diff --git a/.github/linters/.markdown-lint.yml b/.github/linters/.markdown-lint.yml
index e16596c0a..5d0e3b14d 100644
--- a/.github/linters/.markdown-lint.yml
+++ b/.github/linters/.markdown-lint.yml
@@ -35,3 +35,8 @@ MD024: false
 # The issue template doesn't have one
 # https://github.com/DavidAnson/markdownlint/blob/main/doc/Rules.md#md041
 MD041: false
+
+# Table column style
+# The docs pad tables loosely rather than aligning every pipe
+# https://github.com/DavidAnson/markdownlint/blob/main/doc/Rules.md#md060
+MD060: false
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index e7a25e4ff..ca9dbeee9 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -38,7 +38,7 @@ jobs:
           cache: 'npm'
           cache-dependency-path: '.github/workflows/lint.yml'
       - name: Install markdownlint-cli
-        run: npm install -g markdownlint-cli@0.35.0
+        run: npm install -g markdownlint-cli@0.50.0
       - name: Run markdown-lint
         run: markdownlint -c .github/linters/.markdown-lint.yml --ignore tests/apps '**/*.md'
 
diff --git a/HISTORY.md b/HISTORY.md
index 0cc114105..33964285c 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -8793,7 +8793,7 @@ sudo DOKKU_TAG=v0.13.1 bash bootstrap.sh
 - #3145: @josegonzalez Add report trigger
 - #3144: @josegonzalez Increase curl max timeout to 600 seconds (10 minutes)
 - #3107: @znz Remove unused password in ssl cert generation
-- #3095: @josegonzalez Migrate env for NGINX_* to PROXY_*
+- #3095: @josegonzalez Migrate env for `NGINX_*` to `PROXY_*`
 - #3140: @josegonzalez Add newline to config:get output
 - #3139: @josegonzalez Add ability to initialize a git repository out of band
 - #3111: @josegonzalez Upgrade herokuish to 0.4.0
@@ -9602,7 +9602,7 @@ Release 0.5.5 is mostly a documentation release, further clarifying how our defa
 
 We've also added a small section to the [dokku homepage](https://dokku.com/docs/) that lists the current core team. Feel free to look at their beautiful faces and imagine yourself contributing to Dokku and joining our core team. There are [quite a few ways to contribute](https://github.com/dokku/dokku/blob/master/CONTRIBUTING.md) - even without code/documentation - so feel more than free to jump on the bandwagon!
 
-Finally, we've started an [Official Dokku Blog](https://dokku.github.io/), where we will post about dokku internals, roadmaps, potential use-cases, etc. An rss feed is available [here](https://dokku.github.io/feed.xml).
+Finally, we've started an [Official Dokku Blog](https://dokku.github.io/), where we will post about dokku internals, roadmaps, potential use-cases, etc. An [rss feed](https://dokku.github.io/feed.xml) is available.
 
 Thanks to all the contributors who helped with this release!
 
@@ -9807,7 +9807,7 @@ Thanks to all the contributors who helped with this release!
 
 ## 0.4.12
 
-This is a small bugfix release, which will be the final release before the 0.5.x line. You can follow along on bugs/features we hope to cleanup for 0.5.x [here](https://github.com/dokku/dokku/milestones/v0.5.0).
+This is a small bugfix release, which will be the final release before the 0.5.x line. You can follow along on bugs/features we hope to cleanup in the [0.5.x milestone](https://github.com/dokku/dokku/milestones/v0.5.0).
 
 Thanks to all the contributors who helped with this release!
 
@@ -10306,7 +10306,7 @@ This release is a bugfix release covering dokku packaging.
 
 ## 0.3.23
 
-This release is a bugfix release mostly covering installation and nginx issues. As well, we launched a nicer documentation site [here](https://dokku.com/docs/). Thanks to all of our contributors for making this a great release!
+This release is a bugfix release mostly covering installation and nginx issues. As well, we launched a [nicer documentation site](https://dokku.com/docs/). Thanks to all of our contributors for making this a great release!
 
 ### Bug Fixes
 
diff --git a/docs/advanced-usage/builds.md b/docs/advanced-usage/builds.md
index 12be61a8e..d94bb51fb 100644
--- a/docs/advanced-usage/builds.md
+++ b/docs/advanced-usage/builds.md
@@ -190,7 +190,7 @@ Available flags:
 The following flags surface in `builds:report` but are not managed by `builds:set` - they are derived metadata recorded during the build:
 
 | Flag | Description |
-|---|---|
+| --- | --- |
 | `--build-id` | Unique identifier of the most recent build for the app |
 | `--build-kind` | Whether the record was a `build` or a `deploy` |
 | `--build-status` | Display status (`running`, `succeeded`, `failed`, `canceled`, `abandoned`); computed at read time |
diff --git a/docs/advanced-usage/deployment-tasks.md b/docs/advanced-usage/deployment-tasks.md
index 0065b0ffc..41e3cf372 100644
--- a/docs/advanced-usage/deployment-tasks.md
+++ b/docs/advanced-usage/deployment-tasks.md
@@ -142,7 +142,7 @@ app2.json
 
 #### `app.json` deployment tasks
 
-Dokku provides limited support for the `app.json` manifest from Heroku (documentation available [here](https://devcenter.heroku.com/articles/app-json-schema)). The keys available for use with Deployment Tasks are:
+Dokku provides limited support for the `app.json` manifest from Heroku (see the [app.json schema documentation](https://devcenter.heroku.com/articles/app-json-schema)). The keys available for use with Deployment Tasks are:
 
 - `scripts.dokku.predeploy`: This is run _after_ an app's docker image is built, but _before_ any containers are scheduled. Changes made to your image are committed at this phase.
 - `scripts.dokku.postdeploy`: This is run _after_ an app's containers are scheduled. Changes made to your image are _not_ committed at this phase.
diff --git a/docs/advanced-usage/docker-options.md b/docs/advanced-usage/docker-options.md
index 6469f3878..d938fed73 100644
--- a/docs/advanced-usage/docker-options.md
+++ b/docs/advanced-usage/docker-options.md
@@ -34,7 +34,7 @@ Adding or removing docker-options will not apply to any running containers, and
 
 #### Supported Docker Options
 
-More information on supported Docker options can be found [here](https://docs.docker.com/engine/reference/commandline/run/).
+More information on supported Docker options can be found in the [docker run reference](https://docs.docker.com/engine/reference/commandline/run/).
 
 Container options configured via the `docker-options` plugin are not used to modify the process a container runs. Container options are the `[OPTIONS]` portion of the following, where `[CONTAINER_COMMAND]` and `[ARG]` are the process and the arguments passed to it that are launched in the created container: `docker run [OPTIONS] [CONTAINER_COMMAND] [ARG...]`. Please see the documentation for [customizing the run command](/docs/deployment/builders/dockerfiles.md#customizing-the-run-command) or use a [Procfile](/docs/deployment/builders/dockerfiles.md#procfiles-and-multiple-processes) to modify the command used by a Dockerfile-based container.
 
@@ -288,7 +288,7 @@ dokku docker-options:list node-js-app --phase deploy
 The following properties are recorded internally by the docker-options plugin and are not exposed via `docker-options:report`:
 
 | Property | Scope | Description | Source |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | `migrated-from-files` | global | Global migration sentinel that records that the legacy `DOCKER_OPTIONS_<PHASE>` flat-file store has been drained into plugin properties | `plugins/docker-options/functions.go` writes `"true"` once the install-time migration runs |
 | `migrated-build` | per-app | Per-app marker recording that the app's legacy `DOCKER_OPTIONS_BUILD` file was drained into the `_default_.build` property list. Only set when the legacy file contained non-empty content | `plugins/docker-options/functions.go` writes `"true"` after the per-phase drain |
 | `migrated-deploy` | per-app | Per-app marker recording that the app's legacy `DOCKER_OPTIONS_DEPLOY` file was drained into the `_default_.deploy` property list. Only set when the legacy file contained non-empty content | `plugins/docker-options/functions.go` writes `"true"` after the per-phase drain |
diff --git a/docs/advanced-usage/persistent-storage.md b/docs/advanced-usage/persistent-storage.md
index 12acdbca8..8926b34a9 100644
--- a/docs/advanced-usage/persistent-storage.md
+++ b/docs/advanced-usage/persistent-storage.md
@@ -172,7 +172,7 @@ dokku storage:set node-js-data chown
 The following properties can be set:
 
 | Property | Description | Unsetting it means |
-|---|---|---|
+| --- | --- | --- |
 | `chown` | Ownership preset or numeric uid for the host directory | no chown is performed |
 | `mode` | Octal permissions for the host directory | permissions are left alone |
 | `namespace` | Namespace holding the PVC (k3s) | the `default` namespace |
@@ -324,7 +324,7 @@ dokku storage:mount --replace node-js-app \
 ```
 
 | Token | Meaning |
-|---|---|
+| --- | --- |
 | `ro` | Mount the volume read-only |
 | `rw` | Mount it read-write, the explicit opposite of `ro` and the default |
 | `volume-subpath=<path>` | Subpath within the entry |
diff --git a/docs/advanced-usage/registry-management.md b/docs/advanced-usage/registry-management.md
index 85380dec4..0bd550b5e 100644
--- a/docs/advanced-usage/registry-management.md
+++ b/docs/advanced-usage/registry-management.md
@@ -283,7 +283,7 @@ dokku registry:set --global push-extra-tags
 > The `Report flags` column lists the CLI argument names accepted by `registry:report`. The JSON keys emitted by `registry:report --format json` are the same names with the leading `--registry-` stripped (e.g. `image-repo`, `global-server`, `computed-push-on-release`). Legacy keys with the `registry-` prefix (e.g. `registry-image-repo`) are also emitted during the 0.38.x deprecation window and will be removed in a future major release.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `image-repo` | app only | `dokku/<app>` | `--registry-image-repo`, `--registry-computed-image-repo` | Repository name used when pushing the app's image (overrides the global template) |
 | `image-repo-template` | app + global | none | `--registry-image-repo-template`, `--registry-global-image-repo-template`, `--registry-computed-image-repo-template` | Go template used to compute the per-app image repository when `image-repo` is unset |
 | `push-extra-tags` | app + global | none | `--registry-push-extra-tags`, `--registry-global-push-extra-tags`, `--registry-computed-push-extra-tags` | Comma-separated list of additional tags pushed alongside the deploy tag |
@@ -298,7 +298,7 @@ dokku registry:set --global push-extra-tags
 The following `registry:report` fields describe credentials created by `registry:login` and are not settable via `registry:set`.
 
 | Report flag | Scope | Description |
-|---|---|---|
+| --- | --- | --- |
 | `--registry-auth-servers` | app only | Comma-separated list of servers the app has its own credentials for |
 | `--registry-global-auth-servers` | app + global | Comma-separated list of servers the global credentials cover |
 | `--registry-computed-auth-servers` | app + global | Comma-separated list of servers whose credentials would be used for the app |
diff --git a/docs/appendices/0.38.0-migration-guide.md b/docs/appendices/0.38.0-migration-guide.md
index 835a38def..da17e52bb 100644
--- a/docs/appendices/0.38.0-migration-guide.md
+++ b/docs/appendices/0.38.0-migration-guide.md
@@ -45,7 +45,7 @@ A number of `DOKKU_*` config environment variables have been replaced with prope
 Going forward, configure these settings using the property commands listed below. Setting the deprecated env vars via `dokku config:set` will no longer have any effect.
 
 | Deprecated Env Var | Replacement Command |
-|---|---|
+| --- | --- |
 | `DOKKU_APP_PROXY_TYPE` | `dokku proxy:set <app> type <value>` |
 | `DOKKU_APP_RESTORE` | `dokku ps:set <app> restore <true\|false>` |
 | `DOKKU_APP_SHELL` | `dokku scheduler:set <app> shell <value>` |
diff --git a/docs/appendices/0.5.0-migration-guide.md b/docs/appendices/0.5.0-migration-guide.md
index fe0f1fd6b..fbc69f5e6 100644
--- a/docs/appendices/0.5.0-migration-guide.md
+++ b/docs/appendices/0.5.0-migration-guide.md
@@ -5,11 +5,11 @@
 - The nginx-vhosts template language is now [sigil](https://github.com/gliderlabs/sigil)
     - No need to escape literal `$` characters (or other "bash-isms")
     - Template variables are represented as {{ .VARIABLE_NAME }}
-    - A detailed list of template variables can be found [here](/docs/networking/proxies/nginx.md#available-template-variables)
+    - A detailed list of template variables can be found in the [available template variables documentation](/docs/networking/proxies/nginx.md#available-template-variables)
 - A custom nginx-vhosts template must be named `nginx.conf.sigil`
     - The default path for this custom template is the root of your repo (i.e. `/app` in the container or `WORKDIR` if defined in a dockerfile app)
     - Dokku no longer looks for this file in `/home/dokku/node-js-app` on the Dokku server
-    - Check out an example template [here](/docs/networking/proxies/nginx.md)
+    - Check out an [example template](/docs/networking/proxies/nginx.md)
 - Support for server-wide SSL certs have been dropped in favor of using the `certs` plugin
     - `dokku certs:add node-js-app < certs.tar`
 - All domains for an SSL-enabled app will be redirected to https by default
diff --git a/docs/appendices/file-formats/nginx-conf-sigil.md b/docs/appendices/file-formats/nginx-conf-sigil.md
index 8c1acf152..78fba3f58 100644
--- a/docs/appendices/file-formats/nginx-conf-sigil.md
+++ b/docs/appendices/file-formats/nginx-conf-sigil.md
@@ -1,6 +1,6 @@
 # nginx.conf.sigil
 
-The `nginx.conf.sigil` file is used to configure the nginx server for an application. The default template can be found [here](https://github.com/dokku/dokku/blob/master/plugins/nginx-vhosts/templates/nginx.conf.sigil). Dokku uses a tool named [sigil](https://github.com/gliderlabs/sigil) to generate the nginx configuration based on the template provided.
+The `nginx.conf.sigil` file is used to configure the nginx server for an application. The [default template](https://github.com/dokku/dokku/blob/master/plugins/nginx-vhosts/templates/nginx.conf.sigil) is in the nginx-vhosts plugin. Dokku uses a tool named [sigil](https://github.com/gliderlabs/sigil) to generate the nginx configuration based on the template provided.
 
 ## Validation
 
diff --git a/docs/community/plugins.md b/docs/community/plugins.md
index 74e38428c..496a5c530 100644
--- a/docs/community/plugins.md
+++ b/docs/community/plugins.md
@@ -233,7 +233,7 @@ The following plugins are no longer maintained by their developers.
 | [CouchDB (multi containers)](https://github.com/Flink/dokku-couchdb-multi-containers)             | [flink][]             | 0.4.0+                |
 | [CouchDB](https://github.com/racehub/dokku-couchdb-plugin)                                        | [raceHub][]           | Compatible with 0.2.0 |
 | [Dokku Copy App Config Files](https://github.com/alexkruegger/dokku-app-configfiles)              | [alexkruegger][]      | Compatible with 0.3.17+ |
-| [Dokku Registry](https://github.com/agco-adm/dokku-registry)                                      | [agco-adm][]          | 0.4.0+
+| [Dokku Registry](https://github.com/agco-adm/dokku-registry)                                      | [agco-adm][]          | 0.4.0+                |
 | [Elasticsearch](https://github.com/robv/dokku-elasticsearch)                                      | [robv][]              | Not compatible with >= 0.3.0 (still uses /home/git) |
 | [Elasticsearch](https://github.com/blag/dokku-elasticsearch-plugin)<sup>1</sup>                   | [blag][]              | Compatible with 0.2.0 |
 | [Graphite/statsd](https://github.com/jlachowski/dokku-graphite-plugin)                            | [jlachowski][]        | < 0.4.0               |
diff --git a/docs/configuration/ssl.md b/docs/configuration/ssl.md
index 4a2ab602e..9ad455dc2 100644
--- a/docs/configuration/ssl.md
+++ b/docs/configuration/ssl.md
@@ -164,7 +164,7 @@ See the [running behind another proxy documentation](/docs/networking/proxies/ng
 The following flags surface in `certs:report` but are not managed by `certs:set` - they are derived from the on-disk certificate:
 
 | Flag | Description |
-|---|---|
+| --- | --- |
 | `--ssl-enabled` | `true` when an SSL certificate is installed for the app |
 | `--ssl-dir` | Absolute path to the per-app certificate directory |
 | `--ssl-hostnames` | Hostnames the certificate covers (CN plus Subject Alternative Names) |
diff --git a/docs/deployment/application-management.md b/docs/deployment/application-management.md
index 057f31f25..4231329ac 100644
--- a/docs/deployment/application-management.md
+++ b/docs/deployment/application-management.md
@@ -347,7 +347,7 @@ dokku apps:report node-js-app --app-dir
 The following flags surface in `apps:report` but are not managed by `apps:set`:
 
 | Flag | Description |
-|---|---|
+| --- | --- |
 | `--app-created-at` | UNIX timestamp of app creation |
 | `--app-deploy-source` | Source kind of the last deploy (`git`, `archive`, `docker-image`, `git-sync`) |
 | `--app-deploy-source-metadata` | Free-form metadata for the deploy source (commit sha, image ref, URL) |
diff --git a/docs/deployment/builders/builder-management.md b/docs/deployment/builders/builder-management.md
index fd2b43c80..ddc475e99 100644
--- a/docs/deployment/builders/builder-management.md
+++ b/docs/deployment/builders/builder-management.md
@@ -181,7 +181,7 @@ For a simple example of how to implement this trigger, see `builder-pack`, which
 > The `Report flags` column lists the CLI argument names accepted by `builder:report`. The JSON keys emitted by `builder:report --format json` are the same names with the leading `--builder-` stripped (e.g. `selected`, `global-selected`, `computed-selected`). Legacy keys with the `builder-` prefix are also emitted during the 0.38.x deprecation window and will be removed in a future major release.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `build-dir` | app + global | none | `--builder-build-dir`, `--builder-global-build-dir`, `--builder-computed-build-dir` | Subdirectory within the repository to use as the build context |
 | `selected` | app + global | none | `--builder-selected`, `--builder-global-selected`, `--builder-computed-selected` | Builder plugin to use; overrides automatic detection |
 | `skip-cleanup` | app + global | `false` | `--builder-skip-cleanup`, `--builder-global-skip-cleanup`, `--builder-computed-skip-cleanup` | When `true`, leaves intermediate build artifacts in place after the build |
diff --git a/docs/deployment/logs.md b/docs/deployment/logs.md
index dc507e098..4c1f526f1 100644
--- a/docs/deployment/logs.md
+++ b/docs/deployment/logs.md
@@ -316,7 +316,7 @@ dokku logs:set --global vector-cron-sink "console://?encoding[codec]=text"
 Setting a cron sink **moves** cron task output rather than copying it. Vector routes each log line to exactly one of the two sinks:
 
 | Configuration | Where cron output goes | Where all other output goes |
-|---|---|---|
+| --- | --- | --- |
 | `vector-sink` only | `vector-sink` | `vector-sink` |
 | `vector-cron-sink` only | `vector-cron-sink` | nowhere |
 | both | `vector-cron-sink` | `vector-sink` |
@@ -398,7 +398,7 @@ The alias only changes the shipped event. Containers are always discovered by th
 > The `Report flags` column lists the CLI argument names accepted by `logs:report`. The JSON keys emitted by `logs:report --format json` are the same names with the leading `--logs-` stripped (e.g. `max-size`, `global-max-size`, `computed-max-size`). Legacy keys with the `logs-` prefix are also emitted during the 0.38.x deprecation window and will be removed in a future major release.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `app-label-alias` | app + global | `com.dokku.app-name` | `--logs-app-label-alias`, `--logs-global-app-label-alias`, `--logs-computed-app-label-alias` | Field name the app name is shipped under, renamed from `com.dokku.app-name` on the event |
 | `max-size` | app + global | `10m` | `--logs-max-size`, `--logs-global-max-size`, `--logs-computed-max-size` | Maximum size of an individual log file before rotation |
 | `vector-image` | global only | _parsed from `plugins/logs/Dockerfile`_ | `--logs-global-vector-image`, `--logs-computed-vector-image` | Docker image used to run the vector log-shipper container |
diff --git a/docs/deployment/methods/git.md b/docs/deployment/methods/git.md
index 6a9112b97..fe6a3b687 100644
--- a/docs/deployment/methods/git.md
+++ b/docs/deployment/methods/git.md
@@ -339,7 +339,7 @@ The `--format` flag cannot be combined with an info flag.
 ### Settable properties
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `archive-max-files` | app + global | none | `--git-global-archive-max-files`, `--git-computed-archive-max-files` | Maximum number of files allowed in an uploaded archive deploy |
 | `archive-max-size` | app + global | none | `--git-global-archive-max-size`, `--git-computed-archive-max-size` | Maximum total size of an uploaded archive deploy |
 | `deploy-branch` | app + global | `master` | `--git-deploy-branch`, `--git-global-deploy-branch`, `--git-computed-deploy-branch` | Branch name pushed by the git remote that triggers a deploy |
@@ -352,6 +352,6 @@ The `--format` flag cannot be combined with an info flag.
 The following flags surface in `git:report` but are not managed by `git:set` - they are derived from repository state:
 
 | Flag | Description |
-|---|---|
+| --- | --- |
 | `--git-sha` | HEAD commit SHA of the app's git repo |
 | `--git-last-updated-at` | UNIX timestamp of the last write to the deploy branch ref |
diff --git a/docs/deployment/schedulers/docker-local.md b/docs/deployment/schedulers/docker-local.md
index 0c8361298..a6b403fb7 100644
--- a/docs/deployment/schedulers/docker-local.md
+++ b/docs/deployment/schedulers/docker-local.md
@@ -222,6 +222,6 @@ The `docker-local` scheduler supports a minimal list of resource _limits_ and _r
 ### Settable properties
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `init-process` | app + global | `true` | `--scheduler-docker-local-init-process`, `--scheduler-docker-local-global-init-process`, `--scheduler-docker-local-computed-init-process` | When `true`, runs containers with Docker's `--init` flag (reaping zombie processes) |
 | `parallel-schedule-count` | app + global | `1` | `--scheduler-docker-local-parallel-schedule-count`, `--scheduler-docker-local-global-parallel-schedule-count`, `--scheduler-docker-local-computed-parallel-schedule-count` | Maximum number of containers scheduled in parallel during a deploy |
diff --git a/docs/deployment/schedulers/k3s.md b/docs/deployment/schedulers/k3s.md
index e51991d5b..31fd5b552 100644
--- a/docs/deployment/schedulers/k3s.md
+++ b/docs/deployment/schedulers/k3s.md
@@ -1341,7 +1341,7 @@ If unspecified for any task, the default reservation will be `.1` CPU and `128Mi
 > The `Report flags` column lists the CLI argument names accepted by `scheduler-k3s:report`. The JSON keys emitted by `scheduler-k3s:report --format json` are the same names with the leading `--scheduler-k3s-` stripped (e.g. `deploy-timeout`, `global-deploy-timeout`, `computed-deploy-timeout`). Legacy keys with the `scheduler-k3s-` prefix are also emitted during the 0.38.x deprecation window and will be removed in a future major release.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `cert-issuer-kind` | app + global | `ClusterIssuer` | `--scheduler-k3s-cert-issuer-kind`, `--scheduler-k3s-global-cert-issuer-kind`, `--scheduler-k3s-computed-cert-issuer-kind` | Kind of the manually managed cert-manager issuer referenced by `cert-issuer-name`, either `Issuer` or `ClusterIssuer` |
 | `cert-issuer-name` | app + global | none | `--scheduler-k3s-cert-issuer-name`, `--scheduler-k3s-global-cert-issuer-name`, `--scheduler-k3s-computed-cert-issuer-name` | Name of a manually managed cert-manager issuer to request certificates from, taking precedence over the letsencrypt integration. Set to `false` to opt an app out of a global value |
 | `deploy-timeout` | app + global | `300s` | `--scheduler-k3s-deploy-timeout`, `--scheduler-k3s-global-deploy-timeout`, `--scheduler-k3s-computed-deploy-timeout` | Timeout for a single helm install/upgrade cycle |
diff --git a/docs/deployment/schedulers/scheduler-management.md b/docs/deployment/schedulers/scheduler-management.md
index 95036d825..53dcfe490 100644
--- a/docs/deployment/schedulers/scheduler-management.md
+++ b/docs/deployment/schedulers/scheduler-management.md
@@ -156,6 +156,6 @@ Deployment tasks are currently executed directly on the primary Dokku server.
 > The `Report flags` column lists the CLI argument names accepted by `scheduler:report`. The JSON keys emitted by `scheduler:report --format json` are the same names with the leading `--scheduler-` stripped (e.g. `selected`, `global-selected`, `computed-selected`). Legacy keys with the `scheduler-` prefix are also emitted during the 0.38.x deprecation window and will be removed in a future major release.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `selected` | app + global | `docker-local` | `--scheduler-selected`, `--scheduler-global-selected`, `--scheduler-computed-selected` | Scheduler plugin used to deploy this app (`docker-local`, `k3s`, etc.) |
 | `shell` | app + global | none | `--scheduler-shell`, `--scheduler-global-shell`, `--scheduler-computed-shell` | Shell used by `enter`/`run` commands when entering a container |
diff --git a/docs/development/architecture.md b/docs/development/architecture.md
index 83b72d028..e53cec10f 100644
--- a/docs/development/architecture.md
+++ b/docs/development/architecture.md
@@ -141,7 +141,7 @@ Plugins communicate through the **trigger system** powered by [plugn](https://gi
 **Key trigger categories:**
 
 | Category | Examples | Purpose |
-|----------|----------|---------|
+| ---------- | ---------- | --------- |
 | App lifecycle | `post-create`, `pre-delete`, `post-deploy` | React to app events |
 | Build | `builder-detect`, `pre-build`, `builder-build` | Control build process |
 | Deploy | `scheduler-deploy`, `check-deploy` | Manage deployments |
@@ -333,7 +333,7 @@ Global settings can be configured via:
 ## Key Design Decisions
 
 | Decision | Rationale |
-|----------|-----------|
+| ---------- | ----------- |
 | **Plugin-based architecture** | Enables extensibility without modifying core code. Community plugins can add databases, caching, and other services. |
 | **Bash + Go hybrid** | Bash for orchestration and simple commands; Go for performance-critical operations and complex logic. |
 | **Trigger system** | Loose coupling between plugins. Plugins don't need to know about each other; they just fire and respond to events. |
diff --git a/docs/networking/network.md b/docs/networking/network.md
index aba7edf78..fa9cf84e4 100644
--- a/docs/networking/network.md
+++ b/docs/networking/network.md
@@ -534,7 +534,7 @@ dokku network:report node-js-app --network-bind-all-interfaces
 > The `Report flags` column lists the CLI argument names accepted by `network:report`. The JSON keys emitted by `network:report --format json` are the same names with the leading `--network-` stripped (e.g. `attach-post-create`, `global-attach-post-create`, `computed-attach-post-create`). Legacy keys with the `network-` prefix (e.g. `network-attach-post-create`) are also emitted during the 0.38.x deprecation window and will be removed in a future major release.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `attach-post-create` | app + global | none | `--network-attach-post-create`, `--network-global-attach-post-create`, `--network-computed-attach-post-create` | Networks attached to a container immediately after creation, before the deploy phase |
 | `attach-post-deploy` | app + global | none | `--network-attach-post-deploy`, `--network-global-attach-post-deploy`, `--network-computed-attach-post-deploy` | Networks attached to a container after it passes healthchecks |
 | `bind-all-interfaces` | app + global | `false` | `--network-bind-all-interfaces`, `--network-global-bind-all-interfaces`, `--network-computed-bind-all-interfaces` | When `true`, binds containers to `0.0.0.0` instead of the default Docker network address |
diff --git a/docs/networking/port-management.md b/docs/networking/port-management.md
index bdd179677..4a64633db 100644
--- a/docs/networking/port-management.md
+++ b/docs/networking/port-management.md
@@ -272,7 +272,7 @@ dokku ports:report node-js-app --ports-map-detected-json | jq '.[0].container_po
 The following flags surface configured port mappings managed by `ports:set` / `ports:add` / `ports:remove` / `ports:clear`:
 
 | Flag | Description |
-|---|---|
+| --- | --- |
 | `--ports-map` | Configured port mappings as space-separated `scheme:host-port:container-port` values |
 | `--ports-map-json` | Configured port mappings as a JSON array of `{scheme, host_port, container_port}` objects |
 
@@ -281,6 +281,6 @@ The following flags surface configured port mappings managed by `ports:set` / `p
 The following flags surface in `ports:report` but are not managed by `ports:set` - they are derived from the deploy:
 
 | Flag | Description |
-|---|---|
+| --- | --- |
 | `--ports-map-detected` | Port mapping inferred from `EXPOSE` directives or the running container |
 | `--ports-map-detected-json` | Detected port mappings as a JSON array of `{scheme, host_port, container_port}` objects |
diff --git a/docs/networking/proxies/caddy.md b/docs/networking/proxies/caddy.md
index e126dd7d8..490eb7dac 100644
--- a/docs/networking/proxies/caddy.md
+++ b/docs/networking/proxies/caddy.md
@@ -271,7 +271,7 @@ dokku caddy:report node-js-app --caddy-computed-image
 ### Settable properties
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `image` | global only | _parsed from `plugins/caddy-vhosts/Dockerfile`_ | `--caddy-global-image`, `--caddy-computed-image` | Docker image used to run the Caddy container |
 | `letsencrypt-email` | global only | none | `--caddy-global-letsencrypt-email`, `--caddy-computed-letsencrypt-email` | Contact email enabling letsencrypt; empty disables https issuance |
 | `letsencrypt-server` | global only | `https://acme-v02.api.letsencrypt.org/directory` | `--caddy-global-letsencrypt-server`, `--caddy-computed-letsencrypt-server` | ACME directory used when requesting certificates |
diff --git a/docs/networking/proxies/haproxy.md b/docs/networking/proxies/haproxy.md
index b6534897b..b85980d7e 100644
--- a/docs/networking/proxies/haproxy.md
+++ b/docs/networking/proxies/haproxy.md
@@ -254,7 +254,7 @@ dokku haproxy:report node-js-app --haproxy-computed-image
 All haproxy properties are global only. Set with `haproxy:set --global <property> <value>`.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `image` | global only | _parsed from `plugins/haproxy-vhosts/Dockerfile`_ | `--haproxy-global-image`, `--haproxy-computed-image` | Docker image used to run the Haproxy container |
 | `letsencrypt-email` | global only | none | `--haproxy-global-letsencrypt-email`, `--haproxy-computed-letsencrypt-email` | Contact email enabling letsencrypt; empty disables https issuance |
 | `letsencrypt-server` | global only | `https://acme-v02.api.letsencrypt.org/directory` | `--haproxy-global-letsencrypt-server`, `--haproxy-computed-letsencrypt-server` | ACME directory used when requesting certificates |
diff --git a/docs/networking/proxies/nginx.md b/docs/networking/proxies/nginx.md
index 3bf9bb6a6..4ac343db6 100644
--- a/docs/networking/proxies/nginx.md
+++ b/docs/networking/proxies/nginx.md
@@ -634,7 +634,7 @@ See the [proxy documentation](/docs/networking/proxy-management.md#regenerating-
 All nginx-vhosts properties are settable at both the app and global scope.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `access-log-format` | app + global | none | `--nginx-access-log-format`, `--nginx-global-access-log-format`, `--nginx-computed-access-log-format` | Custom nginx `log_format` directive used for the access log |
 | `access-log-path` | app + global | _`{nginx-log-root}/{app}-access.log`_ | `--nginx-access-log-path`, `--nginx-global-access-log-path`, `--nginx-computed-access-log-path` | Path inside the nginx container where access logs are written |
 | `bind-address-ipv4` | app + global | none | `--nginx-bind-address-ipv4`, `--nginx-global-bind-address-ipv4`, `--nginx-computed-bind-address-ipv4` | IPv4 address the nginx server block binds to |
@@ -681,6 +681,6 @@ The following flag surfaces in `nginx:report` but is not managed by `nginx:set`:
 The following properties are recorded internally by the plugin and are not exposed via `nginx:report`:
 
 | Property | Description | Source |
-|---|---|---|
+| --- | --- | --- |
 | `proxy-status` | `started`/`stopped` state of the nginx system service | `cmd-nginx-start`/`cmd-nginx-stop` |
 | `nginx-conf-sigil-migrated` | Migration sentinel set the first time a v1 template is rewritten to the current schema | `plugins/nginx-vhosts/install` writes `"true"` once the install-time migration runs |
diff --git a/docs/networking/proxies/openresty.md b/docs/networking/proxies/openresty.md
index ea8d0272b..274dabd4b 100644
--- a/docs/networking/proxies/openresty.md
+++ b/docs/networking/proxies/openresty.md
@@ -291,7 +291,7 @@ Global-only properties expose two report flags: `--openresty-global-<property>`
 App-or-global properties expose three report flags: `--openresty-<property>` returns the raw per-app value (empty when unset), `--openresty-global-<property>` returns the raw global value (empty when unset), and `--openresty-computed-<property>` returns the effective value, resolving the per-app value first, then the global value, then the built-in default.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `access-log-format` | app or global | none | `--openresty-access-log-format`, `--openresty-global-access-log-format`, `--openresty-computed-access-log-format` | Custom nginx `log_format` directive used for the access log |
 | `access-log-path` | app or global | _`/var/log/nginx/{app}-access.log`_ | `--openresty-access-log-path`, `--openresty-global-access-log-path`, `--openresty-computed-access-log-path` | Path inside the openresty container where access logs are written |
 | `allowed-letsencrypt-domains-func-base64` | global only | _allow-all stub_ | `--openresty-global-allowed-letsencrypt-domains-func-base64`, `--openresty-computed-allowed-letsencrypt-domains-func-base64` | Base64-encoded Lua function deciding which domains may request a letsencrypt certificate |
diff --git a/docs/networking/proxies/traefik.md b/docs/networking/proxies/traefik.md
index 3a508578a..2e7a08fbe 100644
--- a/docs/networking/proxies/traefik.md
+++ b/docs/networking/proxies/traefik.md
@@ -408,7 +408,7 @@ dokku traefik:report node-js-app --traefik-computed-api-enabled
 All traefik properties are global only. Set with `traefik:set --global <property> <value>`.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `api-enabled` | global only | `false` | `--traefik-global-api-enabled`, `--traefik-computed-api-enabled` | When `true`, enables the Traefik HTTP API |
 | `api-entry-point` | global only | none | `--traefik-global-api-entry-point`, `--traefik-computed-api-entry-point` | Name of the entry point used by the Traefik API |
 | `api-entry-point-address` | global only | none | `--traefik-global-api-entry-point-address`, `--traefik-computed-api-entry-point-address` | Address (`host:port`) the Traefik API listens on |
diff --git a/docs/networking/proxy-management.md b/docs/networking/proxy-management.md
index cda6ad6a1..260cee22f 100644
--- a/docs/networking/proxy-management.md
+++ b/docs/networking/proxy-management.md
@@ -245,7 +245,7 @@ Finally, proxy implementations _may_ install extra software needed for the proxy
 > The `Report flags` column lists the CLI argument names accepted by `proxy:report`. The JSON keys emitted by `proxy:report --format json` are the same names with the leading `--proxy-` stripped (e.g. `type`, `global-type`, `computed-type`). Legacy keys with the `proxy-` prefix (e.g. `proxy-type`) are also emitted during the 0.38.x deprecation window and will be removed in a future major release.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `disabled` | app only | `false` | `--proxy-disabled`, `--proxy-computed-disabled` (also exposed inverted as `--proxy-enabled`) | When `true`, disables proxy integration for this app (`proxy:enable`/`proxy:disable` write this) |
 | `proxy-port` | app + global | none | `--proxy-proxy-port`, `--proxy-global-proxy-port`, `--proxy-computed-proxy-port` | Override port used for the HTTP listener in the generated proxy config |
 | `proxy-ssl-port` | app + global | none | `--proxy-proxy-ssl-port`, `--proxy-global-proxy-ssl-port`, `--proxy-computed-proxy-ssl-port` | Override port used for the HTTPS listener in the generated proxy config |
diff --git a/docs/processes/process-management.md b/docs/processes/process-management.md
index 6ee9f9c37..6c6b37bd8 100644
--- a/docs/processes/process-management.md
+++ b/docs/processes/process-management.md
@@ -543,7 +543,7 @@ dokku ps:set node-js-app restore
 > The `Report flags` column lists the CLI argument names accepted by `ps:report`. The JSON keys emitted by `ps:report --format json` are the same names with the leading `--ps-` stripped (e.g. `procfile-path`, `global-procfile-path`, `computed-procfile-path`). Legacy keys with the `ps-` prefix (e.g. `ps-procfile-path`) are also emitted during the 0.38.x deprecation window and will be removed in a future major release.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `dockerfile-start-cmd` | app only | none | `--ps-dockerfile-start-cmd`, `--ps-computed-dockerfile-start-cmd` | Override `CMD` for Dockerfile-based apps |
 | `procfile-path` | app + global | `Procfile` | `--ps-procfile-path`, `--ps-global-procfile-path`, `--ps-computed-procfile-path` | Path to the app's Procfile, relative to the build root |
 | `restart-policy` | app + global | `on-failure:10` | `--ps-restart-policy`, `--ps-global-restart-policy`, `--ps-computed-restart-policy` | Docker restart policy applied to deployed containers (`no`, `always`, `unless-stopped`, `on-failure[:max-retries]`) |
@@ -557,7 +557,7 @@ dokku ps:set node-js-app restore
 The following flags surface in `ps:report` but are not managed by `ps:set` - they are derived from the running process state:
 
 | Flag | Description |
-|---|---|
+| --- | --- |
 | `--ps-can-scale` | `false` when the app's procfile or builder forbids horizontal scaling |
 | `--deployed` | `true` after the first successful deploy |
 | `--running` | `true` while any container for the app is running |
diff --git a/docs/processes/scheduled-cron-tasks.md b/docs/processes/scheduled-cron-tasks.md
index dfd80db53..77b983a8e 100644
--- a/docs/processes/scheduled-cron-tasks.md
+++ b/docs/processes/scheduled-cron-tasks.md
@@ -338,7 +338,7 @@ SHELL=/bin/bash
 > The `Report flags` column lists the CLI argument names accepted by `cron:report`. The JSON keys emitted by `cron:report --format json` are the same names with the leading `--cron-` stripped (e.g. `global-mailto`, `computed-mailto`, `maintenance`). Legacy keys with the `cron-` prefix (e.g. `cron-global-mailto`) are also emitted during the 0.38.x deprecation window and will be removed in a future major release.
 
 | Property | Scope | Default | Report flags | Description |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | `mailfrom` | global only | none | `--cron-global-mailfrom`, `--cron-computed-mailfrom` | `From:` address used in cron failure emails |
 | `mailto` | global only | none | `--cron-global-mailto`, `--cron-computed-mailto` | Recipient address for cron failure emails; empty disables email |
 | `maintenance` | app + global | `false` | `--cron-maintenance`, `--cron-global-maintenance`, `--cron-computed-maintenance` | When `true`, suspends all cron tasks for the app (or globally) |