorf("Unable to attach as the pod has already exited with a failed exit code")
+			return failedRunContainerError(appName, processType, selectedPod)
 		}
 		return fmt.Errorf("Unable to attach as the pod is in an unknown state: %s", selectedPod.Status.Phase)
 	}
@@ -1276,17 +1320,7 @@ func TriggerSchedulerRun(scheduler string, appName string, envCount int, args []
 				return fmt.Errorf("Error streaming logs: %w", err)
 			}
 			if selectedPod.Status.Phase == v1.PodFailed {
-				for _, status := range selectedPod.Status.ContainerStatuses {
-					if status.Name != fmt.Sprintf("%s-%s", appName, processType) {
-						continue
-					}
-					if status.State.Terminated == nil {
-						continue
-					}
-					return fmt.Errorf("Unable to attach as the pod has already exited with a failed exit code: %s", status.State.Terminated.Message)
-				}
-
-				return fmt.Errorf("Unable to attach as the pod has already exited with a failed exit code")
+				return failedRunContainerError(appName, processType, selectedPod)
 			} else if selectedPod.Status.Phase == v1.PodSucceeded {
 				return nil
 			}
@@ -1307,17 +1341,7 @@ func TriggerSchedulerRun(scheduler string, appName string, envCount int, args []
 	switch selectedPod.Status.Phase {
 	case v1.PodFailed, v1.PodSucceeded:
 		if selectedPod.Status.Phase == v1.PodFailed {
-			for _, status := range selectedPod.Status.ContainerStatuses {
-				if status.Name != fmt.Sprintf("%s-%s", appName, processType) {
-					continue
-				}
-				if status.State.Terminated == nil {
-					continue
-				}
-				return fmt.Errorf("Unable to attach as the pod has already exited with a failed exit code: %s", status.State.Terminated.Message)
-			}
-
-			return fmt.Errorf("Unable to attach as the pod has already exited with a failed exit code")
+			return failedRunContainerError(appName, processType, selectedPod)
 		} else if selectedPod.Status.Phase == v1.PodSucceeded {
 			return errors.New("Unable to attach as the pod has already exited with a successful exit code")
 		}
diff --git a/plugins/scheduler-k3s/triggers_test.go b/plugins/scheduler-k3s/triggers_test.go
index 3b8afa20e..fd19e804a 100644
--- a/plugins/scheduler-k3s/triggers_test.go
+++ b/plugins/scheduler-k3s/triggers_test.go
@@ -2,12 +2,15 @@ package scheduler_k3s
 
 import (
 	"encoding/json"
+	"fmt"
 	"os"
 	"path/filepath"
 	"testing"
 
 	"github.com/dokku/dokku/plugins/common"
 	. "github.com/onsi/gomega"
+	corev1 "k8s.io/api/core/v1"
+	v1 "k8s.io/api/core/v1"
 )
 
 func setupChartMigrationTest(t *testing.T) {
@@ -85,7 +88,7 @@ func TestMigrateChartPropertiesToMapFormatPreservesExistingNonOverlappingKeys(t
 	setupChartMigrationTest(t)
 
 	Expect(common.PropertyMapWrite("scheduler-k3s", "--global", "chart-overrides.cert-manager", map[string]string{
-		"installCRDs":                              "true",
+		"installCRDs": "true",
 		"service.annotations.prometheus.io/scrape": "true",
 	})).To(Succeed())
 	Expect(common.PropertyWrite("scheduler-k3s", "--global", "chart.cert-manager.installCRDs", "false")).To(Succeed())
@@ -96,9 +99,9 @@ func TestMigrateChartPropertiesToMapFormatPreservesExistingNonOverlappingKeys(t
 	got, err := common.PropertyMapGet("scheduler-k3s", "--global", "chart-overrides.cert-manager")
 	Expect(err).NotTo(HaveOccurred())
 	Expect(got).To(Equal(map[string]string{
-		"installCRDs":                              "false",
+		"installCRDs": "false",
 		"service.annotations.prometheus.io/scrape": "true",
-		"version":                                  "1.13.3",
+		"version": "1.13.3",
 	}))
 }
 
@@ -194,3 +197,146 @@ func TestMigrateAnnotationsLabelsToMapFormatSkipsReservedPrefixes(t *testing.T)
 	Expect(common.PropertyGet("scheduler-k3s", "--global", "chart.cert-manager.deployment")).To(Equal("irrelevant"))
 	Expect(common.PropertyGet("scheduler-k3s", "--global", "node-profile-foo.json")).To(Equal("{}"))
 }
+
+func TestExitCodeError(t *testing.T) {
+	var _ common.ErrWithExitCode = (*ExitCodeError)(nil)
+
+	err := &ExitCodeError{Code: 3, Message: "boom"}
+	if err.ExitCode() != 3 {
+		t.Errorf("ExitCode() = %d, want 3", err.ExitCode())
+	}
+	if err.Error() != "boom" {
+		t.Errorf("Error() = %q, want %q", err.Error(), "boom")
+	}
+}
+
+func runPod(appName string, processType string, containerStatuses []corev1.ContainerStatus) v1.Pod {
+	return v1.Pod{
+		Status: v1.PodStatus{
+			Phase:             v1.PodFailed,
+			ContainerStatuses: containerStatuses,
+		},
+	}
+}
+
+func terminatedContainerStatus(name string, exitCode int32, message string) corev1.ContainerStatus {
+	return corev1.ContainerStatus{
+		Name: name,
+		State: corev1.ContainerState{
+			Terminated: &corev1.ContainerStateTerminated{
+				ExitCode: exitCode,
+				Message:  message,
+			},
+		},
+	}
+}
+
+func TestFailedRunContainerError(t *testing.T) {
+	containerName := fmt.Sprintf("%s-%s", "myapp", "run")
+
+	cases := []struct {
+		name        string
+		appName     string
+		processType string
+		statuses    []corev1.ContainerStatus
+		wantCode    int
+		wantError   string
+	}{
+		{
+			name:        "terminated run container with nonzero exit code",
+			appName:     "myapp",
+			processType: "run",
+			statuses:    []corev1.ContainerStatus{terminatedContainerStatus(containerName, 3, "")},
+			wantCode:    3,
+			wantError:   "Unable to attach as the pod has already exited with a failed exit code: 3",
+		},
+		{
+			name:        "terminated run container with nonzero exit code and message",
+			appName:     "myapp",
+			processType: "run",
+			statuses:    []corev1.ContainerStatus{terminatedContainerStatus(containerName, 137, "OOMKilled")},
+			wantCode:    137,
+			wantError:   "Unable to attach as the pod has already exited with a failed exit code: 137 (OOMKilled)",
+		},
+		{
+			name:        "terminated run container with zero exit code returns generic error",
+			appName:     "myapp",
+			processType: "run",
+			statuses:    []corev1.ContainerStatus{terminatedContainerStatus(containerName, 0, "")},
+			wantCode:    -1,
+			wantError:   "Unable to attach as the pod has already exited with a failed exit code",
+		},
+		{
+			name:        "no container statuses returns generic error",
+			appName:     "myapp",
+			processType: "run",
+			statuses:    []corev1.ContainerStatus{},
+			wantCode:    -1,
+			wantError:   "Unable to attach as the pod has already exited with a failed exit code",
+		},
+		{
+			name:        "container name mismatch returns generic error",
+			appName:     "myapp",
+			processType: "run",
+			statuses:    []corev1.ContainerStatus{terminatedContainerStatus("other-app-run", 3, "")},
+			wantCode:    -1,
+			wantError:   "Unable to attach as the pod has already exited with a failed exit code",
+		},
+		{
+			name:        "unterminated matching container returns generic error",
+			appName:     "myapp",
+			processType: "run",
+			statuses: []corev1.ContainerStatus{
+				{
+					Name:  containerName,
+					State: corev1.ContainerState{},
+				},
+			},
+			wantCode:  -1,
+			wantError: "Unable to attach as the pod has already exited with a failed exit code",
+		},
+		{
+			name:        "unrelated terminated container before matching one",
+			appName:     "myapp",
+			processType: "run",
+			statuses: []corev1.ContainerStatus{
+				terminatedContainerStatus("myapp-web", 9, ""),
+				terminatedContainerStatus(containerName, 5, ""),
+			},
+			wantCode:  5,
+			wantError: "Unable to attach as the pod has already exited with a failed exit code: 5",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := failedRunContainerError(tc.appName, tc.processType, runPod(tc.appName, tc.processType, tc.statuses))
+			if tc.wantCode == -1 {
+				if err == nil {
+					t.Fatal("failedRunContainerError() = nil, want generic error")
+				}
+				if _, ok := err.(*ExitCodeError); ok {
+					t.Fatalf("failedRunContainerError() returned %T, want generic error", err)
+				}
+				if err.Error() != tc.wantError {
+					t.Errorf("failedRunContainerError() error = %q, want %q", err.Error(), tc.wantError)
+				}
+				return
+			}
+
+			if err == nil {
+				t.Fatal("failedRunContainerError() = nil, want ExitCodeError")
+			}
+			exitErr, ok := err.(*ExitCodeError)
+			if !ok {
+				t.Fatalf("failedRunContainerError() returned %T, want *ExitCodeError", err)
+			}
+			if exitErr.ExitCode() != tc.wantCode {
+				t.Errorf("ExitCode() = %d, want %d", exitErr.ExitCode(), tc.wantCode)
+			}
+			if err.Error() != tc.wantError {
+				t.Errorf("Error() = %q, want %q", err.Error(), tc.wantError)
+			}
+		})
+	}
+}
diff --git a/plugins/scheduler-null/plugin.toml b/plugins/scheduler-null/plugin.toml
index 4b60f96fa..886e2ce90 100644
--- a/plugins/scheduler-null/plugin.toml
+++ b/plugins/scheduler-null/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core scheduler-null plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/scheduler/go.mod b/plugins/scheduler/go.mod
index 6714b9e4d..0f2ea81cf 100644
--- a/plugins/scheduler/go.mod
+++ b/plugins/scheduler/go.mod
@@ -1,29 +1,29 @@
 module github.com/dokku/dokku/plugins/scheduler
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/scheduler/go.sum b/plugins/scheduler/go.sum
index 14bf42b1c..9ada61068 100644
--- a/plugins/scheduler/go.sum
+++ b/plugins/scheduler/go.sum
@@ -1,25 +1,24 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -28,28 +27,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/scheduler/plugin.toml b/plugins/scheduler/plugin.toml
index f3e52934d..a2ee92378 100644
--- a/plugins/scheduler/plugin.toml
+++ b/plugins/scheduler/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core scheduler plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/shell/plugin.toml b/plugins/shell/plugin.toml
index cc4deef4a..c70e7d740 100644
--- a/plugins/shell/plugin.toml
+++ b/plugins/shell/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core shell plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/ssh-keys/plugin.toml b/plugins/ssh-keys/plugin.toml
index 879223241..0993a2fcd 100644
--- a/plugins/ssh-keys/plugin.toml
+++ b/plugins/ssh-keys/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core ssh-keys plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/storage/.gitignore b/plugins/storage/.gitignore
index d3939e0d4..dce8215ae 100644
--- a/plugins/storage/.gitignore
+++ b/plugins/storage/.gitignore
@@ -1,4 +1,7 @@
 /commands
+/docker-args-deploy
+/docker-args-process-deploy
+/docker-args-run
 /subcommands/*
 /triggers/*
 /triggers
diff --git a/plugins/storage/Makefile b/plugins/storage/Makefile
index b430b0882..e08a7683e 100644
--- a/plugins/storage/Makefile
+++ b/plugins/storage/Makefile
@@ -1,6 +1,5 @@
-GOARCH ?= amd64
 SUBCOMMANDS = subcommands/default subcommands/annotations:set subcommands/annotations:report subcommands/create subcommands/destroy subcommands/ensure-directory subcommands/exec subcommands/info subcommands/labels:set subcommands/labels:report subcommands/list subcommands/list-entries subcommands/migrate subcommands/mount subcommands/report subcommands/set subcommands/unmount subcommands/wait
-TRIGGERS = triggers/install triggers/storage-list triggers/storage-app-mounts triggers/docker-args-deploy triggers/docker-args-run triggers/post-delete triggers/post-app-clone-setup triggers/post-app-rename-setup
+TRIGGERS = triggers/install triggers/storage-list triggers/storage-app-mounts triggers/docker-args-process-deploy triggers/docker-args-run triggers/post-delete triggers/post-app-clone-setup triggers/post-app-rename-setup
 BUILD = commands subcommands triggers
 PLUGIN_NAME = storage
 
diff --git a/plugins/storage/attachment.go b/plugins/storage/attachment.go
index 8b02fcec4..f2b5c687d 100644
--- a/plugins/storage/attachment.go
+++ b/plugins/storage/attachment.go
@@ -66,6 +66,38 @@ func (a *Attachment) Validate() error {
 	return nil
 }
 
+// EffectiveProcessType returns the process type an attachment is scoped to,
+// treating an unset value as the default scope so attachments written before
+// the field existed still sort into a scope.
+func (a *Attachment) EffectiveProcessType() string {
+	if a == nil || a.ProcessType == "" {
+		return DefaultProcessType
+	}
+
+	return a.ProcessType
+}
+
+// AppliesToProcessType reports whether an attachment is mounted into the
+// container being built for the given process type. The default scope applies
+// to every process; a named scope applies only to itself. An empty processType
+// names a container that belongs to no process at all - a `dokku run` one-off,
+// an app.json deploy task, a k3s cron job - and so sees the default scope only.
+func (a *Attachment) AppliesToProcessType(processType string) bool {
+	if processType == "" {
+		processType = DefaultProcessType
+	}
+
+	scope := a.EffectiveProcessType()
+	return scope == DefaultProcessType || scope == processType
+}
+
+// scopesOverlap reports whether two process-type scopes can both apply to one
+// container. The default scope overlaps every named scope; two named scopes
+// overlap only when they are equal.
+func scopesOverlap(first string, second string) bool {
+	return first == DefaultProcessType || second == DefaultProcessType || first == second
+}
+
 // LoadAttachments returns every attachment registered against an app.
 func LoadAttachments(appName string) ([]*Attachment, error) {
 	lines, err := common.PropertyListGet(PluginName, appName, AttachmentsProperty)
@@ -73,6 +105,11 @@ func LoadAttachments(appName string) ([]*Attachment, error) {
 		return nil, fmt.Errorf("unable to read storage attachments for %q: %w", appName, err)
 	}
 
+	return decodeAttachments(appName, lines)
+}
+
+// decodeAttachments parses the stored attachment lines of an app.
+func decodeAttachments(appName string, lines []string) ([]*Attachment, error) {
 	attachments := []*Attachment{}
 	for _, line := range lines {
 		line = strings.TrimSpace(line)
@@ -90,40 +127,90 @@ func LoadAttachments(appName string) ([]*Attachment, error) {
 
 // SaveAttachments overwrites the entire attachment list for an app.
 func SaveAttachments(appName string, attachments []*Attachment) error {
-	lines := make([]string, 0, len(attachments))
-	for _, attachment := range attachments {
-		data, err := json.Marshal(attachment)
-		if err != nil {
-			return fmt.Errorf("unable to encode storage attachment for %q: %w", appName, err)
-		}
-		lines = append(lines, string(data))
+	lines, err := encodeAttachments(appName, attachments)
+	if err != nil {
+		return err
 	}
 	return common.PropertyListWrite(PluginName, appName, AttachmentsProperty, lines)
 }
 
+// UpdateAttachments loads the attachment list for an app, passes it to fn and
+// saves the list fn returns, holding the app's storage property lock across
+// the read and the write so concurrent mounts and unmounts cannot drop each
+// other's changes. Nothing is saved when fn returns an error.
+func UpdateAttachments(appName string, fn func(attachments []*Attachment) ([]*Attachment, error)) error {
+	return common.PropertyListUpdate(PluginName, appName, AttachmentsProperty, func(lines []string) ([]string, error) {
+		attachments, err := decodeAttachments(appName, lines)
+		if err != nil {
+			return nil, err
+		}
+
+		attachments, err = fn(attachments)
+		if err != nil {
+			return nil, err
+		}
+
+		return encodeAttachments(appName, attachments)
+	})
+}
+
+// encodeAttachments serializes attachments into stored attachment lines.
+func encodeAttachments(appName string, attachments []*Attachment) ([]string, error) {
+	lines := make([]string, 0, len(attachments))
+	for _, attachment := range attachments {
+		data, err := json.Marshal(attachment)
+		if err != nil {
+			return nil, fmt.Errorf("unable to encode storage attachment for %q: %w", appName, err)
+		}
+		lines = append(lines, string(data))
+	}
+	return lines, nil
+}
+
+// ensureContainerPathFree rejects a candidate whose container path is already
+// claimed by an attachment in an overlapping scope. Two attachments bound at
+// one container path in overlapping scopes emit two -v flags for the same
+// target, leaving which volume the process actually sees up to Docker.
+func ensureContainerPathFree(appName string, attachments []*Attachment, candidate *Attachment) error {
+	for _, existing := range attachments {
+		if existing.ContainerPath != candidate.ContainerPath {
+			continue
+		}
+		if !scopesOverlap(existing.EffectiveProcessType(), candidate.EffectiveProcessType()) {
+			continue
+		}
+
+		return fmt.Errorf("Container path %s on app %s is already mounted by storage entry %s for process type %s",
+			candidate.ContainerPath, appName, existing.EntryName, existing.EffectiveProcessType())
+	}
+
+	return nil
+}
+
 // AddAttachment appends an attachment, rejecting duplicates of the same
-// (entry_name, container_path, process_type) tuple.
+// (entry_name, container_path, process_type) tuple as well as container paths
+// already claimed by an attachment in an overlapping scope.
 func AddAttachment(appName string, attachment *Attachment) error {
 	if err := attachment.Validate(); err != nil {
 		return err
 	}
 
-	attachments, err := LoadAttachments(appName)
-	if err != nil {
-		return err
-	}
-
-	for _, existing := range attachments {
-		if existing.EntryName == attachment.EntryName &&
-			existing.ContainerPath == attachment.ContainerPath &&
-			existing.ProcessType == attachment.ProcessType {
-			return fmt.Errorf("storage entry %q is already mounted at %q for process type %q on app %q",
-				attachment.EntryName, attachment.ContainerPath, attachment.ProcessType, appName)
+	return UpdateAttachments(appName, func(attachments []*Attachment) ([]*Attachment, error) {
+		for _, existing := range attachments {
+			if existing.EntryName == attachment.EntryName &&
+				existing.ContainerPath == attachment.ContainerPath &&
+				existing.EffectiveProcessType() == attachment.EffectiveProcessType() {
+				return nil, fmt.Errorf("storage entry %q is already mounted at %q for process type %q on app %q",
+					attachment.EntryName, attachment.ContainerPath, attachment.EffectiveProcessType(), appName)
+			}
 		}
-	}
 
-	attachments = append(attachments, attachment)
-	return SaveAttachments(appName, attachments)
+		if err := ensureContainerPathFree(appName, attachments, attachment); err != nil {
+			return nil, err
+		}
+
+		return append(attachments, attachment), nil
+	})
 }
 
 // UpsertAttachment inserts an attachment, or updates the mount-time fields
@@ -136,42 +223,58 @@ func AddAttachment(appName string, attachment *Attachment) error {
 // false Readonly clears any previously-set value, mirroring the operator's
 // "set the flags as I just typed them" intent and the same idempotent
 // contract storage:create offers for entries.
+//
+// A new attachment is rejected when its container path is already claimed by
+// an attachment in an overlapping scope.
 func UpsertAttachment(appName string, attachment *Attachment) (bool, error) {
 	if err := attachment.Validate(); err != nil {
 		return false, err
 	}
 
-	attachments, err := LoadAttachments(appName)
+	created := false
+	err := UpdateAttachments(appName, func(attachments []*Attachment) ([]*Attachment, error) {
+		for _, existing := range attachments {
+			if existing.EntryName == attachment.EntryName &&
+				existing.ContainerPath == attachment.ContainerPath &&
+				existing.EffectiveProcessType() == attachment.EffectiveProcessType() {
+				existing.Phases = attachment.Phases
+				existing.Subpath = attachment.Subpath
+				existing.Readonly = attachment.Readonly
+				existing.VolumeOptions = attachment.VolumeOptions
+				existing.VolumeChown = attachment.VolumeChown
+				return attachments, nil
+			}
+		}
+
+		// Only the append branch needs the overlap check: rewriting an existing
+		// tuple in place would otherwise trip over the attachment it is updating.
+		if err := ensureContainerPathFree(appName, attachments, attachment); err != nil {
+			return nil, err
+		}
+
+		created = true
+		return append(attachments, attachment), nil
+	})
 	if err != nil {
 		return false, err
 	}
-
-	for _, existing := range attachments {
-		if existing.EntryName == attachment.EntryName &&
-			existing.ContainerPath == attachment.ContainerPath &&
-			existing.ProcessType == attachment.ProcessType {
-			existing.Phases = attachment.Phases
-			existing.Subpath = attachment.Subpath
-			existing.Readonly = attachment.Readonly
-			existing.VolumeOptions = attachment.VolumeOptions
-			existing.VolumeChown = attachment.VolumeChown
-			return false, SaveAttachments(appName, attachments)
-		}
-	}
-
-	attachments = append(attachments, attachment)
-	return true, SaveAttachments(appName, attachments)
+	return created, nil
 }
 
 // RemoveAttachment removes the attachment matching the given entry and
 // optional container path. If containerPath is empty and there is more
 // than one match, returns an error.
 func RemoveAttachment(appName string, entryName string, containerPath string) error {
-	attachments, err := LoadAttachments(appName)
-	if err != nil {
-		return err
-	}
+	return UpdateAttachments(appName, func(attachments []*Attachment) ([]*Attachment, error) {
+		return removeMatchingAttachments(attachments, appName, entryName, containerPath)
+	})
+}
 
+// removeMatchingAttachments returns the given list with the attachments
+// matching the entry and optional container path dropped. Working against an
+// in-memory list lets storage:unmount resolve several mounts before any of
+// them is written, so one unresolvable mount removes none of them.
+func removeMatchingAttachments(attachments []*Attachment, appName string, entryName string, containerPath string) ([]*Attachment, error) {
 	matches := []*Attachment{}
 	keep := []*Attachment{}
 	for _, attachment := range attachments {
@@ -184,9 +287,9 @@ func RemoveAttachment(appName string, entryName string, containerPath string) er
 
 	if len(matches) == 0 {
 		if containerPath == "" {
-			return fmt.Errorf("storage entry %q is not mounted on app %q", entryName, appName)
+			return nil, fmt.Errorf("storage entry %q is not mounted on app %q", entryName, appName)
 		}
-		return fmt.Errorf("storage entry %q is not mounted at %q on app %q", entryName, containerPath, appName)
+		return nil, fmt.Errorf("storage entry %q is not mounted at %q on app %q", entryName, containerPath, appName)
 	}
 	if len(matches) > 1 && containerPath == "" {
 		paths := []string{}
@@ -194,11 +297,11 @@ func RemoveAttachment(appName string, entryName string, containerPath string) er
 			paths = append(paths, attachment.ContainerPath)
 		}
 		sort.Strings(paths)
-		return fmt.Errorf("storage entry %q is mounted at multiple paths on app %q (%s); pass --container-dir to disambiguate",
+		return nil, fmt.Errorf("storage entry %q is mounted at multiple paths on app %q (%s); pass --container-dir to disambiguate",
 			entryName, appName, strings.Join(paths, ", "))
 	}
 
-	return SaveAttachments(appName, keep)
+	return keep, nil
 }
 
 // AttachmentsForPhase returns the subset of an app's attachments that
diff --git a/plugins/storage/attachment_test.go b/plugins/storage/attachment_test.go
index d43f7ec53..5f7906937 100644
--- a/plugins/storage/attachment_test.go
+++ b/plugins/storage/attachment_test.go
@@ -302,19 +302,135 @@ func TestUpsertAttachmentDistinctIdentity(t *testing.T) {
 	Expect(err).NotTo(HaveOccurred())
 	Expect(created).To(BeTrue())
 
-	// Different process type on the same (entry, container_path) is also distinct.
+	// Two named scopes never apply to the same container, so they can each
+	// claim one container path.
 	created, err = UpsertAttachment("demo", &Attachment{
 		EntryName:     "demo-data",
-		ContainerPath: "/data",
+		ContainerPath: "/scoped",
 		Phases:        []string{PhaseDeploy},
 		ProcessType:   "web",
 	})
 	Expect(err).NotTo(HaveOccurred())
 	Expect(created).To(BeTrue())
 
+	created, err = UpsertAttachment("demo", &Attachment{
+		EntryName:     "demo-data",
+		ContainerPath: "/scoped",
+		Phases:        []string{PhaseDeploy},
+		ProcessType:   "worker",
+	})
+	Expect(err).NotTo(HaveOccurred())
+	Expect(created).To(BeTrue())
+
 	attachments, err := LoadAttachments("demo")
 	Expect(err).NotTo(HaveOccurred())
-	Expect(attachments).To(HaveLen(3))
+	Expect(attachments).To(HaveLen(4))
+}
+
+// TestUpsertAttachmentRejectsOverlappingContainerPath covers the conflict the
+// process-type scoping makes reachable: the default scope also applies to
+// "web", so both attachments would emit a -v flag for /data on the same
+// container and Docker would decide which one wins.
+func TestUpsertAttachmentRejectsOverlappingContainerPath(t *testing.T) {
+	RegisterTestingT(t)
+	withTempLibRoot(t)
+
+	created, err := UpsertAttachment("demo", &Attachment{
+		EntryName:     "demo-data",
+		ContainerPath: "/data",
+		Phases:        []string{PhaseDeploy},
+		ProcessType:   DefaultProcessType,
+	})
+	Expect(err).NotTo(HaveOccurred())
+	Expect(created).To(BeTrue())
+
+	_, err = UpsertAttachment("demo", &Attachment{
+		EntryName:     "demo-cache",
+		ContainerPath: "/data",
+		Phases:        []string{PhaseDeploy},
+		ProcessType:   "web",
+	})
+	Expect(err).To(HaveOccurred())
+	Expect(err.Error()).To(ContainSubstring("Container path /data on app demo is already mounted by storage entry demo-data for process type _default_"))
+
+	// The rejected write leaves the stored set exactly as it was.
+	attachments, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(HaveLen(1))
+
+	// The same collision the other way round: a default-scoped mount cannot
+	// claim a path a named scope already holds.
+	_, err = UpsertAttachment("demo", &Attachment{
+		EntryName:     "demo-cache",
+		ContainerPath: "/cache",
+		Phases:        []string{PhaseDeploy},
+		ProcessType:   "worker",
+	})
+	Expect(err).NotTo(HaveOccurred())
+
+	_, err = UpsertAttachment("demo", &Attachment{
+		EntryName:     "demo-logs",
+		ContainerPath: "/cache",
+		Phases:        []string{PhaseDeploy},
+		ProcessType:   DefaultProcessType,
+	})
+	Expect(err).To(HaveOccurred())
+	Expect(err.Error()).To(ContainSubstring("for process type worker"))
+}
+
+// TestAttachmentAppliesToProcessType pins the scoping rule every deploy-time
+// caller shares: the default scope reaches every process, a named scope reaches
+// only itself, and a container with no process type of its own - a `dokku run`
+// one-off, an app.json deploy task, a k3s cron job - sees the default scope.
+func TestAttachmentAppliesToProcessType(t *testing.T) {
+	RegisterTestingT(t)
+
+	defaultScoped := &Attachment{ProcessType: DefaultProcessType}
+	legacyScoped := &Attachment{}
+	webScoped := &Attachment{ProcessType: "web"}
+
+	Expect(defaultScoped.EffectiveProcessType()).To(Equal(DefaultProcessType))
+	Expect(legacyScoped.EffectiveProcessType()).To(Equal(DefaultProcessType))
+	Expect(webScoped.EffectiveProcessType()).To(Equal("web"))
+
+	for _, processType := range []string{"web", "worker", "", DefaultProcessType} {
+		Expect(defaultScoped.AppliesToProcessType(processType)).To(BeTrue(), "default scope, process type %q", processType)
+		Expect(legacyScoped.AppliesToProcessType(processType)).To(BeTrue(), "legacy scope, process type %q", processType)
+	}
+
+	Expect(webScoped.AppliesToProcessType("web")).To(BeTrue())
+	Expect(webScoped.AppliesToProcessType("worker")).To(BeFalse())
+	Expect(webScoped.AppliesToProcessType("")).To(BeFalse())
+	Expect(webScoped.AppliesToProcessType(DefaultProcessType)).To(BeFalse())
+}
+
+// TestAddAttachmentTreatsLegacyScopeAsDefault covers attachments written before
+// the process-type field existed: an empty value and an explicit _default_ name
+// the same scope, so the pair is a duplicate rather than two mounts.
+func TestAddAttachmentTreatsLegacyScopeAsDefault(t *testing.T) {
+	RegisterTestingT(t)
+	root := withTempLibRoot(t)
+
+	writeAttachmentsFile(t, root, "demo", []*Attachment{
+		{
+			EntryName:     "demo-data",
+			ContainerPath: "/data",
+			Phases:        []string{PhaseDeploy},
+		},
+	})
+
+	err := AddAttachment("demo", &Attachment{
+		EntryName:     "demo-data",
+		ContainerPath: "/data",
+		Phases:        []string{PhaseDeploy},
+		ProcessType:   DefaultProcessType,
+	})
+	Expect(err).To(HaveOccurred())
+	Expect(err.Error()).To(ContainSubstring("is already mounted at"))
+
+	attachments, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(HaveLen(1))
 }
 
 func TestUpsertAttachmentValidationFailureLeavesStoreUntouched(t *testing.T) {
diff --git a/plugins/storage/commands_entries.go b/plugins/storage/commands_entries.go
index fd8624ccc..20248f066 100644
--- a/plugins/storage/commands_entries.go
+++ b/plugins/storage/commands_entries.go
@@ -9,6 +9,7 @@ import (
 	"strings"
 
 	"github.com/dokku/dokku/plugins/common"
+	"github.com/mattn/go-isatty"
 )
 
 // CommandCreateInput captures the flags accepted by storage:create.
@@ -273,32 +274,27 @@ func CommandSet(input CommandSetInput) error {
 	if !EntryExists(input.Name) {
 		return fmt.Errorf("storage entry %q does not exist", input.Name)
 	}
-	entry, err := LoadEntry(input.Name)
-	if err != nil {
-		return err
-	}
-
 	touchesDirectory := false
-	for _, change := range input.Changes {
-		if err := applyPropertyChange(entry, change); err != nil {
-			return err
+	entry, err := UpdateEntry(input.Name, func(entry *Entry) error {
+		for _, change := range input.Changes {
+			if err := applyPropertyChange(entry, change); err != nil {
+				return err
+			}
+			if change.Property == "chown" || change.Property == "mode" {
+				touchesDirectory = true
+			}
 		}
-		if change.Property == "chown" || change.Property == "mode" {
-			touchesDirectory = true
+
+		if input.Annotations != nil {
+			entry.Annotations = input.Annotations
+		}
+		if input.Labels != nil {
+			entry.Labels = input.Labels
 		}
-	}
 
-	if input.Annotations != nil {
-		entry.Annotations = input.Annotations
-	}
-	if input.Labels != nil {
-		entry.Labels = input.Labels
-	}
-
-	if err := entry.Validate(); err != nil {
-		return err
-	}
-	if err := SaveEntry(entry); err != nil {
+		return entry.Validate()
+	})
+	if err != nil {
 		return err
 	}
 	// Only converge the directory when the caller actually asked to change
@@ -422,14 +418,16 @@ func CommandExec(input CommandExecInput) error {
 
 // stdinModes inspects os.Stdin to decide whether docker / the k8s exec
 // SDK should request an interactive session and a TTY.
+//
+// TTY detection uses isatty rather than ModeCharDevice: /dev/null is a
+// character device but not a terminal, and treating it as a TTY makes
+// docker run -it fail with "cannot attach stdin to a TTY-enabled
+// container because stdin is not a terminal" (e.g. docker exec without
+// -t, as in CI).
 func stdinModes() (interactive bool, tty bool) {
+	tty = isatty.IsTerminal(os.Stdin.Fd()) || isatty.IsCygwinTerminal(os.Stdin.Fd())
 	fi, err := os.Stdin.Stat()
-	if err != nil || fi == nil {
-		return false, false
-	}
-	mode := fi.Mode()
-	tty = mode&os.ModeCharDevice != 0
-	hasStdinData := mode&os.ModeNamedPipe != 0
+	hasStdinData := err == nil && fi != nil && fi.Mode()&os.ModeNamedPipe != 0
 	interactive = tty || hasStdinData
 	return interactive, tty
 }
diff --git a/plugins/storage/commands_entries_test.go b/plugins/storage/commands_entries_test.go
index 41139a880..58a842970 100644
--- a/plugins/storage/commands_entries_test.go
+++ b/plugins/storage/commands_entries_test.go
@@ -1,6 +1,7 @@
 package storage
 
 import (
+	"os"
 	"path/filepath"
 	"testing"
 
@@ -218,3 +219,47 @@ func TestCommandSetPersistsAndValidates(t *testing.T) {
 	Expect(err).To(HaveOccurred())
 	Expect(err.Error()).To(ContainSubstring("does not exist"))
 }
+
+// TestStdinModesDevNullIsNotTTY guards the CI / docker-exec path: stdin is
+// often /dev/null, which is a character device but not a terminal. ModeCharDevice
+// alone would request docker run -it and fail attach.
+func TestStdinModesDevNullIsNotTTY(t *testing.T) {
+	devNull, err := os.Open(os.DevNull)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer devNull.Close()
+
+	old := os.Stdin
+	os.Stdin = devNull
+	t.Cleanup(func() { os.Stdin = old })
+
+	interactive, tty := stdinModes()
+	if tty {
+		t.Fatalf("expected tty=false for /dev/null, got tty=true interactive=%v", interactive)
+	}
+	if interactive {
+		t.Fatalf("expected interactive=false for /dev/null, got interactive=true")
+	}
+}
+
+func TestStdinModesNamedPipeIsInteractiveWithoutTTY(t *testing.T) {
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer r.Close()
+	defer w.Close()
+
+	old := os.Stdin
+	os.Stdin = r
+	t.Cleanup(func() { os.Stdin = old })
+
+	interactive, tty := stdinModes()
+	if tty {
+		t.Fatalf("expected tty=false for a pipe, got tty=true")
+	}
+	if !interactive {
+		t.Fatalf("expected interactive=true for a named pipe")
+	}
+}
diff --git a/plugins/storage/commands_metadata.go b/plugins/storage/commands_metadata.go
index 7b4b6703f..005f77e3c 100644
--- a/plugins/storage/commands_metadata.go
+++ b/plugins/storage/commands_metadata.go
@@ -76,32 +76,27 @@ func setEntryMapKey(field entryMapField, name string, key string, value string)
 		return fmt.Errorf("storage entry %q does not exist", name)
 	}
 
-	entry, err := LoadEntry(name)
-	if err != nil {
-		return err
-	}
-
-	values := field.Get(entry)
-	if value == "" {
-		delete(values, key)
-		common.LogInfo2Quiet(fmt.Sprintf("Unsetting %s %s", field.Singular, key))
-	} else {
-		if values == nil {
-			values = map[string]string{}
+	entry, err := UpdateEntry(name, func(entry *Entry) error {
+		values := field.Get(entry)
+		if value == "" {
+			delete(values, key)
+			common.LogInfo2Quiet(fmt.Sprintf("Unsetting %s %s", field.Singular, key))
+		} else {
+			if values == nil {
+				values = map[string]string{}
+			}
+			values[key] = value
+			common.LogInfo2Quiet(fmt.Sprintf("Setting %s %s to %s", field.Singular, key, value))
 		}
-		values[key] = value
-		common.LogInfo2Quiet(fmt.Sprintf("Setting %s %s to %s", field.Singular, key, value))
-	}
-	if len(values) == 0 {
-		// Drop the empty map so the omitempty tag keeps it out of the JSON.
-		values = nil
-	}
-	field.Set(entry, values)
+		if len(values) == 0 {
+			// Drop the empty map so the omitempty tag keeps it out of the JSON.
+			values = nil
+		}
+		field.Set(entry, values)
 
-	if err := entry.Validate(); err != nil {
-		return err
-	}
-	if err := SaveEntry(entry); err != nil {
+		return entry.Validate()
+	})
+	if err != nil {
 		return err
 	}
 
diff --git a/plugins/storage/concurrency_test.go b/plugins/storage/concurrency_test.go
new file mode 100644
index 000000000..a6fb3d6be
--- /dev/null
+++ b/plugins/storage/concurrency_test.go
@@ -0,0 +1,92 @@
+package storage
+
+import (
+	"errors"
+	"fmt"
+	"sync"
+	"testing"
+
+	. "github.com/onsi/gomega"
+)
+
+func TestAddAttachmentConcurrent(t *testing.T) {
+	RegisterTestingT(t)
+	withTempLibRoot(t)
+
+	const count = 20
+	var wg sync.WaitGroup
+	errs := make([]error, count)
+	for i := 0; i < count; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			errs[i] = AddAttachment("demo", &Attachment{
+				EntryName:     fmt.Sprintf("demo-data-%d", i),
+				ContainerPath: fmt.Sprintf("/data/%d", i),
+				Phases:        []string{PhaseDeploy, PhaseRun},
+				ProcessType:   DefaultProcessType,
+			})
+		}(i)
+	}
+	wg.Wait()
+	Expect(errors.Join(errs...)).NotTo(HaveOccurred())
+
+	attachments, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(HaveLen(count))
+}
+
+func TestUpdateEntryConcurrent(t *testing.T) {
+	RegisterTestingT(t)
+	withTempLibRoot(t)
+
+	Expect(SaveEntry(&Entry{
+		Name:      "demo-data",
+		Scheduler: SchedulerK3s,
+		Size:      "2Gi",
+	})).To(Succeed())
+
+	const count = 20
+	var wg sync.WaitGroup
+	errs := make([]error, count)
+	for i := 0; i < count; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			_, errs[i] = UpdateEntry("demo-data", func(entry *Entry) error {
+				if entry.Labels == nil {
+					entry.Labels = map[string]string{}
+				}
+				entry.Labels[fmt.Sprintf("label-%d", i)] = "value"
+				return nil
+			})
+		}(i)
+	}
+	wg.Wait()
+	Expect(errors.Join(errs...)).NotTo(HaveOccurred())
+
+	entry, err := LoadEntry("demo-data")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(entry.Labels).To(HaveLen(count))
+}
+
+func TestUpdateEntryErrorLeavesEntryUnchanged(t *testing.T) {
+	RegisterTestingT(t)
+	withTempLibRoot(t)
+
+	Expect(SaveEntry(&Entry{
+		Name:      "demo-data",
+		Scheduler: SchedulerK3s,
+		Size:      "2Gi",
+	})).To(Succeed())
+
+	_, err := UpdateEntry("demo-data", func(entry *Entry) error {
+		entry.Size = "5Gi"
+		return errors.New("boom")
+	})
+	Expect(err).To(MatchError("boom"))
+
+	entry, err := LoadEntry("demo-data")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(entry.Size).To(Equal("2Gi"))
+}
diff --git a/plugins/storage/entry.go b/plugins/storage/entry.go
index 0ed9db919..2729de71f 100644
--- a/plugins/storage/entry.go
+++ b/plugins/storage/entry.go
@@ -67,7 +67,7 @@ var (
 )
 
 // Entry is the source of truth for a storage volume. One file per entry
-// lives at $DOKKU_LIB_ROOT/config/storage/entries/<name>.json.
+// lives at $DOKKU_LIB_ROOT/data/storage-registry/entries/<name>.json.
 type Entry struct {
 	Name          string            `json:"name"`
 	Scheduler     string            `json:"scheduler"`
@@ -162,6 +162,39 @@ func SaveEntry(entry *Entry) error {
 	return nil
 }
 
+// UpdateEntry loads a registered entry, passes it to fn and saves it, holding
+// the entries directory lock across the read and the write so concurrent
+// edits to one entry cannot drop each other's changes. Nothing is saved when
+// fn returns an error. The saved entry is returned.
+func UpdateEntry(name string, fn func(entry *Entry) error) (*Entry, error) {
+	if err := EnsureEntriesDirectory(); err != nil {
+		return nil, err
+	}
+
+	var updated *Entry
+	err := common.LockDirectory(EntriesDirectory(), func() error {
+		entry, err := LoadEntry(name)
+		if err != nil {
+			return err
+		}
+
+		if err := fn(entry); err != nil {
+			return err
+		}
+
+		if err := SaveEntry(entry); err != nil {
+			return err
+		}
+
+		updated = entry
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return updated, nil
+}
+
 // DeleteEntry removes the on-disk record for an entry.
 func DeleteEntry(name string) error {
 	if err := os.Remove(entryPath(name)); err != nil && !os.IsNotExist(err) {
diff --git a/plugins/storage/entry_test.go b/plugins/storage/entry_test.go
index edbb4caa5..f53806efc 100644
--- a/plugins/storage/entry_test.go
+++ b/plugins/storage/entry_test.go
@@ -20,6 +20,10 @@ func withTempLibRoot(t *testing.T) string {
 	t.Helper()
 	dir := t.TempDir()
 	t.Setenv("DOKKU_LIB_ROOT", dir)
+	// Point plugn at an empty tree so anything resolving a plugin trigger in
+	// these tests falls back to its default instead of reading the host's
+	// real dokku install.
+	t.Setenv("PLUGIN_PATH", filepath.Join(dir, "plugins"))
 
 	current, err := user.Current()
 	if err != nil {
diff --git a/plugins/storage/go.mod b/plugins/storage/go.mod
index 200d61403..dfb135cec 100644
--- a/plugins/storage/go.mod
+++ b/plugins/storage/go.mod
@@ -1,36 +1,36 @@
 module github.com/dokku/dokku/plugins/storage
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
 	github.com/dokku/dokku/plugins/docker-options v0.0.0-00010101000000-000000000000
-	github.com/onsi/gomega v1.42.1
-	github.com/spf13/pflag v1.0.10
+	github.com/mattn/go-isatty v0.0.24
+	github.com/onsi/gomega v1.44.0
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/net v0.57.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/text v0.41.0 // indirect
-	mvdan.cc/sh/v3 v3.13.1 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/net v0.60.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/text v0.43.0 // indirect
+	mvdan.cc/sh/v3 v3.14.1 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/storage/go.sum b/plugins/storage/go.sum
index 63c77e651..7e089b416 100644
--- a/plugins/storage/go.sum
+++ b/plugins/storage/go.sum
@@ -1,15 +1,14 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
-github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
-github.com/go-quicktest/qt v1.101.0/go.mod h1:14Bz/f7NwaXPtdYEgzsx46kqSxVwTbzVZsDC26tQJow=
+github.com/go-quicktest/qt v1.102.0 h1:HSQxCeh5YZH3EL3W39ixjtyaEhcWSXQHtHnMBzSs474=
+github.com/go-quicktest/qt v1.102.0/go.mod h1:p4lGIVX+8Wa6ZPNDvqcxq36XpUDLh42FLetFU7odllI=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
@@ -20,12 +19,12 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -34,34 +33,27 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rogpeppe/go-internal v1.15.0 h1:D0RCU5rMAp+SpgkiNdrjfJ+LX4J1M32V2NeCY7EJ6hc=
+github.com/rogpeppe/go-internal v1.15.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-mvdan.cc/sh/v3 v3.13.1 h1:DP3TfgZhDkT7lerUdnp6PTGKyxxzz6T+cOlY/xEvfWk=
-mvdan.cc/sh/v3 v3.13.1/go.mod h1:lXJ8SexMvEVcHCoDvAGLZgFJ9Wsm2sulmoNEXGhYZD0=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
+mvdan.cc/sh/v3 v3.14.1 h1:bXkhQWNHCs0KZEChF8hYS6FC+T2N9mUZLbQv9blditI=
+mvdan.cc/sh/v3 v3.14.1/go.mod h1:syYCoFET8w9tvevxiXUtY8/ICrU+l26jHmhJDra3Vwo=
diff --git a/plugins/storage/migrate.go b/plugins/storage/migrate.go
index 20c31909e..c8182497a 100644
--- a/plugins/storage/migrate.go
+++ b/plugins/storage/migrate.go
@@ -19,6 +19,12 @@ import (
 // filesystem flag file at `data/storage-registry/migrations/<app>`.
 const MigratedProperty = "legacy-mounts-migrated"
 
+// MigratedPropertyVersion is the value MigratedProperty carries once an app
+// has been through the current migration. Earlier releases wrote "true" and
+// drained only the default process-type scope, so an app still holding that
+// value is rescanned once to pick up its process-scoped `-v` lines.
+const MigratedPropertyVersion = "2"
+
 // migrationFlagDir / migrationFlagFile remain for one release cycle so
 // the upgrade-cycle helper convertLegacyMigrationFlag can drain any
 // leftover flag files into the new property.
@@ -43,7 +49,7 @@ func MigrateApp(appName string) error {
 	if err := convertLegacyMigrationFlag(appName); err != nil {
 		return err
 	}
-	if err := migrateApp(appName); err != nil {
+	if err := migrateApp(appName, true); err != nil {
 		return fmt.Errorf("storage migration failed for app %q: %w", appName, err)
 	}
 	return nil
@@ -66,10 +72,7 @@ func MigrateLegacyMounts() error {
 		if err := convertLegacyMigrationFlag(app); err != nil {
 			return err
 		}
-		if common.PropertyExists(PluginName, app, MigratedProperty) {
-			continue
-		}
-		if err := migrateApp(app); err != nil {
+		if err := migrateApp(app, false); err != nil {
 			return fmt.Errorf("storage migration failed for app %q: %w", app, err)
 		}
 	}
@@ -97,18 +100,57 @@ func convertLegacyMigrationFlag(appName string) error {
 	return os.Remove(path)
 }
 
-// migrateApp performs the per-app migration. Order is intentional: write
-// the entry, write the attachment, drain the docker-options line. Any
-// step failing aborts before drain, so the original behavior is
-// preserved on partial failure.
-func migrateApp(appName string) error {
-	deployLines, err := dockeroptions.GetDockerOptionsForPhase(appName, PhaseDeploy)
+// migrateApp performs the per-app migration across every process-type scope
+// docker-options holds options for. The default scope is migrated first: the
+// per-scope drain skips a named-scope mount that the default scope already
+// covers, which only works once the default scope's attachments exist.
+//
+// force bypasses the version gate, which is what `dokku storage:migrate <app>`
+// wants - it exists so an operator can rescan an app whose docker-options
+// state changed after the bulk install-time pass.
+func migrateApp(appName string, force bool) error {
+	migrated := common.PropertyGet(PluginName, appName, MigratedProperty)
+	if !force && migrated == MigratedPropertyVersion {
+		return nil
+	}
+
+	processTypes := []string{DefaultProcessType}
+	named, err := dockeroptions.ListProcessTypesWithOptions(appName)
 	if err != nil {
 		return err
 	}
-	runLines, err := dockeroptions.GetDockerOptionsForPhase(appName, PhaseRun)
+	processTypes = append(processTypes, named...)
+
+	drained := false
+	for _, processType := range processTypes {
+		scopeDrained, err := migrateProcessScope(appName, processType)
+		if err != nil {
+			return err
+		}
+		drained = drained || scopeDrained
+	}
+
+	// An app that never had legacy state keeps no marker at all, so
+	// `storage:report` (and future tooling) can still tell it apart from one
+	// that did and was drained. An app already carrying an older marker keeps
+	// one, advanced to the current version so it stops being rescanned.
+	if !drained && migrated == "" {
+		return nil
+	}
+
+	return common.PropertyWrite(PluginName, appName, MigratedProperty, MigratedPropertyVersion)
+}
+
+// migrateProcessScope drains one process-type scope's legacy `-v` lines into
+// attachments. Reports whether anything was drained.
+func migrateProcessScope(appName string, processType string) (bool, error) {
+	deployLines, err := dockeroptions.GetDockerOptionsForProcessPhase(appName, processType, PhaseDeploy)
 	if err != nil {
-		return err
+		return false, err
+	}
+	runLines, err := dockeroptions.GetDockerOptionsForProcessPhase(appName, processType, PhaseRun)
+	if err != nil {
+		return false, err
 	}
 
 	deployMounts := filterMountLines(deployLines)
@@ -130,22 +172,19 @@ func migrateApp(appName string) error {
 	sort.Strings(mounts)
 
 	if len(mounts) == 0 {
-		// No legacy `-v` lines for this app. Leave the marker unset so
-		// `storage:report` (and future tooling) distinguishes apps that
-		// never had legacy state from apps that did and were drained.
-		return nil
+		return false, nil
 	}
 
 	for _, mount := range mounts {
-		if err := migrateMount(appName, mount, phaseMap[mount]); err != nil {
-			return err
+		if err := migrateMount(appName, processType, mount, phaseMap[mount]); err != nil {
+			return false, err
 		}
 	}
 
-	return common.PropertyWrite(PluginName, appName, MigratedProperty, "true")
+	return true, nil
 }
 
-func migrateMount(appName string, mount string, phases []string) error {
+func migrateMount(appName string, processType string, mount string, phases []string) error {
 	parsed := ParseMountPath(mount)
 	entry := LegacyMountToEntry(mount)
 
@@ -173,32 +212,54 @@ func migrateMount(appName string, mount string, phases []string) error {
 		EntryName:     entry.Name,
 		ContainerPath: containerPath,
 		Phases:        phases,
-		ProcessType:   DefaultProcessType,
+		ProcessType:   processType,
 		Readonly:      parsed.Readonly,
 		VolumeOptions: parsed.VolumeOptions,
 	}
 
-	existing, err := LoadAttachments(appName)
+	// A named scope whose mount the default scope already covers needs no
+	// attachment of its own - the default one reaches that process anyway, and
+	// recording both would manufacture two -v flags for one container path.
+	// The docker-options line is still drained so it stops being emitted twice.
+	err := UpdateAttachments(appName, func(existing []*Attachment) ([]*Attachment, error) {
+		if attachmentExists(existing, attachment) || coveredByDefaultScope(existing, attachment) {
+			return existing, nil
+		}
+		return append(existing, attachment), nil
+	})
 	if err != nil {
 		return err
 	}
-	if !attachmentExists(existing, attachment) {
-		existing = append(existing, attachment)
-		if err := SaveAttachments(appName, existing); err != nil {
-			return err
-		}
-	}
 
 	mountedPhases := []string{}
 	for _, phase := range phases {
 		mountedPhases = append(mountedPhases, phase)
 	}
-	if err := dockeroptions.RemoveDockerOptionFromPhases(appName, mountedPhases, fmt.Sprintf("-v %s", mount)); err != nil {
+	if err := dockeroptions.RemoveDockerOptionFromProcessPhases(appName, []string{processType}, mountedPhases, fmt.Sprintf("-v %s", mount)); err != nil {
 		return err
 	}
 	return nil
 }
 
+// coveredByDefaultScope reports whether a named-scope candidate binds the same
+// entry at the same container path as an attachment already in the default
+// scope. Always false for a default-scope candidate, which is its own cover.
+func coveredByDefaultScope(attachments []*Attachment, candidate *Attachment) bool {
+	if candidate.EffectiveProcessType() == DefaultProcessType {
+		return false
+	}
+
+	for _, existing := range attachments {
+		if existing.EffectiveProcessType() != DefaultProcessType {
+			continue
+		}
+		if existing.EntryName == candidate.EntryName && existing.ContainerPath == candidate.ContainerPath {
+			return true
+		}
+	}
+	return false
+}
+
 func filterMountLines(lines []string) []string {
 	out := []string{}
 	for _, line := range lines {
@@ -222,7 +283,7 @@ func attachmentExists(attachments []*Attachment, candidate *Attachment) bool {
 	for _, existing := range attachments {
 		if existing.EntryName == candidate.EntryName &&
 			existing.ContainerPath == candidate.ContainerPath &&
-			existing.ProcessType == candidate.ProcessType {
+			existing.EffectiveProcessType() == candidate.EffectiveProcessType() {
 			return true
 		}
 	}
diff --git a/plugins/storage/migrate_test.go b/plugins/storage/migrate_test.go
index 484615f64..a25a36bf0 100644
--- a/plugins/storage/migrate_test.go
+++ b/plugins/storage/migrate_test.go
@@ -72,7 +72,7 @@ func TestMigrateAppSinglePhase(t *testing.T) {
 		"deploy": {"-v /var/log:/log", "--restart=on-failure:5"},
 	})
 
-	if err := migrateApp("alpha"); err != nil {
+	if err := migrateApp("alpha", false); err != nil {
 		t.Fatalf("migrateApp: %v", err)
 	}
 
@@ -126,7 +126,7 @@ func TestMigrateAppCrossPhaseGroupsIntoOneAttachment(t *testing.T) {
 		"run":    {"-v /data:/d"},
 	})
 
-	if err := migrateApp("alpha"); err != nil {
+	if err := migrateApp("alpha", false); err != nil {
 		t.Fatalf("migrateApp: %v", err)
 	}
 
@@ -158,7 +158,7 @@ func TestMigrateAppPreservesVolumeOptions(t *testing.T) {
 		"deploy": {"-v /ro:/r:ro", "-v /label:/l:Z"},
 	})
 
-	if err := migrateApp("alpha"); err != nil {
+	if err := migrateApp("alpha", false); err != nil {
 		t.Fatalf("migrateApp: %v", err)
 	}
 
@@ -190,7 +190,7 @@ func TestMigrateAppIdempotent(t *testing.T) {
 		"deploy": {"-v /var/log:/log"},
 	})
 
-	if err := migrateApp("alpha"); err != nil {
+	if err := migrateApp("alpha", false); err != nil {
 		t.Fatalf("first migrateApp: %v", err)
 	}
 
@@ -202,7 +202,7 @@ func TestMigrateAppIdempotent(t *testing.T) {
 	if err := common.PropertyListWrite("docker-options", "alpha", "_default_.deploy", []string{"-v /var/log:/log"}); err != nil {
 		t.Fatalf("re-stage: %v", err)
 	}
-	if err := migrateApp("alpha"); err != nil {
+	if err := migrateApp("alpha", false); err != nil {
 		t.Fatalf("second migrateApp: %v", err)
 	}
 
@@ -280,7 +280,7 @@ func TestMigrateAppRefusesEntryNameCollision(t *testing.T) {
 		"deploy": {"-v /var/log:/log"},
 	})
 
-	if err := migrateApp("alpha"); err == nil {
+	if err := migrateApp("alpha", false); err == nil {
 		t.Fatalf("expected migrateApp to error on entry name collision")
 	}
 
@@ -301,7 +301,7 @@ func TestMigrateAppChownsLegacyEntryFiles(t *testing.T) {
 		"deploy": {"-v /var/log:/log"},
 	})
 
-	if err := migrateApp("alpha"); err != nil {
+	if err := migrateApp("alpha", false); err != nil {
 		t.Fatalf("migrateApp: %v", err)
 	}
 
@@ -334,7 +334,7 @@ func TestMigrateAppNoMountsDoesNotMarkMigrated(t *testing.T) {
 		"deploy": {"--restart=on-failure:5"},
 	})
 
-	if err := migrateApp("alpha"); err != nil {
+	if err := migrateApp("alpha", false); err != nil {
 		t.Fatalf("migrateApp: %v", err)
 	}
 
@@ -370,25 +370,28 @@ func TestMigrateLegacyMountsConvertsLegacyFlagFile(t *testing.T) {
 		t.Fatalf("MigrateLegacyMounts: %v", err)
 	}
 
+	// The flag file converts to the old "true" value, which the version gate
+	// then treats as stale and rescans, leaving the marker at the current
+	// version rather than at the value the flag file carried.
 	got := common.PropertyGetDefault(PluginName, "alpha", MigratedProperty, "")
-	if got != "true" {
-		t.Errorf("legacy-mounts-migrated = %q, want %q", got, "true")
+	if got != MigratedPropertyVersion {
+		t.Errorf("legacy-mounts-migrated = %q, want %q", got, MigratedPropertyVersion)
 	}
 	if _, err := os.Stat(flagPath); !os.IsNotExist(err) {
 		t.Errorf("expected flag file gone, got err=%v", err)
 	}
 }
 
-// TestMigrateLegacyMountsRespectsExistingProperty confirms that the
-// property is the gate: an app with a `-v` line is skipped when the
-// property is already set, leaving the legacy line in docker-options.
-func TestMigrateLegacyMountsRespectsExistingProperty(t *testing.T) {
+// TestMigrateLegacyMountsRespectsCurrentMarker confirms that the marker is the
+// gate: an app with a `-v` line is skipped when it already carries the current
+// version, leaving the legacy line in docker-options.
+func TestMigrateLegacyMountsRespectsCurrentMarker(t *testing.T) {
 	_, dokkuRoot := setupMigrationEnv(t)
 	stageApp(t, dokkuRoot, "alpha", map[string][]string{
 		"deploy": {"-v /var/log:/log"},
 	})
 
-	if err := common.PropertyWrite(PluginName, "alpha", MigratedProperty, "true"); err != nil {
+	if err := common.PropertyWrite(PluginName, "alpha", MigratedProperty, MigratedPropertyVersion); err != nil {
 		t.Fatalf("seed property: %v", err)
 	}
 
@@ -405,7 +408,40 @@ func TestMigrateLegacyMountsRespectsExistingProperty(t *testing.T) {
 		t.Fatalf("LoadAttachments: %v", err)
 	}
 	if len(atts) != 0 {
-		t.Errorf("expected 0 attachments (property gated migration), got %d", len(atts))
+		t.Errorf("expected 0 attachments (marker gated migration), got %d", len(atts))
+	}
+}
+
+// TestMigrateLegacyMountsRescansStaleMarker is the other half of that gate.
+// Releases before process-scoped migration wrote "true" and drained only the
+// default scope, so an app still holding that value has to be rescanned once
+// rather than skipped forever.
+func TestMigrateLegacyMountsRescansStaleMarker(t *testing.T) {
+	_, dokkuRoot := setupMigrationEnv(t)
+	stageApp(t, dokkuRoot, "alpha", map[string][]string{
+		"deploy": {"-v /var/log:/log"},
+	})
+
+	if err := common.PropertyWrite(PluginName, "alpha", MigratedProperty, "true"); err != nil {
+		t.Fatalf("seed property: %v", err)
+	}
+
+	if err := MigrateLegacyMounts(); err != nil {
+		t.Fatalf("MigrateLegacyMounts: %v", err)
+	}
+
+	if got := phaseOptions(t, "alpha", "deploy"); len(got) != 0 {
+		t.Errorf("expected -v line drained, got %v", got)
+	}
+	atts, err := LoadAttachments("alpha")
+	if err != nil {
+		t.Fatalf("LoadAttachments: %v", err)
+	}
+	if len(atts) != 1 {
+		t.Fatalf("expected 1 attachment, got %d", len(atts))
+	}
+	if got := common.PropertyGetDefault(PluginName, "alpha", MigratedProperty, ""); got != MigratedPropertyVersion {
+		t.Errorf("legacy-mounts-migrated = %q, want %q", got, MigratedPropertyVersion)
 	}
 }
 
@@ -424,3 +460,98 @@ func equalSorted(a, b []string) bool {
 	}
 	return true
 }
+
+// stageProcessOptions seeds a named process-type scope's docker-options
+// property file for one phase, the shape `docker-options:add --process worker`
+// leaves behind.
+func stageProcessOptions(t *testing.T, app string, processType string, phase string, lines []string) {
+	t.Helper()
+	key := processType + "." + phase
+	if err := common.PropertyListWrite("docker-options", app, key, lines); err != nil {
+		t.Fatalf("PropertyListWrite: %v", err)
+	}
+}
+
+func processPhaseOptions(t *testing.T, app string, processType string, phase string) []string {
+	t.Helper()
+	got, err := dockeroptions.GetDockerOptionsForProcessPhase(app, processType, phase)
+	if err != nil {
+		t.Fatalf("GetDockerOptionsForProcessPhase %s/%s/%s: %v", app, processType, phase, err)
+	}
+	return got
+}
+
+// TestMigrateAppDrainsProcessScopedMounts is the migration half of #9059. A
+// `-v` line registered under `docker-options:add --process worker` used to be
+// invisible to storage forever, because the drain only read the default scope.
+func TestMigrateAppDrainsProcessScopedMounts(t *testing.T) {
+	_, dokkuRoot := setupMigrationEnv(t)
+	stageApp(t, dokkuRoot, "alpha", map[string][]string{
+		"deploy": {"-v /var/log:/log"},
+	})
+	stageProcessOptions(t, "alpha", "worker", "deploy", []string{"-v /var/spool:/spool", "--restart=on-failure:5"})
+
+	if err := migrateApp("alpha", false); err != nil {
+		t.Fatalf("migrateApp: %v", err)
+	}
+
+	attachments, err := LoadAttachments("alpha")
+	if err != nil {
+		t.Fatalf("LoadAttachments: %v", err)
+	}
+	if len(attachments) != 2 {
+		t.Fatalf("expected 2 attachments, got %d", len(attachments))
+	}
+
+	scopes := map[string]string{}
+	for _, attachment := range attachments {
+		scopes[attachment.ContainerPath] = attachment.EffectiveProcessType()
+	}
+	if scopes["/log"] != DefaultProcessType {
+		t.Errorf("expected /log in the default scope, got %q", scopes["/log"])
+	}
+	if scopes["/spool"] != "worker" {
+		t.Errorf("expected /spool scoped to worker, got %q", scopes["/spool"])
+	}
+
+	// The drained line goes, the non-mount option in the same scope stays.
+	if got := processPhaseOptions(t, "alpha", "worker", "deploy"); !equalSorted(got, []string{"--restart=on-failure:5"}) {
+		t.Errorf("expected only the non-mount option left, got %v", got)
+	}
+}
+
+// TestMigrateAppSkipsProcessScopeCoveredByDefault covers an app that declared
+// the same mount twice, once globally and once for a process. The default
+// attachment already reaches that process, so recording the second one would
+// emit two -v flags for one container path.
+func TestMigrateAppSkipsProcessScopeCoveredByDefault(t *testing.T) {
+	_, dokkuRoot := setupMigrationEnv(t)
+	stageApp(t, dokkuRoot, "alpha", map[string][]string{
+		"deploy": {"-v /var/log:/log"},
+	})
+	stageProcessOptions(t, "alpha", "worker", "deploy", []string{"-v /var/log:/log"})
+
+	if err := migrateApp("alpha", false); err != nil {
+		t.Fatalf("migrateApp: %v", err)
+	}
+
+	attachments, err := LoadAttachments("alpha")
+	if err != nil {
+		t.Fatalf("LoadAttachments: %v", err)
+	}
+	if len(attachments) != 1 {
+		t.Fatalf("expected 1 attachment, got %d", len(attachments))
+	}
+	if attachments[0].EffectiveProcessType() != DefaultProcessType {
+		t.Errorf("expected the surviving attachment in the default scope, got %q", attachments[0].EffectiveProcessType())
+	}
+
+	// Both lines are still drained, so docker-options stops emitting the
+	// duplicate alongside the storage attachment.
+	if got := processPhaseOptions(t, "alpha", "worker", "deploy"); len(got) != 0 {
+		t.Errorf("expected the worker scope drained, got %v", got)
+	}
+	if got := phaseOptions(t, "alpha", "deploy"); len(got) != 0 {
+		t.Errorf("expected the default scope drained, got %v", got)
+	}
+}
diff --git a/plugins/storage/mounts_test.go b/plugins/storage/mounts_test.go
new file mode 100644
index 000000000..108d79b5a
--- /dev/null
+++ b/plugins/storage/mounts_test.go
@@ -0,0 +1,883 @@
+package storage
+
+import (
+	"testing"
+
+	. "github.com/onsi/gomega"
+)
+
+func TestParseMountSpec(t *testing.T) {
+	RegisterTestingT(t)
+
+	parsed, err := parseMountSpec("demo-data:/app/storage")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(parsed.EntryName).To(Equal("demo-data"))
+	Expect(parsed.ContainerPath).To(Equal("/app/storage"))
+	Expect(parsed.Readonly).To(BeFalse())
+	Expect(parsed.VolumeOptions).To(BeEmpty())
+
+	parsed, err = parseMountSpec("demo-data:/app/storage:ro,noexec,nosuid")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(parsed.Readonly).To(BeTrue())
+	Expect(parsed.VolumeOptions).To(Equal("noexec,nosuid"))
+
+	// A trailing colon is the no-options case, not an empty option.
+	parsed, err = parseMountSpec("demo-data:/app/storage:")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(parsed.VolumeOptions).To(BeEmpty())
+	Expect(parsed.Phases).To(Equal([]string{PhaseDeploy, PhaseRun}))
+
+	for _, spec := range []string{"demo-data", ":/app/storage", ""} {
+		_, err := parseMountSpec(spec)
+		Expect(err).To(HaveOccurred(), "expected %q to be rejected", spec)
+		Expect(err.Error()).To(ContainSubstring("Invalid mount specified"))
+	}
+}
+
+// TestParseMountSpecTokens covers the key=value tokens the option list carries
+// on top of the bare docker options it has always passed through. Order within
+// the list is not significant, so the cases deliberately mix the two.
+func TestParseMountSpecTokens(t *testing.T) {
+	RegisterTestingT(t)
+
+	for _, testCase := range []struct {
+		spec     string
+		expected mountSpec
+	}{
+		{
+			spec:     "demo-data:/app/storage",
+			expected: mountSpec{Phases: []string{PhaseDeploy, PhaseRun}},
+		},
+		{
+			spec:     "demo-data:/app/storage:rw",
+			expected: mountSpec{Phases: []string{PhaseDeploy, PhaseRun}},
+		},
+		{
+			spec:     "demo-data:/app/storage:volume-subpath=uploads",
+			expected: mountSpec{Phases: []string{PhaseDeploy, PhaseRun}, Subpath: "uploads"},
+		},
+		{
+			spec:     "demo-data:/app/storage:volume-chown=herokuish",
+			expected: mountSpec{Phases: []string{PhaseDeploy, PhaseRun}, VolumeChown: "herokuish"},
+		},
+		{
+			spec:     "demo-data:/app/storage:phase=deploy",
+			expected: mountSpec{Phases: []string{PhaseDeploy}},
+		},
+		{
+			spec:     "demo-data:/app/storage:phase=deploy,phase=run",
+			expected: mountSpec{Phases: []string{PhaseDeploy, PhaseRun}},
+		},
+		{
+			spec: "demo-data:/app/storage:ro,Z,volume-subpath=uploads,volume-chown=herokuish",
+			expected: mountSpec{
+				Phases:        []string{PhaseDeploy, PhaseRun},
+				Subpath:       "uploads",
+				Readonly:      true,
+				VolumeOptions: "Z",
+				VolumeChown:   "herokuish",
+			},
+		},
+		{
+			// The same fields written in a different order, with the
+			// remaining bare options keeping the order they were given in.
+			spec: "demo-data:/app/storage:volume-chown=herokuish,noexec,phase=run,nosuid,ro,volume-subpath=uploads",
+			expected: mountSpec{
+				Phases:        []string{PhaseRun},
+				Subpath:       "uploads",
+				Readonly:      true,
+				VolumeOptions: "noexec,nosuid",
+				VolumeChown:   "herokuish",
+			},
+		},
+	} {
+		parsed, err := parseMountSpec(testCase.spec)
+		Expect(err).NotTo(HaveOccurred(), "expected %q to be accepted", testCase.spec)
+
+		expected := testCase.expected
+		expected.EntryName = "demo-data"
+		expected.ContainerPath = "/app/storage"
+		Expect(parsed).To(Equal(expected), "parsing %q", testCase.spec)
+	}
+}
+
+// TestParseMountSpecNormalizesPhaseOrder pins phases to a canonical order, so
+// two specs naming the same phases store identical JSON and render identically
+// in storage:report rather than looking like a change to a declarative caller.
+func TestParseMountSpecNormalizesPhaseOrder(t *testing.T) {
+	RegisterTestingT(t)
+
+	for _, spec := range []string{
+		"demo-data:/app/storage:phase=run,phase=deploy",
+		"demo-data:/app/storage:phase=deploy,phase=run",
+	} {
+		parsed, err := parseMountSpec(spec)
+		Expect(err).NotTo(HaveOccurred())
+		Expect(parsed.Phases).To(Equal([]string{PhaseDeploy, PhaseRun}), "parsing %q", spec)
+	}
+}
+
+// TestParseMountSpecAllowsSeparatorsInValues documents that only a comma ends
+// a token value: the spec splits on the first two colons and a token on its
+// first equals sign, so both characters survive inside a value.
+func TestParseMountSpecAllowsSeparatorsInValues(t *testing.T) {
+	RegisterTestingT(t)
+
+	parsed, err := parseMountSpec("demo-data:/app/storage:volume-subpath=a:b")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(parsed.Subpath).To(Equal("a:b"))
+
+	parsed, err = parseMountSpec("demo-data:/app/storage:volume-subpath=a=b")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(parsed.Subpath).To(Equal("a=b"))
+}
+
+func TestParseMountSpecRejectsInvalidTokens(t *testing.T) {
+	RegisterTestingT(t)
+
+	for _, testCase := range []struct {
+		spec     string
+		contains string
+	}{
+		{"demo-data:/app/storage:volume-subpth=uploads", `specifies unknown key "volume-subpth"`},
+		{"demo-data:/app/storage:volume-subpath=", "has an empty value for volume-subpath"},
+		{"demo-data:/app/storage:volume-chown=", "has an empty value for volume-chown"},
+		{"demo-data:/app/storage:phase=", "has an empty value for phase"},
+		{"demo-data:/app/storage:ro,,Z", "has an empty mount option"},
+		{"demo-data:/app/storage:volume-subpath=a,volume-subpath=b", "specifies volume-subpath more than once"},
+		{"demo-data:/app/storage:volume-chown=root,volume-chown=false", "specifies volume-chown more than once"},
+		{"demo-data:/app/storage:phase=run,phase=run", "specifies phase run more than once"},
+		{"demo-data:/app/storage:ro,rw", "sets both ro and rw"},
+		{"demo-data:/app/storage:phase=build", `specifies unsupported phase "build"`},
+		{"demo-data:/app/storage:volume-chown=bogus", "Unsupported chown permissions"},
+	} {
+		_, err := parseMountSpec(testCase.spec)
+		Expect(err).To(HaveOccurred(), "expected %q to be rejected", testCase.spec)
+		Expect(err.Error()).To(ContainSubstring(testCase.contains), "rejecting %q", testCase.spec)
+		// Every rejection names the spec it came from, since a --replace
+		// call can carry any number of them.
+		Expect(err.Error()).To(ContainSubstring(testCase.spec), "rejecting %q", testCase.spec)
+	}
+}
+
+func TestValidateChownOption(t *testing.T) {
+	RegisterTestingT(t)
+
+	for _, chownFlag := range []string{"", "herokuish", "heroku", "paketo", "packeto", "root", "false", "0", "1000", "65535"} {
+		Expect(ValidateChownOption(chownFlag)).To(Succeed(), "expected %q to be accepted", chownFlag)
+	}
+
+	for _, chownFlag := range []string{"bogus", "-1", "65536", "1.5", "herokuish "} {
+		err := ValidateChownOption(chownFlag)
+		Expect(err).To(HaveOccurred(), "expected %q to be rejected", chownFlag)
+		Expect(err.Error()).To(ContainSubstring("Unsupported chown permissions"))
+	}
+}
+
+func TestCommandMountRejectsInvalidVolumeChown(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+	stageDockerLocalEntry(t, "demo-data")
+
+	err := CommandMount(CommandMountInput{
+		AppName:      "demo",
+		NameOrPath:   "demo-data",
+		ContainerDir: "/app/storage",
+		VolumeChown:  "bogus",
+	})
+	Expect(err).To(HaveOccurred())
+	Expect(err.Error()).To(ContainSubstring("Unsupported chown permissions"))
+
+	attachments, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(BeEmpty())
+}
+
+func TestCommandMountReplaceReplacesTheScope(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+	stageDockerLocalEntry(t, "demo-data")
+	stageDockerLocalEntry(t, "demo-cache")
+	stageDockerLocalEntry(t, "demo-logs")
+
+	Expect(CommandMount(CommandMountInput{
+		AppName:      "demo",
+		NameOrPath:   "demo-data",
+		ContainerDir: "/app/storage",
+	})).To(Succeed())
+
+	Expect(CommandMount(CommandMountInput{
+		AppName:     "demo",
+		Replace:     true,
+		Specs:       []string{"demo-cache:/cache", "demo-logs:/logs"},
+		ProcessType: DefaultProcessType,
+	})).To(Succeed())
+
+	attachments, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(HaveLen(2))
+	Expect(attachments[0].EntryName).To(Equal("demo-cache"))
+	Expect(attachments[0].ContainerPath).To(Equal("/cache"))
+	Expect(attachments[0].Phases).To(Equal([]string{PhaseDeploy, PhaseRun}))
+	Expect(attachments[0].ProcessType).To(Equal(DefaultProcessType))
+	Expect(attachments[1].EntryName).To(Equal("demo-logs"))
+}
+
+func TestCommandMountReplaceLeavesOtherProcessTypesUntouched(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+	stageDockerLocalEntry(t, "demo-data")
+	stageDockerLocalEntry(t, "demo-cache")
+	stageDockerLocalEntry(t, "demo-logs")
+
+	Expect(CommandMount(CommandMountInput{
+		AppName:      "demo",
+		NameOrPath:   "demo-data",
+		ContainerDir: "/app/storage",
+	})).To(Succeed())
+
+	Expect(CommandMount(CommandMountInput{
+		AppName:      "demo",
+		NameOrPath:   "demo-cache",
+		ContainerDir: "/cache",
+		ProcessType:  "web",
+	})).To(Succeed())
+
+	Expect(CommandMount(CommandMountInput{
+		AppName: "demo",
+		Replace: true,
+		Specs:   []string{"demo-logs:/logs"},
+	})).To(Succeed())
+
+	attachments, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(HaveLen(2))
+	Expect(attachments[0].EntryName).To(Equal("demo-cache"))
+	Expect(attachments[0].ProcessType).To(Equal("web"))
+	Expect(attachments[1].EntryName).To(Equal("demo-logs"))
+	Expect(attachments[1].ProcessType).To(Equal(DefaultProcessType))
+}
+
+// TestCommandMountReplaceVariesFieldsPerSpec is the point of the token
+// grammar: every mount-time field except the process type is declared by the
+// spec that carries it, so one call can give two mounts different values.
+func TestCommandMountReplaceVariesFieldsPerSpec(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+	stageDockerLocalEntry(t, "demo-data")
+	stageDockerLocalEntry(t, "demo-cache")
+
+	Expect(CommandMount(CommandMountInput{
+		AppName: "demo",
+		Replace: true,
+		Specs: []string{
+			"demo-data:/app/storage:Z,volume-subpath=uploads,volume-chown=herokuish",
+			"demo-cache:/cache:ro,noexec,phase=deploy",
+		},
+		ProcessType: "web",
+	})).To(Succeed())
+
+	attachments, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(HaveLen(2))
+
+	// --process-type is the one field that still scopes the whole call.
+	Expect(attachments[0].ProcessType).To(Equal("web"))
+	Expect(attachments[1].ProcessType).To(Equal("web"))
+
+	Expect(attachments[0].Phases).To(Equal([]string{PhaseDeploy, PhaseRun}))
+	Expect(attachments[0].Subpath).To(Equal("uploads"))
+	Expect(attachments[0].VolumeChown).To(Equal("herokuish"))
+	Expect(attachments[0].VolumeOptions).To(Equal("Z"))
+	Expect(attachments[0].Readonly).To(BeFalse())
+
+	Expect(attachments[1].Phases).To(Equal([]string{PhaseDeploy}))
+	Expect(attachments[1].Subpath).To(BeEmpty())
+	Expect(attachments[1].VolumeChown).To(BeEmpty())
+	Expect(attachments[1].VolumeOptions).To(Equal("noexec"))
+	Expect(attachments[1].Readonly).To(BeTrue())
+}
+
+// TestCommandMountReplaceReadonlyIsPerSpec covers the ro/rw pair, including
+// that rw is consumed into the attachment rather than left in VolumeOptions,
+// where it would be handed to docker as a mount option.
+func TestCommandMountReplaceReadonlyIsPerSpec(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+	stageDockerLocalEntry(t, "demo-data")
+	stageDockerLocalEntry(t, "demo-cache")
+	stageDockerLocalEntry(t, "demo-logs")
+
+	Expect(CommandMount(CommandMountInput{
+		AppName: "demo",
+		Replace: true,
+		Specs:   []string{"demo-data:/app/storage:ro", "demo-cache:/cache:rw", "demo-logs:/logs"},
+	})).To(Succeed())
+
+	attachments, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(HaveLen(3))
+	Expect(attachments[0].Readonly).To(BeTrue())
+	Expect(attachments[1].Readonly).To(BeFalse())
+	Expect(attachments[1].VolumeOptions).To(BeEmpty())
+	Expect(attachments[2].Readonly).To(BeFalse())
+}
+
+// TestCommandMountReplaceDefaultsPhasesWithoutAToken pins the default a spec
+// without a phase token gets, which is the same pair a mount has always had.
+func TestCommandMountReplaceDefaultsPhasesWithoutAToken(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+	stageDockerLocalEntry(t, "demo-data")
+
+	Expect(CommandMount(CommandMountInput{
+		AppName: "demo",
+		Replace: true,
+		Specs:   []string{"demo-data:/app/storage:Z"},
+	})).To(Succeed())
+
+	attachments, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(HaveLen(1))
+	Expect(attachments[0].Phases).To(Equal([]string{PhaseDeploy, PhaseRun}))
+}
+
+// TestCommandMountReplaceRejectsMountTimeFlags covers the other half of "one
+// spelling per field": a flag that a token now expresses is refused rather
+// than silently acting as a default. The --volume-options row is the case that
+// was previously accepted and then dropped on the floor.
+func TestCommandMountReplaceRejectsMountTimeFlags(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+	stageDockerLocalEntry(t, "demo-data")
+
+	for _, testCase := range []struct {
+		name     string
+		input    CommandMountInput
+		contains string
+	}{
+		{"--phase", CommandMountInput{Phases: []string{PhaseDeploy}}, "The --phase flag cannot be used with --replace; set phase=deploy in the mount spec instead"},
+		{"--volume-subpath", CommandMountInput{Subpath: "uploads"}, "The --volume-subpath flag cannot be used with --replace; set volume-subpath=<path> in the mount spec instead"},
+		{"--volume-readonly", CommandMountInput{Readonly: true}, "The --volume-readonly flag cannot be used with --replace; set ro in the mount spec instead"},
+		{"--volume-chown", CommandMountInput{VolumeChown: "herokuish"}, "The --volume-chown flag cannot be used with --replace; set volume-chown=<option> in the mount spec instead"},
+		{"--volume-options", CommandMountInput{VolumeOptions: "Z"}, "The --volume-options flag cannot be used with --replace; set the option as a bare token in the mount spec instead"},
+	} {
+		input := testCase.input
+		input.AppName = "demo"
+		input.Replace = true
+		input.Specs = []string{"demo-data:/app/storage"}
+
+		err := CommandMount(input)
+		Expect(err).To(HaveOccurred(), "expected %s to be rejected", testCase.name)
+		Expect(err.Error()).To(Equal(testCase.contains), "rejecting %s", testCase.name)
+
+		attachments, err := LoadAttachments("demo")
+		Expect(err).NotTo(HaveOccurred())
+		Expect(attachments).To(BeEmpty(), "rejecting %s wrote an attachment", testCase.name)
+	}
+}
+
+// TestCommandMountReplaceValidatesTokensPerSpec keeps the all-or-nothing
+// contract over the failures the token grammar adds: a bad token in a later
+// spec leaves an earlier one unwritten and the stored set as it was.
+func TestCommandMountReplaceValidatesTokensPerSpec(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+	stageDockerLocalEntry(t, "demo-data")
+	stageDockerLocalEntry(t, "demo-cache")
+
+	Expect(CommandMount(CommandMountInput{
+		AppName:      "demo",
+		NameOrPath:   "demo-data",
+		ContainerDir: "/app/storage",
+	})).To(Succeed())
+
+	for _, testCase := range []struct {
+		spec     string
+		contains string
+	}{
+		{"demo-cache:/cache:volume-chown=bogus", "Unsupported chown permissions"},
+		{"demo-cache:/cache:phase=build", `specifies unsupported phase "build"`},
+		{"demo-cache:/cache:volume-subpth=uploads", `specifies unknown key "volume-subpth"`},
+	} {
+		err := CommandMount(CommandMountInput{
+			AppName: "demo",
+			Replace: true,
+			Specs:   []string{"demo-cache:/cache2", testCase.spec},
+		})
+		Expect(err).To(HaveOccurred(), "expected %q to be rejected", testCase.spec)
+		Expect(err.Error()).To(ContainSubstring(testCase.contains))
+		Expect(err.Error()).To(ContainSubstring(testCase.spec))
+
+		attachments, err := LoadAttachments("demo")
+		Expect(err).NotTo(HaveOccurred())
+		Expect(attachments).To(HaveLen(1), "rejecting %q changed the stored set", testCase.spec)
+		Expect(attachments[0].EntryName).To(Equal("demo-data"))
+	}
+}
+
+// TestCommandMountReplaceRejectsPathHeldByAnotherScope covers the scopes a
+// --replace call does not replace. The declared set is already unique on
+// container path within its own scope, but a path held by a different process
+// type would still collide at deploy time.
+func TestCommandMountReplaceRejectsPathHeldByAnotherScope(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+	stageDockerLocalEntry(t, "demo-data")
+	stageDockerLocalEntry(t, "demo-cache")
+
+	Expect(CommandMount(CommandMountInput{
+		AppName:      "demo",
+		NameOrPath:   "demo-data",
+		ContainerDir: "/app/storage",
+		ProcessType:  "web",
+	})).To(Succeed())
+
+	err := CommandMount(CommandMountInput{
+		AppName: "demo",
+		Replace: true,
+		Specs:   []string{"demo-cache:/app/storage"},
+	})
+	Expect(err).To(HaveOccurred())
+	Expect(err.Error()).To(ContainSubstring("Container path /app/storage on app demo is already mounted by storage entry demo-data for process type web"))
+
+	// The rejected call leaves the stored set exactly as it was.
+	attachments, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(HaveLen(1))
+	Expect(attachments[0].EntryName).To(Equal("demo-data"))
+	Expect(attachments[0].ProcessType).To(Equal("web"))
+}
+
+// TestCommandMountReplaceAllowsPathInAReplacedScope is the other side of it:
+// the scope being replaced is dropped before the check, so re-declaring a path
+// that scope already held is the ordinary idempotent case, not a conflict.
+func TestCommandMountReplaceAllowsPathInAReplacedScope(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+	stageDockerLocalEntry(t, "demo-data")
+	stageDockerLocalEntry(t, "demo-cache")
+
+	Expect(CommandMount(CommandMountInput{
+		AppName:      "demo",
+		NameOrPath:   "demo-data",
+		ContainerDir: "/app/storage",
+	})).To(Succeed())
+
+	Expect(CommandMount(CommandMountInput{
+		AppName: "demo",
+		Replace: true,
+		Specs:   []string{"demo-cache:/app/storage"},
+	})).To(Succeed())
+
+	attachments, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(HaveLen(1))
+	Expect(attachments[0].EntryName).To(Equal("demo-cache"))
+}
+
+func TestCommandMountReplaceIsIdempotent(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+	stageDockerLocalEntry(t, "demo-data")
+	stageDockerLocalEntry(t, "demo-cache")
+
+	input := CommandMountInput{
+		AppName: "demo",
+		Replace: true,
+		Specs:   []string{"demo-data:/app/storage", "demo-cache:/cache"},
+	}
+
+	Expect(CommandMount(input)).To(Succeed())
+	first, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+
+	Expect(CommandMount(input)).To(Succeed())
+	second, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+
+	Expect(second).To(Equal(first))
+}
+
+func TestCommandMountReplaceRejectsEmptySpecs(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+	stageDockerLocalEntry(t, "demo-data")
+
+	Expect(CommandMount(CommandMountInput{
+		AppName:      "demo",
+		NameOrPath:   "demo-data",
+		ContainerDir: "/app/storage",
+	})).To(Succeed())
+
+	err := CommandMount(CommandMountInput{AppName: "demo", Replace: true})
+	Expect(err).To(HaveOccurred())
+	Expect(err.Error()).To(Equal("Must specify at least one mount, use storage:unmount --all to remove all mounts"))
+
+	attachments, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(HaveLen(1))
+}
+
+func TestCommandMountReplaceRejectsContainerDirFlag(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+	stageDockerLocalEntry(t, "demo-data")
+
+	err := CommandMount(CommandMountInput{
+		AppName:      "demo",
+		Replace:      true,
+		Specs:        []string{"demo-data:/app/storage"},
+		ContainerDir: "/app/storage",
+	})
+	Expect(err).To(HaveOccurred())
+	Expect(err.Error()).To(Equal("The --container-dir flag cannot be used with --replace"))
+}
+
+func TestCommandMountReplaceRejectsDuplicateContainerPath(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+	stageDockerLocalEntry(t, "demo-data")
+	stageDockerLocalEntry(t, "demo-cache")
+
+	err := CommandMount(CommandMountInput{
+		AppName: "demo",
+		Replace: true,
+		Specs:   []string{"demo-data:/app/storage", "demo-cache:/app/storage"},
+	})
+	Expect(err).To(HaveOccurred())
+	Expect(err.Error()).To(Equal("Container path /app/storage is specified more than once"))
+
+	attachments, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(BeEmpty())
+}
+
+func TestCommandMountReplaceLeavesStoreUntouchedOnInvalidSpec(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+	stageDockerLocalEntry(t, "demo-data")
+	stageDockerLocalEntry(t, "demo-cache")
+
+	Expect(CommandMount(CommandMountInput{
+		AppName:      "demo",
+		NameOrPath:   "demo-data",
+		ContainerDir: "/app/storage",
+	})).To(Succeed())
+
+	err := CommandMount(CommandMountInput{
+		AppName: "demo",
+		Replace: true,
+		Specs:   []string{"demo-cache:/cache", "demo-missing:/missing"},
+	})
+	Expect(err).To(HaveOccurred())
+	Expect(err.Error()).To(ContainSubstring(`storage entry "demo-missing" does not exist`))
+
+	attachments, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(HaveLen(1))
+	Expect(attachments[0].EntryName).To(Equal("demo-data"))
+}
+
+func TestCommandMountReplaceRejectsRelativeContainerPath(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+	stageDockerLocalEntry(t, "demo-data")
+
+	err := CommandMount(CommandMountInput{
+		AppName: "demo",
+		Replace: true,
+		Specs:   []string{"demo-data:app/storage"},
+	})
+	Expect(err).To(HaveOccurred())
+	Expect(err.Error()).To(ContainSubstring("must be absolute"))
+
+	attachments, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(BeEmpty())
+}
+
+func TestCommandMountReplaceRejectsSchedulerMismatch(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+
+	Expect(SaveEntry(&Entry{
+		Name:      "demo-pvc",
+		Scheduler: SchedulerK3s,
+	})).To(Succeed())
+
+	err := CommandMount(CommandMountInput{
+		AppName: "demo",
+		Replace: true,
+		Specs:   []string{"demo-pvc:/data"},
+	})
+	Expect(err).To(HaveOccurred())
+	Expect(err.Error()).To(Equal(`storage entry "demo-pvc" is scheduler=k3s but cannot be mounted on a docker-local app; recreate it with --scheduler docker-local`))
+}
+
+func TestCommandMountReplaceRejectsUnregisteredEntry(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+
+	err := CommandMount(CommandMountInput{
+		AppName: "demo",
+		Replace: true,
+		Specs:   []string{"demo-data:/app/storage"},
+	})
+	Expect(err).To(HaveOccurred())
+	Expect(err.Error()).To(ContainSubstring(`storage entry "demo-data" does not exist`))
+}
+
+func TestCommandMountReplaceAcceptsLegacyHostPath(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+
+	Expect(CommandMount(CommandMountInput{
+		AppName: "demo",
+		Replace: true,
+		Specs:   []string{"/var/lib/dokku/data/storage/shared:/app/shared"},
+	})).To(Succeed())
+
+	attachments, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(HaveLen(1))
+	Expect(attachments[0].ContainerPath).To(Equal("/app/shared"))
+
+	expected := LegacyMountToEntry("/var/lib/dokku/data/storage/shared:/app/shared")
+	Expect(attachments[0].EntryName).To(Equal(expected.Name))
+	Expect(EntryExists(expected.Name)).To(BeTrue())
+}
+
+// TestCommandMountReplaceAcceptsLegacyHostPathWithTokens guards the entry
+// hash: LegacyMountToEntry only ever sees the first colon field, so a token in
+// the third one must not move a host path onto a different legacy-<hash>
+// entry than the same path without it.
+func TestCommandMountReplaceAcceptsLegacyHostPathWithTokens(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+
+	Expect(CommandMount(CommandMountInput{
+		AppName: "demo",
+		Replace: true,
+		Specs:   []string{"/var/lib/dokku/data/storage/shared:/app/shared:ro,volume-subpath=uploads"},
+	})).To(Succeed())
+
+	attachments, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(HaveLen(1))
+	Expect(attachments[0].Subpath).To(Equal("uploads"))
+	Expect(attachments[0].Readonly).To(BeTrue())
+
+	expected := LegacyMountToEntry("/var/lib/dokku/data/storage/shared:/app/shared")
+	Expect(attachments[0].EntryName).To(Equal(expected.Name))
+	Expect(EntryExists(expected.Name)).To(BeTrue())
+}
+
+func TestCommandUnmountRemovesMultipleMounts(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+	stageDockerLocalEntry(t, "demo-data")
+	stageDockerLocalEntry(t, "demo-cache")
+	stageDockerLocalEntry(t, "demo-logs")
+
+	Expect(CommandMount(CommandMountInput{
+		AppName: "demo",
+		Replace: true,
+		Specs:   []string{"demo-data:/app/storage", "demo-cache:/cache", "demo-logs:/logs"},
+	})).To(Succeed())
+
+	Expect(CommandUnmount(CommandUnmountInput{
+		AppName: "demo",
+		Mounts:  []string{"demo-data", "demo-logs"},
+	})).To(Succeed())
+
+	attachments, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(HaveLen(1))
+	Expect(attachments[0].EntryName).To(Equal("demo-cache"))
+}
+
+func TestCommandUnmountAcceptsEntryColonContainerPath(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+	stageDockerLocalEntry(t, "demo-data")
+
+	Expect(CommandMount(CommandMountInput{
+		AppName: "demo",
+		Replace: true,
+		Specs:   []string{"demo-data:/app/storage", "demo-data:/app/uploads"},
+	})).To(Succeed())
+
+	Expect(CommandUnmount(CommandUnmountInput{
+		AppName: "demo",
+		Mounts:  []string{"demo-data:/app/uploads"},
+	})).To(Succeed())
+
+	attachments, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(HaveLen(1))
+	Expect(attachments[0].ContainerPath).To(Equal("/app/storage"))
+}
+
+// TestCommandUnmountIgnoresMountSpecTokens keeps a mount spec pasteable into
+// an unmount call. An unmount target is identified by entry and container path
+// alone, and the third field has always been ignored here - including "ro" -
+// so the tokens that field now also carries are ignored the same way rather
+// than being rejected only because they are newer.
+func TestCommandUnmountIgnoresMountSpecTokens(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+	stageDockerLocalEntry(t, "demo-data")
+
+	Expect(CommandMount(CommandMountInput{
+		AppName: "demo",
+		Replace: true,
+		Specs:   []string{"demo-data:/app/storage", "demo-data:/app/uploads:ro,volume-subpath=uploads"},
+	})).To(Succeed())
+
+	Expect(CommandUnmount(CommandUnmountInput{
+		AppName: "demo",
+		Mounts:  []string{"demo-data:/app/uploads:ro,volume-subpath=uploads"},
+	})).To(Succeed())
+
+	attachments, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(HaveLen(1))
+	Expect(attachments[0].ContainerPath).To(Equal("/app/storage"))
+}
+
+func TestCommandUnmountLeavesStoreUntouchedOnUnknownMount(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+	stageDockerLocalEntry(t, "demo-data")
+	stageDockerLocalEntry(t, "demo-cache")
+
+	Expect(CommandMount(CommandMountInput{
+		AppName: "demo",
+		Replace: true,
+		Specs:   []string{"demo-data:/app/storage", "demo-cache:/cache"},
+	})).To(Succeed())
+
+	err := CommandUnmount(CommandUnmountInput{
+		AppName: "demo",
+		Mounts:  []string{"demo-data", "demo-missing"},
+	})
+	Expect(err).To(HaveOccurred())
+	Expect(err.Error()).To(ContainSubstring(`storage entry "demo-missing" is not mounted`))
+
+	attachments, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(HaveLen(2))
+}
+
+func TestCommandUnmountRejectsContainerDirWithMultipleMounts(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+
+	err := CommandUnmount(CommandUnmountInput{
+		AppName:      "demo",
+		Mounts:       []string{"demo-data", "demo-cache"},
+		ContainerDir: "/app/storage",
+	})
+	Expect(err).To(HaveOccurred())
+	Expect(err.Error()).To(Equal("The --container-dir flag cannot be used with multiple mounts"))
+}
+
+func TestCommandUnmountRequiresAMount(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+
+	err := CommandUnmount(CommandUnmountInput{AppName: "demo"})
+	Expect(err).To(HaveOccurred())
+	Expect(err.Error()).To(Equal("Must specify at least one mount, use storage:unmount --all to remove all mounts"))
+}
+
+func TestCommandUnmountRejectsProcessTypeWithoutAll(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+
+	err := CommandUnmount(CommandUnmountInput{
+		AppName:     "demo",
+		Mounts:      []string{"demo-data"},
+		ProcessType: "web",
+	})
+	Expect(err).To(HaveOccurred())
+	Expect(err.Error()).To(Equal("The --process-type flag can only be used with --all"))
+}
+
+func TestCommandUnmountAllRemovesEverything(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+	stageDockerLocalEntry(t, "demo-data")
+	stageDockerLocalEntry(t, "demo-cache")
+
+	Expect(CommandMount(CommandMountInput{
+		AppName: "demo",
+		Replace: true,
+		Specs:   []string{"demo-data:/app/storage", "demo-cache:/cache"},
+	})).To(Succeed())
+
+	Expect(CommandUnmount(CommandUnmountInput{AppName: "demo", All: true})).To(Succeed())
+
+	attachments, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(BeEmpty())
+
+	// Idempotent: clearing an app with no mounts is not an error.
+	Expect(CommandUnmount(CommandUnmountInput{AppName: "demo", All: true})).To(Succeed())
+}
+
+func TestCommandUnmountAllScopedToProcessType(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+	stageDockerLocalEntry(t, "demo-data")
+	stageDockerLocalEntry(t, "demo-cache")
+
+	Expect(CommandMount(CommandMountInput{
+		AppName: "demo",
+		Replace: true,
+		Specs:   []string{"demo-data:/app/storage"},
+	})).To(Succeed())
+
+	Expect(CommandMount(CommandMountInput{
+		AppName:     "demo",
+		Replace:     true,
+		Specs:       []string{"demo-cache:/cache"},
+		ProcessType: "web",
+	})).To(Succeed())
+
+	Expect(CommandUnmount(CommandUnmountInput{
+		AppName:     "demo",
+		All:         true,
+		ProcessType: "web",
+	})).To(Succeed())
+
+	attachments, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(HaveLen(1))
+	Expect(attachments[0].EntryName).To(Equal("demo-data"))
+
+	// A scope that matches nothing is a no-op rather than an error.
+	Expect(CommandUnmount(CommandUnmountInput{
+		AppName:     "demo",
+		All:         true,
+		ProcessType: "worker",
+	})).To(Succeed())
+
+	attachments, err = LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(HaveLen(1))
+}
+
+func TestCommandUnmountAllRejectsNamedMount(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+
+	err := CommandUnmount(CommandUnmountInput{
+		AppName: "demo",
+		All:     true,
+		Mounts:  []string{"demo-data"},
+	})
+	Expect(err).To(HaveOccurred())
+	Expect(err.Error()).To(Equal("A mount cannot be specified with --all"))
+}
diff --git a/plugins/storage/mountspec.go b/plugins/storage/mountspec.go
new file mode 100644
index 000000000..5583e4a7d
--- /dev/null
+++ b/plugins/storage/mountspec.go
@@ -0,0 +1,164 @@
+package storage
+
+import (
+	"fmt"
+	"strings"
+)
+
+// The key=value tokens a storage:mount --replace option list recognizes. Each
+// one mirrors the flag the single-entry form uses, so every mount-time field
+// has exactly one spelling across the two forms. Readonly keeps its docker
+// spelling - the bare "ro" token this grammar already had, plus "rw" as its
+// explicit opposite - rather than gaining a key of its own.
+const (
+	mountSpecKeyPhase       = "phase"
+	mountSpecKeySubpath     = "volume-subpath"
+	mountSpecKeyVolumeChown = "volume-chown"
+)
+
+// mountSpec is one parsed positional argument of the storage:mount --replace
+// form. Every mount-time field an attachment carries except ProcessType is
+// expressible per spec, so one call can vary them between mounts.
+type mountSpec struct {
+	EntryName     string
+	ContainerPath string
+	Phases        []string
+	Subpath       string
+	Readonly      bool
+	VolumeOptions string
+	VolumeChown   string
+}
+
+// parseMountSpec splits an "<entry>:<container-dir>[:<options>]" argument,
+// where the first field names a storage entry rather than a host path and the
+// option list carries every mount-time field rather than only the docker ones.
+//
+// It deliberately does not route through ParseMountPath, which hoists "ro" out
+// of the list before any caller sees it. Keeping the whole grammar here leaves
+// the ro/rw pair as a single rule in a single place, lets an error quote the
+// token list the operator actually typed, and keeps the legacy colon form,
+// storage:unmount and the migration on the grammar they already had.
+func parseMountSpec(spec string) (mountSpec, error) {
+	parts := strings.SplitN(spec, ":", 3)
+	parsed := mountSpec{Phases: []string{PhaseDeploy, PhaseRun}}
+	if len(parts) >= 1 {
+		parsed.EntryName = parts[0]
+	}
+	if len(parts) >= 2 {
+		parsed.ContainerPath = parts[1]
+	}
+
+	if parsed.EntryName == "" || parsed.ContainerPath == "" {
+		return mountSpec{}, fmt.Errorf("Invalid mount specified: %s", spec)
+	}
+
+	// A trailing colon is the no-options case rather than an empty option.
+	if len(parts) >= 3 && parts[2] != "" {
+		if err := parseMountSpecOptions(&parsed, spec, parts[2]); err != nil {
+			return mountSpec{}, err
+		}
+	}
+
+	return parsed, nil
+}
+
+// parseMountSpecOptions consumes a spec's comma-separated option list, lifting
+// the recognized tokens into their mount-time fields and rejoining what is left
+// into VolumeOptions the way the colon form always has.
+//
+// Order within the list is not significant, so anything the list can say twice
+// is rejected rather than resolved by position, and an unrecognized key is
+// rejected rather than passed through - a typo that reaches VolumeOptions would
+// otherwise surface only when docker refuses the container at deploy time.
+func parseMountSpecOptions(parsed *mountSpec, spec string, options string) error {
+	sawReadonly := false
+	sawWritable := false
+	seenKeys := map[string]bool{}
+	seenPhases := map[string]bool{}
+	remaining := []string{}
+
+	for _, token := range strings.Split(options, ",") {
+		if token == "" {
+			return fmt.Errorf("Mount spec %q has an empty mount option", spec)
+		}
+
+		switch token {
+		case "ro":
+			sawReadonly = true
+			continue
+		case "rw":
+			sawWritable = true
+			continue
+		}
+
+		// A bare docker option carries no "=", and neither does a token
+		// starting with one, which is no key at all. Both pass through.
+		index := strings.Index(token, "=")
+		if index <= 0 {
+			remaining = append(remaining, token)
+			continue
+		}
+
+		key, value := token[:index], token[index+1:]
+		if key != mountSpecKeyPhase && key != mountSpecKeySubpath && key != mountSpecKeyVolumeChown {
+			return fmt.Errorf("Mount spec %q specifies unknown key %q; supported keys are %s, %s and %s",
+				spec, key, mountSpecKeyPhase, mountSpecKeyVolumeChown, mountSpecKeySubpath)
+		}
+
+		if value == "" {
+			return fmt.Errorf("Mount spec %q has an empty value for %s", spec, key)
+		}
+
+		// A phase names one of a pair and so appears once per phase; every
+		// other key names a single value and so appears at most once.
+		if key != mountSpecKeyPhase {
+			if seenKeys[key] {
+				return fmt.Errorf("Mount spec %q specifies %s more than once", spec, key)
+			}
+			seenKeys[key] = true
+		}
+
+		switch key {
+		case mountSpecKeyPhase:
+			if value != PhaseDeploy && value != PhaseRun {
+				return fmt.Errorf("Mount spec %q specifies unsupported phase %q (must be %q or %q)", spec, value, PhaseDeploy, PhaseRun)
+			}
+			if seenPhases[value] {
+				return fmt.Errorf("Mount spec %q specifies phase %s more than once", spec, value)
+			}
+			seenPhases[value] = true
+		case mountSpecKeySubpath:
+			parsed.Subpath = value
+		case mountSpecKeyVolumeChown:
+			if err := ValidateChownOption(value); err != nil {
+				return fmt.Errorf("Mount spec %q has an invalid %s value %q: %w", spec, key, value, err)
+			}
+			parsed.VolumeChown = value
+		}
+	}
+
+	if sawReadonly && sawWritable {
+		return fmt.Errorf("Mount spec %q sets both ro and rw", spec)
+	}
+
+	parsed.Readonly = sawReadonly
+	parsed.VolumeOptions = strings.Join(remaining, ",")
+	if len(seenPhases) > 0 {
+		parsed.Phases = canonicalPhases(seenPhases)
+	}
+
+	return nil
+}
+
+// canonicalPhases renders a phase set in a fixed order, so two spec strings
+// naming the same phases in a different order store identical JSON and render
+// identically in storage:report.
+func canonicalPhases(seen map[string]bool) []string {
+	phases := []string{}
+	for _, phase := range []string{PhaseDeploy, PhaseRun} {
+		if seen[phase] {
+			phases = append(phases, phase)
+		}
+	}
+	return phases
+}
diff --git a/plugins/storage/plugin.toml b/plugins/storage/plugin.toml
index 99ebb456d..31747cb22 100644
--- a/plugins/storage/plugin.toml
+++ b/plugins/storage/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core storage plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/storage/report.go b/plugins/storage/report.go
index 9e4dd3121..5455c497c 100644
--- a/plugins/storage/report.go
+++ b/plugins/storage/report.go
@@ -72,7 +72,9 @@ func reportRunMounts(appName string) string {
 // registerAttachmentFlags adds one report flag per Attachment field for the
 // given 1-based index. Host path is resolved from the referenced Entry
 // (falling back to entry.Name when the entry has no host path, matching
-// ListAppMountEntries).
+// ListAppMountEntries). Process type is reported as the scope the attachment
+// actually deploys under, so a row written before the field existed reads as
+// _default_ rather than blank.
 func registerAttachmentFlags(flags map[string]common.ReportFunc, index int, att *Attachment, entry *Entry) {
 	prefix := fmt.Sprintf("--storage-attachment.%d.", index)
 	captured := att
@@ -84,7 +86,7 @@ func registerAttachmentFlags(flags map[string]common.ReportFunc, index int, att
 	flags[prefix+"host-path"] = func(string) string { return host }
 	flags[prefix+"container-path"] = func(string) string { return captured.ContainerPath }
 	flags[prefix+"phases"] = func(string) string { return strings.Join(captured.Phases, ",") }
-	flags[prefix+"process-type"] = func(string) string { return captured.ProcessType }
+	flags[prefix+"process-type"] = func(string) string { return captured.EffectiveProcessType() }
 	flags[prefix+"subpath"] = func(string) string { return captured.Subpath }
 	flags[prefix+"readonly"] = func(string) string { return strconv.FormatBool(captured.Readonly) }
 	flags[prefix+"volume-options"] = func(string) string { return captured.VolumeOptions }
diff --git a/plugins/storage/src/commands/commands.go b/plugins/storage/src/commands/commands.go
index 7c9828af0..6be542380 100644
--- a/plugins/storage/src/commands/commands.go
+++ b/plugins/storage/src/commands/commands.go
@@ -19,21 +19,21 @@ Additional commands:`
 
 	helpContent = `
     storage:annotations:report [<name>] [<flag>], Displays annotations for one or more storage entries
-    storage:annotations:set <name> <key> [<value>], Set or clear an annotation on a storage entry
+    storage:annotations:set <name> <key> [<value>], Set or clear a single annotation on a storage entry
     storage:create <name> [<path>] [flags], Register a named storage entry
     storage:destroy <name> [--force] [--destroy-host-dir], Remove a named storage entry (must be unmounted from every app first)
     storage:ensure-directory [--chown option] <directory>, [DEPRECATED] use storage:create instead
     storage:exec <name> [-- <cmd>...], Run a command (or shell) in a temporary container that mounts the entry
     storage:info <name> [--format text|json], Show details for one storage entry
     storage:labels:report [<name>] [<flag>], Displays labels for one or more storage entries
-    storage:labels:set <name> <key> [<value>], Set or clear a label on a storage entry
-    storage:list <app> [--format text|json], List bind mounts for app's container(s) (host:container)
+    storage:labels:set <name> <key> [<value>], Set or clear a single label on a storage entry
+    storage:list <app> [--format text|json], List bind mounts for an app's container(s) (legacy host:container view)
     storage:list-entries [--scheduler s] [--format text|json], List registered storage entries
     storage:migrate [<app>|--all], Re-run the legacy -v to attachment migration for an app
-    storage:mount <app> <host-dir:container-dir>, Create a new bind mount
-    storage:report [<app>] [<flag>], Displays a storage report for one or more apps
+    storage:mount [--replace] <app> <host-dir:container-dir>... [flags], Create or replace bind mounts
+    storage:report [<app>|--global] [<flag>], Displays a storage report for one or more apps
     storage:set <name> <property> [<value>], Update a storage entry in place
-    storage:unmount <app> <host-dir:container-dir>, Remove an existing bind mount
+    storage:unmount [--all] <app> [<host-dir:container-dir>...] [flags], Remove one or all bind mounts
     storage:wait <name>, Wait for a storage entry's PVC to be bound (k3s)`
 )
 
diff --git a/plugins/storage/src/subcommands/subcommands.go b/plugins/storage/src/subcommands/subcommands.go
index 59cd25408..9fe51c1fe 100644
--- a/plugins/storage/src/subcommands/subcommands.go
+++ b/plugins/storage/src/subcommands/subcommands.go
@@ -218,16 +218,16 @@ func main() {
 	case "mount":
 		args := flag.NewFlagSet("storage:mount", flag.ExitOnError)
 		containerDir := args.String("container-dir", "", "--container-dir: container path (named-entry form)")
-		phases := args.StringSlice("phase", nil, "--phase: phase to mount in (deploy, run; default both)")
+		phases := args.StringSlice("phase", nil, "--phase: phase to mount in (deploy, run; default both); not valid with --replace")
 		processType := args.String("process-type", "", "--process-type: process type to mount for")
-		subpath := args.String("volume-subpath", "", "--volume-subpath: subpath within the entry")
-		readonly := args.Bool("volume-readonly", false, "--volume-readonly: mount the volume read-only")
-		volumeChown := args.String("volume-chown", "", "--volume-chown: chown option applied at mount time")
-		volumeOptions := args.String("volume-options", "", "--volume-options: comma-separated mount options (e.g. Z, noexec,nosuid)")
+		subpath := args.String("volume-subpath", "", "--volume-subpath: subpath within the entry; not valid with --replace")
+		readonly := args.Bool("volume-readonly", false, "--volume-readonly: mount the volume read-only; not valid with --replace")
+		volumeChown := args.String("volume-chown", "", "--volume-chown: chown option applied at mount time; not valid with --replace")
+		volumeOptions := args.String("volume-options", "", "--volume-options: comma-separated mount options (e.g. Z, noexec,nosuid); not valid with --replace")
+		replace := args.Bool("replace", false, "--replace: replace the entire mount set for the process type")
 		args.Parse(os.Args[2:])
-		err = storage.CommandMount(storage.CommandMountInput{
+		input := storage.CommandMountInput{
 			AppName:       args.Arg(0),
-			NameOrPath:    args.Arg(1),
 			ContainerDir:  *containerDir,
 			Phases:        *phases,
 			ProcessType:   *processType,
@@ -235,7 +235,16 @@ func main() {
 			Readonly:      *readonly,
 			VolumeChown:   *volumeChown,
 			VolumeOptions: *volumeOptions,
-		})
+			Replace:       *replace,
+		}
+
+		if *replace {
+			input.Specs = common.VarArgs(args.Args(), 1)
+		} else {
+			input.NameOrPath = args.Arg(1)
+		}
+
+		err = storage.CommandMount(input)
 	case "report":
 		args := flag.NewFlagSet("storage:report", flag.ExitOnError)
 		format := args.String("format", "stdout", "format: [ stdout | json ]")
@@ -251,11 +260,15 @@ func main() {
 	case "unmount":
 		args := flag.NewFlagSet("storage:unmount", flag.ExitOnError)
 		containerDir := args.String("container-dir", "", "--container-dir: container path (named-entry form, disambiguates duplicates)")
+		all := args.Bool("all", false, "--all: remove every mount for the app or the specified process type")
+		processType := args.String("process-type", "", "--process-type: process type to remove mounts for (requires --all)")
 		args.Parse(os.Args[2:])
 		err = storage.CommandUnmount(storage.CommandUnmountInput{
 			AppName:      args.Arg(0),
-			NameOrPath:   args.Arg(1),
+			Mounts:       common.VarArgs(args.Args(), 1),
 			ContainerDir: *containerDir,
+			All:          *all,
+			ProcessType:  *processType,
 		})
 	default:
 		err = fmt.Errorf("Invalid plugin subcommand call: %s", subcommand)
diff --git a/plugins/storage/src/triggers/triggers.go b/plugins/storage/src/triggers/triggers.go
index 565891290..6d05a4e82 100644
--- a/plugins/storage/src/triggers/triggers.go
+++ b/plugins/storage/src/triggers/triggers.go
@@ -28,12 +28,22 @@ func main() {
 		appName := flag.Arg(0)
 		phase := flag.Arg(1)
 		err = storage.TriggerStorageAppMounts(appName, phase)
+	case "docker-args-process-deploy":
+		appName := flag.Arg(0)
+		processType := flag.Arg(3)
+		err = storage.TriggerDockerArgs(appName, storage.PhaseDeploy, processType)
 	case "docker-args-deploy":
-		appName := flag.Arg(0)
-		err = storage.TriggerDockerArgs(appName, storage.PhaseDeploy)
+		// No longer registered in the plugin Makefile; storage emits its
+		// deploy-phase flags through docker-args-process-deploy, which every
+		// caller of this trigger also invokes. The case remains so a symlink
+		// left behind by an older build resolves to a no-op rather than
+		// falling through to the error below and failing the deploy.
+		err = nil
 	case "docker-args-run":
+		// A `dokku run` container belongs to no process type, so only
+		// default-scoped attachments apply.
 		appName := flag.Arg(0)
-		err = storage.TriggerDockerArgs(appName, storage.PhaseRun)
+		err = storage.TriggerDockerArgs(appName, storage.PhaseRun, storage.DefaultProcessType)
 	case "post-delete":
 		appName := flag.Arg(0)
 		err = storage.TriggerPostDelete(appName)
diff --git a/plugins/storage/storage.go b/plugins/storage/storage.go
index 18fc19447..987f583f0 100644
--- a/plugins/storage/storage.go
+++ b/plugins/storage/storage.go
@@ -3,6 +3,7 @@ package storage
 import (
 	"errors"
 	"fmt"
+	"os"
 	"path/filepath"
 	"regexp"
 	"strings"
@@ -190,6 +191,26 @@ func GetStorageDirectory() string {
 	return fmt.Sprintf("%s/data/storage", dokkuLibRoot)
 }
 
+// HostPathForDocker rewrites a path under DOKKU_LIB_ROOT to the
+// DOKKU_LIB_HOST_ROOT view used by the host Docker daemon. Named
+// volumes and paths outside DOKKU_LIB_ROOT are returned unchanged.
+//
+// When Dokku runs in a container with a shared Docker socket, filesystem
+// operations must use DOKKU_LIB_ROOT (visible inside the Dokku container)
+// while Docker -v host paths must use DOKKU_LIB_HOST_ROOT (visible to the
+// daemon on the real host).
+func HostPathForDocker(path string) string {
+	libRoot := common.GetenvWithDefault("DOKKU_LIB_ROOT", "/var/lib/dokku")
+	libHost := os.Getenv("DOKKU_LIB_HOST_ROOT")
+	if libHost == "" || libHost == libRoot {
+		return path
+	}
+	if path == libRoot || strings.HasPrefix(path, libRoot+"/") {
+		return libHost + strings.TrimPrefix(path, libRoot)
+	}
+	return path
+}
+
 // storageDirScriptNames lists the sudo helpers shipped in the plugin's bin
 // directory. Each one takes a storage entry basename and builds the path
 // under $DOKKU_LIB_ROOT/data/storage itself, so no caller can point them
diff --git a/plugins/storage/storage_test.go b/plugins/storage/storage_test.go
index 871bdf53a..854040016 100644
--- a/plugins/storage/storage_test.go
+++ b/plugins/storage/storage_test.go
@@ -107,3 +107,46 @@ func TestGetStorageDirectory(t *testing.T) {
 	dir := GetStorageDirectory()
 	Expect(dir).To(ContainSubstring("data/storage"))
 }
+
+func TestHostPathForDocker(t *testing.T) {
+	RegisterTestingT(t)
+
+	t.Setenv("DOKKU_LIB_ROOT", "/var/lib/dokku")
+
+	t.Run("unset host root leaves path unchanged", func(t *testing.T) {
+		RegisterTestingT(t)
+		t.Setenv("DOKKU_LIB_HOST_ROOT", "")
+		Expect(HostPathForDocker("/var/lib/dokku/data/storage/foo")).To(Equal("/var/lib/dokku/data/storage/foo"))
+	})
+
+	t.Run("equal host root leaves path unchanged", func(t *testing.T) {
+		RegisterTestingT(t)
+		t.Setenv("DOKKU_LIB_HOST_ROOT", "/var/lib/dokku")
+		Expect(HostPathForDocker("/var/lib/dokku/data/storage/foo")).To(Equal("/var/lib/dokku/data/storage/foo"))
+	})
+
+	t.Run("rewrites paths under lib root", func(t *testing.T) {
+		RegisterTestingT(t)
+		t.Setenv("DOKKU_LIB_HOST_ROOT", "/host/var/lib/dokku")
+		Expect(HostPathForDocker("/var/lib/dokku/data/storage/foo")).To(Equal("/host/var/lib/dokku/data/storage/foo"))
+		Expect(HostPathForDocker("/var/lib/dokku")).To(Equal("/host/var/lib/dokku"))
+	})
+
+	t.Run("leaves named volumes unchanged", func(t *testing.T) {
+		RegisterTestingT(t)
+		t.Setenv("DOKKU_LIB_HOST_ROOT", "/host/var/lib/dokku")
+		Expect(HostPathForDocker("myvolume")).To(Equal("myvolume"))
+	})
+
+	t.Run("leaves custom absolute paths unchanged", func(t *testing.T) {
+		RegisterTestingT(t)
+		t.Setenv("DOKKU_LIB_HOST_ROOT", "/host/var/lib/dokku")
+		Expect(HostPathForDocker("/srv/demo")).To(Equal("/srv/demo"))
+	})
+
+	t.Run("does not false-match similar prefixes", func(t *testing.T) {
+		RegisterTestingT(t)
+		t.Setenv("DOKKU_LIB_HOST_ROOT", "/host/var/lib/dokku")
+		Expect(HostPathForDocker("/var/lib/dokku-extra/data")).To(Equal("/var/lib/dokku-extra/data"))
+	})
+}
diff --git a/plugins/storage/subcommands.go b/plugins/storage/subcommands.go
index 08295653e..f73798261 100644
--- a/plugins/storage/subcommands.go
+++ b/plugins/storage/subcommands.go
@@ -21,21 +21,21 @@ Additional commands:`
 
 	helpContent = `
     storage:annotations:report [<name>] [<flag>], Displays annotations for one or more storage entries
-    storage:annotations:set <name> <key> [<value>], Set or clear an annotation on a storage entry
+    storage:annotations:set <name> <key> [<value>], Set or clear a single annotation on a storage entry
     storage:create <name> [<path>] [flags], Register a named storage entry
     storage:destroy <name> [--force] [--destroy-host-dir], Remove a named storage entry (must be unmounted from every app first)
     storage:ensure-directory [--chown option] <directory>, [DEPRECATED] use storage:create instead
     storage:exec <name> [-- <cmd>...], Run a command (or shell) in a temporary container that mounts the entry
     storage:info <name> [--format text|json], Show details for one storage entry
     storage:labels:report [<name>] [<flag>], Displays labels for one or more storage entries
-    storage:labels:set <name> <key> [<value>], Set or clear a label on a storage entry
-    storage:list <app> [--format text|json], List bind mounts for app's container(s) (host:container)
+    storage:labels:set <name> <key> [<value>], Set or clear a single label on a storage entry
+    storage:list <app> [--format text|json], List bind mounts for an app's container(s) (legacy host:container view)
     storage:list-entries [--scheduler s] [--format text|json], List registered storage entries
     storage:migrate [<app>|--all], Re-run the legacy -v to attachment migration for an app
-    storage:mount <app> <host-dir:container-dir>, Create a new bind mount
-    storage:report [<app>] [<flag>], Displays a storage report for one or more apps
+    storage:mount [--replace] <app> <host-dir:container-dir>... [flags], Create or replace bind mounts
+    storage:report [<app>|--global] [<flag>], Displays a storage report for one or more apps
     storage:set <name> <property> [<value>], Update a storage entry in place
-    storage:unmount <app> <host-dir:container-dir>, Remove an existing bind mount
+    storage:unmount [--all] <app> [<host-dir:container-dir>...] [flags], Remove one or all bind mounts
     storage:wait <name>, Wait for a storage entry's PVC to be bound (k3s)`
 )
 
@@ -118,6 +118,24 @@ func ResolveChownID(chownFlag string) (string, error) {
 	return chownID, nil
 }
 
+// ValidateChownOption reports whether a chown option is one the storage
+// plugin understands, mirroring the set ResolveChownID maps. An empty value
+// means no chown was requested. Unlike ResolveChownID it never shells out to
+// docker for the user namespace offset, so it is safe to call as a pure
+// validation step before anything has been written.
+func ValidateChownOption(chownFlag string) error {
+	switch chownFlag {
+	case "", "herokuish", "heroku", "packeto", "paketo", "root", "false":
+		return nil
+	}
+
+	if _, err := strconv.ParseUint(chownFlag, 10, 16); err != nil {
+		return errors.New("Unsupported chown permissions")
+	}
+
+	return nil
+}
+
 // isUserNamespacesEnabled checks if Docker user namespaces are enabled
 func isUserNamespacesEnabled() (bool, error) {
 	result, err := common.CallExecCommand(common.ExecCommandInput{
@@ -132,6 +150,11 @@ func isUserNamespacesEnabled() (bool, error) {
 
 // CommandMountInput captures the optional flags accepted by storage:mount
 // when the second argument is a named entry rather than a colon-form path.
+//
+// Replace and Specs drive the whole-set form, where the positional arguments
+// are mount specs carrying their own mount-time fields. Only ProcessType
+// scopes that call; every other mount-time field is rejected with Replace so
+// each one has exactly one spelling.
 type CommandMountInput struct {
 	AppName       string
 	NameOrPath    string
@@ -142,6 +165,8 @@ type CommandMountInput struct {
 	Readonly      bool
 	VolumeOptions string
 	VolumeChown   string
+	Replace       bool
+	Specs         []string
 }
 
 // CommandMount creates a new bind mount for an app. The second positional
@@ -152,11 +177,20 @@ func CommandMount(input CommandMountInput) error {
 		return err
 	}
 
+	if input.Replace {
+		return replaceMounts(input)
+	}
+
+	appScheduler := common.GetAppScheduler(input.AppName)
+
 	// Legacy colon form: synthesize a legacy-<hash> entry plus an
 	// attachment so storage:list (now attachment-only) sees the mount.
 	// The storage docker-args trigger emits the corresponding -v flag at
 	// deploy time, so behavior at the docker-run boundary is unchanged.
 	if strings.Contains(input.NameOrPath, ":") {
+		if appScheduler != SchedulerDockerLocal {
+			return fmt.Errorf("colon-form mounts are only supported on docker-local apps; %s is a %s app. Create a named entry with 'dokku storage:create --scheduler %s' and mount it instead", input.AppName, appScheduler, appScheduler)
+		}
 		return mountLegacyColon(input.AppName, input.NameOrPath)
 	}
 
@@ -173,6 +207,14 @@ func CommandMount(input CommandMountInput) error {
 		return err
 	}
 
+	if entry.Scheduler != appScheduler {
+		return fmt.Errorf("storage entry %q is scheduler=%s but cannot be mounted on a %s app; recreate it with --scheduler %s", entry.Name, entry.Scheduler, appScheduler, appScheduler)
+	}
+
+	if err := ValidateChownOption(input.VolumeChown); err != nil {
+		return err
+	}
+
 	phases := input.Phases
 	if len(phases) == 0 {
 		phases = []string{PhaseDeploy, PhaseRun}
@@ -211,12 +253,183 @@ func CommandMount(input CommandMountInput) error {
 	return nil
 }
 
-// CommandUnmountInput captures the flags accepted by storage:unmount when
-// the second argument is a named entry.
+// resolveMountSpecEntry maps a parsed spec onto the storage entry it names.
+//
+// The single-mount form tells a named entry from a colon-form host path by the
+// presence of a colon, which every --replace spec has, so a leading "/" is the
+// discriminator instead. Without that rule a mistyped entry name would match
+// the docker volume grammar and silently register a legacy entry for a volume
+// that does not exist.
+//
+// The returned bool reports whether the entry still needs registering, so the
+// registry write can wait until every spec in the call has validated.
+func resolveMountSpecEntry(appName string, appScheduler string, spec string, parsed mountSpec) (*Entry, bool, error) {
+	if strings.HasPrefix(parsed.EntryName, "/") {
+		if appScheduler != SchedulerDockerLocal {
+			return nil, false, fmt.Errorf("colon-form mounts are only supported on docker-local apps; %s is a %s app. Create a named entry with 'dokku storage:create --scheduler %s' and mount it instead", appName, appScheduler, appScheduler)
+		}
+
+		if err := VerifyPaths(spec); err != nil {
+			return nil, false, err
+		}
+
+		entry := LegacyMountToEntry(spec)
+		return entry, !EntryExists(entry.Name), nil
+	}
+
+	if !EntryExists(parsed.EntryName) {
+		return nil, false, fmt.Errorf("storage entry %q does not exist; create it first with `dokku storage:create`", parsed.EntryName)
+	}
+
+	entry, err := LoadEntry(parsed.EntryName)
+	if err != nil {
+		return nil, false, err
+	}
+
+	if entry.Scheduler != appScheduler {
+		return nil, false, fmt.Errorf("storage entry %q is scheduler=%s but cannot be mounted on a %s app; recreate it with --scheduler %s", entry.Name, entry.Scheduler, appScheduler, appScheduler)
+	}
+
+	return entry, false, nil
+}
+
+// replaceMounts swaps one process type's entire mount set for the declared one
+// in a single write, so a caller converging an app onto a declared set no
+// longer issues one storage:mount or storage:unmount per difference and can no
+// longer fail partway through holding a mixture of the two sets.
+//
+// Every spec is parsed and validated before anything is written, so a rejected
+// spec leaves the stored set untouched. Attachments belonging to other process
+// types are kept: an omitted --process-type scopes the replacement to
+// _default_ the same way it scopes a single storage:mount.
+//
+// Every other mount-time field comes from the spec that declares it rather
+// than from a call-level flag, so one call can vary them between mounts.
+func replaceMounts(input CommandMountInput) error {
+	if input.ContainerDir != "" {
+		return errors.New("The --container-dir flag cannot be used with --replace")
+	}
+
+	// Each mount-time field has exactly one spelling in this form, the token
+	// in the spec that declares it, rather than a call-level default a token
+	// overrides. A flag is taken as passed when it holds anything but its
+	// zero value, which is what pflag leaves behind when it is absent; the
+	// values that slip through - an empty string or an explicit false - ask
+	// for what an omitted flag already gives.
+	for _, conflict := range []struct {
+		flag string
+		set  bool
+		hint string
+	}{
+		{"--phase", len(input.Phases) > 0, mountSpecKeyPhase + "=" + PhaseDeploy},
+		{"--volume-subpath", input.Subpath != "", mountSpecKeySubpath + "=<path>"},
+		{"--volume-readonly", input.Readonly, "ro"},
+		{"--volume-chown", input.VolumeChown != "", mountSpecKeyVolumeChown + "=<option>"},
+		{"--volume-options", input.VolumeOptions != "", "the option as a bare token"},
+	} {
+		if conflict.set {
+			return fmt.Errorf("The %s flag cannot be used with --replace; set %s in the mount spec instead", conflict.flag, conflict.hint)
+		}
+	}
+
+	if len(input.Specs) == 0 {
+		return errors.New("Must specify at least one mount, use storage:unmount --all to remove all mounts")
+	}
+
+	processType := input.ProcessType
+	if processType == "" {
+		processType = DefaultProcessType
+	}
+
+	appScheduler := common.GetAppScheduler(input.AppName)
+	declared := []*Attachment{}
+	pending := []*Entry{}
+	containerPaths := map[string]bool{}
+	for _, spec := range input.Specs {
+		parsed, err := parseMountSpec(spec)
+		if err != nil {
+			return err
+		}
+
+		entry, needsRegister, err := resolveMountSpecEntry(input.AppName, appScheduler, spec, parsed)
+		if err != nil {
+			return err
+		}
+
+		// Two entries bound at one container path inside one process type
+		// would emit two -v flags for the same target, so the declared set
+		// must name each container path at most once.
+		if containerPaths[parsed.ContainerPath] {
+			return fmt.Errorf("Container path %s is specified more than once", parsed.ContainerPath)
+		}
+		containerPaths[parsed.ContainerPath] = true
+
+		attachment := &Attachment{
+			EntryName:     entry.Name,
+			ContainerPath: parsed.ContainerPath,
+			Phases:        parsed.Phases,
+			ProcessType:   processType,
+			Subpath:       parsed.Subpath,
+			Readonly:      parsed.Readonly,
+			VolumeOptions: parsed.VolumeOptions,
+			VolumeChown:   parsed.VolumeChown,
+		}
+		if err := attachment.Validate(); err != nil {
+			return err
+		}
+
+		if needsRegister {
+			pending = append(pending, entry)
+		}
+		declared = append(declared, attachment)
+	}
+
+	for _, entry := range pending {
+		if err := SaveEntry(entry); err != nil {
+			return err
+		}
+	}
+
+	err := UpdateAttachments(input.AppName, func(existing []*Attachment) ([]*Attachment, error) {
+		retained := []*Attachment{}
+		for _, attachment := range existing {
+			if attachment.EffectiveProcessType() != processType {
+				retained = append(retained, attachment)
+			}
+		}
+
+		// The declared set is already unique on container path within its own
+		// scope; what is left to check is the scopes this call does not replace,
+		// so a declared path cannot collide with one held by another process type.
+		// Checking before the write keeps the all-or-nothing contract.
+		for _, attachment := range declared {
+			if err := ensureContainerPathFree(input.AppName, retained, attachment); err != nil {
+				return nil, err
+			}
+		}
+
+		return append(retained, declared...), nil
+	})
+	if err != nil {
+		return err
+	}
+
+	common.LogInfo1(fmt.Sprintf("Storage mounts for process type %s replaced on %s", processType, input.AppName))
+	return nil
+}
+
+// CommandUnmountInput captures the arguments accepted by storage:unmount.
+// Mounts holds one or more entry names or colon-form mount strings, each
+// naming an attachment to remove.
+//
+// All and ProcessType drive the whole-set form, where no mount is named and
+// every attachment in scope is removed at once.
 type CommandUnmountInput struct {
 	AppName      string
-	NameOrPath   string
+	Mounts       []string
 	ContainerDir string
+	All          bool
+	ProcessType  string
 }
 
 // CommandUnmount removes an existing bind mount from an app.
@@ -225,11 +438,136 @@ func CommandUnmount(input CommandUnmountInput) error {
 		return err
 	}
 
-	if strings.Contains(input.NameOrPath, ":") {
-		return unmountLegacyColon(input.AppName, input.NameOrPath)
+	if input.All {
+		return unmountAll(input)
 	}
 
-	return RemoveAttachment(input.AppName, input.NameOrPath, input.ContainerDir)
+	if input.ProcessType != "" {
+		return errors.New("The --process-type flag can only be used with --all")
+	}
+
+	if len(input.Mounts) == 0 {
+		return errors.New("Must specify at least one mount, use storage:unmount --all to remove all mounts")
+	}
+
+	// --container-dir disambiguates a single entry mounted at several paths,
+	// which has no meaning once more than one mount is named.
+	if len(input.Mounts) > 1 && input.ContainerDir != "" {
+		return errors.New("The --container-dir flag cannot be used with multiple mounts")
+	}
+
+	return unmountMounts(input)
+}
+
+// unmountTarget names the attachment one storage:unmount argument resolves to.
+type unmountTarget struct {
+	EntryName     string
+	ContainerPath string
+	Legacy        bool
+}
+
+// resolveUnmountTarget maps one storage:unmount argument onto the attachment it
+// names. An argument without a colon is a registered entry name, disambiguated
+// by --container-dir when the entry is mounted at more than one path. An
+// argument with a colon names a registered entry when its first field is one,
+// and otherwise falls back to the legacy host:container form, which keeps a
+// host path or docker volume name resolving the way it always has.
+func resolveUnmountTarget(mount string, containerDir string) (unmountTarget, error) {
+	if !strings.Contains(mount, ":") {
+		return unmountTarget{EntryName: mount, ContainerPath: containerDir}, nil
+	}
+
+	parsed := ParseMountPath(mount)
+	if !strings.HasPrefix(parsed.HostPath, "/") && EntryExists(parsed.HostPath) {
+		if parsed.ContainerPath == "" {
+			return unmountTarget{}, fmt.Errorf("Invalid mount specified: %s", mount)
+		}
+
+		return unmountTarget{EntryName: parsed.HostPath, ContainerPath: parsed.ContainerPath}, nil
+	}
+
+	if err := VerifyPaths(mount); err != nil {
+		return unmountTarget{}, err
+	}
+
+	if parsed.ContainerPath == "" {
+		return unmountTarget{}, errors.New("Storage path must be two valid paths divided by colon.")
+	}
+
+	return unmountTarget{
+		EntryName:     LegacyMountToEntry(mount).Name,
+		ContainerPath: parsed.ContainerPath,
+		Legacy:        true,
+	}, nil
+}
+
+// unmountMounts removes every named mount in a single write. Each argument is
+// resolved and matched against the app's attachments before anything is
+// written, so an argument naming a mount the app does not have leaves the rest
+// of the set in place rather than removing a prefix of it.
+func unmountMounts(input CommandUnmountInput) error {
+	return UpdateAttachments(input.AppName, func(attachments []*Attachment) ([]*Attachment, error) {
+		for _, mount := range input.Mounts {
+			target, err := resolveUnmountTarget(mount, input.ContainerDir)
+			if err != nil {
+				return nil, err
+			}
+
+			attachments, err = removeMatchingAttachments(attachments, input.AppName, target.EntryName, target.ContainerPath)
+			if err != nil {
+				// The legacy form historically said "Mount path does not
+				// exist." - preserve that exact wording so existing automation
+				// and the bats suite keep matching.
+				if target.Legacy && strings.Contains(err.Error(), "is not mounted") {
+					return nil, errors.New("Mount path does not exist.")
+				}
+				return nil, err
+			}
+		}
+
+		return attachments, nil
+	})
+}
+
+// unmountAll removes every attachment on an app, or every attachment for one
+// process type when --process-type is given. This is the empty case the
+// --replace form refuses to treat as a request to remove everything, so that a
+// generated spec list which expands to nothing cannot silently drop an app's
+// mounts. A scope matching nothing is a no-op rather than an error, leaving the
+// command idempotent.
+func unmountAll(input CommandUnmountInput) error {
+	if len(input.Mounts) > 0 {
+		return errors.New("A mount cannot be specified with --all")
+	}
+
+	if input.ContainerDir != "" {
+		return errors.New("The --container-dir flag cannot be used with --all")
+	}
+
+	if input.ProcessType == "" {
+		if err := common.PropertyDelete(PluginName, input.AppName, AttachmentsProperty); err != nil {
+			return err
+		}
+
+		common.LogInfo1(fmt.Sprintf("Removed all storage mounts on %s", input.AppName))
+		return nil
+	}
+
+	err := UpdateAttachments(input.AppName, func(attachments []*Attachment) ([]*Attachment, error) {
+		keep := []*Attachment{}
+		for _, attachment := range attachments {
+			if attachment.EffectiveProcessType() != input.ProcessType {
+				keep = append(keep, attachment)
+			}
+		}
+		return keep, nil
+	})
+	if err != nil {
+		return err
+	}
+
+	common.LogInfo1(fmt.Sprintf("Removed all storage mounts for process type %s on %s", input.ProcessType, input.AppName))
+	return nil
 }
 
 // mountLegacyColon translates a `<host>:<container>[:options]` mount
@@ -274,29 +612,6 @@ func mountLegacyColon(appName string, mountPath string) error {
 	return nil
 }
 
-// unmountLegacyColon is the inverse of mountLegacyColon. The legacy
-// mount string identifies an entry+container-path tuple deterministically
-// via LegacyMountToEntry, so we can route to RemoveAttachment.
-func unmountLegacyColon(appName string, mountPath string) error {
-	if err := VerifyPaths(mountPath); err != nil {
-		return err
-	}
-	parsed := ParseMountPath(mountPath)
-	if parsed.ContainerPath == "" {
-		return errors.New("Storage path must be two valid paths divided by colon.")
-	}
-
-	entry := LegacyMountToEntry(mountPath)
-	if err := RemoveAttachment(appName, entry.Name, parsed.ContainerPath); err != nil {
-		// Match the legacy wording for "not currently mounted".
-		if strings.Contains(err.Error(), "is not mounted") {
-			return errors.New("Mount path does not exist.")
-		}
-		return err
-	}
-	return nil
-}
-
 // CommandList lists all bind mounts for an app. Reads attachments
 // directly from the storage plugin's own state rather than going through
 // the deprecated `storage-list` plugn trigger.
diff --git a/plugins/storage/subcommands_test.go b/plugins/storage/subcommands_test.go
index d0d5bfe4e..f3fded584 100644
--- a/plugins/storage/subcommands_test.go
+++ b/plugins/storage/subcommands_test.go
@@ -1,6 +1,8 @@
 package storage
 
 import (
+	"os"
+	"path/filepath"
 	"testing"
 
 	. "github.com/onsi/gomega"
@@ -15,3 +17,60 @@ func TestResolveChownIDRejectsOutOfBoundsValues(t *testing.T) {
 		Expect(err.Error()).To(ContainSubstring("Unsupported chown permissions"))
 	}
 }
+
+func setupTestApp(t *testing.T, appName string) {
+	t.Helper()
+	libRoot := withTempLibRoot(t)
+	dokkuRoot := t.TempDir()
+	t.Setenv("DOKKU_ROOT", dokkuRoot)
+	t.Setenv("PLUGIN_PATH", filepath.Join(libRoot, "plugins"))
+	if err := os.MkdirAll(filepath.Join(dokkuRoot, appName), 0755); err != nil {
+		t.Fatalf("mkdir app root: %v", err)
+	}
+}
+
+func TestCommandMountRejectsSchedulerMismatch(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+
+	Expect(SaveEntry(&Entry{
+		Name:      "demo-pvc",
+		Scheduler: SchedulerK3s,
+	})).To(Succeed())
+
+	err := CommandMount(CommandMountInput{
+		AppName:      "demo",
+		NameOrPath:   "demo-pvc",
+		ContainerDir: "/data",
+	})
+	Expect(err).To(HaveOccurred())
+	Expect(err.Error()).To(Equal(`storage entry "demo-pvc" is scheduler=k3s but cannot be mounted on a docker-local app; recreate it with --scheduler docker-local`))
+
+	attachments, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(BeEmpty())
+}
+
+func TestCommandMountAcceptsMatchingScheduler(t *testing.T) {
+	RegisterTestingT(t)
+	setupTestApp(t, "demo")
+
+	Expect(SaveEntry(&Entry{
+		Name:      "demo-data",
+		Scheduler: SchedulerDockerLocal,
+		HostPath:  "/data",
+	})).To(Succeed())
+
+	err := CommandMount(CommandMountInput{
+		AppName:      "demo",
+		NameOrPath:   "demo-data",
+		ContainerDir: "/data",
+	})
+	Expect(err).NotTo(HaveOccurred())
+
+	attachments, err := LoadAttachments("demo")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(attachments).To(HaveLen(1))
+	Expect(attachments[0].EntryName).To(Equal("demo-data"))
+	Expect(attachments[0].ContainerPath).To(Equal("/data"))
+}
diff --git a/plugins/storage/triggers.go b/plugins/storage/triggers.go
index 7b2042f5f..d35a767aa 100644
--- a/plugins/storage/triggers.go
+++ b/plugins/storage/triggers.go
@@ -236,37 +236,79 @@ func TriggerStorageAppMounts(appName string, phase string) error {
 	return nil
 }
 
-// TriggerDockerArgs emits `-v` flags for each docker-local attachment in
-// the requested phase. Plugn concatenates this with docker-options'
-// equivalent trigger output, so docker-local apps continue to receive
-// their bind mounts through the standard pipeline.
-func TriggerDockerArgs(appName string, phase string) error {
-	attachments, err := AttachmentsForPhase(appName, phase)
+// TriggerDockerArgs emits `-v` flags for the docker-local attachments in the
+// requested phase that apply to the given process type. Plugn concatenates
+// this with docker-options' equivalent trigger output, so docker-local apps
+// continue to receive their bind mounts through the standard pipeline.
+//
+// An empty processType names a container that belongs to no process - the
+// app.json deploy-task path invokes the trigger without one - and so receives
+// the default scope. Unlike docker-options, which emits its default scope from
+// a separate docker-args-deploy handler, this is storage's only deploy-time
+// emitter: returning early on an empty process type would drop every mount.
+func TriggerDockerArgs(appName string, phase string, processType string) error {
+	flags, err := dockerVFlagsForProcess(appName, phase, processType)
 	if err != nil {
 		return err
 	}
 
+	for _, flag := range flags {
+		fmt.Printf(" %s", flag)
+	}
+	return nil
+}
+
+// dockerVFlagsForProcess returns the `-v` flags a single process type's
+// container receives for the given phase.
+//
+// Every attachment in the phase is resolved and scheduler-checked, not just
+// the ones in scope, so an entry created for the wrong scheduler still fails
+// the deploy no matter which process type happens to be starting.
+//
+// Apps on another scheduler emit nothing rather than failing: the docker-args
+// triggers are invoked for every app, whatever its scheduler, because the
+// app.json deploy-task path builds its ephemeral container with docker
+// directly. A k3s app's volumes are PersistentVolumeClaims mounted by its own
+// scheduler and there is nothing to bind-mount here.
+func dockerVFlagsForProcess(appName string, phase string, processType string) ([]string, error) {
+	if appSchedulerFor(appName) != SchedulerDockerLocal {
+		return nil, nil
+	}
+
+	attachments, err := AttachmentsForPhase(appName, phase)
+	if err != nil {
+		return nil, err
+	}
+
+	flags := []string{}
 	for _, attachment := range attachments {
 		entry, err := LoadEntry(attachment.EntryName)
 		if err != nil {
-			return fmt.Errorf("attachment on %q references missing entry %q: %w", appName, attachment.EntryName, err)
+			return nil, fmt.Errorf("attachment on %q references missing entry %q: %w", appName, attachment.EntryName, err)
 		}
 		if entry.Scheduler != SchedulerDockerLocal {
+			return nil, fmt.Errorf("storage entry %q is scheduler=%s but is mounted on a docker-local app; recreate it with --scheduler docker-local", entry.Name, entry.Scheduler)
+		}
+		if !attachment.AppliesToProcessType(processType) {
 			continue
 		}
 		flag := buildDockerVFlag(entry, attachment)
 		if flag == "" {
 			continue
 		}
-		fmt.Printf(" %s", flag)
+		flags = append(flags, flag)
 	}
-	return nil
+	return flags, nil
 }
 
+// appSchedulerFor resolves the scheduler an app deploys with. It is a variable
+// so tests can exercise the non-docker-local path without a plugn install.
+var appSchedulerFor = common.GetAppScheduler
+
 // buildDockerVFlag formats the Docker -v argument for a docker-local
 // attachment.
 func buildDockerVFlag(entry *Entry, attachment *Attachment) string {
-	host := entry.HostPath
+	host := HostPathForDocker(entry.HostPath)
 	container := attachment.ContainerPath
 	if host == "" || container == "" {
 		return ""
diff --git a/plugins/storage/triggers_test.go b/plugins/storage/triggers_test.go
index ac4e6731e..f8913be75 100644
--- a/plugins/storage/triggers_test.go
+++ b/plugins/storage/triggers_test.go
@@ -60,3 +60,146 @@ func TestBuildDockerVFlagVolumeOptions(t *testing.T) {
 	roOpts := buildDockerVFlag(entry, &Attachment{ContainerPath: "/container", Readonly: true, VolumeOptions: "noexec,nosuid"})
 	Expect(roOpts).To(Equal("-v /host:/container:ro,noexec,nosuid"))
 }
+
+func TestBuildDockerVFlagRewritesLibHostRoot(t *testing.T) {
+	RegisterTestingT(t)
+
+	t.Setenv("DOKKU_LIB_ROOT", "/var/lib/dokku")
+	t.Setenv("DOKKU_LIB_HOST_ROOT", "/host/var/lib/dokku")
+
+	entry := &Entry{HostPath: "/var/lib/dokku/data/storage/demo"}
+	flag := buildDockerVFlag(entry, &Attachment{ContainerPath: "/app/data"})
+	Expect(flag).To(Equal("-v /host/var/lib/dokku/data/storage/demo:/app/data"))
+}
+
+func TestTriggerDockerArgsRejectsSchedulerMismatch(t *testing.T) {
+	RegisterTestingT(t)
+	root := withTempLibRoot(t)
+
+	Expect(SaveEntry(&Entry{
+		Name:      "demo-pvc",
+		Scheduler: SchedulerK3s,
+	})).To(Succeed())
+
+	writeAttachmentsFile(t, root, "demo", []*Attachment{
+		{
+			EntryName:     "demo-pvc",
+			ContainerPath: "/data",
+			Phases:        []string{PhaseDeploy},
+		},
+	})
+
+	err := TriggerDockerArgs("demo", PhaseDeploy, "web")
+	Expect(err).To(HaveOccurred())
+	Expect(err.Error()).To(Equal(`storage entry "demo-pvc" is scheduler=k3s but is mounted on a docker-local app; recreate it with --scheduler docker-local`))
+}
+
+// TestTriggerDockerArgsRejectsSchedulerMismatchOutOfScope pins that the
+// scheduler check runs over every attachment in the phase, not just the ones
+// the process type being deployed would actually mount. An entry created for
+// the wrong scheduler has to fail the deploy whichever process starts first.
+func TestTriggerDockerArgsRejectsSchedulerMismatchOutOfScope(t *testing.T) {
+	RegisterTestingT(t)
+	root := withTempLibRoot(t)
+
+	Expect(SaveEntry(&Entry{
+		Name:      "demo-pvc",
+		Scheduler: SchedulerK3s,
+	})).To(Succeed())
+
+	writeAttachmentsFile(t, root, "demo", []*Attachment{
+		{
+			EntryName:     "demo-pvc",
+			ContainerPath: "/data",
+			Phases:        []string{PhaseDeploy},
+			ProcessType:   "worker",
+		},
+	})
+
+	_, err := dockerVFlagsForProcess("demo", PhaseDeploy, "web")
+	Expect(err).To(HaveOccurred())
+}
+
+// TestDockerVFlagsForProcessSkipsOtherSchedulers covers apps that do not
+// deploy with docker-local. The docker-args triggers are fired for every app -
+// the app.json deploy-task path builds its ephemeral container with docker
+// whatever the app's scheduler is - so a k3s app reaches this code with k3s
+// entries attached. Those are PersistentVolumeClaims its own scheduler mounts,
+// so the right answer is no flags, not an error.
+func TestDockerVFlagsForProcessSkipsOtherSchedulers(t *testing.T) {
+	RegisterTestingT(t)
+	root := withTempLibRoot(t)
+
+	previous := appSchedulerFor
+	appSchedulerFor = func(string) string { return SchedulerK3s }
+	t.Cleanup(func() { appSchedulerFor = previous })
+
+	Expect(SaveEntry(&Entry{
+		Name:      "demo-pvc",
+		Scheduler: SchedulerK3s,
+	})).To(Succeed())
+
+	writeAttachmentsFile(t, root, "demo", []*Attachment{
+		{
+			EntryName:     "demo-pvc",
+			ContainerPath: "/data",
+			Phases:        []string{PhaseDeploy},
+		},
+	})
+
+	flags, err := dockerVFlagsForProcess("demo", PhaseDeploy, "web")
+	Expect(err).NotTo(HaveOccurred())
+	Expect(flags).To(BeEmpty())
+}
+
+// TestDockerVFlagsForProcessScopes is the docker-local half of #9059. An
+// attachment scoped to a named process type reaches that process only; the
+// default scope reaches every process, including containers that belong to no
+// process at all - the app.json deploy-task path passes an empty process type.
+func TestDockerVFlagsForProcessScopes(t *testing.T) {
+	RegisterTestingT(t)
+	root := withTempLibRoot(t)
+
+	for _, name := range []string{"shared", "web-only", "legacy"} {
+		Expect(SaveEntry(&Entry{
+			Name:      name,
+			Scheduler: SchedulerDockerLocal,
+			HostPath:  "/host/" + name,
+		})).To(Succeed())
+	}
+
+	writeAttachmentsFile(t, root, "demo", []*Attachment{
+		{
+			EntryName:     "shared",
+			ContainerPath: "/shared",
+			Phases:        []string{PhaseDeploy},
+			ProcessType:   DefaultProcessType,
+		},
+		{
+			EntryName:     "web-only",
+			ContainerPath: "/web",
+			Phases:        []string{PhaseDeploy},
+			ProcessType:   "web",
+		},
+		{
+			// Written before the process-type field existed.
+			EntryName:     "legacy",
+			ContainerPath: "/legacy",
+			Phases:        []string{PhaseDeploy},
+		},
+	})
+
+	for _, testCase := range []struct {
+		processType string
+		expected    []string
+	}{
+		{processType: "web", expected: []string{"-v /host/legacy:/legacy", "-v /host/shared:/shared", "-v /host/web-only:/web"}},
+		{processType: "worker", expected: []string{"-v /host/legacy:/legacy", "-v /host/shared:/shared"}},
+		{processType: "", expected: []string{"-v /host/legacy:/legacy", "-v /host/shared:/shared"}},
+		{processType: DefaultProcessType, expected: []string{"-v /host/legacy:/legacy", "-v /host/shared:/shared"}},
+	} {
+		flags, err := dockerVFlagsForProcess("demo", PhaseDeploy, testCase.processType)
+		Expect(err).NotTo(HaveOccurred())
+		Expect(flags).To(Equal(testCase.expected), "process type %q", testCase.processType)
+	}
+}
diff --git a/plugins/trace/plugin.toml b/plugins/trace/plugin.toml
index 209f1d52b..e9408bf50 100644
--- a/plugins/trace/plugin.toml
+++ b/plugins/trace/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core trace plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/traefik-vhosts/Dockerfile b/plugins/traefik-vhosts/Dockerfile
index 10165a3f6..9ec18152c 100644
--- a/plugins/traefik-vhosts/Dockerfile
+++ b/plugins/traefik-vhosts/Dockerfile
@@ -1 +1 @@
-FROM traefik:v3.7.10
+FROM traefik:v3.7.17
diff --git a/plugins/traefik-vhosts/Makefile b/plugins/traefik-vhosts/Makefile
index e868730fe..54912710d 100644
--- a/plugins/traefik-vhosts/Makefile
+++ b/plugins/traefik-vhosts/Makefile
@@ -1,4 +1,3 @@
-GOARCH ?= amd64
 TRIGGERS = triggers/report
 BUILD = report-subcommand triggers
 PLUGIN_NAME = traefik-vhosts
diff --git a/plugins/traefik-vhosts/docker-args-process-deploy b/plugins/traefik-vhosts/docker-args-process-deploy
index 96937e5e5..1f62ea2d6 100755
--- a/plugins/traefik-vhosts/docker-args-process-deploy
+++ b/plugins/traefik-vhosts/docker-args-process-deploy
@@ -14,11 +14,26 @@ trigger-traefik-vhosts-docker-args-process-deploy() {
   local proxy_container_https_port proxy_container_https_port_candidate proxy_host_https_port_candidate
   local STDIN=$(cat)
 
-  if [[ "$PROC_TYPE" != "web" ]]; then
+  if [[ "$(plugn trigger proxy-type "$APP")" != "traefik" ]]; then
     return
   fi
 
-  if [[ "$(plugn trigger proxy-type "$APP")" != "traefik" ]]; then
+  if [[ "$PROC_TYPE" != "web" ]]; then
+    # Non-web processes are only labeled when at least one path-based route
+    # targets the process. Otherwise traefik should ignore the container.
+    local route_line route_proc
+    local has_route=false
+    while IFS='|' read -r route_proc _ _ _; do
+      if [[ "$route_proc" == "$PROC_TYPE" ]]; then
+        has_route=true
+        break
+      fi
+    done < <(plugn trigger proxy-routes-list "$APP")
+    if [[ "$has_route" != "true" ]]; then
+      echo -n "$STDIN"
+      return
+    fi
+    fn-traefik-route-labels "$APP" "$PROC_TYPE" "$STDIN"
     return
   fi
 
@@ -130,27 +145,34 @@ trigger-traefik-vhosts-docker-args-process-deploy() {
       fi
     fi
 
-    local app_json hc_path hc_scheme hc_port hc_timeout hc_interval hc_filter
-    app_json="$(plugn trigger app-json-get-content "$APP" 2>/dev/null || echo "{}")"
-    hc_filter='.healthchecks.web // [] | map(select(.type == "readiness" and .path != null and .path != "")) | .[0]'
-    hc_path=$(echo "$app_json" | jq -r "$hc_filter | .path // empty")
-    if [[ -n "$hc_path" ]]; then
-      hc_scheme=$(echo "$app_json" | jq -r "$hc_filter | .scheme // empty")
-      hc_port=$(echo "$app_json" | jq -r "$hc_filter | .port // empty")
-      hc_timeout=$(echo "$app_json" | jq -r "$hc_filter | .timeout // empty")
-      hc_interval=$(echo "$app_json" | jq -r "$hc_filter | .wait // empty")
+    local healthcheck hc_path hc_scheme hc_port hc_timeout hc_interval
+    healthcheck="$(fn-proxy-get-readiness-healthcheck "$APP")"
+    if [[ -n "$healthcheck" ]]; then
+      hc_path=$(echo "$healthcheck" | jq -r ".path // empty")
+      hc_scheme=$(echo "$healthcheck" | jq -r ".scheme // empty")
+      hc_port=$(echo "$healthcheck" | jq -r ".port // empty")
+      hc_timeout=$(echo "$healthcheck" | jq -r ".timeout // empty")
+      hc_interval=$(echo "$healthcheck" | jq -r ".wait // empty")
+
+      if ! fn-proxy-healthcheck-path-is-valid "$hc_path"; then
+        dokku_log_fail "Invalid app.json healthcheck path for traefik: path must start with a / and must not contain whitespace, control characters, quotes, or backslashes"
+      fi
+
+      if ! fn-proxy-healthcheck-scheme-is-valid "$hc_scheme"; then
+        dokku_log_fail "Invalid app.json healthcheck scheme for traefik: scheme must be one of http or https"
+      fi
 
       if [[ -n "$proxy_container_http_port" ]]; then
-        output="$output --label traefik.http.services.$APP-$PROC_TYPE-http.loadbalancer.healthcheck.path=$hc_path"
-        [[ -n "$hc_scheme" ]] && output="$output --label traefik.http.services.$APP-$PROC_TYPE-http.loadbalancer.healthcheck.scheme=$hc_scheme"
+        output="$output --label \"traefik.http.services.$APP-$PROC_TYPE-http.loadbalancer.healthcheck.path=$hc_path\""
+        [[ -n "$hc_scheme" ]] && output="$output --label \"traefik.http.services.$APP-$PROC_TYPE-http.loadbalancer.healthcheck.scheme=$hc_scheme\""
         [[ -n "$hc_port" ]] && output="$output --label traefik.http.services.$APP-$PROC_TYPE-http.loadbalancer.healthcheck.port=$hc_port"
         [[ -n "$hc_timeout" ]] && output="$output --label traefik.http.services.$APP-$PROC_TYPE-http.loadbalancer.healthcheck.timeout=${hc_timeout}s"
         [[ -n "$hc_interval" ]] && output="$output --label traefik.http.services.$APP-$PROC_TYPE-http.loadbalancer.healthcheck.interval=${hc_interval}s"
       fi
 
       if [[ -n "$proxy_container_https_port" ]]; then
-        output="$output --label traefik.http.services.$APP-$PROC_TYPE-https.loadbalancer.healthcheck.path=$hc_path"
-        [[ -n "$hc_scheme" ]] && output="$output --label traefik.http.services.$APP-$PROC_TYPE-https.loadbalancer.healthcheck.scheme=$hc_scheme"
+        output="$output --label \"traefik.http.services.$APP-$PROC_TYPE-https.loadbalancer.healthcheck.path=$hc_path\""
+        [[ -n "$hc_scheme" ]] && output="$output --label \"traefik.http.services.$APP-$PROC_TYPE-https.loadbalancer.healthcheck.scheme=$hc_scheme\""
         [[ -n "$hc_port" ]] && output="$output --label traefik.http.services.$APP-$PROC_TYPE-https.loadbalancer.healthcheck.port=$hc_port"
         [[ -n "$hc_timeout" ]] && output="$output --label traefik.http.services.$APP-$PROC_TYPE-https.loadbalancer.healthcheck.timeout=${hc_timeout}s"
         [[ -n "$hc_interval" ]] && output="$output --label traefik.http.services.$APP-$PROC_TYPE-https.loadbalancer.healthcheck.interval=${hc_interval}s"
diff --git a/plugins/traefik-vhosts/go.mod b/plugins/traefik-vhosts/go.mod
index 07f22ec1d..7b88ac169 100644
--- a/plugins/traefik-vhosts/go.mod
+++ b/plugins/traefik-vhosts/go.mod
@@ -1,29 +1,29 @@
 module github.com/dokku/dokku/plugins/traefik-vhosts
 
-go 1.26.2
+go 1.27.1
 
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
-	github.com/spf13/pflag v1.0.10
+	github.com/spf13/pflag v1.1.0
 )
 
 require (
 	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/sync v0.25.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 )
 
 replace github.com/dokku/dokku/plugins/common => ../common
diff --git a/plugins/traefik-vhosts/go.sum b/plugins/traefik-vhosts/go.sum
index 14bf42b1c..9ada61068 100644
--- a/plugins/traefik-vhosts/go.sum
+++ b/plugins/traefik-vhosts/go.sum
@@ -1,25 +1,24 @@
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
 github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
 github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=
+github.com/onsi/gomega v1.44.0/go.mod h1:e/C2HwaZ1DhvjzXXuFhcR7hY7Sh9pl7MmoWKEjzwcdA=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
@@ -28,28 +27,23 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag=
+github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sync v0.25.0 h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs=
+golang.org/x/sync v0.25.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
diff --git a/plugins/traefik-vhosts/internal-functions b/plugins/traefik-vhosts/internal-functions
index 49b9afc5c..29df8bd6f 100755
--- a/plugins/traefik-vhosts/internal-functions
+++ b/plugins/traefik-vhosts/internal-functions
@@ -4,6 +4,89 @@ source "$PLUGIN_CORE_AVAILABLE_PATH/common/property-functions"
 set -eo pipefail
 [[ $DOKKU_TRACE ]] && set -x
 
+fn-traefik-route-labels() {
+  declare desc="emits per-route traefik labels for a non-web container"
+  declare APP="$1" PROC_TYPE="$2" STDIN="$3"
+  local host_rule output route_proc route_port route_path route_strip
+  local router_name service_name middleware_name path_len
+
+  host_rule="$(fn-traefik-host-rule "$APP")"
+  output="--label traefik.enable=true"
+
+  while IFS='|' read -r route_proc route_port route_path route_strip; do
+    [[ -z "$route_proc" ]] && continue
+    [[ "$route_proc" != "$PROC_TYPE" ]] && continue
+
+    local route_slug
+    route_slug="$(fn-traefik-route-slug "$route_path")"
+    router_name="${APP}-${route_proc}-${route_slug}"
+    service_name="${APP}-${route_proc}-${route_slug}"
+    path_len="${#route_path}"
+
+    local rule="PathPrefix(\`${route_path}\`)"
+    if [[ -n "$host_rule" ]]; then
+      rule="(${host_rule}) && ${rule}"
+    fi
+
+    output="$output --label \"traefik.http.routers.${router_name}.rule=${rule}\""
+    output="$output --label traefik.http.routers.${router_name}.entrypoints=$(fn-traefik-computed-http-entry-point)"
+    # No explicit priority - traefik's default (rule length) gives
+    # longest-prefix-wins because our rule includes both Host(...) and
+    # PathPrefix(...), which is always longer than web's bare Host(...) rule.
+    output="$output --label traefik.http.routers.${router_name}.service=${service_name}"
+    output="$output --label traefik.http.services.${service_name}.loadbalancer.server.port=${route_port}"
+
+    if [[ "$route_strip" == "1" ]]; then
+      middleware_name="${router_name}-strip"
+      output="$output --label traefik.http.middlewares.${middleware_name}.stripprefix.prefixes=${route_path}"
+      output="$output --label traefik.http.routers.${router_name}.middlewares=${middleware_name}"
+    fi
+  done < <(plugn trigger proxy-routes-list "$APP")
+
+  local proxy_labels_file_path=$(fn-proxy-get-labels-file-path "traefik" "$APP")
+  if [[ -f "$proxy_labels_file_path" ]]; then
+    while read -r line; do
+      [[ -z "$line" ]] && continue
+      output="$output --label '$line'"
+    done <"$proxy_labels_file_path"
+  fi
+
+  echo -n "$STDIN $output"
+}
+
+fn-traefik-route-slug() {
+  declare desc="returns a deterministic kebab-case slug for a route path"
+  declare ROUTE_PATH="$1"
+  local s="${ROUTE_PATH#/}"
+  s="${s%/}"
+  s="${s//\//-}"
+  s="${s,,}"
+  if [[ -z "$s" ]]; then
+    s="root"
+  fi
+  echo "$s"
+}
+
+fn-traefik-host-rule() {
+  declare desc="builds a traefik Host(\`d1\`) || Host(\`d2\`) rule fragment from an app's domains"
+  declare APP="$1"
+  local app_domains domain result=""
+
+  app_domains="$(plugn trigger domains-list "$APP")"
+  if [[ -z "$app_domains" ]]; then
+    return
+  fi
+
+  for domain in $(echo "$app_domains" | xargs); do
+    if [[ -z "$result" ]]; then
+      result="Host(\`${domain}\`)"
+      continue
+    fi
+    result="${result} || Host(\`${domain}\`)"
+  done
+  echo "$result"
+}
+
 fn-traefik-logs() {
   declare desc="shows the logs for the traefik container"
   declare TAIL="$1" NUM="$2"
diff --git a/plugins/traefik-vhosts/plugin.toml b/plugins/traefik-vhosts/plugin.toml
index 47c02664d..e30156988 100644
--- a/plugins/traefik-vhosts/plugin.toml
+++ b/plugins/traefik-vhosts/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core traefik-vhosts plugin"
-version = "0.38.27"
+version = "0.38.34"
 [plugin.config]
diff --git a/plugins/traefik-vhosts/subcommands/set b/plugins/traefik-vhosts/subcommands/set
index 247ab1222..f1f6513c9 100755
--- a/plugins/traefik-vhosts/subcommands/set
+++ b/plugins/traefik-vhosts/subcommands/set
@@ -25,11 +25,8 @@ cmd-traefik-set() {
     dokku_log_fail "Invalid key specified, valid keys include: api-enabled api-entry-point api-entry-point-address api-vhost challenge-mode dashboard-enabled basic-auth-username basic-auth-password dns-provider dns-provider-<ENV_VAR> image letsencrypt-email letsencrypt-server log-level http-entry-point https-entry-point"
   fi
 
-  if ! fn-in-array "$KEY" "${GLOBAL_KEYS[@]}" && [[ "$is_dns_provider_env_var" != "true" ]]; then
-    if [[ "$APP" == "--global" ]]; then
-      dokku_log_fail "The key '$KEY' cannot be set globally"
-    fi
-    verify_app_name "$APP"
+  if ! fn-in-array "$KEY" "${GLOBAL_KEYS[@]}" && [[ "$is_dns_provider_env_var" != "true" ]] && [[ "$APP" == "--global" ]]; then
+    dokku_log_fail "The key '$KEY' cannot be set globally"
   fi
 
   # dns-provider-* keys and GLOBAL_ONLY_KEYS can only be set globally
@@ -41,6 +38,8 @@ cmd-traefik-set() {
     dokku_log_fail "The key '$KEY' can only be set globally"
   fi
 
+  [[ "$APP" == "--global" ]] || verify_app_name "$APP"
+
   if [[ -n "$VALUE" ]]; then
     dokku_log_info2_quiet "Setting ${KEY} to ${VALUE}"
     fn-plugin-property-write "traefik" "$APP" "$KEY" "$VALUE"
diff --git a/tests.mk b/tests.mk
index 701ac2380..b0e96dd57 100644
--- a/tests.mk
+++ b/tests.mk
@@ -182,16 +182,21 @@ go-tests:
 	@$(MAKE) go-test-plugin PLUGIN_NAME=common
 	@$(MAKE) go-test-plugin PLUGIN_NAME=config
 	@$(MAKE) go-test-plugin PLUGIN_NAME=cron
+	@$(MAKE) go-test-plugin PLUGIN_NAME=datastore
 	@$(MAKE) go-test-plugin PLUGIN_NAME=docker-options
 	@$(MAKE) go-test-plugin PLUGIN_NAME=logs
 	@$(MAKE) go-test-plugin PLUGIN_NAME=network
+	@$(MAKE) go-test-plugin PLUGIN_NAME=nginx-vhosts
+	@$(MAKE) go-test-plugin PLUGIN_NAME=ps
+	@$(MAKE) go-test-plugin PLUGIN_NAME=registry
+	@$(MAKE) go-test-plugin PLUGIN_NAME=resource
 	@$(MAKE) go-test-plugin PLUGIN_NAME=buildpacks
 	@$(MAKE) go-test-plugin PLUGIN_NAME=scheduler-k3s
 	@$(MAKE) go-test-plugin PLUGIN_NAME=storage
 	@$(MAKE) go-test-plugin PLUGIN_NAME=traefik-vhosts
 
 go-test-plugin:
-	cd plugins/$(PLUGIN_NAME) && go get github.com/onsi/gomega && DOKKU_ROOT=/home/dokku DOKKU_LIB_ROOT=/var/lib/dokku go test -v -p 1 -race -mod=readonly || exit $$?
+	cd plugins/$(PLUGIN_NAME) && DOKKU_ROOT=/home/dokku DOKKU_LIB_ROOT=/var/lib/dokku go test -v -p 1 -race -mod=readonly || exit $$?
 
 go-test-plugin-in-docker:
 	@echo running go unit tests...
@@ -234,6 +239,10 @@ deploy-test-config:
 	@echo deploying config app...
 	cd tests && ./test_deploy ./apps/config $(DOKKU_DOMAIN)
 
+deploy-test-coredns-docker-outage:
+	@echo testing nginx-vhosts behavior when coredns-docker is unavailable...
+	cd tests && ./test_coredns_outage $(DOKKU_DOMAIN) docker
+
 deploy-test-dockerfile:
 	@echo deploying dockerfile app...
 	cd tests && ./test_deploy ./apps/dockerfile $(DOKKU_DOMAIN)
@@ -333,7 +342,11 @@ tests-ci-retry-failed:
 	tar xzf /tmp/bats-retry.tgz -C /usr/local/bin
 	bats-retry --execute test-results/bats
 
-test-ci-docker: setup-docker-deploy-tests deploy-test-checks-root deploy-test-config deploy-test-multi deploy-test-go-fail-predeploy deploy-test-go-fail-postdeploy test-ci-binaries
+deploy-test-storage-lib-host-root:
+	@echo deploy-test-storage-lib-host-root
+	cd tests/docker && bats storage.bats
+
+test-ci-docker: setup-docker-deploy-tests deploy-test-checks-root deploy-test-config deploy-test-multi deploy-test-go-fail-predeploy deploy-test-go-fail-postdeploy deploy-test-storage-lib-host-root deploy-test-coredns-docker-outage test-ci-binaries
 
 generate-ssl-tars: generate-ssl-tar generate-ssl-sans-tar generate-ssl-wildcard-tar
 
diff --git a/tests/apps/checks-root/package-lock.json b/tests/apps/checks-root/package-lock.json
index 4cc8f722e..0f6f4be17 100644
--- a/tests/apps/checks-root/package-lock.json
+++ b/tests/apps/checks-root/package-lock.json
@@ -28,18 +28,18 @@
       }
     },
     "node_modules/body-parser": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
-      "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==",
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.4.0.tgz",
+      "integrity": "sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==",
       "license": "MIT",
       "dependencies": {
         "bytes": "^3.1.2",
-        "content-type": "^2.0.0",
+        "content-type": "^2.1.0",
         "debug": "^4.4.3",
         "http-errors": "^2.0.1",
-        "iconv-lite": "^0.7.2",
+        "iconv-lite": "^0.7.3",
         "on-finished": "^2.4.1",
-        "qs": "^6.15.2",
+        "qs": "^6.16.1",
         "raw-body": "^3.0.2",
         "type-is": "^2.1.0"
       },
@@ -51,19 +51,6 @@
         "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/body-parser/node_modules/content-type": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
-      "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
     "node_modules/bytes": {
       "version": "3.1.2",
       "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
@@ -103,24 +90,29 @@
       }
     },
     "node_modules/content-disposition": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-1.0.0.tgz",
-      "integrity": "sha512-Au9nRL8VNUut/XSzbQA38+M78dzP4D+eqg3gfJHMIHHYa3bg067xj1KxMUWj+VULbiZMowKngFFbKczUrNJ1mg==",
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-2.0.1.tgz",
+      "integrity": "sha512-e+H0ZXHSWYrENhQzw1LPuP4oF5MzVKmDU6d3hxlvaPEYLLg62MxtQNPRx4SYSuYJSBUgnQIG4HIN2tEtNv7Dog==",
       "license": "MIT",
-      "dependencies": {
-        "safe-buffer": "5.2.1"
-      },
       "engines": {
-        "node": ">= 0.6"
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/content-type": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
-      "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
+      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
       "license": "MIT",
       "engines": {
-        "node": ">= 0.6"
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/cookie": {
@@ -214,9 +206,9 @@
       }
     },
     "node_modules/es-object-atoms": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
-      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
+      "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0"
@@ -241,15 +233,15 @@
       }
     },
     "node_modules/express": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz",
-      "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==",
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/express/-/express-5.3.0.tgz",
+      "integrity": "sha512-qCqy1xSoaugxOD4IVHb1ZWdkvCF2W3aE2okKouWj8VwJ+ztskSiXoBnCSJqfKT+cVPJhuJqe9YLbY425+Zh00g==",
       "license": "MIT",
       "dependencies": {
         "accepts": "^2.0.0",
-        "body-parser": "^2.2.1",
-        "content-disposition": "^1.0.0",
-        "content-type": "^1.0.5",
+        "body-parser": "^2.3.0",
+        "content-disposition": "^2.0.1",
+        "content-type": "^2.0.0",
         "cookie": "^0.7.1",
         "cookie-signature": "^1.2.1",
         "debug": "^4.4.0",
@@ -265,14 +257,14 @@
         "on-finished": "^2.4.1",
         "once": "^1.4.0",
         "parseurl": "^1.3.3",
-        "proxy-addr": "^2.0.7",
-        "qs": "^6.14.0",
+        "proxy-addr": "^2.0.8",
+        "qs": "^6.16.0",
         "range-parser": "^1.2.1",
         "router": "^2.2.0",
         "send": "^1.1.0",
         "serve-static": "^2.2.0",
         "statuses": "^2.0.1",
-        "type-is": "^2.0.1",
+        "type-is": "^2.1.0",
         "vary": "^1.1.2"
       },
       "engines": {
@@ -389,9 +381,9 @@
       }
     },
     "node_modules/hasown": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
-      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
+      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
       "license": "MIT",
       "dependencies": {
         "function-bind": "^1.1.2"
@@ -576,9 +568,9 @@
       }
     },
     "node_modules/proxy-addr": {
-      "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
-      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+      "version": "2.0.8",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
+      "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
       "license": "MIT",
       "dependencies": {
         "forwarded": "0.2.0",
@@ -586,15 +578,20 @@
       },
       "engines": {
         "node": ">= 0.10"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/qs": {
-      "version": "6.15.2",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz",
-      "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==",
+      "version": "6.17.0",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.17.0.tgz",
+      "integrity": "sha512-5LK5BZ2XDHMvcUJaf0CQ5HL3aVgKbpklvByC7qLSxYkfE8COEEbJg5xCHWCTqzqi0Gs4Jn5Mv5v3R38W6edscA==",
       "license": "BSD-3-Clause",
       "dependencies": {
-        "side-channel": "^1.1.0"
+        "es-define-property": "^1.0.1",
+        "side-channel": "^1.1.1"
       },
       "engines": {
         "node": ">=0.6"
@@ -643,26 +640,6 @@
         "node": ">= 18"
       }
     },
-    "node_modules/safe-buffer": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
-      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT"
-    },
     "node_modules/safer-buffer": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
@@ -713,14 +690,14 @@
       "license": "ISC"
     },
     "node_modules/side-channel": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
-      "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz",
+      "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
-        "object-inspect": "^1.13.3",
-        "side-channel-list": "^1.0.0",
+        "object-inspect": "^1.13.4",
+        "side-channel-list": "^1.0.1",
         "side-channel-map": "^1.0.1",
         "side-channel-weakmap": "^1.0.2"
       },
@@ -732,13 +709,13 @@
       }
     },
     "node_modules/side-channel-list": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.0.tgz",
-      "integrity": "sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==",
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
+      "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
-        "object-inspect": "^1.13.3"
+        "object-inspect": "^1.13.4"
       },
       "engines": {
         "node": ">= 0.4"
@@ -820,19 +797,6 @@
         "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/type-is/node_modules/content-type": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
-      "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
     "node_modules/unpipe": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
diff --git a/tests/apps/dockerfile-app-json-formations/package.json b/tests/apps/dockerfile-app-json-formations/package.json
index fbc0ffdac..7dd7beedb 100644
--- a/tests/apps/dockerfile-app-json-formations/package.json
+++ b/tests/apps/dockerfile-app-json-formations/package.json
@@ -2,7 +2,7 @@
   "name": "node-example",
   "version": "0.0.1",
   "dependencies": {
-    "express": "5.2.x"
+    "express": "5.3.x"
   },
   "engines": {
     "node": "4.2.x"
diff --git a/tests/apps/dockerfile-entrypoint/Dockerfile b/tests/apps/dockerfile-entrypoint/Dockerfile
index 0998cc27a..dfc97947c 100644
--- a/tests/apps/dockerfile-entrypoint/Dockerfile
+++ b/tests/apps/dockerfile-entrypoint/Dockerfile
@@ -1,4 +1,4 @@
-FROM ruby:4.0.6
+FROM ruby:4.0.9
 
 RUN mkdir /app
 WORKDIR /app
diff --git a/tests/apps/dockerfile-procfile-bad/package.json b/tests/apps/dockerfile-procfile-bad/package.json
index fbc0ffdac..7dd7beedb 100644
--- a/tests/apps/dockerfile-procfile-bad/package.json
+++ b/tests/apps/dockerfile-procfile-bad/package.json
@@ -2,7 +2,7 @@
   "name": "node-example",
   "version": "0.0.1",
   "dependencies": {
-    "express": "5.2.x"
+    "express": "5.3.x"
   },
   "engines": {
     "node": "4.2.x"
diff --git a/tests/apps/dockerfile-procfile/package.json b/tests/apps/dockerfile-procfile/package.json
index fbc0ffdac..7dd7beedb 100644
--- a/tests/apps/dockerfile-procfile/package.json
+++ b/tests/apps/dockerfile-procfile/package.json
@@ -2,7 +2,7 @@
   "name": "node-example",
   "version": "0.0.1",
   "dependencies": {
-    "express": "5.2.x"
+    "express": "5.3.x"
   },
   "engines": {
     "node": "4.2.x"
diff --git a/tests/apps/dockerfile-release/Dockerfile b/tests/apps/dockerfile-release/Dockerfile
index d20fa2266..9811704c3 100644
--- a/tests/apps/dockerfile-release/Dockerfile
+++ b/tests/apps/dockerfile-release/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.15.0rc1-bookworm
+FROM python:3.15.0-bookworm
 
 RUN pip install --user pipenv
 ENV PATH="${PATH}:/root/.local/bin"
diff --git a/tests/apps/dockerfile-release/Pipfile.lock b/tests/apps/dockerfile-release/Pipfile.lock
index c63f42958..c27fefefb 100644
--- a/tests/apps/dockerfile-release/Pipfile.lock
+++ b/tests/apps/dockerfile-release/Pipfile.lock
@@ -18,11 +18,11 @@
     "default": {
         "asgiref": {
             "hashes": [
-                "sha256:59dcb51c272ad209d59bed5708a64a333083e86017d7fcdd67498eeab7784340",
-                "sha256:fe386d1c2bff7259ea95929266d12a8cf9a8b5a1c2598402967d8792e7a7c094"
+                "sha256:034cc8cbf72d00553b4be256703ac545120b4e50af13b49dec99da899aeeecb4",
+                "sha256:f9596a2434512686473d50f96ff6207fbba49ae1a785dfac614df4aeb085674d"
             ],
-            "markers": "python_version >= '3.10'",
-            "version": "==3.12.1"
+            "markers": "python_version >= '3.11'",
+            "version": "==3.13.0"
         },
         "dj-database-url": {
             "hashes": [
@@ -35,30 +35,30 @@
         },
         "django": {
             "hashes": [
-                "sha256:9d4d93be539a18ab80d058eb515900e10951e04c537c5a6b394fc49528d3251f",
-                "sha256:f04fb3b36ee119e1af4fa1d397d5fd6cf12700f49321e84d4f4c642c5b1973db"
+                "sha256:5965d974a5218a2b68a11dd1276434707f23886525c23f0598eccedaf4f4ca00",
+                "sha256:ad03d8abc51dbff95ebf34b27123cf0c26a3b62db7ba0cd520783686362533d1"
             ],
             "index": "pypi",
             "markers": "python_version >= '3.10'",
-            "version": "==5.2.17"
+            "version": "==5.2.19"
         },
         "djangorestframework": {
             "hashes": [
-                "sha256:2323a5111837e0b784dcb8323abc78ecc54fa2a5af7aff2677cf50cdd849477f",
-                "sha256:381fc44d3249c9565c5f723850855b734e99030eb30957a49f506d3fe11d7dcb"
+                "sha256:446a9b352e7eff630421ab3f2328bd2401b109a9470afa4a31189994911ed030",
+                "sha256:8544bb674846731b1e3c9b309236ee1dc412905a0aa725be2ec193ca950a7d12"
             ],
             "index": "pypi",
             "markers": "python_version >= '3.10'",
-            "version": "==3.18.0"
+            "version": "==3.18.3"
         },
         "gunicorn": {
             "hashes": [
-                "sha256:1413d777bf99d31ebeb08acd354b01f1ecc44db0aa7b811ae7b86c669232e4f7",
-                "sha256:9f45bcddec5e9dc7a25a3bdccb0c6832f11fd5d4739b1ee36c8d2fec25f1dc86"
+                "sha256:1380f2f520abc3beb9e72cd2e728bd2d08a19b3ff6ac03ebd8da71d1798a4008",
+                "sha256:88d52e7c60b3af07bc8db431fbb450a94780f2cbe7c420c7cf1891392661c591"
             ],
             "index": "pypi",
             "markers": "python_version >= '3.10'",
-            "version": "==26.1.0"
+            "version": "==27.0.0"
         },
         "packaging": {
             "hashes": [
@@ -70,102 +70,85 @@
         },
         "psycopg2-binary": {
             "hashes": [
-                "sha256:00814e40fa23c2b37ef0a1e3c749d89982c73a9cb5046137f0752a22d432e82f",
-                "sha256:049366c6d884bdcd65d66e6ca1fdbebe670b56c6c9ba46f164e6667e90881964",
-                "sha256:0dc9228d47c46bda253d2ecd6bb93b56a9f2d7ad33b684a1fa3622bf74ffe30c",
-                "sha256:1006fb62f0f0bc5ce256a832356c6262e91be43f5e4eb15b5eaf38079464caf2",
-                "sha256:127467c6e476dd876634f17c3d870530e73ff454ff99bff73d36e80af28e1115",
-                "sha256:1c8ad4c08e00f7679559eaed7aff1edfffc60c086b976f93972f686384a95e2c",
-                "sha256:29d4d134bd0ab46ffb04e94aa3c5fa3ef582e9026609165e2f758ff76fc3a3be",
-                "sha256:3471336e1acfd9c7fe507b8bad5af9317b6a89294f9eb37bd9a030bb7bebcdc6",
-                "sha256:36512911ebb2b60a0c3e44d0bb5048c1980aced91235d133b7874f3d1d93487c",
-                "sha256:398fcd4db988c7d7d3713e2b8e18939776fd3fb447052daae4f24fa39daede4c",
-                "sha256:3d999bd982a723113c1a45b55a7a6a90d64d0ed2278020ed625c490ff7bef96c",
-                "sha256:40e7b28b63aaf737cb3a1edc3a9bbc9a9f4ad3dcb7152e8c1130e4050eddcb7d",
-                "sha256:411e85815652d13560fbe731878daa5d92378c4995a22302071890ec3397d019",
-                "sha256:4413d0caef93c5cf50b96863df4c2efe8c269bf2267df353225595e7e15e8df7",
-                "sha256:4766ab678563054d3f1d064a4db19cc4b5f9e3a8d9018592a8285cf200c248f3",
-                "sha256:4dfcf8e45ebb0c663be34a3442f65e17311f3367089cd4e5e3a3e8e62c978777",
-                "sha256:527e6342b3e44c2f0544f6b8e927d60de7f163f5723b8f1dfa7d2a84298738cd",
-                "sha256:54a0dfecab1b48731f934e06139dfe11e24219fb6d0ceb32177cf0375f14c7b5",
-                "sha256:5a0253224780c978746cb9be55a946bcdaf40fe3519c0f622924cdabdafe2c39",
-                "sha256:5ac9444edc768c02a6b6a591f070b8aae28ff3a99be57560ac996001580f294c",
-                "sha256:5c7cb4cbf894a1d36c720d713de507952c7c58f66d30834708f03dbe5c822ccf",
-                "sha256:5c8ce6c61bd1b1f6b9c24ee32211599f6166af2c55abb19456090a21fd16554b",
-                "sha256:5cdc05117180c5fa9c40eea8ea559ce64d73824c39d928b7da9fb5f6a9392433",
-                "sha256:612b965daee295ae2da8f8218ce1d274645dc76ef3f1abf6a0a94fd57eff876d",
-                "sha256:63a3ebbd543d3d1eda088ac99164e8c5bac15293ee91f20281fd17d050aee1c4",
-                "sha256:66a7685d7e548f10fb4ce32fb01a7b7f4aa702134de92a292c7bd9e0d3dbd290",
-                "sha256:6f3b3de8a74ef8db215f22edffb19e32dc6fa41340456de7ec99efdc8a7b3ec2",
-                "sha256:6f9cae1f848779b5b01f417e762c40d026ea93eb0648249a604728cda991dde3",
-                "sha256:718e1fc18edf573b02cb8aea868de8d8d33f99ce9620206aa9144b67b0985e94",
-                "sha256:77b348775efd4cdab410ec6609d81ccecd1139c90265fa583a7255c8064bc03d",
-                "sha256:7af18183109e23502c8b2ae7f6926c0882766f35b5175a4cd737ad825e4d7a1b",
-                "sha256:7c729a73c7b1b84de3582f73cdd27d905121dc2c531f3d9a3c32a3011033b965",
-                "sha256:83946ba43979ebfdc99a3cd0ee775c89f221df026984ba19d46133d8d75d3cd9",
-                "sha256:840066105706cd2eb29b9a1c2329620056582a4bf3e8169dec5c447042d0869f",
-                "sha256:863f5d12241ebe1c76a72a04c2113b6dc905f90b9cef0e9be0efd994affd9354",
-                "sha256:864c261b3690e1207d14bbfe0a61e27567981b80c47a778561e49f676f7ce433",
-                "sha256:89d19a9f7899e8eb0656a2b3a08e0da04c720a06db6e0033eab5928aabe60fa9",
-                "sha256:8ffdb59fe88f99589e34354a130217aa1fd2d615612402d6edc8b3dbc7a44463",
-                "sha256:96937c9c5d891f772430f418a7a8b4691a90c3e6b93cf72b5bd7cad8cbca32a5",
-                "sha256:98062447aebc20ed20add1f547a364fd0ef8933640d5372ff1873f8deb9b61be",
-                "sha256:995ce929eede89db6254b50827e2b7fd61e50d11f0b116b29fffe4a2e53c4580",
-                "sha256:9b818ceff717f98851a64bffd4c5eb5b3059ae280276dcecc52ac658dcf006a4",
-                "sha256:9fe06d93e72f1c048e731a2e3e7854a5bfaa58fc736068df90b352cefe66f03f",
-                "sha256:a46fe069b65255df410f856d842bc235f90e22ffdf532dda625fd4213d3fd9b1",
-                "sha256:a7e39a65b7d2a20e4ba2e0aaad1960b61cc2888d6ab047769f8347bd3c9ad915",
-                "sha256:a99eaab34a9010f1a086b126de467466620a750634d114d20455f3a824aae033",
-                "sha256:ab29414b25dcb698bf26bf213e3348abdcd07bbd5de032a5bec15bd75b298b03",
-                "sha256:ace94261f43850e9e79f6c56636c5e0147978ab79eda5e5e5ebf13ae146fc8fe",
-                "sha256:b4a9eaa6e7f4ff91bec10aa3fb296878e75187bced5cc4bafe17dc40915e1326",
-                "sha256:b6937f5fe4e180aeee87de907a2fa982ded6f7f15d7218f78a083e4e1d68f2a0",
-                "sha256:b9a339b79d37c1b45f3235265f07cdeb0cb5ad7acd2ac7720a5920989c17c24e",
-                "sha256:ba3df2fc42a1cfa45b72cf096d4acb2b885937eedc61461081d53538d4a82a86",
-                "sha256:c41321a14dd74aceb6a9a643b9253a334521babfa763fa873e33d89cfa122fb5",
-                "sha256:c5ee5213445dd45312459029b8c4c0a695461eb517b753d2582315bd07995f5e",
-                "sha256:c6528cefc8e50fcc6f4a107e27a672058b36cc5736d665476aeb413ba88dbb06",
-                "sha256:cb4a1dacdd48077150dc762a9e5ddbf32c256d66cb46f80839391aa458774936",
-                "sha256:cfa2517c94ea3af6deb46f81e1bbd884faa63e28481eb2f889989dd8d95e5f03",
-                "sha256:d2fa0d7caca8635c56e373055094eeda3208d901d55dd0ff5abc1d4e47f82b56",
-                "sha256:d3227a3bc228c10d21011a99245edca923e4e8bf461857e869a507d9a41fe9f6",
-                "sha256:d6fcbba8c9fed08a73b8ac61ea79e4821e45b1e92bb466230c5e746bbf3d5256",
-                "sha256:e4e184b1fb6072bf05388aa41c697e1b2d01b3473f107e7ec44f186a32cfd0b8",
-                "sha256:ee2d84ef5eb6c04702d2e9c372ad557fb027f26a5d82804f749dfb14c7fdd2ab",
-                "sha256:f12ae41fcafadb39b2785e64a40f9db05d6de2ac114077457e0e7c597f3af980",
-                "sha256:f625abb7020e4af3432d95342daa1aa0db3fa369eed19807aa596367ba791b10",
-                "sha256:f921f3cd87035ef7df233383011d7a53ea1d346224752c1385f1edfd790ceb6a",
-                "sha256:fb1828cf3da68f99e45ebce1355d65d2d12b6a78fb5dfb16247aad6bdef5f5d2",
-                "sha256:ffdd7dc5463ccd61845ac37b7012d0f35a1548df9febe14f8dd549be4a0bc81e"
-            ],
-            "index": "pypi",
-            "markers": "python_version >= '3.9'",
-            "version": "==2.9.12"
-        },
-        "pytz": {
-            "hashes": [
-                "sha256:1d8ce29db189191fb55338ee6d0387d82ab59f3d00eac103412d64e0ebd0c588",
-                "sha256:a151b3abb88eda1d4e34a9814df37de2a80e301e68ba0fd856fb9b46bfbbbffb"
-            ],
-            "version": "==2023.3"
-        },
-        "setuptools": {
-            "hashes": [
-                "sha256:025bccbbf0fa05b6192bc64ae1e7b16e001fd6d6d4d5de03c97b1c1ade523bef",
-                "sha256:29b23c360f22f414dc7336bb39178cc7bcbf6021ed2733cde173f09dba19abb3"
+                "sha256:0405dd4d97720e7ab177aa02e493f524907c4cb3c445ac173e2627948d3d0528",
+                "sha256:0463c00f946517f3e69192a59e6601e023ff9de45ad0a875eda3d6b1bebeb7ce",
+                "sha256:07b7bd9f410650c34c3532162cc329f112368d78a3fc8668cb1ea9df61bc11bf",
+                "sha256:086659ab083119f7ee87a779e31b94211cf162b708fc9a6bec771f75c73ac3e6",
+                "sha256:08d3b81a6a91775c937abf97d4c58fc9142e8e35fb91c387d24f81d15c98e6cf",
+                "sha256:0a6444ac48e2c04f691c2ddd542b38ba30c89463a2d446b3d74ec7d8fc90c964",
+                "sha256:0ebcf3c4266a695df9d0ef51296155f60c86ac51cf82f0d0dd2e827255a891c5",
+                "sha256:13d955f6054a705a19554364fe9888d0a6e8b0746dc7ebc08a447c7b4fd4145c",
+                "sha256:1752b9821f1377404d65ac43af03d59a1eccc57fb2c1eb8305f9a3fe8eb7a8ba",
+                "sha256:190c18b97d9ef72f2e88c451b6588af90d6bd7bf54cb94b963280dc86a2c7076",
+                "sha256:1f4c7bdbafdf9dc018efbc29213b73f8308332888ba76a4cf503f560bfd21705",
+                "sha256:202dedd5cadb3e5dfd4d0415ab2fc5d5b44f4208de5308938e3e74ae222b638e",
+                "sha256:215777c62ce81c3b487cefdb6a41969944eb982309f91349ff3ca0323d6f17ed",
+                "sha256:27e539b4cafd5e03dcd32921db1b12dd72fe549dd06bae6d4d2a5b5838465f24",
+                "sha256:28eb30bf4a52c1117406f45771038faa96f882fdeeeb0ce43b960a1dbc6c1fd2",
+                "sha256:2bf9f97a6df69a5d89d054b8cf5257a0916096c479800715fbfe7974dbcb3a26",
+                "sha256:2ca263643ae37998ae04d18e431df34d0d61f12b47640dab585f14b6dbe00798",
+                "sha256:31db6cba66df5231dfd91d9f69188bec3fe6c8baae384e93a0ce792067ee2d98",
+                "sha256:32cd049095135d2b69e824aea9056745a4aaaa9115a9febbc65584793665d0d0",
+                "sha256:33a6d3c47f9655b481b2cdc1b4bf71c235e054e55663d3066036b6ce5fbe5165",
+                "sha256:376ebf7d8aee4b7386b2bac31fdc27911e7e57cd0a88f1e038b8b149398ac008",
+                "sha256:38397def2d794ffde9db80f63d6820253e61b17483112652a318355f51a56f50",
+                "sha256:3aea95340825f5ff236e7b40f0b5602c2c77a1e95943f71fae34909834043d29",
+                "sha256:3dc3372b3731b3ef23407fe06b94f640ef87a2bda242fa386033d5589c87514a",
+                "sha256:3e60b06ec7f9dc3e5f1106d12706514b6d6b92c3dc438fcdf4e43e65cc660d1b",
+                "sha256:3f699a5225094a5c61402984e2fc1eca20e940223e76767c88189efb0c313f69",
+                "sha256:41c2eb569ebd0e1b02d30d361a46932923b193fe1b5e641fb4d547c75e218955",
+                "sha256:4c0214c7da18a28d108aa7108c8a3cca8035c7911ec97ef9ec0827569c9a2720",
+                "sha256:4d66bfd44a46eb88cff0287929a4193fb45166b6c1f84bb1b233cc17ece0813c",
+                "sha256:4e55357d1943673d491bbabb171c891704fc6a22441fea539e05a5c27a79ea3c",
+                "sha256:4ff0f575cbb14f30445858dcfdd751e043486f5290915df78a9818bc74042eff",
+                "sha256:5085f7ff7b1e890f279577cedeb8c628957869a340fa34a39f7f406500b3c916",
+                "sha256:541a487a9ccd72b5e38f37f27b0ce78cb7eb3e336e7b5277d45463010c03a7a8",
+                "sha256:562fe2a43b30e781848dce63d9080c15414c777c96df348c4342558338cc7bf3",
+                "sha256:5d89e064bb12b40cad696cf4975e6da86f8c60f14cd06cb6c1bc0a7f5d01761f",
+                "sha256:5f04ae99c9fbb94c3197ec88599ed7db921f6adcddfe83687a74c7ead4037c22",
+                "sha256:691da68ae5dd7c3ac77514357d35ece7b1ba8b5f3e6c92735198aa6159c355c8",
+                "sha256:6e696297891b56ff0115f0665de6ad774e1e301e4f60745b8d5024001ae7c2f6",
+                "sha256:6ede8595767e19d30a7e8a84a7d47bfde6176d45d194fed08dbb68d1584a780b",
+                "sha256:70d091f5c3a6177fac50c0da20181ce0e0c053f1e43c872d5f75bd6d9429c020",
+                "sha256:7e2405196a8cfe6cd3e54172a54452dcf85c241eaf2e9dde7190d7469f7f5ef7",
+                "sha256:81404c37e0344ebcf10aac127d33d35137e5dbab1daf9f3deee46188fd5879c2",
+                "sha256:81682c227cc1849c4a6adf7b85274229073bb4c9d6ad5697222c695dcea5a8a7",
+                "sha256:8cb734989420c18ca1b71a82da880e11988f5ff3fcdaadd669161de3e98794ac",
+                "sha256:930e7e58b33a4f9c39e7532d7a40147925cf3372baed4229cbebe0cf3ba9ce6b",
+                "sha256:aa37089795bd9701576edc2eb5849ce77a439eda9dfdfa47857449332cfa5292",
+                "sha256:b6ae51708201f501a171b02419d0c30878a743c369c9054eb1289f0f8d5979e2",
+                "sha256:c00ebe9a2f31151aade0db233dc1446513a95e92c39ce055ee097af0ae86be1c",
+                "sha256:c24c98fe1a113db287dfb1958771eafca97b7db812f23b7897c2a12b6b904c22",
+                "sha256:c519e406287085f43aa0d3061936edf1ba51286093532f215315c6ab8ba92c3b",
+                "sha256:d19aec88857d2a52f99eefcefdbbb45921fb2f777bee5186a355a23d9cf8a0b9",
+                "sha256:d2fc9342aad969b9a28490a4c3eaba94b35beb2d26e9a39b31d1430378aa71b2",
+                "sha256:d79530b4c1af657d5620a1d21b8e39f2996aa06821d5564d05b22d6b8cd413d0",
+                "sha256:db31cf7f617a51625f1473d8a66fc35dac159af8b28e80bc014ed3ee994a9fbf",
+                "sha256:dddfe650e7dda464d676c27fbedb5061f1ad05e1604627f54c770d7f799d36e9",
+                "sha256:dde942b46ce20f6c4464cdf551f3293207f803f4e4354454eb1f5599c3eb1fa1",
+                "sha256:dff5c70ed9789ccb0d97ff4a7da51dc523a255c4ec95df188fa5d44adcae4ea8",
+                "sha256:e324ecf60f952d21dd11413b8bbed0951bbd99579a06fd06f28bfc37737cd373",
+                "sha256:e3861eba31f8ea8663fd876166b032fd89179e42aa63764d6feb281f13f9eb60",
+                "sha256:f04ada42bcd537adbaf8b7f3140237a204e452a88d0c1831cfce69f7d2e59f4e",
+                "sha256:f124954a32640dfb5c000d33028f48053930d7ff226bc74cde5fb316f9c6fcb6",
+                "sha256:f28b5f2fa8154d0d97e97a664136f58d1639ca008d45d6e09e69fff24826abee",
+                "sha256:f3088eb80f58ed933c62d87128741d31e786edc862e23266d3c286763d646de0",
+                "sha256:f47f23db2d70db39cfb714b64fd5df76595b51b2ec0a669710a78f2dceb0c3f8",
+                "sha256:f4cdfe41149dcc5583a3b7a2f0ad433f75bb3afd1c7a7332e63df89b05e34666",
+                "sha256:f818161d2302b3b3e9c75d5a1d0a5c5679e92e45cfec6432b9d5432dde5ff1f1",
+                "sha256:feb7b1856f6ca805cc0e08739858f6cdfed8ce903390126af30343c62899a389"
             ],
             "index": "pypi",
             "markers": "python_version >= '3.10'",
-            "version": "==83.0.0"
+            "version": "==2.9.13"
         },
         "sqlparse": {
             "hashes": [
-                "sha256:113c35c75365ab9cc9c7231d68c6428fb11c085fc8e9eb1ad659b7ddbf6cd2b9",
-                "sha256:b861c0288ce2fa56209a9a6412d2e066ac664b3873b89c26c9d8415e8e32996f"
+                "sha256:3be5a72d04c873d690d7c6dedd33d6fae2ef82759881ceec02fc2efd0cba564f",
+                "sha256:ca722573f848ff2d30e40ea30f53a104b7dea7635ea9285891263eb2c58fb6e7"
             ],
-            "index": "pypi",
             "markers": "python_version >= '3.10'",
-            "version": "==0.6.0"
+            "version": "==0.6.1"
         },
         "whitenoise": {
             "hashes": [
diff --git a/tests/apps/gitsubmodules/package.json b/tests/apps/gitsubmodules/package.json
index b66a507b6..7d404056f 100644
--- a/tests/apps/gitsubmodules/package.json
+++ b/tests/apps/gitsubmodules/package.json
@@ -2,7 +2,7 @@
   "name": "node-example",
   "version": "0.0.1",
   "dependencies": {
-    "express": "~5.2.1"
+    "express": "~5.3.0"
   },
   "engines": {
     "node": "4.2.x"
diff --git a/tests/apps/go-fail-postdeploy/Dockerfile b/tests/apps/go-fail-postdeploy/Dockerfile
index c51827a16..1c9ef31c0 100644
--- a/tests/apps/go-fail-postdeploy/Dockerfile
+++ b/tests/apps/go-fail-postdeploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.26.6
+FROM golang:1.27.3
 
 EXPOSE 3000/tcp
 
diff --git a/tests/apps/go-fail-predeploy/Dockerfile b/tests/apps/go-fail-predeploy/Dockerfile
index c51827a16..1c9ef31c0 100644
--- a/tests/apps/go-fail-predeploy/Dockerfile
+++ b/tests/apps/go-fail-predeploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.26.6
+FROM golang:1.27.3
 
 EXPOSE 3000/tcp
 
diff --git a/tests/apps/gogrpc/Dockerfile b/tests/apps/gogrpc/Dockerfile
index 323c45966..506093fb4 100644
--- a/tests/apps/gogrpc/Dockerfile
+++ b/tests/apps/gogrpc/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.26.6
+FROM golang:1.27.3
 
 RUN mkdir /app
 WORKDIR /app
diff --git a/tests/apps/gogrpc/go.mod b/tests/apps/gogrpc/go.mod
index e617f296b..0ff2fa22e 100644
--- a/tests/apps/gogrpc/go.mod
+++ b/tests/apps/gogrpc/go.mod
@@ -1,17 +1,16 @@
 module github.com/dokku/dokko/tests/apps/gorpc
 
-go 1.26.2
-
-require (
-	golang.org/x/net v0.55.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
-	google.golang.org/grpc v1.83.0
-)
+go 1.27.1
 
 require (
+	google.golang.org/grpc v1.85.0
 	google.golang.org/grpc/examples v0.0.0-20240118175532-987df1309236
 	google.golang.org/protobuf v1.36.12
 )
 
-require google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+require (
+	golang.org/x/net v0.60.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1 // indirect
+)
diff --git a/tests/apps/gogrpc/go.sum b/tests/apps/gogrpc/go.sum
index bbfcdda42..6c66f6c0a 100644
--- a/tests/apps/gogrpc/go.sum
+++ b/tests/apps/gogrpc/go.sum
@@ -1,39 +1,19 @@
-github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
-github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
-github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
-github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
-go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
-go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
-go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
-go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
-go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
-go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
-go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
-go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
-go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
-go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
-golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
-golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
-golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
-golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.83.0 h1:JeNZEKJFbQxArAMl+hiytHauacDNqJUllNfmIMmpqnQ=
-google.golang.org/grpc v1.83.0/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1 h1:utmqiUzZAEINbLmRyAt1QjVkMyLQ+lvIwCpLaB1rZfw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.85.0 h1:BPBCfuVRQ1qvBhKDOq9uvQllMvO59rKsYhXpp7Dd8vw=
+google.golang.org/grpc v1.85.0/go.mod h1:0rQrOD58yjal/0EaVbGBANindixsCZNQPDV3VKtaKuQ=
 google.golang.org/grpc/examples v0.0.0-20240118175532-987df1309236 h1:wTUkwrodi4IuWD3kYkMUwCU8BhwFaqDywrXmsthCvQA=
 google.golang.org/grpc/examples v0.0.0-20240118175532-987df1309236/go.mod h1:j5uROIAAgi3YmtiETMt1LW0d/lHqQ7wwrIY4uGRXLQ4=
 google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
diff --git a/tests/apps/multi/package-lock.json b/tests/apps/multi/package-lock.json
index 4304ae76e..2bf24ca62 100644
--- a/tests/apps/multi/package-lock.json
+++ b/tests/apps/multi/package-lock.json
@@ -11,7 +11,7 @@
       "license": "ISC",
       "dependencies": {
         "bootstrap": "^5.3.8",
-        "sass": "^1.102.0"
+        "sass": "^1.108.1"
       },
       "engines": {
         "node": "24.x.x",
@@ -432,9 +432,9 @@
       }
     },
     "node_modules/sass": {
-      "version": "1.102.0",
-      "resolved": "https://registry.npmjs.org/sass/-/sass-1.102.0.tgz",
-      "integrity": "sha512-NSOyTnaQF7rTAEOtI2fwb386vL+akyiQLBZu8Na7hXCb+umJy0GAqlcMIaqACZ6Z1VgTBS4K9PG6B3IdjHGJsw==",
+      "version": "1.108.1",
+      "resolved": "https://registry.npmjs.org/sass/-/sass-1.108.1.tgz",
+      "integrity": "sha512-sIYgSvOPeD9wABwDS/ofNjHASSck+7h3jLkk7wG1NPFL3XeS6vOQjBlAFSmRV09kZr1yt/Tuayt6kKtBbLjHNQ==",
       "license": "MIT",
       "dependencies": {
         "chokidar": "^5.0.0",
@@ -452,9 +452,9 @@
       }
     },
     "node_modules/source-map-js": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",
+      "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.10.0"
diff --git a/tests/apps/multi/package.json b/tests/apps/multi/package.json
index 895f99224..27dc6673b 100644
--- a/tests/apps/multi/package.json
+++ b/tests/apps/multi/package.json
@@ -2,7 +2,7 @@
   "author": "Al Johri",
   "dependencies": {
     "bootstrap": "^5.3.8",
-    "sass": "^1.102.0"
+    "sass": "^1.108.1"
   },
   "description": "Test application for heroku multi buildpack.",
   "engines": {
diff --git a/tests/apps/multi/requirements.txt b/tests/apps/multi/requirements.txt
index d70bab6a8..9d9d20ce3 100644
--- a/tests/apps/multi/requirements.txt
+++ b/tests/apps/multi/requirements.txt
@@ -1,2 +1,2 @@
 Flask==3.1.3
-gunicorn==26.1.0
+gunicorn==27.0.0
diff --git a/tests/apps/nodejs-express-noappjson/package.json b/tests/apps/nodejs-express-noappjson/package.json
index 213e958c2..6140e67a2 100644
--- a/tests/apps/nodejs-express-noappjson/package.json
+++ b/tests/apps/nodejs-express-noappjson/package.json
@@ -2,7 +2,7 @@
   "name": "node-example",
   "version": "0.0.1",
   "dependencies": {
-    "express": "5.2.x"
+    "express": "5.3.x"
   },
   "engines": {
     "node": "18.x.x"
diff --git a/tests/apps/nodejs-express-noprocfile/package.json b/tests/apps/nodejs-express-noprocfile/package.json
index 216976a24..e844264d5 100644
--- a/tests/apps/nodejs-express-noprocfile/package.json
+++ b/tests/apps/nodejs-express-noprocfile/package.json
@@ -2,7 +2,7 @@
   "name": "node-example",
   "version": "0.0.1",
   "dependencies": {
-    "express": "5.2.x"
+    "express": "5.3.x"
   },
   "engines": {
     "node": "4.2.x"
diff --git a/tests/apps/nodejs-express/package.json b/tests/apps/nodejs-express/package.json
index 213e958c2..6140e67a2 100644
--- a/tests/apps/nodejs-express/package.json
+++ b/tests/apps/nodejs-express/package.json
@@ -2,7 +2,7 @@
   "name": "node-example",
   "version": "0.0.1",
   "dependencies": {
-    "express": "5.2.x"
+    "express": "5.3.x"
   },
   "engines": {
     "node": "18.x.x"
diff --git a/tests/apps/php/composer.lock b/tests/apps/php/composer.lock
index 72f8e08f1..617d8a0ad 100644
--- a/tests/apps/php/composer.lock
+++ b/tests/apps/php/composer.lock
@@ -8,16 +8,16 @@
     "packages": [
         {
             "name": "monolog/monolog",
-            "version": "3.10.0",
+            "version": "3.12.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/Seldaek/monolog.git",
-                "reference": "b321dd6749f0bf7189444158a3ce785cc16d69b0"
+                "reference": "d7059e4c691d05ea1222b5124bed0f961be46e15"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/Seldaek/monolog/zipball/b321dd6749f0bf7189444158a3ce785cc16d69b0",
-                "reference": "b321dd6749f0bf7189444158a3ce785cc16d69b0",
+                "url": "https://api.github.com/repos/Seldaek/monolog/zipball/d7059e4c691d05ea1222b5124bed0f961be46e15",
+                "reference": "d7059e4c691d05ea1222b5124bed0f961be46e15",
                 "shasum": ""
             },
             "require": {
@@ -43,6 +43,7 @@
                 "phpstan/phpstan-strict-rules": "^2",
                 "phpunit/phpunit": "^10.5.17 || ^11.0.7",
                 "predis/predis": "^1.1 || ^2",
+                "psr/clock": "^1.0",
                 "rollbar/rollbar": "^4.0",
                 "ruflin/elastica": "^7 || ^8",
                 "symfony/mailer": "^5.4 || ^6",
@@ -61,6 +62,7 @@
                 "graylog2/gelf-php": "Allow sending log messages to a GrayLog2 server",
                 "mongodb/mongodb": "Allow sending log messages to a MongoDB server (via library)",
                 "php-amqplib/php-amqplib": "Allow sending log messages to an AMQP server using php-amqplib",
+                "psr/clock": "Required to pass a clock to the Logger and control the timestamp of log records",
                 "rollbar/rollbar": "Allow sending log messages to Rollbar",
                 "ruflin/elastica": "Allow sending log messages to an Elastic Search server"
             },
@@ -95,7 +97,7 @@
             ],
             "support": {
                 "issues": "https://github.com/Seldaek/monolog/issues",
-                "source": "https://github.com/Seldaek/monolog/tree/3.10.0"
+                "source": "https://github.com/Seldaek/monolog/tree/3.12.1"
             },
             "funding": [
                 {
@@ -107,20 +109,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-01-02T08:56:05+00:00"
+            "time": "2026-09-29T19:21:12+00:00"
         },
         {
             "name": "nikic/fast-route",
-            "version": "v1.3.0",
+            "version": "1.3.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/nikic/FastRoute.git",
-                "reference": "181d480e08d9476e61381e04a71b34dc0432e812"
+                "reference": "7476684f39bb9124b3be69ed3d84b66723920298"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/nikic/FastRoute/zipball/181d480e08d9476e61381e04a71b34dc0432e812",
-                "reference": "181d480e08d9476e61381e04a71b34dc0432e812",
+                "url": "https://api.github.com/repos/nikic/FastRoute/zipball/7476684f39bb9124b3be69ed3d84b66723920298",
+                "reference": "7476684f39bb9124b3be69ed3d84b66723920298",
                 "shasum": ""
             },
             "require": {
@@ -155,9 +157,9 @@
             ],
             "support": {
                 "issues": "https://github.com/nikic/FastRoute/issues",
-                "source": "https://github.com/nikic/FastRoute/tree/master"
+                "source": "https://github.com/nikic/FastRoute/tree/1.3.1"
             },
-            "time": "2018-02-13T20:26:39+00:00"
+            "time": "2026-07-09T19:38:47+00:00"
         },
         {
             "name": "psr/container",
@@ -485,16 +487,16 @@
         },
         {
             "name": "slim/slim",
-            "version": "4.15.2",
+            "version": "4.15.3",
             "source": {
                 "type": "git",
                 "url": "https://github.com/slimphp/Slim.git",
-                "reference": "e12cb05ca2a14e8f459d019e87a31dc915b80470"
+                "reference": "3675bf6baac66b07032575b7bef4200b60b7974b"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/slimphp/Slim/zipball/e12cb05ca2a14e8f459d019e87a31dc915b80470",
-                "reference": "e12cb05ca2a14e8f459d019e87a31dc915b80470",
+                "url": "https://api.github.com/repos/slimphp/Slim/zipball/3675bf6baac66b07032575b7bef4200b60b7974b",
+                "reference": "3675bf6baac66b07032575b7bef4200b60b7974b",
                 "shasum": ""
             },
             "require": {
@@ -597,22 +599,22 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-05-22T08:00:12+00:00"
+            "time": "2026-09-01T17:11:05+00:00"
         }
     ],
     "packages-dev": [
         {
             "name": "heroku/heroku-buildpack-php",
-            "version": "v294",
+            "version": "v300",
             "source": {
                 "type": "git",
                 "url": "https://github.com/heroku/heroku-buildpack-php.git",
-                "reference": "2a8f9567a34acc79b6ebc1118196cfeda031ca2a"
+                "reference": "b52841c0eea8c9dadf4d7dc4dc0736d4ee3d2b29"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/heroku/heroku-buildpack-php/zipball/2a8f9567a34acc79b6ebc1118196cfeda031ca2a",
-                "reference": "2a8f9567a34acc79b6ebc1118196cfeda031ca2a",
+                "url": "https://api.github.com/repos/heroku/heroku-buildpack-php/zipball/b52841c0eea8c9dadf4d7dc4dc0736d4ee3d2b29",
+                "reference": "b52841c0eea8c9dadf4d7dc4dc0736d4ee3d2b29",
                 "shasum": ""
             },
             "bin": [
@@ -642,9 +644,9 @@
             ],
             "support": {
                 "issues": "https://github.com/heroku/heroku-buildpack-php/issues",
-                "source": "https://github.com/heroku/heroku-buildpack-php/tree/v294"
+                "source": "https://github.com/heroku/heroku-buildpack-php/tree/v300"
             },
-            "time": "2026-07-31T14:30:30+00:00"
+            "time": "2026-10-29T18:03:00+00:00"
         }
     ],
     "aliases": [],
diff --git a/tests/apps/python-flask/requirements.txt b/tests/apps/python-flask/requirements.txt
index 5345c6973..f24d76301 100644
--- a/tests/apps/python-flask/requirements.txt
+++ b/tests/apps/python-flask/requirements.txt
@@ -1,5 +1,5 @@
 Flask==3.1.3
 Jinja2==3.1.6
-Werkzeug==3.1.8
-gunicorn==26.1.0
+Werkzeug==3.1.9
+gunicorn==27.0.0
 
diff --git a/tests/apps/python/app-failing-check.json b/tests/apps/python/app-failing-check.json
new file mode 100644
index 000000000..bea74107a
--- /dev/null
+++ b/tests/apps/python/app-failing-check.json
@@ -0,0 +1,15 @@
+{
+  "healthchecks": {
+    "web": [
+      {
+        "attempts": 1,
+        "content": "this-content-does-not-exist",
+        "name": "failing-check",
+        "path": "/",
+        "timeout": 2,
+        "type": "startup",
+        "wait": 1
+      }
+    ]
+  }
+}
diff --git a/tests/apps/python/app-traefik.json b/tests/apps/python/app-readiness.json
similarity index 100%
rename from tests/apps/python/app-traefik.json
rename to tests/apps/python/app-readiness.json
diff --git a/tests/apps/python/fail.Dockerfile b/tests/apps/python/fail.Dockerfile
new file mode 100644
index 000000000..b5644761d
--- /dev/null
+++ b/tests/apps/python/fail.Dockerfile
@@ -0,0 +1,3 @@
+FROM alpine:3.20
+
+RUN false
diff --git a/tests/apps/ruby/Gemfile.lock b/tests/apps/ruby/Gemfile.lock
index e9985994f..42fabbf17 100644
--- a/tests/apps/ruby/Gemfile.lock
+++ b/tests/apps/ruby/Gemfile.lock
@@ -7,7 +7,7 @@ GEM
     logger (1.7.0)
     mustermann (3.0.4)
       ruby2_keywords (~> 0.0.1)
-    rack (3.2.6)
+    rack (3.2.8)
     rack-protection (4.2.1)
       base64 (>= 0.1.0)
       logger (>= 1.6.0)
@@ -44,7 +44,7 @@ CHECKSUMS
   eventmachine (1.2.7) sha256=994016e42aa041477ba9cff45cbe50de2047f25dd418eba003e84f0d16560972
   logger (1.7.0) sha256=196edec7cc44b66cfb40f9755ce11b392f21f7967696af15d274dde7edff0203
   mustermann (3.0.4) sha256=85fadcb6b3c6493a8b511b42426f904b7f27b282835502233dd154daab13aa22
-  rack (3.2.6) sha256=5ed78e1f73b2e25679bec7d45ee2d4483cc4146eb1be0264fc4d94cb5ef212c2
+  rack (3.2.8) sha256=1fecc85e463ebc7a2a945fff829ffcd549babeb1556384796fad946c28dc4ec7
   rack-protection (4.2.1) sha256=cf6e2842df8c55f5e4d1a4be015e603e19e9bc3a7178bae58949ccbb58558bac
   rack-session (2.1.2) sha256=595434f8c0c3473ae7d7ac56ecda6cc6dfd9d37c0b2b5255330aa1576967ffe8
   ruby2_keywords (0.0.5) sha256=ffd13740c573b7301cf7a2e61fc857b2a8e3d3aff32545d6f8300d8bae10e3ef
diff --git a/tests/apps/zombies-buildpack/go.mod b/tests/apps/zombies-buildpack/go.mod
index 3c966508e..fbeeee70d 100644
--- a/tests/apps/zombies-buildpack/go.mod
+++ b/tests/apps/zombies-buildpack/go.mod
@@ -1,3 +1,3 @@
 module dokku.me/web
 
-go 1.26.2
+go 1.27.1
diff --git a/tests/apps/zombies-dockerfile-no-tini/Dockerfile b/tests/apps/zombies-dockerfile-no-tini/Dockerfile
index 58770afb4..4e43e0036 100644
--- a/tests/apps/zombies-dockerfile-no-tini/Dockerfile
+++ b/tests/apps/zombies-dockerfile-no-tini/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.26.6
+FROM golang:1.27.3
 
 ADD . /go/src/github.com/dokku/apps/web
 WORKDIR /go/src/github.com/dokku/apps/web
diff --git a/tests/apps/zombies-dockerfile-no-tini/go.mod b/tests/apps/zombies-dockerfile-no-tini/go.mod
index 3c966508e..fbeeee70d 100644
--- a/tests/apps/zombies-dockerfile-no-tini/go.mod
+++ b/tests/apps/zombies-dockerfile-no-tini/go.mod
@@ -1,3 +1,3 @@
 module dokku.me/web
 
-go 1.26.2
+go 1.27.1
diff --git a/tests/apps/zombies-dockerfile-tini/Dockerfile b/tests/apps/zombies-dockerfile-tini/Dockerfile
index b8fadc661..e917420c0 100644
--- a/tests/apps/zombies-dockerfile-tini/Dockerfile
+++ b/tests/apps/zombies-dockerfile-tini/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.26.6
+FROM golang:1.27.3
 
 ADD . /go/src/github.com/dokku/apps/web
 WORKDIR /go/src/github.com/dokku/apps/web
diff --git a/tests/apps/zombies-dockerfile-tini/go.mod b/tests/apps/zombies-dockerfile-tini/go.mod
index 3c966508e..fbeeee70d 100644
--- a/tests/apps/zombies-dockerfile-tini/go.mod
+++ b/tests/apps/zombies-dockerfile-tini/go.mod
@@ -1,3 +1,3 @@
 module dokku.me/web
 
-go 1.26.2
+go 1.27.1
diff --git a/tests/ci/setup.sh b/tests/ci/setup.sh
index 1cb1d4e80..84cc019ed 100755
--- a/tests/ci/setup.sh
+++ b/tests/ci/setup.sh
@@ -20,6 +20,12 @@ install_dependencies() {
     curl -L "https://packagecloud.io/dokku/dokku/packages/ubuntu/noble/docker-container-healthchecker_${DOCKER_CONTAINER_HEALTHCHECKER_VERSION}_amd64.deb/download.deb" -o "$ROOT_DIR/build/${DOCKER_CONTAINER_HEALTHCHECKER_PACKAGE_NAME}"
   fi
 
+  COREDNS_DOCKER_VERSION=$(jq -r --arg name coredns-docker '.dependencies[] | select(.name == $name) | .version' contrib/dependencies.json)
+  COREDNS_DOCKER_PACKAGE_NAME="coredns-docker_${COREDNS_DOCKER_VERSION}_amd64.deb"
+  if [[ ! -f "$ROOT_DIR/build/${COREDNS_DOCKER_PACKAGE_NAME}" ]]; then
+    curl -L "https://packagecloud.io/dokku/dokku/packages/ubuntu/noble/coredns-docker_${COREDNS_DOCKER_VERSION}_amd64.deb/download.deb" -o "$ROOT_DIR/build/${COREDNS_DOCKER_PACKAGE_NAME}"
+  fi
+
   HEROKUISH_VERSION=$(jq -r --arg name herokuish '.recommendations[] | select(.name == $name) | .version' contrib/dependencies.json)
   HEROKUISH_PACKAGE_NAME="herokuish_${HEROKUISH_VERSION}_amd64.deb"
   if [[ ! -f "$ROOT_DIR/build/${HEROKUISH_PACKAGE_NAME}" ]]; then
@@ -68,6 +74,7 @@ install_dependencies() {
 
   ls -lah "${ROOT_DIR}/build/"
   sudo dpkg -i \
+    "${ROOT_DIR}/build/$COREDNS_DOCKER_PACKAGE_NAME" \
     "${ROOT_DIR}/build/$DOCKER_CONTAINER_HEALTHCHECKER_PACKAGE_NAME" \
     "${ROOT_DIR}/build/$DOCKER_IMAGE_LABELER_PACKAGE_NAME" \
     "${ROOT_DIR}/build/$HEROKUISH_PACKAGE_NAME" \
@@ -123,8 +130,13 @@ build_dokku_docker_image() {
 run_dokku_container() {
   echo "=====> run_dokku_container on CIRCLE_NODE_INDEX: $CIRCLE_NODE_INDEX"
   echo "redirect: https://github.com/dokku/dokku-redirect.git" | sudo tee /var/lib/dokku/plugin-list
+  # DOKKU_HOST_ROOT / DOKKU_LIB_HOST_ROOT match the install docs: the host
+  # mounts /var/lib/dokku at /mnt/dokku, and in-container /var/lib/dokku/{home,data}
+  # are symlinks into that volume.
   docker run -d \
     --env DOKKU_HOSTNAME=dokku.me \
+    --env DOKKU_HOST_ROOT=/var/lib/dokku/home/dokku \
+    --env DOKKU_LIB_HOST_ROOT=/var/lib/dokku/var/lib/dokku \
     --name dokku \
     --publish 3022:22 \
     --publish 80:80 \
diff --git a/tests/ci/sudo_preserve_env.sh b/tests/ci/sudo_preserve_env.sh
new file mode 100755
index 000000000..51896556b
--- /dev/null
+++ b/tests/ci/sudo_preserve_env.sh
@@ -0,0 +1,112 @@
+#!/usr/bin/env bash
+# Checks that the environment dokku forwards across its privilege drop survives the
+# local sudo implementation. sudo-rs, the default sudo on ubuntu 25.10 and later,
+# ignores -E and bare --preserve-env, so dokku names every variable it needs.
+set -eo pipefail
+
+PLUGIN_CORE_AVAILABLE_PATH="${PLUGIN_CORE_AVAILABLE_PATH:-$(dirname "$0")/../../plugins}"
+export PLUGIN_CORE_AVAILABLE_PATH
+source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
+
+FAILURES=0
+
+fail() {
+  declare desc="report a failed check"
+  echo "not ok - $1" 1>&2
+  FAILURES=$((FAILURES + 1))
+}
+
+pass() {
+  declare desc="report a passing check"
+  echo "ok - $1"
+}
+
+report-whole-environment-support() {
+  declare desc="record whether this sudo honours -E, for the log"
+  local warning
+
+  warning="$(DOKKU_TEST_CROSSING=1 sudo -E -u nobody true 2>&1 >/dev/null || true)"
+  if [[ -n "$warning" ]]; then
+    echo "# sudo -E is not supported here: $warning"
+  else
+    echo "# sudo -E is supported here"
+  fi
+}
+
+check-named-list-crosses() {
+  declare desc="the named variables reach the target user"
+  local flag output
+
+  flag="$(DOKKU_QUIET_OUTPUT=1 DOKKU_TRACE=1 SSH_USER=ci fn-sudo-preserve-env-flag DOKKU_QUIET_OUTPUT DOKKU_TRACE SSH_USER)"
+  output="$(DOKKU_QUIET_OUTPUT=1 DOKKU_TRACE=1 SSH_USER=ci sudo "$flag" -u nobody /usr/bin/env)"
+
+  local name
+  for name in DOKKU_QUIET_OUTPUT=1 DOKKU_TRACE=1 SSH_USER=ci; do
+    if grep -qxF "$name" <<<"$output"; then
+      pass "$name crossed the privilege drop"
+    else
+      fail "$name did not cross the privilege drop"
+    fi
+  done
+}
+
+check-named-list-is-silent() {
+  declare desc="no warning is written to stderr"
+  local flag stderr
+
+  flag="$(SSH_USER=ci fn-sudo-preserve-env-flag SSH_USER)"
+  stderr="$(SSH_USER=ci sudo "$flag" -u nobody true 2>&1 >/dev/null || true)"
+  if [[ -z "$stderr" ]]; then
+    pass "no warning on stderr"
+  else
+    fail "unexpected stderr: $stderr"
+  fi
+}
+
+check-absent-names-are-tolerated() {
+  declare desc="naming a variable that is not set is not an error"
+  local flag
+
+  flag="$(fn-sudo-preserve-env-flag DOKKU_DEFINITELY_NOT_SET_HERE SSH_USER)"
+  if sudo "$flag" -u nobody true; then
+    pass "unset names are ignored"
+  else
+    fail "sudo rejected a list naming an unset variable"
+  fi
+}
+
+check-home-still-wins() {
+  declare desc="-H is not defeated by the preserved list"
+  local flag output
+  local names=()
+
+  read -ra names <<<"$(fn-cli-preserved-env-names)"
+  flag="$(fn-sudo-preserve-env-flag "${names[@]}")"
+  output="$(sudo "$flag" -H -u nobody /usr/bin/env)"
+  if grep -qxF "HOME=$(getent passwd nobody | cut -d: -f6)" <<<"$output"; then
+    pass "-H still sets HOME for the target user"
+  else
+    fail "HOME was not reset for the target user"
+  fi
+}
+
+main() {
+  declare desc="run every check"
+
+  echo "# sudo version:"
+  sudo --version | head -1 | sed -e 's/^/# /'
+
+  report-whole-environment-support
+  check-named-list-crosses
+  check-named-list-is-silent
+  check-absent-names-are-tolerated
+  check-home-still-wins
+
+  if [[ "$FAILURES" -gt 0 ]]; then
+    echo "$FAILURES check(s) failed" 1>&2
+    exit 1
+  fi
+  echo "all checks passed"
+}
+
+main "$@"
diff --git a/tests/docker/storage.bats b/tests/docker/storage.bats
new file mode 100644
index 000000000..bad567729
--- /dev/null
+++ b/tests/docker/storage.bats
@@ -0,0 +1,49 @@
+#!/usr/bin/env bats
+
+# Dokku-in-Docker coverage for DOKKU_LIB_HOST_ROOT. These tests talk to the
+# `dokku` container started by tests/ci/setup.sh docker and read/write the
+# host path that volume backs (/var/lib/dokku -> /mnt/dokku).
+
+setup_file() {
+  if ! docker inspect dokku >/dev/null 2>&1; then
+    echo "dokku container is not running; skip docker storage tests" >&2
+    return 1
+  fi
+
+  DOKKU_LIB_HOST_ROOT="$(docker exec dokku bash -c 'echo -n "$DOKKU_LIB_HOST_ROOT"')"
+  if [[ -z "$DOKKU_LIB_HOST_ROOT" ]]; then
+    echo "DOKKU_LIB_HOST_ROOT is unset inside the dokku container" >&2
+    return 1
+  fi
+  export DOKKU_LIB_HOST_ROOT
+}
+
+setup() {
+  ENTRY_NAME="rdmtest-docker-hostroot-$$"
+  export ENTRY_NAME
+}
+
+teardown() {
+  docker exec dokku dokku storage:destroy "$ENTRY_NAME" --force >/dev/null 2>&1 || true
+  sudo rm -rf "${DOKKU_LIB_HOST_ROOT}/data/storage/${ENTRY_NAME}"
+}
+
+@test "(docker) storage:exec sees a file written under DOKKU_LIB_HOST_ROOT" {
+  run docker exec dokku dokku storage:create "$ENTRY_NAME" --chown root
+  echo "output: $output"
+  echo "status: $status"
+  [[ "$status" -eq 0 ]]
+
+  # storage:create mkdirs under DOKKU_LIB_ROOT inside the container, which is
+  # the same tree as DOKKU_LIB_HOST_ROOT on the host via the /mnt/dokku volume.
+  HOST_STORAGE_DIR="${DOKKU_LIB_HOST_ROOT}/data/storage/${ENTRY_NAME}"
+  [[ -d "$HOST_STORAGE_DIR" ]]
+
+  echo "Hello World!" | sudo tee "${HOST_STORAGE_DIR}/welcome.txt" >/dev/null
+
+  run docker exec dokku dokku storage:exec "$ENTRY_NAME" -- cat /data/welcome.txt
+  echo "output: $output"
+  echo "status: $status"
+  [[ "$status" -eq 0 ]]
+  [[ "$output" == *"Hello World!"* ]]
+}
diff --git a/tests/test_coredns_outage b/tests/test_coredns_outage
new file mode 100755
index 000000000..fe9b4b125
--- /dev/null
+++ b/tests/test_coredns_outage
@@ -0,0 +1,108 @@
+#!/usr/bin/env bash
+set -xeo pipefail
+
+SELF=$(command -v "$0")
+TARGET="$1"
+SCOPE="${2:-host}"
+REMOTE="dokku@$TARGET"
+APP="test-coredns-outage-$RANDOM"
+
+cleanup() {
+  local exit_code=$?
+  set +e
+  start_coredns_docker
+  ssh "$REMOTE" apps:destroy "$APP" --force >/dev/null 2>&1
+  ssh "$REMOTE" nginx:set --global dns-resolver >/dev/null 2>&1
+  ssh "$REMOTE" events:off >/dev/null 2>&1
+  exit $exit_code
+}
+
+stop_coredns_docker() {
+  case "$SCOPE" in
+    docker)
+      docker exec dokku sv stop coredns-docker
+      ;;
+    host)
+      sudo systemctl stop coredns-docker
+      ;;
+    *)
+      echo "Unknown scope: $SCOPE"
+      exit 1
+      ;;
+  esac
+}
+
+start_coredns_docker() {
+  case "$SCOPE" in
+    docker)
+      docker exec dokku sv start coredns-docker
+      ;;
+    host)
+      sudo systemctl start coredns-docker
+      ;;
+    *)
+      echo "Unknown scope: $SCOPE"
+      exit 1
+      ;;
+  esac
+}
+
+curl_status() {
+  curl -kSso /dev/null -w "%{http_code}" -m 10 "http://$APP.$TARGET/"
+}
+
+wait_for_status() {
+  local expected="$1" attempts="${2:-15}" actual
+  while [[ $attempts -gt 0 ]]; do
+    actual="$(curl_status || true)"
+    [[ "$actual" == "$expected" ]] && return 0
+    attempts=$((attempts - 1))
+    sleep 1
+  done
+  echo "Expected HTTP $expected, last observed $actual"
+  return 1
+}
+
+trap cleanup INT TERM EXIT
+
+ssh "$REMOTE" events:on
+ssh "$REMOTE" nginx:set --global dns-resolver 127.0.0.1:1053
+
+TMP=$(mktemp -d "/tmp/$TARGET.XXXXX")
+rmdir "$TMP" && cp -r "$(dirname "$SELF")/apps/python" "$TMP"
+
+pushd "$TMP" >/dev/null
+git init -q
+git config user.email "robot@example.com"
+git config user.name "Test Robot"
+git remote add target "${REMOTE}:${APP}"
+[[ -f gitignore ]] && mv gitignore .gitignore
+git add .
+git commit -qm 'initial commit'
+git push target master
+popd >/dev/null
+rm -rf "$TMP"
+
+echo "-----> Verifying app responds before outage"
+wait_for_status 200
+
+echo "-----> Stopping coredns-docker ($SCOPE)"
+stop_coredns_docker
+
+# Wait long enough for any cached DNS entry (resolver valid=10s in the template)
+sleep 12
+
+echo "-----> Verifying nginx returns 502 with coredns-docker stopped"
+actual="$(curl_status || true)"
+if [[ "$actual" != "502" ]]; then
+  echo "Expected HTTP 502 with coredns-docker stopped, observed $actual"
+  exit 1
+fi
+
+echo "-----> Restarting coredns-docker"
+start_coredns_docker
+
+echo "-----> Verifying app recovers"
+wait_for_status 200
+
+echo "-----> coredns-docker outage test PASSED"
diff --git a/tests/unit/app-json-3.bats b/tests/unit/app-json-3.bats
index efc8de7f8..3b8c75d87 100644
--- a/tests/unit/app-json-3.bats
+++ b/tests/unit/app-json-3.bats
@@ -58,6 +58,37 @@ teardown() {
   assert_output_contains "cron: 1" 1
 }
 
+@test "(app-json) negative formation quantity" {
+  mkdir -p /var/lib/dokku/data/app-json/$TEST_APP
+  negative_formation_callback "$TEST_APP" /var/lib/dokku/data/app-json/$TEST_APP
+
+  run_plugn_trigger post-release-builder herokuish $TEST_APP dokku/$TEST_APP:latest
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Invalid quantity for process type web in app.json: value must be zero or greater"
+
+  run /bin/bash -c "dokku --quiet ps:scale $TEST_APP"
+  output=$(echo "$output" | tr -s " ")
+  echo "output: ($output)"
+  echo "status: $status"
+  assert_output "web: 1"
+}
+
+@test "(app-json) healthcheck path with whitespace fails deploy" {
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP whitespace_healthcheck_path_callback
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains 'Invalid app.json healthcheck web readiness check for process type web: path "/health check" must not contain whitespace, control characters, quotes, or backslashes' 2
+
+  run /bin/bash -c "docker ps -a -q --filter label=com.dokku.app-name=$TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_not_exists
+}
+
 persist_scale_callback_a() {
   local APP="$1"
   local APP_REPO_DIR="$2"
@@ -81,3 +112,39 @@ persist_scale_callback_b() {
   echo "cron: python3 worker.py" >>"$APP_REPO_DIR/Procfile"
   mv "$APP_REPO_DIR/app-5205b.json" "$APP_REPO_DIR/app.json"
 }
+
+negative_formation_callback() {
+  local APP="$1"
+  local APP_REPO_DIR="$2"
+  [[ -z "$APP" ]] && local APP="$TEST_APP"
+
+  cat >"$APP_REPO_DIR/app.json" <<EOF
+{
+  "formation": {
+    "web": {
+      "quantity": -1
+    }
+  }
+}
+EOF
+}
+
+whitespace_healthcheck_path_callback() {
+  local APP="$1"
+  local APP_REPO_DIR="$2"
+  [[ -z "$APP" ]] && local APP="$TEST_APP"
+
+  cat >"$APP_REPO_DIR/app.json" <<EOF
+{
+  "healthchecks": {
+    "web": [
+      {
+        "name": "web readiness check",
+        "path": "/health check",
+        "type": "readiness"
+      }
+    ]
+  }
+}
+EOF
+}
diff --git a/tests/unit/app-json.bats b/tests/unit/app-json.bats
index b9bb6f8bf..a23243dfa 100644
--- a/tests/unit/app-json.bats
+++ b/tests/unit/app-json.bats
@@ -144,7 +144,7 @@ teardown() {
   echo "status: $status"
   assert_success
 
-  run /bin/bash -c "dokku postgres:create $TEST_APP $TEST_APP"
+  run /bin/bash -c "dokku postgres:create $TEST_APP"
   echo "output: $output"
   echo "status: $status"
   assert_success
@@ -154,7 +154,7 @@ teardown() {
   echo "status: $status"
   assert_success
 
-  run /bin/bash -c "dokku redis:create $TEST_APP $TEST_APP"
+  run /bin/bash -c "dokku redis:create $TEST_APP"
   echo "output: $output"
   echo "status: $status"
   assert_success
@@ -179,12 +179,12 @@ teardown() {
   echo "status: $status"
   assert_success
 
-  run /bin/bash -c "dokku --force postgres:destroy $TEST_APP"
+  run /bin/bash -c "dokku postgres:destroy $TEST_APP --force"
   echo "output: $output"
   echo "status: $status"
   assert_success
 
-  run /bin/bash -c "dokku --force redis:destroy $TEST_APP"
+  run /bin/bash -c "dokku redis:destroy $TEST_APP --force"
   echo "output: $output"
   echo "status: $status"
   assert_success
diff --git a/tests/unit/apps_1.bats b/tests/unit/apps_1.bats
index 7799ae7f1..c5ce24cc3 100644
--- a/tests/unit/apps_1.bats
+++ b/tests/unit/apps_1.bats
@@ -2,11 +2,16 @@
 
 load test_helper
 
+APP_FILTER_PLUGIN_NAME="app-filter-test"
+
 setup() {
   global_setup
 }
 
 teardown() {
+  release_deploy_lock
+  rm -rf "${PLUGIN_ENABLED_PATH:?}/$APP_FILTER_PLUGIN_NAME" "${PLUGIN_AVAILABLE_PATH:?}/$APP_FILTER_PLUGIN_NAME"
+  dokku --force apps:destroy "$TEST_APP-source" &>/dev/null || true
   global_teardown
 }
 
@@ -398,6 +403,162 @@ teardown() {
   destroy_app
 }
 
+@test "(apps) apps:lock does not modify the deploy lock file" {
+  run create_app
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "echo holder-id >$DOKKU_LIB_ROOT/data/apps/$TEST_APP/.deploy.lock && chown dokku:dokku $DOKKU_LIB_ROOT/data/apps/$TEST_APP/.deploy.lock"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku apps:lock $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "cat $DOKKU_LIB_ROOT/data/apps/$TEST_APP/.deploy.lock"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "holder-id"
+
+  run /bin/bash -c "dokku apps:unlock $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  destroy_app
+}
+
+@test "(apps:locked) ignores a deploy lock file that no deploy holds" {
+  run create_app
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "echo stale-id >$DOKKU_LIB_ROOT/data/apps/$TEST_APP/.deploy.lock && chown dokku:dokku $DOKKU_LIB_ROOT/data/apps/$TEST_APP/.deploy.lock"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku apps:locked $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "dokku apps:report $TEST_APP --app-locked"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output "false"
+
+  destroy_app
+}
+
+@test "(apps:locked) reports a deploy lock held by a running deploy" {
+  run create_app
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  hold_deploy_lock
+
+  run /bin/bash -c "dokku apps:locked $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku apps:unlock $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "A deploy may be in progress."
+
+  release_deploy_lock
+  destroy_app
+}
+
+@test "(apps:unlock) succeeds for an app that is not locked" {
+  run create_app
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku apps:unlock $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_not_contains "A deploy may be in progress."
+
+  destroy_app
+}
+
+@test "(apps:rename) fails for a locked app" {
+  run create_app
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku apps:lock $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku apps:rename $TEST_APP great-test-name"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Unable to rename a locked app"
+
+  run /bin/bash -c "dokku apps:exists great-test-name"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "dokku apps:locked $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  destroy_app
+}
+
+@test "(apps) [install] converts a lock created by apps:lock in older versions" {
+  run create_app
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "sudo -u dokku touch $DOKKU_LIB_ROOT/data/apps/$TEST_APP/.deploy.lock"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "DOKKU_ROOT=$DOKKU_ROOT PLUGIN_PATH=$PLUGIN_PATH PLUGIN_AVAILABLE_PATH=$PLUGIN_AVAILABLE_PATH PLUGIN_ENABLED_PATH=$PLUGIN_ENABLED_PATH PLUGIN_CORE_AVAILABLE_PATH=$PLUGIN_CORE_AVAILABLE_PATH DOKKU_LIB_ROOT=$DOKKU_LIB_ROOT $PLUGIN_ENABLED_PATH/apps/install"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "[[ ! -e $DOKKU_LIB_ROOT/data/apps/$TEST_APP/.deploy.lock ]]"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "[[ -f $DOKKU_LIB_ROOT/data/apps/$TEST_APP/.manual-deploy.lock ]]"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku apps:locked $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  destroy_app
+}
+
 @test "(apps:report) emits new stripped JSON keys alongside legacy" {
   create_app
 
@@ -489,3 +650,59 @@ teardown() {
 
   destroy_app
 }
+
+@test "(apps) apps:create, apps:clone, and apps:rename with an existing filtered app" {
+  create_app
+  create_app "$TEST_APP-source"
+
+  setup_app_filter_plugin "$TEST_APP"
+
+  run /bin/bash -c "dokku apps:create $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Name is already taken"
+  assert_output_not_contains "Creating $TEST_APP"
+
+  run /bin/bash -c "dokku apps:clone $TEST_APP-source $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Name is already taken"
+
+  run /bin/bash -c "dokku apps:rename $TEST_APP-source $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Name is already taken"
+
+  rm -rf "${PLUGIN_ENABLED_PATH:?}/$APP_FILTER_PLUGIN_NAME" "${PLUGIN_AVAILABLE_PATH:?}/$APP_FILTER_PLUGIN_NAME"
+
+  destroy_app 0 "$TEST_APP-source"
+  destroy_app
+}
+
+setup_app_filter_plugin() {
+  declare desc="installs a plugin that filters out a single app"
+  declare FILTERED_APP="$1"
+  local PLUGIN_DIR="$PLUGIN_AVAILABLE_PATH/$APP_FILTER_PLUGIN_NAME"
+  mkdir -p "$PLUGIN_DIR"
+
+  cat <<EOF >"$PLUGIN_DIR/plugin.toml"
+[plugin]
+description = "test plugin filtering out a single app"
+version = "0.1.0"
+[plugin.config]
+EOF
+
+  cat <<EOF >"$PLUGIN_DIR/user-auth-app"
+#!/usr/bin/env bash
+shift 2
+for app in "\$@"; do
+  [[ "\$app" == "$FILTERED_APP" ]] || echo "\$app"
+done
+EOF
+  chmod +x "$PLUGIN_DIR/user-auth-app"
+
+  dokku plugin:enable "$APP_FILTER_PLUGIN_NAME"
+}
diff --git a/tests/unit/apps_2.bats b/tests/unit/apps_2.bats
index 1ab9549da..fbc6dc733 100644
--- a/tests/unit/apps_2.bats
+++ b/tests/unit/apps_2.bats
@@ -33,6 +33,38 @@ teardown() {
   assert_success
 }
 
+@test "(apps:clone) does not copy the lock of a locked app" {
+  run /bin/bash -c "dokku apps:create $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku apps:lock $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku apps:clone --skip-deploy $TEST_APP great-test-name"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku apps:locked great-test-name"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "dokku apps:locked $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku --force apps:destroy great-test-name"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+}
+
 @test "(apps) apps:clone (no app)" {
   run /bin/bash -c "dokku apps:create $TEST_APP"
   echo "output: $output"
diff --git a/tests/unit/apps_3.bats b/tests/unit/apps_3.bats
new file mode 100644
index 000000000..31be60d0e
--- /dev/null
+++ b/tests/unit/apps_3.bats
@@ -0,0 +1,83 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+  global_setup
+  create_app
+}
+
+teardown() {
+  destroy_app
+  global_teardown
+}
+
+@test "(apps:lock) blocks ps:rebuild until apps:unlock" {
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP convert_to_dockerfile
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku builds:list $TEST_APP --format json | jq length"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  local BUILD_COUNT="$output"
+
+  run /bin/bash -c "dokku apps:lock $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "$TEST_APP has been locked via apps:lock" -1
+  assert_output_not_contains "Building $TEST_APP"
+
+  run /bin/bash -c "dokku builds:list $TEST_APP --format json | jq length"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "$BUILD_COUNT"
+
+  run /bin/bash -c "dokku apps:locked $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku apps:unlock $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+}
+
+@test "(apps:lock) blocks git:sync before fetching" {
+  run /bin/bash -c "dokku apps:lock $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku git:sync --build $TEST_APP https://github.com/dokku/smoke-test-app.git"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "$TEST_APP has been locked via apps:lock"
+
+  run /bin/bash -c "sudo -u dokku git -C $DOKKU_ROOT/$TEST_APP rev-parse --verify -q master"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "dokku builds:list $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "No builds recorded"
+}
diff --git a/tests/unit/builder-dockerfile.bats b/tests/unit/builder-dockerfile.bats
index 93d662f00..9f34a5bdd 100644
--- a/tests/unit/builder-dockerfile.bats
+++ b/tests/unit/builder-dockerfile.bats
@@ -345,6 +345,80 @@ EOF
   assert_output "['task.py', 'some', 'cron', 'task']"
 }
 
+@test "(builder-dockerfile) ps:rebuild --no-cache" {
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP convert_to_dockerfile
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "CACHED" -1
+
+  run /bin/bash -c "dokku ps:rebuild --no-cache $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "CACHED" 1
+
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "CACHED" -1
+}
+
+@test "(builder-dockerfile) failed build restores previous image" {
+  local CUSTOM_TMP=$(mktemp -d "/tmp/${DOKKU_DOMAIN}.XXXXX")
+  trap 'popd &>/dev/null || true; rm -rf "$CUSTOM_TMP"' INT TERM
+
+  CUSTOM_TMP="$CUSTOM_TMP" run deploy_app python "dokku@$DOKKU_DOMAIN:$TEST_APP" convert_to_dockerfile
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  local previous_image
+  previous_image="$(docker container inspect "$TEST_APP.web.1" --format '{{.Image}}')"
+  [[ -n "$previous_image" ]]
+
+  run failing_build_callback "$TEST_APP" "$CUSTOM_TMP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run git -C "$CUSTOM_TMP" add Dockerfile
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run git -C "$CUSTOM_TMP" commit -m 'Break the build'
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run git -C "$CUSTOM_TMP" push target master:master
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "App build failed"
+  assert_output_contains "Removing invalid image tag" 0
+
+  run /bin/bash -c "docker image inspect dokku/$TEST_APP:latest --format '{{.Id}}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "$previous_image"
+
+  run /bin/bash -c "dokku ps:restart $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  rm -rf "$CUSTOM_TMP"
+}
+
 cron_run_wrapper() {
   local APP="$1"
   local APP_REPO_DIR="$2"
@@ -354,3 +428,9 @@ cron_run_wrapper() {
   convert_to_dockerfile "$APP" "$APP_REPO_DIR"
   mv -f "$APP_REPO_DIR/app-cron.json" "$APP_REPO_DIR/app.json"
 }
+
+failing_build_callback() {
+  local APP="$1"
+  local APP_REPO_DIR="$2"
+  echo "RUN exit 1" >>"$APP_REPO_DIR/Dockerfile"
+}
diff --git a/tests/unit/builder-herokuish.bats b/tests/unit/builder-herokuish.bats
index c6a7ef2ed..451fb04d7 100644
--- a/tests/unit/builder-herokuish.bats
+++ b/tests/unit/builder-herokuish.bats
@@ -104,6 +104,50 @@ teardown() {
   assert_success
 }
 
+@test "(builder-herokuish:report) stack raw vs computed vs global" {
+  local default_stack="gliderlabs/herokuish:latest-24"
+
+  run /bin/bash -c "dokku builder-herokuish:report $TEST_APP --builder-herokuish-stack"
+  assert_success
+  assert_output_not_exists
+
+  run /bin/bash -c "dokku builder-herokuish:report $TEST_APP --builder-herokuish-global-stack"
+  assert_success
+  assert_output_not_exists
+
+  run /bin/bash -c "dokku builder-herokuish:report $TEST_APP --builder-herokuish-computed-stack"
+  assert_success
+  assert_output "$default_stack"
+
+  run /bin/bash -c "dokku builder-herokuish:set --global stack gliderlabs/herokuish:global"
+  assert_success
+
+  run /bin/bash -c "dokku builder-herokuish:report $TEST_APP --builder-herokuish-global-stack"
+  assert_success
+  assert_output "gliderlabs/herokuish:global"
+
+  run /bin/bash -c "dokku builder-herokuish:report $TEST_APP --builder-herokuish-computed-stack"
+  assert_success
+  assert_output "gliderlabs/herokuish:global"
+
+  run /bin/bash -c "dokku builder-herokuish:set $TEST_APP stack gliderlabs/herokuish:app"
+  assert_success
+
+  run /bin/bash -c "dokku builder-herokuish:report $TEST_APP --builder-herokuish-stack"
+  assert_success
+  assert_output "gliderlabs/herokuish:app"
+
+  run /bin/bash -c "dokku builder-herokuish:report $TEST_APP --builder-herokuish-computed-stack"
+  assert_success
+  assert_output "gliderlabs/herokuish:app"
+
+  run /bin/bash -c "dokku builder-herokuish:set $TEST_APP stack"
+  assert_success
+
+  run /bin/bash -c "dokku builder-herokuish:set --global stack"
+  assert_success
+}
+
 @test "(builder-herouish:build .env)" {
   run /bin/bash -c "dokku docker-options:add $TEST_APP build '--label=com.dokku.build-test=safe'"
   echo "output: $output"
@@ -253,6 +297,50 @@ teardown() {
   assert_output "['task.py', 'some', 'cron', 'task']"
 }
 
+@test "(builder-herokuish) ps:rebuild --no-cache" {
+  run /bin/bash -c "dokku builder-herokuish:set $TEST_APP allowed true"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "docker volume inspect --format '{{.CreatedAt}}' cache-$TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  cache_created_at="$output"
+
+  sleep 1
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "Clearing build cache" 0
+
+  run /bin/bash -c "docker volume inspect --format '{{.CreatedAt}}' cache-$TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "$cache_created_at"
+
+  sleep 1
+  run /bin/bash -c "dokku ps:rebuild --no-cache $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "Clearing build cache"
+
+  run /bin/bash -c "docker volume inspect --format '{{.CreatedAt}}' cache-$TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  [[ "$output" != "$cache_created_at" ]]
+}
+
 cron_run_wrapper() {
   local APP="$1"
   local APP_REPO_DIR="$2"
diff --git a/tests/unit/builder-nixpacks.bats b/tests/unit/builder-nixpacks.bats
index d0a1ac1a5..e8facd71d 100644
--- a/tests/unit/builder-nixpacks.bats
+++ b/tests/unit/builder-nixpacks.bats
@@ -229,6 +229,30 @@ teardown() {
   assert_success
 }
 
+@test "(builder-nixpacks) ps:rebuild --no-cache" {
+  run /bin/bash -c "dokku builder:set $TEST_APP selected nixpacks"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP add_requirements_txt
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "CACHED" -1
+
+  run /bin/bash -c "dokku ps:rebuild --no-cache $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "unpacking 'https://github.com/NixOS/nixpkgs" -1
+}
+
 cron_run_wrapper() {
   local APP="$1"
   local APP_REPO_DIR="$2"
diff --git a/tests/unit/builder-pack.bats b/tests/unit/builder-pack.bats
index ef8e64849..48eb23336 100644
--- a/tests/unit/builder-pack.bats
+++ b/tests/unit/builder-pack.bats
@@ -107,6 +107,55 @@ teardown() {
   assert_success
 }
 
+@test "(builder-pack:report) stack raw vs computed vs global" {
+  run /bin/bash -c "dokku builder-pack:set --global stack"
+  assert_success
+
+  run /bin/bash -c "dokku builder-pack:report $TEST_APP --builder-pack-stack"
+  assert_success
+  assert_output_not_exists
+
+  run /bin/bash -c "dokku builder-pack:report $TEST_APP --builder-pack-global-stack"
+  assert_success
+  assert_output_not_exists
+
+  run /bin/bash -c "dokku builder-pack:report $TEST_APP --builder-pack-computed-stack"
+  assert_success
+  assert_output "heroku/builder:24"
+
+  run /bin/bash -c "dokku builder-pack:set --global stack paketobuildpacks/builder:global"
+  assert_success
+
+  run /bin/bash -c "dokku builder-pack:report $TEST_APP --builder-pack-global-stack"
+  assert_success
+  assert_output "paketobuildpacks/builder:global"
+
+  run /bin/bash -c "dokku builder-pack:report $TEST_APP --builder-pack-computed-stack"
+  assert_success
+  assert_output "paketobuildpacks/builder:global"
+
+  run /bin/bash -c "dokku builder-pack:set $TEST_APP stack paketobuildpacks/builder:app"
+  assert_success
+
+  run /bin/bash -c "dokku builder-pack:report $TEST_APP --builder-pack-stack"
+  assert_success
+  assert_output "paketobuildpacks/builder:app"
+
+  run /bin/bash -c "dokku builder-pack:report $TEST_APP --builder-pack-computed-stack"
+  assert_success
+  assert_output "paketobuildpacks/builder:app"
+
+  run /bin/bash -c "cat $DOKKU_LIB_ROOT/config/builder-pack/$TEST_APP/clear-cache"
+  assert_success
+  assert_output "true"
+
+  run /bin/bash -c "dokku builder-pack:set $TEST_APP stack"
+  assert_success
+
+  run /bin/bash -c "dokku builder-pack:set --global stack"
+  assert_success
+}
+
 @test "(builder-pack:set)" {
   run /bin/bash -c "dokku config:set $TEST_APP SECRET_KEY=fjdkslafjdk"
   echo "output: $output"
@@ -118,11 +167,17 @@ teardown() {
   echo "status: $status"
   assert_success
 
-  run /bin/bash -c "dokku buildpacks:set-property $TEST_APP stack heroku/builder:24"
+  run /bin/bash -c "dokku builder-pack:set $TEST_APP stack heroku/builder:24"
   echo "output: $output"
   echo "status: $status"
   assert_success
 
+  run /bin/bash -c "cat $DOKKU_LIB_ROOT/config/builder-pack/$TEST_APP/clear-cache"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "true"
+
   run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP add_requirements_txt_cnb
   echo "output: $output"
   echo "status: $status"
@@ -130,6 +185,11 @@ teardown() {
   assert_output_contains 'Building with buildpack 1' 0
   assert_output_contains 'Installing dependencies using pip'
 
+  run /bin/bash -c "test -f $DOKKU_LIB_ROOT/config/builder-pack/$TEST_APP/clear-cache"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
   run /bin/bash -c "dokku builder-pack:set $TEST_APP projecttoml-path nonexistent.toml"
   echo "output: $output"
   echo "status: $status"
@@ -326,6 +386,32 @@ teardown() {
   assert_success
 }
 
+@test "(builder-pack) ps:rebuild --no-cache" {
+  run /bin/bash -c "dokku builder:set $TEST_APP selected pack"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP add_requirements_txt_cnb
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "Using cached pip download/wheel cache"
+  assert_output_contains "Skipping buildpack layer analysis" 0
+
+  run /bin/bash -c "dokku ps:rebuild --no-cache $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "Skipping buildpack layer analysis"
+  assert_output_contains "Using cached pip download/wheel cache" 0
+}
+
 cron_run_wrapper() {
   local APP="$1"
   local APP_REPO_DIR="$2"
diff --git a/tests/unit/builder-railpack.bats b/tests/unit/builder-railpack.bats
index d94cba63b..eae0c4208 100644
--- a/tests/unit/builder-railpack.bats
+++ b/tests/unit/builder-railpack.bats
@@ -240,6 +240,53 @@ teardown() {
   assert_success
 }
 
+@test "(builder-railpack) ps:rebuild --no-cache" {
+  run /bin/bash -c "dokku builder:set $TEST_APP selected railpack"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP add_requirements_txt
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "CACHED" -1
+
+  run /bin/bash -c "dokku ps:rebuild --no-cache $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "Collecting flask" -1
+}
+
+@test "(builder-railpack) docker-options build --no-cache" {
+  run /bin/bash -c "dokku builder:set $TEST_APP selected railpack"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP add_requirements_txt
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku docker-options:add $TEST_APP build --no-cache"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "Collecting flask" -1
+}
+
 cron_run_wrapper() {
   local APP="$1"
   local APP_REPO_DIR="$2"
diff --git a/tests/unit/buildpacks.bats b/tests/unit/buildpacks.bats
index e52e700fb..d6ecad0af 100644
--- a/tests/unit/buildpacks.bats
+++ b/tests/unit/buildpacks.bats
@@ -253,71 +253,51 @@ teardown() {
   assert_output "https://github.com/heroku/heroku-buildpack-nodejs.git"
 }
 
-@test "(buildpacks) buildpacks:set-property" {
-  run /bin/bash -c "dokku buildpacks:set-property --global stack gliderlabs/herokuish:latest"
+@test "(buildpacks) buildpacks:set-property forwards stack to the detected builder" {
+  run /bin/bash -c "dokku buildpacks:set-property $TEST_APP stack gliderlabs/herokuish:app"
   echo "output: $output"
   echo "status: $status"
   assert_success
-}
+  assert_output_contains "Deprecated"
 
-@test "(buildpacks:report) stack raw vs computed vs global" {
-  run /bin/bash -c "dokku buildpacks:set-property --global stack"
-  assert_success
-
-  run /bin/bash -c "dokku buildpacks:report $TEST_APP --format json | jq -r '.\"buildpacks-stack\"'"
-  assert_success
-  assert_output ""
-
-  run /bin/bash -c "dokku buildpacks:report $TEST_APP --format json | jq -r '.\"buildpacks-global-stack\"'"
-  assert_success
-  assert_output ""
-
-  run /bin/bash -c "dokku buildpacks:set-property --global stack gliderlabs/herokuish:global"
-  assert_success
-
-  run /bin/bash -c "dokku buildpacks:report $TEST_APP --format json | jq -r '.\"buildpacks-global-stack\"'"
-  assert_success
-  assert_output "gliderlabs/herokuish:global"
-
-  run /bin/bash -c "dokku buildpacks:report $TEST_APP --format json | jq -r '.\"buildpacks-computed-stack\"'"
-  assert_success
-  assert_output "gliderlabs/herokuish:global"
-
-  run /bin/bash -c "dokku buildpacks:set-property $TEST_APP stack gliderlabs/herokuish:app"
-  assert_success
-
-  run /bin/bash -c "dokku buildpacks:report $TEST_APP --format json | jq -r '.\"buildpacks-stack\"'"
+  run /bin/bash -c "dokku builder-herokuish:report $TEST_APP --builder-herokuish-stack"
+  echo "output: $output"
+  echo "status: $status"
   assert_success
   assert_output "gliderlabs/herokuish:app"
 
-  run /bin/bash -c "dokku buildpacks:report $TEST_APP --format json | jq -r '.\"buildpacks-global-stack\"'"
+  run /bin/bash -c "dokku builder-pack:report $TEST_APP --builder-pack-stack"
+  echo "output: $output"
+  echo "status: $status"
   assert_success
-  assert_output "gliderlabs/herokuish:global"
+  assert_output ""
 
-  run /bin/bash -c "dokku buildpacks:report $TEST_APP --format json | jq -r '.\"buildpacks-computed-stack\"'"
+  run /bin/bash -c "dokku buildpacks:set-property $TEST_APP stack heroku/builder:24"
+  echo "output: $output"
+  echo "status: $status"
   assert_success
-  assert_output "gliderlabs/herokuish:app"
+
+  run /bin/bash -c "dokku builder-pack:report $TEST_APP --builder-pack-stack"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "heroku/builder:24"
 
   run /bin/bash -c "dokku buildpacks:set-property $TEST_APP stack"
+  echo "output: $output"
+  echo "status: $status"
   assert_success
 
-  run /bin/bash -c "dokku buildpacks:set-property --global stack"
+  run /bin/bash -c "dokku builder-herokuish:report $TEST_APP --builder-herokuish-stack"
   assert_success
+  assert_output ""
+
+  run /bin/bash -c "dokku builder-pack:report $TEST_APP --builder-pack-stack"
+  assert_success
+  assert_output ""
 }
 
 @test "(buildpacks:report) emits new stripped JSON keys alongside legacy" {
-  run /bin/bash -c "dokku buildpacks:report $TEST_APP --format json | jq -r 'has(\"stack\") and has(\"buildpacks-stack\")'"
-  assert_success
-  assert_output "true"
-
-  run /bin/bash -c "dokku buildpacks:report $TEST_APP --format json | jq -r 'has(\"global-stack\") and has(\"buildpacks-global-stack\")'"
-  assert_success
-  assert_output "true"
-
-  run /bin/bash -c "dokku buildpacks:report $TEST_APP --format json | jq -r 'has(\"computed-stack\") and has(\"buildpacks-computed-stack\")'"
-  assert_success
-  assert_output "true"
-
   run /bin/bash -c "dokku buildpacks:report $TEST_APP --format json | jq -r 'has(\"list\") and has(\"buildpacks-list\")'"
   assert_success
   assert_output "true"
@@ -476,6 +456,29 @@ teardown() {
   assert_output_contains "heroku-buildpack-python"
 }
 
+@test "(buildpacks:add) concurrent calls for the same app keep every buildpack" {
+  run run_concurrently 20 /bin/bash -c 'dokku buildpacks:add "$1" "https://github.com/dokku/buildpack-race$2.git"' _ "$TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku --quiet buildpacks:list $TEST_APP | grep -cE '^ *https://github.com/dokku/buildpack-race[0-9]+\.git$'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "20"
+
+  run run_concurrently 20 /bin/bash -c 'dokku buildpacks:remove "$1" "https://github.com/dokku/buildpack-race$2.git"' _ "$TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku --quiet buildpacks:list $TEST_APP | grep -cE '^ *https://github.com/dokku/buildpack-race[0-9]+\.git$'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output "0"
+}
+
 template_buildpacks_appjson() {
   local APP="$1"
   local APP_REPO_DIR="$2"
diff --git a/tests/unit/builds.bats b/tests/unit/builds.bats
index 115916884..b0ad5f9eb 100644
--- a/tests/unit/builds.bats
+++ b/tests/unit/builds.bats
@@ -91,6 +91,36 @@ EOF
   assert_output_contains "git-hook"
 }
 
+@test "(builds:report) records a ps:rebuild called with flags before the app name" {
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP convert_to_dockerfile
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:rebuild --no-cache $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "builds-record" 0
+
+  run /bin/bash -c "dokku builds:report $TEST_APP --build-source"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "ps:rebuild"
+
+  run /bin/bash -c "dokku builds:report $TEST_APP --build-status"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "succeeded"
+
+  run /bin/bash -c "[[ ! -e $DOKKU_LIB_ROOT/data/builds/--no-cache ]]"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+}
+
 @test "(builds:list) shows an abandoned record when the PID is gone but the record is still running" {
   write_running_record "$TEST_APP" "ghost001" 99999 "git-hook"
 
@@ -101,6 +131,75 @@ EOF
   assert_output_contains "abandoned"
 }
 
+@test "(builds) [lock] a failed build releases the deploy lock and finalizes the record as failed" {
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP convert_to_dockerfile
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku builder-dockerfile:set $TEST_APP dockerfile-path fail.Dockerfile"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "App build failed" -1
+
+  run /bin/bash -c "dokku apps:locked $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "[[ ! -e $DOKKU_LIB_ROOT/data/apps/$TEST_APP/.deploy.lock ]]"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku builds:report $TEST_APP --build-status"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "failed"
+
+  run /bin/bash -c "dokku builds:report $TEST_APP --build-exit-code"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_not_output "0"
+}
+
+@test "(builds) [lock] a deploy that exits while holding the lock finalizes its record" {
+  run /bin/bash -c "sudo -u dokku env PLUGIN_PATH=$PLUGIN_PATH PLUGIN_AVAILABLE_PATH=$PLUGIN_AVAILABLE_PATH PLUGIN_ENABLED_PATH=$PLUGIN_ENABLED_PATH PLUGIN_CORE_AVAILABLE_PATH=$PLUGIN_CORE_AVAILABLE_PATH DOKKU_LIB_ROOT=$DOKKU_LIB_ROOT DOKKU_BUILD_ID=exit0001 bash -c 'source $PLUGIN_CORE_AVAILABLE_PATH/common/functions; plugn trigger builds-record-start $TEST_APP exit0001 \$\$ git-hook; acquire_app_deploy_lock $TEST_APP exclusive; exit 3'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_equal 3 "$status"
+
+  run /bin/bash -c "[[ ! -e $DOKKU_LIB_ROOT/data/apps/$TEST_APP/.deploy.lock ]]"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku apps:locked $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "dokku builds:info $TEST_APP exit0001 --format json | jq -r .status"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "failed"
+
+  run /bin/bash -c "dokku builds:info $TEST_APP exit0001 --format json | jq -r .exit_code"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "3"
+}
+
 @test "(builds:list --kind=build) filters to build-kind records" {
   write_finished_record "$TEST_APP" "b1" "succeeded" "git-hook" 1001 "build"
   write_finished_record "$TEST_APP" "d1" "succeeded" "ps:restart" 1002 "deploy"
diff --git a/tests/unit/caddy-vhosts-docker-args.bats b/tests/unit/caddy-vhosts-docker-args.bats
new file mode 100644
index 000000000..5b4ec9c18
--- /dev/null
+++ b/tests/unit/caddy-vhosts-docker-args.bats
@@ -0,0 +1,311 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+# Isolated coverage for plugins/caddy-vhosts/docker-args-process-deploy.
+# Stubs plugn and plugin sources so the trigger can run without a Dokku install.
+
+setup() {
+  REPO_ROOT="$(cd "$BATS_TEST_DIRNAME/../.." && pwd)"
+  TRIGGER="$REPO_ROOT/plugins/caddy-vhosts/docker-args-process-deploy"
+  STUB_ROOT="$BATS_TEST_TMPDIR/stub"
+  mkdir -p "$STUB_ROOT/bin" \
+    "$STUB_ROOT/core/common" \
+    "$STUB_ROOT/plugins/proxy" \
+    "$STUB_ROOT/plugins/caddy-vhosts"
+
+  cat >"$STUB_ROOT/core/common/functions" <<'EOF'
+#!/usr/bin/env bash
+dokku_log_warn() { echo "WARN: $*" >&2; }
+dokku_log_fail() {
+  echo "FAIL: $*" >&2
+  exit 1
+}
+EOF
+
+  cat >"$STUB_ROOT/plugins/proxy/functions" <<EOF
+#!/usr/bin/env bash
+source "$REPO_ROOT/plugins/proxy/functions"
+EOF
+  cat >>"$STUB_ROOT/plugins/proxy/functions" <<'EOF'
+fn-proxy-get-labels-file-path() {
+  echo "${STUB_LABELS_FILE:-/nonexistent}"
+}
+EOF
+
+  cat >"$STUB_ROOT/plugins/caddy-vhosts/internal-functions" <<'EOF'
+#!/usr/bin/env bash
+fn-caddy-computed-letsencrypt-email() {
+  echo "${STUB_LETSENCRYPT_EMAIL:-}"
+}
+fn-caddy-computed-tls-internal() {
+  echo "${STUB_TLS_INTERNAL:-false}"
+}
+EOF
+
+  cat >"$STUB_ROOT/bin/plugn" <<'EOF'
+#!/usr/bin/env bash
+set -e
+if [[ "$1" != "trigger" ]]; then
+  echo "unexpected plugn command: $*" >&2
+  exit 1
+fi
+shift
+cmd="$1"
+shift
+case "$cmd" in
+  proxy-type)
+    echo "${STUB_PROXY_TYPE:-caddy}"
+    ;;
+  proxy-is-enabled)
+    echo "${STUB_PROXY_ENABLED:-true}"
+    ;;
+  domains-vhost-enabled)
+    [[ "${STUB_VHOST_ENABLED:-true}" == "true" ]]
+    ;;
+  ports-configure)
+    ;;
+  ports-get)
+    if [[ -n "${STUB_PORTS:-}" ]]; then
+      printf '%s\n' "$STUB_PORTS"
+    fi
+    ;;
+  domains-list)
+    if [[ -n "${STUB_DOMAINS:-}" ]]; then
+      printf '%s\n' "$STUB_DOMAINS"
+    fi
+    ;;
+  app-json-get-content)
+    echo "${STUB_APP_JSON:-{\}}"
+    ;;
+  *)
+    echo "unexpected plugn trigger: $cmd $*" >&2
+    exit 1
+    ;;
+esac
+EOF
+  chmod +x "$STUB_ROOT/bin/plugn"
+}
+
+invoke_caddy_docker_args() {
+  env \
+    PLUGIN_CORE_AVAILABLE_PATH="$STUB_ROOT/core" \
+    PLUGIN_AVAILABLE_PATH="$STUB_ROOT/plugins" \
+    PATH="$STUB_ROOT/bin:$PATH" \
+    STUB_PORTS="${STUB_PORTS:-}" \
+    STUB_DOMAINS="${STUB_DOMAINS:-}" \
+    STUB_TLS_INTERNAL="${STUB_TLS_INTERNAL:-false}" \
+    STUB_LETSENCRYPT_EMAIL="${STUB_LETSENCRYPT_EMAIL:-}" \
+    STUB_PROXY_TYPE="${STUB_PROXY_TYPE:-caddy}" \
+    STUB_PROXY_ENABLED="${STUB_PROXY_ENABLED:-true}" \
+    STUB_VHOST_ENABLED="${STUB_VHOST_ENABLED:-true}" \
+    STUB_LABELS_FILE="${STUB_LABELS_FILE:-/nonexistent}" \
+    STUB_APP_JSON="${STUB_APP_JSON:-}" \
+    bash "$TRIGGER" "${APP_NAME:-testapp}" "dockerfile" "latest" "${PROC_TYPE:-web}" "1" <<<"${STDIN_DATA:-}"
+}
+
+@test "(caddy-vhosts) tls-internal does not leak caddy.tls=internal without http/https ports" {
+  STUB_DOMAINS="example.com"
+  STUB_PORTS=""
+  STUB_TLS_INTERNAL="true"
+
+  run invoke_caddy_docker_args
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  if [[ "$output" == *"caddy.tls=internal"* ]]; then
+    flunk "stray caddy.tls=internal label leaked with no http/https mapping: $output"
+  fi
+}
+
+@test "(caddy-vhosts) is_app_listening gate compares == true not -n" {
+  run grep -F '[[ "$is_app_listening" == "true" ]]' "$TRIGGER"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run grep -F '[[ -n "$is_app_listening" ]]' "$TRIGGER"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+}
+
+@test "(caddy-vhosts) is_app_listening true still emits reverse_proxy labels" {
+  STUB_DOMAINS="example.com"
+  STUB_PORTS="http:80:5000"
+  STUB_TLS_INTERNAL="false"
+
+  run invoke_caddy_docker_args
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "caddy.reverse_proxy"
+}
+
+@test "(caddy-vhosts) readiness healthcheck emits health and retry labels" {
+  STUB_DOMAINS="example.com"
+  STUB_PORTS="http:80:5000"
+  STUB_APP_JSON='{"healthchecks":{"web":[{"type":"readiness","path":"/health","timeout":3,"wait":2}]}}'
+
+  run invoke_caddy_docker_args
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains '--label "caddy.reverse_proxy.health_uri=/health"'
+  assert_output_contains "--label caddy.reverse_proxy.health_interval=2s"
+  assert_output_contains "--label caddy.reverse_proxy.health_timeout=3s"
+  assert_output_contains "--label caddy.reverse_proxy.health_headers.Host=example.com"
+  assert_output_contains "--label caddy.reverse_proxy.lb_try_duration=5s"
+  assert_output_contains "--label caddy.reverse_proxy.lb_try_interval=250ms"
+  assert_output_contains "health_port" 0
+}
+
+@test "(caddy-vhosts) readiness healthcheck defaults and port" {
+  STUB_DOMAINS="example.com"
+  STUB_PORTS="http:80:5000"
+  STUB_APP_JSON='{"healthchecks":{"web":[{"type":"readiness","path":"/","port":5001}]}}'
+
+  run invoke_caddy_docker_args
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "--label caddy.reverse_proxy.health_port=5001"
+  assert_output_contains "--label caddy.reverse_proxy.health_interval=5s"
+  assert_output_contains "--label caddy.reverse_proxy.health_timeout=5s"
+}
+
+@test "(caddy-vhosts) healthcheck host header skips localhost and catch-all domains" {
+  STUB_DOMAINS="localhost * app.example.com other.example.com"
+  STUB_PORTS="http:80:5000"
+  STUB_APP_JSON='{"healthchecks":{"web":[{"type":"readiness","path":"/"}]}}'
+
+  run invoke_caddy_docker_args
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "--label caddy.reverse_proxy.health_headers.Host=app.example.com"
+}
+
+@test "(caddy-vhosts) startup healthcheck emits no health or retry labels" {
+  STUB_DOMAINS="example.com"
+  STUB_PORTS="http:80:5000"
+  STUB_APP_JSON='{"healthchecks":{"web":[{"type":"startup","path":"/"}]}}'
+
+  run invoke_caddy_docker_args
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "caddy.reverse_proxy="
+  assert_output_contains "health_" 0
+  assert_output_contains "lb_try_" 0
+}
+
+@test "(caddy-vhosts) missing app.json emits no health or retry labels" {
+  STUB_DOMAINS="example.com"
+  STUB_PORTS="http:80:5000"
+
+  run invoke_caddy_docker_args
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "caddy.reverse_proxy="
+  assert_output_contains "health_" 0
+  assert_output_contains "lb_try_" 0
+}
+
+@test "(caddy-vhosts) readiness healthcheck without routing labels emits no health labels" {
+  STUB_DOMAINS="example.com"
+  STUB_PORTS=""
+  STUB_APP_JSON='{"healthchecks":{"web":[{"type":"readiness","path":"/"}]}}'
+
+  run invoke_caddy_docker_args
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "health_" 0
+}
+
+@test "(caddy-vhosts) invalid readiness healthcheck path fails" {
+  STUB_DOMAINS="example.com"
+  STUB_PORTS="http:80:5000"
+  STUB_APP_JSON='{"healthchecks":{"web":[{"type":"readiness","path":"/has space"}]}}'
+
+  run invoke_caddy_docker_args
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Invalid app.json healthcheck path for caddy"
+}
+
+@test "(caddy-vhosts) readiness healthcheck maps attempts and headers" {
+  STUB_DOMAINS="example.com"
+  STUB_PORTS="http:80:5000"
+  STUB_APP_JSON='{"healthchecks":{"web":[{"type":"readiness","path":"/","attempts":4,"httpHeaders":[{"name":"X-Check","value":"dokku check"},{"name":"host","value":"check.example.com"}]}]}}'
+
+  run invoke_caddy_docker_args
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "--label caddy.reverse_proxy.health_fails=4"
+  assert_output_contains "--label 'caddy.reverse_proxy.health_headers.X-Check=\"dokku check\"'"
+  assert_output_contains "--label caddy.reverse_proxy.health_headers.Host=check.example.com"
+  assert_output_contains "health_headers.Host=example.com" 0
+  assert_output_contains "health_headers.host" 0
+}
+
+@test "(caddy-vhosts) readiness healthcheck defaults attempts to 3" {
+  STUB_DOMAINS="example.com"
+  STUB_PORTS="http:80:5000"
+  STUB_APP_JSON='{"healthchecks":{"web":[{"type":"readiness","path":"/"}]}}'
+
+  run invoke_caddy_docker_args
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "--label caddy.reverse_proxy.health_fails=3"
+}
+
+@test "(caddy-vhosts) invalid healthcheck headers are skipped" {
+  STUB_DOMAINS="example.com"
+  STUB_PORTS="http:80:5000"
+  STUB_APP_JSON='{"healthchecks":{"web":[{"type":"readiness","path":"/","httpHeaders":[{"name":"X.Dotted","value":"a"},{"name":"X-Order_1","value":"a"},{"name":"X-Quote","value":"it'"'"'s"},{"name":"Bad Name","value":"a"},{"name":"X-Good","value":"ok"}]}]}}'
+
+  run invoke_caddy_docker_args
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "Skipping invalid app.json healthcheck header for caddy" 4
+  assert_output_contains "health_headers.X-Good=" 1
+  assert_output_contains "health_headers.X.Dotted" 0
+  assert_output_contains "health_headers.X-Order_1" 0
+  assert_output_contains "health_headers.X-Quote" 0
+}
+
+@test "(caddy-vhosts) tls-internal emits caddy.tls=internal alongside https site labels" {
+  STUB_DOMAINS="example.com"
+  STUB_PORTS="$(printf 'http:80:5000\nhttps:443:5000')"
+  STUB_LETSENCRYPT_EMAIL="admin@example.com"
+  STUB_TLS_INTERNAL="true"
+
+  run invoke_caddy_docker_args
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "--label 'caddy=example.com'"
+  assert_output_contains "--label caddy.tls=internal"
+  assert_output_contains "caddy.reverse_proxy="
+}
+
+@test "(caddy-vhosts) tls-internal does not emit caddy.tls=internal for http-only sites" {
+  STUB_DOMAINS="example.com"
+  STUB_PORTS="http:80:5000"
+  STUB_TLS_INTERNAL="true"
+
+  run invoke_caddy_docker_args
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "--label 'caddy=example.com:80'"
+  assert_output_contains "caddy.tls=internal" 0
+}
diff --git a/tests/unit/caddy-vhosts.bats b/tests/unit/caddy-vhosts.bats
index 1c3180359..f65832d44 100644
--- a/tests/unit/caddy-vhosts.bats
+++ b/tests/unit/caddy-vhosts.bats
@@ -82,3 +82,16 @@ teardown() {
   assert_success
   assert_output "false"
 }
+
+@test "(caddy:set) missing app" {
+  run /bin/bash -c "dokku caddy:set missing-app tls-internal true"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "App missing-app does not exist"
+
+  run /bin/bash -c "test -e $DOKKU_LIB_ROOT/config/caddy/missing-app"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+}
diff --git a/tests/unit/caddy.bats b/tests/unit/caddy.bats
index dd1e48658..b8be0c5c0 100644
--- a/tests/unit/caddy.bats
+++ b/tests/unit/caddy.bats
@@ -429,3 +429,216 @@ teardown() {
   assert_success
   assert_output_not_exists
 }
+
+@test "(caddy:labels:add) concurrent calls for the same app keep every label" {
+  run run_concurrently 20 /bin/bash -c 'dokku caddy:labels:add "$1" "caddy.race$2" value' _ "$TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku caddy:labels:show $TEST_APP | grep -c 'caddy\.race[0-9]*=value'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "20"
+
+  run run_concurrently 20 /bin/bash -c 'dokku caddy:labels:remove "$1" "caddy.race$2"' _ "$TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku caddy:labels:show $TEST_APP 2>/dev/null | grep -c 'caddy\.race[0-9]*=value'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output "0"
+}
+
+@test "(caddy) healthcheck labels from app.json" {
+  run /bin/bash -c "dokku proxy:set $TEST_APP caddy"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP setup_caddy_readiness_healthcheck
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"caddy.reverse_proxy.health_uri\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "/"
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"caddy.reverse_proxy.health_interval\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "2s"
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"caddy.reverse_proxy.health_timeout\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "5s"
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"caddy.reverse_proxy.health_headers.Host\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "$TEST_APP.$DOKKU_DOMAIN"
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"caddy.reverse_proxy.lb_try_duration\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "5s"
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"caddy.reverse_proxy.lb_try_interval\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "250ms"
+
+  assert_http_localhost_response "http" "$TEST_APP.dokku.me" "80" "" "python/http.server"
+
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  assert_http_localhost_response "http" "$TEST_APP.dokku.me" "80" "" "python/http.server"
+}
+
+@test "(caddy) healthcheck labels can be overridden" {
+  run /bin/bash -c "dokku proxy:set $TEST_APP caddy"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku caddy:labels:add $TEST_APP caddy.reverse_proxy.lb_try_duration 10s"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP setup_caddy_readiness_healthcheck
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"caddy.reverse_proxy.lb_try_duration\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "10s"
+
+  assert_http_localhost_response "http" "$TEST_APP.dokku.me" "80" "" "python/http.server"
+}
+
+@test "(caddy) no healthcheck labels without readiness check" {
+  run /bin/bash -c "dokku proxy:set $TEST_APP caddy"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP convert_to_dockerfile
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"caddy.reverse_proxy.health_uri\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_not_exists
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"caddy.reverse_proxy.lb_try_duration\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_not_exists
+}
+
+@test "(caddy) invalid stored healthcheck path fails restart" {
+  run /bin/bash -c "dokku proxy:set $TEST_APP caddy"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP setup_caddy_readiness_healthcheck
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "jq '.healthchecks.web[0].path = \"/health check\"' /var/lib/dokku/data/app-json/$TEST_APP/app.json > /var/lib/dokku/data/app-json/$TEST_APP/app.json.tmp && mv /var/lib/dokku/data/app-json/$TEST_APP/app.json.tmp /var/lib/dokku/data/app-json/$TEST_APP/app.json"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:restart $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Invalid app.json healthcheck path for caddy" -1
+}
+
+@test "(caddy) healthcheck headers from app.json" {
+  run /bin/bash -c "dokku proxy:set $TEST_APP caddy"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP setup_caddy_readiness_healthcheck_headers
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"caddy.reverse_proxy.health_headers.X-Check\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output '"dokku check"'
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"caddy.reverse_proxy.health_fails\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "2"
+
+  sleep 5
+
+  run /bin/bash -c "docker cp caddy-caddy-1:/config/caddy/Caddyfile.autosave - | tar -xO"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains 'X-Check "dokku check"'
+  assert_output_contains "health_fails 2"
+
+  run /bin/bash -c "docker logs caddy-caddy-1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "Failed to convert caddyfile" 0
+
+  assert_http_localhost_response "http" "$TEST_APP.dokku.me" "80" "" "python/http.server"
+}
+
+setup_caddy_readiness_healthcheck() {
+  local APP="$1"
+  local APP_REPO_DIR="$2"
+  [[ -z "$APP" ]] && local APP="$TEST_APP"
+  APP_REPO_DIR="$(realpath "$APP_REPO_DIR")"
+
+  convert_to_dockerfile "$APP" "$APP_REPO_DIR"
+  mv "$APP_REPO_DIR/app-readiness.json" "$APP_REPO_DIR/app.json"
+}
+
+setup_caddy_readiness_healthcheck_headers() {
+  local APP="$1"
+  local APP_REPO_DIR="$2"
+  [[ -z "$APP" ]] && local APP="$TEST_APP"
+  APP_REPO_DIR="$(realpath "$APP_REPO_DIR")"
+
+  convert_to_dockerfile "$APP" "$APP_REPO_DIR"
+  jq '.healthchecks.web[0].attempts = 2 | .healthchecks.web[0].httpHeaders = [{"name": "X-Check", "value": "dokku check"}]' "$APP_REPO_DIR/app-readiness.json" >"$APP_REPO_DIR/app.json"
+}
diff --git a/tests/unit/certs.bats b/tests/unit/certs.bats
index eb9d74802..cecb754ab 100644
--- a/tests/unit/certs.bats
+++ b/tests/unit/certs.bats
@@ -53,6 +53,18 @@ teardown() {
   assert_success
   assert_output_contains "/$TEST_APP/tls"
 
+  run /bin/bash -c "dokku certs:report $TEST_APP --ssl-fingerprint"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output ""
+
+  run /bin/bash -c "dokku certs:report $TEST_APP --ssl-serial"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output ""
+
   run /bin/bash -c "dokku certs:report $TEST_APP --ssl-invalid-flag"
   echo "output: $output"
   echo "status: $status"
@@ -118,6 +130,75 @@ teardown() {
   assert_output "node-js-app.dokku.me"
 }
 
+@test "(certs:report) reports the certificate fingerprint and serial" {
+  local EXPECTED_FINGERPRINT EXPECTED_SERIAL
+  EXPECTED_FINGERPRINT="$(openssl x509 -in "$BATS_TMPDIR/tls/server.crt" -noout -fingerprint -sha256 | cut -d= -f2-)"
+  EXPECTED_SERIAL="$(openssl x509 -in "$BATS_TMPDIR/tls/server.crt" -noout -serial | cut -d= -f2-)"
+
+  run /bin/bash -c "dokku certs:add $TEST_APP $BATS_TMPDIR/tls/server.crt $BATS_TMPDIR/tls/server.key"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku certs:report $TEST_APP --ssl-fingerprint"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "$EXPECTED_FINGERPRINT"
+
+  run /bin/bash -c "dokku certs:report $TEST_APP --ssl-serial"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "$EXPECTED_SERIAL"
+
+  run /bin/bash -c "dokku certs:report $TEST_APP --format json | jq -r '.fingerprint'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "$EXPECTED_FINGERPRINT"
+
+  run /bin/bash -c "dokku certs:report $TEST_APP --format json | jq -r '.serial'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "$EXPECTED_SERIAL"
+}
+
+@test "(certs:report) fingerprint and serial follow a replaced certificate" {
+  local EXPECTED_FINGERPRINT EXPECTED_SERIAL
+  EXPECTED_FINGERPRINT="$(openssl x509 -in "$BATS_TMPDIR/tls/domain.com.crt" -noout -fingerprint -sha256 | cut -d= -f2-)"
+  EXPECTED_SERIAL="$(openssl x509 -in "$BATS_TMPDIR/tls/domain.com.crt" -noout -serial | cut -d= -f2-)"
+
+  run /bin/bash -c "dokku certs:add $TEST_APP $BATS_TMPDIR/tls/server.crt $BATS_TMPDIR/tls/server.key"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku certs:report $TEST_APP --ssl-fingerprint"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_not_output "$EXPECTED_FINGERPRINT"
+
+  run /bin/bash -c "dokku certs:update $TEST_APP $BATS_TMPDIR/tls/domain.com.crt $BATS_TMPDIR/tls/domain.com.key"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku certs:report $TEST_APP --ssl-fingerprint"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "$EXPECTED_FINGERPRINT"
+
+  run /bin/bash -c "dokku certs:report $TEST_APP --ssl-serial"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "$EXPECTED_SERIAL"
+}
+
 @test "(certs:report) reports the CN and all SANs as hostnames" {
   local SANS_TLS="$BATS_TMPDIR/tls-sans"
   mkdir -p "$SANS_TLS"
diff --git a/tests/unit/checks.bats b/tests/unit/checks.bats
index 365702002..f506aeb52 100644
--- a/tests/unit/checks.bats
+++ b/tests/unit/checks.bats
@@ -374,3 +374,26 @@ teardown() {
   assert_output_contains "Failure in name='port listening check': container listening on expected IPv4 interface with an unexpected port: expected=5000 actual=5001"
   assert_output_contains "Running healthcheck name='port listening check' attempts=3 port=5000 retries=2 timeout=5 type='listening' wait=5"
 }
+
+@test "(checks:disable) concurrent calls for the same app keep every process type" {
+  run run_concurrently 20 /bin/bash -c 'dokku checks:disable "$1" "worker$2"' _ "$TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku checks:report $TEST_APP --checks-disabled-list | tr ',' '\n' | grep -cx 'worker[0-9]*'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "20"
+
+  run run_concurrently 20 /bin/bash -c 'dokku checks:enable "$1" "worker$2"' _ "$TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku checks:report $TEST_APP --checks-disabled-list | tr ',' '\n' | grep -cx 'worker[0-9]*'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output "0"
+}
diff --git a/tests/unit/config.bats b/tests/unit/config.bats
index 1f7d9c164..7545308b6 100644
--- a/tests/unit/config.bats
+++ b/tests/unit/config.bats
@@ -11,6 +11,7 @@ setup() {
 }
 
 teardown() {
+  restore_app_config_dir
   destroy_app
   if [[ -f ${DOKKU_LIB_ROOT}/config/--global/ENV.bak ]]; then
     mv -f ${DOKKU_LIB_ROOT}/config/--global/ENV.bak ${DOKKU_LIB_ROOT}/config/--global/ENV
@@ -704,6 +705,131 @@ teardown() {
   assert_success
 }
 
+@test "(config:set) fails when the config file cannot be written" {
+  run /bin/bash -c "dokku config:set --no-restart $TEST_APP first_key=first_value"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  block_app_config_dir
+
+  run /bin/bash -c "dokku config:set --no-restart $TEST_APP second_key=second_value"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Unable to write config vars"
+
+  restore_app_config_dir
+
+  run /bin/bash -c "dokku config:get $TEST_APP first_key"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "first_value"
+
+  run /bin/bash -c "dokku config:get $TEST_APP second_key"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+}
+
+@test "(config:unset) fails when the config file cannot be written" {
+  run /bin/bash -c "dokku config:set --no-restart $TEST_APP first_key=first_value"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  block_app_config_dir
+
+  run /bin/bash -c "dokku config:unset --no-restart $TEST_APP first_key"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Unable to write config vars"
+
+  restore_app_config_dir
+
+  run /bin/bash -c "dokku config:get $TEST_APP first_key"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "first_value"
+}
+
+@test "(config:clear) fails when the config file cannot be written" {
+  run /bin/bash -c "dokku config:set --no-restart $TEST_APP first_key=first_value"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  block_app_config_dir
+
+  run /bin/bash -c "dokku config:clear --no-restart $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Unable to write config vars"
+
+  restore_app_config_dir
+
+  run /bin/bash -c "dokku config:get $TEST_APP first_key"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "first_value"
+}
+
+@test "(config) config-unset plugin trigger reports a failure" {
+  run_plugn_trigger config-unset "$TEST_APP" invalid-key false
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Invalid key name"
+}
+
+@test "(config:set) concurrent calls for the same app keep every key" {
+  run run_concurrently 20 /bin/bash -c 'dokku config:set --no-restart "$1" "RACE_KEY_$2=value"' _ "$TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku config:keys $TEST_APP | grep -cx 'RACE_KEY_[0-9]*'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "20"
+
+  run run_concurrently 20 /bin/bash -c 'dokku config:unset --no-restart "$1" "RACE_KEY_$2"' _ "$TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku config:keys $TEST_APP | grep -cx 'RACE_KEY_[0-9]*'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output "0"
+}
+
+block_app_config_dir() {
+  declare desc="makes the app config directory unwritable for the dokku user"
+
+  run /bin/bash -c "sudo chown root:root ${DOKKU_LIB_ROOT}/config/$TEST_APP && sudo chmod 0555 ${DOKKU_LIB_ROOT}/config/$TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+}
+
+restore_app_config_dir() {
+  declare desc="hands the app config directory back to the dokku user"
+
+  if [[ ! -d "${DOKKU_LIB_ROOT}/config/$TEST_APP" ]]; then
+    return 0
+  fi
+
+  sudo chmod 0755 "${DOKKU_LIB_ROOT}/config/$TEST_APP"
+  sudo chown -R dokku:dokku "${DOKKU_LIB_ROOT}/config/$TEST_APP"
+}
+
 stage_stale_env() {
   declare desc="writes a legacy ENV file at the pre-0.38 path for the test app"
 
diff --git a/tests/unit/core_1.bats b/tests/unit/core_1.bats
index b28d3c510..c27db95c6 100644
--- a/tests/unit/core_1.bats
+++ b/tests/unit/core_1.bats
@@ -120,3 +120,85 @@ teardown() {
   assert_line 0 "--label"
   assert_line 1 "a b"
 }
+
+@test "(common) [preserve-env] fn-sudo-preserve-env-flag emits only the requested names" {
+  run /bin/bash -c "source '$PLUGIN_CORE_AVAILABLE_PATH/common/functions'; fn-sudo-preserve-env-flag DOKKU_TRACE DOKKU_APP_NAME"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "--preserve-env=DOKKU_TRACE,DOKKU_APP_NAME"
+}
+
+@test "(common) [preserve-env] fn-sudo-preserve-env-flag omits sudo managed names" {
+  run /bin/bash -c "source '$PLUGIN_CORE_AVAILABLE_PATH/common/functions'; export DOKKU_TEST_CROSSING=1; fn-sudo-preserve-env-flag | sed 's/^--preserve-env=//' | tr ',' '\\n' | grep -cx DOKKU_TEST_CROSSING"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "1"
+
+  run /bin/bash -c "source '$PLUGIN_CORE_AVAILABLE_PATH/common/functions'; fn-sudo-preserve-env-flag | sed 's/^--preserve-env=//' | tr ',' '\\n' | grep -cxE 'HOME|LOGNAME|MAIL|PATH|SHELL|USER|_|SUDO_.*'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output "0"
+}
+
+@test "(common) [preserve-env] fn-sudo-preserve-env-flag honors DOKKU_PRESERVE_ENV" {
+  run /bin/bash -c "source '$PLUGIN_CORE_AVAILABLE_PATH/common/functions'; DOKKU_PRESERVE_ENV=ALPHA,BETA fn-sudo-preserve-env-flag DOKKU_TRACE"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "--preserve-env=DOKKU_TRACE,ALPHA,BETA"
+
+  run /bin/bash -c "source '$PLUGIN_CORE_AVAILABLE_PATH/common/functions'; DOKKU_PRESERVE_ENV=ALPHA fn-sudo-preserve-env-flag | sed 's/^--preserve-env=//' | tr ',' '\\n' | grep -cx ALPHA"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "1"
+}
+
+@test "(common) [preserve-env] fn-cli-preserved-env-names covers every parse_args export" {
+  run /bin/bash -c "source '$PLUGIN_CORE_AVAILABLE_PATH/common/functions'; fn-cli-preserved-env-names | tr ' ' '\\n' | grep -cxE 'DOKKU_APP_NAME|DOKKU_APPS_FORCE_DELETE|DOKKU_GLOBAL_FLAGS|DOKKU_PRESERVE_ENV|DOKKU_QUIET_OUTPUT|DOKKU_TRACE|SSH_USER'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "7"
+}
+
+@test "(common) [preserve-env] fn-cli-preserved-env-names covers the docker image build variables" {
+  # neither is read by the dokku script itself, so the derivation test below does not
+  # catch them. both exist only in the environment while the docker image is built
+  run /bin/bash -c "source '$PLUGIN_CORE_AVAILABLE_PATH/common/functions'; fn-cli-preserved-env-names | tr ' ' '\\n' | grep -cxE 'DOKKU_INIT_SYSTEM|DOKKU_LIB_HOST_ROOT'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "2"
+}
+
+@test "(common) [preserve-env] every environment-overridable dokku variable is preserved" {
+  # test_helper leaves these unexported, so the single-quoted script below cannot see
+  # them without this
+  export PLUGIN_CORE_AVAILABLE_PATH
+  export DOKKU_SOURCE="${BATS_TEST_DIRNAME}/../../dokku"
+  run /bin/bash -c 'source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"; comm -23 <(grep -oE "[{][A-Z_]+:=" "$DOKKU_SOURCE" | tr -cd "A-Z_\n" | sort -u | grep -vx DOKKU_PID) <(fn-cli-preserved-env-names | tr " " "\n" | sort -u)'
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output ""
+  unset DOKKU_SOURCE
+}
+
+@test "(common) [preserve-env] parse_args records global flags for replay" {
+  run /bin/bash -c "source '$PLUGIN_CORE_AVAILABLE_PATH/common/functions'; parse_args --label=a=b run foo env; echo \"\$DOKKU_GLOBAL_FLAGS\""
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "--label=a=b"
+}
+
+@test "(core) cleanup missing app" {
+  run /bin/bash -c "dokku cleanup missing-app"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "App missing-app does not exist"
+}
diff --git a/tests/unit/core_2.bats b/tests/unit/core_2.bats
index a0f7a4591..2efe0e25c 100644
--- a/tests/unit/core_2.bats
+++ b/tests/unit/core_2.bats
@@ -37,6 +37,14 @@ teardown() {
   assert_success
 }
 
+@test "(core) ssh arguments are passed through unchanged" {
+  run ssh "dokku@$DOKKU_DOMAIN" fakecommand --version --help -n -e -E
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains '`fakecommand --version --help -n -e -E` is not a dokku command.'
+}
+
 @test "(core) urls (non-ssl)" {
   assert_urls "http://${TEST_APP}.${DOKKU_DOMAIN}"
 
diff --git a/tests/unit/core_3.bats b/tests/unit/core_3.bats
new file mode 100644
index 000000000..832bb51b1
--- /dev/null
+++ b/tests/unit/core_3.bats
@@ -0,0 +1,105 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+  global_setup
+  create_app
+}
+
+teardown() {
+  destroy_app
+  global_teardown
+}
+
+@test "(core) [global-flags] --quiet crosses the privilege drop" {
+  run /bin/bash -c "dokku apps:list"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "My Apps"
+
+  run /bin/bash -c "dokku --quiet apps:list"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_not_contains "My Apps"
+  assert_output_contains "$TEST_APP"
+}
+
+@test "(core) [global-flags] --trace crosses the privilege drop" {
+  run /bin/bash -c "dokku --trace apps:list 2>&1 >/dev/null"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "execute_dokku_cmd"
+}
+
+@test "(core) [global-flags] --force crosses the privilege drop" {
+  local force_app="${TEST_APP}-force"
+  run /bin/bash -c "dokku apps:create $force_app"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku --force apps:destroy $force_app </dev/null"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_not_contains "To proceed, type"
+}
+
+@test "(core) [global-flags] --app crosses the privilege drop" {
+  run /bin/bash -c "dokku --app $TEST_APP config:set --no-restart TEST_PRESERVED=crossed"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku config:get $TEST_APP TEST_PRESERVED"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "crossed"
+}
+
+@test "(core) [global-flags] a clean invocation writes nothing to stderr" {
+  run /bin/bash -c "dokku apps:list 2>&1 >/dev/null"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output ""
+}
+
+@test "(core) [global-flags] the caller environment crosses the privilege drop" {
+  run /bin/bash -c "DOKKU_QUIET_OUTPUT=1 dokku apps:list"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_not_contains "My Apps"
+  assert_output_contains "$TEST_APP"
+}
+
+@test "(core) [global-flags] an unlisted variable only crosses when DOKKU_PRESERVE_ENV names it" {
+  # DOKKU_TRACE is set in the environment rather than passed as --trace so that the
+  # parent traces too: the sudo line naming the forwarded variables is only emitted there
+  run /bin/bash -c "DOKKU_TRACE=1 DOKKU_TEST_CROSSING=1 dokku apps:list 2>&1 >/dev/null | grep -o -- '--preserve-env=[^ ]*' | head -1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "--preserve-env="
+  assert_output_not_contains "DOKKU_TEST_CROSSING"
+
+  run /bin/bash -c "DOKKU_TRACE=1 DOKKU_PRESERVE_ENV=DOKKU_TEST_CROSSING DOKKU_TEST_CROSSING=1 dokku apps:list 2>&1 >/dev/null | grep -o -- '--preserve-env=[^ ]*' | head -1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "DOKKU_TEST_CROSSING"
+}
+
+@test "(core) [global-flags] the system sudo supports a named preserve-env list" {
+  run /bin/bash -c "DOKKU_TEST_CROSSING=1 sudo -u dokku --preserve-env=DOKKU_TEST_CROSSING -H /usr/bin/env | grep -cxE 'DOKKU_TEST_CROSSING=1|HOME=/home/dokku'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "2"
+}
diff --git a/tests/unit/cron-3.bats b/tests/unit/cron-3.bats
index 4f830c620..f20f2e72a 100644
--- a/tests/unit/cron-3.bats
+++ b/tests/unit/cron-3.bats
@@ -104,6 +104,54 @@ teardown() {
   assert_failure
 }
 
+@test "(cron) injected json entries" {
+  cat >/var/lib/dokku/plugins/enabled/cron-entries/cron-entries <<'EOF'
+#!/usr/bin/env bash
+[[ "$2" == "json" ]] || exit 0
+echo '@daily;/bin/true'
+echo '{"schedule":"@hourly","command":"/bin/false","log-file":"/var/log/dokku/log.log","mailto":"ops@example.com"}'
+EOF
+  chmod +x /var/lib/dokku/plugins/enabled/cron-entries/cron-entries
+
+  run /bin/bash -c "dokku cron:set --global mailto global@example.com"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku plugin:trigger scheduler-cron-write"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "cat /var/spool/cron/crontabs/dokku"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  # once in the header, and once to reset it after the task with its own
+  assert_output_contains "MAILTO=global@example.com" 2
+  assert_output_contains "@daily /bin/true"
+  assert_output_contains "MAILTO=ops@example.com"
+  assert_output_contains "@hourly /bin/false 2>&1 | tee -a /var/log/dokku/log.log"
+
+  # the global MAILTO is restored for every task after the one with its own
+  run /bin/bash -c "grep -A1 -F 'tee -a /var/log/dokku/log.log' /var/spool/cron/crontabs/dokku | tail -n 1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "MAILTO=global@example.com"
+
+  run /bin/bash -c "dokku cron:list --global --format json | jq -r '.[] | select(.schedule == \"@hourly\") | .mailto'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "ops@example.com"
+
+  run /bin/bash -c "dokku cron:set --global mailto"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+}
+
 @test "(cron) invalid [command]" {
   run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP template_cron_file_injection
   echo "output: $output"
diff --git a/tests/unit/datastore.bats b/tests/unit/datastore.bats
new file mode 100644
index 000000000..2c9e197b7
--- /dev/null
+++ b/tests/unit/datastore.bats
@@ -0,0 +1,137 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+TEST_SERVICE="ds-test-service"
+
+setup() {
+  global_setup
+  create_app
+}
+
+teardown() {
+  dokku datastore:unlink redis "$TEST_SERVICE" "$TEST_APP" --no-restart >/dev/null 2>&1 || true
+  dokku datastore:destroy redis "$TEST_SERVICE" --force >/dev/null 2>&1 || true
+  destroy_app
+  global_teardown
+}
+
+@test "(datastore) datastore:help" {
+  run /bin/bash -c "dokku datastore"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "Manage datastore services."
+  assert_output_contains "datastore:create <datastore-type> <service>"
+  help_output="$output"
+
+  run /bin/bash -c "dokku datastore:help"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "$help_output"
+
+  run /bin/bash -c "dokku datastore:help redis"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "dokku datastore:list redis"
+
+  run /bin/bash -c "dokku datastore:help redis create"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "dokku datastore:create redis <service>"
+
+  run /bin/bash -c "dokku datastore:help nonsense"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "dokku help --all"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "datastore:create <datastore-type> <service>"
+}
+
+@test "(datastore) datastore:version" {
+  run /bin/bash -c "dokku datastore:version"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "v"
+}
+
+@test "(datastore) create, link, unlink and destroy a service" {
+  run /bin/bash -c "dokku datastore:create redis $TEST_SERVICE"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku datastore:exists redis $TEST_SERVICE"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku datastore:list redis"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "$TEST_SERVICE"
+
+  run /bin/bash -c "dokku datastore:link redis $TEST_SERVICE $TEST_APP --no-restart"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku config:get $TEST_APP REDIS_URL"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "redis://"
+
+  run /bin/bash -c "dokku datastore:unlink redis $TEST_SERVICE $TEST_APP --no-restart"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku config:get $TEST_APP REDIS_URL"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output ""
+
+  run /bin/bash -c "dokku datastore:destroy redis $TEST_SERVICE --force"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku datastore:exists redis $TEST_SERVICE"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+}
+
+@test "(datastore) deleting an app unlinks its services" {
+  run /bin/bash -c "dokku datastore:create redis $TEST_SERVICE"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku datastore:link redis $TEST_SERVICE $TEST_APP --no-restart"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku --force apps:destroy $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku datastore:linked redis $TEST_SERVICE $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  create_app
+}
diff --git a/tests/unit/deploy-lock.bats b/tests/unit/deploy-lock.bats
new file mode 100644
index 000000000..6aa894298
--- /dev/null
+++ b/tests/unit/deploy-lock.bats
@@ -0,0 +1,133 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+  global_setup
+  LOCK_DIR="$(mktemp -d "/tmp/${DOKKU_DOMAIN}.XXXXX")"
+  LOCK_FILE="$LOCK_DIR/test.lock"
+  LOCK_PIDS=()
+}
+
+teardown() {
+  local pid
+  touch "$LOCK_DIR/release"
+  for pid in "${LOCK_PIDS[@]}"; do
+    kill "$pid" &>/dev/null || true
+  done
+  rm -rf "$LOCK_DIR"
+  global_teardown
+}
+
+lock_script() {
+  declare BUILD_ID="$1" SCRIPT="$2"
+  echo "source '$PLUGIN_CORE_AVAILABLE_PATH/common/functions'; export DOKKU_BUILD_ID='$BUILD_ID'; $SCRIPT"
+}
+
+start_lock_holder() {
+  declare BUILD_ID="$1"
+  /bin/bash -c "$(lock_script "$BUILD_ID" "acquire_advisory_lock '$LOCK_FILE' exclusive 'waiting' 'lock held'; while [[ ! -f '$LOCK_DIR/release' ]]; do sleep 0.2; done; release_advisory_lock '$LOCK_FILE'")" >/dev/null 2>&1 3>&- &
+  LOCK_PIDS+=("$!")
+  wait_for "[[ \"\$(cat '$LOCK_FILE' 2>/dev/null)\" == '$BUILD_ID' ]]"
+}
+
+wait_for() {
+  declare CONDITION="$1"
+  local i
+  for i in $(seq 1 50); do
+    if eval "$CONDITION"; then
+      return 0
+    fi
+    sleep 0.2
+  done
+
+  echo "timed out waiting for: $CONDITION"
+  return 1
+}
+
+@test "(deploy-lock) a failed acquire does not truncate the lock holder's build id" {
+  start_lock_holder "holder-a"
+
+  run /bin/bash -c "$(lock_script "other" "acquire_advisory_lock '$LOCK_FILE' exclusive 'waiting' 'lock held'")"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "lock held"
+
+  run /bin/bash -c "cat '$LOCK_FILE'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "holder-a"
+}
+
+@test "(deploy-lock) a waiter does not keep a stale lock after the holder removes the lock file" {
+  start_lock_holder "holder-a"
+
+  /bin/bash -c "$(lock_script "holder-b" "acquire_advisory_lock '$LOCK_FILE' waiting 'waiting' 'lock held'; touch '$LOCK_DIR/b.acquired'; exec sleep 60")" >"$LOCK_DIR/b.log" 2>&1 3>&- &
+  local B_PID="$!"
+  LOCK_PIDS+=("$B_PID")
+  wait_for "grep -q waiting '$LOCK_DIR/b.log'"
+
+  touch "$LOCK_DIR/release"
+  wait_for "[[ -f '$LOCK_DIR/b.acquired' ]]"
+
+  run /bin/bash -c "[[ /proc/$B_PID/fd/200 -ef '$LOCK_FILE' ]]"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "cat '$LOCK_FILE'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "holder-b"
+
+  run /bin/bash -c "$(lock_script "holder-c" "acquire_advisory_lock '$LOCK_FILE' exclusive 'waiting' 'lock held'")"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "lock held"
+}
+
+@test "(deploy-lock) the lock file is removed when the holder exits without releasing it" {
+  run /bin/bash -c "$(lock_script "holder-a" "acquire_advisory_lock '$LOCK_FILE' exclusive 'waiting' 'lock held'; exit 1")"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "[[ ! -e '$LOCK_FILE' ]]"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+}
+
+@test "(deploy-lock) the lock file is removed when the holder is terminated" {
+  start_lock_holder "holder-a"
+
+  kill -TERM "${LOCK_PIDS[0]}"
+  wait_for "! kill -0 ${LOCK_PIDS[0]} 2>/dev/null"
+
+  run /bin/bash -c "[[ ! -e '$LOCK_FILE' ]]"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+}
+
+@test "(deploy-lock) release only removes the lock file it holds" {
+  start_lock_holder "holder-a"
+
+  run /bin/bash -c "rm -f '$LOCK_FILE' && echo 'replacement' >'$LOCK_FILE'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  touch "$LOCK_DIR/release"
+  wait_for "! kill -0 ${LOCK_PIDS[0]} 2>/dev/null"
+
+  run /bin/bash -c "cat '$LOCK_FILE'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "replacement"
+}
diff --git a/tests/unit/docker-cleanup-force-flag.bats b/tests/unit/docker-cleanup-force-flag.bats
new file mode 100644
index 000000000..86bb692d2
--- /dev/null
+++ b/tests/unit/docker-cleanup-force-flag.bats
@@ -0,0 +1,27 @@
+#!/usr/bin/env bats
+
+setup() {
+  DOKKU_TEST_TMPDIR="$(mktemp -d)"
+  export DOKKU_TEST_ARGS_FILE="$DOKKU_TEST_TMPDIR/args"
+  export PLUGIN_CORE_AVAILABLE_PATH="$DOKKU_TEST_TMPDIR/plugin"
+
+  mkdir -p "$PLUGIN_CORE_AVAILABLE_PATH/common"
+  cat >"$PLUGIN_CORE_AVAILABLE_PATH/common/common" <<'EOF'
+#!/usr/bin/env bash
+printf '%s\n' "$@" > "$DOKKU_TEST_ARGS_FILE"
+EOF
+  chmod +x "$PLUGIN_CORE_AVAILABLE_PATH/common/common"
+
+  source "$BATS_TEST_DIRNAME/../../plugins/common/functions"
+}
+
+teardown() {
+  rm -rf "$DOKKU_TEST_TMPDIR"
+}
+
+@test "docker_cleanup forwards the manual force flag to the core command" {
+  run docker_cleanup --global true
+
+  [ "$status" -eq 0 ]
+  [ "$(cat "$DOKKU_TEST_ARGS_FILE")" = $'--quiet\ndocker-cleanup\n--global\ntrue' ]
+}
diff --git a/tests/unit/docker-options-2.bats b/tests/unit/docker-options-2.bats
index 620a8a105..16f494b0d 100644
--- a/tests/unit/docker-options-2.bats
+++ b/tests/unit/docker-options-2.bats
@@ -316,6 +316,29 @@ teardown() {
   assert_output_contains "running"
 }
 
+@test "(docker-options:add) concurrent calls for the same app keep every option" {
+  run run_concurrently 20 /bin/bash -c 'dokku docker-options:add "$1" deploy "--label=race$2"' _ "$TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku docker-options:list $TEST_APP --phase deploy | grep -cx -- '--label=race[0-9]*'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "20"
+
+  run run_concurrently 20 /bin/bash -c 'dokku docker-options:remove "$1" deploy "--label=race$2"' _ "$TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku docker-options:list $TEST_APP --phase deploy | grep -cx -- '--label=race[0-9]*'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output "0"
+}
+
 web_worker_callback() {
   local APP="$1"
   local APP_REPO_DIR="$2"
diff --git a/tests/unit/domains.bats b/tests/unit/domains.bats
index 005973044..6edd71f64 100644
--- a/tests/unit/domains.bats
+++ b/tests/unit/domains.bats
@@ -136,6 +136,20 @@ teardown() {
   assert_failure
 }
 
+@test "(domains) domains:enable and domains:disable (missing app)" {
+  run /bin/bash -c "dokku domains:disable missing-app"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "App missing-app does not exist"
+
+  run /bin/bash -c "dokku domains:enable missing-app"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "App missing-app does not exist"
+}
+
 @test "(domains) domains:remove" {
   run /bin/bash -c "dokku domains:add $TEST_APP test.app.${DOKKU_DOMAIN}"
   echo "output: $output"
@@ -519,3 +533,28 @@ teardown() {
   assert_success
   assert_output "http:2019:2019 http:80:80 https:443:443 udp:443:443"
 }
+
+@test "(domains) urls do not glob expand a catch-all domain" {
+  local tmp_dir
+  tmp_dir="$(mktemp -d)"
+  touch "$tmp_dir/glob-canary"
+  chmod 755 "$tmp_dir"
+
+  run /bin/bash -c "dokku proxy:set $TEST_APP caddy"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku domains:set $TEST_APP '*'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "cd $tmp_dir && dokku urls $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  rm -rf "$tmp_dir"
+  assert_success
+  assert_output_contains "glob-canary" 0
+  assert_output_contains "http://*"
+}
diff --git a/tests/unit/git_3.bats b/tests/unit/git_3.bats
index 069816cd4..eca165091 100644
--- a/tests/unit/git_3.bats
+++ b/tests/unit/git_3.bats
@@ -185,12 +185,18 @@ teardown() {
   run /bin/bash -c "dokku git:auth-status"
   echo "output: $output"
   echo "status: $status"
-  assert_failure
+  assert_exit_status 3
+  assert_output_contains "Please supply a git host"
 
   run /bin/bash -c "dokku git:auth-status github.com"
   echo "output: $output"
   echo "status: $status"
-  assert_success
+  assert_exit_status 0
+
+  run /bin/bash -c "dokku git:auth-status github.com username password"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 1
 
   run /bin/bash -c "dokku git:auth github.com username password"
   echo "output: $output"
@@ -200,38 +206,85 @@ teardown() {
   run /bin/bash -c "dokku git:auth-status github.com"
   echo "output: $output"
   echo "status: $status"
-  assert_failure
+  assert_exit_status 2
 
   run /bin/bash -c "dokku git:auth-status github.com username password"
   echo "output: $output"
   echo "status: $status"
-  assert_success
+  assert_exit_status 0
 
   run /bin/bash -c "dokku git:auth-status github.com username wrong-password"
   echo "output: $output"
   echo "status: $status"
-  assert_failure
+  assert_exit_status 2
 
   run /bin/bash -c "dokku git:auth-status github.com other-username password"
   echo "output: $output"
   echo "status: $status"
-  assert_failure
+  assert_exit_status 2
 
   run /bin/bash -c "dokku git:auth-status github.com username"
   echo "output: $output"
   echo "status: $status"
-  assert_failure
+  assert_exit_status 3
   assert_output_contains "Missing password for netrc auth entry"
 
   run /bin/bash -c "printf 'password' | dokku git:auth-status github.com username"
   echo "output: $output"
   echo "status: $status"
-  assert_success
+  assert_exit_status 0
 
   run /bin/bash -c "printf 'wrong-password' | dokku git:auth-status github.com username"
   echo "output: $output"
   echo "status: $status"
-  assert_failure
+  assert_exit_status 2
+}
+
+@test "(git:auth-status) distinguishes a missing entry from a differing entry" {
+  run /bin/bash -c "dokku git:auth auth-status.example.com"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku git:auth-status auth-status.example.com username password"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 1
+
+  run /bin/bash -c "dokku git:auth-status auth-status.example.com"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 0
+
+  run /bin/bash -c "dokku git:auth auth-status.example.com username password"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku git:auth-status auth-status.example.com username password"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 0
+
+  run /bin/bash -c "dokku git:auth-status auth-status.example.com username other-password"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 2
+
+  run /bin/bash -c "dokku git:auth-status auth-status.example.com"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 2
+
+  run /bin/bash -c "dokku git:auth auth-status.example.com"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku git:auth-status auth-status.example.com username password"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 1
 }
 
 @test "(git) git:sync new [errors]" {
@@ -342,6 +395,59 @@ teardown() {
   echo "status: $status"
   assert_success
   assert_output_contains "$SMOKE_TEST_APP_MASTER_SHA"
+
+  # the no-op tick must not add a record of its own, and must leave the
+  # succeeded record of the build above untouched
+  run /bin/bash -c "ls $DOKKU_LIB_ROOT/data/builds/$TEST_APP/*.json 2>/dev/null | wc -l"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "1"
+
+  run /bin/bash -c "dokku builds:list $TEST_APP --format json"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains '"status":"succeeded"'
+  assert_output_not_contains '"display_status":"abandoned"'
+}
+
+@test "(git) git:sync new [no build leaves no build record]" {
+  run /bin/bash -c "rm -rf $DOKKU_LIB_ROOT/data/builds/$TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # a sync with no build flag builds nothing, so it should record nothing
+  run /bin/bash -c "dokku git:sync $TEST_APP https://github.com/dokku/smoke-test-app.git"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "ls $DOKKU_LIB_ROOT/data/builds/$TEST_APP/*.json 2>/dev/null | wc -l"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "0"
+
+  # and neither should a --build-if-changes poll that finds no changes
+  run /bin/bash -c "dokku git:sync --build-if-changes $TEST_APP https://github.com/dokku/smoke-test-app.git"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "Skipping build as no changes were detected"
+
+  run /bin/bash -c "ls $DOKKU_LIB_ROOT/data/builds/$TEST_APP/*.json 2>/dev/null | wc -l"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "0"
+
+  run /bin/bash -c "ls $DOKKU_LIB_ROOT/data/builds/$TEST_APP/*.log 2>/dev/null | wc -l"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "0"
 }
 
 @test "(git) git:sync new [--build branch]" {
diff --git a/tests/unit/git_4.bats b/tests/unit/git_4.bats
index 3abdc460b..650f40454 100644
--- a/tests/unit/git_4.bats
+++ b/tests/unit/git_4.bats
@@ -10,11 +10,49 @@ setup() {
 }
 
 teardown() {
+  release_deploy_lock
+  docker image rm "dokku-test/$TEST_APP:second-procfile" "dokku-test/$TEST_APP:default-procfile" &>/dev/null || true
   rm -f /home/dokku/.ssh/id_rsa.pub || true
   destroy_app
   global_teardown
 }
 
+build_python_image() {
+  declare TAG="$1" PROCFILE="$2"
+  local TMP_IMAGE_DIR exit_code=0
+  TMP_IMAGE_DIR="$(mktemp -d "/tmp/${DOKKU_DOMAIN}.XXXXX")"
+  cp -r "${BATS_TEST_DIRNAME}/../../tests/apps/python/." "$TMP_IMAGE_DIR"
+  if [[ -n "$PROCFILE" ]]; then
+    cp "$TMP_IMAGE_DIR/$PROCFILE" "$TMP_IMAGE_DIR/Procfile"
+  fi
+
+  docker image build --label "com.dokku.test-app=$TEST_APP" -t "dokku-test/$TEST_APP:$TAG" -f "$TMP_IMAGE_DIR/alt.Dockerfile" "$TMP_IMAGE_DIR" || exit_code="$?"
+  rm -rf "$TMP_IMAGE_DIR"
+  return "$exit_code"
+}
+
+deploy_second_procfile_image() {
+  run build_python_image second-procfile second.Procfile
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku git:from-image $TEST_APP dokku-test/$TEST_APP:second-procfile"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku plugin:trigger procfile-get-command $TEST_APP web 5001"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "second.Procfile"
+}
+
+deploy_branch_rev() {
+  sudo -u dokku git -C "/home/dokku/$TEST_APP" rev-parse master
+}
+
 @test "(git) git:from-image [missing]" {
   run /bin/bash -c "dokku git:from-image $TEST_APP dokku/python:missing-tag"
   echo "output: $output"
@@ -50,11 +88,21 @@ teardown() {
   assert_output_contains "Image exists on host, skipping pull"
   assert_output_contains "No changes detected, skipping git commit"
 
+  run /bin/bash -c "dokku apps:locked $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
   run /bin/bash -c "dokku git:from-image --force $TEST_APP linuxserver/foldingathome:7.6.21"
   echo "output: $output"
   echo "status: $status"
   assert_output_contains "Force pulling image"
   assert_output_contains "No changes detected, skipping git commit"
+
+  run /bin/bash -c "dokku apps:locked $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
 }
 
 @test "(git) git:from-image [normal-custom-branch]" {
@@ -141,6 +189,17 @@ teardown() {
   assert_failure
   assert_output "fatal: this operation must be run in a work tree"
 
+  run /bin/bash -c "dokku git:report $TEST_APP --git-source-image"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output ""
+
+  run /bin/bash -c "dokku apps:locked $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
   run /bin/bash -c "dokku config:set --no-restart $TEST_APP FAIL_ON_STARTUP=false"
   echo "output: $output"
   echo "status: $status"
@@ -151,6 +210,12 @@ teardown() {
   echo "status: $status"
   assert_success
 
+  run /bin/bash -c "dokku git:report $TEST_APP --git-source-image"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "dokku-test/$TEST_APP:latest"
+
   run /bin/bash -c "dokku config:set --no-restart $TEST_APP FAIL_ON_STARTUP=true"
   echo "output: $output"
   echo "status: $status"
@@ -161,6 +226,17 @@ teardown() {
   echo "status: $status"
   assert_failure
 
+  run /bin/bash -c "dokku apps:locked $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "dokku git:report $TEST_APP --git-source-image"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "dokku-test/$TEST_APP:latest"
+
   run /bin/bash -c "dokku config:set --no-restart $TEST_APP FAIL_ON_STARTUP=false"
   echo "output: $output"
   echo "status: $status"
@@ -172,6 +248,12 @@ teardown() {
   assert_success
   assert_output_contains "No changes detected, skipping git commit" 0
 
+  run /bin/bash -c "dokku git:report $TEST_APP --git-source-image"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "dokku-test/$TEST_APP:v2"
+
   run /bin/bash -c "docker image rm dokku-test/$TEST_APP:latest dokku-test/$TEST_APP:v2"
   echo "output: $output"
   echo "status: $status"
@@ -249,3 +331,235 @@ EOF
   assert_success
   assert_output_contains "linuxserver/foldingathome:7.6.21"
 }
+
+@test "(git) git:from-image source-image after failed deploy and ps:rebuild" {
+  deploy_second_procfile_image
+
+  run build_python_image default-procfile
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku config:set --no-restart $TEST_APP FAIL_ON_STARTUP=true"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku git:from-image $TEST_APP dokku-test/$TEST_APP:default-procfile"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "dokku git:report $TEST_APP --git-source-image"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "dokku-test/$TEST_APP:second-procfile"
+
+  run /bin/bash -c "dokku config:set --no-restart $TEST_APP FAIL_ON_STARTUP=false"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku git:report $TEST_APP --git-source-image"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "dokku-test/$TEST_APP:second-procfile"
+
+  run /bin/bash -c "dokku plugin:trigger procfile-get-command $TEST_APP web 5001"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "second.Procfile"
+  assert_output_contains "first.Procfile" 0
+}
+
+@test "(git) git:from-image then git:from-archive ignores the previous source-image" {
+  deploy_second_procfile_image
+
+  run /bin/bash -c "dokku config:set --no-restart $TEST_APP FAIL_ON_STARTUP=true"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "tar -C ${BATS_TEST_DIRNAME}/../../tests/apps -cf - python | dokku git:from-archive $TEST_APP --"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "dokku git:report $TEST_APP --git-source-image"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "dokku-test/$TEST_APP:second-procfile"
+
+  run /bin/bash -c "dokku config:set --no-restart $TEST_APP FAIL_ON_STARTUP=false"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "tar -C ${BATS_TEST_DIRNAME}/../../tests/apps -cf - python | dokku git:from-archive $TEST_APP --"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku git:report $TEST_APP --git-source-image"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output ""
+
+  run /bin/bash -c "dokku plugin:trigger procfile-get-command $TEST_APP web 5001"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "first.Procfile"
+  assert_output_contains "second.Procfile" 0
+}
+
+@test "(git) git:from-image then git push ignores the previous source-image" {
+  local TMP=$(mktemp -d "/tmp/${DOKKU_DOMAIN}.XXXXX")
+  trap 'rm -rf "$TMP"' INT TERM
+
+  deploy_second_procfile_image
+
+  rmdir "$TMP" && cp -r "${BATS_TEST_DIRNAME}/../../tests/apps/python" "$TMP"
+  run /bin/bash -c "cd $TMP && git init -q && git checkout -q -b master && git config user.email 'robot@example.com' && git config user.name 'Test Robot' && git add . && git commit -q -m 'initial commit' && git push --force dokku@${DOKKU_DOMAIN}:$TEST_APP master:master"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  rm -rf "$TMP"
+
+  run /bin/bash -c "dokku git:report $TEST_APP --git-source-image"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output ""
+
+  run /bin/bash -c "dokku plugin:trigger procfile-get-command $TEST_APP web 5001"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "first.Procfile"
+  assert_output_contains "second.Procfile" 0
+}
+
+@test "(git) git:from-image then git:sync clears the source-image" {
+  deploy_second_procfile_image
+
+  run /bin/bash -c "dokku git:sync $TEST_APP https://github.com/dokku/smoke-test-app.git 2.0.0"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku git:report $TEST_APP --git-source-image"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output ""
+
+  run /bin/bash -c "dokku git:from-image $TEST_APP dokku-test/$TEST_APP:second-procfile"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku git:report $TEST_APP --git-source-image"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "dokku-test/$TEST_APP:second-procfile"
+
+  run /bin/bash -c "dokku git:sync --build $TEST_APP https://github.com/dokku/smoke-test-app.git 2.0.0"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku git:report $TEST_APP --git-source-image"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output ""
+}
+
+@test "(git) source-image is unchanged when the deploy lock is held" {
+  deploy_second_procfile_image
+
+  run build_python_image default-procfile
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  local DEPLOY_REV
+  DEPLOY_REV="$(deploy_branch_rev)"
+  echo "deploy branch rev: $DEPLOY_REV"
+
+  hold_deploy_lock
+
+  run /bin/bash -c "dokku git:from-image $TEST_APP dokku-test/$TEST_APP:default-procfile"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "currently has a deploy lock in place"
+
+  run /bin/bash -c "dokku git:report $TEST_APP --git-source-image"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "dokku-test/$TEST_APP:second-procfile"
+
+  run deploy_branch_rev
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "$DEPLOY_REV"
+
+  run /bin/bash -c "cat $DEPLOY_LOCK_FILE"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "test-lock-holder"
+
+  run /bin/bash -c "dokku git:sync $TEST_APP https://github.com/dokku/smoke-test-app.git 2.0.0"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "currently has a deploy lock in place"
+
+  run /bin/bash -c "dokku git:report $TEST_APP --git-source-image"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "dokku-test/$TEST_APP:second-procfile"
+
+  run deploy_branch_rev
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "$DEPLOY_REV"
+
+  run /bin/bash -c "cat $DEPLOY_LOCK_FILE"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "test-lock-holder"
+
+  release_deploy_lock
+
+  run /bin/bash -c "dokku git:from-image $TEST_APP dokku-test/$TEST_APP:default-procfile"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "No changes detected, skipping git commit" 0
+
+  run /bin/bash -c "dokku git:report $TEST_APP --git-source-image"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "dokku-test/$TEST_APP:default-procfile"
+}
diff --git a/tests/unit/git_6.bats b/tests/unit/git_6.bats
index 03c81f264..59028d573 100644
--- a/tests/unit/git_6.bats
+++ b/tests/unit/git_6.bats
@@ -154,6 +154,12 @@ teardown() {
   assert_failure
   assert_output "fatal: this operation must be run in a work tree"
 
+  run /bin/bash -c "dokku git:report $TEST_APP --git-source-image"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output ""
+
   run /bin/bash -c "dokku config:set --no-restart $TEST_APP FAIL_ON_STARTUP=false"
   echo "output: $output"
   echo "status: $status"
@@ -164,6 +170,12 @@ teardown() {
   echo "status: $status"
   assert_success
 
+  run /bin/bash -c "dokku git:report $TEST_APP --git-source-image"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "dokku-test/$TEST_APP:latest"
+
   run /bin/bash -c "dokku config:set --no-restart $TEST_APP FAIL_ON_STARTUP=true"
   echo "output: $output"
   echo "status: $status"
@@ -174,6 +186,12 @@ teardown() {
   echo "status: $status"
   assert_failure
 
+  run /bin/bash -c "dokku git:report $TEST_APP --git-source-image"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "dokku-test/$TEST_APP:latest"
+
   run /bin/bash -c "dokku config:set --no-restart $TEST_APP FAIL_ON_STARTUP=false"
   echo "output: $output"
   echo "status: $status"
@@ -184,6 +202,12 @@ teardown() {
   echo "status: $status"
   assert_success
   assert_output_contains "No changes detected, skipping git commit" 0
+
+  run /bin/bash -c "dokku git:report $TEST_APP --git-source-image"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "dokku-test/$TEST_APP:v2"
 }
 
 @test "(git) git:load-image [onbuild]" {
diff --git a/tests/unit/git_8.bats b/tests/unit/git_8.bats
new file mode 100644
index 000000000..ce5bf2c93
--- /dev/null
+++ b/tests/unit/git_8.bats
@@ -0,0 +1,93 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+APP_FILTER_PLUGIN_NAME="app-filter-test"
+
+setup() {
+  global_setup
+  create_app
+}
+
+teardown() {
+  rm -rf "${PLUGIN_ENABLED_PATH:?}/$APP_FILTER_PLUGIN_NAME" "${PLUGIN_AVAILABLE_PATH:?}/$APP_FILTER_PLUGIN_NAME"
+  rm -rf /tmp/hidden-app-clone
+  destroy_app
+  global_teardown
+}
+
+@test "(git) push to filtered app" {
+  run deploy_app
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  setup_app_filter_plugin "$TEST_APP"
+
+  run /bin/bash -c "dokku apps:exists $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "cd /tmp && rm -rf hidden-app-clone && cp -r $BATS_TEST_DIRNAME/../../tests/apps/python hidden-app-clone && cd hidden-app-clone && git init -q && git add . && git -c user.email=robot@example.com -c user.name=Robot commit -qm second && git push -f dokku@$DOKKU_DOMAIN:$TEST_APP HEAD:master"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "App $TEST_APP does not exist"
+  assert_output_not_contains "pre-receive hook declined"
+}
+
+@test "(git) clone of filtered app" {
+  run deploy_app
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  setup_app_filter_plugin "$TEST_APP"
+
+  run /bin/bash -c "git clone dokku@$DOKKU_DOMAIN:$TEST_APP /tmp/hidden-app-clone"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "App $TEST_APP does not exist"
+}
+
+@test "(git) archive of filtered app" {
+  run deploy_app
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  setup_app_filter_plugin "$TEST_APP"
+
+  run /bin/bash -c "set -o pipefail; git archive --remote=dokku@$DOKKU_DOMAIN:$TEST_APP master | tar -t"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "App $TEST_APP does not exist"
+}
+
+setup_app_filter_plugin() {
+  declare desc="installs a plugin that filters out a single app"
+  declare FILTERED_APP="$1"
+  local PLUGIN_DIR="$PLUGIN_AVAILABLE_PATH/$APP_FILTER_PLUGIN_NAME"
+  mkdir -p "$PLUGIN_DIR"
+
+  cat <<EOF >"$PLUGIN_DIR/plugin.toml"
+[plugin]
+description = "test plugin filtering out a single app"
+version = "0.1.0"
+[plugin.config]
+EOF
+
+  cat <<EOF >"$PLUGIN_DIR/user-auth-app"
+#!/usr/bin/env bash
+shift 2
+for app in "\$@"; do
+  [[ "\$app" == "$FILTERED_APP" ]] || echo "\$app"
+done
+EOF
+  chmod +x "$PLUGIN_DIR/user-auth-app"
+
+  dokku plugin:enable "$APP_FILTER_PLUGIN_NAME"
+}
diff --git a/tests/unit/haproxy.bats b/tests/unit/haproxy.bats
index 6edc97db8..e8135f4d4 100644
--- a/tests/unit/haproxy.bats
+++ b/tests/unit/haproxy.bats
@@ -246,6 +246,12 @@ teardown() {
   assert_success
   assert_output "true"
 
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"haproxy.$TEST_APP-web.certbot\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "true"
+
   run /bin/bash -c "dokku ports:report $TEST_APP --ports-map"
   echo "output: $output"
   echo "status: $status"
diff --git a/tests/unit/makefile-arch.bats b/tests/unit/makefile-arch.bats
new file mode 100644
index 000000000..4e26fbf80
--- /dev/null
+++ b/tests/unit/makefile-arch.bats
@@ -0,0 +1,67 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+  REPO_ROOT="$(cd "$BATS_TEST_DIRNAME/../.." && pwd)"
+  HOST_ARCH="$(dpkg --print-architecture)"
+  OTHER_ARCH="amd64"
+  if [[ "$HOST_ARCH" == "amd64" ]]; then
+    OTHER_ARCH="arm64"
+  fi
+}
+
+@test "(makefile) [arch] dependency urls default to the host architecture" {
+  run make -n -C "$REPO_ROOT" docker-image-labeler
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "$(dependency_url docker-image-labeler "$HOST_ARCH")" -1
+}
+
+@test "(makefile) [arch] TARGETARCH overrides the dependency architecture" {
+  run env TARGETARCH="$OTHER_ARCH" make -n -C "$REPO_ROOT" docker-image-labeler
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "$(dependency_url docker-image-labeler "$OTHER_ARCH")" -1
+}
+
+@test "(makefile) [arch] plugin builds default to the host architecture" {
+  run make -B -n -C "$REPO_ROOT" go-build-plugin PLUGIN_NAME=common PLUGIN_MAKE_TARGET=build
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "GOARCH=$HOST_ARCH go build" -1
+  assert_output_contains "GOARCH=$OTHER_ARCH" 0
+}
+
+@test "(makefile) [arch] TARGETARCH sets the plugin build architecture" {
+  run env TARGETARCH="$OTHER_ARCH" make -B -n -C "$REPO_ROOT" go-build-plugin PLUGIN_NAME=common PLUGIN_MAKE_TARGET=build
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "GOARCH=$OTHER_ARCH go build" -1
+  assert_output_contains "GOARCH=$HOST_ARCH" 0
+}
+
+@test "(makefile) [arch] GOARCH overrides the plugin build architecture" {
+  run env GOARCH="$OTHER_ARCH" make -B -n -C "$REPO_ROOT" go-build-plugin PLUGIN_NAME=common PLUGIN_MAKE_TARGET=build
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "GOARCH=$OTHER_ARCH go build" -1
+  assert_output_contains "GOARCH=$HOST_ARCH" 0
+
+  run env GOARCH="$OTHER_ARCH" make -n -C "$REPO_ROOT" docker-image-labeler
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "$(dependency_url docker-image-labeler "$HOST_ARCH")" -1
+}
+
+dependency_url() {
+  declare desc="print the url for a dependency in contrib/dependencies.json"
+  declare NAME="$1" ARCH="$2"
+  jq -r --arg name "$NAME" --arg arch "$ARCH" '.dependencies[] | select(.name == $name) | .urls[$arch]' "$REPO_ROOT/contrib/dependencies.json"
+}
diff --git a/tests/unit/network.bats b/tests/unit/network.bats
index 449eefacc..67c4715c7 100644
--- a/tests/unit/network.bats
+++ b/tests/unit/network.bats
@@ -12,7 +12,9 @@ teardown() {
   destroy_app
   [[ -f "$DOKKU_ROOT/VHOST.bak" ]] && mv "$DOKKU_ROOT/VHOST.bak" "$DOKKU_ROOT/VHOST" && chown dokku:dokku "$DOKKU_ROOT/VHOST"
   docker network rm create-network || true
+  docker network rm create-network-2 || true
   docker network rm deploy-network || true
+  docker network rm deploy-network-2 || true
   docker network rm initial-network || true
   docker network rm "$TEST_NETWORK" || true
   global_teardown
@@ -630,6 +632,37 @@ teardown() {
   assert_success
 }
 
+@test "(network) network:set attach-post-create attaches every network" {
+  for network in create-network create-network-2 deploy-network deploy-network-2; do
+    run /bin/bash -c "dokku network:create $network"
+    echo "output: $output"
+    echo "status: $status"
+    assert_success
+  done
+
+  run /bin/bash -c "dokku network:set $TEST_APP attach-post-create create-network create-network-2"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku network:set $TEST_APP attach-post-deploy deploy-network deploy-network-2"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  for network in create-network create-network-2 deploy-network deploy-network-2; do
+    run /bin/bash -c "docker container inspect --format '{{range \$k, \$v := .NetworkSettings.Networks}}{{println \$k}}{{end}}' $TEST_APP.web.1 | grep -cx $network"
+    echo "output: $output"
+    echo "status: $status"
+    assert_output "1"
+  done
+}
+
 @test "(network) dont re-attach to network" {
   run /bin/bash -c "dokku network:create deploy-network"
   echo "output: $output"
@@ -698,3 +731,16 @@ teardown() {
   assert_output_contains "Attempting pre-flight checks" 0
   assert_output_contains "Application deployed"
 }
+
+@test "(network:rebuild) missing app" {
+  run /bin/bash -c "dokku network:rebuild missing-app"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "App missing-app does not exist"
+
+  run /bin/bash -c "test -e $DOKKU_LIB_ROOT/config/common/missing-app"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+}
diff --git a/tests/unit/nginx-vhosts_12.bats b/tests/unit/nginx-vhosts_12.bats
index 95b6af069..cbaf8c32b 100644
--- a/tests/unit/nginx-vhosts_12.bats
+++ b/tests/unit/nginx-vhosts_12.bats
@@ -129,3 +129,22 @@ teardown() {
 
   docker image rm dokku-test/$TEST_APP:latest dokku-test/$TEST_APP:v2 || true
 }
+
+@test "(nginx-vhosts) deploy removes stale nginx.conf.sigil files" {
+  local DATA_DIR="/var/lib/dokku/data/nginx-vhosts/app-$TEST_APP"
+  mkdir -p "$DATA_DIR"
+  echo "# stale" >"$DATA_DIR/nginx.conf.sigil.99999999"
+  touch "$DATA_DIR/nginx.conf.sigil.99999998.missing"
+  chown -R dokku:dokku "$DATA_DIR"
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "find $DATA_DIR -maxdepth 1 -name 'nginx.conf.sigil.*'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_not_exists
+}
diff --git a/tests/unit/nginx-vhosts_15.bats b/tests/unit/nginx-vhosts_15.bats
index 3de423ca1..1d1e3fb58 100644
--- a/tests/unit/nginx-vhosts_15.bats
+++ b/tests/unit/nginx-vhosts_15.bats
@@ -3,7 +3,10 @@
 load test_helper
 
 NGINX_VALIDATE_PLUGIN_NAME="test-nginx-validate"
+NGINX_VALIDATE_LEGACY_PLUGIN_NAME="test-nginx-validate-legacy"
 NGINX_VALIDATE_ZONE_CONF="/etc/nginx/conf.d/00-dokku-test-limit-req.conf"
+NGINX_VALIDATE_BROKEN_CONF="/etc/nginx/conf.d/00-dokku-test-broken.conf"
+NGINX_VALIDATE_CACHE_DIR="/var/cache/nginx/dokku-test-cache"
 
 setup() {
   global_setup
@@ -12,9 +15,12 @@ setup() {
 }
 
 teardown() {
+  rm -f "$NGINX_VALIDATE_ZONE_CONF" "$NGINX_VALIDATE_BROKEN_CONF"
+  rm -rf "$NGINX_VALIDATE_CACHE_DIR"
   rm -rf "${PLUGIN_ENABLED_PATH:?}/$NGINX_VALIDATE_PLUGIN_NAME" "${PLUGIN_AVAILABLE_PATH:?}/$NGINX_VALIDATE_PLUGIN_NAME"
+  rm -rf "${PLUGIN_ENABLED_PATH:?}/$NGINX_VALIDATE_LEGACY_PLUGIN_NAME" "${PLUGIN_AVAILABLE_PATH:?}/$NGINX_VALIDATE_LEGACY_PLUGIN_NAME"
+  rm -rf "$DOKKU_LIB_ROOT/data/nginx-vhosts/app-$TEST_APP" || true
   destroy_app
-  rm -f "$NGINX_VALIDATE_ZONE_CONF"
   [[ -f "$DOKKU_ROOT/VHOST.bak" ]] && mv "$DOKKU_ROOT/VHOST.bak" "$DOKKU_ROOT/VHOST" && chown dokku:dokku "$DOKKU_ROOT/VHOST"
   global_teardown
 }
@@ -84,6 +90,102 @@ teardown() {
   assert_output_contains "Pre-validating custom nginx.conf.sigil"
 }
 
+@test "(nginx-vhosts) [pre-validate] fn-nginx-vhosts-nginx-user parses the main nginx config" {
+  source "$PLUGIN_AVAILABLE_PATH/nginx-vhosts/internal-functions"
+
+  cat <<'EOF' >"$BATS_TEST_TMPDIR/nginx.conf"
+#user nobody;
+  user   www-data www-data; # workers run as www-data
+userid on;
+EOF
+
+  run fn-nginx-vhosts-nginx-user "$BATS_TEST_TMPDIR/nginx.conf"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output "www-data"
+}
+
+@test "(nginx-vhosts) [pre-validate] fn-nginx-vhosts-nginx-user ignores configs declaring no user" {
+  source "$PLUGIN_AVAILABLE_PATH/nginx-vhosts/internal-functions"
+
+  cat <<'EOF' >"$BATS_TEST_TMPDIR/nginx.conf"
+#user nobody;
+userid on;
+auth_basic_user_file conf/htpasswd;
+EOF
+
+  run fn-nginx-vhosts-nginx-user "$BATS_TEST_TMPDIR/nginx.conf"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output ""
+
+  run fn-nginx-vhosts-nginx-user "$BATS_TEST_TMPDIR/missing.conf"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output ""
+}
+
+@test "(nginx-vhosts) [pre-validate] does not change proxy_cache_path directory ownership" {
+  local NGINX_USER
+  NGINX_USER="$(nginx_host_user)"
+  [[ -n "$NGINX_USER" ]] || skip "host nginx config declares no user directive"
+
+  setup_nginx_cache_dir "$NGINX_USER"
+  nginx_cache_config "$BATS_TEST_TMPDIR/nginx.conf.sigil"
+
+  run_plugin_script nginx-vhosts core-post-extract "$TEST_APP" "$BATS_TEST_TMPDIR"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "Pre-validating custom nginx.conf.sigil"
+
+  run /bin/bash -c "stat -c %U $NGINX_VALIDATE_CACHE_DIR"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output "$NGINX_USER"
+}
+
+@test "(nginx-vhosts) [pre-validate] preserves ownership with a validate-config template predating NGINX_USER" {
+  local NGINX_USER
+  NGINX_USER="$(nginx_host_user)"
+  [[ -n "$NGINX_USER" ]] || skip "host nginx config declares no user directive"
+
+  setup_nginx_validate_legacy_plugin
+  setup_nginx_cache_dir "$NGINX_USER"
+  nginx_cache_config "$BATS_TEST_TMPDIR/nginx.conf.sigil"
+
+  run_plugin_script nginx-vhosts core-post-extract "$TEST_APP" "$BATS_TEST_TMPDIR"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "Pre-validating custom nginx.conf.sigil"
+
+  run /bin/bash -c "stat -c %U $NGINX_VALIDATE_CACHE_DIR"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output "$NGINX_USER"
+}
+
+@test "(nginx-vhosts:validate-config) does not change proxy_cache_path directory ownership" {
+  local NGINX_USER
+  NGINX_USER="$(nginx_host_user)"
+  [[ -n "$NGINX_USER" ]] || skip "host nginx config declares no user directive"
+
+  setup_nginx_cache_dir "$NGINX_USER"
+  nginx_cache_config "$DOKKU_ROOT/$TEST_APP/nginx.conf"
+  echo 'not_a_directive;' >"$NGINX_VALIDATE_BROKEN_CONF"
+
+  run /bin/bash -c "dokku nginx:validate-config $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "stat -c %U $NGINX_VALIDATE_CACHE_DIR"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output "$NGINX_USER"
+}
+
 setup_nginx_validate_plugin() {
   declare desc="installs a plugin that overrides the validate-config nginx template"
   local PLUGIN_DIR="$PLUGIN_AVAILABLE_PATH/$NGINX_VALIDATE_PLUGIN_NAME"
@@ -110,6 +212,7 @@ EOF
   chmod +x "$PLUGIN_DIR/nginx-app-template-source"
 
   cat <<'EOF' >"$PLUGIN_DIR/validate.conf.sigil"
+{{ if $.NGINX_USER }}user {{ $.NGINX_USER }};{{ end }}
 events { worker_connections 768; }
 http {
   access_log off;
@@ -170,3 +273,74 @@ upstream {{ $.APP }}-{{ \$upstream_port }} {
 EOF
   cat "$APP_REPO_DIR/nginx.conf.sigil"
 }
+
+nginx_host_user() {
+  declare desc="returns the user the host nginx runs its workers as"
+
+  awk '{ sub(/#.*/, "") } $1 == "user" && NF >= 2 { value = $2; sub(/;.*$/, "", value); print value; exit }' /etc/nginx/nginx.conf
+}
+
+setup_nginx_cache_dir() {
+  declare desc="creates a proxy_cache_path directory owned by the host nginx user"
+  local NGINX_USER="$1"
+
+  mkdir -p "$NGINX_VALIDATE_CACHE_DIR"
+  chown "$NGINX_USER" "$NGINX_VALIDATE_CACHE_DIR"
+}
+
+nginx_cache_config() {
+  declare desc="writes an nginx config declaring a proxy_cache_path at the test cache directory"
+  local OUTPUT_PATH="$1"
+
+  echo "injecting nginx_cache_config -> $OUTPUT_PATH"
+  cat <<EOF >"$OUTPUT_PATH"
+proxy_cache_path $NGINX_VALIDATE_CACHE_DIR levels=1:2 keys_zone=dokkuvalidatecache:1m max_size=10m inactive=1m use_temp_path=off;
+
+server {
+  listen 127.0.0.1:18999;
+  server_name dokku-validate-cache.test;
+
+  location / {
+    proxy_cache dokkuvalidatecache;
+    proxy_pass http://127.0.0.1:18998;
+  }
+}
+EOF
+}
+
+setup_nginx_validate_legacy_plugin() {
+  declare desc="installs a plugin whose validate-config template predates the NGINX_USER variable"
+  local PLUGIN_DIR="$PLUGIN_AVAILABLE_PATH/$NGINX_VALIDATE_LEGACY_PLUGIN_NAME"
+  mkdir -p "$PLUGIN_DIR"
+
+  cat <<EOF >"$PLUGIN_DIR/plugin.toml"
+[plugin]
+description = "test plugin overriding the validate-config nginx template without a user directive"
+version = "0.1.0"
+[plugin.config]
+EOF
+
+  cat <<'EOF' >"$PLUGIN_DIR/nginx-app-template-source"
+#!/usr/bin/env bash
+
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+
+TEMPLATE_TYPE="$2"
+if [[ "$TEMPLATE_TYPE" == "validate-config" ]]; then
+  echo "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/validate.conf.sigil"
+fi
+EOF
+  chmod +x "$PLUGIN_DIR/nginx-app-template-source"
+
+  cat <<'EOF' >"$PLUGIN_DIR/validate.conf.sigil"
+events { worker_connections 768; }
+http {
+  access_log off;
+  error_log /dev/null;
+  include {{ $.NGINX_CONF }};
+}
+EOF
+
+  dokku plugin:enable "$NGINX_VALIDATE_LEGACY_PLUGIN_NAME"
+}
diff --git a/tests/unit/nginx-vhosts_17.bats b/tests/unit/nginx-vhosts_17.bats
new file mode 100644
index 000000000..0cf044171
--- /dev/null
+++ b/tests/unit/nginx-vhosts_17.bats
@@ -0,0 +1,211 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+  global_setup
+  [[ -f "$DOKKU_ROOT/VHOST" ]] && cp -fp "$DOKKU_ROOT/VHOST" "$DOKKU_ROOT/VHOST.bak"
+  create_app
+}
+
+teardown() {
+  sudo systemctl start coredns-docker >/dev/null 2>&1 || true
+  dokku --quiet nginx:set --global dns-resolver
+  dokku --quiet nginx:set --global dns-zone
+  destroy_app
+  [[ -f "$DOKKU_ROOT/VHOST.bak" ]] && mv "$DOKKU_ROOT/VHOST.bak" "$DOKKU_ROOT/VHOST" && chown dokku:dokku "$DOKKU_ROOT/VHOST"
+  global_teardown
+}
+
+@test "(nginx-vhosts:set) dns-resolver defaults to empty and dns-zone defaults to docker" {
+  run /bin/bash -c "dokku nginx:report $TEST_APP --nginx-computed-dns-resolver"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output ""
+
+  run /bin/bash -c "dokku nginx:report $TEST_APP --nginx-computed-dns-zone"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "docker"
+}
+
+@test "(nginx-vhosts:set) dns-resolver and dns-zone can be overridden globally" {
+  run /bin/bash -c "dokku nginx:set --global dns-resolver 127.0.0.2:5353"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku nginx:set --global dns-zone test"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku nginx:report $TEST_APP --nginx-computed-dns-resolver"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "127.0.0.2:5353"
+
+  run /bin/bash -c "dokku nginx:report $TEST_APP --nginx-computed-dns-zone"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "test"
+}
+
+@test "(nginx-vhosts) generated nginx.conf uses IP-based upstream by default" {
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku nginx:show-config $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_not_contains "resolver "
+  assert_output_not_contains "\$dokku_upstream"
+  assert_output_contains "upstream ${TEST_APP}-"
+}
+
+@test "(nginx-vhosts) generated nginx.conf uses resolver and variable-based proxy_pass when dns-resolver is set" {
+  run /bin/bash -c "dokku nginx:set --global dns-resolver 127.0.0.1:1053"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku nginx:show-config $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "resolver 127.0.0.1:1053 valid=10s ipv6=off"
+  assert_output_contains "set \$dokku_upstream"
+  assert_output_contains "${TEST_APP}.web.docker:"
+  assert_output_contains "proxy_pass http://\$dokku_upstream"
+  assert_output_not_contains "upstream ${TEST_APP}-"
+}
+
+@test "(nginx-vhosts) unsetting dns-resolver reverts to IP-based upstream" {
+  run /bin/bash -c "dokku nginx:set --global dns-resolver 127.0.0.1:1053"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku nginx:show-config $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "resolver 127.0.0.1:1053 valid=10s ipv6=off"
+
+  run /bin/bash -c "dokku nginx:set --global dns-resolver"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku proxy:build-config $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku nginx:show-config $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_not_contains "resolver 127.0.0.1:1053"
+  assert_output_contains "upstream ${TEST_APP}-"
+}
+
+@test "(nginx-vhosts) vendored nginx.conf.sigil renders IP-based upstream regardless of dns-resolver" {
+  run /bin/bash -c "dokku nginx:set --global dns-resolver 127.0.0.1:1053"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP custom_nginx_template
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku nginx:show-config $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_not_contains "resolver 127.0.0.1:1053"
+  assert_output_not_contains "\$dokku_upstream"
+  assert_output_contains "upstream ${TEST_APP}-"
+}
+
+@test "(nginx-vhosts) nginx returns 502 when coredns-docker is stopped" {
+  run /bin/bash -c "dokku nginx:set --global dns-resolver 127.0.0.1:1053"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run sudo systemctl stop coredns-docker
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run curl --connect-to "$TEST_APP.$DOKKU_DOMAIN:80:localhost:80" -kSso /dev/null -w "%{http_code}" -m 10 "http://$TEST_APP.$DOKKU_DOMAIN/"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output "502"
+
+  run sudo systemctl start coredns-docker
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  assert_http_localhost_response http "$TEST_APP.$DOKKU_DOMAIN" 80 / "" 200
+}
+
+@test "(nginx-vhosts) nginx returns 502 when the app container is not running" {
+  run /bin/bash -c "dokku nginx:set --global dns-resolver 127.0.0.1:1053"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  assert_http_localhost_response http "$TEST_APP.$DOKKU_DOMAIN" 80 / "" 200
+
+  run /bin/bash -c "docker container stop $TEST_APP.web.1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku nginx:show-config $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "proxy_pass http://\$dokku_upstream"
+
+  assert_http_localhost_response http "$TEST_APP.$DOKKU_DOMAIN" 80 / "" 502
+
+  run /bin/bash -c "docker container start $TEST_APP.web.1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  assert_http_localhost_response http "$TEST_APP.$DOKKU_DOMAIN" 80 / "" 200
+}
diff --git a/tests/unit/nginx-vhosts_properties.bats b/tests/unit/nginx-vhosts_properties.bats
index 586908eec..fc1a5300a 100644
--- a/tests/unit/nginx-vhosts_properties.bats
+++ b/tests/unit/nginx-vhosts_properties.bats
@@ -103,7 +103,21 @@ assert_nginx_property_set_get() {
 @test "(nginx:report) misc properties raw/global/computed" {
   assert_nginx_property_set_get "disable-custom-config" "false" "true"
   assert_nginx_property_set_get "underscore-in-headers" "on" "off"
+  assert_nginx_property_set_get "proxy-http-version" "2" "1.1"
   assert_nginx_property_set_get "proxy-keepalive" "8" "16"
   assert_nginx_property_set_get "nginx-conf-sigil-path" "custom.sigil" "global.sigil"
   assert_nginx_property_set_get "nginx-service-command" "/usr/sbin/nginx-app" "/usr/sbin/nginx-global"
 }
+
+@test "(nginx:set) missing app" {
+  run /bin/bash -c "dokku nginx:set missing-app hsts false"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "App missing-app does not exist"
+
+  run /bin/bash -c "test -e $DOKKU_LIB_ROOT/config/nginx/missing-app"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+}
diff --git a/tests/unit/openresty-includes.bats b/tests/unit/openresty-includes.bats
new file mode 100644
index 000000000..ab3e056ad
--- /dev/null
+++ b/tests/unit/openresty-includes.bats
@@ -0,0 +1,136 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+  global_setup
+  dokku nginx:stop
+  dokku openresty:set --global letsencrypt-server https://acme-staging-v02.api.letsencrypt.org/directory
+  dokku openresty:set --global letsencrypt-email
+  dokku openresty:start
+  create_app
+}
+
+teardown() {
+  global_teardown
+  destroy_app
+  dokku openresty:stop
+  dokku nginx:start
+}
+
+@test "(openresty) includes persist across ps:restart" {
+  run /bin/bash -c "dokku proxy:set $TEST_APP openresty"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP add_openresty_include
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"openresty.include-http-example.conf\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "IyBmb3JjZSB0aGUgY2hhcmFjdGVyIHNldCB0byB1dGYtOApjaGFyc2V0IFVURi04Owo="
+
+  run /bin/bash -c "dokku ps:restart $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"openresty.include-http-example.conf\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "IyBmb3JjZSB0aGUgY2hhcmFjdGVyIHNldCB0byB1dGYtOApjaGFyc2V0IFVURi04Owo="
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"openresty.include-location-http-example.conf\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "IyBsb2NhdGlvbi1ibG9jawo="
+}
+
+@test "(openresty) includes are removed when deleted from the repo" {
+  local DATA_DIR="/var/lib/dokku/data/openresty-vhosts/app-$TEST_APP"
+  local CUSTOM_TMP=$(mktemp -d "/tmp/${DOKKU_DOMAIN}.XXXXX")
+  trap 'popd &>/dev/null || true; rm -rf "$CUSTOM_TMP"' INT TERM
+
+  run /bin/bash -c "dokku proxy:set $TEST_APP openresty"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  CUSTOM_TMP="$CUSTOM_TMP" run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP add_openresty_include
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run git -C "$CUSTOM_TMP" rm -r openresty
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run git -C "$CUSTOM_TMP" commit -m 'Remove openresty includes'
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run git -C "$CUSTOM_TMP" push target master:master
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"openresty.include-http-example.conf\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_not_exists
+
+  run /bin/bash -c "find $DATA_DIR -maxdepth 1 -name 'openresty-*-includes*'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_not_exists
+
+  rm -rf "$CUSTOM_TMP"
+}
+
+@test "(openresty) deploy removes stale include markers and directories" {
+  local DATA_DIR="/var/lib/dokku/data/openresty-vhosts/app-$TEST_APP"
+  mkdir -p "$DATA_DIR/openresty-http-includes.99999999" "$DATA_DIR/openresty-location-includes.99999999"
+  echo "charset UTF-8;" >"$DATA_DIR/openresty-http-includes.99999999/example.conf"
+  echo "# location-block" >"$DATA_DIR/openresty-location-includes.99999999/example.conf"
+  touch "$DATA_DIR/openresty-http-includes.99999998.missing" "$DATA_DIR/openresty-location-includes.99999998.missing"
+  chown -R dokku:dokku "$DATA_DIR"
+
+  run /bin/bash -c "dokku proxy:set $TEST_APP openresty"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "find $DATA_DIR -maxdepth 1 -name 'openresty-*-includes*'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_not_exists
+}
+
+add_openresty_include() {
+  local APP="$1"
+  local APP_REPO_DIR="$2"
+  [[ -z "$APP" ]] && local APP="$TEST_APP"
+  mkdir -p "$APP_REPO_DIR/openresty/http-includes"
+  echo "# force the character set to utf-8" >>"$APP_REPO_DIR/openresty/http-includes/example.conf"
+  echo "charset UTF-8;" >>"$APP_REPO_DIR/openresty/http-includes/example.conf"
+
+  mkdir -p "$APP_REPO_DIR/openresty/http-location-includes"
+  echo "# location-block" >>"$APP_REPO_DIR/openresty/http-location-includes/example.conf"
+}
diff --git a/tests/unit/openresty-vhosts.bats b/tests/unit/openresty-vhosts.bats
index 916edcf8a..e82ec5fa3 100644
--- a/tests/unit/openresty-vhosts.bats
+++ b/tests/unit/openresty-vhosts.bats
@@ -82,3 +82,16 @@ teardown() {
   assert_success
   assert_output "5m"
 }
+
+@test "(openresty:set) missing app" {
+  run /bin/bash -c "dokku openresty:set missing-app client-max-body-size 5m"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "App missing-app does not exist"
+
+  run /bin/bash -c "test -e $DOKKU_LIB_ROOT/config/openresty/missing-app"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+}
diff --git a/tests/unit/openresty.bats b/tests/unit/openresty.bats
index 6751438ff..eee7e9e08 100644
--- a/tests/unit/openresty.bats
+++ b/tests/unit/openresty.bats
@@ -760,6 +760,175 @@ teardown() {
   assert_output_not_exists
 }
 
+@test "(openresty) healthcheck labels from app.json" {
+  run /bin/bash -c "dokku proxy:set $TEST_APP openresty"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP setup_openresty_readiness_healthcheck
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"openresty.upstream-max-fails\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "1"
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"openresty.upstream-fail-timeout\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "2s"
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"openresty.proxy-next-upstream-timeout\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "5s"
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"openresty.healthcheck-path\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "/"
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"openresty.healthcheck-interval\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "2"
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"openresty.healthcheck-timeout\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "5"
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"openresty.healthcheck-fall\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "3"
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"openresty.healthcheck-host\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "$TEST_APP.dokku.me"
+
+  run /bin/bash -c "docker exec openresty-openresty-1 /usr/local/openresty/nginx/sbin/nginx -t"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "docker exec openresty-openresty-1 cat /etc/nginx/sites-enabled/sites.conf"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "max_fails=1 fail_timeout=2s;"
+  assert_output_contains "proxy_next_upstream_timeout 5s;"
+
+  sleep 5
+
+  run /bin/bash -c "docker exec openresty-openresty-1 wget -qO- http://127.0.0.1:8999/upstream-healthcheck-status"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "Upstream $TEST_APP-web-5000"
+  assert_output_contains " UP"
+  assert_output_contains "(NO checkers)" 0
+
+  assert_http_localhost_response "http" "$TEST_APP.dokku.me" "80" "" "python/http.server"
+}
+
+@test "(openresty) no healthcheck labels without readiness check" {
+  run /bin/bash -c "dokku proxy:set $TEST_APP openresty"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP convert_to_dockerfile
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"openresty.upstream-max-fails\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_not_exists
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"openresty.proxy-next-upstream-timeout\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_not_exists
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"openresty.healthcheck-path\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_not_exists
+}
+
+@test "(openresty) healthcheck headers from app.json" {
+  run /bin/bash -c "dokku proxy:set $TEST_APP openresty"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP setup_openresty_readiness_healthcheck_headers
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"openresty.healthcheck-header.X-Check\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "dokku"
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"openresty.healthcheck-host\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "check.dokku.me"
+
+  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"openresty.healthcheck-header.Host\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_not_exists
+
+  assert_http_localhost_response "http" "$TEST_APP.dokku.me" "80" "" "python/http.server"
+}
+
+@test "(openresty) invalid stored healthcheck path fails restart" {
+  run /bin/bash -c "dokku proxy:set $TEST_APP openresty"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP setup_openresty_readiness_healthcheck
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "jq '.healthchecks.web[0].path = \"/health check\"' /var/lib/dokku/data/app-json/$TEST_APP/app.json > /var/lib/dokku/data/app-json/$TEST_APP/app.json.tmp && mv /var/lib/dokku/data/app-json/$TEST_APP/app.json.tmp /var/lib/dokku/data/app-json/$TEST_APP/app.json"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:restart $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Invalid app.json healthcheck path for openresty" -1
+}
+
 add_openresty_include() {
   local APP="$1"
   local APP_REPO_DIR="$2"
@@ -786,3 +955,23 @@ add_openresty_include_unsafe() {
   mkdir -p "$APP_REPO_DIR/openresty/http-location-includes"
   printf '# location\n' >"$APP_REPO_DIR/openresty/http-location-includes/unsafe filename.conf"
 }
+
+setup_openresty_readiness_healthcheck() {
+  local APP="$1"
+  local APP_REPO_DIR="$2"
+  [[ -z "$APP" ]] && local APP="$TEST_APP"
+  APP_REPO_DIR="$(realpath "$APP_REPO_DIR")"
+
+  convert_to_dockerfile "$APP" "$APP_REPO_DIR"
+  mv "$APP_REPO_DIR/app-readiness.json" "$APP_REPO_DIR/app.json"
+}
+
+setup_openresty_readiness_healthcheck_headers() {
+  local APP="$1"
+  local APP_REPO_DIR="$2"
+  [[ -z "$APP" ]] && local APP="$TEST_APP"
+  APP_REPO_DIR="$(realpath "$APP_REPO_DIR")"
+
+  convert_to_dockerfile "$APP" "$APP_REPO_DIR"
+  jq '.healthchecks.web[0].httpHeaders = [{"name": "X-Check", "value": "dokku"}, {"name": "Host", "value": "check.dokku.me"}]' "$APP_REPO_DIR/app-readiness.json" >"$APP_REPO_DIR/app.json"
+}
diff --git a/tests/unit/plugin.bats b/tests/unit/plugin.bats
index c4037754e..2698bd38e 100644
--- a/tests/unit/plugin.bats
+++ b/tests/unit/plugin.bats
@@ -9,9 +9,16 @@ setup() {
 
 teardown() {
   remove_test_plugin || true
+  restore_enter_plugin
   global_teardown
 }
 
+restore_enter_plugin() {
+  declare desc="re-enables the enter core plugin if a test left it disabled"
+  [[ -e "$PLUGIN_CORE_PATH/enabled/enter" ]] || PLUGIN_PATH="$PLUGIN_CORE_PATH" plugn enable enter || true
+  [[ -e "$PLUGIN_ENABLED_PATH/enter" ]] || PLUGIN_PATH="$PLUGIN_PATH" plugn enable enter || true
+}
+
 @test "(plugin) plugin:help" {
   run /bin/bash -c "dokku plugin"
   echo "output: $output"
@@ -116,7 +123,7 @@ teardown() {
   echo "status: $status"
   assert_success
 
-  run /bin/bash -c "sudo -E -u nobody dokku plugin:uninstall $TEST_PLUGIN_NAME"
+  run /bin/bash -c "sudo -u nobody dokku plugin:uninstall $TEST_PLUGIN_NAME"
   echo "output: $output"
   echo "status: $status"
   assert_failure
@@ -158,7 +165,7 @@ teardown() {
   echo "status: $status"
   assert_success
 
-  run /bin/bash -c "sudo -E -u nobody dokku plugin:uninstall $TEST_PLUGIN_NAME"
+  run /bin/bash -c "sudo -u nobody dokku plugin:uninstall $TEST_PLUGIN_NAME"
   echo "output: $output"
   echo "status: $status"
   assert_failure
@@ -212,7 +219,7 @@ teardown() {
 }
 
 @test "(plugin) plugin:install, plugin:disable, plugin:uninstall as non-root user failure" {
-  run /bin/bash -c "sudo -E -u nobody dokku plugin:install $TEST_PLUGIN_GIT_REPO"
+  run /bin/bash -c "sudo -u nobody dokku plugin:install $TEST_PLUGIN_GIT_REPO"
   echo "output: $output"
   echo "status: $status"
   assert_failure
@@ -227,7 +234,7 @@ teardown() {
   echo "status: $status"
   assert_success
 
-  run /bin/bash -c "sudo -E -u nobody dokku plugin:disable $TEST_PLUGIN_NAME"
+  run /bin/bash -c "sudo -u nobody dokku plugin:disable $TEST_PLUGIN_NAME"
   echo "output: $output"
   echo "status: $status"
   assert_failure
@@ -372,3 +379,40 @@ teardown() {
   assert_output_contains "root" "0"
   assert_output_contains "dokku" "3"
 }
+
+@test "(plugin:trigger) forwards the caller environment across the privilege drop" {
+  run /bin/bash -c "DOKKU_TEST_CROSSING=1 DOKKU_TRACE=1 dokku plugin:trigger app-list 2>&1 >/dev/null | grep -q -- '--preserve-env=[^ ]*DOKKU_TEST_CROSSING'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+}
+
+@test "(plugin:enable) core plugin skipped at install" {
+  run /bin/bash -c "rm $PLUGIN_ENABLED_PATH/enter $PLUGIN_CORE_PATH/enabled/enter"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku plugin:list --format json | jq -r '.[] | select(.name == \"enter\") | .enabled'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "false"
+
+  run /bin/bash -c "dokku plugin:enable enter"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "Plugin enter enabled"
+
+  run /bin/bash -c "dokku plugin:list --format json | jq -r '.[] | select(.name == \"enter\") | .enabled'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "true"
+
+  run /bin/bash -c "test -L $PLUGIN_CORE_PATH/enabled/enter"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+}
diff --git a/tests/unit/ports.bats b/tests/unit/ports.bats
index e09440b60..761e65fe7 100644
--- a/tests/unit/ports.bats
+++ b/tests/unit/ports.bats
@@ -7,19 +7,19 @@ setup() {
   [[ -f "$DOKKU_ROOT/VHOST" ]] && cp -fp "$DOKKU_ROOT/VHOST" "$DOKKU_ROOT/VHOST.bak"
   create_app
 
-  dokku --force postgres:destroy $TEST_APP 2>/dev/null || true
-  dokku --force redis:destroy $TEST_APP 2>/dev/null || true
-  dokku --force postgres:destroy $TEST_APP-other 2>/dev/null || true
-  dokku --force redis:destroy $TEST_APP-other 2>/dev/null || true
+  dokku postgres:destroy $TEST_APP --force 2>/dev/null || true
+  dokku redis:destroy $TEST_APP --force 2>/dev/null || true
+  dokku postgres:destroy $TEST_APP-other --force 2>/dev/null || true
+  dokku redis:destroy $TEST_APP-other --force 2>/dev/null || true
 }
 
 teardown() {
   destroy_app
 
-  dokku --force postgres:destroy $TEST_APP 2>/dev/null || true
-  dokku --force redis:destroy $TEST_APP 2>/dev/null || true
-  dokku --force postgres:destroy $TEST_APP-other 2>/dev/null || true
-  dokku --force redis:destroy $TEST_APP-other 2>/dev/null || true
+  dokku postgres:destroy $TEST_APP --force 2>/dev/null || true
+  dokku redis:destroy $TEST_APP --force 2>/dev/null || true
+  dokku postgres:destroy $TEST_APP-other --force 2>/dev/null || true
+  dokku redis:destroy $TEST_APP-other --force 2>/dev/null || true
 
   [[ -f "$DOKKU_ROOT/VHOST.bak" ]] && mv "$DOKKU_ROOT/VHOST.bak" "$DOKKU_ROOT/VHOST" && chown dokku:dokku "$DOKKU_ROOT/VHOST"
   global_teardown
@@ -274,7 +274,7 @@ teardown() {
   echo "status: $status"
   assert_success
 
-  run /bin/bash -c "dokku postgres:create $TEST_APP $TEST_APP"
+  run /bin/bash -c "dokku postgres:create $TEST_APP"
   echo "output: $output"
   echo "status: $status"
   assert_success
@@ -284,7 +284,7 @@ teardown() {
   echo "status: $status"
   assert_success
 
-  run /bin/bash -c "dokku redis:create $TEST_APP $TEST_APP"
+  run /bin/bash -c "dokku redis:create $TEST_APP"
   echo "output: $output"
   echo "status: $status"
   assert_success
@@ -415,3 +415,26 @@ teardown() {
   assert_success
   assert_output "true"
 }
+
+@test "(ports:add) concurrent calls for the same app keep every port mapping" {
+  run run_concurrently 20 /bin/bash -c 'dokku ports:add "$1" "http:$((8000 + $2)):5000"' _ "$TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku --quiet ports:report $TEST_APP --ports-map | tr ' ' '\n' | grep -cx 'http:80[0-9][0-9]:5000'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "20"
+
+  run run_concurrently 20 /bin/bash -c 'dokku ports:remove "$1" "http:$((8000 + $2)):5000"' _ "$TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku --quiet ports:report $TEST_APP --ports-map | tr ' ' '\n' | grep -cx 'http:80[0-9][0-9]:5000'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output "0"
+}
diff --git a/tests/unit/proxy-route-caddy.bats b/tests/unit/proxy-route-caddy.bats
new file mode 100644
index 000000000..ee2db14de
--- /dev/null
+++ b/tests/unit/proxy-route-caddy.bats
@@ -0,0 +1,147 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+  global_setup
+  dokku nginx:stop
+  dokku caddy:start
+  create_app
+  dokku proxy:set "$TEST_APP" caddy
+}
+
+teardown() {
+  dokku proxy:route:clear "$TEST_APP" >/dev/null 2>&1 || true
+  destroy_app
+  dokku caddy:stop
+  dokku nginx:start
+  global_teardown
+}
+
+@test "(proxy-route:caddy) basic routing - /api/v0 hits api, / hits web" {
+  run deploy_app python "dokku@$DOKKU_DOMAIN:$TEST_APP" add_api_process_callback
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:scale $TEST_APP web=1 api=1"
+  assert_success
+
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Give the daemon a moment to read the new labels.
+  sleep 5
+
+  # Without --strip-prefix, /api/v0/Procfile reaches api as /api/v0/Procfile
+  # which python's http.server returns 404 for. A 404 here proves the route
+  # reaches api - web's catch-all would have returned 200.
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "" "404"
+}
+
+@test "(proxy-route:caddy) --strip-prefix toggles upstream path visibility" {
+  run deploy_app python "dokku@$DOKKU_DOMAIN:$TEST_APP" add_api_process_callback
+  assert_success
+
+  run /bin/bash -c "dokku ps:scale $TEST_APP web=1 api=1"
+  assert_success
+
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001"
+  assert_success
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Give the daemon a moment to read the new labels.
+  sleep 5
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "" "404"
+
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001 --strip-prefix"
+  assert_success
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Give the daemon a moment to read the new labels.
+  sleep 5
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "python3 -m http.server"
+}
+
+@test "(proxy-route:caddy) removing a route falls back to web" {
+  run deploy_app python "dokku@$DOKKU_DOMAIN:$TEST_APP" add_api_process_callback
+  assert_success
+
+  run /bin/bash -c "dokku ps:scale $TEST_APP web=1 api=1"
+  assert_success
+
+  # Set without --strip-prefix first; 404 proves the labels attached.
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001"
+  assert_success
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Give the daemon a moment to read the new labels.
+  sleep 5
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "" "404"
+
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001 --strip-prefix"
+  assert_success
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Give the daemon a moment to read the new labels.
+  sleep 5
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "python3 -m http.server"
+
+  run /bin/bash -c "dokku proxy:route:remove $TEST_APP /api/v0"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku proxy:route:report $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "(none)"
+
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Give the daemon a moment to read the new labels.
+  sleep 5
+
+  # Poll the response body via file to avoid shell-quoting issues with JSON
+  # bodies that contain embedded double quotes.
+  rm -f /tmp/route-removed-body
+  local attempt=0
+  for attempt in $(seq 1 30); do
+    curl --connect-to "${TEST_APP}.${DOKKU_DOMAIN}:80:localhost:80" -kSso /tmp/route-removed-body "http://${TEST_APP}.${DOKKU_DOMAIN}:80/api/v0/Procfile" || true
+    if ! grep -q 'python3 -m http.server' /tmp/route-removed-body 2>/dev/null; then
+      break
+    fi
+    sleep 1
+  done
+  run /bin/bash -c "grep -c 'python3 -m http.server' /tmp/route-removed-body || true"
+  assert_output "0"
+}
+
+add_api_process_callback() {
+  local APP="$1"
+  local APP_REPO_DIR="$2"
+  echo "api: python3 -m http.server 5001" >>"$APP_REPO_DIR/Procfile"
+}
diff --git a/tests/unit/proxy-route-k3s-nginx.bats b/tests/unit/proxy-route-k3s-nginx.bats
new file mode 100644
index 000000000..c09389166
--- /dev/null
+++ b/tests/unit/proxy-route-k3s-nginx.bats
@@ -0,0 +1,163 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+TEST_APP="rdmtestapp"
+
+setup() {
+  uninstall_k3s || true
+  global_setup
+  dokku nginx:stop
+  export KUBECONFIG="/etc/rancher/k3s/k3s.yaml"
+}
+
+teardown() {
+  global_teardown
+  dokku nginx:start
+  uninstall_k3s || true
+}
+
+@test "(proxy-route:k3s-nginx) basic routing - /api/v0 hits api, / hits web" {
+  if [[ -z "$DOCKERHUB_USERNAME" ]] || [[ -z "$DOCKERHUB_TOKEN" ]]; then
+    skip "skipping due to missing docker.io credentials DOCKERHUB_USERNAME:DOCKERHUB_TOKEN"
+  fi
+
+  INGRESS_CLASS=nginx install_k3s
+
+  run /bin/bash -c "dokku apps:create $TEST_APP"
+  assert_success
+
+  run deploy_app python "dokku@$DOKKU_DOMAIN:$TEST_APP" add_api_process_callback
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:scale $TEST_APP web=1 api=1"
+  assert_success
+
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # scheduler-k3s does not yet have a proxy-build-config trigger handler, so
+  # proxy:route:set does not re-render the chart. ps:rebuild forces a redeploy
+  # which renders the chart with current routes. Runtime gap tracked as a
+  # follow-up; the test fix unblocks CI.
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Without --strip-prefix, /api/v0/Procfile reaches api as /api/v0/Procfile
+  # which python's http.server returns 404 for. 404 proves the route reaches
+  # api (web's catch-all would have returned 200).
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "" "404"
+}
+
+@test "(proxy-route:k3s-nginx) --strip-prefix renders rewrite-target Ingress and strips upstream path" {
+  if [[ -z "$DOCKERHUB_USERNAME" ]] || [[ -z "$DOCKERHUB_TOKEN" ]]; then
+    skip "skipping due to missing docker.io credentials DOCKERHUB_USERNAME:DOCKERHUB_TOKEN"
+  fi
+
+  INGRESS_CLASS=nginx install_k3s
+
+  run /bin/bash -c "dokku apps:create $TEST_APP"
+  assert_success
+
+  run deploy_app python "dokku@$DOKKU_DOMAIN:$TEST_APP" add_api_process_callback
+  assert_success
+
+  run /bin/bash -c "dokku ps:scale $TEST_APP web=1 api=1"
+  assert_success
+
+  # Set without strip first; the 404 proves the route reached api before we
+  # assert the strip-prefix HTTP behavior.
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001"
+  assert_success
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  assert_success
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "" "404"
+
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001 --strip-prefix"
+  assert_success
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  assert_success
+
+  # The chart should emit an additional Ingress carrying the rewrite-target
+  # annotation when --strip-prefix is set.
+  run /bin/bash -c "kubectl get ingress -o json | jq -r '.items[].metadata.annotations | select(.[\"nginx.ingress.kubernetes.io/rewrite-target\"] != null) | .[\"nginx.ingress.kubernetes.io/rewrite-target\"]'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "/\$2"
+
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "python3 -m http.server"
+}
+
+@test "(proxy-route:k3s-nginx) removing a route drops the extra Ingress paths" {
+  if [[ -z "$DOCKERHUB_USERNAME" ]] || [[ -z "$DOCKERHUB_TOKEN" ]]; then
+    skip "skipping due to missing docker.io credentials DOCKERHUB_USERNAME:DOCKERHUB_TOKEN"
+  fi
+
+  INGRESS_CLASS=nginx install_k3s
+
+  run /bin/bash -c "dokku apps:create $TEST_APP"
+  assert_success
+
+  run deploy_app python "dokku@$DOKKU_DOMAIN:$TEST_APP" add_api_process_callback
+  assert_success
+
+  run /bin/bash -c "dokku ps:scale $TEST_APP web=1 api=1"
+  assert_success
+
+  # Verify the route reaches api first (404 proves routing) before checking
+  # that strip applied (200 with Procfile content). scheduler-k3s does not
+  # yet have a proxy-build-config trigger, so ps:rebuild forces a chart
+  # re-render after each proxy:route mutation.
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001"
+  assert_success
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  assert_success
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "" "404"
+
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001 --strip-prefix"
+  assert_success
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  assert_success
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "python3 -m http.server"
+
+  run /bin/bash -c "dokku proxy:route:remove $TEST_APP /api/v0"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  assert_success
+
+  # Confirm storage was cleared before checking cluster state.
+  run /bin/bash -c "dokku proxy:route:report $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "(none)"
+
+  # The rewrite-target Ingress should be gone after removal. Retry briefly
+  # in case the chart re-render hasn't settled.
+  local count="1"
+  for attempt in $(seq 1 30); do
+    run /bin/bash -c "kubectl get ingress -o json | jq -r '[.items[] | select(.metadata.annotations[\"nginx.ingress.kubernetes.io/rewrite-target\"] != null)] | length'"
+    count="$output"
+    if [[ "$count" == "0" ]]; then
+      break
+    fi
+    sleep 1
+  done
+  echo "final ingress count after $attempt attempts: $count"
+  assert_equal "$count" "0"
+}
+
+add_api_process_callback() {
+  local APP="$1"
+  local APP_REPO_DIR="$2"
+  echo "api: python3 -m http.server 5001" >>"$APP_REPO_DIR/Procfile"
+}
diff --git a/tests/unit/proxy-route-k3s-traefik.bats b/tests/unit/proxy-route-k3s-traefik.bats
new file mode 100644
index 000000000..89dbae262
--- /dev/null
+++ b/tests/unit/proxy-route-k3s-traefik.bats
@@ -0,0 +1,163 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+TEST_APP="rdmtestapp"
+
+setup() {
+  uninstall_k3s || true
+  global_setup
+  dokku nginx:stop
+  export KUBECONFIG="/etc/rancher/k3s/k3s.yaml"
+}
+
+teardown() {
+  global_teardown
+  dokku nginx:start
+  uninstall_k3s || true
+}
+
+@test "(proxy-route:k3s-traefik) basic routing - /api/v0 hits api, / hits web" {
+  if [[ -z "$DOCKERHUB_USERNAME" ]] || [[ -z "$DOCKERHUB_TOKEN" ]]; then
+    skip "skipping due to missing docker.io credentials DOCKERHUB_USERNAME:DOCKERHUB_TOKEN"
+  fi
+
+  INGRESS_CLASS=traefik install_k3s
+
+  run /bin/bash -c "dokku apps:create $TEST_APP"
+  assert_success
+
+  run deploy_app python "dokku@$DOKKU_DOMAIN:$TEST_APP" add_api_process_callback
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:scale $TEST_APP web=1 api=1"
+  assert_success
+
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # scheduler-k3s does not yet have a proxy-build-config trigger handler, so
+  # proxy:route:set does not re-render the chart. ps:rebuild forces a redeploy
+  # which renders the chart with current routes. Runtime gap tracked as a
+  # follow-up; the test fix unblocks CI.
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Without --strip-prefix, /api/v0/Procfile reaches api as /api/v0/Procfile
+  # which python's http.server returns 404 for. 404 proves the route reaches
+  # api (web's catch-all would have returned 200).
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "" "404"
+}
+
+@test "(proxy-route:k3s-traefik) --strip-prefix renders stripPrefix Middleware and strips upstream path" {
+  if [[ -z "$DOCKERHUB_USERNAME" ]] || [[ -z "$DOCKERHUB_TOKEN" ]]; then
+    skip "skipping due to missing docker.io credentials DOCKERHUB_USERNAME:DOCKERHUB_TOKEN"
+  fi
+
+  INGRESS_CLASS=traefik install_k3s
+
+  run /bin/bash -c "dokku apps:create $TEST_APP"
+  assert_success
+
+  run deploy_app python "dokku@$DOKKU_DOMAIN:$TEST_APP" add_api_process_callback
+  assert_success
+
+  run /bin/bash -c "dokku ps:scale $TEST_APP web=1 api=1"
+  assert_success
+
+  # Set without strip first; the 404 proves the route reached api before we
+  # assert the strip-prefix HTTP behavior. ps:rebuild after each mutation
+  # forces a chart re-render (k3s has no proxy-build-config trigger yet).
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001"
+  assert_success
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  assert_success
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "" "404"
+
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001 --strip-prefix"
+  assert_success
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  assert_success
+
+  # The chart should emit a StripPrefix Middleware CRD when --strip-prefix
+  # is set.
+  run /bin/bash -c "kubectl get middleware.traefik.io -o json | jq -r '.items[].spec.stripPrefix.prefixes[]?' | head -1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "/api/v0"
+
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "python3 -m http.server"
+}
+
+@test "(proxy-route:k3s-traefik) removing a route drops the stripPrefix Middleware" {
+  if [[ -z "$DOCKERHUB_USERNAME" ]] || [[ -z "$DOCKERHUB_TOKEN" ]]; then
+    skip "skipping due to missing docker.io credentials DOCKERHUB_USERNAME:DOCKERHUB_TOKEN"
+  fi
+
+  INGRESS_CLASS=traefik install_k3s
+
+  run /bin/bash -c "dokku apps:create $TEST_APP"
+  assert_success
+
+  run deploy_app python "dokku@$DOKKU_DOMAIN:$TEST_APP" add_api_process_callback
+  assert_success
+
+  run /bin/bash -c "dokku ps:scale $TEST_APP web=1 api=1"
+  assert_success
+
+  # Verify the route reaches api first (404 proves routing) before checking
+  # that strip applied (200 with Procfile content). ps:rebuild after each
+  # mutation forces a chart re-render (k3s has no proxy-build-config yet).
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001"
+  assert_success
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  assert_success
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "" "404"
+
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001 --strip-prefix"
+  assert_success
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  assert_success
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "python3 -m http.server"
+
+  run /bin/bash -c "dokku proxy:route:remove $TEST_APP /api/v0"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  assert_success
+
+  # Confirm storage was cleared before checking cluster state.
+  run /bin/bash -c "dokku proxy:route:report $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "(none)"
+
+  # The stripPrefix Middleware should be gone after removal. Retry briefly
+  # in case the chart re-render hasn't settled.
+  local count="1"
+  for attempt in $(seq 1 30); do
+    run /bin/bash -c "kubectl get middleware.traefik.io -o json | jq -r '[.items[] | select(.spec.stripPrefix != null)] | length'"
+    count="$output"
+    if [[ "$count" == "0" ]]; then
+      break
+    fi
+    sleep 1
+  done
+  echo "final middleware count after $attempt attempts: $count"
+  assert_equal "$count" "0"
+}
+
+add_api_process_callback() {
+  local APP="$1"
+  local APP_REPO_DIR="$2"
+  echo "api: python3 -m http.server 5001" >>"$APP_REPO_DIR/Procfile"
+}
diff --git a/tests/unit/proxy-route-nginx.bats b/tests/unit/proxy-route-nginx.bats
new file mode 100644
index 000000000..8cf993301
--- /dev/null
+++ b/tests/unit/proxy-route-nginx.bats
@@ -0,0 +1,145 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+  global_setup
+  create_app
+}
+
+teardown() {
+  dokku proxy:route:clear "$TEST_APP" >/dev/null 2>&1 || true
+  destroy_app
+  global_teardown
+}
+
+@test "(proxy-route:nginx) basic routing - /api/v0 hits api, / hits web" {
+  run deploy_app python "dokku@$DOKKU_DOMAIN:$TEST_APP" add_api_process_callback
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:scale $TEST_APP web=1 api=1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Without --strip-prefix, /api/v0/Procfile reaches api as /api/v0/Procfile.
+  # api (python's http.server) does not have that file on disk and returns
+  # 404. A 404 here proves the route reaches api - web's catch-all would
+  # have returned 200 instead.
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "" "404"
+}
+
+@test "(proxy-route:nginx) --strip-prefix toggles upstream path visibility" {
+  run deploy_app python "dokku@$DOKKU_DOMAIN:$TEST_APP" add_api_process_callback
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:scale $TEST_APP web=1 api=1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Without --strip-prefix, /api/v0/Procfile is forwarded as-is to api,
+  # which does not have an /api/v0/Procfile file on disk.
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001"
+  assert_success
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "" "404"
+
+  # With --strip-prefix, /api/v0/Procfile becomes /Procfile upstream and api
+  # returns the Procfile content.
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001 --strip-prefix"
+  assert_success
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "python3 -m http.server"
+}
+
+@test "(proxy-route:nginx) removing a route falls back to web" {
+  run deploy_app python "dokku@$DOKKU_DOMAIN:$TEST_APP" add_api_process_callback
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:scale $TEST_APP web=1 api=1"
+  assert_success
+
+  # First set the route without --strip-prefix so a 404 from api uniquely
+  # identifies that the route reached api (avoids racing with web's catch-all
+  # 200 during the brief window before nginx fully reloads).
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001"
+  assert_success
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "" "404"
+
+  # Now switch the route to --strip-prefix and assert api serves the Procfile.
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001 --strip-prefix"
+  assert_success
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "python3 -m http.server"
+
+  run /bin/bash -c "dokku proxy:route:remove $TEST_APP /api/v0"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Confirm storage was actually mutated; a CommandRouteRemove that returns
+  # changed=false silently skips BuildConfig and leaves nginx with the old
+  # route block.
+  run /bin/bash -c "dokku proxy:route:report $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "(none)"
+
+  # nginx reload races with the curl after route removal: both api and web
+  # return 200 for /api/v0/Procfile so the polling loop in
+  # assert_http_localhost_response_contains exits on status alone before
+  # nginx picks up the new config. Hand-roll a retry that polls the BODY
+  # written to a file (avoids shell-quoting issues with JSON bodies that
+  # contain embedded double quotes).
+  rm -f /tmp/route-removed-body
+  local attempt=0
+  for attempt in $(seq 1 30); do
+    curl --connect-to "${TEST_APP}.${DOKKU_DOMAIN}:80:localhost:80" -kSso /tmp/route-removed-body "http://${TEST_APP}.${DOKKU_DOMAIN}:80/api/v0/Procfile" || true
+    if ! grep -q 'python3 -m http.server' /tmp/route-removed-body 2>/dev/null; then
+      break
+    fi
+    sleep 1
+  done
+  run /bin/bash -c "grep -c 'python3 -m http.server' /tmp/route-removed-body || true"
+  assert_output "0"
+}
+
+@test "(proxy-route:nginx) websocket upgrade headers are present in rendered config" {
+  run deploy_app python "dokku@$DOKKU_DOMAIN:$TEST_APP" add_api_process_callback
+  assert_success
+  run /bin/bash -c "dokku ps:scale $TEST_APP web=1 api=1"
+  assert_success
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001"
+  assert_success
+
+  run /bin/bash -c "dokku nginx:show-config $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "location /api/v0"
+  # These headers appear in both the route's location block AND the existing
+  # location / block, so allow >= 1 occurrence (count = -1) rather than the
+  # default exact-count-of-1.
+  assert_output_contains "proxy_http_version 1.1" -1
+  assert_output_contains "proxy_set_header Upgrade \$http_upgrade" -1
+  assert_output_contains "proxy_set_header Connection \$http_connection" -1
+}
+
+add_api_process_callback() {
+  local APP="$1"
+  local APP_REPO_DIR="$2"
+  # api serves /app's working directory on port 5001. GET /Procfile returns
+  # the literal Procfile bytes, which web.py does not serve - this gives the
+  # HTTP assertions a clear marker for which process handled the request.
+  echo "api: python3 -m http.server 5001" >>"$APP_REPO_DIR/Procfile"
+}
diff --git a/tests/unit/proxy-route-openresty.bats b/tests/unit/proxy-route-openresty.bats
new file mode 100644
index 000000000..db7e321a2
--- /dev/null
+++ b/tests/unit/proxy-route-openresty.bats
@@ -0,0 +1,147 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+  global_setup
+  dokku nginx:stop
+  dokku openresty:start
+  create_app
+  dokku proxy:set "$TEST_APP" openresty
+}
+
+teardown() {
+  dokku proxy:route:clear "$TEST_APP" >/dev/null 2>&1 || true
+  destroy_app
+  dokku openresty:stop
+  dokku nginx:start
+  global_teardown
+}
+
+@test "(proxy-route:openresty) basic routing - /api/v0 hits api, / hits web" {
+  run deploy_app python "dokku@$DOKKU_DOMAIN:$TEST_APP" add_api_process_callback
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:scale $TEST_APP web=1 api=1"
+  assert_success
+
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Give the daemon a moment to read the new labels.
+  sleep 5
+
+  # Without --strip-prefix, /api/v0/Procfile reaches api as /api/v0/Procfile
+  # which python's http.server returns 404 for. A 404 here proves the route
+  # reaches api - web's catch-all would have returned 200.
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "" "404"
+}
+
+@test "(proxy-route:openresty) --strip-prefix toggles upstream path visibility" {
+  run deploy_app python "dokku@$DOKKU_DOMAIN:$TEST_APP" add_api_process_callback
+  assert_success
+
+  run /bin/bash -c "dokku ps:scale $TEST_APP web=1 api=1"
+  assert_success
+
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001"
+  assert_success
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Give the daemon a moment to read the new labels.
+  sleep 5
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "" "404"
+
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001 --strip-prefix"
+  assert_success
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Give the sidecar a longer window than the default HTTP retry to detect
+  # and re-render after a route's labels change on the api container.
+  HTTP_ASSERT_RETRIES=60 assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "python3 -m http.server"
+}
+
+@test "(proxy-route:openresty) removing a route falls back to web" {
+  run deploy_app python "dokku@$DOKKU_DOMAIN:$TEST_APP" add_api_process_callback
+  assert_success
+
+  run /bin/bash -c "dokku ps:scale $TEST_APP web=1 api=1"
+  assert_success
+
+  # Set without --strip-prefix first; 404 proves the labels attached.
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001"
+  assert_success
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Give the daemon a moment to read the new labels.
+  sleep 5
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "" "404"
+
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001 --strip-prefix"
+  assert_success
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Give the daemon a moment to read the new labels.
+  sleep 5
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "python3 -m http.server"
+
+  run /bin/bash -c "dokku proxy:route:remove $TEST_APP /api/v0"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku proxy:route:report $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "(none)"
+
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Give the daemon a moment to read the new labels.
+  sleep 5
+
+  # Poll the response body via file to avoid shell-quoting issues with JSON
+  # bodies that contain embedded double quotes.
+  rm -f /tmp/route-removed-body
+  local attempt=0
+  for attempt in $(seq 1 30); do
+    curl --connect-to "${TEST_APP}.${DOKKU_DOMAIN}:80:localhost:80" -kSso /tmp/route-removed-body "http://${TEST_APP}.${DOKKU_DOMAIN}:80/api/v0/Procfile" || true
+    if ! grep -q 'python3 -m http.server' /tmp/route-removed-body 2>/dev/null; then
+      break
+    fi
+    sleep 1
+  done
+  run /bin/bash -c "grep -c 'python3 -m http.server' /tmp/route-removed-body || true"
+  assert_output "0"
+}
+
+add_api_process_callback() {
+  local APP="$1"
+  local APP_REPO_DIR="$2"
+  echo "api: python3 -m http.server 5001" >>"$APP_REPO_DIR/Procfile"
+}
diff --git a/tests/unit/proxy-route-traefik.bats b/tests/unit/proxy-route-traefik.bats
new file mode 100644
index 000000000..7af93a89c
--- /dev/null
+++ b/tests/unit/proxy-route-traefik.bats
@@ -0,0 +1,160 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+  global_setup
+  dokku nginx:stop
+  dokku traefik:start
+  create_app
+  dokku proxy:set "$TEST_APP" traefik
+}
+
+teardown() {
+  dokku proxy:route:clear "$TEST_APP" >/dev/null 2>&1 || true
+  destroy_app
+  dokku traefik:stop
+  dokku nginx:start
+  global_teardown
+}
+
+@test "(proxy-route:traefik) basic routing - /api/v0 hits api, / hits web" {
+  run deploy_app python "dokku@$DOKKU_DOMAIN:$TEST_APP" add_api_process_callback
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:scale $TEST_APP web=1 api=1"
+  assert_success
+
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Routes are applied via container labels - rebuild so the api container
+  # restarts with the new labels attached.
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "docker inspect $TEST_APP.api.1 --format '{{ index .Config.Labels \"traefik.http.routers.$TEST_APP-api-api-v0.rule\" }}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "(Host(\`$TEST_APP.$DOKKU_DOMAIN\`)) && PathPrefix(\`/api/v0\`)"
+
+  # Give the daemon a moment to read the new labels.
+  sleep 5
+
+  # Without --strip-prefix, /api/v0/Procfile reaches api as /api/v0/Procfile
+  # which python's http.server returns 404 for. A 404 here proves the route
+  # reaches api - web's catch-all would have returned 200.
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "" "404"
+}
+
+@test "(proxy-route:traefik) --strip-prefix toggles upstream path visibility" {
+  run deploy_app python "dokku@$DOKKU_DOMAIN:$TEST_APP" add_api_process_callback
+  assert_success
+
+  run /bin/bash -c "dokku ps:scale $TEST_APP web=1 api=1"
+  assert_success
+
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001"
+  assert_success
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Give the daemon a moment to read the new labels.
+  sleep 5
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "" "404"
+
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001 --strip-prefix"
+  assert_success
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Give the daemon a moment to read the new labels.
+  sleep 5
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "python3 -m http.server"
+}
+
+@test "(proxy-route:traefik) removing a route falls back to web" {
+  run deploy_app python "dokku@$DOKKU_DOMAIN:$TEST_APP" add_api_process_callback
+  assert_success
+
+  run /bin/bash -c "dokku ps:scale $TEST_APP web=1 api=1"
+  assert_success
+
+  # Set the route without --strip-prefix first; a 404 from api proves the
+  # labels attached and traefik is routing correctly.
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001"
+  assert_success
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Give the daemon a moment to read the new labels.
+  sleep 5
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "" "404"
+
+  # Switch to --strip-prefix and verify api now serves the Procfile.
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001 --strip-prefix"
+  assert_success
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Give the daemon a moment to read the new labels.
+  sleep 5
+  assert_http_localhost_response_contains "http" "${TEST_APP}.${DOKKU_DOMAIN}" "80" "/api/v0/Procfile" "python3 -m http.server"
+
+  run /bin/bash -c "dokku proxy:route:remove $TEST_APP /api/v0"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Confirm storage was actually mutated before doing the slow rebuild.
+  run /bin/bash -c "dokku proxy:route:report $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "(none)"
+
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Give the daemon a moment to read the new labels.
+  sleep 5
+
+  # After ps:rebuild, traefik recreates the api container without the route
+  # labels, but there is still a race with traefik picking up the new state.
+  # Poll the response body via file to avoid shell-quoting issues with JSON
+  # bodies that contain embedded double quotes.
+  rm -f /tmp/route-removed-body
+  local attempt=0
+  for attempt in $(seq 1 30); do
+    curl --connect-to "${TEST_APP}.${DOKKU_DOMAIN}:80:localhost:80" -kSso /tmp/route-removed-body "http://${TEST_APP}.${DOKKU_DOMAIN}:80/api/v0/Procfile" || true
+    if ! grep -q 'python3 -m http.server' /tmp/route-removed-body 2>/dev/null; then
+      break
+    fi
+    sleep 1
+  done
+  run /bin/bash -c "grep -c 'python3 -m http.server' /tmp/route-removed-body || true"
+  assert_output "0"
+}
+
+add_api_process_callback() {
+  local APP="$1"
+  local APP_REPO_DIR="$2"
+  echo "api: python3 -m http.server 5001" >>"$APP_REPO_DIR/Procfile"
+}
diff --git a/tests/unit/proxy-route.bats b/tests/unit/proxy-route.bats
new file mode 100644
index 000000000..a3f22dfa7
--- /dev/null
+++ b/tests/unit/proxy-route.bats
@@ -0,0 +1,233 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+  global_setup
+  create_app
+}
+
+teardown() {
+  dokku proxy:route:clear "$TEST_APP" >/dev/null 2>&1 || true
+  destroy_app
+  global_teardown
+}
+
+@test "(proxy:route) help text mentions route commands" {
+  run /bin/bash -c "dokku proxy:help"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output_contains "proxy:route:set"
+  assert_output_contains "proxy:route:remove"
+  assert_output_contains "proxy:route:clear"
+  assert_output_contains "proxy:route:report"
+}
+
+@test "(proxy:route:set) stores a route under the default port and is idempotent" {
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku proxy:route:report $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "/api/v0 -> api:5000"
+
+  # second call with identical args produces identical state
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku proxy:route:report $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output_contains "/api/v0 -> api:5000"
+}
+
+@test "(proxy:route:set) --port overrides the default port" {
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku proxy:route:report $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output_contains "/api/v0 -> api:5001"
+}
+
+@test "(proxy:route:set) --strip-prefix marks the route as stripping" {
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --strip-prefix"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku proxy:route:report $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output_contains "/api/v0 -> api:5000 (strip)"
+}
+
+@test "(proxy:route:set) re-setting without --port resets port to default" {
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 5001"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku proxy:route:report $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output_contains "/api/v0 -> api:5000"
+}
+
+@test "(proxy:route:set) re-setting without --strip-prefix resets strip to false" {
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --strip-prefix"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku proxy:route:report $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output_not_contains "(strip)"
+}
+
+@test "(proxy:route:set) refuses web as a target" {
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP web /api/v0"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "web cannot be a route target"
+}
+
+@test "(proxy:route:set) refuses root path" {
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "reserved for the web process"
+}
+
+@test "(proxy:route:set) refuses path without leading slash" {
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api api/v0"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "must start with /"
+}
+
+@test "(proxy:route:set) refuses path with trailing slash" {
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0/"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "must not end with /"
+}
+
+@test "(proxy:route:set) refuses ports out of range" {
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0 --port 70000"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "out of range"
+}
+
+@test "(proxy:route:set) warns when target process is scaled to zero" {
+  run /bin/bash -c "dokku ps:scale $TEST_APP api=0"
+  echo "output: $output"
+  echo "status: $status"
+
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "scaled to 0"
+}
+
+@test "(proxy:route:remove) deletes a route" {
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0"
+  assert_success
+
+  run /bin/bash -c "dokku proxy:route:remove $TEST_APP /api/v0"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku proxy:route:report $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output_not_contains "/api/v0"
+}
+
+@test "(proxy:route:remove) is idempotent on a nonexistent path" {
+  run /bin/bash -c "dokku proxy:route:remove $TEST_APP /does/not/exist"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+}
+
+@test "(proxy:route:clear) removes every route" {
+  dokku proxy:route:set "$TEST_APP" api /api/v0 >/dev/null
+  dokku proxy:route:set "$TEST_APP" api /api/v0/admin >/dev/null
+  dokku proxy:route:set "$TEST_APP" ws /ws --port 8080 >/dev/null
+
+  run /bin/bash -c "dokku proxy:route:clear $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku proxy:route:report $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output_contains "(none)"
+}
+
+@test "(proxy:route:clear) is idempotent on an empty route set" {
+  run /bin/bash -c "dokku proxy:route:clear $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+}
+
+@test "(proxy:route:report) supports json output" {
+  dokku proxy:route:set "$TEST_APP" api /api/v0 --port 5001 >/dev/null
+  dokku proxy:route:set "$TEST_APP" ws /ws --port 8080 --strip-prefix >/dev/null
+
+  run /bin/bash -c "dokku proxy:route:report $TEST_APP --format json | jq -e '.routes | length'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "2"
+
+  run /bin/bash -c "dokku proxy:route:report $TEST_APP --format json | jq -r '.routes[] | select(.path == \"/ws\") | .strip_prefix'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output "true"
+}
+
+@test "(proxy:route:set) stores routes under haproxy backend even though they are inert" {
+  dokku proxy:set "$TEST_APP" haproxy >/dev/null 2>&1 || skip "haproxy proxy not available"
+
+  run /bin/bash -c "dokku proxy:route:set $TEST_APP api /api/v0"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku proxy:route:report $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output_contains "/api/v0 -> api:5000"
+}
diff --git a/tests/unit/ps-general-1.bats b/tests/unit/ps-general-1.bats
index 20a00858d..be285ccd3 100644
--- a/tests/unit/ps-general-1.bats
+++ b/tests/unit/ps-general-1.bats
@@ -305,6 +305,129 @@ worker=1" >/var/lib/dokku/config/ps/$TEST_APP/scale
   assert_output "[]"
 }
 
+@test "(ps:scale) --replace" {
+  echo "web=4
+worker=1" >/var/lib/dokku/config/ps/$TEST_APP/scale
+
+  run /bin/bash -c "dokku ps:scale --replace $TEST_APP web=2"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku --quiet ps:scale $TEST_APP"
+  output=$(echo "$output" | tr -s " ")
+  echo "output: ($output)"
+  echo "status: $status"
+  assert_output $'web: 2\nworker: 0'
+}
+
+@test "(ps:scale) --clear" {
+  echo "web=4
+worker=1" >/var/lib/dokku/config/ps/$TEST_APP/scale
+
+  run /bin/bash -c "dokku ps:scale --clear $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku --quiet ps:scale $TEST_APP"
+  output=$(echo "$output" | tr -s " ")
+  echo "output: ($output)"
+  echo "status: $status"
+  assert_output $'web: 1\nworker: 0'
+}
+
+@test "(ps:scale) --clear and --replace argument validation" {
+  run /bin/bash -c "dokku ps:scale --replace $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Must specify at least one process type when using the --replace flag"
+
+  run /bin/bash -c "dokku ps:scale --clear $TEST_APP web=1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Process types cannot be specified when using the --clear flag"
+
+  run /bin/bash -c "dokku ps:scale --clear --replace $TEST_APP web=1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "The --clear and --replace flags cannot be specified together"
+}
+
+@test "(ps:scale) invalid process counts" {
+  run /bin/bash -c "dokku ps:scale $TEST_APP web=-1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Invalid count for process type web: value must be zero or greater"
+
+  run /bin/bash -c "dokku ps:scale --replace $TEST_APP web=1 worker=-2"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Invalid count for process type worker: value must be zero or greater"
+
+  run /bin/bash -c "dokku ps:scale $TEST_APP =1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Missing process type for count 1"
+
+  run_plugn_trigger ps-set-scale $TEST_APP true false web=-1
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Invalid count for process type web: value must be zero or greater"
+
+  run /bin/bash -c "dokku --quiet ps:scale $TEST_APP"
+  output=$(echo "$output" | tr -s " ")
+  echo "output: ($output)"
+  echo "status: $status"
+  assert_output "web: 1"
+
+  run /bin/bash -c "dokku ps:scale --skip-deploy $TEST_APP web=0"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku --quiet ps:scale $TEST_APP"
+  output=$(echo "$output" | tr -s " ")
+  echo "output: ($output)"
+  echo "status: $status"
+  assert_output "web: 0"
+}
+
+@test "(ps:scale) repairing a negative process count" {
+  echo "web=-1
+worker=2" >/var/lib/dokku/config/ps/$TEST_APP/scale
+
+  run /bin/bash -c "dokku --quiet ps:scale $TEST_APP"
+  output=$(echo "$output" | tr -s " ")
+  echo "output: ($output)"
+  echo "status: $status"
+  assert_success
+  assert_output $'web: -1\nworker: 2'
+
+  run_plugn_trigger ps-current-scale $TEST_APP
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:scale --skip-deploy $TEST_APP web=1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku --quiet ps:scale $TEST_APP"
+  output=$(echo "$output" | tr -s " ")
+  echo "output: ($output)"
+  echo "status: $status"
+  assert_output $'web: 1\nworker: 2'
+}
+
 @test "(ps) handle windows newlines in procfile" {
   run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP procfile_line_endings_to_windows
   echo "output: $output"
diff --git a/tests/unit/ps-general-2.bats b/tests/unit/ps-general-2.bats
index db2520b3b..0f51319a8 100644
--- a/tests/unit/ps-general-2.bats
+++ b/tests/unit/ps-general-2.bats
@@ -196,3 +196,16 @@ teardown() {
   echo "output: ($output)"
   assert_output 'web: 1'
 }
+
+@test "(ps:rebuild) --all --no-cache" {
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP convert_to_dockerfile
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:rebuild --all --no-cache"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "CACHED" 1
+}
diff --git a/tests/unit/ps-general-3.bats b/tests/unit/ps-general-3.bats
new file mode 100644
index 000000000..475a1d6b5
--- /dev/null
+++ b/tests/unit/ps-general-3.bats
@@ -0,0 +1,102 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+  global_setup
+  create_app
+}
+
+teardown() {
+  destroy_app
+  global_teardown
+}
+
+@test "(ps:scale) --replace scales down unspecified processes" {
+  run /bin/bash -c "dokku builder-herokuish:set $TEST_APP allowed true"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:scale $TEST_APP worker=1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "docker ps --filter label=com.dokku.app-name=$TEST_APP --filter label=com.dokku.process-type=worker --format '{{.Names}}' | wc -l"
+  output=$(echo "$output" | tr -d " ")
+  echo "output: ($output)"
+  echo "status: $status"
+  assert_output "1"
+
+  run /bin/bash -c "dokku ps:scale --replace $TEST_APP web=1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku --quiet ps:scale $TEST_APP"
+  output=$(echo "$output" | tr -s " ")
+  echo "output: ($output)"
+  echo "status: $status"
+  assert_output $'cron: 0\ncustom: 0\nrelease: 0\ntask: 0\nweb: 1\nworker: 0'
+
+  sleep 2
+
+  run /bin/bash -c "dokku ps:retire"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "docker ps --filter label=com.dokku.app-name=$TEST_APP --filter label=com.dokku.process-type=worker --format '{{.Names}}' | wc -l"
+  output=$(echo "$output" | tr -d " ")
+  echo "output: ($output)"
+  echo "status: $status"
+  assert_output "0"
+}
+
+@test "(ps:scale) --clear without a web process type" {
+  run /bin/bash -c "dokku ps:scale $TEST_APP web=0 console=0"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python-console-only
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:scale --skip-deploy $TEST_APP console=2"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku --quiet ps:scale $TEST_APP"
+  output=$(echo "$output" | tr -s " ")
+  echo "output: ($output)"
+  echo "status: $status"
+  assert_output "console: 2"
+
+  run /bin/bash -c "dokku ps:scale --clear $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku --quiet ps:scale $TEST_APP"
+  output=$(echo "$output" | tr -s " ")
+  echo "output: ($output)"
+  echo "status: $status"
+  assert_output "console: 0"
+}
+
+@test "(ps:retire) missing app" {
+  run /bin/bash -c "dokku ps:retire missing-app"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "App missing-app does not exist"
+}
diff --git a/tests/unit/registry.bats b/tests/unit/registry.bats
index 249676752..a21ece944 100644
--- a/tests/unit/registry.bats
+++ b/tests/unit/registry.bats
@@ -90,6 +90,12 @@ teardown() {
   echo "output: $output"
   echo "status: $status"
   assert_success
+
+  run /bin/bash -c "jq -r '.auths | keys | join(\",\")' /var/lib/dokku/config/registry/$TEST_APP/config.json"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_not_contains "index.docker.io"
 }
 
 @test "(registry:logout) global logout" {
@@ -106,6 +112,55 @@ teardown() {
   echo "output: $output"
   echo "status: $status"
   assert_success
+
+  run /bin/bash -c "jq -r '.auths | keys | join(\",\")' $DOKKU_ROOT/.docker/config.json"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_not_contains "index.docker.io"
+}
+
+@test "(registry:auth-status) matches a credential written by registry:login" {
+  if [[ -z "$DOCKERHUB_USERNAME" ]] || [[ -z "$DOCKERHUB_TOKEN" ]]; then
+    skip "skipping due to missing docker.io credentials DOCKERHUB_USERNAME:DOCKERHUB_TOKEN"
+  fi
+
+  run /bin/bash -c "dokku registry:login --global docker.io $DOCKERHUB_USERNAME $DOCKERHUB_TOKEN"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku registry:auth-status --global docker.io $DOCKERHUB_USERNAME $DOCKERHUB_TOKEN"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 0
+  assert_output ""
+
+  run /bin/bash -c "dokku registry:auth-status --global docker.io $DOCKERHUB_USERNAME wrong-password"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 2
+
+  run /bin/bash -c "dokku registry:report --global --format json | jq -r '.\"global-auth-servers\"'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "docker.io"
+
+  run /bin/bash -c "dokku registry:logout --global docker.io"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku registry:auth-status --global docker.io $DOCKERHUB_USERNAME $DOCKERHUB_TOKEN"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 1
+
+  run /bin/bash -c "dokku registry:auth-status --global docker.io"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 0
 }
 
 @test "(registry) per-app credentials deleted on app destroy" {
@@ -567,6 +622,13 @@ teardown() {
     skip "skipping due to missing docker.io credentials DOCKERHUB_USERNAME:DOCKERHUB_TOKEN"
   fi
 
+  # this test pushes to the registry, so it establishes its own credentials
+  # rather than relying on a login left behind by an earlier test
+  run /bin/bash -c "dokku registry:login --global docker.io $DOCKERHUB_USERNAME $DOCKERHUB_TOKEN"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
   run /bin/bash -c "dokku registry:set $TEST_APP push-on-release true"
   echo "output: $output"
   echo "status: $status"
@@ -696,6 +758,13 @@ teardown() {
     skip "skipping due to missing docker.io credentials DOCKERHUB_USERNAME:DOCKERHUB_TOKEN"
   fi
 
+  # this test pushes to the registry, so it establishes its own credentials
+  # rather than relying on a login left behind by an earlier test
+  run /bin/bash -c "dokku registry:login --global docker.io $DOCKERHUB_USERNAME $DOCKERHUB_TOKEN"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
   run /bin/bash -c "dokku registry:set $TEST_APP push-on-release true"
   echo "output: $output"
   echo "status: $status"
@@ -743,3 +812,214 @@ teardown() {
   assert_success
   assert_output "true"
 }
+
+@test "(registry:auth-status) validates arguments" {
+  run /bin/bash -c "dokku registry:auth-status"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 3
+  assert_output_contains "Please specify an app or the --global flag"
+
+  run /bin/bash -c "dokku registry:auth-status --global"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 3
+  assert_output_contains "Missing server argument"
+
+  run /bin/bash -c "dokku registry:auth-status $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 3
+  assert_output_contains "Missing server argument"
+
+  run /bin/bash -c "dokku registry:auth-status $TEST_APP docker.io username"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 3
+  assert_output_contains "Missing password argument"
+
+  # an unknown flag must not be reported as a differing credential, which is
+  # what pflag would exit with if it handled the error itself
+  run /bin/bash -c "dokku registry:auth-status --nonsense --global docker.io"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 3
+
+  run /bin/bash -c "dokku registry:auth-status --help"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 3
+
+  run /bin/bash -c "dokku registry:auth-status nonexistent-app-name docker.io username password"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 20
+
+  # a malformed app name must not be reported as a missing credential
+  run /bin/bash -c "dokku registry:auth-status 'BAD NAME' docker.io username password"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 3
+}
+
+@test "(registry:auth-status) reports per-app credential state" {
+  run /bin/bash -c "dokku registry:auth-status $TEST_APP docker.io fakeuser fakepass"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 1
+  assert_output ""
+
+  run /bin/bash -c "dokku registry:auth-status $TEST_APP docker.io"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 0
+  assert_output ""
+
+  write_registry_auth_config "$TEST_APP" "{\"auths\":{\"https://index.docker.io/v1/\":{\"auth\":\"$(fake_registry_auth fakeuser fakepass)\"}}}"
+
+  run /bin/bash -c "dokku registry:auth-status $TEST_APP docker.io fakeuser fakepass"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 0
+  assert_output ""
+
+  run /bin/bash -c "dokku registry:auth-status $TEST_APP docker.io fakeuser wrongpass"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 2
+  assert_output ""
+
+  run /bin/bash -c "dokku registry:auth-status $TEST_APP docker.io otheruser fakepass"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 2
+
+  run /bin/bash -c "dokku registry:auth-status $TEST_APP docker.io"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 2
+
+  run /bin/bash -c "dokku registry:auth-status $TEST_APP ghcr.io fakeuser fakepass"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 1
+
+  run /bin/bash -c "printf 'fakepass' | dokku registry:auth-status --password-stdin $TEST_APP docker.io fakeuser"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 0
+
+  run /bin/bash -c "printf 'wrongpass' | dokku registry:auth-status --password-stdin $TEST_APP docker.io fakeuser"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 2
+
+  run /bin/bash -c "dokku --app $TEST_APP registry:auth-status docker.io fakeuser fakepass"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 0
+}
+
+@test "(registry:auth-status) normalizes server names and reports unreadable credentials" {
+  write_registry_auth_config "$TEST_APP" "{\"auths\":{\"https://index.docker.io/v1/\":{\"auth\":\"$(fake_registry_auth fakeuser fakepass)\"}}}"
+
+  for server in docker.io hub.docker.com docker.com index.docker.io; do
+    run /bin/bash -c "dokku registry:auth-status $TEST_APP $server fakeuser fakepass"
+    echo "server: $server"
+    echo "output: $output"
+    echo "status: $status"
+    assert_exit_status 0
+  done
+
+  # docker stores registry-1.docker.io under a key of its own rather than the
+  # index server, so a docker hub credential does not cover it
+  run /bin/bash -c "dokku registry:auth-status $TEST_APP registry-1.docker.io fakeuser fakepass"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 1
+
+  write_registry_auth_config "$TEST_APP" '{"auths":{"ghcr.io":{}},"credsStore":"secretservice"}'
+
+  run /bin/bash -c "dokku registry:auth-status $TEST_APP ghcr.io fakeuser fakepass"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 4
+  assert_output_contains "credential helper"
+  assert_output_not_contains "fakepass"
+
+  # knowing a credential exists needs no access to the secret
+  run /bin/bash -c "dokku registry:auth-status $TEST_APP ghcr.io"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 2
+
+  write_registry_auth_config "$TEST_APP" "{\"auths\":{\"ghcr.io\":{\"auth\":\"$(fake_registry_auth fakeuser '')\",\"identitytoken\":\"token\"}}}"
+
+  run /bin/bash -c "dokku registry:auth-status $TEST_APP ghcr.io fakeuser fakepass"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 4
+  assert_output_contains "identity token"
+
+  # a username that differs settles the comparison without reading the secret
+  run /bin/bash -c "dokku registry:auth-status $TEST_APP ghcr.io otheruser fakepass"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 2
+}
+
+@test "(registry:report) auth-servers raw vs computed vs global" {
+  run /bin/bash -c "dokku registry:report $TEST_APP --format json | jq -r '.\"auth-servers\"'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output ""
+
+  run /bin/bash -c "dokku registry:report $TEST_APP --format json | jq -r '.\"computed-auth-servers\" == .\"global-auth-servers\"'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "true"
+
+  write_registry_auth_config "$TEST_APP" "{\"auths\":{\"https://index.docker.io/v1/\":{\"auth\":\"$(fake_registry_auth fakeuser fakepass)\"},\"ghcr.io\":{\"auth\":\"$(fake_registry_auth fakeuser fakepass)\"}}}"
+
+  run /bin/bash -c "dokku registry:report $TEST_APP --format json | jq -r '.\"auth-servers\"'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "docker.io,ghcr.io"
+
+  # a per-app config shadows the global one entirely rather than merging
+  run /bin/bash -c "dokku registry:report $TEST_APP --format json | jq -r '.\"computed-auth-servers\"'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "docker.io,ghcr.io"
+
+  run /bin/bash -c "dokku registry:report $TEST_APP --format json | jq -r 'has(\"auth-servers\") and has(\"registry-auth-servers\")'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "true"
+
+  run /bin/bash -c "dokku registry:report --global --format json | jq -r 'has(\"global-auth-servers\") and has(\"computed-auth-servers\")'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "true"
+}
+
+fake_registry_auth() {
+  declare desc="base64 encodes a username and password as docker stores them"
+  declare USERNAME="$1" PASSWORD="$2"
+  printf '%s:%s' "$USERNAME" "$PASSWORD" | base64 -w0
+}
+
+write_registry_auth_config() {
+  declare desc="writes a docker config.json for an app without contacting a registry"
+  declare APP="$1" CONTENTS="$2"
+  mkdir -p "/var/lib/dokku/config/registry/$APP"
+  echo "$CONTENTS" >"/var/lib/dokku/config/registry/$APP/config.json"
+  chown -R dokku:dokku "/var/lib/dokku/config/registry/$APP"
+  chmod 600 "/var/lib/dokku/config/registry/$APP/config.json"
+}
diff --git a/tests/unit/resource_1.bats b/tests/unit/resource_1.bats
index c36031e89..e026063bc 100644
--- a/tests/unit/resource_1.bats
+++ b/tests/unit/resource_1.bats
@@ -59,6 +59,22 @@ teardown() {
   echo "status: $status"
   assert_output "536870912"
 
+  run /bin/bash -c "dokku resource:limit --memory 1G $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  CID=$(<$DOKKU_ROOT/$TEST_APP/CONTAINER.web.1)
+  run /bin/bash -c "docker inspect --format '{{.HostConfig.Memory}}' $CID"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output "1073741824"
+
   run /bin/bash -c "dokku resource:limit --memory 512 $TEST_APP"
   echo "output: $output"
   echo "status: $status"
@@ -174,3 +190,52 @@ teardown() {
   echo "status: $status"
   assert_failure
 }
+
+@test "(resource) resource:limit-clear preserves reservations" {
+  run /bin/bash -c "dokku resource:limit --memory 512m $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku resource:limit --memory 384m --process-type web $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku resource:reserve --memory 256m $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku resource:reserve --memory 128m --process-type web $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku resource:limit-clear $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku resource:report --resource-_default_.limit.memory $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "dokku resource:report --resource-web.limit.memory $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "dokku resource:report --resource-_default_.reserve.memory $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "256m"
+
+  run /bin/bash -c "dokku resource:report --resource-web.reserve.memory $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "128m"
+}
diff --git a/tests/unit/resource_2.bats b/tests/unit/resource_2.bats
index 5ef9bfde1..481ae1579 100644
--- a/tests/unit/resource_2.bats
+++ b/tests/unit/resource_2.bats
@@ -149,3 +149,52 @@ teardown() {
   echo "status: $status"
   assert_failure
 }
+
+@test "(resource) resource:reserve-clear preserves limits" {
+  run /bin/bash -c "dokku resource:limit --memory 512m $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku resource:limit --memory 384m --process-type web $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku resource:reserve --memory 256m $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku resource:reserve --memory 128m --process-type web $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku resource:reserve-clear $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku resource:report --resource-_default_.reserve.memory $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "dokku resource:report --resource-web.reserve.memory $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "dokku resource:report --resource-_default_.limit.memory $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "512m"
+
+  run /bin/bash -c "dokku resource:report --resource-web.limit.memory $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "384m"
+}
diff --git a/tests/unit/resource_3.bats b/tests/unit/resource_3.bats
index 174d2084d..91d03a8ff 100644
--- a/tests/unit/resource_3.bats
+++ b/tests/unit/resource_3.bats
@@ -101,6 +101,8 @@ teardown() {
   echo "status: $status"
   assert_success
 
+  # DOKKU_OMIT_RESOURCE_ARGS has to survive the privilege drop in
+  # plugins/plugin/subcommands/trigger, so this also covers that forwarding
   run_plugn_trigger DOKKU_OMIT_RESOURCE_ARGS=1 docker-args-process-build "$TEST_APP" herokuish
   echo "output: $output"
   echo "status: $status"
@@ -129,3 +131,80 @@ teardown() {
   echo "status: $status"
   assert_failure
 }
+
+@test "(resource) resource:limit uppercase memory units" {
+  run /bin/bash -c "dokku resource:limit --memory 1G --memory-swap 2G $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku resource:reserve --memory 512M $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run_plugin_script resource docker-args-process-deploy "$TEST_APP" herokuish "dokku/$TEST_APP:latest" web "< /dev/null"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "--memory=1G "
+  assert_output_contains "--memory-swap=2G "
+  assert_output_contains "--memory-reservation=512M "
+  assert_output_not_contains "1Gm"
+  assert_output_not_contains "512Mm"
+
+  run /bin/bash -c "dokku resource:limit --memory 1G --process-type build $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run_plugn_trigger docker-args-process-build "$TEST_APP" herokuish
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "--memory=1G "
+  assert_output_not_contains "1Gm"
+}
+
+@test "(resource) resource:limit rejects invalid memory values" {
+  run /bin/bash -c "dokku resource:limit --memory '100G --foo' $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "dokku resource:limit --memory 1x $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "dokku resource:limit --memory-swap 1x $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "dokku resource:reserve --memory 1Gm $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "dokku resource:report --resource-_default_.limit.memory $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "dokku resource:report --resource-_default_.reserve.memory $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "dokku resource:limit --memory-swap -1 $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku resource:report --resource-_default_.limit.memory-swap $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "-1"
+}
diff --git a/tests/unit/run_1.bats b/tests/unit/run_1.bats
index 91fda6ce9..b87bb0ffd 100644
--- a/tests/unit/run_1.bats
+++ b/tests/unit/run_1.bats
@@ -140,3 +140,65 @@ teardown() {
   assert_success
   assert_output_not_contains "$container_id"
 }
+
+@test "(run:logs) run:logs" {
+  run deploy_app
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku run:detached $TEST_APP worker"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku run:list $TEST_APP --format json | jq -r '.[0].name'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  local RUN_CONTAINER="$output"
+  sleep 5
+
+  run /bin/bash -c "dokku run:logs $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "sleeping for 60 seconds"
+
+  run /bin/bash -c "dokku run:logs $TEST_APP -n 1 -q"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "sleeping for 60 seconds"
+
+  run /bin/bash -c "dokku run:logs --container $RUN_CONTAINER -q"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "sleeping for 60 seconds"
+
+  run /bin/bash -c "dokku run:stop $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+}
+
+@test "(run:logs) invalid arguments" {
+  run /bin/bash -c "dokku run:logs $TEST_APP -n abc"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Invalid value for num: must be an integer"
+
+  run /bin/bash -c "dokku run:logs $TEST_APP --container other-app.run.1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Specified app does not match app in container name"
+
+  run /bin/bash -c "dokku run:logs --container $TEST_APP.run.1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Specified container does not exist"
+}
diff --git a/tests/unit/run_2.bats b/tests/unit/run_2.bats
index b80957028..aab7f9168 100644
--- a/tests/unit/run_2.bats
+++ b/tests/unit/run_2.bats
@@ -8,6 +8,7 @@ setup() {
 }
 
 teardown() {
+  docker container rm -f "$TEST_APP.run.9999" >/dev/null 2>&1 || true
   destroy_app
   global_teardown
 }
@@ -29,12 +30,35 @@ teardown() {
   assert_failure
 }
 
+@test "(run) run over ssh preserves echo-like arguments" {
+  run deploy_app
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "ssh dokku@$DOKKU_DOMAIN run $TEST_APP /bin/echo --version --help 2>/dev/null"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "--version --help"
+
+  # bats strips trailing newlines from $output, so count bytes to verify -n was honored
+  run /bin/bash -c "ssh dokku@$DOKKU_DOMAIN run $TEST_APP /bin/echo -n hello 2>/dev/null | wc -c"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "5"
+}
+
 @test "(run) run:detached" {
   run deploy_app
   echo "output: $output"
   echo "status: $status"
   assert_success
 
+  # the leading --label is replayed out of DOKKU_GLOBAL_FLAGS by
+  # plugins/scheduler-docker-local/scheduler-run, so this also covers that variable
+  # surviving the re-exec as the dokku user
   RANDOM_RUN_CID="$(dokku --label=com.dokku.test-label=value run:detached $TEST_APP sleep 300)"
   run /bin/bash -c "docker inspect -f '{{ .State.Status }}' $RANDOM_RUN_CID"
   echo "output: $output"
@@ -154,6 +178,58 @@ teardown() {
   assert_output "2"
 }
 
+@test "(run:stop) only stops run containers for the app" {
+  run deploy_app
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku run:detached $TEST_APP sleep 300"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku run:list $TEST_APP --format json | jq -r '.[0].name'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  local RUN_CONTAINER="$output"
+
+  run /bin/bash -c "docker container run -d --name $TEST_APP.run.9999 --entrypoint sleep dokku/$TEST_APP:latest 300"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku run:stop $TEST_APP --container other-app.run.1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Specified app does not match app in container name"
+
+  run /bin/bash -c "dokku run:stop $TEST_APP --container $TEST_APP.run.9999"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "Specified container does not exist"
+
+  run /bin/bash -c "docker container inspect -f '{{.State.Running}}' $TEST_APP.run.9999"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "true"
+
+  run /bin/bash -c "dokku run:stop $TEST_APP --container $RUN_CONTAINER"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "docker container ls -q --filter name=^/$RUN_CONTAINER\$ | wc -l"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "0"
+}
+
 @test "(run) docker-options and -e flags are not eval-injected" {
   run deploy_app
   echo "output: $output"
@@ -178,6 +254,23 @@ teardown() {
   [[ "$output" != *"uid="* ]] || flunk "id command output leaked - env value was expanded"
 }
 
+@test "(run) run propagates the command exit code" {
+  run deploy_app dockerfile
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku run $TEST_APP sh -c 'exit 3'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 3
+
+  run /bin/bash -c "dokku run $TEST_APP sh -c 'exit 0'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+}
+
 @test "(run) --ttl-seconds rejects non-numeric input; docker-options stores it verbatim" {
   run /bin/bash -c "dokku run --ttl-seconds '\$(id)' $TEST_APP echo hi"
   echo "output: $output"
diff --git a/tests/unit/scheduler-docker-local.bats b/tests/unit/scheduler-docker-local.bats
index 29c76196c..a87d833e7 100644
--- a/tests/unit/scheduler-docker-local.bats
+++ b/tests/unit/scheduler-docker-local.bats
@@ -8,6 +8,8 @@ setup() {
 
 teardown() {
   global_teardown
+  docker image rm "dokku-test/$TEST_APP:shared" &>/dev/null || true
+  start_retire_timer
 }
 
 @test "(scheduler-docker-local:report) --global raw and computed keys" {
@@ -483,3 +485,322 @@ teardown() {
   echo "status: $status"
   assert_output "running"
 }
+
+@test "(scheduler-docker-local) ps:retire keeps an image that is another app's source image" {
+  local SECOND_APP="$TEST_APP-2" TMP_IMAGE_DIR
+  stop_retire_timer
+  TMP_IMAGE_DIR="$(mktemp -d "/tmp/${DOKKU_DOMAIN}.XXXXX")"
+  cp -r "${BATS_TEST_DIRNAME}/../../tests/apps/python/." "$TMP_IMAGE_DIR"
+  run /bin/bash -c "docker image build -t dokku-test/$TEST_APP:shared -f $TMP_IMAGE_DIR/alt.Dockerfile $TMP_IMAGE_DIR"
+  echo "output: $output"
+  echo "status: $status"
+  rm -rf "$TMP_IMAGE_DIR"
+  assert_success
+
+  run create_app
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run create_app "$SECOND_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku checks:set $TEST_APP wait-to-retire 1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku git:from-image $TEST_APP dokku-test/$TEST_APP:shared"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku git:from-image $SECOND_APP dokku-test/$TEST_APP:shared"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "tar -C ${BATS_TEST_DIRNAME}/../../tests/apps -cf - python | dokku git:from-archive $TEST_APP --"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  sleep 3
+
+  run /bin/bash -c "dokku ps:retire"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "is the source image for $SECOND_APP"
+
+  run /bin/bash -c "docker image inspect dokku-test/$TEST_APP:shared --format '{{.Id}}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+}
+
+@test "(scheduler-docker-local) procfile quoted arguments on deploy" {
+  run create_app
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP quoted_procfile_callback
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "docker inspect --format '{{json .Config.Cmd}}' $TEST_APP.web.1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output '["python3","-u","web.py","double quoted","single quoted","escaped \"quote\"","literal`tick`","5000"]'
+}
+
+@test "(scheduler-docker-local) procfile quoted arguments on run" {
+  run create_app
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP quoted_procfile_callback
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku run $TEST_APP args"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "['double quoted', 'single quoted', 'escaped \"quote\"', 'literal\`tick\`', '5000']"
+}
+
+@test "(scheduler-docker-local) procfile with shell operators fails deploy" {
+  run create_app
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP operator_procfile_callback
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Unable to parse command"
+}
+
+@test "(scheduler-docker-local) deploy removes stale CHECKS files" {
+  local DATA_DIR="/var/lib/dokku/data/scheduler-docker-local/$TEST_APP"
+
+  run create_app
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  mkdir -p "$DATA_DIR"
+  echo "/ python/http.server" >"$DATA_DIR/CHECKS.99999999"
+  touch "$DATA_DIR/CHECKS.99999998.missing"
+  chown -R dokku:dokku "$DATA_DIR"
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "find $DATA_DIR -maxdepth 1 -name 'CHECKS.*'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_not_exists
+}
+
+@test "(scheduler-docker-local) failed deploy restores previous image" {
+  local CUSTOM_TMP=$(mktemp -d "/tmp/${DOKKU_DOMAIN}.XXXXX")
+  trap 'popd &>/dev/null || true; rm -rf "$CUSTOM_TMP"' INT TERM
+
+  run create_app
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku checks:set $TEST_APP wait-to-retire 1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  CUSTOM_TMP="$CUSTOM_TMP" run deploy_app python "dokku@$DOKKU_DOMAIN:$TEST_APP" dockerfile_callback
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  local previous_image
+  previous_image="$(docker container inspect "$TEST_APP.web.1" --format '{{.Image}}')"
+  [[ -n "$previous_image" ]]
+
+  run failing_check_callback "$TEST_APP" "$CUSTOM_TMP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run git -C "$CUSTOM_TMP" add app.json
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run git -C "$CUSTOM_TMP" commit -m 'Add a failing healthcheck'
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run git -C "$CUSTOM_TMP" push target master:master
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Retagging old image $previous_image as dokku/$TEST_APP:latest"
+
+  run /bin/bash -c "docker image inspect dokku/$TEST_APP:latest --format '{{.Id}}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "$previous_image"
+
+  sleep 3
+
+  run /bin/bash -c "dokku ps:retire"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "docker image inspect dokku/$TEST_APP:latest --format '{{.Id}}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "$previous_image"
+
+  run /bin/bash -c "dokku ps:restart $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "docker container inspect $TEST_APP.web.1 --format '{{.Image}}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "$previous_image"
+
+  rm -rf "$CUSTOM_TMP"
+}
+
+@test "(scheduler-docker-local) retire keeps image tagged as the app latest" {
+  local CUSTOM_TMP=$(mktemp -d "/tmp/${DOKKU_DOMAIN}.XXXXX")
+  trap 'popd &>/dev/null || true; rm -rf "$CUSTOM_TMP"' INT TERM
+
+  run create_app
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku checks:set $TEST_APP wait-to-retire 1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  rmdir "$CUSTOM_TMP"
+  cp -r "${BATS_TEST_DIRNAME}/../../tests/apps/python" "$CUSTOM_TMP"
+  dockerfile_callback "$TEST_APP" "$CUSTOM_TMP"
+  failing_check_callback "$TEST_APP" "$CUSTOM_TMP"
+
+  run git -C "$CUSTOM_TMP" init -b master
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run git -C "$CUSTOM_TMP" config user.email "robot@example.com"
+  assert_success
+  run git -C "$CUSTOM_TMP" config user.name "Test Robot"
+  assert_success
+  run git -C "$CUSTOM_TMP" remote add target "dokku@$DOKKU_DOMAIN:$TEST_APP"
+  assert_success
+
+  run git -C "$CUSTOM_TMP" add .
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run git -C "$CUSTOM_TMP" commit -m 'initial commit'
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run git -C "$CUSTOM_TMP" push target master:master
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  local failed_image
+  failed_image="$(docker image inspect "dokku/$TEST_APP:latest" --format '{{.Id}}')"
+  [[ -n "$failed_image" ]]
+
+  sleep 3
+
+  run /bin/bash -c "dokku ps:retire"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "is the current image for $TEST_APP, skipping rm"
+
+  run /bin/bash -c "docker image inspect dokku/$TEST_APP:latest --format '{{.Id}}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "$failed_image"
+
+  rm -rf "$CUSTOM_TMP"
+}
+
+quoted_procfile_callback() {
+  local APP="$1"
+  local APP_REPO_DIR="$2"
+  mv "$APP_REPO_DIR/dockerfile.Dockerfile" "$APP_REPO_DIR/Dockerfile"
+  cat >"$APP_REPO_DIR/Procfile" <<'PROCFILE'
+web: python3 -u web.py "double quoted" 'single quoted' "escaped \"quote\"" literal\`tick\` "$PORT"
+args: python3 -c "import sys; print(sys.argv[1:])" "double quoted" 'single quoted' "escaped \"quote\"" literal\`tick\` "$PORT"
+PROCFILE
+}
+
+operator_procfile_callback() {
+  local APP="$1"
+  local APP_REPO_DIR="$2"
+  mv "$APP_REPO_DIR/dockerfile.Dockerfile" "$APP_REPO_DIR/Dockerfile"
+  cat >"$APP_REPO_DIR/Procfile" <<'PROCFILE'
+web: python3 -u web.py && echo done
+PROCFILE
+}
+
+stop_retire_timer() {
+  declare desc="stops the dokku-retire timer so only the test runs ps:retire"
+  if systemctl is-active --quiet dokku-retire.timer 2>/dev/null; then
+    systemctl stop dokku-retire.timer
+    RETIRE_TIMER_STOPPED=true
+  fi
+}
+
+start_retire_timer() {
+  declare desc="starts the dokku-retire timer if stop_retire_timer stopped it"
+  if [[ "$RETIRE_TIMER_STOPPED" == "true" ]]; then
+    systemctl start dokku-retire.timer
+  fi
+}
+
+dockerfile_callback() {
+  local APP="$1"
+  local APP_REPO_DIR="$2"
+  mv "$APP_REPO_DIR/dockerfile.Dockerfile" "$APP_REPO_DIR/Dockerfile"
+}
+
+failing_check_callback() {
+  local APP="$1"
+  local APP_REPO_DIR="$2"
+  mv "$APP_REPO_DIR/app-failing-check.json" "$APP_REPO_DIR/app.json"
+}
diff --git a/tests/unit/scheduler-k3s-annotations.bats b/tests/unit/scheduler-k3s-annotations.bats
index 8ff04b1a3..78c840d4c 100644
--- a/tests/unit/scheduler-k3s-annotations.bats
+++ b/tests/unit/scheduler-k3s-annotations.bats
@@ -10,10 +10,8 @@ setup() {
 teardown() {
   dokku --force apps:destroy $TEST_APP >/dev/null 2>/dev/null || true
   dokku --force apps:destroy ${TEST_APP}-2 >/dev/null 2>/dev/null || true
-  for resource in deployment service pod cronjob job secret ingress serviceaccount; do
-    dokku scheduler-k3s:annotations:set --global --resource-type "$resource" foo "" >/dev/null 2>/dev/null || true
-    dokku scheduler-k3s:annotations:set --global --resource-type "$resource" bar "" >/dev/null 2>/dev/null || true
-  done
+  dokku scheduler-k3s:annotations:clear --global >/dev/null 2>/dev/null || true
+  dokku scheduler-k3s:node-sysctls:clear --global >/dev/null 2>/dev/null || true
   global_teardown
 }
 
@@ -113,3 +111,166 @@ teardown() {
   assert_failure
   assert_output_contains "Invalid flag passed"
 }
+
+@test "(scheduler-k3s:annotations:set) --replace writes the declared map in one call" {
+  run /bin/bash -c "dokku scheduler-k3s:annotations:set $TEST_APP --resource-type deployment keep old-value"
+  assert_success
+  run /bin/bash -c "dokku scheduler-k3s:annotations:set $TEST_APP --resource-type deployment drop dropped-value"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:set --replace $TEST_APP --resource-type deployment keep=new-value add=added-value"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:report $TEST_APP --format json | jq -r 'keys | sort | join(\",\")'"
+  assert_success
+  assert_output "global.deployment.add,global.deployment.keep"
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:report $TEST_APP --format json | jq -r '.\"global.deployment.keep\"'"
+  assert_success
+  assert_output "new-value"
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:set --replace $TEST_APP --resource-type deployment --process-type web scoped=scoped-value"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:report $TEST_APP --format json | jq -r 'keys | sort | join(\",\")'"
+  assert_success
+  assert_output "global.deployment.add,global.deployment.keep,web.deployment.scoped"
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:set --replace --global --resource-type deployment global-key=global-value"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:report --global --format json | jq -r '.\"global.deployment.global-key\"'"
+  assert_success
+  assert_output "global-value"
+}
+
+@test "(scheduler-k3s:annotations:set) --replace stores empty values and rejects malformed pair lists" {
+  run /bin/bash -c "dokku scheduler-k3s:annotations:set --replace $TEST_APP --resource-type deployment empty="
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:report $TEST_APP --format json | jq -r '.\"global.deployment.empty\"'"
+  assert_success
+  assert_output ""
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:set --replace $TEST_APP --resource-type deployment"
+  assert_failure
+  assert_output_contains "Must specify at least one key=value pair, use scheduler-k3s:annotations:clear to remove all annotations"
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:set --replace $TEST_APP --resource-type deployment nodelimiter"
+  assert_failure
+  assert_output_contains "Invalid key=value pair: nodelimiter"
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:set --replace $TEST_APP --resource-type deployment foo=bar foo=qux"
+  assert_failure
+  assert_output_contains "Duplicate key specified: foo"
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:report $TEST_APP --format json | jq -r 'keys | sort | join(\",\")'"
+  assert_success
+  assert_output "global.deployment.empty"
+}
+
+@test "(scheduler-k3s:annotations:set) rejects an unknown resource-type and a missing app" {
+  run /bin/bash -c "dokku scheduler-k3s:annotations:set $TEST_APP --resource-type deploymnet foo bar"
+  assert_failure
+  assert_output_contains "Invalid resource-type specified, valid resource types include:"
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:set --replace $TEST_APP --resource-type deploymnet foo=bar"
+  assert_failure
+  assert_output_contains "Invalid resource-type specified, valid resource types include:"
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:set ${TEST_APP}-missing --resource-type deployment foo bar"
+  assert_failure
+  assert_output_contains "App ${TEST_APP}-missing does not exist"
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:set --replace ${TEST_APP}-missing --resource-type deployment foo=bar"
+  assert_failure
+  assert_output_contains "App ${TEST_APP}-missing does not exist"
+}
+
+@test "(scheduler-k3s:annotations:clear) removes annotations, honouring filters" {
+  run /bin/bash -c "dokku scheduler-k3s:annotations:set $TEST_APP --resource-type deployment foo bar"
+  assert_success
+  run /bin/bash -c "dokku scheduler-k3s:annotations:set $TEST_APP --process-type web --resource-type deployment baz qux"
+  assert_success
+  run /bin/bash -c "dokku scheduler-k3s:annotations:set $TEST_APP --resource-type service alpha beta"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:clear $TEST_APP --process-type web"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:report $TEST_APP --format json | jq -r 'keys | sort | join(\",\")'"
+  assert_success
+  assert_output "global.deployment.foo,global.service.alpha"
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:clear $TEST_APP --resource-type service"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:report $TEST_APP --format json | jq -r 'keys | sort | join(\",\")'"
+  assert_success
+  assert_output "global.deployment.foo"
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:clear $TEST_APP"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:report $TEST_APP --format json"
+  assert_success
+  assert_output "{}"
+}
+
+@test "(scheduler-k3s:annotations:clear) leaves neighbouring scheduler-k3s properties alone" {
+  run /bin/bash -c "dokku scheduler-k3s:set $TEST_APP deploy-timeout 300s"
+  assert_success
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:set --global vm.max_map_count 262144"
+  assert_success
+  run /bin/bash -c "dokku scheduler-k3s:autoscaling-auth:set $TEST_APP datadog --metadata apiKey=secret-1"
+  assert_success
+  run /bin/bash -c "dokku scheduler-k3s:annotations:set $TEST_APP --resource-type deployment foo bar"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:clear $TEST_APP"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:report $TEST_APP --format json"
+  assert_success
+  assert_output "{}"
+
+  run /bin/bash -c "dokku --quiet scheduler-k3s:report $TEST_APP --scheduler-k3s-deploy-timeout"
+  assert_success
+  assert_output "300s"
+
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:report --format json | jq -r '.\"--global\".\"vm.max_map_count\"'"
+  assert_success
+  assert_output "262144"
+
+  run /bin/bash -c "dokku scheduler-k3s:autoscaling-auth:report $TEST_APP --format json | jq -r '.\"datadog.apiKey\"'"
+  assert_success
+  assert_output "secret-1"
+}
+
+@test "(scheduler-k3s:annotations:clear) supports --global and requires an app" {
+  run /bin/bash -c "dokku scheduler-k3s:annotations:set --global --resource-type deployment foo global-val"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:clear"
+  assert_failure
+  assert_output_contains "Please specify an app to run the command on"
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:clear ${TEST_APP}-missing"
+  assert_failure
+  assert_output_contains "App ${TEST_APP}-missing does not exist"
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:clear $TEST_APP --resource-type deploymnet"
+  assert_failure
+  assert_output_contains "Invalid resource-type specified, valid resource types include:"
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:report --global --format json | jq -r '.\"global.deployment.foo\"'"
+  assert_success
+  assert_output "global-val"
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:clear --global"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:annotations:report --global --format json"
+  assert_success
+  assert_output "{}"
+}
diff --git a/tests/unit/scheduler-k3s-autoscaling-auth.bats b/tests/unit/scheduler-k3s-autoscaling-auth.bats
index 3b3428962..6f8bf0255 100644
--- a/tests/unit/scheduler-k3s-autoscaling-auth.bats
+++ b/tests/unit/scheduler-k3s-autoscaling-auth.bats
@@ -149,3 +149,44 @@ teardown() {
   assert_failure
   assert_output_contains "Invalid flag passed"
 }
+
+@test "(scheduler-k3s:autoscaling-auth:set) --replace drops metadata keys not named" {
+  run /bin/bash -c "dokku scheduler-k3s:autoscaling-auth:set $TEST_APP datadog --metadata apiKey=secret-1 --metadata appKey=secret-2 --metadata datadogSite=us5.datadoghq.com"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:autoscaling-auth:set $TEST_APP datadog --metadata apiKey=secret-3"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:autoscaling-auth:report $TEST_APP --format json | jq -r 'keys | sort | join(\",\")'"
+  assert_success
+  assert_output "datadog.apiKey,datadog.appKey,datadog.datadogSite"
+
+  run /bin/bash -c "dokku scheduler-k3s:autoscaling-auth:set --replace $TEST_APP datadog --metadata apiKey=secret-4"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:autoscaling-auth:report $TEST_APP --format json | jq -r 'keys | sort | join(\",\")'"
+  assert_success
+  assert_output "datadog.apiKey"
+
+  run /bin/bash -c "dokku scheduler-k3s:autoscaling-auth:report $TEST_APP --format json | jq -r '.\"datadog.apiKey\"'"
+  assert_success
+  assert_output "secret-4"
+}
+
+@test "(scheduler-k3s:autoscaling-auth:set) --replace requires metadata and leaves other triggers alone" {
+  run /bin/bash -c "dokku scheduler-k3s:autoscaling-auth:set $TEST_APP datadog --metadata apiKey=secret-1"
+  assert_success
+  run /bin/bash -c "dokku scheduler-k3s:autoscaling-auth:set $TEST_APP memory --metadata some-key=some-value"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:autoscaling-auth:set --replace $TEST_APP datadog"
+  assert_failure
+  assert_output_contains "Must specify at least one --metadata flag, omit --replace to remove all metadata for the trigger"
+
+  run /bin/bash -c "dokku scheduler-k3s:autoscaling-auth:set --replace $TEST_APP datadog --metadata appKey=secret-2"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:autoscaling-auth:report $TEST_APP --format json | jq -r 'keys | sort | join(\",\")'"
+  assert_success
+  assert_output "datadog.appKey,memory.some-key"
+}
diff --git a/tests/unit/scheduler-k3s-charts-1.bats b/tests/unit/scheduler-k3s-charts-1.bats
index a15c2326b..2e00bfaf6 100644
--- a/tests/unit/scheduler-k3s-charts-1.bats
+++ b/tests/unit/scheduler-k3s-charts-1.bats
@@ -7,9 +7,8 @@ setup() {
 }
 
 teardown() {
-  dokku scheduler-k3s:charts:set cert-manager.installCRDs >/dev/null 2>/dev/null || true
-  dokku scheduler-k3s:charts:set cert-manager.version >/dev/null 2>/dev/null || true
-  dokku scheduler-k3s:charts:set traefik.replicas >/dev/null 2>/dev/null || true
+  dokku scheduler-k3s:charts:clear cert-manager >/dev/null 2>/dev/null || true
+  dokku scheduler-k3s:charts:clear traefik >/dev/null 2>/dev/null || true
   global_teardown
 }
 
diff --git a/tests/unit/scheduler-k3s-charts-2.bats b/tests/unit/scheduler-k3s-charts-2.bats
index e56f3ea4a..f6dc8a845 100644
--- a/tests/unit/scheduler-k3s-charts-2.bats
+++ b/tests/unit/scheduler-k3s-charts-2.bats
@@ -7,9 +7,8 @@ setup() {
 }
 
 teardown() {
-  dokku scheduler-k3s:charts:set traefik.service.annotations.prometheus.io/scrape >/dev/null 2>/dev/null || true
-  dokku scheduler-k3s:charts:set traefik.controller.config >/dev/null 2>/dev/null || true
-  dokku scheduler-k3s:charts:set cert-manager.installCRDs >/dev/null 2>/dev/null || true
+  dokku scheduler-k3s:charts:clear cert-manager >/dev/null 2>/dev/null || true
+  dokku scheduler-k3s:charts:clear traefik >/dev/null 2>/dev/null || true
   global_teardown
 }
 
diff --git a/tests/unit/scheduler-k3s-charts-3.bats b/tests/unit/scheduler-k3s-charts-3.bats
new file mode 100644
index 000000000..f7749622b
--- /dev/null
+++ b/tests/unit/scheduler-k3s-charts-3.bats
@@ -0,0 +1,99 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+  global_setup
+}
+
+teardown() {
+  dokku scheduler-k3s:charts:clear cert-manager >/dev/null 2>/dev/null || true
+  dokku scheduler-k3s:charts:clear traefik >/dev/null 2>/dev/null || true
+  global_teardown
+}
+
+@test "(scheduler-k3s:charts:set) --replace writes the declared map in one call" {
+  run /bin/bash -c "dokku scheduler-k3s:charts:set traefik.replicas 2"
+  assert_success
+  run /bin/bash -c "dokku scheduler-k3s:charts:set traefik.foo bar"
+  assert_success
+  run /bin/bash -c "dokku scheduler-k3s:charts:set cert-manager.installCRDs false"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:charts:set --replace traefik replicas=3 service.annotations.prometheus.io/scrape=true opt=a=b empty="
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:charts:report traefik --format json | jq -c -S ."
+  assert_success
+  assert_output '{"traefik.empty":"","traefik.opt":"a=b","traefik.replicas":"3","traefik.service.annotations.prometheus.io/scrape":"true"}'
+
+  run /bin/bash -c "dokku scheduler-k3s:charts:report cert-manager --format json | jq -c -S ."
+  assert_success
+  assert_output '{"cert-manager.installCRDs":"false"}'
+}
+
+@test "(scheduler-k3s:charts:set) --replace rejects invalid input without writing" {
+  run /bin/bash -c "dokku scheduler-k3s:charts:set traefik.replicas 2"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:charts:set --replace"
+  assert_failure
+  assert_output_contains "Missing chart name"
+
+  run /bin/bash -c "dokku scheduler-k3s:charts:set --replace not-a-chart replicas=3"
+  assert_failure
+  assert_output_contains "Invalid chart name"
+
+  run /bin/bash -c "dokku scheduler-k3s:charts:set --replace replicas=3"
+  assert_failure
+  assert_output_contains "Invalid chart name"
+
+  run /bin/bash -c "dokku scheduler-k3s:charts:set --replace traefik"
+  assert_failure
+  assert_output_contains "scheduler-k3s:charts:clear"
+
+  run /bin/bash -c "dokku scheduler-k3s:charts:set --replace traefik replicas=3 malformed"
+  assert_failure
+  assert_output_contains "Invalid key=value pair: malformed"
+
+  run /bin/bash -c "dokku scheduler-k3s:charts:set --replace traefik replicas=3 =3"
+  assert_failure
+  assert_output_contains "Invalid key=value pair: =3"
+
+  run /bin/bash -c "dokku scheduler-k3s:charts:set --replace traefik replicas=3 replicas=4"
+  assert_failure
+  assert_output_contains "Duplicate key specified: replicas"
+
+  run /bin/bash -c "dokku scheduler-k3s:charts:report traefik --format json | jq -c -S ."
+  assert_success
+  assert_output '{"traefik.replicas":"2"}'
+}
+
+@test "(scheduler-k3s:charts:clear) removes every override for a chart" {
+  run /bin/bash -c "dokku scheduler-k3s:charts:set --replace traefik replicas=2 foo=bar"
+  assert_success
+  run /bin/bash -c "dokku scheduler-k3s:charts:set cert-manager.installCRDs false"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:charts:clear traefik"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:charts:report traefik --format json"
+  assert_success
+  assert_output "{}"
+
+  run /bin/bash -c "dokku scheduler-k3s:charts:report cert-manager --format json | jq -c -S ."
+  assert_success
+  assert_output '{"cert-manager.installCRDs":"false"}'
+
+  run /bin/bash -c "dokku scheduler-k3s:charts:clear traefik"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:charts:clear"
+  assert_failure
+  assert_output_contains "Missing chart name"
+
+  run /bin/bash -c "dokku scheduler-k3s:charts:clear not-a-chart"
+  assert_failure
+  assert_output_contains "Invalid chart name"
+}
diff --git a/tests/unit/scheduler-k3s-dockerfile.bats b/tests/unit/scheduler-k3s-dockerfile.bats
index 83636ce6f..eb8fdf1da 100644
--- a/tests/unit/scheduler-k3s-dockerfile.bats
+++ b/tests/unit/scheduler-k3s-dockerfile.bats
@@ -156,6 +156,34 @@ teardown() {
   assert_output_contains "SECRET_KEY=fjdkslafjdk"
 }
 
+@test "(scheduler-k3s) dockerfile dokku run propagates the command exit code" {
+  if [[ -z "$DOCKERHUB_USERNAME" ]] || [[ -z "$DOCKERHUB_TOKEN" ]]; then
+    skip "skipping due to missing docker.io credentials DOCKERHUB_USERNAME:DOCKERHUB_TOKEN"
+  fi
+
+  INGRESS_CLASS=nginx install_k3s
+
+  run /bin/bash -c "dokku apps:create $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app dockerfile-procfile dokku@$DOKKU_DOMAIN:$TEST_APP
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku --quiet run $TEST_APP sh -c 'exit 3'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_exit_status 3
+
+  run /bin/bash -c "dokku --quiet run $TEST_APP sh -c 'exit 0'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+}
+
 @test "(scheduler-k3s) dockerfile dokku run resolves Procfile key" {
   if [[ -z "$DOCKERHUB_USERNAME" ]] || [[ -z "$DOCKERHUB_TOKEN" ]]; then
     skip "skipping due to missing docker.io credentials DOCKERHUB_USERNAME:DOCKERHUB_TOKEN"
diff --git a/tests/unit/scheduler-k3s-ensure-charts.bats b/tests/unit/scheduler-k3s-ensure-charts.bats
new file mode 100644
index 000000000..3b3169e58
--- /dev/null
+++ b/tests/unit/scheduler-k3s-ensure-charts.bats
@@ -0,0 +1,65 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+  uninstall_k3s || true
+  global_setup
+  dokku nginx:stop
+  export KUBECONFIG="/etc/rancher/k3s/k3s.yaml"
+}
+
+teardown() {
+  global_teardown
+  dokku nginx:start
+  uninstall_k3s || true
+}
+
+@test "(scheduler-k3s:ensure-charts) upgrades an existing release to the pinned chart version" {
+  if [[ -z "$DOCKERHUB_USERNAME" ]] || [[ -z "$DOCKERHUB_TOKEN" ]]; then
+    skip "skipping due to missing docker.io credentials DOCKERHUB_USERNAME:DOCKERHUB_TOKEN"
+  fi
+
+  install_k3s
+
+  run /bin/bash -c "helm list -n traefik -o json | jq -r '.[] | select(.name == \"traefik\") | .chart'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "traefik-26.0.0"
+
+  run /bin/bash -c "helm list -n traefik -o json | jq -r '.[] | select(.name == \"traefik\") | .revision'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  local initial_revision="$output"
+
+  run /bin/bash -c "dokku scheduler-k3s:ensure-charts --charts traefik"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "helm list -n traefik -o json | jq -r '.[] | select(.name == \"traefik\") | .chart'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "traefik-26.0.0"
+
+  run /bin/bash -c "helm list -n traefik -o json | jq -r '.[] | select(.name == \"traefik\") | .revision'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  local upgraded_revision="$output"
+  [[ "$upgraded_revision" -gt "$initial_revision" ]]
+
+  run /bin/bash -c "dokku scheduler-k3s:ensure-charts"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "helm list -n traefik -o json | jq -r '.[] | select(.name == \"traefik\") | .revision'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "$upgraded_revision"
+}
diff --git a/tests/unit/scheduler-k3s-kustomize.bats b/tests/unit/scheduler-k3s-kustomize.bats
new file mode 100644
index 000000000..ba2e8bb70
--- /dev/null
+++ b/tests/unit/scheduler-k3s-kustomize.bats
@@ -0,0 +1,88 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+  global_setup
+  create_app
+}
+
+teardown() {
+  destroy_app
+  global_teardown
+}
+
+@test "(scheduler-k3s) [kustomize] deploy removes a stale non-empty kustomization directory" {
+  local DATA_DIR="/var/lib/dokku/data/scheduler-k3s/$TEST_APP"
+  mkdir -p "$DATA_DIR/kustomization.99999999"
+  echo "kind: Kustomization" >"$DATA_DIR/kustomization.99999999/kustomization.yaml"
+  chown -R dokku:dokku "$DATA_DIR"
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "find $DATA_DIR -maxdepth 1 -name 'kustomization.*'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_not_exists
+}
+
+@test "(scheduler-k3s) [kustomize] deploy removes the stored kustomization when the repo no longer has one" {
+  local DATA_DIR="/var/lib/dokku/data/scheduler-k3s/$TEST_APP"
+  local CUSTOM_TMP=$(mktemp -d "/tmp/${DOKKU_DOMAIN}.XXXXX")
+  trap 'popd &>/dev/null || true; rm -rf "$CUSTOM_TMP"' INT TERM
+
+  CUSTOM_TMP="$CUSTOM_TMP" run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP inject_kustomization_yaml
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "test -f $DATA_DIR/kustomization/kustomization.yaml"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run git -C "$CUSTOM_TMP" rm -r config/kustomize
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run git -C "$CUSTOM_TMP" commit -m 'Remove kustomization'
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run git -C "$CUSTOM_TMP" push target master:master
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "test -e $DATA_DIR/kustomization"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "find $DATA_DIR -maxdepth 1 -name 'kustomization.*'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_not_exists
+
+  rm -rf "$CUSTOM_TMP"
+}
+
+inject_kustomization_yaml() {
+  local APP="$1"
+  local APP_REPO_DIR="$2"
+  [[ -z "$APP" ]] && local APP="$TEST_APP"
+  mkdir -p "$APP_REPO_DIR/config/kustomize"
+  cat <<EOF >"$APP_REPO_DIR/config/kustomize/kustomization.yaml"
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- rendered.yaml
+EOF
+}
diff --git a/tests/unit/scheduler-k3s-labels.bats b/tests/unit/scheduler-k3s-labels.bats
index ae007b45c..165540d4d 100644
--- a/tests/unit/scheduler-k3s-labels.bats
+++ b/tests/unit/scheduler-k3s-labels.bats
@@ -10,10 +10,7 @@ setup() {
 teardown() {
   dokku --force apps:destroy $TEST_APP >/dev/null 2>/dev/null || true
   dokku --force apps:destroy ${TEST_APP}-2 >/dev/null 2>/dev/null || true
-  for resource in deployment service pod cronjob job secret ingress serviceaccount; do
-    dokku scheduler-k3s:labels:set --global --resource-type "$resource" foo "" >/dev/null 2>/dev/null || true
-    dokku scheduler-k3s:labels:set --global --resource-type "$resource" bar "" >/dev/null 2>/dev/null || true
-  done
+  dokku scheduler-k3s:labels:clear --global >/dev/null 2>/dev/null || true
   global_teardown
 }
 
@@ -113,3 +110,136 @@ teardown() {
   assert_failure
   assert_output_contains "Invalid flag passed"
 }
+
+@test "(scheduler-k3s:labels:set) --replace writes the declared map in one call" {
+  run /bin/bash -c "dokku scheduler-k3s:labels:set $TEST_APP --resource-type deployment keep old-value"
+  assert_success
+  run /bin/bash -c "dokku scheduler-k3s:labels:set $TEST_APP --resource-type deployment drop dropped-value"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:set --replace $TEST_APP --resource-type deployment keep=new-value add=added-value"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:report $TEST_APP --format json | jq -r 'keys | sort | join(\",\")'"
+  assert_success
+  assert_output "global.deployment.add,global.deployment.keep"
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:report $TEST_APP --format json | jq -r '.\"global.deployment.keep\"'"
+  assert_success
+  assert_output "new-value"
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:set --replace $TEST_APP --resource-type deployment --process-type web scoped=scoped-value"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:report $TEST_APP --format json | jq -r 'keys | sort | join(\",\")'"
+  assert_success
+  assert_output "global.deployment.add,global.deployment.keep,web.deployment.scoped"
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:set --replace --global --resource-type deployment global-key=global-value"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:report --global --format json | jq -r '.\"global.deployment.global-key\"'"
+  assert_success
+  assert_output "global-value"
+}
+
+@test "(scheduler-k3s:labels:set) --replace stores empty values and rejects malformed pair lists" {
+  run /bin/bash -c "dokku scheduler-k3s:labels:set --replace $TEST_APP --resource-type deployment empty="
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:report $TEST_APP --format json | jq -r '.\"global.deployment.empty\"'"
+  assert_success
+  assert_output ""
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:set --replace $TEST_APP --resource-type deployment"
+  assert_failure
+  assert_output_contains "Must specify at least one key=value pair, use scheduler-k3s:labels:clear to remove all labels"
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:set --replace $TEST_APP --resource-type deployment nodelimiter"
+  assert_failure
+  assert_output_contains "Invalid key=value pair: nodelimiter"
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:set --replace $TEST_APP --resource-type deployment foo=bar foo=qux"
+  assert_failure
+  assert_output_contains "Duplicate key specified: foo"
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:report $TEST_APP --format json | jq -r 'keys | sort | join(\",\")'"
+  assert_success
+  assert_output "global.deployment.empty"
+}
+
+@test "(scheduler-k3s:labels:set) rejects an unknown resource-type and a missing app" {
+  run /bin/bash -c "dokku scheduler-k3s:labels:set $TEST_APP --resource-type deploymnet foo bar"
+  assert_failure
+  assert_output_contains "Invalid resource-type specified, valid resource types include:"
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:set --replace $TEST_APP --resource-type deploymnet foo=bar"
+  assert_failure
+  assert_output_contains "Invalid resource-type specified, valid resource types include:"
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:set ${TEST_APP}-missing --resource-type deployment foo bar"
+  assert_failure
+  assert_output_contains "App ${TEST_APP}-missing does not exist"
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:set --replace ${TEST_APP}-missing --resource-type deployment foo=bar"
+  assert_failure
+  assert_output_contains "App ${TEST_APP}-missing does not exist"
+}
+
+@test "(scheduler-k3s:labels:clear) removes labels, honouring filters" {
+  run /bin/bash -c "dokku scheduler-k3s:labels:set $TEST_APP --resource-type deployment foo bar"
+  assert_success
+  run /bin/bash -c "dokku scheduler-k3s:labels:set $TEST_APP --process-type web --resource-type deployment baz qux"
+  assert_success
+  run /bin/bash -c "dokku scheduler-k3s:labels:set $TEST_APP --resource-type service alpha beta"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:clear $TEST_APP --process-type web"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:report $TEST_APP --format json | jq -r 'keys | sort | join(\",\")'"
+  assert_success
+  assert_output "global.deployment.foo,global.service.alpha"
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:clear $TEST_APP --resource-type service"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:report $TEST_APP --format json | jq -r 'keys | sort | join(\",\")'"
+  assert_success
+  assert_output "global.deployment.foo"
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:clear $TEST_APP"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:report $TEST_APP --format json"
+  assert_success
+  assert_output "{}"
+}
+
+@test "(scheduler-k3s:labels:clear) supports --global and requires an app" {
+  run /bin/bash -c "dokku scheduler-k3s:labels:set --global --resource-type deployment foo global-val"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:clear"
+  assert_failure
+  assert_output_contains "Please specify an app to run the command on"
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:clear ${TEST_APP}-missing"
+  assert_failure
+  assert_output_contains "App ${TEST_APP}-missing does not exist"
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:clear $TEST_APP --resource-type deploymnet"
+  assert_failure
+  assert_output_contains "Invalid resource-type specified, valid resource types include:"
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:report --global --format json | jq -r '.\"global.deployment.foo\"'"
+  assert_success
+  assert_output "global-val"
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:clear --global"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:labels:report --global --format json"
+  assert_success
+  assert_output "{}"
+}
diff --git a/tests/unit/scheduler-k3s-node-sysctls-2.bats b/tests/unit/scheduler-k3s-node-sysctls-2.bats
new file mode 100644
index 000000000..fd2e745d6
--- /dev/null
+++ b/tests/unit/scheduler-k3s-node-sysctls-2.bats
@@ -0,0 +1,91 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+  global_setup
+}
+
+teardown() {
+  dokku scheduler-k3s:node-sysctls:clear --global >/dev/null 2>/dev/null || true
+  dokku scheduler-k3s:node-sysctls:clear --profile edge-workers >/dev/null 2>/dev/null || true
+  dokku scheduler-k3s:profiles:remove edge-workers >/dev/null 2>/dev/null || true
+  global_teardown
+}
+
+@test "(scheduler-k3s:node-sysctls:report) --stored returns only the map each scope owns" {
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:set --replace --global vm.overcommit_memory=1 vm.swappiness=20"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:profiles:add edge-workers --role worker"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:set --replace --profile edge-workers vm.swappiness=60"
+  assert_success
+
+  # the resolved set a profile's daemonset applies carries the global sysctls underneath its own
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:report --format json | jq -r '.\"edge-workers\" | to_entries | sort_by(.key) | map(\"\(.key)=\(.value)\") | join(\",\")'"
+  assert_success
+  assert_output "vm.overcommit_memory=1,vm.swappiness=60"
+
+  # the stored map holds only what the profile itself was set to
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:report --stored --format json | jq -r '.\"edge-workers\" | to_entries | sort_by(.key) | map(\"\(.key)=\(.value)\") | join(\",\")'"
+  assert_success
+  assert_output "vm.swappiness=60"
+
+  # the global scope stores exactly what it applies
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:report --stored --format json | jq -r '.\"--global\" | to_entries | sort_by(.key) | map(\"\(.key)=\(.value)\") | join(\",\")'"
+  assert_success
+  assert_output "vm.overcommit_memory=1,vm.swappiness=20"
+
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:report --stored --global --format json | jq -rS '.'"
+  assert_success
+  stored_global="$output"
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:report --global --format json | jq -rS '.'"
+  assert_success
+  assert_output "$stored_global"
+
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:report --stored --profile edge-workers --format json | jq -rS 'keys | join(\",\")'"
+  assert_success
+  assert_output "edge-workers"
+
+  # the stdout renderer honours both flags too
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:report --stored --profile edge-workers"
+  assert_success
+  assert_output_contains "edge-workers"
+  assert_output_not_contains "vm.overcommit_memory"
+
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:clear --profile edge-workers"
+  assert_success
+
+  # a cleared profile keeps inheriting the global sysctls, so only the stored map converges
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:report --format json | jq -r '.\"edge-workers\" | length'"
+  assert_success
+  assert_output "2"
+
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:report --stored --profile edge-workers --format json | jq -r '.\"edge-workers\" | length'"
+  assert_success
+  assert_output "0"
+
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:report --stored --profile edge-workers"
+  assert_success
+  assert_output_not_contains "vm.overcommit_memory"
+  assert_output_not_contains "vm.swappiness"
+}
+
+@test "(scheduler-k3s:node-sysctls:report) rejects conflicting and unknown scopes" {
+  run /bin/bash -c "dokku scheduler-k3s:profiles:add edge-workers --role worker"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:report --global --profile edge-workers"
+  assert_failure
+  assert_output_contains "Only one of --global and --profile may be specified"
+
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:report --profile missing-profile"
+  assert_failure
+  assert_output_contains "Node profile missing-profile not found"
+
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:report --stored --format bogus"
+  assert_failure
+  assert_output_contains "Invalid format: bogus"
+}
diff --git a/tests/unit/scheduler-k3s-node-sysctls.bats b/tests/unit/scheduler-k3s-node-sysctls.bats
new file mode 100644
index 000000000..9cd5f154d
--- /dev/null
+++ b/tests/unit/scheduler-k3s-node-sysctls.bats
@@ -0,0 +1,87 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+  global_setup
+}
+
+teardown() {
+  dokku scheduler-k3s:node-sysctls:clear --global >/dev/null 2>/dev/null || true
+  dokku scheduler-k3s:node-sysctls:clear --profile edge-workers >/dev/null 2>/dev/null || true
+  dokku scheduler-k3s:profiles:remove edge-workers >/dev/null 2>/dev/null || true
+  global_teardown
+}
+
+@test "(scheduler-k3s:node-sysctls:set) --replace writes the declared map in one call" {
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:set --global vm.max_map_count 262144"
+  assert_success
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:set --global vm.swappiness 10"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:set --replace --global vm.swappiness=20 vm.overcommit_memory=1"
+  assert_success
+  assert_output_contains "Removing vm.max_map_count stops dokku managing it"
+
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:report --format json | jq -r '.\"--global\" | keys | sort | join(\",\")'"
+  assert_success
+  assert_output "vm.overcommit_memory,vm.swappiness"
+
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:report --format json | jq -r '.\"--global\".\"vm.swappiness\"'"
+  assert_success
+  assert_output "20"
+
+  run /bin/bash -c "dokku scheduler-k3s:profiles:add edge-workers --role worker"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:set --replace --profile edge-workers vm.swappiness=60"
+  assert_success
+
+  # a profile scope inherits the global sysctls and overrides them on conflict
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:report --format json | jq -r '.\"edge-workers\" | to_entries | sort_by(.key) | map(\"\(.key)=\(.value)\") | join(\",\")'"
+  assert_success
+  assert_output "vm.overcommit_memory=1,vm.swappiness=60"
+}
+
+@test "(scheduler-k3s:node-sysctls:set) --replace rejects malformed pair lists without writing" {
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:set --global vm.max_map_count 262144"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:set --replace --global"
+  assert_failure
+  assert_output_contains "Must specify at least one key=value pair, use scheduler-k3s:node-sysctls:clear to remove all sysctls"
+
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:set --replace --global nodelimiter"
+  assert_failure
+  assert_output_contains "Invalid key=value pair: nodelimiter"
+
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:set --replace --global vm.swappiness=10 vm.swappiness=20"
+  assert_failure
+  assert_output_contains "Duplicate key specified: vm.swappiness"
+
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:report --format json | jq -r '.\"--global\" | keys | join(\",\")'"
+  assert_success
+  assert_output "vm.max_map_count"
+}
+
+@test "(scheduler-k3s:node-sysctls:clear) removes every sysctl for a scope" {
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:set --replace --global vm.max_map_count=262144 vm.swappiness=10"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:clear --global --profile edge-workers"
+  assert_failure
+  assert_output_contains "Only one of --global and --profile may be specified"
+
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:clear --profile missing-profile"
+  assert_failure
+  assert_output_contains "Node profile missing-profile not found"
+
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:clear --global"
+  assert_success
+  assert_output_contains "Removing vm.max_map_count stops dokku managing it"
+  assert_output_contains "Removing vm.swappiness stops dokku managing it"
+
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:report --format json | jq -r '.\"--global\" | length'"
+  assert_success
+  assert_output "0"
+}
diff --git a/tests/unit/scheduler-k3s-profiles.bats b/tests/unit/scheduler-k3s-profiles.bats
new file mode 100644
index 000000000..1bf643f05
--- /dev/null
+++ b/tests/unit/scheduler-k3s-profiles.bats
@@ -0,0 +1,94 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+PROFILE_PROPERTY_PATH="/var/lib/dokku/config/scheduler-k3s/--global"
+
+setup() {
+  global_setup
+}
+
+teardown() {
+  rm -f "$PROFILE_PROPERTY_PATH"/node-profile-*.json || true
+  global_teardown
+}
+
+@test "(scheduler-k3s:profiles:add) rejects names that cannot derive a valid helm release name" {
+  run /bin/bash -c "dokku scheduler-k3s:profiles:add a-twenty-seven-char-profile --role worker"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Profile name is too long, must be at most 26 characters"
+
+  run /bin/bash -c "dokku scheduler-k3s:profiles:add EdgePool --role worker"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "must only contain lowercase alphanumeric characters"
+
+  run /bin/bash -c "dokku scheduler-k3s:profiles:list --format json | jq -r '. | length'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "0"
+}
+
+@test "(scheduler-k3s:profiles:add) accepts a name at the maximum length" {
+  run /bin/bash -c "dokku scheduler-k3s:profiles:add aaaaaaaaaaaaaaaaaaaaaaaaaa --role worker"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:profiles:list --format json | jq -r '.[0].name'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "aaaaaaaaaaaaaaaaaaaaaaaaaa"
+
+  run /bin/bash -c "dokku scheduler-k3s:profiles:remove aaaaaaaaaaaaaaaaaaaaaaaaaa"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:profiles:list --format json | jq -r '. | length'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "0"
+}
+
+@test "(scheduler-k3s:profiles:remove) removes a profile stored under a legacy name" {
+  seed_legacy_node_profile EdgePool
+
+  run /bin/bash -c "dokku scheduler-k3s:profiles:list --format json | jq -r '.[0].name'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "EdgePool"
+
+  run /bin/bash -c "dokku scheduler-k3s:node-sysctls:set --profile EdgePool vm.max_map_count 262144"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "cannot carry node sysctls"
+
+  run /bin/bash -c "dokku scheduler-k3s:profiles:remove EdgePool"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler-k3s:profiles:list --format json | jq -r '. | length'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "0"
+}
+
+seed_legacy_node_profile() {
+  declare desc="writes a node profile property under a name profiles:add no longer accepts"
+  declare PROFILE_NAME="$1"
+
+  mkdir -p "$PROFILE_PROPERTY_PATH"
+  echo "{\"name\":\"$PROFILE_NAME\",\"role\":\"worker\"}" >"$PROFILE_PROPERTY_PATH/node-profile-$PROFILE_NAME.json"
+  chown dokku:dokku "$PROFILE_PROPERTY_PATH/node-profile-$PROFILE_NAME.json"
+}
diff --git a/tests/unit/scheduler-k3s-report.bats b/tests/unit/scheduler-k3s-report.bats
index f70d6fd6c..76268eb2b 100644
--- a/tests/unit/scheduler-k3s-report.bats
+++ b/tests/unit/scheduler-k3s-report.bats
@@ -7,7 +7,7 @@ setup() {
 }
 
 teardown() {
-  for prop in cert-issuer-kind cert-issuer-name deploy-timeout image-pull-secrets ingress-class kubeconfig-path kube-context kustomize-root-path namespace network-interface rollback-on-failure shm-size token; do
+  for prop in cert-issuer-kind cert-issuer-name deploy-timeout image-pull-secrets ingress-class kubeconfig-path kube-context kustomize-root-path namespace network-interface node-sysctls-image node-sysctls-pause-image rollback-on-failure shm-size token; do
     dokku scheduler-k3s:set --global "$prop" >/dev/null 2>/dev/null || true
   done
   global_teardown
@@ -56,6 +56,8 @@ assert_k3s_global_unset_set() {
   assert_k3s_global_unset_set "network-interface" "eth0" "eth1"
   assert_k3s_global_unset_set "kubeconfig-path" "/etc/rancher/k3s/k3s.yaml" "/tmp/custom-kubeconfig.yaml"
   assert_k3s_global_unset_set "cert-issuer-kind" "ClusterIssuer" "Issuer"
+  assert_k3s_global_unset_set "node-sysctls-image" "busybox:1.36" "registry.internal/busybox:1.36"
+  assert_k3s_global_unset_set "node-sysctls-pause-image" "registry.k8s.io/pause:3.9" "registry.internal/pause:3.9"
 }
 
 @test "(scheduler-k3s:report --global) empty-default properties expose computed sibling" {
diff --git a/tests/unit/storage-1.bats b/tests/unit/storage-1.bats
index 1f702d95d..c1e04ac68 100644
--- a/tests/unit/storage-1.bats
+++ b/tests/unit/storage-1.bats
@@ -670,12 +670,14 @@ teardown() {
   assert_success
   assert_output "1"
 
-  # Property marker is set after a successful migration with mounts.
+  # Property marker is set after a successful migration with mounts. It
+  # carries the migration version rather than a bare "true" so an app
+  # migrated by an older release is rescanned once for process-scoped mounts.
   run /bin/bash -c "sudo test -f /var/lib/dokku/config/storage/$TEST_APP/legacy-mounts-migrated"
   assert_success
   run /bin/bash -c "sudo cat /var/lib/dokku/config/storage/$TEST_APP/legacy-mounts-migrated"
   assert_success
-  assert_output "true"
+  assert_output "2"
 
   # Cleanup: unmount + destroy the synthesized legacy entry. We need
   # the entry name from list-entries since legacy-<hash> is content-derived.
@@ -727,11 +729,13 @@ teardown() {
   echo "status: $status"
   assert_success
 
+  # The flag file drains into the property, which the version gate then
+  # treats as stale and advances to the current migration version.
   run /bin/bash -c "sudo test -f /var/lib/dokku/config/storage/$TEST_APP/legacy-mounts-migrated"
   assert_success
   run /bin/bash -c "sudo cat /var/lib/dokku/config/storage/$TEST_APP/legacy-mounts-migrated"
   assert_success
-  assert_output "true"
+  assert_output "2"
 
   run /bin/bash -c "sudo test -e $flag_dir/$TEST_APP"
   assert_failure
diff --git a/tests/unit/storage-2.bats b/tests/unit/storage-2.bats
index 5908732e1..94737bb78 100644
--- a/tests/unit/storage-2.bats
+++ b/tests/unit/storage-2.bats
@@ -842,3 +842,57 @@ teardown() {
   run /bin/bash -c "dokku storage:destroy rdmtest-set-annot --destroy-host-dir --force"
   assert_success
 }
+
+@test "(storage:mount) rejects k3s storage entry on docker-local app" {
+  entry_path="$DOKKU_LIB_ROOT/data/storage-registry/entries/rdmtest-k3s-entry.json"
+  run /bin/bash -c "echo '{\"name\":\"rdmtest-k3s-entry\",\"scheduler\":\"k3s\",\"size\":\"1Gi\",\"schema_version\":1}' | sudo tee $entry_path >/dev/null"
+  assert_success
+  run /bin/bash -c "sudo chown dokku:dokku $entry_path"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount $TEST_APP rdmtest-k3s-entry --container-dir /data"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "storage entry \"rdmtest-k3s-entry\" is scheduler=k3s but cannot be mounted on a docker-local app; recreate it with --scheduler docker-local"
+
+  run /bin/bash -c "dokku storage:list $TEST_APP --format json | jq -r '.[].entry_name' | grep '^rdmtest-k3s-entry$' || true"
+  assert_output ""
+
+  run /bin/bash -c "sudo rm -f $entry_path"
+  assert_success
+}
+
+@test "(storage:mount) rejects docker-local storage entry on k3s app" {
+  run /bin/bash -c "dokku storage:create rdmtest-local-entry"
+  assert_success
+
+  run /bin/bash -c "dokku scheduler:set $TEST_APP selected k3s"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount $TEST_APP rdmtest-local-entry --container-dir /data"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "storage entry \"rdmtest-local-entry\" is scheduler=docker-local but cannot be mounted on a k3s app; recreate it with --scheduler k3s"
+
+  run /bin/bash -c "dokku scheduler:set $TEST_APP selected docker-local"
+  assert_success
+
+  run /bin/bash -c "dokku storage:destroy rdmtest-local-entry --destroy-host-dir --force"
+  assert_success
+}
+
+@test "(storage:mount) rejects colon-form mount on k3s app" {
+  run /bin/bash -c "dokku scheduler:set $TEST_APP selected k3s"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount $TEST_APP /tmp/custom-mount:/data"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "colon-form mounts are only supported on docker-local apps"
+
+  run /bin/bash -c "dokku scheduler:set $TEST_APP selected docker-local"
+  assert_success
+}
diff --git a/tests/unit/storage-3.bats b/tests/unit/storage-3.bats
new file mode 100644
index 000000000..4fe6b0119
--- /dev/null
+++ b/tests/unit/storage-3.bats
@@ -0,0 +1,540 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+  global_setup
+  create_app
+  rm -rf "$DOKKU_LIB_ROOT/data/storage/rdmtestapp*"
+}
+
+teardown() {
+  destroy_app
+  global_teardown
+}
+
+@test "(storage:mount) --replace replaces the whole mount set" {
+  run /bin/bash -c "dokku storage:create rdmtest-data"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  run /bin/bash -c "dokku storage:create rdmtest-cache"
+  assert_success
+  run /bin/bash -c "dokku storage:create rdmtest-logs"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount $TEST_APP rdmtest-data --container-dir /app/storage"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount --replace $TEST_APP rdmtest-cache:/cache rdmtest-logs:/logs"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:list $TEST_APP --format json | jq -r '.[].entry_name' | sort | xargs"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "rdmtest-cache rdmtest-logs"
+
+  run /bin/bash -c "dokku storage:mount --replace $TEST_APP rdmtest-cache:/cache rdmtest-logs:/logs"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:list $TEST_APP --format json | jq -r '. | length'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "2"
+
+  run /bin/bash -c "dokku storage:unmount --all $TEST_APP"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-data --force"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-cache --force"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-logs --force"
+  assert_success
+}
+
+@test "(storage:mount) --replace leaves other process types untouched" {
+  run /bin/bash -c "dokku storage:create rdmtest-data"
+  assert_success
+  run /bin/bash -c "dokku storage:create rdmtest-cache"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount $TEST_APP rdmtest-cache --container-dir /cache --process-type web"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount --replace $TEST_APP rdmtest-data:/app/storage"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:list $TEST_APP --format json | jq -r '.[].entry_name' | sort | xargs"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "rdmtest-cache rdmtest-data"
+
+  run /bin/bash -c "dokku storage:report $TEST_APP --format json | jq -r '.\"attachment.1.process-type\"'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "web"
+
+  run /bin/bash -c "dokku storage:report $TEST_APP --format json | jq -r '.\"attachment.2.process-type\"'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "_default_"
+
+  run /bin/bash -c "dokku storage:unmount --all $TEST_APP"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-data --force"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-cache --force"
+  assert_success
+}
+
+@test "(storage:mount) --replace varies mount-time fields per spec" {
+  run /bin/bash -c "dokku storage:create rdmtest-data"
+  assert_success
+  run /bin/bash -c "dokku storage:create rdmtest-cache"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount --replace $TEST_APP rdmtest-data:/app/storage:Z,volume-subpath=uploads,volume-chown=herokuish rdmtest-cache:/cache:ro,noexec,phase=deploy --process-type web"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:report $TEST_APP --format json | jq -r '.\"attachment.1.phases\"'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "deploy,run"
+
+  run /bin/bash -c "dokku storage:report $TEST_APP --format json | jq -r '.\"attachment.1.subpath\"'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "uploads"
+
+  run /bin/bash -c "dokku storage:report $TEST_APP --format json | jq -r '.\"attachment.1.volume-chown\"'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "herokuish"
+
+  run /bin/bash -c "dokku storage:report $TEST_APP --format json | jq -r '.\"attachment.1.volume-options\"'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "Z"
+
+  run /bin/bash -c "dokku storage:report $TEST_APP --format json | jq -r '.\"attachment.2.phases\"'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "deploy"
+
+  run /bin/bash -c "dokku storage:report $TEST_APP --format json | jq -r '.\"attachment.2.subpath\"'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output ""
+
+  run /bin/bash -c "dokku storage:report $TEST_APP --format json | jq -r '.\"attachment.2.volume-chown\"'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output ""
+
+  run /bin/bash -c "dokku storage:report $TEST_APP --format json | jq -r '.\"attachment.2.readonly\"'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "true"
+
+  run /bin/bash -c "dokku storage:report $TEST_APP --format json | jq -r '.\"attachment.2.volume-options\"'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "noexec"
+
+  run /bin/bash -c "dokku storage:report $TEST_APP --format json | jq -r '.\"attachment.1.process-type\", .\"attachment.2.process-type\"' | sort -u | xargs"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "web"
+
+  run /bin/bash -c "dokku storage:unmount --all $TEST_APP"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-data --force"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-cache --force"
+  assert_success
+}
+
+@test "(storage:mount) --replace rejects mount-time flags" {
+  run /bin/bash -c "dokku storage:create rdmtest-data"
+  assert_success
+  run /bin/bash -c "dokku storage:create rdmtest-cache"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount $TEST_APP rdmtest-data --container-dir /app/storage"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  for flag in "--phase deploy" "--volume-subpath uploads" "--volume-readonly" "--volume-chown herokuish" "--volume-options Z"; do
+    run /bin/bash -c "dokku storage:mount --replace $TEST_APP rdmtest-cache:/cache $flag"
+    echo "flag: $flag"
+    echo "output: $output"
+    echo "status: $status"
+    assert_failure
+    assert_output_contains "cannot be used with --replace" -1
+  done
+
+  run /bin/bash -c "dokku storage:list $TEST_APP --format json | jq -r '.[].entry_name' | xargs"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "rdmtest-data"
+
+  run /bin/bash -c "dokku storage:unmount --all $TEST_APP"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-data --force"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-cache --force"
+  assert_success
+}
+
+@test "(storage:mount) --replace rejects malformed spec options" {
+  run /bin/bash -c "dokku storage:create rdmtest-data"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount --replace $TEST_APP rdmtest-data:/app/storage:volume-subpth=uploads"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "unknown key" -1
+
+  run /bin/bash -c "dokku storage:mount --replace $TEST_APP rdmtest-data:/app/storage:volume-subpath="
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "empty value" -1
+
+  run /bin/bash -c "dokku storage:mount --replace $TEST_APP rdmtest-data:/app/storage:volume-subpath=a,volume-subpath=b"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "more than once" -1
+
+  run /bin/bash -c "dokku storage:mount --replace $TEST_APP rdmtest-data:/app/storage:ro,rw"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "sets both ro and rw" -1
+
+  run /bin/bash -c "dokku storage:mount --replace $TEST_APP rdmtest-data:/app/storage:phase=build"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "unsupported phase" -1
+
+  run /bin/bash -c "dokku storage:mount --replace $TEST_APP rdmtest-data:/app/storage:volume-chown=bogus"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Unsupported chown permissions" -1
+
+  run /bin/bash -c "dokku storage:list $TEST_APP --format json | jq -r '. | length'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "0"
+
+  run /bin/bash -c "dokku storage:destroy rdmtest-data --force"
+  assert_success
+}
+
+@test "(storage:mount) --replace rw leaves the option list alone" {
+  run /bin/bash -c "dokku storage:create rdmtest-data"
+  assert_success
+  run /bin/bash -c "dokku storage:create rdmtest-cache"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount --replace $TEST_APP rdmtest-data:/app/storage:rw rdmtest-cache:/cache:rw,Z"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:report $TEST_APP --format json | jq -r '.\"attachment.1.readonly\"'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "false"
+
+  run /bin/bash -c "dokku storage:report $TEST_APP --format json | jq -r '.\"attachment.1.volume-options\"'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output ""
+
+  run /bin/bash -c "dokku storage:report $TEST_APP --format json | jq -r '.\"attachment.2.volume-options\"'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "Z"
+
+  run /bin/bash -c "dokku storage:report $TEST_APP --storage-deploy-mounts"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_not_contains "rw"
+
+  run /bin/bash -c "dokku storage:unmount --all $TEST_APP"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-data --force"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-cache --force"
+  assert_success
+}
+
+@test "(storage:mount) --replace leaves the existing set untouched when a spec is invalid" {
+  run /bin/bash -c "dokku storage:create rdmtest-data"
+  assert_success
+  run /bin/bash -c "dokku storage:create rdmtest-cache"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount $TEST_APP rdmtest-data --container-dir /app/storage"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount --replace $TEST_APP rdmtest-cache:/cache rdmtest-missing:/missing"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "does not exist" -1
+
+  run /bin/bash -c "dokku storage:list $TEST_APP --format json | jq -r '.[].entry_name' | xargs"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "rdmtest-data"
+
+  run /bin/bash -c "dokku storage:mount --replace $TEST_APP rdmtest-data:/app/storage rdmtest-cache:/app/storage"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "specified more than once" -1
+
+  run /bin/bash -c "dokku storage:list $TEST_APP --format json | jq -r '.[].entry_name' | xargs"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "rdmtest-data"
+
+  run /bin/bash -c "dokku storage:unmount --all $TEST_APP"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-data --force"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-cache --force"
+  assert_success
+}
+
+@test "(storage:mount) --replace rejects an empty spec list" {
+  run /bin/bash -c "dokku storage:mount --replace $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "storage:unmount --all" -1
+}
+
+@test "(storage:unmount) removes multiple mounts in one call" {
+  run /bin/bash -c "dokku storage:create rdmtest-data"
+  assert_success
+  run /bin/bash -c "dokku storage:create rdmtest-cache"
+  assert_success
+  run /bin/bash -c "dokku storage:create rdmtest-logs"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount --replace $TEST_APP rdmtest-data:/app/storage rdmtest-cache:/cache rdmtest-logs:/logs"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:unmount $TEST_APP rdmtest-data rdmtest-logs"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:list $TEST_APP --format json | jq -r '.[].entry_name' | xargs"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "rdmtest-cache"
+
+  run /bin/bash -c "dokku storage:unmount $TEST_APP rdmtest-cache rdmtest-missing"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "dokku storage:list $TEST_APP --format json | jq -r '.[].entry_name' | xargs"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "rdmtest-cache"
+
+  run /bin/bash -c "dokku storage:unmount --all $TEST_APP"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-data --force"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-cache --force"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-logs --force"
+  assert_success
+}
+
+@test "(storage:unmount) --all removes every mount and is idempotent" {
+  run /bin/bash -c "dokku storage:create rdmtest-data"
+  assert_success
+  run /bin/bash -c "dokku storage:create rdmtest-cache"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount --replace $TEST_APP rdmtest-data:/app/storage rdmtest-cache:/cache"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:unmount --all $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:list $TEST_APP --format json | jq -r '. | length'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "0"
+
+  run /bin/bash -c "dokku storage:unmount --all $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:unmount --all $TEST_APP rdmtest-data"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "cannot be specified with --all" -1
+
+  run /bin/bash -c "dokku storage:destroy rdmtest-data --force"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-cache --force"
+  assert_success
+}
+
+@test "(storage:unmount) --all --process-type removes only that scope" {
+  run /bin/bash -c "dokku storage:create rdmtest-data"
+  assert_success
+  run /bin/bash -c "dokku storage:create rdmtest-cache"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount $TEST_APP rdmtest-data --container-dir /app/storage"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount $TEST_APP rdmtest-cache --container-dir /cache --process-type web"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:unmount --all $TEST_APP --process-type web"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:list $TEST_APP --format json | jq -r '.[].entry_name' | xargs"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "rdmtest-data"
+
+  run /bin/bash -c "dokku storage:unmount --all $TEST_APP --process-type worker"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:list $TEST_APP --format json | jq -r '. | length'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "1"
+
+  run /bin/bash -c "dokku storage:unmount --all $TEST_APP"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-data --force"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-cache --force"
+  assert_success
+}
+
+@test "(storage:mount) concurrent calls for the same app keep every mount" {
+  run run_concurrently 20 /bin/bash -c 'dokku storage:create "rdmtest-race$1"' _
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run run_concurrently 20 /bin/bash -c 'dokku storage:mount "$1" "rdmtest-race$2" --container-dir "/race/$2"' _ "$TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:list $TEST_APP --format json | jq -r '. | length'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "20"
+
+  run run_concurrently 20 /bin/bash -c 'dokku storage:unmount "$1" "rdmtest-race$2"' _ "$TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:list $TEST_APP --format json | jq -r '. | length'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output "0"
+
+  run run_concurrently 20 /bin/bash -c 'dokku storage:destroy "rdmtest-race$1" --force' _
+  assert_success
+}
+
+@test "(storage:labels:set) concurrent calls for the same entry keep every label" {
+  run /bin/bash -c "dokku storage:create rdmtest-race-label"
+  assert_success
+
+  run run_concurrently 20 /bin/bash -c 'dokku storage:labels:set rdmtest-race-label "example.com/race$1" value' _
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:info rdmtest-race-label --format json | jq -r '.labels | length'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "20"
+
+  run /bin/bash -c "dokku storage:destroy rdmtest-race-label --force"
+  assert_success
+}
diff --git a/tests/unit/storage-4.bats b/tests/unit/storage-4.bats
new file mode 100644
index 000000000..8bc37ea17
--- /dev/null
+++ b/tests/unit/storage-4.bats
@@ -0,0 +1,239 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+  global_setup
+  create_app
+  rm -rf "$DOKKU_LIB_ROOT/data/storage/rdmtestapp*"
+}
+
+teardown() {
+  destroy_app
+  global_teardown
+}
+
+@test "(storage) [process-type] docker-args-process-deploy emits default and matching mounts" {
+  run /bin/bash -c "dokku storage:create rdmtest-shared"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  run /bin/bash -c "dokku storage:create rdmtest-web"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount $TEST_APP rdmtest-shared --container-dir /shared"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount $TEST_APP rdmtest-web --container-dir /web --process-type web"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "echo '' | dokku plugin:trigger docker-args-process-deploy $TEST_APP herokuish latest web | grep -o -- '-v [^ ]*' | cut -d: -f2 | sort | xargs"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "/shared /web"
+
+  run /bin/bash -c "dokku storage:unmount --all $TEST_APP"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-shared --force"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-web --force"
+  assert_success
+}
+
+@test "(storage) [process-type] docker-args-process-deploy omits mounts scoped to another process" {
+  run /bin/bash -c "dokku storage:create rdmtest-shared"
+  assert_success
+  run /bin/bash -c "dokku storage:create rdmtest-web"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount $TEST_APP rdmtest-shared --container-dir /shared"
+  assert_success
+  run /bin/bash -c "dokku storage:mount $TEST_APP rdmtest-web --container-dir /web --process-type web"
+  assert_success
+
+  run /bin/bash -c "echo '' | dokku plugin:trigger docker-args-process-deploy $TEST_APP herokuish latest worker | grep -o -- '-v [^ ]*' | cut -d: -f2 | sort | xargs"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "/shared"
+
+  # An ephemeral container with no process type of its own - the app.json
+  # deploy-task path invokes the trigger this way - still gets the default
+  # scope, and only the default scope.
+  run /bin/bash -c "echo '' | dokku plugin:trigger docker-args-process-deploy $TEST_APP herokuish latest | grep -o -- '-v [^ ]*' | cut -d: -f2 | sort | xargs"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "/shared"
+
+  run /bin/bash -c "dokku storage:unmount --all $TEST_APP"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-shared --force"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-web --force"
+  assert_success
+}
+
+@test "(storage) [process-type] docker-args-run emits only default-scoped mounts" {
+  run /bin/bash -c "dokku storage:create rdmtest-shared"
+  assert_success
+  run /bin/bash -c "dokku storage:create rdmtest-web"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount $TEST_APP rdmtest-shared --container-dir /shared"
+  assert_success
+  run /bin/bash -c "dokku storage:mount $TEST_APP rdmtest-web --container-dir /web --process-type web"
+  assert_success
+
+  run /bin/bash -c "echo '' | dokku plugin:trigger docker-args-run $TEST_APP latest | grep -o -- '-v [^ ]*' | cut -d: -f2 | sort | xargs"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "/shared"
+
+  run /bin/bash -c "dokku storage:unmount --all $TEST_APP"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-shared --force"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-web --force"
+  assert_success
+}
+
+@test "(storage:mount) rejects a container path already mounted in an overlapping process type" {
+  run /bin/bash -c "dokku storage:create rdmtest-data"
+  assert_success
+  run /bin/bash -c "dokku storage:create rdmtest-cache"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount $TEST_APP rdmtest-data --container-dir /app/storage"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # The default scope also applies to web, so both mounts would target
+  # /app/storage on the same container.
+  run /bin/bash -c "dokku storage:mount $TEST_APP rdmtest-cache --container-dir /app/storage --process-type web"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "is already mounted by storage entry rdmtest-data for process type _default_"
+
+  run /bin/bash -c "dokku storage:list $TEST_APP --format json | jq -r '. | length'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "1"
+
+  # Two named scopes never share a container, so they may each claim the path.
+  run /bin/bash -c "dokku storage:mount $TEST_APP rdmtest-data --container-dir /scoped --process-type web"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount $TEST_APP rdmtest-cache --container-dir /scoped --process-type worker"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:unmount --all $TEST_APP"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-data --force"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-cache --force"
+  assert_success
+}
+
+@test "(storage:migrate) drains process-scoped docker-options mounts" {
+  run /bin/bash -c "mkdir -p /tmp/rdmtest-spool"
+  assert_success
+
+  run /bin/bash -c "dokku docker-options:add --process worker $TEST_APP deploy '-v /tmp/rdmtest-spool:/spool'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:migrate $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:report $TEST_APP --format json | jq -r '.\"attachment.1.container-path\"'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "/spool"
+
+  run /bin/bash -c "dokku storage:report $TEST_APP --format json | jq -r '.\"attachment.1.process-type\"'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "worker"
+
+  run /bin/bash -c "dokku docker-options:report $TEST_APP --format json | jq -r '.. | strings' | grep -c 'rdmtest-spool' || true"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "0"
+
+  run /bin/bash -c "dokku storage:unmount --all $TEST_APP"
+  assert_success
+  run /bin/bash -c "rm -rf /tmp/rdmtest-spool"
+  assert_success
+}
+
+@test "(storage) [process-type] a process-scoped mount reaches only its own process" {
+  run /bin/bash -c "dokku storage:create rdmtest-shared"
+  assert_success
+  run /bin/bash -c "dokku storage:create rdmtest-web"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount $TEST_APP rdmtest-shared --container-dir /shared"
+  assert_success
+  run /bin/bash -c "dokku storage:mount $TEST_APP rdmtest-web --container-dir /web --process-type web"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP web_worker_callback
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Only web is scaled up by default, so the worker needs a container of its
+  # own before there is anything to compare against.
+  run /bin/bash -c "dokku ps:scale $TEST_APP worker=1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "docker inspect -f '{{range .HostConfig.Binds}}{{println .}}{{end}}' \$(< $DOKKU_ROOT/$TEST_APP/CONTAINER.web.1) | cut -d: -f2 | sort | xargs"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "/shared /web"
+
+  run /bin/bash -c "docker inspect -f '{{range .HostConfig.Binds}}{{println .}}{{end}}' \$(< $DOKKU_ROOT/$TEST_APP/CONTAINER.worker.1) | cut -d: -f2 | sort | xargs"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "/shared"
+
+  run /bin/bash -c "dokku storage:unmount --all $TEST_APP"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-shared --force"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-web --force"
+  assert_success
+}
+
+web_worker_callback() {
+  local APP="$1"
+  local APP_REPO_DIR="$2"
+  cat >"$APP_REPO_DIR/Procfile" <<EOF
+web: python3 -u web.py
+worker: python3 -u worker.py
+EOF
+}
diff --git a/tests/unit/storage-5.bats b/tests/unit/storage-5.bats
new file mode 100644
index 000000000..dd9b6f78b
--- /dev/null
+++ b/tests/unit/storage-5.bats
@@ -0,0 +1,117 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+  global_setup
+  create_app
+  rm -rf "${DOKKU_LIB_ROOT}"/data/storage/rdmtest*
+}
+
+teardown() {
+  destroy_app
+  global_teardown
+}
+
+@test "(storage) without DOKKU_LIB_HOST_ROOT docker-args and storage:exec use DOKKU_LIB_ROOT" {
+  unset DOKKU_LIB_HOST_ROOT
+
+  run /bin/bash -c "dokku storage:create rdmtest-bare"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount $TEST_APP rdmtest-bare --container-dir /data"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "echo '' | dokku plugin:trigger docker-args-process-deploy $TEST_APP herokuish latest web | grep -o -- '-v [^ ]*'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "-v ${DOKKU_LIB_ROOT}/data/storage/rdmtest-bare:/data"
+
+  run /bin/bash -c "docker pull alpine:3 >/dev/null"
+  assert_success
+
+  run /bin/bash -c "dokku storage:exec rdmtest-bare -- /bin/sh -c 'echo bare-metal > /data/marker && cat /data/marker'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "bare-metal"
+
+  run /bin/bash -c "cat ${DOKKU_LIB_ROOT}/data/storage/rdmtest-bare/marker"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "bare-metal"
+
+  run /bin/bash -c "dokku storage:unmount --all $TEST_APP"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-bare --force"
+  assert_success
+}
+
+@test "(storage) with DOKKU_LIB_HOST_ROOT docker-args rewrites the mount host path" {
+  HOST_ROOT="$(mktemp -d /tmp/dokku-lib-host.XXXXXX)"
+  export DOKKU_LIB_HOST_ROOT="$HOST_ROOT"
+
+  run /bin/bash -c "dokku storage:create rdmtest-hostroot"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  # Create still lands under DOKKU_LIB_ROOT inside Dokku.
+  run /bin/bash -c "test -d ${DOKKU_LIB_ROOT}/data/storage/rdmtest-hostroot"
+  assert_success
+
+  run /bin/bash -c "dokku storage:mount $TEST_APP rdmtest-hostroot --container-dir /data"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "echo '' | dokku plugin:trigger docker-args-process-deploy $TEST_APP herokuish latest web | grep -o -- '-v [^ ]*'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "-v ${HOST_ROOT}/data/storage/rdmtest-hostroot:/data"
+
+  run /bin/bash -c "dokku storage:unmount --all $TEST_APP"
+  assert_success
+  run /bin/bash -c "dokku storage:destroy rdmtest-hostroot --force"
+  assert_success
+  rm -rf "$HOST_ROOT"
+}
+
+@test "(storage) with DOKKU_LIB_HOST_ROOT storage:exec mounts the host-root path" {
+  # Simulate Dokku-in-Docker: filesystem ops use DOKKU_LIB_ROOT, but Docker -v
+  # mounts must resolve under DOKKU_LIB_HOST_ROOT.
+  HOST_ROOT="$(mktemp -d /tmp/dokku-lib-host.XXXXXX)"
+  export DOKKU_LIB_HOST_ROOT="$HOST_ROOT"
+
+  run /bin/bash -c "dokku storage:create rdmtest-hostroot-exec --chown root"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  mkdir -p "${HOST_ROOT}/data/storage/rdmtest-hostroot-exec"
+  echo "Hello World!" >"${HOST_ROOT}/data/storage/rdmtest-hostroot-exec/welcome.txt"
+
+  run /bin/bash -c "docker pull alpine:3 >/dev/null"
+  assert_success
+
+  run /bin/bash -c "dokku storage:exec rdmtest-hostroot-exec -- cat /data/welcome.txt"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "Hello World!"
+
+  # The in-container create path must not have received the host-written file.
+  run /bin/bash -c "test ! -f ${DOKKU_LIB_ROOT}/data/storage/rdmtest-hostroot-exec/welcome.txt"
+  assert_success
+
+  run /bin/bash -c "dokku storage:destroy rdmtest-hostroot-exec --force"
+  assert_success
+  rm -rf "$HOST_ROOT"
+}
diff --git a/tests/unit/test_helper.bash b/tests/unit/test_helper.bash
index d24ee09d2..d49ca6961 100644
--- a/tests/unit/test_helper.bash
+++ b/tests/unit/test_helper.bash
@@ -251,6 +251,47 @@ run_plugin_script() {
   run /bin/bash -c "PLUGIN_PATH=$PLUGIN_PATH PLUGIN_AVAILABLE_PATH=$PLUGIN_AVAILABLE_PATH PLUGIN_ENABLED_PATH=$PLUGIN_ENABLED_PATH PLUGIN_CORE_AVAILABLE_PATH=$PLUGIN_CORE_AVAILABLE_PATH DOKKU_LIB_ROOT=$DOKKU_LIB_ROOT $PLUGIN_ENABLED_PATH/$PLUGIN_NAME/$SCRIPT_NAME $*"
 }
 
+# Hold the deploy lock for $TEST_APP from a background process, as an in-progress deploy would.
+# Call release_deploy_lock (typically from teardown) to release it.
+hold_deploy_lock() {
+  DEPLOY_LOCK_FILE="$DOKKU_LIB_ROOT/data/apps/$TEST_APP/.deploy.lock"
+  DEPLOY_LOCK_HOLDER_PID_FILE="$(mktemp "/tmp/${DOKKU_DOMAIN}.XXXXX")"
+  chown dokku:dokku "$DEPLOY_LOCK_HOLDER_PID_FILE"
+
+  # the holder writes a build id like a deploy would, then becomes the sleep
+  # process so that killing its pid releases the lock
+  sudo -u dokku bash -c "exec 200>>'$DEPLOY_LOCK_FILE'; flock -n 200 || exit 1; echo test-lock-holder >'$DEPLOY_LOCK_FILE'; echo \$\$ >'$DEPLOY_LOCK_HOLDER_PID_FILE'; exec sleep 120" >/dev/null 2>&1 3>&- &
+
+  local i
+  for i in $(seq 1 20); do
+    if [[ -s "$DEPLOY_LOCK_HOLDER_PID_FILE" ]] && ! flock -n "$DEPLOY_LOCK_FILE" true; then
+      return 0
+    fi
+    sleep 0.5
+  done
+
+  echo "unable to acquire the deploy lock for $TEST_APP"
+  return 1
+}
+
+release_deploy_lock() {
+  if [[ -z "$DEPLOY_LOCK_HOLDER_PID_FILE" ]]; then
+    return 0
+  fi
+
+  local holder_pid i
+  if [[ -s "$DEPLOY_LOCK_HOLDER_PID_FILE" ]]; then
+    holder_pid="$(cat "$DEPLOY_LOCK_HOLDER_PID_FILE")"
+    kill "$holder_pid" &>/dev/null || true
+    for i in $(seq 1 20); do
+      kill -0 "$holder_pid" &>/dev/null || break
+      sleep 0.5
+    done
+  fi
+  rm -f "$DEPLOY_LOCK_FILE" "$DEPLOY_LOCK_HOLDER_PID_FILE"
+  DEPLOY_LOCK_HOLDER_PID_FILE=""
+}
+
 check_urls() {
   local PATTERN="$1"
   run /bin/bash -c "dokku urls $TEST_APP | grep -E \"${PATTERN}\""
@@ -756,3 +797,23 @@ uninstall_k3s() {
   echo "status: $status"
   assert_success
 }
+
+run_concurrently() {
+  declare desc="runs a command COUNT times in parallel, appending the run number as the last argument, and fails if any run fails"
+  declare COUNT="$1"
+  shift 1
+  local i pid failed=0
+  local pids=()
+
+  for i in $(seq 1 "$COUNT"); do
+    "$@" "$i" &
+    pids+=("$!")
+  done
+
+  for pid in "${pids[@]}"; do
+    wait "$pid" || failed=$((failed + 1))
+  done
+
+  echo "failed runs: $failed"
+  [[ "$failed" -eq 0 ]]
+}
diff --git a/tests/unit/traefik.bats b/tests/unit/traefik.bats
index 86cd2a5fe..6a3d1ac2f 100644
--- a/tests/unit/traefik.bats
+++ b/tests/unit/traefik.bats
@@ -882,11 +882,84 @@ teardown() {
   assert_output_not_exists
 }
 
+@test "(traefik) healthcheck path with whitespace fails deploy" {
+  run /bin/bash -c "dokku proxy:set $TEST_APP traefik"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP setup_traefik_healthcheck_whitespace_path
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains 'path "/health check" must not contain whitespace, control characters, quotes, or backslashes' 2
+
+  run /bin/bash -c "docker ps -a -q --filter label=com.dokku.app-name=$TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_not_exists
+}
+
+@test "(traefik) healthcheck invalid scheme fails deploy" {
+  run /bin/bash -c "dokku proxy:set $TEST_APP traefik"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP setup_traefik_healthcheck_invalid_scheme
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains 'scheme "tcp" must be one of http or https' 2
+}
+
+@test "(traefik) invalid stored healthcheck path fails restart" {
+  run /bin/bash -c "dokku proxy:set $TEST_APP traefik"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP setup_traefik_healthcheck
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "jq '.healthchecks.web[0].path = \"/health check\"' /var/lib/dokku/data/app-json/$TEST_APP/app.json > /var/lib/dokku/data/app-json/$TEST_APP/app.json.tmp && mv /var/lib/dokku/data/app-json/$TEST_APP/app.json.tmp /var/lib/dokku/data/app-json/$TEST_APP/app.json"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku ps:restart $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Invalid app.json healthcheck path for traefik" 2
+}
+
 setup_traefik_healthcheck() {
   local APP="$1"
   local APP_REPO_DIR="$2"
   [[ -z "$APP" ]] && local APP="$TEST_APP"
   APP_REPO_DIR="$(realpath "$APP_REPO_DIR")"
 
-  mv "$APP_REPO_DIR/app-traefik.json" "$APP_REPO_DIR/app.json"
+  mv "$APP_REPO_DIR/app-readiness.json" "$APP_REPO_DIR/app.json"
+}
+
+setup_traefik_healthcheck_whitespace_path() {
+  local APP="$1"
+  local APP_REPO_DIR="$2"
+  [[ -z "$APP" ]] && local APP="$TEST_APP"
+  APP_REPO_DIR="$(realpath "$APP_REPO_DIR")"
+
+  jq '.healthchecks.web[0].path = "/health check"' "$APP_REPO_DIR/app-readiness.json" >"$APP_REPO_DIR/app.json"
+}
+
+setup_traefik_healthcheck_invalid_scheme() {
+  local APP="$1"
+  local APP_REPO_DIR="$2"
+  [[ -z "$APP" ]] && local APP="$TEST_APP"
+  APP_REPO_DIR="$(realpath "$APP_REPO_DIR")"
+
+  jq '.healthchecks.web[0].scheme = "tcp"' "$APP_REPO_DIR/app-readiness.json" >"$APP_REPO_DIR/app.json"
 }