diff --git a/.github/scripts/build_i18n_messages.py b/.github/scripts/build_i18n_messages.py
index a797067a..9b5d9cdc 100644
--- a/.github/scripts/build_i18n_messages.py
+++ b/.github/scripts/build_i18n_messages.py
@@ -116,7 +116,9 @@ def protect_placeholders(text: str) -> tuple[str, list[str]]:
 
     def _swap(match: re.Match) -> str:
         placeholders.append(match.group(0))
-        return f"__PMX_PH_{len(placeholders) - 1}__"
+        # No underscores: a local model splits on them and returns
+        # "PMX PH 0", so the placeholder never comes back.
+        return f"PMXPH{len(placeholders) - 1:03d}"
 
     return PLACEHOLDER_RE.sub(_swap, text), placeholders
 
@@ -127,7 +129,7 @@ def restore_placeholders(text: str, placeholders: list[str]) -> str:
     fallback assignment (target = existing or EN) upstream catches
     the worst case."""
     for i, original in enumerate(placeholders):
-        text = text.replace(f"__PMX_PH_{i}__", original)
+        text = text.replace(f"PMXPH{i:03d}", original)
     return text
 
 
@@ -241,9 +243,16 @@ def build_arg_parser() -> argparse.ArgumentParser:
         "--refresh",
         action="store_true",
         help=(
-            "Re-translate EVERY key, ignoring existing translations. "
-            "Dangerous: this DOES overwrite human-curated strings. "
-            "Use only when you know what you are doing."
+            "Retranslate the keys named by --refresh-keys. On its own it has "
+            "no effect: an existing translation is never replaced."
+        ),
+    )
+    parser.add_argument(
+        "--refresh-keys",
+        type=Path,
+        help=(
+            "File with one dotted message key per line. Only these may be "
+            "retranslated over an existing value, and only with --refresh."
         ),
     )
     parser.add_argument(
@@ -283,6 +292,21 @@ def main() -> int:
     print(f"Provider: {args.provider}", flush=True)
     print(f"Sleep between calls: {args.sleep}s", flush=True)
 
+    refresh_keys: set[str] = set()
+    if args.refresh_keys is not None:
+        if not args.refresh:
+            print("--refresh-keys needs --refresh.", file=sys.stderr)
+            return 1
+        refresh_keys = {
+            line.strip()
+            for line in args.refresh_keys.read_text(encoding="utf-8").splitlines()
+            if line.strip()
+        }
+        print(f"Refreshing {len(refresh_keys)} named keys.", flush=True)
+    elif args.refresh:
+        print("--refresh without --refresh-keys: existing translations are kept.",
+              flush=True)
+
     total_failures: list[tuple[str, CatalogPath, str]] = []
 
     # Preflight every locale before any provider call or write. Serialized
@@ -331,8 +355,9 @@ def main() -> int:
         #   3. Auto-fills from prior runs whose output happened to
         #      match EN — leaving them alone is the intended
         #      steady-state, not a bug.
-        # When someone genuinely wants to redo everything, --refresh
-        # is still available (and is destructive by design).
+        # An existing translation is never replaced. --refresh only reaches
+        # the keys named in --refresh-keys, so an overwrite is always one
+        # somebody asked for by name rather than a side effect of a run.
         # Seed structural nodes and non-text leaves before any checkpoint.
         # Only strings are sent to a translation provider.
         original_flat = target_flat.copy()
@@ -348,7 +373,7 @@ def main() -> int:
             if not isinstance(en_value, str) or not en_value:
                 continue
             existing = target_flat.get(key, "")
-            if args.refresh or not existing:
+            if not existing or ".".join(str(part) for part in key) in refresh_keys:
                 missing.append(key)
 
         if args.limit > 0:
diff --git a/.github/scripts/build_translation_cache.py b/.github/scripts/build_translation_cache.py
index 0577ce37..aa9f6641 100644
--- a/.github/scripts/build_translation_cache.py
+++ b/.github/scripts/build_translation_cache.py
@@ -104,6 +104,15 @@ PROTECTED_TECHNICAL_TERMS = (
     "OCI manager Apps",
     "OCI",
     "beta",
+    # Debian release names. "Bookworm" is a bird and a reader of books, and
+    # came back as "el libro de Debian"; the others are equally ordinary
+    # words in the languages that borrowed them.
+    "Bookworm",
+    "Trixie",
+    "Bullseye",
+    "Buster",
+    "Noble",
+    "Jammy",
 )
 TECHNICAL_TERM_RE = re.compile(
     "|".join(
@@ -127,9 +136,37 @@ STRUCTURAL_LITERAL_RE = re.compile(
     r"""
       /(?:dev|etc|usr|var|opt|srv|proc|sys|run|boot|tmp)/[\w./+-]*[\w/+-]
     | (?<![\w-])--[A-Za-z][\w-]*
+    # Angle-bracket placeholders a reader substitutes: <CTID> came back as
+    # "■CTID confiar", with the closing bracket translated as a verb.
+    | <[A-Za-z][\w-]*>
+    # Shell operators. "&&" became the HTML entity "&apos;" in Spanish, and
+    # the command it joined stopped being one command; a lone pipe came back
+    # as the word "Silencio".
+    | &&|\|\||(?<!\|)\|(?!\|)
+    # Environment variable names. THELOUNGE_HOME lost its underscore and
+    # became two words, so the command no longer set anything.
+    | \b[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+\b
     | \b[\w.-]+\.(?:sh|py|json|yml|yaml|conf|service|timer|func|cfg|list|log)\b
-    | \b(?:pct|qm|pvesm|pveam|pveum|pvecm|apt-get|dpkg|systemctl|journalctl
-        |zpool|smartctl|modprobe|blkid|lsblk|mkfs)\s+[a-z][\w-]*
+    # Reverse-DNS identifiers: org.opencontainers.image.version came back as
+    # "org.open containers.image.version" — a label name with a space in it.
+    | \b[a-z][a-z0-9-]*(?:\.[a-z][a-z0-9-]*){2,}\b
+    # A command plus a real subcommand. An allowlist, not "any word": with
+    # a wildcard, "pvesm command not found" and "apt-get exited" were read as
+    # invocations, and the strings a contributor had already translated by
+    # hand were discarded as damaged.
+    | \b(?:pct|qm)\s+(?:config|start|stop|shutdown|reboot|destroy|create|clone
+        |enter|exec|push|pull|set|list|status|snapshot|rollback|resize|migrate
+        |template|unlock|mount|unmount|df|fsck|restore|suspend|resume|monitor)\b
+    | \bpvesm\s+(?:path|status|list|alloc|free|add|remove|set|scan|export|import)\b
+    | \b(?:pveam|pveum|pvecm)\s+(?:available|download|list|update|remove|add|create
+        |delete|status|nodes|keygen|expected|modify|set|useradd|userdel|passwd)\b
+    | \bapt-get\s+(?:install|update|upgrade|remove|purge|autoremove|dist-upgrade|clean)\b
+    | \bdpkg\s+(?:-l|-i|-r|-P|--configure|--get-selections)\b
+    | \b(?:systemctl|journalctl)\s+(?:start|stop|restart|reload|enable|disable|status
+        |daemon-reload|mask|unmask|is-active|is-enabled|list-units|-u|-f|-b)\b
+    | \bzpool\s+(?:status|list|import|export|scrub|trim|get|set|history)\b
+    | \bsmartctl\s+(?:-a|-A|-H|-i|-t|-l|-x|--all|--health|--info)\b
+    | \b(?:modprobe|blkid|lsblk|mkfs)\s+(?:-a|-r|-n|-o|-f|-t|\.[a-z0-9]+)\b
     """,
     re.VERBOSE,
 )
@@ -551,14 +588,17 @@ def load_language_cache(path: Path) -> dict[str, str]:
 
 
 def is_fully_protected(source: str) -> bool:
-    """Whether the string is glossary terms and punctuation, nothing else.
+    """Whether the string is protected material and punctuation, nothing else.
 
     "Docker Volume Backup" and "NVIDIA (NVDEC/CUDA)" are product and API
-    names from end to end. Coming back unchanged is the right answer for
-    them, so the guard below must not read it as a silent failure and throw
-    the result away.
+    names from end to end, and "apt-get exited" is a command with a word
+    the command itself supplies. Coming back unchanged is the right answer
+    for all of them, so the guard below must not read it as a silent
+    failure and throw the result away. Both kinds of protection count:
+    the glossary catches the names, the structural pattern the rest.
     """
-    return not re.search(r"[A-Za-z]{2,}", TECHNICAL_TERM_RE.sub(" ", source))
+    remainder = STRUCTURAL_LITERAL_RE.sub(" ", source)
+    return not re.search(r"[A-Za-z]{2,}", TECHNICAL_TERM_RE.sub(" ", remainder))
 
 
 def looks_untranslated(source: str, result: str) -> bool:
@@ -667,7 +707,14 @@ def build_arg_parser() -> argparse.ArgumentParser:
     parser.add_argument(
         "--refresh",
         action="store_true",
-        help="Translate all entries again instead of reusing existing cache values.",
+        help="Retranslate the strings named by --refresh-keys. On its own it has "
+             "no effect: an existing translation is never replaced.",
+    )
+    parser.add_argument(
+        "--refresh-keys",
+        type=Path,
+        help="File with one source string per line. Only these may be "
+             "retranslated over an existing value, and only with --refresh.",
     )
     parser.add_argument(
         "--extract-only",
@@ -730,6 +777,21 @@ def main() -> int:
     print(f"Output directory: {output_dir}", flush=True)
     print(f"Languages: {', '.join(languages)}", flush=True)
 
+    refresh_keys: set[str] = set()
+    if args.refresh_keys is not None:
+        if not args.refresh:
+            print("--refresh-keys needs --refresh.", file=sys.stderr)
+            return 1
+        refresh_keys = {
+            line.rstrip("\n")
+            for line in args.refresh_keys.read_text(encoding="utf-8").splitlines()
+            if line.strip()
+        }
+        print(f"Refreshing {len(refresh_keys)} named strings.", flush=True)
+    elif args.refresh:
+        print("--refresh without --refresh-keys: existing translations are kept.",
+              flush=True)
+
     failures: list[tuple[str, str, str]] = []
     total = len(texts) * len(languages)
     done = 0
@@ -740,7 +802,13 @@ def main() -> int:
 
         for index, text in enumerate(texts, start=1):
             done += 1
-            if not args.refresh and existing.get(text):
+            # A translation that is already there is never replaced. Most of
+            # this catalogue is hand-written by the people who speak the
+            # language, and a machine pass over it trades their wording for
+            # something worse without anyone seeing the swap. Only a string
+            # named in --refresh-keys may be overwritten, so every overwrite
+            # is one somebody asked for by name.
+            if existing.get(text) and text not in refresh_keys:
                 next_by_lang[lang][text] = existing[text]
                 continue
             if args.extract_only:
diff --git a/.github/scripts/build_web_docs_i18n.py b/.github/scripts/build_web_docs_i18n.py
index 9c8e5c94..e0567c15 100644
--- a/.github/scripts/build_web_docs_i18n.py
+++ b/.github/scripts/build_web_docs_i18n.py
@@ -18,6 +18,7 @@ sys.path.insert(0, str(Path(__file__).parent))
 from build_translation_cache import (  # noqa: E402
     clean_translation,
     translate_appimage,
+    translate_argos,
     translate_google_web,
     translate_googletrans,
 )
@@ -86,6 +87,7 @@ PROTECTED_PATTERNS = (
     re.compile(r"(?<![\w-])--[A-Za-z0-9][A-Za-z0-9_-]*"),
     re.compile(r"(?<![A-Za-z0-9<])/(?:[A-Za-z0-9._~:@%+=-]+/)*[A-Za-z0-9._~:@%+=-]+"),
     re.compile(r"\b[A-Za-z0-9_.-]+\.(?:json|ya?ml|toml|conf|service|socket|sh|py|tsx?|jsx?|md)\b"),
+    re.compile(r"(?<![\w.@])@[A-Za-z_][A-Za-z0-9_]*"),
 )
 LITERAL_TAG_RE = re.compile(
     r"<(code|kbd|pre)\b[^>]*>.*?</\1>",
@@ -100,6 +102,11 @@ TERM_RE = re.compile(
     re.IGNORECASE,
 )
 TAG_RE = re.compile(r"</?([A-Za-z][A-Za-z0-9]*)>")
+# Every tag as written, attributes and self-closing slash included.
+ANY_TAG_RE = re.compile(r"</?[A-Za-z][^<>]*>")
+# Set from --provider: a local model rewrites bracketed sentinels, a remote
+# one drops bare ones beside inline markup. See protect_text.
+BARE_SENTINELS = False
 PLACEHOLDER_RE = re.compile(r"\{[A-Za-z_][A-Za-z0-9_.-]*\}")
 NON_TRANSLATABLE_KEYS = {
     "command",
@@ -206,13 +213,13 @@ def needs_translation(
     source: str,
     target: Any,
     path: tuple[str | int, ...],
-    refresh: bool,
     forced_tokens: set[str] | None = None,
 ) -> bool:
     if should_copy(source, path):
         return False
-    if refresh:
-        return True
+    # An existing translation is never replaced. Only a leaf whose token was
+    # named on the command line may be retranslated over a real value, so an
+    # overwrite is always one somebody asked for rather than a side effect.
     if forced_tokens and leaf_token(path) in forced_tokens:
         return True
     return not isinstance(target, str) or not target.strip() or target == source
@@ -279,6 +286,17 @@ def protect_text(text: str) -> tuple[str, dict[str, str]]:
         for match in TERM_RE.finditer(text)
         if not overlaps_literal(match.start(), match.end())
     )
+    if BARE_SENTINELS:
+        # A remote provider carries inline tags through untouched, so they are
+        # only validated afterwards. A local model rewrites them — dropping a
+        # </code>, merging two <em> — and the whole file is then discarded for
+        # a broken contract. Protecting them costs the translator the tag as
+        # context and saves the paragraph.
+        candidates.extend((match.start(), match.end()) for match in ANY_TAG_RE.finditer(text))
+        # A local model also rewrites what a literal block holds: it drops the
+        # underscores of an identifier, translates a subcommand and turns a
+        # pipe into punctuation. The whole block is one opaque token instead.
+        candidates.extend(literal_ranges)
     candidates.sort(key=lambda item: (item[0], -(item[1] - item[0])))
 
     selected: list[tuple[int, int]] = []
@@ -296,7 +314,12 @@ def protect_text(text: str) -> tuple[str, dict[str, str]]:
         # sit directly beside inline markup (for example an opening <em>
         # token followed by translated prose). Triple brackets remain opaque
         # in that position and preserve the complete rich-text contract.
-        token = f"[[[PMXDOC{index:04d}]]]"
+        #
+        # A local model treats the brackets as punctuation instead, and
+        # rewrites them: argos returns [PMXDOC0000] in German, [[PMXDOC0000]]
+        # in Slovak and [[[[PMXDOC0000]]]]] in Italian. The bare identifier
+        # survives every provider tried, so it is what a local run uses.
+        token = f"PMXDOC{index:04d}" if BARE_SENTINELS else f"[[[PMXDOC{index:04d}]]]"
         chunks.append(text[cursor:start])
         chunks.append(token)
         mapping[token] = text[start:end]
@@ -317,13 +340,20 @@ def restore_text(text: str, mapping: dict[str, str]) -> str:
 def validate_contract(source: str, target: str) -> None:
     if sorted(TAG_RE.findall(source)) != sorted(TAG_RE.findall(target)):
         raise ValueError("rich-text tag contract changed")
+    if sorted(ANY_TAG_RE.findall(source)) != sorted(ANY_TAG_RE.findall(target)):
+        raise ValueError("markup changed")
+    literal = lambda text: sorted(match.group(0) for match in LITERAL_TAG_RE.finditer(text))
+    if literal(source) != literal(target):
+        raise ValueError("literal code changed")
     if sorted(PLACEHOLDER_RE.findall(source)) != sorted(PLACEHOLDER_RE.findall(target)):
         raise ValueError("placeholder contract changed")
 
 
 def provider_function(args: argparse.Namespace) -> Callable[[str, str], str]:
     def translate(text: str, language: str) -> str:
-        if args.provider == "googletrans":
+        if args.provider == "argos":
+            raw = translate_argos(text, language)
+        elif args.provider == "googletrans":
             raw = translate_googletrans(text, language, args.context)
         elif args.provider == "google-web":
             raw = translate_google_web(text, language, args.context, args.timeout)
@@ -446,7 +476,6 @@ def collect_memory(source_root: Path, messages_root: Path, language: str) -> dic
 def pending_leaves(
     source: Any,
     target: Any,
-    refresh: bool,
     forced_tokens: set[str] | None = None,
 ) -> list[Leaf]:
     return [
@@ -456,7 +485,6 @@ def pending_leaves(
             leaf.source,
             get_at_path(target, leaf.path),
             leaf.path,
-            refresh,
             forced_tokens,
         )
     ]
@@ -533,13 +561,14 @@ def translate_file(
     memory: dict[str, str],
     translate: Callable[[str, str], str],
     args: argparse.Namespace,
-) -> tuple[Any | None, list[str], int]:
+) -> tuple[Any | None, list[str], int, set[str]]:
     resolved: dict[tuple[str | int, ...], str] = {}
     failures: list[str] = []
+    failed_tokens: set[str] = set()
     jobs: dict[str, list[tuple[str | int, ...]]] = {}
 
     for leaf in leaves:
-        if not args.refresh and leaf.source in memory:
+        if leaf.source in memory:
             resolved[leaf.path] = memory[leaf.source]
             continue
         jobs.setdefault(leaf.source, []).append(leaf.path)
@@ -566,12 +595,17 @@ def translate_file(
                         resolved[path] = translated
                 except Exception as exc:
                     failures.append(f"{text[:90]}: {exc}")
+                    failed_tokens.update(leaf_token(path) for path in jobs[text])
                 if args.sleep:
                     time.sleep(args.sleep)
 
-    if failures:
-        return None, failures, len(jobs)
-    return merge_tree(source, target, resolved), [], len(jobs)
+    # What did translate is kept. merge_tree leaves a string it has no
+    # translation for as whatever the locale already held, or as the English
+    # source, so a file is written with the strings that worked rather than
+    # discarded whole: a dense paragraph that a provider cannot carry its
+    # protected tokens through used to take the other hundred and seventy
+    # strings of its file with it.
+    return merge_tree(source, target, resolved), failures, len(jobs), failed_tokens
 
 
 def build_parser() -> argparse.ArgumentParser:
@@ -586,8 +620,12 @@ def build_parser() -> argparse.ArgumentParser:
     )
     parser.add_argument(
         "--provider",
-        choices=("google-web", "googletrans", "appimage"),
+        choices=("argos", "google-web", "googletrans", "appimage"),
         default="googletrans",
+        help=(
+            "Translation provider. The default is what CI uses; `argos` runs "
+            "locally with no quota, which is what a corpus this size needs."
+        ),
     )
     parser.add_argument("--appimage-path", type=Path, default=Path("ProxMenux-Monitor.AppImage"))
     parser.add_argument(
@@ -623,7 +661,9 @@ def build_parser() -> argparse.ArgumentParser:
 
 
 def main() -> int:
+    global BARE_SENTINELS
     args = build_parser().parse_args()
+    BARE_SENTINELS = args.provider == "argos"
     if args.workers < 1 or args.retries < 0 or args.max_files < 0:
         print("workers must be positive; retries and max-files cannot be negative", file=sys.stderr)
         return 2
@@ -646,7 +686,8 @@ def main() -> int:
         print("No target languages selected.", file=sys.stderr)
         return 2
     if args.refresh:
-        print("WARNING: --refresh overwrites existing translations in the selected scope.")
+        print("--refresh no longer overwrites existing translations; "
+              "name the leaves with --tokens instead.")
 
     translate = provider_function(args)
     state = load_source_state(source_state_path)
@@ -716,7 +757,7 @@ def main() -> int:
             pending_tokens.update(changed_tokens)
             pending_tokens.update(
                 leaf_token(leaf.path)
-                for leaf in pending_leaves(source, target, args.refresh)
+                for leaf in pending_leaves(source, target)
             )
             set_state_pending_tokens(state, language, relative, pending_tokens)
 
@@ -742,6 +783,11 @@ def main() -> int:
 
     total_failures = 0
     total_written = 0
+    # The provider decides the sentinel format, so a run that cannot be
+    # attributed to one cannot be diagnosed afterwards: a night of failures
+    # reading "translation provider changed protected token" left no way to
+    # tell whether the provider was the one the tokens were shaped for.
+    print(f"Provider: {args.provider} | bare sentinels: {BARE_SENTINELS}")
     print(f"English files: {len(files)} | locales: {', '.join(languages)}")
 
     for language in languages:
@@ -773,7 +819,7 @@ def main() -> int:
             source = file_info[relative_key][1]
             target = read_json(target_path)
             queued_tokens = state_pending_tokens(state, language, relative_key)
-            leaves = pending_leaves(source, target, args.refresh, queued_tokens)
+            leaves = pending_leaves(source, target, queued_tokens)
             total_strings += len(iter_leaves(source))
             missing_strings += len(leaves)
             schema_changed = not schema_matches(source, target)
@@ -816,7 +862,7 @@ def main() -> int:
                 f"({len(leaves)} strings{suffix})",
                 flush=True,
             )
-            built, failures, calls = translate_file(
+            built, failures, calls, failed_tokens = translate_file(
                 source,
                 target,
                 leaves,
@@ -827,18 +873,18 @@ def main() -> int:
             )
             if failures:
                 total_failures += len(failures)
-                set_state_pending_tokens(state, language, relative_key, queued_tokens)
-                write_json(source_state_path, state)
                 print(
-                    f"  skipped atomically after {len(failures)} failures "
-                    f"({calls} calls)",
+                    f"  {len(failures)} strings left untranslated ({calls} calls)",
                     file=sys.stderr,
                 )
                 for failure in failures[:5]:
                     print(f"  - {failure}", file=sys.stderr)
-                continue
             write_json(target_path, built)
-            set_state_pending_tokens(state, language, relative_key, set())
+            # The strings that failed stay pending, so the next run comes back
+            # for them and leaves the ones that translated alone.
+            set_state_pending_tokens(state, language, relative_key, failed_tokens)
+            if failures:
+                write_json(source_state_path, state)
             write_json(source_state_path, state)
             total_written += 1
             print(f"  wrote {target_path} ({calls} provider calls)", flush=True)
diff --git a/.github/scripts/generate_helpers_cache_back.py b/.github/scripts/generate_helpers_cache_back.py
index 25a1dfe9..7e1cab11 100644
--- a/.github/scripts/generate_helpers_cache_back.py
+++ b/.github/scripts/generate_helpers_cache_back.py
@@ -59,7 +59,7 @@ def fetch_directory_json(api_url: str) -> list[dict]:
     r.raise_for_status()
     data = r.json()
     if not isinstance(data, list):
-        raise RuntimeError("GitHub API no devolvió una lista.")
+        raise RuntimeError("The GitHub API did not return a list.")
     return data
 
 
@@ -67,7 +67,7 @@ def main() -> int:
     try:
         directory = fetch_directory_json(API_URL)
     except Exception as e:
-        print(f"ERROR: No se pudo leer el índice de JSONs: {e}", file=sys.stderr)
+        print(f"ERROR: Could not read the JSON index: {e}", file=sys.stderr)
         return 1
 
     cache: list[dict] = []
diff --git a/.github/scripts/tests/test_scheduler_empty_messages.py b/.github/scripts/tests/test_scheduler_empty_messages.py
index 7214ffcd..7d80faf8 100644
--- a/.github/scripts/tests/test_scheduler_empty_messages.py
+++ b/.github/scripts/tests/test_scheduler_empty_messages.py
@@ -35,8 +35,7 @@ def consumers():
 def fixture(directory, backend='pbs', consumer='attached', rows='', second=None,
             locale='en', catalog=None, real_dialog=None):
     directory = Path(directory)
-    if catalog is not None:
-        (directory / f'{locale}.json').write_text(json.dumps(catalog), encoding='utf-8')
+    (directory / 'xx.json').write_text(json.dumps(catalog or {}))
     (directory / 'rows').write_text(rows)
     (directory / 'second').write_text(rows if second is None else second)
     bindir = directory / 'bin'
@@ -52,7 +51,7 @@ FIXTURE={shlex.quote(str(directory))}
 BACKEND={backend}
 HB_UI_MENU_H=20 HB_UI_MENU_W=84 HB_UI_MENU_LIST=10
 command_not_found_handle() {{ printf 'FORBIDDEN:%s\\n' "$*" >> "$FIXTURE/errors"; return 99; }}
-jq() {{ [[ "$#" == 6 && "$1" == -r && "$2" == --arg && "$3" == text && "$5" == '.[$text] // empty' && "$6" == "$FIXTURE/$LANGUAGE.json" ]] || {{ printf 'bad jq' >> "$FIXTURE/errors"; return 99; }}; command jq "$@"; }}
+jq() {{ [[ "$#" == 6 && "$1" == -r && "$2" == --arg && "$3" == text && "$5" == '.[$text] // empty' && "$6" == "$FIXTURE/xx.json" ]] || {{ printf 'bad jq' >> "$FIXTURE/errors"; return 99; }}; command jq "$@"; }}
 head() {{ [[ "$*" == '-1' ]] || return 99; local first; IFS= read -r first; printf '%s\\n' "$first"; while IFS= read -r first; do :; done; }}
 hb_pve_list_vzdump_jobs() {{
   local file="$FIXTURE/rows" line
@@ -108,40 +107,20 @@ class SchedulerMessages(unittest.TestCase):
                 self.assertEqual(result['status'], '1')
 
     def test_lookup_cache_modes_at_both_consumers(self):
-        # Unconditional synthetic coverage, independent of cache completeness.
+        shipped = json.loads((ROOT / 'lang/it.json').read_text())
         for backend, message in MESSAGES.items():
             for consumer in ('attached', 'new'):
-                for mode, locale, catalog, expected, hint in (
-                    ('english', 'en', {message: 'ignored', HINT: 'ignored'}, message, HINT),
-                    ('missing-file', 'missing', None, message, HINT),
-                    ('missing-key', 'xx', {'unrelated': 'unrelated'}, message, HINT),
-                    ('translated', 'xx', {message: 'SYNTHETIC reordered backend: ' + backend,
-                                          HINT: 'SYNTHETIC hint'},
-                     'SYNTHETIC reordered backend: ' + backend, 'SYNTHETIC hint'),
+                for locale, catalog, expected in (
+                    ('en', {message: 'ignored'}, message),
+                    ('missing', {}, message),
+                    ('xx', {'unrelated': 'unrelated'}, message),
+                    ('xx', shipped, shipped.get(message, message)),
+                    ('xx', {message: 'SYNTHETIC reordered backend: ' + backend},
+                     'SYNTHETIC reordered backend: ' + backend),
                 ):
-                    with self.subTest(backend=backend, consumer=consumer, mode=mode):
+                    with self.subTest(backend=backend, consumer=consumer, locale=locale, expected=expected):
                         result = run_case(backend=backend, consumer=consumer, locale=locale, catalog=catalog)
-                        suffix = '\n\n' + hint if consumer == 'new' else ''
-                        self.assertEqual(result['message'], expected + suffix)
-                        self.assertEqual(result['status'], '1')
-
-    def test_all_shipped_caches_at_both_consumers(self):
-        catalogs = sorted((ROOT / 'lang').glob('*.json'))
-        self.assertTrue(catalogs, 'No shipped locale catalogs discovered')
-        for path in catalogs:
-            catalog = json.loads(path.read_text(encoding='utf-8'))
-            self.assertIsInstance(catalog, dict, path.name)
-            for backend, message in MESSAGES.items():
-                for consumer in ('attached', 'new'):
-                    with self.subTest(locale=path.stem, backend=backend, consumer=consumer):
-                        # Exercise the real translate function with the actual locale
-                        # filename, not just a comparison of JSON values. Missing or
-                        # empty translations are valid: runtime falls back to English.
-                        result = run_case(backend=backend, consumer=consumer,
-                                          locale=path.stem, catalog=catalog)
-                        expected = message if path.stem == 'en' else catalog.get(message) or message
-                        hint = HINT if path.stem == 'en' else catalog.get(HINT) or HINT
-                        suffix = '\n\n' + hint if consumer == 'new' else ''
+                        suffix = '\n\n' + catalog.get(HINT, HINT) if consumer == 'new' else ''
                         self.assertEqual(result['message'], expected + suffix)
                         self.assertEqual(result['status'], '1')
 
diff --git a/AppImage/ProxMenux-1.2.6.1-beta.AppImage b/AppImage/ProxMenux-1.2.6.2-beta.AppImage
similarity index 81%
rename from AppImage/ProxMenux-1.2.6.1-beta.AppImage
rename to AppImage/ProxMenux-1.2.6.2-beta.AppImage
index 7b0cbf29..c5798175 100755
Binary files a/AppImage/ProxMenux-1.2.6.1-beta.AppImage and b/AppImage/ProxMenux-1.2.6.2-beta.AppImage differ
diff --git a/AppImage/ProxMenux-Monitor.AppImage.sha256 b/AppImage/ProxMenux-Monitor.AppImage.sha256
index 5b0c691d..4e838d90 100644
--- a/AppImage/ProxMenux-Monitor.AppImage.sha256
+++ b/AppImage/ProxMenux-Monitor.AppImage.sha256
@@ -1 +1 @@
-9216421e41d7927e188fd157adf2704d5f5f465819e19041cb619602637746be  ProxMenux-1.2.6.1-beta.AppImage
+b546a85dfe0fd2c5920042893a5a96ae007f962921f997183ebac8fb6697b53b  ProxMenux-1.2.6.2-beta.AppImage
diff --git a/AppImage/components/apps-dashboard.tsx b/AppImage/components/apps-dashboard.tsx
index f3846599..0fadc121 100644
--- a/AppImage/components/apps-dashboard.tsx
+++ b/AppImage/components/apps-dashboard.tsx
@@ -595,9 +595,9 @@ function CardsGrid({
 // `changeTab` switches the outer tab (dashboard-level) and
 // `openLxcAppModal` tells VirtualMachines which guest to open and on
 // which inner tab to land. Both fire in the same tick.
-function openLxcModalOnAppTab(vmid: number) {
+function openLxcModalOnAppTab(vmid: number, tab: "app" | "updates" = "app") {
   window.dispatchEvent(new CustomEvent("changeTab", { detail: { tab: "vms" } }))
-  window.dispatchEvent(new CustomEvent("openLxcAppModal", { detail: { vmid } }))
+  window.dispatchEvent(new CustomEvent("openLxcAppModal", { detail: { vmid, tab } }))
 }
 
 // Same pattern for a QEMU guest: land on the modal's Status tab
@@ -637,6 +637,15 @@ function AppCard({
     }
   }
 
+  // The update icon leads to where the update is applied: the Updates
+  // tab of the container.
+  const goToUpdates = (e: React.MouseEvent | React.KeyboardEvent) => {
+    e.preventDefault()
+    e.stopPropagation()
+    if (link.vmid == null) return
+    openLxcModalOnAppTab(link.vmid, "updates")
+  }
+
   const goToEditor = (e: React.MouseEvent | React.KeyboardEvent) => {
     e.preventDefault()
     e.stopPropagation()
@@ -682,7 +691,20 @@ function AppCard({
             <Pencil className="h-4 w-4" />
           </button>
         ) : link.updateAvailable && (
-          <ArrowUpCircle className="h-5 w-5 text-purple-400 flex-shrink-0 self-start mt-0.5" aria-hidden="true" />
+          link.vmid != null && link.guestType !== "qemu" ? (
+            <button
+              type="button"
+              onClick={goToUpdates}
+              onKeyDown={(e) => { if (e.key === "Enter" || e.key === " ") goToUpdates(e) }}
+              className="rounded-full flex-shrink-0 self-start mt-0.5 text-purple-400 hover:text-purple-300 transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+              aria-label={t("apps.openUpdatesAria", { name: link.appName })}
+              title={t("apps.openUpdatesTitle")}
+            >
+              <ArrowUpCircle className="h-5 w-5" />
+            </button>
+          ) : (
+            <ArrowUpCircle className="h-5 w-5 text-purple-400 flex-shrink-0 self-start mt-0.5" aria-hidden="true" />
+          )
         )}
       </div>
 
diff --git a/AppImage/components/hardware.tsx b/AppImage/components/hardware.tsx
index d079df9d..80021881 100644
--- a/AppImage/components/hardware.tsx
+++ b/AppImage/components/hardware.tsx
@@ -629,7 +629,7 @@ export default function Hardware() {
   const hasRealtimeData = (): boolean => {
     if (!realtimeGPUData) return false
 
-    // Esto permite mostrar datos incluso cuando la GPU está inactiva (valores en 0 o null)
+    // Show the data even while the GPU is idle, when values are 0 or null
     return realtimeGPUData.has_monitoring_tool === true
   }
 
diff --git a/AppImage/components/lxc-app-panel.tsx b/AppImage/components/lxc-app-panel.tsx
index 3f40048c..df70ff34 100644
--- a/AppImage/components/lxc-app-panel.tsx
+++ b/AppImage/components/lxc-app-panel.tsx
@@ -43,7 +43,7 @@ import { useT } from "@/lib/i18n/provider"
 // apps and casual "just want a link" registrations use this default.
 type InstalledVia = "" | "dpkg" | "apk" | "file" | "binary" |
                     "python_dist" | "docker_label" | "docker_exec" |
-                    "command" | "manual"
+                    "command" | "manual" | "oci_image"
 type GithubSource = "releases" | "tags"
 
 interface PortEntry {
@@ -120,6 +120,10 @@ interface DetectedApp {
   // auto-fill the Web Link editor when the user clicks "Register".
   category?: string | null
   tracking_suggestion?: TrackingSuggestion | null
+  // The scheme the application is served on, when it is known rather than
+  // guessed. A ProxMenux OCI install records it; Chromium answers on 3001
+  // over https, which no port heuristic can tell from 3000 over http.
+  scheme?: "http" | "https" | null
 }
 
 interface AppState {
@@ -129,8 +133,31 @@ interface AppState {
   update_available: boolean | null
   error: string | null
   checked_at: string | null
+  // An application installed from an OCI image: the image it runs and the
+  // one its registry publishes today. The image decides whether there is an
+  // update; the version above only says which application it carries.
+  installed_digest?: string | null
+  latest_digest?: string | null
+  image_created?: string | null
+  latest_image_created?: string | null
+  image_reference?: string | null
+  image_repository?: string | null
 }
 
+// The repository of an OCI image, shown the way the repository of a tracked
+// application is: owner/name for GitHub, the image name for Docker Hub.
+export const ociRepoLabel = (url: string) =>
+  url.replace(/^https?:\/\/(www\.)?/, "")
+    .replace(/^github\.com\//, "")
+    .replace(/^hub\.docker\.com\/(r|_)\//, "")
+    .replace(/\/$/, "")
+
+// "2026-09-24 · a3f21c08": an image as a reader can compare two of them.
+export const ociImageLabel = (created?: string | null, digest?: string | null) =>
+  [created ? created.slice(0, 10) : null, digest ? digest.split(":").pop()!.slice(0, 8) : null]
+    .filter(Boolean)
+    .join(" · ")
+
 interface AppEntry extends AppConfig {
   id: string
   state?: AppState
@@ -219,10 +246,25 @@ interface DockerWebLinkSuggestion {
   logo_url?: string | null
 }
 
+// Identity of a container ProxMenux installed from an OCI image. It comes
+// from the installation record rather than a probe, so it names the
+// application even when the guest also ships something else — CT 152 runs
+// Chromium and carries a docker client the probe reported instead.
+interface OciInstance {
+  template_id: string | null
+  image_reference: string | null
+  repository: string | null
+  scheme: string | null
+  port: number | null
+  path: string | null
+  website: string | null
+}
+
 interface Suggestions {
   ready?: boolean
   name_suggestion: string | null
   helper_slug: string | null
+  oci_instance?: OciInstance | null
   port_suggestions: number[]
   web_path_hint: string | null
   tracking_suggestion?: TrackingSuggestion | null
@@ -400,6 +442,7 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData }: Prop
   const [loading, setLoading] = useState(!seed)
   const [sidecar, setSidecar] = useState<SidecarResponse | null>(seed?.sidecar ?? null)
   const [suggestions, setSuggestions] = useState<Suggestions | null>(seed?.suggestions ?? null)
+  const [adguardSetupAvailable, setAdguardSetupAvailable] = useState(false)
   const [error, setError] = useState<string | null>(null)
   const [searchingApplications, setSearchingApplications] = useState(false)
   const [detectionNotice, setDetectionNotice] = useState<{ found: boolean; text: string } | null>(null)
@@ -589,14 +632,19 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData }: Prop
   const detectedList: DetectedApp[] = useMemo(() => {
     if (!suggestions) return []
     const out: DetectedApp[] = []
-    if (suggestions.helper_slug && suggestions.name_suggestion) {
+    // A ProxMenux OCI install has no helper slug — nothing was installed by a
+    // community script — so its template id identifies it instead.
+    const primarySlug = suggestions.helper_slug || suggestions.oci_instance?.template_id
+    if (primarySlug && suggestions.name_suggestion) {
       out.push({
-        slug: suggestions.helper_slug,
+        slug: primarySlug,
         name: suggestions.name_suggestion,
         logo_url: suggestions.logo_url,
         default_ports: suggestions.default_ports,
         category: suggestions.category,
         tracking_suggestion: suggestions.tracking_suggestion,
+        scheme: suggestions.oci_instance?.scheme === "https" ? "https"
+          : suggestions.oci_instance?.scheme === "http" ? "http" : null,
       })
     }
     const seen = new Set(out.map((d) => d.slug))
@@ -639,6 +687,43 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData }: Prop
   const hiddenDetections = [...detectedList, ...(suggestions?.docker_workloads || [])]
     .filter((d, index, items) => dismissedSlugs.has(d.slug) && items.findIndex(item => item.slug === d.slug) === index)
 
+  // A container installed from an OCI image holds exactly the application its
+  // record names, so there is nothing to search for and nothing else to add.
+  // What can go stale is what the record and the registry say, and this
+  // reads both again.
+  const isOciInstall = !!suggestions?.oci_instance
+  const isOciAdguard = suggestions?.oci_instance?.template_id === "image-adguard-home"
+  useEffect(() => {
+    if (!isOciAdguard) return
+    let cancelled = false
+    fetchApi<{ available: boolean }>(`/api/vms/${vmid}/apps/adguard-setup`)
+      .then((result) => { if (!cancelled) setAdguardSetupAvailable(result.available === true) })
+      .catch(() => { if (!cancelled) setAdguardSetupAvailable(false) })
+    return () => { cancelled = true }
+  }, [vmid, isOciAdguard])
+  const refreshOciData = async () => {
+    setSearchingApplications(true)
+    setDetectionNotice(null)
+    setError(null)
+    try {
+      const result: Suggestions = await fetchApi(`/api/vms/${vmid}/apps/suggestions`, {
+        method: "POST",
+      })
+      setSuggestions(result)
+      let next = sidecar
+      if (apps.length > 0) {
+        next = await fetchApi(`/api/vms/${vmid}/apps/check`, { method: "POST" })
+        setSidecar(next)
+      }
+      if (next) setLxcAppsCached(vmid, next, result)
+      onChange?.()
+    } catch (e: any) {
+      setError(e?.message || t("vmLxc.appEditor.checkFailed"))
+    } finally {
+      setSearchingApplications(false)
+    }
+  }
+
   const searchInstalledApplications = async () => {
     const before = new Set([...visibleDetected, ...visibleWorkloads].map((item) => item.slug))
     setSearchingApplications(true)
@@ -756,10 +841,16 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData }: Prop
         // Docker endpoints come from the real published host-port mappings
         // listed under Web links.  Do not pre-save a catalog default such as
         // 9000; the user explicitly chooses which workload links to add.
-        if (p.slug !== "docker" && p.default_ports?.length) {
-          seed.ports = p.default_ports.map((port) => ({
+        const suggestedPorts = isOciAdguard && p.slug === "image-adguard-home"
+          ? [80, ...(adguardSetupAvailable ? [3000] : [])]
+          : p.default_ports || []
+        if (p.slug !== "docker" && suggestedPorts.length) {
+          seed.ports = suggestedPorts.map((port) => ({
             port,
-            scheme: defaultSchemeFor(port),
+            ...(isOciAdguard && port === 3000 ? { description: "Config" } : {}),
+            // A recorded scheme beats the port heuristic: getting this wrong
+            // hands the user a link that cannot connect.
+            scheme: p.scheme || defaultSchemeFor(port),
             web_path: s?.web_path_hint || "",
             // Auto-fill Categoría from helpers_cache.category_names[0]
             // when the catalog entry carries one. User can still change
@@ -822,7 +913,7 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData }: Prop
     setEditing({ appId: existing?.id || null, draft: seed })
     setDetectorTest(null)
     setError(null)
-  }, [suggestions, vmid, sidecar])
+  }, [suggestions, vmid, sidecar, isOciAdguard, adguardSetupAvailable])
 
   const closeEditor = () => {
     setEditing(null)
@@ -1686,10 +1777,26 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData }: Prop
                           <SelectItem value="docker_exec">{t("vmLxc.appEditor.methodDockerExec")}</SelectItem>
                           <SelectItem value="command">{t("vmLxc.appEditor.methodCommand")}</SelectItem>
                           <SelectItem value="manual">{t("vmLxc.appEditor.methodManual")}</SelectItem>
+                          {/* Only meaningful on a container ProxMenux installed
+                              from an image: the record it reads exists nowhere else. */}
+                          {(method === "oci_image" || suggestions?.oci_instance) && (
+                            <SelectItem value="oci_image">{t("vmLxc.appEditor.methodOciImage")}</SelectItem>
+                          )}
                         </SelectContent>
                       </Select>
                     </div>
 
+                    {method === "oci_image" && (
+                      <div className="sm:col-span-2 text-xs text-muted-foreground leading-relaxed">
+                        {t("vmLxc.appEditor.ociImageHelp")}
+                        {suggestions?.oci_instance?.image_reference && (
+                          <div className="mt-1">
+                            <code className="text-foreground/80">{suggestions.oci_instance.image_reference}</code>
+                          </div>
+                        )}
+                      </div>
+                    )}
+
                     {isPackaged && (
                       <div>
                         <Label htmlFor="app-package">{t("vmLxc.appEditor.packageIdentifierLabel")}</Label>
@@ -1892,7 +1999,9 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData }: Prop
                     </div>
                   )}
 
-                  {method && (() => {
+                  {/* The registry of the image is the upstream of an OCI
+                      install, and the record already names it. */}
+                  {method && method !== "oci_image" && (() => {
                     // Upstream source selector — 3 methods (github,
                     // http_json, docker_hub). Legacy sidecars with a
                     // `repo` set but no `upstream_type` default to
@@ -2466,17 +2575,20 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData }: Prop
             )}
             <div className="pt-1 flex flex-wrap justify-center gap-2">
               <Button
-                onClick={searchInstalledApplications}
+                onClick={isOciInstall ? refreshOciData : searchInstalledApplications}
                 disabled={searchingApplications}
                 className="bg-blue-500 hover:bg-blue-600 text-white"
               >
                 {searchingApplications
                   ? <Loader2 className="h-4 w-4 mr-1.5 animate-spin" />
-                  : <Search className="h-4 w-4 mr-1.5" />}
-                {searchingApplications
-                  ? t("vmLxc.appEditor.searchingApplications")
-                  : t("vmLxc.appEditor.searchApplications")}
+                  : isOciInstall ? <RefreshCw className="h-4 w-4 mr-1.5" /> : <Search className="h-4 w-4 mr-1.5" />}
+                {isOciInstall
+                  ? t(searchingApplications ? "vmLxc.appEditor.refreshingData" : "vmLxc.appEditor.refreshData")
+                  : searchingApplications
+                    ? t("vmLxc.appEditor.searchingApplications")
+                    : t("vmLxc.appEditor.searchApplications")}
               </Button>
+              {!isOciInstall && (
               <Button
                 onClick={openBrowseOrEditor}
                 className="bg-blue-500 hover:bg-blue-600 text-white"
@@ -2489,6 +2601,7 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData }: Prop
                   </span>
                 )}
               </Button>
+              )}
             </div>
             {detectionNotice && (
               <p className={`text-xs text-center ${detectionNotice.found ? "text-emerald-400" : "text-muted-foreground"}`}>
@@ -2524,6 +2637,7 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData }: Prop
                         {app.installed_via === "apk" && app.package && <>apk · <code className="text-foreground/80">{app.package}</code></>}
                         {app.installed_via === "file" && app.file_path && <>file · <code className="text-foreground/80">{app.file_path}</code></>}
                         {app.installed_via === "binary" && app.binary_path && <>binary · <code className="text-foreground/80">{app.binary_path}</code></>}
+                        {app.installed_via === "oci_image" && st?.image_reference && <>OCI · <code className="text-foreground/80 break-all">{st.image_reference}</code></>}
                       </div>
                     )}
                     {tracking && st?.checked_at && (
@@ -2535,6 +2649,17 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData }: Prop
                         stack below Checked, full-width so long repo
                         names wrap cleanly instead of competing with
                         the top-right on narrow screens. */}
+                    {app.installed_via === "oci_image" && tracking && st?.image_repository && (
+                      <a
+                        href={st.image_repository}
+                        target="_blank"
+                        rel="noopener noreferrer"
+                        className="md:hidden mt-1 text-xs text-muted-foreground hover:text-foreground inline-flex items-center gap-1 min-w-0"
+                      >
+                        <span className="truncate">{ociRepoLabel(st.image_repository)}</span>
+                        <ExternalLink className="h-3 w-3 flex-shrink-0" />
+                      </a>
+                    )}
                     {app.repo && tracking && (
                       <a
                         href={`https://github.com/${app.repo}`}
@@ -2551,6 +2676,17 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData }: Prop
                 {/* Desktop-only repo link: same row as the title on md+,
                     hidden on mobile where the stacked variant above
                     handles it. */}
+                {app.installed_via === "oci_image" && tracking && st?.image_repository && (
+                  <a
+                    href={st.image_repository}
+                    target="_blank"
+                    rel="noopener noreferrer"
+                    className="hidden md:inline-flex text-xs text-muted-foreground hover:text-foreground items-center gap-1 flex-shrink-0 mt-1"
+                  >
+                    {ociRepoLabel(st.image_repository)}
+                    <ExternalLink className="h-3 w-3" />
+                  </a>
+                )}
                 {app.repo && tracking && (
                   <a
                     href={`https://github.com/${app.repo}`}
@@ -2565,6 +2701,41 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData }: Prop
               </div>
 
               {(() => {
+                // An application installed from an OCI image changes when its
+                // image does. Both are shown — the application version it
+                // carries and the image it runs — and the image decides.
+                if (app.installed_via === "oci_image") {
+                  if (!tracking) return null
+                  const newImage = st?.update_available === true
+                  const appMoved = !!(st?.latest_version && st.latest_version !== st.installed_version)
+                  return (
+                    <div className="mb-3 grid gap-3 grid-cols-1 sm:grid-cols-2">
+                      <div className="p-3 rounded-md bg-muted/40">
+                        <div className="text-[10px] text-muted-foreground uppercase tracking-wider mb-1">{t("vmLxc.appEditor.ociAppVersion")}</div>
+                        <div className="text-lg font-semibold font-mono text-foreground break-all">
+                          {st?.installed_version || "—"}
+                        </div>
+                        {appMoved && (
+                          <div className="text-xs font-mono text-purple-400 mt-1 break-all">→ {st!.latest_version}</div>
+                        )}
+                      </div>
+                      <div className="p-3 rounded-md bg-muted/40">
+                        <div className="text-[10px] text-muted-foreground uppercase tracking-wider mb-1">{t("vmLxc.appEditor.ociImage")}</div>
+                        <div className="text-sm font-semibold font-mono text-foreground">
+                          {ociImageLabel(st?.image_created, st?.installed_digest) || "—"}
+                        </div>
+                        {newImage ? (
+                          <div className="text-sm font-semibold font-mono text-purple-400 mt-1 flex items-center gap-2">
+                            {t("vmLxc.appEditor.ociNewImage")}: {ociImageLabel(st?.latest_image_created, st?.latest_digest)}
+                            <ArrowUpCircle className="h-5 w-5 text-purple-400 flex-shrink-0" aria-label={t("vmLxc.appEditor.updateAvailableBadge")} />
+                          </div>
+                        ) : st?.latest_digest ? (
+                          <div className="text-xs text-muted-foreground mt-1">{t("vmLxc.appEditor.ociImageCurrent")}</div>
+                        ) : null}
+                      </div>
+                    </div>
+                  )
+                }
                 // A delegated app has no upstream of its own; the version to
                 // compare against comes from the image it updates with.
                 const delegated = app.update_via === "docker"
@@ -2614,9 +2785,14 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData }: Prop
                   Logo is optional (per-port `logo_url`); when absent
                   the row indents naturally to align with the text.
                   If we can't resolve an IP for the CT we hide the row. */}
-              {app.ports && app.ports.length > 0 && (
+              {(isOciAdguard ? true : !!app.ports?.length) && (
                 <div className="mb-3 space-y-4">
-                  {app.ports.map((p) => {
+                  {(isOciAdguard
+                    ? [
+                        { port: 80, description: app.name, scheme: "http" as const },
+                        ...(adguardSetupAvailable ? [{ port: 3000, description: "Config", scheme: "http" as const }] : []),
+                      ]
+                    : app.ports).map((p) => {
                     const url = buildWebUrl(ctIp, p.port, p.scheme, p.custom_url)
                     if (!url) return null
                     const label = p.description || app.name
@@ -2766,22 +2942,27 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData }: Prop
           <Button
             variant="outline"
             size="sm"
-            onClick={searchInstalledApplications}
+            onClick={isOciInstall ? refreshOciData : searchInstalledApplications}
             disabled={searchingApplications || editMode}
             className="min-w-[7rem] sm:min-w-0 px-2.5 sm:px-3"
-            aria-label={searchingApplications
-              ? t("vmLxc.appEditor.searchingApplications")
-              : t("vmLxc.appEditor.searchApplications")}
+            aria-label={isOciInstall
+              ? t(searchingApplications ? "vmLxc.appEditor.refreshingData" : "vmLxc.appEditor.refreshData")
+              : searchingApplications
+                ? t("vmLxc.appEditor.searchingApplications")
+                : t("vmLxc.appEditor.searchApplications")}
           >
             {searchingApplications
               ? <Loader2 className="h-4 w-4 sm:mr-1.5 animate-spin" />
-              : <Search className="h-4 w-4 sm:mr-1.5" />}
+              : isOciInstall ? <RefreshCw className="h-4 w-4 sm:mr-1.5" /> : <Search className="h-4 w-4 sm:mr-1.5" />}
             <span className="hidden sm:inline">
-              {searchingApplications
-                ? t("vmLxc.appEditor.searchingApplications")
-                : t("vmLxc.appEditor.searchApplications")}
+              {isOciInstall
+                ? t(searchingApplications ? "vmLxc.appEditor.refreshingData" : "vmLxc.appEditor.refreshData")
+                : searchingApplications
+                  ? t("vmLxc.appEditor.searchingApplications")
+                  : t("vmLxc.appEditor.searchApplications")}
             </span>
           </Button>
+          {!isOciInstall && (
           <Button
             variant="outline"
             size="sm"
@@ -2800,6 +2981,7 @@ export function LxcAppPanel({ vmid, ctIp, onChange, managed, initialData }: Prop
               )}
             </span>
           </Button>
+          )}
           <button
             type="button"
             onClick={() => setEditMode((v) => !v)}
diff --git a/AppImage/components/lxc-terminal-modal.tsx b/AppImage/components/lxc-terminal-modal.tsx
index 460efa67..3afc8042 100644
--- a/AppImage/components/lxc-terminal-modal.tsx
+++ b/AppImage/components/lxc-terminal-modal.tsx
@@ -178,8 +178,7 @@ export function LxcTerminalModal({
     // `cancelled` short-circuits the async init if the modal closes
     // before the dynamic xterm import resolves. Without this, we'd
     // construct a Terminal instance, attach it to a now-stale ref, and
-    // open a WebSocket that nobody listens to. Audit Tier 6 — useEffect
-    // con `import("xterm")` sin cancelación.
+    // open a WebSocket that nobody listens to.
     let cancelled = false
 
     // Small delay to ensure Dialog content is rendered
diff --git a/AppImage/components/network-flow.tsx b/AppImage/components/network-flow.tsx
index 3f0cf9e3..6da3ffae 100644
--- a/AppImage/components/network-flow.tsx
+++ b/AppImage/components/network-flow.tsx
@@ -665,9 +665,8 @@ function renderVertical(data: NetworkFlowData, labels: FlowLabels, unit: Network
   const NIC_PATH_START_OFFSET = 46    // clears SUB_OFFSET_Y + text height
   const NIC_VERTICAL_LEG = 56
   const HOST_GAP_FROM_CONVERGE = 56
-  const GUEST_ROW_H = 100          // más separación vertical entre
-                                   // guests para que sub no toque
-                                   // el círculo del siguiente
+  const GUEST_ROW_H = 100          // enough vertical room that one guest's
+                                   // sub clears the next guest's circle
   const BRIDGE_PITCH_PAD = 36
   // Vertical positions of the label and the sub (rate) BELOW each
   // node's circle. Both grew when the font went up to 12.5 px; this
diff --git a/AppImage/components/notification-settings.tsx b/AppImage/components/notification-settings.tsx
index b82af9a4..621743a2 100644
--- a/AppImage/components/notification-settings.tsx
+++ b/AppImage/components/notification-settings.tsx
@@ -15,7 +15,7 @@ import { useT } from "../lib/i18n/provider"
 import {
   Bell, BellOff, Send, CheckCircle2, XCircle, Loader2,
   AlertTriangle, Info, Settings2, Zap, Eye, EyeOff,
-  Trash2, ChevronDown, ChevronUp, ChevronRight, TestTube2, Mail, Webhook,
+  Trash2, ChevronRight, TestTube2, Mail, Webhook,
   Copy, Server, Shield, ExternalLink, RefreshCw, Download, Upload,
   Cloud, Brain, Globe, MessageSquareText, Sparkles, Pencil, Save, RotateCcw, Lightbulb,
   Moon, Newspaper
@@ -343,7 +343,6 @@ export function NotificationSettings() {
   const [testing, setTesting] = useState<string | null>(null)
   const [testResult, setTestResult] = useState<{ channel: string; success: boolean; message: string } | null>(null)
   const [showHistory, setShowHistory] = useState(false)
-  const [showAdvanced, setShowAdvanced] = useState(false)
   const [showSecrets, setShowSecrets] = useState<Record<string, boolean>>({})
   // Cleartext secrets cached only while the eye toggle is "on" for
   // that field. Settings GET returns "************" for everything in
@@ -509,13 +508,6 @@ export function NotificationSettings() {
     if (showHistory) loadHistory()
   }, [showHistory, loadHistory])
 
-  // Auto-expand AI section when AI is enabled
-  useEffect(() => {
-    if (config.ai_enabled) {
-      setShowAdvanced(true)
-    }
-  }, [config.ai_enabled])
-
   const updateConfig = (updater: (prev: NotificationConfig) => NotificationConfig) => {
     setConfig(prev => {
       const next = updater(prev)
@@ -919,13 +911,13 @@ export function NotificationSettings() {
     return flat
   }
 
-  const handleSave = async () => {
+  const saveConfig = async (nextConfig: NotificationConfig): Promise<boolean> => {
     setSaving(true)
     setSaveError(null)
     try {
       // If notifications are being disabled, clean up PVE webhook first
       const wasEnabled = originalConfig.enabled
-      const isNowDisabled = !config.enabled
+      const isNowDisabled = !nextConfig.enabled
 
       if (wasEnabled && isNowDisabled) {
         try {
@@ -935,26 +927,33 @@ export function NotificationSettings() {
         }
       }
 
-      const payload = flattenConfig(config)
+      const payload = flattenConfig(nextConfig)
       await fetchApi("/api/notifications/settings", {
         method: "POST",
         body: JSON.stringify(payload),
       })
-      setOriginalConfig(config)
+      setConfig(nextConfig)
+      setOriginalConfig(nextConfig)
       setHasChanges(false)
       setEditMode(false)
       setSaved(true)
       setTimeout(() => setSaved(false), 3000)
       loadStatus()
+      return true
     } catch (err) {
       console.error("Failed to save notification settings:", err)
       const msg = err instanceof Error ? err.message : t("settings.notifications.errors.saveFailed")
       setSaveError(msg)
+      return false
     } finally {
       setSaving(false)
     }
   }
 
+  const handleSave = async () => {
+    await saveConfig(config)
+  }
+
   const handleCancel = () => {
     setConfig(originalConfig)
     setHasChanges(false)
@@ -2226,74 +2225,45 @@ export function NotificationSettings() {
               </p>
             </div>
 
-            {/* ── Advanced: AI Enhancement ── */}
-            <div>
-              <div className="flex items-center justify-between py-1">
-                <button
-                  className="flex items-center gap-2 text-sm text-foreground hover:bg-muted/60 rounded-md px-2 py-1.5 -mx-2 transition-colors"
-                  onClick={() => setShowAdvanced(!showAdvanced)}
-                >
-                  {showAdvanced ? (
-                    <ChevronUp className="h-4 w-4 text-muted-foreground" />
-                  ) : (
-                    <ChevronDown className="h-4 w-4 text-muted-foreground" />
-                  )}
-                  <Sparkles className="h-4 w-4 text-purple-400" />
-                  <span className="font-medium">{t("settings.notifications.ai.title")}</span>
-                  {config.ai_enabled ? (
-                    <Badge variant="outline" className="text-[10px] border-purple-500/40 text-purple-400 ml-1">
-                      {t("status.active")}
-                    </Badge>
-                  ) : (
-                    <Badge variant="outline" className="text-[10px] border-border text-muted-foreground ml-1">
-                      {t("settings.notifications.ui.optional")}
-                    </Badge>
-                  )}
-                </button>
-                {showAdvanced && (
-                  <div className="flex items-center gap-2">
-                    {editMode ? (
-                      <>
-                        <button
-                          className="h-6 px-2 text-xs rounded-md border border-border bg-background hover:bg-muted transition-colors text-muted-foreground"
-                          onClick={handleCancel}
-                          disabled={saving}
-                        >
-                          {t("actions.cancel")}
-                        </button>
-                        <button
-                          className="h-6 px-2 text-xs rounded-md bg-blue-600 hover:bg-blue-700 text-white transition-colors disabled:opacity-50 flex items-center gap-1"
-                          onClick={handleSave}
-                          disabled={saving || !hasChanges}
-                        >
-                          {saving ? <Loader2 className="h-3 w-3 animate-spin" /> : <CheckCircle2 className="h-3 w-3" />}
-                          {t("actions.save")}
-                        </button>
-                      </>
-                    ) : (
-                      <button
-                        className="h-6 px-2 text-xs rounded-md border border-border bg-background hover:bg-muted transition-colors flex items-center gap-1"
-                        onClick={() => setEditMode(true)}
-                      >
-                        <Settings2 className="h-3 w-3" />
-                        {t("actions.edit")}
-                      </button>
-                    )}
+            {/* ── AI Enhancement ── */}
+            <div className="space-y-3">
+              <div className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between py-1">
+                <div className="flex items-start gap-3">
+                  <Sparkles className="h-5 w-5 text-purple-400 mt-0.5 shrink-0" />
+                  <div>
+                    <span className="text-sm font-medium">{t("settings.notifications.ai.title")}</span>
+                    <p className="text-xs sm:text-sm text-muted-foreground">{t("settings.notifications.ai.enhancedMessagesDescription")}</p>
                   </div>
-                )}
-              </div>
-
-{showAdvanced && (
-                  <div className="space-y-4 mt-3 p-4 rounded-lg bg-muted/30 border border-border/50">
-                    <div className="flex items-center justify-between">
-                      <div className="flex items-start gap-3">
-                        <Sparkles className="h-5 w-5 text-purple-400 mt-0.5 shrink-0" />
-                        <div>
-                          <span className="text-sm font-medium">{t("settings.notifications.ai.enhancedMessages")}</span>
-                          <p className="text-xs sm:text-sm text-muted-foreground">{t("settings.notifications.ai.enhancedMessagesDescription")}</p>
-                        </div>
-                      </div>
+                </div>
+                <div className="flex items-center justify-end gap-2">
+                  {editMode ? (
+                    <>
                       <button
+                        className="h-7 px-2 text-xs rounded-md border border-border bg-background hover:bg-muted transition-colors text-muted-foreground"
+                        onClick={handleCancel}
+                        disabled={saving}
+                      >
+                        {t("actions.cancel")}
+                      </button>
+                      <button
+                        className="h-7 px-2 text-xs rounded-md bg-blue-600 hover:bg-blue-700 text-white transition-colors disabled:opacity-50 flex items-center gap-1"
+                        onClick={handleSave}
+                        disabled={saving || !hasChanges}
+                      >
+                        {saving ? <Loader2 className="h-3 w-3 animate-spin" /> : <CheckCircle2 className="h-3 w-3" />}
+                        {t("actions.save")}
+                      </button>
+                    </>
+                  ) : (
+                    <button
+                      className="h-7 px-2 text-xs rounded-md border border-border bg-background hover:bg-muted transition-colors flex items-center gap-1"
+                      onClick={() => setEditMode(true)}
+                    >
+                      <Settings2 className="h-3 w-3" />
+                      {t("actions.edit")}
+                    </button>
+                  )}
+                  <button
                       className={`relative w-9 h-[18px] rounded-full transition-colors ${
                         config.ai_enabled ? "bg-purple-600" : "bg-muted-foreground/20 border border-muted-foreground/40"
                       } ${!editMode ? "opacity-60 cursor-not-allowed" : "cursor-pointer"}`}
@@ -2305,10 +2275,12 @@ export function NotificationSettings() {
                       <span className={`absolute top-[1px] left-[1px] h-4 w-4 rounded-full bg-white shadow transition-transform ${
                         config.ai_enabled ? "translate-x-[18px]" : "translate-x-0"
                       }`} />
-                    </button>
-                  </div>
+                  </button>
+                </div>
+              </div>
 
-                  {config.ai_enabled && (
+              {config.ai_enabled && (
+                <div className="space-y-4 p-4 rounded-lg bg-muted/30 border border-border/50">
                     <>
                       {/* Provider + Info button */}
                       <div className="space-y-2">
@@ -2661,10 +2633,12 @@ export function NotificationSettings() {
                                       <Button
                                         variant="outline"
                                         size="sm"
-                                        onClick={() => {
-                                          updateConfig(p => ({ ...p, ai_custom_prompt: customPromptDraft }))
-                                          setEditingCustomPrompt(false)
-                                          handleSave()
+                                        onClick={async () => {
+                                          const nextConfig = { ...config, ai_custom_prompt: customPromptDraft }
+                                          if (await saveConfig(nextConfig)) {
+                                            setEditingCustomPrompt(false)
+                                            setCustomPromptDraft("")
+                                          }
                                         }}
                                         className="h-7 px-2 text-xs flex items-center gap-1 bg-blue-600 hover:bg-blue-700 text-white border-blue-600"
                                       >
@@ -2714,8 +2688,8 @@ export function NotificationSettings() {
                                     const file = (e.target as HTMLInputElement).files?.[0]
                                     if (file) {
                                       const text = await file.text()
-                                      updateConfig(p => ({ ...p, ai_custom_prompt: text }))
-                                      handleSave()
+                                      const nextConfig = { ...config, ai_custom_prompt: text }
+                                      await saveConfig(nextConfig)
                                     }
                                   }
                                   input.click()
@@ -2783,7 +2757,6 @@ export function NotificationSettings() {
                         )}
                       </div>
                     </>
-                  )}
                 </div>
               )}
             </div>
diff --git a/AppImage/components/oci-console-log-panel.tsx b/AppImage/components/oci-console-log-panel.tsx
new file mode 100644
index 00000000..f37eaf9f
--- /dev/null
+++ b/AppImage/components/oci-console-log-panel.tsx
@@ -0,0 +1,255 @@
+"use client"
+
+// Console output of a native OCI container: what the image's main process
+// writes to stdout/stderr, kept on the host by liblxc. The first request
+// brings the last N lines; while following, each poll sends back the byte
+// offset and inode it holds and receives only what was appended. Nothing is
+// cached — the backend reads the file on every request.
+
+import { useCallback, useEffect, useMemo, useRef, useState } from "react"
+import { Card, CardContent } from "./ui/card"
+import { Badge } from "./ui/badge"
+import { Button } from "./ui/button"
+import { Input } from "./ui/input"
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "./ui/select"
+import { AlertCircle, Download, FileText, Loader2, Pause, Play, RefreshCw } from "lucide-react"
+import { fetchApi } from "../lib/api-config"
+import { useT } from "@/lib/i18n/provider"
+
+interface ConsoleLogResponse {
+  ok: boolean
+  enabled: boolean
+  lines: string[]
+  offset: number
+  inode: number | null
+  reset?: boolean
+  head_truncated?: boolean
+  error?: string
+}
+
+const LINE_OPTIONS = [100, 500, 1000] as const
+const POLL_MS = 2000
+
+const lineTone = (line: string) => {
+  if (/\b(error|fatal|panic|critical|exception)\b/i.test(line)) return "text-red-400"
+  if (/\bwarn(ing)?\b/i.test(line)) return "text-amber-400"
+  return "text-foreground/90"
+}
+
+export function OciConsoleLogPanel({ vmid, running }: { vmid: number; running: boolean }) {
+  const t = useT()
+  const [lineCount, setLineCount] = useState<number>(500)
+  const [lines, setLines] = useState<string[]>([])
+  const [enabled, setEnabled] = useState(true)
+  const [loading, setLoading] = useState(true)
+  const [error, setError] = useState<string | null>(null)
+  const [follow, setFollow] = useState(true)
+  const [filter, setFilter] = useState("")
+  const position = useRef<{ offset: number; inode: number | null } | null>(null)
+  const scroller = useRef<HTMLDivElement>(null)
+  const inFlight = useRef(false)
+
+  const load = useCallback(async () => {
+    setLoading(true)
+    setError(null)
+    try {
+      const r = await fetchApi<ConsoleLogResponse>(`/api/lxc/${vmid}/console-log?lines=${lineCount}`)
+      setEnabled(r.enabled)
+      setLines(r.lines || [])
+      position.current = { offset: r.offset, inode: r.inode }
+      if (r.error) setError(r.error)
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setLoading(false)
+    }
+  }, [vmid, lineCount])
+
+  const poll = useCallback(async () => {
+    const pos = position.current
+    if (!pos || inFlight.current) return
+    inFlight.current = true
+    try {
+      const inode = pos.inode === null ? "" : `&inode=${pos.inode}`
+      const r = await fetchApi<ConsoleLogResponse>(
+        `/api/lxc/${vmid}/console-log?lines=${lineCount}&offset=${pos.offset}${inode}`,
+      )
+      position.current = { offset: r.offset, inode: r.inode }
+      if (r.reset) {
+        setLines(r.lines || [])
+      } else if (r.lines?.length) {
+        setLines((prev) => {
+          const next = prev.concat(r.lines)
+          return next.length > lineCount ? next.slice(next.length - lineCount) : next
+        })
+      }
+    } catch {
+      // A failed poll leaves the view as it is; the next one retries.
+    } finally {
+      inFlight.current = false
+    }
+  }, [vmid, lineCount])
+
+  useEffect(() => {
+    load()
+  }, [load])
+
+  useEffect(() => {
+    if (!follow || !running || !enabled || loading) return
+    const timer = setInterval(() => {
+      if (document.visibilityState === "visible") poll()
+    }, POLL_MS)
+    poll()
+    return () => clearInterval(timer)
+  }, [follow, running, enabled, loading, poll])
+
+  const shown = useMemo(() => {
+    const needle = filter.trim().toLowerCase()
+    return needle ? lines.filter((l) => l.toLowerCase().includes(needle)) : lines
+  }, [lines, filter])
+
+  useEffect(() => {
+    if (follow && scroller.current) scroller.current.scrollTop = scroller.current.scrollHeight
+  }, [shown, follow])
+
+  // Scrolling up to read stops following; the Follow button resumes it.
+  const onScroll = () => {
+    const el = scroller.current
+    if (!el || !follow) return
+    if (el.scrollHeight - el.scrollTop - el.clientHeight > 40) setFollow(false)
+  }
+
+  const download = () => {
+    const blob = new Blob([lines.join("\n") + "\n"], { type: "text/plain;charset=utf-8" })
+    const url = URL.createObjectURL(blob)
+    const a = document.createElement("a")
+    a.href = url
+    a.download = `ct-${vmid}-console.log`
+    a.click()
+    URL.revokeObjectURL(url)
+  }
+
+  return (
+    <div className="h-full flex flex-col min-h-0">
+      <Card className="border border-border bg-card/50 flex flex-col flex-1 min-h-0">
+        <CardContent className="p-4 flex flex-col flex-1 min-h-0">
+          <div className="flex items-center justify-between mb-2 gap-2 flex-wrap shrink-0">
+            <div className="flex items-center gap-2">
+              <div className="p-1.5 rounded-md bg-sky-500/10">
+                <FileText className="h-4 w-4 text-sky-500" />
+              </div>
+              <h3 className="text-sm font-semibold text-foreground">{t("vmLxc.consoleLog.title")}</h3>
+              {enabled && shown.length > 0 && (
+                <Badge variant="secondary" className="text-xs h-5 ml-1">{shown.length}</Badge>
+              )}
+            </div>
+            {enabled && (
+              <div className="flex items-center gap-2 flex-wrap">
+                <Select value={String(lineCount)} onValueChange={(v) => setLineCount(Number(v))}>
+                  <SelectTrigger className="h-7 w-auto text-xs gap-1">
+                    <SelectValue />
+                  </SelectTrigger>
+                  <SelectContent>
+                    {LINE_OPTIONS.map((n) => (
+                      <SelectItem key={n} value={String(n)} className="text-xs">
+                        {t("vmLxc.consoleLog.lastLines", { count: n })}
+                      </SelectItem>
+                    ))}
+                  </SelectContent>
+                </Select>
+                {running && (
+                  <Button
+                    size="sm"
+                    variant="outline"
+                    className="h-7 text-xs gap-1"
+                    onClick={() => setFollow((f) => !f)}
+                    aria-pressed={follow}
+                  >
+                    {follow ? <Pause className="h-3 w-3" /> : <Play className="h-3 w-3" />}
+                    <span>{follow ? t("vmLxc.consoleLog.pause") : t("vmLxc.consoleLog.follow")}</span>
+                  </Button>
+                )}
+                <Button size="sm" variant="outline" className="h-7 text-xs gap-1" onClick={load} disabled={loading}>
+                  {loading ? <Loader2 className="h-3 w-3 animate-spin" /> : <RefreshCw className="h-3 w-3" />}
+                  <span>{t("vmLxc.consoleLog.refresh")}</span>
+                </Button>
+                <Button
+                  size="sm"
+                  variant="outline"
+                  className="h-7 text-xs gap-1"
+                  onClick={download}
+                  disabled={lines.length === 0}
+                >
+                  <Download className="h-3 w-3" />
+                  <span>{t("vmLxc.consoleLog.download")}</span>
+                </Button>
+              </div>
+            )}
+          </div>
+
+          <p className="text-xs text-muted-foreground mb-3 shrink-0">
+            {t("vmLxc.consoleLog.description")}
+            {enabled && !running && <> {t("vmLxc.consoleLog.stopped")}</>}
+          </p>
+
+          {enabled && (
+            <Input
+              value={filter}
+              onChange={(e) => setFilter(e.target.value)}
+              placeholder={t("vmLxc.consoleLog.filter")}
+              className="h-8 text-xs mb-3 shrink-0"
+            />
+          )}
+
+          {loading && lines.length === 0 ? (
+            <div className="flex-1 flex items-center justify-center text-muted-foreground min-h-0">
+              <Loader2 className="h-4 w-4 animate-spin mr-2" />
+              <span className="text-sm">{t("vmLxc.consoleLog.loading")}</span>
+            </div>
+          ) : error ? (
+            <div className="rounded-md border border-red-500/30 bg-red-500/5 p-4 text-sm shrink-0">
+              <div className="flex items-start gap-2">
+                <AlertCircle className="h-4 w-4 text-red-500 shrink-0 mt-0.5" />
+                <div>
+                  <p className="font-medium text-red-500 mb-1">{t("vmLxc.consoleLog.readFailed")}</p>
+                  <p className="text-xs text-muted-foreground break-all">{error}</p>
+                </div>
+              </div>
+            </div>
+          ) : !enabled ? (
+            <div className="rounded-md border border-amber-500/30 bg-amber-500/5 p-4 text-sm shrink-0">
+              <div className="flex items-start gap-2">
+                <FileText className="h-4 w-4 text-amber-500 shrink-0 mt-0.5" />
+                <div className="space-y-2">
+                  <p className="font-medium text-amber-500">{t("vmLxc.consoleLog.notAvailableTitle")}</p>
+                  <p className="text-xs text-muted-foreground leading-relaxed">{t("vmLxc.consoleLog.notAvailableHint")}</p>
+                </div>
+              </div>
+            </div>
+          ) : lines.length === 0 ? (
+            <div className="flex-1 flex flex-col items-center justify-center text-sm text-muted-foreground min-h-0">
+              {t("vmLxc.consoleLog.empty")}
+              <div className="text-xs mt-1">{t("vmLxc.consoleLog.emptyHint")}</div>
+            </div>
+          ) : shown.length === 0 ? (
+            <div className="flex-1 flex items-center justify-center text-sm text-muted-foreground min-h-0">
+              {t("vmLxc.consoleLog.noMatches")}
+            </div>
+          ) : (
+            <div
+              ref={scroller}
+              onScroll={onScroll}
+              className="rounded-md border border-border bg-background/50 flex-1 overflow-y-auto min-h-0"
+            >
+              <pre className="text-[11px] font-mono leading-snug whitespace-pre-wrap break-all p-3">
+                {shown.map((line, idx) => (
+                  <div key={idx} className={lineTone(line)}>{line || " "}</div>
+                ))}
+              </pre>
+            </div>
+          )}
+        </CardContent>
+      </Card>
+    </div>
+  )
+}
diff --git a/AppImage/components/proxmox-dashboard.tsx b/AppImage/components/proxmox-dashboard.tsx
index df4c7af8..92071468 100644
--- a/AppImage/components/proxmox-dashboard.tsx
+++ b/AppImage/components/proxmox-dashboard.tsx
@@ -239,8 +239,7 @@ export function ProxmoxDashboard() {
   fetchHealthInfoCount()
   fetchUpdateStatus()
 
-    // En overview: cada 30 segundos para actualización frecuente del estado de salud
-    // En otras tabs: cada 60 segundos para reducir carga
+    // Overview polls health every 30 s; the other tabs every 60 s.
     let interval: ReturnType<typeof setInterval> | null = null
     let healthInterval: ReturnType<typeof setInterval> | null = null
     if (activeTab === "overview") {
diff --git a/AppImage/components/release-notes-modal.tsx b/AppImage/components/release-notes-modal.tsx
index 386a1a8b..86c883e0 100644
--- a/AppImage/components/release-notes-modal.tsx
+++ b/AppImage/components/release-notes-modal.tsx
@@ -3,7 +3,7 @@
 import { useState, useEffect } from "react"
 import { Button } from "./ui/button"
 import { Dialog, DialogContent, DialogTitle } from "./ui/dialog"
-import { X, Sparkles, Thermometer, Activity, HardDrive, Shield, Globe, Cpu, Zap, Sliders, Wrench, RefreshCw, Server, BellOff, Bell, Calendar, DatabaseBackup, Smartphone, Languages } from "lucide-react"
+import { X, Sparkles, Thermometer, Activity, HardDrive, Shield, Globe, Cpu, Zap, Sliders, Wrench, RefreshCw, Server, BellOff, Bell, Calendar, DatabaseBackup, Smartphone, Languages, Package, ScrollText, ArrowUpCircle } from "lucide-react"
 import { Checkbox } from "./ui/checkbox"
 import { useT } from "../lib/i18n/provider"
 import { APP_VERSION } from "../lib/version"
@@ -305,34 +305,39 @@ export const CHANGELOG: Record<string, ReleaseNote> = {
 // that haven't been curated by hand.
 const CURRENT_VERSION_FEATURES = [
   {
-    icon: <Activity className="h-5 w-5" />,
-    key: "releaseNotes.currentFeatures.auditAssessment",
-    text: "Audit & Report — a new page that documents and assesses the node. The Assessment runs a catalogue of checks across security, backups, capacity, storage, network, hardware, guests and system, classifying each finding as critical, warning, observation or conformant and stating what it read rather than judging it.",
+    icon: <Package className="h-5 w-5" />,
+    key: "releaseNotes.currentFeatures.ociAppTab",
+    text: "OCI containers in the App tab — a container installed by OCI manager Apps is recognised from its installation record: the application and its image, a new image detected by digest, and a link to the image repository.",
   },
   {
-    icon: <Sliders className="h-5 w-5" />,
-    key: "releaseNotes.currentFeatures.changeJournal",
-    text: "Change journal — a Changes view that lists exactly what ProxMenux modified on this host: every configuration file, package and service it touched, with the prior state of each, deduplicated to a current-state view that shows the host as it stands now rather than a log of every run.",
+    icon: <RefreshCw className="h-5 w-5" />,
+    key: "releaseNotes.currentFeatures.ociUpdatesTab",
+    text: "Updates for OCI containers — Update and Recreate open the same flow as the OCI menu, the backup taken before updating can be kept in a backup storage, and the image can be updated on a schedule.",
   },
   {
-    icon: <Sparkles className="h-5 w-5" />,
-    key: "releaseNotes.currentFeatures.auditReports",
-    text: "Reports — a full audit plus focused Security review, Backup assurance and Capacity & wear reports, each opening on its own posture header, and a printable Inventory; all export to PDF. A security assessment asks before running Lynis so a run stays fast.",
+    icon: <ScrollText className="h-5 w-5" />,
+    key: "releaseNotes.currentFeatures.ociLogsTab",
+    text: "Logs tab for OCI containers — the console output of the application, kept on the host and followed live, with a filter and a download. The Proxmox console of these containers opens a shell.",
   },
   {
-    icon: <Calendar className="h-5 w-5" />,
-    key: "releaseNotes.currentFeatures.auditPolicyBaseline",
-    text: "Policy and baseline — declare what the host is expected to be (backup requirements, firewall, root SSH login) so findings grade against it, mark a run as the reference, and see what changed since, with new, resolved and accepted findings kept apart.",
+    icon: <ArrowUpCircle className="h-5 w-5" />,
+    key: "releaseNotes.currentFeatures.appsUpdateShortcut",
+    text: "The update icon on the Apps page opens the container straight on its Updates tab.",
   },
   {
     icon: <Bell className="h-5 w-5" />,
-    key: "releaseNotes.currentFeatures.groupedAppUpdates",
-    text: "Grouped application update notifications — one complete message per scan instead of one per application, grouped by LXC with the installed and available versions.",
+    key: "releaseNotes.currentFeatures.webhookHttps",
+    text: "Proxmox notifications reach the Monitor with HTTPS enabled — they are delivered on a local-only address and no longer fail with a certificate error.",
   },
   {
-    icon: <Shield className="h-5 w-5" />,
-    key: "releaseNotes.currentFeatures.adminTokenScope",
-    text: "Administrative scope — opening a Monitor terminal and disabling authentication now require a full-admin token, so a read-only API token issued to a monitoring integration stays read-only (reported by @f3rs3n).",
+    icon: <Activity className="h-5 w-5" />,
+    key: "releaseNotes.currentFeatures.persistentLogs",
+    text: "A burst of log errors that ended is no longer reported as persistent: a pattern has to keep appearing for 15 minutes, and its warning clears on its own (reported by @Joshua1264).",
+  },
+  {
+    icon: <HardDrive className="h-5 w-5" />,
+    key: "releaseNotes.currentFeatures.mountsLanAddress",
+    text: "Mount points on LVM-thin and other block storage show their usage, and multi-container applications open at their LAN address.",
   },
 ]
 
diff --git a/AppImage/components/script-terminal-modal.tsx b/AppImage/components/script-terminal-modal.tsx
index 96b9b990..605ed58a 100644
--- a/AppImage/components/script-terminal-modal.tsx
+++ b/AppImage/components/script-terminal-modal.tsx
@@ -287,8 +287,7 @@ const initMessage = {
     // Snapshot the open-state at call time. After the dynamic xterm
     // imports resolve, bail out if the modal has since been closed —
     // otherwise we attach a Terminal to a stale ref and open a WS that
-    // nobody reads. Audit Tier 6 — useEffect con `import("xterm")` sin
-    // cancelación.
+    // nobody reads.
     const wasOpenAtCall = isOpenRef.current
     const [TerminalClass, FitAddonClass] = await Promise.all([
       import("xterm").then((mod) => mod.Terminal),
diff --git a/AppImage/components/terminal-panel.tsx b/AppImage/components/terminal-panel.tsx
index 4f239718..13ba67d3 100644
--- a/AppImage/components/terminal-panel.tsx
+++ b/AppImage/components/terminal-panel.tsx
@@ -639,7 +639,7 @@ export const TerminalPanel: React.FC<TerminalPanelProps> = ({ websocketUrl, onCl
   }
 
   const handleKeyButton = (key: string, e?: React.MouseEvent | React.TouchEvent) => {
-    // Prevenir comportamientos por defecto del navegador
+    // Stop the browser default for this key
     if (e) {
       e.preventDefault()
       e.stopPropagation()
diff --git a/AppImage/components/virtual-machines.tsx b/AppImage/components/virtual-machines.tsx
index 88af9b17..94eb5b3b 100644
--- a/AppImage/components/virtual-machines.tsx
+++ b/AppImage/components/virtual-machines.tsx
@@ -21,7 +21,8 @@ import useSWR from "swr"
 import { MetricsView } from "./metrics-dialog"
 import { LxcTerminalModal } from "./lxc-terminal-modal"
 import { ScriptTerminalModal } from "./script-terminal-modal"
-import { LxcAppPanel, ThemeAwareLogo } from "./lxc-app-panel"
+import { LxcAppPanel, ThemeAwareLogo, ociImageLabel } from "./lxc-app-panel"
+import { OciConsoleLogPanel } from "./oci-console-log-panel"
 import { AppUpdaterEditor, type AppUpdateMethod } from "./app-updater-editor"
 import { formatStorage } from "../lib/utils"
 import { formatNetworkTraffic, getNetworkUnit } from "../lib/format-network"
@@ -40,6 +41,17 @@ interface LxcPackageUpdate {
   latest: string
   security: boolean
 }
+// A container installed by OCI manager Apps, read from its record.
+interface OciInstanceInfo {
+  oci_instance: boolean
+  console_log: boolean
+  stack: boolean
+  primary_vmid: number
+  members: number[]
+  host_directories: boolean
+  pending: boolean
+}
+
 interface LxcUpdateCheck {
   available: boolean
   count: number
@@ -114,6 +126,12 @@ interface LxcAppWatch {
   error: string | null
   checked_at: string | null
   has_repo?: boolean
+  // OCI image of an application installed by OCI manager Apps.
+  image_reference?: string | null
+  image_created?: string | null
+  installed_digest?: string | null
+  latest_image_created?: string | null
+  latest_digest?: string | null
   // Set for the synthetic entry that represents a ProxMenux-managed
   // OCI app (Secure Gateway). The frontend renders it read-only +
   // wires the Update action to /api/oci/installed/<id>/update.
@@ -951,7 +969,15 @@ export function VirtualMachines() {
   const [backupPbsChangeMode, setBackupPbsChangeMode] = useState<string>("default")
   
   // Tab state for modal
-  const [activeModalTab, setActiveModalTab] = useState<"status" | "mounts" | "backups" | "app" | "updates" | "firewall">("status")
+  const [activeModalTab, setActiveModalTab] = useState<"status" | "mounts" | "backups" | "app" | "updates" | "firewall" | "logs">("status")
+  // OCI containers keep their console output on the host; the Logs tab is
+  // offered only when the backend finds that log for the open container.
+  const [consoleLogAvailable, setConsoleLogAvailable] = useState(false)
+  // Set when the open container was installed by OCI manager Apps: its
+  // Updates tab replaces the image instead of updating packages.
+  const [ociInstance, setOciInstance] = useState<OciInstanceInfo | null>(null)
+  const [ociAction, setOciAction] = useState<{ vmid: number; action: "update" | "recreate" } | null>(null)
+  const [scheduleAckExternal, setScheduleAckExternal] = useState(false)
 
   // Firewall log state — fetched only when the operator opens that tab
   // so a CT/VM without firewall use doesn't pay the pvesh cost on every
@@ -1094,9 +1120,10 @@ export function VirtualMachines() {
       if (!vm) return
       handleVMClick(vm)
       // handleVMClick resets the inner tab to "status"; override to
-      // "app" in the same render tick — React batches these and the
+      // the requested tab ("app" by default, "updates" from the update
+      // icon) in the same render tick — React batches these and the
       // last setActiveModalTab wins.
-      setActiveModalTab("app")
+      setActiveModalTab(detail.tab === "updates" ? "updates" : "app")
     }
     window.addEventListener("openLxcAppModal", handler as EventListener)
     return () => window.removeEventListener("openLxcAppModal", handler as EventListener)
@@ -1249,6 +1276,8 @@ export function VirtualMachines() {
     setFirewallLogs([])
     setFirewallLogError(null)
     setFirewallEnabled(true)
+    setConsoleLogAvailable(false)
+    setOciInstance(null)
 
     // Prime UI from last-known payloads so a reopened guest never
     // flashes "Loading…" — the backend and this cache both revalidate
@@ -1290,6 +1319,7 @@ export function VirtualMachines() {
     // extends the same idea to the two tabs still on lazy-fetch.
     if (vm.type === "lxc") {
       fetchMountPoints(vm.vmid)
+      fetchOciInstance(vm.vmid)
       // Shared cache dedup: if a hover already fired this, we share
       // the same promise (no duplicate backend work). The App panel
       // reads from the same cache, so switching to that tab either
@@ -1403,6 +1433,17 @@ export function VirtualMachines() {
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [vmidsKey])
 
+  const fetchOciInstance = (vmid: number) =>
+    fetchApi<OciInstanceInfo>(`/api/lxc/${vmid}/oci-instance`)
+      .then((r) => {
+        setConsoleLogAvailable(!!r?.console_log)
+        setOciInstance(r?.oci_instance ? r : null)
+      })
+      .catch(() => {
+        setConsoleLogAvailable(false)
+        setOciInstance(null)
+      })
+
   const fetchMountPoints = async (vmid: number) => {
     // Two fetches in parallel:
     //   1) STATIC — configured mp entries + PVE classification. Backed
@@ -1993,6 +2034,7 @@ const handleDownloadLogs = async (vmid: number, vmName: string) => {
       ? s.targets.map((value: any) => String(value))
       : ([...(legacyTarget !== "app" ? ["os"] : []), ...(legacyTarget !== "os" ? ["apps"] : [])]))
     setScheduleReleaseDelayDays(Number.isInteger(Number(s.release_delay_days)) ? Number(s.release_delay_days) : 0)
+    setScheduleAckExternal(s.acknowledge_external_data === true)
     if (s.backup !== undefined) setApplyBackup(!!s.backup)
     if (s.backup_storage) setApplyBackupStorage(s.backup_storage)
     if (s.restart !== undefined) setApplyRestart(!!s.restart)
@@ -2144,8 +2186,11 @@ const handleDownloadLogs = async (vmid: number, vmName: string) => {
     // leave scheduleConfigured=false and Save PUTs cron="" so the
     // backend doesn't resurrect the schedule.
     const cronToSave = scheduleEnabled || scheduleConfigured ? scheduleCron : ""
-    const hasOsTarget = scheduleTargets.includes("os")
-    const hasAppTarget = scheduleTargets.some((value) => value !== "os")
+    // A container installed by OCI manager Apps has one thing to update on
+    // a schedule: its image.
+    const targetsToSave = ociInstance ? ["oci_image"] : scheduleTargets
+    const hasOsTarget = targetsToSave.includes("os")
+    const hasAppTarget = targetsToSave.some((value) => value !== "os")
     const derivedTarget: "os" | "app" | "both" = hasOsTarget && hasAppTarget ? "both" : hasOsTarget ? "os" : "app"
     try {
       await fetchApi(`/api/vms/${vmid}/schedule`, {
@@ -2155,11 +2200,12 @@ const handleDownloadLogs = async (vmid: number, vmName: string) => {
           enabled: scheduleEnabled,
           cron: cronToSave,
           target: derivedTarget,
-          targets: scheduleTargets,
+          targets: targetsToSave,
           release_delay_days: scheduleReleaseDelayDays,
           backup: applyBackup,
           backup_storage: applyBackupStorage || selectedBackupStorage || "",
-          restart: applyRestart,
+          restart: ociInstance ? false : applyRestart,
+          acknowledge_external_data: ociInstance ? scheduleAckExternal : false,
         }),
       })
       if (cronToSave.trim()) setScheduleConfigured(true)
@@ -2181,6 +2227,7 @@ const handleDownloadLogs = async (vmid: number, vmName: string) => {
       scheduleTarget: scheduleTarget,
       scheduleTargets: [...scheduleTargets],
       scheduleReleaseDelayDays: scheduleReleaseDelayDays,
+      scheduleAckExternal: scheduleAckExternal,
     })
     setOptionsEditMode(true)
   }
@@ -2195,6 +2242,7 @@ const handleDownloadLogs = async (vmid: number, vmName: string) => {
       setScheduleTarget(optionsSnapshot.scheduleTarget)
       setScheduleTargets(optionsSnapshot.scheduleTargets || ["os", "apps"])
       setScheduleReleaseDelayDays(optionsSnapshot.scheduleReleaseDelayDays)
+      setScheduleAckExternal(!!optionsSnapshot.scheduleAckExternal)
     }
     setOptionsSnapshot(null)
     setOptionsEditMode(false)
@@ -3761,6 +3809,24 @@ const handleDownloadLogs = async (vmid: number, vmName: string) => {
                     </Badge>
                   </button>
                 )}
+                {/* Logs tab — native OCI containers only: the console
+                    output of the image's main process, read live from
+                    the host on every open. */}
+                {selectedVM?.type === "lxc" && (consoleLogAvailable || selectedVM?.update_check?.is_oci_lxc) && (
+                  <button
+                    onClick={() => setActiveModalTab("logs")}
+                    className={`flex items-center gap-1.5 sm:gap-2 px-2.5 sm:px-4 py-2.5 text-sm font-medium transition-colors border-b-2 -mb-px whitespace-nowrap shrink-0 ${
+                      activeModalTab === "logs"
+                        ? "border-sky-500 text-sky-500"
+                        : "border-transparent text-muted-foreground hover:text-foreground"
+                    }`}
+                  >
+                    <FileText className="h-4 w-4" />
+                    <span className={activeModalTab === "logs" ? "" : "hidden sm:inline"}>
+                      {t("vmLxc.tabs.logs")}
+                    </span>
+                  </button>
+                )}
                 <button
                   onClick={() => setActiveModalTab("backups")}
                   className={`flex items-center gap-1.5 sm:gap-2 px-2.5 sm:px-4 py-2.5 text-sm font-medium transition-colors border-b-2 -mb-px whitespace-nowrap shrink-0 ${
@@ -5130,8 +5196,299 @@ const handleDownloadLogs = async (vmid: number, vmName: string) => {
                       )
                     })()}
 
-                    {/* Branch 1 — OCI-image container */}
-                    {!selectedVM.update_check?.managed_oci_app &&
+                    {/* Branch 0b — container installed by OCI manager Apps. It is
+                        updated by replacing its image, through the same flow as
+                        the OCI menu; nothing of the package or app updaters of an
+                        ordinary LXC applies. */}
+                    {!selectedVM.update_check?.managed_oci_app && ociInstance && (() => {
+                      const ociApp = (selectedVM.app_watches || []).find((a) => a.installed_via === "oci_image")
+                      const hasUpdate = ociApp?.update_available === true
+                      const upToDate = ociApp?.update_available === false
+                      const installedLabel = ociApp ? ociImageLabel(ociApp.image_created, ociApp.installed_digest) : ""
+                      const latestLabel = ociApp ? ociImageLabel(ociApp.latest_image_created, ociApp.latest_digest) : ""
+                      const updateBtnCls = hasUpdate
+                        ? "bg-purple-600/15 hover:bg-purple-600/25 border border-purple-500/40 text-purple-300 hover:text-purple-200"
+                        : "bg-green-500/10 hover:bg-green-500/20 border border-green-500/30 text-green-400 hover:text-green-300"
+                      const neutralBtnCls = "border border-input bg-background text-foreground/80 hover:bg-accent hover:text-accent-foreground"
+                      const storageForBackup = applyBackupStorage || selectedBackupStorage
+                      return (
+                        <>
+                          <Card className="border border-border bg-card/50">
+                            <CardContent className="p-4">
+                              <div className="flex items-center gap-2 mb-3 min-w-0">
+                                <Package className="h-4 w-4 text-muted-foreground flex-shrink-0" />
+                                <h3 className="text-sm font-semibold text-foreground truncate">
+                                  {ociApp?.name || selectedVM.name}
+                                </h3>
+                              </div>
+                              {ociApp?.checked_at && (
+                                <div className="text-xs text-muted-foreground mb-3 leading-relaxed">
+                                  {t("vmLxc.updates.lastCheckedPrefix")} {new Date(ociApp.checked_at).toLocaleString()}
+                                </div>
+                              )}
+                              {!ociApp ? (
+                                <div className="text-sm text-muted-foreground">{t("vmLxc.ociUpdates.notTracked")}</div>
+                              ) : hasUpdate ? (
+                                <div className="space-y-2 text-sm">
+                                  <div className="flex items-center gap-2">
+                                    <Package className="h-4 w-4 text-muted-foreground flex-shrink-0" />
+                                    <span>{t("vmLxc.ociUpdates.installedImage")} <code className="text-foreground/80">{installedLabel}</code></span>
+                                  </div>
+                                  <div className="flex items-center gap-2">
+                                    <ArrowUpCircle className="h-4 w-4 text-purple-400 flex-shrink-0" />
+                                    <span>{t("vmLxc.ociUpdates.newImage", { image: latestLabel })}</span>
+                                  </div>
+                                </div>
+                              ) : upToDate ? (
+                                <div className="text-sm text-muted-foreground flex items-center gap-2">
+                                  <CheckCircle2 className="h-4 w-4 text-green-500 flex-shrink-0" />
+                                  <span>{t("vmLxc.updates.upToDateAtLabel")} <code className="text-foreground/80">{installedLabel}</code></span>
+                                </div>
+                              ) : (
+                                <div className="text-sm text-muted-foreground flex items-center gap-2">
+                                  <Package className="h-4 w-4 flex-shrink-0" />
+                                  <span>{t("vmLxc.ociUpdates.installedImage")} <code className="text-foreground/80">{installedLabel || "—"}</code></span>
+                                </div>
+                              )}
+                              {ociInstance.stack && (
+                                <div className="text-xs text-muted-foreground mt-3 leading-relaxed">
+                                  {t("vmLxc.ociUpdates.stackNote", { primary: ociInstance.primary_vmid, count: ociInstance.members.length })}
+                                </div>
+                              )}
+                              {ociInstance.pending && (
+                                <div className="text-xs text-amber-400 mt-3 leading-relaxed">{t("vmLxc.ociUpdates.pendingNote")}</div>
+                              )}
+                              <div className="mt-4 pt-4 border-t border-border/50 flex flex-wrap justify-end gap-2">
+                                {!ociInstance.stack && !ociInstance.pending && (
+                                  <Button
+                                    size="sm"
+                                    className={neutralBtnCls}
+                                    onClick={() => setOciAction({ vmid: selectedVM.vmid, action: "recreate" })}
+                                  >
+                                    <RotateCcw className="h-4 w-4 mr-1.5" />
+                                    {t("vmLxc.ociUpdates.recreate")}
+                                  </Button>
+                                )}
+                                <Button
+                                  size="sm"
+                                  className={updateBtnCls}
+                                  onClick={() => setOciAction({ vmid: selectedVM.vmid, action: "update" })}
+                                >
+                                  {hasUpdate
+                                    ? <ArrowUpCircle className="h-4 w-4 mr-1.5" />
+                                    : <RefreshCw className="h-4 w-4 mr-1.5" />}
+                                  {ociInstance.pending ? t("vmLxc.ociUpdates.recover") : t("vmLxc.ociUpdates.update")}
+                                </Button>
+                              </div>
+                            </CardContent>
+                          </Card>
+
+                          {/* Options — the backup the update keeps and the
+                              scheduled image update. */}
+                          <Card className={optionsEditMode ? "border border-border bg-card" : "border border-border bg-card/50"}>
+                            <CardContent className="p-4 space-y-4">
+                              <h3 className="text-sm font-semibold text-foreground">{t("vmLxc.options.title")}</h3>
+                              {!optionsEditMode ? (
+                                <div className="text-sm flex items-center gap-2">
+                                  {applyBackup ? (
+                                    <CheckCircle2 className="h-4 w-4 text-green-500 flex-shrink-0" />
+                                  ) : (
+                                    <div className="h-4 w-4 rounded-full border border-muted-foreground/40 flex-shrink-0" />
+                                  )}
+                                  <span>
+                                    {applyBackup
+                                      ? <>{t("vmLxc.ociUpdates.keepBackup")} <span className="text-muted-foreground">{t("vmLxc.options.snapshotOn", { storage: storageForBackup || t("vmLxc.options.storageAuto") })}</span></>
+                                      : <span className="text-muted-foreground">{t("vmLxc.ociUpdates.noKeepBackup")}</span>}
+                                  </span>
+                                </div>
+                              ) : (
+                                <div className="space-y-3">
+                                  <div className="flex items-start gap-2 text-sm">
+                                    <Checkbox
+                                      id="oci-keep-backup"
+                                      checked={applyBackup}
+                                      onCheckedChange={(v) => setApplyBackup(Boolean(v))}
+                                      className="mt-0.5"
+                                    />
+                                    <Label htmlFor="oci-keep-backup" className="leading-tight cursor-pointer">
+                                      <span>{t("vmLxc.ociUpdates.keepBackup")}</span>
+                                      <div className="text-xs text-muted-foreground mt-0.5">{t("vmLxc.ociUpdates.keepBackupHelp")}</div>
+                                    </Label>
+                                  </div>
+                                  {applyBackup && backupStorages.length > 0 && (
+                                    <div className="pl-6">
+                                      <Label className="text-xs text-muted-foreground">{t("vmLxc.options.backupStorage")}</Label>
+                                      <Select value={storageForBackup} onValueChange={setApplyBackupStorage}>
+                                        <SelectTrigger className="h-8 text-sm mt-1 max-w-xs">
+                                          <SelectValue placeholder={t("vmLxc.options.pickStorage")} />
+                                        </SelectTrigger>
+                                        <SelectContent>
+                                          {backupStorages.map((st) => (
+                                            <SelectItem key={st.storage} value={st.storage}>{st.storage}</SelectItem>
+                                          ))}
+                                        </SelectContent>
+                                      </Select>
+                                    </div>
+                                  )}
+                                </div>
+                              )}
+
+                              <div className="pt-4 border-t border-border/50 space-y-3">
+                                <div className="flex items-start justify-between gap-3">
+                                  <div className="min-w-0">
+                                    <div className="text-sm font-medium text-foreground">{t("vmLxc.scheduled.title")}</div>
+                                    {optionsEditMode && (
+                                      <div className="text-xs text-muted-foreground mt-0.5">{t("vmLxc.ociUpdates.scheduleHelp")}</div>
+                                    )}
+                                  </div>
+                                  <Switch
+                                    checked={scheduleEnabled}
+                                    onCheckedChange={(v) => { if (optionsEditMode) setScheduleEnabled(v) }}
+                                    disabled={!optionsEditMode}
+                                    className="data-[state=checked]:bg-blue-600 data-[state=unchecked]:bg-input border border-border"
+                                  />
+                                </div>
+                                {!optionsEditMode && scheduleConfigured && (
+                                  <div className="text-sm space-y-1.5">
+                                    <div className="flex items-center gap-2 flex-wrap">
+                                      <span className={"h-2 w-2 rounded-full flex-shrink-0 " + (scheduleEnabled ? "bg-green-500" : "bg-muted-foreground/40")} />
+                                      <span className={scheduleEnabled ? "" : "text-muted-foreground"}>
+                                        <span className="text-foreground/80">{t("vmLxc.scheduled.chipLabel")}</span> — {humanCron(scheduleCron)}
+                                        {!scheduleEnabled && <span className="text-muted-foreground"> {t("vmLxc.scheduled.disabledSuffix")}</span>}
+                                      </span>
+                                    </div>
+                                    {scheduleReleaseDelayDays > 0 && (
+                                      <div className="text-xs text-muted-foreground pl-4">
+                                        {t("vmLxc.scheduled.releaseDelaySummary", { days: scheduleReleaseDelayDays })}
+                                      </div>
+                                    )}
+                                    {renderScheduleRunDetails(true)}
+                                  </div>
+                                )}
+                                {!optionsEditMode && !scheduleConfigured && (
+                                  <div className="text-sm flex items-center gap-2 text-muted-foreground">
+                                    <div className="h-4 w-4 rounded-full border border-muted-foreground/40 flex-shrink-0" />
+                                    <span>{t("vmLxc.scheduled.notScheduled")}</span>
+                                  </div>
+                                )}
+                                {optionsEditMode && scheduleEnabled && (
+                                  <div className="space-y-3">
+                                    <div className="grid grid-cols-1 sm:grid-cols-2 gap-3">
+                                      <div>
+                                        <Label className="text-xs text-muted-foreground">{t("vmLxc.scheduled.frequency")}</Label>
+                                        <Select
+                                          value={schedulePreset}
+                                          onValueChange={(v) => {
+                                            setSchedulePreset(v)
+                                            const preset = CRON_PRESETS.find((p) => p.value === v)
+                                            if (preset && preset.cron) setScheduleCron(preset.cron)
+                                          }}
+                                        >
+                                          <SelectTrigger className="h-8 text-sm mt-1"><SelectValue /></SelectTrigger>
+                                          <SelectContent>
+                                            {CRON_PRESETS.map((p) => (
+                                              <SelectItem key={p.value} value={p.value}>{p.label}</SelectItem>
+                                            ))}
+                                          </SelectContent>
+                                        </Select>
+                                      </div>
+                                      <div>
+                                        <Label className="text-xs text-muted-foreground">{t("vmLxc.scheduled.cronExpression")}</Label>
+                                        <Input
+                                          value={scheduleCron}
+                                          onChange={(e) => { setScheduleCron(e.target.value); setSchedulePreset("custom") }}
+                                          placeholder={t("vmLxc.scheduled.cronPlaceholder")}
+                                          className="h-8 text-sm mt-1 font-mono"
+                                        />
+                                      </div>
+                                    </div>
+                                    <div>
+                                      <Label className="text-xs text-muted-foreground">{t("vmLxc.scheduled.releaseDelayLabel")}</Label>
+                                      <Select value={String(scheduleReleaseDelayDays)} onValueChange={(v) => setScheduleReleaseDelayDays(Number(v))}>
+                                        <SelectTrigger className="h-8 text-sm mt-1 max-w-xs"><SelectValue /></SelectTrigger>
+                                        <SelectContent>
+                                          <SelectItem value="0">{t("vmLxc.scheduled.releaseDelayNone")}</SelectItem>
+                                          {[1, 3, 7, 14].map((days) => (
+                                            <SelectItem key={days} value={String(days)}>{t("vmLxc.scheduled.releaseDelayDays", { days })}</SelectItem>
+                                          ))}
+                                        </SelectContent>
+                                      </Select>
+                                      <div className="text-[10px] text-muted-foreground mt-1 max-w-xl">{t("vmLxc.ociUpdates.releaseDelayHelp")}</div>
+                                    </div>
+                                    {ociInstance.host_directories && (
+                                      <div className="flex items-start gap-2 text-sm">
+                                        <Checkbox
+                                          id="oci-ack-external"
+                                          checked={scheduleAckExternal}
+                                          onCheckedChange={(v) => setScheduleAckExternal(Boolean(v))}
+                                          className="mt-0.5"
+                                        />
+                                        <Label htmlFor="oci-ack-external" className="leading-tight cursor-pointer">
+                                          <span>{t("vmLxc.ociUpdates.ackExternal")}</span>
+                                          <div className="text-xs text-muted-foreground mt-0.5">{t("vmLxc.ociUpdates.ackExternalHelp")}</div>
+                                        </Label>
+                                      </div>
+                                    )}
+                                    {renderScheduleRunDetails()}
+                                  </div>
+                                )}
+                                {optionsEditMode && scheduleConfigured && (
+                                  <div className="flex justify-end">
+                                    <button
+                                      type="button"
+                                      onClick={deleteScheduleFromOptions}
+                                      disabled={scheduleSaving}
+                                      className="h-8 px-3 text-xs rounded-md border border-red-500/30 bg-red-500/10 hover:bg-red-500/20 text-red-400 transition-colors inline-flex items-center gap-1.5 disabled:opacity-60"
+                                    >
+                                      <Trash2 className="h-3.5 w-3.5" />
+                                      {t("vmLxc.scheduled.deleteButton")}
+                                    </button>
+                                  </div>
+                                )}
+                                {scheduleError && <div className="text-xs text-red-400">{scheduleError}</div>}
+                              </div>
+
+                              <div className="pt-4 border-t border-border/50 flex items-center justify-end gap-2">
+                                {!optionsEditMode ? (
+                                  <button
+                                    type="button"
+                                    onClick={enterOptionsEdit}
+                                    className="h-8 px-3 text-xs rounded-md border border-border bg-background hover:bg-muted transition-colors inline-flex items-center gap-1.5"
+                                  >
+                                    <Settings2 className="h-3.5 w-3.5" />
+                                    {t("vmLxc.options.editButton")}
+                                  </button>
+                                ) : (
+                                  <>
+                                    <button
+                                      type="button"
+                                      onClick={cancelOptionsEdit}
+                                      disabled={scheduleSaving}
+                                      className="h-8 px-3 text-xs rounded-md border border-border bg-background hover:bg-muted transition-colors inline-flex items-center gap-1.5 disabled:opacity-60"
+                                    >
+                                      {t("vmLxc.options.cancelButton")}
+                                    </button>
+                                    <button
+                                      type="button"
+                                      onClick={saveOptionsEdit}
+                                      disabled={scheduleSaving || (scheduleEnabled && ociInstance.host_directories && !scheduleAckExternal)}
+                                      className="h-8 px-3 text-xs rounded-md bg-blue-600 hover:bg-blue-700 text-white transition-colors disabled:opacity-40 inline-flex items-center gap-1.5"
+                                    >
+                                      {scheduleSaving ? <Loader2 className="h-3.5 w-3.5 animate-spin" /> : <Check className="h-3.5 w-3.5" />}
+                                      {t("vmLxc.options.saveButton")}
+                                    </button>
+                                  </>
+                                )}
+                              </div>
+                            </CardContent>
+                          </Card>
+                        </>
+                      )
+                    })()}
+
+                    {/* Branch 1 — OCI-image container not installed by
+                        OCI manager Apps */}
+                    {!selectedVM.update_check?.managed_oci_app && !ociInstance &&
                       selectedVM.update_check?.is_oci_lxc && (
                       <Card className="border border-border bg-card/50">
                         <CardContent className="p-4 space-y-2">
@@ -5164,7 +5521,7 @@ const handleDownloadLogs = async (vmid: number, vmName: string) => {
                         Individual actions stay with their section. The
                         optional reusable bulk action is configured in its
                         own card immediately before Options. */}
-                    {!selectedVM.update_check?.managed_oci_app &&
+                    {!selectedVM.update_check?.managed_oci_app && !ociInstance &&
                       !selectedVM.update_check?.is_oci_lxc && (() => {
                         const uc = selectedVM.update_check
                         const osUpdateStatusKnown = !!uc && !uc.error
@@ -6957,6 +7314,14 @@ const handleDownloadLogs = async (vmid: number, vmName: string) => {
                     </Card>
                   </div>
                 )}
+
+                {activeModalTab === "logs" && selectedVM?.type === "lxc" && (
+                  <OciConsoleLogPanel
+                    key={selectedVM.vmid}
+                    vmid={selectedVM.vmid}
+                    running={selectedVM.status === "running"}
+                  />
+                )}
               </div>
 
               <div className="border-t border-border bg-background px-6 py-4 mt-auto shrink-0">
@@ -7390,6 +7755,37 @@ const handleDownloadLogs = async (vmid: number, vmName: string) => {
           }}
         />
       )}
+
+      {/* Update or recreate an OCI instance: the same flow as OCI manager
+          Apps -> Manage installed OCI applications, for this container. */}
+      {ociAction && (
+        <ScriptTerminalModal
+          open={!!ociAction}
+          onClose={() => {
+            const vmid = ociAction.vmid
+            setOciAction(null)
+            // The image, the digest and the record changed: read them again.
+            fetchApi(`/api/vms/${vmid}/apps/check`, { method: "POST" })
+              .catch(() => undefined)
+              .finally(() => {
+                invalidateLxcApps(vmid)
+                vmModalCacheRef.current.mountPoints.delete(vmid)
+                fetchOciInstance(vmid)
+                fetchMountPoints(vmid)
+                mutate()
+              })
+          }}
+          scriptPath="/usr/local/share/proxmenux/scripts/oci/manage_instance.sh"
+          scriptName="oci_manage_instance"
+          title={ociAction.action === "update" ? t("vmLxc.ociUpdates.terminalTitleUpdate") : t("vmLxc.ociUpdates.terminalTitleRecreate")}
+          description={t("vmLxc.ociUpdates.terminalDescription")}
+          params={{
+            VMID: String(ociAction.vmid),
+            ACTION: ociAction.action,
+            KEEP_BACKUP: ociAction.action === "update" && applyBackup ? (applyBackupStorage || selectedBackupStorage || "") : "",
+          }}
+        />
+      )}
     </div>
   )
 }
diff --git a/AppImage/lib/version.ts b/AppImage/lib/version.ts
index e1e1ae5d..f4e96d7d 100644
--- a/AppImage/lib/version.ts
+++ b/AppImage/lib/version.ts
@@ -8,4 +8,4 @@
 //   3. beta_version.txt              ← bash pipeline (build_appimage.sh)
 //
 // Keep the three in sync on every bump.
-export const APP_VERSION = "1.2.6.1-beta"
+export const APP_VERSION = "1.2.6.2-beta"
diff --git a/AppImage/messages/de/common.json b/AppImage/messages/de/common.json
index 1ea85310..fad84f32 100644
--- a/AppImage/messages/de/common.json
+++ b/AppImage/messages/de/common.json
@@ -1487,7 +1487,6 @@
       "containerNameLabel": "Containername",
       "containerNamePlaceholder": "z. B. <Ihr-Container-Name>",
       "ociLabelKeyLabel": "OCI-Labelschlüssel",
-      "ociLabelPlaceholder": "org.opencontainers.image.version",
       "pythonInterpreterLabel": "Pfad des Python-Interpreters",
       "pythonInterpreterPlaceholder": "z. B. /opt/<your-app>/venv/bin/python",
       "pipDistLabel": "Distributionsname (Pip-Paket)",
@@ -1534,11 +1533,8 @@
       "portHttps": "https",
       "portLogoLabel": "Logo-URL für diesen Link (optional)",
       "portLogoPlaceholder": "z. B. https://example.com/logo.webp",
-      "portCategoryPlaceholder": "Category for the Apps dashboard (optional)",
       "portCategoryNone": "No category",
       "portCategoryAddNew": "+ Add new category…",
-      "portCategoryCustomPlaceholder": "Type a category and press Enter (Esc to cancel)",
-      "portCustomUrlPlaceholder": "Custom URL (e.g. https://vault.example.com) — overrides IP:port",
       "removePortTooltip": "Port entfernen",
       "detectMethodDpkg": "dpkg ·",
       "detectMethodApk": "apk ·",
@@ -1631,7 +1627,11 @@
       "notifyUpstreamLabel": "Benachrichtigen Sie mich, wenn eine neue Upstream-Version verfügbar ist",
       "notifyUpstreamHelp": "Sendet „app_update_available“ an die Kanäle, die in Einstellungen → Benachrichtigungen aktiviert sind. Deaktivieren Sie diese Option, wenn diese App auf Ihrer Box nicht aktualisiert werden kann.",
       "excludeFromBadgeLabel": "Vom LXC-Aktualisierungszähler ausschließen",
-      "excludeFromBadgeHelp": "Zählen Sie diese App nicht im Abzeichen „Aggregate Updates“ auf der LXC-Listenkarte. Nützlich, wenn Sie absichtlich an eine bestimmte Version gebunden sind (Tracker-Anforderung, Kompatibilitätsstopp).Hat keinen Einfluss auf den eigenen Status der App-Registerkarte oder die ausgehende Benachrichtigung."
+      "excludeFromBadgeHelp": "Zählen Sie diese App nicht im Abzeichen „Aggregate Updates“ auf der LXC-Listenkarte. Nützlich, wenn Sie absichtlich an eine bestimmte Version gebunden sind (Tracker-Anforderung, Kompatibilitätsstopp).Hat keinen Einfluss auf den eigenen Status der App-Registerkarte oder die ausgehende Benachrichtigung.",
+      "ociLabelPlaceholder": "org.opencontainers.image.version",
+      "portCategoryPlaceholder": "Kategorie für das Apps-Dashboard (optional)",
+      "portCategoryCustomPlaceholder": "Geben Sie eine Kategorie ein und drücken Sie Enter (Esc to cancel)",
+      "portCustomUrlPlaceholder": "Benutzerdefinierte URL (z. B. https://vault.example.com) überschreibt IP:port"
     },
     "statusFilter": {
       "ariaLabel": "Virtuelle Maschinen und Container filtern",
@@ -2515,10 +2515,10 @@
       "scope": {
         "label": "Token permissions",
         "readOnly": "Read-only",
-        "readOnlyHint": "Reads metrics and status. Recommended for dashboards and integrations.",
         "fullAdmin": "Full admin",
-        "fullAdminHint": "Full control, like your own session.",
-        "fullAdminWarning": "A full-admin token can do everything you can: power off or reboot the host, run updates and open a terminal. Share it only with fully trusted integrations."
+        "readOnlyHint": "Lesen Sie Metriken und Status. Empfohlen für Dashboards und Integrationen.",
+        "fullAdminHint": "Volle Kontrolle, wie Ihre eigene Sitzung.",
+        "fullAdminWarning": "Ein Full-Admin-Token kann alles tun, was Sie können: den Host ausschalten oder neu starten, Updates ausführen und ein Terminal öffnen. Teilen Sie es nur mit vollständig vertrauenswürdigen Integrationen."
       }
     },
     "firewall": {
@@ -3302,26 +3302,33 @@
     "gotIt": "Habe es!",
     "dontShowAgain": "Für diese Version nicht mehr anzeigen",
     "currentFeatures": {
-      "appDetection": "Smarter app detection in the App tab: Docker is correctly promoted as the parent workload during cold start (Portainer/SearXNG no longer briefly show up as native apps), unregistered suggestions live in the startup cache, and 'Find applications' runs a fresh catalog-backed scan on demand.",
-      "dockerUpdates": "The Updates tab now covers Docker end-to-end: Docker Engine and per-image update tracking follow the same 24-hour rolling cycle as OS packages, with a 'Check now' action for on-demand digest comparison — no more waiting for the daily collector.",
-      "appCatalog": "New application detection catalog with over 380 tracked workloads, generated live from community-scripts across seven detector methods (file, binary, dpkg, apk, Python, Docker exec, Docker label). Primary and fallback detectors cover both new and historical LXC layouts.",
-      "pushover": "Pushover joins Telegram, Gotify, Discord, Email and Apprise as a native notification channel — user/API key, device and sound selectors, priority 0 for regular messages, optional priority 1 for CRITICAL events. Suggested by @benginx (#308).",
-      "appsDashboard": "New top-level Apps dashboard — a single launcher for every Web Link across the node. LXC-registered apps and user-defined Custom Web Links share the same grid with category badges, search, and one-click deep-links back to the guest modal.",
-      "lxcAppsUpdates": "App tab inside every LXC modal registers installed apps, captures weblinks and tracks upstream versions. Reworked Updates tab applies OS packages and app updates from a single button; Docker Engine and per-image tracking follow the same 24-hour cycle, with a 'Check now' action on demand.",
-      "multilingual": "The Monitor now speaks 8 languages: English, Spanish, German, French, Italian, Portuguese, Swedish and Slovak. Huge thanks to @vaso73 for building the i18n scaffolding that made this possible.",
-      "nvidiaMultiGpu": "NVIDIA driver lifecycle moves to per-BDF ownership so a multi-GPU host can pass one card to a VM and keep the other operational on the host or in LXCs, plus a kernel + branch + GPU-aware version picker (#298).",
-      "aiCustomEndpoint": "AI Assistant custom OpenAI endpoint — LiteLLM, LM Studio, LocalAI, vLLM, OmniRoute and any self-hosted proxy on private IPs, loopback or Docker networks are recognised when loading the model catalogue. The dropdown surfaces the server's error (or the underlying network reason) directly under the Load button (#325, reported by @jorgeffonte).",
-      "secureGatewayArch": "Secure Gateway wizard — the Alpine template download, local template selection and pct create all match the host's real architecture, so x86_64 hosts receive amd64 containers and arm64 hosts receive arm64 containers (#324, reported by @N0X4DD0).",
-      "atomicNotifications": "Notification events reserve their deduplication fingerprint atomically before AI processing and channel delivery, so concurrent collectors, completion callbacks or parallel Monitor processes cannot send the same event twice. The reservation is released when no channel succeeds, preserving retries.",
-      "borgSshPort": "Borg remote target — the Add Borg destination dialog and the shell TUI accept a custom SSH port. BORG_RSH, the auto key install flow and the capacity probe all honour it. Fully backwards compatible with existing entries created without an explicit port (suggested by @songochain in discussion #236).",
-      "githubToken": "Settings → GitHub API accepts an optional personal access token for release and tag checks when the anonymous quota is exhausted. The token is encrypted at rest and never returned to the browser; the rate-limit error is translated in every Monitor language (suggested by @SystemIdleProcess in discussion #306).",
-      "replicationContext": "Native Proxmox replication failure notifications resolve the replication job ID, affected VM/LXC ID and guest name; the exact error block from Proxmox is preserved as the reason, and each replication job deduplicates independently (reported by Ale R.).",
-      "auditAssessment": "Audit & Report — a new page that documents and assesses the node. The Assessment runs a catalogue of checks across security, backups, capacity, storage, network, hardware, guests and system, classifying each finding as critical, warning, observation or conformant and stating what it read rather than judging it.",
-      "changeJournal": "Change journal — a Changes view that lists exactly what ProxMenux modified on this host: every configuration file, package and service it touched, with the prior state of each, deduplicated to a current-state view that shows the host as it stands now rather than a log of every run.",
-      "auditReports": "Reports — a full audit plus focused Security review, Backup assurance and Capacity & wear reports, each opening on its own posture header, and a printable Inventory; all export to PDF. A security assessment asks before running Lynis so a run stays fast.",
-      "auditPolicyBaseline": "Policy and baseline — declare what the host is expected to be (backup requirements, firewall, root SSH login) so findings grade against it, mark a run as the reference, and see what changed since, with new, resolved and accepted findings kept apart.",
-      "groupedAppUpdates": "Grouped application update notifications — one complete message per scan instead of one per application, grouped by LXC with the installed and available versions.",
-      "adminTokenScope": "Administrative scope — opening a Monitor terminal and disabling authentication now require a full-admin token, so a read-only API token issued to a monitoring integration stays read-only (reported by @f3rs3n)."
+      "appDetection": "Intelligentere App-Erkennung im App-Tab: Docker wird korrekt gefördert, da der übergeordnete Workload während des Kaltstarts (Portainer/SearXNG wird nicht mehr kurzzeitig als native Apps angezeigt), nicht registrierte Vorschläge live im Start-Cache und \"Anwendungen finden\" führt bei Bedarf einen neuen kataloggestützten Scan aus.",
+      "dockerUpdates": "Die Registerkarte Updates umfasst jetzt Docker Ende-zu-Ende: Docker Engine und Per-Image-Update-Tracking folgen dem gleichen 24-Stunden-Rollenzyklus wie OS-Pakete, mit einer \"Check now\" -Aktion für den On-Demand-Digest-Vergleich - nicht mehr auf den täglichen Sammler warten.",
+      "appCatalog": "Neuer Anwendungserkennungskatalog mit über 380 verfolgten Workloads, der live aus Community-Scripts über sieben Detektormethoden generiert wurde (Datei, Binär, dpkg, apk, Python, Docker exec, Docker Label). Primär- und Fallbackdetektoren decken sowohl neue als auch historische LXC-Layouts ab.",
+      "pushover": "Pushover verbindet Telegram, Gotify, Discord, E-Mail und Apprise als nativen Benachrichtigungskanal - Benutzer / API-Schlüssel, Geräte- und Sound-Selektoren, Priorität 0 für reguläre Nachrichten, optionale Priorität 1 für kritische Ereignisse. Vorgeschlagen von @benginx (#308).",
+      "appsDashboard": "Neues Top-Level-Apps-Dashboard - ein einziger Launcher für jeden Weblink über den Knoten. LXC-registrierte Apps und benutzerdefiniertes Custom Web Links teilen sich das gleiche Raster mit Kategorieabzeichen, Suche und Ein-Klick-Deep-Links zurück zum Gastmodal.",
+      "lxcAppsUpdates": "Die App-Registerkarte in jedem LXC-Modal registriert installierte Apps, erfasst Weblinks und verfolgt Upstream-Versionen. Überarbeitete Updates Tab wendet OS-Pakete und App-Updates von einer einzigen Schaltfläche; Docker Engine und Per-Image-Tracking folgen dem gleichen 24-Stunden-Zyklus, mit einer \"Check now\" -Aktion auf Anfrage.",
+      "multilingual": "Der Monitor spricht jetzt 8 Sprachen: Englisch, Spanisch, Deutsch, Französisch, Italienisch, Portugiesisch, Schwedisch und Slowakisch. Großer Dank an @vaso73 für den Bau des i18n-Gerüsts, das dies ermöglicht hat.",
+      "nvidiaMultiGpu": "Der NVIDIA-Treiber-Lebenszyklus bewegt sich in den Besitz pro BDF, so dass ein Multi-GPU-Host eine Karte an einen VM übergeben und den anderen auf dem Host oder in LXCs betriebsbereit halten kann, sowie einen Kernel + Branch + GPU-fähige Versionsauswahl (# 298).",
+      "aiCustomEndpoint": "AI Assistant benutzerdefinierte OpenAI-Endpunkte – LiteLLM, LM Studio, LocalAI, vLLM, OmniRoute und jeder selbst gehostete Proxy auf privaten IPs, Loopback- oder Docker-Netzwerken werden beim Laden des Modellkatalogs erkannt. Der Dropdown zeigt den Fehler des Servers (oder den zugrunde liegenden Netzwerkgrund) direkt unter der Schaltfläche Laden (#325, berichtet von @jorgeffonte).",
+      "secureGatewayArch": "Secure Gateway-Assistent - der Alpine Template-Download, die lokale Template-Auswahl und pct create passen alle zur realen Architektur des Hosts, so dass x86 64-Hosts amd64-Container und arm64-Hosts arm64-Container erhalten (#324, berichtet von @N0X4DD0).",
+      "atomicNotifications": "Benachrichtigungsereignisse reservieren ihren Deduplizierungs-Fingerabdruck atomar vor der KI-Verarbeitung und Kanalzustellung, so dass gleichzeitige Sammler, Abschlussrückrufe oder parallele Monitorprozesse dasselbe Ereignis nicht zweimal senden können. Die Reservierung wird freigegeben, wenn kein Kanal erfolgreich ist, wobei Wiederholungen beibehalten werden.",
+      "borgSshPort": "Borg-Remoteziel – der Add Borg-Zieldialog und die Shell TUI akzeptieren einen benutzerdefinierten SSH-Port. BORG RSH, der Autoschlüssel-Installationsfluss und die Kapazitätssonde ehren dies. Vollständig rückwärtskompatibel mit vorhandenen Einträgen, die ohne expliziten Port erstellt wurden (vorgeschlagen von @songochain in Diskussion #236).",
+      "githubToken": "Einstellungen → GitHub API akzeptiert ein optionales persönliches Zugriffstoken für die Freigabe und Tag-Prüfung, wenn das anonyme Kontingent erschöpft ist. Das Token wird im Ruhezustand verschlüsselt und niemals an den Browser zurückgegeben; der Rate-Limit-Fehler wird in jede Monitorsprache übersetzt (vorgeschlagen von @SystemIdleProcess in Diskussion #306).",
+      "replicationContext": "Native Proxmox Replikationsfehlermeldungen lösen die Replikationsauftrags-ID, die betroffene VM/LXC ID und den Gastnamen; der genaue Fehlerblock aus Proxmox bleibt als Grund erhalten, und jeder Replikationsauftrag wird unabhängig dedupliziert (von Ale R. berichtet).",
+      "auditAssessment": "Audit & Report - eine neue Seite, die den Knoten dokumentiert und bewertet. Die Bewertung führt einen Katalog von Prüfungen über Sicherheit, Backups, Kapazität, Speicher, Netzwerk, Hardware, Gäste und System durch, wobei jeder Befund als kritisch, Warnung, Beobachtung oder konform eingestuft wird und angegeben wird, was er gelesen hat, anstatt ihn zu beurteilen.",
+      "changeJournal": "Änderungsjournal - eine Änderungsansicht, in der genau aufgeführt ist, was ProxMenux auf diesem Host geändert hat: jede Konfigurationsdatei, jedes Paket und jeder Dienst, die es berührt hat, mit dem vorherigen Status von jedem, dedupliziert zu einer aktuellen Zustandsansicht, die den Host so zeigt, wie er jetzt steht, anstatt ein Protokoll von jedem Lauf.",
+      "auditReports": "Berichte - ein vollständiges Audit sowie eine fokussierte Sicherheitsüberprüfung, Backup Assurance und Capacity & Wear-Berichte, jede Öffnung auf einem eigenen Haltungskopf und ein druckbares Inventar; alle exportieren in PDF. Eine Sicherheitsbewertung fragt vor dem Ausführen von Lynis, damit ein Lauf schnell bleibt.",
+      "auditPolicyBaseline": "Policy und Baseline - Deklarieren Sie, was der Host sein soll (Backup-Anforderungen, Firewall, Root SSH-Login), damit die Ergebnisse dagegen bewertet werden, markieren Sie einen Lauf als Referenz und sehen Sie, was sich seitdem geändert hat, wobei neue, gelöste und akzeptierte Ergebnisse auseinandergehalten werden.",
+      "groupedAppUpdates": "Gruppierte Anwendungsaktualisierungsbenachrichtigungen — eine vollständige Nachricht pro Scan statt einer pro Anwendung, gruppiert nach LXC mit den installierten und verfügbaren Versionen.",
+      "adminTokenScope": "Administrativer Umfang: Das Öffnen eines Monitor-Terminals und das Deaktivieren der Authentifizierung erfordern jetzt ein Full-Admin-Token, so dass ein schreibgeschütztes API-Token, das an eine Überwachungsintegration ausgegeben wird, schreibgeschützt bleibt (berichtet von @f3rs3n).",
+      "ociAppTab": "OCI-Container in der App-Registerkarte — ein von OCI manager Apps installierter Container wird anhand seines Installationsdatensatzes erkannt: Anwendung und Image, ein neues Image per Digest erkannt und ein Link zum Image-Repository.",
+      "ociUpdatesTab": "Updates für OCI-Container — Aktualisieren und Neu erstellen öffnen denselben Ablauf wie das OCI-Menü, das vor dem Update erstellte Backup kann in einem Backup-Speicher behalten werden und das Image lässt sich zeitgesteuert aktualisieren.",
+      "ociLogsTab": "Logs-Registerkarte für OCI-Container — die Konsolenausgabe der Anwendung, auf dem Host gespeichert und live verfolgt, mit Filter und Download. Die Proxmox-Konsole dieser Container öffnet eine Shell.",
+      "appsUpdateShortcut": "Das Update-Symbol auf der Apps-Seite öffnet den Container direkt auf seiner Registerkarte Updates.",
+      "webhookHttps": "Proxmox-Benachrichtigungen erreichen den Monitor auch mit aktiviertem HTTPS — sie werden über eine nur lokale Adresse zugestellt und scheitern nicht mehr an einem Zertifikatsfehler.",
+      "persistentLogs": "Eine beendete Häufung von Log-Fehlern wird nicht mehr als dauerhaft gemeldet: Ein Muster muss 15 Minuten lang weiter auftreten, und seine Warnung schließt sich von selbst (gemeldet von @Joshua1264).",
+      "mountsLanAddress": "Mountpunkte auf LVM-thin und anderem Blockspeicher zeigen ihre Belegung, und Multi-Container-Anwendungen öffnen sich unter ihrer LAN-Adresse."
     }
   },
   "network": {
@@ -5027,23 +5034,20 @@
     "uncategorized": "Uncategorized",
     "openAriaLabel": "Open {name} in a new tab",
     "openGuestAriaLabel": "{name} öffnen ({type} {id})",
-    "emptyTitle": "No apps with a web link yet.",
-    "emptyHint": "Register a Web Link for any app (App tab of a CT) to see it here.",
     "customLinkAdd": "Add link",
     "editModeToggle": "Edit",
     "editModeDone": "Done",
     "customLinkNewTitle": "New web link",
     "customLinkEditTitle": "Edit web link",
     "customLinkEditAria": "Benutzerdefinierten Link {name} bearbeiten",
+    "openUpdatesAria": "Registerkarte Updates von {name} öffnen",
+    "openUpdatesTitle": "Update verfügbar — Registerkarte Updates öffnen",
     "customLinkName": "Name",
     "customLinkNamePlaceholder": "e.g. My app",
     "customLinkUrl": "URL",
     "customLinkLogo": "Logo URL (optional)",
-    "customLinkLogoPlaceholder": "e.g., https://example.com/logo.webp",
     "customLinkCategory": "Category (optional)",
     "customLinkBinding": "Bound to",
-    "customLinkBindingNone": "Not bound to any guest",
-    "customLinkBindingHelp": "Bind this link to a VM or CT to add its ID + name to the card and jump to the guest with one click.",
     "customLinkSave": "Save",
     "customLinkCreate": "Create",
     "customLinkCancel": "Cancel",
@@ -5079,7 +5083,12 @@
       "remoteAccessVpn": "Remote Access & VPN",
       "webserversProxies": "Webservers & Proxies",
       "zigbeeZwaveMatter": "ZigBee, Z-Wave & Matter"
-    }
+    },
+    "emptyTitle": "Noch keine Apps mit einem Weblink.",
+    "emptyHint": "Registrieren Sie einen Weblink für eine beliebige App (App-Tab eines CT), um ihn hier zu sehen.",
+    "customLinkLogoPlaceholder": "z. B. https://example.com/logo.webp",
+    "customLinkBindingNone": "Nicht an einen Gast gebunden",
+    "customLinkBindingHelp": "Binden Sie diesen Link an eine VM oder CT, um die ID + den Namen der Karte hinzuzufügen und mit einem Klick zum Gast zu springen."
   },
   "audit": {
     "presentation": {
@@ -5234,13 +5243,10 @@
     "loading": "Loading assessment…",
     "run": "Run assessment",
     "running": "Assessing…",
-    "neverRun": "This host has not been assessed yet.",
     "lastRun": "Last assessed on {when}",
     "stale": "{days} days ago",
     "unverifiedChecks": "Nicht erhoben: {checks}. Jede nennt in ihrer Evidenz, was sie nicht lesen konnte.",
-    "noFindings": "No findings match the current filter.",
     "affectedCount": "{count} affected",
-    "acceptedNotice": "{count} accepted risk(s) recorded on this host.",
     "reviewOn": "Überprüfen am: {when}",
     "reviewDue": "Zur Überprüfung fällig — die Entscheidung gilt weiter",
     "reviewDueNotice": "{count} akzeptierte Entscheidung(en) stehen zur Überprüfung an.",
@@ -5272,7 +5278,7 @@
       "sources": "Quellen und Erfassungszeitpunkte"
     },
     "errors": {
-      "runFailed": "The assessment could not be started."
+      "runFailed": "Mit der Bewertung konnte nicht begonnen werden."
     },
     "checks": {
       "backup": {
@@ -5285,7 +5291,7 @@
             "uncovered": "{count} von {total} Gästen werden von keinem aktivierten Sicherungsauftrag ausgewählt",
             "excludedData": "{count} Datenträger- oder Mountpoint-Ausschlüsse prüfen",
             "uncoveredExpected": "{required} Gäste, für die eine Sicherung erklärt wurde, wählt kein aktivierter Auftrag aus",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           },
           "nextStep": {
             "noJobs": "Erstellen Sie einen Backup-Job auf diesem Knoten und wählen Sie die Gäste mit Daten aus, die Sie nicht von Hand neu erstellen möchten. Ein Job, der existiert, aber deaktiviert ist, wählt nichts aus.",
@@ -5300,10 +5306,10 @@
           "rationale": "Alter: vergangene Zeit seit der letzten gespeicherten Sicherung. Verwendeter Grenzwert: das Referenzalter, mit dem diese Sicherung verglichen wird.",
           "summary": {
             "recent": "Alle {total} Gast-/Zielprüfungen erfüllen die angegebene Altersrichtlinie",
-            "stale": "{count} of {total} guests have no backup from the last 30 days",
-            "noBackups": "No stored backup matches a guest on this node",
             "attention": "{count} von {total} Gast-/Zielprüfungen erfordern eine Überprüfung",
-            "evaluationFailed": "The check could not be evaluated"
+            "stale": "{count} von {total}-Gästen haben kein Backup der letzten 30 Tage",
+            "noBackups": "Kein gespeichertes Backup passt zu einem Gast auf diesem Knoten",
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           },
           "nextStep": {
             "stale": "Finden Sie heraus, warum der Job aufhörte, Kopien für diese Gäste zu produzieren: Möglicherweise wurde er deaktiviert, sein Zeitplan wird möglicherweise nie ausgelöst oder seine Läufe können fehlschlagen. Der Run Results Check berichtet, wie jeder Job zuletzt beendet wurde.",
@@ -5317,10 +5323,10 @@
           "rationale": "Die Aufbewahrung, wie Proxmox sie auflöst: Einstellung des Auftrags, dann des Speichers, dann der Knotenstandard. Aufbewahrung, die ein Sicherungsserver anwendet, ist von diesem Knoten aus nicht lesbar.",
           "summary": {
             "allDefined": "Alle {total} Aufträge lösen eine Aufbewahrungseinstellung auf",
-            "missing": "{count} of {total} enabled job(s) declare no retention",
             "notDeclared": "{count} von {total} Aufträgen behalten jede Kopie: für sie ist keine Aufbewahrung erklärt",
             "onServer": "{count} von {total} Aufträgen schreiben auf einen Sicherungsserver, der sie mit eigenen Aufträgen bereinigt",
-            "evaluationFailed": "The check could not be evaluated"
+            "missing": "{count} von {total}-fähigen Job(s) erklären keine Aufbewahrung",
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           },
           "nextStep": {
             "missing": "Legen Sie eine Aufbewahrung für diese Jobs oder für den Speicher fest, an den sie schreiben. Proxmox nimmt zuerst die Einstellung des Jobs, dann den Speicher und dann den Node Default an.",
@@ -5383,36 +5389,36 @@
           "summary": {
             "none": "Nichts hat einen Neustart angefordert",
             "pending": "{count} Elemente sind installiert und warten auf einen Neustart",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         },
         "enterprise_repo_without_subscription": {
           "title": "Enterprise repository",
           "rationale": "Verweise auf `enterprise.proxmox.com` in `/etc/apt/sources.list` und `sources.list.d`, gegenüber dem Status aus `pvesubscription get`.",
           "summary": {
-            "notEnabled": "The enterprise repository is not enabled",
-            "subscribed": "The enterprise repository is backed by a subscription",
-            "unsubscribed": "The enterprise repository is enabled without an active subscription",
-            "evaluationFailed": "The check could not be evaluated"
+            "notEnabled": "Das Enterprise Repository ist nicht aktiviert",
+            "subscribed": "Das Enterprise-Repository wird durch ein Abonnement gesichert",
+            "unsubscribed": "Das Enterprise-Repository ist ohne aktives Abonnement aktiviert",
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         },
         "memory_overcommit": {
           "title": "Memory allocation",
           "rationale": "Die `memory`-Obergrenze jeder Gastkonfiguration gegenüber MemTotal, laufende Gäste getrennt gezählt. Container verbrauchen bis zu dieser Grenze; virtuelle Maschinen ohne Ballooning reservieren sie.",
           "summary": {
-            "withinRatio": "Guests are allocated {percent}% of host memory",
-            "aboveRatio": "Guests are allocated {percent}% of host memory",
-            "evaluationFailed": "The check could not be evaluated"
+            "withinRatio": "Gäste erhalten {percent}% des Host-Speichers",
+            "aboveRatio": "Gäste erhalten {percent}% des Host-Speichers",
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         },
         "time_synchronisation": {
           "title": "Time synchronisation",
           "rationale": "NTP und NTPSynchronized, wie `timedatectl` sie meldet. Clusterzugehörigkeit, Zertifikatsprüfung und Protokollreihenfolge hängen von übereinstimmenden Uhren ab. Ein anderer Mechanismus kann die Uhr führen.",
           "summary": {
-            "synchronised": "The clock is synchronised with a time source",
             "disabled": "Time synchronisation is disabled",
-            "notSynchronised": "Time synchronisation is enabled but the clock is not synchronised",
-            "evaluationFailed": "The check could not be evaluated"
+            "synchronised": "Die Uhr wird mit einer Zeitquelle synchronisiert",
+            "notSynchronised": "Zeitsynchronisation ist aktiviert, aber die Uhr ist nicht synchronisiert",
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         },
         "kernel_current": {
@@ -5420,21 +5426,21 @@
           "rationale": "Der laufende Kernel gegenüber dem, den der Host als Nächstes starten würde, wie `proxmox-boot-tool` ihn meldet. Ein lediglich installierter neuerer Kernel kann bewusst zurückgehalten sein; ein Unterschied nach einem Neustart bedeutet einen Start, der nicht griff.",
           "summary": {
             "current": "Der laufende Kernel {version} ist der, den der Host als Nächstes starten würde",
-            "newerAvailable": "The host runs {running} while {newest} is installed",
             "newerSelected": "Der Host führt {running} aus und würde beim nächsten Neustart {selected} starten",
             "wouldDowngrade": "Der Host führt {running} aus, würde beim nächsten Neustart aber das ältere {selected} starten",
             "bootTargetUnknown": "Der Host führt {version} aus; der für den nächsten Start gewählte Kernel war nicht lesbar",
-            "evaluationFailed": "The check could not be evaluated"
+            "newerAvailable": "Der Host führt {running} aus, während {newest} installiert ist",
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         },
         "security_updates": {
           "title": "Security updates",
           "rationale": "Ausstehende Pakete, deren Quelle ein Sicherheits-Repository ist, aus einem simulierten `apt-get upgrade`. Die Zahl gibt wieder, was apt meldet, nicht die Schwere dessen, was jedes Paket behebt.",
           "summary": {
-            "none": "No package updates are pending",
-            "noSecurity": "{total} update(s) pending, none from a security repository",
-            "pending": "{count} of {total} pending update(s) come from a security repository",
-            "evaluationFailed": "The check could not be evaluated"
+            "none": "Keine Paket-Updates stehen aus",
+            "noSecurity": "{total}-Update(s) ausstehend, keine aus einem Sicherheitsrepository",
+            "pending": "{count} von {total} ausstehende Updates stammen aus einem Sicherheitsrepository",
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         },
         "journal_size": {
@@ -5442,10 +5448,10 @@
           "rationale": "Das Journal auf der Platte gegenüber der für es geltenden Obergrenze: SystemMaxUse, sofern gesetzt, sonst der journald-Standard von einem Zehntel des Dateisystems, auf dem es liegt.",
           "summary": {
             "bounded": "Das Journal belegt {size} und bleibt unter seiner wirksamen Obergrenze",
-            "large": "The journal holds {size} on disk",
             "nearCap": "Das Journal belegt {size} und liegt bei {percent}% seiner wirksamen Obergrenze",
             "capUnknown": "Das Journal belegt {size}; die wirksame Obergrenze war nicht zu ermitteln",
-            "evaluationFailed": "The check could not be evaluated"
+            "large": "Das Journal hält {size} auf der Festplatte",
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         },
         "swap_configured": {
@@ -5454,7 +5460,7 @@
           "summary": {
             "active": "{size} of swap is active",
             "none": "No swap area is active",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         },
         "filesystem_capacity": {
@@ -5500,7 +5506,7 @@
           "summary": {
             "synchronised": "Die {total} Bootpartitionen tragen dieselben Kernel",
             "attention": "{count} von {total} Bootpartitionen bedürfen der Prüfung",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           },
           "rationale": "Die EFI-Systempartitionen proxmox-boot-tool-Berichte und die Kernel, die jeder trägt. proxmox-boot-tool-Status kann EFI-Systempartitionen vorübergehend bereitstellen; Es wird kein Bootversuch unternommen."
         },
@@ -5510,7 +5516,7 @@
           "summary": {
             "allRunning": "Die {total} wesentlichen Dienste sind aktiv und keine Unit ist fehlgeschlagen",
             "attention": "{count} Feststellung(en) unter den Units",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         },
         "ha_state": {
@@ -5519,7 +5525,7 @@
           "summary": {
             "managed": "Die {total} verwalteten Dienste sind auf {nodes} Knoten in einem gesetzten Zustand",
             "attention": "{count} Feststellung(en) zu {total} verwalteten Diensten",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         }
       },
@@ -5528,27 +5534,27 @@
           "title": "Container privileges",
           "rationale": "Die Einstellung `unprivileged` jeder Containerkonfiguration. Ihr Fehlen bedeutet, dass der Container den Benutzernamensraum des Hosts teilt, was manche Arbeitslasten benötigen.",
           "summary": {
-            "allUnprivileged": "All {total} containers are unprivileged",
             "privileged": "{count} of {total} containers run privileged",
-            "evaluationFailed": "The check could not be evaluated"
+            "allUnprivileged": "Alle {total} Container sind unprivilegiert",
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         },
         "qemu_without_agent": {
-          "title": "Guest agent on virtual machines",
           "rationale": "Die Einstellung `agent` in jeder Konfiguration einer virtuellen Maschine. Die Einstellung besagt, dass der Agent deklariert ist, nicht dass er antwortet.",
           "summary": {
-            "allHaveAgent": "All {total} virtual machines declare the guest agent",
-            "missingAgent": "{count} of {total} virtual machines do not declare the guest agent",
-            "evaluationFailed": "The check could not be evaluated"
-          }
+            "allHaveAgent": "Alle virtuellen {total}-Maschinen erklären den Gastagenten",
+            "missingAgent": "{count} von virtuellen {total} Maschinen deklarieren nicht den Gastagenten",
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
+          },
+          "title": "Gastagent auf virtuellen Maschinen"
         },
         "autostart": {
           "title": "Automatic start",
           "rationale": "Die Einstellung `onboot` jedes Gastes, ohne Vorlagen und von HA verwaltete Gäste. Ob ein Gast von selbst zurückkehren soll, ergibt sich aus der erklärten Richtlinie.",
           "summary": {
-            "allAutostart": "All {total} guests start with the host",
-            "notAutostart": "{count} of {total} guests do not start with the host",
-            "evaluationFailed": "The check could not be evaluated"
+            "allAutostart": "Alle {total} Gäste beginnen mit dem Gastgeber",
+            "notAutostart": "{count} der {total} Gäste starten nicht mit dem Gastgeber",
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         },
         "stuck_snapshots": {
@@ -5556,28 +5562,28 @@
           "rationale": "Zustand und Alter der Snapshots sowie aktive Aufgaben. Ein kürzlicher oder undatierter Vorgang gilt nicht als unterbrochen.",
           "summary": {
             "noSnapshots": "No guest holds snapshots",
-            "allComplete": "The {total} snapshot(s) are complete",
-            "stuck": "{count} of {total} snapshot(s) were left mid-operation",
-            "evaluationFailed": "The check could not be evaluated"
+            "allComplete": "Die {total} Snapshots sind vollständig",
+            "stuck": "{count} von {total} Snapshot(s) wurden mitten in Betrieb gelassen",
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         },
         "cpu_host_type": {
           "title": "Virtual CPU model",
           "rationale": "Der Wert `cpu` jeder virtuellen Maschine. `host` gibt den Funktionsumfang des physischen Prozessors weiter, was die Knoten einschränkt, auf die der Gast migrieren kann. Unverträglichkeit mit einem bestimmten Ziel wird hier nicht ermittelt.",
           "summary": {
-            "none": "None of the {total} virtual machines is pinned to the host processor",
-            "pinned": "{count} of {total} virtual machines are pinned to the host processor",
-            "evaluationFailed": "The check could not be evaluated"
+            "none": "Keine der virtuellen {total}-Maschinen ist an den Host-Prozessor gebunden",
+            "pinned": "{count} von virtuellen {total}-Maschinen werden an den Host-Prozessor angeheftet",
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         },
         "replication_state": {
           "title": "Replication",
           "rationale": "Replikationsaufträge aus der API: Fehlerzahl, letzter Fehler, letzte Synchronisierung und der Kalender, den jeder Auftrag angibt. Pausierte Aufträge werden als solche ausgewiesen.",
           "summary": {
-            "healthy": "The {total} replication job(s) report no error",
-            "failing": "{count} of {total} replication job(s) report an error",
-            "statusUnavailable": "Replication jobs are defined but their status could not be read",
-            "evaluationFailed": "The check could not be evaluated"
+            "healthy": "Die {total} Replikationsjob(s) melden keinen Fehler",
+            "failing": "{count} von {total} Replikationsjob(s) melden einen Fehler",
+            "statusUnavailable": "Replikationsjobs sind definiert, aber ihr Status konnte nicht gelesen werden",
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         }
       },
@@ -5589,39 +5595,39 @@
             "bothEnabled": "Die Firewall-Aktivierung ist auf Datacenter- und Knotenebene konfiguriert",
             "datacenterOff": "Die Firewall ist auf Datacenter-Ebene deaktiviert; Knotenregeln werden daher nicht angewendet",
             "nodeOff": "Die Firewall ist auf Datacenter-Ebene aktiviert, aber nicht auf diesem Knoten",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         },
         "lynis_warnings": {
           "title": "Lynis warnings",
           "rationale": "Warnungen der letzten Lynis-Prüfung, jeweils mit Test-Kennung, und das Alter dieser Prüfung. Eine Prüfung läuft nur, wenn Lynis installiert ist und kein vollständiger Bericht vorliegt. Vorschläge sind nicht enthalten.",
           "summary": {
-            "none": "The last Lynis audit recorded no warnings",
-            "found": "The last Lynis audit recorded {count} warning(s)",
-            "incomplete": "The Lynis report is incomplete",
-            "evaluationFailed": "The check could not be evaluated",
             "noneStale": "Die letzte Lynis-Prüfung verzeichnete keine Warnungen, und ihr Bericht ist {days} Tag(e) alt",
-            "foundStale": "Die letzte Lynis-Prüfung verzeichnete {count} Warnung(en), und ihr Bericht ist {days} Tag(e) alt"
+            "foundStale": "Die letzte Lynis-Prüfung verzeichnete {count} Warnung(en), und ihr Bericht ist {days} Tag(e) alt",
+            "none": "Das letzte Lynis-Audit verzeichnete keine Warnungen",
+            "found": "Das letzte Lynis-Audit hat {count}-Warnungen aufgezeichnet",
+            "incomplete": "Der Bericht Lynis ist unvollständig",
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         },
         "certificate_expiry": {
           "title": "Certificate validity",
           "rationale": "Das Ablaufdatum des Zertifikats, das pveproxy aus /etc/pve/local ausliefert. Ein eigenes Zertifikat hat Vorrang vor dem von Proxmox erzeugten.",
           "summary": {
-            "valid": "The certificate is valid for {days} more day(s)",
-            "expiring": "The certificate expires in {days} day(s)",
-            "expired": "The certificate expired {days} day(s) ago",
-            "evaluationFailed": "The check could not be evaluated"
+            "valid": "Das Zertifikat gilt für {days} weitere Tage",
+            "expiring": "Das Zertifikat läuft in {days} Tagen ab",
+            "expired": "Das Zertifikat ist vor {days} Tagen abgelaufen",
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         },
         "ssh_root_login": {
           "title": "SSH root access",
           "rationale": "PermitRootLogin in der effektiven `sshd -T`-Konfiguration samt den kombinierten Authentifizierungsmethoden. Proxmox liefert `yes` aus, was ein Passwort zulässt.",
           "summary": {
-            "password": "Root may sign in over SSH with a password",
-            "keyOnly": "Root may sign in over SSH with a key only",
-            "denied": "Root may not sign in over SSH",
-            "evaluationFailed": "The check could not be evaluated"
+            "password": "Root kann sich über SSH mit einem Passwort anmelden",
+            "keyOnly": "Root kann sich über SSH nur mit einem Schlüssel anmelden",
+            "denied": "Root kann sich nicht über SSH anmelden",
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         }
       },
@@ -5630,9 +5636,9 @@
           "title": "Volume assignment",
           "rationale": "Gastvolumes auf lokalem Speicher gegenüber den Verweisen in aktuellen, ausstehenden und Snapshot-Konfigurationen. Sicherungen, ISOs und Vorlagen bleiben außerhalb des Vergleichs. Ein Volume ohne Verweis ist ein Kandidat zur Prüfung.",
           "summary": {
-            "none": "No orphaned volumes were found",
             "found": "{count} Volumes ohne Verweis in den geprüften Konfigurationen",
-            "evaluationFailed": "The check could not be evaluated"
+            "none": "Es wurden keine verwaisten Volumen gefunden",
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         },
         "zfs_arc_max": {
@@ -5640,21 +5646,21 @@
           "rationale": "Effektive Werte von c_min, c_max und ARC-Größe, der geladene Modulparameter und die persistenten Einstellungen in /etc/modprobe.d. Ein konfigurierter Wert von null wählt den Modulstandard; der ARC ist eine Obergrenze, und der belegte Speicher ist rückgewinnbar.",
           "summary": {
             "bounded": "Die ARC-Grenze liegt bei {percent}% des Hostspeichers, und der belegte Speicher ist rückgewinnbar",
-            "high": "The ARC may use {percent}% of host memory",
-            "unset": "The ARC has no explicit limit set",
             "conflicting": "{count} ARC-Einstellungen widersprechen einander",
             "pending": "Eine persistente ARC-Einstellung weicht vom Wert des laufenden Moduls ab",
-            "evaluationFailed": "The check could not be evaluated"
+            "high": "Der ARC kann {percent}% des Hostspeichers verwenden",
+            "unset": "Der ARC hat kein explizites Limit",
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         },
         "zfs_scrub_age": {
           "title": "ZFS scrub",
           "rationale": "Der letzte abgeschlossene Scrub, den `zpool status` je Pool meldet. Ein Resilver ist kein Scrub. Ein kürzlich erstellter Pool hatte noch keine Gelegenheit dazu.",
           "summary": {
-            "recent": "The {total} pool(s) were scrubbed within the last 35 days",
-            "overdue": "{count} of {total} pool(s) have not been scrubbed in 35 days",
             "neverScrubbed": "{count} pool(s) record no scrub",
-            "evaluationFailed": "The check could not be evaluated"
+            "recent": "Die {total}-Pools wurden innerhalb der letzten 35 Tage gewaschen",
+            "overdue": "{count} von {total} Pool(s) wurden in 35 Tagen nicht geschrubbt",
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         },
         "thin_pool_overprovisioning": {
@@ -5664,7 +5670,7 @@
             "withinRatio": "Die {total} Thin-Pools liegen unter den angewendeten Prüfgrenzen",
             "aboveRatio": "{count} von {total} Thin-Pools vergeben mehr Kapazität, als sie besitzen",
             "pressure": "{pressure} von {total} Thin-Pools füllen ihre Daten oder Metadaten fast aus",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         },
         "connected_storage": {
@@ -5673,7 +5679,7 @@
           "summary": {
             "available": "PVE meldet alle {total} Speicher als verfügbar; interne Remote-Komponenten und Schreibzugriff wurden nicht geprüft",
             "attention": "{count} von {total} Speichern müssen geprüft werden",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         },
         "pool_integrity": {
@@ -5691,7 +5697,7 @@
           "summary": {
             "healthy": "Ceph meldet HEALTH_OK",
             "degraded": "Ceph meldet {state}, mit {count} benannten Prüfung(en)",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         },
         "array_integrity": {
@@ -5700,7 +5706,7 @@
           "summary": {
             "intact": "Die {total} Arrays und Maps halten ihre Redundanz",
             "degraded": "{count} von {total} Arrays oder Maps fehlt sie",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         }
       },
@@ -5712,7 +5718,7 @@
             "withinLife": "Die {total} Datenträgermessungen liegen unter der Fünfjahresschwelle",
             "pastLife": "{count} von {total} Datenträgermessungen liegen über fünf Betriebsjahren",
             "noReadings": "Keine Festplatte meldet verwertbare SMART-Werte ({skipped} ohne Messwerte)",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         },
         "disk_errors": {
@@ -5729,23 +5735,22 @@
           "title": "Bond members",
           "rationale": "Der MII-Status jedes Bond-Mitglieds aus /proc/net/bonding und wie viele Verbindungen bleiben. In active-backup meldet sich ein Reservemitglied als aktiv und überträgt nichts.",
           "summary": {
-            "allUp": "All members of the {total} bond(s) are up",
-            "membersDown": "{count} bond member(s) are not up",
-            "evaluationFailed": "The check could not be evaluated"
+            "allUp": "Alle Mitglieder der {total} Bond (s) sind up",
+            "membersDown": "{count} Bond Mitglied (s) sind nicht oben",
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         },
         "bridge_without_ports": {
           "title": "Bridge ports",
           "rationale": "Die Portkonfiguration jeder Bridge. Eine Bridge ohne physischen Port bedient ein internes oder geroutetes Netz.",
           "summary": {
-            "allConnected": "The {total} bridge(s) carry a port",
             "isolated": "{count} of {total} bridge(s) carry no port",
-            "evaluationFailed": "The check could not be evaluated"
+            "allConnected": "Die {total} Bridge(s) tragen einen Port",
+            "evaluationFailed": "Die Überprüfung konnte nicht ausgewertet werden"
           }
         }
       }
     },
-    "summaryFallback": "The check could not be evaluated",
     "acceptRisk": {
       "action": "Risiko akzeptieren",
       "revoke": "Wieder aktivieren",
@@ -5779,17 +5784,15 @@
       "OK": "OK"
     },
     "viewSwitch": {
-      "ariaLabel": "Switch between assessment and inventory",
       "assessment": "Assessment",
       "inventory": "Inventory",
       "policy": "Richtlinie",
-      "changes": "Änderungen"
+      "changes": "Änderungen",
+      "ariaLabel": "Wechsel zwischen Assessment und Inventar"
     },
     "inventory": {
       "loading": "Loading inventory…",
-      "failed": "The inventory could not be composed.",
       "collectedAt": "Composed on {when}",
-      "unavailable": "Not read in this inventory",
       "unresolved": "path not resolved",
       "noUplink": "no uplink",
       "identity": "Node identity",
@@ -5832,12 +5835,10 @@
       "protection": "Backup",
       "passthrough": "Passthrough",
       "noBackup": "No backup",
-      "noBackupDetail": "No enabled backup job selects this guest.",
       "applications": "Applications",
       "versionUnknown": "version not detected",
       "passthroughTitle": "PCI passthrough",
       "iommuGroup": "IOMMU group {group}",
-      "sharedGroup": "{count} more device(s) in the same group",
       "proxmenux": "ProxMenux optimizations",
       "latency": "Netzwerklatenz",
       "subscriptionStatus": {
@@ -5848,7 +5849,11 @@
         "suspended": "Ausgesetzt",
         "new": "Aktivierung ausstehend",
         "unknown": "Unbekannt"
-      }
+      },
+      "failed": "Das Inventar konnte nicht zusammengestellt werden.",
+      "unavailable": "Nicht in diesem Inventar lesen",
+      "noBackupDetail": "Kein aktivierter Backup-Job wählt diesen Gast aus.",
+      "sharedGroup": "{count} weitere Geräte in derselben Gruppe"
     },
     "profile": {
       "label": "Report",
@@ -5871,7 +5876,6 @@
       "area": "Area",
       "inventoryAnnex": "Inventory annex",
       "scopeTitle": "Scope of this report",
-      "scopeBody": "This report describes the Proxmox VE node named above, as observed from the node itself at the time stated. It does not cover the interior of the guests beyond what they declare, network equipment outside the host, physical infrastructure, or any dependency not visible from this node. Findings marked as not determined were not measured and are not evidence of absence.",
       "building": "Bericht wird zusammengestellt…",
       "node": "Knoten",
       "profile": "Profil",
@@ -6020,11 +6024,12 @@
       "structureSubtitle": "Wie {node} aufgebaut und konfiguriert ist",
       "postureTitle": "Posture",
       "posture": {
-        "security": "Host exposure and access.",
-        "backup": "Guest protection and whether it is real.",
-        "capacity": "Room to grow and the wear on the disks."
+        "security": "Host Exposition und Zugang.",
+        "backup": "Gästeschutz und ob es real ist.",
+        "capacity": "Raum zum Wachsen und der Verschleiß an den Scheiben."
       },
-      "scopeReadOnly": "Die Bewertung überprüft die Hosteinstellungen und den Zustand. Es kann Berichte und Protokolle schreiben; Boot-Statusprüfungen können EFI-Systempartitionen vorübergehend bereitstellen."
+      "scopeReadOnly": "Die Bewertung überprüft die Hosteinstellungen und den Zustand. Es kann Berichte und Protokolle schreiben; Boot-Statusprüfungen können EFI-Systempartitionen vorübergehend bereitstellen.",
+      "scopeBody": "Dieser Bericht beschreibt den oben genannten Proxmox VE-Knoten, wie er vom Knoten selbst zum angegebenen Zeitpunkt beobachtet wurde. Es umfasst nicht das Innere der Gäste über das hinaus, was sie deklarieren, Netzwerkausrüstung außerhalb des Hosts, physische Infrastruktur oder jede Abhängigkeit, die von diesem Knoten nicht sichtbar ist. Befunde, die als nicht bestimmt markiert wurden, wurden nicht gemessen und sind kein Hinweis auf Abwesenheit."
     },
     "results": "Ergebnisse",
     "classifications": {
@@ -6178,15 +6183,19 @@
     "notApplicableScope": "Im geprüften Umfang gibt es nichts, worauf diese Prüfung zutrifft.",
     "lynis": {
       "title": "Run Lynis",
-      "bodyNotRun": "Lynis is installed but has not been run yet. Running it now completes the security review, but the process can take a few minutes.",
-      "bodyStale": "The Lynis report is {days} days old. You can run it now to refresh the data (it takes a little longer) or continue with the existing report.",
       "withLynis": "Run with Lynis",
       "withoutLynis": "Run without Lynis",
-      "cancel": "Cancel"
+      "cancel": "Cancel",
+      "bodyNotRun": "Lynis ist installiert, wurde aber noch nicht ausgeführt. Die Ausführung vervollständigt nun die Sicherheitsüberprüfung, aber der Prozess kann einige Minuten dauern.",
+      "bodyStale": "Der Lynis-Bericht ist {days} Tage alt. Sie können es jetzt ausführen, um die Daten zu aktualisieren (es dauert etwas länger) oder mit dem vorhandenen Bericht fortzufahren."
     },
     "readOnlyNotice": "Die Bewertung überprüft die Hosteinstellungen und den Zustand. Es kann Berichte und Protokolle schreiben; Boot-Statusprüfungen können EFI-Systempartitionen vorübergehend bereitstellen.",
     "noActionNeeded": "Nichts zu tun. Dieser Check hat herausgefunden, was er erwartet.",
-    "couldNotEvaluate": "Diese Überprüfung konnte nicht ausgewertet werden, so dass sie nichts meldet. Die Beweise dokumentieren, was sie nicht lesen konnten."
+    "couldNotEvaluate": "Diese Überprüfung konnte nicht ausgewertet werden, so dass sie nichts meldet. Die Beweise dokumentieren, was sie nicht lesen konnten.",
+    "neverRun": "Dieser Gastgeber wurde noch nicht bewertet.",
+    "noFindings": "Keine Ergebnisse stimmen mit dem aktuellen Filter überein.",
+    "acceptedNotice": "{count} akzeptierte Risiken, die auf diesem Host aufgezeichnet wurden.",
+    "summaryFallback": "Die Überprüfung konnte nicht ausgewertet werden"
   },
   "runtime": {
     "notifications": {
diff --git a/AppImage/messages/en/common.json b/AppImage/messages/en/common.json
index bd0a8ebd..16de1a2f 100644
--- a/AppImage/messages/en/common.json
+++ b/AppImage/messages/en/common.json
@@ -1090,7 +1090,8 @@
       "backups": "Backups",
       "updates": "Updates",
       "firewall": "Firewall",
-      "app": "App"
+      "app": "App",
+      "logs": "Logs"
     },
     "actions": {
       "start": "Start",
@@ -1190,6 +1191,44 @@
       "empty": "No firewall events recorded yet.",
       "emptyHint": "Rules with log: info or higher will populate this view as packets arrive."
     },
+    "consoleLog": {
+      "title": "Console output",
+      "description": "Standard output and error of the image's main process.",
+      "stopped": "The container is stopped; the log keeps the output of its previous runs.",
+      "lastLines": "Last {count} lines",
+      "follow": "Follow",
+      "pause": "Pause",
+      "refresh": "Refresh",
+      "download": "Download",
+      "filter": "Filter lines",
+      "loading": "Loading console output...",
+      "empty": "No output recorded yet.",
+      "emptyHint": "Lines appear here as the container writes to its console.",
+      "noMatches": "No lines match the filter.",
+      "readFailed": "Failed to read the console log",
+      "notAvailableTitle": "This container has no console log",
+      "notAvailableHint": "The console log is set up when ProxMenux installs the container from its OCI image."
+    },
+    "ociUpdates": {
+      "notTracked": "Registering the application in the App tab follows its image here.",
+      "installedImage": "Installed image",
+      "newImage": "New image {image} available",
+      "stackNote": "Part of a multi-container application (main CT {primary}, {count} containers): the update covers all of them.",
+      "pendingNote": "An operation on this container was interrupted; Recover opens its recovery.",
+      "update": "Update",
+      "recreate": "Recreate",
+      "recover": "Recover",
+      "terminalTitleUpdate": "Update OCI application",
+      "terminalTitleRecreate": "Recreate OCI application",
+      "terminalDescription": "The same flow as OCI manager Apps → Manage installed OCI applications.",
+      "keepBackup": "Keep the backup taken before updating",
+      "noKeepBackup": "The backup taken before updating is not kept",
+      "keepBackupHelp": "Every update backs up the container before replacing its image, to restore it if the update fails. With this option that backup is kept in the chosen storage; on Proxmox Backup Server a backup is written before the update.",
+      "scheduleHelp": "Only the image is updated, and only when its registry publishes a new one.",
+      "releaseDelayHelp": "A new image is installed only once it is at least this old.",
+      "ackExternal": "Host directories are not reverted by the backup",
+      "ackExternalHelp": "This container uses host directories. A scheduled update runs only with this confirmed."
+    },
     "options": {
       "title": "Options",
       "snapshotBefore": "Snapshot before applying",
@@ -1393,7 +1432,7 @@
       "otherPackagesPending": "+{count} other packages pending in the container",
       "noManagedUpdateInfo": "No update information yet — check from Security → Secure Gateway.",
       "ociTitle": "OCI image container",
-      "ociBody": "This container was created from an OCI (Docker) image. Update management for OCI containers is coming with the upcoming OCI install feature — updates will rebuild the container from a newer image tag rather than patching packages inside.",
+      "ociBody": "This container was created from an OCI image outside OCI manager Apps. It is updated by replacing its image, which ProxMenux does not manage for it.",
       "dockerImagesTitle": "Docker images",
       "dockerAppTitle": "Docker",
       "dockerImagesSubheading": "Images",
@@ -1652,7 +1691,15 @@
       "notifyUpstreamLabel": "Notify me when a new upstream version is available",
       "notifyUpstreamHelp": "Sends `app_update_available` to the channels enabled in Settings → Notifications. Turn off if this app can't be updated on your box.",
       "excludeFromBadgeLabel": "Exclude from the LXC updates counter",
-      "excludeFromBadgeHelp": "Don't count this app in the aggregate updates badge on the LXC list card. Useful when you're pinned to a specific version on purpose (tracker requirement, compatibility freeze). Doesn't affect the App tab's own state or the outbound notification."
+      "excludeFromBadgeHelp": "Don't count this app in the aggregate updates badge on the LXC list card. Useful when you're pinned to a specific version on purpose (tracker requirement, compatibility freeze). Doesn't affect the App tab's own state or the outbound notification.",
+      "methodOciImage": "OCI image (installed by ProxMenux)",
+      "ociImageHelp": "The version and its updates are read from the image this container was created from. ProxMenux installed it, so there is nothing to configure: the installed image is compared with the one its registry publishes today.",
+      "ociAppVersion": "Application",
+      "ociImage": "Image",
+      "ociNewImage": "New image",
+      "ociImageCurrent": "Version",
+      "refreshData": "Refresh data",
+      "refreshingData": "Refreshing…"
     }
   },
   "settings": {
@@ -3320,7 +3367,14 @@
       "auditReports": "Reports — a full audit plus focused Security review, Backup assurance and Capacity & wear reports, each opening on its own posture header, and a printable Inventory; all export to PDF. A security assessment asks before running Lynis so a run stays fast.",
       "auditPolicyBaseline": "Policy and baseline — declare what the host is expected to be (backup requirements, firewall, root SSH login) so findings grade against it, mark a run as the reference, and see what changed since, with new, resolved and accepted findings kept apart.",
       "groupedAppUpdates": "Grouped application update notifications — one complete message per scan instead of one per application, grouped by LXC with the installed and available versions.",
-      "adminTokenScope": "Administrative scope — opening a Monitor terminal and disabling authentication now require a full-admin token, so a read-only API token issued to a monitoring integration stays read-only (reported by @f3rs3n)."
+      "adminTokenScope": "Administrative scope — opening a Monitor terminal and disabling authentication now require a full-admin token, so a read-only API token issued to a monitoring integration stays read-only (reported by @f3rs3n).",
+      "ociAppTab": "OCI containers in the App tab — a container installed by OCI manager Apps is recognised from its installation record: the application and its image, a new image detected by digest, and a link to the image repository.",
+      "ociUpdatesTab": "Updates for OCI containers — Update and Recreate open the same flow as the OCI menu, the backup taken before updating can be kept in a backup storage, and the image can be updated on a schedule.",
+      "ociLogsTab": "Logs tab for OCI containers — the console output of the application, kept on the host and followed live, with a filter and a download. The Proxmox console of these containers opens a shell.",
+      "appsUpdateShortcut": "The update icon on the Apps page opens the container straight on its Updates tab.",
+      "webhookHttps": "Proxmox notifications reach the Monitor with HTTPS enabled — they are delivered on a local-only address and no longer fail with a certificate error.",
+      "persistentLogs": "A burst of log errors that ended is no longer reported as persistent: a pattern has to keep appearing for 15 minutes, and its warning clears on its own (reported by @Joshua1264).",
+      "mountsLanAddress": "Mount points on LVM-thin and other block storage show their usage, and multi-container applications open at their LAN address."
     }
   },
   "network": {
@@ -5034,6 +5088,8 @@
     "customLinkNewTitle": "New web link",
     "customLinkEditTitle": "Edit web link",
     "customLinkEditAria": "Edit custom link {name}",
+    "openUpdatesAria": "Open the Updates tab of {name}",
+    "openUpdatesTitle": "Update available — open the Updates tab",
     "customLinkName": "Name",
     "customLinkNamePlaceholder": "e.g. My app",
     "customLinkUrl": "URL",
diff --git a/AppImage/messages/es/common.json b/AppImage/messages/es/common.json
index 634ff8d1..0f221010 100644
--- a/AppImage/messages/es/common.json
+++ b/AppImage/messages/es/common.json
@@ -377,7 +377,7 @@
       "criticalStatus": "Crítico: requiere atención inmediata",
       "warningStatus": "Advertencia: debe ser monitoreado",
       "moreIssues": "...y {count} problemas más (ver detalles a continuación)",
-      "dismissed": "Despedido",
+      "dismissed": "Descartado",
       "occurrences": "Ocurrencias",
       "errorSignature": "Firma de error",
       "rawMessage": "Mensaje sin procesar",
@@ -1066,10 +1066,11 @@
     "tabs": {
       "status": "Estado",
       "mounts": "Montajes",
-      "backups": "Copias",
+      "backups": "Backups",
       "updates": "Actualiz.",
       "firewall": "Cortafuegos",
-      "app": "App"
+      "app": "App",
+      "logs": "Logs"
     },
     "actions": {
       "start": "Iniciar",
@@ -1087,9 +1088,9 @@
       "guest": "Invitado:"
     },
     "guestTypes": {
-      "container": "recipiente",
+      "container": "contenedor",
       "vm": "VM",
-      "containerUi": "Recipiente"
+      "containerUi": "Contenedor"
     },
     "backups": {
       "title": "Copias de seguridad",
@@ -1146,7 +1147,7 @@
       "variables": "Variables: {{cluster}}, {{guestname}}, {{node}}, {{vmid}}",
       "creating": "Creando...",
       "submit": "Backup",
-      "typeContainer": "recipiente",
+      "typeContainer": "contenedor",
       "typeVirtualMachine": "máquina virtual",
       "modes": {
         "snapshot": "Instantánea",
@@ -1169,16 +1170,54 @@
       "empty": "Aún no se han registrado eventos del cortafuegos.",
       "emptyHint": "Las reglas con log: info o superior completarán esta vista a medida que lleguen los paquetes."
     },
+    "consoleLog": {
+      "title": "Salida de consola",
+      "description": "Salida estándar y de errores del proceso principal de la imagen.",
+      "stopped": "El contenedor está detenido; el log conserva la salida de sus ejecuciones anteriores.",
+      "lastLines": "Últimas {count} líneas",
+      "follow": "Seguir",
+      "pause": "Pausar",
+      "refresh": "Actualizar",
+      "download": "Descargar",
+      "filter": "Filtrar líneas",
+      "loading": "Cargando la salida de consola...",
+      "empty": "Todavía no hay salida registrada.",
+      "emptyHint": "Las líneas aparecen aquí a medida que el contenedor escribe en su consola.",
+      "noMatches": "Ninguna línea coincide con el filtro.",
+      "readFailed": "No se pudo leer el log de consola",
+      "notAvailableTitle": "Este contenedor no tiene log de consola",
+      "notAvailableHint": "El log de consola se configura cuando ProxMenux instala el contenedor desde su imagen OCI."
+    },
+    "ociUpdates": {
+      "notTracked": "Al registrar la aplicación en la pestaña App, aquí se sigue su imagen.",
+      "installedImage": "Imagen instalada",
+      "newImage": "Nueva imagen {image} disponible",
+      "stackNote": "Forma parte de una aplicación multicontenedor (CT principal {primary}, {count} contenedores): la actualización los abarca a todos.",
+      "pendingNote": "Una operación sobre este contenedor quedó interrumpida; Recuperar abre su recuperación.",
+      "update": "Actualizar",
+      "recreate": "Recrear",
+      "recover": "Recuperar",
+      "terminalTitleUpdate": "Actualizar aplicación OCI",
+      "terminalTitleRecreate": "Recrear aplicación OCI",
+      "terminalDescription": "El mismo recorrido que OCI manager Apps → Gestionar aplicaciones OCI instaladas.",
+      "keepBackup": "Conservar el backup previo a la actualización",
+      "noKeepBackup": "El backup previo a la actualización no se conserva",
+      "keepBackupHelp": "Cada actualización hace un backup del contenedor antes de sustituir su imagen, para restaurarlo si la actualización falla. Con esta opción ese backup se conserva en el almacenamiento elegido; en Proxmox Backup Server se escribe un backup antes de actualizar.",
+      "scheduleHelp": "Solo se actualiza la imagen, y solo cuando su registro publica una nueva.",
+      "releaseDelayHelp": "Una imagen nueva solo se instala cuando tiene al menos esta antigüedad.",
+      "ackExternal": "Los directorios del host no se revierten con el backup",
+      "ackExternalHelp": "Este contenedor usa directorios del host. Una actualización programada solo se ejecuta con esto confirmado."
+    },
     "options": {
       "title": "Opciones",
-      "snapshotBefore": "Instantánea antes de aplicar",
-      "snapshotOn": "— el {storage}",
-      "noSnapshot": "Sin instantánea previa a la solicitud",
-      "restartAfter": "Reiniciar el contenedor después de aplicar.",
-      "noRestart": "Sin reinicio posterior a la aplicación",
+      "snapshotBefore": "Backup antes de aplicar",
+      "snapshotOn": "— en {storage}",
+      "noSnapshot": "Sin backup antes de aplicar",
+      "restartAfter": "Reiniciar el contenedor después de aplicar",
+      "noRestart": "Sin reinicio después de aplicar",
       "snapshotLabel": "Backup del contenedor antes de aplicar (vzdump)",
       "appliesToBoth": "Aplica para ejecuciones manuales + programadas.",
-      "backupStorage": "Almacenamiento de respaldo",
+      "backupStorage": "Almacenamiento de backups",
       "pickStorage": "Elige un almacenamiento",
       "editButton": "Editar",
       "cancelButton": "Cancelar",
@@ -1372,7 +1411,7 @@
       "otherPackagesPending": "+{count} otros paquetes pendientes en el contenedor",
       "noManagedUpdateInfo": "Aún no hay información de actualización: verifique desde Seguridad → Secure Gateway.",
       "ociTitle": "Contenedor de imágenes OCI",
-      "ociBody": "Este contenedor se creó a partir de una imagen OCI (Docker). La gestión de actualizaciones para contenedores OCI viene con la próxima función de instalación de OCI: las actualizaciones reconstruirán el contenedor a partir de una etiqueta de imagen más nueva en lugar de aplicar parches a los paquetes internos.",
+      "ociBody": "Este contenedor se creó desde una imagen OCI fuera de OCI manager Apps. Se actualiza sustituyendo su imagen, algo que ProxMenux no gestiona en este caso.",
       "dockerImagesTitle": "Imágenes Docker",
       "dockerAppTitle": "Docker",
       "dockerImagesSubheading": "Imágenes",
@@ -1487,7 +1526,6 @@
       "containerNameLabel": "Nombre del contenedor",
       "containerNamePlaceholder": "por ejemplo, <nombre-de-su-contenedor>",
       "ociLabelKeyLabel": "Clave de etiqueta OCI",
-      "ociLabelPlaceholder": "org.opencontainers.image.version",
       "pythonInterpreterLabel": "Ruta del intérprete de Python",
       "pythonInterpreterPlaceholder": "por ejemplo, /opt/<tu-aplicación>/venv/bin/python",
       "pipDistLabel": "Nombre de distribución (paquete pip)",
@@ -1631,7 +1669,16 @@
       "notifyUpstreamLabel": "Notificarme cuando haya una nueva versión disponible",
       "notifyUpstreamHelp": "Envía `app_update_available` a los canales activos en Ajustes → Notificaciones. Desactívalo si esta app no se puede actualizar en tu instalación.",
       "excludeFromBadgeLabel": "Excluir del contador de actualizaciones del LXC",
-      "excludeFromBadgeHelp": "No sumar esta app al contador agregado de actualizaciones del card del LXC. Útil cuando mantienes una versión concreta a propósito (requisito de tracker, compatibilidad). No afecta al estado que se muestra en la pestaña App ni al envío de la notificación."
+      "excludeFromBadgeHelp": "No sumar esta app al contador agregado de actualizaciones del card del LXC. Útil cuando mantienes una versión concreta a propósito (requisito de tracker, compatibilidad). No afecta al estado que se muestra en la pestaña App ni al envío de la notificación.",
+      "ociLabelPlaceholder": "org.opencontainers.image.version",
+      "methodOciImage": "Imagen OCI (instalada por ProxMenux)",
+      "ociImageHelp": "La versión y sus actualizaciones se leen de la imagen con la que se creó este contenedor. La instaló ProxMenux, así que no hay nada que configurar: la imagen instalada se compara con la que publica hoy su registro.",
+      "ociAppVersion": "Aplicación",
+      "ociImage": "Imagen",
+      "ociNewImage": "Nueva imagen",
+      "ociImageCurrent": "Versión",
+      "refreshData": "Actualizar datos",
+      "refreshingData": "Actualizando…"
     },
     "statusFilter": {
       "ariaLabel": "Filtrar máquinas virtuales y contenedores",
@@ -1702,7 +1749,7 @@
       "labels": {
         "category": "categoría",
         "severity": "gravedad",
-        "dismissed": "despedido"
+        "dismissed": "descartado"
       },
       "errorNames": {
         "security_login_attempts": "Intentos de inicio de sesión de seguridad"
@@ -3321,7 +3368,14 @@
       "auditReports": "Informes — una auditoría completa más informes enfocados de Revisión de seguridad, Garantía de backups y Capacidad y desgaste, cada uno con su propia cabecera de postura, y un Inventario imprimible; todos se exportan a PDF. La evaluación de seguridad pregunta antes de ejecutar Lynis para que sea rápida.",
       "auditPolicyBaseline": "Política y referencia — declara qué se espera del host (backups requeridos, firewall, acceso SSH de root) para que los hallazgos se evalúen contra ello, marca una ejecución como referencia y ve qué cambió desde entonces, con los hallazgos nuevos, resueltos y aceptados por separado.",
       "groupedAppUpdates": "Notificaciones de actualización de aplicaciones agrupadas — un mensaje completo por escaneo en lugar de uno por aplicación, agrupado por LXC con las versiones instalada y disponible.",
-      "adminTokenScope": "Ámbito administrativo — abrir un terminal del Monitor y desactivar la autenticación ahora requieren un token de administrador completo, así que un token de API de solo lectura se mantiene de solo lectura (reportado por @f3rs3n)."
+      "adminTokenScope": "Ámbito administrativo — abrir un terminal del Monitor y desactivar la autenticación ahora requieren un token de administrador completo, así que un token de API de solo lectura se mantiene de solo lectura (reportado por @f3rs3n).",
+      "ociAppTab": "Contenedores OCI en la pestaña App — un contenedor instalado por OCI manager Apps se reconoce desde su registro de instalación: la aplicación y su imagen, una imagen nueva detectada por digest y el enlace al repositorio de la imagen.",
+      "ociUpdatesTab": "Actualizaciones de contenedores OCI — Actualizar y Recrear abren el mismo recorrido que el menú OCI, el backup previo a la actualización puede conservarse en un almacenamiento de backups y la imagen puede actualizarse de forma programada.",
+      "ociLogsTab": "Pestaña Logs para contenedores OCI — la salida de consola de la aplicación, guardada en el host y seguida en directo, con filtro y descarga. La consola de Proxmox de estos contenedores abre un shell.",
+      "appsUpdateShortcut": "El icono de actualización de la página Apps abre el contenedor directamente en su pestaña Actualizaciones.",
+      "webhookHttps": "Las notificaciones de Proxmox llegan al Monitor con HTTPS activado — se entregan en una dirección solo local y ya no fallan por un error de certificado.",
+      "persistentLogs": "Una ráfaga de errores en los logs que ya terminó no se presenta como persistente: el patrón tiene que seguir apareciendo durante 15 minutos, y su aviso se cierra solo (reportado por @Joshua1264).",
+      "mountsLanAddress": "Los puntos de montaje en LVM-thin y otros almacenamientos de bloques muestran su uso, y las aplicaciones multicontenedor se abren en su dirección de la LAN."
     }
   },
   "network": {
@@ -4668,7 +4722,7 @@
     "updateNow": "Actualizar ahora",
     "dismissedItems": "Artículos descartados ({count})",
     "permanent": "Permanente",
-    "dismissed": "Despedido",
+    "dismissed": "Descartado",
     "wasStatus": "era {status}",
     "permanentlySuppressed": "Permanentemente suprimido",
     "suppressedForMore": "Suprimido por {duration} más",
@@ -4677,7 +4731,7 @@
     "lastUpdated": "Última actualización: {date}",
     "updateTerminalTitle": "Actualización del sistema Proxmox",
     "updateTerminalDescription": "Ejecuta apt-get update + dist-upgrade y limpieza posterior a la actualización en el host.",
-    "dismiss": "Despedir",
+    "dismiss": "Descartar",
     "silenceFor": "Silencia esta alerta por",
     "permanently": "Permanentemente",
     "duration": {
@@ -5035,6 +5089,8 @@
     "customLinkNewTitle": "Nuevo enlace web",
     "customLinkEditTitle": "Editar enlace web",
     "customLinkEditAria": "Editar el enlace personalizado {name}",
+    "openUpdatesAria": "Abrir la pestaña Actualizaciones de {name}",
+    "openUpdatesTitle": "Actualización disponible — abrir la pestaña Actualizaciones",
     "customLinkName": "Nombre",
     "customLinkNamePlaceholder": "p. ej. Mi app",
     "customLinkUrl": "URL",
diff --git a/AppImage/messages/fr/common.json b/AppImage/messages/fr/common.json
index 7ca80e6e..7b289a8d 100644
--- a/AppImage/messages/fr/common.json
+++ b/AppImage/messages/fr/common.json
@@ -1487,7 +1487,6 @@
       "containerNameLabel": "Nom du conteneur",
       "containerNamePlaceholder": "par exemple, <votre-nom-de-conteneur>",
       "ociLabelKeyLabel": "Clé d'étiquette OCI",
-      "ociLabelPlaceholder": "org.opencontainers.image.version",
       "pythonInterpreterLabel": "Chemin de l'interpréteur Python",
       "pythonInterpreterPlaceholder": "par exemple, /opt/<votre-application>/venv/bin/python",
       "pipDistLabel": "Nom de la distribution (paquet pip)",
@@ -1534,11 +1533,8 @@
       "portHttps": "https",
       "portLogoLabel": "URL du logo pour ce lien (facultatif)",
       "portLogoPlaceholder": "par exemple, https://example.com/logo.webp",
-      "portCategoryPlaceholder": "Category for the Apps dashboard (optional)",
       "portCategoryNone": "No category",
       "portCategoryAddNew": "+ Add new category…",
-      "portCategoryCustomPlaceholder": "Type a category and press Enter (Esc to cancel)",
-      "portCustomUrlPlaceholder": "Custom URL (e.g. https://vault.example.com) — overrides IP:port",
       "removePortTooltip": "Supprimer le port",
       "detectMethodDpkg": "dpkg ·",
       "detectMethodApk": "apk ·",
@@ -1631,7 +1627,11 @@
       "notifyUpstreamLabel": "Me prévenir lorsqu'une nouvelle version en amont est disponible",
       "notifyUpstreamHelp": "envoie `app_update_available` aux canaux activés dans Paramètres → Notifications. Désactivez-la si cette application ne peut pas être mise à jour sur votre box.",
       "excludeFromBadgeLabel": "exclure du compteur de mises à jour LXC",
-      "excludeFromBadgeHelp": "Ne comptez pas cette application dans le badge de mises à jour globales sur la carte de liste LXC.Utile lorsque vous êtes volontairement épinglé à une version spécifique (exigence de suivi, gel de la compatibilité).N'affecte pas l'état de l'onglet Application ni la notification sortante."
+      "excludeFromBadgeHelp": "Ne comptez pas cette application dans le badge de mises à jour globales sur la carte de liste LXC.Utile lorsque vous êtes volontairement épinglé à une version spécifique (exigence de suivi, gel de la compatibilité).N'affecte pas l'état de l'onglet Application ni la notification sortante.",
+      "ociLabelPlaceholder": "org.opencontainers.image.version",
+      "portCategoryPlaceholder": "Catégorie pour le tableau de bord Apps (facultatif)",
+      "portCategoryCustomPlaceholder": "Tapez une catégorie et appuyez sur Entrée (Esc pour annuler)",
+      "portCustomUrlPlaceholder": "URL personnalisée (par exemple https://vault.example.com) — remplace IP:port"
     },
     "statusFilter": {
       "ariaLabel": "Filtrer les machines virtuelles et les conteneurs",
@@ -2515,10 +2515,10 @@
       "scope": {
         "label": "Token permissions",
         "readOnly": "Read-only",
-        "readOnlyHint": "Reads metrics and status. Recommended for dashboards and integrations.",
         "fullAdmin": "Full admin",
-        "fullAdminHint": "Full control, like your own session.",
-        "fullAdminWarning": "A full-admin token can do everything you can: power off or reboot the host, run updates and open a terminal. Share it only with fully trusted integrations."
+        "readOnlyHint": "Lire les paramètres et l'état. Recommandé pour les tableaux de bord et les intégrations.",
+        "fullAdminHint": "Contrôle complet, comme votre propre session.",
+        "fullAdminWarning": "Un jeton entièrement administratif peut faire tout ce que vous pouvez : désactiver ou redémarrer l'hôte, lancer des mises à jour et ouvrir un terminal. Partagez-le seulement avec des intégrations entièrement fiables."
       }
     },
     "firewall": {
@@ -3302,26 +3302,33 @@
     "gotIt": "J'ai compris!",
     "dontShowAgain": "Ne plus afficher pour cette version",
     "currentFeatures": {
-      "appDetection": "Smarter app detection in the App tab: Docker is correctly promoted as the parent workload during cold start (Portainer/SearXNG no longer briefly show up as native apps), unregistered suggestions live in the startup cache, and 'Find applications' runs a fresh catalog-backed scan on demand.",
-      "dockerUpdates": "The Updates tab now covers Docker end-to-end: Docker Engine and per-image update tracking follow the same 24-hour rolling cycle as OS packages, with a 'Check now' action for on-demand digest comparison — no more waiting for the daily collector.",
-      "appCatalog": "New application detection catalog with over 380 tracked workloads, generated live from community-scripts across seven detector methods (file, binary, dpkg, apk, Python, Docker exec, Docker label). Primary and fallback detectors cover both new and historical LXC layouts.",
-      "pushover": "Pushover joins Telegram, Gotify, Discord, Email and Apprise as a native notification channel — user/API key, device and sound selectors, priority 0 for regular messages, optional priority 1 for CRITICAL events. Suggested by @benginx (#308).",
-      "appsDashboard": "New top-level Apps dashboard — a single launcher for every Web Link across the node. LXC-registered apps and user-defined Custom Web Links share the same grid with category badges, search, and one-click deep-links back to the guest modal.",
-      "lxcAppsUpdates": "App tab inside every LXC modal registers installed apps, captures weblinks and tracks upstream versions. Reworked Updates tab applies OS packages and app updates from a single button; Docker Engine and per-image tracking follow the same 24-hour cycle, with a 'Check now' action on demand.",
-      "multilingual": "The Monitor now speaks 8 languages: English, Spanish, German, French, Italian, Portuguese, Swedish and Slovak. Huge thanks to @vaso73 for building the i18n scaffolding that made this possible.",
-      "nvidiaMultiGpu": "NVIDIA driver lifecycle moves to per-BDF ownership so a multi-GPU host can pass one card to a VM and keep the other operational on the host or in LXCs, plus a kernel + branch + GPU-aware version picker (#298).",
-      "aiCustomEndpoint": "AI Assistant custom OpenAI endpoint — LiteLLM, LM Studio, LocalAI, vLLM, OmniRoute and any self-hosted proxy on private IPs, loopback or Docker networks are recognised when loading the model catalogue. The dropdown surfaces the server's error (or the underlying network reason) directly under the Load button (#325, reported by @jorgeffonte).",
-      "secureGatewayArch": "Secure Gateway wizard — the Alpine template download, local template selection and pct create all match the host's real architecture, so x86_64 hosts receive amd64 containers and arm64 hosts receive arm64 containers (#324, reported by @N0X4DD0).",
-      "atomicNotifications": "Notification events reserve their deduplication fingerprint atomically before AI processing and channel delivery, so concurrent collectors, completion callbacks or parallel Monitor processes cannot send the same event twice. The reservation is released when no channel succeeds, preserving retries.",
-      "borgSshPort": "Borg remote target — the Add Borg destination dialog and the shell TUI accept a custom SSH port. BORG_RSH, the auto key install flow and the capacity probe all honour it. Fully backwards compatible with existing entries created without an explicit port (suggested by @songochain in discussion #236).",
-      "githubToken": "Settings → GitHub API accepts an optional personal access token for release and tag checks when the anonymous quota is exhausted. The token is encrypted at rest and never returned to the browser; the rate-limit error is translated in every Monitor language (suggested by @SystemIdleProcess in discussion #306).",
-      "replicationContext": "Native Proxmox replication failure notifications resolve the replication job ID, affected VM/LXC ID and guest name; the exact error block from Proxmox is preserved as the reason, and each replication job deduplicates independently (reported by Ale R.).",
-      "auditAssessment": "Audit & Report — a new page that documents and assesses the node. The Assessment runs a catalogue of checks across security, backups, capacity, storage, network, hardware, guests and system, classifying each finding as critical, warning, observation or conformant and stating what it read rather than judging it.",
-      "changeJournal": "Change journal — a Changes view that lists exactly what ProxMenux modified on this host: every configuration file, package and service it touched, with the prior state of each, deduplicated to a current-state view that shows the host as it stands now rather than a log of every run.",
-      "auditReports": "Reports — a full audit plus focused Security review, Backup assurance and Capacity & wear reports, each opening on its own posture header, and a printable Inventory; all export to PDF. A security assessment asks before running Lynis so a run stays fast.",
-      "auditPolicyBaseline": "Policy and baseline — declare what the host is expected to be (backup requirements, firewall, root SSH login) so findings grade against it, mark a run as the reference, and see what changed since, with new, resolved and accepted findings kept apart.",
-      "groupedAppUpdates": "Grouped application update notifications — one complete message per scan instead of one per application, grouped by LXC with the installed and available versions.",
-      "adminTokenScope": "Administrative scope — opening a Monitor terminal and disabling authentication now require a full-admin token, so a read-only API token issued to a monitoring integration stays read-only (reported by @f3rs3n)."
+      "appDetection": "La détection d'applications plus intelligentes dans l'onglet App : Docker est correctement promue en tant que charge de travail parent lors du démarrage à froid (Portainer/SearXNG ne s'affiche plus brièvement en tant qu'applications natives), suggestions non enregistrées en direct dans le cache de démarrage, et 'Trouver des applications' lance un nouveau scanner soutenu par catalogue à la demande.",
+      "dockerUpdates": "L'onglet Mises à jour couvre maintenant le Docker de bout en bout : Docker Le suivi de la mise à jour du moteur et de l'image suit le même cycle de roulement de 24 heures que les paquets OS, avec une action 'Vérifiez maintenant' pour la comparaison de digest à la demande — pas plus attendre le collecteur quotidien.",
+      "appCatalog": "Nouveau catalogue de détection d'applications avec plus de 380 charges de travail suivies, généré en direct à partir de scripts communautaires sur sept méthodes de détecteurs (fichier, binaire, dpkg, apk, Python, Docker exec, étiquette Docker). Les détecteurs primaires et les détecteurs de recul couvrent les mises en page nouvelles et historiques du LXC.",
+      "pushover": "Pushover rejoint Telegram, Gotify, Discord, Email et Apprise en tant que canal de notification natif — touche utilisateur/API, sélecteurs de périphérique et de son, priorité 0 pour les messages réguliers, priorité 1 optionnelle pour les événements CRITIQUES. Proposé par @benginx (#308).",
+      "appsDashboard": "Nouveau tableau de bord des applications de haut niveau — un lanceur unique pour chaque lien Web à travers le nœud. Applications enregistrées par LXC et Web personnalisé Les liens partagent la même grille avec les badges de catégorie, les liens de recherche et les liens profonds à un clic vers le modal invité.",
+      "lxcAppsUpdates": "Onglet App à l'intérieur de chaque LXC modal enregistre les applications installées, capture les liens web et suit les versions en amont. L'onglet Mises à jour retravaillées applique les paquets OS et les mises à jour d'applications à partir d'un seul bouton; Docker Moteur et suivi par image suivent le même cycle de 24 heures, avec une action 'Vérifier maintenant' sur demande.",
+      "multilingual": "Le moniteur parle maintenant 8 langues: anglais, espagnol, allemand, français, italien, portugais, suédois et slovaque. Un énorme merci à @vaso73 pour la construction de l'échafaudage i18n qui a rendu cela possible.",
+      "nvidiaMultiGpu": "Le cycle de vie du pilote NVIDIA passe à la propriété par BDF de sorte qu'un hôte multi-GPU peut transmettre une carte à un VM et garder l'autre opérationnel sur l'hôte ou en LXCs, plus un noyau + branche + GPU-aware sélecteur de version (#298).",
+      "aiCustomEndpoint": "AI Assistant personnalisé OpenAI endpoint — LiteLLM, LM Studio, LocalAI, vLLM, OmniRoute et tout proxy auto-organisé sur les IP privées, les réseaux loopback ou Docker sont reconnus lors du chargement du catalogue modèle. Le menu déroulant couvre l'erreur du serveur (ou la raison réseau sous-jacente) directement sous le bouton Charger (#325, signalé par @jorgeffonte).",
+      "secureGatewayArch": "Secure Gateway assistant — le téléchargement de modèle Alpine, la sélection de modèle local et pct create correspondent tous à l'architecture réelle de l'hôte, donc x86 64 hôtes reçoivent amd64 conteneurs et arm64 hôtes reçoivent arm64 conteneurs (#324, rapporté par @N0X4DD0).",
+      "atomicNotifications": "Les événements de notification réservent leur empreinte digitale de duplication atomiquement avant le traitement de l'IA et la livraison du canal, de sorte que les collecteurs concurrents, les callbacks d'achèvement ou les processus Moniteur parallèles ne peuvent pas envoyer le même événement deux fois. La réservation est libérée lorsqu'aucun canal ne réussit, en préservant les relevés.",
+      "borgSshPort": "Cible distante Borg — la boîte de dialogue Add Borg destination et le shell TUI acceptent un port SSH personnalisé. BORG RSH, la clé automatique installe le flux et la sonde de capacité tout l'honore. Entièrement en arrière compatible avec les entrées existantes créées sans port explicite (suggéré par @songochain dans la discussion #236).",
+      "githubToken": "Paramètres → L'API GitHub accepte un jeton d'accès personnel optionnel pour la libération et vérifie les étiquettes lorsque le quota anonyme est épuisé. Le jeton est chiffré au repos et n'est jamais retourné dans le navigateur; l'erreur de limite de taux est traduite dans chaque langue Monitor (suggéré par @SystemIdleProcess dans la discussion #306).",
+      "replicationContext": "Les notifications de défaillance de réplication natives Proxmox résolvent l'ID de la tâche de réplication, l'ID touché VM/LXC et le nom de l'invité; le bloc d'erreur exact de Proxmox est conservé comme raison, et chaque tâche de réplication se dédouble indépendamment (rapporté par Ale R.).",
+      "auditAssessment": "Audit & Report — une nouvelle page qui documente et évalue le nœud. L'évaluation comporte un catalogue de vérifications de sécurité, de sauvegardes, de capacité, de stockage, de réseau, de matériel, d'invités et de système, classant chaque constatation comme critique, d'avertissement, d'observation ou conforme et indiquant ce qu'elle lit plutôt que de le juger.",
+      "changeJournal": "Change journal — a Changes view that listes exact what ProxMenux modified on this host: every configuration file, package and service it touched, with the previous state of chaque, dupliquée to a current-state view that shows the host as it stands now plutôt qu'un journal de chaque exécution.",
+      "auditReports": "Rapports — un audit complet plus un examen de sécurité ciblé, l'assurance de sauvegarde et rapports de capacité et d'usure, chaque ouverture sur son propre en-tête de posture, et un inventaire imprimable; tous exportent vers PDF. Une évaluation de sécurité demande avant de courir Lynis donc une course reste rapide.",
+      "auditPolicyBaseline": "Politique et base de référence — déclarer ce que l'hôte est censé être (exigences de sauvegarde, pare-feu, connexion à la racine SSH) de sorte que les constatations notent contre elle, marquent une course comme référence, et voir ce qui a changé puisque, avec les nouvelles, les conclusions résolues et acceptées restent séparées.",
+      "groupedAppUpdates": "Notifications groupées de mise à jour des applications — un message complet par balayage au lieu d'un message par application, groupé par LXC avec les versions installées et disponibles.",
+      "adminTokenScope": "Champ d'application administratif — l'ouverture d'un terminal de monitoring et la désactivation de l'authentification nécessitent maintenant un jeton d'administration complet, de sorte qu'un jeton d'API en lecture seule émis à un monitoring intégré reste en lecture seule (rapporté par @f3rs3n).",
+      "ociAppTab": "Conteneurs OCI dans l'onglet App — un conteneur installé par OCI manager Apps est reconnu à partir de son enregistrement d'installation : l'application et son image, une nouvelle image détectée par digest et un lien vers le dépôt de l'image.",
+      "ociUpdatesTab": "Mises à jour des conteneurs OCI — Mettre à jour et Recréer ouvrent le même parcours que le menu OCI, la sauvegarde prise avant la mise à jour peut être conservée dans un stockage de sauvegardes et l'image peut être mise à jour de façon planifiée.",
+      "ociLogsTab": "Onglet Logs pour les conteneurs OCI — la sortie console de l'application, conservée sur l'hôte et suivie en direct, avec un filtre et un téléchargement. La console Proxmox de ces conteneurs ouvre un shell.",
+      "appsUpdateShortcut": "L'icône de mise à jour de la page Apps ouvre directement le conteneur sur son onglet Mises à jour.",
+      "webhookHttps": "Les notifications de Proxmox atteignent le Monitor avec HTTPS activé — elles sont livrées sur une adresse uniquement locale et n'échouent plus sur une erreur de certificat.",
+      "persistentLogs": "Une rafale d'erreurs de logs terminée n'est plus signalée comme persistante : un motif doit continuer d'apparaître pendant 15 minutes, et son avertissement se ferme de lui-même (signalé par @Joshua1264).",
+      "mountsLanAddress": "Les points de montage sur LVM-thin et autres stockages en mode bloc affichent leur utilisation, et les applications multi-conteneurs s'ouvrent sur leur adresse LAN."
     }
   },
   "network": {
@@ -5027,23 +5034,20 @@
     "uncategorized": "Uncategorized",
     "openAriaLabel": "Open {name} in a new tab",
     "openGuestAriaLabel": "Ouvrir {name} ({type} {id})",
-    "emptyTitle": "No apps with a web link yet.",
-    "emptyHint": "Register a Web Link for any app (App tab of a CT) to see it here.",
     "customLinkAdd": "Add link",
     "editModeToggle": "Edit",
     "editModeDone": "Done",
     "customLinkNewTitle": "New web link",
     "customLinkEditTitle": "Edit web link",
     "customLinkEditAria": "Modifier le lien personnalisé {name}",
+    "openUpdatesAria": "Ouvrir l'onglet Mises à jour de {name}",
+    "openUpdatesTitle": "Mise à jour disponible — ouvrir l'onglet Mises à jour",
     "customLinkName": "Name",
     "customLinkNamePlaceholder": "e.g. My app",
     "customLinkUrl": "URL",
     "customLinkLogo": "Logo URL (optional)",
-    "customLinkLogoPlaceholder": "e.g., https://example.com/logo.webp",
     "customLinkCategory": "Category (optional)",
     "customLinkBinding": "Bound to",
-    "customLinkBindingNone": "Not bound to any guest",
-    "customLinkBindingHelp": "Bind this link to a VM or CT to add its ID + name to the card and jump to the guest with one click.",
     "customLinkSave": "Save",
     "customLinkCreate": "Create",
     "customLinkCancel": "Cancel",
@@ -5079,7 +5083,12 @@
       "remoteAccessVpn": "Remote Access & VPN",
       "webserversProxies": "Webservers & Proxies",
       "zigbeeZwaveMatter": "ZigBee, Z-Wave & Matter"
-    }
+    },
+    "emptyTitle": "Pas encore d'applications avec un lien web.",
+    "emptyHint": "Enregistrez un lien Web pour toute application (onglet App d'un CT) pour le voir ici.",
+    "customLinkLogoPlaceholder": "Par exemple, https://exemple.com/logo.webp",
+    "customLinkBindingNone": "Non lié à un invité",
+    "customLinkBindingHelp": "Relier ce lien à un VM ou CT pour ajouter son ID + nom à la carte et sauter à l'invité en un clic."
   },
   "audit": {
     "presentation": {
@@ -5234,13 +5243,10 @@
     "loading": "Loading assessment…",
     "run": "Run assessment",
     "running": "Assessing…",
-    "neverRun": "This host has not been assessed yet.",
     "lastRun": "Last assessed on {when}",
     "stale": "{days} days ago",
     "unverifiedChecks": "Non relevés : {checks}. Chacun indique dans ses évidences ce qu'il n'a pas pu lire.",
-    "noFindings": "No findings match the current filter.",
     "affectedCount": "{count} affected",
-    "acceptedNotice": "{count} accepted risk(s) recorded on this host.",
     "reviewOn": "À revoir le : {when}",
     "reviewDue": "À revoir — la décision reste en vigueur",
     "reviewDueNotice": "{count} décision(s) acceptée(s) sont à revoir.",
@@ -5272,7 +5278,7 @@
       "sources": "Sources et dates de collecte"
     },
     "errors": {
-      "runFailed": "The assessment could not be started."
+      "runFailed": "L'évaluation n'a pas pu être entreprise."
     },
     "checks": {
       "backup": {
@@ -5285,7 +5291,7 @@
             "uncovered": "{count} invités sur {total} ne sont sélectionnés par aucune tâche de sauvegarde activée",
             "excludedData": "{count} exclusions de disques ou montages à vérifier",
             "uncoveredExpected": "{required} invités déclarés comme devant être sauvegardés ne sont sélectionnés par aucune tâche activée",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           },
           "nextStep": {
             "noJobs": "Créez un travail de sauvegarde sur ce noeud et sélectionnez les invités qui détiennent des données que vous ne voudriez pas reconstruire à la main. Un emploi qui existe mais qui est handicapé ne sélectionne rien.",
@@ -5300,10 +5306,10 @@
           "rationale": "Ancienneté : temps écoulé depuis la dernière copie stockée. Limite utilisée : ancienneté de référence à laquelle cette copie est comparée.",
           "summary": {
             "recent": "Les {total} vérifications invité/destination respectent le critère d’ancienneté indiqué",
-            "stale": "{count} of {total} guests have no backup from the last 30 days",
-            "noBackups": "No stored backup matches a guest on this node",
             "attention": "{count} vérifications invité/destination sur {total} nécessitent un examen",
-            "evaluationFailed": "The check could not be evaluated"
+            "stale": "{count} de {total} invités n'ont aucune sauvegarde depuis les 30 derniers jours",
+            "noBackups": "Aucune sauvegarde enregistrée ne correspond à un invité sur ce nœud",
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           },
           "nextStep": {
             "stale": "Découvrez pourquoi le travail a cessé de produire des copies pour ces invités : il a peut-être été désactivé, son emploi du temps peut ne jamais tirer, ou ses pistes peuvent échouer. La vérification des résultats de l'exécution indique comment chaque travail s'est terminé.",
@@ -5317,10 +5323,10 @@
           "rationale": "La rétention telle que Proxmox la résout : réglage de la tâche, puis du stockage, puis la valeur par défaut du nœud. La rétention appliquée par un serveur de sauvegarde n'est pas lisible depuis ce nœud.",
           "summary": {
             "allDefined": "Les {total} tâches résolvent un réglage de rétention",
-            "missing": "{count} of {total} enabled job(s) declare no retention",
             "notDeclared": "{count} tâches sur {total} conservent toutes les copies : aucune rétention n'est déclarée",
             "onServer": "{count} tâches sur {total} écrivent sur un serveur de sauvegarde, qui les élague avec ses propres tâches",
-            "evaluationFailed": "The check could not be evaluated"
+            "missing": "{count} de {total} emploi(s) autorisé(s) déclarer aucune rétention",
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           },
           "nextStep": {
             "missing": "Réglez une rétention sur ces tâches, ou sur le stockage auquel ils écrivent. Proxmox prend le réglage du travail d'abord, puis le stockage, puis le noeud par défaut.",
@@ -5383,36 +5389,36 @@
           "summary": {
             "none": "Rien n'a demandé de redémarrage",
             "pending": "{count} éléments sont installés et attendent un redémarrage",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         },
         "enterprise_repo_without_subscription": {
           "title": "Enterprise repository",
           "rationale": "Références à `enterprise.proxmox.com` dans `/etc/apt/sources.list` et `sources.list.d`, face au statut renvoyé par `pvesubscription get`.",
           "summary": {
-            "notEnabled": "The enterprise repository is not enabled",
-            "subscribed": "The enterprise repository is backed by a subscription",
-            "unsubscribed": "The enterprise repository is enabled without an active subscription",
-            "evaluationFailed": "The check could not be evaluated"
+            "notEnabled": "Le dépôt d'entreprise n'est pas activé",
+            "subscribed": "Le dépôt d'entreprise est soutenu par un abonnement",
+            "unsubscribed": "Le dépôt d'entreprise est activé sans abonnement actif",
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         },
         "memory_overcommit": {
           "title": "Memory allocation",
           "rationale": "Le plafond `memory` de chaque configuration d'invité face à MemTotal, les invités en cours comptés séparément. Les conteneurs consomment jusqu'à cette limite ; les machines virtuelles sans ballooning la réservent.",
           "summary": {
-            "withinRatio": "Guests are allocated {percent}% of host memory",
-            "aboveRatio": "Guests are allocated {percent}% of host memory",
-            "evaluationFailed": "The check could not be evaluated"
+            "withinRatio": "Les invités reçoivent {percent}% de la mémoire hôte",
+            "aboveRatio": "Les invités reçoivent {percent}% de la mémoire hôte",
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         },
         "time_synchronisation": {
           "title": "Time synchronisation",
           "rationale": "NTP et NTPSynchronized tels que `timedatectl` les rapporte. L'appartenance au cluster, la validation des certificats et l'ordre des journaux dépendent d'horloges concordantes. Un autre mécanisme peut discipliner l'horloge.",
           "summary": {
-            "synchronised": "The clock is synchronised with a time source",
             "disabled": "Time synchronisation is disabled",
-            "notSynchronised": "Time synchronisation is enabled but the clock is not synchronised",
-            "evaluationFailed": "The check could not be evaluated"
+            "synchronised": "L'horloge est synchronisée avec une source de temps",
+            "notSynchronised": "La synchronisation du temps est activée mais l'horloge n'est pas synchronisée",
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         },
         "kernel_current": {
@@ -5420,21 +5426,21 @@
           "rationale": "Le noyau en cours face à celui que l'hôte démarrerait ensuite, tel que `proxmox-boot-tool` le rapporte. Un noyau plus récent seulement installé peut être retenu délibérément ; un écart après un redémarrage indique un démarrage qui n'a pas pris.",
           "summary": {
             "current": "Le noyau en cours {version} est celui que l'hôte démarrerait ensuite",
-            "newerAvailable": "The host runs {running} while {newest} is installed",
             "newerSelected": "L'hôte exécute {running} et démarrerait {selected} au prochain redémarrage",
             "wouldDowngrade": "L'hôte exécute {running} mais démarrerait le plus ancien {selected} au prochain redémarrage",
             "bootTargetUnknown": "L'hôte exécute {version} ; le noyau choisi pour le prochain démarrage n'a pas pu être lu",
-            "evaluationFailed": "The check could not be evaluated"
+            "newerAvailable": "L'hôte exécute {running} alors que {newest} est installé",
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         },
         "security_updates": {
           "title": "Security updates",
           "rationale": "Paquets en attente dont l'origine est un dépôt de sécurité, à partir d'un `apt-get upgrade` simulé. Le nombre reflète ce que rapporte apt, non la gravité de ce que chaque paquet corrige.",
           "summary": {
-            "none": "No package updates are pending",
-            "noSecurity": "{total} update(s) pending, none from a security repository",
-            "pending": "{count} of {total} pending update(s) come from a security repository",
-            "evaluationFailed": "The check could not be evaluated"
+            "none": "Aucune mise à jour du paquet n'est en cours",
+            "noSecurity": "{total} mise(s) à jour en attente, aucune depuis un dépôt de sécurité",
+            "pending": "{count} de {total} en attente de mise(s) à jour proviennent d'un dépôt de sécurité",
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         },
         "journal_size": {
@@ -5442,10 +5448,10 @@
           "rationale": "Le journal sur disque face au plafond qui s'y applique : SystemMaxUse lorsqu'il est défini, sinon la valeur par défaut de journald, un dixième du système de fichiers qui l'héberge.",
           "summary": {
             "bounded": "Le journal occupe {size}, en deçà de son plafond effectif",
-            "large": "The journal holds {size} on disk",
             "nearCap": "Le journal occupe {size} et atteint {percent}% de son plafond effectif",
             "capUnknown": "Le journal occupe {size} ; son plafond effectif n'a pas pu être déterminé",
-            "evaluationFailed": "The check could not be evaluated"
+            "large": "La revue détient {size} sur disque",
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         },
         "swap_configured": {
@@ -5454,7 +5460,7 @@
           "summary": {
             "active": "{size} of swap is active",
             "none": "No swap area is active",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         },
         "filesystem_capacity": {
@@ -5500,7 +5506,7 @@
           "summary": {
             "synchronised": "Les {total} partitions d'amorçage portent les mêmes noyaux",
             "attention": "{count} partitions d'amorçage sur {total} demandent un examen",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           },
           "rationale": "Le système EFI partitionne les rapports proxmox-boot-tool et les noyaux que chacun transporte. L'état proxmox-boot-tool peut monter temporairement les partitions système EFI ;aucun démarrage n'est tenté."
         },
@@ -5510,7 +5516,7 @@
           "summary": {
             "allRunning": "Les {total} services essentiels sont actifs et aucune unité n'est en échec",
             "attention": "{count} constat(s) parmi les unités",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         },
         "ha_state": {
@@ -5519,7 +5525,7 @@
           "summary": {
             "managed": "Les {total} services gérés sont dans un état stabilisé sur {nodes} nœud(s)",
             "attention": "{count} constat(s) sur {total} service(s) géré(s)",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         }
       },
@@ -5528,27 +5534,27 @@
           "title": "Container privileges",
           "rationale": "Le réglage `unprivileged` de chaque configuration de conteneur. Son absence signifie que le conteneur partage l'espace de noms utilisateur de l'hôte, ce dont certaines charges ont besoin.",
           "summary": {
-            "allUnprivileged": "All {total} containers are unprivileged",
             "privileged": "{count} of {total} containers run privileged",
-            "evaluationFailed": "The check could not be evaluated"
+            "allUnprivileged": "Tous les conteneurs {total} ne sont pas privilégiés",
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         },
         "qemu_without_agent": {
-          "title": "Guest agent on virtual machines",
           "rationale": "Le réglage `agent` dans la configuration de chaque machine virtuelle. Le réglage indique que l'agent est déclaré, non qu'il répond.",
           "summary": {
-            "allHaveAgent": "All {total} virtual machines declare the guest agent",
-            "missingAgent": "{count} of {total} virtual machines do not declare the guest agent",
-            "evaluationFailed": "The check could not be evaluated"
-          }
+            "allHaveAgent": "Toutes les machines virtuelles {total} déclarent l'agent invité",
+            "missingAgent": "{count} des machines virtuelles {total} ne déclarent pas l'agent invité",
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
+          },
+          "title": "Agent invité sur machines virtuelles"
         },
         "autostart": {
           "title": "Automatic start",
           "rationale": "Le réglage `onboot` de chaque invité, hors modèles et invités gérés par HA. Qu'un invité doive revenir de lui-même relève de la politique déclarée.",
           "summary": {
-            "allAutostart": "All {total} guests start with the host",
-            "notAutostart": "{count} of {total} guests do not start with the host",
-            "evaluationFailed": "The check could not be evaluated"
+            "allAutostart": "Tous les invités {total} commencent par l'hôte",
+            "notAutostart": "{count} des invités {total} ne commencent pas avec l'hôte",
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         },
         "stuck_snapshots": {
@@ -5556,28 +5562,28 @@
           "rationale": "État et ancienneté des snapshots ainsi que les tâches actives. Une opération récente ou sans date vérifiable n'est pas considérée comme interrompue.",
           "summary": {
             "noSnapshots": "No guest holds snapshots",
-            "allComplete": "The {total} snapshot(s) are complete",
-            "stuck": "{count} of {total} snapshot(s) were left mid-operation",
-            "evaluationFailed": "The check could not be evaluated"
+            "allComplete": "Les instantanés {total} sont complets",
+            "stuck": "{count} du ou des instantanés {total} ont été laissés en milieu de fonctionnement",
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         },
         "cpu_host_type": {
           "title": "Virtual CPU model",
           "rationale": "La valeur `cpu` de chaque machine virtuelle. `host` expose le jeu d'instructions du processeur physique, ce qui restreint les nœuds vers lesquels l'invité peut migrer. L'incompatibilité avec une destination précise n'est pas déterminée ici.",
           "summary": {
-            "none": "None of the {total} virtual machines is pinned to the host processor",
-            "pinned": "{count} of {total} virtual machines are pinned to the host processor",
-            "evaluationFailed": "The check could not be evaluated"
+            "none": "Aucune des machines virtuelles {total} n'est épinglée au processeur hôte",
+            "pinned": "{count} des machines virtuelles {total} sont épinglées au processeur hôte",
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         },
         "replication_state": {
           "title": "Replication",
           "rationale": "Tâches de réplication issues de l'API : nombre d'échecs, dernière erreur, dernière synchronisation et le calendrier que chaque tâche déclare. Les tâches en pause sont signalées comme telles.",
           "summary": {
-            "healthy": "The {total} replication job(s) report no error",
-            "failing": "{count} of {total} replication job(s) report an error",
-            "statusUnavailable": "Replication jobs are defined but their status could not be read",
-            "evaluationFailed": "The check could not be evaluated"
+            "healthy": "La ou les tâches de réplication {total} ne signalent aucune erreur",
+            "failing": "{count} des tâches de réplication {total} signalent une erreur",
+            "statusUnavailable": "Les emplois de replication sont définis mais leur statut n'a pas pu être lu.",
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         }
       },
@@ -5589,39 +5595,39 @@
             "bothEnabled": "L'activation du pare-feu est configurée au niveau du datacenter et du nœud",
             "datacenterOff": "Le pare-feu est désactivé au niveau du datacenter ; les règles du nœud ne sont donc pas appliquées",
             "nodeOff": "Le pare-feu est activé au niveau du datacenter, mais pas sur ce nœud",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         },
         "lynis_warnings": {
           "title": "Lynis warnings",
           "rationale": "Avertissements du dernier audit Lynis, chacun avec son identifiant de test, et l'ancienneté de cet audit. Un audit n'est lancé que si Lynis est installé et qu'aucun rapport complet n'existe. Les suggestions ne sont pas incluses.",
           "summary": {
-            "none": "The last Lynis audit recorded no warnings",
-            "found": "The last Lynis audit recorded {count} warning(s)",
-            "incomplete": "The Lynis report is incomplete",
-            "evaluationFailed": "The check could not be evaluated",
             "noneStale": "Le dernier audit Lynis n'a relevé aucun avertissement, et son rapport a {days} jour(s)",
-            "foundStale": "Le dernier audit Lynis a relevé {count} avertissement(s), et son rapport a {days} jour(s)"
+            "foundStale": "Le dernier audit Lynis a relevé {count} avertissement(s), et son rapport a {days} jour(s)",
+            "none": "La dernière vérification de Lynis n'a enregistré aucun avertissement",
+            "found": "La dernière vérification de Lynis a enregistré des avertissements {count}",
+            "incomplete": "Le rapport Lynis est incomplet",
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         },
         "certificate_expiry": {
           "title": "Certificate validity",
           "rationale": "La date d'expiration du certificat que pveproxy sert depuis /etc/pve/local. Un certificat personnalisé prime sur celui que Proxmox génère.",
           "summary": {
-            "valid": "The certificate is valid for {days} more day(s)",
-            "expiring": "The certificate expires in {days} day(s)",
-            "expired": "The certificate expired {days} day(s) ago",
-            "evaluationFailed": "The check could not be evaluated"
+            "valid": "Le certificat est valide pour {days} plus jour(s)",
+            "expiring": "Le certificat expire en {days} jour(s)",
+            "expired": "Le certificat a expiré {days} jour(s)",
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         },
         "ssh_root_login": {
           "title": "SSH root access",
           "rationale": "PermitRootLogin dans la configuration effective de `sshd -T`, avec les méthodes d'authentification associées. Proxmox est livré avec `yes`, qui accepte un mot de passe.",
           "summary": {
-            "password": "Root may sign in over SSH with a password",
-            "keyOnly": "Root may sign in over SSH with a key only",
-            "denied": "Root may not sign in over SSH",
-            "evaluationFailed": "The check could not be evaluated"
+            "password": "Root peut se connecter sur SSH avec un mot de passe",
+            "keyOnly": "La racine peut se connecter sur SSH avec une clé seulement",
+            "denied": "La racine ne peut pas se connecter au-dessus de SSH",
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         }
       },
@@ -5630,9 +5636,9 @@
           "title": "Volume assignment",
           "rationale": "Volumes d'invité sur le stockage local face aux références des configurations actuelles, en attente et de snapshots. Les sauvegardes, ISO et modèles restent hors de la comparaison. Un volume sans référence est un candidat à examiner.",
           "summary": {
-            "none": "No orphaned volumes were found",
             "found": "{count} volumes sans référence dans les configurations examinées",
-            "evaluationFailed": "The check could not be evaluated"
+            "none": "Aucun volume d'orphelins n'a été trouvé",
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         },
         "zfs_arc_max": {
@@ -5640,21 +5646,21 @@
           "rationale": "Valeurs effectives de c_min, c_max et taille de l'ARC, le paramètre de module chargé et les réglages persistants de /etc/modprobe.d. Une valeur configurée à zéro sélectionne la valeur par défaut du module ; l'ARC est un plafond et la mémoire qu'il occupe est récupérable.",
           "summary": {
             "bounded": "La limite de l'ARC représente {percent}% de la mémoire de l'hôte, et la mémoire qu'elle occupe est récupérable",
-            "high": "The ARC may use {percent}% of host memory",
-            "unset": "The ARC has no explicit limit set",
             "conflicting": "{count} réglages ARC ne concordent pas entre eux",
             "pending": "Un réglage ARC persistant diffère de la valeur portée par le module en cours",
-            "evaluationFailed": "The check could not be evaluated"
+            "high": "L'ARC peut utiliser {percent}% de la mémoire hôte",
+            "unset": "L'ARC n'a pas de limite explicite",
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         },
         "zfs_scrub_age": {
           "title": "ZFS scrub",
           "rationale": "Le dernier scrub terminé que `zpool status` rapporte pour chaque pool. Un resilver n'est pas un scrub. Un pool créé récemment n'a pas encore eu l'occasion d'en effectuer un.",
           "summary": {
-            "recent": "The {total} pool(s) were scrubbed within the last 35 days",
-            "overdue": "{count} of {total} pool(s) have not been scrubbed in 35 days",
             "neverScrubbed": "{count} pool(s) record no scrub",
-            "evaluationFailed": "The check could not be evaluated"
+            "recent": "Les piscines {total} ont été nettoyées au cours des 35 derniers jours.",
+            "overdue": "{count} de la ou des piscines {total} n'ont pas été nettoyées en 35 jours",
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         },
         "thin_pool_overprovisioning": {
@@ -5664,7 +5670,7 @@
             "withinRatio": "Les {total} thin pools restent sous les seuils d'examen appliqués",
             "aboveRatio": "{count} pools légers sur {total} distribuent plus de capacité qu'ils n'en possèdent",
             "pressure": "{pressure} pools légers sur {total} approchent le remplissage de leurs données ou métadonnées",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         },
         "connected_storage": {
@@ -5673,7 +5679,7 @@
           "summary": {
             "available": "PVE indique que les {total} stockages sont disponibles ; les composants internes distants et l'accès en écriture n'ont pas été testés",
             "attention": "{count} stockages sur {total} nécessitent un examen",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         },
         "pool_integrity": {
@@ -5691,7 +5697,7 @@
           "summary": {
             "healthy": "Ceph rapporte HEALTH_OK",
             "degraded": "Ceph rapporte {state}, avec {count} vérification(s) nommée(s)",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         },
         "array_integrity": {
@@ -5700,7 +5706,7 @@
           "summary": {
             "intact": "Les {total} grappes et cartes conservent leur redondance",
             "degraded": "{count} grappes ou cartes sur {total} en manquent",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         }
       },
@@ -5712,7 +5718,7 @@
             "withinLife": "Les {total} relevés de disques ne dépassent pas le seuil indicatif de cinq ans",
             "pastLife": "{count} relevés de disques sur {total} dépassent cinq ans de service",
             "noReadings": "Aucun disque ne rapporte de compteurs SMART exploitables ({skipped} sans relevés)",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         },
         "disk_errors": {
@@ -5729,23 +5735,22 @@
           "title": "Bond members",
           "rationale": "L'état MII de chaque membre du bond selon /proc/net/bonding et le nombre de liens restants. En active-backup, un membre de secours se déclare actif et ne transporte rien.",
           "summary": {
-            "allUp": "All members of the {total} bond(s) are up",
-            "membersDown": "{count} bond member(s) are not up",
-            "evaluationFailed": "The check could not be evaluated"
+            "allUp": "Tous les membres des obligations {total} sont en hausse",
+            "membersDown": "Les membres d'obligations {count} ne sont pas en hausse",
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         },
         "bridge_without_ports": {
           "title": "Bridge ports",
           "rationale": "La configuration des ports de chaque bridge. Un bridge sans port physique dessert un réseau interne ou routé.",
           "summary": {
-            "allConnected": "The {total} bridge(s) carry a port",
             "isolated": "{count} of {total} bridge(s) carry no port",
-            "evaluationFailed": "The check could not be evaluated"
+            "allConnected": "Le ou les ponts {total} portent un port",
+            "evaluationFailed": "La vérification n'a pas pu être évaluée"
           }
         }
       }
     },
-    "summaryFallback": "The check could not be evaluated",
     "acceptRisk": {
       "action": "Accepter le risque",
       "revoke": "Remettre en actif",
@@ -5779,17 +5784,15 @@
       "OK": "OK"
     },
     "viewSwitch": {
-      "ariaLabel": "Switch between assessment and inventory",
       "assessment": "Assessment",
       "inventory": "Inventory",
       "policy": "Politique",
-      "changes": "Modifications"
+      "changes": "Modifications",
+      "ariaLabel": "Changement entre l'évaluation et l'inventaire"
     },
     "inventory": {
       "loading": "Loading inventory…",
-      "failed": "The inventory could not be composed.",
       "collectedAt": "Composed on {when}",
-      "unavailable": "Not read in this inventory",
       "unresolved": "path not resolved",
       "noUplink": "no uplink",
       "identity": "Node identity",
@@ -5832,12 +5835,10 @@
       "protection": "Backup",
       "passthrough": "Passthrough",
       "noBackup": "No backup",
-      "noBackupDetail": "No enabled backup job selects this guest.",
       "applications": "Applications",
       "versionUnknown": "version not detected",
       "passthroughTitle": "PCI passthrough",
       "iommuGroup": "IOMMU group {group}",
-      "sharedGroup": "{count} more device(s) in the same group",
       "proxmenux": "ProxMenux optimizations",
       "latency": "Latence réseau",
       "subscriptionStatus": {
@@ -5848,7 +5849,11 @@
         "suspended": "Suspendu",
         "new": "En attente d'activation",
         "unknown": "Inconnu"
-      }
+      },
+      "failed": "L'inventaire n'a pas pu être composé.",
+      "unavailable": "Non lu dans cet inventaire",
+      "noBackupDetail": "Aucune tâche de sauvegarde activée ne sélectionne cet invité.",
+      "sharedGroup": "{count} plus de dispositif(s) dans le même groupe"
     },
     "profile": {
       "label": "Report",
@@ -5871,7 +5876,6 @@
       "area": "Area",
       "inventoryAnnex": "Inventory annex",
       "scopeTitle": "Scope of this report",
-      "scopeBody": "This report describes the Proxmox VE node named above, as observed from the node itself at the time stated. It does not cover the interior of the guests beyond what they declare, network equipment outside the host, physical infrastructure, or any dependency not visible from this node. Findings marked as not determined were not measured and are not evidence of absence.",
       "building": "Composition du rapport…",
       "node": "Nœud",
       "profile": "Profil",
@@ -6020,11 +6024,12 @@
       "structureSubtitle": "Comment {node} est construit et configuré",
       "postureTitle": "Posture",
       "posture": {
-        "security": "Host exposure and access.",
-        "backup": "Guest protection and whether it is real.",
-        "capacity": "Room to grow and the wear on the disks."
+        "security": "Exposition de l'hôte et accès.",
+        "backup": "Protection des invités et si elle est réelle.",
+        "capacity": "La place pour grandir et l'usure sur les disques."
       },
-      "scopeReadOnly": "L’évaluation inspecte les paramètres et l’état de l’hôte. Il peut rédiger des rapports et des journaux ;les vérifications de l'état de démarrage peuvent monter temporairement les partitions système EFI."
+      "scopeReadOnly": "L’évaluation inspecte les paramètres et l’état de l’hôte. Il peut rédiger des rapports et des journaux ;les vérifications de l'état de démarrage peuvent monter temporairement les partitions système EFI.",
+      "scopeBody": "Le présent rapport décrit le noeud Proxmox VE nommé ci-dessus, comme on l'a vu dans le nœud lui-même à l'époque indiquée. Il ne couvre pas l'intérieur des invités au-delà de ce qu'ils déclarent, l'équipement réseau en dehors de l'hôte, l'infrastructure physique, ou toute dépendance non visible de ce noeud. Les résultats marqués comme non déterminés n'ont pas été mesurés et ne sont pas une preuve d'absence."
     },
     "results": "Résultats",
     "classifications": {
@@ -6178,15 +6183,19 @@
     "notApplicableScope": "Rien dans le périmètre examiné auquel cette vérification s'applique.",
     "lynis": {
       "title": "Run Lynis",
-      "bodyNotRun": "Lynis is installed but has not been run yet. Running it now completes the security review, but the process can take a few minutes.",
-      "bodyStale": "The Lynis report is {days} days old. You can run it now to refresh the data (it takes a little longer) or continue with the existing report.",
       "withLynis": "Run with Lynis",
       "withoutLynis": "Run without Lynis",
-      "cancel": "Cancel"
+      "cancel": "Cancel",
+      "bodyNotRun": "Lynis est installé mais n'a pas encore été exécuté. Il termine maintenant l'examen de sécurité, mais le processus peut prendre quelques minutes.",
+      "bodyStale": "Le rapport Lynis date de {days} jours. Vous pouvez l'exécuter maintenant pour actualiser les données (il faut un peu plus longtemps) ou continuer avec le rapport existant."
     },
     "readOnlyNotice": "L’évaluation inspecte les paramètres et l’état de l’hôte. Il peut rédiger des rapports et des journaux ;les vérifications de l'état de démarrage peuvent monter temporairement les partitions système EFI.",
     "noActionNeeded": "Rien à faire. Ce chèque a trouvé ce qu'il s'attend à trouver.",
-    "couldNotEvaluate": "Cette vérification n'a pu être évaluée, de sorte qu'elle ne fait aucun rapport. La preuve enregistre ce qu'elle n'a pas pu lire."
+    "couldNotEvaluate": "Cette vérification n'a pu être évaluée, de sorte qu'elle ne fait aucun rapport. La preuve enregistre ce qu'elle n'a pas pu lire.",
+    "neverRun": "Cet hôte n'a pas encore été évalué.",
+    "noFindings": "Aucune découverte ne correspond au filtre actuel.",
+    "acceptedNotice": "{count} a accepté les risques enregistrés sur cet hôte.",
+    "summaryFallback": "La vérification n'a pas pu être évaluée"
   },
   "runtime": {
     "notifications": {
diff --git a/AppImage/messages/it/common.json b/AppImage/messages/it/common.json
index 62d662b1..16e8a321 100644
--- a/AppImage/messages/it/common.json
+++ b/AppImage/messages/it/common.json
@@ -1487,7 +1487,6 @@
       "containerNameLabel": "Nome del contenitore",
       "containerNamePlaceholder": "ad esempio, <nome-contenitore>",
       "ociLabelKeyLabel": "Chiave etichetta OCI",
-      "ociLabelPlaceholder": "org.opencontainers.image.version",
       "pythonInterpreterLabel": "Percorso dell'interprete Python",
       "pythonInterpreterPlaceholder": "ad esempio, /opt/<tua-app>/venv/bin/python",
       "pipDistLabel": "Nome della distribuzione (pacchetto pip)",
@@ -1534,11 +1533,8 @@
       "portHttps": "https",
       "portLogoLabel": "URL del logo per questo collegamento (facoltativo)",
       "portLogoPlaceholder": "ad esempio, https://example.com/logo.webp",
-      "portCategoryPlaceholder": "Category for the Apps dashboard (optional)",
       "portCategoryNone": "No category",
       "portCategoryAddNew": "+ Add new category…",
-      "portCategoryCustomPlaceholder": "Type a category and press Enter (Esc to cancel)",
-      "portCustomUrlPlaceholder": "Custom URL (e.g. https://vault.example.com) — overrides IP:port",
       "removePortTooltip": "Rimuovere la porta",
       "detectMethodDpkg": "dpkg ·",
       "detectMethodApk": "apk ·",
@@ -1631,7 +1627,11 @@
       "notifyUpstreamLabel": "avvisami quando è disponibile una nuova versione upstream",
       "notifyUpstreamHelp": "invia `app_update_available` ai canali abilitati in Impostazioni → Notifiche. Disattiva se questa app non può essere aggiornata sul tuo box.",
       "excludeFromBadgeLabel": "esclusione dal contatore degli aggiornamenti LXC",
-      "excludeFromBadgeHelp": "non contare questa app nel badge degli aggiornamenti aggregati sulla scheda dell'elenco LXC.Utile quando sei bloccato di proposito su una versione specifica (requisito del tracker, blocco della compatibilità).Non influisce sullo stato della scheda App o sulla notifica in uscita."
+      "excludeFromBadgeHelp": "non contare questa app nel badge degli aggiornamenti aggregati sulla scheda dell'elenco LXC.Utile quando sei bloccato di proposito su una versione specifica (requisito del tracker, blocco della compatibilità).Non influisce sullo stato della scheda App o sulla notifica in uscita.",
+      "ociLabelPlaceholder": "org.opencontainers.image.version",
+      "portCategoryPlaceholder": "Categoria per il cruscotto App (opzionale)",
+      "portCategoryCustomPlaceholder": "Digitare una categoria e premere Invio (Esc per annullare)",
+      "portCustomUrlPlaceholder": "URL personalizzato (ad esempio https://vault.example.com) — overrides IP:port"
     },
     "statusFilter": {
       "ariaLabel": "Filtra macchine virtuali e container",
@@ -2515,10 +2515,10 @@
       "scope": {
         "label": "Token permissions",
         "readOnly": "Read-only",
-        "readOnlyHint": "Reads metrics and status. Recommended for dashboards and integrations.",
         "fullAdmin": "Full admin",
-        "fullAdminHint": "Full control, like your own session.",
-        "fullAdminWarning": "A full-admin token can do everything you can: power off or reboot the host, run updates and open a terminal. Share it only with fully trusted integrations."
+        "readOnlyHint": "Legge metriche e stato. Consigliato per cruscotti e integrazioni.",
+        "fullAdminHint": "Controllo completo, come la tua sessione.",
+        "fullAdminWarning": "Un token full-admin può fare tutto il possibile: spegnere o riavviare l'host, eseguire aggiornamenti e aprire un terminale. Condividi solo con integrazioni completamente affidabili."
       }
     },
     "firewall": {
@@ -3302,26 +3302,33 @@
     "gotIt": "Fatto!",
     "dontShowAgain": "Non mostrare più per questa versione",
     "currentFeatures": {
-      "appDetection": "Smarter app detection in the App tab: Docker is correctly promoted as the parent workload during cold start (Portainer/SearXNG no longer briefly show up as native apps), unregistered suggestions live in the startup cache, and 'Find applications' runs a fresh catalog-backed scan on demand.",
-      "dockerUpdates": "The Updates tab now covers Docker end-to-end: Docker Engine and per-image update tracking follow the same 24-hour rolling cycle as OS packages, with a 'Check now' action for on-demand digest comparison — no more waiting for the daily collector.",
-      "appCatalog": "New application detection catalog with over 380 tracked workloads, generated live from community-scripts across seven detector methods (file, binary, dpkg, apk, Python, Docker exec, Docker label). Primary and fallback detectors cover both new and historical LXC layouts.",
-      "pushover": "Pushover joins Telegram, Gotify, Discord, Email and Apprise as a native notification channel — user/API key, device and sound selectors, priority 0 for regular messages, optional priority 1 for CRITICAL events. Suggested by @benginx (#308).",
-      "appsDashboard": "New top-level Apps dashboard — a single launcher for every Web Link across the node. LXC-registered apps and user-defined Custom Web Links share the same grid with category badges, search, and one-click deep-links back to the guest modal.",
-      "lxcAppsUpdates": "App tab inside every LXC modal registers installed apps, captures weblinks and tracks upstream versions. Reworked Updates tab applies OS packages and app updates from a single button; Docker Engine and per-image tracking follow the same 24-hour cycle, with a 'Check now' action on demand.",
-      "multilingual": "The Monitor now speaks 8 languages: English, Spanish, German, French, Italian, Portuguese, Swedish and Slovak. Huge thanks to @vaso73 for building the i18n scaffolding that made this possible.",
-      "nvidiaMultiGpu": "NVIDIA driver lifecycle moves to per-BDF ownership so a multi-GPU host can pass one card to a VM and keep the other operational on the host or in LXCs, plus a kernel + branch + GPU-aware version picker (#298).",
-      "aiCustomEndpoint": "AI Assistant custom OpenAI endpoint — LiteLLM, LM Studio, LocalAI, vLLM, OmniRoute and any self-hosted proxy on private IPs, loopback or Docker networks are recognised when loading the model catalogue. The dropdown surfaces the server's error (or the underlying network reason) directly under the Load button (#325, reported by @jorgeffonte).",
-      "secureGatewayArch": "Secure Gateway wizard — the Alpine template download, local template selection and pct create all match the host's real architecture, so x86_64 hosts receive amd64 containers and arm64 hosts receive arm64 containers (#324, reported by @N0X4DD0).",
-      "atomicNotifications": "Notification events reserve their deduplication fingerprint atomically before AI processing and channel delivery, so concurrent collectors, completion callbacks or parallel Monitor processes cannot send the same event twice. The reservation is released when no channel succeeds, preserving retries.",
-      "borgSshPort": "Borg remote target — the Add Borg destination dialog and the shell TUI accept a custom SSH port. BORG_RSH, the auto key install flow and the capacity probe all honour it. Fully backwards compatible with existing entries created without an explicit port (suggested by @songochain in discussion #236).",
-      "githubToken": "Settings → GitHub API accepts an optional personal access token for release and tag checks when the anonymous quota is exhausted. The token is encrypted at rest and never returned to the browser; the rate-limit error is translated in every Monitor language (suggested by @SystemIdleProcess in discussion #306).",
-      "replicationContext": "Native Proxmox replication failure notifications resolve the replication job ID, affected VM/LXC ID and guest name; the exact error block from Proxmox is preserved as the reason, and each replication job deduplicates independently (reported by Ale R.).",
-      "auditAssessment": "Audit & Report — a new page that documents and assesses the node. The Assessment runs a catalogue of checks across security, backups, capacity, storage, network, hardware, guests and system, classifying each finding as critical, warning, observation or conformant and stating what it read rather than judging it.",
-      "changeJournal": "Change journal — a Changes view that lists exactly what ProxMenux modified on this host: every configuration file, package and service it touched, with the prior state of each, deduplicated to a current-state view that shows the host as it stands now rather than a log of every run.",
-      "auditReports": "Reports — a full audit plus focused Security review, Backup assurance and Capacity & wear reports, each opening on its own posture header, and a printable Inventory; all export to PDF. A security assessment asks before running Lynis so a run stays fast.",
-      "auditPolicyBaseline": "Policy and baseline — declare what the host is expected to be (backup requirements, firewall, root SSH login) so findings grade against it, mark a run as the reference, and see what changed since, with new, resolved and accepted findings kept apart.",
-      "groupedAppUpdates": "Grouped application update notifications — one complete message per scan instead of one per application, grouped by LXC with the installed and available versions.",
-      "adminTokenScope": "Administrative scope — opening a Monitor terminal and disabling authentication now require a full-admin token, so a read-only API token issued to a monitoring integration stays read-only (reported by @f3rs3n)."
+      "appDetection": "Rilevamento delle app più intelligenti nella scheda App: Docker è correttamente promosso come il carico di lavoro dei genitori durante l'avvio a freddo (Portainer/SearXNG non si presenta più brevemente come applicazioni native), suggerimenti non registrati dal vivo nella cache di avvio, e 'Find application' esegue una nuova scansione a catalogo a richiesta.",
+      "dockerUpdates": "La scheda Aggiornamenti ora copre Docker end-to-end: Docker Aggiornamento motore e per immagine seguire lo stesso ciclo di rotolamento 24 ore di pacchetti OS, con un'azione 'Check now' per il confronto on-demand digest — non più in attesa per il collettore quotidiano.",
+      "appCatalog": "Nuovo catalogo di rilevamento delle applicazioni con oltre 380 carichi di lavoro tracciati, generati dal vivo da codici comunitari attraverso sette metodi di rivelatore (file, binario, dpkg, apk, Python, Docker exec, Docker label). I rilevatori primari e fallback coprono sia i nuovi che storici layout LXC.",
+      "pushover": "Pushover unisce Telegram, Gotify, Discord, Email e Apprise come canale di notifica nativo — chiave utente/API, selettori di dispositivo e suono, priorità 0 per messaggi regolari, priorità opzionale 1 per eventi CRITICAL. Suggerito da @benginx (#308).",
+      "appsDashboard": "Nuovo cruscotto App di alto livello — un singolo lanciatore per ogni collegamento Web attraverso il nodo. Applicazioni registrate da LXC e Web personalizzato definito dall'utente I collegamenti condividono la stessa griglia con i distintivi di categoria, la ricerca e un clic deep-link torna al modal guest.",
+      "lxcAppsUpdates": "Scheda App all'interno di ogni LXC modal registra app installate, cattura weblink e traccia versioni a monte. La scheda Aggiornamenti rielaborati applica i pacchetti OS e gli aggiornamenti delle app da un singolo pulsante; Docker Engine e per-image tracking seguono lo stesso ciclo di 24 ore, con un'azione 'Check now' a richiesta.",
+      "multilingual": "Il Monitor ora parla 8 lingue: inglese, spagnolo, tedesco, francese, italiano, portoghese, svedese e slovacco. Enorme grazie a @vaso73 per la costruzione del ponteggio i18n che ha reso possibile questo.",
+      "nvidiaMultiGpu": "Il ciclo di vita del driver NVIDIA si sposta alla proprietà per-BDF in modo che un host multi-GPU possa passare una scheda a un VM e mantenere l'altra operativa sull'host o in LXCs, oltre a un kernel + branch + GPU-aware versione picker (#298).",
+      "aiCustomEndpoint": "AI Assistant Custom OpenAI endpoint — LiteLLM, LM Studio, LocalAI, vLLM, OmniRoute e qualsiasi proxy self-hosted su IP privati, loopback o reti Docker sono riconosciuti al momento del caricamento del catalogo del modello. Il dropdown supera l'errore del server (o la ragione di rete sottostante) direttamente sotto il pulsante Carica (#325, riportato da @jorgeffonte).",
+      "secureGatewayArch": "Secure Gateway wizard — il download del modello alpino, la selezione dei modelli locali e pct create tutti corrispondono all'architettura reale dell'host, così gli host x86 64 ricevono i container amd64 e gli host arm64 ricevono i container arm64 (#324, segnalati da @N0X4DD0).",
+      "atomicNotifications": "Gli eventi di notifica riservano le loro impronte di deduplicazione atomicamente prima dell'elaborazione di AI e della consegna dei canali, così i collettori concomitanti, i callback di completamento o i processi di Monitor parallelo non possono inviare lo stesso evento due volte. La prenotazione viene rilasciata quando nessun canale riesce, conservando i retries.",
+      "borgSshPort": "Borg obiettivo remoto — la finestra di dialogo Aggiungi destinazione Borg e la shell TUI accettano una porta SSH personalizzata. BORG RSH, il flusso di installazione chiave automatica e la sonda di capacità lo onorano tutti. Pienamente compatibile con le voci esistenti create senza un porto esplicito (suggested da @songochain in discussione #236).",
+      "githubToken": "Impostazioni → GitHub API accetta un gettone di accesso personale facoltativo per il rilascio e i controlli dei tag quando la quota anonima è esaurita. Il token è crittografato a riposo e non è mai tornato al browser; l'errore di tasso-limit è tradotto in ogni lingua Monitor (suggested da @SystemIdleProcess in discussione #306).",
+      "replicationContext": "Le notifiche di errori di replica Proxmox native risolvono l'ID del lavoro di replica, l'ID VM/LXC interessato e il nome dell'ospite; il blocco di errore esatto da Proxmox è conservato come il motivo, e ogni lavoro di replica deduplica indipendentemente (riportato da Ale R.).",
+      "auditAssessment": "Audit & Report — una nuova pagina che documenta e valuta il nodo. La valutazione gestisce un catalogo di controlli su sicurezza, backup, capacità, storage, rete, hardware, ospiti e sistema, classificando ogni ricerca come critico, avviso, osservazione o conformante e affermando ciò che legge anziché giudicarlo.",
+      "changeJournal": "Cambia la rivista — una vista Modifiche che elenca esattamente ciò che ProxMenux modificato su questo host: ogni file di configurazione, pacchetto e servizio che ha toccato, con lo stato precedente di ciascuno, deduplicato a una vista corrente-stato che mostra l'host come si trova ora piuttosto che un registro di ogni corsa.",
+      "auditReports": "Rapporti — una revisione completa di audit più focalizzata di sicurezza, garanzia di backup e report di capacità & usura, ogni apertura sul proprio intestazione postura, e un Inventory stampabile; tutte le esportazioni in PDF. Una valutazione di sicurezza chiede prima di eseguire Lynis così una corsa rimane veloce.",
+      "auditPolicyBaseline": "Politica e linea di base — dichiarare ciò che l'host è previsto per essere (requisiti di backup, firewall, root SSH login) in modo da trovare grado contro di esso, contrassegnare una corsa come il riferimento, e vedere che cosa cambiato da, con nuovi, risolti e accettati risultati tenuti separati.",
+      "groupedAppUpdates": "Notifiche di aggiornamento dell'applicazione raggruppate — un messaggio completo per scansione invece di uno per applicazione, raggruppate da LXC con le versioni installate e disponibili.",
+      "adminTokenScope": "Amministrativo — l'apertura di un terminale Monitor e la disattivazione dell'autenticazione richiedono ora un token full-admin, quindi un token API di sola lettura rilasciato ad un'integrazione di monitoraggio resta in sola lettura (reported by @f3rs3n).",
+      "ociAppTab": "Container OCI nella scheda App — un container installato da OCI manager Apps viene riconosciuto dal suo registro di installazione: l'applicazione e la sua immagine, una nuova immagine rilevata tramite digest e un link al repository dell'immagine.",
+      "ociUpdatesTab": "Aggiornamenti dei container OCI — Aggiorna e Ricrea aprono lo stesso percorso del menu OCI, il backup eseguito prima dell'aggiornamento può essere conservato in uno storage di backup e l'immagine può essere aggiornata in modo pianificato.",
+      "ociLogsTab": "Scheda Logs per i container OCI — l'output della console dell'applicazione, conservato sull'host e seguito in tempo reale, con filtro e download. La console di Proxmox di questi container apre una shell.",
+      "appsUpdateShortcut": "L'icona di aggiornamento nella pagina App apre il container direttamente sulla sua scheda Aggiornamenti.",
+      "webhookHttps": "Le notifiche di Proxmox raggiungono il Monitor con HTTPS attivo — vengono consegnate su un indirizzo solo locale e non falliscono più per un errore di certificato.",
+      "persistentLogs": "Una raffica di errori nei log che si è conclusa non viene più segnalata come persistente: un pattern deve continuare a comparire per 15 minuti, e il suo avviso si chiude da solo (segnalato da @Joshua1264).",
+      "mountsLanAddress": "I punti di mount su LVM-thin e altri storage a blocchi mostrano il loro utilizzo, e le applicazioni multi-container si aprono sul loro indirizzo LAN."
     }
   },
   "network": {
@@ -5027,23 +5034,20 @@
     "uncategorized": "Uncategorized",
     "openAriaLabel": "Open {name} in a new tab",
     "openGuestAriaLabel": "Apri {name} ({type} {id})",
-    "emptyTitle": "No apps with a web link yet.",
-    "emptyHint": "Register a Web Link for any app (App tab of a CT) to see it here.",
     "customLinkAdd": "Add link",
     "editModeToggle": "Edit",
     "editModeDone": "Done",
     "customLinkNewTitle": "New web link",
     "customLinkEditTitle": "Edit web link",
     "customLinkEditAria": "Modifica il collegamento personalizzato {name}",
+    "openUpdatesAria": "Apri la scheda Aggiornamenti di {name}",
+    "openUpdatesTitle": "Aggiornamento disponibile — apri la scheda Aggiornamenti",
     "customLinkName": "Name",
     "customLinkNamePlaceholder": "e.g. My app",
     "customLinkUrl": "URL",
     "customLinkLogo": "Logo URL (optional)",
-    "customLinkLogoPlaceholder": "e.g., https://example.com/logo.webp",
     "customLinkCategory": "Category (optional)",
     "customLinkBinding": "Bound to",
-    "customLinkBindingNone": "Not bound to any guest",
-    "customLinkBindingHelp": "Bind this link to a VM or CT to add its ID + name to the card and jump to the guest with one click.",
     "customLinkSave": "Save",
     "customLinkCreate": "Create",
     "customLinkCancel": "Cancel",
@@ -5079,7 +5083,12 @@
       "remoteAccessVpn": "Remote Access & VPN",
       "webserversProxies": "Webservers & Proxies",
       "zigbeeZwaveMatter": "ZigBee, Z-Wave & Matter"
-    }
+    },
+    "emptyTitle": "Nessuna applicazione con un link web ancora.",
+    "emptyHint": "Registrare un Web Link per qualsiasi applicazione (App scheda di un CT) per vederlo qui.",
+    "customLinkLogoPlaceholder": "ad esempio, https://example.com/logo.webp",
+    "customLinkBindingNone": "Non vincolato a nessun ospite",
+    "customLinkBindingHelp": "Collegare questo link a un VM o CT per aggiungere il suo ID + nome alla scheda e saltare all'ospite con un clic."
   },
   "audit": {
     "presentation": {
@@ -5234,13 +5243,10 @@
     "loading": "Loading assessment…",
     "run": "Run assessment",
     "running": "Assessing…",
-    "neverRun": "This host has not been assessed yet.",
     "lastRun": "Last assessed on {when}",
     "stale": "{days} days ago",
     "unverifiedChecks": "Non effettuate: {checks}. Ciascuna dice nella propria evidenza cosa non ha potuto leggere.",
-    "noFindings": "No findings match the current filter.",
     "affectedCount": "{count} affected",
-    "acceptedNotice": "{count} accepted risk(s) recorded on this host.",
     "reviewOn": "Da rivedere il: {when}",
     "reviewDue": "Da rivedere — la decisione resta valida",
     "reviewDueNotice": "{count} decisione/i accettata/e da rivedere.",
@@ -5272,7 +5278,7 @@
       "sources": "Fonti e date di raccolta"
     },
     "errors": {
-      "runFailed": "The assessment could not be started."
+      "runFailed": "La valutazione non potrebbe essere iniziata."
     },
     "checks": {
       "backup": {
@@ -5285,7 +5291,7 @@
             "uncovered": "{count} guest su {total} non sono selezionati da alcun processo di backup attivo",
             "excludedData": "{count} esclusioni di dischi o mount point da verificare",
             "uncoveredExpected": "{required} guest dichiarati come da proteggere non sono selezionati da alcun processo attivo",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           },
           "nextStep": {
             "noJobs": "Creare un lavoro di backup su questo nodo e selezionare gli ospiti in possesso di dati che non si desidera ricostruire a mano. Un lavoro che esiste ma è disabilitato non seleziona nulla.",
@@ -5300,10 +5306,10 @@
           "rationale": "Età: tempo trascorso dall’ultima copia archiviata. Limite utilizzato: età di riferimento con cui viene confrontata la copia.",
           "summary": {
             "recent": "Tutte le {total} verifiche guest/destinazione rispettano il criterio di anzianità indicato",
-            "stale": "{count} of {total} guests have no backup from the last 30 days",
-            "noBackups": "No stored backup matches a guest on this node",
             "attention": "{count} verifiche guest/destinazione su {total} richiedono attenzione",
-            "evaluationFailed": "The check could not be evaluated"
+            "stale": "{count} degli ospiti di {total} non hanno alcun backup dagli ultimi 30 giorni",
+            "noBackups": "Nessun backup memorizzato corrisponde a un ospite su questo nodo",
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           },
           "nextStep": {
             "stale": "Scopri perché il lavoro ha smesso di produrre copie per questi ospiti: potrebbe essere stato disabilitato, il suo programma potrebbe non sparare, o le sue piste potrebbero essere in fallimento. I risultati dell'esecuzione controllano i rapporti come ogni lavoro è finito.",
@@ -5317,10 +5323,10 @@
           "rationale": "La ritenzione come la risolve Proxmox: impostazione del processo, poi dello storage, poi il valore predefinito del nodo. La ritenzione applicata da un server di backup non è leggibile da questo nodo.",
           "summary": {
             "allDefined": "Tutti i {total} processi risolvono un'impostazione di ritenzione",
-            "missing": "{count} of {total} enabled job(s) declare no retention",
             "notDeclared": "{count} processi su {total} conservano ogni copia: non hanno una ritenzione dichiarata",
             "onServer": "{count} processi su {total} scrivono su un server di backup, che le pota con i propri processi",
-            "evaluationFailed": "The check could not be evaluated"
+            "missing": "{count} di {total} abilitato lavori(i) non dichiarano nessuna ritenzione",
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           },
           "nextStep": {
             "missing": "Impostare una ritenzione su questi lavori, o sullo storage a cui scrivono. Proxmox prende l'impostazione del lavoro prima, poi lo storage è, poi il nodo predefinito.",
@@ -5383,36 +5389,36 @@
           "summary": {
             "none": "Nulla ha richiesto un riavvio",
             "pending": "{count} elementi sono installati e attendono un riavvio",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         },
         "enterprise_repo_without_subscription": {
           "title": "Enterprise repository",
           "rationale": "Riferimenti a `enterprise.proxmox.com` in `/etc/apt/sources.list` e `sources.list.d`, rispetto allo stato restituito da `pvesubscription get`.",
           "summary": {
-            "notEnabled": "The enterprise repository is not enabled",
-            "subscribed": "The enterprise repository is backed by a subscription",
-            "unsubscribed": "The enterprise repository is enabled without an active subscription",
-            "evaluationFailed": "The check could not be evaluated"
+            "notEnabled": "Il repository enterprise non è abilitato",
+            "subscribed": "Il repository enterprise è supportato da un abbonamento",
+            "unsubscribed": "Il repository enterprise è abilitato senza un abbonamento attivo",
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         },
         "memory_overcommit": {
           "title": "Memory allocation",
           "rationale": "Il tetto `memory` di ogni configurazione guest rispetto a MemTotal, con i guest in esecuzione conteggiati a parte. I container consumano fino a quel limite; le macchine virtuali senza ballooning lo riservano.",
           "summary": {
-            "withinRatio": "Guests are allocated {percent}% of host memory",
-            "aboveRatio": "Guests are allocated {percent}% of host memory",
-            "evaluationFailed": "The check could not be evaluated"
+            "withinRatio": "Gli ospiti sono assegnati {percent}% della memoria host",
+            "aboveRatio": "Gli ospiti sono assegnati {percent}% della memoria host",
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         },
         "time_synchronisation": {
           "title": "Time synchronisation",
           "rationale": "NTP e NTPSynchronized come li riporta `timedatectl`. L'appartenenza al cluster, la validazione dei certificati e l'ordine dei log dipendono da orologi concordi. Un altro meccanismo può regolare l'orologio.",
           "summary": {
-            "synchronised": "The clock is synchronised with a time source",
             "disabled": "Time synchronisation is disabled",
-            "notSynchronised": "Time synchronisation is enabled but the clock is not synchronised",
-            "evaluationFailed": "The check could not be evaluated"
+            "synchronised": "L'orologio è sincronizzato con una fonte di tempo",
+            "notSynchronised": "La sincronizzazione del tempo è abilitata ma l'orologio non è sincronizzato",
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         },
         "kernel_current": {
@@ -5420,21 +5426,21 @@
           "rationale": "Il kernel in esecuzione rispetto a quello che l'host avvierebbe successivamente, come lo riporta `proxmox-boot-tool`. Un kernel più recente solo installato può essere trattenuto di proposito; una differenza dopo un riavvio indica un avvio che non ha avuto effetto.",
           "summary": {
             "current": "Il kernel in esecuzione {version} è quello che l'host avvierebbe successivamente",
-            "newerAvailable": "The host runs {running} while {newest} is installed",
             "newerSelected": "L'host esegue {running} e avvierebbe {selected} al prossimo riavvio",
             "wouldDowngrade": "L'host esegue {running} ma avvierebbe il più vecchio {selected} al prossimo riavvio",
             "bootTargetUnknown": "L'host esegue {version}; non è stato possibile leggere il kernel scelto per il prossimo avvio",
-            "evaluationFailed": "The check could not be evaluated"
+            "newerAvailable": "L'host esegue {running} mentre {newest} è installato",
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         },
         "security_updates": {
           "title": "Security updates",
           "rationale": "Pacchetti in sospeso la cui origine è un repository di sicurezza, da un `apt-get upgrade` simulato. Il numero riflette quanto riporta apt, non la gravità di ciò che ogni pacchetto corregge.",
           "summary": {
-            "none": "No package updates are pending",
-            "noSecurity": "{total} update(s) pending, none from a security repository",
-            "pending": "{count} of {total} pending update(s) come from a security repository",
-            "evaluationFailed": "The check could not be evaluated"
+            "none": "Nessun aggiornamento dei pacchetti sono in sospeso",
+            "noSecurity": "{total} update(s) in attesa, nessuno da un repository di sicurezza",
+            "pending": "{count} di {total} in attesa di aggiornamenti(i) provengono da un repository di sicurezza",
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         },
         "journal_size": {
@@ -5442,10 +5448,10 @@
           "rationale": "Il journal su disco rispetto al tetto che gli si applica: SystemMaxUse quando è impostato, altrimenti il predefinito di journald, un decimo del filesystem su cui risiede.",
           "summary": {
             "bounded": "Il journal occupa {size}, entro il suo tetto effettivo",
-            "large": "The journal holds {size} on disk",
             "nearCap": "Il journal occupa {size} ed è al {percent}% del suo tetto effettivo",
             "capUnknown": "Il journal occupa {size}; non è stato possibile determinarne il tetto effettivo",
-            "evaluationFailed": "The check could not be evaluated"
+            "large": "La rivista contiene {size} su disco",
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         },
         "swap_configured": {
@@ -5454,7 +5460,7 @@
           "summary": {
             "active": "{size} of swap is active",
             "none": "No swap area is active",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         },
         "filesystem_capacity": {
@@ -5500,7 +5506,7 @@
           "summary": {
             "synchronised": "Le {total} partizioni di avvio portano gli stessi kernel",
             "attention": "{count} di {total} partizioni di avvio richiedono una revisione",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           },
           "rationale": "I report sulle partizioni di sistema EFI proxmox-boot-tool e i kernel che ciascuna trasporta. Lo stato proxmox-boot-tool può montare temporaneamente partizioni di sistema EFI; non viene tentato alcun avvio."
         },
@@ -5510,7 +5516,7 @@
           "summary": {
             "allRunning": "I {total} servizi essenziali sono attivi e nessuna unità è fallita",
             "attention": "{count} rilievo/i tra le unità",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         },
         "ha_state": {
@@ -5519,7 +5525,7 @@
           "summary": {
             "managed": "I {total} servizi gestiti sono in uno stato assestato su {nodes} nodo/i",
             "attention": "{count} rilievo/i su {total} servizio/i gestito/i",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         }
       },
@@ -5528,27 +5534,27 @@
           "title": "Container privileges",
           "rationale": "L'impostazione `unprivileged` di ogni configurazione container. La sua assenza significa che il container condivide lo spazio dei nomi utente dell'host, cosa che alcuni carichi richiedono.",
           "summary": {
-            "allUnprivileged": "All {total} containers are unprivileged",
             "privileged": "{count} of {total} containers run privileged",
-            "evaluationFailed": "The check could not be evaluated"
+            "allUnprivileged": "Tutti i contenitori {total} non sono privati",
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         },
         "qemu_without_agent": {
-          "title": "Guest agent on virtual machines",
           "rationale": "L'impostazione `agent` nella configurazione di ogni macchina virtuale. L'impostazione indica che l'agente è dichiarato, non che risponda.",
           "summary": {
-            "allHaveAgent": "All {total} virtual machines declare the guest agent",
-            "missingAgent": "{count} of {total} virtual machines do not declare the guest agent",
-            "evaluationFailed": "The check could not be evaluated"
-          }
+            "allHaveAgent": "Tutte le macchine virtuali {total} dichiarano l'agente ospite",
+            "missingAgent": "{count} delle macchine virtuali {total} non dichiarano l'agente ospite",
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
+          },
+          "title": "Agente ospite su macchine virtuali"
         },
         "autostart": {
           "title": "Automatic start",
           "rationale": "L'impostazione `onboot` di ogni guest, esclusi i template e i guest gestiti da HA. Se un guest debba tornare da solo lo indica la politica dichiarata.",
           "summary": {
-            "allAutostart": "All {total} guests start with the host",
-            "notAutostart": "{count} of {total} guests do not start with the host",
-            "evaluationFailed": "The check could not be evaluated"
+            "allAutostart": "Tutti gli ospiti {total} iniziano con l'host",
+            "notAutostart": "{count} degli ospiti di {total} non iniziano con l'host",
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         },
         "stuck_snapshots": {
@@ -5556,28 +5562,28 @@
           "rationale": "Stato e anzianità degli snapshot e attività in corso. Un'operazione recente o senza data verificabile non è considerata interrotta.",
           "summary": {
             "noSnapshots": "No guest holds snapshots",
-            "allComplete": "The {total} snapshot(s) are complete",
-            "stuck": "{count} of {total} snapshot(s) were left mid-operation",
-            "evaluationFailed": "The check could not be evaluated"
+            "allComplete": "Le snapshot {total} sono complete",
+            "stuck": "{count} di {total} snapshot(s) sono stati lasciati a metà operazione",
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         },
         "cpu_host_type": {
           "title": "Virtual CPU model",
           "rationale": "Il valore `cpu` di ogni macchina virtuale. `host` espone il set di istruzioni del processore fisico, il che limita i nodi verso cui il guest può migrare. L'incompatibilità con una destinazione precisa non viene determinata qui.",
           "summary": {
-            "none": "None of the {total} virtual machines is pinned to the host processor",
-            "pinned": "{count} of {total} virtual machines are pinned to the host processor",
-            "evaluationFailed": "The check could not be evaluated"
+            "none": "Nessuna delle macchine virtuali {total} è fissata al processore host",
+            "pinned": "Le macchine virtuali {count} di {total} sono fissate al processore host",
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         },
         "replication_state": {
           "title": "Replication",
           "rationale": "Processi di replica dalle API: numero di errori, ultimo errore, ultima sincronizzazione e il calendario dichiarato da ciascun processo. I processi in pausa sono indicati come tali.",
           "summary": {
-            "healthy": "The {total} replication job(s) report no error",
-            "failing": "{count} of {total} replication job(s) report an error",
-            "statusUnavailable": "Replication jobs are defined but their status could not be read",
-            "evaluationFailed": "The check could not be evaluated"
+            "healthy": "Il lavoro di replica {total} non segnala errore",
+            "failing": "{count} del lavoro di replica {total} segnala un errore",
+            "statusUnavailable": "I lavori di replica sono definiti ma il loro stato non può essere letto",
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         }
       },
@@ -5589,39 +5595,39 @@
             "bothEnabled": "L'attivazione del firewall è configurata a livello di datacenter e nodo",
             "datacenterOff": "Il firewall è disattivato a livello di datacenter, quindi le regole del nodo non vengono applicate",
             "nodeOff": "Il firewall è attivato a livello di datacenter ma non su questo nodo",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         },
         "lynis_warnings": {
           "title": "Lynis warnings",
           "rationale": "Avvisi dell'ultimo audit di Lynis, ciascuno con il proprio identificatore di test, e l'età di quell'audit. Un audit viene eseguito solo se Lynis è installato e non esiste alcun report completo. I suggerimenti non sono inclusi.",
           "summary": {
-            "none": "The last Lynis audit recorded no warnings",
-            "found": "The last Lynis audit recorded {count} warning(s)",
-            "incomplete": "The Lynis report is incomplete",
-            "evaluationFailed": "The check could not be evaluated",
             "noneStale": "L'ultimo audit di Lynis non ha registrato avvisi, e il suo report ha {days} giorno/i",
-            "foundStale": "L'ultimo audit di Lynis ha registrato {count} avviso/i, e il suo report ha {days} giorno/i"
+            "foundStale": "L'ultimo audit di Lynis ha registrato {count} avviso/i, e il suo report ha {days} giorno/i",
+            "none": "L'ultima verifica di Lynis non ha registrato avvisi",
+            "found": "L'ultimo controllo di Lynis ha registrato {count} avvisi(i)",
+            "incomplete": "La relazione Lynis è incompleta",
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         },
         "certificate_expiry": {
           "title": "Certificate validity",
           "rationale": "La data di scadenza del certificato che pveproxy serve da /etc/pve/local. Un certificato personalizzato ha la precedenza su quello generato da Proxmox.",
           "summary": {
-            "valid": "The certificate is valid for {days} more day(s)",
-            "expiring": "The certificate expires in {days} day(s)",
-            "expired": "The certificate expired {days} day(s) ago",
-            "evaluationFailed": "The check could not be evaluated"
+            "valid": "Il certificato è valido per {days} più giorno(i)",
+            "expiring": "Il certificato scade in {days} day(s)",
+            "expired": "Il certificato è scaduto {days} giorno(i) fa",
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         },
         "ssh_root_login": {
           "title": "SSH root access",
           "rationale": "PermitRootLogin nella configurazione effettiva di `sshd -T`, con i metodi di autenticazione a cui si combina. Proxmox viene consegnato con `yes`, che accetta una password.",
           "summary": {
-            "password": "Root may sign in over SSH with a password",
-            "keyOnly": "Root may sign in over SSH with a key only",
-            "denied": "Root may not sign in over SSH",
-            "evaluationFailed": "The check could not be evaluated"
+            "password": "Root può accedere a SSH con una password",
+            "keyOnly": "Root può firmare in oltre SSH con una chiave solo",
+            "denied": "La radice non può firmare su SSH",
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         }
       },
@@ -5630,9 +5636,9 @@
           "title": "Volume assignment",
           "rationale": "Volumi dei guest sullo storage locale rispetto ai riferimenti nelle configurazioni correnti, in sospeso e di snapshot. Backup, ISO e template restano fuori dal confronto. Un volume senza riferimento è un candidato alla verifica.",
           "summary": {
-            "none": "No orphaned volumes were found",
             "found": "{count} volumi senza riferimenti nelle configurazioni esaminate",
-            "evaluationFailed": "The check could not be evaluated"
+            "none": "Non sono stati trovati volumi orfani",
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         },
         "zfs_arc_max": {
@@ -5640,21 +5646,21 @@
           "rationale": "Valori effettivi di c_min, c_max e dimensione dell'ARC, il parametro del modulo caricato e le impostazioni persistenti in /etc/modprobe.d. Un valore configurato a zero seleziona il predefinito del modulo; l'ARC è un tetto e la memoria che occupa è recuperabile.",
           "summary": {
             "bounded": "Il limite dell'ARC è il {percent}% della memoria dell'host, e la memoria che occupa è recuperabile",
-            "high": "The ARC may use {percent}% of host memory",
-            "unset": "The ARC has no explicit limit set",
             "conflicting": "{count} impostazioni dell'ARC non concordano tra loro",
             "pending": "Un'impostazione persistente dell'ARC differisce dal valore del modulo in esecuzione",
-            "evaluationFailed": "The check could not be evaluated"
+            "high": "L'ARC può utilizzare {percent}% della memoria host",
+            "unset": "L'ARC non ha un limite esplicito",
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         },
         "zfs_scrub_age": {
           "title": "ZFS scrub",
           "rationale": "L'ultimo scrub completato registrato da `zpool status` per ogni pool. Un resilver non è uno scrub. Un pool creato di recente non ha ancora avuto occasione di eseguirne uno.",
           "summary": {
-            "recent": "The {total} pool(s) were scrubbed within the last 35 days",
-            "overdue": "{count} of {total} pool(s) have not been scrubbed in 35 days",
             "neverScrubbed": "{count} pool(s) record no scrub",
-            "evaluationFailed": "The check could not be evaluated"
+            "recent": "La piscina {total} è stata lavata negli ultimi 35 giorni",
+            "overdue": "{count} della piscina {total} non sono stati ripuliti in 35 giorni",
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         },
         "thin_pool_overprovisioning": {
@@ -5664,7 +5670,7 @@
             "withinRatio": "I {total} thin pool sono al di sotto delle soglie di verifica applicate",
             "aboveRatio": "{count} thin pool su {total} distribuiscono più capacità di quella che possiedono",
             "pressure": "{pressure} thin pool su {total} sono vicini a riempire dati o metadati",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         },
         "connected_storage": {
@@ -5673,7 +5679,7 @@
           "summary": {
             "available": "PVE indica tutti i {total} archivi come disponibili; i componenti interni remoti e l'accesso in scrittura non sono stati verificati",
             "attention": "{count} archivi su {total} richiedono una verifica",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         },
         "pool_integrity": {
@@ -5691,7 +5697,7 @@
           "summary": {
             "healthy": "Ceph riporta HEALTH_OK",
             "degraded": "Ceph riporta {state}, con {count} controllo/i nominato/i",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         },
         "array_integrity": {
@@ -5700,7 +5706,7 @@
           "summary": {
             "intact": "I {total} array e mappe conservano la loro ridondanza",
             "degraded": "{count} di {total} array o mappe ne sono a corto",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         }
       },
@@ -5712,7 +5718,7 @@
             "withinLife": "Le {total} letture dei dischi non superano la soglia indicativa di cinque anni",
             "pastLife": "{count} di {total} letture dei dischi superano cinque anni di servizio",
             "noReadings": "Nessun disco espone contatori SMART utilizzabili ({skipped} senza letture)",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         },
         "disk_errors": {
@@ -5729,23 +5735,22 @@
           "title": "Bond members",
           "rationale": "Lo stato MII di ogni membro del bond da /proc/net/bonding e quanti collegamenti restano. In active-backup un membro di riserva risulta attivo e non trasporta traffico.",
           "summary": {
-            "allUp": "All members of the {total} bond(s) are up",
-            "membersDown": "{count} bond member(s) are not up",
-            "evaluationFailed": "The check could not be evaluated"
+            "allUp": "Tutti i membri delle obbligazioni {total} sono in aumento",
+            "membersDown": "I membri delle obbligazioni {count} non sono aggiornati",
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         },
         "bridge_without_ports": {
           "title": "Bridge ports",
           "rationale": "La configurazione delle porte di ogni bridge. Un bridge senza porta fisica serve una rete interna o instradata.",
           "summary": {
-            "allConnected": "The {total} bridge(s) carry a port",
             "isolated": "{count} of {total} bridge(s) carry no port",
-            "evaluationFailed": "The check could not be evaluated"
+            "allConnected": "Il ponte {total} porta una porta",
+            "evaluationFailed": "Il controllo non potrebbe essere valutato"
           }
         }
       }
     },
-    "summaryFallback": "The check could not be evaluated",
     "acceptRisk": {
       "action": "Accetta il rischio",
       "revoke": "Riporta tra gli attivi",
@@ -5779,17 +5784,15 @@
       "OK": "OK"
     },
     "viewSwitch": {
-      "ariaLabel": "Switch between assessment and inventory",
       "assessment": "Assessment",
       "inventory": "Inventory",
       "policy": "Politica",
-      "changes": "Modifiche"
+      "changes": "Modifiche",
+      "ariaLabel": "Interruttore tra valutazione e inventario"
     },
     "inventory": {
       "loading": "Loading inventory…",
-      "failed": "The inventory could not be composed.",
       "collectedAt": "Composed on {when}",
-      "unavailable": "Not read in this inventory",
       "unresolved": "path not resolved",
       "noUplink": "no uplink",
       "identity": "Node identity",
@@ -5832,12 +5835,10 @@
       "protection": "Backup",
       "passthrough": "Passthrough",
       "noBackup": "No backup",
-      "noBackupDetail": "No enabled backup job selects this guest.",
       "applications": "Applications",
       "versionUnknown": "version not detected",
       "passthroughTitle": "PCI passthrough",
       "iommuGroup": "IOMMU group {group}",
-      "sharedGroup": "{count} more device(s) in the same group",
       "proxmenux": "ProxMenux optimizations",
       "latency": "Latenza di rete",
       "subscriptionStatus": {
@@ -5848,7 +5849,11 @@
         "suspended": "Sospeso",
         "new": "In attesa di attivazione",
         "unknown": "Sconosciuto"
-      }
+      },
+      "failed": "L'inventario non poteva essere composto.",
+      "unavailable": "Non leggere in questo inventario",
+      "noBackupDetail": "Nessun lavoro di backup abilitato seleziona questo guest.",
+      "sharedGroup": "{count} più dispositivo(i) nello stesso gruppo"
     },
     "profile": {
       "label": "Report",
@@ -5871,7 +5876,6 @@
       "area": "Area",
       "inventoryAnnex": "Inventory annex",
       "scopeTitle": "Scope of this report",
-      "scopeBody": "This report describes the Proxmox VE node named above, as observed from the node itself at the time stated. It does not cover the interior of the guests beyond what they declare, network equipment outside the host, physical infrastructure, or any dependency not visible from this node. Findings marked as not determined were not measured and are not evidence of absence.",
       "building": "Composizione del rapporto…",
       "node": "Nodo",
       "profile": "Profilo",
@@ -6020,11 +6024,12 @@
       "structureSubtitle": "Com'è costruito e configurato {node}",
       "postureTitle": "Posture",
       "posture": {
-        "security": "Host exposure and access.",
-        "backup": "Guest protection and whether it is real.",
-        "capacity": "Room to grow and the wear on the disks."
+        "security": "Esposizione e accesso host.",
+        "backup": "Protezione degli ospiti e se è reale.",
+        "capacity": "Stanza per crescere e l'usura sui dischi."
       },
-      "scopeReadOnly": "La valutazione esamina le impostazioni e l'integrità dell'host. Può scrivere report e log; i controlli dello stato di avvio possono montare temporaneamente partizioni di sistema EFI."
+      "scopeReadOnly": "La valutazione esamina le impostazioni e l'integrità dell'host. Può scrivere report e log; i controlli dello stato di avvio possono montare temporaneamente partizioni di sistema EFI.",
+      "scopeBody": "Questo rapporto descrive il nodo VE Proxmox sopra indicato, come osservato dal nodo stesso al momento indicato. Non copre l'interno degli ospiti al di là di quanto dichiarano, apparecchiature di rete al di fuori dell'host, infrastrutture fisiche, o qualsiasi dipendenza non visibile da questo nodo. I risultati contrassegnati come non determinati non sono stati misurati e non sono prove di assenza."
     },
     "results": "Risultati",
     "classifications": {
@@ -6178,15 +6183,19 @@
     "notApplicableScope": "Nulla nell'ambito esaminato a cui questo controllo si applichi.",
     "lynis": {
       "title": "Run Lynis",
-      "bodyNotRun": "Lynis is installed but has not been run yet. Running it now completes the security review, but the process can take a few minutes.",
-      "bodyStale": "The Lynis report is {days} days old. You can run it now to refresh the data (it takes a little longer) or continue with the existing report.",
       "withLynis": "Run with Lynis",
       "withoutLynis": "Run without Lynis",
-      "cancel": "Cancel"
+      "cancel": "Cancel",
+      "bodyNotRun": "Lynis è installato ma non è stato ancora eseguito. L'esecuzione ora completa la revisione di sicurezza, ma il processo può richiedere alcuni minuti.",
+      "bodyStale": "Il rapporto Lynis è {days} giorni. È possibile eseguire ora per aggiornare i dati (ci vuole un po 'di più) o continuare con il rapporto esistente."
     },
     "readOnlyNotice": "La valutazione esamina le impostazioni e l'integrità dell'host. Può scrivere report e log; i controlli dello stato di avvio possono montare temporaneamente partizioni di sistema EFI.",
     "noActionNeeded": "Niente da fare. Questo assegno ha trovato quello che si aspetta di trovare.",
-    "couldNotEvaluate": "Questo controllo non può essere valutato, quindi non segnala nulla in entrambi i casi. Le prove riportano ciò che non era in grado di leggere."
+    "couldNotEvaluate": "Questo controllo non può essere valutato, quindi non segnala nulla in entrambi i casi. Le prove riportano ciò che non era in grado di leggere.",
+    "neverRun": "Questo host non è stato ancora valutato.",
+    "noFindings": "Nessun risultato corrisponde al filtro corrente.",
+    "acceptedNotice": "{count} ha accettato i rischi registrati su questo host.",
+    "summaryFallback": "Il controllo non potrebbe essere valutato"
   },
   "runtime": {
     "notifications": {
diff --git a/AppImage/messages/pt/common.json b/AppImage/messages/pt/common.json
index 76d886c9..4527596c 100644
--- a/AppImage/messages/pt/common.json
+++ b/AppImage/messages/pt/common.json
@@ -1487,7 +1487,6 @@
       "containerNameLabel": "Nome do contêiner",
       "containerNamePlaceholder": "por exemplo, <seu-nome-do-contêiner>",
       "ociLabelKeyLabel": "Chave de rótulo OCI",
-      "ociLabelPlaceholder": "org.opencontainers.image.version",
       "pythonInterpreterLabel": "Caminho do interpretador Python",
       "pythonInterpreterPlaceholder": "por exemplo, /opt/<seu-app>/venv/bin/python",
       "pipDistLabel": "Nome da distribuição (pacote pip)",
@@ -1534,11 +1533,8 @@
       "portHttps": "https",
       "portLogoLabel": "URL do logotipo deste link (opcional)",
       "portLogoPlaceholder": "por exemplo, https://example.com/logo.webp",
-      "portCategoryPlaceholder": "Category for the Apps dashboard (optional)",
       "portCategoryNone": "No category",
       "portCategoryAddNew": "+ Add new category…",
-      "portCategoryCustomPlaceholder": "Type a category and press Enter (Esc to cancel)",
-      "portCustomUrlPlaceholder": "Custom URL (e.g. https://vault.example.com) — overrides IP:port",
       "removePortTooltip": "Remover porta",
       "detectMethodDpkg": "dpkg ·",
       "detectMethodApk": "APK ·",
@@ -1631,7 +1627,11 @@
       "notifyUpstreamLabel": "Notifique-me quando uma nova versão upstream estiver disponível",
       "notifyUpstreamHelp": "Envia `app_update_available` para os canais habilitados em Configurações → Notificações. Desligue se este aplicativo não puder ser atualizado em sua caixa.",
       "excludeFromBadgeLabel": "Excluir do contador de atualizações LXC",
-      "excludeFromBadgeHelp": "não conte este aplicativo no selo de atualizações agregadas no cartão de lista LXC.Útil quando você está fixado em uma versão específica propositalmente (requisito do rastreador, congelamento de compatibilidade).Não afeta o próprio estado da guia Aplicativo ou a notificação de saída."
+      "excludeFromBadgeHelp": "não conte este aplicativo no selo de atualizações agregadas no cartão de lista LXC.Útil quando você está fixado em uma versão específica propositalmente (requisito do rastreador, congelamento de compatibilidade).Não afeta o próprio estado da guia Aplicativo ou a notificação de saída.",
+      "ociLabelPlaceholder": "org.opencontainers.image.version",
+      "portCategoryPlaceholder": "Categoria para o painel de aplicativos (opcional)",
+      "portCategoryCustomPlaceholder": "Digite uma categoria e pressione Enter (Esc para cancelar)",
+      "portCustomUrlPlaceholder": "URL personalizada (por exemplo, https://vault.example.com) — substitui IP:port"
     },
     "statusFilter": {
       "ariaLabel": "Filtrar máquinas virtuais e contêineres",
@@ -2515,10 +2515,10 @@
       "scope": {
         "label": "Token permissions",
         "readOnly": "Read-only",
-        "readOnlyHint": "Reads metrics and status. Recommended for dashboards and integrations.",
         "fullAdmin": "Full admin",
-        "fullAdminHint": "Full control, like your own session.",
-        "fullAdminWarning": "A full-admin token can do everything you can: power off or reboot the host, run updates and open a terminal. Share it only with fully trusted integrations."
+        "readOnlyHint": "Lê métricas e status. Recomendado para painéis e integrações.",
+        "fullAdminHint": "Controle total, como a sua própria sessão.",
+        "fullAdminWarning": "Um token de administração completa pode fazer tudo que puder: desligar ou reiniciar o host, executar atualizações e abrir um terminal. Compartilhe-o apenas com integrações totalmente confiáveis."
       }
     },
     "firewall": {
@@ -3302,26 +3302,33 @@
     "gotIt": "Entendi!",
     "dontShowAgain": "Não mostrar novamente para esta versão",
     "currentFeatures": {
-      "appDetection": "Smarter app detection in the App tab: Docker is correctly promoted as the parent workload during cold start (Portainer/SearXNG no longer briefly show up as native apps), unregistered suggestions live in the startup cache, and 'Find applications' runs a fresh catalog-backed scan on demand.",
-      "dockerUpdates": "The Updates tab now covers Docker end-to-end: Docker Engine and per-image update tracking follow the same 24-hour rolling cycle as OS packages, with a 'Check now' action for on-demand digest comparison — no more waiting for the daily collector.",
-      "appCatalog": "New application detection catalog with over 380 tracked workloads, generated live from community-scripts across seven detector methods (file, binary, dpkg, apk, Python, Docker exec, Docker label). Primary and fallback detectors cover both new and historical LXC layouts.",
-      "pushover": "Pushover joins Telegram, Gotify, Discord, Email and Apprise as a native notification channel — user/API key, device and sound selectors, priority 0 for regular messages, optional priority 1 for CRITICAL events. Suggested by @benginx (#308).",
-      "appsDashboard": "New top-level Apps dashboard — a single launcher for every Web Link across the node. LXC-registered apps and user-defined Custom Web Links share the same grid with category badges, search, and one-click deep-links back to the guest modal.",
-      "lxcAppsUpdates": "App tab inside every LXC modal registers installed apps, captures weblinks and tracks upstream versions. Reworked Updates tab applies OS packages and app updates from a single button; Docker Engine and per-image tracking follow the same 24-hour cycle, with a 'Check now' action on demand.",
-      "multilingual": "The Monitor now speaks 8 languages: English, Spanish, German, French, Italian, Portuguese, Swedish and Slovak. Huge thanks to @vaso73 for building the i18n scaffolding that made this possible.",
-      "nvidiaMultiGpu": "NVIDIA driver lifecycle moves to per-BDF ownership so a multi-GPU host can pass one card to a VM and keep the other operational on the host or in LXCs, plus a kernel + branch + GPU-aware version picker (#298).",
-      "aiCustomEndpoint": "AI Assistant custom OpenAI endpoint — LiteLLM, LM Studio, LocalAI, vLLM, OmniRoute and any self-hosted proxy on private IPs, loopback or Docker networks are recognised when loading the model catalogue. The dropdown surfaces the server's error (or the underlying network reason) directly under the Load button (#325, reported by @jorgeffonte).",
-      "secureGatewayArch": "Secure Gateway wizard — the Alpine template download, local template selection and pct create all match the host's real architecture, so x86_64 hosts receive amd64 containers and arm64 hosts receive arm64 containers (#324, reported by @N0X4DD0).",
-      "atomicNotifications": "Notification events reserve their deduplication fingerprint atomically before AI processing and channel delivery, so concurrent collectors, completion callbacks or parallel Monitor processes cannot send the same event twice. The reservation is released when no channel succeeds, preserving retries.",
-      "borgSshPort": "Borg remote target — the Add Borg destination dialog and the shell TUI accept a custom SSH port. BORG_RSH, the auto key install flow and the capacity probe all honour it. Fully backwards compatible with existing entries created without an explicit port (suggested by @songochain in discussion #236).",
-      "githubToken": "Settings → GitHub API accepts an optional personal access token for release and tag checks when the anonymous quota is exhausted. The token is encrypted at rest and never returned to the browser; the rate-limit error is translated in every Monitor language (suggested by @SystemIdleProcess in discussion #306).",
-      "replicationContext": "Native Proxmox replication failure notifications resolve the replication job ID, affected VM/LXC ID and guest name; the exact error block from Proxmox is preserved as the reason, and each replication job deduplicates independently (reported by Ale R.).",
-      "auditAssessment": "Audit & Report — a new page that documents and assesses the node. The Assessment runs a catalogue of checks across security, backups, capacity, storage, network, hardware, guests and system, classifying each finding as critical, warning, observation or conformant and stating what it read rather than judging it.",
-      "changeJournal": "Change journal — a Changes view that lists exactly what ProxMenux modified on this host: every configuration file, package and service it touched, with the prior state of each, deduplicated to a current-state view that shows the host as it stands now rather than a log of every run.",
-      "auditReports": "Reports — a full audit plus focused Security review, Backup assurance and Capacity & wear reports, each opening on its own posture header, and a printable Inventory; all export to PDF. A security assessment asks before running Lynis so a run stays fast.",
-      "auditPolicyBaseline": "Policy and baseline — declare what the host is expected to be (backup requirements, firewall, root SSH login) so findings grade against it, mark a run as the reference, and see what changed since, with new, resolved and accepted findings kept apart.",
-      "groupedAppUpdates": "Grouped application update notifications — one complete message per scan instead of one per application, grouped by LXC with the installed and available versions.",
-      "adminTokenScope": "Administrative scope — opening a Monitor terminal and disabling authentication now require a full-admin token, so a read-only API token issued to a monitoring integration stays read-only (reported by @f3rs3n)."
+      "appDetection": "Detecção de aplicativos mais inteligente na aba App: Docker é corretamente promovido como a carga de trabalho pai durante o início frio (Portainer/SearXNG já não aparece brevemente como aplicativos nativos), sugestões não registradas ao vivo no cache de inicialização, e 'Find applications' executa uma nova varredura baseada em catálogo sob demanda.",
+      "dockerUpdates": "A página Atualizações agora cobre o Docker de ponta a ponta: Docker O rastreamento de atualização do motor e por imagem segue o mesmo ciclo de rolamento de 24 horas que os pacotes OS, com uma ação 'Check now' para comparação de digest sob demanda – sem mais esperar pelo coletor diário.",
+      "appCatalog": "Novo catálogo de detecção de aplicativos com mais de 380 cargas de trabalho rastreadas, geradas ao vivo a partir de scripts comunitários em sete métodos de detector (ficheiro, binário, dpkg, apk, Python, Docker exec, etiqueta Docker). Os detectores primários e de retorno cobrem layouts LXC novos e históricos.",
+      "pushover": "Pushover junta-se ao Telegram, Gotify, Discord, Email e Apprise como um canal de notificação nativo — chave de usuário/API, seletores de som e dispositivo, prioridade 0 para mensagens regulares, prioridade opcional 1 para eventos CRITICAIS. Sugerido por @benginx (# 308).",
+      "appsDashboard": "Novo painel de topo de Apps — um único lançador para cada Web Link em todo o nó. Aplicativos registrados em LXC e Web personalizada definida pelo usuário Links compartilham a mesma grade com crachás de categoria, pesquisa e links profundos de um clique de volta para o modal convidado.",
+      "lxcAppsUpdates": "A guia App dentro de cada LXC registra aplicativos instalados, captura weblinks e rastreia versões upstream. A guia Atualizações retrabalhadas aplica pacotes OS e atualizações de aplicativos a partir de um único botão; o motor Docker e o rastreamento por imagem seguem o mesmo ciclo de 24 horas, com uma ação 'Cheque agora' sob demanda.",
+      "multilingual": "O Monitor agora fala 8 línguas: inglês, espanhol, alemão, francês, italiano, português, sueco e eslovaco. Enormes graças a @vaso73 por construir o andaime i18n que tornou isso possível.",
+      "nvidiaMultiGpu": "O ciclo de vida do driver NVIDIA se move para a propriedade por BDF para que um host multi-GPU possa passar um cartão para um VM e manter o outro operacional no host ou em LXCs, além de um kernel + branch + GPU-aware version picker (#298).",
+      "aiCustomEndpoint": "AI Assistant custom OpenAI endpoint — LiteLLM, LM Studio, LocalAI, vLLM, OmniRoute e qualquer proxy self-hosted em IPs privados, loopback ou Docker redes são reconhecidas ao carregar o catálogo do modelo. A superfície dropdown do erro do servidor (ou a razão de rede subjacente) diretamente sob o botão Carregar (#325, relatado por @jorgeffonte).",
+      "secureGatewayArch": "Assistente de Gateway seguro — o download do modelo alpino, seleção de modelos local e pct create todos correspondem à arquitetura real do host, então os hosts x86 64 recebem containers amd64 e os hosts arm64 recebem containers arm64 (#324, reportados por @N0X4DD0).",
+      "atomicNotifications": "Eventos de notificação reservam sua impressão digital de deduplicação atomicamente antes do processamento de IA e entrega de canais, então coletores simultâneos, callbacks de conclusão ou processos de monitoramento paralelos não podem enviar o mesmo evento duas vezes. A reserva é liberada quando nenhum canal tem sucesso, preservando repetições.",
+      "borgSshPort": "Alvo remoto Borg — a janela Adicionar destino Borg e o shell TUI aceitam uma porta SSH personalizada. BORG RSH, o fluxo de instalação da chave automática e a sonda de capacidade todos honram. Totalmente compatível com entradas existentes criadas sem uma porta explícita (sugerida por @songochain na discussão #236).",
+      "githubToken": "Configurações → GitHub API aceita um token de acesso pessoal opcional para liberação e verificação de tags quando a quota anônima está esgotada. O token é criptografado em repouso e nunca retorna ao navegador; o erro de limite de taxa é traduzido em cada idioma Monitor (sugerido por @SystemIdleProcess em discussão #306).",
+      "replicationContext": "As notificações de falha de replicação nativa do Proxmox resolvem o ID do trabalho de replicação, afeta o ID do VM/LXC e o nome do convidado; o bloco de erro exato do Proxmox é preservado como razão, e cada tarefa de replicação deduplica-se independentemente (referido por Ale R.).",
+      "auditAssessment": "Auditoria & Relatório — uma nova página que documenta e avalia o nó. A Avaliação realiza um catálogo de verificações em segurança, backups, capacidade, armazenamento, rede, hardware, convidados e sistema, classificando cada achado como crítico, alerta, observação ou conforme e declarando o que leu em vez de julgá-lo.",
+      "changeJournal": "Change journal — uma visão de mudanças que lista exatamente o que ProxMenux modificou nesta máquina: cada arquivo de configuração, pacote e serviço que tocou, com o estado anterior de cada um, deduplicado para uma visão de estado atual que mostra o host como ele está agora em vez de um log de cada execução.",
+      "auditReports": "Relatórios – uma auditoria completa mais revisão de segurança focada, garantia de backup e relatórios de capacidade e desgaste, cada abertura em seu próprio cabeçalho postura, e um Inventário imprimível; todas as exportações para PDF. Uma avaliação de segurança pede antes de executar Lynis para que uma corrida seja rápida.",
+      "auditPolicyBaseline": "Política e linha de base — declarar o que o host deve ser (requisitos de backup, firewall, login do root SSH) para que as descobertas classem contra ele, marque uma corrida como referência e veja o que mudou desde, com novas descobertas resolvidas e aceitas mantidas separadas.",
+      "groupedAppUpdates": "Notificações de atualização de aplicativos agrupadas — uma mensagem completa por digitalização em vez de uma por aplicação, agrupadas por LXC com as versões instaladas e disponíveis.",
+      "adminTokenScope": "Âmbito administrativo — abrir um terminal Monitor e desativar a autenticação agora requer um token de administração completa, então um token API somente para leitura emitido para uma integração de monitoramento permanece somente para leitura (referido por @f3rs3n).",
+      "ociAppTab": "Contentores OCI no separador App — um contentor instalado pelo OCI manager Apps é reconhecido a partir do seu registo de instalação: a aplicação e a sua imagem, uma nova imagem detetada por digest e uma ligação ao repositório da imagem.",
+      "ociUpdatesTab": "Atualizações de contentores OCI — Atualizar e Recriar abrem o mesmo percurso do menu OCI, o backup feito antes da atualização pode ser mantido num armazenamento de backups e a imagem pode ser atualizada de forma agendada.",
+      "ociLogsTab": "Separador Logs para contentores OCI — a saída da consola da aplicação, guardada no host e acompanhada em direto, com filtro e transferência. A consola do Proxmox destes contentores abre uma shell.",
+      "appsUpdateShortcut": "O ícone de atualização da página Apps abre o contentor diretamente no seu separador Atualizações.",
+      "webhookHttps": "As notificações do Proxmox chegam ao Monitor com HTTPS ativo — são entregues num endereço apenas local e já não falham por um erro de certificado.",
+      "persistentLogs": "Uma rajada de erros nos logs que terminou já não é apresentada como persistente: um padrão tem de continuar a aparecer durante 15 minutos, e o seu aviso fecha-se sozinho (reportado por @Joshua1264).",
+      "mountsLanAddress": "Os pontos de montagem em LVM-thin e outros armazenamentos em bloco mostram a sua utilização, e as aplicações com vários contentores abrem no seu endereço LAN."
     }
   },
   "network": {
@@ -5027,23 +5034,20 @@
     "uncategorized": "Uncategorized",
     "openAriaLabel": "Open {name} in a new tab",
     "openGuestAriaLabel": "Abrir {name} ({type} {id})",
-    "emptyTitle": "No apps with a web link yet.",
-    "emptyHint": "Register a Web Link for any app (App tab of a CT) to see it here.",
     "customLinkAdd": "Add link",
     "editModeToggle": "Edit",
     "editModeDone": "Done",
     "customLinkNewTitle": "New web link",
     "customLinkEditTitle": "Edit web link",
     "customLinkEditAria": "Editar o link personalizado {name}",
+    "openUpdatesAria": "Abrir o separador Atualizações de {name}",
+    "openUpdatesTitle": "Atualização disponível — abrir o separador Atualizações",
     "customLinkName": "Name",
     "customLinkNamePlaceholder": "e.g. My app",
     "customLinkUrl": "URL",
     "customLinkLogo": "Logo URL (optional)",
-    "customLinkLogoPlaceholder": "e.g., https://example.com/logo.webp",
     "customLinkCategory": "Category (optional)",
     "customLinkBinding": "Bound to",
-    "customLinkBindingNone": "Not bound to any guest",
-    "customLinkBindingHelp": "Bind this link to a VM or CT to add its ID + name to the card and jump to the guest with one click.",
     "customLinkSave": "Save",
     "customLinkCreate": "Create",
     "customLinkCancel": "Cancel",
@@ -5079,7 +5083,12 @@
       "remoteAccessVpn": "Remote Access & VPN",
       "webserversProxies": "Webservers & Proxies",
       "zigbeeZwaveMatter": "ZigBee, Z-Wave & Matter"
-    }
+    },
+    "emptyTitle": "Nenhum aplicativo com um link web ainda.",
+    "emptyHint": "Registre um Web Link para qualquer aplicativo (App tab de um CT) para vê-lo aqui.",
+    "customLinkLogoPlaceholder": "Por exemplo, https://exemplo.com/logo.webp",
+    "customLinkBindingNone": "Não está ligado a nenhum hóspede.",
+    "customLinkBindingHelp": "Ligar este link a um VM ou CT para adicionar o seu ID + nome ao cartão e saltar para o hóspede com um clique."
   },
   "audit": {
     "presentation": {
@@ -5234,13 +5243,10 @@
     "loading": "Loading assessment…",
     "run": "Run assessment",
     "running": "Assessing…",
-    "neverRun": "This host has not been assessed yet.",
     "lastRun": "Last assessed on {when}",
     "stale": "{days} days ago",
     "unverifiedChecks": "Não obtidas: {checks}. Cada uma diz na sua evidência o que não conseguiu ler.",
-    "noFindings": "No findings match the current filter.",
     "affectedCount": "{count} affected",
-    "acceptedNotice": "{count} accepted risk(s) recorded on this host.",
     "reviewOn": "Rever em: {when}",
     "reviewDue": "A rever — a decisão continua em vigor",
     "reviewDueNotice": "{count} decisão(ões) aceite(s) aguardam revisão.",
@@ -5272,7 +5278,7 @@
       "sources": "Fontes e datas de coleta"
     },
     "errors": {
-      "runFailed": "The assessment could not be started."
+      "runFailed": "A avaliação não pôde ser iniciada."
     },
     "checks": {
       "backup": {
@@ -5285,7 +5291,7 @@
             "uncovered": "{count} de {total} convidados não são selecionados por nenhuma tarefa de backup ativa",
             "excludedData": "Há {count} exclusões de discos ou montagens para revisar",
             "uncoveredExpected": "{required} convidados declarados como necessitando backup não são selecionados por nenhuma tarefa ativa",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           },
           "nextStep": {
             "noJobs": "Crie uma tarefa de backup neste nó e selecione os convidados segurando dados que você não gostaria de reconstruir à mão. Uma tarefa que existe mas está desactivada não seleciona nada.",
@@ -5300,10 +5306,10 @@
           "rationale": "Idade: tempo decorrido desde a última cópia armazenada. Limite utilizado: idade de referência com a qual essa cópia é comparada.",
           "summary": {
             "recent": "As {total} verificações de máquina/destino cumprem o critério de antiguidade indicado",
-            "stale": "{count} of {total} guests have no backup from the last 30 days",
-            "noBackups": "No stored backup matches a guest on this node",
             "attention": "{count} de {total} verificações de máquina/destino requerem revisão",
-            "evaluationFailed": "The check could not be evaluated"
+            "stale": "{count} dos hóspedes do {total} não têm backup dos últimos 30 dias",
+            "noBackups": "Nenhuma cópia de segurança armazenada corresponde a um convidado neste nó",
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           },
           "nextStep": {
             "stale": "Descubra por que o trabalho parou de produzir cópias para esses hóspedes: ele pode ter sido desativado, sua programação pode nunca disparar, ou suas corridas podem estar falhando. A verificação de resultados de execução relata como cada trabalho terminou pela última vez.",
@@ -5317,10 +5323,10 @@
           "rationale": "A retenção tal como o Proxmox a resolve: definição da tarefa, depois do armazenamento, depois o valor por omissão do nó. A retenção aplicada por um servidor de backup não é legível a partir deste nó.",
           "summary": {
             "allDefined": "As {total} tarefas resolvem uma definição de retenção",
-            "missing": "{count} of {total} enabled job(s) declare no retention",
             "notDeclared": "{count} de {total} tarefas guardam todas as cópias: não têm retenção declarada",
             "onServer": "{count} de {total} tarefas escrevem num servidor de backup, que as poda com as suas próprias tarefas",
-            "evaluationFailed": "The check could not be evaluated"
+            "missing": "{count} do( s) trabalho( s) habilitado( s) {total} declaram não haver retenção",
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           },
           "nextStep": {
             "missing": "Defina uma retenção nesses trabalhos, ou no armazenamento para o qual eles escrevem. Proxmox toma a configuração do trabalho primeiro, depois o armazenamento, depois o padrão do nó.",
@@ -5383,36 +5389,36 @@
           "summary": {
             "none": "Nada solicitou um reinício",
             "pending": "{count} elementos estão instalados e aguardam um reinício",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         },
         "enterprise_repo_without_subscription": {
           "title": "Enterprise repository",
           "rationale": "Referências a `enterprise.proxmox.com` em `/etc/apt/sources.list` e `sources.list.d`, face ao estado devolvido por `pvesubscription get`.",
           "summary": {
-            "notEnabled": "The enterprise repository is not enabled",
-            "subscribed": "The enterprise repository is backed by a subscription",
-            "unsubscribed": "The enterprise repository is enabled without an active subscription",
-            "evaluationFailed": "The check could not be evaluated"
+            "notEnabled": "O repositório da empresa não está habilitado",
+            "subscribed": "O repositório da empresa é suportado por uma assinatura",
+            "unsubscribed": "O repositório corporativo está habilitado sem uma assinatura ativa",
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         },
         "memory_overcommit": {
           "title": "Memory allocation",
           "rationale": "O teto `memory` de cada configuração de convidado face a MemTotal, com os convidados em execução contados à parte. Os contentores consomem até esse limite; as máquinas virtuais sem ballooning reservam-no.",
           "summary": {
-            "withinRatio": "Guests are allocated {percent}% of host memory",
-            "aboveRatio": "Guests are allocated {percent}% of host memory",
-            "evaluationFailed": "The check could not be evaluated"
+            "withinRatio": "Os hóspedes recebem {percent}% da memória da máquina",
+            "aboveRatio": "Os hóspedes recebem {percent}% da memória da máquina",
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         },
         "time_synchronisation": {
           "title": "Time synchronisation",
           "rationale": "NTP e NTPSynchronized tal como o `timedatectl` os reporta. A pertença ao cluster, a validação de certificados e a ordem dos registos dependem de relógios concordantes. Outro mecanismo pode estar a disciplinar o relógio.",
           "summary": {
-            "synchronised": "The clock is synchronised with a time source",
             "disabled": "Time synchronisation is disabled",
-            "notSynchronised": "Time synchronisation is enabled but the clock is not synchronised",
-            "evaluationFailed": "The check could not be evaluated"
+            "synchronised": "O relógio está sincronizado com uma fonte de tempo",
+            "notSynchronised": "A sincronização do tempo está activa mas o relógio não está sincronizado",
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         },
         "kernel_current": {
@@ -5420,21 +5426,21 @@
           "rationale": "O kernel em execução face àquele que o anfitrião arrancaria a seguir, conforme o `proxmox-boot-tool` o reporta. Um kernel mais recente apenas instalado pode estar retido de propósito; uma diferença após reiniciar indica um arranque que não vingou.",
           "summary": {
             "current": "O kernel em execução {version} é o que o anfitrião arrancaria a seguir",
-            "newerAvailable": "The host runs {running} while {newest} is installed",
             "newerSelected": "O anfitrião executa {running} e arrancaria {selected} no próximo reinício",
             "wouldDowngrade": "O anfitrião executa {running} mas arrancaria o mais antigo {selected} no próximo reinício",
             "bootTargetUnknown": "O anfitrião executa {version}; não foi possível ler o kernel escolhido para o próximo arranque",
-            "evaluationFailed": "The check could not be evaluated"
+            "newerAvailable": "A máquina executa o {running} enquanto o {newest} está instalado",
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         },
         "security_updates": {
           "title": "Security updates",
           "rationale": "Pacotes pendentes cuja origem é um repositório de segurança, a partir de um `apt-get upgrade` simulado. O número reflete o que o apt reporta, não a gravidade do que cada pacote corrige.",
           "summary": {
-            "none": "No package updates are pending",
-            "noSecurity": "{total} update(s) pending, none from a security repository",
-            "pending": "{count} of {total} pending update(s) come from a security repository",
-            "evaluationFailed": "The check could not be evaluated"
+            "none": "Nenhuma atualização do pacote está pendente",
+            "noSecurity": "Atualização do {total} pendente, nenhuma de um repositório de segurança",
+            "pending": "O {count} do {total} ainda pendentes é proveniente de um repositório de segurança",
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         },
         "journal_size": {
@@ -5442,10 +5448,10 @@
           "rationale": "O journal em disco face ao limite que se lhe aplica: SystemMaxUse quando está definido e, caso contrário, o valor por omissão do journald, um décimo do sistema de ficheiros onde reside.",
           "summary": {
             "bounded": "O journal ocupa {size}, dentro do seu limite efetivo",
-            "large": "The journal holds {size} on disk",
             "nearCap": "O journal ocupa {size} e está a {percent}% do seu limite efetivo",
             "capUnknown": "O journal ocupa {size}; não foi possível determinar o seu limite efetivo",
-            "evaluationFailed": "The check could not be evaluated"
+            "large": "O diário contém {size} no disco",
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         },
         "swap_configured": {
@@ -5454,7 +5460,7 @@
           "summary": {
             "active": "{size} of swap is active",
             "none": "No swap area is active",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         },
         "filesystem_capacity": {
@@ -5500,7 +5506,7 @@
           "summary": {
             "synchronised": "As {total} partições de arranque levam os mesmos kernels",
             "attention": "{count} de {total} partições de arranque requerem revisão",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           },
           "rationale": "As partições do sistema EFI proxmox-boot-tool reportam e os kernels que cada uma carrega. proxmox-boot-tool status pode montar temporariamente partições do sistema EFI; nenhuma inicialização é tentada."
         },
@@ -5510,7 +5516,7 @@
           "summary": {
             "allRunning": "Os {total} serviços essenciais estão ativos e nenhuma unidade falhou",
             "attention": "{count} constatação(ões) entre as unidades",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         },
         "ha_state": {
@@ -5519,7 +5525,7 @@
           "summary": {
             "managed": "Os {total} serviços geridos estão num estado assente em {nodes} nó(s)",
             "attention": "{count} constatação(ões) sobre {total} serviço(s) gerido(s)",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         }
       },
@@ -5528,27 +5534,27 @@
           "title": "Container privileges",
           "rationale": "A definição `unprivileged` de cada configuração de contentor. A sua ausência significa que o contentor partilha o espaço de nomes de utilizador do anfitrião, algo que certas cargas necessitam.",
           "summary": {
-            "allUnprivileged": "All {total} containers are unprivileged",
             "privileged": "{count} of {total} containers run privileged",
-            "evaluationFailed": "The check could not be evaluated"
+            "allUnprivileged": "Todos os recipientes {total} não são privilegiados",
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         },
         "qemu_without_agent": {
-          "title": "Guest agent on virtual machines",
           "rationale": "A definição `agent` na configuração de cada máquina virtual. A definição indica que o agente está declarado, não que responda.",
           "summary": {
-            "allHaveAgent": "All {total} virtual machines declare the guest agent",
-            "missingAgent": "{count} of {total} virtual machines do not declare the guest agent",
-            "evaluationFailed": "The check could not be evaluated"
-          }
+            "allHaveAgent": "Todas as máquinas virtuais {total} declaram o agente convidado",
+            "missingAgent": "{count} das máquinas virtuais {total} não declaram o agente convidado",
+            "evaluationFailed": "A verificação não pôde ser avaliada"
+          },
+          "title": "Agente convidado em máquinas virtuais"
         },
         "autostart": {
           "title": "Automatic start",
           "rationale": "A definição `onboot` de cada convidado, excluindo modelos e convidados geridos por HA. Se se espera que um convidado volte por si só, indica-o a política declarada.",
           "summary": {
-            "allAutostart": "All {total} guests start with the host",
-            "notAutostart": "{count} of {total} guests do not start with the host",
-            "evaluationFailed": "The check could not be evaluated"
+            "allAutostart": "Todos os hóspedes do {total} começam com o anfitrião",
+            "notAutostart": "{count} dos hóspedes do {total} não começam com a máquina",
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         },
         "stuck_snapshots": {
@@ -5556,28 +5562,28 @@
           "rationale": "Estado e antiguidade dos snapshots e tarefas ativas. Uma operação recente ou sem data verificável não é considerada interrompida.",
           "summary": {
             "noSnapshots": "No guest holds snapshots",
-            "allComplete": "The {total} snapshot(s) are complete",
-            "stuck": "{count} of {total} snapshot(s) were left mid-operation",
-            "evaluationFailed": "The check could not be evaluated"
+            "allComplete": "Os instantâneos {total} estão completos",
+            "stuck": "{count} dos instantâneos {total} foram deixados no meio da operação",
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         },
         "cpu_host_type": {
           "title": "Virtual CPU model",
           "rationale": "O valor `cpu` de cada máquina virtual. `host` expõe o conjunto de instruções do processador físico, o que limita os nós para onde o convidado pode migrar. A incompatibilidade com um destino concreto não se determina aqui.",
           "summary": {
-            "none": "None of the {total} virtual machines is pinned to the host processor",
-            "pinned": "{count} of {total} virtual machines are pinned to the host processor",
-            "evaluationFailed": "The check could not be evaluated"
+            "none": "Nenhuma das máquinas virtuais {total} está presa ao processador host",
+            "pinned": "{count} de máquinas virtuais {total} são fixados ao processador host",
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         },
         "replication_state": {
           "title": "Replication",
           "rationale": "Tarefas de replicação a partir da API: número de falhas, último erro, última sincronização e o calendário que cada tarefa declara. As tarefas em pausa são assinaladas como tal.",
           "summary": {
-            "healthy": "The {total} replication job(s) report no error",
-            "failing": "{count} of {total} replication job(s) report an error",
-            "statusUnavailable": "Replication jobs are defined but their status could not be read",
-            "evaluationFailed": "The check could not be evaluated"
+            "healthy": "A tarefa de replicação do {total} não reporta nenhum erro",
+            "failing": "{count} das tarefas de replicação do {total} reportam um erro",
+            "statusUnavailable": "As tarefas de replicação estão definidas mas o seu estado não pôde ser lido",
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         }
       },
@@ -5589,39 +5595,39 @@
             "bothEnabled": "A ativação da firewall está configurada ao nível do centro de dados e do nó",
             "datacenterOff": "A firewall está desativada ao nível do centro de dados, pelo que as regras do nó não são aplicadas",
             "nodeOff": "A firewall está ativada ao nível do centro de dados, mas não neste nó",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         },
         "lynis_warnings": {
           "title": "Lynis warnings",
           "rationale": "Avisos da última auditoria do Lynis, cada um com o seu identificador de teste, e a idade dessa auditoria. Só é executada uma auditoria se o Lynis estiver instalado e não existir relatório completo. As sugestões não são incluídas.",
           "summary": {
-            "none": "The last Lynis audit recorded no warnings",
-            "found": "The last Lynis audit recorded {count} warning(s)",
-            "incomplete": "The Lynis report is incomplete",
-            "evaluationFailed": "The check could not be evaluated",
             "noneStale": "A última auditoria do Lynis não registou avisos, e o seu relatório tem {days} dia(s)",
-            "foundStale": "A última auditoria do Lynis registou {count} aviso(s), e o seu relatório tem {days} dia(s)"
+            "foundStale": "A última auditoria do Lynis registou {count} aviso(s), e o seu relatório tem {days} dia(s)",
+            "none": "A última auditoria do Lynis não registrou avisos",
+            "found": "A última auditoria de Lynis registrou avisos {count}",
+            "incomplete": "O relatório Lynis está incompleto.",
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         },
         "certificate_expiry": {
           "title": "Certificate validity",
           "rationale": "A data de validade do certificado que o pveproxy serve a partir de /etc/pve/local. Um certificado próprio tem precedência sobre o que o Proxmox gera.",
           "summary": {
-            "valid": "The certificate is valid for {days} more day(s)",
-            "expiring": "The certificate expires in {days} day(s)",
-            "expired": "The certificate expired {days} day(s) ago",
-            "evaluationFailed": "The check could not be evaluated"
+            "valid": "O certificado é válido para {days} mais dias",
+            "expiring": "O certificado expira em {days} dia(s)",
+            "expired": "O certificado expirou {days} dias atrás",
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         },
         "ssh_root_login": {
           "title": "SSH root access",
           "rationale": "PermitRootLogin na configuração efetiva de `sshd -T`, com os métodos de autenticação com que se combina. O Proxmox é entregue com `yes`, que aceita palavra-passe.",
           "summary": {
-            "password": "Root may sign in over SSH with a password",
-            "keyOnly": "Root may sign in over SSH with a key only",
-            "denied": "Root may not sign in over SSH",
-            "evaluationFailed": "The check could not be evaluated"
+            "password": "Raiz pode entrar sobre SSH com uma senha",
+            "keyOnly": "Raiz pode entrar sobre SSH com uma chave apenas",
+            "denied": "A raiz não pode entrar sobre o SSH",
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         }
       },
@@ -5630,9 +5636,9 @@
           "title": "Volume assignment",
           "rationale": "Volumes de convidado no armazenamento local face às referências nas configurações atuais, pendentes e de snapshots. Backups, ISOs e modelos ficam fora da comparação. Um volume sem referência é um candidato a revisão.",
           "summary": {
-            "none": "No orphaned volumes were found",
             "found": "Há {count} volumes sem referência nas configurações examinadas",
-            "evaluationFailed": "The check could not be evaluated"
+            "none": "Não foram encontrados volumes órfãos",
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         },
         "zfs_arc_max": {
@@ -5640,21 +5646,21 @@
           "rationale": "Valores efetivos de c_min, c_max e tamanho do ARC, o parâmetro de módulo carregado e as definições persistentes em /etc/modprobe.d. Um valor configurado a zero seleciona o valor por omissão do módulo; o ARC é um teto e a memória que ocupa é recuperável.",
           "summary": {
             "bounded": "O limite do ARC é {percent}% da memória do anfitrião, e a memória que ocupa é recuperável",
-            "high": "The ARC may use {percent}% of host memory",
-            "unset": "The ARC has no explicit limit set",
             "conflicting": "{count} definições do ARC não coincidem entre si",
             "pending": "Uma definição persistente do ARC difere do valor que o módulo em execução transporta",
-            "evaluationFailed": "The check could not be evaluated"
+            "high": "O ARC pode usar {percent}% da memória da máquina",
+            "unset": "O ARC não tem limite explícito definido",
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         },
         "zfs_scrub_age": {
           "title": "ZFS scrub",
           "rationale": "O último scrub concluído que o `zpool status` regista em cada pool. Um resilver não é um scrub. Uma pool criada há pouco ainda não teve ocasião de executar um.",
           "summary": {
-            "recent": "The {total} pool(s) were scrubbed within the last 35 days",
-            "overdue": "{count} of {total} pool(s) have not been scrubbed in 35 days",
             "neverScrubbed": "{count} pool(s) record no scrub",
-            "evaluationFailed": "The check could not be evaluated"
+            "recent": "As piscinas {total} foram esfregadas nos últimos 35 dias",
+            "overdue": "{count} da(s) piscina(s) {total} não foram esfregadas em 35 dias",
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         },
         "thin_pool_overprovisioning": {
@@ -5664,7 +5670,7 @@
             "withinRatio": "Os {total} thin pools encontram-se abaixo dos limites de revisão aplicados",
             "aboveRatio": "{count} de {total} thin pools distribuem mais capacidade do que possuem",
             "pressure": "{pressure} de {total} thin pools estão perto de encher os seus dados ou metadados",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         },
         "connected_storage": {
@@ -5673,7 +5679,7 @@
           "summary": {
             "available": "O PVE indica que os {total} armazenamentos estão disponíveis; os componentes internos remotos e o acesso de escrita não foram testados",
             "attention": "{count} de {total} armazenamentos requerem revisão",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         },
         "pool_integrity": {
@@ -5691,7 +5697,7 @@
           "summary": {
             "healthy": "O Ceph reporta HEALTH_OK",
             "degraded": "O Ceph reporta {state}, com {count} verificação(ões) nomeada(s)",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         },
         "array_integrity": {
@@ -5700,7 +5706,7 @@
           "summary": {
             "intact": "Os {total} arrays e mapas mantêm a sua redundância",
             "degraded": "{count} de {total} arrays ou mapas estão sem ela",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         }
       },
@@ -5712,7 +5718,7 @@
             "withinLife": "As {total} leituras de discos não excedem o limiar indicativo de cinco anos",
             "pastLife": "{count} de {total} leituras de discos excedem cinco anos de funcionamento",
             "noReadings": "Nenhum disco expõe contadores SMART utilizáveis ({skipped} sem leituras)",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         },
         "disk_errors": {
@@ -5729,23 +5735,22 @@
           "title": "Bond members",
           "rationale": "O estado MII de cada membro do bond a partir de /proc/net/bonding e quantas ligações restam. Em active-backup, um membro de reserva figura como ativo e não transporta tráfego.",
           "summary": {
-            "allUp": "All members of the {total} bond(s) are up",
-            "membersDown": "{count} bond member(s) are not up",
-            "evaluationFailed": "The check could not be evaluated"
+            "allUp": "Todos os membros da(s) ligação(ões) {total} estão em alta",
+            "membersDown": "O( s) membro( s) de ligação do {count} não está( s) em espera",
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         },
         "bridge_without_ports": {
           "title": "Bridge ports",
           "rationale": "A configuração de portas de cada bridge. Uma bridge sem porta física serve uma rede interna ou encaminhada.",
           "summary": {
-            "allConnected": "The {total} bridge(s) carry a port",
             "isolated": "{count} of {total} bridge(s) carry no port",
-            "evaluationFailed": "The check could not be evaluated"
+            "allConnected": "A(s) ponte(s) {total} carrega(m) uma porta",
+            "evaluationFailed": "A verificação não pôde ser avaliada"
           }
         }
       }
     },
-    "summaryFallback": "The check could not be evaluated",
     "acceptRisk": {
       "action": "Aceitar risco",
       "revoke": "Voltar a ativo",
@@ -5779,17 +5784,15 @@
       "OK": "OK"
     },
     "viewSwitch": {
-      "ariaLabel": "Switch between assessment and inventory",
       "assessment": "Assessment",
       "inventory": "Inventory",
       "policy": "Política",
-      "changes": "Alterações"
+      "changes": "Alterações",
+      "ariaLabel": "Mudança entre avaliação e inventário"
     },
     "inventory": {
       "loading": "Loading inventory…",
-      "failed": "The inventory could not be composed.",
       "collectedAt": "Composed on {when}",
-      "unavailable": "Not read in this inventory",
       "unresolved": "path not resolved",
       "noUplink": "no uplink",
       "identity": "Node identity",
@@ -5832,12 +5835,10 @@
       "protection": "Backup",
       "passthrough": "Passthrough",
       "noBackup": "No backup",
-      "noBackupDetail": "No enabled backup job selects this guest.",
       "applications": "Applications",
       "versionUnknown": "version not detected",
       "passthroughTitle": "PCI passthrough",
       "iommuGroup": "IOMMU group {group}",
-      "sharedGroup": "{count} more device(s) in the same group",
       "proxmenux": "ProxMenux optimizations",
       "latency": "Latência de rede",
       "subscriptionStatus": {
@@ -5848,7 +5849,11 @@
         "suspended": "Suspensa",
         "new": "Aguarda ativação",
         "unknown": "Desconhecido"
-      }
+      },
+      "failed": "O inventário não pôde ser composto.",
+      "unavailable": "Não lido neste inventário",
+      "noBackupDetail": "Nenhuma tarefa de backup ativada seleciona este convidado.",
+      "sharedGroup": "{count} mais dispositivo( s) no mesmo grupo"
     },
     "profile": {
       "label": "Report",
@@ -5871,7 +5876,6 @@
       "area": "Area",
       "inventoryAnnex": "Inventory annex",
       "scopeTitle": "Scope of this report",
-      "scopeBody": "This report describes the Proxmox VE node named above, as observed from the node itself at the time stated. It does not cover the interior of the guests beyond what they declare, network equipment outside the host, physical infrastructure, or any dependency not visible from this node. Findings marked as not determined were not measured and are not evidence of absence.",
       "building": "A compor o relatório…",
       "node": "Nó",
       "profile": "Perfil",
@@ -6020,11 +6024,12 @@
       "structureSubtitle": "Como {node} está construído e configurado",
       "postureTitle": "Posture",
       "posture": {
-        "security": "Host exposure and access.",
-        "backup": "Guest protection and whether it is real.",
-        "capacity": "Room to grow and the wear on the disks."
+        "security": "Exposição ao hospedeiro e acesso.",
+        "backup": "Proteção de hóspedes e se é real.",
+        "capacity": "Espaço para crescer e o desgaste nos discos."
       },
-      "scopeReadOnly": "A avaliação inspeciona as configurações e a integridade do host. Pode escrever relatórios e logs; verificações de status de inicialização podem montar temporariamente partições do sistema EFI."
+      "scopeReadOnly": "A avaliação inspeciona as configurações e a integridade do host. Pode escrever relatórios e logs; verificações de status de inicialização podem montar temporariamente partições do sistema EFI.",
+      "scopeBody": "Este relatório descreve o nó Proxmox VE denominado acima, como observado a partir do próprio nó no momento indicado. Não cobre o interior dos hóspedes além do que eles declaram, equipamento de rede fora do host, infraestrutura física, ou qualquer dependência não visível deste nó. Os achados marcados como não determinados não foram medidos e não são evidência de ausência."
     },
     "results": "Resultados",
     "classifications": {
@@ -6178,15 +6183,19 @@
     "notApplicableScope": "Nada no âmbito examinado a que esta verificação se aplique.",
     "lynis": {
       "title": "Run Lynis",
-      "bodyNotRun": "Lynis is installed but has not been run yet. Running it now completes the security review, but the process can take a few minutes.",
-      "bodyStale": "The Lynis report is {days} days old. You can run it now to refresh the data (it takes a little longer) or continue with the existing report.",
       "withLynis": "Run with Lynis",
       "withoutLynis": "Run without Lynis",
-      "cancel": "Cancel"
+      "cancel": "Cancel",
+      "bodyNotRun": "Lynis está instalado, mas ainda não foi executado. Executá-lo agora completa a revisão de segurança, mas o processo pode demorar alguns minutos.",
+      "bodyStale": "O relatório Lynis tem {days} dias. Você pode executá-lo agora para atualizar os dados (demora um pouco mais) ou continuar com o relatório existente."
     },
     "readOnlyNotice": "A avaliação inspeciona as configurações e a integridade do host. Pode escrever relatórios e logs; verificações de status de inicialização podem montar temporariamente partições do sistema EFI.",
     "noActionNeeded": "Nada para fazer. Este cheque encontrou o que espera encontrar.",
-    "couldNotEvaluate": "Esta verificação não pôde ser avaliada, por isso não relata nada de qualquer forma. As provas registram o que não conseguiu ler."
+    "couldNotEvaluate": "Esta verificação não pôde ser avaliada, por isso não relata nada de qualquer forma. As provas registram o que não conseguiu ler.",
+    "neverRun": "Este hospedeiro ainda não foi avaliado.",
+    "noFindings": "Nenhuma descoberta corresponde ao filtro actual.",
+    "acceptedNotice": "O {count} aceitou o(s) risco(s) registado(s) nesta máquina.",
+    "summaryFallback": "A verificação não pôde ser avaliada"
   },
   "runtime": {
     "notifications": {
diff --git a/AppImage/messages/sk/common.json b/AppImage/messages/sk/common.json
index 75738276..cff2d754 100644
--- a/AppImage/messages/sk/common.json
+++ b/AppImage/messages/sk/common.json
@@ -1508,7 +1508,6 @@
       "containerNameLabel": "Názov kontajnera",
       "containerNamePlaceholder": "napr. <your-container-name>",
       "ociLabelKeyLabel": "Kľúč OCI labelu",
-      "ociLabelPlaceholder": "org.opencontainers.image.version",
       "pythonInterpreterLabel": "Cesta k Python interpreteru",
       "pythonInterpreterPlaceholder": "napr. /opt/<your-app>/venv/bin/python",
       "pipDistLabel": "Názov distribúcie (pip balík)",
@@ -1652,7 +1651,8 @@
       "notifyUpstreamLabel": "Upozorniť ma, keď bude k dispozícii nová upstream verzia",
       "notifyUpstreamHelp": "Odošle `app_update_available` do kanálov povolených v Nastaveniach → Upozornenia. Vypnite, ak túto aplikáciu nie je možné aktualizovať na vašom boxe.",
       "excludeFromBadgeLabel": "Vylúčiť z počítadla aktualizácií LXC",
-      "excludeFromBadgeHelp": "Nezapočítajte túto aplikáciu do odznaku súhrnných aktualizácií na karte zoznamu LXC.Užitočné, keď ste úmyselne pripnutý ku konkrétnej verzii (požiadavka na sledovanie, zmrazenie kompatibility).Nemá vplyv na vlastný stav karty Aplikácia ani na odchádzajúce upozornenie."
+      "excludeFromBadgeHelp": "Nezapočítajte túto aplikáciu do odznaku súhrnných aktualizácií na karte zoznamu LXC.Užitočné, keď ste úmyselne pripnutý ku konkrétnej verzii (požiadavka na sledovanie, zmrazenie kompatibility).Nemá vplyv na vlastný stav karty Aplikácia ani na odchádzajúce upozornenie.",
+      "ociLabelPlaceholder": "org.opencontainers.image.version"
     }
   },
   "settings": {
@@ -4936,23 +4936,23 @@
       "Zobraziť všetky LXC kontajnery",
       "Spustiť LXC kontajner",
       "Zastaviť LXC kontajner",
-      "Otvoriť shell v LXC kontajneri",
+      "Otvoriť konzolu LXC kontajnera",
       "Zobraziť nastavenia kontajnera",
       "Zobraziť stav úložísk",
       "Zobraziť obsah úložiska",
       "Otestovať výkon Proxmox systému",
       "Zobraziť verziu Proxmox VE",
-      "Zobraziť stav služby pve-cluster",
+      "Skontrolovať stav klastra",
       "Zobraziť stav klastra",
       "Zobraziť uzly klastra",
       "Zobraziť stav ZFS poolu",
       "Zobraziť všetky ZFS pooly",
-      "Zobraziť ZFS súborové systémy a zväzky",
+      "Zobraziť všetky ZFS datasety",
       "Zobraziť podrobnosti o súboroch",
       "Prejsť do iného priečinka",
       "Vytvoriť priečinok",
       "Odstrániť priečinok aj s obsahom",
-      "Kopírovať súbory",
+      "Kopírovať súbory alebo priečinky",
       "Presunúť alebo premenovať súbory",
       "Zobraziť obsah súboru",
       "Hľadať text v súbore",
diff --git a/AppImage/messages/sv/common.json b/AppImage/messages/sv/common.json
index 5ef4792f..039afcc3 100644
--- a/AppImage/messages/sv/common.json
+++ b/AppImage/messages/sv/common.json
@@ -458,11 +458,11 @@
         "extendedNvmeHealth": "Utökad NVMe Health",
         "ssdWearLifetime": "SSD slitage och livstid",
         "nvmeHealthMetrics": "NVMe Health Metrics",
-        "sasHealthMetrics": "SAS/SCSI Health Metrics",
         "smartAttributes": "SMART-attribut",
         "selfTestResult": "Självtestresultat",
         "lastSelfTestResult": "Senaste självtestresultat",
-        "recommendations": "Rekommendationer"
+        "recommendations": "Rekommendationer",
+        "sasHealthMetrics": "SAS / SCSI Health Metrics"
       },
       "statusValues": {
         "ok": "OK",
@@ -1487,7 +1487,6 @@
       "containerNameLabel": "Behållarens namn",
       "containerNamePlaceholder": "t.ex. <ditt-behållarnamn>",
       "ociLabelKeyLabel": "OCI-etikettnyckel",
-      "ociLabelPlaceholder": "org.opencontainers.image.version",
       "pythonInterpreterLabel": "Python-tolkväg",
       "pythonInterpreterPlaceholder": "t.ex. /opt/<din-app>/venv/bin/python",
       "pipDistLabel": "Distributionsnamn (pip-paket)",
@@ -1534,11 +1533,8 @@
       "portHttps": "https",
       "portLogoLabel": "Logotyp URL för denna länk (valfritt)",
       "portLogoPlaceholder": "t.ex. https://example.com/logo.webp",
-      "portCategoryPlaceholder": "Category for the Apps dashboard (optional)",
       "portCategoryNone": "No category",
       "portCategoryAddNew": "+ Add new category…",
-      "portCategoryCustomPlaceholder": "Type a category and press Enter (Esc to cancel)",
-      "portCustomUrlPlaceholder": "Custom URL (e.g. https://vault.example.com) — overrides IP:port",
       "removePortTooltip": "Ta bort porten",
       "detectMethodDpkg": "dpkg ·",
       "detectMethodApk": "apk ·",
@@ -1631,7 +1627,11 @@
       "notifyUpstreamLabel": "Meddela mig när en ny uppströmsversion är tillgänglig",
       "notifyUpstreamHelp": "Skickar `app_update_available` till de kanaler som är aktiverade i Inställningar → Aviseringar. Stäng av om den här appen inte kan uppdateras på din box.",
       "excludeFromBadgeLabel": "Uteslut från LXC-uppdateringsräknaren",
-      "excludeFromBadgeHelp": "Räkna inte den här appen i det samlade uppdateringsmärket på LXC-listkortet. Användbart när du är fäst till en specifik version med avsikt (spårningskrav, frysning av kompatibilitet).Påverkar inte appflikens eget tillstånd eller det utgående meddelandet."
+      "excludeFromBadgeHelp": "Räkna inte den här appen i det samlade uppdateringsmärket på LXC-listkortet. Användbart när du är fäst till en specifik version med avsikt (spårningskrav, frysning av kompatibilitet).Påverkar inte appflikens eget tillstånd eller det utgående meddelandet.",
+      "ociLabelPlaceholder": "org.opencontainers.image.version",
+      "portCategoryPlaceholder": "Kategori för Apps dashboard (tillval)",
+      "portCategoryCustomPlaceholder": "Skriv en kategori och tryck på Enter (Esc för att avbryta)",
+      "portCustomUrlPlaceholder": "Anpassad URL (t.ex. https://vault.example.com) - åsidosätter IP:port"
     },
     "statusFilter": {
       "ariaLabel": "Filtrera virtuella maskiner och containrar",
@@ -2515,10 +2515,10 @@
       "scope": {
         "label": "Token permissions",
         "readOnly": "Read-only",
-        "readOnlyHint": "Reads metrics and status. Recommended for dashboards and integrations.",
         "fullAdmin": "Full admin",
-        "fullAdminHint": "Full control, like your own session.",
-        "fullAdminWarning": "A full-admin token can do everything you can: power off or reboot the host, run updates and open a terminal. Share it only with fully trusted integrations."
+        "readOnlyHint": "Läser mätvärden och status. Rekommenderas för instrumentbrädor och integrationer.",
+        "fullAdminHint": "Full kontroll, som din egen session.",
+        "fullAdminWarning": "En full-admin-token kan göra allt du kan: Strö av eller starta om värden, kör uppdateringar och öppna en terminal. Dela det bara med fullt betrodda integrationer."
       }
     },
     "firewall": {
@@ -3302,26 +3302,33 @@
     "gotIt": "Jag förstår!",
     "dontShowAgain": "Visa inte igen för den här versionen",
     "currentFeatures": {
-      "appDetection": "Smarter app detection in the App tab: Docker is correctly promoted as the parent workload during cold start (Portainer/SearXNG no longer briefly show up as native apps), unregistered suggestions live in the startup cache, and 'Find applications' runs a fresh catalog-backed scan on demand.",
-      "dockerUpdates": "The Updates tab now covers Docker end-to-end: Docker Engine and per-image update tracking follow the same 24-hour rolling cycle as OS packages, with a 'Check now' action for on-demand digest comparison — no more waiting for the daily collector.",
       "appCatalog": "Ny katalog för appdetektering med över 380 spårade arbetsuppgifter, genererad live från community-scripts via sju detektionsmetoder (fil, binär, dpkg, apk, Python, Docker exec, Docker label). Primära och reservdetektorer täcker både nya och historiska LXC-layouter.",
-      "pushover": "Pushover joins Telegram, Gotify, Discord, Email and Apprise as a native notification channel — user/API key, device and sound selectors, priority 0 for regular messages, optional priority 1 for CRITICAL events. Suggested by @benginx (#308).",
       "appsDashboard": "Ny huvudflik Apps — en enda startpunkt för varje webblänk på noden. LXC-registrerade appar och användardefinierade Custom Web Links delar samma rutnät med kategori-taggar, sökning och direktlänk till gästens modal.",
       "lxcAppsUpdates": "App-fliken inuti varje LXC-modal registrerar installerade appar, fångar webblänkar och spårar uppströmsversioner. Omarbetad Updates-flik applicerar OS-paket och appuppdateringar med en enda knapp; Docker Engine och per-image följer samma 24-timmarscykel med en 'Kontrollera nu'-åtgärd på begäran.",
       "multilingual": "Monitorn talar nu 8 språk: engelska, spanska, tyska, franska, italienska, portugisiska, svenska och slovakiska. Ett stort tack till @vaso73 för att ha byggt i18n-grunden.",
       "nvidiaMultiGpu": "NVIDIA-driverns livscykel går över till ägarskap per exakt BDF, så att en multi-GPU-värd kan skicka ett kort till en VM och behålla det andra operativt på värden eller i LXC, plus en versionsväljare som är medveten om kärna, gren och GPU (#298).",
-      "aiCustomEndpoint": "AI Assistant custom OpenAI endpoint — LiteLLM, LM Studio, LocalAI, vLLM, OmniRoute and any self-hosted proxy on private IPs, loopback or Docker networks are recognised when loading the model catalogue. The dropdown surfaces the server's error (or the underlying network reason) directly under the Load button (#325, reported by @jorgeffonte).",
-      "secureGatewayArch": "Secure Gateway wizard — the Alpine template download, local template selection and pct create all match the host's real architecture, so x86_64 hosts receive amd64 containers and arm64 hosts receive arm64 containers (#324, reported by @N0X4DD0).",
-      "atomicNotifications": "Notification events reserve their deduplication fingerprint atomically before AI processing and channel delivery, so concurrent collectors, completion callbacks or parallel Monitor processes cannot send the same event twice. The reservation is released when no channel succeeds, preserving retries.",
-      "borgSshPort": "Borg remote target — the Add Borg destination dialog and the shell TUI accept a custom SSH port. BORG_RSH, the auto key install flow and the capacity probe all honour it. Fully backwards compatible with existing entries created without an explicit port (suggested by @songochain in discussion #236).",
-      "githubToken": "Settings → GitHub API accepts an optional personal access token for release and tag checks when the anonymous quota is exhausted. The token is encrypted at rest and never returned to the browser; the rate-limit error is translated in every Monitor language (suggested by @SystemIdleProcess in discussion #306).",
-      "replicationContext": "Native Proxmox replication failure notifications resolve the replication job ID, affected VM/LXC ID and guest name; the exact error block from Proxmox is preserved as the reason, and each replication job deduplicates independently (reported by Ale R.).",
-      "auditAssessment": "Audit & Report — a new page that documents and assesses the node. The Assessment runs a catalogue of checks across security, backups, capacity, storage, network, hardware, guests and system, classifying each finding as critical, warning, observation or conformant and stating what it read rather than judging it.",
-      "changeJournal": "Change journal — a Changes view that lists exactly what ProxMenux modified on this host: every configuration file, package and service it touched, with the prior state of each, deduplicated to a current-state view that shows the host as it stands now rather than a log of every run.",
-      "auditReports": "Reports — a full audit plus focused Security review, Backup assurance and Capacity & wear reports, each opening on its own posture header, and a printable Inventory; all export to PDF. A security assessment asks before running Lynis so a run stays fast.",
-      "auditPolicyBaseline": "Policy and baseline — declare what the host is expected to be (backup requirements, firewall, root SSH login) so findings grade against it, mark a run as the reference, and see what changed since, with new, resolved and accepted findings kept apart.",
-      "groupedAppUpdates": "Grouped application update notifications — one complete message per scan instead of one per application, grouped by LXC with the installed and available versions.",
-      "adminTokenScope": "Administrative scope — opening a Monitor terminal and disabling authentication now require a full-admin token, so a read-only API token issued to a monitoring integration stays read-only (reported by @f3rs3n)."
+      "appDetection": "Smartare app detektion i fliken App: Docker är korrekt främjas som moder arbetsbelastning under kallstart (Portainer / SearXNG inte längre kort visas som inhemska appar), oregistrerade förslag lever i uppstartscache, och \"Find applikationer\" kör en ny katalogstödd skanning på begäran.",
+      "dockerUpdates": "fliken Uppdateringar täcker nu Docker end-to-end: Docker Motor- och per-image-uppdateringsspårning följer samma 24-timmars rullcykel som OS-paket, med en \"Check now\" -åtgärd för on-demand digest jämförelse - inte mer väntar på den dagliga samlaren.",
+      "pushover": "Pushover ansluter sig till Telegram, Gotify, Discord, Email and Apprise som en infödd meddelandekanal - användar / API-nyckel, enhet och ljudväljare, prioritet 0 för vanliga meddelanden, valfri prioritet 1 för CRITICAL-evenemang. Föreslås av @benginx (#308).",
+      "aiCustomEndpoint": "AI Assistant anpassade OpenAI endpoint - LiteLLM, LM Studio, LocalAI, vLLM, OmniRoute och någon själv värd proxy på privata IPs, loopback eller Docker-nätverk är erkända när man laddar modellkatalogen. Avstängningen ytor serverns fel (eller den underliggande nätverksskäl) direkt under Load-knappen (#325, rapporterad av @jorgeffonte).",
+      "secureGatewayArch": "Säker Gateway guide - Alpine mall nedladdning, lokal mallval och pct create alla matcha värdens verkliga arkitektur, så x86 64 värdar får amd64 behållare och arm64 värdar får arm64 behållare (#324, rapporterad av @N0X4D0).",
+      "atomicNotifications": "Anmälningshändelser förbehåller sig sin deduplicering fingeravtryck atomiskt innan AI-behandling och kanalleverans, så samtidiga samlare, slutförande återkopplingar eller parallella övervakningsprocesser kan inte skicka samma händelse två gånger. Bokningen släpps när ingen kanal lyckas, bevara retries.",
+      "borgSshPort": "Borg fjärrmål - Add Borg destination dialog och skalet TUI acceptera en anpassad SSH hamn. BORG RSH, auto key install flow och kapacitet sond alla hedra det. Fullt bakåtkompatibel med befintliga poster som skapats utan en explicit port (förslag av @songochain i diskussion #236).",
+      "githubToken": "Inställningar → GitHub API accepterar en valfri personlig åtkomsttoken för release och tag kontroller när den anonyma kvoten är utmattad. Token krypteras i vila och återvände aldrig till webbläsaren; hastighetsfel översätts i varje Monitor-språk (föreslås av @SystemIdleProcess i diskussion #306).",
+      "replicationContext": "Native Proxmox replikationsfelmeddelanden löser replikationsjobbet ID, påverkade VM / LXC ID och gästnamn; det exakta felblocket från Proxmox bevaras som orsaken, och varje replikationsjobb dedupliceras oberoende (rapporteras av Ale R.).",
+      "auditAssessment": "Audit & Report – en ny sida som dokumenterar och bedömer noden. Bedömningen driver en katalog över kontroller över säkerhet, säkerhetskopior, kapacitet, lagring, nätverk, hårdvara, gäster och system, klassificera varje hitta som kritisk, varning, observation eller överensstämmelse och ange vad det läser snarare än att döma det.",
+      "changeJournal": "Ändra tidskrift - en Ändringsvy som listar exakt vad ProxMenux modifierade på denna värd: varje konfigurationsfil, paket och tjänst som den rörde, med föregående tillstånd av varje, deduplicerad till en aktuell statsvy som visar värden som det står nu snarare än en logg på varje körning.",
+      "auditReports": "Rapporter - en fullständig revision plus fokuserad säkerhetsgranskning, säkerhetskopiering och kapacitet & slitage rapporter, varje öppning på sin egen hållning rubrik, och en utskrivbar lager; all export till PDF. En säkerhetsbedömning frågar innan du kör Lynis så en körning stannar snabbt.",
+      "auditPolicyBaseline": "Policy och baslinje - förklara vad värden förväntas vara (backup krav, brandvägg, rot SSH inloggning) så resultat betyg mot det, markera en körning som referens, och se vad som förändrats sedan, med nya, lösta och accepterade fynd hålls isär.",
+      "groupedAppUpdates": "Grupperade programuppdateringsmeddelanden - ett komplett meddelande per skanning istället för en per applikation, grupperad av LXC med installerade och tillgängliga versioner.",
+      "adminTokenScope": "Administrativa räckvidd - öppna en Monitor-terminal och inaktivera autentisering kräver nu en full-admin-token, så en lättläst API-token utfärdad till en övervakningsintegration förblir lättläst (rapporterad av @f3rs3n).",
+      "ociAppTab": "OCI-containrar i fliken App — en container som installerats av OCI manager Apps känns igen från sin installationspost: applikationen och dess avbild, en ny avbild som upptäcks via digest och en länk till avbildens repository.",
+      "ociUpdatesTab": "Uppdateringar för OCI-containrar — Uppdatera och Återskapa öppnar samma flöde som OCI-menyn, säkerhetskopian som tas före uppdateringen kan behållas i en lagring för säkerhetskopior och avbilden kan uppdateras enligt schema.",
+      "ociLogsTab": "Fliken Logs för OCI-containrar — applikationens konsolutdata, sparad på värden och följd i realtid, med filter och nedladdning. Proxmox-konsolen för dessa containrar öppnar ett skal.",
+      "appsUpdateShortcut": "Uppdateringsikonen på sidan Appar öppnar containern direkt på dess flik Uppdateringar.",
+      "webhookHttps": "Proxmox-aviseringar når Monitor med HTTPS aktiverat — de levereras till en adress som bara är lokal och misslyckas inte längre på grund av ett certifikatfel.",
+      "persistentLogs": "En avslutad skur av loggfel rapporteras inte längre som bestående: ett mönster måste fortsätta att dyka upp i 15 minuter, och dess varning stängs av sig själv (rapporterat av @Joshua1264).",
+      "mountsLanAddress": "Monteringspunkter på LVM-thin och annan blocklagring visar sin användning, och program med flera containrar öppnas på sin LAN-adress."
     }
   },
   "network": {
@@ -3546,7 +3553,6 @@
         "latencyHistory": "Latenshistorik (senaste {count} poster)",
         "methodology": "Metodik",
         "testMethod": "Testmetod",
-        "icmpEchoRequest": "ICMP Echo Request (Ping)",
         "samplesPerTest": "Prover per test",
         "threeConsecutivePings": "3 plingar i följd",
         "targetIp": "Mål-IP",
@@ -3558,7 +3564,8 @@
         "assessmentUnknown": "Det går inte att fastställa nätverksstatus.",
         "footerTitle": "ProxMenux Monitor - Nätverksprestandarapport",
         "generated": "Genererad",
-        "reportId": "Rapport-ID"
+        "reportId": "Rapport-ID",
+        "icmpEchoRequest": "ICMP Echo Request (Ping)"
       }
     }
   },
@@ -5027,23 +5034,20 @@
     "uncategorized": "Uncategorized",
     "openAriaLabel": "Open {name} in a new tab",
     "openGuestAriaLabel": "Öppna {name} ({type} {id})",
-    "emptyTitle": "No apps with a web link yet.",
-    "emptyHint": "Register a Web Link for any app (App tab of a CT) to see it here.",
     "customLinkAdd": "Add link",
     "editModeToggle": "Edit",
     "editModeDone": "Done",
     "customLinkNewTitle": "New web link",
     "customLinkEditTitle": "Edit web link",
     "customLinkEditAria": "Redigera den anpassade länken {name}",
+    "openUpdatesAria": "Öppna fliken Uppdateringar för {name}",
+    "openUpdatesTitle": "Uppdatering tillgänglig — öppna fliken Uppdateringar",
     "customLinkName": "Name",
     "customLinkNamePlaceholder": "e.g. My app",
     "customLinkUrl": "URL",
     "customLinkLogo": "Logo URL (optional)",
-    "customLinkLogoPlaceholder": "e.g., https://example.com/logo.webp",
     "customLinkCategory": "Category (optional)",
     "customLinkBinding": "Bound to",
-    "customLinkBindingNone": "Not bound to any guest",
-    "customLinkBindingHelp": "Bind this link to a VM or CT to add its ID + name to the card and jump to the guest with one click.",
     "customLinkSave": "Save",
     "customLinkCreate": "Create",
     "customLinkCancel": "Cancel",
@@ -5079,7 +5083,12 @@
       "remoteAccessVpn": "Remote Access & VPN",
       "webserversProxies": "Webservers & Proxies",
       "zigbeeZwaveMatter": "ZigBee, Z-Wave & Matter"
-    }
+    },
+    "emptyTitle": "Inga appar med en webblänk ännu.",
+    "emptyHint": "Registrera en webblänk för någon app (App-fliken på en CT) för att se den här.",
+    "customLinkLogoPlaceholder": "e.g., https://example.com/logo.webp",
+    "customLinkBindingNone": "Inte bunden till någon gäst",
+    "customLinkBindingHelp": "Bind denna länk till en VM eller CT för att lägga till sitt ID +-namn till kortet och hoppa till gästen med ett klick."
   },
   "audit": {
     "presentation": {
@@ -5234,13 +5243,10 @@
     "loading": "Loading assessment…",
     "run": "Run assessment",
     "running": "Assessing…",
-    "neverRun": "This host has not been assessed yet.",
     "lastRun": "Last assessed on {when}",
     "stale": "{days} days ago",
     "unverifiedChecks": "Ej gjorda: {checks}. Var och en anger i sina belägg vad den inte kunde läsa.",
-    "noFindings": "No findings match the current filter.",
     "affectedCount": "{count} affected",
-    "acceptedNotice": "{count} accepted risk(s) recorded on this host.",
     "reviewOn": "Granska den: {when}",
     "reviewDue": "Dags att granska — beslutet gäller fortfarande",
     "reviewDueNotice": "{count} accepterade beslut väntar på granskning.",
@@ -5272,7 +5278,7 @@
       "sources": "Källor och insamlingstider"
     },
     "errors": {
-      "runFailed": "The assessment could not be started."
+      "runFailed": "Bedömningen kunde inte påbörjas."
     },
     "checks": {
       "backup": {
@@ -5285,7 +5291,7 @@
             "uncovered": "{count} av {total} gäster väljs inte av något aktiverat säkerhetskopieringsjobb",
             "excludedData": "Granska {count} undantag för diskar eller monteringspunkter",
             "uncoveredExpected": "{required} gäster som deklarerats behöva säkerhetskopia väljs inte av något aktiverat jobb",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           },
           "nextStep": {
             "noJobs": "Skapa ett backup jobb på denna nod och välj de gäster som håller data som du inte vill bygga för hand. Ett jobb som existerar men är funktionshindrat väljer ingenting.",
@@ -5300,10 +5306,10 @@
           "rationale": "Ålder: tid som gått sedan den senaste lagrade säkerhetskopian. Använd gräns: referensåldern som kopian jämförs med.",
           "summary": {
             "recent": "Alla {total} gäst-/destinationskontroller uppfyller det angivna ålderskravet",
-            "stale": "{count} of {total} guests have no backup from the last 30 days",
-            "noBackups": "No stored backup matches a guest on this node",
             "attention": "{count} av {total} gäst-/destinationskontroller behöver granskas",
-            "evaluationFailed": "The check could not be evaluated"
+            "stale": "{count} av {total} gäster har ingen backup från de senaste 30 dagarna",
+            "noBackups": "Ingen lagrad backup matchar en gäst på denna nod",
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           },
           "nextStep": {
             "stale": "Ta reda på varför jobbet slutade producera kopior för dessa gäster: det kan ha varit inaktiverat, dess schema kan aldrig elda, eller dess körningar kan misslyckas. Löpresultaten kontrollerar hur varje jobb senast slutade.",
@@ -5317,10 +5323,10 @@
           "rationale": "Lagringstiden som Proxmox löser upp den: jobbets inställning, sedan lagringens, sedan nodens standardvärde. Lagringstid som en säkerhetskopieringsserver tillämpar går inte att läsa från den här noden.",
           "summary": {
             "allDefined": "Alla {total} jobb löser upp en inställning för lagringstid",
-            "missing": "{count} of {total} enabled job(s) declare no retention",
             "notDeclared": "{count} av {total} jobb behåller varje kopia: ingen lagringstid är deklarerad",
             "onServer": "{count} av {total} jobb skriver till en säkerhetskopieringsserver, som gallrar dem med egna jobb",
-            "evaluationFailed": "The check could not be evaluated"
+            "missing": "{count} av {total} aktiverade jobb (er) förklarar ingen lagring",
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           },
           "nextStep": {
             "missing": "Ange en lagring på dessa jobb, eller på lagringen de skriver till. Proxmox tar jobbets inställning först, sedan lagringen, sedan noden standard.",
@@ -5383,36 +5389,36 @@
           "summary": {
             "none": "Ingenting har begärt omstart",
             "pending": "{count} poster är installerade och väntar på omstart",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         },
         "enterprise_repo_without_subscription": {
           "title": "Enterprise repository",
           "rationale": "Referenser till `enterprise.proxmox.com` i `/etc/apt/sources.list` och `sources.list.d`, mot statusen från `pvesubscription get`.",
           "summary": {
-            "notEnabled": "The enterprise repository is not enabled",
-            "subscribed": "The enterprise repository is backed by a subscription",
-            "unsubscribed": "The enterprise repository is enabled without an active subscription",
-            "evaluationFailed": "The check could not be evaluated"
+            "notEnabled": "Företagsförvaret är inte aktiverat",
+            "subscribed": "Företagsregister stöds av en prenumeration",
+            "unsubscribed": "Företagsregister är aktiverat utan aktiv prenumeration",
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         },
         "memory_overcommit": {
           "title": "Memory allocation",
           "rationale": "Taket `memory` i varje gästkonfiguration mot MemTotal, med körande gäster räknade för sig. Containrar förbrukar upp till den gränsen; virtuella maskiner utan ballooning reserverar den.",
           "summary": {
-            "withinRatio": "Guests are allocated {percent}% of host memory",
-            "aboveRatio": "Guests are allocated {percent}% of host memory",
-            "evaluationFailed": "The check could not be evaluated"
+            "withinRatio": "Gäster tilldelas {percent}% av värdminnet",
+            "aboveRatio": "Gäster tilldelas {percent}% av värdminnet",
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         },
         "time_synchronisation": {
           "title": "Time synchronisation",
           "rationale": "NTP och NTPSynchronized som `timedatectl` rapporterar dem. Klustermedlemskap, certifikatvalidering och loggordning bygger på klockor som stämmer överens. En annan mekanism kan sköta klockan.",
           "summary": {
-            "synchronised": "The clock is synchronised with a time source",
             "disabled": "Time synchronisation is disabled",
-            "notSynchronised": "Time synchronisation is enabled but the clock is not synchronised",
-            "evaluationFailed": "The check could not be evaluated"
+            "synchronised": "Klockan synkroniseras med en tidskälla",
+            "notSynchronised": "Tidssynkronisering är aktiverad men klockan synkroniseras inte",
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         },
         "kernel_current": {
@@ -5420,21 +5426,21 @@
           "rationale": "Kärnan som körs mot den värden skulle starta härnäst, som `proxmox-boot-tool` rapporterar den. En nyare kärna som bara är installerad kan hållas tillbaka med avsikt; en skillnad efter omstart betyder en start som inte tog.",
           "summary": {
             "current": "Kärnan {version} som körs är den värden skulle starta härnäst",
-            "newerAvailable": "The host runs {running} while {newest} is installed",
             "newerSelected": "Värden kör {running} och skulle starta {selected} vid nästa omstart",
             "wouldDowngrade": "Värden kör {running} men skulle starta den äldre {selected} vid nästa omstart",
             "bootTargetUnknown": "Värden kör {version}; kärnan som valts för nästa start kunde inte läsas",
-            "evaluationFailed": "The check could not be evaluated"
+            "newerAvailable": "Värden kör {running} medan {newest} är installerad",
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         },
         "security_updates": {
           "title": "Security updates",
           "rationale": "Väntande paket vars ursprung är ett säkerhetsarkiv, från en simulerad `apt-get upgrade`. Antalet speglar vad apt rapporterar, inte hur allvarligt det varje paket rättar är.",
           "summary": {
-            "none": "No package updates are pending",
-            "noSecurity": "{total} update(s) pending, none from a security repository",
-            "pending": "{count} of {total} pending update(s) come from a security repository",
-            "evaluationFailed": "The check could not be evaluated"
+            "none": "Inga paketuppdateringar väntar",
+            "noSecurity": "{total} uppdatering (er) i väntan, ingen från ett säkerhetsförvar",
+            "pending": "{count} av {total} pågående uppdateringar kommer från ett säkerhetsförvar",
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         },
         "journal_size": {
@@ -5442,10 +5448,10 @@
           "rationale": "Journalen på disk mot det tak som gäller för den: SystemMaxUse där det är satt, annars journalds standard på en tiondel av filsystemet den ligger på.",
           "summary": {
             "bounded": "Journalen upptar {size}, inom sitt gällande tak",
-            "large": "The journal holds {size} on disk",
             "nearCap": "Journalen upptar {size} och ligger på {percent}% av sitt gällande tak",
             "capUnknown": "Journalen upptar {size}; dess gällande tak kunde inte fastställas",
-            "evaluationFailed": "The check could not be evaluated"
+            "large": "Tidskriften håller {size} på disk",
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         },
         "swap_configured": {
@@ -5454,7 +5460,7 @@
           "summary": {
             "active": "{size} of swap is active",
             "none": "No swap area is active",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         },
         "filesystem_capacity": {
@@ -5500,7 +5506,7 @@
           "summary": {
             "synchronised": "De {total} startpartitionerna bär samma kärnor",
             "attention": "{count} av {total} startpartitioner behöver ses över",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           },
           "rationale": "EFI-systempartitionerna proxmox-boot-tool rapporter och de kärnor som var och en bär. proxmox-boot-tool status kan tillfälligt montera EFI-systempartitioner; ingen start görs."
         },
@@ -5510,7 +5516,7 @@
           "summary": {
             "allRunning": "De {total} väsentliga tjänsterna är aktiva och ingen enhet har misslyckats",
             "attention": "{count} iakttagelse(r) bland enheterna",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         },
         "ha_state": {
@@ -5519,7 +5525,7 @@
           "summary": {
             "managed": "De {total} hanterade tjänsterna är i ett stabilt läge på {nodes} nod(er)",
             "attention": "{count} iakttagelse(r) för {total} hanterade tjänster",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         }
       },
@@ -5528,27 +5534,27 @@
           "title": "Container privileges",
           "rationale": "Inställningen `unprivileged` i varje containerkonfiguration. Att den saknas betyder att containern delar värdens användarnamnrymd, vilket vissa laster kräver.",
           "summary": {
-            "allUnprivileged": "All {total} containers are unprivileged",
             "privileged": "{count} of {total} containers run privileged",
-            "evaluationFailed": "The check could not be evaluated"
+            "allUnprivileged": "Alla {total} behållare är oprivilegierade",
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         },
         "qemu_without_agent": {
-          "title": "Guest agent on virtual machines",
           "rationale": "Inställningen `agent` i varje virtuell maskins konfiguration. Inställningen säger att agenten är deklarerad, inte att den svarar.",
           "summary": {
-            "allHaveAgent": "All {total} virtual machines declare the guest agent",
-            "missingAgent": "{count} of {total} virtual machines do not declare the guest agent",
-            "evaluationFailed": "The check could not be evaluated"
-          }
+            "allHaveAgent": "Alla {total} virtuella maskiner förklarar gästagenten",
+            "missingAgent": "{count} av {total} virtuella maskiner förklarar inte gästagenten",
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
+          },
+          "title": "Gästagent på virtuella maskiner"
         },
         "autostart": {
           "title": "Automatic start",
           "rationale": "Inställningen `onboot` för varje gäst, utom mallar och gäster som HA hanterar. Om en gäst förväntas komma tillbaka av sig själv framgår av den deklarerade policyn.",
           "summary": {
-            "allAutostart": "All {total} guests start with the host",
-            "notAutostart": "{count} of {total} guests do not start with the host",
-            "evaluationFailed": "The check could not be evaluated"
+            "allAutostart": "Alla {total} gäster börjar med värden",
+            "notAutostart": "{count} av {total} gäster börjar inte med värden",
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         },
         "stuck_snapshots": {
@@ -5556,28 +5562,28 @@
           "rationale": "Ögonblicksbildernas tillstånd och ålder samt aktiva uppgifter. En färsk åtgärd eller en utan verifierbart datum betraktas inte som avbruten.",
           "summary": {
             "noSnapshots": "No guest holds snapshots",
-            "allComplete": "The {total} snapshot(s) are complete",
-            "stuck": "{count} of {total} snapshot(s) were left mid-operation",
-            "evaluationFailed": "The check could not be evaluated"
+            "allComplete": "{total} snapshot(s) är kompletta",
+            "stuck": "{count} av {total} snapshot(s) lämnades mitten av driften",
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         },
         "cpu_host_type": {
           "title": "Virtual CPU model",
           "rationale": "Värdet `cpu` för varje virtuell maskin. `host` exponerar den fysiska processorns instruktionsuppsättning, vilket begränsar vilka noder gästen kan migrera till. Oförenlighet med ett visst mål avgörs inte här.",
           "summary": {
-            "none": "None of the {total} virtual machines is pinned to the host processor",
-            "pinned": "{count} of {total} virtual machines are pinned to the host processor",
-            "evaluationFailed": "The check could not be evaluated"
+            "none": "Ingen av {total} virtuella maskiner är fäst vid värdprocessorn",
+            "pinned": "{count} av {total} virtuella maskiner är fästa på värdprocessorn",
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         },
         "replication_state": {
           "title": "Replication",
           "rationale": "Replikeringsjobb från API:et: antal fel, senaste fel, senaste synkronisering och den kalender varje jobb anger. Pausade jobb redovisas som sådana.",
           "summary": {
-            "healthy": "The {total} replication job(s) report no error",
-            "failing": "{count} of {total} replication job(s) report an error",
-            "statusUnavailable": "Replication jobs are defined but their status could not be read",
-            "evaluationFailed": "The check could not be evaluated"
+            "healthy": "{total} replikeringsjobb (er) rapporterar inga fel",
+            "failing": "{count} av {total} replikeringsjobb (er) rapporterar ett fel",
+            "statusUnavailable": "Replikationsjobb definieras men deras status kan inte läsas",
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         }
       },
@@ -5589,39 +5595,39 @@
             "bothEnabled": "Brandväggsaktivering är konfigurerad på datacenter- och nodnivå",
             "datacenterOff": "Brandväggen är avstängd på datacenternivå, så nodreglerna tillämpas inte",
             "nodeOff": "Brandväggen är aktiverad på datacenternivå men inte på den här noden",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         },
         "lynis_warnings": {
           "title": "Lynis warnings",
           "rationale": "Varningar från den senaste Lynis-granskningen, var och en med sin testidentifierare, och hur gammal granskningen är. En granskning körs bara om Lynis är installerat och ingen fullständig rapport finns. Förslag ingår inte.",
           "summary": {
-            "none": "The last Lynis audit recorded no warnings",
-            "found": "The last Lynis audit recorded {count} warning(s)",
-            "incomplete": "The Lynis report is incomplete",
-            "evaluationFailed": "The check could not be evaluated",
             "noneStale": "Den senaste Lynis-granskningen registrerade inga varningar, och dess rapport är {days} dag(ar) gammal",
-            "foundStale": "Den senaste Lynis-granskningen registrerade {count} varning(ar), och dess rapport är {days} dag(ar) gammal"
+            "foundStale": "Den senaste Lynis-granskningen registrerade {count} varning(ar), och dess rapport är {days} dag(ar) gammal",
+            "none": "Den sista Lynis-revisionen registrerade inga varningar",
+            "found": "Den sista Lynis-revisionen spelade in {count}-varning (er)",
+            "incomplete": "Lynis-rapporten är ofullständig",
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         },
         "certificate_expiry": {
           "title": "Certificate validity",
           "rationale": "Utgångsdatum för certifikatet som pveproxy levererar från /etc/pve/local. Ett eget certifikat går före det Proxmox genererar.",
           "summary": {
-            "valid": "The certificate is valid for {days} more day(s)",
-            "expiring": "The certificate expires in {days} day(s)",
-            "expired": "The certificate expired {days} day(s) ago",
-            "evaluationFailed": "The check could not be evaluated"
+            "valid": "Intyget gäller för {days} fler dagar (er)",
+            "expiring": "Certifikatet löper ut i {days}-dagar",
+            "expired": "Certifikatet löpte ut {days}-dagar sedan",
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         },
         "ssh_root_login": {
           "title": "SSH root access",
           "rationale": "PermitRootLogin i den effektiva `sshd -T`-konfigurationen, med de autentiseringsmetoder den kombineras med. Proxmox levereras med `yes`, som accepterar lösenord.",
           "summary": {
-            "password": "Root may sign in over SSH with a password",
-            "keyOnly": "Root may sign in over SSH with a key only",
-            "denied": "Root may not sign in over SSH",
-            "evaluationFailed": "The check could not be evaluated"
+            "password": "Root kan logga in över SSH med ett lösenord",
+            "keyOnly": "Rot kan logga in över SSH med en nyckel endast",
+            "denied": "Rot får inte logga in över SSH",
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         }
       },
@@ -5630,9 +5636,9 @@
           "title": "Volume assignment",
           "rationale": "Gästvolymer på lokal lagring mot referenserna i aktuella, väntande och ögonblicksbildskonfigurationer. Säkerhetskopior, ISO-filer och mallar ligger utanför jämförelsen. En volym utan referens är en kandidat för granskning.",
           "summary": {
-            "none": "No orphaned volumes were found",
             "found": "{count} volymer saknar referens i de granskade konfigurationerna",
-            "evaluationFailed": "The check could not be evaluated"
+            "none": "Inga föräldralösa volymer hittades",
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         },
         "zfs_arc_max": {
@@ -5640,21 +5646,21 @@
           "rationale": "Effektiva värden för c_min, c_max och ARC-storlek, den laddade modulparametern och de bestående inställningarna i /etc/modprobe.d. Ett konfigurerat nollvärde väljer modulens standard; ARC är ett tak och minnet under det är återvinningsbart.",
           "summary": {
             "bounded": "ARC-gränsen är {percent}% av värdens minne, och minnet under den är återvinningsbart",
-            "high": "The ARC may use {percent}% of host memory",
-            "unset": "The ARC has no explicit limit set",
             "conflicting": "{count} ARC-inställningar stämmer inte överens",
             "pending": "En bestående ARC-inställning skiljer sig från värdet den körande modulen bär",
-            "evaluationFailed": "The check could not be evaluated"
+            "high": "ARC kan använda {percent}% av värdminnet",
+            "unset": "ARC har ingen tydlig gränsuppsättning",
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         },
         "zfs_scrub_age": {
           "title": "ZFS scrub",
           "rationale": "Den senaste avslutade scrub som `zpool status` registrerar för varje pool. En resilver är inte en scrub. En nyligen skapad pool har ännu inte haft tillfälle till en.",
           "summary": {
-            "recent": "The {total} pool(s) were scrubbed within the last 35 days",
-            "overdue": "{count} of {total} pool(s) have not been scrubbed in 35 days",
             "neverScrubbed": "{count} pool(s) record no scrub",
-            "evaluationFailed": "The check could not be evaluated"
+            "recent": "{total} pool(s) skrubbades under de senaste 35 dagarna",
+            "overdue": "{count} av {total} pool(s) har inte skrubbats på 35 dagar",
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         },
         "thin_pool_overprovisioning": {
@@ -5664,7 +5670,7 @@
             "withinRatio": "De {total} thin-poolerna ligger under de tillämpade granskningsgränserna",
             "aboveRatio": "{count} av {total} thin-pooler delar ut mer kapacitet än de har",
             "pressure": "{pressure} av {total} thin-pooler närmar sig att fylla data eller metadata",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         },
         "connected_storage": {
@@ -5673,7 +5679,7 @@
           "summary": {
             "available": "PVE rapporterar alla {total} lagringar som tillgängliga; fjärrsystemens interna delar och skrivåtkomst testades inte",
             "attention": "{count} av {total} lagringar behöver granskas",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         },
         "pool_integrity": {
@@ -5691,7 +5697,7 @@
           "summary": {
             "healthy": "Ceph rapporterar HEALTH_OK",
             "degraded": "Ceph rapporterar {state}, med {count} namngivna kontroller",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         },
         "array_integrity": {
@@ -5700,7 +5706,7 @@
           "summary": {
             "intact": "De {total} uppsättningarna och kartorna behåller sin redundans",
             "degraded": "{count} av {total} uppsättningar eller kartor saknar den",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         }
       },
@@ -5712,7 +5718,7 @@
             "withinLife": "De {total} diskavläsningarna ligger under femårströskeln",
             "pastLife": "{count} av {total} diskavläsningar överskrider fem års drift",
             "noReadings": "Ingen disk rapporterar användbara SMART-värden ({skipped} utan avläsningar)",
-            "evaluationFailed": "The check could not be evaluated"
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         },
         "disk_errors": {
@@ -5729,23 +5735,22 @@
           "title": "Bond members",
           "rationale": "MII-status för varje bond-medlem från /proc/net/bonding och hur många länkar som återstår. I active-backup rapporterar en reservmedlem som uppe och bär ingen trafik.",
           "summary": {
-            "allUp": "All members of the {total} bond(s) are up",
-            "membersDown": "{count} bond member(s) are not up",
-            "evaluationFailed": "The check could not be evaluated"
+            "allUp": "Alla medlemmar av {total} obligationer är uppe",
+            "membersDown": "{count} obligationsmedlem (er) är inte upp",
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         },
         "bridge_without_ports": {
           "title": "Bridge ports",
           "rationale": "Portkonfigurationen för varje bridge. En bridge utan fysisk port betjänar ett internt eller routat nät.",
           "summary": {
-            "allConnected": "The {total} bridge(s) carry a port",
             "isolated": "{count} of {total} bridge(s) carry no port",
-            "evaluationFailed": "The check could not be evaluated"
+            "allConnected": "{total} bron bär en port",
+            "evaluationFailed": "Kontrollen kunde inte utvärderas"
           }
         }
       }
     },
-    "summaryFallback": "The check could not be evaluated",
     "acceptRisk": {
       "action": "Acceptera risken",
       "revoke": "Återför till aktiva",
@@ -5779,17 +5784,15 @@
       "OK": "OK"
     },
     "viewSwitch": {
-      "ariaLabel": "Switch between assessment and inventory",
       "assessment": "Assessment",
       "inventory": "Inventory",
       "policy": "Policy",
-      "changes": "Ändringar"
+      "changes": "Ändringar",
+      "ariaLabel": "Växla mellan bedömning och lager"
     },
     "inventory": {
       "loading": "Loading inventory…",
-      "failed": "The inventory could not be composed.",
       "collectedAt": "Composed on {when}",
-      "unavailable": "Not read in this inventory",
       "unresolved": "path not resolved",
       "noUplink": "no uplink",
       "identity": "Node identity",
@@ -5832,12 +5835,10 @@
       "protection": "Backup",
       "passthrough": "Passthrough",
       "noBackup": "No backup",
-      "noBackupDetail": "No enabled backup job selects this guest.",
       "applications": "Applications",
       "versionUnknown": "version not detected",
       "passthroughTitle": "PCI passthrough",
       "iommuGroup": "IOMMU group {group}",
-      "sharedGroup": "{count} more device(s) in the same group",
       "proxmenux": "ProxMenux optimizations",
       "latency": "Nätverkslatens",
       "subscriptionStatus": {
@@ -5848,7 +5849,11 @@
         "suspended": "Pausad",
         "new": "Väntar på aktivering",
         "unknown": "Okänd"
-      }
+      },
+      "failed": "Inventeringen kunde inte komponeras.",
+      "unavailable": "Läs inte i denna inventering",
+      "noBackupDetail": "Inget aktiverat backup jobb väljer denna gäst.",
+      "sharedGroup": "{count} fler enheter (er) i samma grupp"
     },
     "profile": {
       "label": "Report",
@@ -5871,7 +5876,6 @@
       "area": "Area",
       "inventoryAnnex": "Inventory annex",
       "scopeTitle": "Scope of this report",
-      "scopeBody": "This report describes the Proxmox VE node named above, as observed from the node itself at the time stated. It does not cover the interior of the guests beyond what they declare, network equipment outside the host, physical infrastructure, or any dependency not visible from this node. Findings marked as not determined were not measured and are not evidence of absence.",
       "building": "Rapporten sätts samman…",
       "node": "Nod",
       "profile": "Profil",
@@ -6020,11 +6024,12 @@
       "structureSubtitle": "Hur {node} är byggd och konfigurerad",
       "postureTitle": "Posture",
       "posture": {
-        "security": "Host exposure and access.",
-        "backup": "Guest protection and whether it is real.",
-        "capacity": "Room to grow and the wear on the disks."
+        "security": "Värd exponering och åtkomst.",
+        "backup": "Gästskydd och om det är verkligt.",
+        "capacity": "Rum att växa och slitage på diskarna."
       },
-      "scopeReadOnly": "Bedömningen inspekterar värdinställningar och hälsa. Den kan skriva rapporter och loggar; startstatuskontroller kan tillfälligt montera EFI-systempartitioner."
+      "scopeReadOnly": "Bedömningen inspekterar värdinställningar och hälsa. Den kan skriva rapporter och loggar; startstatuskontroller kan tillfälligt montera EFI-systempartitioner.",
+      "scopeBody": "Denna rapport beskriver Proxmox VE-noden som nämns ovan, som observerats från noden själv vid den tidpunkt som anges. Det täcker inte insidan av gästerna bortom vad de deklarerar, nätverksutrustning utanför värden, fysisk infrastruktur eller något beroende som inte är synligt från denna nod. Resultat som inte fastställts mättes inte och är inte bevis på frånvaro."
     },
     "results": "Resultat",
     "classifications": {
@@ -6178,15 +6183,19 @@
     "notApplicableScope": "Inget i det granskade omfånget som den här kontrollen gäller.",
     "lynis": {
       "title": "Run Lynis",
-      "bodyNotRun": "Lynis is installed but has not been run yet. Running it now completes the security review, but the process can take a few minutes.",
-      "bodyStale": "The Lynis report is {days} days old. You can run it now to refresh the data (it takes a little longer) or continue with the existing report.",
       "withLynis": "Run with Lynis",
       "withoutLynis": "Run without Lynis",
-      "cancel": "Cancel"
+      "cancel": "Cancel",
+      "bodyNotRun": "Lynis är installerad men har inte körts ännu. Kör det nu slutför säkerhetsgranskningen, men processen kan ta några minuter.",
+      "bodyStale": "Lynis-rapporten är {days} dagar gammal. Du kan köra det nu för att uppdatera data (det tar lite längre) eller fortsätta med den befintliga rapporten."
     },
     "readOnlyNotice": "Bedömningen inspekterar värdinställningar och hälsa. Den kan skriva rapporter och loggar; startstatuskontroller kan tillfälligt montera EFI-systempartitioner.",
     "noActionNeeded": "Inget att göra. Denna kontroll fann vad den förväntar sig att hitta.",
-    "couldNotEvaluate": "Denna kontroll kunde inte utvärderas, så det rapporterar ingenting heller. Beviset registrerar vad det inte kunde läsa."
+    "couldNotEvaluate": "Denna kontroll kunde inte utvärderas, så det rapporterar ingenting heller. Beviset registrerar vad det inte kunde läsa.",
+    "neverRun": "Denna värd har inte bedömts ännu.",
+    "noFindings": "Inga resultat matchar det aktuella filtret.",
+    "acceptedNotice": "{count} accepterade risker registrerade på denna värd.",
+    "summaryFallback": "Kontrollen kunde inte utvärderas"
   },
   "runtime": {
     "notifications": {
@@ -6298,8 +6307,8 @@
         },
         "migration_start": {
           "title": "{hostname}: Migrering startade — {vmname} ({vmid})",
-          "body": "Live migration of {vmname} (ID: {vmid}) to node {target_node} has started.",
-          "label": "Migreringen startade"
+          "label": "Migreringen startade",
+          "body": "Levande migration av {vmname} (ID: {vmid}) till nod {target_node} har börjat."
         },
         "migration_complete": {
           "title": "{hostname}: Migreringen slutförd — {vmname} ({vmid})",
@@ -6468,8 +6477,8 @@
         },
         "node_disconnect": {
           "title": "{hostname}: Nod {node_name} frånkopplad",
-          "body": "Node {node_name} has disconnected from the cluster.",
-          "label": "Noden frånkopplad"
+          "label": "Noden frånkopplad",
+          "body": "Nod {node_name} har kopplats från klustret."
         },
         "node_reconnect": {
           "title": "{hostname}: Noden {node_name} återansluten",
diff --git a/AppImage/package-lock.json b/AppImage/package-lock.json
index dcffd893..fd2b2ee6 100644
--- a/AppImage/package-lock.json
+++ b/AppImage/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "ProxMenux-Monitor",
-  "version": "1.2.6.1-beta",
+  "version": "1.2.6.2-beta",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "ProxMenux-Monitor",
-      "version": "1.2.6.1-beta",
+      "version": "1.2.6.2-beta",
       "dependencies": {
         "@hookform/resolvers": "^3.10.0",
         "@radix-ui/react-accordion": "1.2.2",
diff --git a/AppImage/package.json b/AppImage/package.json
index 9baeaaf3..e1ec1d3c 100644
--- a/AppImage/package.json
+++ b/AppImage/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ProxMenux-Monitor",
-  "version": "1.2.6.1-beta",
+  "version": "1.2.6.2-beta",
   "description": "Proxmox System Monitoring Dashboard",
   "private": true,
   "scripts": {
diff --git a/AppImage/scripts/build_appimage.sh b/AppImage/scripts/build_appimage.sh
index 494c90f9..ccbeff2b 100755
--- a/AppImage/scripts/build_appimage.sh
+++ b/AppImage/scripts/build_appimage.sh
@@ -136,6 +136,8 @@ cp "$SCRIPT_DIR/flask_proxmenux_routes.py" "$APP_DIR/usr/bin/" 2>/dev/null || ec
 cp "$SCRIPT_DIR/post_install_versions.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  post_install_versions.py not found"
 cp "$SCRIPT_DIR/mount_monitor.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  mount_monitor.py not found"
 cp "$SCRIPT_DIR/lxc_mount_points.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  lxc_mount_points.py not found"
+cp "$SCRIPT_DIR/oci_console_logs.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  oci_console_logs.py not found"
+cp "$SCRIPT_DIR/oci_instance_info.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  oci_instance_info.py not found"
 cp "$SCRIPT_DIR/disk_temperature_history.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  disk_temperature_history.py not found"
 cp "$SCRIPT_DIR/smartctl_resolver.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  smartctl_resolver.py not found"
 cp "$SCRIPT_DIR/disk_identity.py" "$APP_DIR/usr/bin/" 2>/dev/null || echo "⚠️  disk_identity.py not found"
diff --git a/AppImage/scripts/flask_notification_routes.py b/AppImage/scripts/flask_notification_routes.py
index a264575f..8b2ab255 100644
--- a/AppImage/scripts/flask_notification_routes.py
+++ b/AppImage/scripts/flask_notification_routes.py
@@ -865,108 +865,28 @@ _PVE_OUR_HEADERS = {
 }
 
 
-def _ssl_cert_hostname(cert_path: str) -> str:
-    """Pull the most useful hostname out of an x509 cert.
-
-    Preference order: first DNS SAN → CN. Returns '' on any failure.
-    Used to build a webhook URL that won't fail PVE's TLS verification
-    (issue #239 — PVE has no `--insecure` flag and the user's ACME cert
-    is bound to a hostname, not to `127.0.0.1`).
-    """
-    try:
-        import subprocess
-        out = subprocess.run(
-            ['openssl', 'x509', '-in', cert_path, '-noout',
-             '-ext', 'subjectAltName', '-subject'],
-            capture_output=True, text=True, timeout=5,
-        )
-        if out.returncode != 0:
-            return ''
-        text = out.stdout or ''
-        # SAN line example: "    DNS:pve.example.com, DNS:pve, IP Address:..."
-        import re
-        for line in text.splitlines():
-            m = re.search(r'DNS:([A-Za-z0-9.\-]+)', line)
-            if m:
-                return m.group(1)
-        # CN fallback. "subject= CN = pve.example.com" or "...CN=pve.example.com"
-        m = re.search(r'CN\s*=\s*([A-Za-z0-9.\-]+)', text)
-        if m:
-            return m.group(1)
-    except Exception:
-        pass
-    return ''
-
-
-def _hostname_resolves_locally(hostname: str) -> bool:
-    """True when `hostname` resolves to one of this host's own IPs.
-
-    Anti-misconfig: refuse to build a webhook URL that points
-    elsewhere (a stale DNS entry pointing at the previous host, a CN
-    that names a different node in the cluster, etc.). PVE delivers
-    webhooks from the same node, so the URL has to round-trip to
-    ourselves.
-    """
-    try:
-        import socket
-        import ipaddress
-        target_ips = set()
-        for info in socket.getaddrinfo(hostname, None):
-            ip = info[4][0]
-            target_ips.add(ipaddress.ip_address(ip).compressed)
-        # Collect our own IPs from /proc/net/fib_trie isn't portable; use
-        # psutil if available, otherwise fall back to socket on the
-        # hostname itself.
-        local_ips = {'127.0.0.1', '::1'}
-        try:
-            import psutil
-            for _iface, addrs in psutil.net_if_addrs().items():
-                for a in addrs:
-                    if a.family in (socket.AF_INET, socket.AF_INET6):
-                        local_ips.add(ipaddress.ip_address(a.address.split('%')[0]).compressed)
-        except Exception:
-            pass
-        return bool(target_ips & local_ips)
-    except Exception:
-        return False
+# With HTTPS enabled, PVE delivers its notifications to a plain-HTTP listener
+# the Monitor opens on loopback only for this route (see flask_server). PVE's
+# webhook client validates certificates against the system CA store, which
+# does not hold a self-signed, ACME-staging or PVE-CA-signed Monitor
+# certificate, so an https target fails with "unable to get local issuer
+# certificate" on every notification.
+WEBHOOK_LOOPBACK_PORT = 8009
 
 
 def _pve_webhook_url() -> str:
-    """Return the URL we register with PVE as our webhook target.
-
-    Three branches:
-      1. SSL off → http://127.0.0.1:8008 (always works, no cert).
-      2. SSL on + cert hostname extractable and resolves locally →
-         https://<cert-hostname>:8008. This is what PVE's TLS layer
-         actually validates against. Without this, PVE rejects the
-         self/ACME cert with "IP address mismatch" (issue #239).
-      3. SSL on but hostname extraction/check failed → fall back to
-         https://127.0.0.1:8008 and accept that the user may still
-         hit the cert-mismatch error. We log so the operator can
-         diagnose. Better than silently emitting a wrong URL.
-    """
+    """Return the URL we register with PVE as our webhook target: the
+    Monitor itself over HTTP when SSL is off, and its loopback-only HTTP
+    listener when SSL is on. Both stay on 127.0.0.1, so nothing crosses
+    the network and no certificate is involved."""
     try:
         from auth_manager import load_ssl_config
         cfg = load_ssl_config() or {}
-        if not cfg.get('enabled'):
-            return 'http://127.0.0.1:8008/api/notifications/webhook'
-
-        cert_path = cfg.get('cert_path') or ''
-        if cert_path:
-            host = _ssl_cert_hostname(cert_path)
-            if host and _hostname_resolves_locally(host):
-                return f'https://{host}:8008/api/notifications/webhook'
-            if host:
-                print(
-                    f"[ProxMenux] webhook URL fallback to 127.0.0.1: "
-                    f"cert hostname '{host}' does not resolve to a local "
-                    f"IP — PVE will likely report a TLS verification "
-                    f"error. Fix by ensuring the FQDN resolves on this "
-                    f"host (e.g. /etc/hosts entry)."
-                )
-        return 'https://127.0.0.1:8008/api/notifications/webhook'
+        if cfg.get('enabled'):
+            return f'http://127.0.0.1:{WEBHOOK_LOOPBACK_PORT}/api/notifications/webhook'
     except Exception:
-        return 'http://127.0.0.1:8008/api/notifications/webhook'
+        pass
+    return 'http://127.0.0.1:8008/api/notifications/webhook'
 
 
 # Backward-compat alias for callers that read this at import time. Most
@@ -988,15 +908,48 @@ def _pve_read_file(path):
         return None, str(e)
 
 
+_PVE_BACKUPS_KEPT = 3
+
+
 def _pve_backup_file(path):
-    """Create timestamped backup if file exists. Never fails fatally."""
+    """Create timestamped backup if file exists. Never fails fatally.
+
+    The backups live next to the file, inside the cluster filesystem, whose
+    size is limited: a copy identical to the newest one is not written again
+    and only the newest few are kept. Restore uses the newest.
+    """
     import os, shutil
     from datetime import datetime
     try:
-        if os.path.exists(path):
+        if not os.path.exists(path):
+            return
+        directory, name = os.path.split(path)
+        prefix = f"{name}.proxmenux_backup_"
+        existing = sorted(
+            (os.path.join(directory, f) for f in os.listdir(directory) if f.startswith(prefix)),
+            key=os.path.getmtime, reverse=True,
+        )
+        with open(path, 'rb') as f:
+            current = f.read()
+        newest_matches = False
+        if existing:
+            try:
+                with open(existing[0], 'rb') as f:
+                    newest_matches = f.read() == current
+            except OSError:
+                pass
+        if not newest_matches:
             ts = datetime.now().strftime('%Y%m%d_%H%M%S')
-            backup = f"{path}.proxmenux_backup_{ts}"
-            shutil.copy2(path, backup)
+            shutil.copy2(path, os.path.join(directory, prefix + ts))
+            existing = sorted(
+                (os.path.join(directory, f) for f in os.listdir(directory) if f.startswith(prefix)),
+                key=os.path.getmtime, reverse=True,
+            )
+        for stale in existing[_PVE_BACKUPS_KEPT:]:
+            try:
+                os.remove(stale)
+            except OSError:
+                pass
     except Exception:
         pass
 
diff --git a/AppImage/scripts/flask_server.py b/AppImage/scripts/flask_server.py
index 6790784d..48f02c7c 100644
--- a/AppImage/scripts/flask_server.py
+++ b/AppImage/scripts/flask_server.py
@@ -678,6 +678,36 @@ def _warmup_lxc_ip_cache() -> int:
     return count
 
 
+def _lxc_isolated_ips(vmid):
+    """Static addresses on interfaces that have no way out of the host.
+
+    lxc-info lists a container's addresses without saying which interface
+    carries each, so a container with a second network leg could be offered
+    at an address nobody can open: a ProxMenux stack wires its members through
+    a private bridge, and Paperless-ngx answered on 10.77.0.30 instead of its
+    LAN address. The interface a reader reaches is the one with a route out —
+    DHCP, or a static address with a gateway. A static address with no gateway
+    is local to the host, and is kept only as a last resort.
+    """
+    try:
+        with open(f"/etc/pve/lxc/{int(vmid)}.conf", encoding="utf-8") as handle:
+            text = handle.read()
+    except (OSError, ValueError):
+        return set()
+    isolated = set()
+    for line in text.splitlines():
+        if line.startswith("["):
+            break  # snapshot sections describe past states, not this one
+        match = re.match(r"net\d+:\s*(.*)", line)
+        if not match:
+            continue
+        options = dict(part.split("=", 1) for part in match.group(1).split(",") if "=" in part)
+        address = options.get("ip", "")
+        if address and address not in ("dhcp", "manual") and "gw" not in options:
+            isolated.add(address.split("/", 1)[0])
+    return isolated
+
+
 def get_lxc_ip_from_lxc_info(vmid):
     """Get LXC IP addresses using lxc-info command (for DHCP containers)
     Returns a dict with all IPs and classification"""
@@ -705,6 +735,9 @@ def get_lxc_ip_from_lxc_info(vmid):
                     else:
                         # Real network IPs (192.168.x.x, 10.x.x.x, etc.)
                         real_ips.append(ip)
+                isolated = _lxc_isolated_ips(vmid)
+                if isolated:
+                    real_ips.sort(key=lambda ip: ip in isolated)
                 
                 return {
                     'all_ips': ips,
@@ -3369,7 +3402,7 @@ def get_available_updates():
     _system_info_cache['available_updates_stamp'] = stamp
     return available_updates
 
-# AGREGANDO FUNCIÓN PARA PARSEAR PROCESOS DE INTEL_GPU_TOP (SIN -J)
+# Parse intel_gpu_top process output without -J.
 def get_intel_gpu_processes_from_text():
     """Parse processes from intel_gpu_top text output (more reliable than JSON)"""
     try:
@@ -3384,7 +3417,7 @@ def get_intel_gpu_processes_from_text():
                 bufsize=1
             )
         except FileNotFoundError:
-            # intel_gpu_top no está instalado, retornar lista vacía
+            # intel_gpu_top is not installed; return an empty list
             return []
         
         # Wait 2 seconds for intel_gpu_top to collect data
@@ -5519,7 +5552,7 @@ def _get_proxmox_storage_uncached():
         for resource in resources:
             node = resource.get('node', '')
             
-            # Filtrar solo storage del nodo local
+            # Keep only the local node storage
             if node != local_node:
                 # print(f"[v0] Skipping storage {resource.get('storage')} from remote node: {node}")
                 pass
@@ -5538,7 +5571,7 @@ def _get_proxmox_storage_uncached():
                 pass
                 continue
             
-            # No filtrar storages no disponibles - mantenerlos para mostrar errores
+            # Keep unavailable storages so their errors stay visible
             # Calcular porcentaje
             percent = (used / total * 100) if total > 0 else 0.0
             
@@ -7832,7 +7865,7 @@ def get_detailed_gpu_info(gpu):
                 else:
                     # print(f"[v0] WARNING: No valid JSON objects found", flush=True)
                     pass
-                    # CHANGE: Evitar bloqueo al leer stderr - usar communicate() con timeout
+                    # communicate() with a timeout: reading stderr directly blocks
                     try:
                         # Use communicate() with timeout instead of read() to avoid blocking
                         _, stderr_output = process.communicate(timeout=0.5)
@@ -8312,8 +8345,7 @@ def get_detailed_gpu_info(gpu):
                                 # print(f"[v0] Parsing fdinfo with {len(fdinfo)} entries", flush=True)
                                 pass
                                 
-                                # CHANGE: Corregir parseo de fdinfo con estructura anidada
-                                # fdinfo es un diccionario donde las claves son los PIDs (como strings)
+                                # fdinfo is nested: the keys are the PIDs, as strings
                                 for pid_str, proc_data in fdinfo.items():
                                     try:
                                         process_info = {
@@ -13764,6 +13796,13 @@ def api_vm_apps_suggestions(vmid):
         return jsonify({'error': str(e)}), 500
 
 
+@app.route('/api/vms/<int:vmid>/apps/adguard-setup', methods=['GET'])
+@require_auth
+def api_vm_apps_adguard_setup(vmid):
+    import lxc_apps
+    return jsonify({'available': lxc_apps.oci_adguard_setup_available(vmid)})
+
+
 @app.route('/api/vms/<int:vmid>/docker/inventory', methods=['GET'])
 @require_auth
 def api_vm_docker_inventory(vmid):
@@ -14113,6 +14152,8 @@ def _lxc_update_target_labels(
             label = 'Applications'
         elif target == 'docker-engine':
             label = 'Docker Engine'
+        elif target == 'oci_image':
+            label = 'OCI image'
         elif target.startswith('app:'):
             app_item = apps.get(target.split(':', 1)[1]) or {}
             label = str(app_item.get('name') or 'Application')
@@ -15077,7 +15118,7 @@ def api_vms_modal_cache_all():
         return jsonify({'error': str(e)}), 500
 
 
-# CHANGE: Modificar el endpoint para incluir la información completa de IPs
+# The endpoint returns the complete IP information.
 @app.route('/api/vms/<int:vmid>', methods=['GET'])
 @require_auth
 def get_vm_config(vmid):
@@ -15215,6 +15256,38 @@ def api_lxc_mount_points_runtime(vmid):
         return jsonify({"ok": False, "error": str(e)}), 500
 
 
+@app.route('/api/lxc/<int:vmid>/console-log', methods=['GET'])
+@require_auth
+def api_lxc_console_log(vmid):
+    """Console output of a native OCI container. Never cached: the first
+    request returns the last `lines` lines, later ones pass back `offset`
+    and `inode` to receive only what was appended since."""
+    try:
+        import oci_console_logs
+    except ImportError as e:
+        return jsonify({"ok": False, "error": f"helper unavailable: {e}"}), 503
+    try:
+        lines = request.args.get('lines', default=200, type=int)
+        offset = request.args.get('offset', type=int)
+        inode = request.args.get('inode', type=int)
+        return jsonify(oci_console_logs.read(vmid, lines=lines, offset=offset, inode=inode))
+    except Exception as e:
+        return jsonify({"ok": False, "error": str(e)}), 500
+
+
+@app.route('/api/lxc/<int:vmid>/oci-instance', methods=['GET'])
+@require_auth
+def api_lxc_oci_instance(vmid):
+    """Whether the container was installed by OCI manager Apps, its stack,
+    host directories and pending operation, read from its record. Never
+    cached; it also says whether the console log exists (Logs tab)."""
+    try:
+        import oci_instance_info
+        return jsonify(oci_instance_info.info(vmid))
+    except Exception as e:
+        return jsonify({"ok": False, "error": str(e)}), 500
+
+
 @app.route('/api/vms/<int:vmid>/logs', methods=['GET'])
 @require_auth
 def api_vm_logs(vmid):
@@ -22161,6 +22234,41 @@ def _run_scheduled_update(vmid: int, sched: dict) -> dict:
         }
 
     requested_target = sched.get("target") or "both"
+    if requested_targets == ['oci_image']:
+        # A container installed by OCI manager Apps is updated by replacing
+        # its image, through the same flow as the OCI menu, unattended.
+        command = ['bash', '/usr/local/share/proxmenux/scripts/oci/oci_manager_apps.sh',
+                   'manage', str(vmid), '--action', 'update', '--unattended']
+        storage = (sched.get('backup_storage') or '').strip()
+        if sched.get('backup') and storage:
+            command += ['--keep-backup', storage]
+        if sched.get('acknowledge_external_data'):
+            command.append('--acknowledge-external-data')
+        delay = int(sched.get('release_delay_days') or 0)
+        if delay > 0:
+            command += ['--min-image-age-days', str(delay)]
+        try:
+            proc = subprocess.run(command, stdin=subprocess.DEVNULL, capture_output=True, text=True,
+                                  timeout=4 * 3600, env=dict(os.environ, TERM='dumb'))
+        except subprocess.TimeoutExpired:
+            reasons.append('the OCI image update did not finish in time')
+            return finish('failure', 'oci_image', [])
+        output = re.sub(r'\x1b\[[0-9;?]*[ -/]*[@-~]|\x1b[()][A-Z0-9]|\r', '', (proc.stdout or '') + (proc.stderr or ''))
+        _append_lxc_update_log(log_path, output)
+        if proc.returncode == 0:
+            return finish('success', 'oci_image', ['oci_image'])
+        if proc.returncode == 5:
+            deferred_targets.append('oci_image')
+            reasons.append(f'the new image is younger than {delay} days')
+            return finish('deferred', 'oci_image', [])
+        if proc.returncode == 4:
+            reasons.append('the container has changes made outside ProxMenux; review them in OCI manager Apps')
+            return finish('skipped', 'oci_image', [])
+        if proc.returncode == 3:
+            reasons.append('another OCI operation was running')
+            return finish('skipped', 'oci_image', [])
+        reasons.append('the OCI image update failed; the previous installation is restored when the update started')
+        return finish('failure', 'oci_image', [])
     if not os.path.isfile(_APPLY_UPDATES_SCRIPT):
         reasons.append('update runner is not installed')
         return finish('skipped', requested_target, [])
@@ -22744,6 +22852,18 @@ if __name__ == '__main__':
         print(f"[ProxMenux] SSL config error, falling back to HTTP: {e}")
         ssl_ctx = None
     
+    # With HTTPS on, PVE cannot validate the Monitor certificate against the
+    # system CA store, so its webhook is delivered to this plain-HTTP
+    # listener instead. It binds 127.0.0.1 only and answers nothing but the
+    # webhook route.
+    from flask_notification_routes import WEBHOOK_LOOPBACK_PORT
+
+    def _webhook_loopback_app(environ, start_response):
+        if environ.get('PATH_INFO') == '/api/notifications/webhook':
+            return app(environ, start_response)
+        start_response('404 Not Found', [('Content-Type', 'text/plain')])
+        return [b'Not found']
+
     # Use gevent for SSL+WebSocket support, or fallback to Flask dev server
     gevent_available = False
     ssl_loaded = False
@@ -22842,11 +22962,26 @@ if __name__ == '__main__':
                     ssl_context=ssl_context
                 )
                 gevent_available = True
+                try:
+                    webhook_server = pywsgi.WSGIServer(
+                        ('127.0.0.1', WEBHOOK_LOOPBACK_PORT), _webhook_loopback_app, log=None)
+                    webhook_server.start()
+                    print(f"[ProxMenux] PVE webhook listener on 127.0.0.1:{WEBHOOK_LOOPBACK_PORT}")
+                except Exception as _e:
+                    print(f"[ProxMenux] WARN: PVE webhook listener could not start on "
+                          f"127.0.0.1:{WEBHOOK_LOOPBACK_PORT} ({_e}); PVE notifications will not arrive", flush=True)
                 server.serve_forever()
             except ImportError as e:
                 print(f"[ProxMenux] gevent not available ({e})")
                 # Fallback: Flask dev server with SSL - flask-sock handles WebSockets
                 ssl_context = auth_manager.create_reloadable_ssl_context(ssl_cert, ssl_key)
+                try:
+                    from werkzeug.serving import make_server
+                    _webhook_srv = make_server('127.0.0.1', WEBHOOK_LOOPBACK_PORT, _webhook_loopback_app, threaded=True)
+                    threading.Thread(target=_webhook_srv.serve_forever, daemon=True).start()
+                    print(f"[ProxMenux] PVE webhook listener on 127.0.0.1:{WEBHOOK_LOOPBACK_PORT}")
+                except Exception as _e:
+                    print(f"[ProxMenux] WARN: PVE webhook listener could not start ({_e})", flush=True)
                 print("[ProxMenux] Starting Flask server with SSL (using flask-sock for WebSockets)...")
                 app.run(host='::', port=8008, debug=False, ssl_context=ssl_context, threaded=True)
         else:
diff --git a/AppImage/scripts/flask_terminal_routes.py b/AppImage/scripts/flask_terminal_routes.py
index fca4d5d1..002b12bf 100644
--- a/AppImage/scripts/flask_terminal_routes.py
+++ b/AppImage/scripts/flask_terminal_routes.py
@@ -199,7 +199,7 @@ def search_command():
                         'command': stripped
                     })
                     
-                    # Resetear descripciones para el siguiente comando
+                    # Reset the descriptions for the next command
                     current_description = []
             
             return jsonify({
diff --git a/AppImage/scripts/health_monitor.py b/AppImage/scripts/health_monitor.py
index 124ef115..de1e85ee 100644
--- a/AppImage/scripts/health_monitor.py
+++ b/AppImage/scripts/health_monitor.py
@@ -4146,7 +4146,8 @@ class HealthMonitor:
         New thresholds:
         - CASCADE: ≥15 errors (increased from 10)
         - SPIKE: ≥5 errors AND 4x increase (more restrictive)
-        - PERSISTENT: Same error in 3 consecutive checks
+        - PERSISTENT: the same pattern seen in at least 3 checks whose
+          occurrences span 15+ minutes, and still present in this check
         """
         cache_key = 'logs_analysis'
         current_time = time.time()
@@ -4193,6 +4194,8 @@ class HealthMonitor:
                 
                 recent_patterns = defaultdict(int)
                 previous_patterns = defaultdict(int)
+                # Patterns present in this check; each counts one check once.
+                seen_this_check = set()
                 critical_errors_found = {} # To store unique critical error lines for persistence
                 
                 for line in recent_lines:
@@ -4363,10 +4366,15 @@ class HealthMonitor:
                     else:
                         self.persistent_log_patterns[pattern] = {
                             'count': 1,
+                            'checks': 0,
                             'first_seen': current_time,
                             'last_seen': current_time,
                             'sample': line.strip()[:200],  # Original line for display
                         }
+                    if pattern not in seen_this_check:
+                        seen_this_check.add(pattern)
+                        self.persistent_log_patterns[pattern]['checks'] = \
+                            self.persistent_log_patterns[pattern].get('checks', 0) + 1
                 
                 for line in previous_lines:
                     if not line.strip():
@@ -4409,10 +4417,23 @@ class HealthMonitor:
                         samples.append(clean[:120])
                     return samples
                 
+                # A pattern that stopped appearing is forgotten before the
+                # evaluation, and its own warning (if it had one) is closed.
+                patterns_to_remove = [
+                    p for p, data in self.persistent_log_patterns.items()
+                    if current_time - data['last_seen'] > 1800
+                ]
+                for pattern in patterns_to_remove:
+                    del self.persistent_log_patterns[pattern]
+
+                # Persistent means recurring: present in this check, seen in at
+                # least three checks, and with occurrences spanning 15 minutes.
+                # A burst that ended is not persistent however long ago it began.
                 persistent_errors = {}
                 for pattern, data in self.persistent_log_patterns.items():
-                    time_span = current_time - data['first_seen']
-                    if data['count'] >= 3 and time_span >= 900:  # 15 minutes
+                    span = data['last_seen'] - data['first_seen']
+                    if (pattern in seen_this_check and data.get('checks', 1) >= 3
+                            and data['count'] >= 3 and span >= 900):
                         persistent_errors[pattern] = data['count']
                         
                         # Record as warning if not already recorded
@@ -4437,12 +4458,14 @@ class HealthMonitor:
                                          'dismissable': True, 'occurrences': data['count']}
                             )
                 
-                patterns_to_remove = [
-                    p for p, data in self.persistent_log_patterns.items()
-                    if current_time - data['last_seen'] > 1800
-                ]
-                for pattern in patterns_to_remove:
-                    del self.persistent_log_patterns[pattern]
+                # Close the per-pattern warnings of patterns that are no
+                # longer persistent: the burst ended, or it was forgotten.
+                for pattern in list(self.persistent_log_patterns.keys()) + patterns_to_remove:
+                    if pattern in persistent_errors:
+                        continue
+                    stale_key = f'log_persistent_{hashlib.md5(pattern.encode()).hexdigest()[:8]}'
+                    if health_persistence.is_error_active(stale_key, category='logs'):
+                        health_persistence.clear_error(stale_key)
                 
                 # B5 fix: Cap size to prevent unbounded memory growth under high error load
                 MAX_LOG_PATTERNS = 500
diff --git a/AppImage/scripts/lxc_apps.py b/AppImage/scripts/lxc_apps.py
index 117e077f..124b8fcb 100644
--- a/AppImage/scripts/lxc_apps.py
+++ b/AppImage/scripts/lxc_apps.py
@@ -29,6 +29,7 @@ import datetime
 import copy
 import concurrent.futures
 import hashlib
+import ipaddress
 import json
 import os
 import re
@@ -36,6 +37,7 @@ import signal
 import shlex
 import socket
 import subprocess
+import sys
 import threading
 import time
 import urllib.error
@@ -62,7 +64,7 @@ _UPSTREAM_CACHE_TTL_SEC = 24 * 3600
 
 _VALID_METHODS = ("dpkg", "apk", "file", "binary",
                   "python_dist", "docker_label", "docker_exec",
-                  "command", "manual")
+                  "command", "manual", "oci_image")
 _DETECTOR_FIELDS = (
     "package", "file_path", "file_regex", "binary_path", "binary_args",
     "python_path", "distribution", "container_name", "label",
@@ -93,7 +95,7 @@ _VALID_UPSTREAM_TYPES = ("github", "http_json", "docker_hub")
 # exposes and the freeform "custom" text field.
 _VALID_SCHEDULE_TARGETS = ("os", "app", "both")
 _SCHEDULE_TARGET_ID_RE = re.compile(
-    r"^(?:os|apps|app:[A-Za-z0-9_-]{1,64}|docker-engine|docker-(?:compose|container):[A-Za-z0-9][A-Za-z0-9_.-]{0,127}|docker-unit:[a-f0-9]{20})$"
+    r"^(?:os|apps|oci_image|app:[A-Za-z0-9_-]{1,64}|docker-engine|docker-(?:compose|container):[A-Za-z0-9][A-Za-z0-9_.-]{0,127}|docker-unit:[a-f0-9]{20})$"
 )
 _BULK_TARGET_ID_RE = re.compile(
     r"^(?:os|app:[A-Za-z0-9_-]{1,64}|docker-engine|docker-unit:[a-f0-9]{20})$"
@@ -886,6 +888,10 @@ def validate_schedule(payload: Any) -> tuple[bool, Any]:
         "backup_storage": backup_storage,
         "restart": restart,
         "release_delay_days": release_delay_days,
+        # Host directories of an OCI container are not reverted by its
+        # backup; a scheduled image update runs only when this was
+        # confirmed when the schedule was saved.
+        "acknowledge_external_data": bool(payload.get("acknowledge_external_data")),
     }
     # Preserve `last_run_at` / `last_run_status` when the caller sent
     # them (typical when the scheduler writes back after firing);
@@ -951,7 +957,12 @@ def validate_config(payload: dict) -> tuple[bool, Any]:
     if method:
         conf["installed_via"] = method
 
-    if method in ("dpkg", "apk"):
+    if method == "oci_image":
+        # Everything it needs is in the installation record ProxMenux wrote:
+        # the image, the digest and the registry. There is no field to fill
+        # and no upstream to configure.
+        pass
+    elif method in ("dpkg", "apk"):
         pkg = (payload.get("package") or "").strip()
         if not pkg or not _PACKAGE_RE.match(pkg):
             return _err("package is required (letters/digits/._+@:/ up to 127 chars)")
@@ -1345,6 +1356,15 @@ def detect_installed_version(vmid, config: dict) -> tuple[Optional[str], Optiona
     # tag_regex is reused (backward-compat with older hints).
     pattern = config.get("installed_regex") or config.get("tag_regex") or r"(\d+[.\d]+)"
 
+    if method == "oci_image":
+        result = _oci_image_versions(vmid, with_latest=False)
+        if result.get("error"):
+            return None, result["error"]
+        # An image that states no application version is still an image with
+        # a build date and a digest, which is what its updates are decided on.
+        return (result.get("installed_version")
+                or _oci_image_label(None, result.get("image_created"), result.get("installed_digest"))), None
+
     if method == "dpkg":
         rc, out, err = _pct_exec(vmid, ["dpkg-query", "-W", "-f=${Version}", config["package"]])
         if rc != 0:
@@ -3767,9 +3787,14 @@ def partition_scheduled_release_targets(
         # A delegated app has no updater of its own and never resolves a
         # release date, so including it would hold the whole schedule back
         # waiting for a date that will never arrive.
+        # An application ProxMenux installed from an OCI image is updated by
+        # replacing its image through the OCI engine's own transaction, not by
+        # a helper or a command inside the guest, so a scripted plan has
+        # nothing it could run for it.
         if (not app_id or app.get("managed_oci_app_id")
                 or app.get("helper_slug") == "docker"
-                or app.get("update_via") == "docker"):
+                or app.get("update_via") == "docker"
+                or app.get("installed_via") == "oci_image"):
             continue
         if not select_all_apps and app_id not in selected_app_ids:
             continue
@@ -3962,13 +3987,20 @@ def _app_update_notification_payload(vmid, app: dict) -> Optional[dict]:
         return None
     state = app.get("state") or {}
     latest = state.get("latest_version")
+    installed = state.get("installed_version")
+    if app.get("installed_via") == "oci_image" and state.get("latest_digest"):
+        # What is published is an image. Naming it by version, build date and
+        # digest keeps two rebuilds of the same version from being taken for
+        # one notification, and tells the reader what actually changed.
+        latest = _oci_image_label(latest, state.get("latest_image_created"), state.get("latest_digest"))
+        installed = _oci_image_label(installed, state.get("image_created"), state.get("installed_digest"))
     if not state.get("update_available") or not latest:
         return None
     return {
         "vmid": int(vmid),
         "ct_name": app.get("name") or f"CT-{vmid}",
         "app_name": app.get("name") or "app",
-        "installed": state.get("installed_version") or "unknown",
+        "installed": installed or "unknown",
         "latest": latest,
         "app_id": str(app.get("id") or ""),
     }
@@ -4291,6 +4323,28 @@ def check_app(
             except (ValueError, TypeError):
                 pass
 
+        if app.get("installed_via") == "oci_image":
+            result = _oci_image_versions(vmid, known=state)
+            app["state"] = {
+                "installed_version": result.get("installed_version"),
+                "latest_version": result.get("latest_version"),
+                "latest_published_at": None,
+                "update_available": result.get("update_available"),
+                "error": result.get("error"),
+                "checked_at": _now_iso(),
+                "installed_digest": result.get("installed_digest"),
+                "latest_digest": result.get("latest_digest"),
+                "image_created": result.get("image_created"),
+                "latest_image_created": result.get("latest_image_created"),
+                "image_reference": result.get("image_reference"),
+                "image_repository": result.get("image_repository"),
+            }
+            sidecar["updated_at"] = _now_iso()
+            _write_sidecar(vmid, sidecar)
+            if notify and app["state"]["update_available"] and app["state"]["latest_version"]:
+                _fire_update_notification(vmid, app)
+            return sidecar
+
         installed, inst_err, _healed = _detect_with_alt_healing(vmid, app)
         # Trigger the upstream fetch when ANY upstream source is
         # configured. The dispatcher inside `fetch_latest_upstream`
@@ -4511,6 +4565,12 @@ def _summarise_app(app: dict) -> dict:
         # match this registered app against the CT's helper_slug and
         # display its installed/upstream versions.
         "helper_slug": app.get("helper_slug") or "",
+        # OCI image identity, for the Updates tab of an OCI container.
+        "image_reference": state.get("image_reference"),
+        "image_created": state.get("image_created"),
+        "installed_digest": state.get("installed_digest"),
+        "latest_image_created": state.get("latest_image_created"),
+        "latest_digest": state.get("latest_digest"),
     }
 
 
@@ -5238,6 +5298,276 @@ def _helper_slug_meta(vmid) -> Optional[dict]:
     return None
 
 
+_OCI_INSTANCE_ROOT = "/usr/local/share/proxmenux/oci/instances"
+_OCI_CATALOG_INDEX = "/usr/local/share/proxmenux/oci/engine/catalog/index.json"
+_oci_catalog_cache: tuple[float, dict] | None = None
+
+
+def _oci_catalog_icons() -> dict:
+    """Current icon per catalog application, keyed by template id.
+
+    The installation record keeps a copy of the catalog entry as it stood on
+    the day of the install, which freezes the icon along with everything else.
+    Icons get corrected — most of the catalog used to point at a URL that
+    answered 404 — so the panel reads the catalog and keeps the record as the
+    fallback for an application the catalog no longer lists.
+    """
+    global _oci_catalog_cache
+    now = time.time()
+    if _oci_catalog_cache and now - _oci_catalog_cache[0] < 600:
+        return _oci_catalog_cache[1]
+    icons: dict = {}
+    try:
+        with open(_OCI_CATALOG_INDEX, encoding="utf-8") as handle:
+            for item in (json.load(handle) or {}).get("applications", []):
+                icon = (item or {}).get("icon")
+                if not isinstance(icon, str) or not icon.startswith("http"):
+                    continue
+                # An installation records the template id; the catalog is keyed
+                # by the application id and carries both.
+                for key in (item.get("template_id"), item.get("id")):
+                    if key:
+                        icons.setdefault(key, icon)
+    except (OSError, ValueError, TypeError):
+        pass
+    _oci_catalog_cache = (now, icons)
+    return icons
+
+
+def _oci_localised(value) -> str:
+    """A catalog_ui text field, which is either a string or a locale map."""
+    if isinstance(value, str):
+        return value.strip()
+    if isinstance(value, dict):
+        for key in ("en_US", "en", *sorted(value)):
+            text = value.get(key)
+            if isinstance(text, str) and text.strip():
+                return text.strip()
+    return ""
+
+
+def _oci_name_from_image(reference: str | None) -> str:
+    """A presentable name for an image that carries no catalog entry.
+
+    A stack member records the image it runs and the role it plays, not a
+    title: `nextcloud:latest` as the `application` of a Nextcloud stack.
+    """
+    repository = str(reference or "").split("@", 1)[0]
+    basename = repository.rsplit("/", 1)[-1].rsplit(":", 1)[0].strip()
+    if not basename:
+        return ""
+    return " ".join(word.capitalize() for word in re.split(r"[-_.]+", basename) if word)
+
+
+def _oci_instance_meta(vmid) -> Optional[dict]:
+    """What ProxMenux itself recorded when it installed this container.
+
+    The sibling of `_helper_slug_meta`, and stronger evidence: a helper slug
+    is a hint read back out of the guest, while this is the contract the
+    installer wrote. It needs no `pct exec`, so it also answers for a stopped
+    container, and it cannot mistake an incidental binary for the application
+    — CT 152 runs Chromium and happens to have Docker inside, which the
+    runtime probe reported as the only candidate.
+    """
+    try:
+        with open(f"{_OCI_INSTANCE_ROOT}/{int(vmid)}/oci-compose.json", encoding="utf-8") as handle:
+            record = json.load(handle)
+    except (OSError, ValueError, TypeError):
+        return None
+    if not isinstance(record, dict) or record.get("status") not in ("installed", "assembling"):
+        return None
+    template = record.get("template") or {}
+    contract = template.get("container_contract") or {}
+    image = contract.get("image") or {}
+    observed_image = (record.get("observed") or {}).get("image") or {}
+    # A stack member carries only its own image contract; the presentation
+    # belongs to the stack it is part of, which records its title, site,
+    # category and the endpoint the stack is reached on.
+    stack = record.get("stack") if isinstance(record.get("stack"), dict) else {}
+    stack_template = stack.get("template") if isinstance(stack.get("template"), dict) else {}
+    role = str((record.get("stack_member") or {}).get("name") or "").strip()
+
+    member = record.get("stack_member") or {}
+    is_primary = not stack_template or member.get("primary_vmid") in (None, record.get("vmid"))
+    ui = template.get("catalog_ui") or stack_template.get("catalog_ui") or {}
+    if not template.get("catalog_ui") and stack_template and is_primary:
+        # Only the member the stack is reached on inherits the stack endpoint.
+        # The cache and the database of a Nextcloud stack do not answer on its
+        # web port, and offering it would register a service that is not there.
+        template = {**stack_template, "id": template.get("id") or stack_template.get("id")}
+    elif not template.get("catalog_ui") and stack_template:
+        ui = {key: value for key, value in ui.items()
+              if key in ("category", "category_label")}
+    # `container_contract.ports` lists every port the image exposes; the
+    # endpoint is the one the application is actually reached on, with its
+    # scheme. Chromium exposes 3000 and 3001 and serves on 3001 over https.
+    endpoint = next((e for e in (template.get("first_run") or {}).get("endpoints") or []
+                     if isinstance(e, dict) and e.get("port")), None) or ui.get("launch") or {}
+    ports = []
+    for entry in contract.get("ports") or []:
+        try:
+            port = int((entry or {}).get("container_port"))
+        except (TypeError, ValueError):
+            continue
+        if 1 <= port <= 65535 and port not in ports:
+            ports.append(port)
+    template_id = str(template.get("id") or "").strip()
+    catalog_icons = _oci_catalog_icons()
+    logo = catalog_icons.get(template_id) or ""
+    if not logo:
+        # A stack or a one-off image has no catalog entry of its own, but the
+        # image it runs usually does: the Nextcloud stack wears Nextcloud's.
+        repository = str(image.get("reference") or "").split("@", 1)[0]
+        basename = repository.rsplit("/", 1)[-1].rsplit(":", 1)[0].strip().lower()
+        logo = catalog_icons.get(basename) or ""
+    if not logo:
+        logo = ui.get("icon") if isinstance(ui.get("icon"), str) else ""
+    website = ui.get("website") if isinstance(ui.get("website"), str) else ""
+    return {
+        "template_id": template_id or None,
+        "name": (_oci_localised(ui.get("title"))
+                 or _oci_name_from_image(image.get("reference"))
+                 or str(template.get("id") or "").strip() or None),
+        "role": role or None,
+        "logo": logo if logo.startswith(("http://", "https://")) else "",
+        "website": website if website.startswith(("http://", "https://")) else "",
+        "category": str(ui.get("category") or "").strip() or None,
+        "category_label": str(ui.get("category_label") or "").strip() or None,
+        "image_reference": str(image.get("reference") or "").strip() or None,
+        # The repository of the image — its GitHub project, or its page on the
+        # registry for an official image — which is where its updates come from.
+        "repository": (str(ui.get("repository") or "").strip()
+                       or str((template.get("source") or {}).get("repository") or "").strip() or None),
+        "endpoint_port": endpoint.get("port") if isinstance(endpoint.get("port"), int) else None,
+        "endpoint_scheme": str(endpoint.get("scheme") or "").strip().lower() or None,
+        "endpoint_path": str(endpoint.get("path") or "").strip() or None,
+        "ports": ports,
+        # The exact image this container was created from. Its digest is what
+        # an update is decided on; the version label is only for reading.
+        "installed_digest": str(observed_image.get("manifest_digest") or "").strip() or None,
+        "architecture": str(observed_image.get("architecture") or "").strip() or None,
+    }
+
+
+def oci_adguard_setup_available(vmid) -> bool:
+    """Probe only this OCI application's setup endpoint, without caching it."""
+    meta = _oci_instance_meta(vmid)
+    if not meta or meta.get('template_id') != 'image-adguard-home':
+        return False
+    try:
+        result = subprocess.run(['lxc-info', '-n', str(int(vmid)), '-iH'],
+                                capture_output=True, text=True, timeout=3, check=True)
+        ip = next(str(ipaddress.IPv4Address(value.strip()))
+                  for value in result.stdout.splitlines()
+                  if value.strip() and ipaddress.ip_address(value.strip()).version == 4)
+        with socket.create_connection((ip, 3000), timeout=1) as connection:
+            connection.settimeout(1)
+            connection.sendall(b'GET / HTTP/1.0\r\nHost: localhost\r\n\r\n')
+            return connection.recv(32).startswith(b'HTTP/')
+    except (OSError, ValueError, StopIteration, subprocess.SubprocessError):
+        return False
+
+
+_OCI_REMOTE_DIR = "/usr/local/share/proxmenux/oci/engine/remote"
+
+
+def _oci_state_module():
+    """The OCI engine's own reader of image versions.
+
+    Reused rather than copied: it resolves the platform manifest, reads the
+    version the image states in its environment before the label it may
+    have inherited from its base, and it is the same code the engine
+    installs and updates with, so the panel and the updater cannot disagree
+    about what an image is.
+    """
+    if _OCI_REMOTE_DIR not in sys.path:
+        sys.path.insert(0, _OCI_REMOTE_DIR)
+    import oci_installation_state
+    return oci_installation_state
+
+
+def _oci_repository(reference: str) -> str:
+    repository = reference.split("@", 1)[0]
+    if ":" in repository.rsplit("/", 1)[-1]:
+        repository = repository.rsplit(":", 1)[0]
+    return repository
+
+
+def _oci_resolve(module, reference: str, architecture: str) -> dict:
+    # One retry: an anonymous registry answers the occasional request with an
+    # error that the next one does not repeat.
+    try:
+        return module.resolve_candidate(reference, architecture)
+    except RuntimeError:
+        time.sleep(2)
+        return module.resolve_candidate(reference, architecture)
+
+
+def _oci_image_versions(vmid, known: Optional[dict] = None, with_latest: bool = True) -> dict:
+    """Installed and published version of a container ProxMenux installed.
+
+    Nothing is inferred. The installation record names the image and the
+    exact digest the container was created from; the registry says which
+    digest the same tag points at today. An update is available when those
+    two differ — the version strings only say which one it is, and they are
+    not compared, because a rebuild can keep its number and a build id such
+    as ``b1ee1dc8-ls55`` has no order to compare.
+
+    The installed version is read by digest, which never changes, so a
+    previous answer for the same digest is reused instead of asked again.
+    """
+    meta = _oci_instance_meta(vmid)
+    if not meta or not meta.get("image_reference") or not meta.get("installed_digest"):
+        return {"error": "no OCI installation record for this container"}
+    reference = meta["image_reference"]
+    architecture = meta.get("architecture") or "amd64"
+    installed_digest = meta["installed_digest"]
+    result: dict = {"installed_digest": installed_digest, "image_reference": reference,
+                    "image_repository": meta.get("repository")}
+    try:
+        module = _oci_state_module()
+    except Exception as exc:
+        return {**result, "error": f"OCI engine unavailable: {exc}"}
+
+    known = known or {}
+    if (known.get("installed_digest") == installed_digest
+            and (known.get("installed_version") or known.get("image_created"))):
+        result["installed_version"] = known.get("installed_version")
+        result["image_created"] = known.get("image_created")
+    else:
+        try:
+            installed = _oci_resolve(
+                module, f"{_oci_repository(reference)}@{installed_digest}", architecture)
+            result["installed_version"] = installed.get("version")
+            result["image_created"] = installed.get("created")
+        except Exception as exc:
+            return {**result, "error": f"could not read the installed image: {exc}"}
+    if not with_latest:
+        return result
+    try:
+        latest = _oci_resolve(module, reference, architecture)
+    except Exception as exc:
+        return {**result, "error": f"could not read {reference} from its registry: {exc}"}
+    latest_digest = latest.get("manifest_digest")
+    # The image decides. An application whose version did not move can still
+    # have a new image — a rebuild on a patched base — and that is an update
+    # for a container whose application only changes when its image does.
+    replaced = bool(latest_digest) and latest_digest != installed_digest
+    result.update(latest_digest=latest_digest, latest_version=latest.get("version"),
+                  latest_image_created=latest.get("created"), update_available=replaced)
+    return result
+
+
+def _oci_image_label(version: Optional[str], created: Optional[str], digest: Optional[str]) -> str:
+    """One image, as a line a reader can compare: version, build date, digest."""
+    parts = [version] if version else []
+    if created:
+        parts.append(str(created)[:10])
+    if digest:
+        parts.append(str(digest).split(":", 1)[-1][:8])
+    return " · ".join(parts) or "unknown"
+
+
 def _catalog_lookup(slug: str) -> Optional[dict]:
     """Fetch the community-scripts catalog entry for a slug.
     Returns {name, updateable, default_port, logo} or None.
@@ -5292,6 +5622,7 @@ def get_suggestions(vmid, force: bool = False) -> dict:
         if p in _KNOWN_WEB_PORTS:
             web_hint = "/"
             break
+    oci_meta = _oci_instance_meta(vmid)
     meta = _helper_slug_meta(vmid) or {}
     slug = meta.get("slug")
     # Suppress base-OS helper slugs from the suggestion pipeline.
@@ -5318,7 +5649,10 @@ def get_suggestions(vmid, force: bool = False) -> dict:
         detector.get("installed_via") in ("docker_label", "docker_exec")
         for detector in primary_matches
     )
-    if "docker" in detected_map and primary_is_docker_workload:
+    # An OCI container installed by ProxMenux is the application named in its
+    # own record. Promoting a probed binary over that would offer Docker for a
+    # Chromium container just because the image ships a docker client.
+    if "docker" in detected_map and primary_is_docker_workload and not oci_meta:
         slug = "docker"
         meta = {"slug": "docker", "name": "Docker"}
     # Tracking hint pipeline: catalog + curated hints merged.
@@ -5560,6 +5894,47 @@ def get_suggestions(vmid, force: bool = False) -> dict:
             "tracking_suggestion": det_tracking,
         })
 
+    if oci_meta:
+        # The record states what this container runs, so a probe finding is
+        # noise: CT 152 runs Chromium and ships a docker client, and offering
+        # to register Docker there invites the user to track the wrong thing.
+        extras = []
+        # Recorded facts replace every probed guess: the name, the logo, the
+        # site and the endpoint the application is served on. The version is
+        # not filled here — the image has no detector among the guest-side
+        # methods — so the entry registers without version tracking until the
+        # OCI detector exists.
+        name_sug = oci_meta["name"] or name_sug
+        logo_url = oci_meta["logo"] or logo_url
+        category_suggestion = oci_meta["category_label"] or suggest_category_for(slug)
+        if oci_meta["endpoint_port"]:
+            default_ports = [oci_meta["endpoint_port"]]
+            ports = [oci_meta["endpoint_port"]] + [p for p in (oci_meta["ports"] or ports)
+                                                   if p != oci_meta["endpoint_port"]]
+        elif oci_meta["ports"]:
+            default_ports = list(oci_meta["ports"])
+        web_hint = oci_meta["endpoint_path"] or web_hint
+        if oci_meta["template_id"] == "image-adguard-home":
+            # The first-run endpoint disappears once setup switches to :80.
+            default_ports = [80]
+            ports = [80, 3000]
+        # Version tracking comes with the registration. Its updates are
+        # decided by the image, which always has a build date and a digest,
+        # so it applies even to an image that states no application version.
+        versions = _oci_image_versions(vmid, with_latest=False)
+        if not versions.get("error"):
+            tracking = {
+                "installed_via": "oci_image",
+                "detected_version": versions.get("installed_version") or _oci_image_label(
+                    None, versions.get("image_created"), versions.get("installed_digest")),
+                "detector_verified": True,
+                "detector_source": "oci_instance_record",
+                "logo": logo_url or None,
+                "website": oci_meta["website"] or None,
+            }
+    else:
+        category_suggestion = suggest_category_for(slug)
+
     return {
         "name_suggestion": name_sug,
         "helper_slug": slug,
@@ -5568,9 +5943,20 @@ def get_suggestions(vmid, force: bool = False) -> dict:
         "tracking_suggestion": tracking,
         "default_ports": default_ports,
         "logo_url": logo_url or None,
+        # Identity of a ProxMenux OCI install: the scheme the endpoint is
+        # served on, the image it was created from, and the upstream source.
+        "oci_instance": {
+            "template_id": oci_meta["template_id"],
+            "image_reference": oci_meta["image_reference"],
+            "repository": oci_meta["repository"],
+            "scheme": oci_meta["endpoint_scheme"],
+            "port": oci_meta["endpoint_port"],
+            "path": oci_meta["endpoint_path"],
+            "website": oci_meta["website"],
+        } if oci_meta else None,
         # Categoría preset for the primary detection — same lookup as
         # get_catalog_entry so the Register button pre-selects it.
-        "category": suggest_category_for(slug),
+        "category": category_suggestion,
         "extras": extras,
         "docker_workloads": sorted(docker_workloads, key=lambda item: item["name"].lower()),
         "docker_web_links": docker_web_links,
diff --git a/AppImage/scripts/lxc_mount_points.py b/AppImage/scripts/lxc_mount_points.py
index e3ec6c71..b6736398 100644
--- a/AppImage/scripts/lxc_mount_points.py
+++ b/AppImage/scripts/lxc_mount_points.py
@@ -304,21 +304,56 @@ def _df_via_host_pid(host_pid: str, ct_target: str) -> dict[str, Optional[int]]:
             ["df", "-B1", "--output=size,used,avail", full],
             capture_output=True, text=True, timeout=_STAT_TIMEOUT,
         )
+    except subprocess.TimeoutExpired:
+        # A filesystem that does not answer df will not answer statfs
+        # either; asking again would only double the wait.
+        return empty
+    except OSError:
+        return empty
+    if proc.returncode == 0:
+        lines = [ln for ln in proc.stdout.strip().splitlines() if ln.strip()]
+        parts = lines[-1].split() if len(lines) >= 2 else []
+        if len(parts) >= 3:
+            try:
+                return {
+                    "total_bytes": int(parts[0]),
+                    "used_bytes": int(parts[1]),
+                    "available_bytes": int(parts[2]),
+                }
+            except ValueError:
+                pass
+    return _statfs_via_host(full)
+
+
+def _statfs_via_host(full: str) -> dict[str, Optional[int]]:
+    """Capacity of a path read from its filesystem rather than the mount table.
+
+    df names a path by finding the mount that holds it in the host's own
+    table, and a volume of a native OCI container is not in that table: df
+    answers "no file systems processed" and the tab showed no usage for any
+    of its volumes. statfs asks the filesystem of the path directly and
+    returns the same three figures df prints. It is only reached when df
+    completes without an answer, so every mount df can measure keeps the
+    value it had.
+    """
+    empty = {"total_bytes": None, "used_bytes": None, "available_bytes": None}
+    try:
+        proc = subprocess.run(
+            ["stat", "-f", "-c", "%S %b %f %a", full],
+            capture_output=True, text=True, timeout=_STAT_TIMEOUT,
+        )
         if proc.returncode != 0:
             return empty
-        lines = [ln for ln in proc.stdout.strip().splitlines() if ln.strip()]
-        if len(lines) < 2:
-            return empty
-        parts = lines[-1].split()
-        if len(parts) < 3:
-            return empty
-        return {
-            "total_bytes": int(parts[0]),
-            "used_bytes": int(parts[1]),
-            "available_bytes": int(parts[2]),
-        }
+        block, total, free, available = (int(value) for value in proc.stdout.split())
     except (subprocess.TimeoutExpired, OSError, ValueError):
         return empty
+    if block <= 0 or total <= 0:
+        return empty
+    return {
+        "total_bytes": total * block,
+        "used_bytes": (total - free) * block,
+        "available_bytes": available * block,
+    }
 
 
 def _df_via_pct_exec(vmid: str, ct_target: str,
diff --git a/AppImage/scripts/notification_channels.py b/AppImage/scripts/notification_channels.py
index 0f6b43c8..38bd8f68 100644
--- a/AppImage/scripts/notification_channels.py
+++ b/AppImage/scripts/notification_channels.py
@@ -97,8 +97,7 @@ class RateLimiter:
         # Counter of events dropped while over the rate limit. Surfaced via
         # `consume_drop_count()` so the dispatch loop can periodically log
         # "X events suppressed by rate-limit" instead of letting them
-        # disappear silently. Audit Tier 6 — `RateLimiter` descarta
-        # silenciosamente eventos sobre el límite.
+        # disappear silently.
         self._dropped: int = 0
 
     def allow(self) -> bool:
diff --git a/AppImage/scripts/notification_events.py b/AppImage/scripts/notification_events.py
index 86a75ae5..6434a3d5 100644
--- a/AppImage/scripts/notification_events.py
+++ b/AppImage/scripts/notification_events.py
@@ -2502,8 +2502,7 @@ class TaskWatcher:
         # Manual starts (onboot=0) within the grace period also bypass the
         # aggregator: a user manually starting a VM right after boot wants
         # the individual confirmation, not their action silently rolled into
-        # the autostart summary. Audit Tier 6 — `system_startup` aggregation
-        # puede tragar VM starts manuales del usuario durante grace period.
+        # the autostart summary.
         _STARTUP_EVENTS = {'vm_start', 'ct_start'}
         if event_type in _STARTUP_EVENTS and not is_error and not is_warning:
             if _shared_state.is_startup_period():
diff --git a/AppImage/scripts/notification_templates.py b/AppImage/scripts/notification_templates.py
index 66a9065a..c9cff319 100644
--- a/AppImage/scripts/notification_templates.py
+++ b/AppImage/scripts/notification_templates.py
@@ -1353,8 +1353,7 @@ TEMPLATES = {
         # `system-mail` event, and the Monitor forwards it to every enabled
         # channel. Most operators want smartd alerts but NOT noisy cron
         # output — without a visible toggle the only fix is editing
-        # /etc/aliases or removing MAILTO from the cron job. Audit Tier 6
-        # — `system_mail` toggle no visible en UI / reportado por usuario.
+        # /etc/aliases or removing MAILTO from the cron job.
     },
     'apt_listchanges': {
         'title': '{hostname}: {pve_title}',
diff --git a/AppImage/scripts/oci_console_logs.py b/AppImage/scripts/oci_console_logs.py
new file mode 100644
index 00000000..82d93590
--- /dev/null
+++ b/AppImage/scripts/oci_console_logs.py
@@ -0,0 +1,132 @@
+"""Console output of a native OCI container, read from the host.
+
+ProxMenux creates every OCI container with `lxc.console.logfile` pointing at
+`/var/log/proxmenux/oci/<vmid>.console.log`: liblxc copies the stdout and
+stderr of the image's entrypoint there, the way `docker logs` keeps them. The
+file already exists on the host, so nothing here runs inside the container.
+
+The path is derived from the VMID and confirmed against the container's own
+configuration; no caller can name a file. Reads are bounded — the last lines
+on first open, then only what was appended since the offset the viewer holds —
+and a file that got shorter or was replaced (logrotate's copytruncate, a
+container rebuilt by an update) resets the viewer instead of returning garbage.
+"""
+from __future__ import annotations
+
+import os
+import re
+
+LOG_DIR = "/var/log/proxmenux/oci"
+TAIL_READ_LIMIT = 2 * 1024 * 1024     # bytes scanned to find the last lines
+FOLLOW_READ_LIMIT = 512 * 1024        # bytes returned per follow request
+MAX_LINES = 2000
+
+# CSI sequences (colours, cursor), OSC sequences (window titles) and the lone
+# ESC-letter codes some programs emit. Stripped, never rendered: the text goes
+# to the page as text.
+_ANSI_RE = re.compile(r"\x1b\[[0-9;?]*[ -/]*[@-~]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-Z\\-_]")
+_CONTROL_RE = re.compile(r"[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]")
+
+
+def log_path(vmid: int) -> str:
+    return os.path.join(LOG_DIR, f"{int(vmid)}.console.log")
+
+
+def configured_log(vmid: int) -> str | None:
+    """The console log the container declares, when it is the ProxMenux one."""
+    try:
+        with open(f"/etc/pve/lxc/{int(vmid)}.conf", encoding="utf-8") as handle:
+            for line in handle:
+                if line.startswith("["):
+                    break
+                if line.startswith("lxc.console.logfile:"):
+                    value = line.split(":", 1)[1].strip()
+                    return value if value == log_path(vmid) else None
+    except (OSError, ValueError):
+        return None
+    return None
+
+
+def terminal_state(vmid: int) -> dict:
+    """Whether the Proxmox console of the container opens a shell."""
+    mode = "tty"
+    try:
+        with open(f"/etc/pve/lxc/{int(vmid)}.conf", encoding="utf-8") as handle:
+            for line in handle:
+                if line.startswith("["):
+                    break
+                if line.startswith("cmode:"):
+                    mode = line.split(":", 1)[1].strip()
+    except (OSError, ValueError):
+        pass
+    return {"cmode": mode, "shell": mode == "shell"}
+
+
+def clean(text: str) -> list[str]:
+    """Readable lines from raw console output.
+
+    CRLF becomes a line end. A lone carriage return is how a progress bar
+    redraws itself in place, so only what was written after the last one on a
+    line is kept — the state the terminal would have shown.
+    """
+    text = _ANSI_RE.sub("", text).replace("\r\n", "\n")
+    lines = []
+    for raw in text.split("\n"):
+        if "\r" in raw:
+            raw = raw.rsplit("\r", 1)[-1]
+        lines.append(_CONTROL_RE.sub("", raw))
+    return lines
+
+
+def _read_tail(handle, size: int, lines: int) -> tuple[list[str], bool]:
+    start = max(0, size - TAIL_READ_LIMIT)
+    handle.seek(start)
+    data = handle.read(size - start).decode("utf-8", errors="replace")
+    result = clean(data)
+    if start > 0 and result:
+        result = result[1:]   # the first line was cut by the read window
+    if result and result[-1] == "":
+        result = result[:-1]
+    head_cut = start > 0 or len(result) > lines
+    return result[-lines:], head_cut
+
+
+def read(vmid: int, lines: int = 200, offset: int | None = None, inode: int | None = None) -> dict:
+    """The last `lines` lines, or what was appended after `offset`.
+
+    `lines=0` reads nothing: it only says whether the container has a
+    console log, which is what decides if the viewer is offered at all.
+    """
+    lines = max(0, min(int(lines), MAX_LINES))
+    path = configured_log(vmid)
+    base = {"ok": True, "vmid": int(vmid), **terminal_state(vmid)}
+    if not path:
+        return {**base, "enabled": False, "lines": [], "size": 0, "offset": 0, "inode": None}
+    try:
+        stat = os.stat(path)
+    except OSError:
+        return {**base, "enabled": True, "path": path, "lines": [], "size": 0, "offset": 0, "inode": None}
+    size = stat.st_size
+    base.update(enabled=True, path=path, size=size, inode=stat.st_ino)
+    if lines == 0 and offset is None:
+        return {**base, "lines": [], "offset": size}
+    with open(path, "rb") as handle:
+        replaced = inode is not None and inode != stat.st_ino
+        if offset is None or replaced or offset > size:
+            # First open, or the file the viewer followed is gone: rotated by
+            # copytruncate, or recreated with the container.
+            result, head_cut = _read_tail(handle, size, max(lines, 1))
+            return {**base, "lines": result, "offset": size, "reset": offset is not None,
+                    "head_truncated": head_cut}
+        handle.seek(offset)
+        chunk = handle.read(min(size - offset, FOLLOW_READ_LIMIT))
+    # Only whole lines are returned; an unfinished last line is left for the
+    # next read, where it arrives complete.
+    cut = chunk.rfind(b"\n")
+    if cut < 0:
+        return {**base, "lines": [], "offset": offset, "reset": False}
+    complete = chunk[:cut + 1]
+    result = clean(complete.decode("utf-8", errors="replace"))
+    if result and result[-1] == "":
+        result = result[:-1]
+    return {**base, "lines": result, "offset": offset + len(complete), "reset": False}
diff --git a/AppImage/scripts/oci_instance_info.py b/AppImage/scripts/oci_instance_info.py
new file mode 100644
index 00000000..010f99ca
--- /dev/null
+++ b/AppImage/scripts/oci_instance_info.py
@@ -0,0 +1,62 @@
+"""What the VM & LXC modal needs to know about an OCI instance.
+
+Read-only view of the installation record OCI manager Apps keeps for every
+container it created: whether the container is one, whether it belongs to a
+multi-container application, whether it uses host directories (which its
+backup does not revert) and whether an operation is pending. Nothing here
+changes the record or runs inside the container.
+"""
+from __future__ import annotations
+
+import json
+import os
+
+import oci_console_logs
+
+ROOT = "/usr/local/share/proxmenux/oci/instances"
+
+
+def _record(vmid: int) -> dict | None:
+    path = os.path.join(ROOT, str(int(vmid)), "oci-compose.json")
+    try:
+        with open(path, encoding="utf-8") as handle:
+            record = json.load(handle)
+    except (OSError, ValueError):
+        return None
+    return record if isinstance(record, dict) else None
+
+
+def _host_dirs(record: dict) -> bool:
+    mounts = (record.get("deployment") or {}).get("mounts") or []
+    return any(isinstance(m, dict) and m.get("type") == "host-bind" for m in mounts)
+
+
+def info(vmid: int) -> dict:
+    vmid = int(vmid)
+    result = {
+        "vmid": vmid,
+        "oci_instance": False,
+        "console_log": oci_console_logs.configured_log(vmid) is not None,
+        "stack": False,
+        "primary_vmid": vmid,
+        "members": [],
+        "host_directories": False,
+        "pending": False,
+    }
+    record = _record(vmid)
+    if record is None:
+        return result
+    primary_id = int((record.get("stack_member") or {}).get("primary_vmid") or vmid)
+    primary = record if primary_id == vmid else (_record(primary_id) or {})
+    members = [int(m["vmid"]) for m in (primary.get("stack") or {}).get("members") or []
+               if isinstance(m, dict) and str(m.get("vmid", "")).isdigit()]
+    records = [record] if not members else [r for r in (_record(m) for m in members) if r]
+    result.update(
+        oci_instance=True,
+        stack=bool(members) or bool(record.get("stack_member")),
+        primary_vmid=primary_id,
+        members=members,
+        host_directories=any(_host_dirs(r) for r in records),
+        pending=bool(record.get("pending_transaction") or primary.get("pending_stack_transaction")),
+    )
+    return result
diff --git a/AppImage/scripts/tests/test_auth_manager_ssl_reload.py b/AppImage/scripts/tests/test_auth_manager_ssl_reload.py
new file mode 100644
index 00000000..fd346c21
--- /dev/null
+++ b/AppImage/scripts/tests/test_auth_manager_ssl_reload.py
@@ -0,0 +1,217 @@
+import importlib.util
+import json
+import shutil
+import socket
+import ssl
+import subprocess
+import tempfile
+import threading
+import unittest
+from pathlib import Path
+from unittest import mock
+
+
+MODULE_PATH = Path(__file__).resolve().parents[1] / "auth_manager.py"
+SPEC = importlib.util.spec_from_file_location("auth_manager_ssl_under_test", MODULE_PATH)
+auth_manager = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(auth_manager)
+
+
+class _FakeSslSocket:
+    def __init__(self, context):
+        self.context = context
+
+
+class ProxmoxCertificateHotReloadTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        if shutil.which("openssl") is None:
+            raise unittest.SkipTest("openssl is required for TLS fixture generation")
+        cls.fixture_dir = tempfile.TemporaryDirectory()
+        fixture_path = Path(cls.fixture_dir.name)
+        cls.pairs = []
+        for name in ("original", "renewed"):
+            cert_path = fixture_path / f"{name}.pem"
+            key_path = fixture_path / f"{name}.key"
+            subprocess.run(
+                [
+                    "openssl", "req", "-x509", "-newkey", "rsa:2048",
+                    "-nodes", "-days", "1", "-subj", f"/CN={name}.test",
+                    "-keyout", str(key_path), "-out", str(cert_path),
+                ],
+                check=True,
+                stdout=subprocess.DEVNULL,
+                stderr=subprocess.DEVNULL,
+            )
+            cls.pairs.append((cert_path, key_path))
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.fixture_dir.cleanup()
+
+    def setUp(self):
+        self.temp_dir = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp_dir.cleanup)
+        temp_path = Path(self.temp_dir.name)
+        self.active_cert = temp_path / "pveproxy-ssl.pem"
+        self.active_key = temp_path / "pveproxy-ssl.key"
+        self.ssl_config = temp_path / "ssl_config.json"
+        self._install_pair(0)
+        self._write_config("proxmox")
+
+        self.patch = mock.patch.multiple(
+            auth_manager,
+            SSL_CONFIG_FILE=self.ssl_config,
+            PROXMOX_CUSTOM_CERT_PATH=str(self.active_cert),
+            PROXMOX_CUSTOM_KEY_PATH=str(self.active_key),
+            PROXMOX_CERT_PATH=str(temp_path / "missing-pve-ssl.pem"),
+            PROXMOX_KEY_PATH=str(temp_path / "missing-pve-ssl.key"),
+        )
+        self.patch.start()
+        self.addCleanup(self.patch.stop)
+        self.addCleanup(self._reset_runtime)
+
+    def _reset_runtime(self):
+        with auth_manager._SSL_RUNTIME_LOCK:
+            auth_manager._SSL_RUNTIME_CONTEXT = None
+            auth_manager._SSL_RUNTIME_FINGERPRINT = ""
+            auth_manager._SSL_RUNTIME_CERT_PATH = ""
+            auth_manager._SSL_RUNTIME_KEY_PATH = ""
+            auth_manager._SSL_RUNTIME_SOURCE = "none"
+            auth_manager._SSL_RUNTIME_LAST_REFRESH_ERROR = ""
+
+    def _install_pair(self, index):
+        cert_path, key_path = self.pairs[index]
+        shutil.copyfile(cert_path, self.active_cert)
+        shutil.copyfile(key_path, self.active_key)
+
+    def _write_config(self, source):
+        self.ssl_config.write_text(json.dumps({
+            "enabled": True,
+            "cert_path": str(self.active_cert),
+            "key_path": str(self.active_key),
+            "source": source,
+        }))
+
+    def _create_context(self):
+        return auth_manager.create_reloadable_ssl_context(
+            str(self.active_cert), str(self.active_key)
+        )
+
+    def test_unchanged_pair_does_not_rebuild_the_context(self):
+        context = self._create_context()
+        ssl_socket = _FakeSslSocket(context)
+
+        with mock.patch.object(
+            auth_manager,
+            "reload_server_ssl_context",
+            wraps=auth_manager.reload_server_ssl_context,
+        ) as reload_mock:
+            context.sni_callback(ssl_socket, "proxmenux.test", context)
+
+        reload_mock.assert_not_called()
+        self.assertIs(ssl_socket.context, context)
+
+    def test_valid_renewed_pair_is_activated_during_the_handshake(self):
+        context = self._create_context()
+        previous_fingerprint = auth_manager._SSL_RUNTIME_FINGERPRINT
+        self._install_pair(1)
+        ssl_socket = _FakeSslSocket(context)
+
+        context.sni_callback(ssl_socket, "proxmenux.test", context)
+
+        self.assertNotEqual(previous_fingerprint, auth_manager._SSL_RUNTIME_FINGERPRINT)
+        self.assertIs(ssl_socket.context, auth_manager._SSL_RUNTIME_CONTEXT)
+        self.assertIsNot(ssl_socket.context, context)
+        self.assertEqual(auth_manager._SSL_RUNTIME_LAST_REFRESH_ERROR, "")
+
+    def test_mismatched_pair_keeps_the_previous_context(self):
+        context = self._create_context()
+        previous_fingerprint = auth_manager._SSL_RUNTIME_FINGERPRINT
+        shutil.copyfile(self.pairs[1][0], self.active_cert)
+        ssl_socket = _FakeSslSocket(context)
+
+        context.sni_callback(ssl_socket, "proxmenux.test", context)
+
+        self.assertEqual(previous_fingerprint, auth_manager._SSL_RUNTIME_FINGERPRINT)
+        self.assertIs(auth_manager._SSL_RUNTIME_CONTEXT, context)
+        self.assertIs(ssl_socket.context, context)
+        self.assertTrue(auth_manager._SSL_RUNTIME_LAST_REFRESH_ERROR)
+
+    def test_custom_certificate_source_is_not_examined_automatically(self):
+        self._write_config("custom")
+        context = self._create_context()
+        previous_fingerprint = auth_manager._SSL_RUNTIME_FINGERPRINT
+        self._install_pair(1)
+        ssl_socket = _FakeSslSocket(context)
+
+        context.sni_callback(ssl_socket, "proxmenux.test", context)
+
+        self.assertEqual(previous_fingerprint, auth_manager._SSL_RUNTIME_FINGERPRINT)
+        self.assertIs(ssl_socket.context, context)
+
+    def test_first_real_tls_connection_receives_the_renewed_certificate(self):
+        server_context = self._create_context()
+        self._install_pair(1)
+        server_socket, client_socket = socket.socketpair()
+        server_socket.settimeout(5)
+        client_socket.settimeout(5)
+        server_error = []
+
+        def serve_once():
+            try:
+                with server_context.wrap_socket(server_socket, server_side=True) as tls_socket:
+                    tls_socket.recv(1)
+            except Exception as error:  # pragma: no cover - asserted below
+                server_error.append(error)
+
+        thread = threading.Thread(target=serve_once)
+        thread.start()
+        client_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+        client_context.check_hostname = False
+        client_context.verify_mode = ssl.CERT_NONE
+        with client_context.wrap_socket(
+            client_socket, server_hostname="proxmenux.test"
+        ) as tls_client:
+            received_der = tls_client.getpeercert(binary_form=True)
+            tls_client.sendall(b"x")
+        thread.join(timeout=5)
+
+        self.assertFalse(thread.is_alive())
+        self.assertEqual(server_error, [])
+        renewed_pem = self.pairs[1][0].read_text()
+        self.assertEqual(received_der, ssl.PEM_cert_to_DER_cert(renewed_pem))
+
+    def test_tls_connection_without_sni_also_receives_the_renewed_certificate(self):
+        server_context = self._create_context()
+        self._install_pair(1)
+        server_socket, client_socket = socket.socketpair()
+        server_socket.settimeout(5)
+        client_socket.settimeout(5)
+        server_error = []
+
+        def serve_once():
+            try:
+                with server_context.wrap_socket(server_socket, server_side=True) as tls_socket:
+                    tls_socket.recv(1)
+            except Exception as error:  # pragma: no cover - asserted below
+                server_error.append(error)
+
+        thread = threading.Thread(target=serve_once)
+        thread.start()
+        client_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+        client_context.check_hostname = False
+        client_context.verify_mode = ssl.CERT_NONE
+        with client_context.wrap_socket(client_socket) as tls_client:
+            received_der = tls_client.getpeercert(binary_form=True)
+            tls_client.sendall(b"x")
+        thread.join(timeout=5)
+
+        self.assertFalse(thread.is_alive())
+        self.assertEqual(server_error, [])
+        renewed_pem = self.pairs[1][0].read_text()
+        self.assertEqual(received_der, ssl.PEM_cert_to_DER_cert(renewed_pem))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/AppImage/scripts/tests/test_lxc_scheduled_update_records.py b/AppImage/scripts/tests/test_lxc_scheduled_update_records.py
new file mode 100644
index 00000000..a2d89168
--- /dev/null
+++ b/AppImage/scripts/tests/test_lxc_scheduled_update_records.py
@@ -0,0 +1,69 @@
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+
+SCRIPTS_DIR = Path(__file__).resolve().parents[1]
+if str(SCRIPTS_DIR) not in sys.path:
+    sys.path.insert(0, str(SCRIPTS_DIR))
+
+import lxc_apps  # noqa: E402
+
+
+class ScheduledUpdateRecordTests(unittest.TestCase):
+    def setUp(self):
+        self.temp_dir = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp_dir.cleanup)
+        self.apps_dir_patch = mock.patch.object(
+            lxc_apps, '_APPS_DIR', self.temp_dir.name,
+        )
+        self.apps_dir_patch.start()
+        self.addCleanup(self.apps_dir_patch.stop)
+        self.vmid = 9911
+        self.assertTrue(lxc_apps._write_sidecar(self.vmid, {
+            'vmid': self.vmid,
+            'apps': [],
+            'schedule': {'enabled': True, 'cron': '0 3 * * *'},
+        }))
+
+    def test_record_keeps_log_and_reboot_evidence(self):
+        self.assertTrue(lxc_apps.record_schedule_run(
+            self.vmid,
+            'success',
+            'both',
+            log_name='../9911-scheduled-' + ('a' * 32) + '.log',
+            reboot_required=True,
+            reboot_packages=['linux-image-amd64', 'libc6'],
+        ))
+        schedule = lxc_apps._read_sidecar(self.vmid)['schedule']
+        self.assertEqual(
+            schedule['last_run_log'],
+            '9911-scheduled-' + ('a' * 32) + '.log',
+        )
+        self.assertTrue(schedule['last_run_reboot_required'])
+        self.assertEqual(
+            schedule['last_run_reboot_packages'],
+            ['linux-image-amd64', 'libc6'],
+        )
+
+    def test_lifecycle_clear_preserves_run_and_log(self):
+        lxc_apps.record_schedule_run(
+            self.vmid,
+            'success',
+            'os',
+            log_name='9911-scheduled-' + ('b' * 32) + '.log',
+            reboot_required=True,
+            reboot_packages=['linux-image-amd64'],
+        )
+        self.assertTrue(lxc_apps.clear_schedule_reboot_required(self.vmid))
+        schedule = lxc_apps._read_sidecar(self.vmid)['schedule']
+        self.assertFalse(schedule['last_run_reboot_required'])
+        self.assertNotIn('last_run_reboot_packages', schedule)
+        self.assertEqual(schedule['last_run_status'], 'success')
+        self.assertIn('last_run_log', schedule)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/AppImage/scripts/tests/test_notification_delivery_dedup.py b/AppImage/scripts/tests/test_notification_delivery_dedup.py
new file mode 100644
index 00000000..a88d6675
--- /dev/null
+++ b/AppImage/scripts/tests/test_notification_delivery_dedup.py
@@ -0,0 +1,160 @@
+import sqlite3
+import sys
+import tempfile
+import threading
+import time
+import unittest
+from pathlib import Path
+from unittest import mock
+
+
+SCRIPTS_DIR = Path(__file__).resolve().parents[1]
+if str(SCRIPTS_DIR) not in sys.path:
+    sys.path.insert(0, str(SCRIPTS_DIR))
+
+import notification_manager  # noqa: E402
+from notification_events import NotificationEvent  # noqa: E402
+
+
+class RecordingChannel:
+    def __init__(self, results=None):
+        self.results = list(results or [True])
+        self.calls = 0
+        self.lock = threading.Lock()
+
+    def send(self, title, body, severity, data):
+        with self.lock:
+            self.calls += 1
+            success = self.results.pop(0) if self.results else True
+        time.sleep(0.1)
+        return {'success': success, 'error': '' if success else 'temporary failure'}
+
+
+class NotificationDeliveryDedupTests(unittest.TestCase):
+    def setUp(self):
+        self.temp_dir = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp_dir.cleanup)
+        self.db_path = Path(self.temp_dir.name) / 'health_monitor.db'
+        conn = sqlite3.connect(str(self.db_path))
+        conn.execute('''
+            CREATE TABLE notification_last_sent (
+                fingerprint TEXT PRIMARY KEY,
+                last_sent_ts INTEGER NOT NULL,
+                count INTEGER DEFAULT 1
+            )
+        ''')
+        conn.execute('''
+            CREATE TABLE notification_history (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                event_type TEXT NOT NULL,
+                channel TEXT NOT NULL,
+                title TEXT,
+                message TEXT,
+                severity TEXT,
+                sent_at TEXT NOT NULL,
+                success INTEGER DEFAULT 1,
+                error_message TEXT,
+                source TEXT DEFAULT 'server'
+            )
+        ''')
+        conn.commit()
+        conn.close()
+        self.db_patch = mock.patch.object(
+            notification_manager, 'DB_PATH', self.db_path,
+        )
+        self.db_patch.start()
+        self.addCleanup(self.db_patch.stop)
+        self.ai_context_patch = mock.patch.object(
+            notification_manager, 'enrich_context_for_ai', return_value='',
+        )
+        self.ai_context_patch.start()
+        self.addCleanup(self.ai_context_patch.stop)
+        self.ai_rewrite_patch = mock.patch.object(
+            notification_manager, '_format_with_ai_bounded', return_value=None,
+        )
+        self.ai_rewrite_patch.start()
+        self.addCleanup(self.ai_rewrite_patch.stop)
+
+    def _manager(self, channel):
+        manager = notification_manager.NotificationManager()
+        manager._enabled = True
+        manager._config = {
+            'email.enabled': 'true',
+            'email.rich_format': 'false',
+            'ai_enabled': 'false',
+        }
+        manager._channels = {'email': channel}
+        return manager
+
+    @staticmethod
+    def _event():
+        return NotificationEvent(
+            event_type='lxc_update_applied',
+            severity='INFO',
+            data={
+                'hostname': 'pve-test',
+                'vmid': 210,
+                'ct_name': 'docker-frontend',
+                'target': 'Docker Engine',
+                'result': 'succeeded',
+                'duration': '10s',
+                'details': 'Update completed',
+            },
+            source='manual',
+            entity='ct',
+            entity_id='210:same-run',
+        )
+
+    def test_concurrent_managers_deliver_same_fingerprint_once(self):
+        channel = RecordingChannel()
+        managers = [self._manager(channel), self._manager(channel)]
+        barrier = threading.Barrier(3)
+
+        def dispatch(manager):
+            barrier.wait()
+            manager._dispatch_event(self._event())
+
+        threads = [
+            threading.Thread(target=dispatch, args=(manager,))
+            for manager in managers
+        ]
+        for thread in threads:
+            thread.start()
+        barrier.wait()
+        for thread in threads:
+            thread.join(timeout=5)
+
+        self.assertEqual(channel.calls, 1)
+        conn = sqlite3.connect(str(self.db_path))
+        history_count = conn.execute(
+            'SELECT COUNT(*) FROM notification_history WHERE success = 1'
+        ).fetchone()[0]
+        claim_count = conn.execute(
+            'SELECT COUNT(*) FROM notification_delivery_claims'
+        ).fetchone()[0]
+        conn.close()
+        self.assertEqual(history_count, 1)
+        self.assertEqual(claim_count, 0)
+
+    def test_failed_delivery_releases_claim_for_retry(self):
+        channel = RecordingChannel([False, True])
+        manager = self._manager(channel)
+
+        manager._dispatch_event(self._event())
+        manager._dispatch_event(self._event())
+
+        self.assertEqual(channel.calls, 2)
+        conn = sqlite3.connect(str(self.db_path))
+        successes = conn.execute(
+            'SELECT success FROM notification_history ORDER BY id'
+        ).fetchall()
+        claim_count = conn.execute(
+            'SELECT COUNT(*) FROM notification_delivery_claims'
+        ).fetchone()[0]
+        conn.close()
+        self.assertEqual(successes, [(0,), (1,)])
+        self.assertEqual(claim_count, 0)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/AppImage/scripts/tests/test_notification_update_policy.py b/AppImage/scripts/tests/test_notification_update_policy.py
new file mode 100644
index 00000000..0fba87f5
--- /dev/null
+++ b/AppImage/scripts/tests/test_notification_update_policy.py
@@ -0,0 +1,114 @@
+import json
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from queue import Queue
+from unittest import mock
+
+
+SCRIPTS_DIR = Path(__file__).resolve().parents[1]
+if str(SCRIPTS_DIR) not in sys.path:
+    sys.path.insert(0, str(SCRIPTS_DIR))
+
+import notification_events  # noqa: E402
+import notification_templates  # noqa: E402
+import post_install_versions  # noqa: E402
+
+
+class NotificationUpdatePolicyTests(unittest.TestCase):
+    def test_apt_listchanges_system_mail_has_its_own_update_event(self):
+        watcher = notification_events.ProxmoxHookWatcher(Queue())
+        classified = watcher._classify_pve(
+            "system-mail",
+            "info",
+            "Novedades de apt-listchanges para amd",
+            "zfs-linux recommends that all users update absolute paths",
+        )
+        self.assertEqual(classified, ("apt_listchanges", "node", ""))
+
+    def test_regular_system_mail_remains_available(self):
+        watcher = notification_events.ProxmoxHookWatcher(Queue())
+        with mock.patch.object(notification_events, "_record_smartd_observation_impl"):
+            classified = watcher._classify_pve(
+                "system-mail",
+                "warning",
+                "SMART error (CurrentPendingSector) detected on host",
+                "Device: /dev/sda",
+            )
+        self.assertEqual(classified, ("system_mail", "node", ""))
+
+    def test_apt_listchanges_body_is_preserved_and_attributed(self):
+        watcher = notification_events.ProxmoxHookWatcher(Queue())
+        upstream = (
+            "zfs-linux (2.2.4-2) unstable; urgency=medium\n\n"
+            "  Package-maintainer recommendation.\n\n"
+            " -- Maintainer <maintainer@example.com>"
+        )
+        result = watcher.process_webhook({
+            "title": "apt-listchanges: News for host",
+            "message": upstream,
+            "severity": "info",
+            "fields": {"type": "system-mail", "hostname": "pve-test"},
+        })
+        self.assertTrue(result["accepted"])
+        event = watcher._queue.get_nowait()
+        self.assertEqual(event.event_type, "apt_listchanges")
+        self.assertEqual(event.data["reason"], upstream)
+
+        rendered = notification_templates.render_template(
+            event.event_type,
+            event.data,
+        )
+        self.assertIn("not a ProxMenux recommendation", rendered["body_text"])
+        self.assertIn(upstream, rendered["body_text"])
+
+    def test_smaller_pending_subset_does_not_notify_again(self):
+        updates = [
+            {"key": "persistent_network", "available_version": "1.2"},
+        ]
+        notified = {
+            "log2ram": {"1.4"},
+            "persistent_network": {"1.2"},
+        }
+        self.assertEqual(
+            notification_events._new_post_install_update_versions(updates, notified),
+            {},
+        )
+
+    def test_new_version_of_existing_tool_is_detected(self):
+        updates = [
+            {"key": "persistent_network", "available_version": "1.3"},
+        ]
+        notified = {"persistent_network": {"1.2"}}
+        self.assertEqual(
+            notification_events._new_post_install_update_versions(updates, notified),
+            {"persistent_network": "1.3"},
+        )
+
+    def test_notified_versions_share_the_existing_snapshot_file(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            snapshot_path = Path(temporary) / "updates_available.json"
+            cache = {
+                "scanned_at": 123.0,
+                "updates": [
+                    {"key": "log2ram", "available_version": "1.4"},
+                ],
+            }
+            with mock.patch.object(post_install_versions, "_UPDATES_JSON", snapshot_path), \
+                    mock.patch.object(post_install_versions, "_cache", cache):
+                post_install_versions.save_notified_versions(
+                    {"log2ram": {"1.3", "1.4"}}
+                )
+                self.assertEqual(
+                    post_install_versions.load_notified_versions(),
+                    {"log2ram": {"1.3", "1.4"}},
+                )
+                payload = json.loads(snapshot_path.read_text(encoding="utf-8"))
+                self.assertEqual(payload["scanned_at"], 123.0)
+                self.assertEqual(payload["updates"], cache["updates"])
+                self.assertEqual(payload["notified_versions"]["log2ram"], ["1.3", "1.4"])
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/AppImage/scripts/tests/test_oci_adguard_setup.py b/AppImage/scripts/tests/test_oci_adguard_setup.py
new file mode 100644
index 00000000..745833b9
--- /dev/null
+++ b/AppImage/scripts/tests/test_oci_adguard_setup.py
@@ -0,0 +1,37 @@
+import sys
+from pathlib import Path
+import unittest
+from unittest.mock import MagicMock, patch
+
+SCRIPTS = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(SCRIPTS))
+import lxc_apps
+
+
+class AdguardSetupTests(unittest.TestCase):
+    def test_non_adguard_is_not_probed(self):
+        with patch.object(lxc_apps, '_oci_instance_meta', return_value={'template_id': 'image-frigate'}), \
+             patch.object(lxc_apps.subprocess, 'run') as run:
+            self.assertFalse(lxc_apps.oci_adguard_setup_available(190))
+            run.assert_not_called()
+
+    def test_setup_returns_true_only_for_http_response(self):
+        process = MagicMock(stdout='192.168.0.42\n')
+        connection = MagicMock()
+        connection.__enter__.return_value.recv.return_value = b'HTTP/1.1 302 Found\r\n'
+        with patch.object(lxc_apps, '_oci_instance_meta', return_value={'template_id': 'image-adguard-home'}), \
+             patch.object(lxc_apps.subprocess, 'run', return_value=process), \
+             patch.object(lxc_apps.socket, 'create_connection', return_value=connection) as connect:
+            self.assertTrue(lxc_apps.oci_adguard_setup_available(190))
+            connect.assert_called_once_with(('192.168.0.42', 3000), timeout=1)
+
+    def test_closed_setup_port_is_not_offered(self):
+        process = MagicMock(stdout='192.168.0.42\n')
+        with patch.object(lxc_apps, '_oci_instance_meta', return_value={'template_id': 'image-adguard-home'}), \
+             patch.object(lxc_apps.subprocess, 'run', return_value=process), \
+             patch.object(lxc_apps.socket, 'create_connection', side_effect=OSError):
+            self.assertFalse(lxc_apps.oci_adguard_setup_available(190))
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/AppImage/scripts/tests/test_oom_diagnostics.py b/AppImage/scripts/tests/test_oom_diagnostics.py
new file mode 100644
index 00000000..732307f5
--- /dev/null
+++ b/AppImage/scripts/tests/test_oom_diagnostics.py
@@ -0,0 +1,55 @@
+#!/usr/bin/env python3
+"""Regression tests based on LeidenSpain's real LXC OOM block."""
+
+import sys
+import unittest
+from pathlib import Path
+
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+
+from proxmox_known_errors import (  # noqa: E402
+    analyze_oom_event,
+    format_oom_diagnosis,
+    get_error_context,
+)
+
+
+LXC_OOM = """
+apt-get invoked oom-killer: gfp_mask=0x101cca, order=3, oom_score_adj=0
+memory: usage 131056kB, limit 131072kB, failcnt 1922
+swap: usage 0kB, limit 0kB, failcnt 0
+Memory cgroup stats for /lxc/108:
+oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=ns,mems_allowed=0,oom_memcg=/lxc/108,task_memcg=/lxc/108/ns/.lxc,task=apt-get,pid=1183877,uid=100000
+Memory cgroup out of memory: Killed process 1183877 (apt-get) total-vm:79700kB, anon-rss:65056kB
+"""
+
+
+class OomDiagnosticsTest(unittest.TestCase):
+    def test_lxc_memcg_scope_and_limits(self):
+        result = analyze_oom_event(LXC_OOM)
+        self.assertIsNotNone(result)
+        self.assertEqual(result['scope'], 'lxc')
+        self.assertEqual(result['ctid'], '108')
+        self.assertEqual(result['constraint'], 'CONSTRAINT_MEMCG')
+        self.assertEqual(result['memory_usage_kib'], 131056)
+        self.assertEqual(result['memory_limit_kib'], 131072)
+        self.assertEqual(result['swap_limit_kib'], 0)
+        self.assertEqual(result['victim_process'], 'apt-get')
+        self.assertEqual(result['victim_pid'], '1183877')
+
+    def test_diagnosis_does_not_blame_host(self):
+        diagnosis = format_oom_diagnosis(analyze_oom_event(LXC_OOM))
+        self.assertIn('LXC 108', diagnosis)
+        self.assertIn('not a host-wide OOM', diagnosis)
+        self.assertIn('128.0 MiB used of 128.0 MiB', diagnosis)
+        self.assertIn('Killed process: apt-get', diagnosis)
+
+    def test_known_error_context_includes_event_evidence(self):
+        context = get_error_context(LXC_OOM, category='memory', detail_level='detailed')
+        self.assertIn('Event analysis:', context)
+        self.assertIn('LXC 108 memory cgroup', context)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/json/runtime_verified_overrides.json b/json/runtime_verified_overrides.json
index dff11d3e..5e34f06d 100644
--- a/json/runtime_verified_overrides.json
+++ b/json/runtime_verified_overrides.json
@@ -1,8 +1,89 @@
 {
   "schema_version": 1,
-  "observed_at": "2026-08-21",
-  "notes": "Runtime-verified detectors for the LXC app catalog. Every entry is a detector proven to work on a real container, either in maintainer testing or a reviewed community confirmation. Contribution rules \u2014 accept ONLY: `detector` (required, with installed_via + method-specific fields + repo/tag_regex), optional `alt_detectors` (cross-method fallbacks), optional `file_fallbacks` (same-method secondary paths). REJECT anything that identifies a host: no IP addresses, no VMIDs, no hostnames, no `evidence` blocks with those fields. Report reproduction context in the PR description instead \u2014 the committed JSON must stay generic.",
+  "observed_at": "2026-09-24",
+  "notes": "Runtime-verified detectors for the LXC app catalog. Every entry is a detector proven to work on a real container, either in maintainer testing or a reviewed community confirmation. Contribution rules — accept ONLY: `detector` (required, with installed_via + method-specific fields + repo/tag_regex), optional `alt_detectors` (cross-method fallbacks), optional `file_fallbacks` (same-method secondary paths). REJECT anything that identifies a host: no IP addresses, no VMIDs, no hostnames, no `evidence` blocks with those fields. Report reproduction context in the PR description instead — the committed JSON must stay generic.",
   "apps": {
+    "adguard": {
+      "detector": {
+        "installed_via": "binary",
+        "binary_path": "/opt/AdGuardHome/AdGuardHome",
+        "repo": "AdguardTeam/AdGuardHome",
+        "github_source": "releases",
+        "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
+      }
+    },
+    "agentdvr": {
+      "detector": {
+        "installed_via": "file",
+        "file_path": "/root/.agentdvr",
+        "file_regex": "Agent_[^/]+_([0-9]+(?:_[0-9]+){3})\\.zip",
+        "repo": "ispysoftware/agent-install-scripts",
+        "github_source": "releases",
+        "tag_regex": "v?(\\d+(?:\\.\\d+){3})"
+      }
+    },
+    "audiobookshelf": {
+      "operational": true,
+      "name": "Audiobookshelf",
+      "install_scope": [
+        "community-script",
+        "manual-if-same-package"
+      ],
+      "evidence": [
+        "community-confirmed:github-discussion-306"
+      ],
+      "detector": {
+        "installed_via": "dpkg",
+        "package": "audiobookshelf",
+        "repo": "advplyr/audiobookshelf",
+        "github_source": "releases",
+        "tag_regex": "(?i)(?:v|release[-_/]?)?(\\d+(?:\\.\\d+){1,3}(?:[-+._][0-9A-Za-z.-]+)?)"
+      }
+    },
+    "changedetection": {
+      "operational": true,
+      "name": "Changedetection.io",
+      "install_scope": [
+        "community-script",
+        "manual"
+      ],
+      "evidence": [
+        "community-confirmed:github-discussion-306"
+      ],
+      "detector": {
+        "installed_via": "command",
+        "command_argv": [
+          "/opt/changedetection/.venv/bin/changedetection.io",
+          "--version"
+        ],
+        "installed_regex": "v?(\\d+\\.\\d+\\.\\d+)",
+        "repo": "dgtlmoon/changedetection.io",
+        "github_source": "releases",
+        "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
+      },
+      "default_ports": [
+        5000
+      ],
+      "website": "https://changedetection.io/"
+    },
+    "dispatcharr": {
+      "operational": true,
+      "name": "Dispatcharr",
+      "install_scope": [
+        "community-script"
+      ],
+      "evidence": [
+        "community-confirmed:github-discussion-306"
+      ],
+      "detector": {
+        "installed_via": "file",
+        "file_path": "/root/.dispatcharr",
+        "file_regex": "(\\d+\\.\\d+\\.\\d+)",
+        "repo": "Dispatcharr/Dispatcharr",
+        "github_source": "releases",
+        "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
+      }
+    },
     "docker": {
       "operational": true,
       "install_scope": [
@@ -20,6 +101,249 @@
         "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
       }
     },
+    "docmost": {
+      "detector": {
+        "installed_via": "file",
+        "file_path": "/opt/docmost/package.json",
+        "file_regex": "\"version\"\\s*:\\s*\"(\\d+\\.\\d+\\.\\d+)\"",
+        "repo": "docmost/docmost",
+        "github_source": "releases",
+        "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
+      },
+      "file_fallbacks": [
+        {
+          "path": "/root/.docmost",
+          "regex": "v?(\\d+\\.\\d+\\.\\d+)"
+        }
+      ]
+    },
+    "gitea": {
+      "operational": true,
+      "name": "Gitea",
+      "install_scope": [
+        "community-script",
+        "manual-if-same-package"
+      ],
+      "evidence": [
+        "community-confirmed:github-discussion-306"
+      ],
+      "detector": {
+        "installed_via": "apk",
+        "package": "gitea",
+        "repo": "go-gitea/gitea",
+        "github_source": "releases",
+        "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
+      }
+    },
+    "grafana": {
+      "operational": false,
+      "detector": {
+        "installed_via": "docker_exec",
+        "container_name": "grafana",
+        "binary_path": "grafana",
+        "binary_args": [
+          "server",
+          "-v"
+        ],
+        "repo": "grafana/grafana",
+        "github_source": "releases",
+        "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
+      }
+    },
+    "immich": {
+      "detector": {
+        "installed_via": "file",
+        "file_path": "/root/.immich",
+        "file_regex": "(?i)(?:v|release[-_/]?)?(\\d+(?:\\.\\d+){1,3}(?:[-+._][0-9A-Za-z.-]+)?)",
+        "repo": "immich-app/immich",
+        "github_source": "releases",
+        "tag_regex": "(?i)(?:v|release[-_/]?)?(\\d+(?:\\.\\d+){1,3}(?:[-+._][0-9A-Za-z.-]+)?)"
+      },
+      "alt_detectors": [
+        {
+          "installed_via": "docker_label",
+          "container_name": "immich_server",
+          "label": "org.opencontainers.image.version"
+        }
+      ]
+    },
+    "jellyfin": {
+      "detector": {
+        "installed_via": "dpkg",
+        "package": "jellyfin",
+        "repo": "jellyfin/jellyfin",
+        "github_source": "releases",
+        "tag_regex": "(?i)(?:v|release[-_/]?)?(\\d+(?:\\.\\d+){1,3}(?:[-+._][0-9A-Za-z.-]+)?)"
+      }
+    },
+    "kavita": {
+      "operational": true,
+      "name": "Kavita",
+      "install_scope": [
+        "community-script"
+      ],
+      "evidence": [
+        "community-confirmed:github-discussion-306"
+      ],
+      "detector": {
+        "installed_via": "file",
+        "file_path": "/root/.kavita",
+        "file_regex": "(\\d+\\.\\d+\\.\\d+)",
+        "repo": "Kareadita/Kavita",
+        "github_source": "releases",
+        "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
+      }
+    },
+    "lazylibrarian": {
+      "operational": true,
+      "name": "LazyLibrarian",
+      "install_scope": [
+        "community-script"
+      ],
+      "detector": {
+        "installed_via": "command",
+        "command_argv": [
+          "git",
+          "-C",
+          "/opt/LazyLibrarian",
+          "rev-parse",
+          "HEAD"
+        ],
+        "installed_regex": "([0-9a-fA-F]{40})",
+        "upstream_type": "http_json",
+        "upstream_url": "https://gitlab.com/api/v4/projects/LazyLibrarian%2FLazyLibrarian/repository/commits/master",
+        "upstream_json_path": "id",
+        "tag_regex": "([0-9a-fA-F]{40})"
+      },
+      "default_ports": [
+        5299
+      ],
+      "website": "https://lazylibrarian.gitlab.io/"
+    },
+    "netalertx": {
+      "name": "NetAlertX",
+      "install_scope": [
+        "docker"
+      ],
+      "detector": {
+        "installed_via": "docker_label",
+        "container_name": "netalertx",
+        "label": "org.opencontainers.image.version",
+        "repo": "netalertx/NetAlertX",
+        "github_source": "releases",
+        "tag_regex": "v?(\\d+(?:\\.\\d+){1,3})"
+      }
+    },
+    "nginxproxymanager": {
+      "detector": {
+        "installed_via": "file",
+        "file_path": "/opt/nginxproxymanager/backend/package.json",
+        "file_regex": "\"version\"\\s*:\\s*\"(\\d+\\.\\d+\\.\\d+)\"",
+        "repo": "NginxProxyManager/nginx-proxy-manager",
+        "github_source": "releases",
+        "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
+      },
+      "file_fallbacks": [
+        {
+          "path": "/app/package.json",
+          "regex": "\"version\"\\s*:\\s*\"(\\d+\\.\\d+\\.\\d+)\""
+        },
+        {
+          "path": "/root/.nginxproxymanager",
+          "regex": "v?(\\d+\\.\\d+\\.\\d+)"
+        }
+      ]
+    },
+    "odoo": {
+      "detector": {
+        "installed_via": "dpkg",
+        "package": "odoo",
+        "tag_regex": "(\\d+\\.\\d+(?:\\.\\d+)?)"
+      },
+      "alt_detectors": [
+        {
+          "installed_via": "binary",
+          "binary_path": "/usr/bin/odoo"
+        }
+      ]
+    },
+    "openwebui": {
+      "operational": true,
+      "detector": {
+        "installed_via": "python_dist",
+        "python_path": "/root/.local/share/uv/tools/open-webui/bin/python",
+        "distribution": "open-webui",
+        "repo": "open-webui/open-webui",
+        "github_source": "releases",
+        "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
+      }
+    },
+    "pairdrop": {
+      "detector": {
+        "installed_via": "file",
+        "file_path": "/opt/pairdrop/package.json",
+        "file_regex": "\"version\"\\s*:\\s*\"(\\d+\\.\\d+\\.\\d+)\"",
+        "repo": "schlagmichdoch/PairDrop",
+        "github_source": "releases",
+        "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
+      },
+      "file_fallbacks": [
+        {
+          "path": "/root/.pairdrop",
+          "regex": "v?(\\d+\\.\\d+\\.\\d+)"
+        }
+      ]
+    },
+    "paperless-ngx": {
+      "operational": false,
+      "detector": {
+        "installed_via": "docker_label",
+        "container_name": "paperless-webserver-1",
+        "label": "org.opencontainers.image.version",
+        "repo": "paperless-ngx/paperless-ngx",
+        "github_source": "releases",
+        "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
+      },
+      "alt_detectors": [
+        {
+          "installed_via": "file",
+          "file_path": "/opt/paperless/src/paperless/version.py",
+          "file_regex": "__version__[^\\n=]*=\\s*\\((\\d+)\\s*,\\s*(\\d+)\\s*,\\s*(\\d+)\\)"
+        }
+      ]
+    },
+    "peanut": {
+      "operational": true,
+      "name": "PeaNUT",
+      "install_scope": [
+        "community-script"
+      ],
+      "detector": {
+        "installed_via": "file",
+        "file_path": "/opt/peanut/package.json",
+        "file_regex": "\"version\"\\s*:\\s*\"v?(\\d+\\.\\d+\\.\\d+)\"",
+        "upstream_type": "github",
+        "repo": "Brandawg93/PeaNUT",
+        "github_source": "releases",
+        "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
+      },
+      "default_ports": [
+        8080
+      ],
+      "website": "https://github.com/Brandawg93/PeaNUT"
+    },
+    "plex": {
+      "operational": true,
+      "detector": {
+        "installed_via": "dpkg",
+        "package": "plexmediaserver",
+        "installed_regex": "(\\d+\\.\\d+\\.\\d+\\.\\d+)",
+        "upstream_type": "http_json",
+        "upstream_url": "https://plex.tv/api/downloads/5.json?channel=8",
+        "upstream_json_path": "computer.Linux.version",
+        "tag_regex": "(\\d+\\.\\d+\\.\\d+\\.\\d+)"
+      }
+    },
     "portainer": {
       "operational": true,
       "name": "Portainer",
@@ -44,76 +368,25 @@
       "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/portainer.webp",
       "website": "https://www.portainer.io/"
     },
-    "audiobookshelf": {
-      "operational": true,
-      "name": "Audiobookshelf",
-      "install_scope": [
-        "community-script",
-        "manual-if-same-package"
-      ],
-      "evidence": [
-        "community-confirmed:github-discussion-306"
-      ],
+    "prometheus": {
+      "operational": false,
+      "detector": {
+        "installed_via": "docker_exec",
+        "container_name": "prometheus",
+        "binary_path": "/bin/prometheus",
+        "binary_args": [
+          "--version"
+        ],
+        "repo": "prometheus/prometheus",
+        "github_source": "releases",
+        "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
+      }
+    },
+    "proxmox-backup-server": {
       "detector": {
         "installed_via": "dpkg",
-        "package": "audiobookshelf",
-        "repo": "advplyr/audiobookshelf",
-        "github_source": "releases",
-        "tag_regex": "(?i)(?:v|release[-_/]?)?(\\d+(?:\\.\\d+){1,3}(?:[-+._][0-9A-Za-z.-]+)?)"
-      }
-    },
-    "gitea": {
-      "operational": true,
-      "name": "Gitea",
-      "install_scope": [
-        "community-script",
-        "manual-if-same-package"
-      ],
-      "evidence": [
-        "community-confirmed:github-discussion-306"
-      ],
-      "detector": {
-        "installed_via": "apk",
-        "package": "gitea",
-        "repo": "go-gitea/gitea",
-        "github_source": "releases",
-        "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
-      }
-    },
-    "dispatcharr": {
-      "operational": true,
-      "name": "Dispatcharr",
-      "install_scope": [
-        "community-script"
-      ],
-      "evidence": [
-        "community-confirmed:github-discussion-306"
-      ],
-      "detector": {
-        "installed_via": "file",
-        "file_path": "/root/.dispatcharr",
-        "file_regex": "(\\d+\\.\\d+\\.\\d+)",
-        "repo": "Dispatcharr/Dispatcharr",
-        "github_source": "releases",
-        "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
-      }
-    },
-    "kavita": {
-      "operational": true,
-      "name": "Kavita",
-      "install_scope": [
-        "community-script"
-      ],
-      "evidence": [
-        "community-confirmed:github-discussion-306"
-      ],
-      "detector": {
-        "installed_via": "file",
-        "file_path": "/root/.kavita",
-        "file_regex": "(\\d+\\.\\d+\\.\\d+)",
-        "repo": "Kareadita/Kavita",
-        "github_source": "releases",
-        "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
+        "package": "proxmox-backup-server",
+        "tag_regex": "(\\d+\\.\\d+\\.\\d+)"
       }
     },
     "qbittorrent": {
@@ -125,6 +398,19 @@
         "tag_regex": "(?i)(?:release-)?(\\d+\\.\\d+\\.\\d+)"
       }
     },
+    "searxng": {
+      "operational": true,
+      "install_scope": [
+        "community-script",
+        "manual-if-same-venv"
+      ],
+      "detector": {
+        "installed_via": "python_dist",
+        "python_path": "/usr/local/searxng/searx-pyenv/bin/python",
+        "distribution": "searxng",
+        "installed_regex": "(\\d+\\.\\d+\\.\\d+\\+[0-9a-f]+)"
+      }
+    },
     "tandoor": {
       "detector": {
         "installed_via": "file",
@@ -141,77 +427,20 @@
         }
       ]
     },
-    "openwebui": {
-      "operational": true,
-      "detector": {
-        "installed_via": "python_dist",
-        "python_path": "/root/.local/share/uv/tools/open-webui/bin/python",
-        "distribution": "open-webui",
-        "repo": "open-webui/open-webui",
-        "github_source": "releases",
-        "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
-      }
-    },
-    "proxmox-backup-server": {
-      "detector": {
-        "installed_via": "dpkg",
-        "package": "proxmox-backup-server",
-        "tag_regex": "(\\d+\\.\\d+\\.\\d+)"
-      }
-    },
-    "jellyfin": {
-      "detector": {
-        "installed_via": "dpkg",
-        "package": "jellyfin",
-        "repo": "jellyfin/jellyfin",
-        "github_source": "releases",
-        "tag_regex": "(?i)(?:v|release[-_/]?)?(\\d+(?:\\.\\d+){1,3}(?:[-+._][0-9A-Za-z.-]+)?)"
-      }
-    },
-    "adguard": {
-      "detector": {
-        "installed_via": "binary",
-        "binary_path": "/opt/AdGuardHome/AdGuardHome",
-        "repo": "AdguardTeam/AdGuardHome",
-        "github_source": "releases",
-        "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
-      }
-    },
-    "nginxproxymanager": {
+    "technitiumdns": {
+      "name": "Technitium DNS Server",
       "detector": {
         "installed_via": "file",
-        "file_path": "/opt/nginxproxymanager/backend/package.json",
-        "file_regex": "\"version\"\\s*:\\s*\"(\\d+\\.\\d+\\.\\d+)\"",
-        "repo": "NginxProxyManager/nginx-proxy-manager",
-        "github_source": "releases",
-        "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
+        "file_path": "/root/.technitium",
+        "file_regex": "(\\d+(?:\\.\\d+){1,3})",
+        "upstream_type": "http_json",
+        "upstream_url": "https://go.technitium.com/?id=42",
+        "upstream_json_path": "updateVersion"
       },
-      "file_fallbacks": [
-        {
-          "path": "/app/package.json",
-          "regex": "\"version\"\\s*:\\s*\"(\\d+\\.\\d+\\.\\d+)\""
-        },
-        {
-          "path": "/root/.nginxproxymanager",
-          "regex": "v?(\\d+\\.\\d+\\.\\d+)"
-        }
-      ]
-    },
-    "pairdrop": {
-      "detector": {
-        "installed_via": "file",
-        "file_path": "/opt/pairdrop/package.json",
-        "file_regex": "\"version\"\\s*:\\s*\"(\\d+\\.\\d+\\.\\d+)\"",
-        "repo": "schlagmichdoch/PairDrop",
-        "github_source": "releases",
-        "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
-      },
-      "file_fallbacks": [
-        {
-          "path": "/root/.pairdrop",
-          "regex": "v?(\\d+\\.\\d+\\.\\d+)"
-        }
-      ]
+      "default_ports": [
+        5380
+      ],
+      "website": "https://technitium.com/dns/"
     },
     "traefik": {
       "operational": true,
@@ -259,189 +488,6 @@
           "installed_regex": "(?im)^Vaultwarden\\s+v?(\\d+\\.\\d+\\.\\d+)"
         }
       ]
-    },
-    "docmost": {
-      "detector": {
-        "installed_via": "file",
-        "file_path": "/opt/docmost/package.json",
-        "file_regex": "\"version\"\\s*:\\s*\"(\\d+\\.\\d+\\.\\d+)\"",
-        "repo": "docmost/docmost",
-        "github_source": "releases",
-        "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
-      },
-      "file_fallbacks": [
-        {
-          "path": "/root/.docmost",
-          "regex": "v?(\\d+\\.\\d+\\.\\d+)"
-        }
-      ]
-    },
-    "agentdvr": {
-      "detector": {
-        "installed_via": "file",
-        "file_path": "/root/.agentdvr",
-        "file_regex": "Agent_[^/]+_([0-9]+(?:_[0-9]+){3})\\.zip",
-        "repo": "ispysoftware/agent-install-scripts",
-        "github_source": "releases",
-        "tag_regex": "v?(\\d+(?:\\.\\d+){3})"
-      }
-    },
-    "odoo": {
-      "detector": {
-        "installed_via": "dpkg",
-        "package": "odoo",
-        "tag_regex": "(\\d+\\.\\d+(?:\\.\\d+)?)"
-      },
-      "alt_detectors": [
-        {
-          "installed_via": "binary",
-          "binary_path": "/usr/bin/odoo"
-        }
-      ]
-    },
-    "paperless-ngx": {
-      "operational": false,
-      "detector": {
-        "installed_via": "docker_label",
-        "container_name": "paperless-webserver-1",
-        "label": "org.opencontainers.image.version",
-        "repo": "paperless-ngx/paperless-ngx",
-        "github_source": "releases",
-        "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
-      },
-      "alt_detectors": [
-        {
-          "installed_via": "file",
-          "file_path": "/opt/paperless/src/paperless/version.py",
-          "file_regex": "__version__[^\\n=]*=\\s*\\((\\d+)\\s*,\\s*(\\d+)\\s*,\\s*(\\d+)\\)"
-        }
-      ]
-    },
-    "plex": {
-      "operational": true,
-      "detector": {
-        "installed_via": "dpkg",
-        "package": "plexmediaserver",
-        "installed_regex": "(\\d+\\.\\d+\\.\\d+\\.\\d+)",
-        "upstream_type": "http_json",
-        "upstream_url": "https://plex.tv/api/downloads/5.json?channel=8",
-        "upstream_json_path": "computer.Linux.version",
-        "tag_regex": "(\\d+\\.\\d+\\.\\d+\\.\\d+)"
-      }
-    },
-    "prometheus": {
-      "operational": false,
-      "detector": {
-        "installed_via": "docker_exec",
-        "container_name": "prometheus",
-        "binary_path": "/bin/prometheus",
-        "binary_args": [
-          "--version"
-        ],
-        "repo": "prometheus/prometheus",
-        "github_source": "releases",
-        "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
-      }
-    },
-    "grafana": {
-      "operational": false,
-      "detector": {
-        "installed_via": "docker_exec",
-        "container_name": "grafana",
-        "binary_path": "grafana",
-        "binary_args": [
-          "server",
-          "-v"
-        ],
-        "repo": "grafana/grafana",
-        "github_source": "releases",
-        "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
-      }
-    },
-    "searxng": {
-      "operational": true,
-      "install_scope": [
-        "community-script",
-        "manual-if-same-venv"
-      ],
-      "detector": {
-        "installed_via": "python_dist",
-        "python_path": "/usr/local/searxng/searx-pyenv/bin/python",
-        "distribution": "searxng",
-        "installed_regex": "(\\d+\\.\\d+\\.\\d+\\+[0-9a-f]+)"
-      }
-    },
-    "technitiumdns": {
-      "name": "Technitium DNS Server",
-      "detector": {
-        "installed_via": "file",
-        "file_path": "/root/.technitium",
-        "file_regex": "(\\d+(?:\\.\\d+){1,3})",
-        "upstream_type": "http_json",
-        "upstream_url": "https://go.technitium.com/?id=42",
-        "upstream_json_path": "updateVersion"
-      },
-      "default_ports": [
-        5380
-      ],
-      "website": "https://technitium.com/dns/"
-    },
-    "netalertx": {
-      "name": "NetAlertX",
-      "install_scope": [
-        "docker"
-      ],
-      "detector": {
-        "installed_via": "docker_label",
-        "container_name": "netalertx",
-        "label": "org.opencontainers.image.version",
-        "repo": "netalertx/NetAlertX",
-        "github_source": "releases",
-        "tag_regex": "v?(\\d+(?:\\.\\d+){1,3})"
-      }
-    },
-    "immich": {
-      "detector": {
-        "installed_via": "file",
-        "file_path": "/root/.immich",
-        "file_regex": "(?i)(?:v|release[-_/]?)?(\\d+(?:\\.\\d+){1,3}(?:[-+._][0-9A-Za-z.-]+)?)",
-        "repo": "immich-app/immich",
-        "github_source": "releases",
-        "tag_regex": "(?i)(?:v|release[-_/]?)?(\\d+(?:\\.\\d+){1,3}(?:[-+._][0-9A-Za-z.-]+)?)"
-      },
-      "alt_detectors": [
-        {
-          "installed_via": "docker_label",
-          "container_name": "immich_server",
-          "label": "org.opencontainers.image.version"
-        }
-      ]
-    },
-    "changedetection": {
-      "operational": true,
-      "name": "Changedetection.io",
-      "install_scope": [
-        "community-script",
-        "manual"
-      ],
-      "evidence": [
-        "community-confirmed:github-discussion-306"
-      ],
-      "detector": {
-        "installed_via": "command",
-        "command_argv": [
-          "/opt/changedetection/.venv/bin/changedetection.io",
-          "--version"
-        ],
-        "installed_regex": "v?(\\d+\\.\\d+\\.\\d+)",
-        "repo": "dgtlmoon/changedetection.io",
-        "github_source": "releases",
-        "tag_regex": "v?(\\d+\\.\\d+\\.\\d+)"
-      },
-      "default_ports": [
-        5000
-      ],
-      "website": "https://changedetection.io/"
     }
   }
 }
diff --git a/lang/de.json b/lang/de.json
index 14a1750f..e8162f2b 100644
--- a/lang/de.json
+++ b/lang/de.json
@@ -120,11 +120,11 @@
   "ACL Status:": "ACL-Status:",
   "ACL permissions applied for local access for user:": "ACL-Berechtigungen für lokalen Zugriff für Benutzer angewendet:",
   "ADVANCED SETTINGS COMPLETE": "ERWEITERTE EINSTELLUNGEN ABGESCHLOSSEN",
-  "AI / Coding & Dev-Tools": "KI / Codierung und Entwicklungstools",
+  "AI / Coding & Dev-Tools": "KI, Programmierung und Entwicklung",
   "ALL DATA ON": "ALLE DATEN EIN",
   "ALL DATA ON THIS DISK WILL BE PERMANENTLY LOST!": "ALLE DATEN AUF DIESER Diskette gehen dauerhaft verloren!",
   "ALL Utilities": "ALLE Dienstprogramme",
-  "ALLOWED_HOSTS cannot contain line breaks": "ALLOWED HOSTS kann keine Zeilenumbrüche enthalten",
+  "ALLOWED_HOSTS cannot contain line breaks": "ALLOWED_HOSTS kann keine Zeilenumbrüche enthalten",
   "AList initial login": "AList Erstanmeldung",
   "AMD CPU detected": "AMD-CPU erkannt",
   "AMD CPU fixes applied successfully": "AMD-CPU-Korrekturen erfolgreich angewendet",
@@ -185,7 +185,7 @@
   "Actual device path on the host": "Tatsächlicher Gerätepfad auf dem Host",
   "Adaptation file too large": "Anpassungsdatei zu groß",
   "Adaptation file with unexpected permissions or owner": "Anpassungsdatei mit unerwarteten Berechtigungen oder Besitzer",
-  "Adblock & DNS": "Adblock & DNS",
+  "Adblock & DNS": "Adblock und DNS",
   "Add Audio Passthrough": "Fügen Sie Audio-Passthrough hinzu",
   "Add CIFS storage:": "CIFS-Speicher hinzufügen:",
   "Add Controller or NVMe (PCI passthrough)": "Controller oder NVMe hinzufügen (PCI-Passthrough)",
@@ -439,7 +439,7 @@
   "Auth key is required.": "Authentifizierungsschlüssel ist erforderlich.",
   "Auth:": "Authentifizierung:",
   "Authentication": "Authentifizierung",
-  "Authentication & Security": "Authentifizierung & Sicherheit",
+  "Authentication & Security": "Authentifizierung und Sicherheit",
   "Authentication Error": "Authentifizierungsfehler",
   "Authentication failed.": "Die Authentifizierung ist fehlgeschlagen.",
   "Authentication required:": "Authentifizierung erforderlich:",
@@ -463,7 +463,7 @@
   "Automatic private network allocation requires a /24 subnet": "Automatische private Netzwerkzuweisung requires a /24 Subnetz",
   "Automatic video library manager for TV Shows": "Automatischer Videobibliotheksmanager für TV-Shows",
   "Automatic/Unattended": "Automatisch/unbeaufsichtigt",
-  "Automation & Scheduling": "Automatisierung & Terminplanung",
+  "Automation & Scheduling": "Automatisierung und Zeitplanung",
   "Available": "Verfügbar",
   "Available Borg archives (newest first):": "Verfügbare Borg-Archive (neueste zuerst):",
   "Available Borg targets:": "Verfügbare Borg-Ziele:",
@@ -500,7 +500,7 @@
   "Backend:": "Backend:",
   "Background archive extraction for Arr download queues. No web interface.": "Hintergrund-Archivextraktion für Arr-Download-Warteschlangen. Kein Webinterface.",
   "Backup            — VM and CT backups": "Backup – VM- und CT-Backups",
-  "Backup & Recovery": "Backup & Recovery",
+  "Backup & Recovery": "Sicherung und Wiederherstellung",
   "Backup Created": "Backup erstellt",
   "Backup ID (group name in PBS):": "Backup-ID (Gruppenname in PBS):",
   "Backup ID for this job:": "Backup-ID für diesen Job:",
@@ -603,11 +603,11 @@
   "Broken gasket-dkms package state recovered.": "Der Status des defekten „gasket-dkms“-Pakets wurde wiederhergestellt.",
   "Browse Your Life in Images": "Durchsuchen Sie Ihr Leben in Bildern",
   "Browse manually (advanced)...": "Manuell durchsuchen (erweitert)...",
-  "Browsers & Web Desktops": "Browser & Web Desktops",
+  "Browsers & Web Desktops": "Browser und Web-Desktops",
   "Build and install the gasket and apex kernel modules (DKMS)": "gasket- und apex-Kernelmodule erstellen und installieren (DKMS)",
   "Build dependencies installed.": "Build-Abhängigkeiten installiert.",
   "Build your personal knowledge base with TriliumNext Notes": "Erstellen Sie Ihre persönliche Wissensbasis mit TriliumNext Notes",
-  "Business & ERP": "Business & ERP",
+  "Business & ERP": "Unternehmen und ERP",
   "CHANGES APPLIED SUCCESSFULLY": "ÄNDERUNGEN WURDEN ERFOLGREICH ANGEWENDET",
   "CIFS Client Tools: AVAILABLE": "CIFS-Client-Tools: VERFÜGBAR",
   "CIFS Client Tools: NOT AVAILABLE - installing...": "CIFS-Client-Tools: NICHT VERFÜGBAR – Installation...",
@@ -869,7 +869,7 @@
   "Commenting legacy ceph.list (if present)...": "Kommentieren der alten ceph.list (falls vorhanden) ...",
   "Common Issues Check": "Überprüfen Sie häufige Probleme",
   "Common root for the published views": "Gemeinsame Wurzel für die veröffentlichten Ansichten",
-  "Communication & Community": "Kommunikation & Community",
+  "Communication & Community": "Kommunikation und Community",
   "Community Scripts": "Community-Skripte",
   "Community single-container Home Assistant OS image": "Einbehälter-Bild in der Gemeinschaft Home Assistant OS",
   "Compatibility check": "Kompatibilitätsprüfung",
@@ -1084,7 +1084,7 @@
   "Container will pick up the mount on next start": "Der Container holt das Reittier beim nächsten Start ab",
   "Container with ID": "Container mit ID",
   "Container:": "Container:",
-  "Containers & Docker": "Container & Docker",
+  "Containers & Docker": "Container und Docker",
   "Containers returned to their previous state": "Container in ihren vorherigen Zustand zurückgekehrt",
   "Containers that are removed:": "Entfernte Behälter:",
   "Containers that will be created (one LXC per service, on a private network):": "Container, die erstellt werden (ein LXC pro Dienst, in einem privaten Netzwerk):",
@@ -1157,7 +1157,7 @@
   "Coral M.2 Apex configuration added - device ready": "Coral M.2 Apex-Konfiguration hinzugefügt – Gerät bereit",
   "Coral M.2 Apex configuration added - device will be available after reboot": "Coral M.2 Apex-Konfiguration hinzugefügt – Gerät ist nach dem Neustart verfügbar",
   "Coral M.2 Apex detected, configuring...": "Coral M.2 Apex erkannt, konfiguriert...",
-  "Coral PCIe/M.2 node (e.g. /dev/apex_0)": "Coral PCIe/M.2-Knoten (z. B. /dev/apex 0)",
+  "Coral PCIe/M.2 node (e.g. /dev/apex_0)": "Coral PCIe/M.2-Knoten (z. B. /dev/apex_0)",
   "Coral TPU Installation": "Coral-TPU-Installation",
   "Coral TPU Uninstall": "Coral TPU-Deinstallation",
   "Coral TPU device nodes detected with correct group (apex).": "Coral TPU-Geräteknoten wurden mit der richtigen Gruppe (Apex) erkannt.",
@@ -1345,7 +1345,7 @@
   "Creating the container...": "Erstellen des Containers...",
   "Creating the initial administrator...": "Erstellen des ersten Administrators...",
   "Creating the temporary data container": "Erstellen des temporären Datencontainers",
-  "Creative & Design": "Kreativ & Design",
+  "Creative & Design": "Kreativität und Design",
   "Credentials are correct": "Die Anmeldedaten sind korrekt",
   "Credentials cleared. jwt_secret and API tokens preserved.": "Anmeldedaten gelöscht. jwt_secret und API-Token bleiben erhalten.",
   "Credentials file created securely.": "Anmeldeinformationsdatei sicher erstellt.",
@@ -1694,7 +1694,7 @@
   "Docker Mods are only offered for compatible LinuxServer images": "Docker Mods werden nur für kompatible LinuxServer Images angeboten",
   "Docker Volume Backup": "Docker Volume Backup",
   "Docker/CLI not available yet or no valid answer": "Docker/CLI noch nicht verfügbar oder keine gültige Antwort",
-  "Documents & Notes": "Dokumente & Notizen",
+  "Documents & Notes": "Dokumente und Notizen",
   "Documents volume size in GB": "Dokumentenvolumen in GB",
   "Dokuwiki is a simple to use and highly versatile Open Source wiki software that doesn't require a database. It is loved by users for its clean and readable syntax. The ease of maintenance, backup and integration makes it an administrator's favorite. Built in access controls and authentication connectors make DokuWiki especially useful in the enterprise context and the large number of plugins contributed by its vibrant community allow for a broad range of use cases beyond a traditional wiki.": "Dokuwiki ist eine einfach zu bedienende und äußerst vielseitige Open-Source-Wiki-Software, die keine Datenbank requi ist. Es wird von den Benutzern für seine saubere und lesbare Syntax geliebt. Die einfache Wartung, Sicherung und Integration macht es zum Favoriten des Administrators. Integrierte Zugangskontrollen und Authentifizierungskonnektoren machen DokuWiki besonders nützlich im Unternehmenskontext und die große Anzahl von Plugins, die von der lebendigen Community beigetragen werden, ermöglichen eine breite Palette von Anwendungsfällen jenseits eines traditionellen Wikis.",
   "Dolphin Emulator lets you play GameCube and Wii games with various graphical enhancements and other features are available to improve your game experience.": "Mit Dolphin Emulator können Sie GameCube- und Wii-Spiele mit verschiedenen grafischen Verbesserungen spielen, und es stehen weitere Funktionen zur Verfügung, um Ihr Spielerlebnis zu verbessern.",
@@ -1731,7 +1731,7 @@
   "Dry run completed; the container and the mounts were not changed.": "Trockenlauf abgeschlossen; der Behälter und die Halterungen wurden nicht verändert.",
   "DuckDNS subdomain without .duckdns.org (comma separated for several)": "DuckDNS Subdomain ohne .duckdns.org (Komma für mehrere getrennt)",
   "DuckDNS token from your account at duckdns.org": "DuckDNS-Token von Ihrem Konto bei duckdns.org",
-  "DuckDNS updates the subdomain every 5 minutes. Without UPDATE_IP, DuckDNS itself detects the public IPv4 address of the request.": "DuckDNS aktualisiert die Subdomain alle 5 Minuten. Ohne UPDATE IP erkennt DuckDNS selbst die öffentliche IPv4-Adresse der Anfrage.",
+  "DuckDNS updates the subdomain every 5 minutes. Without UPDATE_IP, DuckDNS itself detects the public IPv4 address of the request.": "DuckDNS aktualisiert die Subdomain alle 5 Minuten. Ohne UPDATE_IP erkennt DuckDNS selbst die öffentliche IPv4-Adresse der Anfrage.",
   "DuckStation is a PS1 Emulator aiming for the best accuracy and game support.": "DuckStation ist ein PS1-Emulator, der auf die beste accuracy- und Spielunterstützung abzielt.",
   "Duckdns is a free service which will point a DNS (sub domains of duckdns.org) to an IP of your choice. The service is completely free, and doesn't require reactivation or forum posts to maintain its existence.": "Duckdns ist ein kostenloser Dienst, der ein DNS (Subdomains von duckdns.org) auf eine IP Ihrer Wahl verweist. Der Dienst ist völlig kostenlos und require Reaktivierung oder Forenbeiträge, um seine Existenz zu erhalten.",
   "Dumping AMD GPU ROM BIOS via sysfs...": "Das AMD-GPU-ROM-BIOS wird über sysfs gelöscht ...",
@@ -2230,7 +2230,7 @@
   "FileBrowser Quantum": "FileBrowser Quantum",
   "FileBrowser Quantum (new installation)": "FileBrowser Quantum (Neuinstallation)",
   "FileDrop is a free, open source file sharing service": "FileDrop ist ein kostenloser Open Source File Sharing Service",
-  "Files & Downloads": "Dateien & Downloads",
+  "Files & Downloads": "Dateien und Downloads",
   "Files volume size in GB": "Dateivolumengröße in GB",
   "Filesystem": "Dateisystem",
   "Filesystem Tools Required": "Dateisystem-Tools erforderlich",
@@ -2239,7 +2239,7 @@
   "Final cleanup of the stack operation completed": "Endgültige Bereinigung des Stacks operation abgeschlossen",
   "Final confirmation": "Endgültige Bestätigung",
   "Final storage health/status check": "Endgültige Überprüfung des Speicherzustands/-status",
-  "Finance & Budgeting": "Finanzen & Budgeting",
+  "Finance & Budgeting": "Finanzen und Budget",
   "Find your device using https://finds.synology.com": "Finden Sie Ihr Gerät über https://finds.synology.com",
   "Fingerprint:": "Fingerabdruck:",
   "Firefly, the easiest using of WireGuard VPN server, plus version of wg-easy.": "Firefly, die einfachste Verwendung von WireGuard VPN-Server, plus Version von wg-easy.",
@@ -2386,7 +2386,7 @@
   "GRUB_CMDLINE_LINUX_DEFAULT not found in GRUB config": "GRUB_CMDLINE_LINUX_DEFAULT wurde in der GRUB-Konfiguration nicht gefunden",
   "GUI mode (if available)": "GUI-Modus (falls verfügbar)",
   "GZDoom is a feature centric port for all Doom engine games, based on ZDoom, adding an OpenGL renderer and powerful scripting capabilities.": "GZDoom ist ein funktionsorientierter Port für alle Doom-Engine-Spiele, basierend auf ZDoom, der einen OpenGL-Renderer und leistungsstarke Skriptfunktionen hinzufügt.",
-  "Gaming & Leisure": "Gaming & Leisure",
+  "Gaming & Leisure": "Spiele und Freizeit",
   "Gateway is not installed.": "Gateway ist nicht installiert.",
   "Gateway removed.": "Gateway entfernt.",
   "Gateway restarted.": "Gateway neu gestartet.",
@@ -2526,7 +2526,7 @@
   "Host GPU detected": "Host-GPU erkannt",
   "Host GPU is already bound to vfio-pci. Host reconfiguration/reboot should not be required for this VM-to-VM reassignment.": "Die Host-GPU ist bereits an vfio-pci gebunden. Für diese VM-zu-VM-Neuzuweisung sollte keine Host-Neukonfiguration/Neustart erforderlich sein.",
   "Host IP": "Host-IP",
-  "Host Management": "Host Management",
+  "Host Management": "Host-Verwaltung",
   "Host Mount Path": "Host-Mount-Pfad",
   "Host NFS/Samba as Proxmox Storage (pvesm)": "NFS/Samba als Proxmox-Speicher hosten (pvesm)",
   "Host Path": "Hostpfad",
@@ -2793,7 +2793,7 @@
   "Initiator IQN is authorised on the target": "Der Initiator-IQN ist auf dem Ziel autorisiert",
   "Initiator IQN:": "Initiator-IQN:",
   "Inkscape is professional quality vector graphics software which runs on Linux, Mac OS X and Windows desktop computers.": "Inkscape ist professionelle Qualitätsvektor-Grafiksoftware, die auf Linux, Mac OS X und Windows Desktop-Computern läuft.",
-  "Inside the LXC, create the administrator: console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN": "Erstellen Sie im LXC den Administrator: Konsole kimai:user:creat YOUR USERNAME YOUR EMAIL ROLE SUPER ADMIN",
+  "Inside the LXC, create the administrator: console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN": "Erstellen Sie im LXC den Administrator: Konsole kimai:user:creat YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN",
   "Inspect disks before any action": "Überprüfen Sie die Datenträger vor jeder Aktion",
   "Inspect host device nodes": "Untersuchen Sie die Host-Geräteknoten",
   "Inspect passthrough/kernel events": "Überprüfen Sie Passthrough-/Kernel-Ereignisse",
@@ -3085,7 +3085,7 @@
   "Invalid volume size": "Ungültige Volumengröße",
   "Invalid volume size:": "Ungültige Volumengröße:",
   "Invalid volume target": "Ungültiges Volumenziel",
-  "IoT & Smart Home": "IoT & Smart Home",
+  "IoT & Smart Home": "IoT und Smart Home",
   "Is the value a password or secret?": "Ist der Wert ein Passwort oder ein Geheimnis?",
   "Issue": "Ausgabe",
   "Issues found": "Probleme gefunden",
@@ -3384,7 +3384,7 @@
   "Max user watches configured": "Maximale Benutzerüberwachungen konfiguriert",
   "Maximum auto-repair attempts reached (3). Please review the log and run any remaining commands manually.": "Maximale Anzahl automatischer Reparaturversuche erreicht (3). Bitte überprüfen Sie das Protokoll und führen Sie alle verbleibenden Befehle manuell aus.",
   "May need to restart terminal": "Möglicherweise muss das Terminal neu gestartet werden",
-  "Media & Streaming": "Medien & Streaming",
+  "Media & Streaming": "Medien und Streaming",
   "Media discovery and request management for Jellyfin, Plex and Emby.": "Media Discovery und Request Management für Jellyfin, Plex und Emby.",
   "Media library transcoding and health checking, with an internal worker node.": "Medienbibliothek Transcodierung und Gesundheitsüberprüfung, mit einem internen Mitarbeiterknoten.",
   "Media server": "Medienserver",
@@ -3440,7 +3440,7 @@
   "Monitor progress:": "Fortschritt überwachen:",
   "Monitor, analyze, and alert on network performance.": "Überwachen, analysieren und alarmieren Sie die Netzwerkleistung.",
   "Monitoring": "Überwachung",
-  "Monitoring & Analytics": "Monitoring & Analytics",
+  "Monitoring & Analytics": "Überwachung und Auswertung",
   "Most common cause: the archive is corrupted (interrupted write, partial copy, or storage issue).": "Häufigste Ursache: Das Archiv ist beschädigt (unterbrochener Schreibvorgang, teilweises Kopieren oder Speicherproblem).",
   "Mount Added Successfully:": "Mount erfolgreich hinzugefügt:",
   "Mount CIFS share:": "CIFS-Freigabe bereitstellen:",
@@ -3649,7 +3649,7 @@
   "NVMe health status: WARNING (critical_warning =": "NVMe-Gesundheitsstatus: WARNUNG (critical_warning =",
   "NVMe skipped (to add as PCIe use 'Add Controller or NVMe PCIe to VM'):": "NVMe übersprungen (zum Hinzufügen als PCIe verwenden Sie „Controller oder NVMe PCIe zur VM hinzufügen“):",
   "NVMe-specific SMART log": "NVMe-spezifisches SMART-Protokoll",
-  "NVR & Cameras": "NVR & Kameras",
+  "NVR & Cameras": "NVR und Kameras",
   "NVR with optional VA-API video acceleration and hardware object detectors": "NVR mit optionaler VA-API Videobeschleunigung und Hardwareobjektdetektoren",
   "NZBGet web interface": "NZBGet Web-Schnittstelle",
   "Name": "Name",
@@ -3661,7 +3661,7 @@
   "Name of this wallabag instance, shown in the interface and in 2FA codes": "Name dieser wallabag-Instanz, angezeigt in der Schnittstelle und in 2FA-Codes",
   "Name or part of the description of the application": "Name oder Teil der Beschreibung des Antrags",
   "Name:": "Name:",
-  "Named accounts need private mode. Stop the container, set public: false in /config/config.js, start it again and create each user with: pct exec <CTID> -- env THELOUNGE_HOME=/config s6-setuidgid abc thelounge add <user>": "Benannte Konten benötigen einen privaten Modus. Stoppen Sie den Container, setzen Sie public: false in /config/config.js, starten Sie ihn erneut und erstellen Sie jeden Benutzer mit: pct exec <CTID> -- env THELOUNGE HOME=/config s6-setuidgid abc thelounge add <user>",
+  "Named accounts need private mode. Stop the container, set public: false in /config/config.js, start it again and create each user with: pct exec <CTID> -- env THELOUNGE_HOME=/config s6-setuidgid abc thelounge add <user>": "Benannte Konten benötigen einen privaten Modus. Stoppen Sie den Container, setzen Sie public: false in /config/config.js, starten Sie ihn erneut und erstellen Sie jeden Benutzer mit: pct exec <CTID> -- env THELOUNGE_HOME=/config s6-setuidgid abc thelounge add <user>",
   "Neither /etc/kernel/cmdline nor /etc/default/grub found.": "Weder /etc/kernel/cmdline noch /etc/default/grub gefunden.",
   "Nesting feature enabled": "Verschachtelungsfunktion aktiviert",
   "NetBIOS Service: RUNNING": "NetBIOS-Dienst: LÄUFT",
@@ -3671,7 +3671,7 @@
   "Netbox is an IP address management (IPAM) and data center infrastructure management (DCIM) tool. Initially conceived by the network engineering team at DigitalOcean, NetBox was developed specifically to address the needs of network and infrastructure engineers. It is intended to function as a domain-specific source of truth for network operations.": "Netbox ist ein IP-Adressmanagement (IPAM) und ein Data Center Infrastructure Management (DCIM). Ursprünglich vom Netzwerk-Engineering-Team von DigitalOcean konzipiert, wurde NetBox speziell für die Bedürfnisse von Netzwerk- und Infrastrukturingenieuren entwickelt. Es soll als domänenspezifische Wahrheitsquelle für Netzwerk-operationen fungieren.",
   "Network": "Netzwerk",
   "Network  :": "Netzwerk:",
-  "Network & Firewall": "Netzwerk & Firewall",
+  "Network & Firewall": "Netzwerk und Firewall",
   "Network (interfaces, DNS)": "Netzwerk (Schnittstellen, DNS)",
   "Network Bridge": "Netzwerkbrücke",
   "Network Commands": "Netzwerkbefehle",
@@ -4042,7 +4042,7 @@
   "OCI containers require Proxmox VE 9.1 or later.": "OCI-Container erfordern Proxmox VE 9.1 oder höher.",
   "OCI management": "OCI-Verwaltung",
   "OCI management could not be completed. Check the backend status; no additional cleanup has been authorized.": "Das OCI-Management konnte nicht abgeschlossen werden. Überprüfen Sie den Backend-Status; es wurde keine zusätzliche Bereinigung autorisiert.",
-  "OCI manager Apps (beta)": "OCI Manager Apps (Beta)",
+  "OCI manager Apps (beta)": "OCI manager Apps (beta)",
   "OCI manager Apps is a beta: if something does not work as expected, please report it on GitHub with the application name.": "OCI Manager Apps ist eine Beta: Wenn etwas nicht wie erwartet funktioniert, melden Sie es bitte auf GitHub mit dem Anwendungsnamen.",
   "OCI metadata integrity mismatch": "OCI Unstimmigkeiten bei Metadaten",
   "OCI metadata too large": "OCI-Metadaten zu groß",
@@ -4371,7 +4371,7 @@
   "Postfix configuration": "Postfix-Konfiguration",
   "PostgreSQL": "PostgreSQL",
   "PostgreSQL URL without an associated service:": "PostgreSQL URL ohne zugehörigen Dienst:",
-  "PostgreSQL creates the database named in POSTGRES_DB on the first start. The installer default is postgresql.": "PostgreSQL erstellt beim ersten Start die in POSTGRES DB genannte Datenbank. Der Installer ist standardmäßig postgresql.",
+  "PostgreSQL creates the database named in POSTGRES_DB on the first start. The installer default is postgresql.": "PostgreSQL erstellt beim ersten Start die in POSTGRES_DB genannte Datenbank. Der Installer ist standardmäßig postgresql.",
   "PostgreSQL is an advanced, enterprise-class, and open-source relational database system. PostgreSQL supports both SQL (relational) and JSON (non-relational) querying.": "PostgreSQL ist ein fortschrittliches, Enterprise-Klasse und Open-Source relationale Datenbanksystem. PostgreSQL unterstützt sowohl SQL (relational) als auch JSON (non-relational) Abfragen.",
   "PostgreSQL requires a password": "PostgreSQL requires ein Passwort",
   "PostgreSQL volume size in GB": "PostgreSQL Volumengröße in GB",
@@ -4453,7 +4453,7 @@
   "Process may take several minutes depending on container size": "Der Vorgang kann je nach Behältergröße mehrere Minuten dauern",
   "Process may take several minutes for large containers": "Bei großen Behältern kann der Vorgang mehrere Minuten dauern",
   "Processes using NVIDIA:": "Prozesse mit NVIDIA:",
-  "Productivity & Workflows": "Produktivität & Workflows",
+  "Productivity & Workflows": "Produktivität und Arbeitsabläufe",
   "Profile": "Profil",
   "Profile:": "Profil:",
   "Projectsend is a self-hosted application that lets you upload files and assign them to specific clients that you create yourself. Secure, private and easy. No more depending on external services or e-mail to send those files.": "Projectsend ist eine selbst gehostete Anwendung, mit der Sie Dateien hochladen und bestimmten Clients zuweisen können, die Sie selbst erstellen. Sicher, privat und einfach. Nicht mehr abhängig von externen Diensten oder E-Mail, um diese Dateien zu senden.",
@@ -4534,7 +4534,7 @@
   "Pwndrop is a self-deployable file hosting service for sending out red teaming payloads or securely sharing your private files over HTTP and WebDAV.": "Pwndrop ist ein selbst einsetzbarer Dateihosting-Service zum Senden von roten Teaming-Nutzlasten oder zum sicheren Teilen Ihrer privaten Dateien über HTTP und WebDAV.",
   "PyCharm offers out-of-the-box support for Python, databases, Jupyter, Git, Conda, PyTorch, TensorFlow, Hugging Face, Django, Flask, FastAPI, and more.": "PyCharm bietet Out-of-the-Box-Unterstützung für Python, Datenbanken, Jupyter, Git, Conda, PyTorch, TensorFlow, Hugging Face, Django, Flask, FastAPI und mehr.",
   "Pydio Cells needs an external MySQL or MariaDB database. The setup wizard asks for its address, database name and user on the first start.": "Pydio Cells benötigt eine externe MySQL- oder MariaDB-Datenbank. Der Setup-Assistent fragt beim ersten Start nach Adresse, Datenbankname und Benutzer.",
-  "Pydio Cells redirects to the address given in EXTERNALURL. If the container changes address, edit lxc.environment.runtime: EXTERNALURL and SERVER_IP in /etc/pve/lxc/<CTID>.conf with the container stopped, and delete /config/keys/cert.crt to regenerate the certificate.": "Pydio Cells leitet an die in EXTERNALURL angegebene Adresse weiter. Wenn der Container die Adresse ändert, bearbeiten Sie lxc.environment.runtime: EXTERNALURL und SERVER IP in /etc/pve/lxc/<CTID>.conf mit dem gestoppten Container und löschen Sie /config/keys/cert.crt, um das Zertifikat zu regenerieren.",
+  "Pydio Cells redirects to the address given in EXTERNALURL. If the container changes address, edit lxc.environment.runtime: EXTERNALURL and SERVER_IP in /etc/pve/lxc/<CTID>.conf with the container stopped, and delete /config/keys/cert.crt to regenerate the certificate.": "Pydio Cells leitet an die in EXTERNALURL angegebene Adresse weiter. Wenn der Container die Adresse ändert, bearbeiten Sie lxc.environment.runtime: EXTERNALURL und SERVER_IP in /etc/pve/lxc/<CTID>.conf mit dem gestoppten Container und löschen Sie /config/keys/cert.crt, um das Zertifikat zu regenerieren.",
   "Pydio-cells is the nextgen file sharing platform for organizations. It is a full rewrite of the Pydio project using the Go language following a micro-service architecture.": "Pydio-cells ist die Nextgen File-Sharing-Plattform für Unternehmen. Es ist eine vollständige Neufassung des Pydio-Projekts mit der Go-Sprache nach einer Micro-Service-Architektur.",
   "QDirStat Qt-based directory statistics: KDirStat without any KDE -- from the author of the original KDirStat.": "QDirStat Qt-basierte Verzeichnisstatistik: KDirStat ohne KDE - vom Autor des ursprünglichen KDirStat.",
   "Quick health check (PASSED / FAILED)": "Schneller Gesundheitscheck (bestanden / nicht bestanden)",
@@ -4679,7 +4679,7 @@
   "Remapped users:": "Neu zugeordnete Benutzer:",
   "Reminder: You must install the QEMU Guest Agent inside the Windows VM": "Erinnerung: Sie müssen den QEMU-Gastagenten in der Windows-VM installieren",
   "Remmina is a remote desktop client written in GTK, aiming to be useful for system administrators and travellers, who need to work with lots of remote computers in front of either large or tiny screens. Remmina supports multiple network protocols, in an integrated and consistent user interface. Currently RDP, VNC, SPICE, SSH and EXEC are supported.": "Remmina ist ein Remote-Desktop-Client, der in GTK geschrieben ist und für Systemadministratoren und Reisende nützlich sein soll, die mit vielen Remote-Computern vor großen oder kleinen Bildschirmen arbeiten müssen. Remmina unterstützt mehrere Netzwerkprotokolle in einer integrierten und konsistenten Benutzeroberfläche. Derzeit werden RDP, VNC, SPICE, SSH und EXEC unterstützt.",
-  "Remote Access & VPN": "Remote Access und VPN",
+  "Remote Access & VPN": "Fernzugriff und VPN",
   "Remote dry run completed; no container was created.": "Ferntrockenlauf abgeschlossen; kein Container wurde erstellt.",
   "Remote repository path:": "Remote-Repository-Pfad:",
   "Remote server via SSH  (recommended — off-host, dedup across machines)": "Remote-Server über SSH (empfohlen – Off-Host, maschinenübergreifende Deduplizierung)",
@@ -5947,7 +5947,7 @@
   "The imported Compose requests privileged, but the official jlesage/handbrake documentation does not require it; ProxMenux keeps the LXC unprivileged.": "Die importierte Compose verlangt privilegiert, aber die offizielle jlesage/handbrake Dokumentation require es nicht; ProxMenux hält die LXC unprivilegiert.",
   "The imported OCI groups are not numeric": "Importierte OCI-Gruppen sind nicht numerisch",
   "The imported OCI user or group is not numeric": "Der importierte OCI-Benutzer oder -Gruppe ist nicht numerisch",
-  "The initial user name and password stay written in /etc/pve/lxc/<CTID>.conf as INIT_USERNAME and INIT_PASSWORD. They can be removed after the first login, with the container stopped.": "Der ursprüngliche Benutzername und das Passwort bleiben in /etc/pve/lxc/<CTID>.conf als INIT USERNAME und INIT PASSWORD geschrieben. Sie können nach dem ersten Login entfernt werden, wenn der Container angehalten wird.",
+  "The initial user name and password stay written in /etc/pve/lxc/<CTID>.conf as INIT_USERNAME and INIT_PASSWORD. They can be removed after the first login, with the container stopped.": "Der ursprüngliche Benutzername und das Passwort bleiben in /etc/pve/lxc/<CTID>.conf als INIT_USERNAME und INIT_PASSWORD geschrieben. Sie können nach dem ersten Login entfernt werden, wenn der Container angehalten wird.",
   "The installation asks which one to use for these paths.": "Die Installation fragt, welche für diese Pfade verwendet werden soll.",
   "The installation ended with exit code": "Die Installation endete mit Exit-Code",
   "The installation requires a server restart to apply changes. Do you want to restart now?": "Die Installation erfordert einen Serverneustart, um die Änderungen zu übernehmen. Möchten Sie jetzt neu starten?",
@@ -6066,7 +6066,7 @@
   "The rootfs is not managed by Proxmox": "Die Rootfs werden nicht von Proxmox verwaltet",
   "The rootfs is not mounted": "Die Rootfs sind nicht montiert",
   "The same GPU cannot be used by two VMs at the same time.": "Die gleiche GPU kann nicht von zwei VMs gleichzeitig verwendet werden.",
-  "The same connection can be given as container variables instead of the file: UN_SONARR_0_URL and UN_SONARR_0_API_KEY, or the UN_RADARR_0_ equivalents.": "Die gleiche Verbindung kann als Containervariablen anstelle der Datei angegeben werden: UN SONARR 0 URL und UN SONARR 0 API KEY oder die UN RADARR 0 equivalents.",
+  "The same connection can be given as container variables instead of the file: UN_SONARR_0_URL and UN_SONARR_0_API_KEY, or the UN_RADARR_0_ equivalents.": "Die gleiche Verbindung kann als Containervariablen anstelle der Datei angegeben werden: UN_SONARR_0_URL und UN_SONARR_0_API_KEY oder die UN RADARR 0 equivalents.",
   "The saved MOTD state is invalid; no changes were made": "Der gespeicherte MOTD-Status ist ungültig;Es wurden keine Änderungen vorgenommen",
   "The saved OCI record is incomplete or has an unexpected format.": "Der gespeicherte OCI-Datensatz ist unvollständig oder hat ein unerwartetes Format.",
   "The saved projection does not match the native evidence": "Die gespeicherte Projektion stimmt nicht mit dem nativen Beweis überein",
@@ -6814,7 +6814,7 @@
   "Web interface to manage devices running Tasmota firmware.": "Web-Schnittstelle zur Verwaltung von Geräten mit Tasmota-Firmware.",
   "WebCord can be summarized as a pack of security and privacy hardenings, Discord features reimplementations, Electron / Chromium / Discord bugs workarounds, stylesheets, internal pages and wrapped https://discord.com page, designed to conform with ToS as much as it is possible (or hide the changes that might violate it from Discord's eyes).": "WebCord kann als ein Paket von Sicherheits- und Datenschutz-Härtungen, Discord-Features-Reimplementierungen, Electron / Chromium / Discord-Bugs-Workarounds, Stylesheets, interne Seiten und verpackte https://discord.com-Seite zusammengefasst werden, die so weit wie möglich mit ToS konform sind (oder die Änderungen, die es verletzen könnten, vor Discords Augen verbergen).",
   "Webgrabplus is a multi-site incremental xmltv epg grabber. It collects tv-program guide data from selected tvguide sites for your favourite channels.": "Webgrabplus ist ein multi-site inkrementeller xmltv epg grabber. Es sammelt tv-programm-guide-daten von ausgewählten tvguide-seiten für ihre lieblingskanäle.",
-  "Webservers & Proxies": "Webserver & Proxies",
+  "Webservers & Proxies": "Webserver und Proxys",
   "Website": "Webseite",
   "Webstation is a web native emulation focused LXQt desktop based on Ubuntu.": "Webstation ist ein Web-nativer Emulations-fokussierter LXQt-Desktop auf Basis von Ubuntu.",
   "Webtop - Alpine, Ubuntu, Fedora, and Arch based containers containing full desktop environments in officially supported flavors accessible via any modern web browser.": "Webtop - Alpine, Ubuntu, Fedora und Arch-basierte Container mit vollständigen Desktop-Umgebungen in offiziell unterstützten Geschmacksrichtungen, die über jeden modernen Webbrowser zugänglich sind.",
@@ -6847,7 +6847,7 @@
   "WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many different circumstances. Initially released for the Linux kernel, it is now cross-platform (Windows, macOS, BSD, iOS, Android) and widely deployable. It is currently under heavy development, but already it might be regarded as the most secure, easiest to use, and simplest VPN solution in the industry.": "WireGuard® ist ein extrem einfaches, aber schnelles und modernes VPN, das modernste Kryptographie nutzt. Es zielt darauf ab, schneller, einfacher, schlanker und nützlicher als IPsec zu sein, während die massiven Kopfschmerzen vermieden werden. Es soll deutlich performanter sein als OpenVPN. WireGuard ist als Allzweck-VPN für den Betrieb auf eingebetteten Schnittstellen und Supercomputern konzipiert, die für viele verschiedene Umstände geeignet sind. Ursprünglich für den Linux-Kernel veröffentlicht, ist er jetzt plattformübergreifend (Windows, macOS, BSD, iOS, Android) und weit verbreitet einsetzbar. Es befindet sich derzeit in der entwicklung, aber es könnte bereits als die sicherste, einfachste und einfachste vpn-lösung in der branche angesehen werden.",
   "Wired NICs in backup missing on target:": "Kabelgebundene Netzwerkkarten im Backup fehlen auf dem Ziel:",
   "Wireshark is the world’s foremost and widely-used network protocol analyzer. It lets you see what’s happening on your network at a microscopic level and is the de facto (and often de jure) standard across many commercial and non-profit enterprises, government agencies, and educational institutions. Wireshark development thrives thanks to the volunteer contributions of networking experts around the globe and is the continuation of a project started by Gerald Combs in 1998.": "Wireshark ist der weltweit führende und weit verbreitete Netzwerkprotokollanalysator. Es lässt Sie sehen, was in Ihrem Netzwerk auf einer mikroskopischen Ebene passiert und ist der De-facto- (und oft de jure-) Standard in vielen kommerziellen und gemeinnützigen Unternehmen, Regierungsbehörden und Bildungseinrichtungen. Die Entwicklung von Wireshark gedeiht dank der freiwilligen Beiträge von Netzwerkexperten auf der ganzen Welt und ist die Fortsetzung eines von Gerald Combs 1998 gestarteten Projekts.",
-  "With dns validation, the DNSPLUGIN variable names the provider plugin. The advanced installation asks for it; otherwise add the line lxc.environment.runtime: DNSPLUGIN=<plugin> to /etc/pve/lxc/<CTID>.conf with the container stopped.": "Bei der dns-Validierung benennt die DNSPLUGIN-Variable das Provider-Plugin. Die erweiterte Installation fragt danach; andernfalls fügen Sie die Zeile lxc.environment hinzu. Laufzeit: DNSPLUGIN=<plugin> zu /etc/pve/lxc/<CTID>.conf mit angehaltenem Container.",
+  "With dns validation, the DNSPLUGIN variable names the provider plugin. The advanced installation asks for it; otherwise add the line lxc.environment.runtime: DNSPLUGIN=<plugin> to /etc/pve/lxc/<CTID>.conf with the container stopped.": "Bei der dns-Validierung benennt die DNSPLUGIN-Variable das Provider-Plugin. Die erweiterte Installation fragt danach; andernfalls fügen Sie die Zeile lxc.environment.runtime: DNSPLUGIN=<plugin> zu /etc/pve/lxc/<CTID>.conf hinzu, wenn der Container angehalten wird.",
   "With dns validation, write the provider credentials in /config/dns-conf/<plugin>.ini inside the container and restart it.": "Schreiben Sie mit der dns-Validierung den Provider credentials in /config/dns-conf/<plugin>.ini in den Container und starten Sie ihn neu.",
   "With http validation, port 80 of the router must be forwarded to port 80 of this container.": "Bei der http-Validierung muss Port 80 des Routers an Port 80 dieses Containers weitergeleitet werden.",
   "With warnings": "Mit Warnungen",
diff --git a/lang/es.json b/lang/es.json
index f2c18fc7..d089ede9 100644
--- a/lang/es.json
+++ b/lang/es.json
@@ -80,7 +80,7 @@
   "A new kernel is staged for the next boot:": "Se prepara un nuevo kernel para el siguiente arranque:",
   "A newer version is available:": "Hay una versión más nueva disponible:",
   "A pending operation exists for": "Existe una operación pendiente",
-  "A pending stack assembly already exists; it is not overwritten": "Ya existe un montaje de pila pendiente; no está sobrescrito",
+  "A pending stack assembly already exists; it is not overwritten": "Ya existe un ensamblado de pila pendiente; no se sobrescribe",
   "A previous NVIDIA refresh is pending review": "Un refresco previo de NVIDIA está pendiente de revisión",
   "A previous VFIO passthrough configuration was detected for the following NVIDIA GPU(s):": "Se detectó una configuración de paso a través de VFIO anterior para las siguientes GPU NVIDIA:",
   "A privacy-first, open-source platform for knowledge management and collaboration.": "Una plataforma de código abierto para la gestión del conocimiento y la colaboración.",
@@ -120,7 +120,7 @@
   "ACL Status:": "Estado de ACL:",
   "ACL permissions applied for local access for user:": "Permisos ACL aplicados para el acceso local del usuario:",
   "ADVANCED SETTINGS COMPLETE": "CONFIGURACIÓN AVANZADA COMPLETA",
-  "AI / Coding & Dev-Tools": "AI / Coding & Dev-Tools",
+  "AI / Coding & Dev-Tools": "IA, programación y desarrollo",
   "ALL DATA ON": "TODOS LOS DATOS SOBRE",
   "ALL DATA ON THIS DISK WILL BE PERMANENTLY LOST!": "¡TODOS LOS DATOS DE ESTE DISCO SE PERDERÁN PERMANENTEMENTE!",
   "ALL Utilities": "TODAS las utilidades",
@@ -207,6 +207,8 @@
   "Add a Coral PCIe/M.2 device?": "¿Añada un dispositivo Coral PCIe/M.2?",
   "Add a custom data path?": "¿Añadir una ruta de datos personalizada?",
   "Add an extra custom path": "Añadir una ruta personalizada adicional",
+  "Add another extra path to this stack": "Añadir otra ruta adicional a esta pila",
+  "Add extra paths to this stack": "Añadir rutas adicionales a esta pila",
   "Add as IDE": "Agregar como IDE",
   "Add as SATA": "Agregar como SATA",
   "Add as SCSI": "Agregar como SCSI",
@@ -352,7 +354,7 @@
   "Another OCI operation is using the instance registry. Wait for it to finish and open this menu again; no container is modified.": "Otra operación OCI está utilizando el registro de instancias. Espere a que termine y abra este menú de nuevo; no se modifica ningún contenedor.",
   "Another OCI operation is using the registry. This operation was not started.": "Otro operación OCI está utilizando el registro. Esta operación no se inició.",
   "Another instance uses": "Otro caso utiliza",
-  "Another stack operation is pending": "Otra pila operación está pendiente",
+  "Another stack operation is pending": "Hay otra operación de pila pendiente",
   "Application": "Aplicación",
   "Application responding:": "Solicitud de respuesta:",
   "Application responding; checking its stability...": "Aplicación respondiendo; comprobando su estabilidad...",
@@ -439,7 +441,7 @@
   "Auth key is required.": "Se requiere clave de autenticación.",
   "Auth:": "Autenticación:",
   "Authentication": "Autenticación",
-  "Authentication & Security": "Autenticación y Seguridad",
+  "Authentication & Security": "Autenticación y seguridad",
   "Authentication Error": "Error de autenticación",
   "Authentication failed.": "La autenticación falló.",
   "Authentication required:": "Se requiere autenticación:",
@@ -463,7 +465,7 @@
   "Automatic private network allocation requires a /24 subnet": "Asignación automática de red privada requiere una subred /24",
   "Automatic video library manager for TV Shows": "Gestor automático de la biblioteca de vídeo para TV Shows",
   "Automatic/Unattended": "Automático/desatendido",
-  "Automation & Scheduling": "Automatización y Programación de tareas",
+  "Automation & Scheduling": "Automatización y programación",
   "Available": "Disponible",
   "Available Borg archives (newest first):": "Archivos Borg disponibles (los más nuevos primero):",
   "Available Borg targets:": "Objetivos Borg disponibles:",
@@ -500,7 +502,7 @@
   "Backend:": "Parte trasera:",
   "Background archive extraction for Arr download queues. No web interface.": "Extracción de archivos de fondo para las colas de descarga Arr. No hay interfaz web.",
   "Backup            — VM and CT backups": "Copia de seguridad: copias de seguridad de VM y CT",
-  "Backup & Recovery": "Backups y Recuperación",
+  "Backup & Recovery": "Backups y recuperación",
   "Backup Created": "Copia de seguridad creada",
   "Backup ID (group name in PBS):": "ID del backup (nombre del grupo en PBS):",
   "Backup ID for this job:": "ID del backup para este trabajo:",
@@ -561,7 +563,7 @@
   "Beta (develop branch)": "Beta (rama de desarrollo)",
   "Beta version:": "Versión beta:",
   "Binary not found in extracted content.": "Binario no encontrado en el contenido extraído.",
-  "Bind mount added:": "Montaje de enlace agregado:",
+  "Bind mount added:": "Montaje bind añadido:",
   "Bind mounts are not included in vzdump": "Los bind mounts no están incluidos en vzdump",
   "Bitcoin Knots can be used as a desktop client for regular payments or as a full node server utility for merchants and other payment services.": "Bitcoin Knots se puede utilizar como cliente de escritorio para pagos regulares o como un servidor de nodos completo para comerciantes y otros servicios de pago.",
   "Blacklist nouveau driver": "Poner el controlador nouveau en la lista negra",
@@ -603,7 +605,7 @@
   "Broken gasket-dkms package state recovered.": "Se ha recuperado el estado dañado del paquete gasket-dkms.",
   "Browse Your Life in Images": "Explore su vida en imágenes",
   "Browse manually (advanced)...": "Navegar manualmente (avanzado)...",
-  "Browsers & Web Desktops": "Navegadores y Escritorios web",
+  "Browsers & Web Desktops": "Navegadores y escritorios web",
   "Build and install the gasket and apex kernel modules (DKMS)": "Compilar e instalar los módulos del kernel gasket y apex (DKMS)",
   "Build dependencies installed.": "Construya dependencias instaladas.",
   "Build your personal knowledge base with TriliumNext Notes": "Construya su base de conocimiento personal con Trilium",
@@ -755,7 +757,7 @@
   "Checking the image compatibility:": "Verificación de la compatibilidad de la imagen:",
   "Checking the image in the registry...": "Revisando la imagen en el registro...",
   "Checking the interrupted operation...": "Revisando la interrumpida operación...",
-  "Checking the interrupted stack operation...": "Revisando la pila interrumpida operación...",
+  "Checking the interrupted stack operation...": "Revisando la operación de pila interrumpida...",
   "Checking the new image without starting it:": "Comprobando la nueva imagen sin comenzarla:",
   "Checking the remote...": "Revisando el control remoto...",
   "Checking the restored installation": "Comprobación de la instalación restaurada",
@@ -869,7 +871,7 @@
   "Commenting legacy ceph.list (if present)...": "Comentando ceph.list heredado (si está presente)...",
   "Common Issues Check": "Verificación de problemas comunes",
   "Common root for the published views": "Raíz común para las vistas publicadas",
-  "Communication & Community": "Comunicación y Comunidad",
+  "Communication & Community": "Comunicación y comunidad",
   "Community Scripts": "Scripts comunitarios",
   "Community single-container Home Assistant OS image": "Comunidad Imagen de un solo contenedor Home Assistant OS",
   "Compatibility check": "verificación de compatibilidad",
@@ -1041,7 +1043,7 @@
   "Consider security implications for production environments": "Considere las implicaciones de seguridad para los entornos de producción.",
   "Consider visiting the repository and supporting the project.": "considere visitar el repositorio y apoyar el proyecto.",
   "Console log:": "Registro de consolas:",
-  "Container": "Recipiente",
+  "Container": "Contenedor",
   "Container         — LXC root directories": "Contenedor: directorios raíz de LXC",
   "Container ID": "ID del contenedor",
   "Container ID not defined. Make sure to select a container first.": "ID de contenedor no definido. Asegúrese de seleccionar un contenedor primero.",
@@ -1050,10 +1052,10 @@
   "Container Path": "Ruta del contenedor",
   "Container Path:": "Ruta del contenedor:",
   "Container Status": "Estado del contenedor",
-  "Container checked": "Control de contenedores",
+  "Container checked": "Contenedor comprobado",
   "Container configuration not found": "Configuración del contenedor no encontrada",
-  "Container configured (not started):": "Container configurado (no iniciado):",
-  "Container converted to privileged": "Container convertido a privilegiado",
+  "Container configured (not started):": "Contenedor configurado (no iniciado):",
+  "Container converted to privileged": "Contenedor convertido a privilegiado",
   "Container created:": "Container created:",
   "Container did not become ready in time. Skipping driver installation.": "El contenedor no estuvo listo a tiempo. Saltarse la instalación del controlador.",
   "Container did not start in time.": "El contenedor no arrancó a tiempo.",
@@ -1083,11 +1085,12 @@
   "Container volume (included in backups)": "Volumen de contenedor (incluido en backups)",
   "Container will pick up the mount on next start": "El contenedor recogerá la montura en el próximo inicio.",
   "Container with ID": "Contenedor con identificación",
-  "Container:": "Recipiente:",
+  "Container:": "Contenedor:",
   "Containers & Docker": "Contenedores y Docker",
   "Containers returned to their previous state": "Los contenedores regresaron a su estado anterior",
   "Containers that are removed:": "Contenedores que se eliminan:",
   "Containers that will be created (one LXC per service, on a private network):": "Contenedores que se crearán (un LXC por servicio, en una red privada):",
+  "Containers that will receive this path": "Contenedores que recibirán esta ruta",
   "Containers:": "Containers:",
   "Contains files": "Contiene archivos",
   "Contains:": "Contiene:",
@@ -1157,7 +1160,7 @@
   "Coral M.2 Apex configuration added - device ready": "Configuración de Coral M.2 Apex agregada: dispositivo listo",
   "Coral M.2 Apex configuration added - device will be available after reboot": "Se agregó la configuración de Coral M.2 Apex: el dispositivo estará disponible después del reinicio",
   "Coral M.2 Apex detected, configuring...": "Coral M.2 Apex detectado, configurando...",
-  "Coral PCIe/M.2 node (e.g. /dev/apex_0)": "Nodo Coral PCIe/M.2 (por ejemplo, /dev/apex 0)",
+  "Coral PCIe/M.2 node (e.g. /dev/apex_0)": "Nodo Coral PCIe/M.2 (por ejemplo, /dev/apex_0)",
   "Coral TPU Installation": "Instalación de TPU Coral",
   "Coral TPU Uninstall": "Desinstalación de Coral TPU",
   "Coral TPU device nodes detected with correct group (apex).": "Nodos del dispositivo Coral TPU detectados con el grupo correcto (ápice).",
@@ -1179,7 +1182,7 @@
   "Core is still on the initial installation page": "Core sigue en la página de instalación inicial",
   "Core packages": "Paquetes principales",
   "Cores": "Núcleos",
-  "Corrupted gzip layer": "Capa de gzip corregida",
+  "Corrupted gzip layer": "Capa gzip corrupta",
   "Could not add": "No se pudo agregar",
   "Could not add disk": "No se pudo agregar el disco",
   "Could not add the device to the container:": "No podía añadir el dispositivo al contenedor:",
@@ -1235,7 +1238,7 @@
   "Could not install sshpass automatically (no internet?). Falling back to manual paste mode — you'll see the line to copy onto the server next.": "No se pudo instalar sshpass automáticamente (¿no hay Internet?).Volviendo al modo de pegado manual, verá la línea para copiar en el servidor a continuación.",
   "Could not install the NVIDIA Container Toolkit signing key.": "No se pudo instalar la clave de firma de NVIDIA Container Toolkit.",
   "Could not install the required packages:": "No podía instalar los paquetes necesarios:",
-  "Could not install the stack startup hook": "No podía instalar el gancho de arranque de pila",
+  "Could not install the stack startup hook": "No se pudo instalar el hook de arranque de la pila",
   "Could not install vzdump hook in /etc/vzdump.conf": "No se pudo instalar el gancho vzdump en /etc/vzdump.conf",
   "Could not load shared functions. Script cannot continue.": "No se pudieron cargar funciones compartidas. El guión no puede continuar.",
   "Could not load the host kernel module:": "No podía cargar el módulo del kernel host:",
@@ -1243,7 +1246,7 @@
   "Could not mount": "No se pudo montar",
   "Could not mount ISO on device": "No se pudo montar ISO en el dispositivo",
   "Could not mount the container filesystem:": "No se pudo montar el sistema de archivos de contenedores:",
-  "Could not obtain an intact image after two attempts": "No podía obtener una imagen intacta después de dos intentos",
+  "Could not obtain an intact image after two attempts": "No se pudo obtener una imagen íntegra tras dos intentos",
   "Could not parse OVF file, or no disk image references found.": "No se pudo analizar el archivo OVF o no se encontraron referencias de imágenes de disco.",
   "Could not prepare on-boot restore service. Nothing new was scheduled.": "No se pudo preparar el servicio de restauración en el arranque. No se ha programado nada nuevo.",
   "Could not prepare the NVIDIA driver links": "No podía preparar los enlaces de controladores NVIDIA",
@@ -1258,7 +1261,7 @@
   "Could not remount automatically. Try manually or check credentials.": "No se pudo volver a montar automáticamente. Pruebe manualmente o verifique las credenciales.",
   "Could not remove VM automatically. Run manually:": "No se pudo eliminar la VM automáticamente. Ejecutar manualmente:",
   "Could not remove previous DKMS tree at": "No se pudo eliminar el árbol DKMS anterior en",
-  "Could not reserve a private network for the stack": "No podía reservar una red privada para la pila",
+  "Could not reserve a private network for the stack": "No se pudo reservar una red privada para la pila",
   "Could not resolve the Compose user:": "No podía resolver el usuario de Compose:",
   "Could not resolve the OCI manifest of the image:": "No podía resolver el manifiesto de la imagen de la OCI:",
   "Could not resolve the OCI manifest:": "No podía resolver el manifiesto de la OCI:",
@@ -1345,7 +1348,7 @@
   "Creating the container...": "Creando el contenedor...",
   "Creating the initial administrator...": "Crear el administrador inicial...",
   "Creating the temporary data container": "Creación del contenedor de datos temporales",
-  "Creative & Design": "Creatividad y Diseño",
+  "Creative & Design": "Creatividad y diseño",
   "Credentials are correct": "Las credenciales son correctas",
   "Credentials cleared. jwt_secret and API tokens preserved.": "Credenciales borradas. Se conservan los tokens jwt_secret y API.",
   "Credentials file created securely.": "Archivo de credenciales creado de forma segura.",
@@ -1450,7 +1453,7 @@
   "Data size:": "Tamaño de datos:",
   "Data that is deleted with them:": "Datos que se eliminan con ellos:",
   "Data volume size in GB": "Tamaño del volumen de datos en GB",
-  "Data volumes protected": "Volumen de datos protegidos",
+  "Data volumes protected": "Volúmenes de datos protegidos",
   "Data wipe complete.": "Borrado de datos completo.",
   "Data wiped from": "Datos borrados de",
   "Database management in a single PHP file": "Gestión de bases de datos en un solo archivo PHP",
@@ -1474,7 +1477,7 @@
   "Default Login Credentials:": "Credenciales de inicio de sesión predeterminadas:",
   "Default Port": "Puerto predeterminado",
   "Default Proxmox logo applied": "Logotipo predeterminado de Proxmox aplicado",
-  "Default is none (video-only passthrough). Use SPACE to toggle selections.": "El valor predeterminado es ninguno (transmisión de solo video). Utilice la ESPACIO para alternar selecciones.",
+  "Default is none (video-only passthrough). Use SPACE to toggle selections.": "El valor predeterminado es ninguno (transmisión de solo video). Utilice ESPACIO para alternar selecciones.",
   "Default journald configuration restored": "Configuración de diario predeterminada restaurada",
   "Default location is /mnt/<name>. The share will be mounted here on the host with open permissions so an unprivileged LXC can bind-mount and write to it. For LXC access, bind-mount this path with the LXC Mount Manager.": "La ubicación predeterminada es /mnt/<nombre>. El recurso compartido se montará aquí en el host con permisos abiertos para que un LXC sin privilegios pueda vincularlo, montarlo y escribir en él. Para acceder a LXC, vincule esta ruta con LXC Mount Manager.",
   "Default location is /mnt/<name>. The share will be mounted here on the host. Use this path in /etc/fstab. For LXC access, bind-mount this path with the LXC Mount Manager.": "La ubicación predeterminada es /mnt/<nombre>. El recurso compartido se montará aquí en el host. Utilice esta ruta en /etc/fstab. Para acceder a LXC, vincule esta ruta con LXC Mount Manager.",
@@ -1694,7 +1697,7 @@
   "Docker Mods are only offered for compatible LinuxServer images": "Docker Mods solo se ofrecen para imágenes compatibles de LinuxServer",
   "Docker Volume Backup": "Docker Volume Backup",
   "Docker/CLI not available yet or no valid answer": "Docker/CLI aún no está disponible o no hay respuesta válida",
-  "Documents & Notes": "Documentos y Notas",
+  "Documents & Notes": "Documentos y notas",
   "Documents volume size in GB": "Tamaño del volumen de documentos en GB",
   "Dokuwiki is a simple to use and highly versatile Open Source wiki software that doesn't require a database. It is loved by users for its clean and readable syntax. The ease of maintenance, backup and integration makes it an administrator's favorite. Built in access controls and authentication connectors make DokuWiki especially useful in the enterprise context and the large number of plugins contributed by its vibrant community allow for a broad range of use cases beyond a traditional wiki.": "Dokuwiki es un software de wiki de código abierto muy versátil que no requiere una base de datos. Es amado por los usuarios por su sintaxis limpia y legible. La facilidad de mantenimiento, backup e integración lo convierte en el favorito del administrador. Construidos en controles de acceso y conectores de autenticación hacen de DokuWiki especialmente útil en el contexto empresarial y el gran número de plugins aportados por su vibrante comunidad permiten una amplia gama de casos de uso más allá de un wiki tradicional.",
   "Dolphin Emulator lets you play GameCube and Wii games with various graphical enhancements and other features are available to improve your game experience.": "Dolphin Emulator le permite jugar juegos de GameCube y Wii con diversas mejoras gráficas y otras características están disponibles para mejorar su experiencia de juego.",
@@ -1719,7 +1722,7 @@
   "Downloading amdgpu_top": "Descargando amdgpu_top",
   "Downloading official installer...": "Descargando el instalador oficial...",
   "Downloading pre-existing encrypted backups from this host will fail unless you kept a copy of the current key.": "la descarga de copias de seguridad cifradas preexistentes desde este host fallará a menos que conserve una copia de la clave actual.",
-  "Downloading the image:": "Descargar la imagen:",
+  "Downloading the image:": "Descargando la imagen:",
   "Downloading the latest Fastfetch release...": "Descargando la última versión de Fastfetch...",
   "Driver blacklist entries removed": "Se eliminaron las entradas de la lista negra de controladores",
   "Driver blacklist removed for": "Lista negra de controladores eliminada para",
@@ -1731,7 +1734,7 @@
   "Dry run completed; the container and the mounts were not changed.": "Correción seca completada; el contenedor y las monturas no se cambiaron.",
   "DuckDNS subdomain without .duckdns.org (comma separated for several)": "Subdominio DuckDNS sin .duckdns.org (comma separado para varios)",
   "DuckDNS token from your account at duckdns.org": "DuckDNS token desde tu cuenta en duckdns.org",
-  "DuckDNS updates the subdomain every 5 minutes. Without UPDATE_IP, DuckDNS itself detects the public IPv4 address of the request.": "DuckDNS actualiza el subdominio cada 5 minutos. Sin UPDATE IP, DuckDNS detecta la dirección IPv4 pública de la solicitud.",
+  "DuckDNS updates the subdomain every 5 minutes. Without UPDATE_IP, DuckDNS itself detects the public IPv4 address of the request.": "DuckDNS actualiza el subdominio cada 5 minutos. Sin UPDATE_IP, DuckDNS detecta la dirección IPv4 pública de la solicitud.",
   "DuckStation is a PS1 Emulator aiming for the best accuracy and game support.": "DuckStation es un emulador PS1 que busca el mejor accuracy y soporte para juegos.",
   "Duckdns is a free service which will point a DNS (sub domains of duckdns.org) to an IP of your choice. The service is completely free, and doesn't require reactivation or forum posts to maintain its existence.": "Duckdns es un servicio gratuito que señalará un DNS (sub dominios de duckdns.org) a un IP de su elección. El servicio es totalmente gratuito, y no requiere reactivación o publicaciones de foro para mantener su existencia.",
   "Dumping AMD GPU ROM BIOS via sysfs...": "Volviendo la BIOS de la ROM de la GPU AMD a través de sysfs...",
@@ -1743,7 +1746,7 @@
   "Duplicated VMID in the Proxmox inventory": "VMID duplicado en el inventario de Proxmox",
   "Duplicated native directive:": "Directiva nativa duplicada:",
   "Duplicated native option": "Opción nativa duplicada",
-  "Duplicated or invalid stack VMID": "Montaje duplicado o inválido VMID",
+  "Duplicated or invalid stack VMID": "VMID de pila duplicado o no válido",
   "Duplicati is a backup client that securely stores encrypted, incremental, compressed backups on local storage, cloud storage services and remote file servers. It works with standard protocols like FTP, SSH, WebDAV as well as popular services like Microsoft OneDrive, Amazon S3, Google Drive, box.com, Mega, B2, and many others.": "Duplicati es un cliente de backup que almacena de forma segura backups cifradas, incrementales y comprimidas en almacenamiento local, servicios de almacenamiento en la nube y servidores de archivos remotos. Funciona con protocolos estándar como FTP, SSH, WebDAV y servicios populares como Microsoft OneDrive, Amazon S3, Google Drive, box.com, Mega, B2, y muchos otros.",
   "Duplicati web interface (password only)": "Interfaz web Duplicati (sólo contraseña)",
   "Duration": "Duración",
@@ -2230,16 +2233,16 @@
   "FileBrowser Quantum": "FileBrowser Quantum",
   "FileBrowser Quantum (new installation)": "FileBrowser Quantum (nueva instalación)",
   "FileDrop is a free, open source file sharing service": "FileDrop es un servicio gratuito de intercambio de archivos de código abierto",
-  "Files & Downloads": "Archivos y Descargas",
+  "Files & Downloads": "Archivos y descargas",
   "Files volume size in GB": "Tamaño del volumen de archivos en GB",
   "Filesystem": "Sistema de archivos",
   "Filesystem Tools Required": "Herramientas del sistema de archivos necesarias",
   "Filesystem:": "Sistema de archivos:",
   "Final Confirmation": "Confirmación final",
-  "Final cleanup of the stack operation completed": "Limpieza final de la pila operación completado",
+  "Final cleanup of the stack operation completed": "Limpieza final de la operación de pila completada",
   "Final confirmation": "Confirmación final",
   "Final storage health/status check": "Comprobación final del estado/salud del almacenamiento",
-  "Finance & Budgeting": "Finanzas y Presupuestos",
+  "Finance & Budgeting": "Finanzas y presupuestos",
   "Find your device using https://finds.synology.com": "Encuentre su dispositivo usando https://finds.synology.com",
   "Fingerprint:": "Huella digital:",
   "Firefly, the easiest using of WireGuard VPN server, plus version of wg-easy.": "Firefly, el uso más fácil del servidor WireGuard VPN, además de la versión de wg-easy.",
@@ -2386,7 +2389,7 @@
   "GRUB_CMDLINE_LINUX_DEFAULT not found in GRUB config": "GRUB_CMDLINE_LINUX_DEFAULT no se encuentra en la configuración de GRUB",
   "GUI mode (if available)": "Modo GUI (si está disponible)",
   "GZDoom is a feature centric port for all Doom engine games, based on ZDoom, adding an OpenGL renderer and powerful scripting capabilities.": "GZDoom es un puerto centrico característica para todos los juegos de motores Doom, basado en ZDoom, añadiendo un renderizador OpenGL y potentes capacidades de scripting.",
-  "Gaming & Leisure": "Juegos y Ocio",
+  "Gaming & Leisure": "Juegos y ocio",
   "Gateway is not installed.": "La puerta de enlace no está instalada.",
   "Gateway removed.": "Puerta de enlace eliminada.",
   "Gateway restarted.": "La puerta de enlace se reinició.",
@@ -2519,14 +2522,14 @@
   "Host Config Backup / Restore": "Copia de seguridad/restauración de la configuración del host",
   "Host Config Restore": "Restauración de configuración del host",
   "Host DVB tuners": "Sintonizadores DVB de host",
-  "Host Directory": "Directorio de host",
-  "Host Directory to LXC Mount Point": "Directorio de host para el punto de montaje LXC",
-  "Host Directory:": "Directorio de host:",
+  "Host Directory": "Directorio del host",
+  "Host Directory to LXC Mount Point": "Directorio del host a punto de montaje LXC",
+  "Host Directory:": "Directorio del host:",
   "Host GPU binding changed — reboot required.": "Se cambió el enlace de la GPU del host: es necesario reiniciar.",
   "Host GPU detected": "GPU del host detectada",
   "Host GPU is already bound to vfio-pci. Host reconfiguration/reboot should not be required for this VM-to-VM reassignment.": "La GPU del host ya está vinculada a vfio-pci. No debería ser necesario reconfigurar/reiniciar el host para esta reasignación de VM a VM.",
   "Host IP": "IP del host",
-  "Host Management": "Host Management",
+  "Host Management": "Gestión del host",
   "Host Mount Path": "Ruta de montaje del host",
   "Host NFS/Samba as Proxmox Storage (pvesm)": "Aloje NFS/Samba como almacenamiento en Proxmox (pvesm)",
   "Host Path": "Ruta del host",
@@ -2558,7 +2561,7 @@
   "Host directory access for unprivileged containers has been prepared above": "El acceso al directorio de host para contenedores sin privilegios se preparó anteriormente",
   "Host directory kept, with its content:": "El directorio host se mantiene, con su contenido:",
   "Host directory permissions updated — unprivileged containers can now access it": "Permisos del directorio de host actualizados: los contenedores sin privilegios ahora pueden acceder a él",
-  "Host directory:": "Directorio de host:",
+  "Host directory:": "Directorio del host:",
   "Host fstab CIFS Mounts:": "Montajes CIFS del host fstab:",
   "Host fstab CIFS mounts (not registered with pvesm):": "Montajes CIFS del host fstab (no registrados con pvesm):",
   "Host fstab CIFS mounts:": "Montajes CIFS del host fstab:",
@@ -2668,8 +2671,8 @@
   "If notifications are enabled (Telegram/Discord/ntfy/...), you will receive a \"Host restore finished\" message when all background tasks complete.": "si las notificaciones están habilitadas (Telegram/Discord/ntfy/...), recibirá un mensaje de \"Restauración del host finalizada\" cuando se completen todas las tareas en segundo plano.",
   "If passthrough fails on Windows: install RadeonResetBugFix.": "Si el paso a través falla en Windows: instale RadeonResetBugFix.",
   "If path not accessible (ZFS/BTRFS):": "Si la ruta no es accesible (ZFS/BTRFS):",
-  "If pvesm path returned a DEVICE (LVM):": "Si la ruta pvesm devolvió un DISPOSITIVO (LVM):",
-  "If pvesm path returned a DIRECTORY (ZFS/BTRFS):": "Si la ruta pvesm devolvió un DIRECTORIO (ZFS/BTRFS):",
+  "If pvesm path returned a DEVICE (LVM):": "Si pvesm path devolvió un DISPOSITIVO (LVM):",
+  "If pvesm path returned a DIRECTORY (ZFS/BTRFS):": "Si pvesm path devolvió un DIRECTORIO (ZFS/BTRFS):",
   "If repositories error:": "Si hay error en los repositorios:",
   "If the host freezes, remove hostpci entries from": "Si el host se congela, elimine las entradas hostpci de",
   "If this happens, you can restore the backup from the 'Subscription Banner Removal' option in 'Uninstall optimizations'.": "Si esto sucede, puede restaurar la copia de seguridad desde la opción 'Eliminación del banner de suscripción' en 'Optimizaciones de desinstalación'.",
@@ -2695,7 +2698,7 @@
   "Image downloaded": "Imagen descargada",
   "Image file not found:": "Archivo de imagen no encontrado:",
   "Image imported:": "Imagen importada:",
-  "Image integrity verified": "Verificación de la integridad de la imagen",
+  "Image integrity verified": "Integridad de la imagen verificada",
   "Image not allowed for the host monitor profile": "Imagen no permitida para el perfil del monitor host",
   "Image reference (for example ghcr.io/user/application:latest)": "Referencia de imagen (por ejemplo ghcr.io/user/application:latest)",
   "Image that is not in the catalog": "Imagen que no está en el catálogo",
@@ -2753,7 +2756,7 @@
   "Incompatible instance directory": "Directorio de instancias incompatibles",
   "Incompatible instance record": "Registro de instancia incompatible",
   "Incompatible record": "Registro incompatible",
-  "Incompatible stack assembly": "Montaje de pila incompatible",
+  "Incompatible stack assembly": "Ensamblado de pila incompatible",
   "Incompatible version": "versión incompatible",
   "Incomplete NVIDIA identity": "Identidad incompleta NVIDIA",
   "Incomplete NVIDIA inventory": "Incompleto inventario de NVIDIA",
@@ -2766,11 +2769,11 @@
   "Incomplete or incompatible Proxmox inventory": "Incompleto o incompatible Proxmox inventario",
   "Incomplete primary network": "Red primaria incompleta",
   "Incomplete stack order": "Orden de pila incompleta",
-  "Incomplete stack removed": "Montaje completo eliminado",
+  "Incomplete stack removed": "Pila incompleta eliminada",
   "Inconsistent adaptation profile and recipe": "Perfil de adaptación inconsistente y receta",
   "Inconsistent host monitor profile": "Perfil de monitor de host inconsistente",
   "Inconsistent stack identity": "Identidad de pila inconsistente",
-  "Inconsistent stack membership for": "Miembro de pila inconsistente para",
+  "Inconsistent stack membership for": "Pertenencia a la pila inconsistente para",
   "Increase container RAM temporarily to": "Aumente temporalmente la RAM del contenedor para",
   "Increase file and process limits for advanced workloads": "Aumente los límites de archivos y procesos para cargas de trabajo avanzadas",
   "Increase various system limits": "Aumentar varios límites del sistema",
@@ -2793,7 +2796,7 @@
   "Initiator IQN is authorised on the target": "El iniciador IQN está autorizado en el objetivo.",
   "Initiator IQN:": "IQN del iniciador:",
   "Inkscape is professional quality vector graphics software which runs on Linux, Mac OS X and Windows desktop computers.": "Inkscape es un software de gráficos vectoriales de calidad profesional que funciona en Linux, Mac OS X y Windows computadoras de escritorio.",
-  "Inside the LXC, create the administrator: console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN": "Dentro del LXC, crea el administrador: consola kimai:user:crear Your USERNAME Your EMAIL ROLE SUPER ADMIN",
+  "Inside the LXC, create the administrator: console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN": "Dentro del LXC, crea el administrador: consola kimai:user:crear Your USERNAME Your EMAIL ROLE_SUPER_ADMIN",
   "Inspect disks before any action": "Inspeccionar los discos antes de cualquier acción.",
   "Inspect host device nodes": "Inspeccionar los nodos del dispositivo host",
   "Inspect passthrough/kernel events": "Inspeccionar eventos de transferencia/kernel",
@@ -2841,7 +2844,7 @@
   "Install this image?": "¿Instalar esta imagen?",
   "Install with Cloud-Init script": "Instalar con el script Cloud-Init",
   "Install with ISO from UUP Dump": "Instalar con ISO desde UUP Dump",
-  "Install with advanced settings": "Instalar con configuración avanzada",
+  "Install with advanced settings": "Instalar con la configuración avanzada",
   "Install with default settings": "Instalar con la configuración predeterminada",
   "Install with personal ISO": "Instalar con ISO personal",
   "Install with this configuration?": "¿Instalar con esta configuración?",
@@ -2922,9 +2925,9 @@
   "Installing selected utilities": "Instalación de utilidades seleccionadas",
   "Installing system utilities...": "Instalando utilidades del sistema...",
   "Installing the new image": "Instalación de la nueva imagen",
-  "Installing the new image...": "Instalar la nueva imagen...",
-  "Installing the new image:": "Instalar la nueva imagen:",
-  "Installing the stack startup hook...": "Instalar el gancho de arranque de la pila...",
+  "Installing the new image...": "Instalando la nueva imagen...",
+  "Installing the new image:": "Instalando la nueva imagen:",
+  "Installing the stack startup hook...": "Instalando el hook de arranque de la pila...",
   "Installing zfs-auto-snapshot package...": "Instalando el paquete zfs-auto-snapshot...",
   "Installs essential packages if missing": "Instala paquetes esenciales si faltan",
   "Insufficient Disk Space": "Espacio en disco insuficiente",
@@ -2963,9 +2966,9 @@
   "Internal subnet of the tunnel (change it only if it clashes)": "Subnet interno del túnel (cambiarlo sólo si choca)",
   "Interrupted operation": "Operación interrumpida",
   "Interrupted operation:": "Interrupted operación:",
-  "Interrupted stack operation found": "Montaje interrumpido operación encontrado",
+  "Interrupted stack operation found": "Se ha encontrado una operación de pila interrumpida",
   "Invalid 'proxmox-ve' candidate (not 9.x or none). Please verify your repository configuration and network, then retry.": "Candidato 'proxmox-ve' no válido (ni 9.x ni ninguno). Verifique la configuración y la red de su repositorio y luego vuelva a intentarlo.",
-  "Invalid ALLOWED_HOSTS value": "Valor inválido ALLOWED HOSTS",
+  "Invalid ALLOWED_HOSTS value": "Valor inválido ALLOWED_HOSTS",
   "Invalid Home Assistant OS check timeout": "Inválido Home Assistant OS check timeout",
   "Invalid ID": "ID no válida",
   "Invalid Intel render path": "Ruta de renderización Intel no válida",
@@ -3065,13 +3068,13 @@
   "Invalid service check arguments": "Inválidos argumentos de verificación de servicios",
   "Invalid service check timeout": "Hora de facturación de servicio inválido",
   "Invalid shared path": "Ruta compartida no válida",
-  "Invalid shutdown timeout": "Hora de apagado inválido",
+  "Invalid shutdown timeout": "Tiempo de espera de apagado no válido",
   "Invalid size. Please enter a number in MB (e.g., 128, 256, 512).": "Tamaño no válido. Ingrese un número en MB (por ejemplo, 128, 256, 512).",
-  "Invalid stack contract": "Contrato de pila inválido",
-  "Invalid stack journal": "Revista de pilas inválidas",
-  "Invalid stack members": "Miembros de pila inválidos",
-  "Invalid stack name": "Nombre de pila inválido",
-  "Invalid stack operation": "Apilación inválida operación",
+  "Invalid stack contract": "Contrato de pila no válido",
+  "Invalid stack journal": "Diario de pila no válido",
+  "Invalid stack members": "Miembros de pila no válidos",
+  "Invalid stack name": "Nombre de pila no válido",
+  "Invalid stack operation": "Operación de pila no válida",
   "Invalid storage ID. Use only letters, numbers, hyphens and underscores.": "ID de almacenamiento no válido. Utilice únicamente letras, números, guiones y guiones bajos.",
   "Invalid suite application": "Aplicación de suite inválida",
   "Invalid sysctl value:": "Valor sysctl inválido:",
@@ -3085,7 +3088,7 @@
   "Invalid volume size": "Tamaño del volumen inválido",
   "Invalid volume size:": "Tamaño de volumen inválido:",
   "Invalid volume target": "Destino de volumen no válido",
-  "IoT & Smart Home": "IoT & Smart Home",
+  "IoT & Smart Home": "IoT y domótica",
   "Is the value a password or secret?": "¿Es el valor una contraseña o secreto?",
   "Issue": "Asunto",
   "Issues found": "Problemas encontrados",
@@ -3179,7 +3182,7 @@
   "Kometa reads its configuration from /config/config.yml and the container only ships /config/config.yml.template. Copy the template to config.yml, fill in the required Plex and TMDb connections, then restart the container.": "Kometa lee su configuración desde /config/config.yml y el contenedor sólo barcos /config/config.yml.template. Copiar la plantilla para config.yml, rellenar las conexiones necesario Plex y TMDb, luego reiniciar el contenedor.",
   "Komga is a media server for your comics, mangas, BDs, magazines and eBooks.": "Komga es un servidor multimedia para tus cómics, mangas, BDs, revistas y eBooks.",
   "Krita is a professional FREE and open source painting program. It is made by artists that want to see affordable art tools for everyone.": "Krita es un programa de pintura profesional GRATIS y de código abierto. Está hecho por artistas que quieren ver herramientas de arte asequibles para todos.",
-  "LAN access to the kept containers (stack configuration incomplete):": "Acceso LAN a los contenedores guardados (incompleto de configuración de almacenamiento):",
+  "LAN access to the kept containers (stack configuration incomplete):": "Acceso LAN a los contenedores conservados (configuración de la pila incompleta):",
   "LAN address applied to the application URLs": "Dirección LAN aplicada a las URL de la aplicación",
   "LLM App Development Platform": "Plataforma de desarrollo de aplicaciones LLM",
   "LM Studio can run local AI models like gpt-oss, Llama, Gemma, Qwen, and DeepSeek privately on your computer.": "LM Studio puede ejecutar modelos locales de IA como gpt-oss, Llama, Gemma, Qwen y DeepSeek en privado en su computadora.",
@@ -3384,7 +3387,7 @@
   "Max user watches configured": "Número máximo de relojes de usuario configurados",
   "Maximum auto-repair attempts reached (3). Please review the log and run any remaining commands manually.": "Se alcanzó el número máximo de intentos de reparación automática (3). Revise el registro y ejecute los comandos restantes manualmente.",
   "May need to restart terminal": "Puede que sea necesario reiniciar el terminal",
-  "Media & Streaming": "Multimedia y Streaming",
+  "Media & Streaming": "Multimedia y streaming",
   "Media discovery and request management for Jellyfin, Plex and Emby.": "descubrimiento de medios y gestión de solicitudes para Jellyfin, Plex y Emby.",
   "Media library transcoding and health checking, with an internal worker node.": "Transcodificación de la biblioteca de medios y control de salud, con un nodo de trabajador interno.",
   "Media server": "Servidor multimedia",
@@ -3399,7 +3402,7 @@
   "Memory settings optimized successfully": "Configuración de memoria optimizada con éxito",
   "Memory:": "Memoria:",
   "Memos is a lightweight, self-hosted memo hub. Open Source and Free forever.": "Memos es un centro de memo liviano y auto hospedado. Fuente Abierta y Libre para siempre.",
-  "Messaging & Notifications": "Mensajería y Notificaciones",
+  "Messaging & Notifications": "Mensajería y notificaciones",
   "Messaging & Queues": "Mensajería y Colas",
   "Messenger for the Decentralized Web": "Messenger para la Web descentralizada",
   "Method:": "Método:",
@@ -3440,9 +3443,9 @@
   "Monitor progress:": "Supervisar el progreso:",
   "Monitor, analyze, and alert on network performance.": "Monitorear, analizar y alertar sobre el rendimiento de la red.",
   "Monitoring": "Monitorización",
-  "Monitoring & Analytics": "Monitorización y Analítica",
+  "Monitoring & Analytics": "Monitorización y analítica",
   "Most common cause: the archive is corrupted (interrupted write, partial copy, or storage issue).": "causa más común: el archivo está dañado (escritura interrumpida, copia parcial o problema de almacenamiento).",
-  "Mount Added Successfully:": "Montaje agregado con éxito:",
+  "Mount Added Successfully:": "Montaje añadido correctamente:",
   "Mount CIFS share:": "Monte el recurso compartido CIFS:",
   "Mount Configuration Summary:": "Resumen de configuración de montaje:",
   "Mount Details:": "Detalles de montaje:",
@@ -3512,7 +3515,7 @@
   "Move that copy offsite (USB, password manager, another host). Delete it from this path when done.": "mueva esa copia fuera del sitio (USB, administrador de contraseñas, otro host).Elimínelo de esta ruta cuando haya terminado.",
   "Move to target VM (remove from source VM config)": "Mover a la VM de destino (eliminar de la configuración de la VM de origen)",
   "Moving the data volumes aside": "Mover los volúmenes de datos a un lado",
-  "Moving the data volumes aside...": "Mover los volúmenes de datos a un lado...",
+  "Moving the data volumes aside...": "Apartando los volúmenes de datos...",
   "Multi-container application (experimental)": "Aplicación multicontenedor (experimental)",
   "Multi-line variables are not supported": "No se admiten variables multilíneas",
   "Multiple networks or external networks are not yet supported": "Aún no se admiten múltiples redes o redes externas",
@@ -3649,7 +3652,7 @@
   "NVMe health status: WARNING (critical_warning =": "Estado de salud de NVMe: ADVERTENCIA (advertencia_crítica =",
   "NVMe skipped (to add as PCIe use 'Add Controller or NVMe PCIe to VM'):": "NVMe omitido (para agregar como PCIe use 'Agregar controlador o NVMe PCIe a VM'):",
   "NVMe-specific SMART log": "Registro SMART específico de NVMe",
-  "NVR & Cameras": "NVR y Cámaras",
+  "NVR & Cameras": "NVR y cámaras",
   "NVR with optional VA-API video acceleration and hardware object detectors": "NVR con detectores opcionales de vídeo VA-API y detectores de objetos de hardware",
   "NZBGet web interface": "Interfaz web NZBGet",
   "Name": "Nombre",
@@ -3671,7 +3674,7 @@
   "Netbox is an IP address management (IPAM) and data center infrastructure management (DCIM) tool. Initially conceived by the network engineering team at DigitalOcean, NetBox was developed specifically to address the needs of network and infrastructure engineers. It is intended to function as a domain-specific source of truth for network operations.": "Netbox es una herramienta de gestión de direcciones IP (IPAM) y gestión de infraestructuras del centro de datos (DCIM). Inicialmente concebido por el equipo de ingeniería de red en DigitalOcean, NetBox fue desarrollado específicamente para atender las necesidades de los ingenieros de red e infraestructura. Está destinado a funcionar como una fuente de verdad específica para la red operations.",
   "Network": "Red",
   "Network  :": "Red  :",
-  "Network & Firewall": "Red y Cortafuegos",
+  "Network & Firewall": "Red y cortafuegos",
   "Network (interfaces, DNS)": "Red (interfaces, DNS)",
   "Network Bridge": "Puente de red",
   "Network Commands": "Comandos de red",
@@ -3929,7 +3932,7 @@
   "No jobs": "Sin trabajos",
   "No language selected.": "No se seleccionó ningún idioma.",
   "No local disk storage configured.": "No hay almacenamiento en disco local configurado.",
-  "No main sources.list present (skipped)": "No hay ninguna lista de fuentes principales presente (omitida)",
+  "No main sources.list present (skipped)": "No hay sources.list principal (omitido)",
   "No matching PVE vzdump jobs were found for the PBS backend.": "No se encontraron trabajos PVE vzdump coincidentes para el backend de PBS.",
   "No matching PVE vzdump jobs were found for the local archive backend.": "No se encontraron trabajos PVE vzdump coincidentes para el backend del archivo local.",
   "No mount point was specified.": "No se especificó ningún punto de montaje.",
@@ -4042,7 +4045,7 @@
   "OCI containers require Proxmox VE 9.1 or later.": "Los contenedores OCI requieren Proxmox VE 9.1 o posterior.",
   "OCI management": "Gestión OCI",
   "OCI management could not be completed. Check the backend status; no additional cleanup has been authorized.": "La gestión OCI no pudo completarse. Comprueba el estado del backend; no se ha autorizado ninguna limpieza adicional.",
-  "OCI manager Apps (beta)": "Aplicaciones de administrador de OCI (beta)",
+  "OCI manager Apps (beta)": "OCI manager Apps (beta)",
   "OCI manager Apps is a beta: if something does not work as expected, please report it on GitHub with the application name.": "OCI manager Apps es una beta: si algo no funciona como esperabas, repórtalo en GitHub con el nombre de la aplicación.",
   "OCI metadata integrity mismatch": "Desigualdad de la integridad de los metadatos de la OCI",
   "OCI metadata too large": "OCI metadatos demasiado grandes",
@@ -4095,7 +4098,7 @@
   "Only removes storage definition, not remote data.": "Solo elimina la definición de almacenamiento, no los datos remotos.",
   "Only run this if you used LVM (step 6b):": "Ejecute esto solo si usó LVM (paso 6b):",
   "Only the host backup hook is removed — PVE vzdump jobs targeting this storage stay intact.": "solo se elimina el enlace de copia de seguridad del host; las tareas de PVE vzdump destinados a este almacenamiento permanecen intactos.",
-  "Only the image reference, with no Compose file": "Sólo la referencia de la imagen, sin archivo Compose",
+  "Only the image reference, with no Compose file": "Solo la referencia de la imagen, sin archivo Compose",
   "Open": "Abierto",
   "Open Source realtime backend in 1 file": "Open Source en tiempo real backend en 1 archivo",
   "Open rwx + default inheritance for new files": "Abra rwx + herencia predeterminada para archivos nuevos",
@@ -4163,7 +4166,7 @@
   "Original ZFS ARC config restored from .bak": "Configuración original de ZFS ARC restaurada desde .bak",
   "Original bashrc restored": "Bashrc original restaurado.",
   "Original logrotate configuration restored": "Configuración original de logrotate restaurada",
-  "Orphan stack contract archived:": "Contrato de pila de huérfano archivado:",
+  "Orphan stack contract archived:": "Contrato de pila huérfano archivado:",
   "Oscam is an Open Source Conditional Access Module software used for descrambling DVB transmissions using smart cards. It's both a server and a client.": "Oscam es un software de módulos de acceso condicional de código abierto utilizado para descifrar transmissions DVB utilizando tarjetas inteligentes. Es un servidor y un cliente.",
   "Other Prebuilt Linux VMs": "Otras máquinas virtuales Linux prediseñadas",
   "Output archive:": "Archivo de salida:",
@@ -4262,8 +4265,8 @@
   "Password to access the aMule web interface": "Contraseña para acceder a la interfaz web aMule",
   "Passwords do not match. Please try again.": "Las contraseñas no coinciden. Por favor inténtalo de nuevo.",
   "Paste it here and press Ctrl+D on an empty line.": "Pégalo aquí y pulsa Ctrl+D en una línea vacía.",
-  "Paste its Compose file in the terminal": "Pega su archivo Compose en la terminal",
-  "Paste its docker run command in the terminal": "Pega su comando docker run en la terminal",
+  "Paste its Compose file in the terminal": "Pegar su archivo Compose en la terminal",
+  "Paste its docker run command in the terminal": "Pegar su comando docker run en la terminal",
   "Paste the UUP Dump URL here": "Pegue la URL del volcado UUP aquí",
   "Patching source for kernel compatibility...": "Fuente de parcheo para compatibilidad del kernel...",
   "Path does not exist.": "La ruta no existe.",
@@ -4371,7 +4374,7 @@
   "Postfix configuration": "Configuración de sufijo",
   "PostgreSQL": "PostgreSQL",
   "PostgreSQL URL without an associated service:": "URL de PostgreSQL sin un servicio asociado:",
-  "PostgreSQL creates the database named in POSTGRES_DB on the first start. The installer default is postgresql.": "PostgreSQL crea la base de datos llamada en POSTGRES DB en el primer comienzo. El instalador predeterminado es postgresql.",
+  "PostgreSQL creates the database named in POSTGRES_DB on the first start. The installer default is postgresql.": "PostgreSQL crea la base de datos llamada en POSTGRES_DB en el primer comienzo. El instalador predeterminado es postgresql.",
   "PostgreSQL is an advanced, enterprise-class, and open-source relational database system. PostgreSQL supports both SQL (relational) and JSON (non-relational) querying.": "PostgreSQL es un sistema de bases de datos relacionales avanzado, de clase empresarial y de código abierto. PostgreSQL soporta tanto SQL (relacional) como JSON (no-relacional) querying.",
   "PostgreSQL requires a password": "PostgreSQL requires una contraseña",
   "PostgreSQL volume size in GB": "Tamaño del volumen de PostgreSQL en GB",
@@ -4400,7 +4403,7 @@
   "Press Ctrl+C to stop the server and return to menu.": "Presione Ctrl+C para detener el servidor y regresar al menú.",
   "Press ENTER to continue...": "Presione ENTER para continuar...",
   "Press ENTER to return to the menu...": "Presione ENTER para regresar al menú...",
-  "Press ENTER to return...": "Presione ENTRAR para regresar...",
+  "Press ENTER to return...": "Presione ENTER para regresar...",
   "Press Enter to close...": "Presione Entrar para cerrar...",
   "Press Enter to continue": "Presione Entrar para continuar",
   "Press Enter to continue...": "Presione Entrar para continuar...",
@@ -4453,7 +4456,7 @@
   "Process may take several minutes depending on container size": "El proceso puede tardar varios minutos dependiendo del tamaño del contenedor.",
   "Process may take several minutes for large containers": "El proceso puede tardar varios minutos para contenedores grandes.",
   "Processes using NVIDIA:": "Procesos usando NVIDIA:",
-  "Productivity & Workflows": "Productividad y Flujos de trabajo",
+  "Productivity & Workflows": "Productividad y flujos de trabajo",
   "Profile": "Perfil",
   "Profile:": "Perfil:",
   "Projectsend is a self-hosted application that lets you upload files and assign them to specific clients that you create yourself. Secure, private and easy. No more depending on external services or e-mail to send those files.": "Projectsend es una aplicación autoalojada que le permite subir archivos y asignarlos a clientes específicos que usted crea. Seguro, privado y fácil. No más dependiendo de servicios externos o correo electrónico para enviar esos archivos.",
@@ -4534,7 +4537,7 @@
   "Pwndrop is a self-deployable file hosting service for sending out red teaming payloads or securely sharing your private files over HTTP and WebDAV.": "Pwndrop es un servicio de hospedaje de archivos autodesplegable para enviar descargas de equipo rojo o compartir de forma segura sus archivos privados sobre HTTP y WebDAV.",
   "PyCharm offers out-of-the-box support for Python, databases, Jupyter, Git, Conda, PyTorch, TensorFlow, Hugging Face, Django, Flask, FastAPI, and more.": "PyCharm ofrece soporte fuera de la caja para Python, bases de datos, Jupyter, Git, Conda, PyTorch, TensorFlow, Hugging Face, Django, Flask, FastAPI, y más.",
   "Pydio Cells needs an external MySQL or MariaDB database. The setup wizard asks for its address, database name and user on the first start.": "Pydio Cells necesita una base de datos MySQL externa o MariaDB. El asistente de configuración pide su dirección, nombre de la base de datos y usuario en el primer comienzo.",
-  "Pydio Cells redirects to the address given in EXTERNALURL. If the container changes address, edit lxc.environment.runtime: EXTERNALURL and SERVER_IP in /etc/pve/lxc/<CTID>.conf with the container stopped, and delete /config/keys/cert.crt to regenerate the certificate.": "Pydio Cells redirige a la dirección dada en EXTERNALURL. Si el contenedor cambia la dirección, edite lxc.environment.runtime: EXTERNALURL y SERVER IP en /etc/pve/lxc/Seguido CTID ratio.conf con el contenedor detenido, y elimine /config/keys/cert.crt para regenerar el certificado.",
+  "Pydio Cells redirects to the address given in EXTERNALURL. If the container changes address, edit lxc.environment.runtime: EXTERNALURL and SERVER_IP in /etc/pve/lxc/<CTID>.conf with the container stopped, and delete /config/keys/cert.crt to regenerate the certificate.": "Pydio Cells redirige a la dirección dada en EXTERNALURL. Si el contenedor cambia la dirección, edite lxc.environment.runtime: EXTERNALURL y SERVER_IP en /etc/pve/lxc/Seguido CTID ratio.conf con el contenedor detenido, y elimine /config/keys/cert.crt para regenerar el certificado.",
   "Pydio-cells is the nextgen file sharing platform for organizations. It is a full rewrite of the Pydio project using the Go language following a micro-service architecture.": "Pydio-cells es la plataforma de intercambio de archivos de Nextgen para organizaciones. Es una reescritura completa del proyecto Pydio usando el lenguaje Go siguiendo una arquitectura de microservicio.",
   "QDirStat Qt-based directory statistics: KDirStat without any KDE -- from the author of the original KDirStat.": "QDirStat Estadísticas de directorios basadas en Qt: KDirStat sin ningún KDE -- del autor del original KDirStat.",
   "Quick health check (PASSED / FAILED)": "Chequeo de salud rápido (APROBADO / FALLADO)",
@@ -4569,7 +4572,7 @@
   "Re-enter the BORG REPOKEY passphrase to confirm:": "Vuelva a ingresar la frase de contraseña de BORG REPOKEY para confirmar:",
   "Re-running pre-check after repairs...": "Volviendo a ejecutar la verificación previa después de las reparaciones...",
   "Reachable": "Accesible",
-  "Read its Compose file from a file of this host": "Lea su archivo Compose desde un archivo de este host",
+  "Read its Compose file from a file of this host": "Leer su archivo Compose desde un archivo de este host",
   "Read the link with pct console CTID on the Proxmox host, or from the Console panel of the container in the Proxmox web interface, then open the https://playit.gg/claim/ address it shows in a browser and sign in to playit.gg. Ctrl+a q leaves pct console.": "Lea el enlace con la consola pct CTID en el host Proxmox, o desde el panel Console del contenedor en la interfaz web Proxmox, a continuación, abra la dirección https://playit.gg/claim/ que muestra en un navegador y regístrese para playit.gg. Ctrl+a q deja la consola pct.",
   "Read-Only": "Sólo lectura",
   "Read-Only access": "Acceso de sólo lectura",
@@ -4732,7 +4735,7 @@
   "Remove subscription banner": "Eliminar banner de suscripción",
   "Remove the unprivileged flag from configuration:": "Elimine la bandera sin privilegios de la configuración:",
   "Remove unused packages and their config": "Eliminar paquetes no utilizados y su configuración.",
-  "Remove: delete the application and its containers": "Eliminar: eliminar la aplicación y sus contenedores",
+  "Remove: delete the application and its containers": "Eliminar: la aplicación y sus contenedores",
   "Removed": "Remoto",
   "Removed KVM MSR options from configuration": "Se eliminaron las opciones de KVM MSR de la configuración.",
   "Removed Mount:": "Montaje eliminado:",
@@ -4784,7 +4787,7 @@
   "Removing storage from Proxmox...": "Eliminando almacenamiento de Proxmox...",
   "Removing system limits optimizations...": "Eliminando optimizaciones de límites del sistema...",
   "Removing the containers...": "Removiendo los contenedores...",
-  "Removing the incomplete stack...": "La eliminación de la pila incompleta...",
+  "Removing the incomplete stack...": "Eliminando la pila incompleta...",
   "Removing the previous container": "Remoción del contenedor anterior",
   "Removing utilities installed by ProxMenux...": "Eliminando utilidades instaladas por ProxMenux...",
   "Removing zfs-auto-snapshot...": "Eliminando zfs-auto-snapshot...",
@@ -4873,8 +4876,8 @@
   "Restoring the original rpcbind service state...": "Restaurando el estado original del servicio rpcbind...",
   "Restoring the previous Rclone configuration...": "Restaurar la configuración anterior de Rclone...",
   "Restoring the previous backup...": "Restaurar el backup anterior...",
-  "Restoring the previous state of the stack...": "Restaurar el estado anterior de la pila...",
-  "Restoring the stack records...": "Restaurar los registros de la pila...",
+  "Restoring the previous state of the stack...": "Restaurando el estado anterior de la pila...",
+  "Restoring the stack records...": "Restaurando los registros de la pila...",
   "Results will be saved automatically to:": "Los resultados se guardarán automáticamente en:",
   "Results will be saved to:": "Los resultados se guardarán en:",
   "Retention": "Retención",
@@ -5036,8 +5039,8 @@
   "Save this Borg target so you don't need to enter the details again?": "¿Guardar este objetivo Borg para no tener que volver a introducir los detalles?",
   "Saved record removed": "Se elimina el registro guardado",
   "Saving the new configuration": "Salvando la nueva configuración",
-  "Saving the new configuration...": "Salvando la nueva configuración...",
-  "Saving the stack records...": "Salvando los registros de la pila...",
+  "Saving the new configuration...": "Guardando la nueva configuración...",
+  "Saving the stack records...": "Guardando los registros de la pila...",
   "Scan storage for new content": "Escanear el almacenamiento en busca de contenido nuevo",
   "Scanning available physical disks...": "Escaneando discos físicos disponibles...",
   "Scanning network for NFS servers...": "Escaneando la red en busca de servidores NFS...",
@@ -5136,6 +5139,7 @@
   "Select archive to restore": "Seleccione el archivo para restaurar",
   "Select at least one path to continue.": "seleccione al menos una ruta para continuar.",
   "Select at least one suite application": "Seleccione al menos una aplicación de suite",
+  "Select at least one stack container": "Seleccione al menos un contenedor de la pila",
   "Select authentication mode:": "Seleccione el modo de autenticación:",
   "Select authentication type:": "Seleccione el tipo de autenticación:",
   "Select available Controllers/NVMe to add:": "Seleccione Controladores/NVMe disponibles para agregar:",
@@ -5334,7 +5338,7 @@
   "Shared host data is not reverted by the backups. Continue?": "Los datos de host compartidos no son revertidos por los backups. ¿Continúa?",
   "Shared host directories (not included in Proxmox backups)": "Directorios de host compartidos (no incluidos en backups de Proxmox)",
   "Shared host directory": "Directorio compartido del host",
-  "Shared host directory (not included in Proxmox backups)": "Directorio de host compartido (no incluido en backups de Proxmox)",
+  "Shared host directory (not included in Proxmox backups)": "Directorio del host compartido (no incluido en los backups de Proxmox)",
   "Shared host files are kept as they are; the backup does not restore their content.": "Los archivos de host compartidos se guardan como están; el backup no restaura su contenido.",
   "Shared host media directory": "Directorio multimedia compartido del host",
   "Shared memory size for the GPU workload in MB": "Tamaño de memoria compartido para el volumen de trabajo de GPU en MB",
@@ -5459,20 +5463,20 @@
   "Stable (main branch)": "Estable (rama principal)",
   "Stable monitor service normalized.": "Servicio de monitor estable normalizado.",
   "Stack": "Pila",
-  "Stack adapter not recognized by the translator": "Adaptador Stack no reconocido por el traductor",
-  "Stack backups are missing; a partial restore is not allowed": "Faltan backups; no se permite una restauración parcial",
-  "Stack checked:": "Se ha comprobado:",
-  "Stack members are missing; recreate them after verifying their volumes": "Los miembros de Stack están desaparecidos; recrearlos después de verificar sus volúmenes",
-  "Stack members are updated together with their stack": "Los miembros de Stack se actualizan junto con su pila",
+  "Stack adapter not recognized by the translator": "Adaptador de pila no reconocido por el traductor",
+  "Stack backups are missing; a partial restore is not allowed": "Faltan backups de la pila; no se permite una restauración parcial",
+  "Stack checked:": "Pila comprobada:",
+  "Stack members are missing; recreate them after verifying their volumes": "Faltan miembros de la pila; recréelos después de verificar sus volúmenes",
+  "Stack members are updated together with their stack": "Los miembros de una pila se actualizan junto con su pila",
   "Stack name": "Nombre de la pila",
-  "Stack records restored": "Registros recuperados",
-  "Stack records saved": "Registros guardados",
-  "Stack records saved; no container was reinstalled.": "Registros guardados; no se reinstaló ningún contenedor.",
-  "Stack recovery completed; every member is back to its previous installation.": "Recuperación de etapas completada; cada miembro está de vuelta a su instalación anterior.",
-  "Stack startup hook installed": "Gancho de arranque de Stack instalado",
-  "Stack stopped": "Stack paró",
-  "Stack update completed. Data kept.": "Actualización finalizada. Datos guardados.",
-  "Stack:": "Stack:",
+  "Stack records restored": "Registros de la pila restaurados",
+  "Stack records saved": "Registros de la pila guardados",
+  "Stack records saved; no container was reinstalled.": "Registros de la pila guardados; no se reinstaló ningún contenedor.",
+  "Stack recovery completed; every member is back to its previous installation.": "Recuperación de la pila completada; cada miembro ha vuelto a su instalación anterior.",
+  "Stack startup hook installed": "Hook de arranque de la pila instalado",
+  "Stack stopped": "Pila detenida",
+  "Stack update completed. Data kept.": "Actualización de la pila completada. Datos conservados.",
+  "Stack:": "Pila:",
   "Staging directory:": "Directorio temporal:",
   "Staging ready.": "Preparación completada.",
   "Staging source:": "Origen de la preparación:",
@@ -5507,9 +5511,9 @@
   "Start uploading to PBS — sets a recovery passphrase": "comience a cargar en PBS: establece una frase de contraseña de recuperación",
   "Start when finished": "Iniciar al terminar",
   "Start with Proxmox": "Iniciar con Proxmox",
-  "Starting": "Empezando",
-  "Starting Borg backup...": "Iniciando copia de seguridad de Borg...",
-  "Starting CT": "TC inicial",
+  "Starting": "Iniciando",
+  "Starting Borg backup...": "Iniciando el backup de Borg...",
+  "Starting CT": "Iniciando el CT",
   "Starting LXC Privileged to Unprivileged conversion process...": "Iniciando el proceso de conversión de LXC privilegiado a no privilegiado...",
   "Starting LXC Unprivileged to Privileged conversion process...": "Iniciando el proceso de conversión de LXC sin privilegios a privilegiados...",
   "Starting NVIDIA installer. This may take several minutes...": "Iniciando el instalador de NVIDIA. Esto puede tardar varios minutos...",
@@ -5518,22 +5522,22 @@
   "Starting ProxMenux update...": "Iniciando actualización de ProxMenux...",
   "Starting Proxmox storage integration...": "Iniciando la integración del almacenamiento de Proxmox...",
   "Starting Proxmox system repair...": "Iniciando la reparación del sistema Proxmox...",
-  "Starting Rclone and waiting for the FUSE mount...": "Empezando Rclone y esperando el montaje FUSE...",
+  "Starting Rclone and waiting for the FUSE mount...": "Iniciando Rclone y esperando el montaje FUSE...",
   "Starting SMART long self-test...": "Iniciando la autoprueba larga SMART...",
   "Starting SMART short self-test...": "Iniciando la autoprueba corta SMART...",
-  "Starting container": "Contenedor inicial",
-  "Starting container...": "Contenedor inicial...",
-  "Starting direct conversion of container": "Iniciar la conversión directa del contenedor",
-  "Starting gateway...": "Iniciando puerta de enlace...",
+  "Starting container": "Iniciando el contenedor",
+  "Starting container...": "Iniciando el contenedor...",
+  "Starting direct conversion of container": "Iniciando la conversión directa del contenedor",
+  "Starting gateway...": "Iniciando la puerta de enlace...",
   "Starting installation...": "Iniciando instalación...",
   "Starting installer...": "Iniciando el instalador...",
-  "Starting privileged container...": "Iniciando contenedor privilegiado...",
+  "Starting privileged container...": "Iniciando el contenedor privilegiado...",
   "Starting rpcbind service...": "Iniciando el servicio rpcbind...",
-  "Starting the container...": "Comenzando el contenedor...",
-  "Starting the main container and its dependencies...": "Comenzando el contenedor principal y sus dependencias...",
-  "Starting the service:": "Inicio del servicio:",
-  "Starting unprivileged container...": "Iniciando contenedor sin privilegios...",
-  "Startup: coordinated by the stack startup hook": "Inicio: coordinado por el gancho de arranque de pila",
+  "Starting the container...": "Iniciando el contenedor...",
+  "Starting the main container and its dependencies...": "Iniciando el contenedor principal y sus dependencias...",
+  "Starting the service:": "Iniciando el servicio:",
+  "Starting unprivileged container...": "Iniciando el contenedor sin privilegios...",
+  "Startup: coordinated by the stack startup hook": "Arranque: coordinado por el hook de arranque de la pila",
   "Startup: independent, without hookscript": "Inicio: independiente, sin gancho",
   "Static IP": "IP estática",
   "Static IPv4 address": "Dirección IPv4 estática",
@@ -5570,7 +5574,7 @@
   "Stopping the container before applying configuration...": "Deteniendo el contenedor antes de aplicar la configuración...",
   "Stopping the container before conversion...": "Deteniendo el contenedor antes de la conversión...",
   "Stopping the container...": "Deteniendo el contenedor...",
-  "Stopping the stack...": "Detener la pila...",
+  "Stopping the stack...": "Deteniendo la pila...",
   "Storage": "Almacenamiento",
   "Storage & Share Manager": "Almacenamiento y Gestor de recursos compartidos",
   "Storage Added:": "Almacenamiento agregado:",
@@ -5822,6 +5826,7 @@
   "The command works out a value by running another command:": "El comando obtiene un valor ejecutando otro comando:",
   "The compatibility check raised failures that may break the system after restore.": "La verificación de compatibilidad generó fallas que pueden dañar el sistema después de la restauración.",
   "The configuration changed after the backup was restored; the recovery is not confirmed": "La configuración cambió después de la restauración del backup; la recuperación no se confirma",
+  "The console of the container could not be configured": "No se pudo configurar la consola del contenedor",
   "The configuration changed after the new container was validated": "La configuración cambió después de validar el nuevo contenedor",
   "The configuration changed during the NVIDIA refresh": "La configuración cambió durante la actualización de NVIDIA",
   "The configuration evidence does not match": "La evidencia de configuración no coincide",
@@ -5871,7 +5876,7 @@
   "The data and document volumes need at least 8 GB": "Los volúmenes de datos y documentos necesitan al menos 8 GB",
   "The database server must accept connections from the IP address of this container, with a user that is not limited to localhost.": "El servidor de bases de datos debe aceptar conexiones desde la dirección IP de este contenedor, con un usuario que no se limita a localhost.",
   "The dedicated adapter still requires replaying its rootfs changes": "El adaptador dedicado todavía requiere replaying its rootfs changes",
-  "The dependency hook and the stack recipe differ": "El gancho de dependencia y la receta de pila difieren",
+  "The dependency hook and the stack recipe differ": "El hook de dependencias y la receta de la pila no coinciden",
   "The dependency hook was modified; review it before updating": "El gancho de dependencia fue modificado; revisarlo antes de actualizarlo",
   "The developer-friendly cloud platform for building and running LLM agents for AI-native applications.": "La plataforma de nube amigable con el desarrollador para construir y ejecutar agentes LLM para aplicaciones nativas de AI.",
   "The device directory does not exist:": "El directorio del dispositivo no existe:",
@@ -5934,7 +5939,7 @@
   "The image did not grant the application user access to the devices; check its native init. Host permissions were not relaxed.": "La imagen no concedió el acceso del usuario de la aplicación a los dispositivos; comprobar su entrada nativa. Los permisos del host no se relajaron.",
   "The image did not pass the integrity check": "La imagen no pasó el control de integridad",
   "The image does not declare support for this architecture:": "La imagen no declara soporte para esta arquitectura:",
-  "The image download did not complete correctly; downloading it again...": "La descarga de la imagen no se completó correctamente; descargarlo de nuevo...",
+  "The image download did not complete correctly; downloading it again...": "La descarga de la imagen no se completó correctamente; descargándola de nuevo...",
   "The image expects files that are given to it one by one:": "La imagen espera archivos que se le dan uno por uno:",
   "The image is already up to date; nothing was changed.": "La imagen ya está actualizada; nada cambió.",
   "The image is in its registry, for one architecture.": "La imagen está en su registro, para una arquitectura.",
@@ -5947,7 +5952,7 @@
   "The imported Compose requests privileged, but the official jlesage/handbrake documentation does not require it; ProxMenux keeps the LXC unprivileged.": "El Compose importado solicita privilegiado, pero la documentación oficial jlesage/handbrake no lo requiere; ProxMenux mantiene el LXC sin privilegios.",
   "The imported OCI groups are not numeric": "Los grupos OCI importados no son numéricos",
   "The imported OCI user or group is not numeric": "El usuario o grupo OCI importado no es numérico",
-  "The initial user name and password stay written in /etc/pve/lxc/<CTID>.conf as INIT_USERNAME and INIT_PASSWORD. They can be removed after the first login, with the container stopped.": "El nombre de usuario inicial y la contraseña permanecen escritos en /etc/pve/lxc/según INIT USERNAME e INIT PASSWORD. Se pueden quitar después de la primera entrada, con el contenedor detenido.",
+  "The initial user name and password stay written in /etc/pve/lxc/<CTID>.conf as INIT_USERNAME and INIT_PASSWORD. They can be removed after the first login, with the container stopped.": "El nombre de usuario inicial y la contraseña permanecen escritos en /etc/pve/lxc/según INIT_USERNAME e INIT_PASSWORD. Se pueden quitar después de la primera entrada, con el contenedor detenido.",
   "The installation asks which one to use for these paths.": "La instalación pregunta cuál usar para estas rutas.",
   "The installation ended with exit code": "La instalación terminó con código de salida",
   "The installation requires a server restart to apply changes. Do you want to restart now?": "La instalación requiere reiniciar el servidor para aplicar los cambios. ¿Quieres reiniciar ahora?",
@@ -5973,7 +5978,7 @@
   "The main member must stop first and start last": "El miembro principal debe parar primero y comenzar el último",
   "The main member of the stack is missing": "Falta el miembro principal de la pila",
   "The manifest does not match its digest": "El manifiesto no coincide con su digestión",
-  "The member journal belongs to another stack operation": "El diario miembro pertenece a otra pila operación",
+  "The member journal belongs to another stack operation": "El diario del miembro pertenece a otra operación de pila",
   "The member journal is outside the registry": "La revista miembro está fuera del registro",
   "The mount evidence does not match the verified directories": "La evidencia de montaje no coincide con los directorios verificados",
   "The mount source or options were not kept": "La fuente de montaje o las opciones no se guardaron",
@@ -6027,7 +6032,7 @@
   "The prepared directory escapes the rootfs:": "El directorio preparado escapa a los rootfs:",
   "The preselected VMID does not exist on this host:": "El VMID preseleccionado no existe en este host:",
   "The previous native backup will be restored. Shared host directories are not reverted. Displaced disks are kept.": "El backup nativo anterior será restaurado. Los directorios de host compartidos no son revertidos. Se guardan discos desplazados.",
-  "The previous stack contract is not safe; review it before reusing it": "El contrato de pila anterior no es seguro; revisarlo antes de reutilizarlo",
+  "The previous stack contract is not safe; review it before reusing it": "El contrato de pila anterior no es seguro; revíselo antes de reutilizarlo",
   "The previous stack contract is not valid; it is not archived automatically": "El contrato de pila anterior no es válido; no se archiva automáticamente",
   "The previous stack contract still has containers or VMs:": "El contrato de pila anterior todavía tiene contenedores o VMs:",
   "The private address is already assigned to another container:": "La dirección privada ya está asignada a otro contenedor:",
@@ -6061,12 +6066,12 @@
   "The requested machine learning GPU profile is not working; it is not replaced by CPU": "El perfil GPU de aprendizaje automático solicitado no funciona; no es reemplazado por CPU",
   "The restored service did not pass its health check": "El servicio restaurado no aprobó su cheque de salud",
   "The restored service stopped; the recovery is not confirmed": "El servicio restaurado se detuvo; la recuperación no se confirma",
-  "The reviewed Tandoor stack does not require a privileged LXC.": "La pila Tandoor revisada no requiere un privilegiado LXC.",
+  "The reviewed Tandoor stack does not require a privileged LXC.": "La pila de Tandoor revisada no requiere un LXC privilegiado.",
   "The rootfs capture only belongs to the running installation": "La captura de rootfs sólo pertenece a la instalación de ejecución",
   "The rootfs is not managed by Proxmox": "Los rootfs no son gestionados por Proxmox",
   "The rootfs is not mounted": "Los rootfs no se montan",
   "The same GPU cannot be used by two VMs at the same time.": "Dos máquinas virtuales no pueden utilizar la misma GPU al mismo tiempo.",
-  "The same connection can be given as container variables instead of the file: UN_SONARR_0_URL and UN_SONARR_0_API_KEY, or the UN_RADARR_0_ equivalents.": "La misma conexión se puede administrar como variables contenedor en lugar del archivo: UN SONARR 0 URL y UN SONARR 0 API KEY, o UN RADARR 0  equivalents.",
+  "The same connection can be given as container variables instead of the file: UN_SONARR_0_URL and UN_SONARR_0_API_KEY, or the UN_RADARR_0_ equivalents.": "La misma conexión se puede administrar como variables contenedor en lugar del archivo: UN_SONARR_0_URL y UN_SONARR_0_API_KEY, o UN RADARR 0  equivalents.",
   "The saved MOTD state is invalid; no changes were made": "el estado MOTD guardado no es válido;no se hicieron cambios",
   "The saved OCI record is incomplete or has an unexpected format.": "El registro OCI guardado es incompleto o tiene un formato inesperado.",
   "The saved projection does not match the native evidence": "La proyección salva no coincide con la evidencia nativa",
@@ -6138,11 +6143,11 @@
   "The stack member has no declared adaptation profile": "El miembro de la pila no tiene perfil de adaptación declarado",
   "The stack name only accepts lowercase letters, numbers and hyphens": "El nombre de la pila solo acepta letras minúsculas, números y guiones",
   "The stack needs member adaptations or a verification of missing volumes": "La pila necesita adaptaciones de los miembros o una verificación de volúmenes perdidos",
-  "The stack operation had already finished": "La pila operación ya había terminado",
-  "The stack operation has not finished yet": "La pila operación no ha terminado todavía",
-  "The stack operation stopped halfway. Select the stack again in the OCI management menu to recover it.": "La pila operación se detuvo a mitad de camino. Seleccione la pila de nuevo en el menú de gestión de OCI para recuperarla.",
-  "The stack registry is incomplete; review the private contracts.": "El registro de pilas es incompleto; revisar los contratos privados.",
-  "The stack startup hook was not found": "El gancho de arranque de pila no fue encontrado",
+  "The stack operation had already finished": "La operación de pila ya había terminado",
+  "The stack operation has not finished yet": "La operación de pila todavía no ha terminado",
+  "The stack operation stopped halfway. Select the stack again in the OCI management menu to recover it.": "La operación de pila se detuvo a medias. Seleccione la pila de nuevo en el menú de gestión OCI para recuperarla.",
+  "The stack registry is incomplete; review the private contracts.": "El registro de pilas está incompleto; revise los contratos privados.",
+  "The stack startup hook was not found": "No se encontró el hook de arranque de la pila",
   "The stack update was saved.": "La actualización de la pila fue guardada.",
   "The startup differs from the declared Nextcloud adapter": "La startup difiere del adaptador Nextcloud declarado",
   "The startup differs from the declared adapter": "La startup difiere del adaptador declarado",
@@ -6327,7 +6332,7 @@
   "Transaction log:": "Registro de transacciones:",
   "Translation files:": "Archivos de traducción:",
   "Transmission is designed for easy, powerful use. Transmission has the features you want from a BitTorrent client: encryption, a web interface, peer exchange, magnet links, DHT, µTP, UPnP and NAT-PMP port forwarding, webseed support, watch directories, tracker editing, global and per-torrent speed limits, and more.": "Transmission está diseñado para un uso fácil y potente. Transmission tiene las características que desea de un cliente BitTorrent: cifrado, una interfaz web, intercambio de pares, enlaces magnéticos, DHT, μTP, UPnP y NAT-PMP, soporte web, directorios de reloj, edición de rastreadores, límites de velocidad globales y per-torrent, y más.",
-  "Tried pvesm path and manual detection methods": "Ruta pvesm probada y métodos de detección manual",
+  "Tried pvesm path and manual detection methods": "Se probó pvesm path y métodos de detección manual",
   "Trust this certificate and save it for scheduled backups?": "¿Confiar en este certificado y guardarlo para copias de seguridad programadas?",
   "Try Again": "Intentar otra vez",
   "Try a different search term.": "Pruebe con un término de búsqueda diferente.",
@@ -6422,14 +6427,14 @@
   "Unmounting": "Desmontaje",
   "Unmounting disk...": "Desmontando disco...",
   "Unpackerr configured": "Unpackerr configurado",
-  "Unpackerr has no web interface and extracts nothing until it is pointed at a Starr application. Uncomment the [sonarr.0] or [radarr.0] section in /config/unpackerr.conf inside the container, set its url and api_key, then restart the container.": "Unpackerr no tiene interfaz web y no extrae nada hasta que se apunta a una aplicación Starr. Descomponer la sección [sonarr.0] o [radarr.0] en /config/unpackerr.conf dentro del contenedor, establecer su url y api key, luego reiniciar el recipiente.",
+  "Unpackerr has no web interface and extracts nothing until it is pointed at a Starr application. Uncomment the [sonarr.0] or [radarr.0] section in /config/unpackerr.conf inside the container, set its url and api_key, then restart the container.": "Unpackerr no tiene interfaz web y no extrae nada hasta que se apunta a una aplicación Starr. Descomentar la sección [sonarr.0] o [radarr.0] en /config/unpackerr.conf dentro del contenedor, establecer su url y api_key, y reiniciar el contenedor.",
   "Unpackerr requires Sonarr, Radarr or Lidarr in this suite": "Unpackerr requiere Sonarr, Radarr o Lidarr en esta suite",
   "Unpackerr stopped during its first start": "Unpackerr se detuvo durante su primer inicio",
   "Unprivileged": "Sin privilegios",
   "Unprivileged Container Access": "Acceso a contenedores sin privilegios",
   "Unprivileged container": "Contenedor sin privilegios",
   "Unprivileged container selected:": "Contenedor sin privilegios seleccionado:",
-  "Unprivileged container — UID offset:": "Contenedor sin privilegios: compensación de UID:",
+  "Unprivileged container — UID offset:": "Contenedor sin privilegios — desplazamiento de UID:",
   "Unprivileged containers map their UIDs to high host UIDs (e.g. 100000+), which appear as 'others' on the host filesystem.": "Los contenedores sin privilegios asignan sus UID a UID de host altos (por ejemplo, 100000+), que aparecen como \"otros\" en el sistema de archivos del host.",
   "Unprivileged: Limited access (more secure)": "Sin privilegios: acceso limitado (más seguro)",
   "Unreachable": "Inalcanzable",
@@ -6457,7 +6462,7 @@
   "Unsafe registry directory": "Directorio de registros inseguros",
   "Unsafe registry lock": "Cierre de registro inseguro",
   "Unsafe rootfs for the capture": "rootfs inseguros para la captura",
-  "Unsafe stack assembly": "Montaje de pila inseguro",
+  "Unsafe stack assembly": "Ensamblado de pila inseguro",
   "Unsafe volume path": "Vía de volumen inseguro",
   "Unsupported CPU allocation mode:": "Modo de asignación de CPU no compatible:",
   "Unsupported GID strategy:": "Estrategia GID sin apoyo:",
@@ -6490,7 +6495,7 @@
   "Unsupported volume options:": "Opciones de volumen no admitidas:",
   "Untrusted or modified NVIDIA hook": "Gancho NVIDIA sin confianza o modificado",
   "Unused image removed from the cache:": "Imagen no utilizada extraída del caché:",
-  "Unused images removed from the cache:": "Imágenes no utilizadas eliminadas del caché:",
+  "Unused images removed from the cache:": "Imágenes sin uso eliminadas de la caché:",
   "Update": "Actualización",
   "Update Available": "Actualización disponible",
   "Update Ceph repository (Only if using Ceph):": "Actualice el repositorio de Ceph (solo si usa Ceph):",
@@ -6508,7 +6513,7 @@
   "Update and upgrade all system packages": "Actualizar y actualizar todos los paquetes del sistema.",
   "Update and upgrade system": "Actualizar el sistema",
   "Update cancelled by user": "Actualización cancelada por el usuario",
-  "Update completed. Data kept.": "Actualización completada. Datos guardados.",
+  "Update completed. Data kept.": "Actualización completada. Datos conservados.",
   "Update completed. Press Enter to continue...": "Actualización completada. Presione Entrar para continuar...",
   "Update every container of the application": "Actualizar cada contenedor de la aplicación",
   "Update kernel to compatible version": "Actualizar el kernel a una versión compatible",
@@ -6529,7 +6534,7 @@
   "Updates file is empty or unreadable.": "El archivo de actualizaciones está vacío o es ilegible.",
   "Updating": "Actualización",
   "Updating APT package lists...": "Actualizando listas de paquetes APT...",
-  "Updating Debian Bookworm → Trixie in sources.list...": "Actualizando Debian Bookworm → Trixie en fuentes.list...",
+  "Updating Debian Bookworm → Trixie in sources.list...": "Actualizando Debian Bookworm → Trixie en sources.list...",
   "Updating Figurine binary...": "Actualizando el binario de Figurine...",
   "Updating Lynis to the latest version...": "Actualizando Lynis a la última versión...",
   "Updating PVE application manager...": "Actualizando el administrador de aplicaciones PVE...",
@@ -6566,7 +6571,7 @@
   "Use Custom backup and uncheck the conflicting path from the list": "use una copia de seguridad personalizada y desmarque la ruta conflictiva de la lista",
   "Use Default Settings?": "¿Usar configuración predeterminada?",
   "Use Download first if you want to save a copy of the current key. Continue?": "use Descargar primero si desea guardar una copia de la clave actual.¿Continuar?",
-  "Use SPACE to select, ENTER to confirm": "Utilice ESPACIO para seleccionar, ENTRAR para confirmar",
+  "Use SPACE to select, ENTER to confirm": "Utilice ESPACIO para seleccionar, ENTER para confirmar",
   "Use SPACE to select/deselect, ENTER to confirm": "Utilice ESPACIO para seleccionar/deseleccionar, ENTER para confirmar",
   "Use SSH or terminal access (SSH recommended)": "Utilice SSH o acceso a terminal (se recomienda SSH)",
   "Use Spacebar to select.": "use la barra espaciadora para seleccionar.",
@@ -6623,7 +6628,7 @@
   "Using default Proxmox logo...": "Usando el logotipo predeterminado de Proxmox...",
   "Using existing encryption key:": "Usando la clave de cifrado existente:",
   "Using the image verified by the transaction": "Utilizando la imagen verificada por la transacción",
-  "Using the verified image from the cache": "Utilizando la imagen verificada del cache",
+  "Using the verified image from the cache": "Usando la imagen verificada de la caché",
   "Utilities": "Utilidades",
   "Utilities Installation Menu": "Menú de instalación de utilidades",
   "Utilities Menu": "Menú de utilidades",
@@ -6814,7 +6819,7 @@
   "Web interface to manage devices running Tasmota firmware.": "Interfaz web para gestionar dispositivos que ejecutan el firmware de Tasmota.",
   "WebCord can be summarized as a pack of security and privacy hardenings, Discord features reimplementations, Electron / Chromium / Discord bugs workarounds, stylesheets, internal pages and wrapped https://discord.com page, designed to conform with ToS as much as it is possible (or hide the changes that might violate it from Discord's eyes).": "WebCord se puede resumir como un paquete de endurecimientos de seguridad y privacidad, Discord características reimplementaciones, Electron / Chromium / Discord bugs workarounds, hojas de estilo, páginas internas y envueltas https://discord.com página, diseñado para conformarse con ToS tanto como sea posible (o ocultar los cambios que podrían violarlo de los ojos de Discord).",
   "Webgrabplus is a multi-site incremental xmltv epg grabber. It collects tv-program guide data from selected tvguide sites for your favourite channels.": "Webgrabplus es un multi-sitio incremental xmltv epg grabber. Recopila datos de guía de tv-program de sitios seleccionados de tvguide para sus canales favoritos.",
-  "Webservers & Proxies": "Servidores web y Proxies",
+  "Webservers & Proxies": "Servidores web y proxies",
   "Website": "Sitio web",
   "Webstation is a web native emulation focused LXQt desktop based on Ubuntu.": "Webstation es una emulación nativa web centrada en el escritorio LXQt basado en Ubuntu.",
   "Webtop - Alpine, Ubuntu, Fedora, and Arch based containers containing full desktop environments in officially supported flavors accessible via any modern web browser.": "Webtop - Contenedores alpinos, Ubuntu, Fedora y Arch que contienen entornos completos de escritorio en sabores oficialmente compatibles accesibles a través de cualquier navegador web moderno.",
@@ -6847,7 +6852,7 @@
   "WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many different circumstances. Initially released for the Linux kernel, it is now cross-platform (Windows, macOS, BSD, iOS, Android) and widely deployable. It is currently under heavy development, but already it might be regarded as the most secure, easiest to use, and simplest VPN solution in the industry.": "WireGuard® es un VPN extremadamente sencillo pero rápido y moderno que utiliza la criptografía de última generación. Su objetivo es ser más rápido, más simple, más inclinado y más útil que IPsec, evitando al mismo tiempo el dolor de cabeza masivo. Tiene la intención de ser considerablemente más performante que OpenVPN. WireGuard está diseñado como una VPN de propósito general para ejecutar en interfaces incrustadas y super ordenadores por igual, encajan para muchas circunstancias diferentes. Inicialmente lanzado para el kernel de Linux, ahora es multiplataforma (Windows, macOS, BSD, iOS, Android) y ampliamente implementable. Actualmente está en desarrollo pesado, pero ya podría considerarse como la solución VPN más segura, fácil de usar y más simple de la industria.",
   "Wired NICs in backup missing on target:": "Faltan NIC cableadas en la copia de seguridad en el objetivo:",
   "Wireshark is the world’s foremost and widely-used network protocol analyzer. It lets you see what’s happening on your network at a microscopic level and is the de facto (and often de jure) standard across many commercial and non-profit enterprises, government agencies, and educational institutions. Wireshark development thrives thanks to the volunteer contributions of networking experts around the globe and is the continuation of a project started by Gerald Combs in 1998.": "Wireshark es el analizador de protocolo de red más importante y ampliamente utilizado del mundo. Le permite ver lo que está sucediendo en su red a nivel microscópico y es el estándar de facto (y a menudo de jure) en muchas empresas comerciales y sin fines de lucro, agencias gubernamentales e instituciones educativas. El desarrollo de Wireshark prospera gracias a las contribuciones voluntarias de expertos en redes en todo el mundo y es la continuación de un proyecto iniciado por Gerald Combs en 1998.",
-  "With dns validation, the DNSPLUGIN variable names the provider plugin. The advanced installation asks for it; otherwise add the line lxc.environment.runtime: DNSPLUGIN=<plugin> to /etc/pve/lxc/<CTID>.conf with the container stopped.": "Con dns validation, la variable DNSPLUGIN nombra el plugin del proveedor. La instalación avanzada lo pide; de lo contrario, agregue la línea lxc.environment. tiempo de ejecución: DNSPLUGIN= obedeciópluginilo a /etc/pve/lxc/ se hizo referencia aCTID ratio.conf con el contenedor detenido.",
+  "With dns validation, the DNSPLUGIN variable names the provider plugin. The advanced installation asks for it; otherwise add the line lxc.environment.runtime: DNSPLUGIN=<plugin> to /etc/pve/lxc/<CTID>.conf with the container stopped.": "Con dns validation, la variable DNSPLUGIN nombra el plugin del proveedor. La instalación avanzada lo pide; de lo contrario, añadir la línea lxc.environment.runtime: DNSPLUGIN=<plugin> a /etc/pve/lxc/<CTID>.conf con el contenedor detenido.",
   "With dns validation, write the provider credentials in /config/dns-conf/<plugin>.ini inside the container and restart it.": "Con la validación dns, escriba el proveedor credentials en /config/dns-conf/iereplugin Principe.ini dentro del contenedor y reiniciarlo.",
   "With http validation, port 80 of the router must be forwarded to port 80 of this container.": "Con validación http, el puerto 80 del router debe ser enviado al puerto 80 de este contenedor.",
   "With warnings": "Con advertencias",
@@ -7313,7 +7318,7 @@
   "skipped (already exist)": "omitido (ya existe)",
   "smbclient command is not working properly.": "El comando smbclient no funciona correctamente.",
   "smbclient command not found after installation.": "El comando smbclient no se encuentra después de la instalación.",
-  "sources.list update skipped (no change)": "Actualización de fuentes.list omitida (sin cambios)",
+  "sources.list update skipped (no change)": "Actualización de sources.list omitida (sin cambios)",
   "sources.list updated to Trixie": "fuentes.lista actualizada a Trixie",
   "ssh-keygen failed. Cannot create a new SSH key.": "ssh-keygen falló. No se puede crear una nueva clave SSH.",
   "stale entry/entries for interfaces no longer present": "entrada obsoleta/entradas para interfaces que ya no están presentes",
@@ -7333,7 +7338,7 @@
   "switch_gpu_mode.sh was not found.": "No se encontró switch_gpu_mode.sh.",
   "sysfs ROM dump failed — trying ACPI VFCT table...": "Error en el volcado de ROM de sysfs: al intentar la tabla ACPI VFCT...",
   "syslog-ng allows you to flexibly collect, parse, classify, rewrite and correlate logs from across your infrastructure and store or route them to log analysis tools.": "syslog-ng le permite recoger flexiblemente, parse, clasificar, reescribir y correlacionar los registros de toda su infraestructura y almacenar o encaminarlos a herramientas de análisis de registros.",
-  "systemctl restart networking failed:": "El reinicio de red systemctl falló:",
+  "systemctl restart networking failed:": "systemctl restart networking falló:",
   "systemd OnCalendar expression": "expresión systemd OnCalendar",
   "the API key was not generated on the first start": "la clave de API no se generó en el primer comienzo",
   "the container has its own address, so the port Docker published on the host is not needed": "el contenedor tiene su propia dirección, por lo que el puerto Docker publicado en el host no es necesario",
@@ -7424,5 +7429,43 @@
   "⚠ Disk data will NOT be erased.": "⚠ Los datos del disco NO se borrarán.",
   "⚠ Disk will be unmounted and removed from /etc/fstab.": "⚠ El disco se desmontará y se eliminará de /etc/fstab.",
   "⚠ The /etc/fstab entry will be removed.": "⚠ Se eliminará la entrada /etc/fstab.",
-  "⚠ The disk will be unmounted.": "⚠ El disco se desmontará."
+  "⚠ The disk will be unmounted.": "⚠ El disco se desmontará.",
+  "Review external OCI changes": "Revisar cambios externos de OCI",
+  "These Proxmox resources were added outside ProxMenux:": "Se añadieron estos recursos en Proxmox fuera de ProxMenux:",
+  "They will be added to oci-compose before continuing. Unsupported or changed resources are not imported.": "Se añadirán al oci-compose antes de continuar. No se importarán recursos incompatibles o modificados.",
+  "Include these resources in oci-compose?": "¿Incorporar estos recursos al oci-compose?",
+  "Only an installed standalone OCI instance can adopt external changes": "Solo una instancia OCI independiente e instalada puede incorporar cambios externos",
+  "The container identity changed; nothing was adopted": "Ha cambiado la identidad del contenedor; no se ha incorporado nada",
+  "These manual changes cannot be adopted safely:": "Estos cambios manuales no se pueden incorporar con seguridad:",
+  "The added disk needs a whole-GiB size recorded by Proxmox": "El disco añadido necesita un tamaño en GiB enteros registrado por Proxmox",
+  "The added disk size is not a whole GiB": "El tamaño del disco añadido no equivale a un GiB entero",
+  "Incomplete mount configuration": "Configuración incompleta del punto de montaje",
+  "Unsupported mount options": "Opciones de montaje no admitidas",
+  "Invalid read-only option": "Opción de solo lectura no válida",
+  "Host directories cannot be included in vzdump": "Los directorios del host no pueden incluirse en vzdump",
+  "Only backed-up Proxmox volumes can be adopted": "Solo se pueden incorporar volúmenes de Proxmox incluidos en las copias de seguridad",
+  "Invalid Proxmox volume ID": "Identificador de volumen de Proxmox no válido",
+  "The disk does not belong to this CT; automatic adoption is unsafe": "El disco no pertenece a este CT; incorporarlo automáticamente no es seguro",
+  "Incomplete device configuration": "Configuración incompleta del dispositivo",
+  "Unsupported device options": "Opciones de dispositivo no admitidas",
+  "Only Intel/AMD DRM, Coral and USB nodes can be adopted automatically": "Solo se pueden incorporar automáticamente dispositivos DRM Intel/AMD, Coral y USB",
+  "Device GID does not match the host": "El GID del dispositivo no coincide con el del host",
+  "Invalid device permissions": "Permisos del dispositivo no válidos",
+  "Invalid device UID": "UID del dispositivo no válido",
+  "The OCI contract changed while reviewing; nothing was adopted": "El contrato OCI cambió durante la revisión; no se ha incorporado nada",
+  "The LXC changed while reviewing; nothing was adopted": "El LXC cambió durante la revisión; no se ha incorporado nada",
+  "The proposed changes no longer match; nothing was adopted": "Los cambios propuestos ya no coinciden; no se ha incorporado nada",
+  "The LXC changed during verification; nothing was adopted": "El LXC cambió durante la verificación; no se ha incorporado nada",
+  "A multi-container application is not recreated: its containers are updated together.": "Una aplicación multicontenedor no se recrea: sus contenedores se actualizan juntos.",
+  "A scheduled run cannot answer:": "Una ejecución programada no puede responder:",
+  "Only the update of the image runs unattended.": "Solo la actualización de la imagen se ejecuta de forma desatendida.",
+  "This container is not a registered OCI instance.": "Este contenedor no es una instancia OCI registrada.",
+  "The new image is more recent than the minimum age set for scheduled updates; it is not installed yet.": "La imagen nueva es más reciente que la antigüedad mínima fijada para las actualizaciones programadas; todavía no se instala.",
+  "Invalid storage name": "Nombre de almacenamiento no válido",
+  "Backup kept in": "Backup conservado en",
+  "Creating a backup in": "Creando un backup en",
+  "Backup created in": "Backup creado en",
+  "The backup storage does not exist:": "El almacenamiento de backups no existe:",
+  "The storage does not accept backups:": "El almacenamiento no admite backups:",
+  "Invalid action": "Acción no válida"
 }
diff --git a/lang/fr.json b/lang/fr.json
index 3bdf90f9..b3b7c1c6 100644
--- a/lang/fr.json
+++ b/lang/fr.json
@@ -120,11 +120,11 @@
   "ACL Status:": "Statut de la liste de contrôle d'accès :",
   "ACL permissions applied for local access for user:": "Autorisations ACL appliquées pour l'accès local pour l'utilisateur :",
   "ADVANCED SETTINGS COMPLETE": "PARAMÈTRES AVANCÉS TERMINÉS",
-  "AI / Coding & Dev-Tools": "AI / Codage & Outils Dev",
+  "AI / Coding & Dev-Tools": "IA, programmation et développement",
   "ALL DATA ON": "TOUTES LES DONNÉES SUR",
   "ALL DATA ON THIS DISK WILL BE PERMANENTLY LOST!": "TOUTES LES DONNÉES SUR CE DISQUE SERONT PERMANENTES DÉFINITIVEMENT !",
   "ALL Utilities": "TOUS les utilitaires",
-  "ALLOWED_HOSTS cannot contain line breaks": "ALLOWED HOSTS ne peut pas contenir les ruptures de ligne",
+  "ALLOWED_HOSTS cannot contain line breaks": "ALLOWED_HOSTS ne peut pas contenir les ruptures de ligne",
   "AList initial login": "Connexion initiale AList",
   "AMD CPU detected": "Processeur AMD détecté",
   "AMD CPU fixes applied successfully": "Correctifs du processeur AMD appliqués avec succès",
@@ -185,7 +185,7 @@
   "Actual device path on the host": "Chemin réel du périphérique sur l'hôte",
   "Adaptation file too large": "Dossier d'adaptation trop grand",
   "Adaptation file with unexpected permissions or owner": "Fichier d'adaptation avec permissions inattendues ou propriétaire",
-  "Adblock & DNS": "Adblock & DNS",
+  "Adblock & DNS": "Adblock et DNS",
   "Add Audio Passthrough": "Ajouter un relais audio",
   "Add CIFS storage:": "Ajoutez un stockage CIFS :",
   "Add Controller or NVMe (PCI passthrough)": "Ajouter un contrôleur ou NVMe (passthrough PCI)",
@@ -463,7 +463,7 @@
   "Automatic private network allocation requires a /24 subnet": "Allocation de réseau privé automatique requires un sous-réseau /24",
   "Automatic video library manager for TV Shows": "Gestionnaire automatique de bibliothèque vidéo pour TV Shows",
   "Automatic/Unattended": "Automatique/sans surveillance",
-  "Automation & Scheduling": "Automatisation et calendrier",
+  "Automation & Scheduling": "Automatisation et planification",
   "Available": "Disponible",
   "Available Borg archives (newest first):": "Archives Borg disponibles (les plus récentes en premier) :",
   "Available Borg targets:": "Cibles Borg disponibles :",
@@ -500,7 +500,7 @@
   "Backend:": "Back-end :",
   "Background archive extraction for Arr download queues. No web interface.": "Extraction des archives de fond pour les files de téléchargement Arr. Pas d'interface web.",
   "Backup            — VM and CT backups": "Sauvegarde – Sauvegardes VM et CT",
-  "Backup & Recovery": "Sauvegarde et récupération",
+  "Backup & Recovery": "Sauvegarde et restauration",
   "Backup Created": "Sauvegarde créée",
   "Backup ID (group name in PBS):": "ID de sauvegarde (nom du groupe dans PBS) :",
   "Backup ID for this job:": "ID de sauvegarde pour ce travail :",
@@ -603,11 +603,11 @@
   "Broken gasket-dkms package state recovered.": "L'état défectueux du paquet gasket-dkms a été réparé.",
   "Browse Your Life in Images": "Parcourez votre vie en images",
   "Browse manually (advanced)...": "Parcourir manuellement (avancé)...",
-  "Browsers & Web Desktops": "Navigateurs et bureaux Web",
+  "Browsers & Web Desktops": "Navigateurs et bureaux web",
   "Build and install the gasket and apex kernel modules (DKMS)": "Compiler et installer les modules noyau gasket et apex (DKMS)",
   "Build dependencies installed.": "Dépendances de build installées.",
   "Build your personal knowledge base with TriliumNext Notes": "Construisez votre base de connaissances personnelles avec TriliumNext Notes",
-  "Business & ERP": "Affaires & ERP",
+  "Business & ERP": "Entreprise et ERP",
   "CHANGES APPLIED SUCCESSFULLY": "MODIFICATIONS APPLIQUÉES AVEC SUCCÈS",
   "CIFS Client Tools: AVAILABLE": "Outils clients CIFS : DISPONIBLES",
   "CIFS Client Tools: NOT AVAILABLE - installing...": "Outils client CIFS : NON DISPONIBLE - installation...",
@@ -869,7 +869,7 @@
   "Commenting legacy ceph.list (if present)...": "Commentaire de l'héritage ceph.list (si présent)...",
   "Common Issues Check": "Vérification des problèmes courants",
   "Common root for the published views": "Source commune des vues publiées",
-  "Communication & Community": "Communication & Communauté",
+  "Communication & Community": "Communication et communauté",
   "Community Scripts": "Scripts communautaires",
   "Community single-container Home Assistant OS image": "Image OS communautaire monoconteneur Home Assistant",
   "Compatibility check": "Vérification de compatibilité",
@@ -1041,7 +1041,7 @@
   "Consider security implications for production environments": "Tenir compte des implications en matière de sécurité pour les environnements de production",
   "Consider visiting the repository and supporting the project.": "pensez à visiter le référentiel et à soutenir le projet.",
   "Console log:": "Registre de la console & #160;:",
-  "Container": "Récipient",
+  "Container": "Conteneur",
   "Container         — LXC root directories": "Conteneur — Répertoires racine LXC",
   "Container ID": "ID du conteneur",
   "Container ID not defined. Make sure to select a container first.": "ID de conteneur non défini. Assurez-vous de sélectionner d'abord un conteneur.",
@@ -1083,8 +1083,8 @@
   "Container volume (included in backups)": "Volume des conteneurs (inclus dans les sauvegardes)",
   "Container will pick up the mount on next start": "Le conteneur récupérera la monture au prochain démarrage",
   "Container with ID": "Conteneur avec ID",
-  "Container:": "Récipient:",
-  "Containers & Docker": "Conteneurs & Docker",
+  "Container:": "Conteneur :",
+  "Containers & Docker": "Conteneurs et Docker",
   "Containers returned to their previous state": "Conteneurs retournés à leur état précédent",
   "Containers that are removed:": "Conteneurs enlevés:",
   "Containers that will be created (one LXC per service, on a private network):": "Conteneurs qui seront créés (un LXC par service, sur un réseau privé):",
@@ -1157,7 +1157,7 @@
   "Coral M.2 Apex configuration added - device ready": "Configuration Coral M.2 Apex ajoutée - appareil prêt",
   "Coral M.2 Apex configuration added - device will be available after reboot": "Configuration Coral M.2 Apex ajoutée - l'appareil sera disponible après le redémarrage",
   "Coral M.2 Apex detected, configuring...": "Coral M.2 Apex détecté, configuration...",
-  "Coral PCIe/M.2 node (e.g. /dev/apex_0)": "Coral PCIe/M.2 noeud (par exemple /dev/apex 0)",
+  "Coral PCIe/M.2 node (e.g. /dev/apex_0)": "Coral PCIe/M.2 noeud (par exemple /dev/apex_0)",
   "Coral TPU Installation": "Installation du TPU Coral",
   "Coral TPU Uninstall": "Désinstallation de Coral TPU",
   "Coral TPU device nodes detected with correct group (apex).": "Nœuds de périphérique Coral TPU détectés avec le groupe correct (apex).",
@@ -1345,7 +1345,7 @@
   "Creating the container...": "Créer le conteneur...",
   "Creating the initial administrator...": "Création de l'administrateur initial...",
   "Creating the temporary data container": "Création du conteneur temporaire de données",
-  "Creative & Design": "Création & Design",
+  "Creative & Design": "Création et design",
   "Credentials are correct": "Les informations d'identification sont correctes",
   "Credentials cleared. jwt_secret and API tokens preserved.": "Informations d'identification effacées. Jwt_secret et jetons API préservés.",
   "Credentials file created securely.": "Fichier d’informations d’identification créé en toute sécurité.",
@@ -2230,7 +2230,7 @@
   "FileBrowser Quantum": "FileBrowser Quantum",
   "FileBrowser Quantum (new installation)": "FileBrowser Quantum (nouvelle installation)",
   "FileDrop is a free, open source file sharing service": "FileDrop est un service gratuit de partage de fichiers open source",
-  "Files & Downloads": "Fichiers & téléchargements",
+  "Files & Downloads": "Fichiers et téléchargements",
   "Files volume size in GB": "Taille du volume des fichiers en GB",
   "Filesystem": "Système de fichiers",
   "Filesystem Tools Required": "Outils de système de fichiers requis",
@@ -2239,7 +2239,7 @@
   "Final cleanup of the stack operation completed": "Nettoyage final de la pile operation terminée",
   "Final confirmation": "Confirmation finale",
   "Final storage health/status check": "Vérification finale de l’état/de l’état du stockage",
-  "Finance & Budgeting": "Finances & Budgeting",
+  "Finance & Budgeting": "Finances et budget",
   "Find your device using https://finds.synology.com": "Trouvez votre appareil en utilisant https://finds.synology.com",
   "Fingerprint:": "Empreinte digitale :",
   "Firefly, the easiest using of WireGuard VPN server, plus version of wg-easy.": "Firefly, la plus simple utilisation du serveur VPN WireGuard, plus la version de wg-easy.",
@@ -2386,7 +2386,7 @@
   "GRUB_CMDLINE_LINUX_DEFAULT not found in GRUB config": "GRUB_CMDLINE_LINUX_DEFAULT introuvable dans la configuration GRUB",
   "GUI mode (if available)": "Mode GUI (si disponible)",
   "GZDoom is a feature centric port for all Doom engine games, based on ZDoom, adding an OpenGL renderer and powerful scripting capabilities.": "GZDoom est un port centré pour tous les jeux de moteurs Doom, basé sur ZDoom, ajoutant un rendu OpenGL et de puissantes capacités de script.",
-  "Gaming & Leisure": "Jeu & Leisure",
+  "Gaming & Leisure": "Jeux et loisirs",
   "Gateway is not installed.": "La passerelle n'est pas installée.",
   "Gateway removed.": "Passerelle supprimée.",
   "Gateway restarted.": "La passerelle a redémarré.",
@@ -2540,7 +2540,7 @@
   "Host already in VFIO mode — skipping host reconfiguration for VM reassignment": "Hôte déjà en mode VFIO : ignorer la reconfiguration de l'hôte pour la réaffectation de la VM",
   "Host audio devices": "Appareils audio d'accueil",
   "Host backup attached to PVE job": "Sauvegarde de l'hôte attachée au travail PVE",
-  "Host data is not restored by the backup; confirm it with --acknowledge-external-data": "Les données de l'hôte ne sont pas restaurées par la sauvegarde; confirmez-le avec --acknow-external-data",
+  "Host data is not restored by the backup; confirm it with --acknowledge-external-data": "Les données de l'hôte ne sont pas restaurées par la sauvegarde; confirmez-le avec --acknowledge-external-data",
   "Host device for /dev/kvm": "Appareil d'accueil pour /dev/kvm",
   "Host device for /dev/net/tun": "Appareil hôte pour /dev/net/tun",
   "Host device for /dev/ttyUSB0": "Appareil hôte pour /dev/ttyUSB0",
@@ -2793,7 +2793,7 @@
   "Initiator IQN is authorised on the target": "L'IQN initiateur est autorisé sur la cible",
   "Initiator IQN:": "IQN initiateur :",
   "Inkscape is professional quality vector graphics software which runs on Linux, Mac OS X and Windows desktop computers.": "Inkscape est un logiciel graphique vectoriel de qualité professionnelle qui fonctionne sur les ordinateurs de bureau Linux, Mac OS X et Windows.",
-  "Inside the LXC, create the administrator: console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN": "À l'intérieur du LXC, créez l'administrateur: console kimai:utilisateur:créez VOTRE USERNAME VOTRE ROLE SUPER ADMIN",
+  "Inside the LXC, create the administrator: console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN": "À l'intérieur du LXC, créez l'administrateur: console kimai:utilisateur:créez VOTRE USERNAME VOTRE ROLE_SUPER_ADMIN",
   "Inspect disks before any action": "Inspecter les disques avant toute action",
   "Inspect host device nodes": "Inspecter les nœuds du périphérique hôte",
   "Inspect passthrough/kernel events": "Inspecter les événements de relais/noyau",
@@ -3085,7 +3085,7 @@
   "Invalid volume size": "Volume non valide",
   "Invalid volume size:": "Volume non valide:",
   "Invalid volume target": "Cible de volume non valable",
-  "IoT & Smart Home": "IoT et maison intelligente",
+  "IoT & Smart Home": "IoT et maison connectée",
   "Is the value a password or secret?": "La valeur est-elle un mot de passe ou un secret ?",
   "Issue": "Problème",
   "Issues found": "Problèmes trouvés",
@@ -3384,7 +3384,7 @@
   "Max user watches configured": "Nombre maximum de montres utilisateur configurées",
   "Maximum auto-repair attempts reached (3). Please review the log and run any remaining commands manually.": "Nombre maximal de tentatives de réparation automatique atteint (3). Veuillez consulter le journal et exécuter manuellement les commandes restantes.",
   "May need to restart terminal": "Il faudra peut-être redémarrer le terminal",
-  "Media & Streaming": "Médias & Streaming",
+  "Media & Streaming": "Médias et streaming",
   "Media discovery and request management for Jellyfin, Plex and Emby.": "Découverte des médias et gestion des demandes pour Jellyfin, Plex et Emby.",
   "Media library transcoding and health checking, with an internal worker node.": "Transcodage de la médiathèque et contrôle de la santé, avec un noeud de travail interne.",
   "Media server": "Serveur multimédia",
@@ -3649,7 +3649,7 @@
   "NVMe health status: WARNING (critical_warning =": "État de santé NVMe : AVERTISSEMENT (critical_warning =",
   "NVMe skipped (to add as PCIe use 'Add Controller or NVMe PCIe to VM'):": "NVMe ignoré (pour ajouter en tant que PCIe, utilisez « Ajouter un contrôleur ou NVMe PCIe à la VM ») :",
   "NVMe-specific SMART log": "Journal SMART spécifique à NVMe",
-  "NVR & Cameras": "NVR & Caméras",
+  "NVR & Cameras": "NVR et caméras",
   "NVR with optional VA-API video acceleration and hardware object detectors": "NVR avec accélération vidéo VA-API en option et détecteurs d'objets matériels",
   "NZBGet web interface": "Interface web NZBGet",
   "Name": "Dénomination",
@@ -3661,7 +3661,7 @@
   "Name of this wallabag instance, shown in the interface and in 2FA codes": "Nom de cette instance wallabag, affichée dans l'interface et dans les codes 2FA",
   "Name or part of the description of the application": "Nom ou partie de la description de la demande",
   "Name:": "Nom:",
-  "Named accounts need private mode. Stop the container, set public: false in /config/config.js, start it again and create each user with: pct exec <CTID> -- env THELOUNGE_HOME=/config s6-setuidgid abc thelounge add <user>": "Les comptes nommés nécessitent un mode privé. Arrêter le conteneur, définir public: false in /config/config.js, recommencer et créer chaque utilisateur avec: pct exec <CTID> -- env THELOUNGE HOME=/config s6-setuidgid abc thelounge ajouter <user>",
+  "Named accounts need private mode. Stop the container, set public: false in /config/config.js, start it again and create each user with: pct exec <CTID> -- env THELOUNGE_HOME=/config s6-setuidgid abc thelounge add <user>": "Les comptes nommés nécessitent un mode privé. Arrêter le conteneur, définir public: false in /config/config.js, recommencer et créer chaque utilisateur avec: pct exec <CTID> -- env THELOUNGE_HOME=/config s6-setuidgid abc thelounge ajouter <user>",
   "Neither /etc/kernel/cmdline nor /etc/default/grub found.": "Ni /etc/kernel/cmdline ni /etc/default/grub n'ont été trouvés.",
   "Nesting feature enabled": "Fonction d'imbrication activée",
   "NetBIOS Service: RUNNING": "Service NetBIOS : EN EXÉCUTION",
@@ -3671,7 +3671,7 @@
   "Netbox is an IP address management (IPAM) and data center infrastructure management (DCIM) tool. Initially conceived by the network engineering team at DigitalOcean, NetBox was developed specifically to address the needs of network and infrastructure engineers. It is intended to function as a domain-specific source of truth for network operations.": "Netbox est un outil de gestion des adresses IP (IPAM) et de gestion de l'infrastructure des centres de données (DCIM). Initialement conçu par l'équipe d'ingénierie du réseau de DigitalOcean, NetBox a été développé spécifiquement pour répondre aux besoins des ingénieurs du réseau et de l'infrastructure. Il est destiné à fonctionner comme une source de vérité spécifique au domaine pour le réseau operations.",
   "Network": "Réseau",
   "Network  :": "Réseau  :",
-  "Network & Firewall": "Réseau & Pare-feu",
+  "Network & Firewall": "Réseau et pare-feu",
   "Network (interfaces, DNS)": "Réseau (interfaces, DNS)",
   "Network Bridge": "Pont réseau",
   "Network Commands": "Commandes réseau",
@@ -4371,7 +4371,7 @@
   "Postfix configuration": "Configuration de Postfix",
   "PostgreSQL": "PostgreSQL",
   "PostgreSQL URL without an associated service:": "URL PostgreSQL sans service associé:",
-  "PostgreSQL creates the database named in POSTGRES_DB on the first start. The installer default is postgresql.": "PostgreSQL crée la base de données nommée dans POSTGRES DB au premier démarrage. Par défaut, l'installation est postgresql.",
+  "PostgreSQL creates the database named in POSTGRES_DB on the first start. The installer default is postgresql.": "PostgreSQL crée la base de données nommée dans POSTGRES_DB au premier démarrage. Par défaut, l'installation est postgresql.",
   "PostgreSQL is an advanced, enterprise-class, and open-source relational database system. PostgreSQL supports both SQL (relational) and JSON (non-relational) querying.": "PostgreSQL est un système de base de données relationnelles avancé, de classe entreprise et open-source. PostgreSQL prend en charge les requêtes SQL (relational) et JSON (non-relational).",
   "PostgreSQL requires a password": "PostgreSQL requires un mot de passe",
   "PostgreSQL volume size in GB": "Taille du volume PostgreSQL en GB",
@@ -4534,7 +4534,7 @@
   "Pwndrop is a self-deployable file hosting service for sending out red teaming payloads or securely sharing your private files over HTTP and WebDAV.": "Pwndrop est un service d'hébergement de fichiers autodéployable pour envoyer des équipes rouges ou partager vos fichiers privés en toute sécurité via HTTP et WebDAV.",
   "PyCharm offers out-of-the-box support for Python, databases, Jupyter, Git, Conda, PyTorch, TensorFlow, Hugging Face, Django, Flask, FastAPI, and more.": "PyCharm offre une prise en charge hors de la boîte pour Python, bases de données, Jupyter, Git, Conde, PyTorch, TensorFlow, Hugging Face, Django, Flask, FastAPI, et plus encore.",
   "Pydio Cells needs an external MySQL or MariaDB database. The setup wizard asks for its address, database name and user on the first start.": "Pydio Cells a besoin d'une base de données externe MySQL ou MariaDB. L'assistant de configuration demande son adresse, son nom de base de données et son utilisateur au premier démarrage.",
-  "Pydio Cells redirects to the address given in EXTERNALURL. If the container changes address, edit lxc.environment.runtime: EXTERNALURL and SERVER_IP in /etc/pve/lxc/<CTID>.conf with the container stopped, and delete /config/keys/cert.crt to regenerate the certificate.": "Pydio Cells redirige vers l'adresse indiquée dans EXTERNALURL. Si le conteneur change d'adresse, éditer lxc.environment.runtime: EXTERNALURL et SERVER IP dans /etc/pve/lxc/<CTID>.conf avec le conteneur arrêté, et supprimer /config/keys/cert.crt pour régénérer le certificat.",
+  "Pydio Cells redirects to the address given in EXTERNALURL. If the container changes address, edit lxc.environment.runtime: EXTERNALURL and SERVER_IP in /etc/pve/lxc/<CTID>.conf with the container stopped, and delete /config/keys/cert.crt to regenerate the certificate.": "Pydio Cells redirige vers l'adresse indiquée dans EXTERNALURL. Si le conteneur change d'adresse, éditer lxc.environment.runtime: EXTERNALURL et SERVER_IP dans /etc/pve/lxc/<CTID>.conf avec le conteneur arrêté, et supprimer /config/keys/cert.crt pour régénérer le certificat.",
   "Pydio-cells is the nextgen file sharing platform for organizations. It is a full rewrite of the Pydio project using the Go language following a micro-service architecture.": "Pydio-cells est la plateforme de partage de fichiers nextgen pour les organisations. C'est une réécriture complète du projet Pydio en utilisant le langage Go suivant une architecture de micro-service.",
   "QDirStat Qt-based directory statistics: KDirStat without any KDE -- from the author of the original KDirStat.": "QDirStat Statistiques de répertoire basées sur Qt: KDirStat sans KDE -- de l'auteur de l'original KDirStat.",
   "Quick health check (PASSED / FAILED)": "Bilan de santé rapide (RÉUSSI / ÉCHEC)",
@@ -5711,7 +5711,6 @@
   "Thank you for using ProxMenux. Goodbye!": "Merci d'utiliser ProxMenux. Au revoir!",
   "That VM is currently stopped, so the GPU can be reassigned now.": "Cette VM est actuellement arrêtée, le GPU peut donc être réaffecté maintenant.",
   "That doesn't look like an SSH private key. Pick the private key file (no .pub extension, parseable by ssh-keygen).": "Cela ne ressemble pas à une clé privée SSH.Choisissez le fichier de clé privée (pas d'extension .pub, analysable par ssh-keygen).",
-  "The .conf files under /config/fail2ban are rewritten on every start. Keep customizations in the matching .local file, for example jail.local for jail.conf.": "Les fichiers .conf sous /config/fail2ban sont réécrits à chaque démarrage. Gardez les personnalisations dans le fichier .local correspondant, par exemple prison.local pour prison.conf.",
   "The AppArmor/seccomp relaxation does not include the required consent": "L'AppArmor/seccomp relaxation ne comprend pas le consentement required",
   "The Bookmark Everything App": "L'application Tout Signet",
   "The Brave browser is a fast, private and secure web browser for PC, Mac and mobile.": "Le navigateur Brave est un navigateur Web rapide, privé et sécurisé pour PC, Mac et mobile.",
@@ -5947,7 +5946,7 @@
   "The imported Compose requests privileged, but the official jlesage/handbrake documentation does not require it; ProxMenux keeps the LXC unprivileged.": "Le Compose importé demande privilégié, mais la documentation officielle de jlesage/handbrake ne require; ProxMenux maintient le LXC non privilégié.",
   "The imported OCI groups are not numeric": "Les groupes OCI importés ne sont pas numériques",
   "The imported OCI user or group is not numeric": "L'utilisateur ou le groupe de OCI importé n'est pas numérique",
-  "The initial user name and password stay written in /etc/pve/lxc/<CTID>.conf as INIT_USERNAME and INIT_PASSWORD. They can be removed after the first login, with the container stopped.": "Le nom d'utilisateur initial et le mot de passe restent écrits dans /etc/pve/lxc/<CTID>.conf comme INIT USERNAME et INIT PASSWORD. Ils peuvent être enlevés après la première connexion, le conteneur étant arrêté.",
+  "The initial user name and password stay written in /etc/pve/lxc/<CTID>.conf as INIT_USERNAME and INIT_PASSWORD. They can be removed after the first login, with the container stopped.": "Le nom d'utilisateur initial et le mot de passe restent écrits dans /etc/pve/lxc/<CTID>.conf comme INIT_USERNAME et INIT_PASSWORD. Ils peuvent être enlevés après la première connexion, le conteneur étant arrêté.",
   "The installation asks which one to use for these paths.": "L'installation demande lequel utiliser pour ces chemins.",
   "The installation ended with exit code": "L'installation s'est terminée avec le code de sortie",
   "The installation requires a server restart to apply changes. Do you want to restart now?": "L'installation nécessite un redémarrage du serveur pour appliquer les modifications. Voulez-vous redémarrer maintenant ?",
@@ -6066,7 +6065,7 @@
   "The rootfs is not managed by Proxmox": "Les roofs ne sont pas gérés par Proxmox",
   "The rootfs is not mounted": "Les roofs ne sont pas montés",
   "The same GPU cannot be used by two VMs at the same time.": "Le même GPU ne peut pas être utilisé par deux VM en même temps.",
-  "The same connection can be given as container variables instead of the file: UN_SONARR_0_URL and UN_SONARR_0_API_KEY, or the UN_RADARR_0_ equivalents.": "La même connexion peut être donnée comme variable de conteneur au lieu du fichier : UN SONARR 0 URL et UN SONARR 0 API KEY, ou les UN RADARR 0  equivalents.",
+  "The same connection can be given as container variables instead of the file: UN_SONARR_0_URL and UN_SONARR_0_API_KEY, or the UN_RADARR_0_ equivalents.": "La même connexion peut être donnée comme variable de conteneur au lieu du fichier : UN_SONARR_0_URL et UN_SONARR_0_API_KEY, ou les UN RADARR 0  equivalents.",
   "The saved MOTD state is invalid; no changes were made": "l'état MOTD enregistré n'est pas valide ;aucun changement n'a été apporté",
   "The saved OCI record is incomplete or has an unexpected format.": "L'enregistrement OCI enregistré est incomplet ou a un format inattendu.",
   "The saved projection does not match the native evidence": "La projection enregistrée ne correspond pas à la preuve native",
@@ -6814,7 +6813,7 @@
   "Web interface to manage devices running Tasmota firmware.": "Interface Web pour gérer les appareils utilisant le firmware Tasmota.",
   "WebCord can be summarized as a pack of security and privacy hardenings, Discord features reimplementations, Electron / Chromium / Discord bugs workarounds, stylesheets, internal pages and wrapped https://discord.com page, designed to conform with ToS as much as it is possible (or hide the changes that might violate it from Discord's eyes).": "WebCord peut être résumé comme un paquet de durcissements de sécurité et de confidentialité, les fonctionnalités Discord réimplémentations, Electron / Chromium / Discord bugs workarounds, les feuilles de style, les pages internes et la page https://discord.com enveloppée, conçue pour se conformer à ToS autant qu'il est possible (ou cacher les changements qui pourraient la violer des yeux de Discord).",
   "Webgrabplus is a multi-site incremental xmltv epg grabber. It collects tv-program guide data from selected tvguide sites for your favourite channels.": "Webgrabplus est un accrocheur différentiel multisite xmltv egg. Il recueille les données du guide TV-programme à partir de sites sélectionnés pour vos chaînes préférées.",
-  "Webservers & Proxies": "Serveurs Web & Proxies",
+  "Webservers & Proxies": "Serveurs web et proxys",
   "Website": "Site web",
   "Webstation is a web native emulation focused LXQt desktop based on Ubuntu.": "Webstation est un ordinateur de bureau LXQt basé sur Ubuntu.",
   "Webtop - Alpine, Ubuntu, Fedora, and Arch based containers containing full desktop environments in officially supported flavors accessible via any modern web browser.": "Webtop - conteneurs basés sur Alpine, Ubuntu, Fedora et Arch contenant des environnements de bureau complets dans des saveurs officiellement pris en charge accessibles via n'importe quel navigateur Web moderne.",
@@ -6847,7 +6846,7 @@
   "WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many different circumstances. Initially released for the Linux kernel, it is now cross-platform (Windows, macOS, BSD, iOS, Android) and widely deployable. It is currently under heavy development, but already it might be regarded as the most secure, easiest to use, and simplest VPN solution in the industry.": "WireGuard® est un VPN extrêmement simple mais moderne qui utilise une cryptographie ultramoderne. Il vise à être plus rapide, plus simple, plus maigre et plus utile que IPsec, tout en évitant les maux de tête massifs. Il a l'intention d'être beaucoup plus performant que OpenVPN. WireGuard est conçu comme un VPN à usage général pour fonctionner sur des interfaces intégrées et des super ordinateurs, adaptés à de nombreuses circonstances différentes. Initialement sorti pour le noyau Linux, il est désormais multiplateforme (Windows, macOS, BSD, iOS, Android) et largement déployable. Il est actuellement en développement, mais il pourrait déjà être considéré comme la solution VPN la plus sûre, la plus facile à utiliser et la plus simple de l'industrie.",
   "Wired NICs in backup missing on target:": "Cartes réseau filaires dans la sauvegarde manquantes sur la cible :",
   "Wireshark is the world’s foremost and widely-used network protocol analyzer. It lets you see what’s happening on your network at a microscopic level and is the de facto (and often de jure) standard across many commercial and non-profit enterprises, government agencies, and educational institutions. Wireshark development thrives thanks to the volunteer contributions of networking experts around the globe and is the continuation of a project started by Gerald Combs in 1998.": "Wireshark est l'analyseur de protocole réseau le plus utilisé au monde. Il vous permet de voir ce qui se passe sur votre réseau au niveau microscopique et est la norme de facto (et souvent de jure) dans de nombreuses entreprises commerciales et sans but lucratif, agences gouvernementales et établissements d'enseignement. Le développement de Wireshark prospère grâce aux contributions volontaires d'experts en réseautage dans le monde entier et est la suite d'un projet lancé par Gerald Combs en 1998.",
-  "With dns validation, the DNSPLUGIN variable names the provider plugin. The advanced installation asks for it; otherwise add the line lxc.environment.runtime: DNSPLUGIN=<plugin> to /etc/pve/lxc/<CTID>.conf with the container stopped.": "Avec la validation dns, la variable DNSPLUGIN nomme le plugin fournisseur. L'installation avancée le demande; sinon ajouter la ligne lxc.environment. durée d'exécution: DNSPLUGIN=<plugin> à /etc/pve/lxc/<CTID>.conf avec le conteneur arrêté.",
+  "With dns validation, the DNSPLUGIN variable names the provider plugin. The advanced installation asks for it; otherwise add the line lxc.environment.runtime: DNSPLUGIN=<plugin> to /etc/pve/lxc/<CTID>.conf with the container stopped.": "Avec la validation dns, la variable DNSPLUGIN nomme le plugin fournisseur. L'installation avancée le demande; sinon, ajoutez la ligne lxc.environment.runtime: DNSPLUGIN=<plugin> à /etc/pve/lxc/<CTID>.conf avec le conteneur arrêté.",
   "With dns validation, write the provider credentials in /config/dns-conf/<plugin>.ini inside the container and restart it.": "Avec la validation dns, écrivez le fournisseur credentials dans /config/dns-conf/<plugin>.ini à l'intérieur du conteneur et redémarrez-le.",
   "With http validation, port 80 of the router must be forwarded to port 80 of this container.": "Avec la validation http, le port 80 du routeur doit être envoyé au port 80 de ce conteneur.",
   "With warnings": "Avec des avertissements",
diff --git a/lang/it.json b/lang/it.json
index 08735160..b343bb3a 100644
--- a/lang/it.json
+++ b/lang/it.json
@@ -120,11 +120,11 @@
   "ACL Status:": "Stato ACL:",
   "ACL permissions applied for local access for user:": "ACL permissions applied for local access for user:",
   "ADVANCED SETTINGS COMPLETE": "IMPOSTAZIONI AVANZATE COMPLETATE",
-  "AI / Coding & Dev-Tools": "AI/codifica e strumenti di sviluppo",
+  "AI / Coding & Dev-Tools": "IA, programmazione e sviluppo",
   "ALL DATA ON": "TUTTI I DATI SU",
   "ALL DATA ON THIS DISK WILL BE PERMANENTLY LOST!": "TUTTI I DATI SU QUESTO DISCO SARANNO PERDUTI PERMANENTEMENTE!",
   "ALL Utilities": "TUTTE le utenze",
-  "ALLOWED_HOSTS cannot contain line breaks": "ALLOWED HOSTS non può contenere interruzioni di linea",
+  "ALLOWED_HOSTS cannot contain line breaks": "ALLOWED_HOSTS non può contenere interruzioni di linea",
   "AList initial login": "login iniziale AList",
   "AMD CPU detected": "Rilevata CPU AMD",
   "AMD CPU fixes applied successfully": "Le correzioni della CPU AMD sono state applicate correttamente",
@@ -185,7 +185,7 @@
   "Actual device path on the host": "Percorso effettivo del dispositivo sull'host",
   "Adaptation file too large": "File di adattamento troppo grande",
   "Adaptation file with unexpected permissions or owner": "File di adattamento con autorizzazioni inaspettate o proprietario",
-  "Adblock & DNS": "Adblock & DNS",
+  "Adblock & DNS": "Adblock e DNS",
   "Add Audio Passthrough": "Aggiungi pass-through audio",
   "Add CIFS storage:": "Aggiungi spazio di archiviazione CIFS:",
   "Add Controller or NVMe (PCI passthrough)": "Aggiungi controller o NVMe (passthrough PCI)",
@@ -463,7 +463,7 @@
   "Automatic private network allocation requires a /24 subnet": "Distribuzione automatica della rete privata requires a /24 subnet",
   "Automatic video library manager for TV Shows": "Gestore automatico della libreria video per spettacoli televisivi",
   "Automatic/Unattended": "Automatico/non presidiato",
-  "Automation & Scheduling": "Automazione & Scheduling",
+  "Automation & Scheduling": "Automazione e pianificazione",
   "Available": "Disponibile",
   "Available Borg archives (newest first):": "Archivi Borg disponibili (prima il più recente):",
   "Available Borg targets:": "Obiettivi Borg disponibili:",
@@ -500,7 +500,7 @@
   "Backend:": "Backend:",
   "Background archive extraction for Arr download queues. No web interface.": "Estrazione archivio di sfondo per Arr file di download. Nessuna interfaccia web.",
   "Backup            — VM and CT backups": "Backup: backup di VM e CT",
-  "Backup & Recovery": "Backup & Recupero",
+  "Backup & Recovery": "Backup e ripristino",
   "Backup Created": "Backup creato",
   "Backup ID (group name in PBS):": "ID backup (nome del gruppo in PBS):",
   "Backup ID for this job:": "ID di backup per questo lavoro:",
@@ -603,11 +603,11 @@
   "Broken gasket-dkms package state recovered.": "Lo stato danneggiato del pacchetto gasket-dkms è stato ripristinato.",
   "Browse Your Life in Images": "Sfoglia la tua vita in immagini",
   "Browse manually (advanced)...": "Sfoglia manualmente (avanzato)...",
-  "Browsers & Web Desktops": "Browser & Web Desktops",
+  "Browsers & Web Desktops": "Browser e desktop web",
   "Build and install the gasket and apex kernel modules (DKMS)": "Compila e installa i moduli kernel gasket e apex (DKMS)",
   "Build dependencies installed.": "Costruisci dipendenze installate.",
   "Build your personal knowledge base with TriliumNext Notes": "Costruire la vostra base di conoscenza personale con TriliumNext Notes",
-  "Business & ERP": "Affari & ERP",
+  "Business & ERP": "Business e ERP",
   "CHANGES APPLIED SUCCESSFULLY": "MODIFICHE APPLICATE CON SUCCESSO",
   "CIFS Client Tools: AVAILABLE": "Strumenti client CIFS: DISPONIBILE",
   "CIFS Client Tools: NOT AVAILABLE - installing...": "Strumenti client CIFS: NON DISPONIBILE - installazione in corso...",
@@ -869,7 +869,7 @@
   "Commenting legacy ceph.list (if present)...": "Commento legacy ceph.list (se presente)...",
   "Common Issues Check": "Controllo dei problemi comuni",
   "Common root for the published views": "Radice comune per le opinioni pubblicate",
-  "Communication & Community": "Comunicazione e Comunità",
+  "Communication & Community": "Comunicazione e comunità",
   "Community Scripts": "Script di comunità",
   "Community single-container Home Assistant OS image": "Immagine del sistema operativo Home Assistant",
   "Compatibility check": "Controllo di compatibilità",
@@ -1084,7 +1084,7 @@
   "Container will pick up the mount on next start": "Il contenitore raccoglierà la montatura al prossimo avvio",
   "Container with ID": "Contenitore con ID",
   "Container:": "Contenitore:",
-  "Containers & Docker": "Contenitori & Docker",
+  "Containers & Docker": "Container e Docker",
   "Containers returned to their previous state": "Contenitori tornati al loro stato precedente",
   "Containers that are removed:": "Contenitori che vengono rimossi:",
   "Containers that will be created (one LXC per service, on a private network):": "Contenitori che verranno creati (un LXC per servizio, su una rete privata):",
@@ -1157,7 +1157,7 @@
   "Coral M.2 Apex configuration added - device ready": "Aggiunta configurazione Coral M.2 Apex: dispositivo pronto",
   "Coral M.2 Apex configuration added - device will be available after reboot": "Aggiunta configurazione Coral M.2 Apex: il dispositivo sarà disponibile dopo il riavvio",
   "Coral M.2 Apex detected, configuring...": "Rilevato Coral M.2 Apex, configurazione in corso...",
-  "Coral PCIe/M.2 node (e.g. /dev/apex_0)": "Coral PCIe/M.2 nodo (ad esempio /dev/apex 0)",
+  "Coral PCIe/M.2 node (e.g. /dev/apex_0)": "Coral PCIe/M.2 nodo (ad esempio /dev/apex_0)",
   "Coral TPU Installation": "Installazione TPU Coral",
   "Coral TPU Uninstall": "Disinstallazione di Coral TPU",
   "Coral TPU device nodes detected with correct group (apex).": "Nodi del dispositivo Coral TPU rilevati con il gruppo corretto (apice).",
@@ -1345,7 +1345,7 @@
   "Creating the container...": "Creare il contenitore...",
   "Creating the initial administrator...": "Creazione dell'amministratore iniziale...",
   "Creating the temporary data container": "Creazione del contenitore dati temporaneo",
-  "Creative & Design": "Creativo e design",
+  "Creative & Design": "Creatività e design",
   "Credentials are correct": "Le credenziali sono corrette",
   "Credentials cleared. jwt_secret and API tokens preserved.": "Credenziali cancellate. jwt_secret e token API conservati.",
   "Credentials file created securely.": "File delle credenziali creato in modo sicuro.",
@@ -1455,7 +1455,7 @@
   "Data wiped from": "Dati cancellati da",
   "Database management in a single PHP file": "Gestione database in un unico file PHP",
   "Database server proposed on the login page (empty = typed at each login)": "Server di database proposto nella pagina di login (vuoto = digitato ad ogni login)",
-  "Databases": "Databases",
+  "Databases": "Database",
   "Datastore name:": "Nome dell'archivio dati:",
   "Davos is an FTP automation tool that periodically scans given host locations for new files. It can be configured for various purposes, including listening for specific files to appear in the host location, ready for it to download and then move, if required. It also supports completion notifications as well as downstream API calls, to further the workflow.": "Davos è uno strumento di automazione FTP che scansiona periodicamente le posizioni degli host date per i nuovi file. Può essere configurato per vari scopi, tra cui l'ascolto per i file specifici da visualizzare nella posizione dell'host, pronto per il download e quindi spostare, se required. Supporta anche le notifiche di completamento e le chiamate API a valle, per continuare il flusso di lavoro.",
   "Ddclient is a Perl client used to update dynamic DNS entries for accounts on Dynamic DNS Network Service Provider. It was originally written by Paul Burry and is now mostly by wimpunk. It has the capability to update more than just dyndns and it can fetch your WAN-ipaddress in a few different ways.": "Ddclient è un client Perl utilizzato per aggiornare le voci DNS dinamiche per gli account su Dynamic DNS Network Service Provider. Originariamente è stato scritto da Paul Burry ed è ora per lo più di wimpunk. Ha la capacità di aggiornare più di soli dyndns e può prendere il vostro WAN-ipaddress in pochi modi diversi.",
@@ -1731,7 +1731,7 @@
   "Dry run completed; the container and the mounts were not changed.": "Corsa a secco completata; il contenitore e i supporti non sono stati modificati.",
   "DuckDNS subdomain without .duckdns.org (comma separated for several)": "Sottodominio DuckDNS senza .duckdns.org (comma separato per diversi)",
   "DuckDNS token from your account at duckdns.org": "Token DuckDNS dal tuo account su duckdns.org",
-  "DuckDNS updates the subdomain every 5 minutes. Without UPDATE_IP, DuckDNS itself detects the public IPv4 address of the request.": "DuckDNS aggiorna il sottodominio ogni 5 minuti. Senza UPDATE IP, DuckDNS stesso rileva l'indirizzo IPv4 pubblico della richiesta.",
+  "DuckDNS updates the subdomain every 5 minutes. Without UPDATE_IP, DuckDNS itself detects the public IPv4 address of the request.": "DuckDNS aggiorna il sottodominio ogni 5 minuti. Senza UPDATE_IP, DuckDNS stesso rileva l'indirizzo IPv4 pubblico della richiesta.",
   "DuckStation is a PS1 Emulator aiming for the best accuracy and game support.": "DuckStation è un Emulatore PS1 che mira al miglior supporto accuracy e game.",
   "Duckdns is a free service which will point a DNS (sub domains of duckdns.org) to an IP of your choice. The service is completely free, and doesn't require reactivation or forum posts to maintain its existence.": "Duckdns è un servizio gratuito che indicherà un DNS (sotto domini di duckdns.org) a un IP di vostra scelta. Il servizio è completamente gratuito, e non require riattivazione o post del forum per mantenere la sua esistenza.",
   "Dumping AMD GPU ROM BIOS via sysfs...": "Dumping del BIOS ROM della GPU AMD tramite sysfs...",
@@ -2239,7 +2239,7 @@
   "Final cleanup of the stack operation completed": "Pulizia finale della pila operation completata",
   "Final confirmation": "Conferma finale",
   "Final storage health/status check": "Controllo finale dell'integrità/stato dell'archiviazione",
-  "Finance & Budgeting": "Finanza e Budgeting",
+  "Finance & Budgeting": "Finanze e budget",
   "Find your device using https://finds.synology.com": "Trova il tuo dispositivo utilizzando https://finds.synology.com",
   "Fingerprint:": "Impronta digitale:",
   "Firefly, the easiest using of WireGuard VPN server, plus version of wg-easy.": "Firefly, il più semplice utilizzo del server VPN WireGuard, oltre alla versione di wg-easy.",
@@ -2386,7 +2386,7 @@
   "GRUB_CMDLINE_LINUX_DEFAULT not found in GRUB config": "GRUB_CMDLINE_LINUX_DEFAULT non trovato nella configurazione di GRUB",
   "GUI mode (if available)": "Modalità GUI (se disponibile)",
   "GZDoom is a feature centric port for all Doom engine games, based on ZDoom, adding an OpenGL renderer and powerful scripting capabilities.": "GZDoom è una porta centrica caratteristica per tutti i giochi del motore Doom, basata su ZDoom, aggiungendo un renderer OpenGL e potenti capacità di scripting.",
-  "Gaming & Leisure": "Gioco & Leisure",
+  "Gaming & Leisure": "Giochi e tempo libero",
   "Gateway is not installed.": "Il gateway non è installato.",
   "Gateway removed.": "Gateway rimosso.",
   "Gateway restarted.": "Il gateway è stato riavviato.",
@@ -2526,7 +2526,7 @@
   "Host GPU detected": "Rilevata GPU host",
   "Host GPU is already bound to vfio-pci. Host reconfiguration/reboot should not be required for this VM-to-VM reassignment.": "La GPU host è già associata a vfio-pci. La riconfigurazione/riavvio dell'host non dovrebbe essere necessario per questa riassegnazione da VM a VM.",
   "Host IP": "IP dell'ospite",
-  "Host Management": "Gestione host",
+  "Host Management": "Gestione dell'host",
   "Host Mount Path": "Percorso di montaggio dell'host",
   "Host NFS/Samba as Proxmox Storage (pvesm)": "Ospita NFS/Samba come storage Proxmox (pvesm)",
   "Host Path": "Percorso dell'ospite",
@@ -2793,7 +2793,7 @@
   "Initiator IQN is authorised on the target": "L'IQN dell'iniziatore è autorizzato sul target",
   "Initiator IQN:": "IQN dell'iniziatore:",
   "Inkscape is professional quality vector graphics software which runs on Linux, Mac OS X and Windows desktop computers.": "Inkscape è un software grafico vettoriale di qualità professionale che funziona su computer desktop Linux, Mac OS X e Windows.",
-  "Inside the LXC, create the administrator: console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN": "All'interno del LXC, creare l'amministratore: console kimai:user:creare Your USERNAME Your EMAIL ROLE SUPER ADMIN",
+  "Inside the LXC, create the administrator: console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN": "All'interno del LXC, creare l'amministratore: console kimai:user:creare Your USERNAME Your EMAIL ROLE_SUPER_ADMIN",
   "Inspect disks before any action": "Ispezionare i dischi prima di qualsiasi azione",
   "Inspect host device nodes": "Ispezionare i nodi del dispositivo host",
   "Inspect passthrough/kernel events": "Ispezionare gli eventi passthrough/kernel",
@@ -3399,7 +3399,7 @@
   "Memory settings optimized successfully": "Impostazioni di memoria ottimizzate con successo",
   "Memory:": "Memoria:",
   "Memos is a lightweight, self-hosted memo hub. Open Source and Free forever.": "Memos è un hub memo leggero e self-hosted. Open Source e Free per sempre.",
-  "Messaging & Notifications": "Messaggi e notifiche",
+  "Messaging & Notifications": "Messaggistica e notifiche",
   "Messaging & Queues": "Messaging & Queues",
   "Messenger for the Decentralized Web": "Messaggero per il Web decentrato",
   "Method:": "Metodo:",
@@ -3661,7 +3661,7 @@
   "Name of this wallabag instance, shown in the interface and in 2FA codes": "Nome di questa istanza wallabag, mostrata nell'interfaccia e nei codici 2FA",
   "Name or part of the description of the application": "Nome o parte della descrizione dell'applicazione",
   "Name:": "Nome:",
-  "Named accounts need private mode. Stop the container, set public: false in /config/config.js, start it again and create each user with: pct exec <CTID> -- env THELOUNGE_HOME=/config s6-setuidgid abc thelounge add <user>": "I conti nominati hanno bisogno di modalità privata. Stop al contenitore, set public: false in /config/config.js, avviare di nuovo e creare ogni utente con: pct exec <CTID> -- env THELOUNGE HOME=/config s6-setuidgid abc thelounge add <user>",
+  "Named accounts need private mode. Stop the container, set public: false in /config/config.js, start it again and create each user with: pct exec <CTID> -- env THELOUNGE_HOME=/config s6-setuidgid abc thelounge add <user>": "I conti nominati hanno bisogno di modalità privata. Stop al contenitore, set public: false in /config/config.js, avviare di nuovo e creare ogni utente con: pct exec <CTID> -- env THELOUNGE_HOME=/config s6-setuidgid abc thelounge add <user>",
   "Neither /etc/kernel/cmdline nor /etc/default/grub found.": "Non sono stati trovati né /etc/kernel/cmdline né /etc/default/grub.",
   "Nesting feature enabled": "Funzionalità di annidamento abilitata",
   "NetBIOS Service: RUNNING": "Servizio NetBIOS: IN ESECUZIONE",
@@ -3671,7 +3671,7 @@
   "Netbox is an IP address management (IPAM) and data center infrastructure management (DCIM) tool. Initially conceived by the network engineering team at DigitalOcean, NetBox was developed specifically to address the needs of network and infrastructure engineers. It is intended to function as a domain-specific source of truth for network operations.": "Netbox è uno strumento di gestione degli indirizzi IP (IPAM) e di gestione delle infrastrutture dei data center (DCIM). Inizialmente concepito dal team di ingegneria di rete di DigitalOcean, NetBox è stato sviluppato specificamente per soddisfare le esigenze degli ingegneri della rete e delle infrastrutture. È destinato a funzionare come fonte di verità specifica di dominio per la rete operations.",
   "Network": "Rete",
   "Network  :": "Rete  :",
-  "Network & Firewall": "Rete e Firewall",
+  "Network & Firewall": "Rete e firewall",
   "Network (interfaces, DNS)": "Rete (interfacce, DNS)",
   "Network Bridge": "Ponte di rete",
   "Network Commands": "Comandi di rete",
@@ -4042,7 +4042,7 @@
   "OCI containers require Proxmox VE 9.1 or later.": "I contenitori OCI richiedono Proxmox VE 9.1 o versione successiva.",
   "OCI management": "Gestione OCI",
   "OCI management could not be completed. Check the backend status; no additional cleanup has been authorized.": "La gestione OCI non poteva essere completata. Controlla lo stato del backend; non è stata autorizzata alcuna pulizia aggiuntiva.",
-  "OCI manager Apps (beta)": "App di gestione OCI (beta)",
+  "OCI manager Apps (beta)": "OCI manager Apps (beta)",
   "OCI manager Apps is a beta: if something does not work as expected, please report it on GitHub with the application name.": "OCI manager Apps è una beta: se qualcosa non funziona come previsto, si prega di segnalarlo su GitHub con il nome dell'applicazione.",
   "OCI metadata integrity mismatch": "OCI metadati integrità mismatch",
   "OCI metadata too large": "OCI metadati troppo grandi",
@@ -4371,7 +4371,7 @@
   "Postfix configuration": "Configurazione suffissa",
   "PostgreSQL": "PostgreSQL",
   "PostgreSQL URL without an associated service:": "URL PostgreSQL senza un servizio associato:",
-  "PostgreSQL creates the database named in POSTGRES_DB on the first start. The installer default is postgresql.": "PostgreSQL crea il database chiamato in POSTGRES DB al primo avvio. L'impostazione predefinita è postgresql.",
+  "PostgreSQL creates the database named in POSTGRES_DB on the first start. The installer default is postgresql.": "PostgreSQL crea il database chiamato in POSTGRES_DB al primo avvio. L'impostazione predefinita è postgresql.",
   "PostgreSQL is an advanced, enterprise-class, and open-source relational database system. PostgreSQL supports both SQL (relational) and JSON (non-relational) querying.": "PostgreSQL è un sistema di database relazionale avanzato, di classe enterprise e open source. PostgreSQL supporta sia querying SQL (relazionale) che JSON (non relazionale).",
   "PostgreSQL requires a password": "PostgreSQL requires una password",
   "PostgreSQL volume size in GB": "Dimensione del volume PostgreSQL in GB",
@@ -4534,7 +4534,7 @@
   "Pwndrop is a self-deployable file hosting service for sending out red teaming payloads or securely sharing your private files over HTTP and WebDAV.": "Pwndrop è un servizio di hosting di file auto-deployable per l'invio di payload di teaming rosso o la condivisione sicura dei file privati su HTTP e WebDAV.",
   "PyCharm offers out-of-the-box support for Python, databases, Jupyter, Git, Conda, PyTorch, TensorFlow, Hugging Face, Django, Flask, FastAPI, and more.": "PyCharm offre supporto out-of-the-box per Python, banche dati, Jupyter, Git, Conda, PyTorch, TensorFlow, Hugging Face, Django, Flask, FastAPI, e altro ancora.",
   "Pydio Cells needs an external MySQL or MariaDB database. The setup wizard asks for its address, database name and user on the first start.": "Pydio Cells ha bisogno di un database MySQL esterno o MariaDB. La procedura guidata di configurazione chiede il suo indirizzo, il nome del database e l'utente al primo avvio.",
-  "Pydio Cells redirects to the address given in EXTERNALURL. If the container changes address, edit lxc.environment.runtime: EXTERNALURL and SERVER_IP in /etc/pve/lxc/<CTID>.conf with the container stopped, and delete /config/keys/cert.crt to regenerate the certificate.": "Pydio Cells reindirizza all'indirizzo indicato in EXTERNALURL. Se il contenitore cambia indirizzo, modifica lxc.environment.runtime: EXTERNALURL e SERVER IP in /etc/pve/lxc/∂.conf con il contenitore interrotto, ed eliminare /config/keys/cert.crt per rigenerare il certificato.",
+  "Pydio Cells redirects to the address given in EXTERNALURL. If the container changes address, edit lxc.environment.runtime: EXTERNALURL and SERVER_IP in /etc/pve/lxc/<CTID>.conf with the container stopped, and delete /config/keys/cert.crt to regenerate the certificate.": "Pydio Cells reindirizza all'indirizzo indicato in EXTERNALURL. Se il contenitore cambia indirizzo, modifica lxc.environment.runtime: EXTERNALURL e SERVER_IP in /etc/pve/lxc/∂.conf con il contenitore interrotto, ed eliminare /config/keys/cert.crt per rigenerare il certificato.",
   "Pydio-cells is the nextgen file sharing platform for organizations. It is a full rewrite of the Pydio project using the Go language following a micro-service architecture.": "Pydio-cells è la piattaforma di condivisione file di prossima generazione per le organizzazioni. Si tratta di una riscrittura completa del progetto Pydio utilizzando la lingua Go seguendo un'architettura micro-servizio.",
   "QDirStat Qt-based directory statistics: KDirStat without any KDE -- from the author of the original KDirStat.": "QDirStat Statistiche di directory basate su Qt: KDirStat senza KDE -- dall'autore del KDirStat originale.",
   "Quick health check (PASSED / FAILED)": "Controllo rapido dello stato (SUPERATO/FALLITO)",
@@ -5947,7 +5947,7 @@
   "The imported Compose requests privileged, but the official jlesage/handbrake documentation does not require it; ProxMenux keeps the LXC unprivileged.": "Il Compose importato richiede privilegiato, ma la documentazione ufficiale jlesage/handbrake non lo require; ProxMenux mantiene il LXC non privato.",
   "The imported OCI groups are not numeric": "I gruppi OCI importati non sono numerici",
   "The imported OCI user or group is not numeric": "L'utente o il gruppo OCI importati non è numerico",
-  "The initial user name and password stay written in /etc/pve/lxc/<CTID>.conf as INIT_USERNAME and INIT_PASSWORD. They can be removed after the first login, with the container stopped.": "Il nome utente iniziale e la password rimangono scritti in /etc/pve/lxc/δCTID>.conf come INIT USERNAME e INIT PASSWORD. Possono essere rimossi dopo il primo login, con il contenitore fermato.",
+  "The initial user name and password stay written in /etc/pve/lxc/<CTID>.conf as INIT_USERNAME and INIT_PASSWORD. They can be removed after the first login, with the container stopped.": "Il nome utente iniziale e la password rimangono scritti in /etc/pve/lxc/δCTID>.conf come INIT_USERNAME e INIT_PASSWORD. Possono essere rimossi dopo il primo login, con il contenitore fermato.",
   "The installation asks which one to use for these paths.": "L'installazione chiede quale utilizzare per questi percorsi.",
   "The installation ended with exit code": "L'installazione è terminata con il codice di uscita",
   "The installation requires a server restart to apply changes. Do you want to restart now?": "L'installazione richiede il riavvio del server per applicare le modifiche. Vuoi riavviare adesso?",
@@ -6066,7 +6066,7 @@
   "The rootfs is not managed by Proxmox": "I rootf non sono gestiti da Proxmox",
   "The rootfs is not mounted": "I rootf non sono montati",
   "The same GPU cannot be used by two VMs at the same time.": "La stessa GPU non può essere utilizzata da due VM contemporaneamente.",
-  "The same connection can be given as container variables instead of the file: UN_SONARR_0_URL and UN_SONARR_0_API_KEY, or the UN_RADARR_0_ equivalents.": "La stessa connessione può essere data come variabili di contenitore al posto del file: UN SONARR 0 URL e UN SONARR 0 API KEY, o UN RADARR 0  equivalents.",
+  "The same connection can be given as container variables instead of the file: UN_SONARR_0_URL and UN_SONARR_0_API_KEY, or the UN_RADARR_0_ equivalents.": "La stessa connessione può essere data come variabili di contenitore al posto del file: UN_SONARR_0_URL e UN_SONARR_0_API_KEY, o UN RADARR 0  equivalents.",
   "The saved MOTD state is invalid; no changes were made": "lo stato MOTD salvato non è valido;non sono state apportate modifiche",
   "The saved OCI record is incomplete or has an unexpected format.": "Il record OCI salvato è incompleto o ha un formato inaspettato.",
   "The saved projection does not match the native evidence": "La proiezione salvata non corrisponde alle prove native",
@@ -6814,7 +6814,7 @@
   "Web interface to manage devices running Tasmota firmware.": "Interfaccia web per gestire i dispositivi che eseguono il firmware Tasmota.",
   "WebCord can be summarized as a pack of security and privacy hardenings, Discord features reimplementations, Electron / Chromium / Discord bugs workarounds, stylesheets, internal pages and wrapped https://discord.com page, designed to conform with ToS as much as it is possible (or hide the changes that might violate it from Discord's eyes).": "WebCord può essere riassunto come un pacchetto di indurzioni di sicurezza e privacy, Discord caratteristiche reimplement, Electron / Chromium / Discord bugs workarounds, stylesheets, pagine interne e avvolto https://discord.com pagina, progettato per conformarsi con ToS quanto è possibile (o nascondere le modifiche che potrebbero violarlo dagli occhi di Discord).",
   "Webgrabplus is a multi-site incremental xmltv epg grabber. It collects tv-program guide data from selected tvguide sites for your favourite channels.": "Webgrabplus è un manubrio multi-sito incrementale xmltv epg. Raccoglie i dati della guida tv-programma da siti di guida selezionati per i tuoi canali preferiti.",
-  "Webservers & Proxies": "Webservers & Proxies",
+  "Webservers & Proxies": "Server web e proxy",
   "Website": "Sito web",
   "Webstation is a web native emulation focused LXQt desktop based on Ubuntu.": "Webstation è un desktop LXQt basato su Ubuntu.",
   "Webtop - Alpine, Ubuntu, Fedora, and Arch based containers containing full desktop environments in officially supported flavors accessible via any modern web browser.": "Webtop - contenitori Alpine, Ubuntu, Fedora e Arch, contenenti ambienti desktop completi in gusti ufficialmente supportati accessibili tramite qualsiasi browser web moderno.",
@@ -6847,7 +6847,7 @@
   "WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many different circumstances. Initially released for the Linux kernel, it is now cross-platform (Windows, macOS, BSD, iOS, Android) and widely deployable. It is currently under heavy development, but already it might be regarded as the most secure, easiest to use, and simplest VPN solution in the industry.": "WireGuard® è una VPN estremamente semplice ma veloce e moderna che utilizza la crittografia all'avanguardia. Esso mira ad essere più veloce, più semplice, più snella, e più utile di IPsec, evitando il mal di testa massiccio. Si intende essere molto più performante di OpenVPN. WireGuard è progettato come una VPN di scopo generale per l'esecuzione su interfacce embedded e super computer allo stesso modo, adatto per molte circostanze diverse. Inizialmente rilasciato per il kernel Linux, è ora cross-platform (Windows, macOS, BSD, iOS, Android) e ampiamente implementabile. Attualmente è in forte sviluppo, ma già potrebbe essere considerato come la soluzione VPN più sicura, più facile da usare e più semplice del settore.",
   "Wired NICs in backup missing on target:": "Schede NIC cablate nel backup mancanti sulla destinazione:",
   "Wireshark is the world’s foremost and widely-used network protocol analyzer. It lets you see what’s happening on your network at a microscopic level and is the de facto (and often de jure) standard across many commercial and non-profit enterprises, government agencies, and educational institutions. Wireshark development thrives thanks to the volunteer contributions of networking experts around the globe and is the continuation of a project started by Gerald Combs in 1998.": "Wireshark è il principale e ampiamente utilizzato analizzatore di protocollo di rete. Ti permette di vedere cosa sta accadendo sulla tua rete a livello microscopico ed è lo standard de facto (e spesso de jure) in molte imprese commerciali e non-profit, agenzie governative e istituzioni educative. Lo sviluppo di Wireshark prospera grazie ai contributi volontari di esperti di networking in tutto il mondo ed è la continuazione di un progetto avviato da Gerald Combs nel 1998.",
-  "With dns validation, the DNSPLUGIN variable names the provider plugin. The advanced installation asks for it; otherwise add the line lxc.environment.runtime: DNSPLUGIN=<plugin> to /etc/pve/lxc/<CTID>.conf with the container stopped.": "Con la convalida di dns, la variabile DNSPLUGIN nomina il plugin del provider. L'installazione avanzata lo richiede; altrimenti aggiungere la linea lxc.environment. runtime: DNSPLUGIN= <plugin> a /etc/pve/lxc/δCTID>.conf con il contenitore interrotto.",
+  "With dns validation, the DNSPLUGIN variable names the provider plugin. The advanced installation asks for it; otherwise add the line lxc.environment.runtime: DNSPLUGIN=<plugin> to /etc/pve/lxc/<CTID>.conf with the container stopped.": "Con la convalida di dns, la variabile DNSPLUGIN nomina il plugin del provider. L'installazione avanzata lo richiede; altrimenti aggiungere la linea lxc.environment.runtime: DNSPLUGIN= <plugin> a /etc/pve/lxc/ <CTID>.conf con il contenitore fermato.",
   "With dns validation, write the provider credentials in /config/dns-conf/<plugin>.ini inside the container and restart it.": "Con la validazione di dns, scrivere il credentials del fornitore in /config/dns-conf/δplugin>.ini all'interno del contenitore e riavviarlo.",
   "With http validation, port 80 of the router must be forwarded to port 80 of this container.": "Con la convalida http, la porta 80 del router deve essere inoltrata alla porta 80 di questo contenitore.",
   "With warnings": "Con avvertimenti",
@@ -7366,7 +7366,7 @@
   "vfio-pci IDs configured": "ID vfio-pci configurati",
   "vfio-pci IDs in /etc/modprobe.d/vfio.conf": "ID vfio-pci in /etc/modprobe.d/vfio.conf",
   "vzdump backup speed optimization completed": "Ottimizzazione della velocità di backup di vzdump completata",
-  "wallabag builds its links from the address given during the installation. If it does not match the address of the container, edit lxc.environment.runtime: SYMFONY__ENV__DOMAIN_NAME in /etc/pve/lxc/<CTID>.conf with the container stopped, and start it again.": "wallabag costruisce i suoi collegamenti dall'indirizzo indicato durante l'installazione. Se non corrisponde all'indirizzo del contenitore, modificare lxc.environment. runtime: SYMFONY  ENV DOMAIN NAME in /etc/pve/lxc/δCTID>.conf con il contenitore fermato, e ricominciare.",
+  "wallabag builds its links from the address given during the installation. If it does not match the address of the container, edit lxc.environment.runtime: SYMFONY__ENV__DOMAIN_NAME in /etc/pve/lxc/<CTID>.conf with the container stopped, and start it again.": "wallabag costruisce i suoi collegamenti dall'indirizzo indicato durante l'installazione. Se non corrisponde all'indirizzo del contenitore, modificare lxc.environment.runtime: SYMFONY  ENV DOMAIN NAME in /etc/pve/lxc/δCTID>.conf con il contenitore fermato, e ricominciare.",
   "wallabag listens on port 80 of the container and stores its data in SQLite.": "wallabag ascolta la porta 80 del contenitore e memorizza i suoi dati in SQLite.",
   "wallabag web interface": "Interfaccia web wallabag",
   "was": "era",
diff --git a/lang/pt.json b/lang/pt.json
index df98593d..0c25c8c7 100644
--- a/lang/pt.json
+++ b/lang/pt.json
@@ -20,7 +20,7 @@
   "(recommended)": "(recomendado)",
   "(same MAC — restored config adjusted automatically)": "(mesmo MAC - configuração restaurada ajustada automaticamente)",
   ")": ")",
-  "*Arr Suite": "* Arr Suite",
+  "*Arr Suite": "*Arr Suite",
   "+ Add a path": "+ Adicione um caminho",
   "+ Add new Borg target": "+ Adicionar novo alvo Borg",
   "+ Add new PBS manually": "+ Adicione novo PBS manualmente",
@@ -120,7 +120,7 @@
   "ACL Status:": "Status da ACL:",
   "ACL permissions applied for local access for user:": "Permissões ACL aplicadas para acesso local do usuário:",
   "ADVANCED SETTINGS COMPLETE": "CONFIGURAÇÕES AVANÇADAS CONCLUÍDAS",
-  "AI / Coding & Dev-Tools": "IA / Codificação & Ferramentas Dev",
+  "AI / Coding & Dev-Tools": "IA, programação e desenvolvimento",
   "ALL DATA ON": "TODOS OS DADOS EM",
   "ALL DATA ON THIS DISK WILL BE PERMANENTLY LOST!": "TODOS OS DADOS NESTE DISCO SERÃO PERMANENTEMENTE PERDIDOS!",
   "ALL Utilities": "TODOS os utilitários",
@@ -185,7 +185,7 @@
   "Actual device path on the host": "Localização real do dispositivo na máquina",
   "Adaptation file too large": "Arquivo de adaptação muito grande",
   "Adaptation file with unexpected permissions or owner": "Arquivo de adaptação com permissões inesperadas ou proprietário",
-  "Adblock & DNS": "Adblock & DNS",
+  "Adblock & DNS": "Adblock e DNS",
   "Add Audio Passthrough": "Adicionar passagem de áudio",
   "Add CIFS storage:": "Adicione armazenamento CIFS:",
   "Add Controller or NVMe (PCI passthrough)": "Adicionar controlador ou NVMe (passagem PCI)",
@@ -439,7 +439,7 @@
   "Auth key is required.": "A chave de autenticação é obrigatória.",
   "Auth:": "Autenticação:",
   "Authentication": "Autenticação",
-  "Authentication & Security": "Autenticação e Segurança",
+  "Authentication & Security": "Autenticação e segurança",
   "Authentication Error": "Erro de autenticação",
   "Authentication failed.": "Falha na autenticação.",
   "Authentication required:": "Autenticação necessária:",
@@ -463,7 +463,7 @@
   "Automatic private network allocation requires a /24 subnet": "Alocação automática de rede privada requires a /24 subnet",
   "Automatic video library manager for TV Shows": "Gerenciador automático de bibliotecas de vídeo para programas de TV",
   "Automatic/Unattended": "Automático/Autônomo",
-  "Automation & Scheduling": "Programação de Automação",
+  "Automation & Scheduling": "Automação e agendamento",
   "Available": "Disponível",
   "Available Borg archives (newest first):": "Arquivos Borg disponíveis (os mais recentes primeiro):",
   "Available Borg targets:": "Alvos Borg disponíveis:",
@@ -500,7 +500,7 @@
   "Backend:": "Back-end:",
   "Background archive extraction for Arr download queues. No web interface.": "Extração de arquivo de fundo para as filas de download do Arr. Sem interface web.",
   "Backup            — VM and CT backups": "Backup – backups de VM e CT",
-  "Backup & Recovery": "Backup & Recuperação",
+  "Backup & Recovery": "Backups e recuperação",
   "Backup Created": "Backup criado",
   "Backup ID (group name in PBS):": "ID de backup (nome do grupo no PBS):",
   "Backup ID for this job:": "ID de backup para este trabalho:",
@@ -603,11 +603,11 @@
   "Broken gasket-dkms package state recovered.": "O estado danificado do pacote gasket-dkms foi recuperado.",
   "Browse Your Life in Images": "Navegue por sua vida em imagens",
   "Browse manually (advanced)...": "Navegar manualmente (avançado)...",
-  "Browsers & Web Desktops": "Navegadores e Ecrãs Web",
+  "Browsers & Web Desktops": "Navegadores e ambientes de trabalho web",
   "Build and install the gasket and apex kernel modules (DKMS)": "Compilar e instalar os módulos de kernel gasket e apex (DKMS)",
   "Build dependencies installed.": "Construa dependências instaladas.",
   "Build your personal knowledge base with TriliumNext Notes": "Crie sua base de conhecimento pessoal com TriliumPróximos Notas",
-  "Business & ERP": "Negócios & ERP",
+  "Business & ERP": "Negócio e ERP",
   "CHANGES APPLIED SUCCESSFULLY": "ALTERAÇÕES APLICADAS COM SUCESSO",
   "CIFS Client Tools: AVAILABLE": "Ferramentas de cliente CIFS: DISPONÍVEIS",
   "CIFS Client Tools: NOT AVAILABLE - installing...": "Ferramentas cliente CIFS: NÃO DISPONÍVEIS - instalando...",
@@ -869,7 +869,7 @@
   "Commenting legacy ceph.list (if present)...": "Comentando legado ceph.list (se presente)...",
   "Common Issues Check": "Verificação de problemas comuns",
   "Common root for the published views": "Raiz comum das opiniões publicadas",
-  "Communication & Community": "Comunicação & Comunidade",
+  "Communication & Community": "Comunicação e comunidade",
   "Community Scripts": "Scripts da comunidade",
   "Community single-container Home Assistant OS image": "Imagem do sistema operacional Home Assistant para um único recipiente comunitário",
   "Compatibility check": "Verificação de compatibilidade",
@@ -1041,7 +1041,7 @@
   "Consider security implications for production environments": "Considere as implicações de segurança para ambientes de produção",
   "Consider visiting the repository and supporting the project.": "Considere visitar o repositório e apoiar o projeto.",
   "Console log:": "Registo da consola:",
-  "Container": "Recipiente",
+  "Container": "Contêiner",
   "Container         — LXC root directories": "Container - diretórios raiz LXC",
   "Container ID": "ID do contêiner",
   "Container ID not defined. Make sure to select a container first.": "ID do contêiner não definido. Certifique-se de selecionar um contêiner primeiro.",
@@ -1083,8 +1083,8 @@
   "Container volume (included in backups)": "Volume do recipiente (incluído em backups)",
   "Container will pick up the mount on next start": "O contêiner pegará a montagem na próxima partida",
   "Container with ID": "Contêiner com ID",
-  "Container:": "Recipiente:",
-  "Containers & Docker": "Containers e Docker",
+  "Container:": "Contêiner:",
+  "Containers & Docker": "Contentores e Docker",
   "Containers returned to their previous state": "Os contentores voltaram ao seu estado anterior",
   "Containers that are removed:": "Recipientes que são removidos:",
   "Containers that will be created (one LXC per service, on a private network):": "Containers que serão criados (um LXC por serviço, em uma rede privada):",
@@ -1157,7 +1157,7 @@
   "Coral M.2 Apex configuration added - device ready": "Configuração Coral M.2 Apex adicionada - dispositivo pronto",
   "Coral M.2 Apex configuration added - device will be available after reboot": "Configuração Coral M.2 Apex adicionada - o dispositivo estará disponível após a reinicialização",
   "Coral M.2 Apex detected, configuring...": "Coral M.2 Apex detectado, configurando...",
-  "Coral PCIe/M.2 node (e.g. /dev/apex_0)": "Nó Coral PCIe/M.2 (por exemplo, /dev/apex 0)",
+  "Coral PCIe/M.2 node (e.g. /dev/apex_0)": "Nó Coral PCIe/M.2 (por exemplo, /dev/apex_0)",
   "Coral TPU Installation": "Instalação Coral TPU",
   "Coral TPU Uninstall": "Desinstalação do Coral TPU",
   "Coral TPU device nodes detected with correct group (apex).": "Nós do dispositivo Coral TPU detectados com o grupo correto (apex).",
@@ -1345,7 +1345,7 @@
   "Creating the container...": "A criar o contentor...",
   "Creating the initial administrator...": "Criando o administrador inicial...",
   "Creating the temporary data container": "Criando o recipiente de dados temporário",
-  "Creative & Design": "Desenho Criativo",
+  "Creative & Design": "Criatividade e design",
   "Credentials are correct": "As credenciais estão corretas",
   "Credentials cleared. jwt_secret and API tokens preserved.": "Credenciais apagadas. jwt_secret e tokens de API preservados.",
   "Credentials file created securely.": "Arquivo de credenciais criado com segurança.",
@@ -1694,7 +1694,7 @@
   "Docker Mods are only offered for compatible LinuxServer images": "Docker Mods são oferecidos apenas para imagens LinuxServer compatíveis",
   "Docker Volume Backup": "Docker Volume Backup",
   "Docker/CLI not available yet or no valid answer": "Docker/CLI ainda não disponível ou nenhuma resposta válida",
-  "Documents & Notes": "Documentos e Notas",
+  "Documents & Notes": "Documentos e notas",
   "Documents volume size in GB": "Tamanho do volume de documentos em GB",
   "Dokuwiki is a simple to use and highly versatile Open Source wiki software that doesn't require a database. It is loved by users for its clean and readable syntax. The ease of maintenance, backup and integration makes it an administrator's favorite. Built in access controls and authentication connectors make DokuWiki especially useful in the enterprise context and the large number of plugins contributed by its vibrant community allow for a broad range of use cases beyond a traditional wiki.": "Dokuwiki é um software wiki de código aberto muito simples de usar e altamente versátil que não require um banco de dados. É amado pelos usuários por sua sintaxe limpa e legível. A facilidade de manutenção, backup e integração o torna o favorito do administrador. Conectados em controles de acesso e conectores de autenticação tornam o DokuWiki especialmente útil no contexto empresarial e o grande número de plugins contribuídos por sua comunidade vibrante permitem uma ampla gama de casos de uso além de uma wiki tradicional.",
   "Dolphin Emulator lets you play GameCube and Wii games with various graphical enhancements and other features are available to improve your game experience.": "O Emulador Dolphin permite que você jogue jogos GameCube e Wii com várias melhorias gráficas e outros recursos estão disponíveis para melhorar sua experiência de jogo.",
@@ -1731,7 +1731,7 @@
   "Dry run completed; the container and the mounts were not changed.": "A corrida a seco foi concluída; o recipiente e as montagens não foram alteradas.",
   "DuckDNS subdomain without .duckdns.org (comma separated for several)": "Subdomínio DuckDNS sem .duckdns.org (comma separado para vários)",
   "DuckDNS token from your account at duckdns.org": "DuckDNS token da sua conta em duckdns.org",
-  "DuckDNS updates the subdomain every 5 minutes. Without UPDATE_IP, DuckDNS itself detects the public IPv4 address of the request.": "DuckDNS atualiza o subdomínio a cada 5 minutos. Sem UPDATE IP, o próprio DuckDNS detecta o endereço IPv4 público da solicitação.",
+  "DuckDNS updates the subdomain every 5 minutes. Without UPDATE_IP, DuckDNS itself detects the public IPv4 address of the request.": "DuckDNS atualiza o subdomínio a cada 5 minutos. Sem UPDATE_IP, o próprio DuckDNS detecta o endereço IPv4 público da solicitação.",
   "DuckStation is a PS1 Emulator aiming for the best accuracy and game support.": "DuckStation é um emulador PS1 que visa o melhor accuracy e suporte a jogos.",
   "Duckdns is a free service which will point a DNS (sub domains of duckdns.org) to an IP of your choice. The service is completely free, and doesn't require reactivation or forum posts to maintain its existence.": "Duckdns é um serviço gratuito que irá apontar um DNS (subdomínios do duckdns.org) para um IP de sua escolha. O serviço é completamente gratuito, e não require reativação ou posts de fórum para manter sua existência.",
   "Dumping AMD GPU ROM BIOS via sysfs...": "Despejando BIOS da ROM da GPU AMD via sysfs...",
@@ -2230,7 +2230,7 @@
   "FileBrowser Quantum": "FileBrowser Quantum",
   "FileBrowser Quantum (new installation)": "FileBrowser Quantum (nova instalação)",
   "FileDrop is a free, open source file sharing service": "FileDrop é um serviço de compartilhamento de arquivos livre e aberto",
-  "Files & Downloads": "Ficheiros e Transferências",
+  "Files & Downloads": "Ficheiros e transferências",
   "Files volume size in GB": "Tamanho do volume dos arquivos em GB",
   "Filesystem": "Sistema de arquivos",
   "Filesystem Tools Required": "Ferramentas de sistema de arquivos necessárias",
@@ -2239,7 +2239,7 @@
   "Final cleanup of the stack operation completed": "Limpeza final da pilha operation concluída",
   "Final confirmation": "Confirmação final",
   "Final storage health/status check": "Verificação final de integridade/status do armazenamento",
-  "Finance & Budgeting": "Finanças & Budgeting",
+  "Finance & Budgeting": "Finanças e orçamento",
   "Find your device using https://finds.synology.com": "Encontre o seu dispositivo usando https://finds.synology.com",
   "Fingerprint:": "Impressão digital:",
   "Firefly, the easiest using of WireGuard VPN server, plus version of wg-easy.": "Firefly, o mais fácil de usar o servidor VPN WireGuard, além da versão do wg-fácil.",
@@ -2386,7 +2386,7 @@
   "GRUB_CMDLINE_LINUX_DEFAULT not found in GRUB config": "GRUB_CMDLINE_LINUX_DEFAULT não encontrado na configuração do GRUB",
   "GUI mode (if available)": "Modo GUI (se disponível)",
   "GZDoom is a feature centric port for all Doom engine games, based on ZDoom, adding an OpenGL renderer and powerful scripting capabilities.": "GZDoom é uma porta centrada em recursos para todos os jogos do Doom Engine, baseado no ZDoom, adicionando um renderizador OpenGL e recursos de script poderosos.",
-  "Gaming & Leisure": "Jogos & Leisure",
+  "Gaming & Leisure": "Jogos e lazer",
   "Gateway is not installed.": "O gateway não está instalado.",
   "Gateway removed.": "Gateway removido.",
   "Gateway restarted.": "Gateway reiniciado.",
@@ -2526,7 +2526,7 @@
   "Host GPU detected": "GPU host detectada",
   "Host GPU is already bound to vfio-pci. Host reconfiguration/reboot should not be required for this VM-to-VM reassignment.": "A GPU host já está vinculada ao vfio-pci. A reconfiguração/reinicialização do host não deve ser necessária para esta reatribuição de VM para VM.",
   "Host IP": "IP do host",
-  "Host Management": "Gestão da Máquina",
+  "Host Management": "Gestão do anfitrião",
   "Host Mount Path": "Caminho de montagem do host",
   "Host NFS/Samba as Proxmox Storage (pvesm)": "Hospedar NFS/Samba como armazenamento Proxmox (pvesm)",
   "Host Path": "Caminho do host",
@@ -2540,7 +2540,7 @@
   "Host already in VFIO mode — skipping host reconfiguration for VM reassignment": "Host já no modo VFIO — ignorando a reconfiguração do host para reatribuição de VM",
   "Host audio devices": "Dispositivos de áudio da máquina",
   "Host backup attached to PVE job": "Backup do host anexado ao trabalho PVE",
-  "Host data is not restored by the backup; confirm it with --acknowledge-external-data": "Os dados da máquina não são restaurados pelo backup; confirme- o com -- acknowledge- external- data",
+  "Host data is not restored by the backup; confirm it with --acknowledge-external-data": "Os dados da máquina não são restaurados pelo backup; confirme-o com --acknowledge-external-data",
   "Host device for /dev/kvm": "Dispositivo de máquina para /dev/kvm",
   "Host device for /dev/net/tun": "Dispositivo de máquina para /dev/net/tun",
   "Host device for /dev/ttyUSB0": "Dispositivo da máquina para /dev/ttyUSB0",
@@ -2793,7 +2793,7 @@
   "Initiator IQN is authorised on the target": "O iniciador IQN está autorizado no alvo",
   "Initiator IQN:": "IQN do iniciador:",
   "Inkscape is professional quality vector graphics software which runs on Linux, Mac OS X and Windows desktop computers.": "Inkscape é um software gráfico vetorial de qualidade profissional que funciona em computadores desktop Linux, Mac OS X e Windows.",
-  "Inside the LXC, create the administrator: console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN": "Dentro do LXC, crie o administrador: console kimai:user:create Your USERNAME Your EMAIL ROLE SUPER ADMIN",
+  "Inside the LXC, create the administrator: console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN": "Dentro do LXC, crie o administrador: console kimai:user:create Your USERNAME Your EMAIL ROLE_SUPER_ADMIN",
   "Inspect disks before any action": "Inspecione os discos antes de qualquer ação",
   "Inspect host device nodes": "Inspecione os nós do dispositivo host",
   "Inspect passthrough/kernel events": "Inspecionar eventos de passagem/kernel",
@@ -3384,7 +3384,7 @@
   "Max user watches configured": "Máximo de visualizações do usuário configuradas",
   "Maximum auto-repair attempts reached (3). Please review the log and run any remaining commands manually.": "Máximo de tentativas de reparo automático atingido (3). Revise o log e execute quaisquer comandos restantes manualmente.",
   "May need to restart terminal": "Pode ser necessário reiniciar o terminal",
-  "Media & Streaming": "& Streaming de Mídia",
+  "Media & Streaming": "Multimédia e streaming",
   "Media discovery and request management for Jellyfin, Plex and Emby.": "Gerenciamento de descoberta e solicitação de mídia para Jellyfin, Plex e Emby.",
   "Media library transcoding and health checking, with an internal worker node.": "Transcodificação da biblioteca de mídia e verificação de saúde, com um nó de trabalhador interno.",
   "Media server": "Servidor de mídia",
@@ -3399,7 +3399,7 @@
   "Memory settings optimized successfully": "Configurações de memória otimizadas com sucesso",
   "Memory:": "Memória:",
   "Memos is a lightweight, self-hosted memo hub. Open Source and Free forever.": "Memos é um hub de memorando leve e auto-hospedado. Código Aberto e Livre para sempre.",
-  "Messaging & Notifications": "Mensagens e Notificações",
+  "Messaging & Notifications": "Mensagens e notificações",
   "Messaging & Queues": "Mensagens & Filas",
   "Messenger for the Decentralized Web": "Mensageiro para a Web Descentralizada",
   "Method:": "Método:",
@@ -3440,7 +3440,7 @@
   "Monitor progress:": "Monitore o progresso:",
   "Monitor, analyze, and alert on network performance.": "Monitorar, analisar e alertar sobre o desempenho da rede.",
   "Monitoring": "Monitoramento",
-  "Monitoring & Analytics": "Monitoramento e Análise",
+  "Monitoring & Analytics": "Monitorização e análise",
   "Most common cause: the archive is corrupted (interrupted write, partial copy, or storage issue).": "Causa mais comum: o arquivo está corrompido (gravação interrompida, cópia parcial ou problema de armazenamento).",
   "Mount Added Successfully:": "Montagem adicionada com sucesso:",
   "Mount CIFS share:": "Monte o compartilhamento CIFS:",
@@ -3649,7 +3649,7 @@
   "NVMe health status: WARNING (critical_warning =": "Status de integridade do NVMe: AVISO (critical_warning =",
   "NVMe skipped (to add as PCIe use 'Add Controller or NVMe PCIe to VM'):": "NVMe ignorado (para adicionar como PCIe, use 'Adicionar controlador ou NVMe PCIe à VM'):",
   "NVMe-specific SMART log": "Registro SMART específico do NVMe",
-  "NVR & Cameras": "Câmeras NVR",
+  "NVR & Cameras": "NVR e câmaras",
   "NVR with optional VA-API video acceleration and hardware object detectors": "NVR com aceleração de vídeo VA-API opcional e detectores de objetos de hardware",
   "NZBGet web interface": "Interface Web NZBGet",
   "Name": "Nome",
@@ -3661,7 +3661,7 @@
   "Name of this wallabag instance, shown in the interface and in 2FA codes": "Nome desta instância wallabag, mostrado na interface e em códigos 2FA",
   "Name or part of the description of the application": "Nome ou parte da descrição do pedido",
   "Name:": "Nome:",
-  "Named accounts need private mode. Stop the container, set public: false in /config/config.js, start it again and create each user with: pct exec <CTID> -- env THELOUNGE_HOME=/config s6-setuidgid abc thelounge add <user>": "Contas nomeadas precisam de modo privado. Pare o contêiner, defina público: false in /config/config.js, inicie-o novamente e crie cada usuário com: pct exec <CTID> -- env THELOUNGE HOME=/config s6-setuidgid abc thelounge add <user>",
+  "Named accounts need private mode. Stop the container, set public: false in /config/config.js, start it again and create each user with: pct exec <CTID> -- env THELOUNGE_HOME=/config s6-setuidgid abc thelounge add <user>": "Contas nomeadas precisam de modo privado. Pare o contêiner, defina público: false in /config/config.js, inicie-o novamente e crie cada usuário com: pct exec <CTID> -- env THELOUNGE_HOME=/config s6-setuidgid abc thelounge add <user>",
   "Neither /etc/kernel/cmdline nor /etc/default/grub found.": "Nem /etc/kernel/cmdline nem /etc/default/grub foram encontrados.",
   "Nesting feature enabled": "Recurso de aninhamento ativado",
   "NetBIOS Service: RUNNING": "Serviço NetBIOS: EM EXECUÇÃO",
@@ -3671,7 +3671,7 @@
   "Netbox is an IP address management (IPAM) and data center infrastructure management (DCIM) tool. Initially conceived by the network engineering team at DigitalOcean, NetBox was developed specifically to address the needs of network and infrastructure engineers. It is intended to function as a domain-specific source of truth for network operations.": "Netbox é uma ferramenta de gerenciamento de endereços IP (IPAM) e gerenciamento de infraestrutura de data center (DCIM). Inicialmente concebido pela equipe de engenharia de rede da DigitalOcean, o NetBox foi desenvolvido especificamente para atender às necessidades dos engenheiros de rede e infraestrutura. Pretende-se funcionar como uma fonte específica de domínio de verdade para a rede operations.",
   "Network": "Rede",
   "Network  :": "Rede  :",
-  "Network & Firewall": "Rede e Firewall",
+  "Network & Firewall": "Rede e firewall",
   "Network (interfaces, DNS)": "Rede (interfaces, DNS)",
   "Network Bridge": "Ponte de rede",
   "Network Commands": "Comandos de rede",
@@ -4042,7 +4042,7 @@
   "OCI containers require Proxmox VE 9.1 or later.": "Os contêineres OCI requerem Proxmox VE 9.1 ou posterior.",
   "OCI management": "Gestão de OCI",
   "OCI management could not be completed. Check the backend status; no additional cleanup has been authorized.": "A gestão do OCI não pôde ser concluída. Verifique o estado da infra- estrutura; nenhuma limpeza adicional foi autorizada.",
-  "OCI manager Apps (beta)": "Apps do gestor de OCI (beta)",
+  "OCI manager Apps (beta)": "OCI manager Apps (beta)",
   "OCI manager Apps is a beta: if something does not work as expected, please report it on GitHub with the application name.": "Gerenciador de OCI Apps é um beta: se algo não funcionar como esperado, por favor, relate no GitHub com o nome da aplicação.",
   "OCI metadata integrity mismatch": "Incompatibilidade da integridade dos metadados OCI",
   "OCI metadata too large": "Metadados OCI demasiado grandes",
@@ -4371,7 +4371,7 @@
   "Postfix configuration": "Configuração Postfix",
   "PostgreSQL": "PostgreSQL",
   "PostgreSQL URL without an associated service:": "URL do PostgreSQL sem um serviço associado:",
-  "PostgreSQL creates the database named in POSTGRES_DB on the first start. The installer default is postgresql.": "PostgreSQL cria o banco de dados nomeado em POSTGRES DB no primeiro início. O instalador do programa é chamado geralmente de postgresql.",
+  "PostgreSQL creates the database named in POSTGRES_DB on the first start. The installer default is postgresql.": "PostgreSQL cria o banco de dados nomeado em POSTGRES_DB no primeiro início. O instalador do programa é chamado geralmente de postgresql.",
   "PostgreSQL is an advanced, enterprise-class, and open-source relational database system. PostgreSQL supports both SQL (relational) and JSON (non-relational) querying.": "PostgreSQL é um sistema de banco de dados relacional avançado, de classe empresarial e de código aberto. O PostgreSQL suporta consultas SQL (relacionais) e JSON (não relacionais).",
   "PostgreSQL requires a password": "PostgreSQL requires uma senha",
   "PostgreSQL volume size in GB": "Tamanho do volume PostgreSQL em GB",
@@ -4534,7 +4534,7 @@
   "Pwndrop is a self-deployable file hosting service for sending out red teaming payloads or securely sharing your private files over HTTP and WebDAV.": "Pwndrop é um serviço de hospedagem de arquivos auto-implantável para enviar cargas de trabalho de equipes vermelhas ou compartilhar seus arquivos privados com segurança por HTTP e WebDAV.",
   "PyCharm offers out-of-the-box support for Python, databases, Jupyter, Git, Conda, PyTorch, TensorFlow, Hugging Face, Django, Flask, FastAPI, and more.": "O PyCharm oferece suporte para Python, bases de dados, Jupyter, Git, Conda, PyTorch, TensorFlow, Hugging Face, Django, Flask, FastAPI e muito mais.",
   "Pydio Cells needs an external MySQL or MariaDB database. The setup wizard asks for its address, database name and user on the first start.": "Pydio Cells precisa de um banco de dados externo MySQL ou MariaDB. O assistente de configuração pede o seu endereço, nome do banco de dados e usuário no primeiro início.",
-  "Pydio Cells redirects to the address given in EXTERNALURL. If the container changes address, edit lxc.environment.runtime: EXTERNALURL and SERVER_IP in /etc/pve/lxc/<CTID>.conf with the container stopped, and delete /config/keys/cert.crt to regenerate the certificate.": "Pydio Cells redireciona para o endereço indicado em EXTERNALURL. Se o recipiente mudar de endereço, edite lxc.environment.runtime: EXTERNALURL e SERVER IP em /etc/pve/lxc/<CTID>.conf com o recipiente parado, e apague /config/keys/cert.crt para regenerar o certificado.",
+  "Pydio Cells redirects to the address given in EXTERNALURL. If the container changes address, edit lxc.environment.runtime: EXTERNALURL and SERVER_IP in /etc/pve/lxc/<CTID>.conf with the container stopped, and delete /config/keys/cert.crt to regenerate the certificate.": "Pydio Cells redireciona para o endereço indicado em EXTERNALURL. Se o recipiente mudar de endereço, edite lxc.environment.runtime: EXTERNALURL e SERVER_IP em /etc/pve/lxc/<CTID>.conf com o recipiente parado, e apague /config/keys/cert.crt para regenerar o certificado.",
   "Pydio-cells is the nextgen file sharing platform for organizations. It is a full rewrite of the Pydio project using the Go language following a micro-service architecture.": "Pydio-cells é a plataforma de compartilhamento de arquivos do nextgen para organizações. É uma reescrita completa do projeto Pydio usando a linguagem Go seguindo uma arquitetura de micro-serviço.",
   "QDirStat Qt-based directory statistics: KDirStat without any KDE -- from the author of the original KDirStat.": "QDirStat Estatísticas de pastas baseadas em Qt: KDirStat sem qualquer KDE -- do autor do KDirStat original.",
   "Quick health check (PASSED / FAILED)": "Verificação rápida de integridade (APROVADO/FALHA)",
@@ -4679,7 +4679,7 @@
   "Remapped users:": "Usuários remapeados:",
   "Reminder: You must install the QEMU Guest Agent inside the Windows VM": "Lembrete: você deve instalar o agente convidado QEMU dentro da VM do Windows",
   "Remmina is a remote desktop client written in GTK, aiming to be useful for system administrators and travellers, who need to work with lots of remote computers in front of either large or tiny screens. Remmina supports multiple network protocols, in an integrated and consistent user interface. Currently RDP, VNC, SPICE, SSH and EXEC are supported.": "Remmina é um cliente de desktop remoto escrito em GTK, visando ser útil para administradores de sistema e viajantes, que precisam trabalhar com muitos computadores remotos na frente de telas grandes ou minúsculas. Remmina suporta vários protocolos de rede, em uma interface de usuário integrada e consistente. Atualmente RDP, VNC, SPICE, SSH e EXEC são suportados.",
-  "Remote Access & VPN": "Acesso remoto & VPN",
+  "Remote Access & VPN": "Acesso remoto e VPN",
   "Remote dry run completed; no container was created.": "Execução seca remota concluída; nenhum recipiente foi criado.",
   "Remote repository path:": "Caminho do repositório remoto:",
   "Remote server via SSH  (recommended — off-host, dedup across machines)": "Servidor remoto via SSH (recomendado — fora do host, desduplicação entre máquinas)",
@@ -5947,7 +5947,7 @@
   "The imported Compose requests privileged, but the official jlesage/handbrake documentation does not require it; ProxMenux keeps the LXC unprivileged.": "Os pedidos Compose importados são privilegiados, mas a documentação oficial jlesage/handbrake não require-lo; ProxMenux mantém o LXC sem privilégios.",
   "The imported OCI groups are not numeric": "Os grupos OCI importados não são numéricos",
   "The imported OCI user or group is not numeric": "O usuário ou grupo OCI importado não é numérico",
-  "The initial user name and password stay written in /etc/pve/lxc/<CTID>.conf as INIT_USERNAME and INIT_PASSWORD. They can be removed after the first login, with the container stopped.": "O nome de usuário inicial e senha permanecem escritos em /etc/pve/lxc/<CTID>.conf como INIT USERNAME e INIT PASSWORD. Eles podem ser removidos após o primeiro login, com o recipiente parado.",
+  "The initial user name and password stay written in /etc/pve/lxc/<CTID>.conf as INIT_USERNAME and INIT_PASSWORD. They can be removed after the first login, with the container stopped.": "O nome de usuário inicial e senha permanecem escritos em /etc/pve/lxc/<CTID>.conf como INIT_USERNAME e INIT_PASSWORD. Eles podem ser removidos após o primeiro login, com o recipiente parado.",
   "The installation asks which one to use for these paths.": "A instalação pergunta qual usar para estes caminhos.",
   "The installation ended with exit code": "A instalação terminou com o código de saída",
   "The installation requires a server restart to apply changes. Do you want to restart now?": "A instalação requer a reinicialização do servidor para aplicar as alterações. Quer reiniciar agora?",
@@ -6066,7 +6066,7 @@
   "The rootfs is not managed by Proxmox": "O rootfs não é gerido pelo Proxmox",
   "The rootfs is not mounted": "O rootfs não está montado",
   "The same GPU cannot be used by two VMs at the same time.": "A mesma GPU não pode ser usada por duas VMs ao mesmo tempo.",
-  "The same connection can be given as container variables instead of the file: UN_SONARR_0_URL and UN_SONARR_0_API_KEY, or the UN_RADARR_0_ equivalents.": "A mesma conexão pode ser dada como variáveis de container em vez do arquivo: UN SONARR 0 URL e UN SONARR 0 API KEY, ou o UN RADARR 0  equivalentes.",
+  "The same connection can be given as container variables instead of the file: UN_SONARR_0_URL and UN_SONARR_0_API_KEY, or the UN_RADARR_0_ equivalents.": "A mesma conexão pode ser dada como variáveis de container em vez do arquivo: UN_SONARR_0_URL e UN_SONARR_0_API_KEY, ou o UN RADARR 0  equivalentes.",
   "The saved MOTD state is invalid; no changes were made": "O estado MOTD salvo é inválido;nenhuma alteração foi feita",
   "The saved OCI record is incomplete or has an unexpected format.": "O registro OCI salvo está incompleto ou tem um formato inesperado.",
   "The saved projection does not match the native evidence": "A projeção salva não corresponde à evidência nativa",
@@ -6814,7 +6814,7 @@
   "Web interface to manage devices running Tasmota firmware.": "Interface Web para gerenciar dispositivos rodando firmware Tasmota.",
   "WebCord can be summarized as a pack of security and privacy hardenings, Discord features reimplementations, Electron / Chromium / Discord bugs workarounds, stylesheets, internal pages and wrapped https://discord.com page, designed to conform with ToS as much as it is possible (or hide the changes that might violate it from Discord's eyes).": "WebCord pode ser resumido como um pacote de endurecimentos de segurança e privacidade, recursos de discórdia reimplementações, Electron / Chromium / Erros de discórdia workarounds, stylesheets, páginas internas e página envolto https://discord.com, projetado para se conformar com ToS tanto quanto possível (ou ocultar as alterações que podem violá-lo dos olhos da Discord).",
   "Webgrabplus is a multi-site incremental xmltv epg grabber. It collects tv-program guide data from selected tvguide sites for your favourite channels.": "Webgrabplus é um multi-site incremental xmltv epg grabber. Ele coleta dados de guias de tv-programa de sites selecionados para seus canais favoritos.",
-  "Webservers & Proxies": "Servidores Web & Proxies",
+  "Webservers & Proxies": "Servidores web e proxies",
   "Website": "Site",
   "Webstation is a web native emulation focused LXQt desktop based on Ubuntu.": "Webstation é um ambiente de trabalho LXQt baseado no Ubuntu.",
   "Webtop - Alpine, Ubuntu, Fedora, and Arch based containers containing full desktop environments in officially supported flavors accessible via any modern web browser.": "Webtop - Embalagens baseadas em Alpine, Ubuntu, Fedora e Arch contendo ambientes de desktop completos em sabores oficialmente suportados acessíveis através de qualquer navegador moderno.",
@@ -6847,7 +6847,7 @@
   "WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many different circumstances. Initially released for the Linux kernel, it is now cross-platform (Windows, macOS, BSD, iOS, Android) and widely deployable. It is currently under heavy development, but already it might be regarded as the most secure, easiest to use, and simplest VPN solution in the industry.": "WireGuard® é uma VPN extremamente simples, mas rápida e moderna, que utiliza criptografia de última geração. Pretende ser mais rápido, mais simples, mais magro e mais útil do que o IPsec, evitando ao mesmo tempo a enorme dor de cabeça. Pretende ser consideravelmente mais performante do que o OpenVPN. WireGuard é projetado como uma VPN de propósito geral para execução em interfaces incorporadas e super computadores, apto para muitas circunstâncias diferentes. Inicialmente lançado para o kernel Linux, ele agora é multi-plataforma (Windows, macOS, BSD, iOS, Android) e amplamente implantável. Ele está atualmente em desenvolvimento pesado, mas já pode ser considerado como a solução VPN mais segura, mais fácil de usar e mais simples no setor.",
   "Wired NICs in backup missing on target:": "NICs com fio no backup ausentes no destino:",
   "Wireshark is the world’s foremost and widely-used network protocol analyzer. It lets you see what’s happening on your network at a microscopic level and is the de facto (and often de jure) standard across many commercial and non-profit enterprises, government agencies, and educational institutions. Wireshark development thrives thanks to the volunteer contributions of networking experts around the globe and is the continuation of a project started by Gerald Combs in 1998.": "Wireshark é o principal e amplamente utilizado analisador de protocolos de rede do mundo. Ele permite que você veja o que está acontecendo em sua rede em um nível microscópico e é o padrão de fato (e muitas vezes de jure) em muitas empresas comerciais e sem fins lucrativos, agências governamentais e instituições educacionais. O desenvolvimento do Wireshark prospera graças às contribuições voluntárias de especialistas em redes em todo o mundo e é a continuação de um projeto iniciado por Gerald Combs em 1998.",
-  "With dns validation, the DNSPLUGIN variable names the provider plugin. The advanced installation asks for it; otherwise add the line lxc.environment.runtime: DNSPLUGIN=<plugin> to /etc/pve/lxc/<CTID>.conf with the container stopped.": "Com validação dns, as variáveis DNSPLUGIN nomeiam o plugin provedor. A instalação avançada pede; caso contrário, adicione a linha lxc.environment. tempo de execução: DNSPLUGIN=<plugin> para /etc/pve/lxc/<CTID>.conf com o recipiente parado.",
+  "With dns validation, the DNSPLUGIN variable names the provider plugin. The advanced installation asks for it; otherwise add the line lxc.environment.runtime: DNSPLUGIN=<plugin> to /etc/pve/lxc/<CTID>.conf with the container stopped.": "Com validação dns, as variáveis DNSPLUGIN nomeiam o plugin provedor. A instalação avançada pede; caso contrário, adicione a linha lxc.environment.runtime: DNSPLUGIN=<plugin> ao /etc/pve/lxc/<CTID>.conf com o recipiente parado.",
   "With dns validation, write the provider credentials in /config/dns-conf/<plugin>.ini inside the container and restart it.": "Com validação dns, escreva o provedor credentials em /config/dns-conf/<plugin>.ini dentro do recipiente e reinicie-o.",
   "With http validation, port 80 of the router must be forwarded to port 80 of this container.": "Com a validação http, a porta 80 do roteador deve ser encaminhada para a porta 80 deste recipiente.",
   "With warnings": "Com avisos",
diff --git a/lang/sk.json b/lang/sk.json
index ae5d3fca..489aaada 100644
--- a/lang/sk.json
+++ b/lang/sk.json
@@ -120,7 +120,7 @@
   "ACL Status:": "Stav ACL:",
   "ACL permissions applied for local access for user:": "ACL oprávnenia boli nastavené pre lokálny prístup používateľa:",
   "ADVANCED SETTINGS COMPLETE": "POKROČILÉ NASTAVENIA SÚ HOTOVÉ",
-  "AI / Coding & Dev-Tools": "AI / Coding & Dev-Tools",
+  "AI / Coding & Dev-Tools": "AI, programovanie a vývoj",
   "ALL DATA ON": "VŠETKY DÁTA NA",
   "ALL DATA ON THIS DISK WILL BE PERMANENTLY LOST!": "VŠETKY DÁTA NA TOMTO DISKU BUDÚ NATRVALO STRATENÉ!",
   "ALL Utilities": "VŠETKY nástroje",
@@ -185,7 +185,7 @@
   "Actual device path on the host": "Skutočná dráha zariadenia na hostiteľovi",
   "Adaptation file too large": "Adaptačný súbor príliš veľký",
   "Adaptation file with unexpected permissions or owner": "Adaptačný súbor s neočakávanými oprávneniami alebo majiteľom",
-  "Adblock & DNS": "Adblock & DNS",
+  "Adblock & DNS": "Adblock a DNS",
   "Add Audio Passthrough": "Pridať audio passthrough",
   "Add CIFS storage:": "Pridať CIFS úložisko:",
   "Add Controller or NVMe (PCI passthrough)": "Pridať radič alebo NVMe (priame priradenie cez PCI)",
@@ -317,7 +317,7 @@
   "Already Mounted": "Už je pripojené",
   "Already configured": "Už nastavené",
   "Already installed — skipping": "Už nainštalované - preskakujem",
-  "Also add the /dev/srX optical device (recommended)": "Tiež pridať /dev / srX optické zariadenie (odporúčané)",
+  "Also add the /dev/srX optical device (recommended)": "Tiež pridať /dev/srX optické zariadenie (odporúčané)",
   "Also comment any remaining 'bookworm' entries in *.list if present.": "Zakomentujte aj všetky zostávajúce položky 'bookworm' v *.list, ak existujú.",
   "Also install the VirtIO network driver during setup to enable network access.": "Počas inštalácie nainštalujte aj sieťový ovládač VirtIO, aby fungoval prístup k sieti.",
   "Although VFIO can bind to this device, full passthrough to a VM is": "Aj keď sa VFIO vie na toto zariadenie naviazať, úplný passthrough do VM je",
@@ -439,7 +439,7 @@
   "Auth key is required.": "Auth key je povinný.",
   "Auth:": "Prihlásenie:",
   "Authentication": "Prihlásenie",
-  "Authentication & Security": "Overenie a bezpečnosť",
+  "Authentication & Security": "Overovanie a zabezpečenie",
   "Authentication Error": "Chyba prihlásenia",
   "Authentication failed.": "Prihlásenie zlyhalo.",
   "Authentication required:": "Vyžaduje prihlásenie:",
@@ -500,7 +500,7 @@
   "Backend:": "Backend:",
   "Background archive extraction for Arr download queues. No web interface.": "Extrakcia archívu pozadia pre Arr download fronty. Žiadne webové rozhranie.",
   "Backup            — VM and CT backups": "Backup            — zálohy VM a CT",
-  "Backup & Recovery": "Záloha a obnova",
+  "Backup & Recovery": "Zálohovanie a obnova",
   "Backup Created": "Záloha bola vytvorená",
   "Backup ID (group name in PBS):": "ID zálohy (názov skupiny v PBS):",
   "Backup ID for this job:": "ID zálohy pre túto úlohu:",
@@ -607,7 +607,7 @@
   "Build and install the gasket and apex kernel modules (DKMS)": "Zostaví a nainštaluje kernel moduly gasket a apex (DKMS)",
   "Build dependencies installed.": "Závislosti na zostavenie boli nainštalované.",
   "Build your personal knowledge base with TriliumNext Notes": "Budujte si osobné znalosti základne s TriliumNext Poznámky",
-  "Business & ERP": "Obchod a ERP",
+  "Business & ERP": "Biznis a ERP",
   "CHANGES APPLIED SUCCESSFULLY": "ZMENY BOLI ÚSPEŠNE POUŽITÉ",
   "CIFS Client Tools: AVAILABLE": "Nástroje CIFS klienta: DOSTUPNÉ",
   "CIFS Client Tools: NOT AVAILABLE - installing...": "Nástroje CIFS klienta: NEDOSTUPNÉ - inštalujem...",
@@ -869,7 +869,7 @@
   "Commenting legacy ceph.list (if present)...": "Komentujem starý ceph.list (ak existuje)...",
   "Common Issues Check": "Kontrola bežných problémov",
   "Common root for the published views": "Spoločný koreň uverejnených názorov",
-  "Communication & Community": "Komunikácia a Spoločenstvo",
+  "Communication & Community": "Komunikácia a komunita",
   "Community Scripts": "Komunitné skripty",
   "Community single-container Home Assistant OS image": "Jednoduchý kontajner Spoločenstva Home Assistant OS image",
   "Compatibility check": "Kontrola kompatibility",
@@ -1142,7 +1142,7 @@
   "Converts to deb822; keeps .list backups as .bak": "Prevedie na deb822; zálohy .list ponechá ako .bak",
   "Coordinated backups require zstd": "Koordinované zálohy require zstd",
   "Cops by Sébastien Lucas, now maintained by MikesPub, stands for Calibre OPDS (and HTML) Php Server.": "Cops by Sébastien Lucas, teraz udržiavané MikesPub, znamená Calibre OPDS (a HTML) Php Server.",
-  "Copy a peer configuration to the host with: pct pull <CTID> /config/peer1/peer1.conf peer1.conf": "Kopírovať konfiguráciu peer k hostiteľovi s: pct pull < CTID > /config/peer1/peer1.conf peer1.conf",
+  "Copy a peer configuration to the host with: pct pull <CTID> /config/peer1/peer1.conf peer1.conf": "Kopírovať konfiguráciu peer k hostiteľovi s: pct pull <CTID> /config/peer1/peer1.conf peer1.conf",
   "Copy failed": "Kopírovanie zlyhalo",
   "Copy that file offsite yourself, or download it from the Monitor.": "Skopírujte si tento súbor mimo servera sami alebo ho stiahnite z Monitoru.",
   "Copy the correct keyfile to this host and rerun Restore — or pick an unencrypted backup.": "Skopírujte správny keyfile na tento host a spustite obnovu znova - alebo vyberte nešifrovanú zálohu.",
@@ -1157,7 +1157,7 @@
   "Coral M.2 Apex configuration added - device ready": "Nastavenie Coral M.2 Apex bolo pridané - zariadenie je pripravené",
   "Coral M.2 Apex configuration added - device will be available after reboot": "Nastavenie Coral M.2 Apex bolo pridané - zariadenie bude dostupné po reštarte",
   "Coral M.2 Apex detected, configuring...": "Našiel sa Coral M.2 Apex, nastavujem...",
-  "Coral PCIe/M.2 node (e.g. /dev/apex_0)": "Coral PCIe/M.2 uzly (napr. /dev/apex 0)",
+  "Coral PCIe/M.2 node (e.g. /dev/apex_0)": "Coral PCIe/M.2 uzly (napr. /dev/apex_0)",
   "Coral TPU Installation": "Inštalácia Coral TPU",
   "Coral TPU Uninstall": "Odinštalovanie Coral TPU",
   "Coral TPU device nodes detected with correct group (apex).": "Uzly zariadenia Coral TPU sa našli so správnou skupinou (apex).",
@@ -1345,7 +1345,7 @@
   "Creating the container...": "Vytváram kontajner...",
   "Creating the initial administrator...": "Vytvorenie počiatočného správcu...",
   "Creating the temporary data container": "Vytvorenie dočasného dátového kontajnera",
-  "Creative & Design": "Creative & Design",
+  "Creative & Design": "Kreativita a dizajn",
   "Credentials are correct": "Prihlasovacie údaje sú správne",
   "Credentials cleared. jwt_secret and API tokens preserved.": "Prihlasovacie údaje sú vymazané. jwt_secret a API tokeny zostali zachované.",
   "Credentials file created securely.": "Súbor s prihlasovacími údajmi bol bezpečne vytvorený.",
@@ -1731,7 +1731,7 @@
   "Dry run completed; the container and the mounts were not changed.": "Suchý chod dokončený; kontajner a držiaky neboli zmenené.",
   "DuckDNS subdomain without .duckdns.org (comma separated for several)": "DuckDNS subdoména bez .duckdns.org (koma oddelené pre niekoľko)",
   "DuckDNS token from your account at duckdns.org": "DuckDNS token z vášho účtu na duckdns.org",
-  "DuckDNS updates the subdomain every 5 minutes. Without UPDATE_IP, DuckDNS itself detects the public IPv4 address of the request.": "DuckDNS aktualizuje subdoménu každých 5 minút. Bez UPDATE IP samotná DuckDNS detekuje verejnú IPv4 adresu žiadosti.",
+  "DuckDNS updates the subdomain every 5 minutes. Without UPDATE_IP, DuckDNS itself detects the public IPv4 address of the request.": "DuckDNS aktualizuje subdoménu každých 5 minút. Bez UPDATE_IP samotná DuckDNS detekuje verejnú IPv4 adresu žiadosti.",
   "DuckStation is a PS1 Emulator aiming for the best accuracy and game support.": "DuckStation je PS1 Emulátor zameraný na najlepšie accuracy a hernú podporu.",
   "Duckdns is a free service which will point a DNS (sub domains of duckdns.org) to an IP of your choice. The service is completely free, and doesn't require reactivation or forum posts to maintain its existence.": "Duckdns je bezplatná služba, ktorá bude ukazovať DNS (pod domény duckdns.org) na IP podľa vášho výberu. Služba je úplne zadarmo, a nie je require reaktivácia alebo fóra príspevky udržať jeho existenciu.",
   "Dumping AMD GPU ROM BIOS via sysfs...": "Vytváram dump AMD GPU ROM BIOS cez sysfs...",
@@ -2230,7 +2230,7 @@
   "FileBrowser Quantum": "FileBrowser Quantum",
   "FileBrowser Quantum (new installation)": "FileBrowser Quantum (nová inštalácia)",
   "FileDrop is a free, open source file sharing service": "FileDrop je bezplatná služba zdieľania súborov s otvoreným zdrojom",
-  "Files & Downloads": "Súbory a sťahovania",
+  "Files & Downloads": "Súbory a sťahovanie",
   "Files volume size in GB": "Veľkosť hlasitosti súborov v GB",
   "Filesystem": "Súborový systém",
   "Filesystem Tools Required": "Sú potrebné nástroje pre súborový systém",
@@ -2239,7 +2239,7 @@
   "Final cleanup of the stack operation completed": "Konečné vyčistenie stohu operation dokončené",
   "Final confirmation": "Posledné potvrdenie",
   "Final storage health/status check": "Záverečná kontrola stavu úložiska",
-  "Finance & Budgeting": "Finance & Budgeting",
+  "Finance & Budgeting": "Financie a rozpočet",
   "Find your device using https://finds.synology.com": "Zariadenie nájdete cez https://finds.synology.com",
   "Fingerprint:": "Odtlačok:",
   "Firefly, the easiest using of WireGuard VPN server, plus version of wg-easy.": "Firefly, najjednoduchšie používanie WireGuard VPN servera, plus verzia wg-ľahké.",
@@ -2386,7 +2386,7 @@
   "GRUB_CMDLINE_LINUX_DEFAULT not found in GRUB config": "GRUB_CMDLINE_LINUX_DEFAULT sa v nastavení GRUB nenašlo",
   "GUI mode (if available)": "Grafický režim (ak je dostupný)",
   "GZDoom is a feature centric port for all Doom engine games, based on ZDoom, adding an OpenGL renderer and powerful scripting capabilities.": "GZDoom je funkcia centrický port pre všetky hry Doom motora, založené na ZDoom, pridanie OpenGL kresbu a mocné skriptovanie schopnosti.",
-  "Gaming & Leisure": "Herné a leisure",
+  "Gaming & Leisure": "Hry a voľný čas",
   "Gateway is not installed.": "Brána nie je nainštalovaná.",
   "Gateway removed.": "Brána odstránená.",
   "Gateway restarted.": "Brána reštartovaná.",
@@ -2526,7 +2526,7 @@
   "Host GPU detected": "Na hoste sa našla GPU",
   "Host GPU is already bound to vfio-pci. Host reconfiguration/reboot should not be required for this VM-to-VM reassignment.": "GPU na hostovi už je naviazaná na vfio-pci. Pri tomto presune VM-to-VM by nemalo byť potrebné meniť hosta ani reštartovať.",
   "Host IP": "IP hosta",
-  "Host Management": "Správa hostiteľov",
+  "Host Management": "Správa hostiteľa",
   "Host Mount Path": "Cesta mountu na hostovi",
   "Host NFS/Samba as Proxmox Storage (pvesm)": "Host NFS/Samba ako úložisko Proxmoxu (pvesm)",
   "Host Path": "Cesta na hostovi",
@@ -2540,7 +2540,7 @@
   "Host already in VFIO mode — skipping host reconfiguration for VM reassignment": "Host už je vo VFIO režime - zmena hosta sa pri presune medzi VM preskakuje",
   "Host audio devices": "Hostiteľské audio zariadenia",
   "Host backup attached to PVE job": "Záloha hosta bola pripojená k PVE úlohe",
-  "Host data is not restored by the backup; confirm it with --acknowledge-external-data": "Údaje o hostiteľovi nie sú obnovené zálohou; potvrďte ich -- acnown-external-data",
+  "Host data is not restored by the backup; confirm it with --acknowledge-external-data": "Hostiteľské dáta nie sú obnovené zálohou; potvrďte to pomocou --acknowledge-external-data",
   "Host device for /dev/kvm": "Hostiteľské zariadenie pre /dev/kvm",
   "Host device for /dev/net/tun": "Hostiteľské zariadenie pre /dev/net/tun",
   "Host device for /dev/ttyUSB0": "Hostiteľské zariadenie pre /dev/ttyUSB0",
@@ -2793,7 +2793,7 @@
   "Initiator IQN is authorised on the target": "IQN iniciátora je na targete povolené",
   "Initiator IQN:": "IQN iniciátora:",
   "Inkscape is professional quality vector graphics software which runs on Linux, Mac OS X and Windows desktop computers.": "Inkscape je profesionálne kvalitný vektorový grafický softvér, ktorý beží na počítačoch Linux, Mac OS X a Windows.",
-  "Inside the LXC, create the administrator: console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN": "Vnútri LXC, vytvoriť administrátor: konzola kimai:používateľ:vytvorte VAŠE VYUŽITE VAŠE EMAIL ROLE SUPER ADMIN",
+  "Inside the LXC, create the administrator: console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN": "Vnútri LXC, vytvoriť administrátor: konzola kimai:používateľ:vytvorte VAŠE VYUŽITE VAŠE EMAIL ROLE_SUPER_ADMIN",
   "Inspect disks before any action": "Skontrolovať disky pred akoukoľvek akciou",
   "Inspect host device nodes": "Skontrolovať device nodes na hostovi",
   "Inspect passthrough/kernel events": "Skontrolovať passthrough/kernel udalosti",
@@ -3240,7 +3240,7 @@
   "Limiting size and optimizing journald": "Obmedzujem veľkosť a optimalizujem journald",
   "Limiting size and optimizing journald...": "Obmedzujem veľkosť a optimalizujem journald...",
   "Limnoria A robust, full-featured, and user/programmer-friendly Python IRC bot, with many existing plugins. Successor of the well-known Supybot.": "Limnoria Robustný, full-featured, a užívateľsky / programátor-friendly Python IRC robot, s mnohými existujúcimi modulmi. Nástupca známeho Supybota.",
-  "Limnoria joins no IRC network until its configuration file exists. Create it with the setup wizard from the Proxmox host: pct exec <CTID> -- bash -c 'cd /config && limnoria-wizard'": "Limnoria sa pripája k žiadnej sieti IRC, kým neexistuje jej konfiguračný súbor. Vytvorte ho pomocou sprievodcu nastavením z Proxmox hostiteľa: pct exec <CTID > -- bash -c 'cd /config && limnoria-wizard'",
+  "Limnoria joins no IRC network until its configuration file exists. Create it with the setup wizard from the Proxmox host: pct exec <CTID> -- bash -c 'cd /config && limnoria-wizard'": "Limnoria sa pripája k žiadnej sieti IRC, kým neexistuje jej konfiguračný súbor. Vytvorte ho pomocou sprievodcu nastavením z Proxmox hostiteľa: pct exec <CTID> -- bash -c 'cd /config && limnoria-wizard'",
   "Line to paste (single line, including \"command=...\" prefix):": "Riadok na vloženie (jeden riadok vrátane predpony \"command=...\"):",
   "Linux Installation Options": "Možnosti inštalácie Linuxu",
   "Linux/Mac path:": "Cesta pre Linux/Mac:",
@@ -3384,7 +3384,7 @@
   "Max user watches configured": "Maximálny počet user watches je nastavený",
   "Maximum auto-repair attempts reached (3). Please review the log and run any remaining commands manually.": "Bol dosiahnutý maximálny počet automatických opráv (3). Skontrolujte záznam a zostávajúce príkazy spustite ručne.",
   "May need to restart terminal": "Možno bude potrebné reštartovať terminál",
-  "Media & Streaming": "Media & Streaming",
+  "Media & Streaming": "Médiá a streaming",
   "Media discovery and request management for Jellyfin, Plex and Emby.": "Mediálny prieskum a správa požiadaviek pre Jellyfin, Plex a Emby.",
   "Media library transcoding and health checking, with an internal worker node.": "Média knižnica transkódovanie a zdravotná kontrola, s interným uzol pracovníka.",
   "Media server": "Mediálny server",
@@ -3649,7 +3649,7 @@
   "NVMe health status: WARNING (critical_warning =": "Stav NVMe: UPOZORNENIE (critical_warning =",
   "NVMe skipped (to add as PCIe use 'Add Controller or NVMe PCIe to VM'):": "NVMe preskočené (ak ho chcete pridať ako PCIe, použite 'Pridať radič alebo NVMe PCIe do VM'):",
   "NVMe-specific SMART log": "SMART záznam špecifický pre NVMe",
-  "NVR & Cameras": "NVR & kamery",
+  "NVR & Cameras": "NVR a kamery",
   "NVR with optional VA-API video acceleration and hardware object detectors": "NVR s voliteľným video zrýchlením VA-API a detektormi hardvérových objektov",
   "NZBGet web interface": "Webové rozhranie NZBGet",
   "Name": "Názov",
@@ -3661,7 +3661,7 @@
   "Name of this wallabag instance, shown in the interface and in 2FA codes": "Názov tejto inštancie wallabag, zobrazený v rozhraní a v kódoch 2FA",
   "Name or part of the description of the application": "Názov alebo časť opisu žiadosti",
   "Name:": "Názov:",
-  "Named accounts need private mode. Stop the container, set public: false in /config/config.js, start it again and create each user with: pct exec <CTID> -- env THELOUNGE_HOME=/config s6-setuidgid abc thelounge add <user>": "Menované účty potrebujú súkromný režim. Zastaviť kontajner, nastaviť verejnosť: false in /config/config.js, začať znova a vytvoriť každého užívateľa s: pct exec < CTID> -- env THELOUNGE HOME=/config s6-setuid abc thelounge pridať <user >",
+  "Named accounts need private mode. Stop the container, set public: false in /config/config.js, start it again and create each user with: pct exec <CTID> -- env THELOUNGE_HOME=/config s6-setuidgid abc thelounge add <user>": "Menované účty potrebujú súkromný režim. Zastaviť kontajner, nastaviť verejnosť: false in /config/config.js, začať znova a vytvoriť každého užívateľa s: pct exec <CTID> -- env THELOUNGE_HOME=/config s6-setuid abc thelounge pridať <user>",
   "Neither /etc/kernel/cmdline nor /etc/default/grub found.": "Nenašiel sa /etc/kernel/cmdline ani /etc/default/grub.",
   "Nesting feature enabled": "Funkcia nesting bola zapnutá",
   "NetBIOS Service: RUNNING": "Služba NetBIOS: BEŽÍ",
@@ -3671,7 +3671,7 @@
   "Netbox is an IP address management (IPAM) and data center infrastructure management (DCIM) tool. Initially conceived by the network engineering team at DigitalOcean, NetBox was developed specifically to address the needs of network and infrastructure engineers. It is intended to function as a domain-specific source of truth for network operations.": "Netbox je nástroj riadenia IP adresy (IPAM) a riadenia infraštruktúry dátových centier (DCIM). Pôvodne koncipovaný sieťovým tímom v DigitalOcean, bol NetBox vyvinutý špeciálne pre potreby sieťových a infraštruktúrnych inžinierov. Je určený na fungovanie ako doménový špecifický zdroj pravdy pre siete operations.",
   "Network": "Sieť",
   "Network  :": "Sieť  :",
-  "Network & Firewall": "Sieťový & firewall",
+  "Network & Firewall": "Sieť a firewall",
   "Network (interfaces, DNS)": "Sieť (rozhrania, DNS)",
   "Network Bridge": "Sieťový bridge",
   "Network Commands": "Sieťové príkazy",
@@ -4042,7 +4042,7 @@
   "OCI containers require Proxmox VE 9.1 or later.": "OCI kontajnery vyžadujú Proxmox VE 9.1 alebo novší.",
   "OCI management": "Riadenie OCI",
   "OCI management could not be completed. Check the backend status; no additional cleanup has been authorized.": "Riadenie OCI nebolo možné dokončiť. Skontrolujte stav backendu; žiadne dodatočné vyčistenie nebolo povolené.",
-  "OCI manager Apps (beta)": "Aplikácie pre správcu OCI (beta)",
+  "OCI manager Apps (beta)": "OCI manager Apps (beta)",
   "OCI manager Apps is a beta: if something does not work as expected, please report it on GitHub with the application name.": "OCI manažér Apps je beta: ak niečo nefunguje tak, ako sa očakávalo, nahláste to na GitHub s názvom aplikácie.",
   "OCI metadata integrity mismatch": "Nepomer integrity metaúdajov OCI",
   "OCI metadata too large": "Metaúdaje OCI príliš veľké",
@@ -4371,7 +4371,7 @@
   "Postfix configuration": "Nastavenie Postfixu",
   "PostgreSQL": "PostgreSQL",
   "PostgreSQL URL without an associated service:": "PostgreSQL URL bez súvisiacej služby:",
-  "PostgreSQL creates the database named in POSTGRES_DB on the first start. The installer default is postgresql.": "PostgreSQL vytvára databázu pomenovanú v POSTGRES DB na prvom začiatku. Štandardný inštalátor je postgresql.",
+  "PostgreSQL creates the database named in POSTGRES_DB on the first start. The installer default is postgresql.": "PostgreSQL vytvára databázu pomenovanú v POSTGRES_DB na prvom začiatku. Štandardný inštalátor je postgresql.",
   "PostgreSQL is an advanced, enterprise-class, and open-source relational database system. PostgreSQL supports both SQL (relational) and JSON (non-relational) querying.": "PostgreSQL je moderný, podnikový a open-source relačný databázový systém. PostgreSQL podporuje ako SQL (relatívne) tak JSON (nerelatívne) dotazovanie.",
   "PostgreSQL requires a password": "PostgreSQL requires heslo",
   "PostgreSQL volume size in GB": "PostgreSQL veľkosť objemu v GB",
@@ -4453,7 +4453,7 @@
   "Process may take several minutes depending on container size": "Proces môže trvať niekoľko minút podľa veľkosti kontajnera",
   "Process may take several minutes for large containers": "Pri veľkých kontajneroch môže proces trvať niekoľko minút",
   "Processes using NVIDIA:": "Procesy používajúce NVIDIA:",
-  "Productivity & Workflows": "Produktivita a pracovné toky",
+  "Productivity & Workflows": "Produktivita a pracovné postupy",
   "Profile": "Profil",
   "Profile:": "Profil:",
   "Projectsend is a self-hosted application that lets you upload files and assign them to specific clients that you create yourself. Secure, private and easy. No more depending on external services or e-mail to send those files.": "Projectsend je aplikácia self-hosted, ktorá vám umožní nahrávať súbory a priradiť ich konkrétnym klientom, ktoré vytvoríte sami. Bezpečné, súkromné a jednoduché. Už nie je závislá od externých služieb alebo e-mailu, ktorý by tieto súbory posielal.",
@@ -4534,7 +4534,7 @@
   "Pwndrop is a self-deployable file hosting service for sending out red teaming payloads or securely sharing your private files over HTTP and WebDAV.": "Pwndrop je samozamestnávateľná serverová hostingová služba pre odosielanie červeného spojovacieho užitočného zaťaženia alebo bezpečné zdieľanie vašich súkromných súborov cez HTTP a WebDAV.",
   "PyCharm offers out-of-the-box support for Python, databases, Jupyter, Git, Conda, PyTorch, TensorFlow, Hugging Face, Django, Flask, FastAPI, and more.": "PyCharm ponúka mimo-of-the-box podporu pre Python, databázy, Jupyter, Git, Conda, PyTorch, TensorFlow, Hugging Face, Django, Flask, FastAPI a ďalšie.",
   "Pydio Cells needs an external MySQL or MariaDB database. The setup wizard asks for its address, database name and user on the first start.": "Pydio Cells potrebuje externú MySQL alebo MariaDB databázu. Sprievodca nastavením žiada o svoju adresu, meno databázy a užívateľa pri prvom štarte.",
-  "Pydio Cells redirects to the address given in EXTERNALURL. If the container changes address, edit lxc.environment.runtime: EXTERNALURL and SERVER_IP in /etc/pve/lxc/<CTID>.conf with the container stopped, and delete /config/keys/cert.crt to regenerate the certificate.": "Pydio Cells presmeruje na adresu uvedenú v EXTERNURL. Ak kontajner zmení adresu, upravte lxc.environment.runtime: EXTERNURL a SERVER IP v /etc/pve/lxc/<CTID>.conf s kontajnerom zastavil, a odstráňte /config/keys/cert.crt pre regeneráciu certifikátu.",
+  "Pydio Cells redirects to the address given in EXTERNALURL. If the container changes address, edit lxc.environment.runtime: EXTERNALURL and SERVER_IP in /etc/pve/lxc/<CTID>.conf with the container stopped, and delete /config/keys/cert.crt to regenerate the certificate.": "Pydio Cells presmeruje na adresu uvedenú v EXTERNURL. Ak kontajner zmení adresu, upravte lxc.environment.runtime: EXTERNURL a SERVER_IP v /etc/pve/lxc/<CTID>.conf s kontajnerom zastavil, a odstráňte /config/keys/cert.crt pre regeneráciu certifikátu.",
   "Pydio-cells is the nextgen file sharing platform for organizations. It is a full rewrite of the Pydio project using the Go language following a micro-service architecture.": "Pydio-bunky je platforma pre zdieľanie súborov pre organizácie. Je to úplný prepis projektu Pydio pomocou jazyka Go podľa architektúry mikroslužieb.",
   "QDirStat Qt-based directory statistics: KDirStat without any KDE -- from the author of the original KDirStat.": "QDirStat Štatistika adresára založená na Qt: KDirStat bez KDE -- od autora pôvodného KDirStat.",
   "Quick health check (PASSED / FAILED)": "Rýchla kontrola stavu (PASSED / FAILED)",
@@ -5386,7 +5386,7 @@
   "Show size of a directory": "Zobraziť veľkosť priečinka",
   "Show standard exclude patterns": "Zobraziť štandardné vylučovacie vzory",
   "Show status of all storage pools": "Zobraziť stav všetkých úložísk",
-  "Show the QR code of a peer again with: pct exec <CTID> -- /app/show-peer 1": "Zobraziť QR kód peera znovu s: pct exec < CTID > -- /app/show-peer 1",
+  "Show the QR code of a peer again with: pct exec <CTID> -- /app/show-peer 1": "Zobraziť QR kód peera znovu s: pct exec <CTID> -- /app/show-peer 1",
   "Show traffic statistics per interface": "Zobraziť štatistiky prenosu podľa rozhrania",
   "Show vzdump backup configuration": "Zobraziť nastavenie vzdump záloh",
   "Shows status and type (nfs/cifs/dir/iscsi...).": "Zobrazí stav a typ (nfs/cifs/dir/iscsi...).",
@@ -5711,7 +5711,6 @@
   "Thank you for using ProxMenux. Goodbye!": "Ďakujeme, že používate ProxMenux. Dovidenia!",
   "That VM is currently stopped, so the GPU can be reassigned now.": "Tá VM je momentálne zastavená, takže GPU sa teraz dá presunúť.",
   "That doesn't look like an SSH private key. Pick the private key file (no .pub extension, parseable by ssh-keygen).": "Toto nevyzerá ako súkromný SSH kľúč. Vyberte súbor súkromného kľúča (bez prípony .pub, čitateľný cez ssh-keygen).",
-  "The .conf files under /config/fail2ban are rewritten on every start. Keep customizations in the matching .local file, for example jail.local for jail.conf.": "Súbory .conf pod /config/fail2ban sú prepísané na každom začiatku. Udržujte prispôsobenie v zodpovedajúcom .lokálnom súbore, napríklad vo väzení.lokálne pre väzenie.conf.",
   "The AppArmor/seccomp relaxation does not include the required consent": "AppArmor/seccomp relaxácia nezahŕňa súhlas required",
   "The Bookmark Everything App": "Záložka Všetko App",
   "The Brave browser is a fast, private and secure web browser for PC, Mac and mobile.": "Prehliadač Brave je rýchly, súkromný a bezpečný webový prehliadač pre PC, Mac a mobil.",
@@ -5947,7 +5946,7 @@
   "The imported Compose requests privileged, but the official jlesage/handbrake documentation does not require it; ProxMenux keeps the LXC unprivileged.": "Dovážané kompozície žiadosti privilegované, ale oficiálna jlesage/handbrake dokumentácia nie je require to; ProxMenux udržuje LXC neprivilegované.",
   "The imported OCI groups are not numeric": "Dovezené skupiny OCI nie sú číselné",
   "The imported OCI user or group is not numeric": "Dovážaný užívateľ alebo skupina OCI nie je numerická",
-  "The initial user name and password stay written in /etc/pve/lxc/<CTID>.conf as INIT_USERNAME and INIT_PASSWORD. They can be removed after the first login, with the container stopped.": "Počiatočné užívateľské meno a heslo zostávajú zapísané v /etc/pve/lxc/<CTID>.conf ako INIT USERNAME a INIT PASSWORD. Môžu byť odstránené po prvom prihlásení, pričom kontajner sa zastaví.",
+  "The initial user name and password stay written in /etc/pve/lxc/<CTID>.conf as INIT_USERNAME and INIT_PASSWORD. They can be removed after the first login, with the container stopped.": "Počiatočné užívateľské meno a heslo zostávajú zapísané v /etc/pve/lxc/<CTID>.conf ako INIT_USERNAME a INIT_PASSWORD. Môžu byť odstránené po prvom prihlásení, pričom kontajner sa zastaví.",
   "The installation asks which one to use for these paths.": "Inštalácia žiada, ktorý z nich sa má použiť pre tieto cesty.",
   "The installation ended with exit code": "Inštalácia skončila kódom výstupu",
   "The installation requires a server restart to apply changes. Do you want to restart now?": "Na použitie zmien je po inštalácii potrebný reštart servera. Chcete reštartovať teraz?",
@@ -6066,7 +6065,7 @@
   "The rootfs is not managed by Proxmox": "Rootfs nie je riadený Proxmox",
   "The rootfs is not mounted": "Korene nie sú namontované",
   "The same GPU cannot be used by two VMs at the same time.": "Rovnakú GPU nemôžu používať dve VM naraz.",
-  "The same connection can be given as container variables instead of the file: UN_SONARR_0_URL and UN_SONARR_0_API_KEY, or the UN_RADARR_0_ equivalents.": "Rovnaké spojenie možno uviesť ako kontajnerové premenné namiesto súboru: UN SONARR 0 URL a UN SONARR 0 API KEY, alebo UN RADARR 0  equivalents.",
+  "The same connection can be given as container variables instead of the file: UN_SONARR_0_URL and UN_SONARR_0_API_KEY, or the UN_RADARR_0_ equivalents.": "Rovnaké spojenie možno uviesť ako kontajnerové premenné namiesto súboru: UN_SONARR_0_URL a UN_SONARR_0_API_KEY, alebo UN RADARR 0  equivalents.",
   "The saved MOTD state is invalid; no changes were made": "Uložený stav MOTD je neplatný;neboli vykonané žiadne zmeny",
   "The saved OCI record is incomplete or has an unexpected format.": "Uložený záznam OCI je neúplný alebo má neočakávaný formát.",
   "The saved projection does not match the native evidence": "Uložená projekcia nezodpovedá natívnemu dôkazu",
@@ -6814,7 +6813,7 @@
   "Web interface to manage devices running Tasmota firmware.": "Webové rozhranie pre správu zariadení bežiacich na Tasmota firmware.",
   "WebCord can be summarized as a pack of security and privacy hardenings, Discord features reimplementations, Electron / Chromium / Discord bugs workarounds, stylesheets, internal pages and wrapped https://discord.com page, designed to conform with ToS as much as it is possible (or hide the changes that might violate it from Discord's eyes).": "WebCord možno zhrnúť ako balík bezpečnostných a súkromia kalenie, Discord funkcie reimplementácie, Electron / Chromium / Discord chyby práce, štýlové listy, vnútorné stránky a zabalené https://discord.com stránky, navrhnutý tak, aby zodpovedali ToS tak, ako je to možné (alebo skryť zmeny, ktoré by mohli porušovať z očí Discord).",
   "Webgrabplus is a multi-site incremental xmltv epg grabber. It collects tv-program guide data from selected tvguide sites for your favourite channels.": "Webgrabplus je multi-site prírastkové xmltv epg grabber. Zhromažďuje tv-program sprievodcu dátami z vybraných tvguide stránok pre vaše obľúbené kanály.",
-  "Webservers & Proxies": "Webservers a Proxies",
+  "Webservers & Proxies": "Webové servery a proxy",
   "Website": "Webová stránka",
   "Webstation is a web native emulation focused LXQt desktop based on Ubuntu.": "Webstation je webová natívne emulácia zameraná LXQt plocha na základe Ubuntu.",
   "Webtop - Alpine, Ubuntu, Fedora, and Arch based containers containing full desktop environments in officially supported flavors accessible via any modern web browser.": "Webtop - Alpine, Ubuntu, Fedora, a Arch založené kontajnery obsahujúce plné pracovné prostredie v oficiálne podporovaných príchutiach prístupných cez akýkoľvek moderný webový prehliadač.",
@@ -6847,7 +6846,7 @@
   "WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many different circumstances. Initially released for the Linux kernel, it is now cross-platform (Windows, macOS, BSD, iOS, Android) and widely deployable. It is currently under heavy development, but already it might be regarded as the most secure, easiest to use, and simplest VPN solution in the industry.": "WireGuard® je extrémne jednoduchá, ale rýchla a moderná VPN, ktorá využíva najmodernejšiu kryptografiu. Jeho cieľom je byť rýchlejší, jednoduchší, štíhlejší a užitočnejší ako IPsec, pričom sa vyhýba masívnej bolesti hlavy. Má v úmysle byť výrazne výkonnejší ako OpenVPN. WireGuard je navrhnutý ako všeobecný účel VPN pre prevádzku na vstavaných rozhraniach a super počítačoch podobne, vhodný pre mnoho rôznych okolností. Spočiatku sa vydáva pre jadro Linuxu, je teraz cross-platform (Windows, macOS, BSD, iOS, Android) a široko rozmiestnený. To je v súčasnosti v ťažkom vývoji, ale už to môže byť považované za najbezpečnejšie, najjednoduchšie použitie, a najjednoduchšie riešenie VPN v priemysle.",
   "Wired NICs in backup missing on target:": "Káblové sieťové karty zo zálohy chýbajú na cieli:",
   "Wireshark is the world’s foremost and widely-used network protocol analyzer. It lets you see what’s happening on your network at a microscopic level and is the de facto (and often de jure) standard across many commercial and non-profit enterprises, government agencies, and educational institutions. Wireshark development thrives thanks to the volunteer contributions of networking experts around the globe and is the continuation of a project started by Gerald Combs in 1998.": "Wireshark je prvoradý a široko používaný sieťový protokol analyzátor. Umožňuje vidieť, čo sa deje na vašej sieti na mikroskopickej úrovni a je de facto (a často de jure) štandard v mnohých komerčných a neziskových podnikoch, vládnych agentúr a vzdelávacích inštitúcií. Rozvoj Wireshark sa darí vďaka dobrovoľným príspevkom odborníkov na vytváranie sietí po celom svete a je pokračovaním projektu, ktorý začal Gerald Combs v roku 1998.",
-  "With dns validation, the DNSPLUGIN variable names the provider plugin. The advanced installation asks for it; otherwise add the line lxc.environment.runtime: DNSPLUGIN=<plugin> to /etc/pve/lxc/<CTID>.conf with the container stopped.": "Pri validácii dns, DNSPLUGIN premenná názvy poskytovateľa plugin. Pokročilá inštalácia si to vyžaduje; inak pridajte linku lxc.environment. čas: DNSPLUGIN=<plugin> to /etc/pve/lxc/<CTID>.conf with the container stopd.",
+  "With dns validation, the DNSPLUGIN variable names the provider plugin. The advanced installation asks for it; otherwise add the line lxc.environment.runtime: DNSPLUGIN=<plugin> to /etc/pve/lxc/<CTID>.conf with the container stopped.": "Pri validácii dns, DNSPLUGIN premenná názvy poskytovateľa plugin. Pokročilá inštalácia si to vyžaduje; inak pridajte riadok lxc.environment.runtime: DNSPLUGIN=<plugin> k /etc/pve/lxc/<CTID>.conf s kontajnerom zastavil.",
   "With dns validation, write the provider credentials in /config/dns-conf/<plugin>.ini inside the container and restart it.": "S validáciou dns, napíšte poskytovateľa credentials v /config/dns-conf/<plugin>.ini vnútri kontajnera a reštartujte ho.",
   "With http validation, port 80 of the router must be forwarded to port 80 of this container.": "Pri validácii http sa port 80 routeru musí zaslať do prístavu 80 tohto kontajnera.",
   "With warnings": "S upozorneniami",
@@ -7366,7 +7365,7 @@
   "vfio-pci IDs configured": "vfio-pci ID nastavené",
   "vfio-pci IDs in /etc/modprobe.d/vfio.conf": "vfio-pci ID v /etc/modprobe.d/vfio.conf",
   "vzdump backup speed optimization completed": "Optimalizácia rýchlosti záloh vzdump je dokončená",
-  "wallabag builds its links from the address given during the installation. If it does not match the address of the container, edit lxc.environment.runtime: SYMFONY__ENV__DOMAIN_NAME in /etc/pve/lxc/<CTID>.conf with the container stopped, and start it again.": "wallabag buduje svoje odkazy z adresy uvedenej počas inštalácie. Ak nezodpovedá adrese kontajnera, upravte prostredie lxc. čas: SYMFONY  ENV  DOMAIN NAME in /etc/pve/lxc/ <CTID >.conf s kontajnerom zastavil, a začať znova.",
+  "wallabag builds its links from the address given during the installation. If it does not match the address of the container, edit lxc.environment.runtime: SYMFONY__ENV__DOMAIN_NAME in /etc/pve/lxc/<CTID>.conf with the container stopped, and start it again.": "wallabag buduje svoje odkazy z adresy uvedenej počas inštalácie. Ak nezodpovedá adrese kontajnera, upravte prostredie lxc. čas: SYMFONY  ENV  DOMAIN NAME in /etc/pve/lxc/ <CTID>.conf s kontajnerom zastavil, a začať znova.",
   "wallabag listens on port 80 of the container and stores its data in SQLite.": "wallabag počúva port 80 kontajnera a ukladá svoje údaje v SQLite.",
   "wallabag web interface": "Webové rozhranie wallabag",
   "was": "bolo",
diff --git a/lang/sv.json b/lang/sv.json
index fed355ea..e0f8ce10 100644
--- a/lang/sv.json
+++ b/lang/sv.json
@@ -20,7 +20,7 @@
   "(recommended)": "(rekommenderad)",
   "(same MAC — restored config adjusted automatically)": "(samma MAC — återställd konfiguration justeras automatiskt)",
   ")": ")",
-  "*Arr Suite": "Arr Suite",
+  "*Arr Suite": "*Arr Suite",
   "+ Add a path": "+ Lägg till en sökväg",
   "+ Add new Borg target": "+ Lägg till nytt Borgmål",
   "+ Add new PBS manually": "+ Lägg till ny PBS manuellt",
@@ -120,11 +120,11 @@
   "ACL Status:": "ACL-status:",
   "ACL permissions applied for local access for user:": "ACL-behörigheter tillämpas för lokal åtkomst för användare:",
   "ADVANCED SETTINGS COMPLETE": "AVANCERADE INSTÄLLNINGAR KLARA",
-  "AI / Coding & Dev-Tools": "AI / Coding & Dev-Tools",
+  "AI / Coding & Dev-Tools": "AI, programmering och utveckling",
   "ALL DATA ON": "ALLA DATA PÅ",
   "ALL DATA ON THIS DISK WILL BE PERMANENTLY LOST!": "ALLA DATA PÅ DEN HÄR DISKEN KOMMER ATT FÖRLORAS PERMANENT!",
   "ALL Utilities": "ALLA Utilities",
-  "ALLOWED_HOSTS cannot contain line breaks": "ALLOWED HOSTS kan inte innehålla radbrytningar",
+  "ALLOWED_HOSTS cannot contain line breaks": "ALLOWED_HOSTS kan inte innehålla radbrytningar",
   "AList initial login": "AList initial inloggning",
   "AMD CPU detected": "AMD CPU upptäckt",
   "AMD CPU fixes applied successfully": "AMD CPU-fixar har använts",
@@ -500,7 +500,7 @@
   "Backend:": "Backend:",
   "Background archive extraction for Arr download queues. No web interface.": "Bakgrund arkiv extraktion för Arr nedladdning köer. Inget webbgränssnitt.",
   "Backup            — VM and CT backups": "Säkerhetskopiering — VM- och CT-säkerhetskopior",
-  "Backup & Recovery": "Backup & Recovery",
+  "Backup & Recovery": "Säkerhetskopiering och återställning",
   "Backup Created": "Säkerhetskopiering skapad",
   "Backup ID (group name in PBS):": "Säkerhetskopierings-ID (gruppnamn i PBS):",
   "Backup ID for this job:": "Säkerhetskopierings-ID för detta jobb:",
@@ -603,11 +603,11 @@
   "Broken gasket-dkms package state recovered.": "Det trasiga pakettillståndet för gasket-dkms återställdes.",
   "Browse Your Life in Images": "Bläddra i ditt liv i bilder",
   "Browse manually (advanced)...": "Bläddra manuellt (avancerat)...",
-  "Browsers & Web Desktops": "Webbläsare & Web Desktops",
+  "Browsers & Web Desktops": "Webbläsare och webbskrivbord",
   "Build and install the gasket and apex kernel modules (DKMS)": "Bygg och installera kärnmodulerna gasket och apex (DKMS)",
   "Build dependencies installed.": "Byggberoenden installerade.",
   "Build your personal knowledge base with TriliumNext Notes": "Bygg din personliga kunskapsbas med TriliumNext Notes",
-  "Business & ERP": "Business & ERP",
+  "Business & ERP": "Företag och ERP",
   "CHANGES APPLIED SUCCESSFULLY": "ÄNDRINGAR HAR TILLÄMPATS",
   "CIFS Client Tools: AVAILABLE": "CIFS-klientverktyg: TILLGÄNGLIGT",
   "CIFS Client Tools: NOT AVAILABLE - installing...": "CIFS-klientverktyg: EJ TILLGÄNGLIGT - installerar...",
@@ -1084,7 +1084,7 @@
   "Container will pick up the mount on next start": "Containern hämtar monteringen vid nästa start",
   "Container with ID": "Container med ID",
   "Container:": "Behållare:",
-  "Containers & Docker": "Containers och Docker",
+  "Containers & Docker": "Containrar och Docker",
   "Containers returned to their previous state": "Containers återvände till sin tidigare stat",
   "Containers that are removed:": "Behållare som tas bort:",
   "Containers that will be created (one LXC per service, on a private network):": "Behållare som kommer att skapas (en LXC per tjänst, på ett privat nätverk):",
@@ -1157,7 +1157,7 @@
   "Coral M.2 Apex configuration added - device ready": "Coral M.2 Apex-konfiguration har lagts till - enheten är klar",
   "Coral M.2 Apex configuration added - device will be available after reboot": "Coral M.2 Apex-konfiguration tillagd - enheten kommer att vara tillgänglig efter omstart",
   "Coral M.2 Apex detected, configuring...": "Coral M.2 Apex upptäcktes, konfigurerar...",
-  "Coral PCIe/M.2 node (e.g. /dev/apex_0)": "Coral PCIe/M.2 nod (t.ex. /dev/apex 0)",
+  "Coral PCIe/M.2 node (e.g. /dev/apex_0)": "Coral PCIe/M.2 nod (t.ex. /dev/apex_0)",
   "Coral TPU Installation": "Coral TPU installation",
   "Coral TPU Uninstall": "Avinstallera Coral TPU",
   "Coral TPU device nodes detected with correct group (apex).": "Coral TPU-enhetsnoder upptäckts med korrekt grupp (apex).",
@@ -1345,7 +1345,7 @@
   "Creating the container...": "Skapa behållaren...",
   "Creating the initial administrator...": "Skapa den första administratören...",
   "Creating the temporary data container": "Skapa den tillfälliga databehållaren",
-  "Creative & Design": "Kreativ och design",
+  "Creative & Design": "Kreativitet och design",
   "Credentials are correct": "Inloggningsuppgifterna är korrekta",
   "Credentials cleared. jwt_secret and API tokens preserved.": "Autentiseringsuppgifter rensade. jwt_secret och API-tokens bevarade.",
   "Credentials file created securely.": "Autentiseringsfil skapad på ett säkert sätt.",
@@ -1731,7 +1731,7 @@
   "Dry run completed; the container and the mounts were not changed.": "Torr kör slutfördes; behållaren och fästen ändrades inte.",
   "DuckDNS subdomain without .duckdns.org (comma separated for several)": "DuckDNS underdomän utan .duckdns.org (komma separerad för flera)",
   "DuckDNS token from your account at duckdns.org": "DuckDNS token från ditt konto på duckdns.org",
-  "DuckDNS updates the subdomain every 5 minutes. Without UPDATE_IP, DuckDNS itself detects the public IPv4 address of the request.": "DuckDNS uppdaterar underdomänen var femte minut. Utan UPDATE IP upptäcker DuckDNS själv den offentliga IPv4-adressen för begäran.",
+  "DuckDNS updates the subdomain every 5 minutes. Without UPDATE_IP, DuckDNS itself detects the public IPv4 address of the request.": "DuckDNS uppdaterar underdomänen var femte minut. Utan UPDATE_IP upptäcker DuckDNS själv den offentliga IPv4-adressen för begäran.",
   "DuckStation is a PS1 Emulator aiming for the best accuracy and game support.": "DuckStation är en PS1 Emulator som syftar till bästa accuracy och spelstöd.",
   "Duckdns is a free service which will point a DNS (sub domains of duckdns.org) to an IP of your choice. The service is completely free, and doesn't require reactivation or forum posts to maintain its existence.": "Duckdns är en gratis tjänst som kommer att peka en DNS (sub domäner av duckdns.org) till en IP av ditt val. Tjänsten är helt gratis, och require reaktivering eller forumposter för att behålla sin existens.",
   "Dumping AMD GPU ROM BIOS via sysfs...": "Dumpar AMD GPU ROM BIOS via sysfs...",
@@ -2239,7 +2239,7 @@
   "Final cleanup of the stack operation completed": "Slutlig rensning av stapeln operation färdigställd",
   "Final confirmation": "Slutlig bekräftelse",
   "Final storage health/status check": "Slutlig lagringsstatus/statuskontroll",
-  "Finance & Budgeting": "Finans & Budgeting",
+  "Finance & Budgeting": "Ekonomi och budget",
   "Find your device using https://finds.synology.com": "Hitta din enhet med https://finds.synology.com",
   "Fingerprint:": "Fingeravtryck:",
   "Firefly, the easiest using of WireGuard VPN server, plus version of wg-easy.": "Firefly, den enklaste användningen av WireGuard VPN-server, plus version av wg-easy.",
@@ -2386,7 +2386,7 @@
   "GRUB_CMDLINE_LINUX_DEFAULT not found in GRUB config": "GRUB_CMDLINE_LINUX_DEFAULT hittades inte i GRUB-konfigurationen",
   "GUI mode (if available)": "GUI-läge (om tillgängligt)",
   "GZDoom is a feature centric port for all Doom engine games, based on ZDoom, adding an OpenGL renderer and powerful scripting capabilities.": "GZDoom är en funktion centric port för alla Doom motorspel, baserat på ZDoom, lägga till en OpenGL renderer och kraftfulla skriptfunktioner.",
-  "Gaming & Leisure": "Spel och Leisure",
+  "Gaming & Leisure": "Spel och fritid",
   "Gateway is not installed.": "Gateway är inte installerad.",
   "Gateway removed.": "Gateway har tagits bort.",
   "Gateway restarted.": "Gateway startade om.",
@@ -2526,7 +2526,7 @@
   "Host GPU detected": "Värd GPU upptäckt",
   "Host GPU is already bound to vfio-pci. Host reconfiguration/reboot should not be required for this VM-to-VM reassignment.": "Värd-GPU är redan bunden till vfio-pci. Värd omkonfiguration/omstart bör inte krävas för denna VM-till-VM-omtilldelning.",
   "Host IP": "Värd IP",
-  "Host Management": "Host Management",
+  "Host Management": "Värdhantering",
   "Host Mount Path": "Värdmonteringssökväg",
   "Host NFS/Samba as Proxmox Storage (pvesm)": "NFS/Samba på värden som Proxmox-lagring (pvesm)",
   "Host Path": "Värdsökväg",
@@ -2540,7 +2540,7 @@
   "Host already in VFIO mode — skipping host reconfiguration for VM reassignment": "Värd redan i VFIO-läge — hoppar över värdomkonfiguration för VM-omtilldelning",
   "Host audio devices": "Värd ljudenheter",
   "Host backup attached to PVE job": "Värdsäkerhetskopia kopplad till PVE-jobb",
-  "Host data is not restored by the backup; confirm it with --acknowledge-external-data": "Värddata återställs inte av säkerhetskopieringen; bekräftar den med -acknowledge-extern data",
+  "Host data is not restored by the backup; confirm it with --acknowledge-external-data": "Värddata återställs inte av säkerhetskopieringen; bekräfta den med --acknowledge-external-data",
   "Host device for /dev/kvm": "Värd enhet för /dev/kvm",
   "Host device for /dev/net/tun": "Värd enhet för /dev/nett/tun",
   "Host device for /dev/ttyUSB0": "Värd enhet för /dev/ttyUSB0",
@@ -2793,7 +2793,7 @@
   "Initiator IQN is authorised on the target": "Initiator IQN är auktoriserad på målet",
   "Initiator IQN:": "Initiativtagare IQN:",
   "Inkscape is professional quality vector graphics software which runs on Linux, Mac OS X and Windows desktop computers.": "Inkscape är professionell kvalitet vektor grafik programvara som körs på Linux, Mac OS X och Windows stationära datorer.",
-  "Inside the LXC, create the administrator: console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN": "Inuti LXC, skapa administratören: konsol kimai:user: skapa ditt USERNAME YOUR EMAIL ROLE SUPER ADMIN",
+  "Inside the LXC, create the administrator: console kimai:user:create YOUR_USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN": "Inuti LXC, skapa administratören: konsol kimai:user: skapa ditt USERNAME YOUR_EMAIL ROLE_SUPER_ADMIN",
   "Inspect disks before any action": "Inspektera diskar innan någon åtgärd",
   "Inspect host device nodes": "Inspektera värdenhetsnoder",
   "Inspect passthrough/kernel events": "Inspektera passthrough/kärnhändelser",
@@ -2965,7 +2965,7 @@
   "Interrupted operation:": "Avbruten operation:",
   "Interrupted stack operation found": "Avbruten stack operation hittades",
   "Invalid 'proxmox-ve' candidate (not 9.x or none). Please verify your repository configuration and network, then retry.": "Ogiltig 'proxmox-ve'-kandidat (inte 9.x eller ingen). Verifiera din arkivkonfiguration och ditt nätverk och försök sedan igen.",
-  "Invalid ALLOWED_HOSTS value": "Invalid ALLOWED HOSTS värde",
+  "Invalid ALLOWED_HOSTS value": "Invalid ALLOWED_HOSTS värde",
   "Invalid Home Assistant OS check timeout": "Ogiltig Home Assistant OS check timeout",
   "Invalid ID": "Ogiltigt ID",
   "Invalid Intel render path": "Invalid Intel render bana",
@@ -3384,7 +3384,7 @@
   "Max user watches configured": "Max användarklockor har konfigurerats",
   "Maximum auto-repair attempts reached (3). Please review the log and run any remaining commands manually.": "Maximalt antal autoreparationsförsök har uppnåtts (3). Granska loggen och kör eventuella återstående kommandon manuellt.",
   "May need to restart terminal": "Kan behöva starta om terminalen",
-  "Media & Streaming": "Media & Streaming",
+  "Media & Streaming": "Media och streaming",
   "Media discovery and request management for Jellyfin, Plex and Emby.": "Media discovery och request management för Jellyfin, Plex och Emby.",
   "Media library transcoding and health checking, with an internal worker node.": "Mediebiblioteksöverkodning och hälsokontroll, med en intern arbetstagarnod.",
   "Media server": "Media server",
@@ -3411,7 +3411,7 @@
   "MineOS web interface": "MineOS webbgränssnitt",
   "Minisatip is a multi-threaded satip server version 1.2 that runs under Linux and it was tested with DVB-S, DVB-S2, DVB-T, DVB-T2, DVB-C, DVB-C2, ATSC and ISDB-T cards.": "Minisatip är en multi-threaded satip server version 1.2 som körs under Linux och det testades med DVB-S, DVB-S2, DVB-T, DVB-T2, DVB-C, DVB-C2, ATSC och ISDB-T-kort.",
   "Mirror URL not available for this script.": "Mirror URL inte tillgänglig för det här skriptet.",
-  "Miscellaneous": "Miscellan",
+  "Miscellaneous": "Övrigt",
   "Missing": "Saknad",
   "Missing OCI metadata:": "OCI-metadata saknas:",
   "Missing commands after installation:": "Saknade kommandon efter installation:",
@@ -3649,7 +3649,7 @@
   "NVMe health status: WARNING (critical_warning =": "NVMe hälsostatus: VARNING (critical_warning =",
   "NVMe skipped (to add as PCIe use 'Add Controller or NVMe PCIe to VM'):": "NVMe hoppade över (för att lägga till som PCIe använd 'Lägg till styrenhet eller NVMe PCIe till VM'):",
   "NVMe-specific SMART log": "NVMe-specifik SMART-logg",
-  "NVR & Cameras": "NVR & Kameror",
+  "NVR & Cameras": "NVR och kameror",
   "NVR with optional VA-API video acceleration and hardware object detectors": "NVR med valfri VA-API videoacceleration och hårdvaruobjektdetektorer",
   "NZBGet web interface": "NZBGet webbgränssnitt",
   "Name": "Namnnamn",
@@ -3661,7 +3661,7 @@
   "Name of this wallabag instance, shown in the interface and in 2FA codes": "Namn på denna wallabag instans, visas i gränssnittet och i 2FA-koder",
   "Name or part of the description of the application": "Namn eller del av beskrivningen av ansökan",
   "Name:": "Namn:",
-  "Named accounts need private mode. Stop the container, set public: false in /config/config.js, start it again and create each user with: pct exec <CTID> -- env THELOUNGE_HOME=/config s6-setuidgid abc thelounge add <user>": "Namngivna konton behöver privat läge. Stoppa behållaren, ställ in offentligt: falskt i /config/config.js, starta den igen och skapa varje användare med: pct exec <CTID> - env THELOUNGE HOME=/config s6-setuidgid abc thelounge addera <user>",
+  "Named accounts need private mode. Stop the container, set public: false in /config/config.js, start it again and create each user with: pct exec <CTID> -- env THELOUNGE_HOME=/config s6-setuidgid abc thelounge add <user>": "Namngivna konton behöver privat läge. Stoppa behållaren, ställ in offentligt: falskt i /config/config.js, starta den igen och skapa varje användare med: pct exec <CTID> - env THELOUNGE_HOME=/config s6-setuidgid abc thelounge addera <user>",
   "Neither /etc/kernel/cmdline nor /etc/default/grub found.": "Varken /etc/kernel/cmdline eller /etc/default/grub hittades.",
   "Nesting feature enabled": "Kapningsfunktionen aktiverad",
   "NetBIOS Service: RUNNING": "NetBIOS-tjänst: KÖR",
@@ -3671,7 +3671,7 @@
   "Netbox is an IP address management (IPAM) and data center infrastructure management (DCIM) tool. Initially conceived by the network engineering team at DigitalOcean, NetBox was developed specifically to address the needs of network and infrastructure engineers. It is intended to function as a domain-specific source of truth for network operations.": "Netbox är ett IP-adresshantering (IPAM) och datacenter infrastrukturhantering (DCIM) verktyg. Initialt utformad av nätverksteknikteamet på DigitalOcean, utvecklades NetBox specifikt för att tillgodose behoven hos nätverks- och infrastrukturingenjörer. Den är avsedd att fungera som en domänspecifik källa till sanning för operations.",
   "Network": "Nätverk",
   "Network  :": "Nätverk:",
-  "Network & Firewall": "Network & Firewall",
+  "Network & Firewall": "Nätverk och brandvägg",
   "Network (interfaces, DNS)": "Nätverk (gränssnitt, DNS)",
   "Network Bridge": "Nätverksbrygga",
   "Network Commands": "Nätverkskommandon",
@@ -4042,7 +4042,7 @@
   "OCI containers require Proxmox VE 9.1 or later.": "OCI-behållare kräver Proxmox VE 9.1 eller senare.",
   "OCI management": "OCI management",
   "OCI management could not be completed. Check the backend status; no additional cleanup has been authorized.": "OCI-hanteringen kunde inte slutföras. Kontrollera backend status; ingen ytterligare rengöring har godkänts.",
-  "OCI manager Apps (beta)": "OCI Manager Apps (beta)",
+  "OCI manager Apps (beta)": "OCI manager Apps (beta)",
   "OCI manager Apps is a beta: if something does not work as expected, please report it on GitHub with the application name.": "OCI Manager Apps är en beta: om något inte fungerar som förväntat, vänligen rapportera det på GitHub med applikationsnamnet.",
   "OCI metadata integrity mismatch": "OCI metadata integritet mismatch",
   "OCI metadata too large": "OCI metadata för stor",
@@ -4371,7 +4371,7 @@
   "Postfix configuration": "Postfix-konfiguration",
   "PostgreSQL": "PostgreSQL",
   "PostgreSQL URL without an associated service:": "PostgreSQL URL utan tillhörande tjänst:",
-  "PostgreSQL creates the database named in POSTGRES_DB on the first start. The installer default is postgresql.": "PostgreSQL skapar databasen som heter POSTGRES DB i början. Installationsstandarden är postgresql.",
+  "PostgreSQL creates the database named in POSTGRES_DB on the first start. The installer default is postgresql.": "PostgreSQL skapar databasen som heter POSTGRES_DB i början. Installationsstandarden är postgresql.",
   "PostgreSQL is an advanced, enterprise-class, and open-source relational database system. PostgreSQL supports both SQL (relational) and JSON (non-relational) querying.": "PostgreSQL är ett avancerat, företagsklass och open-source relational databassystem. PostgreSQL stöder både SQL (relational) och JSON (icke-relationell) fråga.",
   "PostgreSQL requires a password": "PostgreSQL requires ett lösenord",
   "PostgreSQL volume size in GB": "PostgreSQL volymstorlek i GB",
@@ -4534,7 +4534,7 @@
   "Pwndrop is a self-deployable file hosting service for sending out red teaming payloads or securely sharing your private files over HTTP and WebDAV.": "Pwndrop är en självutnyttjande fil värdtjänst för att skicka ut röda lager nyttolast eller säkert dela dina privata filer över HTTP och WebDAV.",
   "PyCharm offers out-of-the-box support for Python, databases, Jupyter, Git, Conda, PyTorch, TensorFlow, Hugging Face, Django, Flask, FastAPI, and more.": "PyCharm erbjuder out-of-the-box stöd för Python, databaser, Jupyter, Git, Conda, PyTorch, TensorFlow, Hugging Face, Django, Flask, FastAPI och mer.",
   "Pydio Cells needs an external MySQL or MariaDB database. The setup wizard asks for its address, database name and user on the first start.": "Pydio Cells behöver en extern MySQL- eller MariaDB-databas. Inställningsguiden ber om sin adress, databasnamn och användare i första början.",
-  "Pydio Cells redirects to the address given in EXTERNALURL. If the container changes address, edit lxc.environment.runtime: EXTERNALURL and SERVER_IP in /etc/pve/lxc/<CTID>.conf with the container stopped, and delete /config/keys/cert.crt to regenerate the certificate.": "Pydio Cells omdirigerar till den adress som ges i EXTERNALURL. Om behållaren ändrar adress, redigera lxc.environment.runtime: EXTERNALURL och SERVER IP i /etc/pve/lxc/<CTID>.conf med behållaren stannade, och ta bort /config/keys/cert.crt för att regenerera certifikatet.",
+  "Pydio Cells redirects to the address given in EXTERNALURL. If the container changes address, edit lxc.environment.runtime: EXTERNALURL and SERVER_IP in /etc/pve/lxc/<CTID>.conf with the container stopped, and delete /config/keys/cert.crt to regenerate the certificate.": "Pydio Cells omdirigerar till den adress som ges i EXTERNALURL. Om behållaren ändrar adress, redigera lxc.environment.runtime: EXTERNALURL och SERVER_IP i /etc/pve/lxc/<CTID>.conf med behållaren stannade, och ta bort /config/keys/cert.crt för att regenerera certifikatet.",
   "Pydio-cells is the nextgen file sharing platform for organizations. It is a full rewrite of the Pydio project using the Go language following a micro-service architecture.": "Pydio-celler är nästagen fildelningsplattform för organisationer. Det är en fullständig omskrivning av Pydio-projektet med Go-språket efter en mikroservicearkitektur.",
   "QDirStat Qt-based directory statistics: KDirStat without any KDE -- from the author of the original KDirStat.": "QDirStat Qt-baserad katalogstatistik: KDirStat utan KDE – från författaren till den ursprungliga KDirStat.",
   "Quick health check (PASSED / FAILED)": "Snabb hälsokontroll (GODKÄND / MISLYCKAD)",
@@ -5947,7 +5947,7 @@
   "The imported Compose requests privileged, but the official jlesage/handbrake documentation does not require it; ProxMenux keeps the LXC unprivileged.": "Den importerade Komponera förfrågningar privilegierade, men den officiella jlesage / handbrake dokumentation inte require det; ProxMenux håller LXC oprivilegierad.",
   "The imported OCI groups are not numeric": "De importerade OCI-grupperna är inte numeriska",
   "The imported OCI user or group is not numeric": "Den importerade OCI-användaren eller gruppen är inte numerisk",
-  "The initial user name and password stay written in /etc/pve/lxc/<CTID>.conf as INIT_USERNAME and INIT_PASSWORD. They can be removed after the first login, with the container stopped.": "Det första användarnamnet och lösenordet förblir skrivet i /etc/pve/lxc/<CTID>.conf som INIT USERNAME och INIT PASSWORD. De kan tas bort efter den första inloggningen, med behållaren stannade.",
+  "The initial user name and password stay written in /etc/pve/lxc/<CTID>.conf as INIT_USERNAME and INIT_PASSWORD. They can be removed after the first login, with the container stopped.": "Det första användarnamnet och lösenordet förblir skrivet i /etc/pve/lxc/<CTID>.conf som INIT_USERNAME och INIT_PASSWORD. De kan tas bort efter den första inloggningen, med behållaren stannade.",
   "The installation asks which one to use for these paths.": "Installationen frågar vilken som ska användas för dessa vägar.",
   "The installation ended with exit code": "Installationen slutade med exitkod",
   "The installation requires a server restart to apply changes. Do you want to restart now?": "Installationen kräver en omstart av servern för att tillämpa ändringar. Vill du starta om nu?",
@@ -6066,7 +6066,7 @@
   "The rootfs is not managed by Proxmox": "Rötterna hanteras inte av Proxmox",
   "The rootfs is not mounted": "Rötterna är inte monterade",
   "The same GPU cannot be used by two VMs at the same time.": "Samma GPU kan inte användas av två virtuella datorer samtidigt.",
-  "The same connection can be given as container variables instead of the file: UN_SONARR_0_URL and UN_SONARR_0_API_KEY, or the UN_RADARR_0_ equivalents.": "Samma anslutning kan ges som containervariabler i stället för filen: UN SONARR 0 URL och UN SONARR 0 API KEY, eller UN RADARR 0  equivalents.",
+  "The same connection can be given as container variables instead of the file: UN_SONARR_0_URL and UN_SONARR_0_API_KEY, or the UN_RADARR_0_ equivalents.": "Samma anslutning kan ges som containervariabler i stället för filen: UN_SONARR_0_URL och UN_SONARR_0_API_KEY, eller UN RADARR 0  equivalents.",
   "The saved MOTD state is invalid; no changes were made": "Det sparade MOTD-tillståndet är ogiltigt;inga ändringar gjordes",
   "The saved OCI record is incomplete or has an unexpected format.": "Den sparade OCI-posten är ofullständig eller har ett oväntat format.",
   "The saved projection does not match the native evidence": "Den sparade projektionen matchar inte de infödda bevisen",
@@ -6814,7 +6814,7 @@
   "Web interface to manage devices running Tasmota firmware.": "Webbgränssnitt för att hantera enheter som kör Tasmota firmware.",
   "WebCord can be summarized as a pack of security and privacy hardenings, Discord features reimplementations, Electron / Chromium / Discord bugs workarounds, stylesheets, internal pages and wrapped https://discord.com page, designed to conform with ToS as much as it is possible (or hide the changes that might violate it from Discord's eyes).": "WebCord kan sammanfattas som ett paket av säkerhets- och sekretesshärdningar, Discord-funktioner reimplementations, Electron / Chromium / Discord bugs workarounds, stylesheets, interna sidor och wrapped https://discord.com sida, utformad för att överensstämma med ToS så mycket som möjligt (eller dölja de förändringar som kan bryta mot det från Discords ögon).",
   "Webgrabplus is a multi-site incremental xmltv epg grabber. It collects tv-program guide data from selected tvguide sites for your favourite channels.": "Webgrabplus är en multi-site inkrementell xmltv epg grabber. Det samlar in tv-programguide data från utvalda tvguide webbplatser för dina favoritkanaler.",
-  "Webservers & Proxies": "Webservers & Proxies",
+  "Webservers & Proxies": "Webbservrar och proxyservrar",
   "Website": "Webbplats",
   "Webstation is a web native emulation focused LXQt desktop based on Ubuntu.": "Webstation är en web inhemsk emulering fokuserad LXQt skrivbord baserat på Ubuntu.",
   "Webtop - Alpine, Ubuntu, Fedora, and Arch based containers containing full desktop environments in officially supported flavors accessible via any modern web browser.": "Webtop - Alpine, Ubuntu, Fedora och Arch-baserade behållare som innehåller fullständiga skrivbordsmiljöer i officiellt stödda smaker tillgängliga via alla moderna webbläsare.",
@@ -6847,7 +6847,7 @@
   "WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many different circumstances. Initially released for the Linux kernel, it is now cross-platform (Windows, macOS, BSD, iOS, Android) and widely deployable. It is currently under heavy development, but already it might be regarded as the most secure, easiest to use, and simplest VPN solution in the industry.": "WireGuard® är en extremt enkel men ändå snabb och modern VPN som använder toppmodern kryptografi. Det syftar till att vara snabbare, enklare, smalare och mer användbar än IPsec, samtidigt som man undviker den massiva huvudvärken. Det avser att vara betydligt mer performant än OpenVPN. WireGuard är utformad som ett allmänt ändamål VPN för att köra på inbyggda gränssnitt och superdatorer lika, passar för många olika omständigheter. Initialt släppt för Linux-kärnan är det nu cross-platform (Windows, macOS, BSD, iOS, Android) och allmänt distribuerbar. Det är för närvarande under tung utveckling, men redan kan det anses vara den säkraste, enklaste att använda och enklaste VPN-lösningen i branschen.",
   "Wired NICs in backup missing on target:": "Trådbundna nätverkskort i säkerhetskopia saknas på målet:",
   "Wireshark is the world’s foremost and widely-used network protocol analyzer. It lets you see what’s happening on your network at a microscopic level and is the de facto (and often de jure) standard across many commercial and non-profit enterprises, government agencies, and educational institutions. Wireshark development thrives thanks to the volunteer contributions of networking experts around the globe and is the continuation of a project started by Gerald Combs in 1998.": "Wireshark är världens främsta och allmänt använda nätverksprotokollanalysator. Det låter dig se vad som händer på ditt nätverk på en mikroskopisk nivå och är de facto (och ofta de jure) standard över många kommersiella och ideella företag, myndigheter och utbildningsinstitutioner. Wireshark utveckling frodas tack vare de frivilliga bidragen från nätverksexperter runt om i världen och är fortsättningen av ett projekt som startades av Gerald Combs 1998.",
-  "With dns validation, the DNSPLUGIN variable names the provider plugin. The advanced installation asks for it; otherwise add the line lxc.environment.runtime: DNSPLUGIN=<plugin> to /etc/pve/lxc/<CTID>.conf with the container stopped.": "Med dns validering, DNSPLUGIN variabel namn leverantör plugin. Den avancerade installationen ber om det, annars lägg till linjen lxc.miljö. runtime: DNSPLUGIN <plugin> till /etc/pve/lxc/<CTID>.conf med behållaren stannade.",
+  "With dns validation, the DNSPLUGIN variable names the provider plugin. The advanced installation asks for it; otherwise add the line lxc.environment.runtime: DNSPLUGIN=<plugin> to /etc/pve/lxc/<CTID>.conf with the container stopped.": "Med dns validering, DNSPLUGIN variabel namn leverantör plugin. Den avancerade installationen ber om det, annars lägg till linjen lxc.environment.runtime: DNSPLUGIN <plugin> till /etc/pve/lxc/ <CTID>.conf med behållaren stannade.",
   "With dns validation, write the provider credentials in /config/dns-conf/<plugin>.ini inside the container and restart it.": "Med dns validering, skriv leverantören credentials i /config/dns-conf/<plugin>.ini inuti behållaren och starta om den.",
   "With http validation, port 80 of the router must be forwarded to port 80 of this container.": "Med http validering måste port 80 av routern vidarebefordras till port 80 av denna behållare.",
   "With warnings": "Med varningar",
@@ -7366,7 +7366,7 @@
   "vfio-pci IDs configured": "vfio-pci ID:n konfigurerade",
   "vfio-pci IDs in /etc/modprobe.d/vfio.conf": "vfio-pci ID i /etc/modprobe.d/vfio.conf",
   "vzdump backup speed optimization completed": "Optimeringen av vzdump-säkerhetskopieringen har slutförts",
-  "wallabag builds its links from the address given during the installation. If it does not match the address of the container, edit lxc.environment.runtime: SYMFONY__ENV__DOMAIN_NAME in /etc/pve/lxc/<CTID>.conf with the container stopped, and start it again.": "wallabag bygger sina länkar från den adress som ges under installationen. Om den inte matchar behållarens adress, redigera lxc.environment. runtime: SYMFONY ENV  DOMAIN NAME in /etc/pve/lxc/<CTID>.conf with the container stopped, and start it again.",
+  "wallabag builds its links from the address given during the installation. If it does not match the address of the container, edit lxc.environment.runtime: SYMFONY__ENV__DOMAIN_NAME in /etc/pve/lxc/<CTID>.conf with the container stopped, and start it again.": "wallabag bygger sina länkar från den adress som ges under installationen. Om den inte matchar behållarens adress, redigera lxc.environment.runtime: SYMFONY ENV  DOMAIN NAME in /etc/pve/lxc/<CTID>.conf with the container stopped, and start it again.",
   "wallabag listens on port 80 of the container and stores its data in SQLite.": "wallabag lyssnar på port 80 av behållaren och lagrar sina data i SQLite.",
   "wallabag web interface": "wallabag webbgränssnitt",
   "was": "var",
diff --git a/oci/catalog/apps/2fauth.json b/oci/catalog/apps/2fauth.json
index 83c327d3..65fc8b99 100644
--- a/oci/catalog/apps/2fauth.json
+++ b/oci/catalog/apps/2fauth.json
@@ -17,7 +17,7 @@
     "category_label": "Authentication & Security",
     "author": "Bubka",
     "developer": "Bubka",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/2fauth.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/actualbudget.json b/oci/catalog/apps/actualbudget.json
index 4bd58527..7816157c 100644
--- a/oci/catalog/apps/actualbudget.json
+++ b/oci/catalog/apps/actualbudget.json
@@ -17,7 +17,7 @@
     "category_label": "Finance & Budgeting",
     "author": "ActualBudget",
     "developer": "ActualBudget",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/actual-budget.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/adguard-home.json b/oci/catalog/apps/adguard-home.json
index aa28859f..c5410a5f 100644
--- a/oci/catalog/apps/adguard-home.json
+++ b/oci/catalog/apps/adguard-home.json
@@ -17,7 +17,7 @@
     "category_label": "Network & Firewall",
     "author": "AdguardTeam",
     "developer": "AdguardTeam",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/adguard-home.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/adguardhome-sync.json b/oci/catalog/apps/adguardhome-sync.json
index 34665858..3b108990 100644
--- a/oci/catalog/apps/adguardhome-sync.json
+++ b/oci/catalog/apps/adguardhome-sync.json
@@ -17,7 +17,7 @@
     "category_label": "Adblock & DNS",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/adguardhome-sync-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/adguardhome-sync.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/adguardhome-sync-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/adminer.json b/oci/catalog/apps/adminer.json
index 8c7afdcb..dbd75a29 100644
--- a/oci/catalog/apps/adminer.json
+++ b/oci/catalog/apps/adminer.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Adminer (formerly phpMinAdmin) is a full-featured database management tool written in PHP. Conversely to phpMyAdmin, it consist of a single file ready to deploy to the target server. Adminer is available for MySQL, PostgreSQL, SQLite, MS SQL, Oracle, Firebird, SimpleDB, Elasticsearch and MongoDB."
     },
-    "category": "ai",
-    "category_label": "AI / Coding & Dev-Tools",
-    "author": "Jakub Vr\u00e1na",
-    "developer": "Jakub Vr\u00e1na",
-    "icon": null,
+    "category": "databases",
+    "category_label": "Databases",
+    "author": "Jakub Vrána",
+    "developer": "Jakub Vrána",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/adminer.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/airsonic-advanced.json b/oci/catalog/apps/airsonic-advanced.json
index d705be13..65a16480 100644
--- a/oci/catalog/apps/airsonic-advanced.json
+++ b/oci/catalog/apps/airsonic-advanced.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Airsonic-advanced is a free, web-based media streamer, providing ubiquitious access to your music. Use it to share your music with friends, or to listen to your own music while at work. You can stream to multiple players simultaneously, for instance to one player in your kitchen and another in your living room."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "media",
+    "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/airsonic-advanced-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/airsonic-advanced-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/airsonic-advanced-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/albyhub.json b/oci/catalog/apps/albyhub.json
index 106dab88..9a371a4c 100644
--- a/oci/catalog/apps/albyhub.json
+++ b/oci/catalog/apps/albyhub.json
@@ -5,19 +5,19 @@
   "status": "laboratory-validated",
   "catalog_ui": {
     "title": {
-      "en_US": "Alby Hub \u2728"
+      "en_US": "Alby Hub ✨"
     },
     "tagline": {
       "en_US": "Self-custodial Bitcoin Lightning wallet with integrated node and app connections."
     },
     "description": {
-      "en_US": "Alby Hub is an open-source, self-custodial Bitcoin Lightning wallet, with the easiest-to-use Lightning Network node for everyone.\nWhether you're an individual, creator, or developer, Alby Hub is your centre for seamless Bitcoin payments.\nEffortlessly connect to a variety of apps like the Alby Browser Extension or Alby Go mobile app, create sub-wallets for family and friends, and take full control of your funds\u2014all within an intuitive interface and developer-ready APIs.\n\n**USEFUL LINKS**\n- [Source Repository](https://github.com/getAlby/hub)\n- [Support](https://support.getalby.com/)\n- [Marketing Site](https://albyhub.com/)\n- [Community of users and developers](https://discord.getalby.com)\n- [Feedback Board, feature requests, bug reports[(https://feedback.getalby.com)\n"
+      "en_US": "Alby Hub is an open-source, self-custodial Bitcoin Lightning wallet, with the easiest-to-use Lightning Network node for everyone.\nWhether you're an individual, creator, or developer, Alby Hub is your centre for seamless Bitcoin payments.\nEffortlessly connect to a variety of apps like the Alby Browser Extension or Alby Go mobile app, create sub-wallets for family and friends, and take full control of your funds—all within an intuitive interface and developer-ready APIs.\n\n**USEFUL LINKS**\n- [Source Repository](https://github.com/getAlby/hub)\n- [Support](https://support.getalby.com/)\n- [Marketing Site](https://albyhub.com/)\n- [Community of users and developers](https://discord.getalby.com)\n- [Feedback Board, feature requests, bug reports[(https://feedback.getalby.com)\n"
     },
     "category": "finance",
     "category_label": "Finance & Budgeting",
     "author": "getalby",
     "developer": null,
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/alby-hub.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/alist-sync.json b/oci/catalog/apps/alist-sync.json
index 899df607..9e1bfaec 100644
--- a/oci/catalog/apps/alist-sync.json
+++ b/oci/catalog/apps/alist-sync.json
@@ -17,7 +17,7 @@
     "category_label": "Productivity & Workflows",
     "author": "xjxjin",
     "developer": "xjxjin",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/Alist-Sync/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/alist.json b/oci/catalog/apps/alist.json
index 280ccdbb..0ffa8691 100644
--- a/oci/catalog/apps/alist.json
+++ b/oci/catalog/apps/alist.json
@@ -17,7 +17,7 @@
     "category_label": "Productivity & Workflows",
     "author": "Xhofe",
     "developer": "Xhofe",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/alist.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/altus.json b/oci/catalog/apps/altus.json
index 5c49f227..e9cfc613 100644
--- a/oci/catalog/apps/altus.json
+++ b/oci/catalog/apps/altus.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Altus is an Electron-based WhatsApp client with themes and multiple account support."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "communication",
+    "category_label": "Communication & Community",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/altus-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/altus-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/altus-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/amule.json b/oci/catalog/apps/amule.json
index fa3df805..c1850556 100644
--- a/oci/catalog/apps/amule.json
+++ b/oci/catalog/apps/amule.json
@@ -17,7 +17,7 @@
     "category_label": "Files & Downloads",
     "author": "ngosang",
     "developer": "ngosang",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/a-mule.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/anaconda3.json b/oci/catalog/apps/anaconda3.json
index dadf1989..6211fbb5 100644
--- a/oci/catalog/apps/anaconda3.json
+++ b/oci/catalog/apps/anaconda3.json
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "LisonEvf",
     "developer": "LisonEvf",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/Anaconda3/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/anythingllm.json b/oci/catalog/apps/anythingllm.json
index b94e938f..a2942b62 100644
--- a/oci/catalog/apps/anythingllm.json
+++ b/oci/catalog/apps/anythingllm.json
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "Mintplex Labs",
     "developer": "Mintplex Labs",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/anythingllm.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/apprise-api.json b/oci/catalog/apps/apprise-api.json
index d03c2edd..3411231a 100644
--- a/oci/catalog/apps/apprise-api.json
+++ b/oci/catalog/apps/apprise-api.json
@@ -17,7 +17,7 @@
     "category_label": "Messaging & Notifications",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/apprise-api-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/apprise-api-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/apprise-api-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/archivebox.json b/oci/catalog/apps/archivebox.json
index 0aaaabd1..fd47fd25 100644
--- a/oci/catalog/apps/archivebox.json
+++ b/oci/catalog/apps/archivebox.json
@@ -17,7 +17,7 @@
     "category_label": "Documents & Notes",
     "author": "ArchiveBox",
     "developer": "ArchiveBox",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/archivebox.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/ardour.json b/oci/catalog/apps/ardour.json
index cf289f04..d5c19164 100644
--- a/oci/catalog/apps/ardour.json
+++ b/oci/catalog/apps/ardour.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Ardour is an open source, collaborative effort of a worldwide team including musicians, programmers, and professional recording engineers."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "creative",
+    "category_label": "Creative & Design",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ardour-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/ardour-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ardour-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/audacity.json b/oci/catalog/apps/audacity.json
index 8946046f..8f1ad44e 100644
--- a/oci/catalog/apps/audacity.json
+++ b/oci/catalog/apps/audacity.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Audacity is an easy-to-use, multi-track audio editor and recorder. Developed by a group of volunteers as open source."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "creative",
+    "category_label": "Creative & Design",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/audacity-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/audacity.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/audacity-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/audiobookshelf.json b/oci/catalog/apps/audiobookshelf.json
index 6096ed41..cd21b909 100644
--- a/oci/catalog/apps/audiobookshelf.json
+++ b/oci/catalog/apps/audiobookshelf.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "advplyr",
     "developer": "advplyr",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/audiobookshelf.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/autobrr.json b/oci/catalog/apps/autobrr.json
index 5df54d99..41e8e6a5 100644
--- a/oci/catalog/apps/autobrr.json
+++ b/oci/catalog/apps/autobrr.json
@@ -17,7 +17,7 @@
     "category_label": "*Arr Suite",
     "author": "Autobrr Team",
     "developer": "Autobrr Team",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/autobrr.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/azahar.json b/oci/catalog/apps/azahar.json
index c60dc9d5..cf316c09 100644
--- a/oci/catalog/apps/azahar.json
+++ b/oci/catalog/apps/azahar.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Azahar is an open-source 3DS emulator based on Citra."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "gaming",
+    "category_label": "Gaming & Leisure",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/azahar-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/azahar-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/azahar-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/babybuddy.json b/oci/catalog/apps/babybuddy.json
index 3c0f7acd..786fd283 100644
--- a/oci/catalog/apps/babybuddy.json
+++ b/oci/catalog/apps/babybuddy.json
@@ -17,7 +17,7 @@
     "category_label": "Productivity & Workflows",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/babybuddy-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/baby-buddy.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/babybuddy-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/bambustudio.json b/oci/catalog/apps/bambustudio.json
index c1779463..1286cda2 100644
--- a/oci/catalog/apps/bambustudio.json
+++ b/oci/catalog/apps/bambustudio.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Bambu Studio is an open-source, cutting-edge, feature-rich slicing software. It contains project-based workflows, systematically optimized slicing algorithms, and an easy-to-use graphical interface, bringing users an incredibly smooth printing experience."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "creative",
+    "category_label": "Creative & Design",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/bambustudio-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/bambustudio-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/bambustudio-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/bazarr.json b/oci/catalog/apps/bazarr.json
index e9d824ac..89617e6a 100644
--- a/oci/catalog/apps/bazarr.json
+++ b/oci/catalog/apps/bazarr.json
@@ -17,7 +17,7 @@
     "category_label": "*Arr Suite",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/bazarr-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/bazarr.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/bazarr-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/beaverhabittracker.json b/oci/catalog/apps/beaverhabittracker.json
index cf2c523e..89e97bd2 100644
--- a/oci/catalog/apps/beaverhabittracker.json
+++ b/oci/catalog/apps/beaverhabittracker.json
@@ -17,7 +17,7 @@
     "category_label": "Productivity & Workflows",
     "author": "daya0576",
     "developer": "daya0576",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/beaver-habit-tracker.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/beets.json b/oci/catalog/apps/beets.json
index 7ee06065..0dd89731 100644
--- a/oci/catalog/apps/beets.json
+++ b/oci/catalog/apps/beets.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Beets is a music library manager and not, for the most part, a music player. It does include a simple player plugin and an experimental Web-based player, but it generally leaves actual sound-reproduction to specialized tools."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "media",
+    "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/beets-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/beets.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/beets-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/bentopdf.json b/oci/catalog/apps/bentopdf.json
index 862771af..41695b68 100644
--- a/oci/catalog/apps/bentopdf.json
+++ b/oci/catalog/apps/bentopdf.json
@@ -11,13 +11,13 @@
       "en_US": "Privacy-first, self-hosted PDF toolkit"
     },
     "description": {
-      "en_US": "**Your PDFs never leave your device.** BentoPDF is a privacy-first PDF toolkit that runs entirely in your browser. Every merge, split, conversion, and edit happens locally on your machine \u2014 no file is ever uploaded to a server. More than 50 tools are bundled into one clean, fast, ad-free interface.\n\n**One app for every PDF job.** Organize and edit your documents (merge, split, reorder, rotate, crop, watermark, page numbers, redaction, annotations and forms), convert to and from PDF (images, Word, Excel, PowerPoint, EPUB, Markdown and more), run OCR, and secure your files with compression, encryption, digital signatures, and metadata cleanup.\n\n**Made for your private cloud.** Self-hosting BentoPDF on a private cloud device like self-hosted server gives your whole household or team a single, ad-free PDF workshop on hardware you control \u2014 fast over the local network, with your documents staying private by design.\n"
+      "en_US": "**Your PDFs never leave your device.** BentoPDF is a privacy-first PDF toolkit that runs entirely in your browser. Every merge, split, conversion, and edit happens locally on your machine — no file is ever uploaded to a server. More than 50 tools are bundled into one clean, fast, ad-free interface.\n\n**One app for every PDF job.** Organize and edit your documents (merge, split, reorder, rotate, crop, watermark, page numbers, redaction, annotations and forms), convert to and from PDF (images, Word, Excel, PowerPoint, EPUB, Markdown and more), run OCR, and secure your files with compression, encryption, digital signatures, and metadata cleanup.\n\n**Made for your private cloud.** Self-hosting BentoPDF on a private cloud device like self-hosted server gives your whole household or team a single, ad-free PDF workshop on hardware you control — fast over the local network, with your documents staying private by design.\n"
     },
     "category": "documents",
     "category_label": "Documents & Notes",
     "author": "BentoPDF",
     "developer": "BentoPDF",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/bentopdf.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/bitcoin-knots.json b/oci/catalog/apps/bitcoin-knots.json
index 2ac7e2eb..9102c2f1 100644
--- a/oci/catalog/apps/bitcoin-knots.json
+++ b/oci/catalog/apps/bitcoin-knots.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Bitcoin Knots can be used as a desktop client for regular payments or as a full node server utility for merchants and other payment services."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "finance",
+    "category_label": "Finance & Budgeting",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/bitcoin-knots-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/bitcoin-knots-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/bitcoin-knots-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/blade-of-agony.json b/oci/catalog/apps/blade-of-agony.json
index 0c3731cf..f9851791 100644
--- a/oci/catalog/apps/blade-of-agony.json
+++ b/oci/catalog/apps/blade-of-agony.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Wolfenstein: Blade of Agony is a story-driven WWII shooter inspired by Wolfenstein and Doom."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "gaming",
+    "category_label": "Gaming & Leisure",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/blade-of-agony-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/boa-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/blade-of-agony-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/blender.json b/oci/catalog/apps/blender.json
index 21d6ac41..2f730698 100644
--- a/oci/catalog/apps/blender.json
+++ b/oci/catalog/apps/blender.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Blender is a free and open-source 3D computer graphics software toolset used for creating animated films, visual effects, art, 3D printed models, motion graphics, interactive 3D applications, virtual reality, and computer games. **This image does not support GPU rendering out of the box only accelerated workspace experience**"
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "creative",
+    "category_label": "Creative & Design",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/blender-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/blender.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/blender-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/blinko.json b/oci/catalog/apps/blinko.json
index 19185ee5..cbfe3b9c 100644
--- a/oci/catalog/apps/blinko.json
+++ b/oci/catalog/apps/blinko.json
@@ -17,7 +17,7 @@
     "category_label": "Productivity & Workflows",
     "author": "blinkospace",
     "developer": "blinkospace",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/blinko.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/boinc.json b/oci/catalog/apps/boinc.json
index 24874f4d..8b0a1718 100644
--- a/oci/catalog/apps/boinc.json
+++ b/oci/catalog/apps/boinc.json
@@ -17,7 +17,7 @@
     "category_label": "Miscellaneous",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/boinc-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/boinc.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/boinc-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/bookstack.json b/oci/catalog/apps/bookstack.json
index 271b5266..02325eea 100644
--- a/oci/catalog/apps/bookstack.json
+++ b/oci/catalog/apps/bookstack.json
@@ -17,7 +17,7 @@
     "category_label": "Documents & Notes",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/bookstack-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/bookstack.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/bookstack-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/brave.json b/oci/catalog/apps/brave.json
index 086b3717..9b420596 100644
--- a/oci/catalog/apps/brave.json
+++ b/oci/catalog/apps/brave.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "The Brave browser is a fast, private and secure web browser for PC, Mac and mobile."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "desktop",
+    "category_label": "Browsers & Web Desktops",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/brave-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/brave.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/brave-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/budge.json b/oci/catalog/apps/budge.json
index 7b3d73e3..7cb00554 100644
--- a/oci/catalog/apps/budge.json
+++ b/oci/catalog/apps/budge.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "budge is an open source 'budgeting with envelopes' personal finance app."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "finance",
+    "category_label": "Finance & Budgeting",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/budge-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/budge@master/frontend/public/logo512.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/budge-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/calibre-web.json b/oci/catalog/apps/calibre-web.json
index 47a7a93a..ea7c2436 100644
--- a/oci/catalog/apps/calibre-web.json
+++ b/oci/catalog/apps/calibre-web.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/calibre-web-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/calibre-web.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/calibre-web-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/calibre.json b/oci/catalog/apps/calibre.json
index c2f3b40b..8c42b195 100644
--- a/oci/catalog/apps/calibre.json
+++ b/oci/catalog/apps/calibre.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Calibre is a powerful and easy to use e-book manager. Users say it's outstanding and a must-have. It'll allow you to do nearly everything and it takes things a step beyond normal e-book software. It's also completely free and open source and great for both casual users and computer experts."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "media",
+    "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/calibre-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/calibre.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/calibre-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/calligra.json b/oci/catalog/apps/calligra.json
index 3166d71c..36a4dd92 100644
--- a/oci/catalog/apps/calligra.json
+++ b/oci/catalog/apps/calligra.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Calligra is an office and graphic art suite by KDE. It is available for desktop PCs, tablet computers, and smartphones. It contains applications for word processing, spreadsheets, presentation, vector graphics, and editing databases."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "documents",
+    "category_label": "Documents & Notes",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/calligra-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/calligra-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/calligra-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/changedetection.io.json b/oci/catalog/apps/changedetection.io.json
index 89ed87df..61a52fd8 100644
--- a/oci/catalog/apps/changedetection.io.json
+++ b/oci/catalog/apps/changedetection.io.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Changedetection.io provides free, open-source web page monitoring, notification and change detection."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "monitoring",
+    "category_label": "Monitoring & Analytics",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/changedetection.io-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/changedetection-icon.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/changedetection.io-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/chatbot-ui.json b/oci/catalog/apps/chatbot-ui.json
index bb2d27e6..cb7f1caa 100644
--- a/oci/catalog/apps/chatbot-ui.json
+++ b/oci/catalog/apps/chatbot-ui.json
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "Mckay Wrigley",
     "developer": "Mckay Wrigley",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/ChatbotUI/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/chatgpt-next-web.json b/oci/catalog/apps/chatgpt-next-web.json
index 50b8179e..19c3f277 100644
--- a/oci/catalog/apps/chatgpt-next-web.json
+++ b/oci/catalog/apps/chatgpt-next-web.json
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "Yidadaa",
     "developer": "Yidadaa",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/ChatGPT-Next-Web/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/chrome.json b/oci/catalog/apps/chrome.json
index d4aaf69b..6360ceeb 100644
--- a/oci/catalog/apps/chrome.json
+++ b/oci/catalog/apps/chrome.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Chrome is the official web browser from Google, built to be fast, secure, and customizable."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "desktop",
+    "category_label": "Browsers & Web Desktops",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/chrome-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/chrome.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/chrome-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/chromium.json b/oci/catalog/apps/chromium.json
index 06c8b93d..ff381f8f 100644
--- a/oci/catalog/apps/chromium.json
+++ b/oci/catalog/apps/chromium.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "desktop",
+    "category_label": "Browsers & Web Desktops",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/chromium-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/chromium.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/chromium-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/cloudbeaver.json b/oci/catalog/apps/cloudbeaver.json
index a2547e44..045d0d04 100644
--- a/oci/catalog/apps/cloudbeaver.json
+++ b/oci/catalog/apps/cloudbeaver.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "CloudBeaver is a web-based database GUI tool which provides rich web interface. You can use it to manage PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, DB2, Firebird, H2, Trino."
     },
-    "category": "ai",
-    "category_label": "AI / Coding & Dev-Tools",
+    "category": "databases",
+    "category_label": "Databases",
     "author": "dbeaver",
     "developer": "dbeaver",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/cloudbeaver.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/cloudflared.json b/oci/catalog/apps/cloudflared.json
index 5786da3a..1ee78081 100644
--- a/oci/catalog/apps/cloudflared.json
+++ b/oci/catalog/apps/cloudflared.json
@@ -11,13 +11,13 @@
       "en_US": "A tunneling daemon by Cloudflare that safely exposes your web servers into the internet."
     },
     "description": {
-      "en_US": "Cloudflare Tunnel offers an easy way to expose web servers securely to the internet, without opening up firewall ports and configuring ACLs. Cloudflare Tunnel also ensures requests route through Cloudflare before reaching the web server, so you can be sure attack traffic is stopped with Cloudflare\u2019s WAF and Unmetered DDoS mitigation, and authenticated with Access if you\u2019ve enabled those features for your account.\n\nThe software provides a seamless way to securely expose web servers to the internet without configuring firewall ports or access control lists (ACLs). All requests are routed through Cloudflare before reaching your web server, leveraging Cloudflare\u2019s Web Application Firewall (WAF) and unmetered DDoS mitigation to block attack traffic, with optional authentication via Cloudflare Access if enabled. With its intuitive Web interface and efficient tunnel management, this tool is the perfect solution for securely deploying web services.\n\n**Discover How to Connect self-hosted server to Cloudflare Tunnel**\nIntegrating self-hosted server with Cloudflare Tunnel allows you to securely expose local services to the internet without opening firewall ports, enabling seamless remote access. Below are two practical resources to guide you through the setup process:\n1. [**Cloudflare Official Tutorial**](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/): \n  This tutorial provides detailed steps for creating and managing a Cloudflare Tunnel.\n2. [**Phiptech Practical Guide**](https://phiptech.com/how-to-setup-cloudflare-tunnel-and-expose-your-local-service-or-application/): \n  This guide offers a concise, step-by-step walkthrough for setting up Cloudflare Tunnel on local devices like self-hosted server, with practical examples to help users easily expose services to the public internet.\n"
+      "en_US": "Cloudflare Tunnel offers an easy way to expose web servers securely to the internet, without opening up firewall ports and configuring ACLs. Cloudflare Tunnel also ensures requests route through Cloudflare before reaching the web server, so you can be sure attack traffic is stopped with Cloudflare’s WAF and Unmetered DDoS mitigation, and authenticated with Access if you’ve enabled those features for your account.\n\nThe software provides a seamless way to securely expose web servers to the internet without configuring firewall ports or access control lists (ACLs). All requests are routed through Cloudflare before reaching your web server, leveraging Cloudflare’s Web Application Firewall (WAF) and unmetered DDoS mitigation to block attack traffic, with optional authentication via Cloudflare Access if enabled. With its intuitive Web interface and efficient tunnel management, this tool is the perfect solution for securely deploying web services.\n\n**Discover How to Connect self-hosted server to Cloudflare Tunnel**\nIntegrating self-hosted server with Cloudflare Tunnel allows you to securely expose local services to the internet without opening firewall ports, enabling seamless remote access. Below are two practical resources to guide you through the setup process:\n1. [**Cloudflare Official Tutorial**](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/): \n  This tutorial provides detailed steps for creating and managing a Cloudflare Tunnel.\n2. [**Phiptech Practical Guide**](https://phiptech.com/how-to-setup-cloudflare-tunnel-and-expose-your-local-service-or-application/): \n  This guide offers a concise, step-by-step walkthrough for setting up Cloudflare Tunnel on local devices like self-hosted server, with practical examples to help users easily expose services to the public internet.\n"
     },
     "category": "web",
     "category_label": "Webservers & Proxies",
     "author": "Cloudflare Inc.",
     "developer": "Cloudflare Inc.",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/Cloudflared/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/clumoove.json b/oci/catalog/apps/clumoove.json
index 2b8e1100..148f2821 100644
--- a/oci/catalog/apps/clumoove.json
+++ b/oci/catalog/apps/clumoove.json
@@ -17,7 +17,7 @@
     "category_label": "Productivity & Workflows",
     "author": "Marcel Meyer",
     "developer": "Marcel Meyer",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/Clumoove/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/code-server.json b/oci/catalog/apps/code-server.json
index e2abed38..e5338758 100644
--- a/oci/catalog/apps/code-server.json
+++ b/oci/catalog/apps/code-server.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Code-server is VS Code running on a remote server, accessible through the browser."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "ai",
+    "category_label": "AI / Coding & Dev-Tools",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/code-server-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/code-server.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/code-server-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/codeproject-ai.json b/oci/catalog/apps/codeproject-ai.json
index 4bace122..65a3d51f 100644
--- a/oci/catalog/apps/codeproject-ai.json
+++ b/oci/catalog/apps/codeproject-ai.json
@@ -17,7 +17,7 @@
     "category_label": "AI",
     "author": "codeproject",
     "developer": "codeproject",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/codeproject-ai-server.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/convertx.json b/oci/catalog/apps/convertx.json
index c2b8b32d..4d8f1ccf 100644
--- a/oci/catalog/apps/convertx.json
+++ b/oci/catalog/apps/convertx.json
@@ -17,7 +17,7 @@
     "category_label": "Documents & Notes",
     "author": "c4illin",
     "developer": "c4illin",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/convertx.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/cops.json b/oci/catalog/apps/cops.json
index 5db35fbf..16e94043 100644
--- a/oci/catalog/apps/cops.json
+++ b/oci/catalog/apps/cops.json
@@ -8,16 +8,16 @@
       "en_US": "Cops"
     },
     "tagline": {
-      "en_US": "Cops by S\u00e9bastien Lucas, now maintained by MikesPub, stands for Calibre OPDS (and HTML) Php Server."
+      "en_US": "Cops by Sébastien Lucas, now maintained by MikesPub, stands for Calibre OPDS (and HTML) Php Server."
     },
     "description": {
-      "en_US": "Cops by S\u00e9bastien Lucas, now maintained by MikesPub, stands for Calibre OPDS (and HTML) Php Server."
+      "en_US": "Cops by Sébastien Lucas, now maintained by MikesPub, stands for Calibre OPDS (and HTML) Php Server."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "media",
+    "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/cops-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/cops-icon.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/cops-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/copyparty.json b/oci/catalog/apps/copyparty.json
index fb21dc52..2345eeb3 100644
--- a/oci/catalog/apps/copyparty.json
+++ b/oci/catalog/apps/copyparty.json
@@ -17,7 +17,7 @@
     "category_label": "Files & Downloads",
     "author": "CopyParty",
     "developer": "CopyParty",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/copyparty.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/crafty.json b/oci/catalog/apps/crafty.json
index b69db859..a2dd3fa5 100644
--- a/oci/catalog/apps/crafty.json
+++ b/oci/catalog/apps/crafty.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Crafty is an open source Minecraft control panel built using Tornado and AdminLTE, featuring server scheduling, a interactive console and the ability to run almost any type of Minecraft server"
     },
-    "category": "media",
-    "category_label": "Media & Streaming",
+    "category": "gaming",
+    "category_label": "Gaming & Leisure",
     "author": "Crafty Team",
     "developer": "Crafty Team",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/Crafty/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/cura.json b/oci/catalog/apps/cura.json
index 94942bec..03b82da0 100644
--- a/oci/catalog/apps/cura.json
+++ b/oci/catalog/apps/cura.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "UltiMaker Cura is free, easy-to-use 3D printing software trusted by millions of users. Fine-tune your 3D model with 400+ settings for the best slicing and printing results."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "creative",
+    "category_label": "Creative & Design",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/cura-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/cura.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/cura-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/darktable.json b/oci/catalog/apps/darktable.json
index eee10d2a..17e052a7 100644
--- a/oci/catalog/apps/darktable.json
+++ b/oci/catalog/apps/darktable.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "darktable is an open source photography workflow application and raw developer. A virtual lighttable and darkroom for photographers. It manages your digital negatives in a database, lets you view them through a zoomable lighttable and enables you to develop raw images and enhance them."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "creative",
+    "category_label": "Creative & Design",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/darktable-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/darktable-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/darktable-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/databag.json b/oci/catalog/apps/databag.json
index b736d000..cc72bb57 100644
--- a/oci/catalog/apps/databag.json
+++ b/oci/catalog/apps/databag.json
@@ -17,7 +17,7 @@
     "category_label": "Communication & Community",
     "author": "balzack",
     "developer": "balzack",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/databag.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/davos.json b/oci/catalog/apps/davos.json
index 76f120e2..1fc12ee5 100644
--- a/oci/catalog/apps/davos.json
+++ b/oci/catalog/apps/davos.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Davos is an FTP automation tool that periodically scans given host locations for new files. It can be configured for various purposes, including listening for specific files to appear in the host location, ready for it to download and then move, if required. It also supports completion notifications as well as downstream API calls, to further the workflow."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "downloads",
+    "category_label": "Files & Downloads",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/davos-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/davos-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/davos-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/ddclient.json b/oci/catalog/apps/ddclient.json
index 3678687e..58c007c9 100644
--- a/oci/catalog/apps/ddclient.json
+++ b/oci/catalog/apps/ddclient.json
@@ -17,7 +17,7 @@
     "category_label": "Network & Firewall",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ddclient-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/ddclient.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ddclient-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/ddns-go.json b/oci/catalog/apps/ddns-go.json
index 6ba111fd..7ca5f72a 100644
--- a/oci/catalog/apps/ddns-go.json
+++ b/oci/catalog/apps/ddns-go.json
@@ -17,7 +17,7 @@
     "category_label": "Network & Firewall",
     "author": "jeessy2",
     "developer": "jeessy2",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/Ddns-go/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/ddns-updater.json b/oci/catalog/apps/ddns-updater.json
index fb72e7c5..b15abab4 100644
--- a/oci/catalog/apps/ddns-updater.json
+++ b/oci/catalog/apps/ddns-updater.json
@@ -17,7 +17,7 @@
     "category_label": "Network & Firewall",
     "author": "qmcgaw",
     "developer": "qmcgaw",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/ddns-updater.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/deepseek-ocr-nvidia.json b/oci/catalog/apps/deepseek-ocr-nvidia.json
index 28908474..b5d3e800 100644
--- a/oci/catalog/apps/deepseek-ocr-nvidia.json
+++ b/oci/catalog/apps/deepseek-ocr-nvidia.json
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "rdumasia303",
     "developer": "rdumasia303",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/DeepSeek-OCR_Nvidia/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/deluge.json b/oci/catalog/apps/deluge.json
index eec8dd26..aa8b5f79 100644
--- a/oci/catalog/apps/deluge.json
+++ b/oci/catalog/apps/deluge.json
@@ -17,7 +17,7 @@
     "category_label": "Files & Downloads",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/deluge-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/deluge.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/deluge-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/dify.json b/oci/catalog/apps/dify.json
index 2de1205f..9d40fffc 100644
--- a/oci/catalog/apps/dify.json
+++ b/oci/catalog/apps/dify.json
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "LangGenius",
     "developer": "LangGenius",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/dify.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/digikam.json b/oci/catalog/apps/digikam.json
index a7ff09ad..3239be08 100644
--- a/oci/catalog/apps/digikam.json
+++ b/oci/catalog/apps/digikam.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "digiKam: Professional Photo Management with the Power of Open Source"
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "creative",
+    "category_label": "Creative & Design",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/digikam-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/digikam.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/digikam-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/diskover.json b/oci/catalog/apps/diskover.json
index c1aa4b0b..027cc917 100644
--- a/oci/catalog/apps/diskover.json
+++ b/oci/catalog/apps/diskover.json
@@ -17,7 +17,7 @@
     "category_label": "Miscellaneous",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/diskover-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/diskover.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/diskover-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/docker-volume-backup.json b/oci/catalog/apps/docker-volume-backup.json
index 7bbb24bf..5be7e98d 100644
--- a/oci/catalog/apps/docker-volume-backup.json
+++ b/oci/catalog/apps/docker-volume-backup.json
@@ -17,7 +17,7 @@
     "category_label": "Tools",
     "author": "mrcaringi",
     "developer": "mrcaringi",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/docker-volume-backup.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/docmost.json b/oci/catalog/apps/docmost.json
index fc7f8871..69b16273 100644
--- a/oci/catalog/apps/docmost.json
+++ b/oci/catalog/apps/docmost.json
@@ -11,13 +11,13 @@
       "en_US": "A modern wiki and knowledge base for teams"
     },
     "description": {
-      "en_US": "Docmost is a self-hosted collaborative wiki and documentation tool designed for real-time collaboration, allowing multiple users to edit the same page simultaneously without conflicts. Its intuitive interface is ideal for teams managing knowledge bases, project documentation, or wikis, offering an efficient knowledge creation and sharing experience.\n\nThe tool's core features include real-time collaborative editing and space organization. It supports multiple users editing pages in real time for seamless collaboration and organizes pages into 'spaces' for teams, projects, or departments, each with independent permission settings. A rich text editor with Markdown shortcuts simplifies content creation. Built-in Draw.io, Excalidraw, and Mermaid tools provide robust diagramming capabilities.\n\nIt offers permissions management, assigning access via user groups for content security. Pages can be publicly shared via links for external access. Comments enhance communication and feedback, while page history tracks changes. Features like nested navigation, quick search, file attachments, and Markdown/HTML import/export are supported. The tool\u2019s collaboration and flexibility deliver a modern documentation solution.\n\n**Key Features:**\n- Real-time collaborative editing for multiple users\n- Spaces for organizing pages by team, project or department\n- Permissions management with user group access control\n- Rich text editor with Markdown shortcuts\n- Built-in Draw.io, Excalidraw, Mermaid diagramming tools\n- Public page sharing via links\n- Page comments for communication and feedback\n- Page history, nested navigation, search, and file attachments\n\n**Learn More:**\n- [Docmost Official Website](https://docmost.com/)\n- [Docmost GitHub](https://github.com/docmost/docmost)\n"
+      "en_US": "Docmost is a self-hosted collaborative wiki and documentation tool designed for real-time collaboration, allowing multiple users to edit the same page simultaneously without conflicts. Its intuitive interface is ideal for teams managing knowledge bases, project documentation, or wikis, offering an efficient knowledge creation and sharing experience.\n\nThe tool's core features include real-time collaborative editing and space organization. It supports multiple users editing pages in real time for seamless collaboration and organizes pages into 'spaces' for teams, projects, or departments, each with independent permission settings. A rich text editor with Markdown shortcuts simplifies content creation. Built-in Draw.io, Excalidraw, and Mermaid tools provide robust diagramming capabilities.\n\nIt offers permissions management, assigning access via user groups for content security. Pages can be publicly shared via links for external access. Comments enhance communication and feedback, while page history tracks changes. Features like nested navigation, quick search, file attachments, and Markdown/HTML import/export are supported. The tool’s collaboration and flexibility deliver a modern documentation solution.\n\n**Key Features:**\n- Real-time collaborative editing for multiple users\n- Spaces for organizing pages by team, project or department\n- Permissions management with user group access control\n- Rich text editor with Markdown shortcuts\n- Built-in Draw.io, Excalidraw, Mermaid diagramming tools\n- Public page sharing via links\n- Page comments for communication and feedback\n- Page history, nested navigation, search, and file attachments\n\n**Learn More:**\n- [Docmost Official Website](https://docmost.com/)\n- [Docmost GitHub](https://github.com/docmost/docmost)\n"
     },
     "category": "documents",
     "category_label": "Documents & Notes",
     "author": "docmost",
     "developer": "docmost",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/docmost.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/dogwalk.json b/oci/catalog/apps/dogwalk.json
index dbb01354..0c0b5d0f 100644
--- a/oci/catalog/apps/dogwalk.json
+++ b/oci/catalog/apps/dogwalk.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "DOGWALK is Blender Studio's long awaited second game project, focused on creating a bite-sized interactive storytelling playground. Play as a big adorable dog and explore the winter woods with a little kid."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "gaming",
+    "category_label": "Gaming & Leisure",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/dogwalk-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/dogwalk-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/dogwalk-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/dokuwiki.json b/oci/catalog/apps/dokuwiki.json
index 894a06b8..d7afa200 100644
--- a/oci/catalog/apps/dokuwiki.json
+++ b/oci/catalog/apps/dokuwiki.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Dokuwiki is a simple to use and highly versatile Open Source wiki software that doesn't require a database. It is loved by users for its clean and readable syntax. The ease of maintenance, backup and integration makes it an administrator's favorite. Built in access controls and authentication connectors make DokuWiki especially useful in the enterprise context and the large number of plugins contributed by its vibrant community allow for a broad range of use cases beyond a traditional wiki."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "documents",
+    "category_label": "Documents & Notes",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/dokuwiki-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/dokuwiki.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/dokuwiki-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/dolphin.json b/oci/catalog/apps/dolphin.json
index d66957b3..3210d354 100644
--- a/oci/catalog/apps/dolphin.json
+++ b/oci/catalog/apps/dolphin.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Dolphin Emulator lets you play GameCube and Wii games with various graphical enhancements and other features are available to improve your game experience."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "gaming",
+    "category_label": "Gaming & Leisure",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/dolphin-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/dolphin.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/dolphin-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/doplarr.json b/oci/catalog/apps/doplarr.json
index 6cfd91cc..b61350f3 100644
--- a/oci/catalog/apps/doplarr.json
+++ b/oci/catalog/apps/doplarr.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Doplarr is an *arr request bot for Discord.\""
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "arr",
+    "category_label": "*Arr Suite",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/doplarr-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/doplarr.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/doplarr-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/doplarr_rs.json b/oci/catalog/apps/doplarr_rs.json
index 1a6a758a..9667d4a9 100644
--- a/oci/catalog/apps/doplarr_rs.json
+++ b/oci/catalog/apps/doplarr_rs.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Doplarr_rs is a Discord bot for requesting media through *arr backends, written in Rust."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "arr",
+    "category_label": "*Arr Suite",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/doplarr_rs-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/doplarr_rs-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/doplarr_rs-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/dosbox-staging.json b/oci/catalog/apps/dosbox-staging.json
index 1fe95cbb..cd36bfcd 100644
--- a/oci/catalog/apps/dosbox-staging.json
+++ b/oci/catalog/apps/dosbox-staging.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "DOSBox Staging is a modern continuation of DOSBox a free and open-source emulator that enables the execution of MS-DOS software, especially video games."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "gaming",
+    "category_label": "Gaming & Leisure",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/dosbox-staging-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/dosbox-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/dosbox-staging-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/doublecommander.json b/oci/catalog/apps/doublecommander.json
index ee6d5a03..47fcc0e2 100644
--- a/oci/catalog/apps/doublecommander.json
+++ b/oci/catalog/apps/doublecommander.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Double Commander is a free cross platform open source file manager with two panels side by side. It is inspired by Total Commander and features some new ideas."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "tools",
+    "category_label": "Tools",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/doublecommander-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/double-commander.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/doublecommander-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/downtify.json b/oci/catalog/apps/downtify.json
index 7ff96bb2..9b683aae 100644
--- a/oci/catalog/apps/downtify.json
+++ b/oci/catalog/apps/downtify.json
@@ -15,9 +15,9 @@
     },
     "category": "media",
     "category_label": "Media & Streaming",
-    "author": "Henrique Sebasti\u00e3o",
-    "developer": "Henrique Sebasti\u00e3o",
-    "icon": null,
+    "author": "Henrique Sebastião",
+    "developer": "Henrique Sebastião",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/downtify.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/dsh-harness.json b/oci/catalog/apps/dsh-harness.json
index d1740c09..ce000c66 100644
--- a/oci/catalog/apps/dsh-harness.json
+++ b/oci/catalog/apps/dsh-harness.json
@@ -8,7 +8,7 @@
       "en_US": "DeepSeekHarness"
     },
     "tagline": {
-      "en_US": "DeepSeek Harness \u201cEverything is a Plugin\u201c."
+      "en_US": "DeepSeek Harness “Everything is a Plugin“."
     },
     "description": {
       "en_US": "DeepSeek Harness (dsh) is an open-source agent harness developed by DeepSeek AI."
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "DeepSeek",
     "developer": "DeepSeek",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/deepseek-ai/deepseek-harness@master/apps/web/public/favicon.svg",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/duckdns.json b/oci/catalog/apps/duckdns.json
index 1c34b52e..69493528 100644
--- a/oci/catalog/apps/duckdns.json
+++ b/oci/catalog/apps/duckdns.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Duckdns is a free service which will point a DNS (sub domains of duckdns.org) to an IP of your choice. The service is completely free, and doesn't require reactivation or forum posts to maintain its existence."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "network",
+    "category_label": "Network & Firewall",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/duckdns-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/duckdns.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/duckdns-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/duckstation.json b/oci/catalog/apps/duckstation.json
index 24c0d2ea..363f14c0 100644
--- a/oci/catalog/apps/duckstation.json
+++ b/oci/catalog/apps/duckstation.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "DuckStation is a PS1 Emulator aiming for the best accuracy and game support."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "gaming",
+    "category_label": "Gaming & Leisure",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/duckstation-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/duckstation-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/duckstation-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/duplicati.json b/oci/catalog/apps/duplicati.json
index 90246b7c..ca971234 100644
--- a/oci/catalog/apps/duplicati.json
+++ b/oci/catalog/apps/duplicati.json
@@ -17,7 +17,7 @@
     "category_label": "Backup & Recovery",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/duplicati-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/duplicati.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/duplicati-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/eden.json b/oci/catalog/apps/eden.json
index edc17a83..aa7f551a 100644
--- a/oci/catalog/apps/eden.json
+++ b/oci/catalog/apps/eden.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Eden is an experimental open-source emulator for the Nintendo Switch, built with performance and stability in mind."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "gaming",
+    "category_label": "Gaming & Leisure",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/eden-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/eden-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/eden-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/emby-official.json b/oci/catalog/apps/emby-official.json
index 8d8dea9b..e8afeecf 100644
--- a/oci/catalog/apps/emby-official.json
+++ b/oci/catalog/apps/emby-official.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "Emby Team",
     "developer": "Emby Team",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/emby.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/emby.json b/oci/catalog/apps/emby.json
index 3979fbd0..5681a775 100644
--- a/oci/catalog/apps/emby.json
+++ b/oci/catalog/apps/emby.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/emby-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/emby.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/emby-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/embystat.json b/oci/catalog/apps/embystat.json
index 4ccee2c0..f4dde925 100644
--- a/oci/catalog/apps/embystat.json
+++ b/oci/catalog/apps/embystat.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "Embystart Team",
     "developer": "Embystart Team",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/embystat.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/emulatorjs.json b/oci/catalog/apps/emulatorjs.json
index 69eed79d..b04ed50a 100644
--- a/oci/catalog/apps/emulatorjs.json
+++ b/oci/catalog/apps/emulatorjs.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "EmulatorJS is a Docker-based emulator application that can simulate various operating systems and device environments within containers for development, testing, and learning purposes."
     },
-    "category": "media",
-    "category_label": "Media & Streaming",
+    "category": "gaming",
+    "category_label": "Gaming & Leisure",
     "author": "linuxserver.io",
     "developer": null,
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/emulatorjs.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/esphome.json b/oci/catalog/apps/esphome.json
index 510808f1..854a5c03 100644
--- a/oci/catalog/apps/esphome.json
+++ b/oci/catalog/apps/esphome.json
@@ -17,7 +17,7 @@
     "category_label": "IoT & Smart Home",
     "author": "official",
     "developer": null,
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/esphome.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/etherpad.json b/oci/catalog/apps/etherpad.json
index e6da55a7..e3040cab 100644
--- a/oci/catalog/apps/etherpad.json
+++ b/oci/catalog/apps/etherpad.json
@@ -17,7 +17,7 @@
     "category_label": "Documents & Notes",
     "author": "Etherpad Foundation",
     "developer": "Etherpad Foundation",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/etherpad.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/excalidraw.json b/oci/catalog/apps/excalidraw.json
index 2d6c36b6..ef6c1654 100644
--- a/oci/catalog/apps/excalidraw.json
+++ b/oci/catalog/apps/excalidraw.json
@@ -17,7 +17,7 @@
     "category_label": "Documents & Notes",
     "author": "excalidraw",
     "developer": "excalidraw",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/excalidraw.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/faster-whisper.json b/oci/catalog/apps/faster-whisper.json
index efc604f6..67d5f824 100644
--- a/oci/catalog/apps/faster-whisper.json
+++ b/oci/catalog/apps/faster-whisper.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Faster-whisper is a reimplementation of OpenAI's Whisper model using CTranslate2, which is a fast inference engine for Transformer models. This container provides a Wyoming protocol server for faster-whisper."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "ai",
+    "category_label": "AI / Coding & Dev-Tools",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/faster-whisper-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/home-assistant/brands@master/core_integrations/wyoming/icon.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/faster-whisper-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/ferdium.json b/oci/catalog/apps/ferdium.json
index 8f59adc6..3a048137 100644
--- a/oci/catalog/apps/ferdium.json
+++ b/oci/catalog/apps/ferdium.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Ferdium is a desktop app that helps you organize how you use your favourite apps by combining them into one application."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "communication",
+    "category_label": "Communication & Community",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ferdium-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/ferdium.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ferdium-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/filebrowser-quantum.json b/oci/catalog/apps/filebrowser-quantum.json
index 2e9053a6..2052b6a5 100644
--- a/oci/catalog/apps/filebrowser-quantum.json
+++ b/oci/catalog/apps/filebrowser-quantum.json
@@ -17,7 +17,7 @@
     "category_label": "Tools",
     "author": "gtsteffaniak",
     "developer": "gtsteffaniak",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/filebrowser-quantum.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/filedrop.json b/oci/catalog/apps/filedrop.json
index 22d4656e..0731d9e8 100644
--- a/oci/catalog/apps/filedrop.json
+++ b/oci/catalog/apps/filedrop.json
@@ -15,9 +15,9 @@
     },
     "category": "productivity",
     "category_label": "Productivity & Workflows",
-    "author": "No\u00e9 Favier (noe.favier@outlook.com)",
-    "developer": "No\u00e9 Favier (noe.favier@outlook.com)",
-    "icon": null,
+    "author": "Noé Favier (noe.favier@outlook.com)",
+    "developer": "Noé Favier (noe.favier@outlook.com)",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/filedrop.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/fileflows.json b/oci/catalog/apps/fileflows.json
index 5220d5e9..911aba77 100644
--- a/oci/catalog/apps/fileflows.json
+++ b/oci/catalog/apps/fileflows.json
@@ -11,13 +11,13 @@
       "en_US": "File processing made easy!"
     },
     "description": {
-      "en_US": "Save storage space with efficient file processing.\n\nFileFlows lets you monitor and process any file type with custom flows. Videos, audio, images, archives, comics, eBooks\u2014you name it!\n"
+      "en_US": "Save storage space with efficient file processing.\n\nFileFlows lets you monitor and process any file type with custom flows. Videos, audio, images, archives, comics, eBooks—you name it!\n"
     },
     "category": "media",
     "category_label": "Media & Streaming",
     "author": "FileFlows",
     "developer": "FileFlows",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/fileflows.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/filezilla.json b/oci/catalog/apps/filezilla.json
index 06f792de..f96a9bb4 100644
--- a/oci/catalog/apps/filezilla.json
+++ b/oci/catalog/apps/filezilla.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "FIleZilla Client is a fast and reliable cross-platform FTP, FTPS and SFTP client with lots of useful features and an intuitive graphical user interface."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "downloads",
+    "category_label": "Files & Downloads",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/filezilla-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/filezilla.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/filezilla-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/firefly.json b/oci/catalog/apps/firefly.json
index aea2c7a7..97e43171 100644
--- a/oci/catalog/apps/firefly.json
+++ b/oci/catalog/apps/firefly.json
@@ -11,13 +11,13 @@
       "en_US": "Firefly, the easiest using of WireGuard VPN server, plus version of wg-easy."
     },
     "description": {
-      "en_US": "Firefly is a simple and easy to install WireGuard server software, which can be widely used in scenarios such as remote networking, remote work, and expose a local server behind a NAT or firewall to the internet.  \ud83c\udfaf Features \ud83d\udfe2 Provide a simple and easy-to-use web management UI  \ud83d\udfe3 Supports access to all WireGuard clients  \ud83d\udfe1 No need for system installation of WireGuard components  \ud83d\udfe0 Single file, no additional library dependencies  \ud83d\udd34 Automatically apply for free SSL certificate"
+      "en_US": "Firefly is a simple and easy to install WireGuard server software, which can be widely used in scenarios such as remote networking, remote work, and expose a local server behind a NAT or firewall to the internet.  🎯 Features 🟢 Provide a simple and easy-to-use web management UI  🟣 Supports access to all WireGuard clients  🟡 No need for system installation of WireGuard components  🟠 Single file, no additional library dependencies  🔴 Automatically apply for free SSL certificate"
     },
     "category": "finance",
     "category_label": "Finance & Budgeting",
     "author": "Safe3",
     "developer": "Safe3",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/firefly.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/firefox.json b/oci/catalog/apps/firefox.json
index 6ff2983b..999ac33c 100644
--- a/oci/catalog/apps/firefox.json
+++ b/oci/catalog/apps/firefox.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Firefox Browser, also known as Mozilla Firefox or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation. Firefox uses the Gecko layout engine to render web pages, which implements current and anticipated web standards."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "desktop",
+    "category_label": "Browsers & Web Desktops",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/firefox-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/firefox.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/firefox-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/flaresolverr.json b/oci/catalog/apps/flaresolverr.json
index b5478b21..c7a8bdc2 100644
--- a/oci/catalog/apps/flaresolverr.json
+++ b/oci/catalog/apps/flaresolverr.json
@@ -17,7 +17,7 @@
     "category_label": "*Arr Suite",
     "author": "official",
     "developer": null,
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/flaresolverr.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/flexget.json b/oci/catalog/apps/flexget.json
index 83ce40c8..11b9ca5c 100644
--- a/oci/catalog/apps/flexget.json
+++ b/oci/catalog/apps/flexget.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Flexget is a multipurpose automation tool for all of your media."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "arr",
+    "category_label": "*Arr Suite",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/flexget-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/flexget.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/flexget-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/flowise.json b/oci/catalog/apps/flowise.json
index 9e5c4a3f..ec7a1cd3 100644
--- a/oci/catalog/apps/flowise.json
+++ b/oci/catalog/apps/flowise.json
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "Flowise",
     "developer": "Flowise",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/flowise.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/flycast.json b/oci/catalog/apps/flycast.json
index 14eeebb1..1474f41c 100644
--- a/oci/catalog/apps/flycast.json
+++ b/oci/catalog/apps/flycast.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Flycast is a multi-platform Sega Dreamcast, Naomi, Naomi 2, and Atomiswave emulator derived from reicast."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "gaming",
+    "category_label": "Gaming & Leisure",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/flycast-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/flycast-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/flycast-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/foldingathome.json b/oci/catalog/apps/foldingathome.json
index d9db5440..03e4218a 100644
--- a/oci/catalog/apps/foldingathome.json
+++ b/oci/catalog/apps/foldingathome.json
@@ -17,7 +17,7 @@
     "category_label": "Miscellaneous",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/foldingathome-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/foldingathome.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/foldingathome-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/freecad.json b/oci/catalog/apps/freecad.json
index 00b321f6..5c9f4ce5 100644
--- a/oci/catalog/apps/freecad.json
+++ b/oci/catalog/apps/freecad.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "FreeCAD is a general-purpose parametric 3D computer-aided design (CAD) modeler and a building information modeling (BIM) software application with finite element method (FEM) support."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "creative",
+    "category_label": "Creative & Design",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/freecad-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/freecad.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/freecad-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/freshrss-official.json b/oci/catalog/apps/freshrss-official.json
index a8437f47..93767e83 100644
--- a/oci/catalog/apps/freshrss-official.json
+++ b/oci/catalog/apps/freshrss-official.json
@@ -8,7 +8,7 @@
       "en_US": "FreshRSS"
     },
     "tagline": {
-      "en_US": "A free, self-hostable news aggregator\u2026"
+      "en_US": "A free, self-hostable news aggregator…"
     },
     "description": {
       "en_US": "FreshRSS is a self-hosted RSS and Atom feed aggregator. It is lightweight, easy to work with, powerful, and customizable."
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "FreshRSS",
     "developer": "FreshRSS",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/freshrss.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/freshrss.json b/oci/catalog/apps/freshrss.json
index 9015de5b..e46d0740 100644
--- a/oci/catalog/apps/freshrss.json
+++ b/oci/catalog/apps/freshrss.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/freshrss-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/freshrss.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/freshrss-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/frigate.json b/oci/catalog/apps/frigate.json
index 17a212d7..10e8cd54 100644
--- a/oci/catalog/apps/frigate.json
+++ b/oci/catalog/apps/frigate.json
@@ -17,7 +17,7 @@
     "category_label": "NVR & Cameras",
     "author": "Frigate",
     "developer": "Frigate",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/frigate.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/gateway-go.json b/oci/catalog/apps/gateway-go.json
index 0504f915..120b0745 100644
--- a/oci/catalog/apps/gateway-go.json
+++ b/oci/catalog/apps/gateway-go.json
@@ -17,7 +17,7 @@
     "category_label": "Network & Firewall",
     "author": "iotserv",
     "developer": "iotserv",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/Gateway-go/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/gimp.json b/oci/catalog/apps/gimp.json
index 22daf994..b7a9d7f9 100644
--- a/oci/catalog/apps/gimp.json
+++ b/oci/catalog/apps/gimp.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "GIMP is a free and open-source raster graphics editor used for image manipulation (retouching) and image editing, free-form drawing, transcoding between different image file formats, and more specialized tasks. It is extensible by means of plugins, and scriptable."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "creative",
+    "category_label": "Creative & Design",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/gimp-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/gimp.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/gimp-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/gitea.json b/oci/catalog/apps/gitea.json
index 550dd057..cdd4a5bd 100644
--- a/oci/catalog/apps/gitea.json
+++ b/oci/catalog/apps/gitea.json
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "Gitea",
     "developer": "Gitea",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/gitea.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/github-desktop.json b/oci/catalog/apps/github-desktop.json
index 292d7167..e825cce5 100644
--- a/oci/catalog/apps/github-desktop.json
+++ b/oci/catalog/apps/github-desktop.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Github Desktop is an open source Electron-based GitHub app. It is written in TypeScript and uses React."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "ai",
+    "category_label": "AI / Coding & Dev-Tools",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/github-desktop-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/github-desktop-icon.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/github-desktop-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/gitqlient.json b/oci/catalog/apps/gitqlient.json
index c9442d75..76ca0fea 100644
--- a/oci/catalog/apps/gitqlient.json
+++ b/oci/catalog/apps/gitqlient.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "GitQlient is a multi-platform Git client originally forked from QGit. Nowadays it goes beyond of just a fork and adds a lot of new functionality."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "ai",
+    "category_label": "AI / Coding & Dev-Tools",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/gitqlient-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/gitqlient-icon.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/gitqlient-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/glances.json b/oci/catalog/apps/glances.json
index 89692d41..e4e67d97 100644
--- a/oci/catalog/apps/glances.json
+++ b/oci/catalog/apps/glances.json
@@ -17,7 +17,7 @@
     "category_label": "Monitoring & Analytics",
     "author": "Nicolas Hennion",
     "developer": "Nicolas Hennion",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/glances.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/gopeed.json b/oci/catalog/apps/gopeed.json
index fdbfb672..68544692 100644
--- a/oci/catalog/apps/gopeed.json
+++ b/oci/catalog/apps/gopeed.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "GopeedLab",
     "developer": "GopeedLab",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/gopeed.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/grafana.json b/oci/catalog/apps/grafana.json
index 928b27be..81d193df 100644
--- a/oci/catalog/apps/grafana.json
+++ b/oci/catalog/apps/grafana.json
@@ -17,7 +17,7 @@
     "category_label": "Monitoring & Analytics",
     "author": "grafana",
     "developer": "grafana",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/grafana.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/grav.json b/oci/catalog/apps/grav.json
index a7b6e8e6..0cf7be95 100644
--- a/oci/catalog/apps/grav.json
+++ b/oci/catalog/apps/grav.json
@@ -17,7 +17,7 @@
     "category_label": "Documents & Notes",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/grav-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/grav.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/grav-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/grocy.json b/oci/catalog/apps/grocy.json
index dcdafd66..e09659d4 100644
--- a/oci/catalog/apps/grocy.json
+++ b/oci/catalog/apps/grocy.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Grocy is an ERP system for your kitchen! Cut down on food waste, and manage your chores with this brilliant utility."
     },
-    "category": "gaming",
-    "category_label": "Gaming & Leisure",
+    "category": "productivity",
+    "category_label": "Productivity & Workflows",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/grocy-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/grocy.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/grocy-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/gzdoom.json b/oci/catalog/apps/gzdoom.json
index a326b190..9985bc91 100644
--- a/oci/catalog/apps/gzdoom.json
+++ b/oci/catalog/apps/gzdoom.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "GZDoom is a feature centric port for all Doom engine games, based on ZDoom, adding an OpenGL renderer and powerful scripting capabilities."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "gaming",
+    "category_label": "Gaming & Leisure",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/gzdoom-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/gzdoom-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/gzdoom-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/habridge.json b/oci/catalog/apps/habridge.json
index 254849d6..8e7b78b4 100644
--- a/oci/catalog/apps/habridge.json
+++ b/oci/catalog/apps/habridge.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Habridge emulates Philips Hue API to other home automation gateways such as an Amazon Echo/Dot Gen 1 (gen 2 has issues discovering ha-bridge) or other systems that support Philips Hue. The Bridge handles basic commands such as On, Off and brightness commands of the hue protocol. This bridge can control most devices that have a distinct API."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "smarthome",
+    "category_label": "IoT & Smart Home",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/habridge-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/habridge-icon.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/habridge-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/handbrake-jlesage.json b/oci/catalog/apps/handbrake-jlesage.json
index 5db31309..628e6017 100644
--- a/oci/catalog/apps/handbrake-jlesage.json
+++ b/oci/catalog/apps/handbrake-jlesage.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "jlesage",
     "developer": null,
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/handbrake.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/handbrake.json b/oci/catalog/apps/handbrake.json
index 65c59b84..84e02953 100644
--- a/oci/catalog/apps/handbrake.json
+++ b/oci/catalog/apps/handbrake.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "HandBrake is an open-source tool, built by volunteers, for converting video from nearly any format to a selection of modern, widely supported codecs."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "media",
+    "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/handbrake-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/handbrake.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/handbrake-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/haos-one.json b/oci/catalog/apps/haos-one.json
index bde76045..84ef3475 100644
--- a/oci/catalog/apps/haos-one.json
+++ b/oci/catalog/apps/haos-one.json
@@ -17,7 +17,7 @@
     "category_label": "IoT & Smart Home",
     "author": "qweritos",
     "developer": "qweritos",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/home-assistant.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/healthchecks.json b/oci/catalog/apps/healthchecks.json
index 4993931f..51f25525 100644
--- a/oci/catalog/apps/healthchecks.json
+++ b/oci/catalog/apps/healthchecks.json
@@ -17,7 +17,7 @@
     "category_label": "Monitoring & Analytics",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/healthchecks-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/healthchecks.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/healthchecks-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/hedgedoc.json b/oci/catalog/apps/hedgedoc.json
index 2cc2e026..cdd9280b 100644
--- a/oci/catalog/apps/hedgedoc.json
+++ b/oci/catalog/apps/hedgedoc.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "HedgeDoc gives you access to all your files wherever you are."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "documents",
+    "category_label": "Documents & Notes",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/hedgedoc-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/hedgedoc.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/hedgedoc-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/heimdall.json b/oci/catalog/apps/heimdall.json
index f6896bca..5e2a82c0 100644
--- a/oci/catalog/apps/heimdall.json
+++ b/oci/catalog/apps/heimdall.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Heimdall is a way to organise all those links to your most used web sites and web applications in a simple way."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "productivity",
+    "category_label": "Productivity & Workflows",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/heimdall-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/heimdall.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/heimdall-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/helium.json b/oci/catalog/apps/helium.json
index 69669f91..0ea1b0c5 100644
--- a/oci/catalog/apps/helium.json
+++ b/oci/catalog/apps/helium.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Helium is a Chromium-based web browser made for people, with love. Privacy-first with unbiased ad-blocking."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "desktop",
+    "category_label": "Browsers & Web Desktops",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/helium-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/helium-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/helium-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/hermes.json b/oci/catalog/apps/hermes.json
index 271f67d0..ad3c6338 100644
--- a/oci/catalog/apps/hermes.json
+++ b/oci/catalog/apps/hermes.json
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "Nous Research",
     "developer": "Nous Research",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/hermes.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/hishtory-server.json b/oci/catalog/apps/hishtory-server.json
index 143b72ca..01ee6493 100644
--- a/oci/catalog/apps/hishtory-server.json
+++ b/oci/catalog/apps/hishtory-server.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "hiSHtory is a better shell history. It stores your shell history in context (what directory you ran the command in, whether it succeeded or failed, how long it took, etc). This is all stored locally and end-to-end encrypted for syncing to to all your other computers."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "ai",
+    "category_label": "AI / Coding & Dev-Tools",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/hishtory-server-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/hishtory-server-icon.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/hishtory-server-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/holoplay.json b/oci/catalog/apps/holoplay.json
index 44986e05..0cf19094 100644
--- a/oci/catalog/apps/holoplay.json
+++ b/oci/catalog/apps/holoplay.json
@@ -15,9 +15,9 @@
     },
     "category": "media",
     "category_label": "Media & Streaming",
-    "author": "St\u00e9phane Richin",
-    "developer": "St\u00e9phane Richin",
-    "icon": null,
+    "author": "Stéphane Richin",
+    "developer": "Stéphane Richin",
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/HoloPlay/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/homeassistant-official.json b/oci/catalog/apps/homeassistant-official.json
index 5165fd89..b1969ff9 100644
--- a/oci/catalog/apps/homeassistant-official.json
+++ b/oci/catalog/apps/homeassistant-official.json
@@ -17,7 +17,7 @@
     "category_label": "IoT & Smart Home",
     "author": "Home Assistant",
     "developer": "Home Assistant",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/home-assistant.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/homeassistant.json b/oci/catalog/apps/homeassistant.json
index 968bd1f5..10563148 100644
--- a/oci/catalog/apps/homeassistant.json
+++ b/oci/catalog/apps/homeassistant.json
@@ -17,7 +17,7 @@
     "category_label": "IoT & Smart Home",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/homeassistant-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/home-assistant.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/homeassistant-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/homebridge.json b/oci/catalog/apps/homebridge.json
index 1e860d35..0ab58fad 100644
--- a/oci/catalog/apps/homebridge.json
+++ b/oci/catalog/apps/homebridge.json
@@ -17,7 +17,7 @@
     "category_label": "IoT & Smart Home",
     "author": "Homebridge",
     "developer": "Homebridge",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/homebridge.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/htpcmanager.json b/oci/catalog/apps/htpcmanager.json
index 849e6f10..5fcc143e 100644
--- a/oci/catalog/apps/htpcmanager.json
+++ b/oci/catalog/apps/htpcmanager.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Htpcmanager is a front end for many htpc related applications."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "media",
+    "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/htpcmanager-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/htpcmanager-icon.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/htpcmanager-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/hugo.json b/oci/catalog/apps/hugo.json
index b7b9e0cd..5203a0da 100644
--- a/oci/catalog/apps/hugo.json
+++ b/oci/catalog/apps/hugo.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Hugo is a high-speed static site generation platform written in Go, optimized for speed and designed for flexibility. Advanced templating system and fast asset pipelines render a complete website in seconds, ideal for creating documentation sites, landing pages, and various project websites.\n\nCore features include optimized speed and a flexible framework. Concurrency in Go enables rapid rendering, supporting image processing (convert, resize, crop, rotate, adjust colors, apply filters, overlay text/images, extract EXIF data), JavaScript bundling (tree shaking, code splitting), Sass processing, and TailwindCSS support. Multilingual support and taxonomy system make it suitable for diverse sites like documentation, news, or events.\n\nIt includes an embedded web server for real-time previews of content, structure, and style changes during development. Frequent releases ensure ongoing feature enhancements, keeping it cutting-edge. With efficiency and flexibility at the core, the platform delivers a modern static site generation solution.\n\n**Key Features:**\n- High-speed rendering, generating sites in seconds\n- Fast asset pipelines: image processing, JavaScript bundling, Sass, and TailwindCSS support\n- Flexible framework with multilingual and taxonomy systems\n- Embedded web server for real-time development previews\n- Rich ecosystem of themes and plugins\n\n\n**Prerequisites for Using Hugo:**\n\n1. Open command line, navigate to `/DATA/AppData/hugo/project` directory\n\n```cd /DATA/AppData/hugo/project```\n\n2. Initialize the `project` directory as an empty Git repository\n\n```git init```\n\n3. Download the Ananke theme\n\n```git submodule add https://github.com/theNewDynamic/gohugo-theme-ananke.git themes/ananke```\n\n4. Specify the current theme\n\n```echo \"theme = 'ananke'\" >> hugo.toml```\n\n5. Restart Hugo\n\n\n**Learn More:**\n- [Hugo Official Website](https://gohugo.io/)\n- [Hugo GitHub](https://github.com/gohugoio/hugo)\n"
     },
-    "category": "ai",
-    "category_label": "AI / Coding & Dev-Tools",
+    "category": "web",
+    "category_label": "Webservers & Proxies",
     "author": "gohugoio",
     "developer": "gohugoio",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/hugo.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/immich.json b/oci/catalog/apps/immich.json
index 40c4f77d..948ff62d 100644
--- a/oci/catalog/apps/immich.json
+++ b/oci/catalog/apps/immich.json
@@ -17,7 +17,7 @@
     "category_label": "Media",
     "author": "Immich",
     "developer": "Immich",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/immich.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/index-tts.json b/oci/catalog/apps/index-tts.json
index b6cf6b4a..74e39231 100644
--- a/oci/catalog/apps/index-tts.json
+++ b/oci/catalog/apps/index-tts.json
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "icewhaletech",
     "developer": "icewhaletech",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/Index-TTS/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/inkscape.json b/oci/catalog/apps/inkscape.json
index 9b0025ea..16156ee3 100644
--- a/oci/catalog/apps/inkscape.json
+++ b/oci/catalog/apps/inkscape.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Inkscape is professional quality vector graphics software which runs on Linux, Mac OS X and Windows desktop computers."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "creative",
+    "category_label": "Creative & Design",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/inkscape-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/inkscape.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/inkscape-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/intellij-idea.json b/oci/catalog/apps/intellij-idea.json
index a2098ade..74664814 100644
--- a/oci/catalog/apps/intellij-idea.json
+++ b/oci/catalog/apps/intellij-idea.json
@@ -8,16 +8,16 @@
       "en_US": "Intellij Idea"
     },
     "tagline": {
-      "en_US": "IntelliJ IDEA helps you write code faster with tools that eliminate tedious tasks and let you focus on what matters \u2013 building great software."
+      "en_US": "IntelliJ IDEA helps you write code faster with tools that eliminate tedious tasks and let you focus on what matters – building great software."
     },
     "description": {
-      "en_US": "IntelliJ IDEA helps you write code faster with tools that eliminate tedious tasks and let you focus on what matters \u2013 building great software."
+      "en_US": "IntelliJ IDEA helps you write code faster with tools that eliminate tedious tasks and let you focus on what matters – building great software."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "ai",
+    "category_label": "AI / Coding & Dev-Tools",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/intellij-idea-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/intellij-idea-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/intellij-idea-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/jackett.json b/oci/catalog/apps/jackett.json
index 46fe6218..f13c2703 100644
--- a/oci/catalog/apps/jackett.json
+++ b/oci/catalog/apps/jackett.json
@@ -17,7 +17,7 @@
     "category_label": "*Arr Suite",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/jackett-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/jackett.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/jackett-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/jdownloader.json b/oci/catalog/apps/jdownloader.json
index 6eb741f7..c4befda3 100644
--- a/oci/catalog/apps/jdownloader.json
+++ b/oci/catalog/apps/jdownloader.json
@@ -17,7 +17,7 @@
     "category_label": "Files & Downloads",
     "author": "jlesage",
     "developer": "jlesage",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/jdownloader.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/jellyfin-official.json b/oci/catalog/apps/jellyfin-official.json
index d59fff21..48bf346b 100644
--- a/oci/catalog/apps/jellyfin-official.json
+++ b/oci/catalog/apps/jellyfin-official.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "Jellyfin Team",
     "developer": "Jellyfin Team",
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/jellyfin-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/jellyfin.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/jellyfin-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/jellyfin.json b/oci/catalog/apps/jellyfin.json
index 2e65225b..6e2cbaef 100644
--- a/oci/catalog/apps/jellyfin.json
+++ b/oci/catalog/apps/jellyfin.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/jellyfin-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/jellyfin.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/jellyfin-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/jellyseerr.json b/oci/catalog/apps/jellyseerr.json
index eca79c0e..0a7ae716 100644
--- a/oci/catalog/apps/jellyseerr.json
+++ b/oci/catalog/apps/jellyseerr.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "Fallenbagel",
     "developer": "Fallenbagel",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/jellyseerr.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/jenkins.json b/oci/catalog/apps/jenkins.json
index 1e27b10e..bb5b7845 100644
--- a/oci/catalog/apps/jenkins.json
+++ b/oci/catalog/apps/jenkins.json
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "bepp-boop",
     "developer": "bepp-boop",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/jenkins.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/joplin.json b/oci/catalog/apps/joplin.json
index 60846334..9021e14b 100644
--- a/oci/catalog/apps/joplin.json
+++ b/oci/catalog/apps/joplin.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "documents",
+    "category_label": "Documents & Notes",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/joplin-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/joplin.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/joplin-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/kali-linux.json b/oci/catalog/apps/kali-linux.json
index 60914165..b08d81a8 100644
--- a/oci/catalog/apps/kali-linux.json
+++ b/oci/catalog/apps/kali-linux.json
@@ -8,16 +8,16 @@
       "en_US": "Kali Linux"
     },
     "tagline": {
-      "en_US": "Kali-linux - is an Advanced Penetration Testing Linux distribution used for Penetration Testing, Ethical Hacking and network security assessments. KALI LINUX \u2122 is a trademark of OffSec."
+      "en_US": "Kali-linux - is an Advanced Penetration Testing Linux distribution used for Penetration Testing, Ethical Hacking and network security assessments. KALI LINUX ™ is a trademark of OffSec."
     },
     "description": {
-      "en_US": "Kali-linux - is an Advanced Penetration Testing Linux distribution used for Penetration Testing, Ethical Hacking and network security assessments. KALI LINUX \u2122 is a trademark of OffSec."
+      "en_US": "Kali-linux - is an Advanced Penetration Testing Linux distribution used for Penetration Testing, Ethical Hacking and network security assessments. KALI LINUX ™ is a trademark of OffSec."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "security",
+    "category_label": "Authentication & Security",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/kali-linux-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/kali-linux.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/kali-linux-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/karakeep.json b/oci/catalog/apps/karakeep.json
index 61d7d793..bb6a6b23 100644
--- a/oci/catalog/apps/karakeep.json
+++ b/oci/catalog/apps/karakeep.json
@@ -17,7 +17,7 @@
     "category_label": "Documents & Notes",
     "author": "karakeep-app",
     "developer": "karakeep-app",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/karakeep.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/kasm.json b/oci/catalog/apps/kasm.json
index 0b28bc29..566c62a1 100644
--- a/oci/catalog/apps/kasm.json
+++ b/oci/catalog/apps/kasm.json
@@ -17,7 +17,7 @@
     "category_label": "Remote Access & VPN",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/kasm-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/kasm.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/kasm-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/kavita-jvmilazz0.json b/oci/catalog/apps/kavita-jvmilazz0.json
index cb17a2a2..a128614b 100644
--- a/oci/catalog/apps/kavita-jvmilazz0.json
+++ b/oci/catalog/apps/kavita-jvmilazz0.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "jvmilazz0",
     "developer": "jvmilazz0",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/kavita.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/kavita.json b/oci/catalog/apps/kavita.json
index 095cc79e..f80041e9 100644
--- a/oci/catalog/apps/kavita.json
+++ b/oci/catalog/apps/kavita.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/kavita-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/kavita.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/kavita-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/kdenlive.json b/oci/catalog/apps/kdenlive.json
index f842bf27..2504d87d 100644
--- a/oci/catalog/apps/kdenlive.json
+++ b/oci/catalog/apps/kdenlive.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Kdenlive is a powerful free and open source cross-platform video editing program made by the KDE community. Feature rich and production ready."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "creative",
+    "category_label": "Creative & Design",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/kdenlive-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/kdenlive-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/kdenlive-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/keepassxc.json b/oci/catalog/apps/keepassxc.json
index 181c2424..7e401085 100644
--- a/oci/catalog/apps/keepassxc.json
+++ b/oci/catalog/apps/keepassxc.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "KeePassXC is a free and open-source password manager. It started as a community fork of KeePassX (itself a cross-platform port of KeePass)."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "security",
+    "category_label": "Authentication & Security",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/keepassxc-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/keepassxc.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/keepassxc-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/kicad.json b/oci/catalog/apps/kicad.json
index 2fc90a11..dc705a72 100644
--- a/oci/catalog/apps/kicad.json
+++ b/oci/catalog/apps/kicad.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "KiCad - A Cross Platform and Open Source Electronics Design Automation Suite."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "creative",
+    "category_label": "Creative & Design",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/kicad-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/kicad-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/kicad-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/kimai.json b/oci/catalog/apps/kimai.json
index 97c06bdd..fd888a62 100644
--- a/oci/catalog/apps/kimai.json
+++ b/oci/catalog/apps/kimai.json
@@ -17,7 +17,7 @@
     "category_label": "Business & ERP",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/kimai-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/kimai.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/kimai-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/kometa.json b/oci/catalog/apps/kometa.json
index 1569f76d..28b442f3 100644
--- a/oci/catalog/apps/kometa.json
+++ b/oci/catalog/apps/kometa.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/kometa-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/kometa.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/kometa-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/komga.json b/oci/catalog/apps/komga.json
index 7cfd2a6e..89daaec1 100644
--- a/oci/catalog/apps/komga.json
+++ b/oci/catalog/apps/komga.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "gotson",
     "developer": "gotson",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/komga.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/krita.json b/oci/catalog/apps/krita.json
index 4b4ec14e..a6562ae8 100644
--- a/oci/catalog/apps/krita.json
+++ b/oci/catalog/apps/krita.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Krita is a professional FREE and open source painting program. It is made by artists that want to see affordable art tools for everyone."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "creative",
+    "category_label": "Creative & Design",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/krita-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/krita-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/krita-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/label-studio.json b/oci/catalog/apps/label-studio.json
index d2f47798..43a9379d 100644
--- a/oci/catalog/apps/label-studio.json
+++ b/oci/catalog/apps/label-studio.json
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "Yidadaa",
     "developer": "Yidadaa",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/LabelStudio/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/langflow.json b/oci/catalog/apps/langflow.json
index 179c74f2..3405eeff 100644
--- a/oci/catalog/apps/langflow.json
+++ b/oci/catalog/apps/langflow.json
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "langflowai",
     "developer": "langflowai",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/langflow.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/lazylibrarian.json b/oci/catalog/apps/lazylibrarian.json
index 0177184e..95e097a5 100644
--- a/oci/catalog/apps/lazylibrarian.json
+++ b/oci/catalog/apps/lazylibrarian.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/lazylibrarian-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/lazylibrarian.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/lazylibrarian-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/ldap-auth.json b/oci/catalog/apps/ldap-auth.json
index a2370df9..65ed3599 100644
--- a/oci/catalog/apps/ldap-auth.json
+++ b/oci/catalog/apps/ldap-auth.json
@@ -8,16 +8,16 @@
       "en_US": "Ldap Auth"
     },
     "tagline": {
-      "en_US": "Ldap-auth software is for authenticating users who request protected resources from servers proxied by nginx. It includes a daemon (ldap-auth) that communicates with an authentication server, and a webserver daemon that generates an authentication cookie based on the user\u2019s credentials. The daemons are written in Python for use with a Lightweight Directory Access Protocol (LDAP) authentication server (OpenLDAP or Microsoft Windows Active Directory 2003 and 2012)."
+      "en_US": "Ldap-auth software is for authenticating users who request protected resources from servers proxied by nginx. It includes a daemon (ldap-auth) that communicates with an authentication server, and a webserver daemon that generates an authentication cookie based on the user’s credentials. The daemons are written in Python for use with a Lightweight Directory Access Protocol (LDAP) authentication server (OpenLDAP or Microsoft Windows Active Directory 2003 and 2012)."
     },
     "description": {
-      "en_US": "Ldap-auth software is for authenticating users who request protected resources from servers proxied by nginx. It includes a daemon (ldap-auth) that communicates with an authentication server, and a webserver daemon that generates an authentication cookie based on the user\u2019s credentials. The daemons are written in Python for use with a Lightweight Directory Access Protocol (LDAP) authentication server (OpenLDAP or Microsoft Windows Active Directory 2003 and 2012)."
+      "en_US": "Ldap-auth software is for authenticating users who request protected resources from servers proxied by nginx. It includes a daemon (ldap-auth) that communicates with an authentication server, and a webserver daemon that generates an authentication cookie based on the user’s credentials. The daemons are written in Python for use with a Lightweight Directory Access Protocol (LDAP) authentication server (OpenLDAP or Microsoft Windows Active Directory 2003 and 2012)."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "security",
+    "category_label": "Authentication & Security",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ldap-auth-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/ldap-auth-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ldap-auth-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/librechat.json b/oci/catalog/apps/librechat.json
index 594b29d1..ae6fe9d6 100644
--- a/oci/catalog/apps/librechat.json
+++ b/oci/catalog/apps/librechat.json
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "LibreChat",
     "developer": "LibreChat",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/librechat.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/libredb-studio.json b/oci/catalog/apps/libredb-studio.json
index bfeee30b..ba7e0f00 100644
--- a/oci/catalog/apps/libredb-studio.json
+++ b/oci/catalog/apps/libredb-studio.json
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "libredb",
     "developer": "libredb",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/libredb-studio.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/libreoffice.json b/oci/catalog/apps/libreoffice.json
index 5e0335cd..339f72d7 100644
--- a/oci/catalog/apps/libreoffice.json
+++ b/oci/catalog/apps/libreoffice.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "LibreOffice is a free and powerful office suite, and a successor to OpenOffice.org (commonly known as OpenOffice). Its clean interface and feature-rich tools help you unleash your creativity and enhance your productivity."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "documents",
+    "category_label": "Documents & Notes",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/libreoffice-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/libreoffice.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/libreoffice-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/librespeed.json b/oci/catalog/apps/librespeed.json
index 4087475b..f7407c8b 100644
--- a/oci/catalog/apps/librespeed.json
+++ b/oci/catalog/apps/librespeed.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Librespeed is a very lightweight Speedtest implemented in Javascript, using XMLHttpRequest and Web Workers."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "network",
+    "category_label": "Network & Firewall",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/librespeed-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/librespeed.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/librespeed-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/librewolf.json b/oci/catalog/apps/librewolf.json
index 6b7429ec..cbd24e92 100644
--- a/oci/catalog/apps/librewolf.json
+++ b/oci/catalog/apps/librewolf.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "LibreWolf is a custom and independent version of Firefox, with the primary goals of privacy, security and user freedom. LibreWolf also aims to remove all the telemetry, data collection and annoyances, as well as disabling anti-freedom features like DRM."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "desktop",
+    "category_label": "Browsers & Web Desktops",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/librewolf-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/librewolf.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/librewolf-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/lidarr.json b/oci/catalog/apps/lidarr.json
index 9eaa23ec..ea9be5d5 100644
--- a/oci/catalog/apps/lidarr.json
+++ b/oci/catalog/apps/lidarr.json
@@ -17,7 +17,7 @@
     "category_label": "*Arr Suite",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/lidarr-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/lidarr.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/lidarr-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/limnoria.json b/oci/catalog/apps/limnoria.json
index 43eec790..cfa79a05 100644
--- a/oci/catalog/apps/limnoria.json
+++ b/oci/catalog/apps/limnoria.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Limnoria A robust, full-featured, and user/programmer-friendly Python IRC bot, with many existing plugins. Successor of the well-known Supybot."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "communication",
+    "category_label": "Communication & Community",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/limnoria-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/limnoria-icon.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/limnoria-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/linkwarden.json b/oci/catalog/apps/linkwarden.json
index 902dbdfe..17b1e73d 100644
--- a/oci/catalog/apps/linkwarden.json
+++ b/oci/catalog/apps/linkwarden.json
@@ -17,7 +17,7 @@
     "category_label": "Documents & Notes",
     "author": "linkwarden",
     "developer": "linkwarden",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/linkwarden.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/llama-factory-nvidia.json b/oci/catalog/apps/llama-factory-nvidia.json
index 18dc7d13..8b980868 100644
--- a/oci/catalog/apps/llama-factory-nvidia.json
+++ b/oci/catalog/apps/llama-factory-nvidia.json
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "hiyouga",
     "developer": "hiyouga",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/LLaMA-Factory_Nvidia/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/llamacpp.json b/oci/catalog/apps/llamacpp.json
index 3ed8fc65..f9d2cad2 100644
--- a/oci/catalog/apps/llamacpp.json
+++ b/oci/catalog/apps/llamacpp.json
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "ggml-org",
     "developer": null,
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/llama-cpp.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/lm-studio.json b/oci/catalog/apps/lm-studio.json
index c57550d3..2139ffcb 100644
--- a/oci/catalog/apps/lm-studio.json
+++ b/oci/catalog/apps/lm-studio.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "LM Studio can run local AI models like gpt-oss, Llama, Gemma, Qwen, and DeepSeek privately on your computer."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "ai",
+    "category_label": "AI / Coding & Dev-Tools",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/lm-studio-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/lmstudio-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/lm-studio-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/logseq.json b/oci/catalog/apps/logseq.json
index 61213890..0ba6aada 100644
--- a/oci/catalog/apps/logseq.json
+++ b/oci/catalog/apps/logseq.json
@@ -17,7 +17,7 @@
     "category_label": "Documents & Notes",
     "author": "Logseq  Team",
     "developer": "Logseq  Team",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/logseq.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/lollypop.json b/oci/catalog/apps/lollypop.json
index 42749b91..32087a35 100644
--- a/oci/catalog/apps/lollypop.json
+++ b/oci/catalog/apps/lollypop.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Lollypop is a lightweight modern music player designed to work excellently on the GNOME desktop environment."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "media",
+    "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/lollypop-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/lollypop-icon.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/lollypop-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/luanti.json b/oci/catalog/apps/luanti.json
index 11617339..196886c1 100644
--- a/oci/catalog/apps/luanti.json
+++ b/oci/catalog/apps/luanti.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Luanti (formerly Minetest) is an open source voxel game-creation platform with easy modding and game creation"
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "gaming",
+    "category_label": "Gaming & Leisure",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/luanti-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/minetest-icon.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/luanti-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/lucky.json b/oci/catalog/apps/lucky.json
index f82b63b2..29105706 100644
--- a/oci/catalog/apps/lucky.json
+++ b/oci/catalog/apps/lucky.json
@@ -17,7 +17,7 @@
     "category_label": "Network & Firewall",
     "author": "gdy666",
     "developer": "gdy666",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/Lucky/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/lychee.json b/oci/catalog/apps/lychee.json
index de77c29f..09e18b22 100644
--- a/oci/catalog/apps/lychee.json
+++ b/oci/catalog/apps/lychee.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/lychee-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/lychee.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/lychee-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/lyrionmusicserver.json b/oci/catalog/apps/lyrionmusicserver.json
index 5e2f7aa6..db080443 100644
--- a/oci/catalog/apps/lyrionmusicserver.json
+++ b/oci/catalog/apps/lyrionmusicserver.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "LMS-Community",
     "developer": "LMS-Community",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/lyrion-music-server.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/makemkv.json b/oci/catalog/apps/makemkv.json
index a6a66626..baf712ba 100644
--- a/oci/catalog/apps/makemkv.json
+++ b/oci/catalog/apps/makemkv.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "jlesage",
     "developer": "jlesage",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/makemkv.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/mame.json b/oci/catalog/apps/mame.json
index 41a5f7ea..5ccb1133 100644
--- a/oci/catalog/apps/mame.json
+++ b/oci/catalog/apps/mame.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "MAME is a free and open-source emulator designed to emulate the hardware of arcade games, video game consoles, old computers and other systems in software on modern personal computers."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "gaming",
+    "category_label": "Gaming & Leisure",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/mame-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/mame-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/mame-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/manyfold.json b/oci/catalog/apps/manyfold.json
index 6be1d416..d8cdec21 100644
--- a/oci/catalog/apps/manyfold.json
+++ b/oci/catalog/apps/manyfold.json
@@ -17,7 +17,7 @@
     "category_label": "Gaming & Leisure",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/manyfold-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/manyfold.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/manyfold-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/mariadb.json b/oci/catalog/apps/mariadb.json
index 3d05b490..9096a1dc 100644
--- a/oci/catalog/apps/mariadb.json
+++ b/oci/catalog/apps/mariadb.json
@@ -17,7 +17,7 @@
     "category_label": "Databases",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/mariadb-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/mariadb.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/mariadb-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/mastodon.json b/oci/catalog/apps/mastodon.json
index 15b0d5fb..0dbe6d5f 100644
--- a/oci/catalog/apps/mastodon.json
+++ b/oci/catalog/apps/mastodon.json
@@ -17,7 +17,7 @@
     "category_label": "Communication & Community",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/mastodon-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/mastodon.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/mastodon-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/maybe.json b/oci/catalog/apps/maybe.json
index e1e0b7cd..933c0106 100644
--- a/oci/catalog/apps/maybe.json
+++ b/oci/catalog/apps/maybe.json
@@ -17,7 +17,7 @@
     "category_label": "Finance & Budgeting",
     "author": "maybe-finance",
     "developer": "maybe-finance",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/maybe.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/mediaelch.json b/oci/catalog/apps/mediaelch.json
index f314218b..ae5aa48a 100644
--- a/oci/catalog/apps/mediaelch.json
+++ b/oci/catalog/apps/mediaelch.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "MediaElch is a MediaManager for Kodi. Information about Movies, TV Shows, Concerts and Music are stored as nfo files. Fanarts are downloaded automatically from fanart.tv. Using the nfo generator, MediaElch can be used with other MediaCenters as well."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "media",
+    "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/mediaelch-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/mediaelch.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/mediaelch-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/medusa-official.json b/oci/catalog/apps/medusa-official.json
index 0f99e6b8..233f3534 100644
--- a/oci/catalog/apps/medusa-official.json
+++ b/oci/catalog/apps/medusa-official.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "pyMedusa (https://github.com/pymedusa)",
     "developer": "pyMedusa (https://github.com/pymedusa)",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/medusa.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/medusa.json b/oci/catalog/apps/medusa.json
index d13d38e4..0e84d01f 100644
--- a/oci/catalog/apps/medusa.json
+++ b/oci/catalog/apps/medusa.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/medusa-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/medusa.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/medusa-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/melonds.json b/oci/catalog/apps/melonds.json
index 592eaaaa..5e4e507b 100644
--- a/oci/catalog/apps/melonds.json
+++ b/oci/catalog/apps/melonds.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "melonDS aims at providing fast and accurate Nintendo DS emulation."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "gaming",
+    "category_label": "Gaming & Leisure",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/melonds-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/melonds-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/melonds-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/memos.json b/oci/catalog/apps/memos.json
index 85ac11e7..48b2167f 100644
--- a/oci/catalog/apps/memos.json
+++ b/oci/catalog/apps/memos.json
@@ -11,13 +11,13 @@
       "en_US": "Memos is a lightweight, self-hosted memo hub. Open Source and Free forever."
     },
     "description": {
-      "en_US": "Memos is a lightweight, open-source, self-hosted note-taking application that offers a secure and streamlined solution for users prioritizing privacy and data control. All notes are stored on the user\u2019s own server, eliminating risks associated with third-party cloud services. Its minimalist Web interface supports Markdown syntax and tag-based organization, enabling effortless capture of ideas, personal knowledge management, or small-scale team collaboration. The open-source design ensures transparency, long-term maintainability, and no subscription costs, making it ideal for users seeking data ownership and cost efficiency.\n\nDesigned for simplicity and efficiency, Memos caters to a variety of use cases. Whether jotting down daily thoughts, organizing study notes, or sharing task memos in small teams, Memos delivers a seamless experience through its intuitive tag system and Markdown formatting. Accessible via any web browser, it requires no proprietary clients or complex setup, allowing users to manage notes anytime, anywhere.\n\nWhether used for long-term personal knowledge archiving or as a lightweight tool for team collaboration, Memos offers a secure, flexible, and user-friendly solution, empowering users to maintain full control over their data while enjoying a streamlined note-taking experience.\n"
+      "en_US": "Memos is a lightweight, open-source, self-hosted note-taking application that offers a secure and streamlined solution for users prioritizing privacy and data control. All notes are stored on the user’s own server, eliminating risks associated with third-party cloud services. Its minimalist Web interface supports Markdown syntax and tag-based organization, enabling effortless capture of ideas, personal knowledge management, or small-scale team collaboration. The open-source design ensures transparency, long-term maintainability, and no subscription costs, making it ideal for users seeking data ownership and cost efficiency.\n\nDesigned for simplicity and efficiency, Memos caters to a variety of use cases. Whether jotting down daily thoughts, organizing study notes, or sharing task memos in small teams, Memos delivers a seamless experience through its intuitive tag system and Markdown formatting. Accessible via any web browser, it requires no proprietary clients or complex setup, allowing users to manage notes anytime, anywhere.\n\nWhether used for long-term personal knowledge archiving or as a lightweight tool for team collaboration, Memos offers a secure, flexible, and user-friendly solution, empowering users to maintain full control over their data while enjoying a streamlined note-taking experience.\n"
     },
     "category": "documents",
     "category_label": "Documents & Notes",
     "author": "usememos Team",
     "developer": "usememos Team",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/memos.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/mineos-node.json b/oci/catalog/apps/mineos-node.json
index 830e97a7..f537883c 100644
--- a/oci/catalog/apps/mineos-node.json
+++ b/oci/catalog/apps/mineos-node.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "MineOS is a server front-end to ease managing Minecraft administrative tasks. This iteration using Node.js aims to enhance previous MineOS scripts (Python-based), by leveraging the event-triggering, asyncronous model of Node.JS and websockets."
     },
-    "category": "media",
-    "category_label": "Media & Streaming",
+    "category": "gaming",
+    "category_label": "Gaming & Leisure",
     "author": "hexparrot",
     "developer": "hexparrot",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/mineos.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/minisatip.json b/oci/catalog/apps/minisatip.json
index 42cbb978..6d0b6a40 100644
--- a/oci/catalog/apps/minisatip.json
+++ b/oci/catalog/apps/minisatip.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Minisatip is a multi-threaded satip server version 1.2 that runs under Linux and it was tested with DVB-S, DVB-S2, DVB-T, DVB-T2, DVB-C, DVB-C2, ATSC and ISDB-T cards."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "media",
+    "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/minisatip-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/minisatip-icon.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/minisatip-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/mkvtoolnix.json b/oci/catalog/apps/mkvtoolnix.json
index ad645270..bab9762e 100644
--- a/oci/catalog/apps/mkvtoolnix.json
+++ b/oci/catalog/apps/mkvtoolnix.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "jlesage",
     "developer": "jlesage",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/mkvtoolnix.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/mongodb.json b/oci/catalog/apps/mongodb.json
index c4569dfe..8181c134 100644
--- a/oci/catalog/apps/mongodb.json
+++ b/oci/catalog/apps/mongodb.json
@@ -17,7 +17,7 @@
     "category_label": "Databases",
     "author": "MongoDB Inc.",
     "developer": "MongoDB Inc.",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/mongodb.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/mongodb4.json b/oci/catalog/apps/mongodb4.json
index fd816711..2a55d7d1 100644
--- a/oci/catalog/apps/mongodb4.json
+++ b/oci/catalog/apps/mongodb4.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "MongoDB is a free and open-source cross-platform document-oriented database program. Classified as a NoSQL database program, MongoDB uses JSON-like documents with schemata. MongoDB is developed by MongoDB Inc., and is published under a combination of the Server Side Public License and the Apache License."
     },
-    "category": "ai",
-    "category_label": "AI / Coding & Dev-Tools",
+    "category": "databases",
+    "category_label": "Databases",
     "author": "MongoDB Inc.",
     "developer": "MongoDB Inc.",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/MongoDB4/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/monica-official.json b/oci/catalog/apps/monica-official.json
index cccdcd8d..b5d8014b 100644
--- a/oci/catalog/apps/monica-official.json
+++ b/oci/catalog/apps/monica-official.json
@@ -11,13 +11,13 @@
       "en_US": "A Personal Relationship Management tool to help you document your social life."
     },
     "description": {
-      "en_US": "Monica is a self-hosted personal relationship management tool that helps users document and organize interactions with family and friends via an intuitive Web interface, creating a personalized contact database. It is ideal for users balancing work and life, ensuring key personal connections are never missed.\n\nThe tool's core features include comprehensive contact management and smart reminders. It supports creating detailed contact profiles, logging personal details, relationships (e.g., family, friends), and how contacts were met. Users can set automatic reminders for birthdays, anniversaries, and other key dates, while tracking conversations, activities, and gift ideas. A diary feature records daily moods and significant moments, maintaining a clear life record.\n\nIt offers task and debt management to track to-dos or financial interactions. Users can upload photos and documents, favorite contacts, and organize relationships with labels for streamlined data management. Full control over local data ensures privacy. The tool\u2019s intuitive operation and high flexibility deliver a modern relationship management solution.\n\n**Key Features:**\n- Comprehensive contact management with detailed profiles\n- Automatic reminders for birthdays, anniversaries, and key dates\n- Track conversations, activities, and gift ideas\n- Diary feature to record daily moods and moments\n- Task and debt management for to-dos and finances\n- Upload photos and documents, favorite contacts\n- Organize contacts with labels\n- Local data storage for privacy assurance\n\n**Learn More:**\n- [Monica Official Website](https://www.monicahq.com)\n- [Monica GitHub Repository](https://github.com/monicahq/monica)\n"
+      "en_US": "Monica is a self-hosted personal relationship management tool that helps users document and organize interactions with family and friends via an intuitive Web interface, creating a personalized contact database. It is ideal for users balancing work and life, ensuring key personal connections are never missed.\n\nThe tool's core features include comprehensive contact management and smart reminders. It supports creating detailed contact profiles, logging personal details, relationships (e.g., family, friends), and how contacts were met. Users can set automatic reminders for birthdays, anniversaries, and other key dates, while tracking conversations, activities, and gift ideas. A diary feature records daily moods and significant moments, maintaining a clear life record.\n\nIt offers task and debt management to track to-dos or financial interactions. Users can upload photos and documents, favorite contacts, and organize relationships with labels for streamlined data management. Full control over local data ensures privacy. The tool’s intuitive operation and high flexibility deliver a modern relationship management solution.\n\n**Key Features:**\n- Comprehensive contact management with detailed profiles\n- Automatic reminders for birthdays, anniversaries, and key dates\n- Track conversations, activities, and gift ideas\n- Diary feature to record daily moods and moments\n- Task and debt management for to-dos and finances\n- Upload photos and documents, favorite contacts\n- Organize contacts with labels\n- Local data storage for privacy assurance\n\n**Learn More:**\n- [Monica Official Website](https://www.monicahq.com)\n- [Monica GitHub Repository](https://github.com/monicahq/monica)\n"
     },
     "category": "productivity",
     "category_label": "Productivity & Workflows",
     "author": "monica",
     "developer": "monica",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/monica.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/monica.json b/oci/catalog/apps/monica.json
index 30b1d49f..adca760d 100644
--- a/oci/catalog/apps/monica.json
+++ b/oci/catalog/apps/monica.json
@@ -17,7 +17,7 @@
     "category_label": "Productivity & Workflows",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/monica-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/monica.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/monica-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/motioneye.json b/oci/catalog/apps/motioneye.json
index 28a31bd2..392c48b1 100644
--- a/oci/catalog/apps/motioneye.json
+++ b/oci/catalog/apps/motioneye.json
@@ -17,7 +17,7 @@
     "category_label": "NVR & Cameras",
     "author": "Motioneye",
     "developer": "Motioneye",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/motioneye.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/msedge.json b/oci/catalog/apps/msedge.json
index 4d0b34bf..445e2ff9 100644
--- a/oci/catalog/apps/msedge.json
+++ b/oci/catalog/apps/msedge.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Microsoft Edge is a cross-platform web browser developed by Microsoft and based on Chromium."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "desktop",
+    "category_label": "Browsers & Web Desktops",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/msedge-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/edge-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/msedge-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/mstream.json b/oci/catalog/apps/mstream.json
index 4d911458..94454de4 100644
--- a/oci/catalog/apps/mstream.json
+++ b/oci/catalog/apps/mstream.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "mstream is a personal music streaming server. You can use mStream to stream your music from your home computer to any device, anywhere.  There are mobile apps available for both Android and iPhone."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "media",
+    "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/mstream-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/mstream.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/mstream-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/mullvad-browser.json b/oci/catalog/apps/mullvad-browser.json
index 1fbdd24f..df88964a 100644
--- a/oci/catalog/apps/mullvad-browser.json
+++ b/oci/catalog/apps/mullvad-browser.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": ""
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "desktop",
+    "category_label": "Browsers & Web Desktops",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/mullvad-browser-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/mullvad-browser.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/mullvad-browser-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/mylar3.json b/oci/catalog/apps/mylar3.json
index 6726002d..ab9b5cb8 100644
--- a/oci/catalog/apps/mylar3.json
+++ b/oci/catalog/apps/mylar3.json
@@ -17,7 +17,7 @@
     "category_label": "*Arr Suite",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/mylar3-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/mylar3.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/mylar3-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/myspeed.json b/oci/catalog/apps/myspeed.json
index 08270762..13a41913 100644
--- a/oci/catalog/apps/myspeed.json
+++ b/oci/catalog/apps/myspeed.json
@@ -17,7 +17,7 @@
     "category_label": "Monitoring & Analytics",
     "author": "Mathias Wagner",
     "developer": "Mathias Wagner",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/myspeed.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/mysql-workbench.json b/oci/catalog/apps/mysql-workbench.json
index c4894699..511134a1 100644
--- a/oci/catalog/apps/mysql-workbench.json
+++ b/oci/catalog/apps/mysql-workbench.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "MySQL Workbench is a unified visual tool for database architects, developers, and DBAs. MySQL Workbench provides data modeling, SQL development, and comprehensive administration tools for server configuration, user administration, backup, and much more."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "databases",
+    "category_label": "Databases",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/mysql-workbench-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/mysql-workbench-icon.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/mysql-workbench-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/n8n.json b/oci/catalog/apps/n8n.json
index 63577050..5862f5e4 100644
--- a/oci/catalog/apps/n8n.json
+++ b/oci/catalog/apps/n8n.json
@@ -11,13 +11,13 @@
       "en_US": "Workflow automation tool"
     },
     "description": {
-      "en_US": "n8n is a powerful open-source workflow automation and conversational AI platform that blends the flexibility of coding with the simplicity of no-code development, empowering users to create efficient and secure automation workflows. It seamlessly connects any app with an API, leveraging native AI capabilities (like LangChain-based AI agent workflows) to process custom data, ideal for personal task management, team collaboration, or enterprise-grade automation. Its vibrant community offers over 400 integrations and 900+ ready-to-use templates, enabling users to deploy automations quickly.\n\nThe platform supports highly customizable workflow design, allowing users to write JavaScript/Python, add npm packages, or use an intuitive visual interface to manage data, catering to both simple tasks and complex processes. Enterprise-grade features like advanced permissions and air-gapped deployments ensure security, while multilingual support makes it accessible globally. n8n delivers a versatile and user-friendly automation solution.\n\nDiscover n8n\u2019s Automation Scenarios\nn8n\u2019s community resources provide extensive support and inspiration, helping users explore its scenario-based value and easily build automation workflows. Below are two key resources showcasing n8n\u2019s capabilities across various use cases:\n\n1. [n8n Official Community Forum](https://community.n8n.io/): \nThe forum is a hub for user collaboration and learning, offering resources from beginner guides to advanced workflow designs. Shared use cases include automating social media posts or real-time data syncing, such as using n8n to pull data from Google Sheets and send Slack notifications, boosting team collaboration and data efficiency.\n\n2. [n8n Official Template Library](https://n8n.io/workflows/): \nThe template library offers over 900 ready-to-use workflows for scenarios like marketing automation, data analytics, and customer support. For example, a template can link Shopify to Mailchimp, automatically adding new customers to mailing lists and sending welcome emails, making automation accessible to non-technical users. AI-driven workflows, like handling customer queries with LangChain, highlight n8n\u2019s strength in intelligent interactions.\n"
+      "en_US": "n8n is a powerful open-source workflow automation and conversational AI platform that blends the flexibility of coding with the simplicity of no-code development, empowering users to create efficient and secure automation workflows. It seamlessly connects any app with an API, leveraging native AI capabilities (like LangChain-based AI agent workflows) to process custom data, ideal for personal task management, team collaboration, or enterprise-grade automation. Its vibrant community offers over 400 integrations and 900+ ready-to-use templates, enabling users to deploy automations quickly.\n\nThe platform supports highly customizable workflow design, allowing users to write JavaScript/Python, add npm packages, or use an intuitive visual interface to manage data, catering to both simple tasks and complex processes. Enterprise-grade features like advanced permissions and air-gapped deployments ensure security, while multilingual support makes it accessible globally. n8n delivers a versatile and user-friendly automation solution.\n\nDiscover n8n’s Automation Scenarios\nn8n’s community resources provide extensive support and inspiration, helping users explore its scenario-based value and easily build automation workflows. Below are two key resources showcasing n8n’s capabilities across various use cases:\n\n1. [n8n Official Community Forum](https://community.n8n.io/): \nThe forum is a hub for user collaboration and learning, offering resources from beginner guides to advanced workflow designs. Shared use cases include automating social media posts or real-time data syncing, such as using n8n to pull data from Google Sheets and send Slack notifications, boosting team collaboration and data efficiency.\n\n2. [n8n Official Template Library](https://n8n.io/workflows/): \nThe template library offers over 900 ready-to-use workflows for scenarios like marketing automation, data analytics, and customer support. For example, a template can link Shopify to Mailchimp, automatically adding new customers to mailing lists and sending welcome emails, making automation accessible to non-technical users. AI-driven workflows, like handling customer queries with LangChain, highlight n8n’s strength in intelligent interactions.\n"
     },
     "category": "automation",
     "category_label": "Automation & Scheduling",
     "author": "n8n",
     "developer": "n8n",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/n8n.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/navidrome.json b/oci/catalog/apps/navidrome.json
index ed1ce67d..64997b1d 100644
--- a/oci/catalog/apps/navidrome.json
+++ b/oci/catalog/apps/navidrome.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "deluan",
     "developer": null,
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/navidrome.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/netbird.json b/oci/catalog/apps/netbird.json
index 1aa51958..721ac239 100644
--- a/oci/catalog/apps/netbird.json
+++ b/oci/catalog/apps/netbird.json
@@ -8,16 +8,16 @@
       "en_US": "NetBird"
     },
     "tagline": {
-      "en_US": "Connect your devices into a secure WireGuard\u00ae-based overlay network with SSO, MFA and granular access controls."
+      "en_US": "Connect your devices into a secure WireGuard®-based overlay network with SSO, MFA and granular access controls."
     },
     "description": {
-      "en_US": "NetBird combines a WireGuard\u00ae-based overlay network with Zero Trust Network Access, providing a unified open source platform for reliable and secure connectivity.\n\n- Secure Remote Access \u2013 Enable least privilege network access in a few clicks\n- Zero-Config Deployment \u2013 Replace legacy VPNs with a peer-to-peer WireGuard\u00ae-based network\n- Seamless SSO with MFA \u2013 Secure your network access with session-based SSO & MFA\n- Dynamic Posture Checks \u2013 Grant access only to devices meeting your security rules\n- Centralized Network Management \u2013 Control your private network from a single place\n- Detailed Activity Logging \u2013 Identify who did what, and when in your network\n\n**Learn More:**\n- [NetBird Website](https://netbird.io)\n- [Documentation](https://docs.netbird.io)\n- [Self-Hosting Guide](https://docs.netbird.io/selfhosted/selfhosted-quickstart)\n- [NetBird GitHub](https://github.com/netbirdio/netbird)\n- [Slack Community](https://docs.netbird.io/slack-url)\n"
+      "en_US": "NetBird combines a WireGuard®-based overlay network with Zero Trust Network Access, providing a unified open source platform for reliable and secure connectivity.\n\n- Secure Remote Access – Enable least privilege network access in a few clicks\n- Zero-Config Deployment – Replace legacy VPNs with a peer-to-peer WireGuard®-based network\n- Seamless SSO with MFA – Secure your network access with session-based SSO & MFA\n- Dynamic Posture Checks – Grant access only to devices meeting your security rules\n- Centralized Network Management – Control your private network from a single place\n- Detailed Activity Logging – Identify who did what, and when in your network\n\n**Learn More:**\n- [NetBird Website](https://netbird.io)\n- [Documentation](https://docs.netbird.io)\n- [Self-Hosting Guide](https://docs.netbird.io/selfhosted/selfhosted-quickstart)\n- [NetBird GitHub](https://github.com/netbirdio/netbird)\n- [Slack Community](https://docs.netbird.io/slack-url)\n"
     },
     "category": "remote",
     "category_label": "Remote Access & VPN",
     "author": "NetBird GmbH",
     "developer": "NetBird GmbH",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/netbird.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/netbox.json b/oci/catalog/apps/netbox.json
index 1f209da1..9095a66a 100644
--- a/oci/catalog/apps/netbox.json
+++ b/oci/catalog/apps/netbox.json
@@ -17,7 +17,7 @@
     "category_label": "Network & Firewall",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/netbox-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/netbox.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/netbox-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/netdata.json b/oci/catalog/apps/netdata.json
index 5ca3ba5f..da342a92 100644
--- a/oci/catalog/apps/netdata.json
+++ b/oci/catalog/apps/netdata.json
@@ -17,7 +17,7 @@
     "category_label": "Host Management",
     "author": "official",
     "developer": null,
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/netdata.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/netronome.json b/oci/catalog/apps/netronome.json
index b8fe868c..dae18383 100644
--- a/oci/catalog/apps/netronome.json
+++ b/oci/catalog/apps/netronome.json
@@ -17,7 +17,7 @@
     "category_label": "Network & Firewall",
     "author": "autobrr",
     "developer": "autobrr",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/netronome.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/nextcloud-official.json b/oci/catalog/apps/nextcloud-official.json
index 926510de..e5b633fa 100644
--- a/oci/catalog/apps/nextcloud-official.json
+++ b/oci/catalog/apps/nextcloud-official.json
@@ -17,7 +17,7 @@
     "category_label": "Productivity & Workflows",
     "author": "Nextcloud",
     "developer": "Nextcloud",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/nextcloud.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/nextcloud-stack.json b/oci/catalog/apps/nextcloud-stack.json
index 2472968c..3f2049af 100644
--- a/oci/catalog/apps/nextcloud-stack.json
+++ b/oci/catalog/apps/nextcloud-stack.json
@@ -17,7 +17,7 @@
     "category_label": "Productivity & Workflows",
     "author": "Nextcloud",
     "developer": "Nextcloud",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/nextcloud.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/nextcloud.json b/oci/catalog/apps/nextcloud.json
index 430778be..032f4885 100644
--- a/oci/catalog/apps/nextcloud.json
+++ b/oci/catalog/apps/nextcloud.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Nextcloud gives you access to all your files wherever you are."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "productivity",
+    "category_label": "Productivity & Workflows",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/nextcloud-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/nextcloud.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/nextcloud-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/nginx.json b/oci/catalog/apps/nginx.json
index b557cd15..5a24917f 100644
--- a/oci/catalog/apps/nginx.json
+++ b/oci/catalog/apps/nginx.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Nginx is an HTTP web server, reverse proxy, content cache, load balancer, TCP/UDP proxy server, and mail proxy server."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "web",
+    "category_label": "Webservers & Proxies",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/nginx-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/nginx.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/nginx-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/nginxproxymanager.json b/oci/catalog/apps/nginxproxymanager.json
index f673b712..aa9d9b6a 100644
--- a/oci/catalog/apps/nginxproxymanager.json
+++ b/oci/catalog/apps/nginxproxymanager.json
@@ -17,7 +17,7 @@
     "category_label": "Webservers & Proxies",
     "author": "Nginx Proxy Manager",
     "developer": "Nginx Proxy Manager",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/nginx-proxy-manager.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/ngircd.json b/oci/catalog/apps/ngircd.json
index 5874fa3a..17102f3c 100644
--- a/oci/catalog/apps/ngircd.json
+++ b/oci/catalog/apps/ngircd.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Ngircd is a free, portable and lightweight Internet Relay Chat server for small or private networks, developed under the GNU General Public License (GPL). It is easy to configure, can cope with dynamic IP addresses, and supports IPv6, SSL-protected connections as well as PAM for authentication. It is written from scratch and not based on the original IRCd."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "communication",
+    "category_label": "Communication & Community",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ngircd-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/ngircd-icon.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ngircd-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/node-red.json b/oci/catalog/apps/node-red.json
index 858c8320..64c5aa78 100644
--- a/oci/catalog/apps/node-red.json
+++ b/oci/catalog/apps/node-red.json
@@ -17,7 +17,7 @@
     "category_label": "IoT & Smart Home",
     "author": "Node-RED",
     "developer": "Node-RED",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/node-red.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/nzbfast.json b/oci/catalog/apps/nzbfast.json
index bea0a557..01f5a12a 100644
--- a/oci/catalog/apps/nzbfast.json
+++ b/oci/catalog/apps/nzbfast.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "nzbfast",
     "developer": "nzbfast",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/nzbfast/icon.svg",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/nzbget.json b/oci/catalog/apps/nzbget.json
index 2df52639..8a5f779d 100644
--- a/oci/catalog/apps/nzbget.json
+++ b/oci/catalog/apps/nzbget.json
@@ -17,7 +17,7 @@
     "category_label": "Files & Downloads",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/nzbget-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/nzbget.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/nzbget-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/nzbhydra2.json b/oci/catalog/apps/nzbhydra2.json
index 4189ce1c..41d9bcd6 100644
--- a/oci/catalog/apps/nzbhydra2.json
+++ b/oci/catalog/apps/nzbhydra2.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Nzbhydra2 is a meta search application for NZB indexers, the spiritual successor to NZBmegasearcH, and an evolution of the original application NZBHydra."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "arr",
+    "category_label": "*Arr Suite",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/nzbhydra2-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/nzbhydra2.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/nzbhydra2-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/obsidian.json b/oci/catalog/apps/obsidian.json
index 8727afea..99b2f869 100644
--- a/oci/catalog/apps/obsidian.json
+++ b/oci/catalog/apps/obsidian.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Obsidian is a note-taking app that lets you create, link, and organize your notes on your device, with hundreds of plugins and themes to customize your workflow. You can also publish your notes online, access them offline, and sync them securely with end-to-end encryption."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "documents",
+    "category_label": "Documents & Notes",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/obsidian-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/obsidian.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/obsidian-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/ollama.json b/oci/catalog/apps/ollama.json
index 5d63ad36..527e23c3 100644
--- a/oci/catalog/apps/ollama.json
+++ b/oci/catalog/apps/ollama.json
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "ollama",
     "developer": "ollama",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/ollama.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/ombi.json b/oci/catalog/apps/ombi.json
index 5e00044c..a5257f36 100644
--- a/oci/catalog/apps/ombi.json
+++ b/oci/catalog/apps/ombi.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ombi-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/ombi.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ombi-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/onlyoffice.json b/oci/catalog/apps/onlyoffice.json
index 486b920a..883df28f 100644
--- a/oci/catalog/apps/onlyoffice.json
+++ b/oci/catalog/apps/onlyoffice.json
@@ -17,7 +17,7 @@
     "category_label": "Documents & Notes",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/onlyoffice-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/onlyoffice.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/onlyoffice-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/open-webui-cuda.json b/oci/catalog/apps/open-webui-cuda.json
index 63fb234d..d8542450 100644
--- a/oci/catalog/apps/open-webui-cuda.json
+++ b/oci/catalog/apps/open-webui-cuda.json
@@ -11,13 +11,13 @@
       "en_US": "User-friendly WebUI for LLMs (Formerly Ollama WebUI)"
     },
     "description": {
-      "en_US": "Open WebUI is a feature-rich, user-friendly self-hosted AI platform designed for fully offline operation, supporting multiple large language model runners and API integration. Its intuitive Web interface provides powerful AI deployment capabilities, ideal for developers, researchers, and AI enthusiasts building localized intelligent applications.\n\nThe tool's core features include local model execution and Retrieval Augmented Generation (RAG). It supports Ollama and OpenAI-compatible APIs (e.g., LMStudio, GroqCloud), enabling seamless model switching and multi-model conversations. RAG enhances chat experiences through local document loading or web search integration (e.g., SearXNG, Google PSE). Granular permissions and role-based access control (RBAC) ensure security with customized user role management.\n\nIt supports Markdown and LaTeX for enriched interactions and offers hands-free voice and video call features for dynamic communication. Image generation integration (e.g., DALL-E, ComfyUI) enriches visual content, and a model builder enables creating and importing custom models via the interface. The Pipelines plugin framework supports Python plugins, extending functionality like function calling and real-time translation. The tool\u2019s offline privacy and flexibility deliver a modern AI interaction solution.\n\n**Key Features:**\n- Local execution of Ollama and OpenAI-compatible APIs with multi-model conversations\n- RAG support with local document and web search integration (e.g., SearXNG, Google PSE)\n- Granular permissions and role-based access control (RBAC)\n- Simultaneous interaction with multiple models, leveraging their strengths\n- Image generation integration with DALL-E, ComfyUI, and more\n- Full Markdown and LaTeX support\n- Hands-free voice and video call functionality\n- Pipelines plugin framework for custom Python functionality\n\n**Learn More:**\n- [Open WebUI Official Website](https://openwebui.com)\n- [Open WebUI Documentation](https://docs.openwebui.com)\n- [Open WebUI GitHub Repository](https://github.com/open-webui/open-webui)\n"
+      "en_US": "Open WebUI is a feature-rich, user-friendly self-hosted AI platform designed for fully offline operation, supporting multiple large language model runners and API integration. Its intuitive Web interface provides powerful AI deployment capabilities, ideal for developers, researchers, and AI enthusiasts building localized intelligent applications.\n\nThe tool's core features include local model execution and Retrieval Augmented Generation (RAG). It supports Ollama and OpenAI-compatible APIs (e.g., LMStudio, GroqCloud), enabling seamless model switching and multi-model conversations. RAG enhances chat experiences through local document loading or web search integration (e.g., SearXNG, Google PSE). Granular permissions and role-based access control (RBAC) ensure security with customized user role management.\n\nIt supports Markdown and LaTeX for enriched interactions and offers hands-free voice and video call features for dynamic communication. Image generation integration (e.g., DALL-E, ComfyUI) enriches visual content, and a model builder enables creating and importing custom models via the interface. The Pipelines plugin framework supports Python plugins, extending functionality like function calling and real-time translation. The tool’s offline privacy and flexibility deliver a modern AI interaction solution.\n\n**Key Features:**\n- Local execution of Ollama and OpenAI-compatible APIs with multi-model conversations\n- RAG support with local document and web search integration (e.g., SearXNG, Google PSE)\n- Granular permissions and role-based access control (RBAC)\n- Simultaneous interaction with multiple models, leveraging their strengths\n- Image generation integration with DALL-E, ComfyUI, and more\n- Full Markdown and LaTeX support\n- Hands-free voice and video call functionality\n- Pipelines plugin framework for custom Python functionality\n\n**Learn More:**\n- [Open WebUI Official Website](https://openwebui.com)\n- [Open WebUI Documentation](https://docs.openwebui.com)\n- [Open WebUI GitHub Repository](https://github.com/open-webui/open-webui)\n"
     },
     "category": "ai",
     "category_label": "AI / Coding & Dev-Tools",
     "author": "Tim J. Baek",
     "developer": "Tim J. Baek",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/open-webui.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/open-webui-ollama.json b/oci/catalog/apps/open-webui-ollama.json
index 30674282..d862b857 100644
--- a/oci/catalog/apps/open-webui-ollama.json
+++ b/oci/catalog/apps/open-webui-ollama.json
@@ -11,13 +11,13 @@
       "en_US": "User-friendly WebUI for LLMs (Formerly Ollama WebUI)"
     },
     "description": {
-      "en_US": "Open WebUI is a feature-rich, user-friendly self-hosted AI platform designed for fully offline operation, supporting multiple large language model runners and API integration. Its intuitive Web interface provides powerful AI deployment capabilities, ideal for developers, researchers, and AI enthusiasts building localized intelligent applications.\n\nThe tool's core features include local model execution and Retrieval Augmented Generation (RAG). It supports Ollama and OpenAI-compatible APIs (e.g., LMStudio, GroqCloud), enabling seamless model switching and multi-model conversations. RAG enhances chat experiences through local document loading or web search integration (e.g., SearXNG, Google PSE). Granular permissions and role-based access control (RBAC) ensure security with customized user role management.\n\nIt supports Markdown and LaTeX for enriched interactions and offers hands-free voice and video call features for dynamic communication. Image generation integration (e.g., DALL-E, ComfyUI) enriches visual content, and a model builder enables creating and importing custom models via the interface. The Pipelines plugin framework supports Python plugins, extending functionality like function calling and real-time translation. The tool\u2019s offline privacy and flexibility deliver a modern AI interaction solution.\n\n**Key Features:**\n- Local execution of Ollama and OpenAI-compatible APIs with multi-model conversations\n- RAG support with local document and web search integration (e.g., SearXNG, Google PSE)\n- Granular permissions and role-based access control (RBAC)\n- Simultaneous interaction with multiple models, leveraging their strengths\n- Image generation integration with DALL-E, ComfyUI, and more\n- Full Markdown and LaTeX support\n- Hands-free voice and video call functionality\n- Pipelines plugin framework for custom Python functionality\n\n**Learn More:**\n- [Open WebUI Official Website](https://openwebui.com)\n- [Open WebUI Documentation](https://docs.openwebui.com)\n- [Open WebUI GitHub Repository](https://github.com/open-webui/open-webui)\n"
+      "en_US": "Open WebUI is a feature-rich, user-friendly self-hosted AI platform designed for fully offline operation, supporting multiple large language model runners and API integration. Its intuitive Web interface provides powerful AI deployment capabilities, ideal for developers, researchers, and AI enthusiasts building localized intelligent applications.\n\nThe tool's core features include local model execution and Retrieval Augmented Generation (RAG). It supports Ollama and OpenAI-compatible APIs (e.g., LMStudio, GroqCloud), enabling seamless model switching and multi-model conversations. RAG enhances chat experiences through local document loading or web search integration (e.g., SearXNG, Google PSE). Granular permissions and role-based access control (RBAC) ensure security with customized user role management.\n\nIt supports Markdown and LaTeX for enriched interactions and offers hands-free voice and video call features for dynamic communication. Image generation integration (e.g., DALL-E, ComfyUI) enriches visual content, and a model builder enables creating and importing custom models via the interface. The Pipelines plugin framework supports Python plugins, extending functionality like function calling and real-time translation. The tool’s offline privacy and flexibility deliver a modern AI interaction solution.\n\n**Key Features:**\n- Local execution of Ollama and OpenAI-compatible APIs with multi-model conversations\n- RAG support with local document and web search integration (e.g., SearXNG, Google PSE)\n- Granular permissions and role-based access control (RBAC)\n- Simultaneous interaction with multiple models, leveraging their strengths\n- Image generation integration with DALL-E, ComfyUI, and more\n- Full Markdown and LaTeX support\n- Hands-free voice and video call functionality\n- Pipelines plugin framework for custom Python functionality\n\n**Learn More:**\n- [Open WebUI Official Website](https://openwebui.com)\n- [Open WebUI Documentation](https://docs.openwebui.com)\n- [Open WebUI GitHub Repository](https://github.com/open-webui/open-webui)\n"
     },
     "category": "ai",
     "category_label": "AI / Coding & Dev-Tools",
     "author": "Tim J. Baek",
     "developer": "Tim J. Baek",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/open-webui.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/open-webui.json b/oci/catalog/apps/open-webui.json
index c7f93099..29be11c0 100644
--- a/oci/catalog/apps/open-webui.json
+++ b/oci/catalog/apps/open-webui.json
@@ -11,13 +11,13 @@
       "en_US": "User-friendly WebUI for LLMs (Formerly Ollama WebUI)"
     },
     "description": {
-      "en_US": "Open WebUI is a feature-rich, user-friendly self-hosted AI platform designed for fully offline operation, supporting multiple large language model runners and API integration. Its intuitive Web interface provides powerful AI deployment capabilities, ideal for developers, researchers, and AI enthusiasts building localized intelligent applications.\n\nThe tool's core features include local model execution and Retrieval Augmented Generation (RAG). It supports Ollama and OpenAI-compatible APIs (e.g., LMStudio, GroqCloud), enabling seamless model switching and multi-model conversations. RAG enhances chat experiences through local document loading or web search integration (e.g., SearXNG, Google PSE). Granular permissions and role-based access control (RBAC) ensure security with customized user role management.\n\nIt supports Markdown and LaTeX for enriched interactions and offers hands-free voice and video call features for dynamic communication. Image generation integration (e.g., DALL-E, ComfyUI) enriches visual content, and a model builder enables creating and importing custom models via the interface. The Pipelines plugin framework supports Python plugins, extending functionality like function calling and real-time translation. The tool\u2019s offline privacy and flexibility deliver a modern AI interaction solution.\n\n**Key Features:**\n- Local execution of Ollama and OpenAI-compatible APIs with multi-model conversations\n- RAG support with local document and web search integration (e.g., SearXNG, Google PSE)\n- Granular permissions and role-based access control (RBAC)\n- Simultaneous interaction with multiple models, leveraging their strengths\n- Image generation integration with DALL-E, ComfyUI, and more\n- Full Markdown and LaTeX support\n- Hands-free voice and video call functionality\n- Pipelines plugin framework for custom Python functionality\n\n**Learn More:**\n- [Open WebUI Official Website](https://openwebui.com)\n- [Open WebUI Documentation](https://docs.openwebui.com)\n- [Open WebUI GitHub Repository](https://github.com/open-webui/open-webui)\n"
+      "en_US": "Open WebUI is a feature-rich, user-friendly self-hosted AI platform designed for fully offline operation, supporting multiple large language model runners and API integration. Its intuitive Web interface provides powerful AI deployment capabilities, ideal for developers, researchers, and AI enthusiasts building localized intelligent applications.\n\nThe tool's core features include local model execution and Retrieval Augmented Generation (RAG). It supports Ollama and OpenAI-compatible APIs (e.g., LMStudio, GroqCloud), enabling seamless model switching and multi-model conversations. RAG enhances chat experiences through local document loading or web search integration (e.g., SearXNG, Google PSE). Granular permissions and role-based access control (RBAC) ensure security with customized user role management.\n\nIt supports Markdown and LaTeX for enriched interactions and offers hands-free voice and video call features for dynamic communication. Image generation integration (e.g., DALL-E, ComfyUI) enriches visual content, and a model builder enables creating and importing custom models via the interface. The Pipelines plugin framework supports Python plugins, extending functionality like function calling and real-time translation. The tool’s offline privacy and flexibility deliver a modern AI interaction solution.\n\n**Key Features:**\n- Local execution of Ollama and OpenAI-compatible APIs with multi-model conversations\n- RAG support with local document and web search integration (e.g., SearXNG, Google PSE)\n- Granular permissions and role-based access control (RBAC)\n- Simultaneous interaction with multiple models, leveraging their strengths\n- Image generation integration with DALL-E, ComfyUI, and more\n- Full Markdown and LaTeX support\n- Hands-free voice and video call functionality\n- Pipelines plugin framework for custom Python functionality\n\n**Learn More:**\n- [Open WebUI Official Website](https://openwebui.com)\n- [Open WebUI Documentation](https://docs.openwebui.com)\n- [Open WebUI GitHub Repository](https://github.com/open-webui/open-webui)\n"
     },
     "category": "ai",
     "category_label": "AI / Coding & Dev-Tools",
     "author": "Tim J. Baek",
     "developer": "Tim J. Baek",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/open-webui.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/openclaw.json b/oci/catalog/apps/openclaw.json
index 9ce75483..a06d80d8 100644
--- a/oci/catalog/apps/openclaw.json
+++ b/oci/catalog/apps/openclaw.json
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "openclaw",
     "developer": "openclaw",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/openclaw.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/openhab.json b/oci/catalog/apps/openhab.json
index aa869c80..5e7406da 100644
--- a/oci/catalog/apps/openhab.json
+++ b/oci/catalog/apps/openhab.json
@@ -11,13 +11,13 @@
       "en_US": "Empowering the smart home"
     },
     "description": {
-      "en_US": "The open Home Automation Bus (openHAB, pronounced \u02c8\u0259\u028ap\u0259n\u02c8h\u00e6b) is an open source, technology agnostic home automation platform which runs as the center of your smart home! Its ability to integrate a multitude of other devices and systems. openHAB includes other home automation systems, (smart) devices and other technologies into a single solution. To provide a uniform user interface and a common approach to automation rules across the entire system, regardless of the number of manufacturers and sub-systems involved. Giving you the most flexible tool available to make almost any home automation wish come true; if you can think it, odds are that you can implement it with openHAB."
+      "en_US": "The open Home Automation Bus (openHAB, pronounced ˈəʊpənˈhæb) is an open source, technology agnostic home automation platform which runs as the center of your smart home! Its ability to integrate a multitude of other devices and systems. openHAB includes other home automation systems, (smart) devices and other technologies into a single solution. To provide a uniform user interface and a common approach to automation rules across the entire system, regardless of the number of manufacturers and sub-systems involved. Giving you the most flexible tool available to make almost any home automation wish come true; if you can think it, odds are that you can implement it with openHAB."
     },
     "category": "smarthome",
     "category_label": "IoT & Smart Home",
     "author": "openHAB",
     "developer": "openHAB",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/openhab.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/openhands.json b/oci/catalog/apps/openhands.json
index a731ad6f..8402e3ce 100644
--- a/oci/catalog/apps/openhands.json
+++ b/oci/catalog/apps/openhands.json
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "All-Hands-AI",
     "developer": "All-Hands-AI",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/openhands.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/openlist.json b/oci/catalog/apps/openlist.json
index 2b38f728..cf7ddcd8 100644
--- a/oci/catalog/apps/openlist.json
+++ b/oci/catalog/apps/openlist.json
@@ -17,7 +17,7 @@
     "category_label": "Productivity & Workflows",
     "author": "OpenListTeam",
     "developer": "OpenListTeam",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/openlist.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/openshot.json b/oci/catalog/apps/openshot.json
index 82ed532d..86ead80d 100644
--- a/oci/catalog/apps/openshot.json
+++ b/oci/catalog/apps/openshot.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "OpenShot Video Editor is an award-winning free and open-source video editor for Linux, Mac, and Windows, and is dedicated to delivering high quality video editing and animation solutions to the world."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "creative",
+    "category_label": "Creative & Design",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/openshot-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/openshot-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/openshot-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/openspeedtest.json b/oci/catalog/apps/openspeedtest.json
index 622a99b6..9fb0c0a2 100644
--- a/oci/catalog/apps/openspeedtest.json
+++ b/oci/catalog/apps/openspeedtest.json
@@ -17,7 +17,7 @@
     "category_label": "Network & Firewall",
     "author": "OpenSpeedTest",
     "developer": "OpenSpeedTest",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/openspeedtest.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/openssh-server.json b/oci/catalog/apps/openssh-server.json
index 8a0019fb..10477795 100644
--- a/oci/catalog/apps/openssh-server.json
+++ b/oci/catalog/apps/openssh-server.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Openssh-server is a sandboxed environment that allows ssh access without giving keys to the entire server."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "remote",
+    "category_label": "Remote Access & VPN",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/openssh-server-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/openssh-server-icon.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/openssh-server-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/openvscode-server.json b/oci/catalog/apps/openvscode-server.json
index 94d0ceb1..1c7a4557 100644
--- a/oci/catalog/apps/openvscode-server.json
+++ b/oci/catalog/apps/openvscode-server.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Openvscode-server provides a version of VS Code that runs a server on a remote machine and allows access through a modern web browser."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "ai",
+    "category_label": "AI / Coding & Dev-Tools",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/openvscode-server-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/openvscode-server-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/openvscode-server-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/opera.json b/oci/catalog/apps/opera.json
index 352d8721..54e4caf3 100644
--- a/oci/catalog/apps/opera.json
+++ b/oci/catalog/apps/opera.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Opera is a multi-platform web browser developed by its namesake company Opera. The browser is based on Chromium, but distinguishes itself from other Chromium-based browsers (Chrome, Edge, etc.) through its user interface and other features."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "desktop",
+    "category_label": "Browsers & Web Desktops",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/opera-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/opera.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/opera-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/opodsync.json b/oci/catalog/apps/opodsync.json
index c70a3ee7..de2e8905 100644
--- a/oci/catalog/apps/opodsync.json
+++ b/oci/catalog/apps/opodsync.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "ganeshlab",
     "developer": "ganeshlab",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/oPodSync/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/orcaslicer.json b/oci/catalog/apps/orcaslicer.json
index 80c0c9e4..969ed5ed 100644
--- a/oci/catalog/apps/orcaslicer.json
+++ b/oci/catalog/apps/orcaslicer.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Orca Slicer is an open source slicer for FDM printers. OrcaSlicer is fork of Bambu Studio, it was previously known as BambuStudio-SoftFever, Bambu Studio is forked from PrusaSlicer by Prusa Research, which is from Slic3r by Alessandro Ranellucci and the RepRap community"
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "creative",
+    "category_label": "Creative & Design",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/orcaslicer-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/orca-slicer.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/orcaslicer-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/oscam.json b/oci/catalog/apps/oscam.json
index d2f4a5d7..e6dd5587 100644
--- a/oci/catalog/apps/oscam.json
+++ b/oci/catalog/apps/oscam.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Oscam is an Open Source Conditional Access Module software used for descrambling DVB transmissions using smart cards. It's both a server and a client."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "media",
+    "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/oscam-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/oscam.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/oscam-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/overseerr.json b/oci/catalog/apps/overseerr.json
index 1a543c55..c679ec36 100644
--- a/oci/catalog/apps/overseerr.json
+++ b/oci/catalog/apps/overseerr.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": "LinuxServer.io",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/overseerr.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/pairdrop.json b/oci/catalog/apps/pairdrop.json
index 6fd66032..478d7c9a 100644
--- a/oci/catalog/apps/pairdrop.json
+++ b/oci/catalog/apps/pairdrop.json
@@ -17,7 +17,7 @@
     "category_label": "Files & Downloads",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/pairdrop-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/pairdrop.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/pairdrop-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/paperless-ngx.json b/oci/catalog/apps/paperless-ngx.json
index d379f0b0..df247cb2 100644
--- a/oci/catalog/apps/paperless-ngx.json
+++ b/oci/catalog/apps/paperless-ngx.json
@@ -17,7 +17,7 @@
     "category_label": "Productivity & Workflows",
     "author": "Paperless-ngx",
     "developer": "Paperless-ngx",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/paperless-ngx.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/pcsx2.json b/oci/catalog/apps/pcsx2.json
index d4989370..e6fb4413 100644
--- a/oci/catalog/apps/pcsx2.json
+++ b/oci/catalog/apps/pcsx2.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "PCSX2 is an open source PS2 Emulator."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "gaming",
+    "category_label": "Gaming & Leisure",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/pcsx2-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/pcsx2-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/pcsx2-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/pdfding.json b/oci/catalog/apps/pdfding.json
index ce089101..395d8d91 100644
--- a/oci/catalog/apps/pdfding.json
+++ b/oci/catalog/apps/pdfding.json
@@ -17,7 +17,7 @@
     "category_label": "Productivity & Workflows",
     "author": "mrmn2",
     "developer": "mrmn2",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/pdfding.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/peanut.json b/oci/catalog/apps/peanut.json
index d971dfc6..51fa53f8 100644
--- a/oci/catalog/apps/peanut.json
+++ b/oci/catalog/apps/peanut.json
@@ -17,7 +17,7 @@
     "category_label": "Monitoring & Analytics",
     "author": "brandawg93",
     "developer": "brandawg93",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/peanut.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/pelorus.json b/oci/catalog/apps/pelorus.json
index 1d7327e8..802aea27 100644
--- a/oci/catalog/apps/pelorus.json
+++ b/oci/catalog/apps/pelorus.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Pelorus is an AI navigator for Selkies-powered Linux desktops. Pelorus runs a FastAPI server that gives an LLM agent (Ollama, OpenAI-compatible, or Gemini) control over mouse, keyboard, screenshot, and window management via the Pixelflux computer-use backend, a Linux accessibility tree (AT-SPI), and optional KWin D-Bus integration."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "ai",
+    "category_label": "AI / Coding & Dev-Tools",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/pelorus-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/pelorus-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/pelorus-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/petio.json b/oci/catalog/apps/petio.json
index e04f5a00..6fb919de 100644
--- a/oci/catalog/apps/petio.json
+++ b/oci/catalog/apps/petio.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "Petio Team",
     "developer": "Petio Team",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/petio.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/photoprism.json b/oci/catalog/apps/photoprism.json
index 651ee175..2ea12eca 100644
--- a/oci/catalog/apps/photoprism.json
+++ b/oci/catalog/apps/photoprism.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "PhotoPrism",
     "developer": "PhotoPrism",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/photoprism.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/phpmyadmin.json b/oci/catalog/apps/phpmyadmin.json
index b45a864e..4d9ff85b 100644
--- a/oci/catalog/apps/phpmyadmin.json
+++ b/oci/catalog/apps/phpmyadmin.json
@@ -17,7 +17,7 @@
     "category_label": "Databases",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/phpmyadmin-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/phpmyadmin.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/phpmyadmin-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/pidgin.json b/oci/catalog/apps/pidgin.json
index 6110fcc9..774db58a 100644
--- a/oci/catalog/apps/pidgin.json
+++ b/oci/catalog/apps/pidgin.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Pidgin is a chat program which lets you log into accounts on multiple chat networks simultaneously. This means that you can be chatting with friends on XMPP and sitting in an IRC channel at the same time."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "communication",
+    "category_label": "Communication & Community",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/pidgin-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/pidgin-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/pidgin-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/pihole.json b/oci/catalog/apps/pihole.json
index 0cb35381..a8ba7100 100644
--- a/oci/catalog/apps/pihole.json
+++ b/oci/catalog/apps/pihole.json
@@ -17,7 +17,7 @@
     "category_label": "Adblock & DNS",
     "author": "Pi-hole",
     "developer": "Pi-hole",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/pi-hole.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/pinchflat.json b/oci/catalog/apps/pinchflat.json
index 50b6f730..0528f63e 100644
--- a/oci/catalog/apps/pinchflat.json
+++ b/oci/catalog/apps/pinchflat.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "kieraneglin",
     "developer": "kieraneglin",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/pinchflat.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/pingvin-share.json b/oci/catalog/apps/pingvin-share.json
index 55af2a7a..02eb8def 100644
--- a/oci/catalog/apps/pingvin-share.json
+++ b/oci/catalog/apps/pingvin-share.json
@@ -17,7 +17,7 @@
     "category_label": "Productivity & Workflows",
     "author": "stonith404",
     "developer": "stonith404",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/pingvin-share.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/piper.json b/oci/catalog/apps/piper.json
index abddea01..bcba278c 100644
--- a/oci/catalog/apps/piper.json
+++ b/oci/catalog/apps/piper.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Piper is a fast, local neural text to speech system that sounds great and is optimized for the Raspberry Pi 4. This container provides a Wyoming protocol server for Piper."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "ai",
+    "category_label": "AI / Coding & Dev-Tools",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/piper-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/piper-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/piper-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/piwigo.json b/oci/catalog/apps/piwigo.json
index 0655821e..b7bc97d7 100644
--- a/oci/catalog/apps/piwigo.json
+++ b/oci/catalog/apps/piwigo.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Piwigo is a photo gallery software for the web that comes with powerful features to publish and manage your collection of pictures."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "media",
+    "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/piwigo-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/piwigo.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/piwigo-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/planka.json b/oci/catalog/apps/planka.json
index f2020d2f..9418a3dd 100644
--- a/oci/catalog/apps/planka.json
+++ b/oci/catalog/apps/planka.json
@@ -17,7 +17,7 @@
     "category_label": "Productivity & Workflows",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/planka-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/planka.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/planka-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/playit-agent.json b/oci/catalog/apps/playit-agent.json
index e290f6e4..6e708061 100644
--- a/oci/catalog/apps/playit-agent.json
+++ b/oci/catalog/apps/playit-agent.json
@@ -17,7 +17,7 @@
     "category_label": "Network & Firewall",
     "author": "Patrick Lorio",
     "developer": "Patrick Lorio",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/playit-agent/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/plex-official.json b/oci/catalog/apps/plex-official.json
index 38ac3a6e..fa4d67c6 100644
--- a/oci/catalog/apps/plex-official.json
+++ b/oci/catalog/apps/plex-official.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "Plex, Inc.",
     "developer": "Plex, Inc.",
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/plex-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/plex.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/plex-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/plex.json b/oci/catalog/apps/plex.json
index 66cd557a..72a41503 100644
--- a/oci/catalog/apps/plex.json
+++ b/oci/catalog/apps/plex.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/plex-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/plex.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/plex-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/pocketbase.json b/oci/catalog/apps/pocketbase.json
index ae67eb46..83e3bf49 100644
--- a/oci/catalog/apps/pocketbase.json
+++ b/oci/catalog/apps/pocketbase.json
@@ -17,7 +17,7 @@
     "category_label": "Databases",
     "author": "Gani Georgiev",
     "developer": "Gani Georgiev",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/pocketbase.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/podfetch.json b/oci/catalog/apps/podfetch.json
index 085430ab..4fa554a7 100644
--- a/oci/catalog/apps/podfetch.json
+++ b/oci/catalog/apps/podfetch.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "SamTV12345",
     "developer": "SamTV12345",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/podfetch.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/portainer.json b/oci/catalog/apps/portainer.json
index 8c6e065c..165c195c 100644
--- a/oci/catalog/apps/portainer.json
+++ b/oci/catalog/apps/portainer.json
@@ -11,13 +11,13 @@
       "en_US": "Lightweight Docker management UI"
     },
     "description": {
-      "en_US": "Portainer Community Edition (CE) is a lightweight container management tool offering an intuitive Web interface to simplify building, managing, and monitoring containerized applications. With over 500,000 active users, it is widely appreciated for its ease of use and robust functionality, ideal for individual developers, home lab users, and small teams.\n\nThe tool's core features include multi-platform support, resource management, and real-time monitoring. It supports managing various container platforms, covering containers, images, volumes, and networks. Users can quickly create, deploy, and manage containers via a \u201csmart\u201d graphical interface or comprehensive API, without needing deep command-line expertise. It provides real-time container status monitoring, log viewing, and configuration management, ensuring efficient control over application operations.\n\nIts design philosophy is to \u201csimplify container complexity\u201d with an intuitive interface and default settings that lower the technical barrier. Users can manage containerized applications without complex configurations, saving time and boosting efficiency. It is completely free, with data stored locally, ensuring full user control. Community support via GitHub Discussions and Slack, along with rich documentation and regular updates, enhances the user experience, making it suitable for learning container technology or managing small projects.\n\n**Key Features:**\n- Intuitive Web interface for simplified containerized app management\n- Supports multiple container platforms for unified resource management\n- Real-time monitoring of container status and logs\n- Rapid container deployment and management via API\n- Community support with extensive documentation and assistance\n\n**Learn More:**\n- [Portainer Official Website](https://www.portainer.io/)\n- [Portainer GitHub Repository](https://github.com/portainer/portainer)\n"
+      "en_US": "Portainer Community Edition (CE) is a lightweight container management tool offering an intuitive Web interface to simplify building, managing, and monitoring containerized applications. With over 500,000 active users, it is widely appreciated for its ease of use and robust functionality, ideal for individual developers, home lab users, and small teams.\n\nThe tool's core features include multi-platform support, resource management, and real-time monitoring. It supports managing various container platforms, covering containers, images, volumes, and networks. Users can quickly create, deploy, and manage containers via a “smart” graphical interface or comprehensive API, without needing deep command-line expertise. It provides real-time container status monitoring, log viewing, and configuration management, ensuring efficient control over application operations.\n\nIts design philosophy is to “simplify container complexity” with an intuitive interface and default settings that lower the technical barrier. Users can manage containerized applications without complex configurations, saving time and boosting efficiency. It is completely free, with data stored locally, ensuring full user control. Community support via GitHub Discussions and Slack, along with rich documentation and regular updates, enhances the user experience, making it suitable for learning container technology or managing small projects.\n\n**Key Features:**\n- Intuitive Web interface for simplified containerized app management\n- Supports multiple container platforms for unified resource management\n- Real-time monitoring of container status and logs\n- Rapid container deployment and management via API\n- Community support with extensive documentation and assistance\n\n**Learn More:**\n- [Portainer Official Website](https://www.portainer.io/)\n- [Portainer GitHub Repository](https://github.com/portainer/portainer)\n"
     },
     "category": "containers",
     "category_label": "Containers & Docker",
     "author": "Portainer",
     "developer": "Portainer",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/portainer.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/postgresql.json b/oci/catalog/apps/postgresql.json
index 46c8095d..09aaec0a 100644
--- a/oci/catalog/apps/postgresql.json
+++ b/oci/catalog/apps/postgresql.json
@@ -17,7 +17,7 @@
     "category_label": "Databases",
     "author": "PostgreSQL Global Dev't Group",
     "developer": "PostgreSQL Global Dev't Group",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/postgresql.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/ppsspp.json b/oci/catalog/apps/ppsspp.json
index a12c2640..295918db 100644
--- a/oci/catalog/apps/ppsspp.json
+++ b/oci/catalog/apps/ppsspp.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "PPSSPP is a free and open-source PSP emulator for Windows, macOS, Linux, iOS, Android, Nintendo Wii U, Nintendo Switch, BlackBerry 10, MeeGo, Pandora, Xbox Series and Symbian with a focus on speed and portability."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "gaming",
+    "category_label": "Gaming & Leisure",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ppsspp-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/ppsspp-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ppsspp-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/projectsend.json b/oci/catalog/apps/projectsend.json
index e502f590..41111cec 100644
--- a/oci/catalog/apps/projectsend.json
+++ b/oci/catalog/apps/projectsend.json
@@ -17,7 +17,7 @@
     "category_label": "Documents & Notes",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/projectsend-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/projectsend.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/projectsend-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/prowlarr.json b/oci/catalog/apps/prowlarr.json
index 5a979769..d52e6b8b 100644
--- a/oci/catalog/apps/prowlarr.json
+++ b/oci/catalog/apps/prowlarr.json
@@ -17,7 +17,7 @@
     "category_label": "*Arr Suite",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/prowlarr-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/prowlarr.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/prowlarr-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/psitransfer.json b/oci/catalog/apps/psitransfer.json
index e9e05e74..7384a0dd 100644
--- a/oci/catalog/apps/psitransfer.json
+++ b/oci/catalog/apps/psitransfer.json
@@ -17,7 +17,7 @@
     "category_label": "Productivity & Workflows",
     "author": "psitrax",
     "developer": "psitrax",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/psitransfer.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/pwndrop.json b/oci/catalog/apps/pwndrop.json
index 4177b435..a1a05a05 100644
--- a/oci/catalog/apps/pwndrop.json
+++ b/oci/catalog/apps/pwndrop.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Pwndrop is a self-deployable file hosting service for sending out red teaming payloads or securely sharing your private files over HTTP and WebDAV."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "downloads",
+    "category_label": "Files & Downloads",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/pwndrop-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/pwndrop.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/pwndrop-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/pycharm.json b/oci/catalog/apps/pycharm.json
index f014cd01..8c4931fe 100644
--- a/oci/catalog/apps/pycharm.json
+++ b/oci/catalog/apps/pycharm.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "PyCharm offers out-of-the-box support for Python, databases, Jupyter, Git, Conda, PyTorch, TensorFlow, Hugging Face, Django, Flask, FastAPI, and more."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "ai",
+    "category_label": "AI / Coding & Dev-Tools",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/pycharm-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/pycharm-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/pycharm-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/pydio-cells.json b/oci/catalog/apps/pydio-cells.json
index 1fa523de..b26c69bd 100644
--- a/oci/catalog/apps/pydio-cells.json
+++ b/oci/catalog/apps/pydio-cells.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Pydio-cells is the nextgen file sharing platform for organizations. It is a full rewrite of the Pydio project using the Go language following a micro-service architecture."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "downloads",
+    "category_label": "Files & Downloads",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/pydio-cells-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/pydio-cells-icon.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/pydio-cells-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/pyload-ng.json b/oci/catalog/apps/pyload-ng.json
index 8ad0bc6e..fd568430 100644
--- a/oci/catalog/apps/pyload-ng.json
+++ b/oci/catalog/apps/pyload-ng.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "pyLoad is a Free and Open Source download manager written in Python and designed to be extremely lightweight, easily extensible and fully manageable via web."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "downloads",
+    "category_label": "Files & Downloads",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/pyload-ng-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/pyload-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/pyload-ng-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/qbittorrent-hotio.json b/oci/catalog/apps/qbittorrent-hotio.json
index 1b52183c..c963f33d 100644
--- a/oci/catalog/apps/qbittorrent-hotio.json
+++ b/oci/catalog/apps/qbittorrent-hotio.json
@@ -11,13 +11,13 @@
       "en_US": "P2P bittorrent download"
     },
     "description": {
-      "en_US": "**Elevate Your Home Media Experience**. qBittorrent transforms your home media setup with a polished interface reminiscent of \u00b5Torrent, minus the ads. Unlike traditional download tools, it offers a streamlined, efficient, and ad-free experience. This makes it a perfect fit for those seeking a hassle-free way to manage and enjoy their media collections at home.\n\n**Feature-Rich and User-Friendly**. With qBittorrent, you gain access to a well-integrated and extensible search engine, allowing simultaneous searches across multiple torrent sites, and category-specific searches for books, music, and software. Its support for RSS feeds with advanced filters, magnet links, encrypted connections, and more, ensures you have complete control over your downloads. Available on all major platforms and in around 70 languages, qBittorrent is both versatile and accessible.\n\n**Seamless Integration with Private Clouds like self-hosted server**. Deploying qBittorrent on private cloud devices such as self-hosted server offers unparalleled convenience. Enjoy virtually unlimited storage, enhanced privacy for your data, and local network speeds that make downloading and streaming effortless. This setup ensures that your media library is always at your fingertips, securely and swiftly.\n"
+      "en_US": "**Elevate Your Home Media Experience**. qBittorrent transforms your home media setup with a polished interface reminiscent of µTorrent, minus the ads. Unlike traditional download tools, it offers a streamlined, efficient, and ad-free experience. This makes it a perfect fit for those seeking a hassle-free way to manage and enjoy their media collections at home.\n\n**Feature-Rich and User-Friendly**. With qBittorrent, you gain access to a well-integrated and extensible search engine, allowing simultaneous searches across multiple torrent sites, and category-specific searches for books, music, and software. Its support for RSS feeds with advanced filters, magnet links, encrypted connections, and more, ensures you have complete control over your downloads. Available on all major platforms and in around 70 languages, qBittorrent is both versatile and accessible.\n\n**Seamless Integration with Private Clouds like self-hosted server**. Deploying qBittorrent on private cloud devices such as self-hosted server offers unparalleled convenience. Enjoy virtually unlimited storage, enhanced privacy for your data, and local network speeds that make downloading and streaming effortless. This setup ensures that your media library is always at your fingertips, securely and swiftly.\n"
     },
     "category": "downloads",
     "category_label": "Files & Downloads",
     "author": "qBittorrent",
     "developer": "qBittorrent",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/qbittorrent.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/qbittorrent.json b/oci/catalog/apps/qbittorrent.json
index 335ca381..e8598bd9 100644
--- a/oci/catalog/apps/qbittorrent.json
+++ b/oci/catalog/apps/qbittorrent.json
@@ -17,7 +17,7 @@
     "category_label": "Files & Downloads",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/qbittorrent-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/qbittorrent.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/qbittorrent-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/qdirstat.json b/oci/catalog/apps/qdirstat.json
index 90bf3c77..72bfc0df 100644
--- a/oci/catalog/apps/qdirstat.json
+++ b/oci/catalog/apps/qdirstat.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "QDirStat Qt-based directory statistics: KDirStat without any KDE -- from the author of the original KDirStat."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "tools",
+    "category_label": "Tools",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/qdirstat-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/qdirstat.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/qdirstat-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/qui.json b/oci/catalog/apps/qui.json
index faa844c8..bfe2d58d 100644
--- a/oci/catalog/apps/qui.json
+++ b/oci/catalog/apps/qui.json
@@ -11,13 +11,13 @@
       "en_US": "Fast, modern web interface for qBittorrent"
     },
     "description": {
-      "en_US": "**One dashboard for all your qBittorrent instances.** Qui is a fast, modern web interface for qBittorrent. Instead of juggling several separate WebUI tabs, you connect every qBittorrent instance to Qui and manage them all from a single, responsive dashboard. It ships as a lightweight single binary, so it stays quick and resource-friendly even when you are watching thousands of torrents.\n\n**Automation and cross-seeding built in.** Built by the team behind autobrr, Qui goes well beyond basic torrent listing. It adds powerful rule-based automation, built-in cross-seeding that automatically finds and adds matching torrents across your trackers, scheduled backups with restore, and a clean multi-language interface. Point it at your Torznab-compatible indexers \u2014 such as Prowlarr or Jackett \u2014 to put cross-seeding on autopilot, then filter, search, and bulk-manage torrents across every instance at once.\n\n**Made for your private cloud.** Running Qui on a private cloud device like self-hosted server keeps everything in one place on hardware you control. Pair it with your qBittorrent containers for local-network speeds, full ownership of your data, and a single tidy interface for your entire download stack \u2014 accessible from any device in your home.\n"
+      "en_US": "**One dashboard for all your qBittorrent instances.** Qui is a fast, modern web interface for qBittorrent. Instead of juggling several separate WebUI tabs, you connect every qBittorrent instance to Qui and manage them all from a single, responsive dashboard. It ships as a lightweight single binary, so it stays quick and resource-friendly even when you are watching thousands of torrents.\n\n**Automation and cross-seeding built in.** Built by the team behind autobrr, Qui goes well beyond basic torrent listing. It adds powerful rule-based automation, built-in cross-seeding that automatically finds and adds matching torrents across your trackers, scheduled backups with restore, and a clean multi-language interface. Point it at your Torznab-compatible indexers — such as Prowlarr or Jackett — to put cross-seeding on autopilot, then filter, search, and bulk-manage torrents across every instance at once.\n\n**Made for your private cloud.** Running Qui on a private cloud device like self-hosted server keeps everything in one place on hardware you control. Pair it with your qBittorrent containers for local-network speeds, full ownership of your data, and a single tidy interface for your entire download stack — accessible from any device in your home.\n"
     },
     "category": "downloads",
     "category_label": "Files & Downloads",
     "author": "autobrr",
     "developer": "autobrr",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/qui.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/radarr.json b/oci/catalog/apps/radarr.json
index 3b6a8081..4bc1c2b2 100644
--- a/oci/catalog/apps/radarr.json
+++ b/oci/catalog/apps/radarr.json
@@ -8,16 +8,16 @@
       "en_US": "Radarr"
     },
     "tagline": {
-      "en_US": "Radarr - A fork of Sonarr to work with movies \u00e0 la Couchpotato."
+      "en_US": "Radarr - A fork of Sonarr to work with movies à la Couchpotato."
     },
     "description": {
-      "en_US": "Radarr - A fork of Sonarr to work with movies \u00e0 la Couchpotato."
+      "en_US": "Radarr - A fork of Sonarr to work with movies à la Couchpotato."
     },
     "category": "arr",
     "category_label": "*Arr Suite",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/radarr-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/radarr.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/radarr-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/ragflow.json b/oci/catalog/apps/ragflow.json
index 47a48b01..083ea1d4 100644
--- a/oci/catalog/apps/ragflow.json
+++ b/oci/catalog/apps/ragflow.json
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "RagFlow",
     "developer": "RagFlow",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/RagFlow/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/raneto.json b/oci/catalog/apps/raneto.json
index b2c56cfb..fbc78583 100644
--- a/oci/catalog/apps/raneto.json
+++ b/oci/catalog/apps/raneto.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Raneto - is an open source Knowledgebase platform that uses static Markdown files to power your Knowledgebase."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "documents",
+    "category_label": "Documents & Notes",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/raneto-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/raneto.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/raneto-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/rawtherapee.json b/oci/catalog/apps/rawtherapee.json
index 3eda4d8c..42667d66 100644
--- a/oci/catalog/apps/rawtherapee.json
+++ b/oci/catalog/apps/rawtherapee.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "RawTherapee is a free, cross-platform raw image processing program!"
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "creative",
+    "category_label": "Creative & Design",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/rawtherapee-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/rawtherapee-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/rawtherapee-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/rclone.json b/oci/catalog/apps/rclone.json
index 4bc4f3ff..befc74b1 100644
--- a/oci/catalog/apps/rclone.json
+++ b/oci/catalog/apps/rclone.json
@@ -17,7 +17,7 @@
     "category_label": "Backup & Recovery",
     "author": "Rclone",
     "developer": "Rclone",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/rclone.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/rdtclient.json b/oci/catalog/apps/rdtclient.json
index d6c037a6..1db4f514 100644
--- a/oci/catalog/apps/rdtclient.json
+++ b/oci/catalog/apps/rdtclient.json
@@ -17,7 +17,7 @@
     "category_label": "Files & Downloads",
     "author": "rogerfar",
     "developer": null,
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/rdt-client.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/readarr.json b/oci/catalog/apps/readarr.json
index 56f81a6a..ba0a0ff3 100644
--- a/oci/catalog/apps/readarr.json
+++ b/oci/catalog/apps/readarr.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "Readarr Team",
     "developer": "Readarr Team",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/readarr.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/remmina.json b/oci/catalog/apps/remmina.json
index 41e5dccb..4cd97cb9 100644
--- a/oci/catalog/apps/remmina.json
+++ b/oci/catalog/apps/remmina.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Remmina is a remote desktop client written in GTK, aiming to be useful for system administrators and travellers, who need to work with lots of remote computers in front of either large or tiny screens. Remmina supports multiple network protocols, in an integrated and consistent user interface. Currently RDP, VNC, SPICE, SSH and EXEC are supported."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "remote",
+    "category_label": "Remote Access & VPN",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/remmina-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/remmina.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/remmina-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/resilio-sync.json b/oci/catalog/apps/resilio-sync.json
index a1830965..ae750126 100644
--- a/oci/catalog/apps/resilio-sync.json
+++ b/oci/catalog/apps/resilio-sync.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Resilio-sync (formerly BitTorrent Sync) uses the BitTorrent protocol to sync files and folders between all of your devices. There are both free and paid versions, this container supports both. There is an official sync image but we created this one as it supports user mapping to simplify permissions for volumes."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "downloads",
+    "category_label": "Files & Downloads",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/resilio-sync-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/resilio-sync.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/resilio-sync-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/retroarch-inglebard.json b/oci/catalog/apps/retroarch-inglebard.json
index 9792c9d8..fb67744f 100644
--- a/oci/catalog/apps/retroarch-inglebard.json
+++ b/oci/catalog/apps/retroarch-inglebard.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "RetroArch-web is a web-based classic game emulator that enables users to enjoy a wide range of retro games directly in modern browsers. Supporting platforms like GBA, N64, DOS games, and NES (FC), it brings nostalgic gaming to life. Built on the open-source RetroArch project, RetroArch-web delivers robust features, including high-quality graphics rendering, audio processing, input controls, and save/load game progress, ensuring a precise and smooth emulation experience.\n\nDesigned for ease of use, RetroArch-web requires no complex software installation, running seamlessly in browsers. Its flexible configuration options let users customize controller setups, visual filters, and audio settings to suit individual preferences. With broad cross-platform compatibility, it ensures stable performance across devices, offering retro gaming enthusiasts a consistent experience on the go.\n\nBacked by an active open-source community, RetroArch-web continually improves performance and expands supported game platforms. Whether revisiting classic arcade titles or exploring vintage console games, RetroArch-web stands out as the ideal choice for retro gamers, combining powerful emulation with a user-friendly interface.\n\n**Key Features:**\n- Polished interface for browsing game collections with thumbnails and animated backgrounds\n- Supports multiple emulators and game engines for running classic games and discs\n- Next-frame response time for near-native hardware low-latency experience\n- Highly configurable settings to tweak game performance and display options\n- Automatic controller configuration for easy multiplayer gaming\n- Shaders to enhance old game rendering and mimic CRT monitor effects\n- Netplay for multiplayer gaming and spectator mode\n- Achievements system to unlock trophies and badges in classic games\n- Recording and streaming for capturing gameplay or live streaming\n\n**Learn More:**\n- [RetroArch Official Website](https://www.retroarch.com)\n- [RetroArch GitHub Repository](https://github.com/libretro/RetroArch)\n"
     },
-    "category": "media",
-    "category_label": "Media & Streaming",
+    "category": "gaming",
+    "category_label": "Gaming & Leisure",
     "author": "inglebard",
     "developer": "inglebard",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/RetroArch/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/retroarch.json b/oci/catalog/apps/retroarch.json
index c8c9306f..1244330e 100644
--- a/oci/catalog/apps/retroarch.json
+++ b/oci/catalog/apps/retroarch.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "RetroArch is a frontend for emulators, game engines and media players. It enables you to run classic games on a wide range of computers and consoles through its slick graphical interface."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "gaming",
+    "category_label": "Gaming & Leisure",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/retroarch-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/RetroArch/icon.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/retroarch-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/romm.json b/oci/catalog/apps/romm.json
index 692de4a3..af27d519 100644
--- a/oci/catalog/apps/romm.json
+++ b/oci/catalog/apps/romm.json
@@ -17,7 +17,7 @@
     "category_label": "Gaming & Leisure",
     "author": "rommapp",
     "developer": "rommapp",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/romm.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/roonserver.json b/oci/catalog/apps/roonserver.json
index e7f792cc..686391c8 100644
--- a/oci/catalog/apps/roonserver.json
+++ b/oci/catalog/apps/roonserver.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "Roon Labs",
     "developer": "Roon Labs",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/RoonServer/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/rpcs3.json b/oci/catalog/apps/rpcs3.json
index eff0637a..a48644bc 100644
--- a/oci/catalog/apps/rpcs3.json
+++ b/oci/catalog/apps/rpcs3.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "RPCS3 is a multi-platform open-source Sony PlayStation 3 emulator and debugger written in C++ for Windows, Linux, macOS and FreeBSD."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "gaming",
+    "category_label": "Gaming & Leisure",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/rpcs3-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/rpcs3-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/rpcs3-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/rsnapshot.json b/oci/catalog/apps/rsnapshot.json
index 7591f18a..abb6e039 100644
--- a/oci/catalog/apps/rsnapshot.json
+++ b/oci/catalog/apps/rsnapshot.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Rsnapshot is a filesystem snapshot utility based on rsync. rsnapshot makes it easy to make periodic snapshots of local machines, and remote machines over ssh. The code makes extensive use of hard links whenever possible, to greatly reduce the disk space required."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "backup",
+    "category_label": "Backup & Recovery",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/rsnapshot-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/rsnapshot-icon.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/rsnapshot-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/rustdesk.json b/oci/catalog/apps/rustdesk.json
index 2fc9f83a..fccc398e 100644
--- a/oci/catalog/apps/rustdesk.json
+++ b/oci/catalog/apps/rustdesk.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "RustDesk is a full-featured open source remote control alternative for self-hosting and security with minimal configuration."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "remote",
+    "category_label": "Remote Access & VPN",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/rustdesk-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/rustdesk.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/rustdesk-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/sabnzbd.json b/oci/catalog/apps/sabnzbd.json
index 8f629c4d..e4a4dcc0 100644
--- a/oci/catalog/apps/sabnzbd.json
+++ b/oci/catalog/apps/sabnzbd.json
@@ -17,7 +17,7 @@
     "category_label": "Files & Downloads",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/sabnzbd-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/sabnzbd.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/sabnzbd-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/scummvm.json b/oci/catalog/apps/scummvm.json
index 309f6bef..9edbc584 100644
--- a/oci/catalog/apps/scummvm.json
+++ b/oci/catalog/apps/scummvm.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "ScummVM is a program which allows you to run certain classic graphical adventure and role-playing games, provided you already have their data files. The clever part about this: ScummVM just replaces the executables shipped with the games, allowing you to play them on systems for which they were never designed! ScummVM is a complete rewrite of these games' executables and is not an emulator."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "gaming",
+    "category_label": "Gaming & Leisure",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/scummvm-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/scummvm-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/scummvm-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/sealskin.json b/oci/catalog/apps/sealskin.json
index 36d2cb52..32fabb71 100644
--- a/oci/catalog/apps/sealskin.json
+++ b/oci/catalog/apps/sealskin.json
@@ -8,16 +8,16 @@
       "en_US": "Sealskin"
     },
     "tagline": {
-      "en_US": "Sealskin is a self-hosted, client-server platform that enables users to run powerful, containerized desktop applications streamed directly to a web browser. It uses a browser extension to intercept user actions\u2014such as clicking a link or downloading a file and redirects them to a secure, isolated application environment running on a remote server."
+      "en_US": "Sealskin is a self-hosted, client-server platform that enables users to run powerful, containerized desktop applications streamed directly to a web browser. It uses a browser extension to intercept user actions—such as clicking a link or downloading a file and redirects them to a secure, isolated application environment running on a remote server."
     },
     "description": {
-      "en_US": "Sealskin is a self-hosted, client-server platform that enables users to run powerful, containerized desktop applications streamed directly to a web browser. It uses a browser extension to intercept user actions\u2014such as clicking a link or downloading a file and redirects them to a secure, isolated application environment running on a remote server."
+      "en_US": "Sealskin is a self-hosted, client-server platform that enables users to run powerful, containerized desktop applications streamed directly to a web browser. It uses a browser extension to intercept user actions—such as clicking a link or downloading a file and redirects them to a secure, isolated application environment running on a remote server."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "desktop",
+    "category_label": "Browsers & Web Desktops",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/sealskin-icon.png",
+    "icon": null,
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/sealskin-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/seerr.json b/oci/catalog/apps/seerr.json
index 60596c0b..565e13e1 100644
--- a/oci/catalog/apps/seerr.json
+++ b/oci/catalog/apps/seerr.json
@@ -17,7 +17,7 @@
     "category_label": "*Arr Suite",
     "author": "official",
     "developer": null,
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/seerr.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/shadps4.json b/oci/catalog/apps/shadps4.json
index 89584b54..c77ca896 100644
--- a/oci/catalog/apps/shadps4.json
+++ b/oci/catalog/apps/shadps4.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "shadPS4 is an early PlayStation 4 emulator for Windows, Linux and macOS written in C++."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "gaming",
+    "category_label": "Gaming & Leisure",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/shadps4-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/shadps4-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/shadps4-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/shotcut.json b/oci/catalog/apps/shotcut.json
index a6b862ae..0a6ccf6d 100644
--- a/oci/catalog/apps/shotcut.json
+++ b/oci/catalog/apps/shotcut.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Shotcut is a free, open source, cross-platform video editor."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "creative",
+    "category_label": "Creative & Design",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/shotcut-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/shotcut-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/shotcut-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/sickchill.json b/oci/catalog/apps/sickchill.json
index 83cd80d3..3cd687c1 100644
--- a/oci/catalog/apps/sickchill.json
+++ b/oci/catalog/apps/sickchill.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "Sickchill Team",
     "developer": "Sickchill Team",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/sickchill.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/sickgear.json b/oci/catalog/apps/sickgear.json
index b576b0e2..c683aa69 100644
--- a/oci/catalog/apps/sickgear.json
+++ b/oci/catalog/apps/sickgear.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "SickGear provides management of TV shows and/or Anime, it detects new episodes, links downloader apps, and more.."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "arr",
+    "category_label": "*Arr Suite",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/sickgear-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/sickgear.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/sickgear-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/signal.json b/oci/catalog/apps/signal.json
index eb1c9e60..486c54f6 100644
--- a/oci/catalog/apps/signal.json
+++ b/oci/catalog/apps/signal.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Signal is a messaging app with privacy at its core. It is free and easy to use, with strong end-to-end encryption that keeps your communication completely private."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "communication",
+    "category_label": "Communication & Community",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/signal-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/signal.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/signal-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/siyuan-note.json b/oci/catalog/apps/siyuan-note.json
index 93c3bb5d..ec57c4f8 100644
--- a/oci/catalog/apps/siyuan-note.json
+++ b/oci/catalog/apps/siyuan-note.json
@@ -17,7 +17,7 @@
     "category_label": "Productivity & Workflows",
     "author": "siyuan-note",
     "developer": "siyuan-note",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/Siyuan-Note/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/smokeping.json b/oci/catalog/apps/smokeping.json
index 3e84fb7a..bc236052 100644
--- a/oci/catalog/apps/smokeping.json
+++ b/oci/catalog/apps/smokeping.json
@@ -17,7 +17,7 @@
     "category_label": "Network & Firewall",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/smokeping-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/smokeping.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/smokeping-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/snapdrop.json b/oci/catalog/apps/snapdrop.json
index 6e83a6fe..0cb1ed7d 100644
--- a/oci/catalog/apps/snapdrop.json
+++ b/oci/catalog/apps/snapdrop.json
@@ -17,7 +17,7 @@
     "category_label": "Productivity & Workflows",
     "author": "linuxserver.io",
     "developer": null,
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/snapdrop.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/snapotter.json b/oci/catalog/apps/snapotter.json
index 9bfd6095..b40629eb 100644
--- a/oci/catalog/apps/snapotter.json
+++ b/oci/catalog/apps/snapotter.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "SnapOtter",
     "developer": "SnapOtter",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/snapotter.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/sonarr.json b/oci/catalog/apps/sonarr.json
index 70328ebe..73c37068 100644
--- a/oci/catalog/apps/sonarr.json
+++ b/oci/catalog/apps/sonarr.json
@@ -17,7 +17,7 @@
     "category_label": "*Arr Suite",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/sonarr-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/sonarr.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/sonarr-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/speedtest-tracker.json b/oci/catalog/apps/speedtest-tracker.json
index bcb0a581..eb201b15 100644
--- a/oci/catalog/apps/speedtest-tracker.json
+++ b/oci/catalog/apps/speedtest-tracker.json
@@ -17,7 +17,7 @@
     "category_label": "Network & Firewall",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/speedtest-tracker-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/speedtest-tracker.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/speedtest-tracker-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/spotube.json b/oci/catalog/apps/spotube.json
index bd0e5c75..1b3ac878 100644
--- a/oci/catalog/apps/spotube.json
+++ b/oci/catalog/apps/spotube.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Spotube is an open source, cross-platform Spotify client compatible across multiple platforms utilizing Spotify's data API and YouTube, Piped.video or JioSaavn as an audio source, eliminating the need for Spotify Premium"
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "media",
+    "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/spotube-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/spotube-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/spotube-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/sqlitebrowser.json b/oci/catalog/apps/sqlitebrowser.json
index c42400bc..fb19cd88 100644
--- a/oci/catalog/apps/sqlitebrowser.json
+++ b/oci/catalog/apps/sqlitebrowser.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "DB Browser for SQLite is a high quality, visual, open source tool to create, design, and edit database files compatible with SQLite."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "databases",
+    "category_label": "Databases",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/sqlitebrowser-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/sqlitebrowser.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/sqlitebrowser-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/stable-diffusion-webui-nvidia.json b/oci/catalog/apps/stable-diffusion-webui-nvidia.json
index caf53059..97e982cd 100644
--- a/oci/catalog/apps/stable-diffusion-webui-nvidia.json
+++ b/oci/catalog/apps/stable-diffusion-webui-nvidia.json
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "stability.ai",
     "developer": "stability.ai",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/StableDiffusionWebUI/icon.svg",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/steam.json b/oci/catalog/apps/steam.json
index e4fe07c5..2c07b3e3 100644
--- a/oci/catalog/apps/steam.json
+++ b/oci/catalog/apps/steam.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Steam is the ultimate destination for playing, discussing, and creating games."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "gaming",
+    "category_label": "Gaming & Leisure",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/steam-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/steam.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/steam-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/stremio.json b/oci/catalog/apps/stremio.json
index 7291043a..538ebd16 100644
--- a/oci/catalog/apps/stremio.json
+++ b/oci/catalog/apps/stremio.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "Andreas Tsarida / Stremio",
     "developer": "Andreas Tsarida / Stremio",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/stremio.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/suite-arr.json b/oci/catalog/apps/suite-arr.json
index c8c07c54..c31534d8 100644
--- a/oci/catalog/apps/suite-arr.json
+++ b/oci/catalog/apps/suite-arr.json
@@ -17,7 +17,7 @@
     "category_label": "*Arr Suite",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/prowlarr-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/svg/servarr.svg",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/prowlarr-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/sure.json b/oci/catalog/apps/sure.json
index bca5ae78..63ae0801 100644
--- a/oci/catalog/apps/sure.json
+++ b/oci/catalog/apps/sure.json
@@ -17,7 +17,7 @@
     "category_label": "Finance & Budgeting",
     "author": "we-promise",
     "developer": "we-promise",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/Sure/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/swag.json b/oci/catalog/apps/swag.json
index a8e5a21c..be4ece8a 100644
--- a/oci/catalog/apps/swag.json
+++ b/oci/catalog/apps/swag.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Nginx webserver and reverse proxy with php support and a built-in Certbot (Let's Encrypt) client. It also contains fail2ban for intrusion prevention."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "web",
+    "category_label": "Webservers & Proxies",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/swag-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/linuxserver-ls-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/swag-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/swingmusic.json b/oci/catalog/apps/swingmusic.json
index 2280f57a..bae048e3 100644
--- a/oci/catalog/apps/swingmusic.json
+++ b/oci/catalog/apps/swingmusic.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "SwingMX",
     "developer": "SwingMX",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/swing-music.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/synclounge.json b/oci/catalog/apps/synclounge.json
index fc98ddcd..864c9eb2 100644
--- a/oci/catalog/apps/synclounge.json
+++ b/oci/catalog/apps/synclounge.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Synclounge is a third party tool that allows you to watch Plex in sync with your friends/family, wherever you are."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "media",
+    "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/synclounge-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/synclounge.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/synclounge-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/syncthing.json b/oci/catalog/apps/syncthing.json
index bea1c700..2154aff2 100644
--- a/oci/catalog/apps/syncthing.json
+++ b/oci/catalog/apps/syncthing.json
@@ -17,7 +17,7 @@
     "category_label": "Files & Downloads",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/syncthing-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/syncthing.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/syncthing-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/syslog-ng.json b/oci/catalog/apps/syslog-ng.json
index 09979344..ac00e95f 100644
--- a/oci/catalog/apps/syslog-ng.json
+++ b/oci/catalog/apps/syslog-ng.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "syslog-ng allows you to flexibly collect, parse, classify, rewrite and correlate logs from across your infrastructure and store or route them to log analysis tools."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "monitoring",
+    "category_label": "Monitoring & Analytics",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/syslog-ng-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/syslog-ng-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/syslog-ng-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/tailscale.json b/oci/catalog/apps/tailscale.json
index bd687756..508748bf 100644
--- a/oci/catalog/apps/tailscale.json
+++ b/oci/catalog/apps/tailscale.json
@@ -11,13 +11,13 @@
       "en_US": "Connect your devices and users together in your own secure virtual private network."
     },
     "description": {
-      "en_US": "A modern self-hosted networking app built on WireGuard\u00ae, providing secure, encrypted connections between devices regardless of their location. Its zero-configuration networking eliminates the need for complex firewall rules, port forwarding, or network administration, making it ideal for businesses and individuals creating efficient, secure network environments.\n\nThe app's core features include seamless device connectivity and robust security. It uses WireGuard\u00ae for end-to-end encryption, ensuring traffic cannot be intercepted, with private keys stored solely on user devices. Automatic NAT traversal enables connections across computers, phones, servers, and IoT devices over different network types, forming a unified private network. It also offers identity-based access control, integrating with Google, Microsoft, GitHub, or custom SSO solutions for simple authentication, replacing traditional IP-based restrictions to enhance security.\n\nIt excels in delivering secure remote access to services and infrastructure. Users can effortlessly access home servers, connect to office networks while traveling, or establish secure links between cloud services. Subnet routing allows access to entire networks, exit nodes enable secure internet browsing, and MagicDNS simplifies device discovery. These features ensure efficient, secure access to resources from any location.\n\nIt supports nearly all platforms, including Linux, Windows, macOS, iOS, Android, and various router firmwares, with flexible deployment in cloud or on-premises environments. A user-friendly Web interface provides real-time monitoring of network topology, device status, and access controls, with community documentation aiding configuration optimization. Whether setting up secure access for small teams or managing enterprise-scale networks, the app\u2019s intuitive operation and high flexibility deliver a modern networking solution.\n\n**Key Features:**\n- End-to-end encryption via WireGuard\u00ae, ensuring uninterceptible traffic\n- Zero-configuration networking, eliminating complex firewall or port forwarding setup\n- Automatic NAT traversal for seamless device connectivity across network types\n- Identity-based access control with SSO integration (Google, Microsoft, GitHub)\n- Subnet routing for secure network-wide access\n- Exit nodes for safe internet browsing\n- MagicDNS for simplified device discovery\n\n**Learn More:**\n- [Tailscale Official Website](https://tailscale.com)\n- [Tailscale GitHub Repository](https://github.com/tailscale/tailscale)\n"
+      "en_US": "A modern self-hosted networking app built on WireGuard®, providing secure, encrypted connections between devices regardless of their location. Its zero-configuration networking eliminates the need for complex firewall rules, port forwarding, or network administration, making it ideal for businesses and individuals creating efficient, secure network environments.\n\nThe app's core features include seamless device connectivity and robust security. It uses WireGuard® for end-to-end encryption, ensuring traffic cannot be intercepted, with private keys stored solely on user devices. Automatic NAT traversal enables connections across computers, phones, servers, and IoT devices over different network types, forming a unified private network. It also offers identity-based access control, integrating with Google, Microsoft, GitHub, or custom SSO solutions for simple authentication, replacing traditional IP-based restrictions to enhance security.\n\nIt excels in delivering secure remote access to services and infrastructure. Users can effortlessly access home servers, connect to office networks while traveling, or establish secure links between cloud services. Subnet routing allows access to entire networks, exit nodes enable secure internet browsing, and MagicDNS simplifies device discovery. These features ensure efficient, secure access to resources from any location.\n\nIt supports nearly all platforms, including Linux, Windows, macOS, iOS, Android, and various router firmwares, with flexible deployment in cloud or on-premises environments. A user-friendly Web interface provides real-time monitoring of network topology, device status, and access controls, with community documentation aiding configuration optimization. Whether setting up secure access for small teams or managing enterprise-scale networks, the app’s intuitive operation and high flexibility deliver a modern networking solution.\n\n**Key Features:**\n- End-to-end encryption via WireGuard®, ensuring uninterceptible traffic\n- Zero-configuration networking, eliminating complex firewall or port forwarding setup\n- Automatic NAT traversal for seamless device connectivity across network types\n- Identity-based access control with SSO integration (Google, Microsoft, GitHub)\n- Subnet routing for secure network-wide access\n- Exit nodes for safe internet browsing\n- MagicDNS for simplified device discovery\n\n**Learn More:**\n- [Tailscale Official Website](https://tailscale.com)\n- [Tailscale GitHub Repository](https://github.com/tailscale/tailscale)\n"
     },
     "category": "network",
     "category_label": "Network & Firewall",
     "author": "Tailscale Inc.",
     "developer": "Tailscale Inc.",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/tailscale.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/tandoor.json b/oci/catalog/apps/tandoor.json
index 4bc70d5c..0fb29cf1 100644
--- a/oci/catalog/apps/tandoor.json
+++ b/oci/catalog/apps/tandoor.json
@@ -17,7 +17,7 @@
     "category_label": "Productivity & Workflows",
     "author": "Tandoor Recipes",
     "developer": "Tandoor Recipes",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/tandoor-recipes.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/taskingai.json b/oci/catalog/apps/taskingai.json
index 80561d72..c87b142e 100644
--- a/oci/catalog/apps/taskingai.json
+++ b/oci/catalog/apps/taskingai.json
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "TaskingAI Team",
     "developer": "TaskingAI Team",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/TaskingAI/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/tasmoadmin.json b/oci/catalog/apps/tasmoadmin.json
index 7974be0b..276586f0 100644
--- a/oci/catalog/apps/tasmoadmin.json
+++ b/oci/catalog/apps/tasmoadmin.json
@@ -17,7 +17,7 @@
     "category_label": "IoT & Smart Home",
     "author": "TasmoAdmin",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/TasmoAdmin/TasmoAdmin/master/assets/logo.svg",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/tasmoadmin.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/tautulli.json b/oci/catalog/apps/tautulli.json
index a2727e12..d877ee98 100644
--- a/oci/catalog/apps/tautulli.json
+++ b/oci/catalog/apps/tautulli.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/tautulli-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/tautulli.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/tautulli-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/tdarr.json b/oci/catalog/apps/tdarr.json
index 670674fd..d29934d1 100644
--- a/oci/catalog/apps/tdarr.json
+++ b/oci/catalog/apps/tdarr.json
@@ -17,7 +17,7 @@
     "category_label": "Media",
     "author": "HaveAGitGat",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/HaveAGitGat/Tdarr/master/assets/tdarr.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/tdarr.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/teable.json b/oci/catalog/apps/teable.json
index 8ad95bc9..77492157 100644
--- a/oci/catalog/apps/teable.json
+++ b/oci/catalog/apps/teable.json
@@ -17,7 +17,7 @@
     "category_label": "Databases",
     "author": "teableio",
     "developer": "teableio",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/teable.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/telegram.json b/oci/catalog/apps/telegram.json
index 640bf0cd..48673bcc 100644
--- a/oci/catalog/apps/telegram.json
+++ b/oci/catalog/apps/telegram.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Telegram is a cloud-based mobile and desktop messaging app."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "communication",
+    "category_label": "Communication & Community",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/telegram-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/telegram.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/telegram-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/thelounge.json b/oci/catalog/apps/thelounge.json
index 593f0ef3..53799074 100644
--- a/oci/catalog/apps/thelounge.json
+++ b/oci/catalog/apps/thelounge.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Thelounge (a fork of shoutIRC) is a web IRC client that you host on your own server."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "communication",
+    "category_label": "Communication & Community",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/thelounge-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/the-lounge.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/thelounge-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/threadfin.json b/oci/catalog/apps/threadfin.json
index d7e62357..b9967732 100644
--- a/oci/catalog/apps/threadfin.json
+++ b/oci/catalog/apps/threadfin.json
@@ -17,7 +17,7 @@
     "category_label": "Media & Streaming",
     "author": "jdownloader",
     "developer": "jdownloader",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/threadfin.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/thunderbird.json b/oci/catalog/apps/thunderbird.json
index 56b35e1a..d01cef9a 100644
--- a/oci/catalog/apps/thunderbird.json
+++ b/oci/catalog/apps/thunderbird.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Thunderbird is a free and open-source personal information manager primarily used as an e-mail client with a calendar and contactbook, as well as an RSS feed reader, chat client, and news client."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "communication",
+    "category_label": "Communication & Community",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/thunderbird-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/thunderbird.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/thunderbird-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/transmission.json b/oci/catalog/apps/transmission.json
index a42fbf5a..f6eb3014 100644
--- a/oci/catalog/apps/transmission.json
+++ b/oci/catalog/apps/transmission.json
@@ -8,16 +8,16 @@
       "en_US": "Transmission"
     },
     "tagline": {
-      "en_US": "Transmission is designed for easy, powerful use. Transmission has the features you want from a BitTorrent client: encryption, a web interface, peer exchange, magnet links, DHT, \u00b5TP, UPnP and NAT-PMP port forwarding, webseed support, watch directories, tracker editing, global and per-torrent speed limits, and more."
+      "en_US": "Transmission is designed for easy, powerful use. Transmission has the features you want from a BitTorrent client: encryption, a web interface, peer exchange, magnet links, DHT, µTP, UPnP and NAT-PMP port forwarding, webseed support, watch directories, tracker editing, global and per-torrent speed limits, and more."
     },
     "description": {
-      "en_US": "Transmission is designed for easy, powerful use. Transmission has the features you want from a BitTorrent client: encryption, a web interface, peer exchange, magnet links, DHT, \u00b5TP, UPnP and NAT-PMP port forwarding, webseed support, watch directories, tracker editing, global and per-torrent speed limits, and more."
+      "en_US": "Transmission is designed for easy, powerful use. Transmission has the features you want from a BitTorrent client: encryption, a web interface, peer exchange, magnet links, DHT, µTP, UPnP and NAT-PMP port forwarding, webseed support, watch directories, tracker editing, global and per-torrent speed limits, and more."
     },
     "category": "downloads",
     "category_label": "Files & Downloads",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/transmission-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/transmission.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/transmission-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/trilium.json b/oci/catalog/apps/trilium.json
index 6041f340..313c26b4 100644
--- a/oci/catalog/apps/trilium.json
+++ b/oci/catalog/apps/trilium.json
@@ -17,7 +17,7 @@
     "category_label": "Documents & Notes",
     "author": "zadam",
     "developer": "zadam",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/trilium.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/turbodiffusion-nvidia.json b/oci/catalog/apps/turbodiffusion-nvidia.json
index f8fc84b2..c102c6d8 100644
--- a/oci/catalog/apps/turbodiffusion-nvidia.json
+++ b/oci/catalog/apps/turbodiffusion-nvidia.json
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "thu-ml",
     "developer": "thu-ml",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/TurboDiffusion_Nvidia/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/tvheadend.json b/oci/catalog/apps/tvheadend.json
index 563f8de4..5e968087 100644
--- a/oci/catalog/apps/tvheadend.json
+++ b/oci/catalog/apps/tvheadend.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Tvheadend works as a proxy server: is a TV streaming server and recorder for Linux, FreeBSD and Android supporting DVB-S, DVB-S2, DVB-C, DVB-T, ATSC, ISDB-T, IPTV, SAT>IP and HDHomeRun as input sources."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "media",
+    "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/tvheadend-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/tvheadend.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/tvheadend-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/twingate-connector.json b/oci/catalog/apps/twingate-connector.json
index 7f1853e8..c47c2abc 100644
--- a/oci/catalog/apps/twingate-connector.json
+++ b/oci/catalog/apps/twingate-connector.json
@@ -17,7 +17,7 @@
     "category_label": "Remote Access & VPN",
     "author": "Twingate",
     "developer": "Twingate",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/twingate.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/ubooquity.json b/oci/catalog/apps/ubooquity.json
index d0e4a352..ded21491 100644
--- a/oci/catalog/apps/ubooquity.json
+++ b/oci/catalog/apps/ubooquity.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Ubooquity is a free, lightweight and easy-to-use home server for your comics and ebooks. Use it to access your files from anywhere, with a tablet, an e-reader, a phone or a computer."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "media",
+    "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ubooquity-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/ubooquity.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ubooquity-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/ungoogled-chromium.json b/oci/catalog/apps/ungoogled-chromium.json
index 58608e23..28ca63c5 100644
--- a/oci/catalog/apps/ungoogled-chromium.json
+++ b/oci/catalog/apps/ungoogled-chromium.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Ungoogled Chromium is Google Chromium, sans dependency on Google web services."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "desktop",
+    "category_label": "Browsers & Web Desktops",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ungoogled-chromium-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/ungoogled-chromium-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ungoogled-chromium-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/unifi-controller.json b/oci/catalog/apps/unifi-controller.json
index b7cf5bfe..f4d651f0 100644
--- a/oci/catalog/apps/unifi-controller.json
+++ b/oci/catalog/apps/unifi-controller.json
@@ -17,7 +17,7 @@
     "category_label": "Network & Firewall",
     "author": "LinuxServer.io",
     "developer": "LinuxServer.io",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/unifi-controller.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/unifi-network-application.json b/oci/catalog/apps/unifi-network-application.json
index 01885968..dae265bd 100644
--- a/oci/catalog/apps/unifi-network-application.json
+++ b/oci/catalog/apps/unifi-network-application.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": ""
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "network",
+    "category_label": "Network & Firewall",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/unifi-network-application-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/Unifi-Network-Application/icon.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/unifi-network-application-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/unpackerr.json b/oci/catalog/apps/unpackerr.json
index aaead7d1..c9e9cc53 100644
--- a/oci/catalog/apps/unpackerr.json
+++ b/oci/catalog/apps/unpackerr.json
@@ -17,7 +17,7 @@
     "category_label": "*Arr Suite",
     "author": "golift",
     "developer": null,
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/unpackerr.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/uptimekuma.json b/oci/catalog/apps/uptimekuma.json
index 5e7104c7..90bc44ce 100644
--- a/oci/catalog/apps/uptimekuma.json
+++ b/oci/catalog/apps/uptimekuma.json
@@ -17,7 +17,7 @@
     "category_label": "Monitoring & Analytics",
     "author": "Louis Lam",
     "developer": "Louis Lam",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/uptime-kuma.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/v2raya.json b/oci/catalog/apps/v2raya.json
index 8f873477..23677f10 100644
--- a/oci/catalog/apps/v2raya.json
+++ b/oci/catalog/apps/v2raya.json
@@ -17,7 +17,7 @@
     "category_label": "Network & Firewall",
     "author": "v2rayA",
     "developer": "v2rayA",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/v2raya.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/vaultwarden.json b/oci/catalog/apps/vaultwarden.json
index cc75c422..f61e953a 100644
--- a/oci/catalog/apps/vaultwarden.json
+++ b/oci/catalog/apps/vaultwarden.json
@@ -15,9 +15,9 @@
     },
     "category": "security",
     "category_label": "Authentication & Security",
-    "author": "Daniel Garc\u00eda",
-    "developer": "Daniel Garc\u00eda",
-    "icon": null,
+    "author": "Daniel García",
+    "developer": "Daniel García",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/vaultwarden.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/virt-manager.json b/oci/catalog/apps/virt-manager.json
index 762ee6f4..256c6f30 100644
--- a/oci/catalog/apps/virt-manager.json
+++ b/oci/catalog/apps/virt-manager.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "A GTK Broadway web UI for libvirt and virt-manager, to run virtual machines using QEMU/KVM."
     },
-    "category": "ai",
-    "category_label": "AI / Coding & Dev-Tools",
+    "category": "management",
+    "category_label": "Host Management",
     "author": "Red Hat",
     "developer": "Red Hat",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/VirtualMachineManager/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/vivaldi.json b/oci/catalog/apps/vivaldi.json
index 9d6b6424..fbe385d4 100644
--- a/oci/catalog/apps/vivaldi.json
+++ b/oci/catalog/apps/vivaldi.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Vivaldi is a Norwegian freeware, cross-platform web browser with a built-in email client developed by Vivaldi Technologies."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "desktop",
+    "category_label": "Browsers & Web Desktops",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/vivaldi-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/vivaldi.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/vivaldi-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/vlc.json b/oci/catalog/apps/vlc.json
index bb87bc92..4276e64b 100644
--- a/oci/catalog/apps/vlc.json
+++ b/oci/catalog/apps/vlc.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "VLC Media Player is a free and open source cross-platform multimedia player and framework that delivers dependable performance across multiple devices."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "media",
+    "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/vlc-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/vlc-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/vlc-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/vocechat.json b/oci/catalog/apps/vocechat.json
index cc0a8dc9..fbaac38b 100644
--- a/oci/catalog/apps/vocechat.json
+++ b/oci/catalog/apps/vocechat.json
@@ -11,13 +11,13 @@
       "en_US": "Have a Private Social Space Hosted on Your Site"
     },
     "description": {
-      "en_US": "VoceChat is a secure chat software designed for independent deployment, offering a flexible solution for seamless communication. It combines instant messaging with channel-based group chats, allowing you to engage in one-on-one conversations or create themed channels for group discussions.\n\nVoceChat supports a variety of message formats, including text, images, files, emojis, and rich text (Markdown), making your communication vibrant and expressive. Once deployed, it can be accessed via a WebAPP or mobile APP, ensuring a consistent experience across platforms.\n\nWith robust management features, VoceChat enables easy member and channel administration, giving you full control over your team or group\u2019s communication environment. Whether for individual users or enterprise teams, VoceChat delivers a secure, versatile, and efficient chat solution.\n"
+      "en_US": "VoceChat is a secure chat software designed for independent deployment, offering a flexible solution for seamless communication. It combines instant messaging with channel-based group chats, allowing you to engage in one-on-one conversations or create themed channels for group discussions.\n\nVoceChat supports a variety of message formats, including text, images, files, emojis, and rich text (Markdown), making your communication vibrant and expressive. Once deployed, it can be accessed via a WebAPP or mobile APP, ensuring a consistent experience across platforms.\n\nWith robust management features, VoceChat enables easy member and channel administration, giving you full control over your team or group’s communication environment. Whether for individual users or enterprise teams, VoceChat delivers a secure, versatile, and efficient chat solution.\n"
     },
     "category": "communication",
     "category_label": "Communication & Community",
     "author": "Privoce",
     "developer": "Privoce",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/VoceChat/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/vscode.json b/oci/catalog/apps/vscode.json
index e5f8d889..c8b6d4e5 100644
--- a/oci/catalog/apps/vscode.json
+++ b/oci/catalog/apps/vscode.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "VS Code is an integrated development environment developed by Microsoft. This container runs the full desktop application, for a web native version see Code Server."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "ai",
+    "category_label": "AI / Coding & Dev-Tools",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/vscode-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/vscode.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/vscode-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/vscodium-web.json b/oci/catalog/apps/vscodium-web.json
index e126f54f..1592ff77 100644
--- a/oci/catalog/apps/vscodium-web.json
+++ b/oci/catalog/apps/vscodium-web.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Vscodium-web is a community-driven, freely-licensed binary distribution of the remote host web component of Microsoft's editor VS Code."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "ai",
+    "category_label": "AI / Coding & Dev-Tools",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/vscodium-web-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/vscodium-icon.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/vscodium-web-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/vscodium.json b/oci/catalog/apps/vscodium.json
index a40a8306..cceadc6d 100644
--- a/oci/catalog/apps/vscodium.json
+++ b/oci/catalog/apps/vscodium.json
@@ -8,16 +8,16 @@
       "en_US": "Vscodium"
     },
     "tagline": {
-      "en_US": "VSCodium is a community-driven, freely-licensed binary distribution of Microsoft\u2019s editor VS Code."
+      "en_US": "VSCodium is a community-driven, freely-licensed binary distribution of Microsoft’s editor VS Code."
     },
     "description": {
-      "en_US": "VSCodium is a community-driven, freely-licensed binary distribution of Microsoft\u2019s editor VS Code."
+      "en_US": "VSCodium is a community-driven, freely-licensed binary distribution of Microsoft’s editor VS Code."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "ai",
+    "category_label": "AI / Coding & Dev-Tools",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/vscodium-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/vscodium.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/vscodium-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/wallabag.json b/oci/catalog/apps/wallabag.json
index 4a9c3dbc..54de870f 100644
--- a/oci/catalog/apps/wallabag.json
+++ b/oci/catalog/apps/wallabag.json
@@ -17,7 +17,7 @@
     "category_label": "Documents & Notes",
     "author": "wallabag",
     "developer": "wallabag",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/wallabag.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/webcord.json b/oci/catalog/apps/webcord.json
index e05c3b61..8ac3cc21 100644
--- a/oci/catalog/apps/webcord.json
+++ b/oci/catalog/apps/webcord.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "WebCord can be summarized as a pack of security and privacy hardenings, Discord features reimplementations, Electron / Chromium / Discord bugs workarounds, stylesheets, internal pages and wrapped https://discord.com page, designed to conform with ToS as much as it is possible (or hide the changes that might violate it from Discord's eyes)."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "communication",
+    "category_label": "Communication & Community",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/webcord-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/webcord-icon.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/webcord-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/webdav.json b/oci/catalog/apps/webdav.json
index 24c7f8c0..64d1a2c2 100644
--- a/oci/catalog/apps/webdav.json
+++ b/oci/catalog/apps/webdav.json
@@ -17,7 +17,7 @@
     "category_label": "Productivity & Workflows",
     "author": "Team",
     "developer": "Team",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/webdav.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/webgrabplus.json b/oci/catalog/apps/webgrabplus.json
index 933b6009..b8bd9f4f 100644
--- a/oci/catalog/apps/webgrabplus.json
+++ b/oci/catalog/apps/webgrabplus.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Webgrabplus is a multi-site incremental xmltv epg grabber. It collects tv-program guide data from selected tvguide sites for your favourite channels."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "media",
+    "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/webgrabplus-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/webgrabplus-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/webgrabplus-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/webstation.json b/oci/catalog/apps/webstation.json
index df719925..d30ce23e 100644
--- a/oci/catalog/apps/webstation.json
+++ b/oci/catalog/apps/webstation.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Webstation is a web native emulation focused LXQt desktop based on Ubuntu."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "desktop",
+    "category_label": "Browsers & Web Desktops",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/webstation-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/webstation-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/webstation-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/webtop.json b/oci/catalog/apps/webtop.json
index 75754f9f..be5ae880 100644
--- a/oci/catalog/apps/webtop.json
+++ b/oci/catalog/apps/webtop.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Webtop - Alpine, Ubuntu, Fedora, and Arch based containers containing full desktop environments in officially supported flavors accessible via any modern web browser."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "desktop",
+    "category_label": "Browsers & Web Desktops",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/webtop-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/webtop.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/webtop-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/weixin.json b/oci/catalog/apps/weixin.json
index 77e09602..a1a6b9bf 100644
--- a/oci/catalog/apps/weixin.json
+++ b/oci/catalog/apps/weixin.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Weixin (WeChat) is an instant messaging, social media, and mobile payment app developed by Tencent."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "communication",
+    "category_label": "Communication & Community",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/weixin-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/weixin-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/weixin-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/weknora.json b/oci/catalog/apps/weknora.json
index 48a2e85a..9c6abb16 100644
--- a/oci/catalog/apps/weknora.json
+++ b/oci/catalog/apps/weknora.json
@@ -17,7 +17,7 @@
     "category_label": "AI / Coding & Dev-Tools",
     "author": "Tencent",
     "developer": "Tencent",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/WeKnora/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/wg-easy.json b/oci/catalog/apps/wg-easy.json
index b70931ed..2811ba84 100644
--- a/oci/catalog/apps/wg-easy.json
+++ b/oci/catalog/apps/wg-easy.json
@@ -17,7 +17,7 @@
     "category_label": "Network & Firewall",
     "author": "WeejeWel",
     "developer": "WeejeWel",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/WireGuardEasy/icon.png",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/wikijs.json b/oci/catalog/apps/wikijs.json
index 75e2ad63..5479a33a 100644
--- a/oci/catalog/apps/wikijs.json
+++ b/oci/catalog/apps/wikijs.json
@@ -17,7 +17,7 @@
     "category_label": "Documents & Notes",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/wikijs-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/wiki-js.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/wikijs-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/winegui.json b/oci/catalog/apps/winegui.json
index 590ed49e..431ca136 100644
--- a/oci/catalog/apps/winegui.json
+++ b/oci/catalog/apps/winegui.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "WineGUI is a user-interface friendly Wine manager that provides a graphical frontend for creating and managing Wine bottles."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "desktop",
+    "category_label": "Browsers & Web Desktops",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/winegui-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/winegui-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/winegui-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/wireguard.json b/oci/catalog/apps/wireguard.json
index 236b6b27..6ea1ced8 100644
--- a/oci/catalog/apps/wireguard.json
+++ b/oci/catalog/apps/wireguard.json
@@ -8,16 +8,16 @@
       "en_US": "Wireguard"
     },
     "tagline": {
-      "en_US": "WireGuard\u00ae is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many different circumstances. Initially released for the Linux kernel, it is now cross-platform (Windows, macOS, BSD, iOS, Android) and widely deployable. It is currently under heavy development, but already it might be regarded as the most secure, easiest to use, and simplest VPN solution in the industry."
+      "en_US": "WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many different circumstances. Initially released for the Linux kernel, it is now cross-platform (Windows, macOS, BSD, iOS, Android) and widely deployable. It is currently under heavy development, but already it might be regarded as the most secure, easiest to use, and simplest VPN solution in the industry."
     },
     "description": {
-      "en_US": "WireGuard\u00ae is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many different circumstances. Initially released for the Linux kernel, it is now cross-platform (Windows, macOS, BSD, iOS, Android) and widely deployable. It is currently under heavy development, but already it might be regarded as the most secure, easiest to use, and simplest VPN solution in the industry."
+      "en_US": "WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many different circumstances. Initially released for the Linux kernel, it is now cross-platform (Windows, macOS, BSD, iOS, Android) and widely deployable. It is currently under heavy development, but already it might be regarded as the most secure, easiest to use, and simplest VPN solution in the industry."
     },
     "category": "remote",
     "category_label": "Remote Access & VPN",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/wireguard-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/wireguard.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/wireguard-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/wireshark.json b/oci/catalog/apps/wireshark.json
index 06b668c0..25400f66 100644
--- a/oci/catalog/apps/wireshark.json
+++ b/oci/catalog/apps/wireshark.json
@@ -8,16 +8,16 @@
       "en_US": "Wireshark"
     },
     "tagline": {
-      "en_US": "Wireshark is the world\u2019s foremost and widely-used network protocol analyzer. It lets you see what\u2019s happening on your network at a microscopic level and is the de facto (and often de jure) standard across many commercial and non-profit enterprises, government agencies, and educational institutions. Wireshark development thrives thanks to the volunteer contributions of networking experts around the globe and is the continuation of a project started by Gerald Combs in 1998."
+      "en_US": "Wireshark is the world’s foremost and widely-used network protocol analyzer. It lets you see what’s happening on your network at a microscopic level and is the de facto (and often de jure) standard across many commercial and non-profit enterprises, government agencies, and educational institutions. Wireshark development thrives thanks to the volunteer contributions of networking experts around the globe and is the continuation of a project started by Gerald Combs in 1998."
     },
     "description": {
-      "en_US": "Wireshark is the world\u2019s foremost and widely-used network protocol analyzer. It lets you see what\u2019s happening on your network at a microscopic level and is the de facto (and often de jure) standard across many commercial and non-profit enterprises, government agencies, and educational institutions. Wireshark development thrives thanks to the volunteer contributions of networking experts around the globe and is the continuation of a project started by Gerald Combs in 1998."
+      "en_US": "Wireshark is the world’s foremost and widely-used network protocol analyzer. It lets you see what’s happening on your network at a microscopic level and is the de facto (and often de jure) standard across many commercial and non-profit enterprises, government agencies, and educational institutions. Wireshark development thrives thanks to the volunteer contributions of networking experts around the globe and is the continuation of a project started by Gerald Combs in 1998."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "network",
+    "category_label": "Network & Firewall",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/wireshark-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/wireshark.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/wireshark-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/wps-office.json b/oci/catalog/apps/wps-office.json
index d701a9a9..258fa0ce 100644
--- a/oci/catalog/apps/wps-office.json
+++ b/oci/catalog/apps/wps-office.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "WPS Office is a lightweight, feature-rich comprehensive office suite with high compatibility. As a handy and professional office software, WPS Office allows you to edit files in Writer, Presentation, Spreadsheet, and PDF to improve your work efficiency."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "documents",
+    "category_label": "Documents & Notes",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/wps-office-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/wps-office-icon.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/wps-office-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/xbackbone.json b/oci/catalog/apps/xbackbone.json
index 1d13489d..90d228f2 100644
--- a/oci/catalog/apps/xbackbone.json
+++ b/oci/catalog/apps/xbackbone.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Xbackbone is a simple, self-hosted, lightweight PHP file manager that support the instant sharing tool ShareX and *NIX systems. It supports uploading and displaying images, GIF, video, code, formatted text, and file downloading and uploading. Also have a web UI with multi user management, past uploads history and search support."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "downloads",
+    "category_label": "Files & Downloads",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/xbackbone-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/xbackbone.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/xbackbone-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/xemu.json b/oci/catalog/apps/xemu.json
index bf65e8c0..bf4f4c3d 100644
--- a/oci/catalog/apps/xemu.json
+++ b/oci/catalog/apps/xemu.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "xemu is a free and open-source application that emulates the original Microsoft Xbox game console, enabling people to play their original Xbox games on Windows, macOS, and Linux systems."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "gaming",
+    "category_label": "Gaming & Leisure",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/xemu-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/xemu-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/xemu-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/yaak.json b/oci/catalog/apps/yaak.json
index b2f0872a..fce94c29 100644
--- a/oci/catalog/apps/yaak.json
+++ b/oci/catalog/apps/yaak.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Yaak is a desktop API client for organizing and executing REST, GraphQL, and gRPC requests. It's built using Tauri, Rust, and ReactJS."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "ai",
+    "category_label": "AI / Coding & Dev-Tools",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/yaak-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/yaak-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/yaak-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/your_spotify.json b/oci/catalog/apps/your_spotify.json
index 6acaeaf5..ceba2bea 100644
--- a/oci/catalog/apps/your_spotify.json
+++ b/oci/catalog/apps/your_spotify.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Your_spotify is a self-hosted application that tracks what you listen and offers you a dashboard to explore statistics about it! It's composed of a web server which polls the Spotify API every now and then and a web application on which you can explore your statistics."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "media",
+    "category_label": "Media & Streaming",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/your_spotify-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/your-spotify.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/your_spotify-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/zen.json b/oci/catalog/apps/zen.json
index 0b3197d5..1e9981ed 100644
--- a/oci/catalog/apps/zen.json
+++ b/oci/catalog/apps/zen.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Zen Browser is a free and open-source fork of Mozilla Firefox with a focus on privacy, customizability and design."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "desktop",
+    "category_label": "Browsers & Web Desktops",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/zen-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/zen-logo.png",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/zen-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/znc.json b/oci/catalog/apps/znc.json
index b6e6edf7..a504fc0f 100644
--- a/oci/catalog/apps/znc.json
+++ b/oci/catalog/apps/znc.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Znc is an IRC network bouncer or BNC. It can detach the client from the actual IRC server, and also from selected channels. Multiple clients from different locations can connect to a single ZNC account simultaneously and therefore appear under the same nickname on IRC."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "communication",
+    "category_label": "Communication & Community",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/znc-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/znc.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/znc-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/zotero.json b/oci/catalog/apps/zotero.json
index 69247efe..865d7ffe 100644
--- a/oci/catalog/apps/zotero.json
+++ b/oci/catalog/apps/zotero.json
@@ -13,11 +13,11 @@
     "description": {
       "en_US": "Zotero is a free, easy-to-use tool to help you collect, organize, annotate, cite, and share research."
     },
-    "category": "misc",
-    "category_label": "Miscellaneous",
+    "category": "documents",
+    "category_label": "Documents & Notes",
     "author": "LinuxServer.io",
     "developer": null,
-    "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/zotero-icon.png",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/zotero.webp",
     "thumbnail": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/zotero-banner.png",
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/apps/ztnet.json b/oci/catalog/apps/ztnet.json
index 04e4fd05..08475574 100644
--- a/oci/catalog/apps/ztnet.json
+++ b/oci/catalog/apps/ztnet.json
@@ -17,7 +17,7 @@
     "category_label": "Network & Firewall",
     "author": "sinamics",
     "developer": "sinamics",
-    "icon": null,
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/ztnet.webp",
     "thumbnail": null,
     "screenshots": [],
     "architectures": [
diff --git a/oci/catalog/categories.json b/oci/catalog/categories.json
index ed793b11..3fe4430f 100644
--- a/oci/catalog/categories.json
+++ b/oci/catalog/categories.json
@@ -30,6 +30,7 @@
     "desktop": "Browsers & Web Desktops"
   },
   "applications": {
+    "adguard-home": "adblock",
     "adminer": "databases",
     "airsonic-advanced": "media",
     "altus": "communication",
@@ -55,6 +56,9 @@
     "cura": "creative",
     "darktable": "creative",
     "davos": "downloads",
+    "ddclient": "adblock",
+    "ddns-go": "adblock",
+    "ddns-updater": "adblock",
     "digikam": "creative",
     "dogwalk": "gaming",
     "dokuwiki": "documents",
@@ -63,7 +67,7 @@
     "doplarr_rs": "arr",
     "dosbox-staging": "gaming",
     "doublecommander": "tools",
-    "duckdns": "network",
+    "duckdns": "adblock",
     "duckstation": "gaming",
     "eden": "gaming",
     "emulatorjs": "gaming",
@@ -74,6 +78,7 @@
     "flexget": "arr",
     "flycast": "gaming",
     "freecad": "creative",
+    "gateway-go": "web",
     "gimp": "creative",
     "github-desktop": "ai",
     "gitqlient": "ai",
@@ -97,12 +102,13 @@
     "krita": "creative",
     "ldap-auth": "security",
     "libreoffice": "documents",
-    "librespeed": "network",
+    "librespeed": "monitoring",
     "librewolf": "desktop",
     "limnoria": "communication",
     "lm-studio": "ai",
     "lollypop": "media",
     "luanti": "gaming",
+    "lucky": "web",
     "mame": "gaming",
     "mediaelch": "media",
     "melonds": "gaming",
@@ -113,12 +119,14 @@
     "mstream": "media",
     "mullvad-browser": "desktop",
     "mysql-workbench": "databases",
+    "netronome": "monitoring",
     "nextcloud": "productivity",
     "nginx": "web",
     "ngircd": "communication",
     "nzbhydra2": "arr",
     "obsidian": "documents",
     "openshot": "creative",
+    "openspeedtest": "monitoring",
     "openssh-server": "remote",
     "openvscode-server": "ai",
     "opera": "desktop",
@@ -129,6 +137,7 @@
     "pidgin": "communication",
     "piper": "ai",
     "piwigo": "media",
+    "playit-agent": "web",
     "ppsspp": "gaming",
     "pwndrop": "downloads",
     "pycharm": "ai",
@@ -150,12 +159,15 @@
     "shotcut": "creative",
     "sickgear": "arr",
     "signal": "communication",
+    "smokeping": "monitoring",
+    "speedtest-tracker": "monitoring",
     "spotube": "media",
     "sqlitebrowser": "databases",
     "steam": "gaming",
     "swag": "web",
     "synclounge": "media",
     "syslog-ng": "monitoring",
+    "tailscale": "remote",
     "telegram": "communication",
     "thelounge": "communication",
     "thunderbird": "communication",
@@ -163,6 +175,7 @@
     "ubooquity": "media",
     "ungoogled-chromium": "desktop",
     "unifi-network-application": "network",
+    "v2raya": "remote",
     "virt-manager": "management",
     "vivaldi": "desktop",
     "vlc": "media",
@@ -174,6 +187,7 @@
     "webstation": "desktop",
     "webtop": "desktop",
     "weixin": "communication",
+    "wg-easy": "remote",
     "winegui": "desktop",
     "wireshark": "network",
     "wps-office": "documents",
diff --git a/oci/catalog/index.json b/oci/catalog/index.json
index b5086610..84eda18d 100644
--- a/oci/catalog/index.json
+++ b/oci/catalog/index.json
@@ -14,7 +14,7 @@
       "repository": "https://hub.docker.com/r/2fauth/2fauth",
       "description": "2FAuth is a web based self-hosted alternative to One Time Passcode (OTP) generators like Google Authenticator, designed for both mobile and desktop.",
       "website": "https://2fauth.app",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/2fauth.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -38,7 +38,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-2fauth"
     },
     {
       "id": "actualbudget",
@@ -50,7 +51,7 @@
       "repository": "https://hub.docker.com/r/actualbudget/actual-server",
       "description": "Actual Budget is a fast, privacy-focused finance management app using local-first envelope budgeting, ensuring full control over data. Its intuitive interface supports offline use, with multi-device sync and optional end-to-end encryption, delivering a secure, efficient financial management experience, ideal for users seeking clear financial oversight.\n\nThe app's core features include envelope budgeting based on real income, rapid transaction handling, and intuitive financial reporting. It helps users track spending and monitor monthly savings clearly, with a streamlined transaction editor for quick categorization, split transactions, and transfers. Built-in net worth and cash flow reports provide financial insights, and a custom report engine allows tailored reports for specific needs. Undo and redo functionality ensures users can easily correct mistakes, maintaining operational flexibility.\n\nIt integrates bank accounts via goCardless (EU/UK) or SimpleFIN (US/Canada), supports multi-device syncing for data privacy, and enables importing transaction data from YNAB4, nYNAB, and QIF, OFX, QFX, CAMT.053, CSV files, simplifying migration of existing financial records. Community documentation enhances usability, and the app's simple operation and high flexibility deliver a modern finance management solution.\n\n**Key Features:**\n- Privacy-focused personal finance management\n- Envelope budgeting methodology\n- Multi-device synchronization\n- End-to-end encryption support\n- Local data ownership\n- Fast and responsive interface\n- Open source and self-hosted\n- Bank account synchronization\n- Detailed financial reporting\n- Budget tracking and analysis\n\n**Learn More:**\n- [Actual Budget Official Website](https://actualbudget.org)\n- [Actual Budget GitHub Repository](https://github.com/actualbudget/actual)\n- [Actual Budget Docker Image](https://hub.docker.com/r/actualbudget/actual-server)\n",
       "website": "https://actualbudget.org",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/actual-budget.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -74,7 +75,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-actualbudget"
     },
     {
       "id": "adguard-home",
@@ -86,7 +88,7 @@
       "repository": "https://hub.docker.com/r/adguard/adguardhome",
       "description": "Difference from Traditional Ad Blockers. Unlike traditional ad-blocking plugins that work only on individual devices, AdGuard Home offers a network-wide solution. By setting it up, you can block ads and trackers across all your home devices without needing to install any additional software on each device. This means comprehensive protection with minimal effort.\n\nHow AdGuard Home Works and How to Use It. AdGuard Home functions as a DNS server that reroutes tracking domains to a \"black hole,\" effectively preventing your devices from connecting to these servers. This blocks ads and trackers not only on your computer but also on your smartphone and smart home devices. To start using AdGuard Home, deploy it on your device, then change the DNS address assigned by DHCP on your router to the IP address of your AdGuard Home server.\n\nBenefits of Deploying AdGuard Home on self-hosted server Private Cloud. Deploying AdGuard Home on a self-hosted server device simplifies network-wide ad and tracker blocking, providing a seamless and secure browsing experience for all your home devices. With self-hosted server, you gain the flexibility to monitor network activity and create custom filtering rules tailored to your needs.\n",
       "website": "https://adguard.com/en/adguard-home/overview.html",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/adguard-home.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -97,8 +99,8 @@
       "pushed_at": "2026-09-11T10:43:22Z",
       "updated_at": "2026-09-01",
       "main_image": "adguard/adguardhome:latest",
-      "category": "network",
-      "category_label": "Network & Firewall",
+      "category": "adblock",
+      "category_label": "Adblock & DNS",
       "template": "apps/adguard-home.json",
       "template_status": "generated-unvalidated",
       "content_hash": "7437656a5d50e8fbd642bfc2973a4942334114c4d6a6b4e7b424396f147d76c1",
@@ -110,7 +112,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-adguard-home"
     },
     {
       "id": "adguardhome-sync",
@@ -120,7 +123,7 @@
       "repository": "https://github.com/linuxserver/docker-adguardhome-sync",
       "description": "Adguardhome-sync is a tool to synchronize AdGuardHome config to replica instances.",
       "website": "https://github.com/bakito/adguardhome-sync/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/adguardhome-sync-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/adguardhome-sync.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -142,7 +145,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-adguardhome-sync"
     },
     {
       "id": "adminer",
@@ -154,7 +158,7 @@
       "repository": "https://hub.docker.com/_/adminer",
       "description": "Adminer (formerly phpMinAdmin) is a full-featured database management tool written in PHP. Conversely to phpMyAdmin, it consist of a single file ready to deploy to the target server. Adminer is available for MySQL, PostgreSQL, SQLite, MS SQL, Oracle, Firebird, SimpleDB, Elasticsearch and MongoDB.",
       "website": "https://www.adminer.org",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/adminer.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -165,8 +169,8 @@
       "pushed_at": "2026-09-11T10:43:22Z",
       "updated_at": "2026-02-08",
       "main_image": "adminer:latest",
-      "category": "ai",
-      "category_label": "AI / Coding & Dev-Tools",
+      "category": "databases",
+      "category_label": "Databases",
       "template": "apps/adminer.json",
       "template_status": "generated-unvalidated",
       "content_hash": "1ec8eae75e1a952b5cc2b8f3516cb8cc5eec2226d0ddad566b7e244e10cc38d4",
@@ -178,7 +182,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-adminer"
     },
     {
       "id": "airsonic-advanced",
@@ -188,7 +193,7 @@
       "repository": "https://github.com/linuxserver/docker-airsonic-advanced",
       "description": "Airsonic-advanced is a free, web-based media streamer, providing ubiquitious access to your music. Use it to share your music with friends, or to listen to your own music while at work. You can stream to multiple players simultaneously, for instance to one player in your kitchen and another in your living room.",
       "website": "https://github.com/kagemomiji/airsonic-advanced",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/airsonic-advanced-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/airsonic-advanced-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -197,8 +202,8 @@
       "pushed_at": "2026-09-12T12:53:04Z",
       "updated_at": "2024-12-21",
       "main_image": "lscr.io/linuxserver/airsonic-advanced:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "media",
+      "category_label": "Media & Streaming",
       "template": "apps/airsonic-advanced.json",
       "template_status": "generated-unvalidated",
       "content_hash": "2ac8e1b0163d81c7c542119501b0cbd950b558f712409db48e1d52d2da95e158",
@@ -210,7 +215,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-airsonic-advanced"
     },
     {
       "id": "albyhub",
@@ -222,7 +228,7 @@
       "repository": "https://ghcr.io/getalby/hub",
       "description": "Alby Hub is an open-source, self-custodial Bitcoin Lightning wallet, with the easiest-to-use Lightning Network node for everyone.\nWhether you're an individual, creator, or developer, Alby Hub is your centre for seamless Bitcoin payments.\nEffortlessly connect to a variety of apps like the Alby Browser Extension or Alby Go mobile app, create sub-wallets for family and friends, and take full control of your funds\u2014all within an intuitive interface and developer-ready APIs.\n\n**USEFUL LINKS**\n- [Source Repository](https://github.com/getAlby/hub)\n- [Support](https://support.getalby.com/)\n- [Marketing Site](https://albyhub.com/)\n- [Community of users and developers](https://discord.getalby.com)\n- [Feedback Board, feature requests, bug reports[(https://feedback.getalby.com)\n",
       "website": "https://albyhub.com/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/alby-hub.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -246,7 +252,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-albyhub"
     },
     {
       "id": "alist",
@@ -258,7 +265,7 @@
       "repository": "https://hub.docker.com/r/xhofe/alist",
       "description": "Alist transforms how you manage and access your files at home, whether on your TV, phone, or any other device. Unlike traditional cloud storage, Alist offers a unified experience across multiple platforms, making it a breeze to keep your media and documents at your fingertips.\n\nWith features like easy installation, support for multiple storage providers (local, Aliyundrive, Onedrive, Google Drive), WebDAV support, dark mode, protected routes with password authentication, file previews for videos, audio, office files, PDFs, code, images, package and batch downloads, single sign-on, offline torrent downloads, file encryption, and additional tools like a text editor and Cloudflare workers proxy, Alist ensures a seamless and secure file management experience.\n\nDeploying Alist on private cloud devices like self-hosted server brings unmatched convenience with multi-device access, ensuring your files are always within reach and secure, no matter where you are.\n",
       "website": "https://alistgo.com/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/alist.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -282,7 +289,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-alist"
     },
     {
       "id": "alist-sync",
@@ -294,7 +302,7 @@
       "repository": "https://hub.docker.com/r/xjxjin/alist-sync",
       "description": "Alist-Sync is a storage synchronization tool based on the Web interface. It can achieve data synchronization and mutual backup among multiple network disks, and also has practical functions such as multi-task management, scheduled synchronization and difference handling.\n",
       "website": "",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/Alist-Sync/icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -318,7 +326,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-alist-sync"
     },
     {
       "id": "altus",
@@ -328,7 +337,7 @@
       "repository": "https://github.com/linuxserver/docker-altus",
       "description": "Altus is an Electron-based WhatsApp client with themes and multiple account support.",
       "website": "https://github.com/amanharwara/altus",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/altus-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/altus-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -337,8 +346,8 @@
       "pushed_at": "2026-09-12T08:16:57Z",
       "updated_at": "2026-04-03",
       "main_image": "lscr.io/linuxserver/altus:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "communication",
+      "category_label": "Communication & Community",
       "template": "apps/altus.json",
       "template_status": "generated-unvalidated",
       "content_hash": "2cd8310e6f13ff9ec6e2cb6fe853ae36f51a622fb197a5b5f53079d04a053dac",
@@ -350,7 +359,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-altus"
     },
     {
       "id": "amule",
@@ -360,7 +370,7 @@
       "repository": "https://github.com/ngosang/docker-amule",
       "description": "aMule is a multi-platform client for the ED2K file sharing network and based on the windows client eMule. aMule started in August 2003, as a fork of xMule, which is a fork of lMule.",
       "website": "https://github.com/amule-org/amule",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/a-mule.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -382,7 +392,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "content_hash": "bcef3879a8ce1483332eed56175200e8822600aaa6dfcb73a6e1b32209981229"
+      "content_hash": "bcef3879a8ce1483332eed56175200e8822600aaa6dfcb73a6e1b32209981229",
+      "template_id": "image-amule"
     },
     {
       "id": "anaconda3",
@@ -394,7 +405,7 @@
       "repository": "https://hub.docker.com/r/continuumio/anaconda3",
       "description": "Your machine learning Env work with Jupyter Lab",
       "website": "https://www.anaconda.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/Anaconda3/icon.png",
       "architectures": [
         "amd64"
       ],
@@ -417,7 +428,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-anaconda3"
     },
     {
       "id": "anythingllm",
@@ -429,7 +441,7 @@
       "repository": "https://hub.docker.com/r/mintplexlabs/anythingllm",
       "description": "AnythingLLM is the easiest to use, all-in-one AI application that can do RAG, AI Agents, and much more with no code or infrastructure headaches.",
       "website": "https://anythingllm.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/anythingllm.webp",
       "architectures": [
         "amd64"
       ],
@@ -452,7 +464,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-anythingllm"
     },
     {
       "id": "apprise-api",
@@ -462,7 +475,7 @@
       "repository": "https://github.com/linuxserver/docker-apprise-api",
       "description": "Apprise-api Takes advantage of Apprise through your network with a user-friendly API.",
       "website": "https://github.com/caronc/apprise-api",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/apprise-api-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/apprise-api-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -484,7 +497,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-apprise-api"
     },
     {
       "id": "archivebox",
@@ -496,7 +510,7 @@
       "repository": "https://hub.docker.com/r/archivebox/archivebox",
       "description": "ArchiveBox is a powerful, self-hosted internet archiving solution that allows you to create your own personal archive of web pages, PDFs, videos, and more. It functions as a personal internet archive, saving content in multiple formats for long-term preservation.\n\nThe system consists of multiple components:\n- **ArchiveBox**: The main application providing the web interface and archiving capabilities\n- **Sonic**: A fast search backend for full-text search across archived content\n- **ArchiveBox Scheduler**: A background service for scheduled archiving tasks\n- **NoVNC**: A web-based VNC client for browser-based archiving\n\n**Key Features:**\n- Save web pages in multiple formats (HTML, PDF, screenshots, etc.)\n- Full-text search across all archived content\n- Scheduled archiving of websites and RSS feeds\n- Browser-based archiving with NoVNC\n- User authentication and access control\n- Extract and save media files (videos, audio, PDFs, etc.)\n\n**Learn More:**\n- [ArchiveBox Official Website](https://archivebox.io)\n- [ArchiveBox GitHub Repository](https://github.com/ArchiveBox/ArchiveBox)\n- [ArchiveBox Documentation](https://github.com/ArchiveBox/ArchiveBox/wiki)\n",
       "website": "https://archivebox.io",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/archivebox.webp",
       "architectures": [
         "amd64"
       ],
@@ -525,7 +539,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "image-archivebox"
     },
     {
       "id": "ardour",
@@ -535,7 +550,7 @@
       "repository": "https://github.com/linuxserver/docker-ardour",
       "description": "Ardour is an open source, collaborative effort of a worldwide team including musicians, programmers, and professional recording engineers.",
       "website": "https://ardour.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ardour-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/ardour-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -544,8 +559,8 @@
       "pushed_at": "2026-06-25T16:52:13Z",
       "updated_at": "2026-04-03",
       "main_image": "lscr.io/linuxserver/ardour:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "creative",
+      "category_label": "Creative & Design",
       "template": "apps/ardour.json",
       "template_status": "generated-unvalidated",
       "content_hash": "736ed876a5b5766151c3b7e0634cdd7db3b15c628f8787fe953a146b602b0c73",
@@ -557,7 +572,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-ardour"
     },
     {
       "id": "audacity",
@@ -567,7 +583,7 @@
       "repository": "https://github.com/linuxserver/docker-audacity",
       "description": "Audacity is an easy-to-use, multi-track audio editor and recorder. Developed by a group of volunteers as open source.",
       "website": "https://www.audacityteam.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/audacity-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/audacity.webp",
       "architectures": [
         "amd64"
       ],
@@ -575,8 +591,8 @@
       "pushed_at": "2026-09-08T09:28:27Z",
       "updated_at": "2026-04-29",
       "main_image": "lscr.io/linuxserver/audacity:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "creative",
+      "category_label": "Creative & Design",
       "template": "apps/audacity.json",
       "template_status": "generated-unvalidated",
       "content_hash": "78fd3449e7fd71b6441c4eb3936b2151c7f9a56139ca0d598e737fdeb0af3b4c",
@@ -588,7 +604,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-audacity"
     },
     {
       "id": "audiobookshelf",
@@ -600,7 +617,7 @@
       "repository": "https://ghcr.io/advplyr/audiobookshelf",
       "description": "Audiobookshelf is a self-hosted media server designed for managing and streaming audiobooks, podcasts, and e-books, offering a secure and flexible solution for personal media libraries. Its lightweight architecture and intuitive Web interface (available as a Progressive Web App, PWA) enable seamless access from any browser, while beta Android and iOS apps support offline listening, catering to privacy-focused media enthusiasts.\n\nThe app supports on-the-fly streaming of all audio formats and provides robust management tools, including automatic metadata and cover art fetching from multiple sources, bulk drag-and-drop uploads for books and podcasts, and chapter editing with lookup via the Audnexus API. Users can search and subscribe to podcasts with auto-downloading episodes or manage content via open RSS feeds. It supports multi-user access with custom permissions, ensuring individual playback progress syncs across devices. Additionally, it offers audio tools (like merging files into m4b or embedding metadata) and experimental e-book support (epub, pdf, cbr, cbz), with the ability to send e-books to devices like Kindle.\n\nIt automatically detects library updates, eliminating manual rescans, and includes daily automated backups to safeguard metadata. Chromecast support (on Web and Android apps) enhances streaming capabilities, while an active community provides support documentation for continuous improvements. Whether for personal collections or family sharing, the app's intuitive interface and versatile features deliver a modern media management platform, meeting diverse needs.\n\n**Key Features:**\n- Multi-user support w/ custom permissions\n- Keeps progress per user and syncs across devices\n- Lookup and apply metadata and cover art from several providers\n- Audiobook chapter editor w/ chapter lookup\n- Audiobook tools: Embed metadata in audio files & merge multiple audio files to a single m4b\n- Search and add podcasts to download episodes w/ auto-download\n- Open RSS feeds for audiobooks and podcast episodes\n- Backups with automated backup scheduling\n- Basic ebook support and ereader (epub, pdf, cbr, cbz) + send to device (i.e. Kindle)\n\n**Learn More:**\n- [Audiobookshelf Official Website](https://audiobookshelf.org)\n- [Audiobookshelf GitHub Repository](https://github.com/advplyr/audiobookshelf)\n",
       "website": "https://audiobookshelf.org",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/audiobookshelf.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -624,7 +641,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-audiobookshelf"
     },
     {
       "id": "autobrr",
@@ -636,7 +654,7 @@
       "repository": "https://ghcr.io/autobrr/autobrr",
       "description": "Autobrr is the modern download automation tool for torrents and usenet. With inspiration and ideas from tools like trackarr, autodl-irssi and flexget we built one tool that can do it all, and then some.",
       "website": "https://autobrr.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/autobrr.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -660,7 +678,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-autobrr"
     },
     {
       "id": "azahar",
@@ -670,7 +689,7 @@
       "repository": "https://github.com/linuxserver/docker-azahar",
       "description": "Azahar is an open-source 3DS emulator based on Citra.",
       "website": "https://azahar-emu.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/azahar-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/azahar-logo.png",
       "architectures": [
         "amd64"
       ],
@@ -678,8 +697,8 @@
       "pushed_at": "2026-09-12T04:47:01Z",
       "updated_at": "2026-03-05",
       "main_image": "lscr.io/linuxserver/azahar:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "gaming",
+      "category_label": "Gaming & Leisure",
       "template": "apps/azahar.json",
       "template_status": "generated-unvalidated",
       "content_hash": "6d5a5c7f43ac8f35a586dbedeb6312eeaf5c028ac407b43c141c8fbf517820ff",
@@ -691,7 +710,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-azahar"
     },
     {
       "id": "babybuddy",
@@ -701,7 +721,7 @@
       "repository": "https://github.com/linuxserver/docker-babybuddy",
       "description": "Babybuddy is a buddy for babies! Helps caregivers track sleep, feedings, diaper changes, tummy time and more to learn about and predict baby's needs without (as much) guess work.",
       "website": "https://github.com/babybuddy/babybuddy",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/babybuddy-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/baby-buddy.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -723,7 +743,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-babybuddy"
     },
     {
       "id": "bambustudio",
@@ -733,7 +754,7 @@
       "repository": "https://github.com/linuxserver/docker-bambustudio",
       "description": "Bambu Studio is an open-source, cutting-edge, feature-rich slicing software. It contains project-based workflows, systematically optimized slicing algorithms, and an easy-to-use graphical interface, bringing users an incredibly smooth printing experience.",
       "website": "https://bambulab.com/en/download/studio",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/bambustudio-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/bambustudio-logo.png",
       "architectures": [
         "amd64"
       ],
@@ -741,8 +762,8 @@
       "pushed_at": "2026-09-12T09:25:40Z",
       "updated_at": "2026-04-29",
       "main_image": "lscr.io/linuxserver/bambustudio:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "creative",
+      "category_label": "Creative & Design",
       "template": "apps/bambustudio.json",
       "template_status": "generated-unvalidated",
       "content_hash": "b8cc49805839eec5d60652cecb7f3b672b76e74d4b9c5851b7c891d4c707cd8b",
@@ -754,7 +775,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-bambustudio"
     },
     {
       "id": "bazarr",
@@ -764,7 +786,7 @@
       "repository": "https://github.com/linuxserver/docker-bazarr",
       "description": "Bazarr is a companion application to Sonarr and Radarr. It can manage and download subtitles based on your requirements. You define your preferences by TV show or movie and Bazarr takes care of everything for you.",
       "website": "https://www.bazarr.media/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/bazarr-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/bazarr.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -786,7 +808,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-bazarr"
     },
     {
       "id": "beaverhabittracker",
@@ -798,7 +821,7 @@
       "repository": "https://hub.docker.com/r/daya0576/beaverhabits",
       "description": "Beaver Habit Tracker is a self-hosted habit tracking tool designed for users who want to effortlessly monitor daily behaviors without the stress of goal-setting. Its intuitive Web interface offers a pressure-free tracking experience, ideal for those focused on behavior observation and personal growth.\n\nThe tool's core features include goal-free habit tracking and a minimalist interface. It allows users to log multiple habits easily, without focusing on streaks or targets, and provides simple visualizations to understand behavior patterns. Users can add daily notes to record specific activities or reflections, with a smooth, low-effort interface.\n\nIt uses a self-hosted approach, ensuring data privacy and full control, with a lightweight, efficient design requiring minimal server resources. Users can manually reorder habits for an optimized experience. The tool's stress-free observation and intuitive operation help users gradually improve habits, delivering a modern habit management solution.\n\n**Key Features:**\n- Goal-free habit tracking focused on awareness, not achievement\n- Clean, minimalist interface for effortless daily logging\n- Lightweight and efficient, requiring minimal server resources\n- Simple visualizations to understand behavior patterns\n- Daily notes for recording activities or reflections\n\n**Learn More:**\n- [Beaver Habit Tracker Official Website](https://beaverhabits.com/)\n- [Beaver Habit Tracker GitHub](https://github.com/daya0576/beaverhabits)\n",
       "website": "https://beaverhabits.com/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/beaver-habit-tracker.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -822,7 +845,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-beaverhabittracker"
     },
     {
       "id": "beets",
@@ -832,7 +856,7 @@
       "repository": "https://github.com/linuxserver/docker-beets",
       "description": "Beets is a music library manager and not, for the most part, a music player. It does include a simple player plugin and an experimental Web-based player, but it generally leaves actual sound-reproduction to specialized tools.",
       "website": "http://beets.io/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/beets-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/beets.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -841,8 +865,8 @@
       "pushed_at": "2026-09-13T17:00:11Z",
       "updated_at": "2026-02-01",
       "main_image": "lscr.io/linuxserver/beets:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "media",
+      "category_label": "Media & Streaming",
       "template": "apps/beets.json",
       "template_status": "generated-unvalidated",
       "content_hash": "beaa3825b76040e57e7f81fa3ff15561a3dcbeda4b13c705a5b3a5506d6c4193",
@@ -854,7 +878,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-beets"
     },
     {
       "id": "bentopdf",
@@ -866,7 +891,7 @@
       "repository": "https://ghcr.io/alam00000/bentopdf-simple",
       "description": "**Your PDFs never leave your device.** BentoPDF is a privacy-first PDF toolkit that runs entirely in your browser. Every merge, split, conversion, and edit happens locally on your machine \u2014 no file is ever uploaded to a server. More than 50 tools are bundled into one clean, fast, ad-free interface.\n\n**One app for every PDF job.** Organize and edit your documents (merge, split, reorder, rotate, crop, watermark, page numbers, redaction, annotations and forms), convert to and from PDF (images, Word, Excel, PowerPoint, EPUB, Markdown and more), run OCR, and secure your files with compression, encryption, digital signatures, and metadata cleanup.\n\n**Made for your private cloud.** Self-hosting BentoPDF on a private cloud device like self-hosted server gives your whole household or team a single, ad-free PDF workshop on hardware you control \u2014 fast over the local network, with your documents staying private by design.\n",
       "website": "https://bentopdf.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/bentopdf.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -890,7 +915,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-bentopdf"
     },
     {
       "id": "bitcoin-knots",
@@ -900,7 +926,7 @@
       "repository": "https://github.com/linuxserver/docker-bitcoin-knots",
       "description": "Bitcoin Knots can be used as a desktop client for regular payments or as a full node server utility for merchants and other payment services.",
       "website": "https://bitcoinknots.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/bitcoin-knots-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/bitcoin-knots-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -909,8 +935,8 @@
       "pushed_at": "2026-09-07T22:37:03Z",
       "updated_at": "2026-04-03",
       "main_image": "lscr.io/linuxserver/bitcoin-knots:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "finance",
+      "category_label": "Finance & Budgeting",
       "template": "apps/bitcoin-knots.json",
       "template_status": "generated-unvalidated",
       "content_hash": "1df82e85d15c1bb90aba6121087b85d578cd9d500427de928b663d2ddbad4d7d",
@@ -922,7 +948,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-bitcoin-knots"
     },
     {
       "id": "blade-of-agony",
@@ -932,7 +959,7 @@
       "repository": "https://github.com/linuxserver/docker-blade-of-agony",
       "description": "Wolfenstein: Blade of Agony is a story-driven WWII shooter inspired by Wolfenstein and Doom.",
       "website": "https://boa.realm667.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/blade-of-agony-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/boa-logo.png",
       "architectures": [
         "amd64"
       ],
@@ -940,8 +967,8 @@
       "pushed_at": "2026-09-10T20:27:01Z",
       "updated_at": "2026-03-26",
       "main_image": "lscr.io/linuxserver/blade-of-agony:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "gaming",
+      "category_label": "Gaming & Leisure",
       "template": "apps/blade-of-agony.json",
       "template_status": "generated-unvalidated",
       "content_hash": "fb8c8dc4bfdf72ac202ee75e90f7102e9f2418b6a370cd6321af273b6bdc16e2",
@@ -953,7 +980,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-blade-of-agony"
     },
     {
       "id": "blender",
@@ -963,7 +991,7 @@
       "repository": "https://github.com/linuxserver/docker-blender",
       "description": "Blender is a free and open-source 3D computer graphics software toolset used for creating animated films, visual effects, art, 3D printed models, motion graphics, interactive 3D applications, virtual reality, and computer games. **This image does not support GPU rendering out of the box only accelerated workspace experience**",
       "website": "https://www.blender.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/blender-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/blender.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -972,8 +1000,8 @@
       "pushed_at": "2026-09-10T18:27:11Z",
       "updated_at": "2026-04-19",
       "main_image": "lscr.io/linuxserver/blender:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "creative",
+      "category_label": "Creative & Design",
       "template": "apps/blender.json",
       "template_status": "generated-unvalidated",
       "content_hash": "8ec78837752083a858e6efba3daa6facc48ece115769b2659f93ca31bd5f49b5",
@@ -985,7 +1013,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-blender"
     },
     {
       "id": "blinko",
@@ -997,7 +1026,7 @@
       "repository": "https://hub.docker.com/r/blinkospace/blinko",
       "description": "Blinko is an open-source personal knowledge management and information recording platform, focused on providing users with a lightweight, efficient, and scalable note-taking and knowledge organization experience. Through modular design and a modern technology stack, it enables users to quickly capture ideas, organize knowledge, and build their own information system.\n\nThe project emphasizes simplicity and customizability, supporting flexible combinations of various content types (text, tags, links, etc.), while its clear structured design helps users efficiently retrieve and connect information. Blinko also provides excellent extensibility, making it easy for developers to customize and enhance functionality according to their needs.\n\nIn practical use, Blinko balances usability and functionality, offering a smooth experience for daily note-taking, knowledge accumulation, or project document management - an ideal knowledge tool for long-term personal growth.\n\n**Main features:**\n\n- Lightweight note system for quick content recording and editing\n- Tags and structured organization to improve information retrieval efficiency\n- Support for multiple content types (text, links, etc.)\n- Extensible architecture for custom functionality and plugin development\n- Clean interface design focused on content rather than complex operations\n\n**Learn more:**\n\n- [Blinko GitHub](https://github.com/blinkospace/blinko)\n",
       "website": "https://blinko.space/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/blinko.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -1021,7 +1050,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-blinko"
     },
     {
       "id": "boinc",
@@ -1031,7 +1061,7 @@
       "repository": "https://github.com/linuxserver/docker-boinc",
       "description": "BOINC is a platform for high-throughput computing on a large scale (thousands or millions of computers). It can be used for volunteer computing (using consumer devices) or grid computing (using organizational resources). It supports virtualized, parallel, and GPU-based applications.",
       "website": "https://boinc.berkeley.edu/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/boinc-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/boinc.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -1053,7 +1083,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-boinc"
     },
     {
       "id": "bookstack",
@@ -1063,7 +1094,7 @@
       "repository": "https://github.com/linuxserver/docker-bookstack",
       "description": "Bookstack is a free and open source Wiki designed for creating beautiful documentation. Featuring a simple, but powerful WYSIWYG editor it allows for teams to create detailed and useful documentation with ease.",
       "website": "https://codeberg.org/bookstack/bookstack",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/bookstack-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/bookstack.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -1085,7 +1116,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-bookstack"
     },
     {
       "id": "brave",
@@ -1095,7 +1127,7 @@
       "repository": "https://github.com/linuxserver/docker-brave",
       "description": "The Brave browser is a fast, private and secure web browser for PC, Mac and mobile.",
       "website": "https://brave.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/brave-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/brave.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -1104,8 +1136,8 @@
       "pushed_at": "2026-09-11T17:22:56Z",
       "updated_at": "2026-04-20",
       "main_image": "lscr.io/linuxserver/brave:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "desktop",
+      "category_label": "Browsers & Web Desktops",
       "template": "apps/brave.json",
       "template_status": "generated-unvalidated",
       "content_hash": "9c11de8124e0962c9be80a78d927ca635d246ea5c1250172ea7065cdb00ea1b4",
@@ -1117,7 +1149,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-brave"
     },
     {
       "id": "budge",
@@ -1127,7 +1160,7 @@
       "repository": "https://github.com/linuxserver/docker-budge",
       "description": "budge is an open source 'budgeting with envelopes' personal finance app.",
       "website": "https://github.com/linuxserver/budge",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/budge-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/budge@master/frontend/public/logo512.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -1136,8 +1169,8 @@
       "pushed_at": "2026-06-28T06:11:17Z",
       "updated_at": "2024-06-06",
       "main_image": "lscr.io/linuxserver/budge:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "finance",
+      "category_label": "Finance & Budgeting",
       "template": "apps/budge.json",
       "template_status": "generated-unvalidated",
       "content_hash": "b770ea0c4b5f658c4e9d98ee6eb4334a232c72608bfab0fd015cfe6a17b0f791",
@@ -1149,7 +1182,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-budge"
     },
     {
       "id": "calibre",
@@ -1159,7 +1193,7 @@
       "repository": "https://github.com/linuxserver/docker-calibre",
       "description": "Calibre is a powerful and easy to use e-book manager. Users say it's outstanding and a must-have. It'll allow you to do nearly everything and it takes things a step beyond normal e-book software. It's also completely free and open source and great for both casual users and computer experts.",
       "website": "https://calibre-ebook.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/calibre-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/calibre.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -1168,8 +1202,8 @@
       "pushed_at": "2026-09-09T12:02:26Z",
       "updated_at": "2026-04-19",
       "main_image": "lscr.io/linuxserver/calibre:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "media",
+      "category_label": "Media & Streaming",
       "template": "apps/calibre.json",
       "template_status": "generated-unvalidated",
       "content_hash": "85b7d4d3798e697e5e9ac1541d9b2ccc27c01a3c9b1d4a742a6a0ef8038bd072",
@@ -1181,7 +1215,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": true,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-calibre"
     },
     {
       "id": "calibre-web",
@@ -1191,7 +1226,7 @@
       "repository": "https://github.com/linuxserver/docker-calibre-web",
       "description": "Calibre-web is a web app providing a clean interface for browsing, reading and downloading eBooks using an existing Calibre database.   It is also possible to integrate google drive and edit metadata and your calibre library through the app itself.",
       "website": "https://github.com/janeczku/calibre-web",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/calibre-web-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/calibre-web.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -1213,7 +1248,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-calibre-web"
     },
     {
       "id": "calligra",
@@ -1223,7 +1259,7 @@
       "repository": "https://github.com/linuxserver/docker-calligra",
       "description": "Calligra is an office and graphic art suite by KDE. It is available for desktop PCs, tablet computers, and smartphones. It contains applications for word processing, spreadsheets, presentation, vector graphics, and editing databases.",
       "website": "https://calligra.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/calligra-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/calligra-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -1232,8 +1268,8 @@
       "pushed_at": "2026-09-10T14:06:16Z",
       "updated_at": "2026-03-30",
       "main_image": "lscr.io/linuxserver/calligra:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "documents",
+      "category_label": "Documents & Notes",
       "template": "apps/calligra.json",
       "template_status": "generated-unvalidated",
       "content_hash": "afda96f6a3d65573e1ede68f13fb7ece6321b9637e2027ddc66b4b79b761ec39",
@@ -1245,7 +1281,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-calligra"
     },
     {
       "id": "changedetection.io",
@@ -1255,7 +1292,7 @@
       "repository": "https://github.com/linuxserver/docker-changedetection.io",
       "description": "Changedetection.io provides free, open-source web page monitoring, notification and change detection.",
       "website": "https://github.com/dgtlmoon/changedetection.io",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/changedetection.io-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/changedetection-icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -1264,8 +1301,8 @@
       "pushed_at": "2026-09-10T10:18:30Z",
       "updated_at": "2026-02-18",
       "main_image": "lscr.io/linuxserver/changedetection.io:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "monitoring",
+      "category_label": "Monitoring & Analytics",
       "template": "apps/changedetection.io.json",
       "template_status": "generated-unvalidated",
       "content_hash": "12b84b068f8bcecfa0370ed3cdb06108b6c06326ce84a716d6b1066443c49670",
@@ -1277,7 +1314,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-changedetection-io"
     },
     {
       "id": "chatbot-ui",
@@ -1289,7 +1327,7 @@
       "repository": "https://ghcr.io/mckaywrigley/chatbot-ui",
       "description": "Chatbot UI is an open source chat UI for AI models.",
       "website": "https://www.chatbotui.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/ChatbotUI/icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -1313,7 +1351,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "image-chatbot-ui"
     },
     {
       "id": "chatgpt-next-web",
@@ -1325,7 +1364,7 @@
       "repository": "https://hub.docker.com/r/yidadaa/chatgpt-next-web",
       "description": "An intelligent chat application based on ChatGPT, supports fast deployment, Markdown, beautiful UI, fluid response, privacy and security, and allows customization of preset roles for quick creation, sharing, and debugging of personalized conversations.",
       "website": "https://nextchat.club",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/ChatGPT-Next-Web/icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -1349,7 +1388,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-chatgpt-next-web"
     },
     {
       "id": "chrome",
@@ -1359,7 +1399,7 @@
       "repository": "https://github.com/linuxserver/docker-chrome",
       "description": "Chrome is the official web browser from Google, built to be fast, secure, and customizable.",
       "website": "https://www.google.com/chrome/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/chrome-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/chrome.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -1368,8 +1408,8 @@
       "pushed_at": "2026-09-09T00:55:14Z",
       "updated_at": "2026-07-27",
       "main_image": "lscr.io/linuxserver/chrome:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "desktop",
+      "category_label": "Browsers & Web Desktops",
       "template": "apps/chrome.json",
       "template_status": "generated-unvalidated",
       "content_hash": "64a099762a3c52dc163c02761973977edee09538c9fe34a4bbe55e5b93ad7bb5",
@@ -1381,7 +1421,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-chrome"
     },
     {
       "id": "chromium",
@@ -1391,7 +1432,7 @@
       "repository": "https://github.com/linuxserver/docker-chromium",
       "description": "Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web.",
       "website": "https://www.chromium.org/chromium-projects/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/chromium-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/chromium.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -1400,8 +1441,8 @@
       "pushed_at": "2026-09-09T14:32:01Z",
       "updated_at": "2026-07-04",
       "main_image": "lscr.io/linuxserver/chromium:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "desktop",
+      "category_label": "Browsers & Web Desktops",
       "template": "apps/chromium.json",
       "template_status": "generated-unvalidated",
       "content_hash": "4626a1a3afafb2eea46a2223ff6facfc8a372c6fff546d0882f17071497f9d4b",
@@ -1413,7 +1454,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-chromium"
     },
     {
       "id": "cloudbeaver",
@@ -1425,7 +1467,7 @@
       "repository": "https://hub.docker.com/r/dbeaver/cloudbeaver",
       "description": "CloudBeaver is a web-based database GUI tool which provides rich web interface. You can use it to manage PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, DB2, Firebird, H2, Trino.",
       "website": "https://dbeaver.com/download/cloudbeaver/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/cloudbeaver.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -1436,8 +1478,8 @@
       "pushed_at": "2026-09-11T10:43:22Z",
       "updated_at": "2026-05-18",
       "main_image": "dbeaver/cloudbeaver:latest",
-      "category": "ai",
-      "category_label": "AI / Coding & Dev-Tools",
+      "category": "databases",
+      "category_label": "Databases",
       "template": "apps/cloudbeaver.json",
       "template_status": "generated-unvalidated",
       "content_hash": "073c51f6bbb540cb92a54860e131531e89078865964dcf942ebecf2c9fa6a832",
@@ -1449,7 +1491,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-cloudbeaver"
     },
     {
       "id": "cloudflared",
@@ -1461,7 +1504,7 @@
       "repository": "https://hub.docker.com/r/wisdomsky/cloudflared-web",
       "description": "Cloudflare Tunnel offers an easy way to expose web servers securely to the internet, without opening up firewall ports and configuring ACLs. Cloudflare Tunnel also ensures requests route through Cloudflare before reaching the web server, so you can be sure attack traffic is stopped with Cloudflare\u2019s WAF and Unmetered DDoS mitigation, and authenticated with Access if you\u2019ve enabled those features for your account.\n\nThe software provides a seamless way to securely expose web servers to the internet without configuring firewall ports or access control lists (ACLs). All requests are routed through Cloudflare before reaching your web server, leveraging Cloudflare\u2019s Web Application Firewall (WAF) and unmetered DDoS mitigation to block attack traffic, with optional authentication via Cloudflare Access if enabled. With its intuitive Web interface and efficient tunnel management, this tool is the perfect solution for securely deploying web services.\n\n**Discover How to Connect self-hosted server to Cloudflare Tunnel**\nIntegrating self-hosted server with Cloudflare Tunnel allows you to securely expose local services to the internet without opening firewall ports, enabling seamless remote access. Below are two practical resources to guide you through the setup process:\n1. [**Cloudflare Official Tutorial**](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/): \n  This tutorial provides detailed steps for creating and managing a Cloudflare Tunnel.\n2. [**Phiptech Practical Guide**](https://phiptech.com/how-to-setup-cloudflare-tunnel-and-expose-your-local-service-or-application/): \n  This guide offers a concise, step-by-step walkthrough for setting up Cloudflare Tunnel on local devices like self-hosted server, with practical examples to help users easily expose services to the public internet.\n",
       "website": "https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/Cloudflared/icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -1485,7 +1528,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-cloudflared"
     },
     {
       "id": "clumoove",
@@ -1497,7 +1541,7 @@
       "repository": "https://ghcr.io/xxroxxerxx/clumoove-frontend",
       "description": "Clumoove is a modern, self-hosted cloud data migration and synchronization platform for files, calendars, and contacts.\n\nEasily connect, transfer, and synchronize data between cloud storage providers including Nextcloud, Google Drive, Dropbox, OneDrive, HiDrive, S3, WebDAV, SMB, SFTP, FTP, Immich, Seafile, Koofr, MEGA, and local storage.\n\nKey Features:\n- Zero-disk streaming transfers (no local temporary storage retention during migration)\n- Multi-threaded background migrations and cron-based synchronization schedules\n- Robust 3-way hash integrity verification & flexible conflict resolution\n- Integrated cloud file manager with multi-format previews and thumbnails\n- Multi-channel notification delivery (Gotify, ntfy, Telegram, Discord, Email)\n- Enterprise-grade security with AES-256-GCM encryption, TOTP 2FA, and audit logging\n",
       "website": "https://clumoove.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/Clumoove/icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -1527,7 +1571,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "image-clumoove"
     },
     {
       "id": "code-server",
@@ -1537,7 +1582,7 @@
       "repository": "https://github.com/linuxserver/docker-code-server",
       "description": "Code-server is VS Code running on a remote server, accessible through the browser.",
       "website": "https://coder.com",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/code-server-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/code-server.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -1546,8 +1591,8 @@
       "pushed_at": "2026-09-11T05:22:23Z",
       "updated_at": "2026-05-17",
       "main_image": "lscr.io/linuxserver/code-server:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "ai",
+      "category_label": "AI / Coding & Dev-Tools",
       "template": "apps/code-server.json",
       "template_status": "generated-unvalidated",
       "content_hash": "b50f59e5d639cd53d9213e332de23935795fdbc30300d9d8630ba00bec320822",
@@ -1559,7 +1604,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-code-server"
     },
     {
       "id": "codeproject-ai",
@@ -1569,7 +1615,7 @@
       "repository": "https://github.com/codeproject/CodeProject.AI-Server",
       "description": "Official latest CPU image with persistent settings and modules. Initial CPU and Coral PCIe inference passed on Intel amd64. Coral module uses its persistent upstream EdgeTPU runtime via module-scoped LD_PRELOAD; missing JSON defaults preserve existing user settings. The TPU needs exclusive access. ARM and NVIDIA channels are not offered by this template; Failures observed on the AMD lab host remain unexplained; no blanket AMD incompatibility is inferred.",
       "website": "https://github.com/codeproject/CodeProject.AI-Server",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/codeproject-ai-server.webp",
       "architectures": [
         "amd64"
       ],
@@ -1590,7 +1636,8 @@
       "requires_host_pid_namespace": false,
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
-      "requires_security_confirmation": false
+      "requires_security_confirmation": false,
+      "template_id": "image-codeproject-ai"
     },
     {
       "id": "convertx",
@@ -1602,7 +1649,7 @@
       "repository": "https://hub.docker.com/r/c4illin/convertx",
       "description": "ConvertX is a self-hosted file conversion service that allows users to convert files between different formats through an intuitive web interface. It supports a wide range of file types including documents, images, videos, and audio files, making it a comprehensive solution for all your file conversion needs.\n\nThe service is designed with simplicity and ease of use in mind. Users can simply upload their files, select the desired output format, and let ConvertX handle the conversion process. The web interface provides a clean and user-friendly experience, with drag-and-drop support and batch conversion capabilities.\n\nConvertX runs entirely on your own infrastructure, ensuring that your files remain private and secure. There's no need to upload sensitive documents to third-party services, giving you full control over your data. The service is containerized for easy deployment and can be integrated into existing home server setups.\n\n**Key Features:**\n- Support for multiple file formats (documents, images, videos, audio)\n- Intuitive web interface with drag-and-drop support\n- Batch conversion capabilities\n- Self-hosted for privacy and security\n- Containerized for easy deployment\n- No file size limitations\n\n**Learn More:**\n- [ConvertX GitHub Repository](https://github.com/c4illin/convertx)\n",
       "website": "",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/convertx.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -1626,7 +1673,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-convertx"
     },
     {
       "id": "cops",
@@ -1636,7 +1684,7 @@
       "repository": "https://github.com/linuxserver/docker-cops",
       "description": "Cops by S\u00e9bastien Lucas, now maintained by MikesPub, stands for Calibre OPDS (and HTML) Php Server.",
       "website": "https://github.com/mikespub-org/seblucas-cops",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/cops-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/cops-icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -1645,8 +1693,8 @@
       "pushed_at": "2026-09-06T22:40:35Z",
       "updated_at": "2026-07-21",
       "main_image": "lscr.io/linuxserver/cops:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "media",
+      "category_label": "Media & Streaming",
       "template": "apps/cops.json",
       "template_status": "generated-unvalidated",
       "content_hash": "81c6691f9a3a0d3dcad26dcc598ad86ce59ee45b613862a5886956a947d26629",
@@ -1658,7 +1706,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-cops"
     },
     {
       "id": "copyparty",
@@ -1670,7 +1719,7 @@
       "repository": "https://hub.docker.com/r/icewhaletech/copyparty",
       "description": "**CopyParty** is a fast, privacy-focused file sharing server using a local-first, single-file architecture, ensuring full control over data without cloud dependencies. Its intuitive interface supports offline use, with cross-platform compatibility and multi-protocol access, delivering a secure, efficient file management experience, ideal for users seeking direct data ownership and a lightweight solution.\n\nThe app's core features include accelerated resumable uploads (via the up2k protocol), ensuring reliable large file transfers, and automatic deduplication to optimize storage. It helps users organize folders and media effortlessly, with a web-based file manager that includes a built-in media indexer and thumbnail generator for quick previews. Fine-grained permission controls allow specific user access rules. The \"upload-while-downloading\" feature enhances sharing efficiency, and the zero-dependency design ensures it runs on almost any hardware.\n\nIt integrates multiple access protocols, including HTTP, WebDAV, FTP, and TFTP, supporting connections from standard web browsers, dedicated file clients, and legacy hardware (such as PSP). The app supports Docker and Python for deployment, simplifying setup across various server environments. It facilitates seamless access to local files without complex configuration. Community documentation enhances usability, and the app's simple operation and high flexibility deliver a modern local file service solution.\n\n**Key Features:**\n- Privacy-focused local file sharing\n- Zero-dependency single-file architecture\n- Accelerated resumable uploads\n- Multi-protocol support (HTTP, WebDAV, FTP, etc.)\n- Cross-platform compatibility\n- Media indexing and streaming\n- Smart deduplication\n- User permission management\n\n**Learn More:**\n- [CopyParty GitHub Repository](https://github.com/9001/copyparty)\n",
       "website": "https://copyparty.eu/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/copyparty.webp",
       "architectures": [
         "amd64"
       ],
@@ -1693,7 +1742,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-copyparty"
     },
     {
       "id": "crafty",
@@ -1705,7 +1755,7 @@
       "repository": "https://registry.gitlab.com/crafty-controller/crafty-4",
       "description": "Crafty is an open source Minecraft control panel built using Tornado and AdminLTE, featuring server scheduling, a interactive console and the ability to run almost any type of Minecraft server",
       "website": "https://craftycontrol.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/Crafty/icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -1716,8 +1766,8 @@
       "pushed_at": "2026-09-11T10:43:22Z",
       "updated_at": "2026-04-20",
       "main_image": "registry.gitlab.com/crafty-controller/crafty-4:latest",
-      "category": "media",
-      "category_label": "Media & Streaming",
+      "category": "gaming",
+      "category_label": "Gaming & Leisure",
       "template": "apps/crafty.json",
       "template_status": "laboratory-validated",
       "content_hash": "b586bf376d6ceca65a6a3e2c9402fa667abccfa4ec91283ffcfae78404df05c3",
@@ -1729,7 +1779,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-crafty"
     },
     {
       "id": "cura",
@@ -1739,7 +1790,7 @@
       "repository": "https://github.com/linuxserver/docker-cura",
       "description": "UltiMaker Cura is free, easy-to-use 3D printing software trusted by millions of users. Fine-tune your 3D model with 400+ settings for the best slicing and printing results.",
       "website": "https://ultimaker.com/software/ultimaker-cura/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/cura-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/cura.webp",
       "architectures": [
         "amd64"
       ],
@@ -1747,8 +1798,8 @@
       "pushed_at": "2026-09-07T09:47:30Z",
       "updated_at": "2026-04-19",
       "main_image": "lscr.io/linuxserver/cura:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "creative",
+      "category_label": "Creative & Design",
       "template": "apps/cura.json",
       "template_status": "generated-unvalidated",
       "content_hash": "b967c24a5655dd9b9d95bf04d06e226efc3a03cf28fc54dac551176f30a2f3a7",
@@ -1760,7 +1811,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-cura"
     },
     {
       "id": "darktable",
@@ -1770,7 +1822,7 @@
       "repository": "https://github.com/linuxserver/docker-darktable",
       "description": "darktable is an open source photography workflow application and raw developer. A virtual lighttable and darkroom for photographers. It manages your digital negatives in a database, lets you view them through a zoomable lighttable and enables you to develop raw images and enhance them.",
       "website": "https://www.darktable.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/darktable-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/darktable-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -1779,8 +1831,8 @@
       "pushed_at": "2026-08-31T15:21:14Z",
       "updated_at": "2026-04-03",
       "main_image": "lscr.io/linuxserver/darktable:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "creative",
+      "category_label": "Creative & Design",
       "template": "apps/darktable.json",
       "template_status": "generated-unvalidated",
       "content_hash": "b9e748556222df78760e3505bf08b9e8d277fbf31a55141077ac5641b5e96928",
@@ -1792,7 +1844,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-darktable"
     },
     {
       "id": "databag",
@@ -1804,7 +1857,7 @@
       "repository": "https://hub.docker.com/r/balzack/databag",
       "description": "Databag is a federated chat app for self-hosting that focuses on user privacy and security; the service includes clients for iOS, Android, and browser.",
       "website": "",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/databag.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -1828,7 +1881,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-databag"
     },
     {
       "id": "davos",
@@ -1838,7 +1892,7 @@
       "repository": "https://github.com/linuxserver/docker-davos",
       "description": "Davos is an FTP automation tool that periodically scans given host locations for new files. It can be configured for various purposes, including listening for specific files to appear in the host location, ready for it to download and then move, if required. It also supports completion notifications as well as downstream API calls, to further the workflow.",
       "website": "https://github.com/linuxserver/davos",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/davos-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/davos-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -1847,8 +1901,8 @@
       "pushed_at": "2025-11-21T18:46:32Z",
       "updated_at": "2025-01-27",
       "main_image": "lscr.io/linuxserver/davos:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "downloads",
+      "category_label": "Files & Downloads",
       "template": "apps/davos.json",
       "template_status": "generated-unvalidated",
       "content_hash": "e3a6c26b81f0d93c411bb1b0046fbff0fc33d453a000efe486e6cd9b32905658",
@@ -1860,7 +1914,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-davos"
     },
     {
       "id": "ddclient",
@@ -1870,7 +1925,7 @@
       "repository": "https://github.com/linuxserver/docker-ddclient",
       "description": "Ddclient is a Perl client used to update dynamic DNS entries for accounts on Dynamic DNS Network Service Provider. It was originally written by Paul Burry and is now mostly by wimpunk. It has the capability to update more than just dyndns and it can fetch your WAN-ipaddress in a few different ways.",
       "website": "https://github.com/ddclient/ddclient",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ddclient-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/ddclient.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -1879,8 +1934,8 @@
       "pushed_at": "2026-09-08T11:59:00Z",
       "updated_at": "2025-07-10",
       "main_image": "lscr.io/linuxserver/ddclient:latest",
-      "category": "network",
-      "category_label": "Network & Firewall",
+      "category": "adblock",
+      "category_label": "Adblock & DNS",
       "template": "apps/ddclient.json",
       "template_status": "laboratory-validated",
       "content_hash": "91512aa83c7fe69d3b7ab3be11aac61cb3e41391a57d7beae44d240dceb103d3",
@@ -1892,7 +1947,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-ddclient"
     },
     {
       "id": "ddns-go",
@@ -1904,7 +1960,7 @@
       "repository": "https://hub.docker.com/r/jeessy/ddns-go",
       "description": "A simple and easy-to-use DDNS tool. Automatically updates domain name resolution to your public IP (supports Alibaba Cloud, Tencent Cloud, Dnspod, Cloudflare, Callback, Huawei Cloud, Baidu Cloud, Porkbun, GoDaddy, and Google Domain).\n\nDeploy DDNS-go on self-hosted server, and you can bind the public IP of your self-hosted server device to your domain name. This way, you can access your self-hosted server device via the domain name while you are away.\n",
       "website": "",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/Ddns-go/icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -1915,8 +1971,8 @@
       "pushed_at": "2026-09-11T10:43:22Z",
       "updated_at": "2026-05-31",
       "main_image": "jeessy/ddns-go:latest",
-      "category": "network",
-      "category_label": "Network & Firewall",
+      "category": "adblock",
+      "category_label": "Adblock & DNS",
       "template": "apps/ddns-go.json",
       "template_status": "generated-unvalidated",
       "content_hash": "6ef6f75472f0e7a23f4b3dea4d98bff610c20004bdedd6dabadf5ab35af6b1f7",
@@ -1928,7 +1984,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-ddns-go"
     },
     {
       "id": "ddns-updater",
@@ -1940,7 +1997,7 @@
       "repository": "https://hub.docker.com/r/qmcgaw/ddns-updater",
       "description": "Program to keep DNS A and/or AAAA records updated for multiple DNS providers",
       "website": "",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/ddns-updater.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -1951,8 +2008,8 @@
       "pushed_at": "2026-09-11T10:43:22Z",
       "updated_at": "2026-05-01",
       "main_image": "qmcgaw/ddns-updater:latest",
-      "category": "network",
-      "category_label": "Network & Firewall",
+      "category": "adblock",
+      "category_label": "Adblock & DNS",
       "template": "apps/ddns-updater.json",
       "template_status": "generated-unvalidated",
       "content_hash": "012d83f253220a95a83eb5251ed3f72153192a83a3109becea0d32b7c741bebe",
@@ -1964,7 +2021,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-ddns-updater"
     },
     {
       "id": "deepseek-ocr-nvidia",
@@ -1976,7 +2034,7 @@
       "repository": "https://hub.docker.com/r/icewhaletech/deepseek-ocr-frontend",
       "description": "DeepSeek OCR is a powerful open-source OCR (Optical Character Recognition) tool based on the advanced DeepSeek-AI model. It enables accurate text extraction from images and document scans via a user-friendly web interface and API. Supports various image formats and offers configurations for image size, cropping, and upload limits. Additionally, DeepSeek OCR features four core recognition modes: Plain OCR for raw text extraction, Describe for intelligent image content descriptions, Find for keyword localization with visual bounding box returns, and Freeform for flexible image understanding tasks based on custom prompts.\n\n**Key Features:**\n- High-accuracy text recognition with DeepSeek-OCR, supporting images and multi-page PDF documents\n- Preserves document layout including tables, formulas, and structural formatting\n- Web frontend (React) and REST API (FastAPI) for easy usage and system integration\n- Export results to Markdown, HTML, DOCX, or JSON formats\n- Automatic extraction and embedding of images from PDF files\n- GPU acceleration and Docker deployment for fast and scalable processing\n\n**Prerequisites:**\n- self-hosted server version 1.5.2 or higher, or NVIDIA Open Driver version 580 or higher\n- NVIDIA GPU with >= 8 GB VRAM for optimal performance\n\n**Learn More:**\n- [DeepSeek OCR App (GitHub)](https://github.com/rdumasia303/deepseek_ocr_app)\n",
       "website": "",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/DeepSeek-OCR_Nvidia/icon.png",
       "architectures": [
         "amd64"
       ],
@@ -2003,7 +2061,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "image-deepseek-ocr-nvidia"
     },
     {
       "id": "deluge",
@@ -2013,7 +2072,7 @@
       "repository": "https://github.com/linuxserver/docker-deluge",
       "description": "Deluge is a lightweight, Free Software, cross-platform BitTorrent client.",
       "website": "http://deluge-torrent.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/deluge-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/deluge.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -2035,7 +2094,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-deluge"
     },
     {
       "id": "dify",
@@ -2047,7 +2107,7 @@
       "repository": "https://hub.docker.com/r/langgenius/dify-web",
       "description": "Dify is an open-source large language model (LLM) application development platform. It combines the concepts of Backend-as-a-Service and LLMOps to enable developers to quickly build production-grade generative AI applications. Even non-technical personnel can participate in the definition and data operations of AI applications.",
       "website": "https://dify.ai",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/dify.webp",
       "architectures": [
         "amd64"
       ],
@@ -2080,7 +2140,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "image-dify"
     },
     {
       "id": "digikam",
@@ -2090,7 +2151,7 @@
       "repository": "https://github.com/linuxserver/docker-digikam",
       "description": "digiKam: Professional Photo Management with the Power of Open Source",
       "website": "https://www.digikam.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/digikam-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/digikam.webp",
       "architectures": [
         "amd64"
       ],
@@ -2098,8 +2159,8 @@
       "pushed_at": "2026-09-07T18:35:56Z",
       "updated_at": "2026-04-03",
       "main_image": "lscr.io/linuxserver/digikam:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "creative",
+      "category_label": "Creative & Design",
       "template": "apps/digikam.json",
       "template_status": "generated-unvalidated",
       "content_hash": "363dae41fce55565c023cf71b710511c779fa5c5e8d981836858508c633c14b0",
@@ -2111,7 +2172,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-digikam"
     },
     {
       "id": "diskover",
@@ -2121,7 +2183,7 @@
       "repository": "https://github.com/linuxserver/docker-diskover",
       "description": "diskover is an open source file system indexer that uses Elasticsearch to index and manage data across heterogeneous storage systems.",
       "website": "https://github.com/diskoverdata/diskover-community",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/diskover-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/diskover.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -2147,7 +2209,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "linuxserver-diskover"
     },
     {
       "id": "docker-volume-backup",
@@ -2157,7 +2220,7 @@
       "repository": "https://github.com/MrCaringi/docker-volume-backup",
       "description": "Requires real Docker daemon/socket and Docker Compose stacks; cannot back up native Proxmox OCI instances as Docker volumes. Hidden pending explicit external Docker integration; no Docker installed on Proxmox.",
       "website": "https://github.com/MrCaringi/docker-volume-backup",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/docker-volume-backup.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -2181,7 +2244,8 @@
       "requires_host_pid_namespace": false,
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
-      "requires_security_confirmation": false
+      "requires_security_confirmation": false,
+      "template_id": "image-docker-volume-backup"
     },
     {
       "id": "docmost",
@@ -2193,7 +2257,7 @@
       "repository": "https://hub.docker.com/r/docmost/docmost",
       "description": "Docmost is a self-hosted collaborative wiki and documentation tool designed for real-time collaboration, allowing multiple users to edit the same page simultaneously without conflicts. Its intuitive interface is ideal for teams managing knowledge bases, project documentation, or wikis, offering an efficient knowledge creation and sharing experience.\n\nThe tool's core features include real-time collaborative editing and space organization. It supports multiple users editing pages in real time for seamless collaboration and organizes pages into 'spaces' for teams, projects, or departments, each with independent permission settings. A rich text editor with Markdown shortcuts simplifies content creation. Built-in Draw.io, Excalidraw, and Mermaid tools provide robust diagramming capabilities.\n\nIt offers permissions management, assigning access via user groups for content security. Pages can be publicly shared via links for external access. Comments enhance communication and feedback, while page history tracks changes. Features like nested navigation, quick search, file attachments, and Markdown/HTML import/export are supported. The tool\u2019s collaboration and flexibility deliver a modern documentation solution.\n\n**Key Features:**\n- Real-time collaborative editing for multiple users\n- Spaces for organizing pages by team, project or department\n- Permissions management with user group access control\n- Rich text editor with Markdown shortcuts\n- Built-in Draw.io, Excalidraw, Mermaid diagramming tools\n- Public page sharing via links\n- Page comments for communication and feedback\n- Page history, nested navigation, search, and file attachments\n\n**Learn More:**\n- [Docmost Official Website](https://docmost.com/)\n- [Docmost GitHub](https://github.com/docmost/docmost)\n",
       "website": "https://docmost.com/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/docmost.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -2217,7 +2281,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-docmost"
     },
     {
       "id": "dogwalk",
@@ -2227,7 +2292,7 @@
       "repository": "https://github.com/linuxserver/docker-dogwalk",
       "description": "DOGWALK is Blender Studio's long awaited second game project, focused on creating a bite-sized interactive storytelling playground. Play as a big adorable dog and explore the winter woods with a little kid.",
       "website": "https://studio.blender.org/projects/dogwalk/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/dogwalk-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/dogwalk-logo.png",
       "architectures": [
         "amd64"
       ],
@@ -2235,8 +2300,8 @@
       "pushed_at": "2026-09-06T01:03:22Z",
       "updated_at": "2026-03-31",
       "main_image": "lscr.io/linuxserver/dogwalk:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "gaming",
+      "category_label": "Gaming & Leisure",
       "template": "apps/dogwalk.json",
       "template_status": "generated-unvalidated",
       "content_hash": "987a713a13a56cb9b0b25d264697a37a266727bb192c15c67653e737042b7b4a",
@@ -2248,7 +2313,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-dogwalk"
     },
     {
       "id": "dokuwiki",
@@ -2258,7 +2324,7 @@
       "repository": "https://github.com/linuxserver/docker-dokuwiki",
       "description": "Dokuwiki is a simple to use and highly versatile Open Source wiki software that doesn't require a database. It is loved by users for its clean and readable syntax. The ease of maintenance, backup and integration makes it an administrator's favorite. Built in access controls and authentication connectors make DokuWiki especially useful in the enterprise context and the large number of plugins contributed by its vibrant community allow for a broad range of use cases beyond a traditional wiki.",
       "website": "https://www.dokuwiki.org/dokuwiki/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/dokuwiki-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/dokuwiki.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -2267,8 +2333,8 @@
       "pushed_at": "2026-09-11T18:58:18Z",
       "updated_at": "2026-07-14",
       "main_image": "lscr.io/linuxserver/dokuwiki:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "documents",
+      "category_label": "Documents & Notes",
       "template": "apps/dokuwiki.json",
       "template_status": "generated-unvalidated",
       "content_hash": "6736c22b1b7c79d63952c63c192c73c760c317133b4b6e52dd84bdae585cbd4c",
@@ -2280,7 +2346,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-dokuwiki"
     },
     {
       "id": "dolphin",
@@ -2290,7 +2357,7 @@
       "repository": "https://github.com/linuxserver/docker-dolphin",
       "description": "Dolphin Emulator lets you play GameCube and Wii games with various graphical enhancements and other features are available to improve your game experience.",
       "website": "https://dolphin-emu.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/dolphin-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/dolphin.webp",
       "architectures": [
         "amd64"
       ],
@@ -2298,8 +2365,8 @@
       "pushed_at": "2026-09-13T01:28:48Z",
       "updated_at": "2026-05-06",
       "main_image": "lscr.io/linuxserver/dolphin:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "gaming",
+      "category_label": "Gaming & Leisure",
       "template": "apps/dolphin.json",
       "template_status": "generated-unvalidated",
       "content_hash": "02b815f93359d2912ae83bb5fd592d4ec254511383285789c7d4dc73a1e1d877",
@@ -2311,7 +2378,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-dolphin"
     },
     {
       "id": "doplarr",
@@ -2321,7 +2389,7 @@
       "repository": "https://github.com/linuxserver/docker-doplarr",
       "description": "Doplarr is an *arr request bot for Discord.\"",
       "website": "https://github.com/kiranshila/Doplarr",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/doplarr-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/doplarr.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -2330,8 +2398,8 @@
       "pushed_at": "2026-07-09T23:30:33Z",
       "updated_at": "2025-07-27",
       "main_image": "lscr.io/linuxserver/doplarr:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "arr",
+      "category_label": "*Arr Suite",
       "template": "apps/doplarr.json",
       "template_status": "generated-unvalidated",
       "content_hash": "fab02855609ab1483299490ddbe8cce934dfec2197bcfbf9810bb2bd38344aec",
@@ -2343,7 +2411,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "linuxserver-doplarr"
     },
     {
       "id": "doplarr_rs",
@@ -2353,7 +2422,7 @@
       "repository": "https://github.com/linuxserver/docker-doplarr_rs",
       "description": "Doplarr_rs is a Discord bot for requesting media through *arr backends, written in Rust.",
       "website": "https://github.com/activexray/doplarr_rs",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/doplarr_rs-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/doplarr_rs-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -2362,8 +2431,8 @@
       "pushed_at": "2026-09-10T18:29:06Z",
       "updated_at": "2026-06-22",
       "main_image": "lscr.io/linuxserver/doplarr_rs:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "arr",
+      "category_label": "*Arr Suite",
       "template": "apps/doplarr_rs.json",
       "template_status": "generated-unvalidated",
       "content_hash": "49b97eb2dffe7bcbf3a4aac206d70047829e610d13305cd70be2cf61d82ca44f",
@@ -2375,7 +2444,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-doplarr-rs"
     },
     {
       "id": "dosbox-staging",
@@ -2385,7 +2455,7 @@
       "repository": "https://github.com/linuxserver/docker-dosbox-staging",
       "description": "DOSBox Staging is a modern continuation of DOSBox a free and open-source emulator that enables the execution of MS-DOS software, especially video games.",
       "website": "https://www.dosbox-staging.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/dosbox-staging-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/dosbox-logo.png",
       "architectures": [
         "amd64"
       ],
@@ -2393,8 +2463,8 @@
       "pushed_at": "2026-09-11T15:02:25Z",
       "updated_at": "2026-03-05",
       "main_image": "lscr.io/linuxserver/dosbox-staging:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "gaming",
+      "category_label": "Gaming & Leisure",
       "template": "apps/dosbox-staging.json",
       "template_status": "generated-unvalidated",
       "content_hash": "b8d2edd63d44ab1341f855849bf6b0c86c171b7e84b21975ed0a114c43797172",
@@ -2406,7 +2476,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-dosbox-staging"
     },
     {
       "id": "doublecommander",
@@ -2416,7 +2487,7 @@
       "repository": "https://github.com/linuxserver/docker-doublecommander",
       "description": "Double Commander is a free cross platform open source file manager with two panels side by side. It is inspired by Total Commander and features some new ideas.",
       "website": "https://doublecmd.sourceforge.io/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/doublecommander-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/double-commander.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -2425,8 +2496,8 @@
       "pushed_at": "2026-09-09T21:59:22Z",
       "updated_at": "2026-04-03",
       "main_image": "lscr.io/linuxserver/doublecommander:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "tools",
+      "category_label": "Tools",
       "template": "apps/doublecommander.json",
       "template_status": "generated-unvalidated",
       "content_hash": "01fc0e09ef0b2409f14b1903423ee782b1caf286f52a9119bed34f408f251ea6",
@@ -2438,7 +2509,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-doublecommander"
     },
     {
       "id": "downtify",
@@ -2450,7 +2522,7 @@
       "repository": "https://ghcr.io/henriquesebastiao/downtify",
       "description": "With Downtify you can download Spotify musics containing album art, track names, album title and other metadata about the songs. Just copy the Spotify link, whether it's a single song, an album, etc. As soon as your downloads are complete you will be notified!\n",
       "website": "https://downtify.henriquesebastiao.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/downtify.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -2474,7 +2546,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-downtify"
     },
     {
       "id": "dsh-harness",
@@ -2486,7 +2559,7 @@
       "repository": "https://ghcr.io/smanx/deepseek-harness",
       "description": "DeepSeek Harness (dsh) is an open-source agent harness developed by DeepSeek AI.",
       "website": "https://www.deepseek.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/deepseek-ai/deepseek-harness@master/apps/web/public/favicon.svg",
       "architectures": [
         "amd64",
         "arm64"
@@ -2510,7 +2583,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-dsh-harness"
     },
     {
       "id": "duckdns",
@@ -2520,7 +2594,7 @@
       "repository": "https://github.com/linuxserver/docker-duckdns",
       "description": "Duckdns is a free service which will point a DNS (sub domains of duckdns.org) to an IP of your choice. The service is completely free, and doesn't require reactivation or forum posts to maintain its existence.",
       "website": "https://duckdns.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/duckdns-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/duckdns.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -2529,8 +2603,8 @@
       "pushed_at": "2026-09-07T08:51:40Z",
       "updated_at": "2026-07-15",
       "main_image": "lscr.io/linuxserver/duckdns:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "adblock",
+      "category_label": "Adblock & DNS",
       "template": "apps/duckdns.json",
       "template_status": "generated-unvalidated",
       "content_hash": "4eefc97b4a4f876fb55563b28e2f61850ec84117b1548aa38263a05c5785ef7d",
@@ -2542,7 +2616,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-duckdns"
     },
     {
       "id": "duckstation",
@@ -2552,7 +2627,7 @@
       "repository": "https://github.com/linuxserver/docker-duckstation",
       "description": "DuckStation is a PS1 Emulator aiming for the best accuracy and game support.",
       "website": "https://duckstation.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/duckstation-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/duckstation-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -2561,8 +2636,8 @@
       "pushed_at": "2026-09-09T05:35:37Z",
       "updated_at": "2026-03-05",
       "main_image": "lscr.io/linuxserver/duckstation:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "gaming",
+      "category_label": "Gaming & Leisure",
       "template": "apps/duckstation.json",
       "template_status": "generated-unvalidated",
       "content_hash": "f80996b8b0a9fcb901a750f03c33eb3e891896b812378e18712b8c05b14fdd88",
@@ -2574,7 +2649,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-duckstation"
     },
     {
       "id": "duplicati",
@@ -2584,7 +2660,7 @@
       "repository": "https://github.com/linuxserver/docker-duplicati",
       "description": "Duplicati is a backup client that securely stores encrypted, incremental, compressed backups on local storage, cloud storage services and remote file servers. It works with standard protocols like FTP, SSH, WebDAV as well as popular services like Microsoft OneDrive, Amazon S3, Google Drive, box.com, Mega, B2, and many others.",
       "website": "https://www.duplicati.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/duplicati-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/duplicati.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -2606,7 +2682,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-duplicati"
     },
     {
       "id": "eden",
@@ -2616,7 +2693,7 @@
       "repository": "https://github.com/linuxserver/docker-eden",
       "description": "Eden is an experimental open-source emulator for the Nintendo Switch, built with performance and stability in mind.",
       "website": "https://eden-emu.dev/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/eden-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/eden-logo.png",
       "architectures": [
         "amd64"
       ],
@@ -2624,8 +2701,8 @@
       "pushed_at": "2026-09-10T08:58:13Z",
       "updated_at": "2026-06-30",
       "main_image": "lscr.io/linuxserver/eden:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "gaming",
+      "category_label": "Gaming & Leisure",
       "template": "apps/eden.json",
       "template_status": "generated-unvalidated",
       "content_hash": "514de91483fab4b1a0f63137a4b6901d4d0c7bd7666874a255ea322fe1f2afac",
@@ -2637,7 +2714,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-eden"
     },
     {
       "id": "emby",
@@ -2647,7 +2725,7 @@
       "repository": "https://github.com/linuxserver/docker-emby",
       "description": "Emby organizes video, music, live TV, and photos from personal media libraries and streams them to smart TVs, streaming boxes and mobile devices. This container is packaged as a standalone emby Media Server.",
       "website": "https://emby.media/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/emby-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/emby.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -2669,7 +2747,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-emby"
     },
     {
       "id": "emby-official",
@@ -2679,7 +2758,7 @@
       "repository": "https://hub.docker.com/r/emby/embyserver",
       "description": "Emby is a personal media management platform that brings home videos, music, and photos together, automatically converting and streaming to any device. An intuitive design makes it ideal for users to enjoy media content anytime, anywhere, meeting family entertainment and media management needs.\n\nCore features include cross-device media streaming and easy access. It supports real-time conversion and streaming of personal media to any device for seamless playback. A connection service enables easy media access while away from home. Live TV functionality supports streaming, managing DVR, and accessing a library of recordings. Mobile sync delivers media to smartphones and tablets for offline access, automatically updating new content.\n\nIt offers parental controls to restrict children's content access, set schedules and time limits, and remotely monitor sessions. Chromecast support enables easy streaming of videos, music, photos, and Live TV. Content is presented elegantly, enhancing visual experience. Cloud sync supports backup, archiving, and multi-resolution storage for optimized streaming. Web-based media management facilitates editing metadata, images, and searching subtitles, while DLNA integration auto-detects network devices for content streaming. With convenience and versatility at the core, the platform delivers a modern media management solution.\n\n**Key Features:**\n- Automatic conversion and streaming of media to any device\n- Easy access via connection service while away from home\n- Live TV streaming, DVR management, and recording library access\n- Mobile sync to smartphones and tablets for offline access\n- Parental controls with content restrictions, schedules, and remote monitoring\n- Chromecast support for streaming videos, music, photos, and Live TV\n- Cloud sync for backup and multi-resolution storage\n- Web-based media management for editing metadata and searching subtitles\n- DLNA integration for auto-detecting network devices and streaming content\n\n**Learn More:**\n- [Emby Official Website](https://emby.media/)\n",
       "website": "https://emby.media/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/emby.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -2704,7 +2783,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-emby-official"
     },
     {
       "id": "embystat",
@@ -2716,7 +2796,7 @@
       "repository": "https://hub.docker.com/r/linuxserver/embystat",
       "description": "EmbyStat is a personal web server that can calculate all kinds of statistics from your (local) Emby or Jellyfin server. Just install this on your server and let him calculate all kinds of fun stuff. This project is still in Alpha phase, but feel free to pull in on your computer and test it out yourself. When the time is right I will host a full informational website/release for common platforms and Wiki pages.",
       "website": "",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/embystat.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -2740,7 +2820,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-embystat"
     },
     {
       "id": "emulatorjs",
@@ -2752,7 +2833,7 @@
       "repository": "https://hub.docker.com/r/linuxserver/emulatorjs",
       "description": "EmulatorJS is a Docker-based emulator application that can simulate various operating systems and device environments within containers for development, testing, and learning purposes.",
       "website": "https://emulatorjs.org/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/emulatorjs.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -2763,8 +2844,8 @@
       "pushed_at": "2026-09-11T10:43:22Z",
       "updated_at": "2025-06-09",
       "main_image": "linuxserver/emulatorjs:latest",
-      "category": "media",
-      "category_label": "Media & Streaming",
+      "category": "gaming",
+      "category_label": "Gaming & Leisure",
       "template": "apps/emulatorjs.json",
       "template_status": "generated-unvalidated",
       "content_hash": "267a6a6afae93ed0ba99322abe4732811427e4e49d961b016b23987d562cb173",
@@ -2776,7 +2857,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-emulatorjs"
     },
     {
       "id": "esphome",
@@ -2788,7 +2870,7 @@
       "repository": "https://ghcr.io/esphome/esphome",
       "description": "ESPHome is a system to control your microcontrollers by simple yet powerful configuration files and control them remotely through Home Automation systems.",
       "website": "https://esphome.io",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/esphome.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -2812,7 +2894,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-esphome"
     },
     {
       "id": "etherpad",
@@ -2824,7 +2907,7 @@
       "repository": "https://hub.docker.com/r/etherpad/etherpad",
       "description": "Etherpad is a real-time collaborative document editor where multiple people can edit the same pad simultaneously, with every change synchronized instantly and colour-coded per author.\nSelf-hosted, open source, and fully under your control, it is perfect for meeting notes, brainstorming, shared writing, and lightweight knowledge capture.\nIt ships with a built-in admin panel, a plugin ecosystem of 250+ add-ons, native DOCX/PDF/Markdown import & export, and multi-architecture container support (amd64 + arm64).\n\n**Main Features:**\n- Real-time collaborative editing with instant sync\n- Per-author colour coding for clear writing attribution\n- Built-in admin panel and a plugin ecosystem with 250+ add-ons\n- Native DOCX, PDF, and Markdown import & export\n- Open source, self-hosted deployment with amd64 and arm64 support\n\n**Learn More:**\n- [Etherpad Official Website](https://etherpad.org/)\n- [Etherpad GitHub](https://github.com/ether/etherpad)\n- [Etherpad Documentation](https://docs.etherpad.org/)\n",
       "website": "https://etherpad.org/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/etherpad.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -2848,7 +2931,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-etherpad"
     },
     {
       "id": "excalidraw",
@@ -2860,7 +2944,7 @@
       "repository": "https://hub.docker.com/r/excalidraw/excalidraw",
       "description": "Excalidraw is a virtual hand-drawn style whiteboard platform supporting infinite canvas and end-to-end encrypted collaboration. An intuitive interface offers a hand-drawn experience, ideal for brainstorming, design sketches, or educational scenarios, meeting diverse creative needs.\n\nCore features include an infinite canvas whiteboard and end-to-end encrypted collaboration. Hand-drawn style with shape library support allows creating rich graphics, enhanced by image insertion capabilities. Dark mode improves user experience, catering to diverse users.\n\nIt provides export options including PNG, SVG, and clipboard for easy content sharing. Drawing capabilities cover rectangle, circle, diamond, arrow, line, free-draw, and eraser, with arrow-binding and labeled arrow support. Undo, redo, zoom, and panning functionalities optimize operations. With creativity and security at the core, the platform delivers a modern whiteboard design solution.\n\n**Key Features:**\n- Infinite canvas whiteboard supporting hand-drawn style\n- Shape library support for creating rich graphics\n- Image insertion capability\n- Dark mode\n- Export to PNG, SVG, and clipboard\n- Open format - export drawings as an `.excalidraw` json file\n- Wide range of tools - rectangle, circle, diamond, arrow, line, free-draw, eraser...\n- Arrow-binding & labeled arrows\n- Undo and redo\n- Zoom and panning support\n\n**Learn More:**\n- [Excalidraw Official Website](https://excalidraw.com/)\n- [Excalidraw GitHub](https://github.com/excalidraw/excalidraw)\n",
       "website": "https://excalidraw.com/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/excalidraw.webp",
       "architectures": [
         "amd64"
       ],
@@ -2883,7 +2967,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-excalidraw"
     },
     {
       "id": "faster-whisper",
@@ -2893,7 +2978,7 @@
       "repository": "https://github.com/linuxserver/docker-faster-whisper",
       "description": "Faster-whisper is a reimplementation of OpenAI's Whisper model using CTranslate2, which is a fast inference engine for Transformer models. This container provides a Wyoming protocol server for faster-whisper.",
       "website": "https://github.com/SYSTRAN/faster-whisper",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/faster-whisper-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/home-assistant/brands@master/core_integrations/wyoming/icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -2902,8 +2987,8 @@
       "pushed_at": "2026-09-12T01:03:07Z",
       "updated_at": "2026-08-16",
       "main_image": "lscr.io/linuxserver/faster-whisper:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "ai",
+      "category_label": "AI / Coding & Dev-Tools",
       "template": "apps/faster-whisper.json",
       "template_status": "generated-unvalidated",
       "content_hash": "6101b77660f6e1714e300703a1f7730ac698be028aa6e5982f262f1c8fac9e1a",
@@ -2915,7 +3000,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-faster-whisper"
     },
     {
       "id": "ferdium",
@@ -2925,7 +3011,7 @@
       "repository": "https://github.com/linuxserver/docker-ferdium",
       "description": "Ferdium is a desktop app that helps you organize how you use your favourite apps by combining them into one application.",
       "website": "https://ferdium.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ferdium-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/ferdium.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -2934,8 +3020,8 @@
       "pushed_at": "2026-09-13T08:34:05Z",
       "updated_at": "2026-04-03",
       "main_image": "lscr.io/linuxserver/ferdium:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "communication",
+      "category_label": "Communication & Community",
       "template": "apps/ferdium.json",
       "template_status": "generated-unvalidated",
       "content_hash": "88327550e74883d21cb62ccd94ea6bdaeb952ab3a158f1f984a14e25e0c56afb",
@@ -2947,7 +3033,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-ferdium"
     },
     {
       "id": "filebrowser-quantum",
@@ -2957,7 +3044,7 @@
       "repository": "https://github.com/gtsteffaniak/filebrowser",
       "description": "Official image with managed persistent configuration and selectable content storage. Validated on amd64: clean install, authenticated login, same-digest recreation and interrupted-candidate recovery. Cross-release migration and arm64 runtime not tested.",
       "website": "https://github.com/gtsteffaniak/filebrowser",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/filebrowser-quantum.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -2979,7 +3066,8 @@
       "requires_host_pid_namespace": false,
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
-      "requires_security_confirmation": false
+      "requires_security_confirmation": false,
+      "template_id": "image-filebrowser-quantum"
     },
     {
       "id": "filedrop",
@@ -2991,7 +3079,7 @@
       "repository": "https://hub.docker.com/r/noecl/filedrop",
       "description": "FileDrop is a self-hosted file sharing service that allows you to easily share files with family, friends, or colleagues. It's been designed to be easy to use and light on resources.\n",
       "website": "",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/filedrop.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -3015,7 +3103,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-filedrop"
     },
     {
       "id": "fileflows",
@@ -3025,7 +3114,7 @@
       "repository": "https://hub.docker.com/r/revenz/fileflows",
       "description": "Save storage space with efficient file processing.\n\nFileFlows lets you monitor and process any file type with custom flows. Videos, audio, images, archives, comics, eBooks\u2014you name it!\n",
       "website": "https://fileflows.com/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/fileflows.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -3049,7 +3138,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-fileflows"
     },
     {
       "id": "filezilla",
@@ -3059,7 +3149,7 @@
       "repository": "https://github.com/linuxserver/docker-filezilla",
       "description": "FIleZilla Client is a fast and reliable cross-platform FTP, FTPS and SFTP client with lots of useful features and an intuitive graphical user interface.",
       "website": "https://filezilla-project.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/filezilla-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/filezilla.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -3068,8 +3158,8 @@
       "pushed_at": "2026-09-07T22:33:52Z",
       "updated_at": "2026-05-20",
       "main_image": "lscr.io/linuxserver/filezilla:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "downloads",
+      "category_label": "Files & Downloads",
       "template": "apps/filezilla.json",
       "template_status": "generated-unvalidated",
       "content_hash": "5751f36bb751fe2a8a712ca37189576dca7162d65148391d6815eb1181f5300d",
@@ -3081,7 +3171,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-filezilla"
     },
     {
       "id": "firefly",
@@ -3093,7 +3184,7 @@
       "repository": "https://hub.docker.com/r/uusec/firefly",
       "description": "Firefly is a simple and easy to install WireGuard server software, which can be widely used in scenarios such as remote networking, remote work, and expose a local server behind a NAT or firewall to the internet.  \ud83c\udfaf Features \ud83d\udfe2 Provide a simple and easy-to-use web management UI  \ud83d\udfe3 Supports access to all WireGuard clients  \ud83d\udfe1 No need for system installation of WireGuard components  \ud83d\udfe0 Single file, no additional library dependencies  \ud83d\udd34 Automatically apply for free SSL certificate",
       "website": "https://qq.uusec.com/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/firefly.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -3117,7 +3208,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-firefly"
     },
     {
       "id": "firefox",
@@ -3127,7 +3219,7 @@
       "repository": "https://github.com/linuxserver/docker-firefox",
       "description": "Firefox Browser, also known as Mozilla Firefox or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation. Firefox uses the Gecko layout engine to render web pages, which implements current and anticipated web standards.",
       "website": "https://www.mozilla.org/en-US/firefox/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/firefox-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/firefox.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -3136,8 +3228,8 @@
       "pushed_at": "2026-09-12T23:15:25Z",
       "updated_at": "2026-07-04",
       "main_image": "lscr.io/linuxserver/firefox:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "desktop",
+      "category_label": "Browsers & Web Desktops",
       "template": "apps/firefox.json",
       "template_status": "generated-unvalidated",
       "content_hash": "1e626c8a42bb9ca6a5d471e5b091a63ab3d4f7a3c80f7d9b20c92864f578196d",
@@ -3149,7 +3241,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-firefox"
     },
     {
       "id": "flaresolverr",
@@ -3161,7 +3254,7 @@
       "repository": "https://ghcr.io/flaresolverr/flaresolverr",
       "description": "",
       "website": "",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/flaresolverr.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -3185,7 +3278,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-flaresolverr"
     },
     {
       "id": "flexget",
@@ -3195,7 +3289,7 @@
       "repository": "https://github.com/linuxserver/docker-flexget",
       "description": "Flexget is a multipurpose automation tool for all of your media.",
       "website": "http://flexget.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/flexget-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/flexget.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -3204,8 +3298,8 @@
       "pushed_at": "2026-09-11T21:37:54Z",
       "updated_at": "2026-08-15",
       "main_image": "lscr.io/linuxserver/flexget:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "arr",
+      "category_label": "*Arr Suite",
       "template": "apps/flexget.json",
       "template_status": "laboratory-validated",
       "content_hash": "79cb8eb32708faf01774ccdd3beced9579f95aab0c47c91c7c800ae0993e2e45",
@@ -3217,7 +3311,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-flexget"
     },
     {
       "id": "flowise",
@@ -3229,7 +3324,7 @@
       "repository": "https://hub.docker.com/r/flowiseai/flowise",
       "description": "Flowise is a generative AI development platform for building AI agents and LLM workflows. An intuitive interface with a visual editor simplifies complex workflow design, ideal for developers creating diverse AI applications, from chatbots to data processing pipelines.\n\nCore features include visual orchestration and data integration. Support for various models, custom code, and branching, looping, and routing logic enables complex workflow creation. Connection to over 100 data sources, vector databases, and memory modules ensures flexible data ingestion. Monitoring capabilities provide execution logs and visual debugging for workflow transparency and maintenance. Self-hosted and air-gapped deployment options accommodate diverse infrastructure needs.\n\nIt offers data processing with transforms, filters, aggregates, and RAG indexing pipelines. Memory optimization and planning techniques enhance performance, while MCP integration supports tool connections and authentication. Security controls include role-based access, single sign-on, and encrypted credentials for data protection. API, JavaScript and Python SDKs, and command-line interface enable extensibility, with embedded chat components and a template marketplace accelerating development. Scalability supports high-throughput workflows, and evaluation features optimize performance. With flexibility and efficiency at the core, the platform delivers a modern solution for AI development.\n\n**Key Features:**\n- Visual editor supporting multiple models, custom code, branching looping routing logic\n- Connection to over 100 data sources, vector databases, and memory modules\n- Execution logs and visual debugging for enhanced monitoring\n- Data processing with transforms, filters, aggregates, and RAG indexing pipelines\n- Various memory optimization technique and integrations\n- MCP client and server nodes for tool integration\n- Input moderation and output post-processing for safety\n- API, JavaScript and Python SDKs, and command-line interface\n- Customizable embedded chat components\n- Template marketplace and reusable components\n- Role-based access control, single sign-on, encrypted credentials\n- Vertical and horizontal scalability for high-throughput workflows\n- Datasets and evaluation features for workflow optimization\n\n**Learn More:**\n- [Flowise Official Website](https://flowiseai.com/)\n- [Flowise GitHub](https://github.com/flowiseai/flowise)\n- [Flowise Documentation](https://docs.flowiseai.com/)\n",
       "website": "https://flowiseai.com/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/flowise.webp",
       "architectures": [
         "amd64"
       ],
@@ -3252,7 +3347,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-flowise"
     },
     {
       "id": "flycast",
@@ -3262,7 +3358,7 @@
       "repository": "https://github.com/linuxserver/docker-flycast",
       "description": "Flycast is a multi-platform Sega Dreamcast, Naomi, Naomi 2, and Atomiswave emulator derived from reicast.",
       "website": "https://github.com/flyinghead/flycast",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/flycast-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/flycast-logo.png",
       "architectures": [
         "amd64"
       ],
@@ -3270,8 +3366,8 @@
       "pushed_at": "2026-09-13T19:48:32Z",
       "updated_at": "2026-03-05",
       "main_image": "lscr.io/linuxserver/flycast:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "gaming",
+      "category_label": "Gaming & Leisure",
       "template": "apps/flycast.json",
       "template_status": "generated-unvalidated",
       "content_hash": "52c339b1b7c8cefc8571fc22ab3c4b3f58b40dbf6f028bd4f3d7b1360e7e56c1",
@@ -3283,7 +3379,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-flycast"
     },
     {
       "id": "foldingathome",
@@ -3293,7 +3390,7 @@
       "repository": "https://github.com/linuxserver/docker-foldingathome",
       "description": "Folding@home is a distributed computing project for simulating protein dynamics, including the process of protein folding and the movements of proteins implicated in a variety of diseases. It brings together citizen scientists who volunteer to run simulations of protein dynamics on their personal computers. Insights from this data are helping scientists to better understand biology, and providing new opportunities for developing therapeutics.",
       "website": "https://foldingathome.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/foldingathome-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/foldingathome.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -3315,7 +3412,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-foldingathome"
     },
     {
       "id": "freecad",
@@ -3325,7 +3423,7 @@
       "repository": "https://github.com/linuxserver/docker-freecad",
       "description": "FreeCAD is a general-purpose parametric 3D computer-aided design (CAD) modeler and a building information modeling (BIM) software application with finite element method (FEM) support.",
       "website": "https://www.freecad.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/freecad-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/freecad.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -3334,8 +3432,8 @@
       "pushed_at": "2026-09-12T15:34:22Z",
       "updated_at": "2026-03-29",
       "main_image": "lscr.io/linuxserver/freecad:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "creative",
+      "category_label": "Creative & Design",
       "template": "apps/freecad.json",
       "template_status": "generated-unvalidated",
       "content_hash": "afdc74c18ce6064a650669040d8398487703843fe8390f2ac831cc62b8e7ac46",
@@ -3347,7 +3445,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-freecad"
     },
     {
       "id": "freshrss",
@@ -3357,7 +3456,7 @@
       "repository": "https://github.com/linuxserver/docker-freshrss",
       "description": "Freshrss is a free, self-hostable aggregator for rss feeds.",
       "website": "https://freshrss.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/freshrss-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/freshrss.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -3379,7 +3478,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-freshrss"
     },
     {
       "id": "freshrss-official",
@@ -3391,7 +3491,7 @@
       "repository": "https://hub.docker.com/r/freshrss/freshrss",
       "description": "FreshRSS is a self-hosted RSS and Atom feed aggregator. It is lightweight, easy to work with, powerful, and customizable.",
       "website": "https://freshrss.org/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/freshrss.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -3415,7 +3515,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-freshrss-official"
     },
     {
       "id": "frigate",
@@ -3425,7 +3526,7 @@
       "repository": "https://github.com/blakeblackshear/frigate",
       "description": "Frigate adapted as a native Proxmox OCI LXC with persistent configuration, selectable recording storage, tmpfs cache and optional GPU or detector devices.",
       "website": "https://frigate.video/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/frigate.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -3449,7 +3550,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-frigate"
     },
     {
       "id": "gateway-go",
@@ -3461,7 +3563,7 @@
       "repository": "https://hub.docker.com/r/openiothub/gateway-go",
       "description": "A fast reverse proxy to help you expose a local server behind a NAT or firewall to your client, remote access all your self-hosted server/self-hosted server apps.\n\nUse OpenIoTHub to scan the following QR code add a gateway,then add host,add self-hosted server/self-hosted server host's web page port,finally, enjoy remote control\n",
       "website": "",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/Gateway-go/icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -3472,8 +3574,8 @@
       "pushed_at": "2026-09-11T10:43:22Z",
       "updated_at": "2026-01-11",
       "main_image": "openiothub/gateway-go:latest",
-      "category": "network",
-      "category_label": "Network & Firewall",
+      "category": "web",
+      "category_label": "Webservers & Proxies",
       "template": "apps/gateway-go.json",
       "template_status": "generated-unvalidated",
       "content_hash": "0ea76602729dea636b6325cedcdc6d3ec4d5dc78dce053340fb1f91a91767b58",
@@ -3485,7 +3587,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-gateway-go"
     },
     {
       "id": "gimp",
@@ -3495,7 +3598,7 @@
       "repository": "https://github.com/linuxserver/docker-gimp",
       "description": "GIMP is a free and open-source raster graphics editor used for image manipulation (retouching) and image editing, free-form drawing, transcoding between different image file formats, and more specialized tasks. It is extensible by means of plugins, and scriptable.",
       "website": "https://www.gimp.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/gimp-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/gimp.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -3504,8 +3607,8 @@
       "pushed_at": "2026-09-08T10:28:59Z",
       "updated_at": "2026-03-24",
       "main_image": "lscr.io/linuxserver/gimp:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "creative",
+      "category_label": "Creative & Design",
       "template": "apps/gimp.json",
       "template_status": "generated-unvalidated",
       "content_hash": "457bbc6a87847e3366d82c45f9cccdffade435f5f9684a8ffd471f40dd3c750e",
@@ -3517,7 +3620,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-gimp"
     },
     {
       "id": "gitea",
@@ -3529,7 +3633,7 @@
       "repository": "https://hub.docker.com/r/gitea/gitea",
       "description": "Gitea is a painless self-hosted all-in-one software development service, it includes Git hosting, code review, team collaboration, package registry and CI/CD. It is similar to GitHub, Bitbucket and GitLab. \n\n- Code Hosting\nGitea supports creating and managing repositories, browsing commit history and code files, reviewing and merging code submissions, managing collaborators, handling branches, and more. It also supports many common Git features such as tags, Cherry-pick, hooks, integrated collaboration tools, and more.\n\n- Lightweight and Fast\nOne of Gitea's design goals is to be lightweight and fast in response. Unlike some large code hosting platforms, it remains lean, performing well in terms of speed, and is suitable for resource-limited server environments. Due to its lightweight design, Gitea has relatively low resource consumption and performs well in resource-constrained environments.\n\n- Easy Deployment and Maintenance\nIt can be easily deployed on various servers without complex configurations or dependencies. This makes it convenient for individual developers or small teams to set up and manage their own Git services.\n\n- Security\nGitea places a strong emphasis on security, offering features such as user permission management, access control lists, and more to ensure the security of code and data.\n\n- Code Review\nCode review supports both the Pull Request workflow and AGit workflow. Reviewers can browse code online and provide review comments or feedback. Submitters can receive review comments and respond or modify code online. Code reviews can help individuals and organizations enhance code quality.\n\n- CI/CD\nGitea Actions supports CI/CD functionality, compatible with GitHub Actions. Users can write workflows in familiar YAML format and reuse a variety of existing Actions plugins. Actions plugins support downloading from any Git website.\n\n- Project Management\nGitea tracks project requirements, features, and bugs through columns and issues. Issues support features like branches, tags, milestones, assignments, time tracking, due dates, dependencies, and more.\n\n- Artifact Repository\nGitea supports over 20 different types of public or private software package management, including Cargo, Chef, Composer, Conan, Conda, Container, Helm, Maven, npm, NuGet, Pub, PyPI, RubyGems, Vagrant, and more.\n\n- Open Source Community Support\nGitea is an open-source project based on the MIT license. It has an active open-source community that continuously develops and improves the platform. The project also actively welcomes community contributions, ensuring updates and innovation.\n\n- Multilingual Support\nGitea provides interfaces in multiple languages, catering to users globally and promoting internationalization and localization.\n",
       "website": "https://about.gitea.com/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/gitea.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -3553,7 +3657,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-gitea"
     },
     {
       "id": "github-desktop",
@@ -3563,7 +3668,7 @@
       "repository": "https://github.com/linuxserver/docker-github-desktop",
       "description": "Github Desktop is an open source Electron-based GitHub app. It is written in TypeScript and uses React.",
       "website": "https://desktop.github.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/github-desktop-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/github-desktop-icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -3572,8 +3677,8 @@
       "pushed_at": "2026-09-13T00:12:51Z",
       "updated_at": "2026-04-03",
       "main_image": "lscr.io/linuxserver/github-desktop:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "ai",
+      "category_label": "AI / Coding & Dev-Tools",
       "template": "apps/github-desktop.json",
       "template_status": "generated-unvalidated",
       "content_hash": "340f5476ceacc540de5985e42869bd06c0f0fc8cca0a87c70110f1172e45a03e",
@@ -3585,7 +3690,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-github-desktop"
     },
     {
       "id": "gitqlient",
@@ -3595,7 +3701,7 @@
       "repository": "https://github.com/linuxserver/docker-gitqlient",
       "description": "GitQlient is a multi-platform Git client originally forked from QGit. Nowadays it goes beyond of just a fork and adds a lot of new functionality.",
       "website": "https://github.com/francescmm/GitQlient",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/gitqlient-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/gitqlient-icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -3604,8 +3710,8 @@
       "pushed_at": "2026-09-07T17:07:53Z",
       "updated_at": "2026-06-10",
       "main_image": "lscr.io/linuxserver/gitqlient:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "ai",
+      "category_label": "AI / Coding & Dev-Tools",
       "template": "apps/gitqlient.json",
       "template_status": "generated-unvalidated",
       "content_hash": "43abbf314e5c5e4df6bb06f22a861191d5ff02da81c4b30bc2aebc807e18d734",
@@ -3617,7 +3723,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-gitqlient"
     },
     {
       "id": "glances",
@@ -3629,7 +3736,7 @@
       "repository": "https://hub.docker.com/r/nicolargo/glances",
       "description": "Glances is an open-source system cross-platform monitoring tool. It allows real-time monitoring of various aspects of your system such as CPU, memory, disk, network usage etc.",
       "website": "https://nicolargo.github.io/glances/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/glances.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -3653,7 +3760,8 @@
       "requires_relaxed_confinement": true,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": true,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-glances"
     },
     {
       "id": "gopeed",
@@ -3665,7 +3773,7 @@
       "repository": "https://hub.docker.com/r/liwei2633/gopeed",
       "description": "Gopeed is a modern high-speed download tool supporting HTTP, BitTorrent, and Magnet protocols, offering a beautiful interface and powerful functionality. Its lightweight design and multi-platform support make it ideal for efficient file downloading across various devices.\n\nThe tool's core features include high-speed downloading and an elegant interface. It leverages Golang coroutines for concurrent downloading, supporting HTTP, HTTPS, BitTorrent, and Magnet protocols for fast, stable performance. The interface follows Material Design standards, including a dark mode, balancing aesthetics and usability. Advanced features include seeding, DHT, PEX, uTP, Webtorrent, and UPnP support, with daily automatic tracker list updates to enhance download efficiency.\n\nIt provides a RESTful API for open integration, allowing users to remotely control download tasks, pause, or delete them. Decentralized extensions enable JavaScript plugins to enhance functionality, such as downloading videos or music from websites. The tool's speed, flexibility, and user-friendly design deliver a modern download solution.\n\n**Key Features:**\n- High-speed downloading with HTTP, BitTorrent, Magnet protocols\n- Seeding, DHT, PEX, uTP, Webtorrent, UPnP\n- Daily automatic tracker list updates\n- RESTful API for remote download task control\n- Decentralized extensions with JavaScript plugins\n\n**Learn More:**\n- [Gopeed Official Website](https://gopeed.com)\n- [Gopeed GitHub Repository](https://github.com/gopeedlab/gopeed)\n",
       "website": "https://gopeed.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/gopeed.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -3689,7 +3797,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-gopeed"
     },
     {
       "id": "grafana",
@@ -3701,7 +3810,7 @@
       "repository": "https://hub.docker.com/r/grafana/grafana",
       "description": "Grafana open source is open source visualization and analytics software.Visualizations: Fast and flexible client side graphs with a multitude of options. Panel plugins offer many different ways to visualize metrics and logs. Dynamic Dashboards: Create dynamic & reusable dashboards with template variables that appear as dropdowns at the top of the dashboard. Explore Metrics: Explore your data through ad-hoc queries and dynamic drilldown. Split view and compare different time ranges, queries and data sources side by side. Explore Logs: Experience the magic of switching from metrics to logs with preserved label filters. Quickly search through all your logs or streaming them live. Alerting: Visually define alert rules for your most important metrics. Grafana will continuously evaluate and send notifications to systems like Slack, PagerDuty, VictorOps, OpsGenie. Mixed Data Sources: Mix different data sources in the same graph! You can specify a data source on a per-query basis. This works for even custom datasources.\n",
       "website": "https://grafana.com/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/grafana.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -3725,7 +3834,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-grafana"
     },
     {
       "id": "grav",
@@ -3735,7 +3845,7 @@
       "repository": "https://github.com/linuxserver/docker-grav",
       "description": "Grav is a Fast, Simple, and Flexible, file-based Web-platform.",
       "website": "https://github.com/getgrav/grav/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/grav-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/grav.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -3757,7 +3867,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-grav"
     },
     {
       "id": "grocy",
@@ -3767,7 +3878,7 @@
       "repository": "https://github.com/linuxserver/docker-grocy",
       "description": "Grocy is an ERP system for your kitchen! Cut down on food waste, and manage your chores with this brilliant utility.",
       "website": "https://github.com/grocy/grocy",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/grocy-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/grocy.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -3776,8 +3887,8 @@
       "pushed_at": "2026-09-13T13:04:43Z",
       "updated_at": "2026-03-07",
       "main_image": "lscr.io/linuxserver/grocy:latest",
-      "category": "gaming",
-      "category_label": "Gaming & Leisure",
+      "category": "productivity",
+      "category_label": "Productivity & Workflows",
       "template": "apps/grocy.json",
       "template_status": "generated-unvalidated",
       "content_hash": "2aa466029f5147c1ec588c7addd54b57a6d1c9a47add459d669a1c7a91e5ef51",
@@ -3789,7 +3900,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-grocy"
     },
     {
       "id": "gzdoom",
@@ -3799,7 +3911,7 @@
       "repository": "https://github.com/linuxserver/docker-gzdoom",
       "description": "GZDoom is a feature centric port for all Doom engine games, based on ZDoom, adding an OpenGL renderer and powerful scripting capabilities.",
       "website": "https://gzdoom.app/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/gzdoom-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/gzdoom-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -3808,8 +3920,8 @@
       "pushed_at": "2026-09-08T00:15:20Z",
       "updated_at": "2026-04-19",
       "main_image": "lscr.io/linuxserver/gzdoom:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "gaming",
+      "category_label": "Gaming & Leisure",
       "template": "apps/gzdoom.json",
       "template_status": "generated-unvalidated",
       "content_hash": "b8d8ab7e5cbb9c178b1d5e83f6a3bb077675af88e51e6b5e3ae75aa7d003b500",
@@ -3821,7 +3933,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-gzdoom"
     },
     {
       "id": "habridge",
@@ -3831,7 +3944,7 @@
       "repository": "https://github.com/linuxserver/docker-habridge",
       "description": "Habridge emulates Philips Hue API to other home automation gateways such as an Amazon Echo/Dot Gen 1 (gen 2 has issues discovering ha-bridge) or other systems that support Philips Hue. The Bridge handles basic commands such as On, Off and brightness commands of the hue protocol. This bridge can control most devices that have a distinct API.",
       "website": "https://github.com/bwssytems/ha-bridge/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/habridge-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/habridge-icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -3840,8 +3953,8 @@
       "pushed_at": "2026-07-03T23:18:53Z",
       "updated_at": "2024-06-27",
       "main_image": "lscr.io/linuxserver/habridge:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "smarthome",
+      "category_label": "IoT & Smart Home",
       "template": "apps/habridge.json",
       "template_status": "generated-unvalidated",
       "content_hash": "a822928bdd3bd3fdc19dbcd7d16ee178965e6fdd8288b1047e9b59d4cadfbb5c",
@@ -3853,7 +3966,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-habridge"
     },
     {
       "id": "handbrake",
@@ -3863,7 +3977,7 @@
       "repository": "https://github.com/linuxserver/docker-handbrake",
       "description": "HandBrake is an open-source tool, built by volunteers, for converting video from nearly any format to a selection of modern, widely supported codecs.",
       "website": "https://handbrake.fr/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/handbrake-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/handbrake.webp",
       "architectures": [
         "amd64"
       ],
@@ -3871,8 +3985,8 @@
       "pushed_at": "2026-09-10T14:49:26Z",
       "updated_at": "2026-04-03",
       "main_image": "lscr.io/linuxserver/handbrake:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "media",
+      "category_label": "Media & Streaming",
       "template": "apps/handbrake.json",
       "template_status": "generated-unvalidated",
       "content_hash": "dd4eda75149e2fda09a2387579f4f59b1e3ffa23be520ce4e76358009dc7b2b2",
@@ -3884,7 +3998,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-handbrake"
     },
     {
       "id": "handbrake-jlesage",
@@ -3896,7 +4011,7 @@
       "repository": "https://hub.docker.com/r/jlesage/handbrake",
       "description": "Handbrake is a Docker-based application for video transcoding and compression, offering powerful and flexible multimedia processing across multiple platforms.",
       "website": "https://handbrake.fr",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/handbrake.webp",
       "architectures": [
         "amd64"
       ],
@@ -3919,7 +4034,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-handbrake-jlesage"
     },
     {
       "id": "haos-one",
@@ -3929,7 +4045,7 @@
       "repository": "https://github.com/qweritos/haos-one",
       "description": "Community HAOS One image adapted as a native Proxmox OCI LXC with persistent Supervisor, Core, add-ons and backups under /mnt/data.",
       "website": "https://github.com/qweritos/haos-one",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/home-assistant.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -3951,7 +4067,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-haos-one"
     },
     {
       "id": "healthchecks",
@@ -3961,7 +4078,7 @@
       "repository": "https://github.com/linuxserver/docker-healthchecks",
       "description": "Healthchecks is a watchdog for your cron jobs. It's a web server that listens for pings from your cron jobs, plus a web interface.",
       "website": "https://github.com/healthchecks/healthchecks",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/healthchecks-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/healthchecks.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -3983,7 +4100,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-healthchecks"
     },
     {
       "id": "hedgedoc",
@@ -3993,7 +4111,7 @@
       "repository": "https://github.com/linuxserver/docker-hedgedoc",
       "description": "HedgeDoc gives you access to all your files wherever you are.",
       "website": "https://hedgedoc.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/hedgedoc-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/hedgedoc.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -4002,8 +4120,8 @@
       "pushed_at": "2026-09-09T22:04:01Z",
       "updated_at": "2026-07-29",
       "main_image": "lscr.io/linuxserver/hedgedoc:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "documents",
+      "category_label": "Documents & Notes",
       "template": "apps/hedgedoc.json",
       "template_status": "generated-unvalidated",
       "content_hash": "1cbc155638760ea9d871454c1d79f9f4ca7b2a646b4d8ad96b4f91cc7a422be2",
@@ -4015,7 +4133,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "linuxserver-hedgedoc"
     },
     {
       "id": "heimdall",
@@ -4025,7 +4144,7 @@
       "repository": "https://github.com/linuxserver/docker-heimdall",
       "description": "Heimdall is a way to organise all those links to your most used web sites and web applications in a simple way.",
       "website": "https://heimdall.site",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/heimdall-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/heimdall.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -4034,8 +4153,8 @@
       "pushed_at": "2026-09-11T21:14:01Z",
       "updated_at": "2026-07-14",
       "main_image": "lscr.io/linuxserver/heimdall:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "productivity",
+      "category_label": "Productivity & Workflows",
       "template": "apps/heimdall.json",
       "template_status": "generated-unvalidated",
       "content_hash": "460fcddde0f8011c7c127c9d1bad5f847cee67093cdabb3266d26d7586a331f3",
@@ -4047,7 +4166,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-heimdall"
     },
     {
       "id": "helium",
@@ -4057,7 +4177,7 @@
       "repository": "https://github.com/linuxserver/docker-helium",
       "description": "Helium is a Chromium-based web browser made for people, with love. Privacy-first with unbiased ad-blocking.",
       "website": "https://helium.computer/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/helium-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/helium-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -4066,8 +4186,8 @@
       "pushed_at": "2026-09-12T14:29:44Z",
       "updated_at": "2026-04-15",
       "main_image": "lscr.io/linuxserver/helium:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "desktop",
+      "category_label": "Browsers & Web Desktops",
       "template": "apps/helium.json",
       "template_status": "generated-unvalidated",
       "content_hash": "2c213623ffd8246b3c0805747ac126d76b9aae81a96c06dfc5affeb967432dc2",
@@ -4079,7 +4199,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-helium"
     },
     {
       "id": "hermes",
@@ -4091,7 +4212,7 @@
       "repository": "https://hub.docker.com/r/nousresearch/hermes-agent",
       "description": "Hermes Agent is a self-improving AI agent from Nous Research, designed to be a long-running collaborator rather than a one-off chatbot.\nIts built-in learning loop combines persistent memory, cross-session recall, and reusable skills so it can keep context and improve recurring workflows over time.\nWith a unified gateway, rich toolsets, and a browser-based dashboard, Hermes fits research, automation, cross-platform communication, and ongoing operational work.\n\n**Main Features:**\n- Built-in learning loop with persistent memory, session search, and reusable skills\n- One gateway for CLI, Telegram, Discord, Slack, WhatsApp, Signal, and more\n- Tool-driven workflows with terminal access, web search, browser automation, file editing, and MCP integration\n- Automation and coordination with cron jobs, subagents, the web dashboard, and an OpenAI-compatible API\n\n**Learn More:**\n- [Hermes Agent Official Website](https://hermes-agent.nousresearch.com/)\n- [Hermes Agent GitHub](https://github.com/NousResearch/hermes-agent)\n- [Hermes Agent Documentation](https://hermes-agent.nousresearch.com/docs/)\n",
       "website": "https://hermes-agent.nousresearch.com/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/hermes.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -4115,7 +4236,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-hermes"
     },
     {
       "id": "hishtory-server",
@@ -4125,7 +4247,7 @@
       "repository": "https://github.com/linuxserver/docker-hishtory-server",
       "description": "hiSHtory is a better shell history. It stores your shell history in context (what directory you ran the command in, whether it succeeded or failed, how long it took, etc). This is all stored locally and end-to-end encrypted for syncing to to all your other computers.",
       "website": "https://github.com/ddworken/hishtory",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/hishtory-server-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/hishtory-server-icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -4134,8 +4256,8 @@
       "pushed_at": "2026-09-11T07:39:19Z",
       "updated_at": "2026-07-05",
       "main_image": "lscr.io/linuxserver/hishtory-server:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "ai",
+      "category_label": "AI / Coding & Dev-Tools",
       "template": "apps/hishtory-server.json",
       "template_status": "generated-unvalidated",
       "content_hash": "45aa45c3ed882f849ad8a36db5426eeac9dc5193c956d07cd987b8cc30f89dd6",
@@ -4147,7 +4269,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-hishtory-server"
     },
     {
       "id": "holoplay",
@@ -4159,7 +4282,7 @@
       "repository": "https://hub.docker.com/r/spout8301/holoplay",
       "description": "HoloPlay is a web based self-hosted using Invidious API for listening Youtube audio source.",
       "website": "",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/HoloPlay/icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -4183,7 +4306,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-holoplay"
     },
     {
       "id": "homeassistant",
@@ -4193,7 +4317,7 @@
       "repository": "https://github.com/linuxserver/docker-homeassistant",
       "description": "Home Assistant Core - Open source home automation that puts local control and privacy first. Powered by a worldwide community of tinkerers and DIY enthusiasts. Perfect to run on a Raspberry Pi or a local server",
       "website": "https://www.home-assistant.io/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/homeassistant-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/home-assistant.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -4215,7 +4339,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-homeassistant"
     },
     {
       "id": "homeassistant-official",
@@ -4227,7 +4352,7 @@
       "repository": "https://hub.docker.com/r/homeassistant/home-assistant",
       "description": "Home Assistant is a smart home management app prioritizing local control and data privacy, managing devices through an intuitive interface with data stored locally, eliminating cloud dependency. Its robust features and community support make it ideal for DIY enthusiasts and home users creating personalized home experiences.\n\nThe app's core features include customizable dashboards, powerful automations, and a voice assistant. Dashboards support drag-and-drop customization, with various card types to display data and control devices like lights or sensors. It offers an advanced automation engine, such as turning on lights at sunset or alerting users to an open garage door. The Assist voice assistant enables natural language control, compatible with phones, tablets, smartwatches, and even traditional telephones, allowing users to customize interactions and experiment with AI conversations to meet diverse needs.\n\nIt extends functionality through add-ons, supporting tools like AdGuard for ad blocking, NodeRed for third-party automations, or turning devices into Spotify Connect targets. Home energy management optimizes solar production and usage planning to save costs. Home Assistant Cast transforms TVs into dashboard displays, and NFC tags trigger music playback or routine automations. Community documentation aids configuration, with local data processing ensuring privacy, suitable for home or small team smart home management.\n\n**Key Features:**\n- Local data storage, prioritizing privacy\n- Drag-and-drop customizable dashboards for device control and data display\n- Advanced automations for triggering smart home events\n- Assist voice assistant for natural language control\n- Add-ons for integrating AdGuard, NodeRed, and more\n- Home energy management for optimized usage and cost savings\n- Home Assistant Cast for TV dashboard displays\n- NFC tags for triggering music or automation tasks\n\n**Learn More:**\n- [Home Assistant Official Website](https://www.home-assistant.io)\n- [Home Assistant GitHub Repository](https://github.com/home-assistant/core)\n- [Home Assistant Documentation](https://www.home-assistant.io/docs)\n- [Home Assistant Community](https://community.home-assistant.io)\n- [Home Assistant Add-ons](https://www.home-assistant.io/addons)\n",
       "website": "https://www.home-assistant.io",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/home-assistant.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -4251,7 +4376,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-homeassistant-official"
     },
     {
       "id": "homebridge",
@@ -4263,7 +4389,7 @@
       "repository": "https://hub.docker.com/r/homebridge/homebridge",
       "description": "Homebridge is a lightweight NodeJS server you can run on your home network that emulates the iOS HomeKit API. It supports Plugins, which are community-contributed modules that provide a basic bridge from HomeKit to various 3rd-party APIs provided by manufacturers of \"smart home\" devices.",
       "website": "https://homebridge.io/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/homebridge.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -4287,7 +4413,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-homebridge"
     },
     {
       "id": "htpcmanager",
@@ -4297,7 +4424,7 @@
       "repository": "https://github.com/linuxserver/docker-htpcmanager",
       "description": "Htpcmanager is a front end for many htpc related applications.",
       "website": "https://github.com/HTPC-Manager/HTPC-Manager",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/htpcmanager-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/htpcmanager-icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -4306,8 +4433,8 @@
       "pushed_at": "2026-09-09T01:45:20Z",
       "updated_at": "2024-06-27",
       "main_image": "lscr.io/linuxserver/htpcmanager:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "media",
+      "category_label": "Media & Streaming",
       "template": "apps/htpcmanager.json",
       "template_status": "generated-unvalidated",
       "content_hash": "be7d35d539b80274bdee5287b40e098c88e0488ac5c59705ffe58c60ae088be9",
@@ -4319,7 +4446,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-htpcmanager"
     },
     {
       "id": "hugo",
@@ -4331,7 +4459,7 @@
       "repository": "https://ghcr.io/gohugoio/hugo",
       "description": "Hugo is a high-speed static site generation platform written in Go, optimized for speed and designed for flexibility. Advanced templating system and fast asset pipelines render a complete website in seconds, ideal for creating documentation sites, landing pages, and various project websites.\n\nCore features include optimized speed and a flexible framework. Concurrency in Go enables rapid rendering, supporting image processing (convert, resize, crop, rotate, adjust colors, apply filters, overlay text/images, extract EXIF data), JavaScript bundling (tree shaking, code splitting), Sass processing, and TailwindCSS support. Multilingual support and taxonomy system make it suitable for diverse sites like documentation, news, or events.\n\nIt includes an embedded web server for real-time previews of content, structure, and style changes during development. Frequent releases ensure ongoing feature enhancements, keeping it cutting-edge. With efficiency and flexibility at the core, the platform delivers a modern static site generation solution.\n\n**Key Features:**\n- High-speed rendering, generating sites in seconds\n- Fast asset pipelines: image processing, JavaScript bundling, Sass, and TailwindCSS support\n- Flexible framework with multilingual and taxonomy systems\n- Embedded web server for real-time development previews\n- Rich ecosystem of themes and plugins\n\n\n**Prerequisites for Using Hugo:**\n\n1. Open command line, navigate to `/DATA/AppData/hugo/project` directory\n\n```cd /DATA/AppData/hugo/project```\n\n2. Initialize the `project` directory as an empty Git repository\n\n```git init```\n\n3. Download the Ananke theme\n\n```git submodule add https://github.com/theNewDynamic/gohugo-theme-ananke.git themes/ananke```\n\n4. Specify the current theme\n\n```echo \"theme = 'ananke'\" >> hugo.toml```\n\n5. Restart Hugo\n\n\n**Learn More:**\n- [Hugo Official Website](https://gohugo.io/)\n- [Hugo GitHub](https://github.com/gohugoio/hugo)\n",
       "website": "https://gohugo.io/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/hugo.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -4342,8 +4470,8 @@
       "pushed_at": "2026-09-11T10:43:22Z",
       "updated_at": "2026-04-29",
       "main_image": "ghcr.io/gohugoio/hugo:latest",
-      "category": "ai",
-      "category_label": "AI / Coding & Dev-Tools",
+      "category": "web",
+      "category_label": "Webservers & Proxies",
       "template": "apps/hugo.json",
       "template_status": "generated-unvalidated",
       "content_hash": "cc1e4196d8e67b7ad39f45c5e1df6632eed1346803536d65e15444337ab8651f",
@@ -4355,7 +4483,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-hugo"
     },
     {
       "id": "immich",
@@ -4365,7 +4494,7 @@
       "repository": "https://github.com/immich-app/immich",
       "description": "Immich as a coordinated four-LXC native OCI stack with private PostgreSQL and Valkey services, persistent media and model cache, and selectable hardware acceleration.",
       "website": "https://immich.app/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/immich.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -4389,7 +4518,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-immich"
     },
     {
       "id": "index-tts",
@@ -4401,7 +4531,7 @@
       "repository": "https://hub.docker.com/r/icewhaletech/index-tts",
       "description": "IndexTTS2 is an advanced zero-shot text-to-speech model that innovatively achieves complete decoupling of emotional expression and speaker identity. The model supports precise speech duration control and multimodal emotion control, capable of maintaining the target timbre while accurately reproducing the specified emotional intonation.\n\nThe model employs a three-stage training paradigm and introduces GPT latent representations, ensuring excellent speech clarity and stability even under high emotional expression. Through the Qwen-based soft instruction mechanism, users can easily control the emotional characteristics of generated speech using natural language descriptions.\n\nIn multi-dataset evaluations, IndexTTS2 surpasses existing zero-shot TTS models in key metrics such as word error rate, speaker similarity, and emotion fidelity, providing industry-leading speech synthesis quality.\n\n**Key Features:**\n- Zero-shot TTS capability to replicate any timbre without training\n- Independent control of emotion and timbre with multimodal emotion input\n- Precise duration control with explicit token count specification for perfect audio-video synchronization\n- Natural language-based emotion control to guide speech generation through text descriptions\n\n**Additional Notes:**\n- Please ensure available memory > 12 GB, otherwise the application may not run properly\n- This application runs on CPU by default. This mode has low computational efficiency and will cause extremely high resource consumption and potential system instability. For optimal performance and stability, it is strongly recommended to use NVIDIA GPU to run this application\n- If you need to use NVIDIA GPU, please select \"Custom Install\" and enable the GPU option (supported in self-hosted server 1.5.0 and above)\n- For NVIDIA GPU usage, \u2265 8 GB VRAM is required (recommended for optimal performance)\n- For NVIDIA GPU usage, NVIDIA CUDA Toolkit version \u2265 12.8 is required\n\n**Learn More:**\n- [IndexTTS GitHub](https://github.com/index-tts/index-tts)\n",
       "website": "",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/Index-TTS/icon.png",
       "architectures": [
         "amd64"
       ],
@@ -4424,7 +4554,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-index-tts"
     },
     {
       "id": "inkscape",
@@ -4434,7 +4565,7 @@
       "repository": "https://github.com/linuxserver/docker-inkscape",
       "description": "Inkscape is professional quality vector graphics software which runs on Linux, Mac OS X and Windows desktop computers.",
       "website": "https://inkscape.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/inkscape-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/inkscape.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -4443,8 +4574,8 @@
       "pushed_at": "2026-09-10T01:54:59Z",
       "updated_at": "2026-06-10",
       "main_image": "lscr.io/linuxserver/inkscape:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "creative",
+      "category_label": "Creative & Design",
       "template": "apps/inkscape.json",
       "template_status": "generated-unvalidated",
       "content_hash": "e16bb57dd452200d6d57bfe39a6bb850b1d58095afca5ac035892aa76e45361d",
@@ -4456,7 +4587,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-inkscape"
     },
     {
       "id": "intellij-idea",
@@ -4466,7 +4598,7 @@
       "repository": "https://github.com/linuxserver/docker-intellij-idea",
       "description": "IntelliJ IDEA helps you write code faster with tools that eliminate tedious tasks and let you focus on what matters \u2013 building great software.",
       "website": "https://www.jetbrains.com/idea/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/intellij-idea-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/intellij-idea-logo.png",
       "architectures": [
         "amd64"
       ],
@@ -4474,8 +4606,8 @@
       "pushed_at": "2026-09-06T21:23:59Z",
       "updated_at": "2026-05-18",
       "main_image": "lscr.io/linuxserver/intellij-idea:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "ai",
+      "category_label": "AI / Coding & Dev-Tools",
       "template": "apps/intellij-idea.json",
       "template_status": "generated-unvalidated",
       "content_hash": "8b0718256a4a838336d405b486487387a929f7e95856462ba5ee1ef18ba4effc",
@@ -4487,7 +4619,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-intellij-idea"
     },
     {
       "id": "jackett",
@@ -4497,7 +4630,7 @@
       "repository": "https://github.com/linuxserver/docker-jackett",
       "description": "Jackett works as a proxy server: it translates queries from apps (Sonarr, SickRage, CouchPotato, Mylar, etc) into tracker-site-specific http queries, parses the html response, then sends results back to the requesting software. This allows for getting recent uploads (like RSS) and performing searches. Jackett is a single repository of maintained indexer scraping & translation logic - removing the burden from other apps.",
       "website": "https://github.com/Jackett/Jackett",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/jackett-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/jackett.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -4519,7 +4652,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-jackett"
     },
     {
       "id": "jdownloader",
@@ -4529,7 +4663,7 @@
       "repository": "https://github.com/jlesage/docker-jdownloader-2",
       "description": "The maintained jlesage JDownloader 2 image adapted as a native Proxmox OCI LXC with persistent configuration and shared downloads.",
       "website": "https://jdownloader.org/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/jdownloader.webp",
       "architectures": [
         "amd64"
       ],
@@ -4552,7 +4686,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-jdownloader"
     },
     {
       "id": "jellyfin",
@@ -4562,7 +4697,7 @@
       "repository": "https://github.com/linuxserver/docker-jellyfin",
       "description": "Jellyfin is a Free Software Media System that puts you in control of managing and streaming your media. It is an alternative to the proprietary Emby and Plex, to provide media from a dedicated server to end-user devices via multiple apps. Jellyfin is descended from Emby's 3.5.2 release and ported to the .NET Core framework to enable full cross-platform support. There are no strings attached, no premium licenses or features, and no hidden agendas: just a team who want to build something better and work together to achieve it.",
       "website": "https://github.com/jellyfin/jellyfin",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/jellyfin-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/jellyfin.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -4584,7 +4719,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-jellyfin"
     },
     {
       "id": "jellyfin-official",
@@ -4594,7 +4730,7 @@
       "repository": "https://github.com/jellyfin/jellyfin-packaging",
       "description": "Jellyfin is a Free Software Media System that puts you in control of managing and streaming your media. It is an alternative to the proprietary Emby and Plex, to provide media from a dedicated server to end-user devices via multiple apps. Jellyfin is descended from Emby's 3.5.2 release and ported to the .NET Core framework to enable full cross-platform support. There are no strings attached, no premium licenses or features, and no hidden agendas: just a team who want to build something better and work together to achieve it.",
       "website": "https://jellyfin.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/jellyfin-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/jellyfin.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -4616,7 +4752,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-jellyfin-official"
     },
     {
       "id": "jellyseerr",
@@ -4628,7 +4765,7 @@
       "repository": "https://hub.docker.com/r/fallenbagel/jellyseerr",
       "description": "Jellyseerr is a self-hosted media request and management tool designed to streamline media library request and discovery processes, offering an intuitive Web interface, ideal for home media server users and small teams. It seamlessly integrates with existing media services, enabling efficient management of movies, shows, and mixed content libraries.\n\nThe tool's core features include a customizable request system and broad media server integration. It allows users to request movies or individual show seasons through a user-friendly interface, with administrators able to approve requests via a simple management UI. It integrates with Jellyfin, Emby, and Plex, supporting user import and authentication with existing accounts. Diverse notification channels (e.g., Discord, Telegram, Email) provide real-time request status updates, and library scanning tracks available media to prevent duplicate requests.\n\nIt offers a granular permission system, enabling precise control over user access and actions. The mobile-friendly design facilitates on-the-go request approvals, while watchlist and blacklist support help users filter content. Support for PostgreSQL and SQLite databases ensures flexible deployment options. Community support via GitHub and Discord provides documentation and assistance, delivering a modern media management solution with intuitive operation and high flexibility.\n\n**Key Features:**\n- Full Jellyfin/Emby/Plex integration including authentication with user import & management.\n- Support for PostgreSQL and SQLite databases.\n- Supports Movies, Shows and Mixed Libraries.\n- Ability to change email addresses for SMTP purposes.\n- Easy integration with your existing services. Currently, Jellyseerr supports Sonarr and Radarr.\n- Jellyfin/Emby/Plex library scan, to keep track of the titles which are already available.\n- Customizable request system, which allows users to request individual seasons or movies in a friendly, easy-to-use interface.\n- Incredibly simple request management UI. Don't dig through the app to simply approve recent requests!\n- Granular permission system.\n- Support for various notification agents.\n- Mobile-friendly design, for when you need to approve requests on the go!\n- Support for watchlisting & blacklisting media.\n\n**Learn More:**\n- [Jellyseerr Documentation](https://docs.jellyseerr.dev/)\n- [Jellyseerr GitHub Repository](https://github.com/Fallenbagel/jellyseerr)\n",
       "website": "https://seerr.dev/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/jellyseerr.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -4652,7 +4789,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-jellyseerr"
     },
     {
       "id": "jenkins",
@@ -4664,7 +4802,7 @@
       "repository": "https://hub.docker.com/r/jenkins/jenkins",
       "description": "A server for creating pipelines for Jenkins continuous integration and delivery.",
       "website": "https://www.jenkins.io/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/jenkins.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -4688,7 +4826,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-jenkins"
     },
     {
       "id": "joplin",
@@ -4698,7 +4837,7 @@
       "repository": "https://github.com/linuxserver/docker-joplin",
       "description": "Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks.",
       "website": "https://joplinapp.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/joplin-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/joplin.webp",
       "architectures": [
         "amd64"
       ],
@@ -4706,8 +4845,8 @@
       "pushed_at": "2026-09-11T19:58:57Z",
       "updated_at": "2026-04-03",
       "main_image": "lscr.io/linuxserver/joplin:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "documents",
+      "category_label": "Documents & Notes",
       "template": "apps/joplin.json",
       "template_status": "generated-unvalidated",
       "content_hash": "edc8231ac1a6b45570600949ae3db3b41b8c2dea35b8be1b70fb1d6bb09930bc",
@@ -4719,7 +4858,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-joplin"
     },
     {
       "id": "kali-linux",
@@ -4729,7 +4869,7 @@
       "repository": "https://github.com/linuxserver/docker-kali-linux",
       "description": "Kali-linux - is an Advanced Penetration Testing Linux distribution used for Penetration Testing, Ethical Hacking and network security assessments. KALI LINUX \u2122 is a trademark of OffSec.",
       "website": "https://github.com/linuxserver/docker-kali-linux",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/kali-linux-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/kali-linux.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -4738,8 +4878,8 @@
       "pushed_at": "2026-09-13T00:53:19Z",
       "updated_at": "2026-03-29",
       "main_image": "lscr.io/linuxserver/kali-linux:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "security",
+      "category_label": "Authentication & Security",
       "template": "apps/kali-linux.json",
       "template_status": "generated-unvalidated",
       "content_hash": "16ad4a1d5e51021cc3e81ec206712ae888a5bdcf4cd409665c971d03962d65ae",
@@ -4751,7 +4891,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-kali-linux"
     },
     {
       "id": "karakeep",
@@ -4763,7 +4904,7 @@
       "repository": "https://ghcr.io/karakeep-app/karakeep",
       "description": "Karakeep is an open-source, self-hosted bookmark manager for links, notes, images, PDFs, and highlights, built to keep everything you want to save in one place.\nIt automatically fetches titles, descriptions, and previews, then helps you organize your library with AI tagging, full-text search, lists, and rule-based automation.\nWith browser extensions, mobile apps, RSS ingestion, and page archiving, Karakeep works well as both a read-later tool and a durable personal content archive.\n\n**Main Features:**\n- Save links, notes, images, PDFs, and text highlights in one library\n- Auto-fetch titles, descriptions, images, and archived pages for later reading\n- Use AI tagging, summarization, OCR, and full-text search to rediscover content quickly\n- Organize content with tags, collaborative lists, RSS feeds, and rule-based workflows\n- Access your collection through the web app, mobile apps, browser extensions, REST API, and CLI\n\n**Learn More:**\n- [Karakeep Official Website](https://karakeep.app/)\n- [Karakeep GitHub](https://github.com/karakeep-app/karakeep)\n- [Karakeep Documentation](https://docs.karakeep.app/)\n",
       "website": "https://karakeep.app/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/karakeep.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -4790,7 +4931,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "image-karakeep"
     },
     {
       "id": "kasm",
@@ -4800,7 +4942,7 @@
       "repository": "https://github.com/linuxserver/docker-kasm",
       "description": "Kasm Workspaces is a docker container streaming platform for delivering browser-based access to desktops, applications, and web services. Kasm uses devops-enabled Containerized Desktop Infrastructure (CDI) to create on-demand, disposable, docker containers that are accessible via web browser. Example use-cases include Remote Browser Isolation (RBI), Data Loss Prevention (DLP), Desktop as a Service (DaaS), Secure Remote Access Services (RAS), and Open Source Intelligence (OSINT) collections.",
       "website": "https://www.kasmweb.com/?utm_campaign=LinuxServer&utm_source=listing",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/kasm-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/kasm.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -4822,7 +4964,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": true,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-kasm"
     },
     {
       "id": "kavita",
@@ -4832,7 +4975,7 @@
       "repository": "https://github.com/linuxserver/docker-kavita",
       "description": "Kavita is a fast, feature rich, cross platform reading server. Built with a focus for being a full solution for all your reading needs. Setup your own server and share your reading collection with your friends and family!",
       "website": "https://github.com/Kareadita/Kavita",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/kavita-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/kavita.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -4854,7 +4997,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-kavita"
     },
     {
       "id": "kavita-jvmilazz0",
@@ -4866,7 +5010,7 @@
       "repository": "https://hub.docker.com/r/jvmilazz0/kavita",
       "description": "Kavita is a self-hosted digital library app designed for managing and reading comics, light novels, and e-books (supporting CBZ, CBR, EPUB, PDF, and more), offering a secure and convenient solution for personal reading collections. Its responsive Web interface allows users to access content effortlessly via any browser, with fullscreen reading and full localization support, ideal for comic and e-book enthusiasts building personalized digital libraries.\n\nThe app's core features include robust library management and an enhanced reading experience. Users can organize content with collections, reading lists, and custom tags, editing metadata to keep libraries neatly arranged. The built-in manga reader supports dual-page mode, Webtoon scrolling, and image splitting, while the e-book reader offers customizable fonts, spacing, and themes, with by-line progress syncing across devices. The PDF reader provides light/dark modes and diverse settings. It supports multi-user management, allowing custom permissions for sharing libraries or restricting content access, perfect for family or team use. Bulk imports and full-text search streamline large collection management.\n\nIt can be flexibly deployed on personal servers or NAS devices, with an active community providing extensive documentation to enhance functionality. Folder monitoring automatically detects file changes without manual scans, and sending content to Kindle or other devices improves cross-device access. Whether creating a personal reading hub or sharing media with others, the app's intuitive interface and high customizability deliver a modern management platform, meeting needs from casual reading to professional collections.\n\n**Key Features:**\n- Serve up Manga/Webtoons/Comics (cbr, cbz, zip/rar/rar5, 7zip, raw images) and Books (epub, pdf)\n- First class responsive readers that work great on any device (phone, tablet, desktop)\n- Customizable theming support: [Theme Repo](https://github.com/Kareadita/Themes) and [Documentation](https://wiki.kavitareader.com/guides/themes/)\n- External metadata integration and scrobbling for read status, ratings, and reviews (available via Kavita+)\n- Rich Metadata support with filtering and searching\n- Ways to group reading material: Collections, Reading Lists (CBL Import), Want to Read\n- Ability to manage users with rich Role-based management for age restrictions, abilities within the app, etc\n- Rich web readers supporting webtoon, continuous reading mode (continue without leaving the reader), virtual pages (epub), etc\n- Ability to customize your dashboard and side nav with smart filters, custom order and visibility toggles\n- Ability to download metadata (available via Kavita+)\n\n**Learn More:**\n- [Kavita Official Website](https://www.kavitareader.com)\n- [Kavita GitHub Repository](https://github.com/Kareadita/Kavita)\n",
       "website": "https://www.kavitareader.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/kavita.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -4890,7 +5034,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-kavita-jvmilazz0"
     },
     {
       "id": "kdenlive",
@@ -4900,7 +5045,7 @@
       "repository": "https://github.com/linuxserver/docker-kdenlive",
       "description": "Kdenlive is a powerful free and open source cross-platform video editing program made by the KDE community. Feature rich and production ready.",
       "website": "https://kdenlive.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/kdenlive-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/kdenlive-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -4909,8 +5054,8 @@
       "pushed_at": "2026-09-10T14:57:40Z",
       "updated_at": "2026-03-29",
       "main_image": "lscr.io/linuxserver/kdenlive:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "creative",
+      "category_label": "Creative & Design",
       "template": "apps/kdenlive.json",
       "template_status": "generated-unvalidated",
       "content_hash": "da38a79d680b6dfb2a2f096575e0ad31fdf403764b6fdc91f803ed6afde2274f",
@@ -4922,7 +5067,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-kdenlive"
     },
     {
       "id": "keepassxc",
@@ -4932,7 +5078,7 @@
       "repository": "https://github.com/linuxserver/docker-keepassxc",
       "description": "KeePassXC is a free and open-source password manager. It started as a community fork of KeePassX (itself a cross-platform port of KeePass).",
       "website": "https://keepassxc.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/keepassxc-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/keepassxc.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -4941,8 +5087,8 @@
       "pushed_at": "2026-09-10T12:09:50Z",
       "updated_at": "2026-06-10",
       "main_image": "lscr.io/linuxserver/keepassxc:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "security",
+      "category_label": "Authentication & Security",
       "template": "apps/keepassxc.json",
       "template_status": "generated-unvalidated",
       "content_hash": "8a45a46593c2532263617b77b94cc23772aebff155c07abeafbfe368540408be",
@@ -4954,7 +5100,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-keepassxc"
     },
     {
       "id": "kicad",
@@ -4964,7 +5111,7 @@
       "repository": "https://github.com/linuxserver/docker-kicad",
       "description": "KiCad - A Cross Platform and Open Source Electronics Design Automation Suite.",
       "website": "https://www.kicad.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/kicad-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/kicad-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -4973,8 +5120,8 @@
       "pushed_at": "2026-09-08T15:38:41Z",
       "updated_at": "2026-06-10",
       "main_image": "lscr.io/linuxserver/kicad:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "creative",
+      "category_label": "Creative & Design",
       "template": "apps/kicad.json",
       "template_status": "generated-unvalidated",
       "content_hash": "7fb41022747d47c6b2e3f02448f4a986c46e2eff9ca9e74bf790743698c77a50",
@@ -4986,7 +5133,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-kicad"
     },
     {
       "id": "kimai",
@@ -4996,7 +5144,7 @@
       "repository": "https://github.com/linuxserver/docker-kimai",
       "description": "Kimai is a professional grade time-tracking application, free and open-source.",
       "website": "https://kimai.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/kimai-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/kimai.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -5018,7 +5166,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-kimai"
     },
     {
       "id": "kometa",
@@ -5028,7 +5177,7 @@
       "repository": "https://github.com/linuxserver/docker-kometa",
       "description": "Kometa is a powerful tool designed to give you complete control over your media libraries. With Kometa, you can take your customization to the next level, with granular control over metadata, collections, overlays, and much more.",
       "website": "https://github.com/Kometa-Team/Kometa",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/kometa-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/kometa.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -5050,7 +5199,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-kometa"
     },
     {
       "id": "komga",
@@ -5062,7 +5212,7 @@
       "repository": "https://hub.docker.com/r/gotson/komga",
       "description": "Komga is a self-hosted app designed for managing comics, manga, magazines, and e-books (supporting CBZ, CBR, PDF, and EPUB formats), offering a secure and convenient solution for personal media libraries. Its responsive Web interface enables users to access and manage content effortlessly via any browser, without complex local installations, ideal for comic and e-book enthusiasts.\n\nThe app's core features include versatile content organization and diverse reading options. Users can arrange their library with collections and reading lists, edit metadata for series or books, and keep content neatly organized. It integrates a built-in Web reader, supports Mihon SDK extensions, or connects with third-party OPDS readers, catering to varied reading preferences. Whether managing a personal comic collection or sharing e-books with family, it supports multi-user access and delivers a smooth browsing experience. Bulk import streamlines large media library management, perfect for efficient content organization.\n\nIt can be flexibly deployed on personal servers or NAS devices, with an active community providing support documentation, enabling users to extend functionality through community resources. Whether building a personal digital library or a private media-sharing hub, the app's intuitive interface and high customizability offer a secure, modern media management platform, meeting needs from casual reading to professional collections.\n\n**Key Features:**\n- Organize your library with collections and read lists\n- Edit metadata for your series and books\n- Import embedded metadata automatically\n- Webreader with multiple reading modes\n- Manage multiple users, with per-library access control, age restrictions, and labels restrictions\n- Offers a REST API, many community tools and scripts can interact with Komga\n- OPDS v1 and v2 support\n- Kobo Sync with your Kobo eReader\n- KOReader Sync\n- Download book files, whole series, or read lists\n- Duplicate files detection\n- Duplicate pages detection and removal\n- Import books from outside your libraries directly into your series folder\n- Import ComicRack cbl read lists\n\n**Learn More:**\n- [Komga Official Website](https://komga.org)\n- [Komga GitHub Repository](https://github.com/gotson/komga)\n",
       "website": "https://komga.org",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/komga.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -5086,7 +5236,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-komga"
     },
     {
       "id": "krita",
@@ -5096,7 +5247,7 @@
       "repository": "https://github.com/linuxserver/docker-krita",
       "description": "Krita is a professional FREE and open source painting program. It is made by artists that want to see affordable art tools for everyone.",
       "website": "https://krita.org/en/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/krita-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/krita-logo.png",
       "architectures": [
         "amd64"
       ],
@@ -5104,8 +5255,8 @@
       "pushed_at": "2026-09-11T12:45:23Z",
       "updated_at": "2026-03-29",
       "main_image": "lscr.io/linuxserver/krita:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "creative",
+      "category_label": "Creative & Design",
       "template": "apps/krita.json",
       "template_status": "generated-unvalidated",
       "content_hash": "e746fb2c27b281cc05061a32bbc18e741c7a33b15a65bb7efe4f7bbec76c7f60",
@@ -5117,7 +5268,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-krita"
     },
     {
       "id": "label-studio",
@@ -5129,7 +5281,7 @@
       "repository": "https://hub.docker.com/r/heartexlabs/label-studio",
       "description": "Label Studio is an open source data labeling tool. It lets you label data types like audio, text, images, videos, and time series with a simple and straightforward UI and export to various model formats. It can be used to prepare raw data or improve existing training data to get more accurate ML models.",
       "website": "https://labelstud.io/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/LabelStudio/icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -5153,7 +5305,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-label-studio"
     },
     {
       "id": "langflow",
@@ -5165,7 +5318,7 @@
       "repository": "https://hub.docker.com/r/langflowai/langflow",
       "description": "Langflow is a powerful, open-source UI designed specifically for building and debugging multi-agent and Retrieval-Augmented Generation (RAG) applications. It provides a visual, drag-and-drop interface that simplifies the process of creating complex AI workflows.\n\nThe system consists of two main components:\n- **Langflow**: The main application providing a visual interface for building AI workflows\n- **PostgreSQL**: A robust database system for storing application data and configurations\n\n**Key Features:**\n- Visual, drag-and-drop interface for building AI workflows\n- Support for multi-agent systems and RAG applications\n- Integrated debugging tools for testing and optimization\n- Persistent storage for workflows and configurations\n- Easy deployment with Docker containers\n\n**Learn More:**\n- [Langflow Official Website](https://www.langflow.org)\n- [Langflow GitHub Repository](https://github.com/langflow-ai/langflow)\n- [Documentation](https://docs.langflow.org)\n",
       "website": "https://www.langflow.org",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/langflow.webp",
       "architectures": [
         "amd64"
       ],
@@ -5188,7 +5341,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-langflow"
     },
     {
       "id": "lazylibrarian",
@@ -5198,7 +5352,7 @@
       "repository": "https://github.com/linuxserver/docker-lazylibrarian",
       "description": "Lazylibrarian is a program to follow authors and grab metadata for all your digital reading needs. It uses a combination of Goodreads Librarything and optionally GoogleBooks as sources for author info and book info.  This container is based on the DobyTang fork.",
       "website": "https://lazylibrarian.gitlab.io/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/lazylibrarian-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/lazylibrarian.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -5220,7 +5374,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-lazylibrarian"
     },
     {
       "id": "ldap-auth",
@@ -5230,7 +5385,7 @@
       "repository": "https://github.com/linuxserver/docker-ldap-auth",
       "description": "Ldap-auth software is for authenticating users who request protected resources from servers proxied by nginx. It includes a daemon (ldap-auth) that communicates with an authentication server, and a webserver daemon that generates an authentication cookie based on the user\u2019s credentials. The daemons are written in Python for use with a Lightweight Directory Access Protocol (LDAP) authentication server (OpenLDAP or Microsoft Windows Active Directory 2003 and 2012).",
       "website": "https://github.com/nginxinc/nginx-ldap-auth",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ldap-auth-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/ldap-auth-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -5239,8 +5394,8 @@
       "pushed_at": "2026-09-13T17:09:48Z",
       "updated_at": "2026-07-17",
       "main_image": "lscr.io/linuxserver/ldap-auth:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "security",
+      "category_label": "Authentication & Security",
       "template": "apps/ldap-auth.json",
       "template_status": "generated-unvalidated",
       "content_hash": "ec1d5723bce0784ead049f63fe0e3d1ca13c6d30156df54fea10e20f39369afa",
@@ -5252,7 +5407,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-ldap-auth"
     },
     {
       "id": "librechat",
@@ -5264,7 +5420,7 @@
       "repository": "https://ghcr.io/danny-avila/librechat-dev",
       "description": "LibreChat is a full-featured, open-source AI chat interface that allows users to interact with multiple AI models through a unified platform. It supports various AI providers and offers advanced features like conversation management, plugin support, and customizable interfaces.\n**Key Features:**\n- Support for multiple AI models and providers\n- Conversation history and management\n- Plugin system for extended functionality\n- Customizable themes and interfaces\n- User authentication and management\n- API integrations for various services\n- Search functionality with MeiliSearch\n- RAG (Retrieval-Augmented Generation) support\n- File upload and processing capabilities\n- Multi-language support\n\n**Learn More:**\n- [LibreChat Official Website](https://www.librechat.ai)\n- [LibreChat GitHub Repository](https://github.com/danny-avila/LibreChat)\n\n**extra:**\nYou can refer to the [Custom AI Endpoints](https://www.librechat.ai/docs/configuration/librechat_yaml/ai_endpoints) documentation to configure the relevant files for calling the APIs of Anyscale, ApiPie, Cohere, Deepseek, Databricks, Fireworks, Groq, HuggingFace, Mistral, OpenRouter, Perplexity, ShuttleAI, TogetherAI, Unify, and xAI.\n",
       "website": "https://www.librechat.ai",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/librechat.webp",
       "architectures": [
         "amd64"
       ],
@@ -5292,7 +5448,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "image-librechat"
     },
     {
       "id": "libredb-studio",
@@ -5304,7 +5461,7 @@
       "repository": "https://hub.docker.com/r/libredb/libredb-studio",
       "description": "LibreDB Studio is an open-source (MIT), self-hosted SQL IDE. It provides a modern web-based interface to connect to 16 database engines (PostgreSQL, MySQL, MongoDB, Redis, ClickHouse and more), browse schemas, write and run SQL queries, and manage your data from any browser on your LAN. Data is stored locally in a SQLite database, so everything stays under your control.",
       "website": "https://libredb.org",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/libredb-studio.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -5328,7 +5485,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-libredb-studio"
     },
     {
       "id": "libreoffice",
@@ -5338,7 +5496,7 @@
       "repository": "https://github.com/linuxserver/docker-libreoffice",
       "description": "LibreOffice is a free and powerful office suite, and a successor to OpenOffice.org (commonly known as OpenOffice). Its clean interface and feature-rich tools help you unleash your creativity and enhance your productivity.",
       "website": "https://www.libreoffice.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/libreoffice-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/libreoffice.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -5347,8 +5505,8 @@
       "pushed_at": "2026-09-08T01:30:30Z",
       "updated_at": "2026-06-10",
       "main_image": "lscr.io/linuxserver/libreoffice:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "documents",
+      "category_label": "Documents & Notes",
       "template": "apps/libreoffice.json",
       "template_status": "generated-unvalidated",
       "content_hash": "fcc02118053fb469c9aeb695b26a58447cc3d9ef7c815919a8f4714c2e519cdb",
@@ -5360,7 +5518,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-libreoffice"
     },
     {
       "id": "librespeed",
@@ -5370,7 +5529,7 @@
       "repository": "https://github.com/linuxserver/docker-librespeed",
       "description": "Librespeed is a very lightweight Speedtest implemented in Javascript, using XMLHttpRequest and Web Workers.",
       "website": "https://github.com/librespeed/speedtest",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/librespeed-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/librespeed.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -5379,8 +5538,8 @@
       "pushed_at": "2026-09-12T13:17:52Z",
       "updated_at": "2026-07-29",
       "main_image": "lscr.io/linuxserver/librespeed:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "monitoring",
+      "category_label": "Monitoring & Analytics",
       "template": "apps/librespeed.json",
       "template_status": "generated-unvalidated",
       "content_hash": "cdfd71305229d535495af5189e4c4b5e0321c008f4ef794734c19b8bd17da2a2",
@@ -5392,7 +5551,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-librespeed"
     },
     {
       "id": "librewolf",
@@ -5402,7 +5562,7 @@
       "repository": "https://github.com/linuxserver/docker-librewolf",
       "description": "LibreWolf is a custom and independent version of Firefox, with the primary goals of privacy, security and user freedom. LibreWolf also aims to remove all the telemetry, data collection and annoyances, as well as disabling anti-freedom features like DRM.",
       "website": "https://librewolf.net/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/librewolf-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/librewolf.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -5411,8 +5571,8 @@
       "pushed_at": "2026-09-07T07:42:13Z",
       "updated_at": "2026-03-31",
       "main_image": "lscr.io/linuxserver/librewolf:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "desktop",
+      "category_label": "Browsers & Web Desktops",
       "template": "apps/librewolf.json",
       "template_status": "generated-unvalidated",
       "content_hash": "912397d7d438a946bdb1ead5b6685665f1f9e3b8438d612ecf09cbfe80b00ab4",
@@ -5424,7 +5584,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-librewolf"
     },
     {
       "id": "lidarr",
@@ -5434,7 +5595,7 @@
       "repository": "https://github.com/linuxserver/docker-lidarr",
       "description": "Lidarr is a music collection manager for Usenet and BitTorrent users. It can monitor multiple RSS feeds for new tracks from your favorite artists and will grab, sort and rename them. It can also be configured to automatically upgrade the quality of files already downloaded when a better quality format becomes available.",
       "website": "https://github.com/lidarr/Lidarr",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/lidarr-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/lidarr.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -5456,7 +5617,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-lidarr"
     },
     {
       "id": "limnoria",
@@ -5466,7 +5628,7 @@
       "repository": "https://github.com/linuxserver/docker-limnoria",
       "description": "Limnoria A robust, full-featured, and user/programmer-friendly Python IRC bot, with many existing plugins. Successor of the well-known Supybot.",
       "website": "https://github.com/ProgVal/limnoria",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/limnoria-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/limnoria-icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -5475,8 +5637,8 @@
       "pushed_at": "2026-09-11T21:29:19Z",
       "updated_at": "2025-02-01",
       "main_image": "lscr.io/linuxserver/limnoria:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "communication",
+      "category_label": "Communication & Community",
       "template": "apps/limnoria.json",
       "template_status": "generated-unvalidated",
       "content_hash": "a210b002667bf30202710e7393b3f253f7f9e797d188ef1ef3a2a3b88ad5a9f1",
@@ -5488,7 +5650,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-limnoria"
     },
     {
       "id": "linkwarden",
@@ -5500,7 +5663,7 @@
       "repository": "https://ghcr.io/linkwarden/linkwarden",
       "description": "Linkwarden is an open-source self-hosted bookmark and web archive manager designed to help users collect, organize, and preserve important online content in one place. In addition to traditional bookmarking capabilities, it provides full webpage backup so valuable information remains safely accessible over time.\n\nBuilt around long-term content preservation, Linkwarden can automatically capture webpage screenshots, PDFs, and full HTML files to help prevent link rot. It also includes reading mode, annotations, local AI-powered tagging, full-text search, and a multi-level classification system for smarter and more efficient information management. Its modular architecture supports self-hosting, browser extensions, and cross-device sync.\n\nIn practice, Linkwarden is suitable not only for personal knowledge management and content collection, but also for team collaboration and shared curation. With collections and permission controls, users can organize content together and manage it publicly or privately. It is a modern bookmarking tool that balances data ownership, security, and collaboration.\n\n**Key Features:**\n\n- Full webpage archiving (screenshots, PDFs, HTML) to prevent link rot\n- AI-powered auto-tagging and full-text search\n- Reading mode, text highlighting, and annotations\n- Multi-level categories and tags for flexible organization\n- Team collaboration and permission management\n\n**Learn more:**\n\n- [Linkwarden GitHub](https://github.com/linkwarden/linkwarden)\n",
       "website": "https://linkwarden.app/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/linkwarden.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -5524,7 +5687,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-linkwarden"
     },
     {
       "id": "llama-factory-nvidia",
@@ -5536,7 +5700,7 @@
       "repository": "https://hub.docker.com/r/hiyouga/llamafactory",
       "description": "LLaMA Factory is a comprehensive framework for fine-tuning Large Language Models (LLMs) with support for over 100 models. It provides a user-friendly web interface and powerful training methods including LoRA, QLoRA, and full-parameter training.\n\n**Key Features:**\n- Support for 100+ LLMs including LLaMA, Mistral, Qwen, and more\n- Multiple fine-tuning methods (LoRA, QLoRA, Full, Freeze)\n- Intuitive Web UI for easy model management\n- Built-in API server for model inference\n- Multi-GPU training support\n- Quantization and model export capabilities\n\n**Hardware Requirements:**\n- GPU: NVIDIA GPU with CUDA support required\n\n**Learn More:**\n- [GitHub Repository](https://github.com/hiyouga/LLaMA-Factory)\n- [Documentation](https://llamafactory.readthedocs.io/)\n",
       "website": "https://llamafactory.readthedocs.io/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/LLaMA-Factory_Nvidia/icon.png",
       "architectures": [
         "amd64"
       ],
@@ -5559,7 +5723,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-llama-factory-nvidia"
     },
     {
       "id": "llamacpp",
@@ -5569,7 +5734,7 @@
       "repository": "https://ghcr.io/ggml-org/llama.cpp",
       "description": "llama.cpp is a pure C/C++ inference engine for GGUF large language models, with the official OpenAI-compatible server and a built-in Web UI.\n\n**Key Features:**\n- Run GGUF models (Llama, Qwen, DeepSeek, Gemma, Mistral and more) on CPU or GPU\n- Vulkan backend works on AMD / Intel / NVIDIA GPUs out of the box\n- Great fit for unified-memory machines (e.g. AMD Ryzen AI Max 395)\n- OpenAI-compatible API for integration with Open WebUI, ChatGPT-Next-Web and more\n- Built-in chat Web UI with runtime model loading\n\n**Getting started:**\n1. Put GGUF model files into the models volume (`/models`)\n2. Open the Web UI at `http://<self-hosted server-ip>:18080` and load a model\n3. Keep `/dev/dri` mapped for Vulkan acceleration; remove it for CPU-only mode",
       "website": "https://github.com/ggml-org/llama.cpp",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/llama-cpp.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -5593,7 +5758,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-llamacpp"
     },
     {
       "id": "lm-studio",
@@ -5603,7 +5769,7 @@
       "repository": "https://github.com/linuxserver/docker-lm-studio",
       "description": "LM Studio can run local AI models like gpt-oss, Llama, Gemma, Qwen, and DeepSeek privately on your computer.",
       "website": "https://lmstudio.ai/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/lm-studio-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/lmstudio-logo.png",
       "architectures": [
         "amd64"
       ],
@@ -5611,8 +5777,8 @@
       "pushed_at": "2026-09-13T18:47:08Z",
       "updated_at": "2026-06-22",
       "main_image": "lscr.io/linuxserver/lm-studio:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "ai",
+      "category_label": "AI / Coding & Dev-Tools",
       "template": "apps/lm-studio.json",
       "template_status": "generated-unvalidated",
       "content_hash": "44997beed91523470d9493853cb8c38c231cbceff15c45d92e9a0b83cdd5f52f",
@@ -5624,7 +5790,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-lm-studio"
     },
     {
       "id": "logseq",
@@ -5636,7 +5803,7 @@
       "repository": "https://hub.docker.com/r/correctroad/logseq",
       "description": "A privacy-first, open-source platform for knowledge management and collaboration.",
       "website": "https://logseq.com/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/logseq.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -5660,7 +5827,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-logseq"
     },
     {
       "id": "lollypop",
@@ -5670,7 +5838,7 @@
       "repository": "https://github.com/linuxserver/docker-lollypop",
       "description": "Lollypop is a lightweight modern music player designed to work excellently on the GNOME desktop environment.",
       "website": "https://wiki.gnome.org/Apps/Lollypop",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/lollypop-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/lollypop-icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -5679,8 +5847,8 @@
       "pushed_at": "2026-09-11T18:11:52Z",
       "updated_at": "2026-06-10",
       "main_image": "lscr.io/linuxserver/lollypop:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "media",
+      "category_label": "Media & Streaming",
       "template": "apps/lollypop.json",
       "template_status": "generated-unvalidated",
       "content_hash": "4ddf7603f638ae064a68c9683877247a6499a221008b431454384414b429ebfb",
@@ -5692,7 +5860,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-lollypop"
     },
     {
       "id": "luanti",
@@ -5702,7 +5871,7 @@
       "repository": "https://github.com/linuxserver/docker-luanti",
       "description": "Luanti (formerly Minetest) is an open source voxel game-creation platform with easy modding and game creation",
       "website": "https://www.luanti.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/luanti-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/minetest-icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -5711,8 +5880,8 @@
       "pushed_at": "2026-09-06T23:42:51Z",
       "updated_at": "2025-11-03",
       "main_image": "lscr.io/linuxserver/luanti:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "gaming",
+      "category_label": "Gaming & Leisure",
       "template": "apps/luanti.json",
       "template_status": "generated-unvalidated",
       "content_hash": "e2e3a7ec526e5ebc37496068997d1f3b42a4f316f09c449a22223f475a116a9b",
@@ -5724,7 +5893,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-luanti"
     },
     {
       "id": "lucky",
@@ -5736,7 +5906,7 @@
       "repository": "https://hub.docker.com/r/gdy666/lucky",
       "description": "A powerful tool for port forwarding, reverse proxy, dynamic DNS, wake-on-LAN, IPv4 NAT traversal, webdav services, task scheduling, and automatic certificate management.",
       "website": "https://lucky666.cn/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/Lucky/icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -5747,8 +5917,8 @@
       "pushed_at": "2026-09-11T10:43:22Z",
       "updated_at": "2026-02-15",
       "main_image": "gdy666/lucky:latest",
-      "category": "network",
-      "category_label": "Network & Firewall",
+      "category": "web",
+      "category_label": "Webservers & Proxies",
       "template": "apps/lucky.json",
       "template_status": "generated-unvalidated",
       "content_hash": "f2b9ed8d035576997d9e78403eebfce848f319c25c7775d47643e92bf1e08fdd",
@@ -5760,7 +5930,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-lucky"
     },
     {
       "id": "lychee",
@@ -5770,7 +5941,7 @@
       "repository": "https://github.com/linuxserver/docker-lychee",
       "description": "Lychee is a free photo-management tool, which runs on your server or web-space. Installing is a matter of seconds. Upload, manage and share photos like from a native application. Lychee comes with everything you need and all your photos are stored securely.",
       "website": "https://lycheeorg.github.io/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/lychee-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/lychee.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -5792,7 +5963,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-lychee"
     },
     {
       "id": "lyrionmusicserver",
@@ -5804,7 +5976,7 @@
       "repository": "https://hub.docker.com/r/lmscommunity/lyrionmusicserver",
       "description": "Lyrion Music Server is a self-hosted music management app designed to control a variety of audio playback devices, supporting streaming of local music collections, internet radio, and multiple streaming services (with or without subscriptions). Its intuitive Web interface enables users to access and control music effortlessly via any browser, ideal for music enthusiasts creating personalized audio experiences.\n\nThe app's core features include versatile music streaming and extensive customization. Users can seamlessly play local music libraries, listen to global internet radio, or connect to streaming services, catering to diverse listening needs. It offers flexible control options, allowing customization of server functionality, interaction methods, and interface appearance. Additionally, it supports a unified interface across multiple devices, ensuring a consistent experience on phones, computers, or other players, with the ability to select the ideal playback device for any scenario.\n\nIt can be flexibly deployed on personal servers or NAS devices, with community-provided documentation aiding users in optimising setups and extending functionality. Whether managing personal music collections or creating a shared audio hub for family, the app's intuitive operation and high flexibility deliver a modern music management platform, meeting needs from casual listening to professional audio management.\n\n**Key Features:**\n- Music streaming for local collections, internet radio, and multiple streaming services\n- Intuitive Web interface for effortless music access and control via any browser\n- Extensive customisation options for server functionality, interaction methods, and interface appearance\n- Unified multi-device interface ensuring consistent experience across phones, computers, and other players\n- Community documentation support for optimising setups and extending functionality\n\n**Learn More:**\n- [Lyrion Music Server Official Website](https://www.lyrion.org)\n- [Lyrion Music Server GitHub Repository](https://github.com/lms-community/slimserver)\n",
       "website": "https://www.lyrion.org",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/lyrion-music-server.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -5828,7 +6000,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-lyrionmusicserver"
     },
     {
       "id": "makemkv",
@@ -5838,7 +6011,7 @@
       "repository": "https://github.com/jlesage/docker-makemkv",
       "description": "The maintained jlesage MakeMKV image with persistent settings, shared input/output storage and optional native optical-drive passthrough.",
       "website": "https://github.com/jlesage/docker-makemkv",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/makemkv.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -5862,7 +6035,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-makemkv"
     },
     {
       "id": "mame",
@@ -5872,7 +6046,7 @@
       "repository": "https://github.com/linuxserver/docker-mame",
       "description": "MAME is a free and open-source emulator designed to emulate the hardware of arcade games, video game consoles, old computers and other systems in software on modern personal computers.",
       "website": "https://www.mamedev.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/mame-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/mame-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -5881,8 +6055,8 @@
       "pushed_at": "2026-09-08T18:33:08Z",
       "updated_at": "2026-05-04",
       "main_image": "lscr.io/linuxserver/mame:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "gaming",
+      "category_label": "Gaming & Leisure",
       "template": "apps/mame.json",
       "template_status": "generated-unvalidated",
       "content_hash": "8673f83e98d515c83ce7678e132c32c08bb181d7df462427015a0d3248a23525",
@@ -5894,7 +6068,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-mame"
     },
     {
       "id": "manyfold",
@@ -5904,7 +6079,7 @@
       "repository": "https://github.com/linuxserver/docker-manyfold",
       "description": "Manyfold  is an open source, self-hosted web application for managing a collection of 3D models, particularly focused on 3D printing.",
       "website": "https://github.com/manyfold3d/manyfold/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/manyfold-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/manyfold.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -5926,7 +6101,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-manyfold"
     },
     {
       "id": "mariadb",
@@ -5936,7 +6112,7 @@
       "repository": "https://github.com/linuxserver/docker-mariadb",
       "description": "Mariadb is one of the most popular database servers. Made by the original developers of MySQL.",
       "website": "https://mariadb.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/mariadb-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/mariadb.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -5958,7 +6134,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-mariadb"
     },
     {
       "id": "mastodon",
@@ -5968,7 +6145,7 @@
       "repository": "https://github.com/linuxserver/docker-mastodon",
       "description": "Mastodon is a free, open-source social network server based on ActivityPub where users can follow friends and discover new ones..",
       "website": "https://github.com/mastodon/mastodon/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/mastodon-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/mastodon.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -5990,7 +6167,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "linuxserver-mastodon"
     },
     {
       "id": "maybe",
@@ -6002,7 +6180,7 @@
       "repository": "https://ghcr.io/maybe-finance/maybe",
       "description": "Maybe is a personal finance management application designed to help you track your expenses, income, and investments in one place. With an intuitive interface and powerful features, Maybe makes it easy to understand your financial situation and make informed decisions about your money.\n\n**Key Features:**\n- **Expense Tracking**: Easily log and categorize your expenses\n- **Income Management**: Track multiple income sources\n- **Investment Monitoring**: Keep an eye on your investments and their performance\n- **Budget Planning**: Create and maintain budgets to control your spending\n- **Financial Reports**: Generate detailed reports to understand your financial habits\n- **AI-Powered Insights**: Get personalized financial advice using AI technology\n\n**Use Cases:**\n- Personal budget management\n- Expense tracking and categorization\n- Investment portfolio monitoring\n- Financial goal setting and tracking\n- Cash flow analysis\n\n**Learn More:**\n- [Maybe GitHub Repository](https://github.com/maybe-finance/maybe)\n",
       "website": "",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/maybe.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -6033,7 +6211,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "image-maybe"
     },
     {
       "id": "mediaelch",
@@ -6043,7 +6222,7 @@
       "repository": "https://github.com/linuxserver/docker-mediaelch",
       "description": "MediaElch is a MediaManager for Kodi. Information about Movies, TV Shows, Concerts and Music are stored as nfo files. Fanarts are downloaded automatically from fanart.tv. Using the nfo generator, MediaElch can be used with other MediaCenters as well.",
       "website": "https://github.com/Komet/MediaElch",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/mediaelch-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/mediaelch.webp",
       "architectures": [
         "amd64"
       ],
@@ -6051,8 +6230,8 @@
       "pushed_at": "2026-09-12T16:40:13Z",
       "updated_at": "2026-04-19",
       "main_image": "lscr.io/linuxserver/mediaelch:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "media",
+      "category_label": "Media & Streaming",
       "template": "apps/mediaelch.json",
       "template_status": "generated-unvalidated",
       "content_hash": "76fb38efb00bd0484f6a3cf2f636780605e8ca11e9dd8dbe7cb72b313b20be79",
@@ -6064,7 +6243,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-mediaelch"
     },
     {
       "id": "medusa",
@@ -6074,7 +6254,7 @@
       "repository": "https://github.com/linuxserver/docker-medusa",
       "description": "Medusa is an automatic Video Library Manager for TV Shows. It watches for new episodes of your favorite shows, and when they are posted it does its magic.",
       "website": "https://pymedusa.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/medusa-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/medusa.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -6096,7 +6276,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-medusa"
     },
     {
       "id": "medusa-official",
@@ -6108,7 +6289,7 @@
       "repository": "https://hub.docker.com/r/pymedusa/medusa",
       "description": "Automatic Video Library Manager for TV Shows. It watches for new episodes of your favorite shows, and when they are posted it does its magic.",
       "website": "",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/medusa.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -6132,7 +6313,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-medusa-official"
     },
     {
       "id": "melonds",
@@ -6142,7 +6324,7 @@
       "repository": "https://github.com/linuxserver/docker-melonds",
       "description": "melonDS aims at providing fast and accurate Nintendo DS emulation.",
       "website": "https://melonds.kuribo64.net/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/melonds-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/melonds-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -6151,8 +6333,8 @@
       "pushed_at": "2026-09-07T21:14:11Z",
       "updated_at": "2026-03-05",
       "main_image": "lscr.io/linuxserver/melonds:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "gaming",
+      "category_label": "Gaming & Leisure",
       "template": "apps/melonds.json",
       "template_status": "generated-unvalidated",
       "content_hash": "2b550d653a1de88d15c7d171e42ca2b335cfc1a6ad1cec05e183a4cfd8ddeec7",
@@ -6164,7 +6346,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-melonds"
     },
     {
       "id": "memos",
@@ -6176,7 +6359,7 @@
       "repository": "https://hub.docker.com/r/neosmemo/memos",
       "description": "Memos is a lightweight, open-source, self-hosted note-taking application that offers a secure and streamlined solution for users prioritizing privacy and data control. All notes are stored on the user\u2019s own server, eliminating risks associated with third-party cloud services. Its minimalist Web interface supports Markdown syntax and tag-based organization, enabling effortless capture of ideas, personal knowledge management, or small-scale team collaboration. The open-source design ensures transparency, long-term maintainability, and no subscription costs, making it ideal for users seeking data ownership and cost efficiency.\n\nDesigned for simplicity and efficiency, Memos caters to a variety of use cases. Whether jotting down daily thoughts, organizing study notes, or sharing task memos in small teams, Memos delivers a seamless experience through its intuitive tag system and Markdown formatting. Accessible via any web browser, it requires no proprietary clients or complex setup, allowing users to manage notes anytime, anywhere.\n\nWhether used for long-term personal knowledge archiving or as a lightweight tool for team collaboration, Memos offers a secure, flexible, and user-friendly solution, empowering users to maintain full control over their data while enjoying a streamlined note-taking experience.\n",
       "website": "https://usememos.com/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/memos.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -6200,7 +6383,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-memos"
     },
     {
       "id": "mineos-node",
@@ -6212,7 +6396,7 @@
       "repository": "https://hub.docker.com/r/hexparrot/mineos",
       "description": "MineOS is a server front-end to ease managing Minecraft administrative tasks. This iteration using Node.js aims to enhance previous MineOS scripts (Python-based), by leveraging the event-triggering, asyncronous model of Node.JS and websockets.",
       "website": "https://www.mineos.net/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/mineos.webp",
       "architectures": [
         "amd64"
       ],
@@ -6222,8 +6406,8 @@
       "pushed_at": "2026-09-11T10:43:22Z",
       "updated_at": "2022-04-25",
       "main_image": "hexparrot/mineos:latest",
-      "category": "media",
-      "category_label": "Media & Streaming",
+      "category": "gaming",
+      "category_label": "Gaming & Leisure",
       "template": "apps/mineos-node.json",
       "template_status": "laboratory-validated",
       "content_hash": "ff052e25508b01568438d176fc961b57579b98115a5abc494734c5cb94cc820b",
@@ -6235,7 +6419,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-mineos-node"
     },
     {
       "id": "minisatip",
@@ -6245,7 +6430,7 @@
       "repository": "https://github.com/linuxserver/docker-minisatip",
       "description": "Minisatip is a multi-threaded satip server version 1.2 that runs under Linux and it was tested with DVB-S, DVB-S2, DVB-T, DVB-T2, DVB-C, DVB-C2, ATSC and ISDB-T cards.",
       "website": "https://github.com/catalinii/minisatip",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/minisatip-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/minisatip-icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -6254,8 +6439,8 @@
       "pushed_at": "2026-09-08T12:51:54Z",
       "updated_at": "2026-02-20",
       "main_image": "lscr.io/linuxserver/minisatip:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "media",
+      "category_label": "Media & Streaming",
       "template": "apps/minisatip.json",
       "template_status": "generated-unvalidated",
       "content_hash": "5528556b3663f9dc0c8c9a64c2dae24188afea840f236b43823d72a7ef7d221f",
@@ -6267,7 +6452,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-minisatip"
     },
     {
       "id": "mkvtoolnix",
@@ -6277,7 +6463,7 @@
       "repository": "https://github.com/jlesage/docker-mkvtoolnix",
       "description": "The maintained jlesage MKVToolNix image with browser GUI, persistent settings and user-selectable shared storage.",
       "website": "https://github.com/jlesage/docker-mkvtoolnix",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/mkvtoolnix.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -6301,7 +6487,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-mkvtoolnix"
     },
     {
       "id": "mongodb",
@@ -6313,7 +6500,7 @@
       "repository": "https://hub.docker.com/_/mongo",
       "description": "MongoDB is a free and open-source cross-platform document-oriented database program. Classified as a NoSQL database program, MongoDB uses JSON-like documents with schemata. MongoDB is developed by MongoDB Inc., and is published under a combination of the Server Side Public License and the Apache License.",
       "website": "https://www.mongodb.com/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/mongodb.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -6337,7 +6524,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-mongodb"
     },
     {
       "id": "mongodb4",
@@ -6349,7 +6537,7 @@
       "repository": "https://hub.docker.com/_/mongo",
       "description": "The 4.4 series of MongoDB, the document-oriented NoSQL database. MongoDB 5 and later require a CPU with AVX support and will not start without it, which leaves the low-power processors common in home servers unable to run them at all. This entry exists for those machines: it is pinned to the 4.4 series rather than following the latest release. The series reached its end of life in February 2024 and receives no further fixes, so where the processor does support AVX, the MongoDB entry installs a maintained release instead.",
       "website": "https://www.mongodb.com/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/MongoDB4/icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -6360,8 +6548,8 @@
       "pushed_at": "2026-09-11T10:43:22Z",
       "updated_at": "2023-07-04",
       "main_image": "mongo:4",
-      "category": "ai",
-      "category_label": "AI / Coding & Dev-Tools",
+      "category": "databases",
+      "category_label": "Databases",
       "template": "apps/mongodb4.json",
       "template_status": "generated-unvalidated",
       "content_hash": "ded611e14715be7ecf655239a1b4e4464eba18c8096bd9c9671011708072278b",
@@ -6373,7 +6561,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-mongodb4"
     },
     {
       "id": "monica",
@@ -6383,7 +6572,7 @@
       "repository": "https://github.com/linuxserver/docker-monica",
       "description": "Monica is an open source personal relationship management system, that lets you document your life.",
       "website": "https://github.com/monicahq/monica",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/monica-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/monica.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -6405,7 +6594,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "linuxserver-monica"
     },
     {
       "id": "monica-official",
@@ -6417,7 +6607,7 @@
       "repository": "https://hub.docker.com/_/monica",
       "description": "Monica is a self-hosted personal relationship management tool that helps users document and organize interactions with family and friends via an intuitive Web interface, creating a personalized contact database. It is ideal for users balancing work and life, ensuring key personal connections are never missed.\n\nThe tool's core features include comprehensive contact management and smart reminders. It supports creating detailed contact profiles, logging personal details, relationships (e.g., family, friends), and how contacts were met. Users can set automatic reminders for birthdays, anniversaries, and other key dates, while tracking conversations, activities, and gift ideas. A diary feature records daily moods and significant moments, maintaining a clear life record.\n\nIt offers task and debt management to track to-dos or financial interactions. Users can upload photos and documents, favorite contacts, and organize relationships with labels for streamlined data management. Full control over local data ensures privacy. The tool\u2019s intuitive operation and high flexibility deliver a modern relationship management solution.\n\n**Key Features:**\n- Comprehensive contact management with detailed profiles\n- Automatic reminders for birthdays, anniversaries, and key dates\n- Track conversations, activities, and gift ideas\n- Diary feature to record daily moods and moments\n- Task and debt management for to-dos and finances\n- Upload photos and documents, favorite contacts\n- Organize contacts with labels\n- Local data storage for privacy assurance\n\n**Learn More:**\n- [Monica Official Website](https://www.monicahq.com)\n- [Monica GitHub Repository](https://github.com/monicahq/monica)\n",
       "website": "https://www.monicahq.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/monica.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -6441,7 +6631,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-monica-official"
     },
     {
       "id": "motioneye",
@@ -6453,7 +6644,7 @@
       "repository": "https://hub.docker.com/r/ccrisan/motioneye",
       "description": "motionEye is a web-based frontend for motion. Check out the wiki for more details. Changelog is available on the releases page. https://github.com/motioneye-project/motioneye",
       "website": "",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/motioneye.webp",
       "architectures": [
         "amd64"
       ],
@@ -6476,7 +6667,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-motioneye"
     },
     {
       "id": "msedge",
@@ -6486,7 +6678,7 @@
       "repository": "https://github.com/linuxserver/docker-msedge",
       "description": "Microsoft Edge is a cross-platform web browser developed by Microsoft and based on Chromium.",
       "website": "https://www.microsoft.com/edge",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/msedge-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/edge-logo.png",
       "architectures": [
         "amd64"
       ],
@@ -6494,8 +6686,8 @@
       "pushed_at": "2026-09-11T00:50:56Z",
       "updated_at": "2026-03-31",
       "main_image": "lscr.io/linuxserver/msedge:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "desktop",
+      "category_label": "Browsers & Web Desktops",
       "template": "apps/msedge.json",
       "template_status": "generated-unvalidated",
       "content_hash": "246930a1ee01fb550fb469d05eeba09a1da217925ae876e9ed0a1ff17350b9ea",
@@ -6507,7 +6699,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-msedge"
     },
     {
       "id": "mstream",
@@ -6517,7 +6710,7 @@
       "repository": "https://github.com/linuxserver/docker-mstream",
       "description": "mstream is a personal music streaming server. You can use mStream to stream your music from your home computer to any device, anywhere.  There are mobile apps available for both Android and iPhone.",
       "website": "https://mstream.io/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/mstream-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/mstream.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -6526,8 +6719,8 @@
       "pushed_at": "2026-09-12T23:48:00Z",
       "updated_at": "2026-07-08",
       "main_image": "lscr.io/linuxserver/mstream:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "media",
+      "category_label": "Media & Streaming",
       "template": "apps/mstream.json",
       "template_status": "generated-unvalidated",
       "content_hash": "21fbe98c8b13ed061b21be07261e5048db60c3a86234b840692adeeb0f631249",
@@ -6539,7 +6732,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-mstream"
     },
     {
       "id": "mullvad-browser",
@@ -6549,7 +6743,7 @@
       "repository": "https://github.com/linuxserver/docker-mullvad-browser",
       "description": "",
       "website": null,
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/mullvad-browser-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/mullvad-browser.webp",
       "architectures": [
         "amd64"
       ],
@@ -6557,8 +6751,8 @@
       "pushed_at": "2026-09-06T23:35:48Z",
       "updated_at": "2026-04-19",
       "main_image": "lscr.io/linuxserver/mullvad-browser:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "desktop",
+      "category_label": "Browsers & Web Desktops",
       "template": "apps/mullvad-browser.json",
       "template_status": "generated-unvalidated",
       "content_hash": "6a1075b946faa8b3217f48d596d415a240000937a2baa565f3e14d83905c44cd",
@@ -6570,7 +6764,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-mullvad-browser"
     },
     {
       "id": "mylar3",
@@ -6580,7 +6775,7 @@
       "repository": "https://github.com/linuxserver/docker-mylar3",
       "description": "Mylar3 is an automated Comic Book downloader (cbr/cbz) for use with NZB and torrents written in python. It supports SABnzbd, NZBGET, and many torrent clients in addition to DDL.",
       "website": "https://github.com/MylarComics/mylar3",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/mylar3-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/mylar3.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -6602,7 +6797,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-mylar3"
     },
     {
       "id": "myspeed",
@@ -6614,7 +6810,7 @@
       "repository": "https://hub.docker.com/r/germannewsmaker/myspeed",
       "description": "MySpeed is a speed test analysis software that stores the speed of your internet for up to 30 days. This can also be useful if you want to know when your network might have drops or if you want to check if your internet matches the booked values from your contract.",
       "website": "https://myspeed.dev",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/myspeed.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -6638,7 +6834,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-myspeed"
     },
     {
       "id": "mysql-workbench",
@@ -6648,7 +6845,7 @@
       "repository": "https://github.com/linuxserver/docker-mysql-workbench",
       "description": "MySQL Workbench is a unified visual tool for database architects, developers, and DBAs. MySQL Workbench provides data modeling, SQL development, and comprehensive administration tools for server configuration, user administration, backup, and much more.",
       "website": "https://www.mysql.com/products/workbench/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/mysql-workbench-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/mysql-workbench-icon.png",
       "architectures": [
         "amd64"
       ],
@@ -6656,8 +6853,8 @@
       "pushed_at": "2026-09-12T12:26:36Z",
       "updated_at": "2026-05-18",
       "main_image": "lscr.io/linuxserver/mysql-workbench:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "databases",
+      "category_label": "Databases",
       "template": "apps/mysql-workbench.json",
       "template_status": "generated-unvalidated",
       "content_hash": "61e25e997378b8f98038de75f639e3f0072cd1007a6bd8b113dcd65e240a34f5",
@@ -6669,7 +6866,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-mysql-workbench"
     },
     {
       "id": "n8n",
@@ -6681,7 +6879,7 @@
       "repository": "https://hub.docker.com/r/n8nio/n8n",
       "description": "n8n is a powerful open-source workflow automation and conversational AI platform that blends the flexibility of coding with the simplicity of no-code development, empowering users to create efficient and secure automation workflows. It seamlessly connects any app with an API, leveraging native AI capabilities (like LangChain-based AI agent workflows) to process custom data, ideal for personal task management, team collaboration, or enterprise-grade automation. Its vibrant community offers over 400 integrations and 900+ ready-to-use templates, enabling users to deploy automations quickly.\n\nThe platform supports highly customizable workflow design, allowing users to write JavaScript/Python, add npm packages, or use an intuitive visual interface to manage data, catering to both simple tasks and complex processes. Enterprise-grade features like advanced permissions and air-gapped deployments ensure security, while multilingual support makes it accessible globally. n8n delivers a versatile and user-friendly automation solution.\n\nDiscover n8n\u2019s Automation Scenarios\nn8n\u2019s community resources provide extensive support and inspiration, helping users explore its scenario-based value and easily build automation workflows. Below are two key resources showcasing n8n\u2019s capabilities across various use cases:\n\n1. [n8n Official Community Forum](https://community.n8n.io/): \nThe forum is a hub for user collaboration and learning, offering resources from beginner guides to advanced workflow designs. Shared use cases include automating social media posts or real-time data syncing, such as using n8n to pull data from Google Sheets and send Slack notifications, boosting team collaboration and data efficiency.\n\n2. [n8n Official Template Library](https://n8n.io/workflows/): \nThe template library offers over 900 ready-to-use workflows for scenarios like marketing automation, data analytics, and customer support. For example, a template can link Shopify to Mailchimp, automatically adding new customers to mailing lists and sending welcome emails, making automation accessible to non-technical users. AI-driven workflows, like handling customer queries with LangChain, highlight n8n\u2019s strength in intelligent interactions.\n",
       "website": "https://n8n.io",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/n8n.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -6705,7 +6903,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-n8n"
     },
     {
       "id": "navidrome",
@@ -6717,7 +6916,7 @@
       "repository": "https://hub.docker.com/r/deluan/navidrome",
       "description": "Navidrome is an open source web-based music collection server and streamer. It gives you freedom to listen to your music collection from any browser or mobile device. It's like your personal Spotify!",
       "website": "https://www.navidrome.org",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/navidrome.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -6741,7 +6940,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-navidrome"
     },
     {
       "id": "netbird",
@@ -6753,7 +6953,7 @@
       "repository": "https://hub.docker.com/r/netbirdio/netbird",
       "description": "NetBird combines a WireGuard\u00ae-based overlay network with Zero Trust Network Access, providing a unified open source platform for reliable and secure connectivity.\n\n- Secure Remote Access \u2013 Enable least privilege network access in a few clicks\n- Zero-Config Deployment \u2013 Replace legacy VPNs with a peer-to-peer WireGuard\u00ae-based network\n- Seamless SSO with MFA \u2013 Secure your network access with session-based SSO & MFA\n- Dynamic Posture Checks \u2013 Grant access only to devices meeting your security rules\n- Centralized Network Management \u2013 Control your private network from a single place\n- Detailed Activity Logging \u2013 Identify who did what, and when in your network\n\n**Learn More:**\n- [NetBird Website](https://netbird.io)\n- [Documentation](https://docs.netbird.io)\n- [Self-Hosting Guide](https://docs.netbird.io/selfhosted/selfhosted-quickstart)\n- [NetBird GitHub](https://github.com/netbirdio/netbird)\n- [Slack Community](https://docs.netbird.io/slack-url)\n",
       "website": "https://netbird.io",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/netbird.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -6777,7 +6977,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-netbird"
     },
     {
       "id": "netbox",
@@ -6787,7 +6988,7 @@
       "repository": "https://github.com/linuxserver/docker-netbox",
       "description": "Netbox is an IP address management (IPAM) and data center infrastructure management (DCIM) tool. Initially conceived by the network engineering team at DigitalOcean, NetBox was developed specifically to address the needs of network and infrastructure engineers. It is intended to function as a domain-specific source of truth for network operations.",
       "website": "https://github.com/netbox-community/netbox",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/netbox-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/netbox.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -6809,7 +7010,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-netbox"
     },
     {
       "id": "netdata",
@@ -6821,7 +7023,7 @@
       "repository": "https://hub.docker.com/r/netdata/netdata",
       "description": "Netdata is a real-time performance and health monitoring solution that helps you visualize and understand the behavior of your systems.",
       "website": "https://www.netdata.cloud",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/netdata.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -6845,7 +7047,8 @@
       "requires_relaxed_confinement": true,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": true,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-netdata"
     },
     {
       "id": "netronome",
@@ -6857,7 +7060,7 @@
       "repository": "https://ghcr.io/autobrr/netronome",
       "description": "Netronome is a complete network performance monitoring solution with speed tests, continuous packet-loss monitoring, distributed server agents, automated alerts, visualizations, and historical tracking.",
       "website": "https://netrono.me",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/netronome.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -6868,8 +7071,8 @@
       "pushed_at": "2026-09-11T10:43:22Z",
       "updated_at": "2026-07-30",
       "main_image": "ghcr.io/autobrr/netronome:latest",
-      "category": "network",
-      "category_label": "Network & Firewall",
+      "category": "monitoring",
+      "category_label": "Monitoring & Analytics",
       "template": "apps/netronome.json",
       "template_status": "generated-unvalidated",
       "content_hash": "cc14c3acc44972385b678f72b5430de930b6be9b805616d031496677c4103c98",
@@ -6881,7 +7084,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-netronome"
     },
     {
       "id": "nextcloud",
@@ -6891,7 +7095,7 @@
       "repository": "https://github.com/linuxserver/docker-nextcloud",
       "description": "Nextcloud gives you access to all your files wherever you are.",
       "website": "https://nextcloud.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/nextcloud-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/nextcloud.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -6900,8 +7104,8 @@
       "pushed_at": "2026-09-10T15:04:34Z",
       "updated_at": "2025-07-10",
       "main_image": "lscr.io/linuxserver/nextcloud:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "productivity",
+      "category_label": "Productivity & Workflows",
       "template": "apps/nextcloud.json",
       "template_status": "laboratory-validated",
       "content_hash": "3c6ab555a89e5881bafac6a24c53682080c6e8ddbe2177a49872db46f3fed42d",
@@ -6913,7 +7117,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-nextcloud"
     },
     {
       "id": "nextcloud-official",
@@ -6925,7 +7130,7 @@
       "repository": "https://hub.docker.com/_/nextcloud",
       "description": "Discover the ultimate solution for remote collaboration with Nextcloud. Unlike traditional office software, Nextcloud seamlessly integrates files, communication, and productivity tools into one platform, enhancing teamwork and streamlining your workflow. Say goodbye to the limitations of conventional tools and embrace a new era of collaboration.\n\nNextcloud stands out with its robust features tailored for every need. Enjoy secure file storage, real-time communication via Talk, comprehensive groupware, and powerful office integration, all in one place. Experience these top-notch features at an affordable price, making it accessible for everyone to elevate their collaboration game.\n\nDeploying Nextcloud on a self-hosted server private cloud device brings unparalleled convenience. Benefit from unlimited storage, secure data privacy, local network speeds, and multi-device access, ensuring you have everything you need at your fingertips.\n",
       "website": "https://nextcloud.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/nextcloud.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -6949,7 +7154,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-nextcloud-official"
     },
     {
       "id": "nextcloud-stack",
@@ -6959,7 +7165,7 @@
       "repository": "https://github.com/nextcloud/docker",
       "description": "A three-service Nextcloud deployment adapted to native Proxmox OCI LXC containers.",
       "website": "https://nextcloud.com/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/nextcloud.webp",
       "architectures": [
         "amd64"
       ],
@@ -6980,7 +7186,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-nextcloud-stack"
     },
     {
       "id": "nginx",
@@ -6990,7 +7197,7 @@
       "repository": "https://github.com/linuxserver/docker-nginx",
       "description": "Nginx is an HTTP web server, reverse proxy, content cache, load balancer, TCP/UDP proxy server, and mail proxy server.",
       "website": "https://nginx.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/nginx-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/nginx.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -6999,8 +7206,8 @@
       "pushed_at": "2026-09-10T09:03:57Z",
       "updated_at": "2026-07-05",
       "main_image": "lscr.io/linuxserver/nginx:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "web",
+      "category_label": "Webservers & Proxies",
       "template": "apps/nginx.json",
       "template_status": "generated-unvalidated",
       "content_hash": "9a03ac3c92a200386d640e96174d7dae2ff2c17f6a121445c5b15b4388e6e3df",
@@ -7012,7 +7219,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-nginx"
     },
     {
       "id": "nginxproxymanager",
@@ -7024,7 +7232,7 @@
       "repository": "https://hub.docker.com/r/jc21/nginx-proxy-manager",
       "description": "Nginx Proxy Manager is a simple, powerful tool to help you host multiple websites on a single server.",
       "website": "https://nginxproxymanager.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/nginx-proxy-manager.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -7048,7 +7256,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-nginxproxymanager"
     },
     {
       "id": "ngircd",
@@ -7058,7 +7267,7 @@
       "repository": "https://github.com/linuxserver/docker-ngircd",
       "description": "Ngircd is a free, portable and lightweight Internet Relay Chat server for small or private networks, developed under the GNU General Public License (GPL). It is easy to configure, can cope with dynamic IP addresses, and supports IPv6, SSL-protected connections as well as PAM for authentication. It is written from scratch and not based on the original IRCd.",
       "website": "https://ngircd.barton.de/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ngircd-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/ngircd-icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -7067,8 +7276,8 @@
       "pushed_at": "2026-07-11T15:45:47Z",
       "updated_at": "2024-10-14",
       "main_image": "lscr.io/linuxserver/ngircd:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "communication",
+      "category_label": "Communication & Community",
       "template": "apps/ngircd.json",
       "template_status": "generated-unvalidated",
       "content_hash": "cc1a8c9d07caed3be713c73e24fae3d272d306788a954f7bc2027ff6db46ea6d",
@@ -7080,7 +7289,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-ngircd"
     },
     {
       "id": "node-red",
@@ -7092,7 +7302,7 @@
       "repository": "https://hub.docker.com/r/nodered/node-red",
       "description": "Node-RED is a flow-based low-code development platform that enables creating automation tasks and applications by connecting various nodes. A browser-based editor, simple to use, makes it ideal for users in home automation, industrial control, or other fields to quickly build data processing flows.\n\nCore features include a low-code flow editor and robust data handling. Built on Node.js with an event-driven, non-blocking model, the platform supports real-time data collection, transformation, and visualization. A palette with over 5000 nodes allows users to construct flows via drag-and-drop. A rich text editor enables creating JavaScript functions for enhanced customization.\n\nIt stores flows in JSON format, facilitating easy import and export for sharing. A built-in library allows saving useful functions, templates, or flows for reuse, and an online flow library supports sharing top flows globally. With ease of use and efficiency at the core, the platform delivers a modern solution for diverse automation needs.\n\n**Key Features:**\n- Browser-based low-code flow editor with drag-and-drop node connections\n- Real-time data collection, transformation, and visualization\n- Event-driven, non-blocking model with Node.js\n- Palette with over 5000 nodes for extended functionality\n- Rich text editor for creating JavaScript functions\n- JSON-based flow storage for easy sharing\n- Built-in library for saving functions, templates, and flows\n- Online flow library for sharing top flows\n\n**Learn More:**\n- [Node-RED Official Website](https://nodered.org/)\n- [Node-RED GitHub](https://github.com/node-red/node-red)\n",
       "website": "https://nodered.org/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/node-red.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -7116,7 +7326,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-node-red"
     },
     {
       "id": "nzbfast",
@@ -7128,7 +7339,7 @@
       "repository": "https://hub.docker.com/r/nzbfast/nzbfast",
       "description": "nzbfast is a speed-focused Usenet (NZB) downloader written in Rust. It is one small binary with a low memory footprint, and it saturates a fast line with a handful of connections.\n\nArticles are verified while they arrive, so most jobs finish with no separate verify pass. Repair and unpack run only when they are actually needed, and extraction starts before the last article lands.\n\nThe web dashboard on port 6790 also serves a SABnzbd-compatible API, so Sonarr, Radarr, Prowlarr and friends work with no extra glue. Add an .nzb from the dashboard, or drop one into the watch folder.\n\nFirst run: open the dashboard, add your Usenet provider under Settings, and copy the API key it shows you into your *arr apps. If you would rather pin the key yourself so it survives a reinstall, set NZBFAST_APIKEY before the first start. Leave it empty and nzbfast generates one for you.",
       "website": "https://nzbfast.github.io/nzbfast/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/nzbfast/icon.svg",
       "architectures": [
         "amd64",
         "arm64"
@@ -7152,7 +7363,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-nzbfast"
     },
     {
       "id": "nzbget",
@@ -7162,7 +7374,7 @@
       "repository": "https://github.com/linuxserver/docker-nzbget",
       "description": "Nzbget is a usenet downloader, written in C++ and designed with performance in mind to achieve maximum download speed by using very little system resources.",
       "website": "http://nzbget.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/nzbget-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/nzbget.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -7184,7 +7396,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-nzbget"
     },
     {
       "id": "nzbhydra2",
@@ -7194,7 +7407,7 @@
       "repository": "https://github.com/linuxserver/docker-nzbhydra2",
       "description": "Nzbhydra2 is a meta search application for NZB indexers, the spiritual successor to NZBmegasearcH, and an evolution of the original application NZBHydra.",
       "website": "https://github.com/theotherp/nzbhydra2",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/nzbhydra2-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/nzbhydra2.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -7203,8 +7416,8 @@
       "pushed_at": "2026-09-09T23:57:43Z",
       "updated_at": "2024-07-18",
       "main_image": "lscr.io/linuxserver/nzbhydra2:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "arr",
+      "category_label": "*Arr Suite",
       "template": "apps/nzbhydra2.json",
       "template_status": "generated-unvalidated",
       "content_hash": "9904215820e2919283e2d348b9fbd0e1ff0c7d3ce3188a3a74be4077ea57b0d2",
@@ -7216,7 +7429,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-nzbhydra2"
     },
     {
       "id": "obsidian",
@@ -7226,7 +7440,7 @@
       "repository": "https://github.com/linuxserver/docker-obsidian",
       "description": "Obsidian is a note-taking app that lets you create, link, and organize your notes on your device, with hundreds of plugins and themes to customize your workflow. You can also publish your notes online, access them offline, and sync them securely with end-to-end encryption.",
       "website": "https://obsidian.md",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/obsidian-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/obsidian.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -7235,8 +7449,8 @@
       "pushed_at": "2026-09-06T14:25:02Z",
       "updated_at": "2026-04-03",
       "main_image": "lscr.io/linuxserver/obsidian:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "documents",
+      "category_label": "Documents & Notes",
       "template": "apps/obsidian.json",
       "template_status": "generated-unvalidated",
       "content_hash": "67c69f6c9c0591f35736d94a6f5289d8fecbca454f1644bb6b5b4bba883c8663",
@@ -7248,7 +7462,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-obsidian"
     },
     {
       "id": "ollama",
@@ -7260,7 +7475,7 @@
       "repository": "https://hub.docker.com/r/ollama/ollama",
       "description": "Ollama is a tool for running large language models locally, designed to help users quickly deploy and manage AI models via a simple command-line interface and server. Its intuitive Web interface and efficient design make it ideal for developers, researchers, and AI enthusiasts working on local hardware.\n\nThe tool's core features include local model execution and multi-model support. It enables running models like Llama 3, Mistral, and Gemma, with simple commands for downloading and switching models. All data processing occurs locally, ensuring privacy. Low resource usage optimizes model loading, allowing smooth operation on limited hardware.\n\nIt offers a RESTful API for application integration and supports tool calling (e.g., Llama 3.1) for complex tasks. Model management via Modelfile bundles weights and configurations for ease of use. The tool's efficiency and user control deliver a modern local AI solution.\n\n**Key Features:**\n- **Local Execution**: Run LLMs directly on your hardware without internet dependency\n- **Multiple Model Support**: Access to dozens of pre-trained models including Llama 3, Mistral, Gemma, Code Llama, and more\n- **Easy Model Management**: Simple commands to pull, run, and manage different models\n- **API Integration**: RESTful API for building applications and integrations\n- **Memory Efficient**: Optimized model loading and memory management\n- **Privacy-Focused**: All processing happens locally, ensuring data privacy\n\n**Supported Models:**\n- DeepSeek-R1 (1.5B, 7B, 8B, 14B, 32B, 70B, 671B parameters)\n- Gemma3n (2B, 4B parameters)\n- Gemma3 (1B, 4B, 12B, 27B parameters)\n- Qwen3 (0.6B, 1.7B, 4B, 8B, 14B, 30B, 32B, 235B parameters)\n- Qwen2.5vl (3B, 7B, 32B, 72B parameters)\n- Llama3.1 (8B, 70B, 405B parameters)\n- Llama3.2 (1B, 3B parameters)\n- Mistral (7B parameters)\n- And many more...\n\n**Use Cases:**\n- Local AI development and experimentation\n- Educational purposes and research\n- Building AI-powered applications\n- Code generation and assistance\n- Text generation and completion\n- Chatbots and conversational AI\n- Data analysis and insights\n\n**Learn More:**\n- [Ollama Official Website](https://ollama.com/)\n- [Ollama GitHub Repository](https://github.com/ollama/ollama)\n- [Model Library](https://ollama.com/library)\n",
       "website": "https://ollama.com/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/ollama.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -7284,7 +7499,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-ollama"
     },
     {
       "id": "ombi",
@@ -7294,7 +7510,7 @@
       "repository": "https://github.com/linuxserver/docker-ombi",
       "description": "Ombi allows you to host your own Plex Request and user management system.",
       "website": "https://ombi.io",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ombi-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/ombi.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -7316,7 +7532,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-ombi"
     },
     {
       "id": "onlyoffice",
@@ -7326,7 +7543,7 @@
       "repository": "https://github.com/linuxserver/docker-onlyoffice",
       "description": "ONLYOFFICE provides a full range of tools to create, edit and collaborate on text documents, spreadsheets, presentations, PDF forms and regular PDF files on web, desktop and mobile platforms.",
       "website": "https://www.onlyoffice.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/onlyoffice-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/onlyoffice.webp",
       "architectures": [
         "amd64"
       ],
@@ -7347,7 +7564,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-onlyoffice"
     },
     {
       "id": "open-webui",
@@ -7357,7 +7575,7 @@
       "repository": "https://ghcr.io/open-webui/open-webui",
       "description": "Open WebUI is a feature-rich, user-friendly self-hosted AI platform designed for fully offline operation, supporting multiple large language model runners and API integration. Its intuitive Web interface provides powerful AI deployment capabilities, ideal for developers, researchers, and AI enthusiasts building localized intelligent applications.\n\nThe tool's core features include local model execution and Retrieval Augmented Generation (RAG). It supports Ollama and OpenAI-compatible APIs (e.g., LMStudio, GroqCloud), enabling seamless model switching and multi-model conversations. RAG enhances chat experiences through local document loading or web search integration (e.g., SearXNG, Google PSE). Granular permissions and role-based access control (RBAC) ensure security with customized user role management.\n\nIt supports Markdown and LaTeX for enriched interactions and offers hands-free voice and video call features for dynamic communication. Image generation integration (e.g., DALL-E, ComfyUI) enriches visual content, and a model builder enables creating and importing custom models via the interface. The Pipelines plugin framework supports Python plugins, extending functionality like function calling and real-time translation. The tool\u2019s offline privacy and flexibility deliver a modern AI interaction solution.\n\n**Key Features:**\n- Local execution of Ollama and OpenAI-compatible APIs with multi-model conversations\n- RAG support with local document and web search integration (e.g., SearXNG, Google PSE)\n- Granular permissions and role-based access control (RBAC)\n- Simultaneous interaction with multiple models, leveraging their strengths\n- Image generation integration with DALL-E, ComfyUI, and more\n- Full Markdown and LaTeX support\n- Hands-free voice and video call functionality\n- Pipelines plugin framework for custom Python functionality\n\n**Learn More:**\n- [Open WebUI Official Website](https://openwebui.com)\n- [Open WebUI Documentation](https://docs.openwebui.com)\n- [Open WebUI GitHub Repository](https://github.com/open-webui/open-webui)\n",
       "website": "https://openwebui.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/open-webui.webp",
       "architectures": [
         "amd64"
       ],
@@ -7378,7 +7596,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-open-webui"
     },
     {
       "id": "open-webui-cuda",
@@ -7388,7 +7607,7 @@
       "repository": "https://ghcr.io/open-webui/open-webui",
       "description": "Open WebUI is a feature-rich, user-friendly self-hosted AI platform designed for fully offline operation, supporting multiple large language model runners and API integration. Its intuitive Web interface provides powerful AI deployment capabilities, ideal for developers, researchers, and AI enthusiasts building localized intelligent applications.\n\nThe tool's core features include local model execution and Retrieval Augmented Generation (RAG). It supports Ollama and OpenAI-compatible APIs (e.g., LMStudio, GroqCloud), enabling seamless model switching and multi-model conversations. RAG enhances chat experiences through local document loading or web search integration (e.g., SearXNG, Google PSE). Granular permissions and role-based access control (RBAC) ensure security with customized user role management.\n\nIt supports Markdown and LaTeX for enriched interactions and offers hands-free voice and video call features for dynamic communication. Image generation integration (e.g., DALL-E, ComfyUI) enriches visual content, and a model builder enables creating and importing custom models via the interface. The Pipelines plugin framework supports Python plugins, extending functionality like function calling and real-time translation. The tool\u2019s offline privacy and flexibility deliver a modern AI interaction solution.\n\n**Key Features:**\n- Local execution of Ollama and OpenAI-compatible APIs with multi-model conversations\n- RAG support with local document and web search integration (e.g., SearXNG, Google PSE)\n- Granular permissions and role-based access control (RBAC)\n- Simultaneous interaction with multiple models, leveraging their strengths\n- Image generation integration with DALL-E, ComfyUI, and more\n- Full Markdown and LaTeX support\n- Hands-free voice and video call functionality\n- Pipelines plugin framework for custom Python functionality\n\n**Learn More:**\n- [Open WebUI Official Website](https://openwebui.com)\n- [Open WebUI Documentation](https://docs.openwebui.com)\n- [Open WebUI GitHub Repository](https://github.com/open-webui/open-webui)\n",
       "website": "https://openwebui.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/open-webui.webp",
       "architectures": [
         "amd64"
       ],
@@ -7409,7 +7628,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-open-webui-cuda"
     },
     {
       "id": "open-webui-ollama",
@@ -7419,7 +7639,7 @@
       "repository": "https://ghcr.io/open-webui/open-webui",
       "description": "Open WebUI is a feature-rich, user-friendly self-hosted AI platform designed for fully offline operation, supporting multiple large language model runners and API integration. Its intuitive Web interface provides powerful AI deployment capabilities, ideal for developers, researchers, and AI enthusiasts building localized intelligent applications.\n\nThe tool's core features include local model execution and Retrieval Augmented Generation (RAG). It supports Ollama and OpenAI-compatible APIs (e.g., LMStudio, GroqCloud), enabling seamless model switching and multi-model conversations. RAG enhances chat experiences through local document loading or web search integration (e.g., SearXNG, Google PSE). Granular permissions and role-based access control (RBAC) ensure security with customized user role management.\n\nIt supports Markdown and LaTeX for enriched interactions and offers hands-free voice and video call features for dynamic communication. Image generation integration (e.g., DALL-E, ComfyUI) enriches visual content, and a model builder enables creating and importing custom models via the interface. The Pipelines plugin framework supports Python plugins, extending functionality like function calling and real-time translation. The tool\u2019s offline privacy and flexibility deliver a modern AI interaction solution.\n\n**Key Features:**\n- Local execution of Ollama and OpenAI-compatible APIs with multi-model conversations\n- RAG support with local document and web search integration (e.g., SearXNG, Google PSE)\n- Granular permissions and role-based access control (RBAC)\n- Simultaneous interaction with multiple models, leveraging their strengths\n- Image generation integration with DALL-E, ComfyUI, and more\n- Full Markdown and LaTeX support\n- Hands-free voice and video call functionality\n- Pipelines plugin framework for custom Python functionality\n\n**Learn More:**\n- [Open WebUI Official Website](https://openwebui.com)\n- [Open WebUI Documentation](https://docs.openwebui.com)\n- [Open WebUI GitHub Repository](https://github.com/open-webui/open-webui)\n",
       "website": "https://openwebui.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/open-webui.webp",
       "architectures": [
         "amd64"
       ],
@@ -7442,7 +7662,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-open-webui-ollama"
     },
     {
       "id": "openclaw",
@@ -7454,7 +7675,7 @@
       "repository": "https://hub.docker.com/r/icewhaletech/openclaw",
       "description": "OpenClaw is an open-source personal AI assistant designed to extend the capabilities of large language models (LLMs) into intelligent agents that actively execute tasks, interact across multiple platforms, and operate continuously. It supports 24/7 operation on the user's own device or server and provides intelligent automation services through common communication tools. OpenClaw connects AI to existing chat channels (such as WhatsApp, Telegram, Discord, etc.) via a locally running \"gateway + agent\" architecture, enabling it not only to answer questions but also to proactively perform actions, manage schedules, process emails, automate workflows, and more.\n\n**Key Features**:\n\n- Multi-channel Communication Integration: Interact directly with AI through common communication platforms like WhatsApp, Telegram, Slack, Discord, Signal, iMessage, Microsoft Teams, etc., without the need for additional applications.\n\n- Continuous Online & Long-term Memory: OpenClaw can run 24/7, possessing persistent memory and context retention capabilities, allowing it to remember preferences, historical conversations, and provide personalized services.\n\n- Real Action Execution: Beyond text replies, it can perform system tasks (e.g., clear inbox, send emails, fill forms, schedule appointments, browse web, control browser, etc.).\n\n- Skill Expansion & Automated Workflows: Supports community plugins, extended skills, and custom automation scripts, enabling the AI to execute complex tasks in various scenarios.\n\n**Learn More:**\n\n- [Official Website](https://openclaw.ai)\n\n- [Official Documentation](https://docs.openclaw.ai/)\n\n- [OpenClaw GitHub Repository](https://github.com/openclaw/openclaw)\n\n- [Configure Guide](https://www.self-hosted serverspace.com/docs/self-hosted server/How-to-Deploy-OpenClaw)",
       "website": "https://openclaw.ai",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/openclaw.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -7478,7 +7699,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-openclaw"
     },
     {
       "id": "openhab",
@@ -7490,7 +7712,7 @@
       "repository": "https://hub.docker.com/r/openhab/openhab",
       "description": "The open Home Automation Bus (openHAB, pronounced \u02c8\u0259\u028ap\u0259n\u02c8h\u00e6b) is an open source, technology agnostic home automation platform which runs as the center of your smart home! Its ability to integrate a multitude of other devices and systems. openHAB includes other home automation systems, (smart) devices and other technologies into a single solution. To provide a uniform user interface and a common approach to automation rules across the entire system, regardless of the number of manufacturers and sub-systems involved. Giving you the most flexible tool available to make almost any home automation wish come true; if you can think it, odds are that you can implement it with openHAB.",
       "website": "https://www.openhab.org",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/openhab.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -7514,7 +7736,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-openhab"
     },
     {
       "id": "openhands",
@@ -7526,7 +7749,7 @@
       "repository": "https://ghcr.io/all-hands-ai/openhands",
       "description": "OpenHands is an open-source AI-powered coding assistant that provides developers with intelligent code completion, generation, and debugging capabilities. It runs in a sandboxed environment to ensure security and isolation while allowing access to various development tools and resources.\n\n**Key Features:**\n- AI-powered code completion and generation\n- Interactive debugging and error resolution\n- Support for multiple programming languages\n- Secure sandboxed execution environment\n- Customizable runtime configurations\n- Integration with Docker for containerized workflows\n\n**Learn More:**\n- [OpenHands Official Website](https://www.all-hands.dev)\n- [OpenHands GitHub Repository](https://github.com/All-Hands-AI/OpenHands)\n- [Documentation](https://docs.all-hands.dev)\n",
       "website": "https://www.openhands.dev/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/openhands.webp",
       "architectures": [
         "amd64"
       ],
@@ -7549,7 +7772,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "image-openhands"
     },
     {
       "id": "openlist",
@@ -7561,7 +7785,7 @@
       "repository": "https://hub.docker.com/r/openlistteam/openlist",
       "description": "OpenList is a community-driven, self-hosted file listing and cloud drive mounting service that supports multiple storage backends in one place.\nIt brings local storage plus services like OneDrive, Google Drive, S3, WebDAV, SMB, and many other providers into one browser-based file hub.\nWith previews, uploads, sharing, WebDAV, offline download, and package download built in, it works well for home NAS setups, personal cloud libraries, and lightweight team file portals.\n\n**Main Features:**\n- Connect local disks, cloud drives, object storage, and WebDAV or SMB endpoints in one place\n- Preview documents, images, audio, video, code, Markdown, and Office files directly in the browser\n- Upload, move, rename, copy, delete, and batch download files and folders from a single interface\n- Enable WebDAV, protected routes, sharing, dark mode, and multi-language support\n- Support offline downloads, cross-storage file copying, and multi-thread acceleration\n\n**Learn More:**\n- [OpenList Official Website](https://oplist.org/)\n- [OpenList GitHub](https://github.com/OpenListTeam/OpenList)\n",
       "website": "https://oplist.org/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/openlist.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -7585,7 +7809,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-openlist"
     },
     {
       "id": "openshot",
@@ -7595,7 +7820,7 @@
       "repository": "https://github.com/linuxserver/docker-openshot",
       "description": "OpenShot Video Editor is an award-winning free and open-source video editor for Linux, Mac, and Windows, and is dedicated to delivering high quality video editing and animation solutions to the world.",
       "website": "https://openshot.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/openshot-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/openshot-logo.png",
       "architectures": [
         "amd64"
       ],
@@ -7603,8 +7828,8 @@
       "pushed_at": "2026-09-12T00:56:49Z",
       "updated_at": "2026-08-07",
       "main_image": "lscr.io/linuxserver/openshot:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "creative",
+      "category_label": "Creative & Design",
       "template": "apps/openshot.json",
       "template_status": "generated-unvalidated",
       "content_hash": "ed06e4e88482a7367eadac7ca014629d0144bc64e82b0a40774505945a85bfe9",
@@ -7616,7 +7841,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-openshot"
     },
     {
       "id": "openspeedtest",
@@ -7628,7 +7854,7 @@
       "repository": "https://hub.docker.com/r/openspeedtest/latest",
       "description": "An application for launching HTML5 Network Speed Test Server. You can test download & upload speed from any device within your network with a web browser that is IE10 or new.",
       "website": "",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/openspeedtest.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -7639,8 +7865,8 @@
       "pushed_at": "2026-09-11T10:43:22Z",
       "updated_at": "2025-01-09",
       "main_image": "openspeedtest/latest:latest",
-      "category": "network",
-      "category_label": "Network & Firewall",
+      "category": "monitoring",
+      "category_label": "Monitoring & Analytics",
       "template": "apps/openspeedtest.json",
       "template_status": "generated-unvalidated",
       "content_hash": "08fb7d4b29331c86f918962b5f4eb0cfd25f7800a832a312cfed6b869796e38a",
@@ -7652,7 +7878,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-openspeedtest"
     },
     {
       "id": "openssh-server",
@@ -7662,7 +7889,7 @@
       "repository": "https://github.com/linuxserver/docker-openssh-server",
       "description": "Openssh-server is a sandboxed environment that allows ssh access without giving keys to the entire server.",
       "website": "https://www.openssh.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/openssh-server-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/openssh-server-icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -7671,8 +7898,8 @@
       "pushed_at": "2026-09-06T21:01:44Z",
       "updated_at": "2026-07-05",
       "main_image": "lscr.io/linuxserver/openssh-server:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "remote",
+      "category_label": "Remote Access & VPN",
       "template": "apps/openssh-server.json",
       "template_status": "laboratory-validated",
       "content_hash": "c3b7c81dd77bc5739a1a6881cd3c94750774596e3fb53f3e549456c643bc194d",
@@ -7684,7 +7911,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-openssh-server"
     },
     {
       "id": "openvscode-server",
@@ -7694,7 +7922,7 @@
       "repository": "https://github.com/linuxserver/docker-openvscode-server",
       "description": "Openvscode-server provides a version of VS Code that runs a server on a remote machine and allows access through a modern web browser.",
       "website": "https://github.com/gitpod-io/openvscode-server",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/openvscode-server-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/openvscode-server-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -7703,8 +7931,8 @@
       "pushed_at": "2026-07-16T16:49:20Z",
       "updated_at": "2024-08-19",
       "main_image": "lscr.io/linuxserver/openvscode-server:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "ai",
+      "category_label": "AI / Coding & Dev-Tools",
       "template": "apps/openvscode-server.json",
       "template_status": "generated-unvalidated",
       "content_hash": "8b2e77ba8ba0482319da163c58cb606d486d2caf43c29d01412f827fbd05d550",
@@ -7716,7 +7944,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "linuxserver-openvscode-server"
     },
     {
       "id": "opera",
@@ -7726,7 +7955,7 @@
       "repository": "https://github.com/linuxserver/docker-opera",
       "description": "Opera is a multi-platform web browser developed by its namesake company Opera. The browser is based on Chromium, but distinguishes itself from other Chromium-based browsers (Chrome, Edge, etc.) through its user interface and other features.",
       "website": "https://www.opera.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/opera-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/opera.webp",
       "architectures": [
         "amd64"
       ],
@@ -7734,8 +7963,8 @@
       "pushed_at": "2026-09-11T14:55:26Z",
       "updated_at": "2026-03-31",
       "main_image": "lscr.io/linuxserver/opera:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "desktop",
+      "category_label": "Browsers & Web Desktops",
       "template": "apps/opera.json",
       "template_status": "generated-unvalidated",
       "content_hash": "a61303b8c14b0ae83335582fcb62a7f920cd88b2a167a61fe82f423fb5916824",
@@ -7747,7 +7976,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-opera"
     },
     {
       "id": "opodsync",
@@ -7759,7 +7989,7 @@
       "repository": "https://hub.docker.com/r/ganeshlab/opodsync",
       "description": "oPodSync is a podcast synchronization service that allows users to sync their podcast subscriptions and listening progress across multiple devices. It provides a server-side solution for managing podcast data and ensures that users can seamlessly switch between their devices.\n\n**Key Features:**\n- Sync podcast subscriptions\n- Track listening progress across devices\n- Web-based management interface\n- Support for multiple podcast clients\n- Centralized data storage\n- Easy setup and configuration\n\n**Learn More:**\n- [oPodSync GitHub Repo](https://github.com/kd2org/oPodSync)\n",
       "website": "https://fossil.kd2.org/opodsync/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/oPodSync/icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -7783,7 +8013,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-opodsync"
     },
     {
       "id": "orcaslicer",
@@ -7793,7 +8024,7 @@
       "repository": "https://github.com/linuxserver/docker-orcaslicer",
       "description": "Orca Slicer is an open source slicer for FDM printers. OrcaSlicer is fork of Bambu Studio, it was previously known as BambuStudio-SoftFever, Bambu Studio is forked from PrusaSlicer by Prusa Research, which is from Slic3r by Alessandro Ranellucci and the RepRap community",
       "website": "https://github.com/SoftFever/OrcaSlicer",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/orcaslicer-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/orca-slicer.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -7802,8 +8033,8 @@
       "pushed_at": "2026-09-08T17:21:08Z",
       "updated_at": "2026-06-20",
       "main_image": "lscr.io/linuxserver/orcaslicer:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "creative",
+      "category_label": "Creative & Design",
       "template": "apps/orcaslicer.json",
       "template_status": "generated-unvalidated",
       "content_hash": "7168aad5ee382925e6d4138fd2780f9c4872a602bfcd6d56be53be637d14299a",
@@ -7815,7 +8046,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-orcaslicer"
     },
     {
       "id": "oscam",
@@ -7825,7 +8057,7 @@
       "repository": "https://github.com/linuxserver/docker-oscam",
       "description": "Oscam is an Open Source Conditional Access Module software used for descrambling DVB transmissions using smart cards. It's both a server and a client.",
       "website": "https://git.streamboard.tv/common/oscam",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/oscam-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/oscam.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -7834,8 +8066,8 @@
       "pushed_at": "2026-09-11T13:22:43Z",
       "updated_at": "2026-07-17",
       "main_image": "lscr.io/linuxserver/oscam:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "media",
+      "category_label": "Media & Streaming",
       "template": "apps/oscam.json",
       "template_status": "generated-unvalidated",
       "content_hash": "8372c7d49f28c4a25472eee29955ba229ad9e54cebd4bd273b19f2ca9281e111",
@@ -7847,7 +8079,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-oscam"
     },
     {
       "id": "overseerr",
@@ -7859,7 +8092,7 @@
       "repository": "https://hub.docker.com/r/linuxserver/overseerr",
       "description": "Overseerr is a free and open source software application for managing requests for your media library. It integrates with your existing services, such as Sonarr, Radarr, and Plex!",
       "website": "https://overseerr.dev",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/overseerr.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -7883,7 +8116,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-overseerr"
     },
     {
       "id": "pairdrop",
@@ -7893,7 +8127,7 @@
       "repository": "https://github.com/linuxserver/docker-pairdrop",
       "description": "PairDrop is a sublime alternative to AirDrop that works on all platforms. Send images, documents or text via peer to peer connection to devices in the same local network/Wi-Fi or to paired devices.",
       "website": "https://github.com/schlagmichdoch/PairDrop",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/pairdrop-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/pairdrop.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -7915,7 +8149,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-pairdrop"
     },
     {
       "id": "paperless-ngx",
@@ -7925,7 +8160,7 @@
       "repository": "https://github.com/paperless-ngx/paperless-ngx",
       "description": "Official Paperless-ngx deployment with private PostgreSQL and Valkey dependencies.",
       "website": "https://docs.paperless-ngx.com/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/paperless-ngx.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -7949,7 +8184,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-paperless-ngx"
     },
     {
       "id": "pcsx2",
@@ -7959,7 +8195,7 @@
       "repository": "https://github.com/linuxserver/docker-pcsx2",
       "description": "PCSX2 is an open source PS2 Emulator.",
       "website": "https://pcsx2.net/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/pcsx2-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/pcsx2-logo.png",
       "architectures": [
         "amd64"
       ],
@@ -7967,8 +8203,8 @@
       "pushed_at": "2026-09-11T23:09:27Z",
       "updated_at": "2026-04-29",
       "main_image": "lscr.io/linuxserver/pcsx2:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "gaming",
+      "category_label": "Gaming & Leisure",
       "template": "apps/pcsx2.json",
       "template_status": "generated-unvalidated",
       "content_hash": "f39a306e91011977bf55b7eb29f80307950eea0fcc56b3713a6a45cd1ce2d732",
@@ -7980,7 +8216,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-pcsx2"
     },
     {
       "id": "pdfding",
@@ -7992,7 +8229,7 @@
       "repository": "https://hub.docker.com/r/mrmn/pdfding",
       "description": "PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices. It's designed to be minimal, fast, and easy to set up using Docker.\n\nWith features like seamless browser-based PDF viewing that remembers your current position, multi-level tagging, starring and archiving functionalities, PDF editing with comments, highlighting and drawings, clean intuitive UI with dark mode, SSO support via OIDC, PDF sharing with external audience, markdown notes, and progress bars showing reading progress, PdfDing ensures an excellent PDF management experience.\n\nDeploying PdfDing on private cloud devices like self-hosted server brings unmatched convenience with multi-device access, ensuring your PDF collection is always within reach and secure, no matter where you are.\n",
       "website": "https://www.pdfding.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/pdfding.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -8016,7 +8253,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-pdfding"
     },
     {
       "id": "peanut",
@@ -8028,7 +8266,7 @@
       "repository": "https://hub.docker.com/r/brandawg93/peanut",
       "description": "PeaNUT is a web-based UPS monitoring system specifically designed for monitoring Uninterruptible Power Supplies (UPS). It provides a user-friendly interface for monitoring UPS status, battery life, and power outage notifications to ensure your systems are always protected.\n\n**Key Features:**\n- Real-time UPS status monitoring and control\n- Battery life and charge level monitoring\n- Automatic power outage notifications via email/webhook\n- Historical data logging and reporting\n- Support for various UPS manufacturers and models\n- Mobile-friendly responsive web interface for remote access\n- Configurable warning thresholds and alerts\n- Docker-based deployment for easy installation\n\n**Learn More:**\n- [PeaNUT GitHub Repository](https://github.com/brandawg93/peanut)\n",
       "website": "",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/peanut.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -8052,7 +8290,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-peanut"
     },
     {
       "id": "pelorus",
@@ -8062,7 +8301,7 @@
       "repository": "https://github.com/linuxserver/docker-pelorus",
       "description": "Pelorus is an AI navigator for Selkies-powered Linux desktops. Pelorus runs a FastAPI server that gives an LLM agent (Ollama, OpenAI-compatible, or Gemini) control over mouse, keyboard, screenshot, and window management via the Pixelflux computer-use backend, a Linux accessibility tree (AT-SPI), and optional KWin D-Bus integration.",
       "website": "https://github.com/linuxserver/pelorus",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/pelorus-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/pelorus-logo.png",
       "architectures": [
         "amd64"
       ],
@@ -8070,8 +8309,8 @@
       "pushed_at": "2026-09-07T05:58:26Z",
       "updated_at": "2026-07-19",
       "main_image": "lscr.io/linuxserver/pelorus:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "ai",
+      "category_label": "AI / Coding & Dev-Tools",
       "template": "apps/pelorus.json",
       "template_status": "generated-unvalidated",
       "content_hash": "ff9ffa5ec20c0bcb4c4edd6eb15555197d63d57e813b3c097078f0a3e05fbfe7",
@@ -8083,7 +8322,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-pelorus"
     },
     {
       "id": "petio",
@@ -8095,7 +8335,7 @@
       "repository": "https://ghcr.io/petio-team/petio",
       "description": "Petio is a third party companion app available to Plex server owners to allow their users to request, review and discover content. The app is built to appear instantly familiar and intuitive to even the most tech-agnostic users. Petio will help you manage requests from your users, connect to other third party apps such as Sonarr and Radarr, notify users when content is available and track request progress. Petio also allows users to discover media both on and off your server, quickly and easily find related content and review to leave their opinion for other users.\n\nPetio is an ongoing, forever free, always evolving project currently in alpha prototype stage and now available!\n",
       "website": "https://petio.tv",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/petio.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -8119,7 +8359,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-petio"
     },
     {
       "id": "photoprism",
@@ -8131,7 +8372,7 @@
       "repository": "https://hub.docker.com/r/photoprism/photoprism",
       "description": "Your AI-Powered Photos App for the Decentralized Web\n\nPhotoPrism brings the magic of AI to your home TV, phone, and multiple devices, revolutionizing the way you manage and share your photos. Unlike traditional photo albums that require manual organization, PhotoPrism automatically tags and finds your pictures, making it easier than ever to relive your memories. Whether you're showing family photos on your TV or sharing vacation snapshots on your phone, PhotoPrism makes the experience seamless and enjoyable.\n\nPhotoPrism offers a host of features designed to enhance your photo management experience. With powerful search capabilities, automatic tagging, and a user-friendly interface, you'll find it easy to keep your photo collection organized. The app is free to use, with premium options available for those seeking additional features and support. Users can expect a smooth, intuitive experience that blends cutting-edge technology with everyday convenience.\n\nDeploying PhotoPrism on self-hosted server private cloud devices offers unparalleled convenience. Enjoy unlimited storage capacity, the speed of your local network, and access from multiple devices without the need for the internet. It's the perfect solution for NAS enthusiasts who value privacy and performance.\n",
       "website": "https://www.photoprism.app",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/photoprism.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -8155,7 +8396,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-photoprism"
     },
     {
       "id": "phpmyadmin",
@@ -8165,7 +8407,7 @@
       "repository": "https://github.com/linuxserver/docker-phpmyadmin",
       "description": "Phpmyadmin is a free software tool written in PHP, intended to handle the administration of MySQL over the Web. phpMyAdmin supports a wide range of operations on MySQL and MariaDB.",
       "website": "https://github.com/phpmyadmin/phpmyadmin/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/phpmyadmin-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/phpmyadmin.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -8187,7 +8429,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-phpmyadmin"
     },
     {
       "id": "pidgin",
@@ -8197,7 +8440,7 @@
       "repository": "https://github.com/linuxserver/docker-pidgin",
       "description": "Pidgin is a chat program which lets you log into accounts on multiple chat networks simultaneously. This means that you can be chatting with friends on XMPP and sitting in an IRC channel at the same time.",
       "website": "https://pidgin.im/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/pidgin-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/pidgin-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -8206,8 +8449,8 @@
       "pushed_at": "2026-09-09T21:47:20Z",
       "updated_at": "2026-06-10",
       "main_image": "lscr.io/linuxserver/pidgin:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "communication",
+      "category_label": "Communication & Community",
       "template": "apps/pidgin.json",
       "template_status": "generated-unvalidated",
       "content_hash": "d8de7834c0ffd9dd7134404c079ffdd689d940368810bc575e764504b3a39d95",
@@ -8219,7 +8462,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-pidgin"
     },
     {
       "id": "pihole",
@@ -8231,7 +8475,7 @@
       "repository": "https://hub.docker.com/r/pihole/pihole",
       "description": "Pi-hole is a network-wide ad-blocking platform for Linux hardware, using DNS sinkhole technology to protect devices from unwanted content without requiring client-side software. Designed for home or enterprise networks, it offers efficient ad blocking and network optimization.\n\nCore features include network-wide ad blocking and content blocking in non-browser environments. It uses DNS sinkhole to block ads, covering mobile apps and smart TVs. Caching DNS queries speeds up everyday browsing. A command-line interface ensures interoperability with reliable control options.\n\nIt provides an intuitive web interface dashboard for viewing and managing system status. An optional DHCP server function automatically protects all devices. Capable of handling high query volumes on server-grade hardware, it supports ad blocking over IPv4 and IPv6. With efficiency and versatility at the core, the platform delivers a modern network protection solution.\n\n**Key Features:**\n- Network-wide ad blocking via DNS sinkhole technology\n- Blocking content in non-browser environments, including mobile apps and smart TVs\n- Caching DNS queries to speed up browsing\n- Command-line interface for interoperability\n- Intuitive web interface dashboard for system viewing and control\n- Optional DHCP server function for automatic device protection\n- Ad blocking support for IPv4 and IPv6\n\n**Learn More:**\n- [Pi-hole Official Website](https://pi-hole.net/)\n- [Pi-hole GitHub](https://github.com/pi-hole/pi-hole)\n",
       "website": "https://pi-hole.net/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/pi-hole.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -8255,7 +8499,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-pihole"
     },
     {
       "id": "pinchflat",
@@ -8267,7 +8512,7 @@
       "repository": "https://ghcr.io/kieraneglin/pinchflat",
       "description": "Pinchflat is a self-hosted app for downloading YouTube content built using yt-dlp. It's designed to be lightweight, self-contained, and easy to use. You set up rules for how to download content from YouTube channels or playlists and it'll do the rest, periodically checking for new content.\n\nKey features include:\n- Self-contained - just one Docker container with no external dependencies\n- Powerful naming system so content is stored where and how you want it\n- Easy-to-use web interface with presets to get you started right away\n- First-class support for media center apps like Plex, Jellyfin, and Kodi\n- Supports serving RSS feeds to your favourite podcast app\n- Automatically downloads new content from channels and playlists\n- Supports downloading audio content\n- Custom rules for handling YouTube Shorts and livestreams\n- Apprise support for notifications\n- Optionally automatically delete old content\n- Advanced options like setting cutoff dates and filtering by title\n- Reliable hands-off operation\n- Can pass cookies to YouTube to download your private playlists\n- Sponsorblock integration\n- Supports running custom scripts when after downloading/deleting media\n\nPerfect for people who want to download content for use with a media center app or for those who want to archive media!\n",
       "website": "",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/pinchflat.webp",
       "architectures": [
         "amd64"
       ],
@@ -8290,7 +8535,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-pinchflat"
     },
     {
       "id": "pingvin-share",
@@ -8302,7 +8548,7 @@
       "repository": "https://hub.docker.com/r/stonith404/pingvin-share",
       "description": "Pingvin-Share is a self-hosted file sharing application compatible with Nextcloud apps, offering a modern and intuitive web interface. It enables users to securely store, organize, and share files without relying on external cloud services. The application supports multiple authentication methods and provides features such as share links, user accounts, and a responsive interface.\n\n**Key features:**\n- Modern, responsive web interface\n- User accounts with a permission system\n- Secure share links for files\n- Drag-and-drop file upload\n- Password-protected shares\n- Multiple authentication methods\n- Docker-based deployment for easy installation\n\n**Learn more:**\n- [Pingvin-Share GitHub](https://github.com/stonith404/pingvin-share)\n",
       "website": "https://stonith404.github.io/pingvin-share/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/pingvin-share.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -8326,7 +8572,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-pingvin-share"
     },
     {
       "id": "piper",
@@ -8336,7 +8583,7 @@
       "repository": "https://github.com/linuxserver/docker-piper",
       "description": "Piper is a fast, local neural text to speech system that sounds great and is optimized for the Raspberry Pi 4. This container provides a Wyoming protocol server for Piper.",
       "website": "https://github.com/rhasspy/wyoming-piper",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/piper-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/piper-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -8345,8 +8592,8 @@
       "pushed_at": "2026-09-11T22:05:31Z",
       "updated_at": "2026-07-14",
       "main_image": "lscr.io/linuxserver/piper:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "ai",
+      "category_label": "AI / Coding & Dev-Tools",
       "template": "apps/piper.json",
       "template_status": "generated-unvalidated",
       "content_hash": "61e7e0b4a6bb0235f018a5a28fa40813092967d5f402efd94bdba47e18c01e41",
@@ -8358,7 +8605,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-piper"
     },
     {
       "id": "piwigo",
@@ -8368,7 +8616,7 @@
       "repository": "https://github.com/linuxserver/docker-piwigo",
       "description": "Piwigo is a photo gallery software for the web that comes with powerful features to publish and manage your collection of pictures.",
       "website": "http://piwigo.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/piwigo-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/piwigo.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -8377,8 +8625,8 @@
       "pushed_at": "2026-09-12T18:01:49Z",
       "updated_at": "2026-01-04",
       "main_image": "lscr.io/linuxserver/piwigo:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "media",
+      "category_label": "Media & Streaming",
       "template": "apps/piwigo.json",
       "template_status": "generated-unvalidated",
       "content_hash": "c643c6b64528ff7f9927cf22ef8bd580f67a8cb2f3c1c38bb184e247d590433d",
@@ -8390,7 +8638,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-piwigo"
     },
     {
       "id": "planka",
@@ -8400,7 +8649,7 @@
       "repository": "https://github.com/linuxserver/docker-planka",
       "description": "Planka is an elegant open source project tracking tool.",
       "website": "https://github.com/plankanban/planka/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/planka-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/planka.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -8422,7 +8671,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "linuxserver-planka"
     },
     {
       "id": "playit-agent",
@@ -8434,7 +8684,7 @@
       "repository": "https://ghcr.io/mafen/playit-docker",
       "description": "",
       "website": "https://playit.gg",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/playit-agent/icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -8445,8 +8695,8 @@
       "pushed_at": "2026-09-11T10:43:22Z",
       "updated_at": "2024-11-11",
       "main_image": "ghcr.io/mafen/playit-docker:latest",
-      "category": "network",
-      "category_label": "Network & Firewall",
+      "category": "web",
+      "category_label": "Webservers & Proxies",
       "template": "apps/playit-agent.json",
       "template_status": "generated-unvalidated",
       "content_hash": "4d71b2b20908f9c5566f3fe7243d8c856a83f6a8f6a1ed6fd2415407b34ec821",
@@ -8458,7 +8708,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-playit-agent"
     },
     {
       "id": "plex",
@@ -8468,7 +8719,7 @@
       "repository": "https://github.com/linuxserver/docker-plex",
       "description": "Plex organizes video, music and photos from personal media libraries and streams them to smart TVs, streaming boxes and mobile devices. This container is packaged as a standalone Plex Media Server. Straightforward design and bulk actions mean getting things done faster.",
       "website": "https://plex.tv",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/plex-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/plex.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -8490,7 +8741,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-plex"
     },
     {
       "id": "plex-official",
@@ -8500,7 +8752,7 @@
       "repository": "https://github.com/plexinc/pms-docker",
       "description": "Plex organizes video, music and photos from personal media libraries and streams them to smart TVs, streaming boxes and mobile devices. This container is packaged as a standalone Plex Media Server. Straightforward design and bulk actions mean getting things done faster.",
       "website": "https://www.plex.tv/media-server-downloads/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/plex-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/plex.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -8522,7 +8774,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-plex-official"
     },
     {
       "id": "pocketbase",
@@ -8534,7 +8787,7 @@
       "repository": "https://hub.docker.com/r/argonptg/pocketbase",
       "description": "PocketBase is an open-source backend solution that combines a real-time database, authentication, file storage, and an admin dashboard into a single, portable executable.",
       "website": "https://pocketbase.io",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/pocketbase.webp",
       "architectures": [
         "amd64"
       ],
@@ -8557,7 +8810,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-pocketbase"
     },
     {
       "id": "podfetch",
@@ -8569,7 +8823,7 @@
       "repository": "https://hub.docker.com/r/samuel19982/podfetch",
       "description": "PodFetch is a sleek and efficient self-hosted podcast manager written in Rust. It automatically downloads new episodes of your favorite podcasts on a configurable interval and lets you listen to them from a clean, fast web UI on any device.\n\nIts standout feature is a GPodder-compatible sync API: keep using mobile podcast apps like AntennaPod while subscriptions, episode actions, and playback positions stay in sync with your server. PodFetch also supports multi-user setups with invites and roles, playlists, favorites, OPML import and export, podcast search via iTunes or Podcast Index, and optional OIDC or basic authentication.\n",
       "website": "https://samtv12345.github.io/PodFetch/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/podfetch.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -8593,7 +8847,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-podfetch"
     },
     {
       "id": "portainer",
@@ -8605,7 +8860,7 @@
       "repository": "https://hub.docker.com/r/portainer/portainer-ce",
       "description": "Portainer Community Edition (CE) is a lightweight container management tool offering an intuitive Web interface to simplify building, managing, and monitoring containerized applications. With over 500,000 active users, it is widely appreciated for its ease of use and robust functionality, ideal for individual developers, home lab users, and small teams.\n\nThe tool's core features include multi-platform support, resource management, and real-time monitoring. It supports managing various container platforms, covering containers, images, volumes, and networks. Users can quickly create, deploy, and manage containers via a \u201csmart\u201d graphical interface or comprehensive API, without needing deep command-line expertise. It provides real-time container status monitoring, log viewing, and configuration management, ensuring efficient control over application operations.\n\nIts design philosophy is to \u201csimplify container complexity\u201d with an intuitive interface and default settings that lower the technical barrier. Users can manage containerized applications without complex configurations, saving time and boosting efficiency. It is completely free, with data stored locally, ensuring full user control. Community support via GitHub Discussions and Slack, along with rich documentation and regular updates, enhances the user experience, making it suitable for learning container technology or managing small projects.\n\n**Key Features:**\n- Intuitive Web interface for simplified containerized app management\n- Supports multiple container platforms for unified resource management\n- Real-time monitoring of container status and logs\n- Rapid container deployment and management via API\n- Community support with extensive documentation and assistance\n\n**Learn More:**\n- [Portainer Official Website](https://www.portainer.io/)\n- [Portainer GitHub Repository](https://github.com/portainer/portainer)\n",
       "website": "https://www.portainer.io/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/portainer.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -8629,7 +8884,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "image-portainer"
     },
     {
       "id": "postgresql",
@@ -8641,7 +8897,7 @@
       "repository": "https://hub.docker.com/_/postgres",
       "description": "PostgreSQL is a powerful, open source object-relational database system with over 35 years of active development that has earned it a strong reputation for reliability, feature robustness, and performance.\n\nPostgreSQL is a highly stable database backed by more than 20 years of development by the open-source community.\n\nPostgreSQL is used as a primary database for many web applications as well as mobile and analytics applications.\n",
       "website": "https://www.postgresql.org",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/postgresql.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -8665,7 +8921,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-postgresql"
     },
     {
       "id": "ppsspp",
@@ -8675,7 +8932,7 @@
       "repository": "https://github.com/linuxserver/docker-ppsspp",
       "description": "PPSSPP is a free and open-source PSP emulator for Windows, macOS, Linux, iOS, Android, Nintendo Wii U, Nintendo Switch, BlackBerry 10, MeeGo, Pandora, Xbox Series and Symbian with a focus on speed and portability.",
       "website": "https://www.ppsspp.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ppsspp-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/ppsspp-logo.png",
       "architectures": [
         "amd64"
       ],
@@ -8683,8 +8940,8 @@
       "pushed_at": "2026-09-08T13:01:28Z",
       "updated_at": "2026-01-12",
       "main_image": "lscr.io/linuxserver/ppsspp:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "gaming",
+      "category_label": "Gaming & Leisure",
       "template": "apps/ppsspp.json",
       "template_status": "generated-unvalidated",
       "content_hash": "227432244de320131318616f1f4395ba37fa6e3e766b5f05ddba66a10a31eca8",
@@ -8696,7 +8953,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-ppsspp"
     },
     {
       "id": "projectsend",
@@ -8706,7 +8964,7 @@
       "repository": "https://github.com/linuxserver/docker-projectsend",
       "description": "Projectsend is a self-hosted application that lets you upload files and assign them to specific clients that you create yourself. Secure, private and easy. No more depending on external services or e-mail to send those files.",
       "website": "http://www.projectsend.org",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/projectsend-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/projectsend.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -8728,7 +8986,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-projectsend"
     },
     {
       "id": "prowlarr",
@@ -8738,7 +8997,7 @@
       "repository": "https://github.com/linuxserver/docker-prowlarr",
       "description": "Prowlarr is a indexer manager/proxy built on the popular arr .net/reactjs base stack to integrate with your various PVR apps. Prowlarr supports both Torrent Trackers and Usenet Indexers. It integrates seamlessly with Sonarr, Radarr, Lidarr, and Readarr offering complete management of your indexers with no per app Indexer setup required (we do it all).",
       "website": "https://github.com/Prowlarr/Prowlarr",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/prowlarr-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/prowlarr.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -8760,7 +9019,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-prowlarr"
     },
     {
       "id": "psitransfer",
@@ -8772,7 +9032,7 @@
       "repository": "https://hub.docker.com/r/psitrax/psitransfer",
       "description": "PsiTransfer is a simple, self-hosted open-source file sharing service that allows you to share files securely and easily without registration.\n\n**Key Features:**\n- **No Registration Required:** Share files instantly without creating an account.\n- **Privacy and Control:** All files are stored on your own server, giving you complete control over your data.\n- **Password Protection:** Protect shared files with a password for enhanced security.\n- **Upload Expiry:** Set uploaded files to automatically expire after a specific time to save storage space.\n- **Admin Panel:** Manage all uploads through a clean admin panel.\n- **Delivery Target:** Send files to predefined email addresses (configuration required).\n- **Responsive Web Interface:** Clean and user-friendly interface that works perfectly on all devices.\n\n**Learn More:**\n- [PsiTransfer GitHub Repository](https://github.com/psi-4ward/psitransfer)\n",
       "website": "",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/psitransfer.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -8796,7 +9056,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-psitransfer"
     },
     {
       "id": "pwndrop",
@@ -8806,7 +9067,7 @@
       "repository": "https://github.com/linuxserver/docker-pwndrop",
       "description": "Pwndrop is a self-deployable file hosting service for sending out red teaming payloads or securely sharing your private files over HTTP and WebDAV.",
       "website": "https://github.com/kgretzky/pwndrop",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/pwndrop-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/pwndrop.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -8815,8 +9076,8 @@
       "pushed_at": "2026-09-07T20:21:35Z",
       "updated_at": "2026-07-17",
       "main_image": "lscr.io/linuxserver/pwndrop:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "downloads",
+      "category_label": "Files & Downloads",
       "template": "apps/pwndrop.json",
       "template_status": "generated-unvalidated",
       "content_hash": "afec8b0e1bd578f48d19b933f282cb72332d16fdc686c56a28bad592f899e29a",
@@ -8828,7 +9089,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-pwndrop"
     },
     {
       "id": "pycharm",
@@ -8838,7 +9100,7 @@
       "repository": "https://github.com/linuxserver/docker-pycharm",
       "description": "PyCharm offers out-of-the-box support for Python, databases, Jupyter, Git, Conda, PyTorch, TensorFlow, Hugging Face, Django, Flask, FastAPI, and more.",
       "website": "https://www.jetbrains.com/pycharm/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/pycharm-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/pycharm-logo.png",
       "architectures": [
         "amd64"
       ],
@@ -8846,8 +9108,8 @@
       "pushed_at": "2026-09-11T19:59:37Z",
       "updated_at": "2026-04-04",
       "main_image": "lscr.io/linuxserver/pycharm:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "ai",
+      "category_label": "AI / Coding & Dev-Tools",
       "template": "apps/pycharm.json",
       "template_status": "generated-unvalidated",
       "content_hash": "cee5e3c89d3d1163905746bc5bc1b88d66217be8df400dbfb424b6e7b7a09832",
@@ -8859,7 +9121,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-pycharm"
     },
     {
       "id": "pydio-cells",
@@ -8869,7 +9132,7 @@
       "repository": "https://github.com/linuxserver/docker-pydio-cells",
       "description": "Pydio-cells is the nextgen file sharing platform for organizations. It is a full rewrite of the Pydio project using the Go language following a micro-service architecture.",
       "website": "https://pydio.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/pydio-cells-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/pydio-cells-icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -8878,8 +9141,8 @@
       "pushed_at": "2026-08-27T14:24:17Z",
       "updated_at": "2026-07-17",
       "main_image": "lscr.io/linuxserver/pydio-cells:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "downloads",
+      "category_label": "Files & Downloads",
       "template": "apps/pydio-cells.json",
       "template_status": "generated-unvalidated",
       "content_hash": "e1a803957605720af4dabadb265f5455d75ed37e2b3b0c254c34844fae14dbb4",
@@ -8891,7 +9154,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-pydio-cells"
     },
     {
       "id": "pyload-ng",
@@ -8901,7 +9165,7 @@
       "repository": "https://github.com/linuxserver/docker-pyload-ng",
       "description": "pyLoad is a Free and Open Source download manager written in Python and designed to be extremely lightweight, easily extensible and fully manageable via web.",
       "website": "https://pyload.net/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/pyload-ng-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/pyload-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -8910,8 +9174,8 @@
       "pushed_at": "2026-09-11T22:03:25Z",
       "updated_at": "2026-01-09",
       "main_image": "lscr.io/linuxserver/pyload-ng:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "downloads",
+      "category_label": "Files & Downloads",
       "template": "apps/pyload-ng.json",
       "template_status": "generated-unvalidated",
       "content_hash": "49914b770ad2514abff6e8308954e7c31b8aa76fbba583c10858741fbaf72aa9",
@@ -8923,7 +9187,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-pyload-ng"
     },
     {
       "id": "qbittorrent",
@@ -8933,7 +9198,7 @@
       "repository": "https://github.com/linuxserver/docker-qbittorrent",
       "description": "",
       "website": null,
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/qbittorrent-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/qbittorrent.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -8955,7 +9220,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-qbittorrent"
     },
     {
       "id": "qbittorrent-hotio",
@@ -8967,7 +9233,7 @@
       "repository": "https://ghcr.io/hotio/qbittorrent",
       "description": "**Elevate Your Home Media Experience**. qBittorrent transforms your home media setup with a polished interface reminiscent of \u00b5Torrent, minus the ads. Unlike traditional download tools, it offers a streamlined, efficient, and ad-free experience. This makes it a perfect fit for those seeking a hassle-free way to manage and enjoy their media collections at home.\n\n**Feature-Rich and User-Friendly**. With qBittorrent, you gain access to a well-integrated and extensible search engine, allowing simultaneous searches across multiple torrent sites, and category-specific searches for books, music, and software. Its support for RSS feeds with advanced filters, magnet links, encrypted connections, and more, ensures you have complete control over your downloads. Available on all major platforms and in around 70 languages, qBittorrent is both versatile and accessible.\n\n**Seamless Integration with Private Clouds like self-hosted server**. Deploying qBittorrent on private cloud devices such as self-hosted server offers unparalleled convenience. Enjoy virtually unlimited storage, enhanced privacy for your data, and local network speeds that make downloading and streaming effortless. This setup ensures that your media library is always at your fingertips, securely and swiftly.\n",
       "website": "https://www.qbittorrent.org",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/qbittorrent.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -8991,7 +9257,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-qbittorrent-hotio"
     },
     {
       "id": "qdirstat",
@@ -9001,7 +9268,7 @@
       "repository": "https://github.com/linuxserver/docker-qdirstat",
       "description": "QDirStat Qt-based directory statistics: KDirStat without any KDE -- from the author of the original KDirStat.",
       "website": "https://github.com/shundhammer/qdirstat",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/qdirstat-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/qdirstat.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -9010,8 +9277,8 @@
       "pushed_at": "2026-09-06T22:49:49Z",
       "updated_at": "2026-04-19",
       "main_image": "lscr.io/linuxserver/qdirstat:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "tools",
+      "category_label": "Tools",
       "template": "apps/qdirstat.json",
       "template_status": "generated-unvalidated",
       "content_hash": "46b5bab0e4c9df729f8f0ba94d68ae7014287556ea24b575599964877c9a849f",
@@ -9023,7 +9290,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-qdirstat"
     },
     {
       "id": "qui",
@@ -9035,7 +9303,7 @@
       "repository": "https://ghcr.io/autobrr/qui",
       "description": "**One dashboard for all your qBittorrent instances.** Qui is a fast, modern web interface for qBittorrent. Instead of juggling several separate WebUI tabs, you connect every qBittorrent instance to Qui and manage them all from a single, responsive dashboard. It ships as a lightweight single binary, so it stays quick and resource-friendly even when you are watching thousands of torrents.\n\n**Automation and cross-seeding built in.** Built by the team behind autobrr, Qui goes well beyond basic torrent listing. It adds powerful rule-based automation, built-in cross-seeding that automatically finds and adds matching torrents across your trackers, scheduled backups with restore, and a clean multi-language interface. Point it at your Torznab-compatible indexers \u2014 such as Prowlarr or Jackett \u2014 to put cross-seeding on autopilot, then filter, search, and bulk-manage torrents across every instance at once.\n\n**Made for your private cloud.** Running Qui on a private cloud device like self-hosted server keeps everything in one place on hardware you control. Pair it with your qBittorrent containers for local-network speeds, full ownership of your data, and a single tidy interface for your entire download stack \u2014 accessible from any device in your home.\n",
       "website": "https://getqui.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/qui.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -9059,7 +9327,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-qui"
     },
     {
       "id": "radarr",
@@ -9069,7 +9338,7 @@
       "repository": "https://github.com/linuxserver/docker-radarr",
       "description": "Radarr - A fork of Sonarr to work with movies \u00e0 la Couchpotato.",
       "website": "https://github.com/Radarr/Radarr",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/radarr-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/radarr.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -9091,7 +9360,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-radarr"
     },
     {
       "id": "ragflow",
@@ -9103,7 +9373,7 @@
       "repository": "https://hub.docker.com/r/icewhaletech/ragflow",
       "description": "RagFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding. It enables users to build their own private ChatGPT by leveraging the power of large language models and deep document parsing capabilities. RagFlow supports various document formats including PDF, Word, Markdown, and more, allowing users to create intelligent question-answering systems based on their own documents.\n\n**Key Features:**\n- Deep document understanding with advanced parsing capabilities\n- Support for multiple document formats (PDF, Word, Markdown, etc.)\n- Private knowledge base with data security assurance\n- Customizable RAG workflows for different use cases\n- Integration with popular large language models\n- Web-based interface for easy management and interaction\n\n**Hardware Requirements:**\n- CPU >= 4 cores\n- RAM >= 16 GB\n- Disk >= 50 GB\n\n**Learn More:**\n- [RagFlow Official Website](https://ragflow.io)\n- [RagFlow GitHub Repository](https://github.com/infiniflow/ragflow)\n",
       "website": "https://ragflow.io",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/RagFlow/icon.png",
       "architectures": [
         "amd64"
       ],
@@ -9132,7 +9402,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "image-ragflow"
     },
     {
       "id": "raneto",
@@ -9142,7 +9413,7 @@
       "repository": "https://github.com/linuxserver/docker-raneto",
       "description": "Raneto - is an open source Knowledgebase platform that uses static Markdown files to power your Knowledgebase.",
       "website": "http://raneto.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/raneto-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/raneto.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -9151,8 +9422,8 @@
       "pushed_at": "2026-09-12T23:38:17Z",
       "updated_at": "2025-09-16",
       "main_image": "lscr.io/linuxserver/raneto:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "documents",
+      "category_label": "Documents & Notes",
       "template": "apps/raneto.json",
       "template_status": "generated-unvalidated",
       "content_hash": "1aba7fd8cb7a3b7a48453a6b3b2451feeb0ce06df30881f553f0e53737063d39",
@@ -9164,7 +9435,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-raneto"
     },
     {
       "id": "rawtherapee",
@@ -9174,7 +9446,7 @@
       "repository": "https://github.com/linuxserver/docker-rawtherapee",
       "description": "RawTherapee is a free, cross-platform raw image processing program!",
       "website": "https://rawtherapee.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/rawtherapee-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/rawtherapee-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -9183,8 +9455,8 @@
       "pushed_at": "2026-09-13T07:59:19Z",
       "updated_at": "2026-07-26",
       "main_image": "lscr.io/linuxserver/rawtherapee:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "creative",
+      "category_label": "Creative & Design",
       "template": "apps/rawtherapee.json",
       "template_status": "generated-unvalidated",
       "content_hash": "dea13f85c5b83b7a2415dc74f9238c9b4fcbda5bb7467bbe2ede999279d57fd6",
@@ -9196,7 +9468,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-rawtherapee"
     },
     {
       "id": "rclone",
@@ -9206,7 +9479,7 @@
       "repository": "https://github.com/rclone/rclone",
       "description": "Official Rclone image adapted as a native Proxmox OCI LXC with persistent configuration, authenticated WebUI and optional FUSE publication for other LXCs.",
       "website": "https://rclone.org/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/rclone.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -9228,7 +9501,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": true,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-rclone"
     },
     {
       "id": "rdtclient",
@@ -9240,7 +9514,7 @@
       "repository": "https://hub.docker.com/r/rogerfar/rdtclient",
       "description": "",
       "website": "",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/rdt-client.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -9264,7 +9538,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-rdtclient"
     },
     {
       "id": "readarr",
@@ -9276,7 +9551,7 @@
       "repository": "https://hub.docker.com/r/linuxserver/readarr",
       "description": "Readarr is a ebook collection manager for Usenet and BitTorrent users. It can monitor multiple RSS feeds for new books from your favorite authors and will interface with clients and indexers to grab, sort, and rename them.",
       "website": "https://readarr.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/readarr.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -9300,7 +9575,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "image-readarr"
     },
     {
       "id": "remmina",
@@ -9310,7 +9586,7 @@
       "repository": "https://github.com/linuxserver/docker-remmina",
       "description": "Remmina is a remote desktop client written in GTK, aiming to be useful for system administrators and travellers, who need to work with lots of remote computers in front of either large or tiny screens. Remmina supports multiple network protocols, in an integrated and consistent user interface. Currently RDP, VNC, SPICE, SSH and EXEC are supported.",
       "website": "https://remmina.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/remmina-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/remmina.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -9319,8 +9595,8 @@
       "pushed_at": "2026-09-09T18:26:31Z",
       "updated_at": "2026-06-20",
       "main_image": "lscr.io/linuxserver/remmina:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "remote",
+      "category_label": "Remote Access & VPN",
       "template": "apps/remmina.json",
       "template_status": "generated-unvalidated",
       "content_hash": "fd2a7694158b46d8e4736753c0b917a6c2d363940473d9ceca338b8172766191",
@@ -9332,7 +9608,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-remmina"
     },
     {
       "id": "resilio-sync",
@@ -9342,7 +9619,7 @@
       "repository": "https://github.com/linuxserver/docker-resilio-sync",
       "description": "Resilio-sync (formerly BitTorrent Sync) uses the BitTorrent protocol to sync files and folders between all of your devices. There are both free and paid versions, this container supports both. There is an official sync image but we created this one as it supports user mapping to simplify permissions for volumes.",
       "website": "https://www.resilio.com/individuals/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/resilio-sync-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/resilio-sync.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -9351,8 +9628,8 @@
       "pushed_at": "2026-09-08T01:30:09Z",
       "updated_at": "2024-08-21",
       "main_image": "lscr.io/linuxserver/resilio-sync:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "downloads",
+      "category_label": "Files & Downloads",
       "template": "apps/resilio-sync.json",
       "template_status": "generated-unvalidated",
       "content_hash": "d14178b19b3d372d6c8eb0f049468b04236f5d09ed6145dc0e558c021fcf2731",
@@ -9364,7 +9641,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-resilio-sync"
     },
     {
       "id": "retroarch",
@@ -9374,7 +9652,7 @@
       "repository": "https://github.com/linuxserver/docker-retroarch",
       "description": "RetroArch is a frontend for emulators, game engines and media players. It enables you to run classic games on a wide range of computers and consoles through its slick graphical interface.",
       "website": "https://retroarch.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/retroarch-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/RetroArch/icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -9383,8 +9661,8 @@
       "pushed_at": "2026-09-13T18:17:52Z",
       "updated_at": "2026-04-19",
       "main_image": "lscr.io/linuxserver/retroarch:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "gaming",
+      "category_label": "Gaming & Leisure",
       "template": "apps/retroarch.json",
       "template_status": "generated-unvalidated",
       "content_hash": "e0c34aa3121f19cb4b9c09acd78d3c0c88689ef1cd6c632b05cccc042b643a46",
@@ -9396,7 +9674,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-retroarch"
     },
     {
       "id": "retroarch-inglebard",
@@ -9408,7 +9687,7 @@
       "repository": "https://hub.docker.com/r/inglebard/retroarch-web",
       "description": "RetroArch-web is a web-based classic game emulator that enables users to enjoy a wide range of retro games directly in modern browsers. Supporting platforms like GBA, N64, DOS games, and NES (FC), it brings nostalgic gaming to life. Built on the open-source RetroArch project, RetroArch-web delivers robust features, including high-quality graphics rendering, audio processing, input controls, and save/load game progress, ensuring a precise and smooth emulation experience.\n\nDesigned for ease of use, RetroArch-web requires no complex software installation, running seamlessly in browsers. Its flexible configuration options let users customize controller setups, visual filters, and audio settings to suit individual preferences. With broad cross-platform compatibility, it ensures stable performance across devices, offering retro gaming enthusiasts a consistent experience on the go.\n\nBacked by an active open-source community, RetroArch-web continually improves performance and expands supported game platforms. Whether revisiting classic arcade titles or exploring vintage console games, RetroArch-web stands out as the ideal choice for retro gamers, combining powerful emulation with a user-friendly interface.\n\n**Key Features:**\n- Polished interface for browsing game collections with thumbnails and animated backgrounds\n- Supports multiple emulators and game engines for running classic games and discs\n- Next-frame response time for near-native hardware low-latency experience\n- Highly configurable settings to tweak game performance and display options\n- Automatic controller configuration for easy multiplayer gaming\n- Shaders to enhance old game rendering and mimic CRT monitor effects\n- Netplay for multiplayer gaming and spectator mode\n- Achievements system to unlock trophies and badges in classic games\n- Recording and streaming for capturing gameplay or live streaming\n\n**Learn More:**\n- [RetroArch Official Website](https://www.retroarch.com)\n- [RetroArch GitHub Repository](https://github.com/libretro/RetroArch)\n",
       "website": "https://www.retroarch.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/RetroArch/icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -9419,8 +9698,8 @@
       "pushed_at": "2026-09-11T10:43:22Z",
       "updated_at": "2025-11-20",
       "main_image": "inglebard/retroarch-web:latest",
-      "category": "media",
-      "category_label": "Media & Streaming",
+      "category": "gaming",
+      "category_label": "Gaming & Leisure",
       "template": "apps/retroarch-inglebard.json",
       "template_status": "generated-unvalidated",
       "content_hash": "209fd5aa52427c27557a53cc14fc3384673418a74bf3db42f8a4c203cf2421a6",
@@ -9432,7 +9711,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-retroarch-inglebard"
     },
     {
       "id": "romm",
@@ -9444,7 +9724,7 @@
       "repository": "https://hub.docker.com/r/rommapp/romm",
       "description": "RomM is a self-hosted game collection management app designed for emulator enthusiasts, offering a convenient way to scan, enrich, browse, and play games. Its responsive Web interface allows users to manage collections via any modern browser, supporting over 400 platforms, ideal for retro gaming fans building personal game libraries.\n\nThe app's core features include robust library management and seamless gameplay. It fetches metadata from IGDB, Screenscraper, and MobyGames, and custom artwork from SteamGridDB, enhancing the visual appeal of collections. Users can play games directly in the browser using EmulatorJS and RuffleRS, with support for multi-disk games, DLCs, patches, and manuals. It also enables parsing and filtering by filename tags for tailored organization. Additionally, it supports multi-user accounts with limited access permissions, allowing library sharing with friends and displaying RetroAchievements.\n\nIt can be flexibly deployed on personal servers or NAS devices, with official apps for Playnite and muOS enhancing cross-device access. Users can upload, update, or delete games via the Web interface, with community support documentation expanding functionality. Whether managing a personal retro game library or sharing with others, the app's intuitive interface and high customizability deliver a modern game management platform, meeting diverse needs.\n\n**Key Features:**\n- Scan and enhance your game library with metadata from IGDB, Screenscraper and MobyGames\n- Fetch custom artwork from SteamGridDB\n- Display your achievements from Retroachievements\n- Metadata available for 400+ platforms\n- Play games directly from the browser using EmulatorJS and RuffleRS\n- Share your library with friends with limited access and permissions\n- Official apps for Playnite and muOS\n- Supports multi-disk games, DLCs, mods, hacks, patches, and manuals\n- Parse and filter by tags in filenames\n- View, upload, update, and delete games from any modern web browser\n\n**Learn More:**\n- [RomM Official Website](https://romm.app)\n- [RomM GitHub Repository](https://github.com/rommapp/romm)\n",
       "website": "https://romm.app",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/romm.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -9468,7 +9748,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-romm"
     },
     {
       "id": "roonserver",
@@ -9478,7 +9759,7 @@
       "repository": "https://ghcr.io/roonlabs/roonserver",
       "description": "Roon music software transforms your listening experience with rich metadata, discovery features, and audiophile sound. It works with streaming services and local files.\n\nRoon brings all your music together and adds bios, reviews, photos, lyrics, tour dates, and cross-linked credits for performers, songwriters, producers, engineers, and composers. Everything about music - browsing, discovery, collecting, and listening - is more engaging with Roon.\n\nRoonServer is the central server component. It runs on a Linux amd64/x86_64 host, stores the Roon database and settings, and serves your library to Roon Remote clients and audio endpoints on your local network. It is controlled from the Roon app and does not provide a browser-based WebUI.\n",
       "website": "https://roon.app",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/RoonServer/icon.png",
       "architectures": [
         "amd64"
       ],
@@ -9501,7 +9782,8 @@
       "requires_relaxed_confinement": true,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": true,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-roonserver"
     },
     {
       "id": "rpcs3",
@@ -9511,7 +9793,7 @@
       "repository": "https://github.com/linuxserver/docker-rpcs3",
       "description": "RPCS3 is a multi-platform open-source Sony PlayStation 3 emulator and debugger written in C++ for Windows, Linux, macOS and FreeBSD.",
       "website": "https://rpcs3.net/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/rpcs3-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/rpcs3-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -9520,8 +9802,8 @@
       "pushed_at": "2026-09-13T18:49:58Z",
       "updated_at": "2026-07-30",
       "main_image": "lscr.io/linuxserver/rpcs3:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "gaming",
+      "category_label": "Gaming & Leisure",
       "template": "apps/rpcs3.json",
       "template_status": "generated-unvalidated",
       "content_hash": "6ddb459ac6d44627cdfd1f125c9d24ec751661792c6a724c2678d1e2985b5570",
@@ -9533,7 +9815,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-rpcs3"
     },
     {
       "id": "rsnapshot",
@@ -9543,7 +9826,7 @@
       "repository": "https://github.com/linuxserver/docker-rsnapshot",
       "description": "Rsnapshot is a filesystem snapshot utility based on rsync. rsnapshot makes it easy to make periodic snapshots of local machines, and remote machines over ssh. The code makes extensive use of hard links whenever possible, to greatly reduce the disk space required.",
       "website": "http://www.rsnapshot.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/rsnapshot-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/rsnapshot-icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -9552,8 +9835,8 @@
       "pushed_at": "2026-09-10T09:13:39Z",
       "updated_at": "2025-02-01",
       "main_image": "lscr.io/linuxserver/rsnapshot:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "backup",
+      "category_label": "Backup & Recovery",
       "template": "apps/rsnapshot.json",
       "template_status": "generated-unvalidated",
       "content_hash": "5bfeb5cce3e9da1e47be019fc4ddff9842e33fd0c118436ebc6c470010797fb3",
@@ -9565,7 +9848,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-rsnapshot"
     },
     {
       "id": "rustdesk",
@@ -9575,7 +9859,7 @@
       "repository": "https://github.com/linuxserver/docker-rustdesk",
       "description": "RustDesk is a full-featured open source remote control alternative for self-hosting and security with minimal configuration.",
       "website": "https://rustdesk.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/rustdesk-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/rustdesk.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -9584,8 +9868,8 @@
       "pushed_at": "2026-09-10T18:43:55Z",
       "updated_at": "2026-04-04",
       "main_image": "lscr.io/linuxserver/rustdesk:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "remote",
+      "category_label": "Remote Access & VPN",
       "template": "apps/rustdesk.json",
       "template_status": "generated-unvalidated",
       "content_hash": "09d90aa1f7c7e02bdc3a632cb19258b25f5ff04e7254ff965f12492b94dd8e44",
@@ -9597,7 +9881,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-rustdesk"
     },
     {
       "id": "sabnzbd",
@@ -9607,7 +9892,7 @@
       "repository": "https://github.com/linuxserver/docker-sabnzbd",
       "description": "Sabnzbd makes Usenet as simple and streamlined as possible by automating everything we can. All you have to do is add an .nzb. SABnzbd takes over from there, where it will be automatically downloaded, verified, repaired, extracted and filed away with zero human interaction.",
       "website": "http://sabnzbd.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/sabnzbd-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/sabnzbd.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -9629,7 +9914,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-sabnzbd"
     },
     {
       "id": "scummvm",
@@ -9639,7 +9925,7 @@
       "repository": "https://github.com/linuxserver/docker-scummvm",
       "description": "ScummVM is a program which allows you to run certain classic graphical adventure and role-playing games, provided you already have their data files. The clever part about this: ScummVM just replaces the executables shipped with the games, allowing you to play them on systems for which they were never designed! ScummVM is a complete rewrite of these games' executables and is not an emulator.",
       "website": "https://www.scummvm.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/scummvm-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/scummvm-logo.png",
       "architectures": [
         "amd64"
       ],
@@ -9647,8 +9933,8 @@
       "pushed_at": "2026-09-09T22:29:59Z",
       "updated_at": "2026-06-20",
       "main_image": "lscr.io/linuxserver/scummvm:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "gaming",
+      "category_label": "Gaming & Leisure",
       "template": "apps/scummvm.json",
       "template_status": "generated-unvalidated",
       "content_hash": "b00474648ab3e217e8e305a357aa2873601ac23c629bc912b52e8e96d386b865",
@@ -9660,7 +9946,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": true,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-scummvm"
     },
     {
       "id": "sealskin",
@@ -9670,7 +9957,7 @@
       "repository": "https://github.com/linuxserver/docker-sealskin",
       "description": "Sealskin is a self-hosted, client-server platform that enables users to run powerful, containerized desktop applications streamed directly to a web browser. It uses a browser extension to intercept user actions\u2014such as clicking a link or downloading a file and redirects them to a secure, isolated application environment running on a remote server.",
       "website": "https://github.com/selkies-project/sealskin/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/sealskin-icon.png",
+      "icon": null,
       "architectures": [
         "amd64",
         "arm64"
@@ -9679,8 +9966,8 @@
       "pushed_at": "2026-09-11T18:38:38Z",
       "updated_at": "2026-09-05",
       "main_image": "lscr.io/linuxserver/sealskin:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "desktop",
+      "category_label": "Browsers & Web Desktops",
       "template": "apps/sealskin.json",
       "template_status": "generated-unvalidated",
       "content_hash": "ab76d53eea89231efa385f759751c1c72300d5955af35ee90e745a72140cd40b",
@@ -9692,7 +9979,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "linuxserver-sealskin"
     },
     {
       "id": "seerr",
@@ -9702,7 +9990,7 @@
       "repository": "https://github.com/seerr-team/seerr",
       "description": "Media discovery and request management for Jellyfin, Plex and Emby.",
       "website": "https://docs.seerr.dev/getting-started/docker/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/seerr.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -9724,7 +10012,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-seerr"
     },
     {
       "id": "shadps4",
@@ -9734,7 +10023,7 @@
       "repository": "https://github.com/linuxserver/docker-shadps4",
       "description": "shadPS4 is an early PlayStation 4 emulator for Windows, Linux and macOS written in C++.",
       "website": "https://shadps4.net/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/shadps4-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/shadps4-logo.png",
       "architectures": [
         "amd64"
       ],
@@ -9742,8 +10031,8 @@
       "pushed_at": "2026-09-12T09:53:43Z",
       "updated_at": "2026-02-25",
       "main_image": "lscr.io/linuxserver/shadps4:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "gaming",
+      "category_label": "Gaming & Leisure",
       "template": "apps/shadps4.json",
       "template_status": "generated-unvalidated",
       "content_hash": "267bb1e36ed9cd607f8c27432e74f7801d52da1b18b08f675842269e1c121654",
@@ -9755,7 +10044,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-shadps4"
     },
     {
       "id": "shotcut",
@@ -9765,7 +10055,7 @@
       "repository": "https://github.com/linuxserver/docker-shotcut",
       "description": "Shotcut is a free, open source, cross-platform video editor.",
       "website": "https://www.shotcut.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/shotcut-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/shotcut-logo.png",
       "architectures": [
         "amd64"
       ],
@@ -9773,8 +10063,8 @@
       "pushed_at": "2026-09-09T07:50:00Z",
       "updated_at": "2026-03-30",
       "main_image": "lscr.io/linuxserver/shotcut:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "creative",
+      "category_label": "Creative & Design",
       "template": "apps/shotcut.json",
       "template_status": "generated-unvalidated",
       "content_hash": "e97c11387cb6fcb482c2c5116cb49a5a4ca6be585193de71b0783911b5ed8dc1",
@@ -9786,7 +10076,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-shotcut"
     },
     {
       "id": "sickchill",
@@ -9798,7 +10089,7 @@
       "repository": "https://hub.docker.com/r/linuxserver/sickchill",
       "description": "SickChill is an automatic Video Library Manager for TV Shows. It watches for new episodes of your favorite shows, and when they are posted it does its magic: automatic torrent/nzb searching, downloading, and processing at the qualities you want.\n",
       "website": "https://sickchill.github.io",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/sickchill.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -9822,7 +10113,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-sickchill"
     },
     {
       "id": "sickgear",
@@ -9832,7 +10124,7 @@
       "repository": "https://github.com/linuxserver/docker-sickgear",
       "description": "SickGear provides management of TV shows and/or Anime, it detects new episodes, links downloader apps, and more..",
       "website": "https://github.com/sickgear/sickgear",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/sickgear-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/sickgear.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -9841,8 +10133,8 @@
       "pushed_at": "2026-09-11T00:20:14Z",
       "updated_at": "2025-07-09",
       "main_image": "lscr.io/linuxserver/sickgear:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "arr",
+      "category_label": "*Arr Suite",
       "template": "apps/sickgear.json",
       "template_status": "generated-unvalidated",
       "content_hash": "09946081c57eaddf709c81a6119f7051d63920cb3b2cdb379bd57dfcf17cd4a1",
@@ -9854,7 +10146,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-sickgear"
     },
     {
       "id": "signal",
@@ -9864,7 +10157,7 @@
       "repository": "https://github.com/linuxserver/docker-signal",
       "description": "Signal is a messaging app with privacy at its core. It is free and easy to use, with strong end-to-end encryption that keeps your communication completely private.",
       "website": "https://signal.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/signal-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/signal.webp",
       "architectures": [
         "amd64"
       ],
@@ -9872,8 +10165,8 @@
       "pushed_at": "2026-09-12T10:05:22Z",
       "updated_at": "2026-04-04",
       "main_image": "lscr.io/linuxserver/signal:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "communication",
+      "category_label": "Communication & Community",
       "template": "apps/signal.json",
       "template_status": "generated-unvalidated",
       "content_hash": "4e8fd61dbd630a87807b297be546c72795caf6703ffa579f3c490b53f7a23f92",
@@ -9885,7 +10178,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-signal"
     },
     {
       "id": "siyuan-note",
@@ -9897,7 +10191,7 @@
       "repository": "https://hub.docker.com/r/b3log/siyuan",
       "description": "Experience Seamless Knowledge Management with SiYuan. SiYuan redefines knowledge management by seamlessly integrating with your home TV, mobile devices, and other platforms. Unlike traditional knowledge systems, SiYuan offers a cohesive and flexible environment that adapts to your lifestyle, allowing you to access and organize information effortlessly across all your devices. Whether you are a creator or a regular consumer, SiYuan's innovative approach ensures your knowledge is always at your fingertips.\n\nPowerful Features, Minimal Cost. SiYuan stands out with its robust set of features, most of which are free, even for commercial use. Enjoy block-level referencing, two-way links, custom attributes, SQL query embeds, and the unique protocol siyuan://. The editor supports block-style, markdown WYSIWYG, list outlines, and block zoom-in. Handle large documents with ease and include mathematical formulas, charts, flowcharts, and more. Capture web content, annotate PDFs, and export in various formats including Markdown, PDF, Word, and HTML. SiYuan also offers AI-powered writing and Q/A chat via OpenAI API, Tesseract OCR, and multi-tab support for a comprehensive and seamless experience.\n\nUnlimited Storage, Local Speed, Multi-Device Access. Deploying Alist on self-hosted server private cloud devices brings unparalleled convenience. Enjoy unlimited storage, blazing-fast local network speeds, and access from multiple devices. This setup ensures that your data is always available, secure, and quickly accessible, providing a superior alternative to traditional cloud services.\n",
       "website": "https://b3log.org/siyuan/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/Siyuan-Note/icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -9921,7 +10215,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-siyuan-note"
     },
     {
       "id": "smokeping",
@@ -9931,7 +10226,7 @@
       "repository": "https://github.com/linuxserver/docker-smokeping",
       "description": "Smokeping keeps track of your network latency. For a full example of what this application is capable of visit UCDavis.",
       "website": "https://oss.oetiker.ch/smokeping/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/smokeping-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/smokeping.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -9940,8 +10235,8 @@
       "pushed_at": "2026-09-08T23:14:48Z",
       "updated_at": "2025-12-17",
       "main_image": "lscr.io/linuxserver/smokeping:latest",
-      "category": "network",
-      "category_label": "Network & Firewall",
+      "category": "monitoring",
+      "category_label": "Monitoring & Analytics",
       "template": "apps/smokeping.json",
       "template_status": "generated-unvalidated",
       "content_hash": "69336f4b056f9013342f83aee1941a4f4024b5d7e1cf6a82662588a0928a56d7",
@@ -9953,7 +10248,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-smokeping"
     },
     {
       "id": "snapdrop",
@@ -9965,7 +10261,7 @@
       "repository": "https://hub.docker.com/r/linuxserver/snapdrop",
       "description": "Snapdrop is a Progressive Web App (PWA) that allows you to transfer files between devices in the same network without having to install anything.",
       "website": "https://snapdrop.net",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/snapdrop.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -9989,7 +10285,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-snapdrop"
     },
     {
       "id": "snapotter",
@@ -10001,7 +10298,7 @@
       "repository": "https://hub.docker.com/r/snapotter/snapotter",
       "description": "SnapOtter is an open-source, self-hosted file manipulation suite with 200+ tools across images, video, audio, PDFs, and files. It includes batch processing, reusable pipelines, local AI tools, a browser image editor, and a REST API so files stay on your own server.\n\nThis package uses SnapOtter's single-container embedded mode for an easy self-hosted server install. PostgreSQL 17 and Redis 8 run inside the container when DATABASE_URL and REDIS_URL are left unset, with persistent data stored under /data.\n\nDefault login is admin / admin. SnapOtter asks you to change the default password after first login.\n",
       "website": "https://snapotter.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/snapotter.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -10025,7 +10322,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-snapotter"
     },
     {
       "id": "sonarr",
@@ -10035,7 +10333,7 @@
       "repository": "https://github.com/linuxserver/docker-sonarr",
       "description": "Sonarr (formerly NZBdrone) is a PVR for usenet and bittorrent users. It can monitor multiple RSS feeds for new episodes of your favorite shows and will grab, sort and rename them. It can also be configured to automatically upgrade the quality of files already downloaded when a better quality format becomes available.",
       "website": "https://sonarr.tv/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/sonarr-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/sonarr.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -10057,7 +10355,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-sonarr"
     },
     {
       "id": "speedtest-tracker",
@@ -10067,7 +10366,7 @@
       "repository": "https://github.com/linuxserver/docker-speedtest-tracker",
       "description": "Speedtest-tracker is a self-hosted internet performance tracking application that runs speedtest checks against Ookla's Speedtest service.",
       "website": "https://github.com/alexjustesen/speedtest-tracker",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/speedtest-tracker-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/speedtest-tracker.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -10076,8 +10375,8 @@
       "pushed_at": "2026-09-12T22:58:07Z",
       "updated_at": "2026-07-05",
       "main_image": "lscr.io/linuxserver/speedtest-tracker:latest",
-      "category": "network",
-      "category_label": "Network & Firewall",
+      "category": "monitoring",
+      "category_label": "Monitoring & Analytics",
       "template": "apps/speedtest-tracker.json",
       "template_status": "generated-unvalidated",
       "content_hash": "bd2d1338d7115081530645b900f5a954755b58d06c85b6b89204da88a9af1644",
@@ -10089,7 +10388,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-speedtest-tracker"
     },
     {
       "id": "spotube",
@@ -10099,7 +10399,7 @@
       "repository": "https://github.com/linuxserver/docker-spotube",
       "description": "Spotube is an open source, cross-platform Spotify client compatible across multiple platforms utilizing Spotify's data API and YouTube, Piped.video or JioSaavn as an audio source, eliminating the need for Spotify Premium",
       "website": "https://spotube.krtirtho.dev/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/spotube-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/spotube-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -10108,8 +10408,8 @@
       "pushed_at": "2026-09-11T19:02:13Z",
       "updated_at": "2026-04-04",
       "main_image": "lscr.io/linuxserver/spotube:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "media",
+      "category_label": "Media & Streaming",
       "template": "apps/spotube.json",
       "template_status": "generated-unvalidated",
       "content_hash": "3b64a7e47b91c6459677c454f52b3f60812a14afd07feb6df2da24a9b63d30d1",
@@ -10121,7 +10421,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-spotube"
     },
     {
       "id": "sqlitebrowser",
@@ -10131,7 +10432,7 @@
       "repository": "https://github.com/linuxserver/docker-sqlitebrowser",
       "description": "DB Browser for SQLite is a high quality, visual, open source tool to create, design, and edit database files compatible with SQLite.",
       "website": "https://sqlitebrowser.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/sqlitebrowser-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/sqlitebrowser.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -10140,8 +10441,8 @@
       "pushed_at": "2026-09-12T06:53:37Z",
       "updated_at": "2026-06-10",
       "main_image": "lscr.io/linuxserver/sqlitebrowser:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "databases",
+      "category_label": "Databases",
       "template": "apps/sqlitebrowser.json",
       "template_status": "generated-unvalidated",
       "content_hash": "2185c873858ce1952734289caedfdba2cee9682b6bb173b8bca9346a93741ae3",
@@ -10153,7 +10454,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-sqlitebrowser"
     },
     {
       "id": "stable-diffusion-webui-nvidia",
@@ -10165,7 +10467,7 @@
       "repository": "https://hub.docker.com/r/johnguan/stable-diffusion-webui",
       "description": "Stable Diffusion is a deep learning, text-to-image model released in 2022 based on diffusion techniques. It is primarily used to generate detailed images conditioned on text descriptions, though it can also be applied to other tasks such as inpainting, outpainting, and generating image-to-image translations guided by a text prompt.",
       "website": "",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/StableDiffusionWebUI/icon.svg",
       "architectures": [
         "amd64"
       ],
@@ -10188,7 +10490,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-stable-diffusion-webui-nvidia"
     },
     {
       "id": "steam",
@@ -10198,7 +10501,7 @@
       "repository": "https://github.com/linuxserver/docker-steam",
       "description": "Steam is the ultimate destination for playing, discussing, and creating games.",
       "website": "https://store.steampowered.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/steam-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/steam.webp",
       "architectures": [
         "amd64"
       ],
@@ -10206,8 +10509,8 @@
       "pushed_at": "2026-09-12T23:34:08Z",
       "updated_at": "2026-02-04",
       "main_image": "lscr.io/linuxserver/steam:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "gaming",
+      "category_label": "Gaming & Leisure",
       "template": "apps/steam.json",
       "template_status": "generated-unvalidated",
       "content_hash": "78be734cc7f82cc949c19d9f231c3a6d1db6034e53aaf980c95175725d04ad3e",
@@ -10219,7 +10522,8 @@
       "requires_relaxed_confinement": true,
       "optional_relaxed_confinement": true,
       "requires_security_confirmation": true,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-steam"
     },
     {
       "id": "stremio",
@@ -10229,7 +10533,7 @@
       "repository": "https://hub.docker.com/r/tsaridas/stremio-docker",
       "description": "Stremio offers a secure, modern and seamless entertainment experience. With its easy-to-use interface and diverse content library, including 4K HDR support, users can enjoy their favorite movies and TV shows across all their devices. And with its commitment to security, Stremio is the ultimate choice for a worry-free, high-quality streaming experience.",
       "website": "https://www.stremio.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/stremio.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -10253,7 +10557,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-stremio"
     },
     {
       "id": "suite-arr",
@@ -10263,7 +10568,7 @@
       "repository": "https://github.com/linuxserver/docker-prowlarr",
       "description": "Selectable Arr media suite with shared content and a choice of Jellyfin, Plex or Emby.",
       "website": "https://github.com/Prowlarr/Prowlarr",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/prowlarr-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/svg/servarr.svg",
       "architectures": [
         "amd64",
         "arm64"
@@ -10285,7 +10590,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-suite-arr"
     },
     {
       "id": "sure",
@@ -10297,7 +10603,7 @@
       "repository": "https://ghcr.io/we-promise/sure",
       "description": "Sure is a personal finance management application designed to help you track your expenses, income, and investments in one place. With an intuitive interface and powerful features, Sure makes it easy to understand your financial situation and make informed decisions about your money.\n\n**Key Features:**\n- **Expense Tracking**: Easily log and categorize your expenses\n- **Income Management**: Track multiple income sources\n- **Investment Monitoring**: Keep an eye on your investments and their performance\n- **Budget Planning**: Create and maintain budgets to control your spending\n- **Financial Reports**: Generate detailed reports to understand your financial habits\n- **AI-Powered Insights**: Get personalized financial advice using AI technology\n\n**Use Cases:**\n- Personal budget management\n- Expense tracking and categorization\n- Investment portfolio monitoring\n- Financial goal setting and tracking\n- Cash flow analysis\n\n**Learn More:**\n- [Sure GitHub Repository](https://github.com/we-promise/sure)\n",
       "website": "https://sure.am",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/Sure/icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -10328,7 +10634,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "image-sure"
     },
     {
       "id": "swag",
@@ -10338,7 +10645,7 @@
       "repository": "https://github.com/linuxserver/docker-swag",
       "description": "Nginx webserver and reverse proxy with php support and a built-in Certbot (Let's Encrypt) client. It also contains fail2ban for intrusion prevention.",
       "website": null,
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/swag-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/linuxserver-ls-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -10347,8 +10654,8 @@
       "pushed_at": "2026-09-12T08:06:16Z",
       "updated_at": "2026-07-19",
       "main_image": "lscr.io/linuxserver/swag:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "web",
+      "category_label": "Webservers & Proxies",
       "template": "apps/swag.json",
       "template_status": "generated-unvalidated",
       "content_hash": "c25276bc6f6b54d95fb3dac8ac952ee2345b6ad095eb9f83261145f12b1cd9e8",
@@ -10360,7 +10667,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-swag"
     },
     {
       "id": "swingmusic",
@@ -10372,7 +10680,7 @@
       "repository": "https://ghcr.io/swingmx/swingmusic",
       "description": "Swing Music is a fast, beautiful, self-hosted music player designed for your local audio files, offering a sleek experience akin to Spotify but powered by your own music library. Simply run the app and access your music collection effortlessly through a web browser.\n\nSwing Music curates Daily Mixes based on your listening habits, ensures a clean and consistent library with metadata normalization, and supports album versioning (e.g., Deluxe, Remaster) alongside related artist and album recommendations. Browse your music library via folder view, manage playlists, and enjoy a seamless listening experience with silence detection and cross-fade. Additional features include listening statistics, lyrics view, Last.fm scrobbling, multi-user support, and personalized collections for grouping albums and artists.\n\nWith its stunning browser-based interface and robust functionality, Swing Music is the perfect choice for music enthusiasts seeking a beautiful and practical way to manage and enjoy their local music collection.\n",
       "website": "https://swingmx.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/swing-music.webp",
       "architectures": [
         "amd64"
       ],
@@ -10395,7 +10703,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-swingmusic"
     },
     {
       "id": "synclounge",
@@ -10405,7 +10714,7 @@
       "repository": "https://github.com/linuxserver/docker-synclounge",
       "description": "Synclounge is a third party tool that allows you to watch Plex in sync with your friends/family, wherever you are.",
       "website": "https://github.com/samcm/synclounge",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/synclounge-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/synclounge.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -10414,8 +10723,8 @@
       "pushed_at": "2026-09-08T17:58:13Z",
       "updated_at": "2026-07-15",
       "main_image": "lscr.io/linuxserver/synclounge:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "media",
+      "category_label": "Media & Streaming",
       "template": "apps/synclounge.json",
       "template_status": "generated-unvalidated",
       "content_hash": "63c40039616331f757dfef88c626e84bc5258bf0e4fe1e851a44f2d126588c6a",
@@ -10427,7 +10736,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-synclounge"
     },
     {
       "id": "syncthing",
@@ -10437,7 +10747,7 @@
       "repository": "https://github.com/linuxserver/docker-syncthing",
       "description": "Syncthing replaces proprietary sync and cloud services with something open, trustworthy and decentralized. Your data is your data alone and you deserve to choose where it is stored, if it is shared with some third party and how it's transmitted over the Internet.",
       "website": "https://syncthing.net",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/syncthing-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/syncthing.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -10459,7 +10769,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-syncthing"
     },
     {
       "id": "syslog-ng",
@@ -10469,7 +10780,7 @@
       "repository": "https://github.com/linuxserver/docker-syslog-ng",
       "description": "syslog-ng allows you to flexibly collect, parse, classify, rewrite and correlate logs from across your infrastructure and store or route them to log analysis tools.",
       "website": "https://www.syslog-ng.com/products/open-source-log-management/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/syslog-ng-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/syslog-ng-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -10478,8 +10789,8 @@
       "pushed_at": "2026-09-10T21:27:28Z",
       "updated_at": "2026-07-05",
       "main_image": "lscr.io/linuxserver/syslog-ng:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "monitoring",
+      "category_label": "Monitoring & Analytics",
       "template": "apps/syslog-ng.json",
       "template_status": "generated-unvalidated",
       "content_hash": "59bb91b4371a26d4b98dcafa7b581665f7f761f96cd7a8b608c1f84a6bdc17d4",
@@ -10491,7 +10802,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-syslog-ng"
     },
     {
       "id": "tailscale",
@@ -10503,7 +10815,7 @@
       "repository": "https://hub.docker.com/r/tailscale/tailscale",
       "description": "A modern self-hosted networking app built on WireGuard\u00ae, providing secure, encrypted connections between devices regardless of their location. Its zero-configuration networking eliminates the need for complex firewall rules, port forwarding, or network administration, making it ideal for businesses and individuals creating efficient, secure network environments.\n\nThe app's core features include seamless device connectivity and robust security. It uses WireGuard\u00ae for end-to-end encryption, ensuring traffic cannot be intercepted, with private keys stored solely on user devices. Automatic NAT traversal enables connections across computers, phones, servers, and IoT devices over different network types, forming a unified private network. It also offers identity-based access control, integrating with Google, Microsoft, GitHub, or custom SSO solutions for simple authentication, replacing traditional IP-based restrictions to enhance security.\n\nIt excels in delivering secure remote access to services and infrastructure. Users can effortlessly access home servers, connect to office networks while traveling, or establish secure links between cloud services. Subnet routing allows access to entire networks, exit nodes enable secure internet browsing, and MagicDNS simplifies device discovery. These features ensure efficient, secure access to resources from any location.\n\nIt supports nearly all platforms, including Linux, Windows, macOS, iOS, Android, and various router firmwares, with flexible deployment in cloud or on-premises environments. A user-friendly Web interface provides real-time monitoring of network topology, device status, and access controls, with community documentation aiding configuration optimization. Whether setting up secure access for small teams or managing enterprise-scale networks, the app\u2019s intuitive operation and high flexibility deliver a modern networking solution.\n\n**Key Features:**\n- End-to-end encryption via WireGuard\u00ae, ensuring uninterceptible traffic\n- Zero-configuration networking, eliminating complex firewall or port forwarding setup\n- Automatic NAT traversal for seamless device connectivity across network types\n- Identity-based access control with SSO integration (Google, Microsoft, GitHub)\n- Subnet routing for secure network-wide access\n- Exit nodes for safe internet browsing\n- MagicDNS for simplified device discovery\n\n**Learn More:**\n- [Tailscale Official Website](https://tailscale.com)\n- [Tailscale GitHub Repository](https://github.com/tailscale/tailscale)\n",
       "website": "https://tailscale.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/tailscale.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -10514,8 +10826,8 @@
       "pushed_at": "2026-09-11T10:43:22Z",
       "updated_at": "2026-05-21",
       "main_image": "tailscale/tailscale:latest",
-      "category": "network",
-      "category_label": "Network & Firewall",
+      "category": "remote",
+      "category_label": "Remote Access & VPN",
       "template": "apps/tailscale.json",
       "template_status": "generated-unvalidated",
       "content_hash": "4ceee28e6d136b6e60deb806c69e43e286497b4842c5e21edb539cf2b6da0fcc",
@@ -10527,7 +10839,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-tailscale"
     },
     {
       "id": "tandoor",
@@ -10537,7 +10850,7 @@
       "repository": "https://github.com/vabene1111/recipes",
       "description": "Official Tandoor Recipes deployment with its integrated web server and an isolated PostgreSQL dependency.",
       "website": "https://tandoor.dev/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/tandoor-recipes.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -10561,7 +10874,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-tandoor"
     },
     {
       "id": "taskingai",
@@ -10573,7 +10887,7 @@
       "repository": "https://hub.docker.com/r/taskingai/taskingai-console",
       "description": "The developer-friendly cloud platform for building and running LLM agents for AI-native applications.",
       "website": "https://docs.tasking.ai/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/TaskingAI/icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -10608,7 +10922,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "image-taskingai"
     },
     {
       "id": "tasmoadmin",
@@ -10618,7 +10933,7 @@
       "repository": "https://github.com/TasmoAdmin/TasmoAdmin",
       "description": "TasmoAdmin manages the devices on a network that run Tasmota firmware, from one web interface: it finds them by scanning an address range or through an MQTT broker, shows their sensor readings and configuration, sends commands and backs them up, and updates the firmware of several devices at once, downloading the release from the Tasmota OTA site.",
       "website": "https://github.com/TasmoAdmin/TasmoAdmin",
-      "icon": "https://raw.githubusercontent.com/TasmoAdmin/TasmoAdmin/master/assets/logo.svg",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/tasmoadmin.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -10641,7 +10956,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "multi_container": false
+      "multi_container": false,
+      "template_id": "image-tasmoadmin"
     },
     {
       "id": "tautulli",
@@ -10651,7 +10967,7 @@
       "repository": "https://github.com/linuxserver/docker-tautulli",
       "description": "Tautulli is a python based web application for monitoring, analytics and notifications for Plex Media Server.",
       "website": "http://tautulli.com",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/tautulli-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/tautulli.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -10673,7 +10989,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-tautulli"
     },
     {
       "id": "tdarr",
@@ -10683,7 +11000,7 @@
       "repository": "https://github.com/HaveAGitGat/Tdarr",
       "description": "Tdarr keeps a media library in the formats and codecs chosen for it: it scans the library, checks the health of every file and transcodes what does not match, with its own worker node inside the container. The web interface is on port 8265 and the node listens on 8266.",
       "website": "https://tdarr.io",
-      "icon": "https://raw.githubusercontent.com/HaveAGitGat/Tdarr/master/assets/tdarr.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/tdarr.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -10706,7 +11023,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "multi_container": false
+      "multi_container": false,
+      "template_id": "image-tdarr"
     },
     {
       "id": "teable",
@@ -10718,7 +11036,7 @@
       "repository": "https://hub.docker.com/r/teableio/teable",
       "description": "Teable is a new generation open-source database platform. It provides an intuitive spreadsheet-like experience, while being powered by a high-performance Postgres database underneath, combining ease of use with powerful data processing capabilities.\n\n**Key Features:**\n- **High Performance**: Built on the Postgres core, it effortlessly handles millions of records with extremely fast response times.\n- **Modern Interface**: Offers multiple views including grid, kanban, gallery, and forms, with a clean and user-friendly design.\n- **Real-time Collaboration**: Supports multi-user online collaboration with real-time data synchronisation.\n- **Automation & API**: Provides powerful RESTful APIs to enable flexible integration and automation.\n\n**Learn More:**\n- [Teable Official Website](https://teable.ai)\n- [Teable GitHub Repository](https://github.com/teableio/teable)\n- [Help Documentation](https://help.teable.ai)\n",
       "website": "https://teable.ai",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/teable.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -10742,7 +11060,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-teable"
     },
     {
       "id": "telegram",
@@ -10752,7 +11071,7 @@
       "repository": "https://github.com/linuxserver/docker-telegram",
       "description": "Telegram is a cloud-based mobile and desktop messaging app.",
       "website": "https://telegram.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/telegram-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/telegram.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -10761,8 +11080,8 @@
       "pushed_at": "2026-09-13T15:08:37Z",
       "updated_at": "2026-04-04",
       "main_image": "lscr.io/linuxserver/telegram:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "communication",
+      "category_label": "Communication & Community",
       "template": "apps/telegram.json",
       "template_status": "generated-unvalidated",
       "content_hash": "971f8fd3dc847c583541f3d47f90b0211d3fa007e377590a7109b7ccb52dee6b",
@@ -10774,7 +11093,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-telegram"
     },
     {
       "id": "thelounge",
@@ -10784,7 +11104,7 @@
       "repository": "https://github.com/linuxserver/docker-thelounge",
       "description": "Thelounge (a fork of shoutIRC) is a web IRC client that you host on your own server.",
       "website": "https://thelounge.github.io/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/thelounge-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/the-lounge.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -10793,8 +11113,8 @@
       "pushed_at": "2026-09-13T10:45:06Z",
       "updated_at": "2025-07-27",
       "main_image": "lscr.io/linuxserver/thelounge:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "communication",
+      "category_label": "Communication & Community",
       "template": "apps/thelounge.json",
       "template_status": "laboratory-validated",
       "content_hash": "d5d7aeabb2fa462b13b9c25f2aa2c0607b0f5a6da5f36485d9ecf2bbc420292a",
@@ -10806,7 +11126,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-thelounge"
     },
     {
       "id": "threadfin",
@@ -10818,7 +11139,7 @@
       "repository": "https://hub.docker.com/r/fyb3roptik/threadfin",
       "description": "Threadfin is a M3U proxy server for Plex, Emby, Jellyfin and any client and provider which supports the .TS and .M3U8 (HLS) streaming formats.",
       "website": "",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/threadfin.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -10842,7 +11163,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-threadfin"
     },
     {
       "id": "thunderbird",
@@ -10852,7 +11174,7 @@
       "repository": "https://github.com/linuxserver/docker-thunderbird",
       "description": "Thunderbird is a free and open-source personal information manager primarily used as an e-mail client with a calendar and contactbook, as well as an RSS feed reader, chat client, and news client.",
       "website": "https://www.thunderbird.net/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/thunderbird-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/thunderbird.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -10861,8 +11183,8 @@
       "pushed_at": "2026-09-07T16:54:04Z",
       "updated_at": "2026-05-31",
       "main_image": "lscr.io/linuxserver/thunderbird:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "communication",
+      "category_label": "Communication & Community",
       "template": "apps/thunderbird.json",
       "template_status": "generated-unvalidated",
       "content_hash": "e6e96a980490a5f72de2ed02de7fe049c4cb96b0f52823c325475386ef60c80e",
@@ -10874,7 +11196,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-thunderbird"
     },
     {
       "id": "transmission",
@@ -10884,7 +11207,7 @@
       "repository": "https://github.com/linuxserver/docker-transmission",
       "description": "Transmission is designed for easy, powerful use. Transmission has the features you want from a BitTorrent client: encryption, a web interface, peer exchange, magnet links, DHT, \u00b5TP, UPnP and NAT-PMP port forwarding, webseed support, watch directories, tracker editing, global and per-torrent speed limits, and more.",
       "website": "https://www.transmissionbt.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/transmission-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/transmission.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -10906,7 +11229,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-transmission"
     },
     {
       "id": "trilium",
@@ -10918,7 +11242,7 @@
       "repository": "https://hub.docker.com/r/triliumnext/trilium",
       "description": "TriliumNext Notes is a cross-platform hierarchical note-taking tool focused on building large personal knowledge bases, offering robust organization and editing capabilities. Its intuitive interface and versatile features make it ideal for scholars, developers, and note-taking enthusiasts managing complex knowledge.\n\nThe tool's core features include hierarchical note organization and rich editing. Users can arrange notes in an arbitrarily deep tree structure, with single notes clonable to multiple locations. It supports a WYSIWYG editor with tables, images, math, and Markdown autoformatting for efficiency. Code notes feature syntax highlighting, while fast navigation includes full-text search and note hoisting. Seamless versioning and note attributes enable organization, querying, and advanced scripting.\n\nIt offers secure login (OpenID, TOTP), supports self-hosted synchronization servers or third-party services, and provides per-note encryption for privacy. Users can sketch diagrams with Excalidraw, create relation/link maps, mind maps with Mind Elixir, and geo maps with location pins and GPX tracks. A REST API enables automation, with scalability for over 100,000 notes. Touch-optimized mobile frontend, dark theme, user themes, Evernote/Markdown import/export, and Web Clipper enhance usability.\n\n**Key Features:**\n- Notes can be arranged into arbitrarily deep tree. Single note can be placed into multiple places in the tree (see [cloning](https://triliumnext.github.io/Docs/Wiki/cloning-notes))\n- Rich WYSIWYG note editor including e.g. tables, images and [math](https://triliumnext.github.io/Docs/Wiki/text-notes) with markdown [autoformat](https://triliumnext.github.io/Docs/Wiki/text-notes#autoformat)\n- Support for editing [notes with source code](https://triliumnext.github.io/Docs/Wiki/code-notes), including syntax highlighting\n- Fast and easy [navigation between notes](https://triliumnext.github.io/Docs/Wiki/note-navigation), full text search and [note hoisting](https://triliumnext.github.io/Docs/Wiki/note-hoisting)\n- Seamless [note versioning](https://triliumnext.github.io/Docs/Wiki/note-revisions)\n- Note [attributes](https://triliumnext.github.io/Docs/Wiki/attributes) can be used for note organization, querying and advanced [scripting](https://triliumnext.github.io/Docs/Wiki/scripts)\n- Direct [OpenID and TOTP integration](https://github.com/TriliumNext/Trilium/blob/main/docs/User%20Guide/User%20Guide/Installation%20%26%20Setup/Server%20Installation/Multi-Factor%20Authentication.md) for more secure login\n- [Synchronization](https://triliumnext.github.io/Docs/Wiki/synchronization) with self-hosted sync server\n  - there's a [3rd party service for hosting synchronisation server](https://trilium.cc/paid-hosting)\n- [Sharing](https://triliumnext.github.io/Docs/Wiki/sharing) (publishing) notes to public internet\n- Strong [note encryption](https://triliumnext.github.io/Docs/Wiki/protected-notes) with per-note granularity\n- Sketching diagrams, based on [Excalidraw](https://excalidraw.com/) (note type canvas)\n- [Relation maps](https://triliumnext.github.io/Docs/Wiki/relation-map) and [link maps](https://triliumnext.github.io/Docs/Wiki/link-map) for visualizing notes and their relations\n- Mind maps, based on [Mind Elixir](https://docs.mind-elixir.com/)\n- [Geo maps](https://github.com/TriliumNext/Trilium/blob/main/docs/User%20Guide/User%20Guide/Note%20Types/Geo%20Map.md) with location pins and GPX tracks\n- [Scripting](https://triliumnext.github.io/Docs/Wiki/scripts) - see [Advanced showcases](https://triliumnext.github.io/Docs/Wiki/advanced-showcases)\n- [REST API](https://triliumnext.github.io/Docs/Wiki/etapi) for automation\n- Scales well in both usability and performance upwards of 100 000 notes\n- Touch optimized [mobile frontend](https://triliumnext.github.io/Docs/Wiki/mobile-frontend) for smartphones and tablets\n- Built-in [dark theme](https://triliumnext.github.io/Docs/Wiki/themes), support for user themes\n- [Evernote](https://triliumnext.github.io/Docs/Wiki/evernote-import) and [Markdown import & export](https://triliumnext.github.io/Docs/Wiki/markdown)\n- [Web Clipper](https://triliumnext.github.io/Docs/Wiki/web-clipper) for easy saving of web content\n- Customizable UI (sidebar buttons, user-defined widgets,...)\n- [Metrics](https://github.com/TriliumNext/Trilium/blob/main/docs/User%20Guide/User%20Guide/Advanced%20Usage/Metrics.md), along with a [Grafana Dashboard](https://github.com/TriliumNext/Trilium/blob/main/docs/User%20Guide/User%20Guide/Advanced%20Usage/Metrics/grafana-dashboard.json)\n\n**Learn More:**\n- [TriliumNext GitHub Repository](https://github.com/TriliumNext/Trilium)\n- [awesome-trilium](https://github.com/Nriver/awesome-trilium) for 3rd party themes, scripts, plugins and more\n- [TriliumRocks!](https://trilium.rocks/) for tutorials, guides, and much more\n",
       "website": "https://triliumnext.github.io/Docs/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/trilium.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -10942,7 +11266,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-trilium"
     },
     {
       "id": "turbodiffusion-nvidia",
@@ -10954,7 +11279,7 @@
       "repository": "https://hub.docker.com/r/icewhaletech/turbodiffusion",
       "description": "TurboDiffusion is an accelerated text-to-video generation framework based on the Latent Consistency Model (LCM). It leverages various TurboWan2 models to rapidly generate high-quality videos from text descriptions. The framework supports both image and video generation and provides optimized checkpoints for different GPU configurations.\n\n**Key Features:**\n- Ultra-fast video and image generation\n- Intuitive Gradio WebUI\n- Optimized for different GPU configurations\n- Quantized and unquantized checkpoints\n- Flexible model configuration\n\n**Hardware Requirements:**\n- Recommended: RTX 3090 or above\n- GPU VRAM: > 30 GB\n- System RAM: > 40 GB\n- CUDA-compatible NVIDIA drivers\n\n**Learn More:**\n- [TurboDiffusion GitHub](https://github.com/thu-ml/TurboDiffusion)\n",
       "website": "",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/TurboDiffusion_Nvidia/icon.png",
       "architectures": [
         "amd64"
       ],
@@ -10977,7 +11302,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-turbodiffusion-nvidia"
     },
     {
       "id": "tvheadend",
@@ -10987,7 +11313,7 @@
       "repository": "https://github.com/linuxserver/docker-tvheadend",
       "description": "Tvheadend works as a proxy server: is a TV streaming server and recorder for Linux, FreeBSD and Android supporting DVB-S, DVB-S2, DVB-C, DVB-T, ATSC, ISDB-T, IPTV, SAT>IP and HDHomeRun as input sources.",
       "website": "https://www.tvheadend.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/tvheadend-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/tvheadend.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -10996,8 +11322,8 @@
       "pushed_at": "2026-09-12T18:05:33Z",
       "updated_at": "2024-06-25",
       "main_image": "lscr.io/linuxserver/tvheadend:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "media",
+      "category_label": "Media & Streaming",
       "template": "apps/tvheadend.json",
       "template_status": "generated-unvalidated",
       "content_hash": "5eba949f7de4e82e979919726c2760cedfc0938327154ca145f82c63dc6981e6",
@@ -11009,7 +11335,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-tvheadend"
     },
     {
       "id": "twingate-connector",
@@ -11021,7 +11348,7 @@
       "repository": "https://hub.docker.com/r/twingate/connector",
       "description": "It's a connector for Twingate\".",
       "website": "https://www.twingate.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/twingate.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -11045,7 +11372,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-twingate-connector"
     },
     {
       "id": "ubooquity",
@@ -11055,7 +11383,7 @@
       "repository": "https://github.com/linuxserver/docker-ubooquity",
       "description": "Ubooquity is a free, lightweight and easy-to-use home server for your comics and ebooks. Use it to access your files from anywhere, with a tablet, an e-reader, a phone or a computer.",
       "website": "https://vaemendis.net/ubooquity/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ubooquity-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/ubooquity.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -11064,8 +11392,8 @@
       "pushed_at": "2026-09-09T00:39:52Z",
       "updated_at": "2025-07-27",
       "main_image": "lscr.io/linuxserver/ubooquity:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "media",
+      "category_label": "Media & Streaming",
       "template": "apps/ubooquity.json",
       "template_status": "generated-unvalidated",
       "content_hash": "00be4ce78bdf56e484c8cb9f6bc3fa1b8d7ae403b1c81f84fd0ab865264a7da6",
@@ -11077,7 +11405,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-ubooquity"
     },
     {
       "id": "ungoogled-chromium",
@@ -11087,7 +11416,7 @@
       "repository": "https://github.com/linuxserver/docker-ungoogled-chromium",
       "description": "Ungoogled Chromium is Google Chromium, sans dependency on Google web services.",
       "website": "https://github.com/ungoogled-software/ungoogled-chromium",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/ungoogled-chromium-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/ungoogled-chromium-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -11096,8 +11425,8 @@
       "pushed_at": "2026-09-08T06:58:56Z",
       "updated_at": "2026-03-31",
       "main_image": "lscr.io/linuxserver/ungoogled-chromium:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "desktop",
+      "category_label": "Browsers & Web Desktops",
       "template": "apps/ungoogled-chromium.json",
       "template_status": "generated-unvalidated",
       "content_hash": "05e77f04e355ddb56edf94b8b5df047aca192b5ac908913411505ebc24127af2",
@@ -11109,7 +11438,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-ungoogled-chromium"
     },
     {
       "id": "unifi-controller",
@@ -11121,7 +11451,7 @@
       "repository": "https://hub.docker.com/r/linuxserver/unifi-controller",
       "description": "For Unifi to adopt other devices, e.g. an Access Point, it is required to change the inform IP address. Because Unifi runs inside Docker by default it uses an IP address not accessible by other devices. To change this go to Settings > System Settings > Controller Configuration and set the Controller Hostname/IP to a hostname or IP address accessible by your devices. Additionally the checkbox \"Override inform host with controller hostname/IP\" has to be checked, so that devices can connect to the controller during adoption (devices use the inform-endpoint during adoption).",
       "website": "https://ui.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/unifi-controller.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -11145,7 +11475,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-unifi-controller"
     },
     {
       "id": "unifi-network-application",
@@ -11155,7 +11486,7 @@
       "repository": "https://github.com/linuxserver/docker-unifi-network-application",
       "description": "",
       "website": null,
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/unifi-network-application-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/Unifi-Network-Application/icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -11164,8 +11495,8 @@
       "pushed_at": "2026-09-08T20:23:32Z",
       "updated_at": "2026-07-14",
       "main_image": "lscr.io/linuxserver/unifi-network-application:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "network",
+      "category_label": "Network & Firewall",
       "template": "apps/unifi-network-application.json",
       "template_status": "generated-unvalidated",
       "content_hash": "b30497c2ccc6d4341d7093c2b4f24684042aa39673e43d34556409a605afcbf4",
@@ -11177,7 +11508,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "linuxserver-unifi-network-application"
     },
     {
       "id": "unpackerr",
@@ -11187,7 +11519,7 @@
       "repository": "https://github.com/Unpackerr/unpackerr",
       "description": "Background archive extraction for Arr download queues. No web interface.",
       "website": "https://unpackerr.zip/docs/install/docker/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/unpackerr.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -11209,7 +11541,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-unpackerr"
     },
     {
       "id": "uptimekuma",
@@ -11221,7 +11554,7 @@
       "repository": "https://hub.docker.com/r/louislam/uptime-kuma",
       "description": "Uptime Kuma is a free, easy-to-use self-hosted monitoring tool designed for real-time tracking of network services and infrastructure, offering a modern interface and robust functionality. It provides an intuitive Web dashboard for managing services, ideal for individual developers, home lab users, and small teams.\n\nThe tool's core features include comprehensive monitoring and diverse notification channels. It monitors HTTP/HTTPS, TCP ports, DNS records, databases, Ping, and Steam game servers, with interactive Ping charts visually displaying response times and status. Users can receive real-time alerts via Telegram, Discord, Slack, Email (SMTP), and over 95 other notification services. SSL certificate monitoring checks certificate validity and expiration, aiding timely renewals.\n\nIt supports 20-second monitoring intervals for rapid downtime detection and offers multiple status pages to share real-time service status with customers. Proxy support enables remote access via Cloudflare, Nginx, or similar services, enhancing flexibility. Two-factor authentication (2FA) and API keys bolster security, ensuring full user control over local data. The tool delivers an efficient monitoring solution with intuitive operation and community support.\n\n**Key Features:**\n- Monitor HTTP/HTTPS, TCP, DNS, databases, and other services\n- Notifications via Telegram, Discord, Slack, and over 95 other channels\n- Interactive Ping charts displaying response times and status\n- SSL certificate monitoring for validity and expiration\n- 20-second monitoring intervals for rapid downtime detection\n- Multiple status pages for sharing service status\n- Proxy support compatible with Cloudflare, Nginx, and more\n- Two-factor authentication (2FA) and API keys for enhanced security\n\n**Learn More:**\n- [Uptime Kuma Official Website](https://uptimekuma.org)\n- [Uptime Kuma GitHub Repository](https://github.com/louislam/uptime-kuma)\n",
       "website": "https://uptimekuma.org",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/uptime-kuma.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -11245,7 +11578,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-uptimekuma"
     },
     {
       "id": "v2raya",
@@ -11257,7 +11591,7 @@
       "repository": "https://hub.docker.com/r/mzz2017/v2raya",
       "description": "v2rayA is a V2Ray client supporting global transparent proxy, compatible with SS, SSR, Trojan (trojan-go), Tuic, and Juicity protocols. Designed for simplicity, it meets most user needs, ideal for scenarios requiring efficient proxy services.\n\nCore features include global transparent proxy and multi-outbound load balancing with traffic splitting. It provides proxy services for nearly all applications without requiring application-specific proxy support. Support for creating and connecting multiple outbound nodes ensures load balancing and efficient traffic splitting for optimal network performance.\n\nIt offers RoutingA, a custom routing language for V2Ray, providing powerful and convenient traffic splitting support. Multiple strategies address DNS pollution, with advanced settings enabling customized configurations. With simplicity and functionality at the core, the platform delivers a modern solution for proxy management.\n\n**Key Features:**\n- Web-based GUI for easy configuration and management\n- Support for multiple protocols: VMess, VLESS, SS, SSR, Trojan, Tuic, Juicity\n- Global transparent proxy for seamless application proxy services\n- Multi-outbound load balancing and traffic splitting\n- RoutingA custom routing for convenient traffic splitting\n- Multiple DNS pollution mitigation strategies with advanced custom settings\n\n**Learn More:**\n- [V2rayA Official Website](https://v2raya.org/)\n- [V2rayA GitHub](https://github.com/v2rayA/v2rayA)\n",
       "website": "https://v2raya.org/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/v2raya.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -11268,8 +11602,8 @@
       "pushed_at": "2026-09-11T10:43:22Z",
       "updated_at": "2026-01-25",
       "main_image": "mzz2017/v2raya:latest",
-      "category": "network",
-      "category_label": "Network & Firewall",
+      "category": "remote",
+      "category_label": "Remote Access & VPN",
       "template": "apps/v2raya.json",
       "template_status": "generated-unvalidated",
       "content_hash": "100ab96c062ab93155191ab6099e72098459058ff4f1701f256f1139ddcb55ae",
@@ -11281,7 +11615,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-v2raya"
     },
     {
       "id": "vaultwarden",
@@ -11293,7 +11628,7 @@
       "repository": "https://hub.docker.com/r/vaultwarden/server",
       "description": "Alternative implementation of the Bitwarden server API written in Rust and compatible with upstream Bitwarden clients*, perfect for self-hosted deployment where running the official resource-heavy service might not be ideal.",
       "website": "https://vaultwarden.net",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/vaultwarden.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -11317,7 +11652,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-vaultwarden"
     },
     {
       "id": "virt-manager",
@@ -11329,7 +11665,7 @@
       "repository": "https://hub.docker.com/r/mber5/virt-manager",
       "description": "A GTK Broadway web UI for libvirt and virt-manager, to run virtual machines using QEMU/KVM.",
       "website": "https://virt-manager.org",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/VirtualMachineManager/icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -11340,8 +11676,8 @@
       "pushed_at": "2026-09-11T10:43:22Z",
       "updated_at": "2023-02-01",
       "main_image": "mber5/virt-manager:latest",
-      "category": "ai",
-      "category_label": "AI / Coding & Dev-Tools",
+      "category": "management",
+      "category_label": "Host Management",
       "template": "apps/virt-manager.json",
       "template_status": "generated-unvalidated",
       "content_hash": "d4c674fc1093a8dc0afb9c346d3e3900a9636240f7fbb1b07a123e5a406986fb",
@@ -11353,7 +11689,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "image-virt-manager"
     },
     {
       "id": "vivaldi",
@@ -11363,7 +11700,7 @@
       "repository": "https://github.com/linuxserver/docker-vivaldi",
       "description": "Vivaldi is a Norwegian freeware, cross-platform web browser with a built-in email client developed by Vivaldi Technologies.",
       "website": "https://vivaldi.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/vivaldi-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/vivaldi.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -11372,8 +11709,8 @@
       "pushed_at": "2026-09-12T05:43:20Z",
       "updated_at": "2026-03-31",
       "main_image": "lscr.io/linuxserver/vivaldi:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "desktop",
+      "category_label": "Browsers & Web Desktops",
       "template": "apps/vivaldi.json",
       "template_status": "generated-unvalidated",
       "content_hash": "891cf938d5bce12c3b457524bbbd9a99bb361e06868e9996fe13ebacd23a3d3e",
@@ -11385,7 +11722,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-vivaldi"
     },
     {
       "id": "vlc",
@@ -11395,7 +11733,7 @@
       "repository": "https://github.com/linuxserver/docker-vlc",
       "description": "VLC Media Player is a free and open source cross-platform multimedia player and framework that delivers dependable performance across multiple devices.",
       "website": "https://www.videolan.org/vlc/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/vlc-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/vlc-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -11404,8 +11742,8 @@
       "pushed_at": "2026-09-08T17:57:39Z",
       "updated_at": "2026-03-30",
       "main_image": "lscr.io/linuxserver/vlc:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "media",
+      "category_label": "Media & Streaming",
       "template": "apps/vlc.json",
       "template_status": "generated-unvalidated",
       "content_hash": "e02527d18fd43cafb94d8180a632047be108ae2f6da18bd92cb3ed60805ad1b1",
@@ -11417,7 +11755,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-vlc"
     },
     {
       "id": "vocechat",
@@ -11429,7 +11768,7 @@
       "repository": "https://hub.docker.com/r/privoce/vocechat-server",
       "description": "VoceChat is a secure chat software designed for independent deployment, offering a flexible solution for seamless communication. It combines instant messaging with channel-based group chats, allowing you to engage in one-on-one conversations or create themed channels for group discussions.\n\nVoceChat supports a variety of message formats, including text, images, files, emojis, and rich text (Markdown), making your communication vibrant and expressive. Once deployed, it can be accessed via a WebAPP or mobile APP, ensuring a consistent experience across platforms.\n\nWith robust management features, VoceChat enables easy member and channel administration, giving you full control over your team or group\u2019s communication environment. Whether for individual users or enterprise teams, VoceChat delivers a secure, versatile, and efficient chat solution.\n",
       "website": "https://voce.chat",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/VoceChat/icon.png",
       "architectures": [
         "amd64"
       ],
@@ -11452,7 +11791,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-vocechat"
     },
     {
       "id": "vscode",
@@ -11462,7 +11802,7 @@
       "repository": "https://github.com/linuxserver/docker-vscode",
       "description": "VS Code is an integrated development environment developed by Microsoft. This container runs the full desktop application, for a web native version see Code Server.",
       "website": "https://code.visualstudio.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/vscode-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/vscode.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -11471,8 +11811,8 @@
       "pushed_at": "2026-09-08T18:36:38Z",
       "updated_at": "2026-04-04",
       "main_image": "lscr.io/linuxserver/vscode:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "ai",
+      "category_label": "AI / Coding & Dev-Tools",
       "template": "apps/vscode.json",
       "template_status": "generated-unvalidated",
       "content_hash": "b0fa624781b3cdaa32b5cf7d70ec33f37f198190e7025c7f7adee8c54838c9a0",
@@ -11484,7 +11824,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-vscode"
     },
     {
       "id": "vscodium",
@@ -11494,7 +11835,7 @@
       "repository": "https://github.com/linuxserver/docker-vscodium",
       "description": "VSCodium is a community-driven, freely-licensed binary distribution of Microsoft\u2019s editor VS Code.",
       "website": "https://vscodium.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/vscodium-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/vscodium.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -11503,8 +11844,8 @@
       "pushed_at": "2026-09-09T10:34:25Z",
       "updated_at": "2026-04-04",
       "main_image": "lscr.io/linuxserver/vscodium:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "ai",
+      "category_label": "AI / Coding & Dev-Tools",
       "template": "apps/vscodium.json",
       "template_status": "generated-unvalidated",
       "content_hash": "42e061febe0602119c45eddf245ec9df056c32786b877cc1931ab6666767c8f4",
@@ -11516,7 +11857,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-vscodium"
     },
     {
       "id": "vscodium-web",
@@ -11526,7 +11868,7 @@
       "repository": "https://github.com/linuxserver/docker-vscodium-web",
       "description": "Vscodium-web is a community-driven, freely-licensed binary distribution of the remote host web component of Microsoft's editor VS Code.",
       "website": "https://vscodium.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/vscodium-web-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/vscodium-icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -11535,8 +11877,8 @@
       "pushed_at": "2026-09-09T12:15:12Z",
       "updated_at": "2026-06-24",
       "main_image": "lscr.io/linuxserver/vscodium-web:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "ai",
+      "category_label": "AI / Coding & Dev-Tools",
       "template": "apps/vscodium-web.json",
       "template_status": "generated-unvalidated",
       "content_hash": "fcd69129dfef13b4297e02c9bda504d82d22afd25978a07abd848b5d80b22c17",
@@ -11548,7 +11890,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-vscodium-web"
     },
     {
       "id": "wallabag",
@@ -11560,7 +11903,7 @@
       "repository": "https://hub.docker.com/r/wallabag/wallabag",
       "description": "Wallabag is a web page saving app that allows users to save articles for offline reading, extracting content for a distraction-free experience. Its intuitive Web interface enables saving articles with a click, ensuring users can read them at their convenience.\n\nThe app's core features include convenient web page saving, optimized reading, and flexible content organization. It extracts only the article's content, removing pop-ups and ads, and displays it in a clean, comfortable view. Users can organize saved articles with tags and automatic tagging rules, creating a personalized content library accessible on demand. Browser extensions enable quick saving, compatible with Chrome, Firefox, Opera, and more. Cross-platform clients cover Android, iOS, and other devices, ensuring a seamless reading experience. It also supports multi-user collaboration for sharing saved articles.\n\nIt enables importing data from services like Pocket, Readability, Instapaper, or Pinboard, simplifying content library migration. RSS generation allows users to access saved articles in RSS readers. Community documentation enhances usability, and the app's high flexibility and intuitive operation deliver a modern web content management solution.\n\n**Key Features:**\n- Save web pages for offline reading\n- Extract pure content for a distraction-free reading view\n- Article classification with automatic tagging rules for a personalized content library\n- Browser extensions for quick web page saving\n- Cross-platform clients (Android, iOS, Chrome, Firefox, Opera)\n- Multi-user collaboration for sharing saved articles\n- Import data from Pocket, Readability, Instapaper, Pinboard and other services\n- RSS generation for accessing saved articles in readers\n\n**Learn More:**\n- [Wallabag Official Website](https://wallabag.org)\n- [Wallabag GitHub Repository](https://github.com/wallabag/wallabag)\n- [Wallabag Documentation](https://doc.wallabag.org)\n- [Wallabag Docker Image](https://hub.docker.com/r/wallabag/wallabag)\n",
       "website": "https://wallabag.org",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/wallabag.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -11584,7 +11927,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-wallabag"
     },
     {
       "id": "webcord",
@@ -11594,7 +11938,7 @@
       "repository": "https://github.com/linuxserver/docker-webcord",
       "description": "WebCord can be summarized as a pack of security and privacy hardenings, Discord features reimplementations, Electron / Chromium / Discord bugs workarounds, stylesheets, internal pages and wrapped https://discord.com page, designed to conform with ToS as much as it is possible (or hide the changes that might violate it from Discord's eyes).",
       "website": "https://github.com/SpacingBat3/WebCord",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/webcord-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/webcord-icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -11603,8 +11947,8 @@
       "pushed_at": "2026-09-10T09:27:57Z",
       "updated_at": "2026-04-04",
       "main_image": "lscr.io/linuxserver/webcord:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "communication",
+      "category_label": "Communication & Community",
       "template": "apps/webcord.json",
       "template_status": "generated-unvalidated",
       "content_hash": "ba0930e8043ae3737ec4ea55692111eb35d55e080b2ff24446e191fbae6f91cf",
@@ -11616,7 +11960,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-webcord"
     },
     {
       "id": "webdav",
@@ -11628,7 +11973,7 @@
       "repository": "https://hub.docker.com/r/ugeek/webdav",
       "description": "WebDAV is a web-based protocol that allows you to share and manage files over the internet, providing a collaborative environment for file editing and versioning.",
       "website": "",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/webdav.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -11652,7 +11997,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "image-webdav"
     },
     {
       "id": "webgrabplus",
@@ -11662,7 +12008,7 @@
       "repository": "https://github.com/linuxserver/docker-webgrabplus",
       "description": "Webgrabplus is a multi-site incremental xmltv epg grabber. It collects tv-program guide data from selected tvguide sites for your favourite channels.",
       "website": "https://www.webgrabplus.com",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/webgrabplus-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/webgrabplus-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -11671,8 +12017,8 @@
       "pushed_at": "2026-09-10T15:25:37Z",
       "updated_at": "2025-09-14",
       "main_image": "lscr.io/linuxserver/webgrabplus:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "media",
+      "category_label": "Media & Streaming",
       "template": "apps/webgrabplus.json",
       "template_status": "generated-unvalidated",
       "content_hash": "d95c683641c930199d082b5a4cd0a7f8319fb22c0d7d0094e5f37f7e4709ce70",
@@ -11684,7 +12030,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-webgrabplus"
     },
     {
       "id": "webstation",
@@ -11694,7 +12041,7 @@
       "repository": "https://github.com/linuxserver/docker-webstation",
       "description": "Webstation is a web native emulation focused LXQt desktop based on Ubuntu.",
       "website": "https://github.com/linuxserver/docker-webstation",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/webstation-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/webstation-logo.png",
       "architectures": [
         "amd64"
       ],
@@ -11702,8 +12049,8 @@
       "pushed_at": "2026-09-13T14:32:58Z",
       "updated_at": "2026-08-21",
       "main_image": "lscr.io/linuxserver/webstation:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "desktop",
+      "category_label": "Browsers & Web Desktops",
       "template": "apps/webstation.json",
       "template_status": "generated-unvalidated",
       "content_hash": "98b5ee5bd4e9cfde9a16c956050eb92dc69bc338a2025a274f6247aed82964ae",
@@ -11715,7 +12062,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-webstation"
     },
     {
       "id": "webtop",
@@ -11725,7 +12073,7 @@
       "repository": "https://github.com/linuxserver/docker-webtop",
       "description": "Webtop - Alpine, Ubuntu, Fedora, and Arch based containers containing full desktop environments in officially supported flavors accessible via any modern web browser.",
       "website": "https://github.com/linuxserver/docker-webtop",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/webtop-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/webtop.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -11734,8 +12082,8 @@
       "pushed_at": "2026-09-12T22:34:05Z",
       "updated_at": "2026-06-10",
       "main_image": "lscr.io/linuxserver/webtop:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "desktop",
+      "category_label": "Browsers & Web Desktops",
       "template": "apps/webtop.json",
       "template_status": "generated-unvalidated",
       "content_hash": "aad91f6c615364e5409d09ea3a66cbeba37df33e78431e1466cda87853487253",
@@ -11747,7 +12095,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-webtop"
     },
     {
       "id": "weixin",
@@ -11757,7 +12106,7 @@
       "repository": "https://github.com/linuxserver/docker-weixin",
       "description": "Weixin (WeChat) is an instant messaging, social media, and mobile payment app developed by Tencent.",
       "website": "https://weixin.qq.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/weixin-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/weixin-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -11766,8 +12115,8 @@
       "pushed_at": "2026-09-13T15:32:49Z",
       "updated_at": "2026-03-29",
       "main_image": "lscr.io/linuxserver/weixin:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "communication",
+      "category_label": "Communication & Community",
       "template": "apps/weixin.json",
       "template_status": "generated-unvalidated",
       "content_hash": "478228945042bca9aebc49d1e8124aac5b71c1f321b7fffe8ad49715b887f857",
@@ -11779,7 +12128,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-weixin"
     },
     {
       "id": "weknora",
@@ -11791,7 +12141,7 @@
       "repository": "https://hub.docker.com/r/wechatopenai/weknora-ui",
       "description": "WeKnora is a deep document understanding and semantic retrieval framework based on Large Language Models (LLM), specifically designed for document scenarios with complex structures and heterogeneous content. It adopts a modular architecture, integrating key technologies such as multimodal preprocessing, semantic vector indexing, intelligent retrieval, and large model inference. Based on the Retrieval-Augmented Generation (RAG) paradigm, it achieves context-aware, high-quality Q&A capabilities. WeKnora can deeply understand document content in different formats, combine relevant document fragments with language model inference, and output accurate, coherent semantic results.\n\n**Key Features:**\n- Multimodal Deep Parsing: Supports structured content extraction from various formats such as PDF, Word, TXT, images, including OCR image text recognition.\n- Semantic Vector Indexing and Intelligent Retrieval: Achieves high-precision semantic matching and recall through a combination of vector retrieval, keyword retrieval, and even knowledge graph-enhanced retrieval.\n- RAG Closed-Loop Q&A Generation: Generates accurate and coherent content answers by leveraging large language model inference and retrieval fragment fusion.\n- Agent Mode Enhanced Capabilities: Supports ReACT Agent mode, which can call built-in tools, external web search, etc., during multi-round iterations, to improve complex task processing capabilities.\n- Multi-type Knowledge Base Management: Can create FAQ and document-type knowledge bases, and flexibly manage tags, batch import files or URLs.\n- Configurable Dialogue Strategy and UI: Provides an intuitive Web interface and REST API, allowing online adjustment of models, retrieval thresholds, and Prompt to control dialogue behavior.\n\n**Learn More:**\n- [Official Website](https://weknora.weixin.qq.com)\n- [GitHub Link](https://github.com/Tencent/WeKnora)\n",
       "website": "https://weknora.weixin.qq.com",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/WeKnora/icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -11824,7 +12174,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "image-weknora"
     },
     {
       "id": "wg-easy",
@@ -11836,7 +12187,7 @@
       "repository": "https://ghcr.io/wg-easy/wg-easy",
       "description": "You have found the easiest way to install & manage WireGuard on any Linux host!",
       "website": "",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/WireGuardEasy/icon.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -11847,8 +12198,8 @@
       "pushed_at": "2026-09-11T10:43:22Z",
       "updated_at": "2024-07-16",
       "main_image": "ghcr.io/wg-easy/wg-easy:latest",
-      "category": "network",
-      "category_label": "Network & Firewall",
+      "category": "remote",
+      "category_label": "Remote Access & VPN",
       "template": "apps/wg-easy.json",
       "template_status": "laboratory-validated",
       "content_hash": "1dcc5a50a84c407cb5b9cc5903a7bce1656b1582f2db12494572b5221c37d25a",
@@ -11860,7 +12211,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "image-wg-easy"
     },
     {
       "id": "wikijs",
@@ -11870,7 +12222,7 @@
       "repository": "https://github.com/linuxserver/docker-wikijs",
       "description": "Wikijs A modern, lightweight and powerful wiki app built on NodeJS.",
       "website": "https://github.com/Requarks/wiki",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/wikijs-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/wiki-js.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -11892,7 +12244,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-wikijs"
     },
     {
       "id": "winegui",
@@ -11902,7 +12255,7 @@
       "repository": "https://github.com/linuxserver/docker-winegui",
       "description": "WineGUI is a user-interface friendly Wine manager that provides a graphical frontend for creating and managing Wine bottles.",
       "website": "https://gitlab.melroy.org/melroy/winegui",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/winegui-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/winegui-logo.png",
       "architectures": [
         "amd64"
       ],
@@ -11910,8 +12263,8 @@
       "pushed_at": "2026-09-13T17:40:25Z",
       "updated_at": "2026-04-22",
       "main_image": "lscr.io/linuxserver/winegui:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "desktop",
+      "category_label": "Browsers & Web Desktops",
       "template": "apps/winegui.json",
       "template_status": "generated-unvalidated",
       "content_hash": "c0c8f281a8251cdf5828cf9f535216c7426ccbcac51c5babcf694b7321478f5a",
@@ -11923,7 +12276,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-winegui"
     },
     {
       "id": "wireguard",
@@ -11933,7 +12287,7 @@
       "repository": "https://github.com/linuxserver/docker-wireguard",
       "description": "WireGuard\u00ae is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many different circumstances. Initially released for the Linux kernel, it is now cross-platform (Windows, macOS, BSD, iOS, Android) and widely deployable. It is currently under heavy development, but already it might be regarded as the most secure, easiest to use, and simplest VPN solution in the industry.",
       "website": "https://www.wireguard.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/wireguard-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/wireguard.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -11955,7 +12309,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-wireguard"
     },
     {
       "id": "wireshark",
@@ -11965,7 +12320,7 @@
       "repository": "https://github.com/linuxserver/docker-wireshark",
       "description": "Wireshark is the world\u2019s foremost and widely-used network protocol analyzer. It lets you see what\u2019s happening on your network at a microscopic level and is the de facto (and often de jure) standard across many commercial and non-profit enterprises, government agencies, and educational institutions. Wireshark development thrives thanks to the volunteer contributions of networking experts around the globe and is the continuation of a project started by Gerald Combs in 1998.",
       "website": "https://www.wireshark.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/wireshark-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/wireshark.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -11974,8 +12329,8 @@
       "pushed_at": "2026-09-07T19:32:17Z",
       "updated_at": "2026-06-10",
       "main_image": "lscr.io/linuxserver/wireshark:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "network",
+      "category_label": "Network & Firewall",
       "template": "apps/wireshark.json",
       "template_status": "generated-unvalidated",
       "content_hash": "a4301805cc1694ec90fd9ae0bb316e41e93bc736f791d045ea545a775fd15197",
@@ -11987,7 +12342,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-wireshark"
     },
     {
       "id": "wps-office",
@@ -11997,7 +12353,7 @@
       "repository": "https://github.com/linuxserver/docker-wps-office",
       "description": "WPS Office is a lightweight, feature-rich comprehensive office suite with high compatibility. As a handy and professional office software, WPS Office allows you to edit files in Writer, Presentation, Spreadsheet, and PDF to improve your work efficiency.",
       "website": "https://www.wps.com/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/wps-office-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/wps-office-icon.png",
       "architectures": [
         "amd64"
       ],
@@ -12005,8 +12361,8 @@
       "pushed_at": "2026-09-07T17:45:52Z",
       "updated_at": "2026-04-11",
       "main_image": "lscr.io/linuxserver/wps-office:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "documents",
+      "category_label": "Documents & Notes",
       "template": "apps/wps-office.json",
       "template_status": "generated-unvalidated",
       "content_hash": "b6bec2aab5f09d42185c54420022a7eb6f1ef59f21a23c0475f2550f53b576b5",
@@ -12018,7 +12374,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-wps-office"
     },
     {
       "id": "xbackbone",
@@ -12028,7 +12385,7 @@
       "repository": "https://github.com/linuxserver/docker-xbackbone",
       "description": "Xbackbone is a simple, self-hosted, lightweight PHP file manager that support the instant sharing tool ShareX and *NIX systems. It supports uploading and displaying images, GIF, video, code, formatted text, and file downloading and uploading. Also have a web UI with multi user management, past uploads history and search support.",
       "website": "https://github.com/SergiX44/XBackBone",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/xbackbone-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/xbackbone.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -12037,8 +12394,8 @@
       "pushed_at": "2026-09-13T07:29:57Z",
       "updated_at": "2026-07-05",
       "main_image": "lscr.io/linuxserver/xbackbone:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "downloads",
+      "category_label": "Files & Downloads",
       "template": "apps/xbackbone.json",
       "template_status": "generated-unvalidated",
       "content_hash": "6255b5f8ca24964edd110dda06e8d597673649f56fd113bfbb6203cfb12e3c52",
@@ -12050,7 +12407,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-xbackbone"
     },
     {
       "id": "xemu",
@@ -12060,7 +12418,7 @@
       "repository": "https://github.com/linuxserver/docker-xemu",
       "description": "xemu is a free and open-source application that emulates the original Microsoft Xbox game console, enabling people to play their original Xbox games on Windows, macOS, and Linux systems.",
       "website": "https://xemu.app/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/xemu-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/xemu-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -12069,8 +12427,8 @@
       "pushed_at": "2026-09-08T00:04:23Z",
       "updated_at": "2026-05-09",
       "main_image": "lscr.io/linuxserver/xemu:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "gaming",
+      "category_label": "Gaming & Leisure",
       "template": "apps/xemu.json",
       "template_status": "generated-unvalidated",
       "content_hash": "23d26871dccef7cfd4dd1033de8a2e41aad54a5eaf89491a4a0afd0499144ee2",
@@ -12082,7 +12440,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-xemu"
     },
     {
       "id": "yaak",
@@ -12092,7 +12451,7 @@
       "repository": "https://github.com/linuxserver/docker-yaak",
       "description": "Yaak is a desktop API client for organizing and executing REST, GraphQL, and gRPC requests. It's built using Tauri, Rust, and ReactJS.",
       "website": "https://yaak.app/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/yaak-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/yaak-logo.png",
       "architectures": [
         "amd64"
       ],
@@ -12100,8 +12459,8 @@
       "pushed_at": "2026-09-08T08:58:32Z",
       "updated_at": "2026-04-20",
       "main_image": "lscr.io/linuxserver/yaak:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "ai",
+      "category_label": "AI / Coding & Dev-Tools",
       "template": "apps/yaak.json",
       "template_status": "generated-unvalidated",
       "content_hash": "ed19a7d4fcbcee297a93cca4c257e6bc5f535e19364b8aaa36297913cad18799",
@@ -12113,7 +12472,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-yaak"
     },
     {
       "id": "your_spotify",
@@ -12123,7 +12483,7 @@
       "repository": "https://github.com/linuxserver/docker-your_spotify",
       "description": "Your_spotify is a self-hosted application that tracks what you listen and offers you a dashboard to explore statistics about it! It's composed of a web server which polls the Spotify API every now and then and a web application on which you can explore your statistics.",
       "website": "https://github.com/Yooooomi/your_spotify",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/your_spotify-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/your-spotify.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -12132,8 +12492,8 @@
       "pushed_at": "2026-09-09T21:24:34Z",
       "updated_at": "2026-07-05",
       "main_image": "lscr.io/linuxserver/your_spotify:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "media",
+      "category_label": "Media & Streaming",
       "template": "apps/your_spotify.json",
       "template_status": "generated-unvalidated",
       "content_hash": "513c6c87abca5fe6af78b28e5cb1b838c223a130baa070694b205c61177b15e0",
@@ -12145,7 +12505,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "linuxserver-your-spotify"
     },
     {
       "id": "zen",
@@ -12155,7 +12516,7 @@
       "repository": "https://github.com/linuxserver/docker-zen",
       "description": "Zen Browser is a free and open-source fork of Mozilla Firefox with a focus on privacy, customizability and design.",
       "website": "https://zen-browser.app/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/zen-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/zen-logo.png",
       "architectures": [
         "amd64",
         "arm64"
@@ -12164,8 +12525,8 @@
       "pushed_at": "2026-09-12T17:01:50Z",
       "updated_at": "2026-03-31",
       "main_image": "lscr.io/linuxserver/zen:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "desktop",
+      "category_label": "Browsers & Web Desktops",
       "template": "apps/zen.json",
       "template_status": "generated-unvalidated",
       "content_hash": "72bfa0ed4079c6b8111b293068eb6ffd017a65b80d4528333a2cb0ae0872ec63",
@@ -12177,7 +12538,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-zen"
     },
     {
       "id": "znc",
@@ -12187,7 +12549,7 @@
       "repository": "https://github.com/linuxserver/docker-znc",
       "description": "Znc is an IRC network bouncer or BNC. It can detach the client from the actual IRC server, and also from selected channels. Multiple clients from different locations can connect to a single ZNC account simultaneously and therefore appear under the same nickname on IRC.",
       "website": "http://wiki.znc.in/ZNC",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/znc-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/znc.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -12196,8 +12558,8 @@
       "pushed_at": "2026-09-13T12:59:55Z",
       "updated_at": "2025-07-27",
       "main_image": "lscr.io/linuxserver/znc:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "communication",
+      "category_label": "Communication & Community",
       "template": "apps/znc.json",
       "template_status": "generated-unvalidated",
       "content_hash": "292b65cc31485609de0925f22036da98829f698e98479f8bc7f4477633909808",
@@ -12209,7 +12571,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-znc"
     },
     {
       "id": "zotero",
@@ -12219,7 +12582,7 @@
       "repository": "https://github.com/linuxserver/docker-zotero",
       "description": "Zotero is a free, easy-to-use tool to help you collect, organize, annotate, cite, and share research.",
       "website": "https://www.zotero.org/",
-      "icon": "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/zotero-icon.png",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/zotero.webp",
       "architectures": [
         "amd64"
       ],
@@ -12227,8 +12590,8 @@
       "pushed_at": "2026-09-09T22:15:01Z",
       "updated_at": "2026-03-30",
       "main_image": "lscr.io/linuxserver/zotero:latest",
-      "category": "misc",
-      "category_label": "Miscellaneous",
+      "category": "documents",
+      "category_label": "Documents & Notes",
       "template": "apps/zotero.json",
       "template_status": "generated-unvalidated",
       "content_hash": "d37149cffd35aaed02da6f93edf483865ba4df6937bc1ad9fa6ee24361e27d96",
@@ -12240,7 +12603,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": false
+      "hidden": false,
+      "template_id": "linuxserver-zotero"
     },
     {
       "id": "ztnet",
@@ -12252,7 +12616,7 @@
       "repository": "https://hub.docker.com/r/sinamics/ztnet",
       "description": "ZTNET is a powerful ZeroTier network management tool that simplifies network configuration and management through an intuitive Web interface, ideal for teams and individual users. Its modern design and rich features provide an efficient solution for building secure, scalable virtual networks.\n\nThe tool centers on an intuitive Web interface and organization with multi-user support. Developed in TypeScript, it acts as an intermediary between users and the ZeroTier Controller API, enabling collaborative network management within organizations to streamline team tasks. Integration with ZeroTier Central API allows direct management of networks, nodes, and members through a user-friendly interface, enhancing configuration efficiency.\n\nIt supports custom private root servers to create isolated network environments, improving privacy and control. Personalized user spaces enable users to independently create and manage networks. Support for 6plane and rfc4193 IPv6 addressing enriches enterprise or personal networking capabilities. Compatibility with ARM64 and AMD64 architectures ensures broad device support. The tool focuses on user-friendly and flexible design to deliver a modern network management experience.\n\n**Key Features:**\n- Intuitive Web interface for simplified ZeroTier network management\n- Organization and multi-user support for team collaboration\n- Integration with ZeroTier Central API for managing networks and nodes\n- Custom private root server for enhanced privacy and control\n- Personalized user spaces for independent network creation and management\n- Support for 6plane and rfc4193 IPv6 addressing\n- Compatibility with ARM64 and AMD64 architectures for diverse devices\n\n**Learn More:**\n- [ZTnet Official Website](https://ztnet.network/)\n- [ZTnet GitHub](https://github.com/sinamics/ztnet)\n",
       "website": "https://ztnet.network/",
-      "icon": null,
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/ztnet.webp",
       "architectures": [
         "amd64",
         "arm64"
@@ -12280,7 +12644,8 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true
+      "hidden": true,
+      "template_id": "image-ztnet"
     }
   ],
   "discovery": {
diff --git a/oci/remote/install_immich_stack.sh b/oci/remote/install_immich_stack.sh
index 3291a121..20cda072 100755
--- a/oci/remote/install_immich_stack.sh
+++ b/oci/remote/install_immich_stack.sh
@@ -261,7 +261,7 @@ resolve_image_manifest() {
 
 ensure_image() {
   local key=$1 image=$2 transport_image inspect digest short archive_name archive_volume archive_path
-  local partial log pid bytes elapsed status process_bytes pull_name
+  local partial log pid bytes elapsed status process_bytes pull_name attempt
   msg_info "$(translate "Checking the image in the registry...")"
   oci_log "Resolving ${key}: ${image}"
   transport_image=$(skopeo_transport_reference "$image")
@@ -285,34 +285,49 @@ ensure_image() {
     oci_log "Reusing ${archive_volume}"
   else
     rm -f "$archive_path"
-    partial="${archive_path}.partial.$$"
-    log="${partial}.log"
-    oci_log "Downloading ${image} by digest ${digest}"
-    pull_name=${transport_image%@sha256:*}
-    [[ ${pull_name##*/} != *:* ]] || pull_name=${pull_name%:*}
-    skopeo copy --override-os linux --override-arch "$ARCH" --retry-times 3 \
-      --retry-delay 5s --image-parallel-copies 1 \
-      "docker://${pull_name}@${digest}" "oci-archive:${partial}:image-immich-${key}" >"$log" 2>&1 &
-    pid=$!
-    elapsed=0
-    while kill -0 "$pid" 2>/dev/null; do
-      bytes=$(stat -c %s "$partial" 2>/dev/null || printf 0)
-      process_bytes=$(awk '$1 == "rchar:" { print $2 }' "/proc/${pid}/io" 2>/dev/null || printf 0)
-      process_bytes=${process_bytes:-0}
-      (( process_bytes <= bytes )) || bytes=$process_bytes
-      msg_progress "$(translate "Downloading the image:") ${key} · $((bytes / 1048576)) MiB · ${elapsed}s"
-      sleep 2
-      elapsed=$((elapsed + 2))
+    # A download can come back complete yet damaged when the connection drops
+    # and the transfer resumes; the integrity check catches it, and a second
+    # download is what repairs it.
+    for attempt in 1 2; do
+      partial="${archive_path}.partial.$$"
+      log="${partial}.log"
+      oci_log "Downloading ${image} by digest ${digest} (attempt ${attempt}/2)"
+      pull_name=${transport_image%@sha256:*}
+      [[ ${pull_name##*/} != *:* ]] || pull_name=${pull_name%:*}
+      skopeo copy --override-os linux --override-arch "$ARCH" --retry-times 3 \
+        --retry-delay 5s --image-parallel-copies 1 \
+        "docker://${pull_name}@${digest}" "oci-archive:${partial}:image-immich-${key}" >"$log" 2>&1 &
+      pid=$!
+      elapsed=0
+      while kill -0 "$pid" 2>/dev/null; do
+        bytes=$(stat -c %s "$partial" 2>/dev/null || printf 0)
+        process_bytes=$(awk '$1 == "rchar:" { print $2 }' "/proc/${pid}/io" 2>/dev/null || printf 0)
+        process_bytes=${process_bytes:-0}
+        (( process_bytes <= bytes )) || bytes=$process_bytes
+        msg_progress "$(translate "Downloading the image:") ${key} · $((bytes / 1048576)) MiB · ${elapsed}s"
+        sleep 2
+        elapsed=$((elapsed + 2))
+      done
+      status=0
+      wait "$pid" || status=$?
+      cat "$log" >>"$OCI_LOG"
+      rm -f "$log"
+      if (( status != 0 )); then
+        rm -f "$partial"
+        (( attempt < 2 )) || die "$(translate "Image download failed:") $image"
+        msg_warn "$(translate "The image download did not complete correctly; downloading it again...")"
+        continue
+      fi
+      msg_info "$(translate "Verifying the image integrity...")"
+      if ! oci_quiet python3 "$VERIFY_OCI_ARCHIVE" "$partial"; then
+        rm -f "$partial"
+        (( attempt < 2 )) || die "$(translate "The downloaded image is corrupt:") $image"
+        msg_warn "$(translate "The image download did not complete correctly; downloading it again...")"
+        continue
+      fi
+      mv -f "$partial" "$archive_path"
+      break
     done
-    status=0
-    wait "$pid" || status=$?
-    cat "$log" >>"$OCI_LOG"
-    rm -f "$log"
-    (( status == 0 )) || { rm -f "$partial"; die "$(translate "Image download failed:") $image"; }
-    msg_info "$(translate "Verifying the image integrity...")"
-    oci_quiet python3 "$VERIFY_OCI_ARCHIVE" "$partial" \
-      || { rm -f "$partial"; die "$(translate "The downloaded image is corrupt:") $image"; }
-    mv -f "$partial" "$archive_path"
   fi
   msg_ok "$(translate "Image:") $image"
   RESOLVED_ARCHIVE=$archive_volume
diff --git a/oci/remote/install_nextcloud_stack.sh b/oci/remote/install_nextcloud_stack.sh
index 244610b4..3eec9f7a 100755
--- a/oci/remote/install_nextcloud_stack.sh
+++ b/oci/remote/install_nextcloud_stack.sh
@@ -247,7 +247,7 @@ resolve_image_manifest() {
 
 ensure_image() {
   local key=$1 image=$2 transport_image inspect digest short archive_name archive_volume archive_path
-  local partial log pid bytes elapsed status
+  local partial log pid bytes elapsed status attempt
   msg_info "$(translate "Checking the image in the registry...")"
   oci_log "Resolving ${key}: ${image}"
   transport_image=$(skopeo_transport_reference "$image")
@@ -268,29 +268,44 @@ ensure_image() {
     oci_log "Reusing ${archive_volume}"
   else
     rm -f "$archive_path"
-    partial="${archive_path}.partial.$$"
-    log="${partial}.log"
-    oci_log "Downloading ${image} by digest ${digest}"
-    skopeo copy --override-os linux --override-arch "$ARCH" --retry-times 3 \
-      --retry-delay 5s --image-parallel-copies 1 \
-      "docker://${transport_image}" "oci-archive:${partial}:image-nextcloud-${key}" >"$log" 2>&1 &
-    pid=$!
-    elapsed=0
-    while kill -0 "$pid" 2>/dev/null; do
-      bytes=$(stat -c %s "$partial" 2>/dev/null || printf 0)
-      msg_progress "$(translate "Downloading the image:") ${key} · $((bytes / 1048576)) MiB · ${elapsed}s"
-      sleep 2
-      elapsed=$((elapsed + 2))
+    # A download can come back complete yet damaged when the connection drops
+    # and the transfer resumes; the integrity check catches it, and a second
+    # download is what repairs it.
+    for attempt in 1 2; do
+      partial="${archive_path}.partial.$$"
+      log="${partial}.log"
+      oci_log "Downloading ${image} by digest ${digest} (attempt ${attempt}/2)"
+      skopeo copy --override-os linux --override-arch "$ARCH" --retry-times 3 \
+        --retry-delay 5s --image-parallel-copies 1 \
+        "docker://${transport_image}" "oci-archive:${partial}:image-nextcloud-${key}" >"$log" 2>&1 &
+      pid=$!
+      elapsed=0
+      while kill -0 "$pid" 2>/dev/null; do
+        bytes=$(stat -c %s "$partial" 2>/dev/null || printf 0)
+        msg_progress "$(translate "Downloading the image:") ${key} · $((bytes / 1048576)) MiB · ${elapsed}s"
+        sleep 2
+        elapsed=$((elapsed + 2))
+      done
+      status=0
+      wait "$pid" || status=$?
+      cat "$log" >>"$OCI_LOG"
+      rm -f "$log"
+      if (( status != 0 )); then
+        rm -f "$partial"
+        (( attempt < 2 )) || die "$(translate "Image download failed:") $image"
+        msg_warn "$(translate "The image download did not complete correctly; downloading it again...")"
+        continue
+      fi
+      msg_info "$(translate "Verifying the image integrity...")"
+      if ! oci_quiet python3 "$VERIFY_OCI_ARCHIVE" "$partial"; then
+        rm -f "$partial"
+        (( attempt < 2 )) || die "$(translate "The downloaded image is corrupt:") $image"
+        msg_warn "$(translate "The image download did not complete correctly; downloading it again...")"
+        continue
+      fi
+      mv -f "$partial" "$archive_path"
+      break
     done
-    status=0
-    wait "$pid" || status=$?
-    cat "$log" >>"$OCI_LOG"
-    rm -f "$log"
-    (( status == 0 )) || { rm -f "$partial"; die "$(translate "Image download failed:") $image"; }
-    msg_info "$(translate "Verifying the image integrity...")"
-    oci_quiet python3 "$VERIFY_OCI_ARCHIVE" "$partial" \
-      || { rm -f "$partial"; die "$(translate "The downloaded image is corrupt:") $image"; }
-    mv -f "$partial" "$archive_path"
   fi
   msg_ok "$(translate "Image:") $image"
   RESOLVED_ARCHIVE=$archive_volume
diff --git a/oci/remote/install_oci.sh b/oci/remote/install_oci.sh
index 647b54bc..580ac247 100755
--- a/oci/remote/install_oci.sh
+++ b/oci/remote/install_oci.sh
@@ -226,19 +226,10 @@ INSTALL_COMPLETE=0
 PRESERVE_FAILED_CT=0
 
 cleanup_runtime_console_log() {
-  [[ -n $RUNTIME_CONSOLE_LOG ]] || return 0
-  if [[ -f ${CONF:-} ]]; then
-    local temporary_conf
-    temporary_conf=$(mktemp)
-    awk '
-      $0 !~ /^lxc\.console\.logfile:/ &&
-      $0 !~ /^lxc\.console\.size:/ &&
-      $0 !~ /^lxc\.console\.rotate:/
-    ' "$CONF" >"$temporary_conf"
-    cat "$temporary_conf" >"$CONF"
-    rm -f "$temporary_conf"
-  fi
-  rm -f "$RUNTIME_CONSOLE_LOG" "${RUNTIME_CONSOLE_LOG}.1"
+  # The console log is the container's own log from here on, and its line in
+  # the configuration stays with it: there is nothing to undo. A failed
+  # installation keeps the file too, since it holds why the application did
+  # not come up.
   RUNTIME_CONSOLE_LOG=""
 }
 
@@ -1113,7 +1104,7 @@ if [[ $DRY_RUN == 1 ]]; then
 fi
 
 # Hold the registry lock through installation so reconciliation cannot race it.
-INSTANCE_ROOT=${PROXMENUX_OCI_INSTANCE_ROOT:-/usr/local/share/proxmenux/oci/apps}
+INSTANCE_ROOT=${PROXMENUX_OCI_INSTANCE_ROOT:-/usr/local/share/proxmenux/oci/instances}
 if [[ -n ${PROXMENUX_OCI_TRANSACTION:-} ]]; then
   INSTANCE_ID=$(python3 "${SCRIPT_DIR}/oci_instance_transaction.py" --root "$INSTANCE_ROOT" \
     authorize-candidate "$VMID" --journal "$PROXMENUX_OCI_TRANSACTION" \
@@ -1303,8 +1294,7 @@ if [[ ! -s $ARCHIVE_PATH ]]; then
 fi
 fi
 
-DESCRIPTION="ProxMenux OCI: ${APP_ID}; image=${IMAGE_REF}; digest=${DIGEST}; source=${REVISION}; status=${STATUS}"
-DESCRIPTION="${DESCRIPTION}; proxmenux-instance=${INSTANCE_ID}"
+DESCRIPTION="proxmenux-instance=${INSTANCE_ID}"
 UNPRIVILEGED=$(jq -r 'if .security | has("unprivileged") then .security.unprivileged else true end' "$DEPLOYMENT_FILE")
 case "$UNPRIVILEGED" in
   true) UNPRIVILEGED_FLAG=1 ;;
@@ -1663,13 +1653,14 @@ CREDENTIALS=$(jq -c --argjson environment "$DEPLOYMENT_ENVIRONMENT" '
 ' "$TEMPLATE_FILE")
 RUNTIME_CREDENTIALS=$(jq '[.[] | select(.retrieval.method? == "container-console-pattern")] | length' <<<"$CREDENTIALS")
 
-if [[ $START_AFTER == 1 && ( $RUNTIME_CREDENTIALS -gt 0 || $HAS_STARTUP_HEALTHCHECK == 1 || $HAS_RUNNING_CHECK == 1 || $HAOS_HEALTHCHECK != 0 ) ]]; then
-  RUNTIME_CONSOLE_DIR="/run/proxmenux-oci"
-  install -d -m 700 "$RUNTIME_CONSOLE_DIR"
-  RUNTIME_CONSOLE_LOG="${RUNTIME_CONSOLE_DIR}/ct-${VMID}.console.log"
-  install -m 600 /dev/null "$RUNTIME_CONSOLE_LOG"
-  printf 'lxc.console.logfile: %s\n' "$RUNTIME_CONSOLE_LOG" >>"$CONF"
-fi
+# The console of the container is kept as its log, the way `docker logs` keeps
+# it, and the Proxmox console opens a shell when the image has one. Both are
+# set before the configuration is recorded, so the record carries them and an
+# update, which rebuilds the container through this installer, sets them again.
+# The first-boot credentials are read from the same log.
+CONSOLE_STATE=$(python3 "${SCRIPT_DIR}/oci_console.py" configure "$VMID") \
+  || die "$(translate "The console of the container could not be configured")"
+RUNTIME_CONSOLE_LOG=$(jq -r '.log' <<<"$CONSOLE_STATE")
 
 oci_log "Configuration created for CT $VMID"
 PASSWORD_STATE=""
@@ -1870,6 +1861,12 @@ fi
 
 cleanup_runtime_console_log
 
+UPDATED_DESCRIPTION=$(python3 "${SCRIPT_DIR}/oci_description.py" --template "$TEMPLATE_FILE" \
+  --digest "$DIGEST" --instance "$INSTANCE_ID" --ip "$IP") \
+  || die "Could not prepare the OCI notes"
+oci_quiet pct set "$VMID" --description "$UPDATED_DESCRIPTION" \
+  || die "Could not write the OCI notes in Proxmox"
+
 URLS=$(jq -c --arg ip "$IP" '
   if $ip == "" then []
   elif (.first_run.endpoints? // []) | length > 0 then
diff --git a/oci/remote/install_paperless_stack.sh b/oci/remote/install_paperless_stack.sh
index bcab84a5..fd2afd4e 100755
--- a/oci/remote/install_paperless_stack.sh
+++ b/oci/remote/install_paperless_stack.sh
@@ -254,7 +254,7 @@ resolve_image_manifest() {
 
 ensure_image() {
   local key=$1 image=$2 transport_image inspect digest short archive_name archive_volume archive_path
-  local partial log pid bytes elapsed status
+  local partial log pid bytes elapsed status attempt
   msg_info "$(translate "Checking the image in the registry...")"
   oci_log "Resolving ${key}: ${image}"
   transport_image=$(skopeo_transport_reference "$image")
@@ -275,29 +275,44 @@ ensure_image() {
     oci_log "Reusing ${archive_volume}"
   else
     rm -f "$archive_path"
-    partial="${archive_path}.partial.$$"
-    log="${partial}.log"
-    oci_log "Downloading ${image} by digest ${digest}"
-    skopeo copy --override-os linux --override-arch "$ARCH" --retry-times 3 \
-      --retry-delay 5s --image-parallel-copies 1 \
-      "docker://${transport_image}" "oci-archive:${partial}:image-paperless-${key}" >"$log" 2>&1 &
-    pid=$!
-    elapsed=0
-    while kill -0 "$pid" 2>/dev/null; do
-      bytes=$(stat -c %s "$partial" 2>/dev/null || printf 0)
-      msg_progress "$(translate "Downloading the image:") ${key} · $((bytes / 1048576)) MiB · ${elapsed}s"
-      sleep 2
-      elapsed=$((elapsed + 2))
+    # A download can come back complete yet damaged when the connection drops
+    # and the transfer resumes; the integrity check catches it, and a second
+    # download is what repairs it.
+    for attempt in 1 2; do
+      partial="${archive_path}.partial.$$"
+      log="${partial}.log"
+      oci_log "Downloading ${image} by digest ${digest} (attempt ${attempt}/2)"
+      skopeo copy --override-os linux --override-arch "$ARCH" --retry-times 3 \
+        --retry-delay 5s --image-parallel-copies 1 \
+        "docker://${transport_image}" "oci-archive:${partial}:image-paperless-${key}" >"$log" 2>&1 &
+      pid=$!
+      elapsed=0
+      while kill -0 "$pid" 2>/dev/null; do
+        bytes=$(stat -c %s "$partial" 2>/dev/null || printf 0)
+        msg_progress "$(translate "Downloading the image:") ${key} · $((bytes / 1048576)) MiB · ${elapsed}s"
+        sleep 2
+        elapsed=$((elapsed + 2))
+      done
+      status=0
+      wait "$pid" || status=$?
+      cat "$log" >>"$OCI_LOG"
+      rm -f "$log"
+      if (( status != 0 )); then
+        rm -f "$partial"
+        (( attempt < 2 )) || die "$(translate "Image download failed:") $image"
+        msg_warn "$(translate "The image download did not complete correctly; downloading it again...")"
+        continue
+      fi
+      msg_info "$(translate "Verifying the image integrity...")"
+      if ! oci_quiet python3 "$VERIFY_OCI_ARCHIVE" "$partial"; then
+        rm -f "$partial"
+        (( attempt < 2 )) || die "$(translate "The downloaded image is corrupt:") $image"
+        msg_warn "$(translate "The image download did not complete correctly; downloading it again...")"
+        continue
+      fi
+      mv -f "$partial" "$archive_path"
+      break
     done
-    status=0
-    wait "$pid" || status=$?
-    cat "$log" >>"$OCI_LOG"
-    rm -f "$log"
-    (( status == 0 )) || { rm -f "$partial"; die "$(translate "Image download failed:") $image"; }
-    msg_info "$(translate "Verifying the image integrity...")"
-    oci_quiet python3 "$VERIFY_OCI_ARCHIVE" "$partial" \
-      || { rm -f "$partial"; die "$(translate "The downloaded image is corrupt:") $image"; }
-    mv -f "$partial" "$archive_path"
   fi
   msg_ok "$(translate "Image:") $image"
   RESOLVED_ARCHIVE=$archive_volume
diff --git a/oci/remote/install_tandoor_stack.sh b/oci/remote/install_tandoor_stack.sh
index f8455244..1e99c862 100755
--- a/oci/remote/install_tandoor_stack.sh
+++ b/oci/remote/install_tandoor_stack.sh
@@ -261,7 +261,7 @@ resolve_image_manifest() {
 
 ensure_image() {
   local key=$1 image=$2 transport_image inspect digest short archive_name archive_volume archive_path
-  local partial log pid bytes elapsed status
+  local partial log pid bytes elapsed status attempt
   msg_info "$(translate "Checking the image in the registry...")"
   oci_log "Resolving ${key}: ${image}"
   transport_image=$(skopeo_transport_reference "$image")
@@ -282,29 +282,44 @@ ensure_image() {
     oci_log "Reusing ${archive_volume}"
   else
     rm -f "$archive_path"
-    partial="${archive_path}.partial.$$"
-    log="${partial}.log"
-    oci_log "Downloading ${image} by digest ${digest}"
-    skopeo copy --override-os linux --override-arch "$ARCH" --retry-times 3 \
-      --retry-delay 5s --image-parallel-copies 1 \
-      "docker://${transport_image}" "oci-archive:${partial}:image-tandoor-${key}" >"$log" 2>&1 &
-    pid=$!
-    elapsed=0
-    while kill -0 "$pid" 2>/dev/null; do
-      bytes=$(stat -c %s "$partial" 2>/dev/null || printf 0)
-      msg_progress "$(translate "Downloading the image:") ${key} · $((bytes / 1048576)) MiB · ${elapsed}s"
-      sleep 2
-      elapsed=$((elapsed + 2))
+    # A download can come back complete yet damaged when the connection drops
+    # and the transfer resumes; the integrity check catches it, and a second
+    # download is what repairs it.
+    for attempt in 1 2; do
+      partial="${archive_path}.partial.$$"
+      log="${partial}.log"
+      oci_log "Downloading ${image} by digest ${digest} (attempt ${attempt}/2)"
+      skopeo copy --override-os linux --override-arch "$ARCH" --retry-times 3 \
+        --retry-delay 5s --image-parallel-copies 1 \
+        "docker://${transport_image}" "oci-archive:${partial}:image-tandoor-${key}" >"$log" 2>&1 &
+      pid=$!
+      elapsed=0
+      while kill -0 "$pid" 2>/dev/null; do
+        bytes=$(stat -c %s "$partial" 2>/dev/null || printf 0)
+        msg_progress "$(translate "Downloading the image:") ${key} · $((bytes / 1048576)) MiB · ${elapsed}s"
+        sleep 2
+        elapsed=$((elapsed + 2))
+      done
+      status=0
+      wait "$pid" || status=$?
+      cat "$log" >>"$OCI_LOG"
+      rm -f "$log"
+      if (( status != 0 )); then
+        rm -f "$partial"
+        (( attempt < 2 )) || die "$(translate "Image download failed:") $image"
+        msg_warn "$(translate "The image download did not complete correctly; downloading it again...")"
+        continue
+      fi
+      msg_info "$(translate "Verifying the image integrity...")"
+      if ! oci_quiet python3 "$VERIFY_OCI_ARCHIVE" "$partial"; then
+        rm -f "$partial"
+        (( attempt < 2 )) || die "$(translate "The downloaded image is corrupt:") $image"
+        msg_warn "$(translate "The image download did not complete correctly; downloading it again...")"
+        continue
+      fi
+      mv -f "$partial" "$archive_path"
+      break
     done
-    status=0
-    wait "$pid" || status=$?
-    cat "$log" >>"$OCI_LOG"
-    rm -f "$log"
-    (( status == 0 )) || { rm -f "$partial"; die "$(translate "Image download failed:") $image"; }
-    msg_info "$(translate "Verifying the image integrity...")"
-    oci_quiet python3 "$VERIFY_OCI_ARCHIVE" "$partial" \
-      || { rm -f "$partial"; die "$(translate "The downloaded image is corrupt:") $image"; }
-    mv -f "$partial" "$archive_path"
   fi
   msg_ok "$(translate "Image:") $image"
   RESOLVED_ARCHIVE=$archive_volume
diff --git a/oci/remote/oci_console.py b/oci/remote/oci_console.py
new file mode 100644
index 00000000..d00b1f4b
--- /dev/null
+++ b/oci/remote/oci_console.py
@@ -0,0 +1,200 @@
+#!/usr/bin/env python3
+"""Proxmox console of a native OCI container: a shell through lxc-attach.
+
+An OCI image starts its own entrypoint as PID 1 and runs no login service, so
+the default `cmode: console` attaches to a tty nothing answers on. `cmode:
+shell` makes Proxmox open `lxc-attach --clear-env` instead: a new process in
+the container's namespaces, with PID 1 and the image untouched. It is the
+equivalent of `docker exec` — root inside that container, without a password,
+for whoever Proxmox lets open its console.
+
+lxc-attach runs the shell /etc/passwd gives root, and falls back to /bin/sh
+only when root has no entry at all. An image whose root is set to nologin, or
+that ships no shell, keeps `cmode: console` rather than offering a console
+that closes as soon as it opens.
+"""
+from __future__ import annotations
+
+import argparse
+import contextlib
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+
+NO_LOGIN = ('nologin', 'false')
+LOG_DIR = Path('/var/log/proxmenux/oci')
+LOGROTATE = Path('/etc/logrotate.d/proxmenux-oci')
+# copytruncate, because liblxc keeps the file open for as long as the
+# container runs; moving it away would leave the application writing into the
+# rotated copy. The threshold is checked by the host's daily logrotate run, so
+# it is a rotation threshold, not a hard cap.
+LOGROTATE_POLICY = """/var/log/proxmenux/oci/*.console.log {
+    size 10M
+    rotate 3
+    missingok
+    notifempty
+    copytruncate
+    compress
+}
+"""
+
+
+def _run(*args: str) -> subprocess.CompletedProcess:
+    return subprocess.run(args, capture_output=True, text=True, timeout=60)
+
+
+def _running_pid(vmid: int) -> str | None:
+    result = _run('lxc-info', '-n', str(vmid), '-pH')
+    pid = result.stdout.strip()
+    return pid if result.returncode == 0 and pid.isdigit() else None
+
+
+@contextlib.contextmanager
+def _rootfs(vmid: int):
+    """The container's root filesystem, read from the host.
+
+    A running container is read through its init process, which needs no
+    mount. A stopped one is mounted for the duration of the check and
+    unmounted afterwards.
+    """
+    pid = _running_pid(vmid)
+    if pid:
+        yield Path(f'/proc/{pid}/root')
+        return
+    mounted = _run('pct', 'mount', str(vmid))
+    if mounted.returncode != 0:
+        yield None
+        return
+    try:
+        yield Path(f'/var/lib/lxc/{vmid}/rootfs')
+    finally:
+        _run('pct', 'unmount', str(vmid))
+
+
+def _executable(root: Path, path: str) -> bool:
+    candidate = root / path.lstrip('/')
+    try:
+        return candidate.is_file() and os.access(candidate, os.X_OK)
+    except OSError:
+        return False
+
+
+def root_shell(root: Path) -> str | None:
+    """The shell lxc-attach would start as root, if it can start one."""
+    shell = None
+    try:
+        for line in (root / 'etc/passwd').read_text(errors='replace').splitlines():
+            fields = line.split(':')
+            if len(fields) >= 7 and fields[0] == 'root':
+                shell = fields[6].strip()
+                break
+    except OSError:
+        pass
+    if shell is None:
+        shell = '/bin/sh'
+    if not shell or any(shell.endswith(name) for name in NO_LOGIN):
+        return None
+    return shell if _executable(root, shell) else None
+
+
+def _cmode(vmid: int) -> str:
+    result = _run('pct', 'config', str(vmid))
+    for line in result.stdout.splitlines():
+        if line.startswith('cmode:'):
+            return line.split(':', 1)[1].strip()
+    return 'tty'
+
+
+def status(vmid: int) -> dict:
+    with _rootfs(vmid) as root:
+        shell = root_shell(root) if root else None
+    cmode = _cmode(vmid)
+    return {'vmid': vmid, 'cmode': cmode, 'shell': shell, 'terminal': cmode == 'shell'}
+
+
+def enable_terminal(vmid: int) -> dict:
+    """Open the Proxmox console as a shell, when the image has one."""
+    state = status(vmid)
+    if state['shell'] and state['cmode'] != 'shell':
+        if _run('pct', 'set', str(vmid), '--cmode', 'shell').returncode == 0:
+            state.update(cmode='shell', terminal=True)
+    return state
+
+
+def disable_terminal(vmid: int) -> dict:
+    if _cmode(vmid) == 'shell':
+        _run('pct', 'set', str(vmid), '--cmode', 'console')
+    return status(vmid)
+
+
+def log_path(vmid: int) -> Path:
+    return LOG_DIR / f'{int(vmid)}.console.log'
+
+
+def _ensure_logrotate() -> None:
+    try:
+        if LOGROTATE.read_text() == LOGROTATE_POLICY:
+            return
+    except OSError:
+        pass
+    LOGROTATE.write_text(LOGROTATE_POLICY)
+    os.chmod(LOGROTATE, 0o644)
+
+
+def enable_log(vmid: int) -> Path:
+    """Keep what the container writes to its console, the way `docker logs` does.
+
+    liblxc copies the console of the container — the stdout and stderr of its
+    entrypoint — into the file named by `lxc.console.logfile`, from the moment
+    the container starts and across restarts, without touching the image.
+    It is the only one of the lxc.console options the Proxmox configuration
+    layer keeps; size and rotation are left to logrotate.
+
+    The file starts empty on every creation: a new container, whether freshly
+    installed or rebuilt by an update, has its own log, and the installer reads
+    the first-boot credentials from it without finding a previous one's.
+    """
+    LOG_DIR.mkdir(mode=0o700, parents=True, exist_ok=True)
+    path = log_path(vmid)
+    descriptor = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    os.close(descriptor)
+    os.chmod(path, 0o600)
+    conf = Path(f'/etc/pve/lxc/{int(vmid)}.conf')
+    text = conf.read_text()
+    current, _, snapshots = text.partition('\n[')
+    wanted = f'lxc.console.logfile: {path}'
+    kept = [line for line in current.splitlines() if not line.startswith('lxc.console.logfile:')]
+    kept.append(wanted)
+    rebuilt = '\n'.join(kept) + '\n'
+    if snapshots:
+        rebuilt += '\n[' + snapshots
+    if rebuilt != text:
+        conf.write_text(rebuilt)
+    _ensure_logrotate()
+    return path
+
+
+def configure(vmid: int) -> dict:
+    """Console log and Proxmox terminal of a container being created."""
+    path = enable_log(vmid)
+    state = enable_terminal(vmid)
+    state['log'] = str(path)
+    return state
+
+
+def main(argv=None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__.split('\n', 1)[0])
+    parser.add_argument('action', choices=('status', 'configure', 'enable-terminal', 'disable-terminal'))
+    parser.add_argument('vmid', type=int, nargs='+')
+    args = parser.parse_args(argv)
+    action = {'status': status, 'configure': configure, 'enable-terminal': enable_terminal,
+              'disable-terminal': disable_terminal}[args.action]
+    results = [action(vmid) for vmid in args.vmid]
+    print(json.dumps(results if len(results) > 1 else results[0]))
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())
diff --git a/oci/remote/oci_description.py b/oci/remote/oci_description.py
new file mode 100644
index 00000000..00251708
--- /dev/null
+++ b/oci/remote/oci_description.py
@@ -0,0 +1,127 @@
+#!/usr/bin/env python3
+"""Render the Proxmox Notes for one ProxMenux OCI container."""
+from __future__ import annotations
+
+import argparse
+import html
+import ipaddress
+import json
+from pathlib import Path
+from urllib.parse import urlparse
+
+DOCS = 'https://macrimi.github.io/ProxMenux/docs/oci-manager'
+CODE = 'https://github.com/MacRimi/ProxMenux/tree/main/oci'
+LOGO = 'https://raw.githubusercontent.com/MacRimi/ProxMenux/main/images/logo_desc.png'
+
+
+def safe_url(value):
+    if not isinstance(value, str):
+        return ''
+    parsed = urlparse(value.strip())
+    return value.strip() if parsed.scheme in ('http', 'https') and parsed.netloc else ''
+
+
+def link(label, url):
+    url = safe_url(url)
+    if not url:
+        return ''
+    return (f'<a href="{html.escape(url, quote=True)}" target="_blank" '
+            f'rel="noopener noreferrer">{html.escape(label)}</a>')
+
+
+def image_page(reference):
+    name = reference.split('@', 1)[0]
+    if ':' in name.rsplit('/', 1)[-1]:
+        name = name.rsplit(':', 1)[0]
+    if name.startswith('lscr.io/linuxserver/'):
+        return 'https://docs.linuxserver.io/images/docker-' + name.rsplit('/', 1)[-1] + '/'
+    if name.startswith('ghcr.io/'):
+        parts = name.split('/')
+        if len(parts) >= 3:
+            return f'https://github.com/{parts[1]}/' + '/'.join(parts[2:])
+    if name.startswith('docker.io/'):
+        name = name[len('docker.io/'):]
+    if '/' not in name and name and '.' not in name:
+        return 'https://hub.docker.com/_/' + name
+    if '/' in name and '.' not in name.split('/', 1)[0]:
+        return 'https://hub.docker.com/r/' + name
+    return ''
+
+
+def render(template, digest, instance_id, ip=''):
+    ui = template.get('catalog_ui') or {}
+    contract = template.get('container_contract') or {}
+    image = contract.get('image') or {}
+    title = ui.get('title') or {}
+    if isinstance(title, dict):
+        title = title.get('en_US') or next(iter(title.values()), '')
+    title = str(title or contract.get('service_name') or template.get('id') or 'OCI')
+    reference = str(image.get('reference') or '')
+    source = template.get('source') or {}
+    image_url = (source.get('image_repository_url') or image_page(reference)
+                 or ui.get('repository') or source.get('repository'))
+    resources = [('Image', image_url), ('App', ui.get('website')),
+                 ('App docs', ui.get('documentation'))]
+    repository = ui.get('repository') or source.get('repository')
+    if safe_url(repository) and repository != image_url:
+        resources.append(('Repository', repository))
+    resources = [link(label, url) for label, url in resources]
+    resources = [item for item in resources if item]
+    try:
+        address = str(ipaddress.ip_address(ip)) if ip else ''
+    except ValueError:
+        address = ''
+    endpoints = (template.get('first_run') or {}).get('endpoints') or []
+    if not endpoints and ui.get('launch'):
+        endpoints = [dict(ui['launch'], label='Web UI')]
+    if template.get('id') == 'image-adguard-home':
+        endpoints = [{'label': 'Setup (first run)', 'scheme': 'http', 'port': 3000, 'path': '/'},
+                     {'label': 'Web UI (after setup)', 'scheme': 'http', 'port': 80, 'path': '/'}]
+    access = []
+    if address:
+        for endpoint in endpoints:
+            scheme = endpoint.get('scheme')
+            port = endpoint.get('port')
+            path = endpoint.get('path') or '/'
+            if scheme not in ('http', 'https') or not isinstance(port, int) or not 1 <= port <= 65535:
+                continue
+            if not isinstance(path, str) or not path.startswith('/'):
+                path = '/'
+            url = f'{scheme}://{address}:{port}{path}'
+            item = f'{link(str(endpoint.get("label") or "Web UI"), url)}: {link(url, url)}'
+            if item:
+                access.append(item)
+    badges = (
+        ('Docs', DOCS, 'https://img.shields.io/badge/%F0%9F%93%9A_Docs-blue'),
+        ('Code', CODE, 'https://img.shields.io/badge/%F0%9F%92%BB_Code-green'),
+        ('Ko-fi', 'https://ko-fi.com/macrimi', 'https://img.shields.io/badge/%E2%98%95_Ko--fi-red'),
+    )
+    badge_links = ' '.join(
+        f'<a href="{html.escape(url, quote=True)}" target="_blank" rel="noopener noreferrer">'
+        f'<img src="{badge}" alt="{label}"></a>'
+        for label, url, badge in badges
+    )
+    return f'''<div align="center">
+<table style="width: 100%; border-collapse: collapse;"><tr>
+<td style="width: 100px; vertical-align: middle;"><img src="{LOGO}" alt="ProxMenux Logo" style="height: 100px;"></td>
+<td style="vertical-align: middle;"><h1 style="margin: 0;">{html.escape(title)} OCI</h1><p style="margin: 0;">Created with ProxMenux</p></td>
+</tr></table>
+<p>{badge_links}</p>
+<p>Image: <code>{html.escape(reference)}</code> {' &middot; '.join(resources)}</p>
+{''.join(f'<p>{item}</p>' for item in access)}
+</div>
+<!-- proxmenux-instance={html.escape(instance_id, quote=True)} -->'''
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--template', required=True, type=Path)
+    parser.add_argument('--digest', default='')
+    parser.add_argument('--instance', required=True)
+    parser.add_argument('--ip', default='')
+    args = parser.parse_args()
+    print(render(json.loads(args.template.read_text()), args.digest, args.instance, args.ip))
+
+
+if __name__ == '__main__':
+    main()
diff --git a/oci/remote/oci_installation_state.py b/oci/remote/oci_installation_state.py
index 0a047b60..06a7e92f 100644
--- a/oci/remote/oci_installation_state.py
+++ b/oci/remote/oci_installation_state.py
@@ -21,6 +21,34 @@ from oci_ui import translate, msg_error, msg_ok
 
 ROOT = Path('/var/lib/proxmenux/oci-installations')
 FIELDS = ('Entrypoint', 'Cmd', 'Env', 'User', 'WorkingDir', 'StopSignal', 'Volumes', 'ExposedPorts', 'Healthcheck')
+VERSION_ENV_RE = re.compile(r'^([A-Z][A-Z0-9_]*)_VERSION$')
+# Repositories whose version variable is not named after the image.
+VERSION_ENV_NAMES = {'postgres': 'PG'}
+
+
+def version_from_environment(repository, environment):
+    """The application version an image states in its own environment.
+
+    Official library images publish no labels at all, yet they carry the
+    version as NEXTCLOUD_VERSION, REDIS_VERSION, MONGO_VERSION. Most also
+    carry their dependencies there — GOSU_VERSION, PHP_VERSION, NJS_VERSION —
+    so only a variable that names this image is accepted. A version variable
+    that names something else is never taken for the application's, not even
+    when it is the only one: an application built on a Python base carries
+    PYTHON_VERSION alone, and Paperless-ngx would read as 3.14.7. Anything
+    that does not name the image is left to the label.
+    """
+    found = {}
+    for entry in environment or []:
+        name, _, value = entry.partition('=')
+        match = VERSION_ENV_RE.match(name)
+        if match and value.strip():
+            found[match.group(1)] = value.strip()
+    if not found:
+        return None
+    basename = repository.rsplit('/', 1)[-1]
+    expected = VERSION_ENV_NAMES.get(basename, basename.replace('-', '_')).upper()
+    return found.get(expected)
 
 
 def command(*args):
@@ -151,8 +179,19 @@ def resolve_candidate(reference, architecture):
     if config.get('architecture') != architecture or config.get('os') != 'linux':
         raise ValueError(translate('Incompatible image platform'))
     labels = config.get('config', {}).get('Labels') or {}
-    return {'manifest_digest': digest, 'defaults': {k: config.get('config', {}).get(k) for k in FIELDS},
-            'version': labels.get('org.opencontainers.image.version') or labels.get('build_version')}
+    defaults = {k: config.get('config', {}).get(k) for k in FIELDS}
+    # The environment is read first because a self-naming variable cannot be
+    # inherited: `org.opencontainers.image.version` is copied from the base
+    # image by enough publishers that mongo and rabbitmq both report the
+    # Ubuntu release there instead of their own version.
+    version = (version_from_environment(repo, defaults.get('Env'))
+               or labels.get('org.opencontainers.image.version')
+               or labels.get('build_version'))
+    # The build date identifies the image as the publisher released it: it is
+    # what changes when an image is rebuilt, whether or not the application
+    # version inside it moved.
+    return {'manifest_digest': digest, 'defaults': defaults, 'version': version,
+            'created': config.get('created')}
 
 
 def compare(record, current, candidate=None):
@@ -189,12 +228,24 @@ def compare(record, current, candidate=None):
               'automatic_update_enabled': False, 'blockers': blockers,
               'requires': ['consistent-backup', 'review-rootfs-only-data', 'transactional-updater-not-implemented']}
     if candidate:
-        report['update_available'] = candidate['manifest_digest'] != record['image']['manifest_digest']
-        report['changed_image_fields'] = [key for key in FIELDS if record['image']['defaults'].get(key) != candidate['defaults'].get(key)]
+        replaced = candidate['manifest_digest'] != record['image']['manifest_digest']
+        report['update_available'] = replaced
+        report['candidate_digest'] = candidate['manifest_digest']
+        # The two sides read the image configuration through different paths:
+        # the record from the archive's own config blob, the candidate from
+        # `skopeo inspect --config`, which normalises to the OCI schema and
+        # drops Docker extensions such as Healthcheck. A field the candidate
+        # cannot report is unknown, not changed, and an identical digest means
+        # the configuration is byte-identical whatever either side returns.
+        report['changed_image_fields'] = [
+            key for key in FIELDS
+            if replaced and candidate['defaults'].get(key) is not None
+            and record['image']['defaults'].get(key) != candidate['defaults'].get(key)
+        ]
         old_env = dict(v.split('=', 1) for v in record['image']['defaults'].get('Env') or [] if '=' in v)
         new_env = dict(v.split('=', 1) for v in candidate['defaults'].get('Env') or [] if '=' in v)
-        report['changed_environment_names'] = sorted(k for k in old_env.keys() | new_env.keys() if old_env.get(k) != new_env.get(k))
-        report['candidate_digest'] = candidate['manifest_digest']
+        report['changed_environment_names'] = sorted(
+            k for k in old_env.keys() | new_env.keys() if replaced and old_env.get(k) != new_env.get(k))
     return report
 
 
diff --git a/oci/remote/oci_instance_reconcile.py b/oci/remote/oci_instance_reconcile.py
new file mode 100644
index 00000000..d5efb8ef
--- /dev/null
+++ b/oci/remote/oci_instance_reconcile.py
@@ -0,0 +1,157 @@
+"""Explicitly adopt supported Proxmox mounts and devices into an OCI instance."""
+from __future__ import annotations
+
+import copy
+import re
+import uuid
+
+import oci_instances as instances
+import oci_gpu_devices as gpu_devices
+import oci_host_mounts as host_mounts
+import oci_instance_transaction as transaction
+from oci_installation_state import parse_config, sha
+from oci_ui import translate
+
+
+def _managed_size(value):
+    match = re.fullmatch(r'([1-9][0-9]*)([GMT])', value or '')
+    if not match:
+        raise ValueError(translate('The added disk needs a whole-GiB size recorded by Proxmox'))
+    amount, unit = int(match[1]), match[2]
+    if unit == 'M':
+        if amount % 1024:
+            raise ValueError(translate('The added disk size is not a whole GiB'))
+        return amount // 1024
+    return amount * (1024 if unit == 'T' else 1)
+
+
+def _mount(key, value, vmid):
+    source, *parts = value.split(',')
+    if not source or not parts or any('=' not in part for part in parts):
+        raise ValueError(f'{key}: {translate("Incomplete mount configuration")}')
+    options = dict(part.split('=', 1) for part in parts)
+    if len(options) != len(parts) or set(options) - {'mp', 'size', 'backup', 'ro'}:
+        raise ValueError(f'{key}: {translate("Unsupported mount options")}')
+    target = host_mounts.valid_path(options.get('mp'))
+    read_only = options.get('ro', '0') == '1'
+    if options.get('ro', '0') not in ('0', '1'):
+        raise ValueError(f'{key}: {translate("Invalid read-only option")}')
+    if source.startswith('/'):
+        if options.get('backup', '0') != '0' or 'size' in options:
+            raise ValueError(f'{key}: {translate("Host directories cannot be included in vzdump")}')
+        host_mounts.validate_source(source)
+        return {'type': 'host-bind', 'container_path': target, 'source': source,
+                'size_gb': None, 'backup': False, 'read_only': read_only,
+                'create_if_missing': False}
+    if options.get('backup') != '1' or ':' not in source:
+        raise ValueError(f'{key}: {translate("Only backed-up Proxmox volumes can be adopted")}')
+    storage, volume = source.split(':', 1)
+    if not re.fullmatch(r'[A-Za-z0-9_-]+', storage) or not volume:
+        raise ValueError(f'{key}: {translate("Invalid Proxmox volume ID")}')
+    if not re.search(rf'(?:^|/)(?:vm|subvol)-{vmid}-disk-[0-9]+(?:\.|$)', volume):
+        raise ValueError(f'{key}: {translate("The disk does not belong to this CT; automatic adoption is unsafe")}')
+    return {'type': 'managed-volume', 'container_path': target, 'source': storage,
+            'size_gb': _managed_size(options.get('size')), 'backup': True,
+            'read_only': read_only}
+
+
+def _device(key, value):
+    parts = value.split(',')
+    if any('=' not in part for part in parts):
+        raise ValueError(f'{key}: {translate("Incomplete device configuration")}')
+    fields = dict(part.split('=', 1) for part in parts)
+    if len(fields) != len(parts) or set(fields) - {'path', 'mode', 'gid', 'uid', 'deny-write'}:
+        raise ValueError(f'{key}: {translate("Unsupported device options")}')
+    path = fields.get('path')
+    if not (gpu_devices.gpu_path(path) or gpu_devices.peripheral_path(path)):
+        raise ValueError(f'{key}: {translate("Only Intel/AMD DRM, Coral and USB nodes can be adopted automatically")}')
+    snapshot = gpu_devices.snapshot(path)
+    mode = fields.get('mode', '0660')
+    if not re.fullmatch(r'0?[0-7]{3}', mode):
+        raise ValueError(f'{key}: {translate("Invalid device mode")}')
+    gid = int(fields.get('gid', '0'))
+    if gid not in (0, snapshot['gid']):
+        raise ValueError(f'{key}: {translate("Device GID does not match the host")}')
+    if fields.get('deny-write', '0') not in ('0', '1'):
+        raise ValueError(f'{key}: {translate("Invalid device permissions")}')
+    uid = int(fields.get('uid', '0'))
+    if uid < 0 or uid >= 4294967295:
+        raise ValueError(f'{key}: {translate("Invalid device UID")}')
+    device = {'id': 'adopted-' + path.removeprefix('/dev/').replace('/', '-'),
+              'kind': 'character-device', 'host_path': path, 'container_path': path,
+              'mode': mode, 'gid_strategy': 'host-device-gid' if gid == snapshot['gid'] else 'none',
+              'deny_write': fields.get('deny-write', '0') == '1'}
+    if uid:
+        device['uid'] = uid
+    if gpu_devices.gpu_path(path) and path != '/dev/kfd':
+        device['drm_vendor_ids'] = [snapshot['vendor']]
+    return device
+
+
+def propose(record, config):
+    if (record.get('status') != 'installed' or record.get('stack') or record.get('stack_member')
+            or record.get('native_stack_intent') or record.get('deployment', {}).get('stack_managed')):
+        raise ValueError(translate('Only an installed standalone OCI instance can adopt external changes'))
+    if instances.identity(config) != record['installation_id']:
+        raise ValueError(translate('The container identity changed; nothing was adopted'))
+    before = parse_config(record['observed']['config'].encode())
+    current = parse_config(config)
+    changed = sorted(key for key in before.keys() | current.keys() if before.get(key) != current.get(key))
+    new_keys = [key for key in changed if key not in before and re.fullmatch(r'(mp|dev)[0-9]+', key)]
+    unsupported = [key for key in changed if key not in new_keys and key not in transaction.ADOPTABLE]
+    if unsupported:
+        raise ValueError(f"{translate('These manual changes cannot be adopted safely:')} {', '.join(unsupported)}")
+    if not new_keys:
+        return None
+    candidate = copy.deepcopy(record)
+    deployment = candidate['deployment']
+    details = []
+    for key in new_keys:
+        if key.startswith('mp'):
+            mount = _mount(key, current[key], record['vmid'])
+            deployment.setdefault('mounts', []).append(mount)
+            details.append(f"{key}: {mount['container_path']} <- {current[key].split(',', 1)[0]} "
+                           f"({mount['type']}, backup={int(mount['backup'])})")
+        else:
+            device = _device(key, current[key])
+            deployment.setdefault('devices', []).append(device)
+            kind = 'GPU' if gpu_devices.gpu_path(device['host_path']) else 'USB/Coral'
+            details.append(f"{key}: {device['host_path']} ({kind})")
+    filtered = b'\n'.join(line for line in config.splitlines()
+                          if not any(line.startswith(key.encode() + b': ') for key in new_keys)) + b'\n'
+    for key, value in transaction.external_changes(record, filtered).items():
+        section, name = transaction.ADOPTABLE[key]
+        target = deployment.setdefault(section, {}) if section else deployment
+        target[name] = value
+    candidate['observed']['config'] = config.decode()
+    candidate['observed']['config_sha256'] = sha(config)
+    candidate['observed']['gpu_devices'] = gpu_devices.capture(config)
+    candidate['observed']['host_bind_sources'] = host_mounts.capture_sources(config)
+    transaction.preflight(candidate, copy.deepcopy(candidate), config)
+    return {'candidate': candidate, 'details': details,
+            'previous_record_hash': sha(instances.location(instances.ROOT, record['vmid']).read_bytes()),
+            'config_sha256': sha(config)}
+
+
+def commit(root, vmid, proposal):
+    with instances.locked(root):
+        record = instances.read(root, vmid)
+        path = instances.location(root, vmid)
+        if sha(path.read_bytes()) != proposal['previous_record_hash']:
+            raise ValueError(translate('The OCI contract changed while reviewing; nothing was adopted'))
+        config = instances.command('pct', 'config', str(vmid))
+        if sha(config) != proposal['config_sha256']:
+            raise ValueError(translate('The LXC changed while reviewing; nothing was adopted'))
+        checked = propose(record, config)
+        if checked is None or checked['details'] != proposal['details']:
+            raise ValueError(translate('The proposed changes no longer match; nothing was adopted'))
+        candidate = checked['candidate']
+        observed = instances.observe(vmid, record['installation_id'], record['observed']['archive_path'],
+                                     record['observed']['resolved_registry_digest'], record['observed']['image'])
+        if observed['config_sha256'] != proposal['config_sha256']:
+            raise ValueError(translate('The LXC changed during verification; nothing was adopted'))
+        candidate['observed'] = observed
+        history = path.parent / 'history'
+        instances.write(history / f'before-reconciliation-{uuid.uuid4().hex}.json', record)
+        instances.write(path, candidate)
+        return candidate
diff --git a/oci/remote/oci_instance_transaction.py b/oci/remote/oci_instance_transaction.py
index 1a413a4b..fbeace18 100644
--- a/oci/remote/oci_instance_transaction.py
+++ b/oci/remote/oci_instance_transaction.py
@@ -40,7 +40,10 @@ BASIC = {'arch', 'cmode', 'console', 'tty', 'cores', 'cpulimit', 'cpuunits', 'de
          'entrypoint', 'env', 'features', 'hostname', 'memory', 'net0', 'onboot',
          'ostype', 'rootfs', 'swap', 'tags', 'unprivileged',
          'lxc.init.cwd', 'lxc.init.uid', 'lxc.init.gid', 'lxc.init.groups',
-         'lxc.signal.halt', 'lxc.environment.runtime'}
+         'lxc.signal.halt', 'lxc.environment.runtime',
+         # The container's console log, set by the installer on every
+         # creation; the rebuilt container gets it again the same way.
+         'lxc.console.logfile'}
 # Their output is data (and may hold saved secrets); it is never logged.
 DATA_COMMANDS = {('pct', 'config'), ('pvesh', 'get')}
 LOG_DIR = Path(os.environ.get('OCI_LOG_DIR', '/var/log/proxmenux/oci'))
@@ -759,7 +762,8 @@ def check_archive(archive):
 
 
 def apply(root, vmid, archive, operation, proposal=None, registry_digest=None, interrupt_after=None,
-          backup_compression='zstd', acknowledge_external_data=False, coordinated=None, progress=None):
+          backup_compression='zstd', acknowledge_external_data=False, coordinated=None, progress=None,
+          keep_backup=None):
     # A coordinated member is shown by its stack; progress prefixes the installer steps.
     show = not coordinated
     update = operation == 'update'
@@ -944,6 +948,11 @@ def apply(root, vmid, archive, operation, proposal=None, registry_digest=None, i
     freed = 0
     try:
         release_stage(state)
+        if keep_backup and state.get('backup'):
+            import oci_keep_backup
+            kept = oci_keep_backup.keep(state['backup'], keep_backup)
+            if kept:
+                msg_ok(f"{translate('Backup kept in')} {keep_backup}: {Path(kept).name}")
         prune_backups(root, vmid)
         for path, size in image_cache.prune(root, lock=False):
             log(f'removed unused image archive: {path}')
diff --git a/oci/remote/oci_instances.py b/oci/remote/oci_instances.py
index eaba23fd..bfc733e4 100644
--- a/oci/remote/oci_instances.py
+++ b/oci/remote/oci_instances.py
@@ -22,7 +22,7 @@ from oci_host_mounts import capture_sources
 from oci_accelerators import capture as capture_gpu_devices
 from oci_ui import translate, msg_error, msg_ok
 
-ROOT = Path('/usr/local/share/proxmenux/oci/apps')
+ROOT = Path('/usr/local/share/proxmenux/oci/instances')
 MARKER = 'proxmenux-instance='
 ACTIVE = {'installing', 'assembling', 'updating', 'recovering'}
 
diff --git a/oci/remote/oci_keep_backup.py b/oci/remote/oci_keep_backup.py
new file mode 100644
index 00000000..900985fc
--- /dev/null
+++ b/oci/remote/oci_keep_backup.py
@@ -0,0 +1,75 @@
+#!/usr/bin/env python3
+"""Keeping the backup an OCI update takes, in a Proxmox VE backup storage.
+
+Every update already stops the container and takes a verified vzdump backup,
+which the rollback uses and which is deleted once the new image works. When
+the backup is to be kept, that same archive is moved into the dump directory
+of the chosen storage instead of being deleted: one backup, not two.
+
+A storage without a directory of its own (Proxmox Backup Server) cannot
+receive a file, so a backup is written to it with vzdump before the update.
+"""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+import re
+import shutil
+import subprocess
+
+from oci_ui import translate
+
+STORAGE_RE = re.compile(r'[A-Za-z0-9._-]{1,64}')
+
+
+def _storage(storage):
+    if not STORAGE_RE.fullmatch(storage or ''):
+        raise ValueError(translate('Invalid storage name'))
+    result = subprocess.run(['pvesh', 'get', f'/storage/{storage}', '--output-format', 'json'],
+                            capture_output=True, text=True, timeout=30)
+    if result.returncode != 0:
+        raise ValueError(f"{translate('The backup storage does not exist:')} {storage}")
+    info = json.loads(result.stdout)
+    if 'backup' not in str(info.get('content', '')).split(','):
+        raise ValueError(f"{translate('The storage does not accept backups:')} {storage}")
+    return info
+
+
+def dump_dir(storage):
+    """The directory vzdump writes to on a file storage, or None."""
+    info = _storage(storage)
+    path = info.get('path')
+    return Path(path) / 'dump' if path else None
+
+
+def validate(storage):
+    _storage(storage)
+
+
+def before_update(vmid, storage):
+    """A storage that cannot receive the file gets its own backup first."""
+    if dump_dir(storage) is not None:
+        return None
+    subprocess.run(['vzdump', str(vmid), '--storage', storage, '--mode', 'snapshot',
+                    '--compress', 'zstd', '--notes-template', 'ProxMenux OCI: before the image update'],
+                   check=True)
+    return storage
+
+
+def keep(archive, storage):
+    """Move the update's own backup into the storage; returns where it went,
+    or None when the storage received its backup before the update."""
+    directory = dump_dir(storage)
+    if directory is None:
+        return None
+    archive = Path(archive)
+    directory.mkdir(parents=True, exist_ok=True)
+    target = directory / archive.name
+    shutil.move(str(archive), str(target))
+    target.chmod(0o644)
+    stem = archive.name.split('.tar')[0]
+    log = archive.with_name(stem + '.log')
+    if log.is_file():
+        shutil.move(str(log), str(directory / log.name))
+    (directory / (archive.name + '.notes')).write_text('ProxMenux OCI: before the image update\n')
+    return str(target)
diff --git a/oci/remote/oci_native_stack.py b/oci/remote/oci_native_stack.py
index 164606e0..b57bbaab 100644
--- a/oci/remote/oci_native_stack.py
+++ b/oci/remote/oci_native_stack.py
@@ -5,9 +5,11 @@ import copy
 import json
 import os
 from pathlib import Path
+import re
 import subprocess
 import sys
 
+import oci_console
 import oci_instances as instances
 from oci_installation_state import command, image_from_archive, sha
 import oci_stack_replay
@@ -63,17 +65,21 @@ def create(root, args):
     if record['status'] != 'installing' or args[1] != record['deployment']['archive_volume']:
         raise ValueError(translate('The container creation does not match the prepared instance'))
     argv = list(args)
-    description = ''
     if '--description' in argv:
         index = argv.index('--description')
-        description = argv[index + 1]
         del argv[index:index + 2]
-    argv += ['--description', description + '; ' + instances.MARKER + record['installation_id']]
+    argv += ['--description', instances.MARKER + record['installation_id']]
     record['deployment']['create_arguments'] = argv
     instances.write(instances.location(root, vmid), record)
     # No inherited registry/network locks in long-lived Proxmox processes.
     # Keep PVE extraction directories traversable inside its standard idmap.
-    return subprocess.run(['pct', 'create', *argv], close_fds=True, umask=0o022).returncode
+    code = subprocess.run(['pct', 'create', *argv], close_fds=True, umask=0o022).returncode
+    if code == 0:
+        # Every member keeps its console as its own log and opens a Proxmox
+        # console as a shell, set before the stack records its configuration
+        # so an update rebuilds them the same way.
+        oci_console.configure(vmid)
+    return code
 
 
 def capture_rootfs(root, vmid):
@@ -102,6 +108,20 @@ def finalize(root, primary):
         vmid = member['vmid']
         record = instances.read(root, vmid)
         plan = record['deployment']
+        from oci_description import render
+        presentation = copy.deepcopy(record['template'])
+        if vmid == primary:
+            stack_ui = intent['template'].get('catalog_ui') or {}
+            presentation['catalog_ui'] = {**stack_ui, **(presentation.get('catalog_ui') or {})}
+            if not (presentation.get('first_run') or {}).get('endpoints'):
+                presentation['first_run'] = intent['template'].get('first_run') or {}
+        ip_result = subprocess.run(['lxc-info', '-n', str(vmid), '-iH'],
+                                   capture_output=True, text=True, timeout=5)
+        ip = next((line.strip() for line in ip_result.stdout.splitlines()
+                   if re.fullmatch(r'[0-9]+(?:\.[0-9]+){3}', line.strip())), '')
+        description = render(presentation, plan['image']['manifest_digest'],
+                             record['installation_id'], ip)
+        subprocess.run(['pct', 'set', str(vmid), '--description', description], check=True)
         instances.finish(root, vmid, plan['archive_path'], plan['image']['manifest_digest'])
         record = instances.read(root, vmid)
         plan = record['deployment']
diff --git a/oci/remote/oci_native_stack.sh b/oci/remote/oci_native_stack.sh
index 80f3c05d..dcc69953 100755
--- a/oci/remote/oci_native_stack.sh
+++ b/oci/remote/oci_native_stack.sh
@@ -2,7 +2,7 @@
 oci_native_begin() {
   OCI_NATIVE_PRIMARY=$1
   shift
-  local root=/usr/local/share/proxmenux/oci/apps
+  local root=/usr/local/share/proxmenux/oci/instances
   [[ ! -L $root && ! -L $root/.lock ]] || die "$(translate "The instance registry is not safe")"
   oci_quiet install -d -m 0700 "$root"
   exec 8>>"$root/.lock"
diff --git a/oci/remote/oci_stack_native.py b/oci/remote/oci_stack_native.py
index d1e19ea4..9afbc4bc 100644
--- a/oci/remote/oci_stack_native.py
+++ b/oci/remote/oci_stack_native.py
@@ -160,6 +160,8 @@ class NativeAdapter:
         primary = self.records[plan['primary_vmid']]
         self.services = {s['vmid']: s for s in primary['stack']['deployment']['services']}
         self.acknowledge = acknowledge_external_data
+        # Storage where the verified backups of this update are kept.
+        self.keep_backup = None
 
     def state(self):
         return json.loads(self.journal.read_text())
@@ -558,6 +560,12 @@ class NativeAdapter:
             instances.write(instances.location(self.root, vmid), record)
         try:
             self.release_stages()
+            if self.keep_backup and state['phase'] == 'committed':
+                import oci_keep_backup
+                for backup in sorted(self.journal.parent.glob('backup-*/vzdump-lxc-*.tar.zst')):
+                    kept = oci_keep_backup.keep(backup, self.keep_backup)
+                    if kept:
+                        msg_ok(f"{translate('Backup kept in')} {self.keep_backup}: {Path(kept).name}")
             self.prune_backups(include_current=state['phase'] == 'committed')
             for path, _ in image_cache.prune(self.root, lock=False):
                 member_tx.log(f'removed unused image archive: {path}')
@@ -598,7 +606,7 @@ class NativeAdapter:
 _current = {'journal': None, 'primary': None}
 
 
-def run(vmid, recover=False, acknowledge_external_data=False):
+def run(vmid, recover=False, acknowledge_external_data=False, keep_backup=None):
     root = instances.ROOT
     msg_info(translate('Checking the interrupted stack operation...') if recover
              else translate('Checking the stack before the update...'))
@@ -658,6 +666,16 @@ def run(vmid, recover=False, acknowledge_external_data=False):
         adapter = NativeAdapter(root, journal, plan, acknowledge_external_data)
         adapter.preflight()
         msg_ok(f"{translate('Stack checked:')} {len(plan['members'])} {translate('containers')}")
+        if keep_backup:
+            import oci_keep_backup
+            oci_keep_backup.validate(keep_backup)
+            if oci_keep_backup.dump_dir(keep_backup) is None:
+                for member in plan['members']:
+                    msg_info(f"{translate('Creating a backup in')} {keep_backup}: CT {member['vmid']}...")
+                    oci_keep_backup.before_update(member['vmid'], keep_backup)
+                msg_ok(f"{translate('Backup created in')} {keep_backup}")
+            else:
+                adapter.keep_backup = keep_backup
         if any(mount['type'] == 'host-bind' for member in plan['members']
                for mount in member.get('deployment', {}).get('mounts', [])):
             msg_warn(translate('Host directories are not included in the backups and are not reverted by a recovery.'))
@@ -699,11 +717,12 @@ def main():
     parser.add_argument('vmid', type=int)
     parser.add_argument('--recover', action='store_true')
     parser.add_argument('--acknowledge-external-data', action='store_true')
+    parser.add_argument('--keep-backup', metavar='STORAGE')
     args = parser.parse_args()
     if os.geteuid() != 0:
         parser.error(translate('Root privileges on the Proxmox node are required'))
     try:
-        run(args.vmid, args.recover, args.acknowledge_external_data)
+        run(args.vmid, args.recover, args.acknowledge_external_data, args.keep_backup)
         return 0
     except BlockingIOError:
         msg_error(translate('Another OCI operation is using the registry. This operation was not started.'))
diff --git a/oci/remote/oci_stack_replay.py b/oci/remote/oci_stack_replay.py
index b002fc77..b8ddf030 100644
--- a/oci/remote/oci_stack_replay.py
+++ b/oci/remote/oci_stack_replay.py
@@ -561,8 +561,11 @@ def normalize(record):
     preserved = {key: single(key) for key in ('arch', 'ostype', 'cmode', 'console', 'tty', 'cpuunits',
                  'net0', 'net1', 'startup', 'hookscript', 'features', 'tags') if key in values}
     devices = [{'key': key, 'value': single(key)} for key in values if re.fullmatch(r'dev[0-9]+', key)]
+    # The console log line is not replayed: the installer that rebuilds the
+    # member sets it itself, and replaying it too would leave two of them.
     raw_runtime = [line for line in config.splitlines() if line.startswith('lxc.')
-                   and line.partition(': ')[0] not in ('lxc.environment.runtime', 'lxc.init.cwd', 'lxc.signal.halt')]
+                   and line.partition(': ')[0] not in ('lxc.environment.runtime', 'lxc.init.cwd',
+                                                       'lxc.signal.halt', 'lxc.console.logfile')]
     return {'schema_version': 1, 'deployment': plan, 'runtime': runtime,
             'preserved_native': preserved, 'generated_files': copy.deepcopy(files),
             'native_devices': devices, 'preserved_raw_runtime': raw_runtime,
diff --git a/oci/remote/oci_update_current.py b/oci/remote/oci_update_current.py
index 7b318cdc..5fa9aa61 100644
--- a/oci/remote/oci_update_current.py
+++ b/oci/remote/oci_update_current.py
@@ -13,7 +13,7 @@ import tempfile
 import oci_instances as instances
 import oci_instance_transaction as transaction
 from oci_installation_state import image_from_archive
-from oci_ui import translate, msg_info, msg_ok, msg_error, msg_info2
+from oci_ui import translate, msg_info, msg_ok, msg_warn, msg_error, msg_info2
 
 
 def repository(reference):
@@ -78,9 +78,28 @@ def resolve_archive(desired, config, current=None, check=None):
     if archive.is_symlink():
         raise ValueError(translate('Unsafe OCI archive path'))
     verifier = Path(__file__).with_name('verify_oci_archive.py')
-    cached = archive.exists()
-    if not cached:
+
+    def intact(path):
+        try:
+            run_quiet([sys.executable, str(verifier), str(path)],
+                      translate('The image did not pass the integrity check'))
+        except RuntimeError:
+            return False
+        return image_from_archive(str(path))['manifest_digest'] == digest
+
+    if archive.exists():
+        msg_info(translate('Verifying the image integrity...'))
+        if intact(archive):
+            msg_ok(translate('Using the verified image from the cache'))
+            return archive, digest
+        msg_warn(translate('The cached image is damaged; it will be downloaded again.'))
+        archive.unlink()
+    # A download can come back complete yet damaged when the connection drops
+    # and the transfer resumes; the integrity check catches it, and a second
+    # download is what repairs it.
+    for attempt in (1, 2):
         msg_info(transaction.fit(f"{translate('Downloading the image:')} {reference}"))
+        transaction.log(f'download attempt {attempt}/2')
         fd, name = tempfile.mkstemp(prefix='.proxmenux-update-', suffix='.tar', dir=archive.parent)
         os.close(fd)
         partial = Path(name)
@@ -90,22 +109,19 @@ def resolve_archive(desired, config, current=None, check=None):
                 'oci-archive:' + str(partial)], translate('Could not download the image'))
             msg_ok(translate('Image downloaded'))
             msg_info(translate('Verifying the image integrity...'))
-            run_quiet([sys.executable, str(verifier), str(partial)],
-                      translate('The image did not pass the integrity check'))
-            if image_from_archive(str(partial))['manifest_digest'] != digest:
-                raise ValueError(translate('The downloaded image does not match its manifest'))
-            partial.chmod(0o644)
-            os.replace(partial, archive)
+            if intact(partial):
+                partial.chmod(0o644)
+                os.replace(partial, archive)
+                msg_ok(translate('Image integrity verified'))
+                return archive, digest
+        except RuntimeError:
+            if attempt == 2:
+                raise
         finally:
             partial.unlink(missing_ok=True)
-    else:
-        msg_info(translate('Verifying the image integrity...'))
-    run_quiet([sys.executable, str(verifier), str(archive)],
-              translate('The image did not pass the integrity check'))
-    if image_from_archive(str(archive))['manifest_digest'] != digest:
-        raise ValueError(translate('The cached image does not match the current digest'))
-    msg_ok(translate('Using the verified image from the cache') if cached else translate('Image integrity verified'))
-    return archive, digest
+        if attempt == 2:
+            raise RuntimeError(translate('Could not obtain an intact image after two attempts'))
+        msg_warn(translate('The image download did not complete correctly; downloading it again...'))
 
 
 def kept_settings(changes, deployment):
@@ -121,7 +137,7 @@ def kept_settings(changes, deployment):
     return kept
 
 
-def update(vmid, acknowledge_external_data=False, proposal=None):
+def update(vmid, acknowledge_external_data=False, proposal=None, keep_backup=None):
     operation = 'recreate' if proposal is not None else 'update'
     msg_info(translate('Checking the container before the update...') if operation == 'update'
              else translate('Checking the container before recreating it...'))
@@ -140,11 +156,22 @@ def update(vmid, acknowledge_external_data=False, proposal=None):
         if archive is None:
             msg_ok(translate('The image is already up to date; nothing was changed.'))
             return
+        file_storage = None
+        if keep_backup:
+            import oci_keep_backup
+            oci_keep_backup.validate(keep_backup)
+            if oci_keep_backup.dump_dir(keep_backup) is None:
+                msg_info(f"{translate('Creating a backup in')} {keep_backup}...")
+                oci_keep_backup.before_update(vmid, keep_backup)
+                msg_ok(f"{translate('Backup created in')} {keep_backup}")
+            else:
+                file_storage = keep_backup
         kept = kept_settings(changes, desired['deployment'])
         if kept:
             msg_info2(f"{translate('Keeping the settings changed in Proxmox:')} {', '.join(kept)}")
         transaction.apply(instances.ROOT, vmid, archive, operation, proposal=proposal,
-                          registry_digest=digest, acknowledge_external_data=acknowledge_external_data)
+                          registry_digest=digest, acknowledge_external_data=acknowledge_external_data,
+                          keep_backup=file_storage)
 
 
 def main():
@@ -152,12 +179,13 @@ def main():
     parser.add_argument('vmid', type=int)
     parser.add_argument('--acknowledge-external-data', action='store_true')
     parser.add_argument('--proposal', type=Path)
+    parser.add_argument('--keep-backup', metavar='STORAGE')
     args = parser.parse_args()
     if os.geteuid() != 0:
         parser.error(translate('Root privileges are required'))
     try:
         proposal = json.loads(args.proposal.read_text()) if args.proposal else None
-        update(args.vmid, args.acknowledge_external_data, proposal)
+        update(args.vmid, args.acknowledge_external_data, proposal, args.keep_backup)
         return 0
     except BlockingIOError:
         msg_error(translate('Another OCI operation is using the registry. This operation was not started.'))
diff --git a/oci/src/proxmenux_oci/arr_suite.py b/oci/src/proxmenux_oci/arr_suite.py
index 731e731f..e545346f 100644
--- a/oci/src/proxmenux_oci/arr_suite.py
+++ b/oci/src/proxmenux_oci/arr_suite.py
@@ -40,8 +40,8 @@ class SuiteChildUI(DefaultsUI):
         return self.ui.password(text,required=required)
 
 
-def build_suite(template, ui):
-    from .installer import build_deployment, _hostname_default
+def build_suite(template, ui, mode='advanced'):
+    from .installer import build_deployment, _hostname_default, DEFAULT_MODE
     choices = template['proxmox']['installer_profile']['applications']
     profile = template['proxmox']['installer_profile']
     selected = ui.checklist(translate('Arr suite: applications to install'), [(x, x.capitalize()) for x in choices],
@@ -61,9 +61,9 @@ def build_suite(template, ui):
     from . import host
     from . import network as access
     from .installer import ask_bridge, ask_storage
-    storage = ask_storage(ui, translate('Storage for rootfs and private configuration'), 'rootdir', 'local-lvm')
-    cache = ask_storage(ui, translate('Storage for the OCI image cache'), 'vztmpl', 'local')
-    bridge = ask_bridge(ui, translate('Access bridge'), 'vmbr0')
+    storage = ask_storage(ui, translate('Storage for rootfs and private configuration'), 'rootdir', 'local-lvm', mode)
+    cache = ask_storage(ui, translate('Storage for the OCI image cache'), 'vztmpl', 'local', mode)
+    bridge = ask_bridge(ui, translate('Access bridge'), 'vmbr0', mode)
     reachable = [app for app in selected if app != 'unpackerr']
     labels, gateway = access.ask_addresses(ui, bridge, [app.capitalize() for app in reachable])
     addresses = dict(zip(reachable, labels.values()))
@@ -85,7 +85,9 @@ def build_suite(template, ui):
         child = json.loads(path.read_text())
         if not child['compatibility']['automatic_install_candidate']:
             raise StackError(f"{app}: {translate('individual template is blocked')}")
-        plan = build_deployment(copy.deepcopy(child), SuiteChildUI(ui,child['proxmox'].get('installer_profile',{})))
+        child_ui = (DefaultsUI() if mode == DEFAULT_MODE else
+                    SuiteChildUI(ui, child['proxmox'].get('installer_profile', {})))
+        plan = build_deployment(copy.deepcopy(child), child_ui, mode)
         plan.update(hostname=_hostname_default(name+'-'+app), start_after_create=False, onboot=onboot, template_storage=cache)
         plan['rootfs']['storage'] = storage
         for env in plan['environment']:
@@ -97,9 +99,6 @@ def build_suite(template, ui):
         plan['mounts'] = [config]
         if app in MEDIA_APPS:
             plan['mounts'].append({'type':'host-bind','source':shared,'container_path':'/data','size_gb':None,'backup':False,'read_only':False,'create_if_missing':True})
-        from .custom_mounts import ask_custom_mounts
-        ui.info(f"{translate('Additional paths for')} {app}")
-        plan['mounts'] = ask_custom_mounts(ui, plan['mounts'], storage)
         endpoint = child['first_run']['endpoints'][0] if child['first_run']['endpoints'] else None
         health = {'type':'http','timeout_seconds':360,'endpoint':endpoint} if endpoint else {'type':'running','timeout_seconds':60}
         if app == 'qbittorrent':
@@ -113,6 +112,9 @@ def build_suite(template, ui):
             services[-1]['deferred_setup'] = True
         if app == 'qbittorrent':
             services[-1]['setup_credentials'] = credentials
+    if mode != DEFAULT_MODE:
+        from .custom_mounts import ask_stack_custom_mounts
+        ask_stack_custom_mounts(ui, services, storage)
     return {'deployment_kind':'generic-multi-lxc-stack','suite_arr':True,'lifecycle_mode':'independent','stack_name':name,
             'base_vmid':int(base) if base else None,'services':services,'shared_media':shared,'media_player':player,
             'completion_notes':[
diff --git a/oci/src/proxmenux_oci/casaos.py b/oci/src/proxmenux_oci/casaos.py
index b1d47a32..48edb205 100644
--- a/oci/src/proxmenux_oci/casaos.py
+++ b/oci/src/proxmenux_oci/casaos.py
@@ -48,7 +48,7 @@ CASAOS_TRANSLATED_SERVICE_KEYS = SUPPORTED_SERVICE_KEYS | {"deploy", "network_mo
 def normalize_app_id(value: str) -> str:
     normalized = re.sub(r"[^a-z0-9]+", "-", value.casefold()).strip("-")
     if not normalized:
-        raise ConversionError(f"No se puede normalizar el identificador CasaOS: {value!r}")
+        raise ConversionError(f"Cannot normalise the CasaOS identifier: {value!r}")
     return normalized
 
 
@@ -76,7 +76,7 @@ def _json_safe(value: Any) -> Any:
 def _main_service(compose: dict[str, Any], metadata: dict[str, Any]) -> tuple[str, dict[str, Any]]:
     services = compose.get("services")
     if not isinstance(services, dict) or not services:
-        raise ConversionError("El Compose CasaOS no contiene servicios")
+        raise ConversionError("The CasaOS Compose file has no services")
     service_name = metadata.get("main")
     if not service_name and len(services) == 1:
         service_name = next(iter(services))
@@ -84,7 +84,7 @@ def _main_service(compose: dict[str, Any], metadata: dict[str, Any]) -> tuple[st
         raise ConversionError("x-casaos.main no identifica un servicio valido")
     service = services[service_name]
     if not isinstance(service, dict) or not service.get("image"):
-        raise ConversionError("El servicio principal CasaOS no declara una imagen")
+        raise ConversionError("The main CasaOS service declares no image")
     return str(service_name), service
 
 
@@ -214,10 +214,10 @@ def parse_casaos_compose(compose_text: str) -> tuple[dict[str, Any], dict[str, A
     except yaml.YAMLError as exc:
         raise ConversionError(f"Docker Compose CasaOS no valido: {exc}") from exc
     if not isinstance(compose, dict):
-        raise ConversionError("El documento CasaOS no es un objeto Compose")
+        raise ConversionError("The CasaOS document is not a Compose mapping")
     metadata = compose.get("x-casaos")
     if not isinstance(metadata, dict):
-        raise ConversionError("El Compose no contiene metadatos x-casaos")
+        raise ConversionError("The Compose file has no x-casaos metadata")
     service_name, service = _main_service(compose, metadata)
     return compose, metadata, service_name, service
 
diff --git a/oci/src/proxmenux_oci/catalog.py b/oci/src/proxmenux_oci/catalog.py
index a05fa8f0..fb6b48d9 100644
--- a/oci/src/proxmenux_oci/catalog.py
+++ b/oci/src/proxmenux_oci/catalog.py
@@ -69,6 +69,69 @@ class Catalog:
         self.schema_path = root / "schemas" / "oci-template.schema.json"
         self.source = source or GitHubSource()
 
+    def apply_icons(self) -> dict[str, int]:
+        """Point every catalog_ui icon at an icon that is known to exist.
+
+        Rewrites the index and the application templates from the jsdelivr
+        icon sets. An application neither set covers is left without an icon
+        on purpose: the panel then draws its placeholder, which reads better
+        than the broken image a stale URL produces.
+        """
+        from .icons import IconResolver
+
+        resolver = IconResolver()
+        index_path = self.catalog_dir / "index.json"
+        index = json.loads(index_path.read_text(encoding="utf-8"))
+        report = {"resolved": 0, "kept": 0, "cleared": 0, "unchanged": 0, "themed": 0,
+                  "missing": []}
+        icons: dict[str, str | None] = {}
+        for item in index.get("applications", []):
+            match = resolver.resolve(item.get("id"), item.get("title"))
+            url = match["url"] if match else None
+            if not url:
+                # Neither icon set covers it. The publisher's own URL is kept
+                # only when it answers, so nothing points at a missing file.
+                inherited = item.get("icon")
+                if resolver.reachable(inherited):
+                    url = inherited
+                    report["kept"] += 1
+                elif not item.get("hidden"):
+                    report["missing"].append(item.get("id"))
+            icons[item["id"]] = url
+            if match and match["themed"]:
+                report["themed"] += 1
+            if item.get("icon") == url:
+                report["unchanged"] += 1
+            elif url:
+                report["resolved"] += 1
+            else:
+                report["cleared"] += 1
+            item["icon"] = url
+        template_ids: dict[str, str] = {}
+        for app_id, url in icons.items():
+            path = self.apps_dir / f"{app_id}.json"
+            if not path.is_file():
+                continue
+            template = json.loads(path.read_text(encoding="utf-8"))
+            # An installation records the template id, not the catalog id, so
+            # the index carries both and the panel can find the icon of what
+            # it installed without opening every template.
+            if isinstance(template.get("id"), str):
+                template_ids[app_id] = template["id"]
+            ui = template.get("catalog_ui")
+            if not isinstance(ui, dict) or ui.get("icon") == url:
+                continue
+            ui["icon"] = url
+            path.write_text(json.dumps(template, ensure_ascii=False, indent=2) + "\n",
+                            encoding="utf-8")
+        for item in index.get("applications", []):
+            template_id = template_ids.get(item["id"])
+            if template_id:
+                item["template_id"] = template_id
+        index_path.write_text(json.dumps(index, ensure_ascii=True, indent=2) + "\n",
+                              encoding="utf-8")
+        return report
+
     def sync_index(self) -> dict[str, Any]:
         repos = self.source.list_linuxserver_repositories()
         try:
@@ -333,6 +396,12 @@ class Catalog:
 
     def _enrich_index_from_templates(self, payload: dict[str, Any]) -> None:
         for item in payload.get("applications", []):
+            # categories.json is the hand-maintained classification and has the
+            # final word. The index took its category from the Helper-Scripts
+            # catalogue, which does not list the LinuxServer desktop
+            # applications at all: 138 of them reached the reader under
+            # Miscellaneous while their category sat here all along.
+            self._apply_category(item["id"], item)
             overlay_path = self.overlays_dir / f"{item['id']}.json"
             overlay_ui = json.loads(overlay_path.read_text(encoding="utf-8")).get("catalog_ui", {}) if overlay_path.exists() else {}
             item["hidden"] = overlay_ui.get("hidden", False)
diff --git a/oci/src/proxmenux_oci/cli.py b/oci/src/proxmenux_oci/cli.py
index b9f76e22..e0d79065 100644
--- a/oci/src/proxmenux_oci/cli.py
+++ b/oci/src/proxmenux_oci/cli.py
@@ -3,6 +3,7 @@ from __future__ import annotations
 
 import argparse
 import json
+import re
 import sys
 import textwrap
 import unicodedata
@@ -401,11 +402,8 @@ def _rclone_mount(catalog: Catalog, ui) -> None:
 def _app_detail(catalog: Catalog, ui, item: dict[str, Any]) -> None:
     template = catalog.compose(item["id"])
     actions = []
-    if item.get("multi_container"):
-        actions.append(("advanced", translate("Install (experimental)")))
-    else:
-        actions += [("default", translate("Install with default settings")),
-                    ("advanced", translate("Install with advanced settings"))]
+    actions += [("default", translate("Install with default settings")),
+                ("advanced", translate("Install with advanced settings"))]
     if item["id"] == "rclone":
         actions.append(("mount", translate("Enable a mount on an existing Rclone OCI container")))
     numbered = {str(number): action for number, (action, _) in enumerate(actions, 1)}
@@ -538,6 +536,7 @@ def build_parser() -> argparse.ArgumentParser:
     generate_all_parser = subparsers.add_parser("generate-all", help="Regenerate the catalog templates")
     generate_all_parser.add_argument("--provider", choices=["all", "linuxserver.io", "imported", "curated"],
                                      default="all")
+    subparsers.add_parser("apply-icons", help="Resolve catalog icons against the jsdelivr icon sets")
     show_parser = subparsers.add_parser("show", help="Show the summary of a template")
     show_parser.add_argument("app")
     install_parser = subparsers.add_parser("install", help="Configure and install an application")
@@ -548,6 +547,16 @@ def build_parser() -> argparse.ArgumentParser:
     rclone_parser = subparsers.add_parser("rclone-mount", help="Enable a mount on an installed Rclone OCI")
     rclone_parser.add_argument("--host", default="auto")
     rclone_parser.add_argument("--dry-run", action="store_true")
+    manage_parser = subparsers.add_parser("manage", help="Update or recreate one installed OCI instance")
+    manage_parser.add_argument("vmid", type=int)
+    manage_parser.add_argument("--action", choices=("update", "recreate"), required=True)
+    manage_parser.add_argument("--keep-backup", metavar="STORAGE",
+                               help="Keep the backup taken before the update in this Proxmox storage")
+    manage_parser.add_argument("--unattended", action="store_true",
+                               help="Scheduled run: no questions; stops where a person has to decide")
+    manage_parser.add_argument("--acknowledge-external-data", action="store_true",
+                               help="Host directories are not reverted by the backup (confirmed beforehand)")
+    manage_parser.add_argument("--min-image-age-days", type=int, default=0)
     return parser
 
 
@@ -583,6 +592,11 @@ def main(argv: list[str] | None = None) -> int:
             print(f"\nGenerated: {report['generated_count']}; failed: {report['failed_count']}; "
                   f"family: {args.provider}")
             return 0 if not report["failed"] else 2
+        if args.command == "apply-icons":
+            report = catalog.apply_icons()
+            print(f"Icons resolved: {report['resolved']}; cleared: {report['cleared']}; "
+                  f"unchanged: {report['unchanged']}; with a theme variant: {report['themed']}")
+            return 0
         if args.command == "show":
             print(_template_summary_text(catalog.compose(args.app)))
             return 0
@@ -599,6 +613,17 @@ def main(argv: list[str] | None = None) -> int:
             if result:
                 _print_installation_summary(result)
             return 0
+        if args.command == "manage":
+            from .management import direct_management
+            lifecycle_args = []
+            if args.keep_backup:
+                if not re.fullmatch(r"[A-Za-z0-9._-]{1,64}", args.keep_backup):
+                    raise InstallError(translate("Invalid storage name"))
+                lifecycle_args += ["--keep-backup", args.keep_backup]
+            if args.acknowledge_external_data:
+                lifecycle_args.append("--acknowledge-external-data")
+            return direct_management(PROJECT_ROOT, args.vmid, args.action, lifecycle_args,
+                                     args.unattended, max(0, args.min_image_age_days))
         if args.command == "rclone-mount":
             template = catalog.compose("rclone")
             deployment = build_rclone_mount_deployment(template)
diff --git a/oci/src/proxmenux_oci/converter.py b/oci/src/proxmenux_oci/converter.py
index d0c84000..3a8b1c59 100644
--- a/oci/src/proxmenux_oci/converter.py
+++ b/oci/src/proxmenux_oci/converter.py
@@ -80,7 +80,7 @@ def extract_compose(readme: str) -> str:
         None,
     )
     if heading_index is None:
-        raise ConversionError("El README no contiene una seccion docker-compose reconocible")
+        raise ConversionError("The README has no recognisable docker-compose section")
 
     fence_start = next(
         (index for index in range(heading_index + 1, len(lines)) if lines[index].strip().startswith("```")),
@@ -93,11 +93,11 @@ def extract_compose(readme: str) -> str:
         None,
     )
     if fence_end is None:
-        raise ConversionError("El bloque docker-compose no esta cerrado")
+        raise ConversionError("The docker-compose block is not closed")
 
     compose = "\n".join(lines[fence_start + 1 : fence_end]).strip() + "\n"
     if "services:" not in compose:
-        raise ConversionError("El bloque encontrado no parece un Docker Compose")
+        raise ConversionError("The block found does not look like a Docker Compose file")
     return compose
 
 
@@ -141,7 +141,7 @@ def _environment_contract(value: Any, optional: set[str]) -> list[dict[str, Any]
             name, separator, raw_value = text.partition("=")
             entries.append((name, raw_value if separator else None))
     else:
-        raise ConversionError("environment debe ser una lista o un objeto")
+        raise ConversionError("environment must be a list or a mapping")
 
     for name, raw_value in entries:
         name = str(name)
@@ -178,7 +178,7 @@ def _mount_contract(value: Any, optional: set[str]) -> list[dict[str, Any]]:
     if value is None:
         return []
     if not isinstance(value, list):
-        raise ConversionError("volumes debe ser una lista")
+        raise ConversionError("volumes must be a list")
     result: list[dict[str, Any]] = []
     for index, item in enumerate(value):
         if isinstance(item, dict):
@@ -245,7 +245,7 @@ def _port_contract(value: Any, optional: set[str]) -> list[dict[str, Any]]:
     if value is None:
         return []
     if not isinstance(value, list):
-        raise ConversionError("ports debe ser una lista")
+        raise ConversionError("ports must be a list")
     result: list[dict[str, Any]] = []
     for item in value:
         if isinstance(item, dict):
@@ -326,7 +326,7 @@ def _image_name(image: Any) -> str:
 def _catalog_identifier(app_id: str) -> str:
     normalized = re.sub(r"[^a-z0-9]+", "-", app_id.casefold()).strip("-")
     if not normalized:
-        raise ConversionError(f"No se puede normalizar el identificador: {app_id!r}")
+        raise ConversionError(f"Cannot normalise the identifier: {app_id!r}")
     return f"linuxserver-{normalized}"
 
 
@@ -1404,7 +1404,7 @@ def summarize_readme(repo: Repository, readme: str) -> dict[str, Any]:
         raise ConversionError(f"Docker Compose no valido: {exc}") from exc
     services = compose.get("services") if isinstance(compose, dict) else None
     if not isinstance(services, dict) or not services:
-        raise ConversionError("El Compose no contiene services")
+        raise ConversionError("The Compose file has no services")
     candidates = [
         value
         for value in services.values()
@@ -1427,7 +1427,10 @@ def summarize_readme(repo: Repository, readme: str) -> dict[str, Any]:
         "description": description or repo.description,
         "website": website,
         "architectures": architectures,
-        "icon": f"https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/{repo.app_id}-icon.png",
+        # Resolved by `apply-icons` against the published icon sets. Building
+        # the URL here from the application id named a file that does not
+        # exist for most of the catalog.
+        "icon": None,
         "updated_at": changelog[0]["date"] if changelog else repo.pushed_at,
         "main_image": str(main_service["image"]),
     }
@@ -1445,7 +1448,7 @@ def convert_readme(
     except yaml.YAMLError as exc:
         raise ConversionError(f"Docker Compose no valido: {exc}") from exc
     if not isinstance(compose, dict) or not isinstance(compose.get("services"), dict):
-        raise ConversionError("El Compose no contiene services")
+        raise ConversionError("The Compose file has no services")
     services = compose["services"]
     multi_service = len(services) > 1
     if multi_service:
@@ -1511,7 +1514,10 @@ def convert_readme(
             "category_label": repo.category_label,
             "author": "LinuxServer.io",
             "developer": None,
-            "icon": f"https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/{repo.app_id}-icon.png",
+            # Resolved by `apply-icons` against the published icon sets. Building
+        # the URL here from the application id named a file that does not
+        # exist for most of the catalog.
+        "icon": None,
             "thumbnail": f"https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/{repo.app_id}-banner.png",
             "screenshots": [],
             "architectures": _architectures(readme),
diff --git a/oci/src/proxmenux_oci/custom_mounts.py b/oci/src/proxmenux_oci/custom_mounts.py
index 4506312f..bb4cf24e 100644
--- a/oci/src/proxmenux_oci/custom_mounts.py
+++ b/oci/src/proxmenux_oci/custom_mounts.py
@@ -61,3 +61,43 @@ def ask_custom_mounts(ui, mounts, storage):
         mount['container_path'] = validate_mount(mount, result)
         result.append(mount)
     return result
+
+
+def ask_stack_custom_mounts(ui, services, storage):
+    """Collect extra paths once, then attach each path to selected stack members."""
+    if not ui.confirm(translate('Add extra paths to this stack'), False):
+        return
+    options = [(service['name'], service['name']) for service in services]
+    defaults = [service['name'] for service in services if service.get('main')]
+    while True:
+        selected = ui.checklist(translate('Containers that will receive this path'),
+                                options, defaults or [options[0][0]])
+        if not selected or set(selected) - {name for name, _ in options}:
+            raise ValueError(translate('Select at least one stack container'))
+        mode = ui.choose(translate('Data location'), [
+            ('managed-volume', translate('Container volume (included in backups)')),
+            ('host-bind', translate('Host directory (not included in Proxmox backups)')),
+        ], 'host-bind' if len(selected) > 1 else 'managed-volume')
+        if mode is None:
+            raise UserCancelled(translate('Custom path cancelled'))
+        source = (ui.ask(translate('Proxmox storage for the volume'), storage)
+                  if mode == 'managed-volume' else
+                  ui.ask(translate('Host directory (created if it does not exist)'), '/mnt/oci-shared/custom'))
+        size = int(ui.ask(translate('Volume size in GB'), '8')) if mode == 'managed-volume' else None
+        read_only = ui.confirm(translate('Mount read-only'), False)
+        default_target = '/media-extra'
+        additions = []
+        for service in services:
+            if service['name'] not in selected:
+                continue
+            target = ui.ask(f"{service['name']}: {translate('Path inside the container')}", default_target)
+            mount = {'type': mode, 'container_path': target, 'custom': True,
+                     'source': source, 'size_gb': size, 'backup': mode == 'managed-volume',
+                     'read_only': read_only, 'create_if_missing': mode == 'host-bind'}
+            mount['container_path'] = validate_mount(mount, service['deployment']['mounts'])
+            additions.append((service, mount))
+            default_target = target
+        for service, mount in additions:
+            service['deployment']['mounts'].append(mount)
+        if not ui.confirm(translate('Add another extra path to this stack'), False):
+            break
diff --git a/oci/src/proxmenux_oci/github_source.py b/oci/src/proxmenux_oci/github_source.py
index 35ef34b2..d57f3109 100644
--- a/oci/src/proxmenux_oci/github_source.py
+++ b/oci/src/proxmenux_oci/github_source.py
@@ -93,11 +93,11 @@ class GitHubSource:
                 remaining = exc.headers.get("X-RateLimit-Remaining")
                 if exc.code == 403 and remaining == "0":
                     raise SourceError(
-                        f"GitHub devolvio HTTP 403 para {url}. "
-                        "Define GITHUB_TOKEN para ampliar el limite de la API."
+                        f"GitHub returned HTTP 403 for {url}. "
+                        "Set GITHUB_TOKEN to raise the API rate limit."
                     ) from exc
                 if exc.code not in {429, 500, 502, 503, 504}:
-                    raise SourceError(f"GitHub devolvio HTTP {exc.code} para {url}.") from exc
+                    raise SourceError(f"GitHub returned HTTP {exc.code} para {url}.") from exc
             except (urllib.error.URLError, TimeoutError) as exc:
                 last_error = exc
             if attempt < 2:
@@ -142,7 +142,7 @@ class GitHubSource:
     def proxmenux_app_metadata(self) -> dict[str, dict[str, Any]]:
         payload = self.get_json(PROXMENUX_HELPERS_URL)
         if not isinstance(payload, list):
-            raise SourceError("El catalogo de aplicaciones de ProxMenux no es una lista")
+            raise SourceError("The ProxMenux application catalogue is not a list")
         result: dict[str, dict[str, Any]] = {}
         for item in payload:
             if not isinstance(item, dict) or not item.get("slug"):
@@ -160,7 +160,7 @@ class GitHubSource:
         revision = str(commit["sha"])
         tree = self.get_json(f"/repos/{CASAOS_REPOSITORY}/git/trees/{revision}?recursive=1")
         if tree.get("truncated"):
-            raise SourceError("GitHub devolvio truncado el arbol del catalogo CasaOS")
+            raise SourceError("GitHub returned a truncated tree for the CasaOS catalogue")
         paths = sorted(
             str(item["path"])
             for item in tree.get("tree", [])
@@ -168,7 +168,7 @@ class GitHubSource:
             and re.fullmatch(r"Apps/[^/]+/docker-compose\.yml", str(item.get("path", "")))
         )
         if not paths:
-            raise SourceError("No se encontraron Compose en el catalogo CasaOS")
+            raise SourceError("No Compose files were found in the CasaOS catalogue")
         return {
             "repository": CASAOS_REPOSITORY_URL,
             "revision": revision,
diff --git a/oci/src/proxmenux_oci/gpu.py b/oci/src/proxmenux_oci/gpu.py
index 630e77ff..c4555d81 100644
--- a/oci/src/proxmenux_oci/gpu.py
+++ b/oci/src/proxmenux_oci/gpu.py
@@ -56,27 +56,54 @@ def apply_selkies_contract(template):
         mounts.append({'id': 'nginx-runtime', 'container_path': '/run/nginx',
                        'default_size_mb': 1, 'minimum_size_mb': 1, 'prompt_size': False,
                        'mount_options': ['rw', 'nosuid', 'nodev', 'mode=0755']})
-    if profile.get('hardware_acceleration') or profile.get('device_requests'):
+    if not profile.get('hardware_acceleration'):
+        # Fold optional Compose DRI devices into the Selkies GPU choice rather
+        # than asking twice or bypassing the acceleration menu.
+        removable = lambda device: (str(device.get('host_path_default', '')).startswith('/dev/dri')
+                                    and not device.get('required_by_compose'))
+        profile['device_requests'] = [d for d in profile.get('device_requests', []) if not removable(d)]
+        profile['optional_devices'] = [d for d in profile.get('optional_devices', [])
+                                       if not removable(d)]
+        profile['hardware_acceleration'] = {
+            'prompt': 'Selkies desktop and streaming acceleration', 'default': 'none',
+            'profiles': [
+                {'id': 'none', 'label': 'No GPU (CPU)', 'device_requests': [],
+                 'environment': [{'name': 'AUTO_GPU', 'value': 'false'}]},
+                {'id': 'vaapi', 'label': 'Intel/AMD (streaming rendering and encoding)',
+                 'device_requests': [{'id': 'selkies-render', 'kind': 'character-device',
+                     'path_prompt': 'Intel/AMD render node', 'host_path_default': '/dev/dri/renderD128',
+                     'container_path_strategy': 'same-as-host', 'mode': '0660',
+                     'deny_write': False, 'gid_strategy': 'host-device-gid',
+                     'drm_vendor_ids': ['0x8086', '0x1002']}],
+                 'environment': [{'name': 'PIXELFLUX_WAYLAND', 'value': 'true'},
+                                 {'name': 'AUTO_GPU', 'value': 'false'}],
+                 'environment_from_devices': {'DRINODE': ['selkies-render'],
+                                              'DRI_NODE': ['selkies-render'],
+                                              'ATTACHED_DEVICES_PERMS': ['selkies-render']}}
+            ],
+        }
+
+    # NVIDIA needs the host driver/Toolkit and is unsupported by Alpine Selkies images.
+    hardware = profile.get('hardware_acceleration')
+    if not hardware or 'alpine' in profile['selkies'].get('base', '').lower():
         return
-    profile['optional_devices'] = [d for d in profile.get('optional_devices', [])
-                                   if not str(d.get('host_path_default', '')).startswith('/dev/dri')]
-    profile['hardware_acceleration'] = {
-        'prompt': 'Selkies desktop and streaming acceleration', 'default': 'none',
-        'profiles': [
-            {'id': 'none', 'label': 'No GPU (CPU)', 'device_requests': [],
-             'environment': [{'name': 'AUTO_GPU', 'value': 'false'}]},
-            {'id': 'vaapi', 'label': 'Intel/AMD (streaming rendering and encoding)',
-             'device_requests': [{'id': 'selkies-render', 'kind': 'character-device',
-                 'path_prompt': 'Intel/AMD render node', 'host_path_default': '/dev/dri/renderD128',
-                 'container_path_strategy': 'same-as-host', 'mode': '0660',
-                 'deny_write': False, 'gid_strategy': 'host-device-gid',
-                 'drm_vendor_ids': ['0x8086', '0x1002']}],
-             'environment': [{'name': 'PIXELFLUX_WAYLAND', 'value': 'true'},
-                             {'name': 'AUTO_GPU', 'value': 'false'}],
-             'environment_from_devices': {'DRINODE': ['selkies-render'],
-                                          'DRI_NODE': ['selkies-render'],
-                                          'ATTACHED_DEVICES_PERMS': ['selkies-render']}}
-        ]}
+    profile['selkies']['nvidia'] = 'available-in-advanced-mode-with-compatible-host-driver-and-toolkit'
+    profiles = hardware.setdefault('profiles', [])
+    if any(item.get('id') == 'nvidia' for item in profiles):
+        return
+    profiles.append({
+        'id': 'nvidia',
+        'label': 'NVIDIA (Selkies rendering and NVENC)',
+        'device_requests': [{
+            'id': 'selkies-nvidia', 'kind': 'nvidia-runtime',
+            'device_selection': 'all-requested-by-compose',
+        }],
+        'environment': [
+            {'name': 'AUTO_GPU', 'value': 'true'},
+            {'name': 'NVIDIA_VISIBLE_DEVICES', 'value': 'all'},
+            {'name': 'NVIDIA_DRIVER_CAPABILITIES', 'value': 'compute,video,graphics,utility,display'},
+        ],
+    })
 
 
 def apply_profile_image(template, hardware_profile):
diff --git a/oci/src/proxmenux_oci/icons.py b/oci/src/proxmenux_oci/icons.py
new file mode 100644
index 00000000..ade7d01c
--- /dev/null
+++ b/oci/src/proxmenux_oci/icons.py
@@ -0,0 +1,187 @@
+"""Application icons for the catalog, resolved against the jsdelivr icon sets.
+
+The icon a catalog entry carries used to be a URL built from the application
+id, which nobody ever requested: seven out of ten answered 404, so the panel
+drew a broken image instead of a plain placeholder. These two sets publish an
+index, so an entry only keeps an icon that is known to exist, and every icon
+comes from the same CDN as the rest of the interface.
+"""
+from __future__ import annotations
+
+import json
+import re
+import urllib.request
+
+SELFHST_INDEX = "https://cdn.jsdelivr.net/gh/selfhst/icons@main/index.json"
+SELFHST_ICON = "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/{name}.webp"
+HOMARR_INDEX = "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/tree.json"
+HOMARR_ICON = "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/webp/{name}.webp"
+# The two sources the catalog itself is built from publish their icons beside
+# the application, and both are served by the same CDN. Their file names are
+# read from the repository tree rather than derived: linuxserver names them
+# `<id>-logo.png`, and the `-icon.png` this catalog used to build answered 404
+# for seven entries out of ten.
+PUBLISHER_TREES = (
+    ("https://api.github.com/repos/IceWhaleTech/CasaOS-AppStore/git/trees/main?recursive=1",
+     r"Apps/(?P<name>[^/]+)/icon\.(?:svg|png|webp)",
+     "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/{path}"),
+    ("https://api.github.com/repos/linuxserver/docker-templates/git/trees/master?recursive=1",
+     r"linuxserver\.io/img/(?P<name>.+?)-(?:logo|icon)\.(?:png|svg|jpg|webp)",
+     "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/{path}"),
+)
+TIMEOUT = 30
+VARIANT_SUFFIX_RE = re.compile(r"-(?:dark|light)$")
+# Catalog ids carry the publisher or the accelerator when the same application
+# ships under several images: emby-official, open-webui-cuda, kavita-jvmilazz0.
+# They are the same application and they wear the same icon.
+QUALIFIER_RE = re.compile(
+    r"[-_](?:official|stack|nvidia|cuda|rocm|gpu|ollama|jlesage|jvmilazz0)$")
+
+
+# Applications neither icon set names, resolved by hand and verified. A few are
+# only ProxMenux compositions, so they borrow the icon of what they assemble:
+# HAOS One wears Home Assistant's, and the Arr suite wears Servarr's.
+CURATED = {
+    "blade-of-agony": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/boa-logo.png",
+    "budge": "https://cdn.jsdelivr.net/gh/linuxserver/budge@master/frontend/public/logo512.png",
+    "changedetection.io": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/changedetection-icon.png",
+    "dosbox-staging": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/dosbox-logo.png",
+    "dsh-harness": "https://cdn.jsdelivr.net/gh/deepseek-ai/deepseek-harness@master/apps/web/public/favicon.svg",
+    "faster-whisper": "https://cdn.jsdelivr.net/gh/home-assistant/brands@master/core_integrations/wyoming/icon.png",
+    "haos-one": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/home-assistant.webp",
+    "luanti": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/minetest-icon.png",
+    "msedge": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/edge-logo.png",
+    "pyload-ng": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/pyload-logo.png",
+    "stable-diffusion-webui-nvidia": "https://cdn.jsdelivr.net/gh/IceWhaleTech/CasaOS-AppStore@main/Apps/StableDiffusionWebUI/icon.svg",
+    "suite-arr": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@main/svg/servarr.svg",
+    # SWAG publishes no icon of its own; what sits under its name is a 424 KB
+    # animated banner. The publisher's mark stands in for it.
+    "swag": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/linuxserver-ls-logo.png",
+    "vscodium-web": "https://cdn.jsdelivr.net/gh/linuxserver/docker-templates@master/linuxserver.io/img/vscodium-icon.png",
+}
+
+
+def _key(value: str | None) -> str:
+    return re.sub(r"[^a-z0-9]", "", (value or "").lower())
+
+
+def _read(url: str) -> object:
+    request = urllib.request.Request(url, headers={"User-Agent": "ProxMenux"})
+    with urllib.request.urlopen(request, timeout=TIMEOUT) as response:
+        return json.loads(response.read())
+
+
+class IconResolver:
+    """Resolve an application id and title to an icon on cdn.jsdelivr.net.
+
+    selfh.st is preferred because most of the interface already draws from it;
+    dashboard-icons covers what it lacks. Both are consulted by exact id, then
+    by id and title with separators removed, which is what recovers
+    ``homeassistant`` from ``home-assistant`` and ``actualbudget`` from
+    ``actual-budget``.
+    """
+
+    def __init__(self, selfhst: object | None = None, homarr: object | None = None,
+                 publishers: list[object] | None = None) -> None:
+        self._sets: list[tuple[dict[str, str], set[str], str]] = []
+        self._load_selfhst(selfhst if selfhst is not None else _read(SELFHST_INDEX))
+        self._load_homarr(homarr if homarr is not None else _read(HOMARR_INDEX))
+        for position, (url, pattern, template) in enumerate(PUBLISHER_TREES):
+            tree = publishers[position] if publishers is not None else None
+            if tree is None:
+                try:
+                    tree = _read(url)
+                except Exception:
+                    # A publisher tree that cannot be read costs coverage, not
+                    # correctness: the generic sets already answered first.
+                    continue
+            self._load_publisher(tree, pattern, template)
+
+    def _load_publisher(self, tree: object, pattern: str, template: str) -> None:
+        expression = re.compile(pattern)
+        names: dict[str, str] = {}
+        entries = tree.get("tree") if isinstance(tree, dict) else None
+        for entry in entries if isinstance(entries, list) else []:
+            if not isinstance(entry, dict) or entry.get("type") != "blob":
+                continue
+            match = expression.fullmatch(str(entry.get("path") or ""))
+            if not match:
+                continue
+            name = match.group("name")
+            for candidate in (name.lower(), _key(name)):
+                if candidate:
+                    names.setdefault(candidate, entry["path"])
+        self._sets.append((names, set(), template.replace("{path}", "{name}")))
+
+    def _load_selfhst(self, index: object) -> None:
+        names: dict[str, str] = {}
+        themed: set[str] = set()
+        for entry in index if isinstance(index, list) else []:
+            if not isinstance(entry, dict) or entry.get("WebP") != "Yes":
+                continue
+            reference = str(entry.get("Reference") or "").strip()
+            if not reference:
+                continue
+            for candidate in (reference.lower(), _key(reference), _key(entry.get("Name"))):
+                if candidate:
+                    names.setdefault(candidate, reference)
+            if entry.get("Dark") == "Yes" or entry.get("Light") == "Yes":
+                themed.add(reference)
+        self._sets.append((names, themed, SELFHST_ICON))
+
+    def _load_homarr(self, tree: object) -> None:
+        names: dict[str, str] = {}
+        themed: set[str] = set()
+        files = tree.get("webp") if isinstance(tree, dict) else None
+        for filename in files if isinstance(files, list) else []:
+            stem = str(filename)
+            if not stem.endswith(".webp"):
+                continue
+            stem = stem[: -len(".webp")]
+            base = VARIANT_SUFFIX_RE.sub("", stem)
+            if base != stem:
+                themed.add(base)
+                continue
+            for candidate in (base.lower(), _key(base)):
+                if candidate:
+                    names.setdefault(candidate, base)
+        self._sets.append((names, themed, HOMARR_ICON))
+
+    @staticmethod
+    def reachable(url: str | None) -> bool:
+        """Whether a URL inherited from a publisher still serves an image.
+
+        The linuxserver templates URL was built from the application id and
+        answers 404 for seven out of ten entries, so it is only kept for the
+        ones where the file is really there.
+        """
+        if not isinstance(url, str) or not url.startswith(("http://", "https://")):
+            return False
+        request = urllib.request.Request(url, method="HEAD",
+                                        headers={"User-Agent": "ProxMenux"})
+        try:
+            with urllib.request.urlopen(request, timeout=TIMEOUT) as response:
+                return response.status == 200
+        except Exception:
+            return False
+
+    def resolve(self, app_id: str | None, title: str | None = None) -> dict[str, object] | None:
+        """The icon for one application, or None when neither set has it."""
+        base = str(app_id or "").strip().lower()
+        if base in CURATED:
+            return {"url": CURATED[base], "themed": False}
+        trimmed = base
+        while True:
+            shorter = QUALIFIER_RE.sub("", trimmed)
+            if shorter == trimmed:
+                break
+            trimmed = shorter
+        lookups = [base, _key(app_id), _key(title)]
+        if trimmed != base:
+            lookups += [trimmed, _key(trimmed)]
+        for names, themed, pattern in self._sets:
+            for lookup in lookups:
+                name = names.get(lookup) if lookup else None
+                if name:
+                    return {"url": pattern.format(name=name), "themed": name in themed}
+        return None
diff --git a/oci/src/proxmenux_oci/installer.py b/oci/src/proxmenux_oci/installer.py
index f52888fd..8a4cbea7 100644
--- a/oci/src/proxmenux_oci/installer.py
+++ b/oci/src/proxmenux_oci/installer.py
@@ -122,10 +122,15 @@ def build_deployment(
     ui = ui or TerminalUI()
     if template.get('proxmox', {}).get('installer_profile', {}).get('stack_driver') == 'arr-suite':
         from .arr_suite import build_suite
-        return build_suite(template, ui)
+        return build_suite(template, ui, mode)
     if template.get('proxmox', {}).get('installer_profile', {}).get('stack_driver') == 'generic-multi-lxc-stack':
         from .stack import build_stack
-        return build_stack(template, ui)
+        return build_stack(template, ui, mode)
+    if mode == DEFAULT_MODE and template.get('id') in {
+        'image-immich', 'image-nextcloud-stack', 'image-paperless-ngx', 'image-tandoor'
+    }:
+        from .stack import DefaultsUI
+        ui = DefaultsUI()
     if template.get("id") == "image-immich":
         return _build_immich_deployment(template, ui)
     if template.get("id") == "image-nextcloud-stack":
@@ -1159,7 +1164,7 @@ def _run_remote_install(
             shutil.copy2(project_root / 'remote' / 'haos_healthcheck.py', temporary / 'haos_healthcheck.py')
             shutil.copy2(project_root / 'remote' / 'oci_installation_state.py', temporary / 'oci_installation_state.py')
             shutil.copy2(project_root / 'remote' / 'oci_instances.py', temporary / 'oci_instances.py')
-            for helper in ('oci_ui.sh', 'oci_ui.py', 'oci_native_stack.py', 'oci_native_stack.sh', 'oci_instance_transaction.py', 'oci_host_mounts.py', 'oci_runtime_settings.py', 'oci_gpu_devices.py', 'oci_accelerators.py', 'oci_nvidia_runtime.py', 'oci_nvidia_refresh.py', 'oci_nvidia_dynamic.py', 'oci_update_current.py', 'oci_stack_replay.py', 'oci_stack_plan.py', 'oci_stack_transaction.py', 'oci_stack_native.py', 'oci_image_cache.py', 'nvidia_lxc_mount_lab.sh', 'oci_nvidia_setup.sh', 'oci_immich_ml.sh'):
+            for helper in ('oci_ui.sh', 'oci_ui.py', 'oci_description.py', 'oci_console.py', 'oci_native_stack.py', 'oci_native_stack.sh', 'oci_instance_transaction.py', 'oci_host_mounts.py', 'oci_runtime_settings.py', 'oci_gpu_devices.py', 'oci_accelerators.py', 'oci_nvidia_runtime.py', 'oci_nvidia_refresh.py', 'oci_nvidia_dynamic.py', 'oci_update_current.py', 'oci_stack_replay.py', 'oci_stack_plan.py', 'oci_stack_transaction.py', 'oci_stack_native.py', 'oci_image_cache.py', 'nvidia_lxc_mount_lab.sh', 'oci_nvidia_setup.sh', 'oci_immich_ml.sh'):
                 shutil.copy2(project_root / 'remote' / helper, temporary / helper)
             if deployment_kind == 'generic-multi-lxc-stack':
                 shutil.copy2(project_root / 'remote' / 'install_generic_stack.py', temporary / 'install_generic_stack.py')
@@ -1196,7 +1201,7 @@ def _run_remote_install(
             archive.add(project_root / 'remote' / 'haos_healthcheck.py', arcname='haos_healthcheck.py')
             archive.add(project_root / 'remote' / 'oci_installation_state.py', arcname='oci_installation_state.py')
             archive.add(project_root / 'remote' / 'oci_instances.py', arcname='oci_instances.py')
-            for helper in ('oci_ui.sh', 'oci_ui.py', 'oci_native_stack.py', 'oci_native_stack.sh', 'oci_instance_transaction.py', 'oci_host_mounts.py', 'oci_runtime_settings.py', 'oci_gpu_devices.py', 'oci_accelerators.py', 'oci_nvidia_runtime.py', 'oci_nvidia_refresh.py', 'oci_nvidia_dynamic.py', 'oci_update_current.py', 'oci_stack_replay.py', 'oci_stack_plan.py', 'oci_stack_transaction.py', 'oci_stack_native.py', 'oci_image_cache.py', 'nvidia_lxc_mount_lab.sh', 'oci_nvidia_setup.sh', 'oci_immich_ml.sh'):
+            for helper in ('oci_ui.sh', 'oci_ui.py', 'oci_description.py', 'oci_console.py', 'oci_native_stack.py', 'oci_native_stack.sh', 'oci_instance_transaction.py', 'oci_host_mounts.py', 'oci_runtime_settings.py', 'oci_gpu_devices.py', 'oci_accelerators.py', 'oci_nvidia_runtime.py', 'oci_nvidia_refresh.py', 'oci_nvidia_dynamic.py', 'oci_update_current.py', 'oci_stack_replay.py', 'oci_stack_plan.py', 'oci_stack_transaction.py', 'oci_stack_native.py', 'oci_image_cache.py', 'nvidia_lxc_mount_lab.sh', 'oci_nvidia_setup.sh', 'oci_immich_ml.sh'):
                 archive.add(project_root / 'remote' / helper, arcname=helper)
             if deployment_kind == 'generic-multi-lxc-stack':
                 archive.add(project_root / 'remote' / 'install_generic_stack.py', arcname='install_generic_stack.py')
@@ -1368,10 +1373,13 @@ def configure_acceleration(installer_profile, environment, unprivileged, ui, mod
     if hardware:
         profiles = hardware.get("profiles", [])
         options = [(item["id"], item["label"]) for item in profiles]
-        selected_hardware_profile = ui.choose(
-            translate(hardware.get("prompt", "Hardware acceleration")),
-            [(tag, translate(label)) for tag, label in options],
-            hardware.get("default", profiles[0]["id"] if profiles else None),
+        default_profile = hardware.get("default", profiles[0]["id"] if profiles else None)
+        selected_hardware_profile = (
+            ui.choose(
+                translate(hardware.get("prompt", "Hardware acceleration")),
+                [(tag, translate(label)) for tag, label in options],
+                default_profile,
+            ) if advanced or not installer_profile.get("selkies") else default_profile
         )
         if selected_hardware_profile is None:
             raise UserCancelled(translate("Acceleration configuration cancelled"))
diff --git a/oci/src/proxmenux_oci/management.py b/oci/src/proxmenux_oci/management.py
index 685017fc..735e6cd8 100644
--- a/oci/src/proxmenux_oci/management.py
+++ b/oci/src/proxmenux_oci/management.py
@@ -125,7 +125,8 @@ def _run_lifecycle(command, title):
     console.msg_title(title)
     environment = dict(os.environ, OCI_SPINNER='1' if sys.stdout.isatty() else '0')
     completed = subprocess.run(command, env=environment, check=False)
-    console.wait_for_enter(translate('Press Enter to return to the menu...'))
+    if sys.stdin.isatty():
+        console.wait_for_enter(translate('Press Enter to return to the menu...'))
     return completed.returncode == 0
 
 
@@ -163,28 +164,54 @@ def _interactive_management(project, ui):
     if selection is None:
         return
     row = next(r for r in rows if str(r['vmid']) == selection)
+    manage_instance(project, ui, row)
+
+
+def manage_instance(project, ui, row, action=None, lifecycle_args=()):
+    """What the menu does with one instance once it is selected. `action`
+    skips the choice of operation, as ProxMenux Monitor does; the extra
+    `lifecycle_args` are passed to the program that performs it."""
     row = check_selected(project, row)
     if row['reason'] != 'matched':
         ui.message(translate('The selected CT does not match its OCI record. Its configuration will not be modified or deleted.'), translate('OCI management'))
-        return
+        return False
     if row['stack']:
-        _manage_stack(project, ui, row)
-        return
+        return _manage_stack(project, ui, row, action, lifecycle_args)
     if not row['pending']:
         if row['status'] != 'installed' or row['reason'] != 'matched':
             ui.message(translate('The instance identity or status must be reviewed before updating.'), translate('OCI management'))
-            return
-        action = ui.choose(translate('Manage OCI'), [('update', translate('Update the image with the saved configuration')),
-                                                     ('recreate', translate('Recreate: edit resources, network, paths and GPU')),
-                                                     ('remove', translate('Remove: delete the application and its containers'))], 'update')
+            return False
         if action is None:
-            return
+            action = ui.choose(translate('Manage OCI'), [('update', translate('Update the image with the saved configuration')),
+                                                         ('recreate', translate('Recreate: edit resources, network, paths and GPU')),
+                                                         ('remove', translate('Remove: delete the application and its containers'))], 'update')
+        if action is None:
+            return False
         sys.path.insert(0, str(project / 'remote'))
         import oci_instances as instances
         record = instances.read(instances.ROOT, row['vmid'])
         if action == 'remove':
-            _remove(project, ui, row['vmid'])
-            return
+            return _remove(project, ui, row['vmid'])
+        import oci_instance_reconcile as reconcile
+        try:
+            current_config = instances.command('pct', 'config', str(row['vmid']))
+            adoption = reconcile.propose(record, current_config)
+        except (OSError, ValueError, RuntimeError) as error:
+            ui.message(str(error), translate('Review external OCI changes'))
+            return False
+        if adoption:
+            summary = '\n'.join(adoption['details'])
+            if not ui.review(
+                    f"{translate('These Proxmox resources were added outside ProxMenux:')}\n\n{summary}\n\n"
+                    + translate('They will be added to oci-compose before continuing. Unsupported or changed resources are not imported.'),
+                    translate('Review external OCI changes'),
+                    question=translate('Include these resources in oci-compose?'), default=False):
+                return False
+            try:
+                record = reconcile.commit(instances.ROOT, row['vmid'], adoption)
+            except (OSError, ValueError, RuntimeError) as error:
+                ui.message(str(error), translate('Review external OCI changes'))
+                return False
         proposal = None
         if action == 'recreate':
             from .recreation import edit_recreation
@@ -193,16 +220,18 @@ def _interactive_management(project, ui):
             if not ui.review(_deployment_summary_text(proposal['candidate']['template'],
                              proposal['candidate']['deployment']), translate('Recreate OCI'),
                              question=translate('Recreate with these options?'), default=True):
-                return
+                return False
         elif not ui.review(translate('The current image of the saved channel will be checked and downloaded. Resources, paths and GPU are kept. The CT is stopped during the replacement and a native backup is created first.'),
                            translate('Update OCI'), question=translate('Update now?'), default=True):
-            return
-        command = [sys.executable, str(project / 'remote/oci_update_current.py'), str(row['vmid'])]
+            return False
+        command = [sys.executable, str(project / 'remote/oci_update_current.py'), str(row['vmid']),
+                   *lifecycle_args]
         desired = proposal['candidate'] if proposal else record
         if any(m['type'] == 'host-bind' for m in desired['deployment'].get('mounts', [])):
-            if not ui.confirm(translate('Shared host data is not reverted by the backup. Continue?'), False):
-                return
-            command.append('--acknowledge-external-data')
+            if '--acknowledge-external-data' not in command:
+                if not ui.confirm(translate('Shared host data is not reverted by the backup. Continue?'), False):
+                    return False
+                command.append('--acknowledge-external-data')
         title = translate('Recreate OCI') if proposal else translate('Update OCI')
         if proposal is None:
             completed = _run_lifecycle(command, title)
@@ -212,20 +241,20 @@ def _interactive_management(project, ui):
                 json.dump(proposal, file)
                 file.flush()
                 completed = _run_lifecycle(command + ['--proposal', file.name], title)
-        if completed:
+        if completed and not getattr(ui, 'unattended', False):
             images.offer_removal(ui, [row['vmid']])
-        return
+        return completed
     action = ui.choose(translate('Interrupted operation'), [('status', translate('View status')),
                                                         ('recover', translate('Recover the previous installation'))], 'status')
     if action is None:
-        return
+        return False
     if action == 'recover' and not ui.review(
             translate('The previous native backup will be restored. Shared host directories are not reverted. Displaced disks are kept.'),
             translate('Recover OCI'), question=translate('Recover now?'), default=True):
-        return
-    _run_lifecycle([sys.executable, str(project / 'remote/oci_instance_transaction.py'),
-                    action, str(row['vmid'])],
-                   translate('Recover OCI') if action == 'recover' else translate('OCI management'))
+        return False
+    return _run_lifecycle([sys.executable, str(project / 'remote/oci_instance_transaction.py'),
+                           action, str(row['vmid'])],
+                          translate('Recover OCI') if action == 'recover' else translate('OCI management'))
 
 
 def _removal_summary(project, vmid):
@@ -293,16 +322,16 @@ def _remove(project, ui, vmid):
         summary = _removal_summary(project, vmid)
     except (OSError, ValueError, KeyError) as error:
         ui.message(f"{translate('The removal could not be prepared:')} {error}", translate('Remove OCI'))
-        return
+        return False
     if not ui.review(summary, translate('Remove OCI'),
                      question=translate('Remove it? The data of its containers cannot be recovered afterwards.'),
                      default=False):
-        return
-    _run_lifecycle([sys.executable, str(project / 'remote/oci_remove.py'), str(vmid)],
-                   translate('Remove OCI'))
+        return False
+    return _run_lifecycle([sys.executable, str(project / 'remote/oci_remove.py'), str(vmid)],
+                          translate('Remove OCI'))
 
 
-def _manage_stack(project, ui, row):
+def _manage_stack(project, ui, row, action=None, lifecycle_args=()):
     sys.path.insert(0, str(project / 'remote'))
     import oci_instances as instances
     record = instances.read(instances.ROOT, row['vmid'])
@@ -320,34 +349,132 @@ def _manage_stack(project, ui, row):
                 oci_stack_replay.tandoor_menu_ready(primary) or
                 oci_stack_replay.immich_menu_ready(primary))):
             ui.message(translate('This stack requires replaying specific rootfs adaptations. Coordinated updates are not yet enabled for it.'), translate('OCI stack management'))
-            return
-        action = ui.choose(translate('Manage OCI stack'),
-                           [('update', translate('Update every container of the application')),
-                            ('remove', translate('Remove: delete the application and its containers'))], 'update')
+            return False
+        if action == 'recreate':
+            ui.message(translate('A multi-container application is not recreated: its containers are updated together.'), translate('OCI stack management'))
+            return False
         if action is None:
-            return
+            action = ui.choose(translate('Manage OCI stack'),
+                               [('update', translate('Update every container of the application')),
+                                ('remove', translate('Remove: delete the application and its containers'))], 'update')
+        if action is None:
+            return False
         if action == 'remove':
-            _remove(project, ui, primary_id)
-            return
+            return _remove(project, ui, primary_id)
         if not ui.review(f"{translate('All stack members are updated together. Main CT:')} {primary_id}, "
                 f"{translate('members:')} {len(members)}. "
                 f"{translate('All images are downloaded and verified first, and native backups are taken with the stack stopped. Contracts are published after the whole set is checked. If anything fails, all members are recovered.')}",
                 translate('Update OCI stack'), question=translate('Update the whole stack?'), default=True):
-            return
+            return False
     else:
         if not ui.review(translate('A coordinated operation is pending. The whole previous stack will be recovered, not only the selected member. If the operation already finished, the cleanup of its markers is completed.'), translate('Recover OCI stack'),
                 question=translate('Recover or complete the operation?'), default=True):
-            return
+            return False
         import json
         members = json.loads(Path(pending).read_text())['plan']['members']
     command = [sys.executable, str(project / 'remote/oci_stack_native.py'), str(primary_id)]
     if pending:
         command.append('--recover')
+    else:
+        command.extend(lifecycle_args)
     if any(mount['type'] == 'host-bind' for member in members
            for mount in member.get('deployment', {}).get('mounts', [])):
-        if not ui.confirm(translate('Shared host data is not reverted by the backups. Continue?'), False):
-            return
-        command.append('--acknowledge-external-data')
+        if '--acknowledge-external-data' not in command:
+            if not ui.confirm(translate('Shared host data is not reverted by the backups. Continue?'), False):
+                return False
+            command.append('--acknowledge-external-data')
     completed = _run_lifecycle(command, translate('Recover OCI stack') if pending else translate('Update OCI stack'))
-    if completed and not pending:
+    if completed and not pending and not getattr(ui, 'unattended', False):
         images.offer_removal(ui, [int(member['vmid']) for member in members])
+    return completed
+
+
+class UnattendedUI:
+    """The answers of a scheduled run: a step with a positive default goes on,
+    and one that needs a person (adopting external changes) stops the run."""
+    unattended = True
+
+    def __init__(self):
+        self.declined = None
+
+    def message(self, text, title=None):
+        print(f"{title}: {text}" if title else text, flush=True)
+
+    def review(self, text, title=None, question=None, default=False, **_):
+        if not default:
+            self.declined = title or question
+            self.message(text, title)
+        return default
+
+    def confirm(self, text, default=False, **_):
+        if not default:
+            self.declined = text
+        return default
+
+    def choose(self, *_, **__):
+        return None
+
+    def ask(self, text, *_, **__):
+        raise RuntimeError(f"{translate('A scheduled run cannot answer:')} {text}")
+
+
+# Exit codes of `manage`, read by ProxMenux Monitor.
+EXIT_DONE, EXIT_FAILED, EXIT_NOT_OCI, EXIT_BUSY, EXIT_NEEDS_REVIEW, EXIT_TOO_RECENT = 0, 1, 2, 3, 4, 5
+
+
+def _image_too_recent(project, vmid, min_age_days):
+    """Whether a new image of the instance, or of any member of its stack, is
+    younger than the given number of days. An unchanged digest is never too
+    recent: there is nothing to install."""
+    import datetime
+    sys.path.insert(0, str(project / 'remote'))
+    import oci_instances as instances
+    from oci_installation_state import parse_config, resolve_candidate
+    record = instances.read(instances.ROOT, vmid)
+    primary_id = record.get('stack_member', {}).get('primary_vmid', vmid)
+    primary = instances.read(instances.ROOT, primary_id) if primary_id != vmid else record
+    members = [m['vmid'] for m in primary.get('stack', {}).get('members', [])] or [vmid]
+    limit = datetime.datetime.now(datetime.timezone.utc) - datetime.timedelta(days=min_age_days)
+    for member in members:
+        member_record = instances.read(instances.ROOT, member)
+        reference = member_record['template']['container_contract']['image']['reference']
+        arch = parse_config(instances.command('pct', 'config', str(member)))['arch']
+        candidate = resolve_candidate(reference, arch)
+        installed = (member_record.get('observed', {}).get('image') or {}).get('manifest_digest')
+        if candidate.get('manifest_digest') == installed or not candidate.get('created'):
+            continue
+        created = datetime.datetime.fromisoformat(str(candidate['created']).replace('Z', '+00:00'))
+        if created.tzinfo is None:
+            created = created.replace(tzinfo=datetime.timezone.utc)
+        if created > limit:
+            return True
+    return False
+
+
+def direct_management(project, vmid, action, lifecycle_args=(), unattended=False, min_image_age_days=0):
+    """One operation on one instance, without the list of the menu: the entry
+    ProxMenux Monitor uses for its Update and Recreate buttons and for
+    scheduled updates."""
+    from .ui import interactive_ui
+    ui = UnattendedUI() if unattended else interactive_ui()
+    if os.geteuid() != 0 or not shutil.which('pct'):
+        ui.message(translate('This interface runs on the Proxmox node as root. Open OCI manager Apps from the ProxMenux menu on the Proxmox host.'), translate('OCI management'))
+        return EXIT_FAILED
+    if unattended and action != 'update':
+        ui.message(translate('Only the update of the image runs unattended.'), translate('OCI management'))
+        return EXIT_FAILED
+    try:
+        row = next((r for r in saved_inventory(project) if r['vmid'] == vmid), None)
+        if row is None:
+            ui.message(translate('This container is not a registered OCI instance.'), translate('OCI management'))
+            return EXIT_NOT_OCI
+        if min_image_age_days > 0 and action == 'update' and _image_too_recent(project, vmid, min_image_age_days):
+            ui.message(translate('The new image is more recent than the minimum age set for scheduled updates; it is not installed yet.'), translate('Update OCI'))
+            return EXIT_TOO_RECENT
+        completed = manage_instance(project, ui, row, action, lifecycle_args)
+    except BlockingIOError:
+        ui.message(translate('Another OCI operation is using the instance registry. Wait for it to finish and open this menu again; no container is modified.'), translate('OCI management'))
+        return EXIT_BUSY
+    if unattended and ui.declined:
+        return EXIT_NEEDS_REVIEW
+    return EXIT_DONE if completed else EXIT_FAILED
diff --git a/oci/src/proxmenux_oci/stack.py b/oci/src/proxmenux_oci/stack.py
index a8ca6823..080cb4e7 100644
--- a/oci/src/proxmenux_oci/stack.py
+++ b/oci/src/proxmenux_oci/stack.py
@@ -247,8 +247,8 @@ class DefaultsUI:
         pass
 
 
-def build_stack(template, ui):
-    from .installer import build_deployment, _hostname_default
+def build_stack(template, ui, mode='advanced'):
+    from .installer import build_deployment, _hostname_default, DEFAULT_MODE
     problems = assess(template)
     if problems:
         raise StackError('; '.join(problems))
@@ -259,10 +259,10 @@ def build_stack(template, ui):
     from . import host
     from . import network as access
     from .installer import ask_bridge, ask_storage
-    root = ask_storage(ui, translate('Storage for rootfs'), 'rootdir', defaults['rootfs_storage'])
-    volumes = ask_storage(ui, translate('Storage for persistent data'), 'rootdir', defaults['volume_storage'])
-    cache = ask_storage(ui, translate('Storage for the OCI image cache'), 'vztmpl', defaults['template_storage'])
-    bridge = ask_bridge(ui, translate('Access bridge'), defaults['bridge'])
+    root = ask_storage(ui, translate('Storage for rootfs'), 'rootdir', defaults['rootfs_storage'], mode)
+    volumes = ask_storage(ui, translate('Storage for persistent data'), 'rootdir', defaults['volume_storage'], mode)
+    cache = ask_storage(ui, translate('Storage for the OCI image cache'), 'vztmpl', defaults['template_storage'], mode)
+    bridge = ask_bridge(ui, translate('Access bridge'), defaults['bridge'], mode)
     addresses, gateway = access.ask_addresses(ui, bridge, [''])
     timezone = ui.ask(translate('Timezone'), host.timezone())
     onboot = ui.confirm(translate('Start the stack with Proxmox'), False)
@@ -302,7 +302,7 @@ def build_stack(template, ui):
         for e in single['container_contract']['environment']:
             e['required'] = bool(e['example'])
             e['example'] = 'stack-resolved-value' if e['example'] else ''
-        plan = build_deployment(single, DefaultsUI())
+        plan = build_deployment(single, DefaultsUI(), DEFAULT_MODE)
         # Values are already resolved; do not reinterpret user credentials as Compose variables.
         plan['environment'] = [{'name':key,'value':value,'sensitive':True} for key,value in env.items() if value != '']
         plan.update(hostname=_hostname_default(name+'-'+s['name']), template_storage=cache,
@@ -311,19 +311,20 @@ def build_stack(template, ui):
         if 'memory_default_mb' not in single['proxmox'].get('installer_profile', {}).get('resources', {}):
             plan['resources']['memory_mb'] = max(1024 if k in {'postgres','mariadb','linuxserver/mariadb','mongo','getmeili/meilisearch'} else 512, plan['resources']['memory_mb'])
         for m in plan['mounts']:
-            mode = ui.choose(f"{s['name']}: {m['container_path']}", [('managed-volume',translate('Container volume (included in backups)')),('host-bind',translate('Host directory'))], 'managed-volume')
-            if mode is None:
+            mount_mode = ('managed-volume' if mode == DEFAULT_MODE else
+                          ui.choose(f"{s['name']}: {m['container_path']}",
+                                    [('managed-volume',translate('Container volume (included in backups)')),
+                                     ('host-bind',translate('Host directory'))], 'managed-volume'))
+            if mount_mode is None:
                 raise StackError(translate('Storage selection cancelled'))
-            m.update(type=mode, source=volumes, backup=mode=='managed-volume')
-            if mode == 'host-bind':
+            m.update(type=mount_mode, source=volumes, backup=mount_mode=='managed-volume')
+            if mount_mode == 'host-bind':
                 m['source'] = ui.ask(translate('Host directory'), '/mnt/oci-shared/'+name+'/'+s['name']+'/'+m['container_path'].strip('/').replace('/','-'))
                 m['size_gb'] = None
-            else:
+            elif mode != DEFAULT_MODE:
                 m['size_gb'] = int(ui.ask(translate('Volume size in GB'), str(max(8,m['size_gb'] or 8))))
             if m['size_gb'] is not None and m['size_gb'] < 1:
                 raise StackError(translate('Invalid volume size'))
-        from .custom_mounts import ask_custom_mounts
-        plan['mounts'] = ask_custom_mounts(ui, plan['mounts'], volumes)
         if k == 'postgres':
             health = {'type':'exec','timeout_seconds':180,'argv':['pg_isready','-h','127.0.0.1','-U',env.get('POSTGRES_USER','postgres'),'-d',env.get('POSTGRES_DB',env.get('POSTGRES_USER','postgres'))]}
         elif k == 'mariadb':
@@ -351,6 +352,9 @@ def build_stack(template, ui):
                       'template':single,'deployment':plan,'healthcheck':health})
         if main:
             plans[-1]['frontend_ipv4'] = addresses['']
+    if mode != DEFAULT_MODE:
+        from .custom_mounts import ask_stack_custom_mounts
+        ask_stack_custom_mounts(ui, plans, volumes)
     return {'deployment_kind':'generic-multi-lxc-stack','stack_name':name,'base_vmid':int(vmid) if vmid else None,
             'completion_notes':template.get('proxmox',{}).get('stack_completion_notes',[]),
             'rootfs_storage':root,'template_storage':cache,'onboot':onboot,'start_after_create':True,
diff --git a/oci/tests/test_instance_reconcile.py b/oci/tests/test_instance_reconcile.py
new file mode 100644
index 00000000..27caf9ca
--- /dev/null
+++ b/oci/tests/test_instance_reconcile.py
@@ -0,0 +1,101 @@
+"""Regression tests for explicit adoption of external OCI resources."""
+import json
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / 'remote'))
+
+import oci_instance_reconcile as reconcile
+from oci_installation_state import sha
+
+
+class MountTests(unittest.TestCase):
+    def test_managed_volume_belongs_to_container(self):
+        mount = reconcile._mount(
+            'mp2', 'local-lvm:vm-200-disk-3,mp=/media,size=8G,backup=1', 200)
+        self.assertEqual((mount['source'], mount['size_gb'], mount['backup']),
+                         ('local-lvm', 8, True))
+        with self.assertRaises(ValueError):
+            reconcile._mount('mp2', 'local-lvm:vm-201-disk-3,mp=/media,size=8G,backup=1', 200)
+
+    def test_mount_rejects_missing_backup_and_unsupported_options(self):
+        for value in (
+            'local-lvm:vm-200-disk-3,mp=/media,size=8G,backup=0',
+            'local-lvm:vm-200-disk-3,mp=/media,size=8G,backup=1,acl=1',
+        ):
+            with self.subTest(value=value), self.assertRaises(ValueError):
+                reconcile._mount('mp2', value, 200)
+
+    def test_non_integral_disk_size_rejected(self):
+        with self.assertRaises(ValueError):
+            reconcile._managed_size('7M')
+
+
+class ProposalTests(unittest.TestCase):
+    def test_new_volume_requires_confirmation_before_contract_changes(self):
+        config = b'description: proxmenux-instance=11111111-1111-1111-1111-111111111111\n'
+        added = config + b'mp2: local-lvm:vm-200-disk-3,mp=/media,size=8G,backup=1\n'
+        record = {
+            'vmid': 200, 'status': 'installed',
+            'installation_id': '11111111-1111-1111-1111-111111111111',
+            'deployment': {'mounts': [], 'devices': []},
+            'observed': {'config': config.decode(), 'config_sha256': sha(config),
+                         'archive_path': '/unused.tar', 'resolved_registry_digest': 'sha256:test',
+                         'image': {'manifest_digest': 'sha256:test'}},
+        }
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            target = root / '200' / 'oci-compose.json'
+            target.parent.mkdir()
+            target.write_text(json.dumps(record))
+            with (patch.object(reconcile.instances, 'ROOT', root),
+                  patch.object(reconcile.instances, 'identity', return_value=record['installation_id']),
+                  patch.object(reconcile.gpu_devices, 'capture', return_value={}),
+                  patch.object(reconcile.host_mounts, 'capture_sources', return_value={}),
+                  patch.object(reconcile.transaction, 'preflight')):
+                proposal = reconcile.propose(record, added)
+            self.assertEqual(proposal['candidate']['deployment']['mounts'][0]['container_path'], '/media')
+            self.assertEqual(json.loads(target.read_text())['deployment']['mounts'], [])
+
+    def test_commit_rechecks_configuration_and_saves_only_after_validation(self):
+        config = b'description: proxmenux-instance=11111111-1111-1111-1111-111111111111\n'
+        added = config + b'mp2: local-lvm:vm-200-disk-3,mp=/media,size=8G,backup=1\n'
+        record = {
+            'schema_version': 1, 'vmid': 200, 'status': 'installed',
+            'installation_id': '11111111-1111-1111-1111-111111111111',
+            'deployment': {'mounts': [], 'devices': []},
+            'observed': {'config': config.decode(), 'config_sha256': sha(config),
+                         'archive_path': '/unused.tar', 'resolved_registry_digest': 'sha256:test',
+                         'image': {'manifest_digest': 'sha256:test'}},
+        }
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            target = root / '200' / 'oci-compose.json'
+            target.parent.mkdir()
+            target.write_text(json.dumps(record))
+            with (patch.object(reconcile.instances, 'ROOT', root),
+                  patch.object(reconcile.instances, 'identity', return_value=record['installation_id']),
+                  patch.object(reconcile.instances, 'command', return_value=added),
+                  patch.object(reconcile.instances, 'observe', return_value={
+                      'config': added.decode(), 'config_sha256': sha(added)}),
+                  patch.object(reconcile.gpu_devices, 'capture', return_value={}),
+                  patch.object(reconcile.host_mounts, 'capture_sources', return_value={}),
+                  patch.object(reconcile.transaction, 'preflight')):
+                proposal = reconcile.propose(record, added)
+                stale = dict(proposal, config_sha256='wrong')
+                with self.assertRaises(ValueError):
+                    reconcile.commit(root, 200, stale)
+                self.assertEqual(json.loads(target.read_text())['deployment']['mounts'], [])
+                result = reconcile.commit(root, 200, proposal)
+            self.assertEqual(result['deployment']['mounts'][0]['container_path'], '/media')
+            self.assertEqual(json.loads(target.read_text())['observed']['config_sha256'], sha(added))
+            history = list((target.parent / 'history').glob('before-reconciliation-*.json'))
+            self.assertEqual(len(history), 1)
+            self.assertEqual(json.loads(history[0].read_text())['deployment']['mounts'], [])
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/oci/tests/test_oci_description.py b/oci/tests/test_oci_description.py
new file mode 100644
index 00000000..a4d242a0
--- /dev/null
+++ b/oci/tests/test_oci_description.py
@@ -0,0 +1,52 @@
+import json
+from pathlib import Path
+import sys
+import unittest
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / 'remote'))
+
+from oci_description import render
+from oci_instances import identity
+
+
+CATALOG = Path(__file__).resolve().parents[1] / 'catalog' / 'apps'
+INSTANCE = '978b58f3-d8b1-41a6-b7aa-a7ecac76b57f'
+
+
+class DescriptionTests(unittest.TestCase):
+    def test_adguard_notes_keep_identity_and_both_access_links(self):
+        template = json.loads((CATALOG / 'adguard-home.json').read_text())
+        notes = render(template, 'sha256:abc', INSTANCE, '192.168.0.42')
+        self.assertEqual(identity(('description: ' + notes.replace('\n', '\\n') + '\n').encode()), INSTANCE)
+        self.assertIn('/docs/oci-manager', notes)
+        self.assertIn('hub.docker.com/r/adguard/adguardhome', notes)
+        self.assertIn('http://192.168.0.42:3000/', notes)
+        self.assertIn('http://192.168.0.42:80/', notes)
+        self.assertNotIn('Digest:', notes)
+        self.assertIn('img.shields.io/badge/%F0%9F%93%9A_Docs-blue', notes)
+        self.assertIn('img.shields.io/badge/%F0%9F%92%BB_Code-green', notes)
+        self.assertIn('img.shields.io/badge/%E2%98%95_Ko--fi-red', notes)
+        self.assertIn('Image: <code>adguard/adguardhome:latest</code> ', notes)
+        self.assertIn('>Image</a> &middot; ', notes)
+        self.assertIn('>App</a>', notes)
+        self.assertIn('href="http://192.168.0.42:3000/" target="_blank" rel="noopener noreferrer">Setup (first run)</a>', notes)
+        self.assertIn('>http://192.168.0.42:3000/</a>', notes)
+        self.assertIn('href="http://192.168.0.42:80/" target="_blank" rel="noopener noreferrer">Web UI (after setup)</a>', notes)
+        self.assertIn('>http://192.168.0.42:80/</a>', notes)
+
+    def test_missing_ip_does_not_publish_placeholder_links(self):
+        template = json.loads((CATALOG / 'adguard-home.json').read_text())
+        notes = render(template, '', INSTANCE)
+        self.assertNotIn('http://:3000', notes)
+        self.assertIn('proxmenux-instance=' + INSTANCE, notes)
+
+    def test_untrusted_title_is_escaped(self):
+        template = {'id': 'example', 'catalog_ui': {'title': {'en_US': '<script>x</script>'}},
+                    'container_contract': {'image': {'reference': 'example:latest'}}}
+        notes = render(template, '', INSTANCE)
+        self.assertNotIn('<script>', notes)
+        self.assertIn('&lt;script&gt;', notes)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/scripts/backup_restore/test_backup_restore.sh b/scripts/backup_restore/test_backup_restore.sh
new file mode 100755
index 00000000..fac633b8
--- /dev/null
+++ b/scripts/backup_restore/test_backup_restore.sh
@@ -0,0 +1,609 @@
+#!/bin/bash
+# ==========================================================
+# ProxMenux - Backup/Restore Test Matrix (non-destructive)
+# ==========================================================
+
+set -u
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+RUNNER="${SCRIPT_DIR}/run_scheduled_backup.sh"
+APPLY_ONBOOT="${SCRIPT_DIR}/apply_pending_restore.sh"
+CLUSTER_APPLY="${SCRIPT_DIR}/apply_cluster_postboot.sh"
+HOST_SCRIPT="${SCRIPT_DIR}/backup_host.sh"
+LIB_SCRIPT="${SCRIPT_DIR}/lib_host_backup_common.sh"
+SCHED_SCRIPT="${SCRIPT_DIR}/backup_scheduler.sh"
+
+KEEP_TMP=0
+if [[ "${1:-}" == "--keep-tmp" ]]; then
+  KEEP_TMP=1
+fi
+
+TMP_ROOT="$(mktemp -d /tmp/proxmenux-brtest.XXXXXX)"
+REPORT_FILE="/tmp/proxmenux-backup-restore-test-$(date +%Y%m%d_%H%M%S).log"
+
+PASS=0
+FAIL=0
+SKIP=0
+
+log() {
+  echo "$*" | tee -a "$REPORT_FILE"
+}
+
+pass() {
+  PASS=$((PASS + 1))
+  log "[PASS] $*"
+}
+
+fail() {
+  FAIL=$((FAIL + 1))
+  log "[FAIL] $*"
+}
+
+skip() {
+  SKIP=$((SKIP + 1))
+  log "[SKIP] $*"
+}
+
+cleanup() {
+  if [[ "$KEEP_TMP" -eq 0 ]]; then
+    rm -rf "$TMP_ROOT"
+  else
+    log "[INFO] Temp root preserved: $TMP_ROOT"
+  fi
+}
+trap cleanup EXIT
+
+assert_file_contains() {
+  local file="$1"
+  local needle="$2"
+  if [[ -f "$file" ]] && grep -q "$needle" "$file"; then
+    return 0
+  fi
+  return 1
+}
+
+run_cmd_expect_ok() {
+  local desc="$1"
+  shift
+  if "$@" >>"$REPORT_FILE" 2>&1; then
+    pass "$desc"
+    return 0
+  fi
+  fail "$desc"
+  return 1
+}
+
+run_cmd_expect_fail() {
+  local desc="$1"
+  shift
+  if "$@" >>"$REPORT_FILE" 2>&1; then
+    fail "$desc"
+    return 1
+  fi
+  pass "$desc"
+  return 0
+}
+
+syntax_tests() {
+  log "\n=== Syntax checks ==="
+  run_cmd_expect_ok "bash -n backup_host.sh" bash -n "$HOST_SCRIPT"
+  run_cmd_expect_ok "bash -n lib_host_backup_common.sh" bash -n "$LIB_SCRIPT"
+  run_cmd_expect_ok "bash -n backup_scheduler.sh" bash -n "$SCHED_SCRIPT"
+  run_cmd_expect_ok "bash -n run_scheduled_backup.sh" bash -n "$RUNNER"
+  run_cmd_expect_ok "bash -n apply_pending_restore.sh" bash -n "$APPLY_ONBOOT"
+  run_cmd_expect_ok "bash -n apply_cluster_postboot.sh" bash -n "$CLUSTER_APPLY"
+}
+
+certificate_restore_tests() {
+  log "\n=== Custom pveproxy certificate restore (sandbox) ==="
+  if ! command -v openssl >/dev/null 2>&1; then
+    skip "Certificate restore tests require openssl."
+    return
+  fi
+
+  local fixture="$TMP_ROOT/certificate-restore"
+  local source_node="$fixture/source-node"
+  local empty_node="$fixture/empty-node"
+  local active_dir="$fixture/active"
+  local bin_dir="$fixture/bin"
+  local call_log="$fixture/pvenode.calls"
+  mkdir -p "$source_node" "$empty_node" "$active_dir" "$bin_dir"
+
+  openssl req -x509 -newkey rsa:2048 -nodes -days 1 \
+    -subj '/CN=proxmenux-restore-test' \
+    -keyout "$source_node/pveproxy-ssl.key" \
+    -out "$source_node/pveproxy-ssl.pem" >>"$REPORT_FILE" 2>&1
+  openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 \
+    -out "$fixture/mismatched.key" >>"$REPORT_FILE" 2>&1
+
+  cat > "$bin_dir/pvenode" <<'EOS'
+#!/bin/bash
+printf '%s\n' "$*" >> "$PMX_TEST_CALL_LOG"
+[[ "${PMX_TEST_PVENODE_FAIL:-0}" == "1" ]] && exit 1
+if [[ "$1 $2" == "cert set" ]]; then
+  cp "$3" "$PMX_PVEPROXY_CERT_PATH"
+  cp "$4" "$PMX_PVEPROXY_KEY_PATH"
+elif [[ "$1 $2" == "cert delete" ]]; then
+  rm -f "$PMX_PVEPROXY_CERT_PATH" "$PMX_PVEPROXY_KEY_PATH"
+fi
+EOS
+  cat > "$bin_dir/systemctl" <<'EOS'
+#!/bin/bash
+[[ "${PMX_TEST_SERVICE_INACTIVE:-0}" == "1" ]] && exit 1
+[[ "$1 $2 $3" == "is-active --quiet pveproxy.service" ]]
+EOS
+  chmod +x "$bin_dir/pvenode" "$bin_dir/systemctl"
+
+  export PMX_PVENODE_BIN="$bin_dir/pvenode"
+  export PMX_SYSTEMCTL_BIN="$bin_dir/systemctl"
+  export PMX_PVEPROXY_CERT_PATH="$active_dir/pveproxy-ssl.pem"
+  export PMX_PVEPROXY_KEY_PATH="$active_dir/pveproxy-ssl.key"
+  export PMX_TEST_CALL_LOG="$call_log"
+  export PMX_PVEPROXY_VERIFY_ATTEMPTS=1
+
+  if (
+    PMX_CERT_HELPER_ONLY=1
+    source "$CLUSTER_APPLY"
+    _restore_pveproxy_certificate "$source_node"
+  ) >>"$REPORT_FILE" 2>&1; then
+    local source_fp active_fp
+    source_fp=$(openssl x509 -in "$source_node/pveproxy-ssl.pem" -noout -sha256 -fingerprint)
+    active_fp=$(openssl x509 -in "$PMX_PVEPROXY_CERT_PATH" -noout -sha256 -fingerprint)
+    if [[ "$source_fp" == "$active_fp" ]] \
+      && assert_file_contains "$call_log" "cert set .* --force 1 --restart 1"; then
+      pass "Valid custom certificate is installed through pvenode and verified"
+    else
+      fail "Valid custom certificate was not installed as expected"
+    fi
+  else
+    fail "Valid custom certificate restore failed"
+  fi
+
+  rm -f "$call_log"
+  if (
+    PMX_CERT_HELPER_ONLY=1
+    source "$CLUSTER_APPLY"
+    _restore_pveproxy_certificate "$empty_node"
+  ) >>"$REPORT_FILE" 2>&1 && [[ ! -e "$call_log" ]]; then
+    pass "Backup without a custom certificate leaves the current certificate unchanged"
+  else
+    fail "Empty certificate backup unexpectedly changed the current certificate"
+  fi
+
+  local active_before
+  active_before=$(openssl x509 -in "$PMX_PVEPROXY_CERT_PATH" -noout -sha256 -fingerprint)
+  mv "$source_node/pveproxy-ssl.key" "$fixture/source.key"
+  rm -f "$call_log"
+  if ! (
+    PMX_CERT_HELPER_ONLY=1
+    source "$CLUSTER_APPLY"
+    _restore_pveproxy_certificate "$source_node"
+  ) >>"$REPORT_FILE" 2>&1 \
+    && [[ ! -e "$call_log" ]] \
+    && [[ "$active_before" == "$(openssl x509 -in "$PMX_PVEPROXY_CERT_PATH" -noout -sha256 -fingerprint)" ]]; then
+    pass "Incomplete certificate pair is rejected without changing the active certificate"
+  else
+    fail "Incomplete certificate pair was not rejected safely"
+  fi
+
+  cp "$fixture/mismatched.key" "$source_node/pveproxy-ssl.key"
+  rm -f "$call_log"
+  if ! (
+    PMX_CERT_HELPER_ONLY=1
+    source "$CLUSTER_APPLY"
+    _restore_pveproxy_certificate "$source_node"
+  ) >>"$REPORT_FILE" 2>&1 \
+    && [[ ! -e "$call_log" ]] \
+    && [[ "$active_before" == "$(openssl x509 -in "$PMX_PVEPROXY_CERT_PATH" -noout -sha256 -fingerprint)" ]]; then
+    pass "Mismatched certificate pair is rejected without changing the active certificate"
+  else
+    fail "Mismatched certificate pair was not rejected safely"
+  fi
+
+  local replacement_node="$fixture/replacement-node"
+  mkdir -p "$replacement_node"
+  openssl req -x509 -newkey rsa:2048 -nodes -days 1 \
+    -subj '/CN=proxmenux-rollback-test' \
+    -keyout "$replacement_node/pveproxy-ssl.key" \
+    -out "$replacement_node/pveproxy-ssl.pem" >>"$REPORT_FILE" 2>&1
+  rm -f "$call_log"
+  export PMX_TEST_SERVICE_INACTIVE=1
+  if ! (
+    PMX_CERT_HELPER_ONLY=1
+    source "$CLUSTER_APPLY"
+    _restore_pveproxy_certificate "$replacement_node"
+  ) >>"$REPORT_FILE" 2>&1 \
+    && [[ "$active_before" == "$(openssl x509 -in "$PMX_PVEPROXY_CERT_PATH" -noout -sha256 -fingerprint)" ]] \
+    && [[ "$(grep -c '^cert set ' "$call_log" 2>/dev/null)" == "2" ]]; then
+    pass "Failed post-install verification restores the previous certificate"
+  else
+    fail "Certificate rollback did not restore the previous active pair"
+  fi
+  unset PMX_TEST_SERVICE_INACTIVE
+
+  unset PMX_PVENODE_BIN PMX_SYSTEMCTL_BIN PMX_PVEPROXY_CERT_PATH \
+    PMX_PVEPROXY_KEY_PATH PMX_TEST_CALL_LOG PMX_PVEPROXY_VERIFY_ATTEMPTS
+}
+
+staging_state_tests() {
+  log "\n=== Staging state and custom paths ==="
+  # shellcheck source=/dev/null
+  source "$LIB_SCRIPT"
+
+  if hb_default_profile_paths | grep -Fxq '/var/lib/proxmenux/backup-jobs'; then
+    pass "Default profile includes scheduled backup job definitions"
+  else
+    fail "Default profile does not include scheduled backup job definitions"
+  fi
+
+  if ! help mapfile >/dev/null 2>&1; then
+    skip "Staging copy tests require bash >= 4 and GNU rsync."
+    return
+  fi
+
+  local jobs_dir="$TMP_ROOT/staging-jobs"
+  local custom_dir="$TMP_ROOT/custom-state"
+  local stage_root="$TMP_ROOT/staging-output"
+  local previous_jobs_dir="$HB_BACKUP_JOBS_DIR"
+  local previous_state_dir="$HB_STATE_DIR"
+  mkdir -p "$jobs_dir" "$custom_dir/images" "$custom_dir/tmp"
+  echo "custom-state" > "$custom_dir/images/application.conf"
+  echo "audit" > "$custom_dir/application.log"
+  echo "temporary-but-selected" > "$custom_dir/tmp/state"
+  cat > "$jobs_dir/staging-test.env" <<EOJ
+JOB_ID=staging-test
+BACKEND=local
+ON_CALENDAR=daily
+PROFILE_MODE=custom
+ENABLED=1
+LOCAL_DEST_DIR=/var/lib/vz/dump
+LOCAL_ARCHIVE_EXT=tar.gz
+EOJ
+  echo "$custom_dir" > "$jobs_dir/staging-test.paths"
+
+  HB_BACKUP_JOBS_DIR="$jobs_dir"
+  HB_STATE_DIR="$TMP_ROOT/operator-state"
+  mkdir -p "$HB_STATE_DIR"
+  printf '/root\n' > "$(hb_extra_paths_file)"
+  if hb_path_is_operator_added /root && hb_path_is_operator_added "$custom_dir"; then
+    pass "Persisted and non-default paths are classified as operator-added"
+  else
+    fail "Operator-added path classification failed"
+  fi
+  if PMX_BACKUP_NO_SYSTEMCTL=1 hb_prepare_staging "$stage_root" "$custom_dir" >>"$REPORT_FILE" 2>&1; then
+    pass "Custom payload stages successfully"
+  else
+    fail "Custom payload staging failed"
+  fi
+
+  if [[ -f "$stage_root/rootfs/${custom_dir#/}/images/application.conf" && \
+        -f "$stage_root/rootfs/${custom_dir#/}/application.log" && \
+        -f "$stage_root/rootfs/${custom_dir#/}/tmp/state" ]]; then
+    pass "Custom path content is copied without generic exclusions"
+  else
+    fail "Custom path content was silently excluded from staging"
+  fi
+  if [[ -f "$stage_root/rootfs/${jobs_dir#/}/staging-test.env" ]]; then
+    pass "Job definitions are included with a custom profile"
+  else
+    fail "Job definitions were not added to the custom profile"
+  fi
+  if [[ ! -s "$stage_root/metadata/failed_paths.txt" ]]; then
+    pass "Successful staging has no failed paths"
+  else
+    fail "Successful staging unexpectedly reports failed paths"
+  fi
+  HB_BACKUP_JOBS_DIR="$previous_jobs_dir"
+  HB_STATE_DIR="$previous_state_dir"
+}
+
+restored_job_reconcile_tests() {
+  log "\n=== Restored job reconciliation (sandbox) ==="
+  local jobs_dir="$TMP_ROOT/reconcile-jobs"
+  local logs_dir="$TMP_ROOT/reconcile-logs"
+  local systemd_dir="$TMP_ROOT/reconcile-systemd"
+  local marker="$TMP_ROOT/unsafe-evaluated"
+  mkdir -p "$jobs_dir" "$logs_dir" "$systemd_dir"
+
+  cat > "$jobs_dir/enabled.env" <<'EOJ'
+JOB_ID=enabled
+BACKEND=local
+ON_CALENDAR=Mon..Fri\ 03:00
+PROFILE_MODE=custom
+ENABLED=1
+LOCAL_DEST_DIR=/var/lib/vz/dump
+LOCAL_ARCHIVE_EXT=tar.gz
+EOJ
+  echo "/etc/hosts" > "$jobs_dir/enabled.paths"
+
+  cat > "$jobs_dir/attached.env" <<'EOJ'
+JOB_ID=attached
+BACKEND=pbs
+PVE_PARENT_JOB=backup-1
+PVE_STORAGE=pbs-main
+PROFILE_MODE=default
+ENABLED=1
+PBS_REPOSITORY=root@pam@pbs.example:datastore
+PBS_PASSWORD=''
+PBS_BACKUP_ID=hostcfg-test
+EOJ
+  echo "/etc/hosts" > "$jobs_dir/attached.paths"
+
+  cat > "$jobs_dir/unsafe.env" <<EOJ
+JOB_ID=unsafe
+BACKEND=local
+ON_CALENDAR=daily
+PROFILE_MODE=custom
+ENABLED=1
+LOCAL_DEST_DIR=/var/lib/vz/dump
+LOCAL_ARCHIVE_EXT=tar.gz
+EVIL=\$(touch "$marker")
+EOJ
+  echo "/etc/hosts" > "$jobs_dir/unsafe.paths"
+
+  if PMX_BACKUP_JOBS_DIR="$jobs_dir" PMX_BACKUP_LOG_DIR="$logs_dir" \
+     PMX_BACKUP_SYSTEMD_DIR="$systemd_dir" PMX_BACKUP_NO_SYSTEMCTL=1 \
+     bash "$SCHED_SCRIPT" --reconcile-restored >>"$REPORT_FILE" 2>&1; then
+    fail "Reconciliation should report the invalid restored job"
+  else
+    pass "Reconciliation rejects an invalid restored job"
+  fi
+
+  if assert_file_contains "$systemd_dir/proxmenux-backup-enabled.timer" "OnCalendar=Mon..Fri 03:00"; then
+    pass "Valid standalone job timer is reconstructed"
+  else
+    fail "Valid standalone job timer was not reconstructed"
+  fi
+  if [[ ! -e "$systemd_dir/proxmenux-backup-attached.timer" ]]; then
+    pass "PVE-attached job is not converted into a duplicate timer"
+  else
+    fail "PVE-attached job unexpectedly created a timer"
+  fi
+  if [[ ! -e "$systemd_dir/proxmenux-backup-unsafe.timer" && ! -e "$marker" ]]; then
+    pass "Rejected job cannot create a unit or execute shell content"
+  else
+    fail "Rejected job produced side effects"
+  fi
+}
+
+scheduler_e2e_tests() {
+  log "\n=== Scheduler E2E (sandbox) ==="
+  if ! help mapfile >/dev/null 2>&1; then
+    skip "Scheduler E2E skipped: current bash does not provide mapfile (requires bash >= 4)."
+    return
+  fi
+
+  local jobs_dir="$TMP_ROOT/backup-jobs"
+  local logs_dir="$TMP_ROOT/backup-jobs-logs"
+  local lock_dir="$TMP_ROOT/locks"
+  local archives_dir="$TMP_ROOT/archives"
+
+  mkdir -p "$jobs_dir" "$logs_dir" "$lock_dir" "$archives_dir"
+
+  cat > "$jobs_dir/t1.env" <<EOJ
+JOB_ID=t1
+BACKEND=local
+PROFILE_MODE=custom
+LOCAL_DEST_DIR=${archives_dir}
+LOCAL_ARCHIVE_EXT=tar.gz
+KEEP_LAST=2
+KEEP_HOURLY=0
+KEEP_DAILY=0
+KEEP_WEEKLY=0
+KEEP_MONTHLY=0
+KEEP_YEARLY=0
+EOJ
+
+  cat > "$jobs_dir/t1.paths" <<EOP
+/etc/hosts
+/etc/resolv.conf
+EOP
+
+  local i
+  for i in 1 2 3; do
+    if PMX_BACKUP_JOBS_DIR="$jobs_dir" PMX_BACKUP_LOG_DIR="$logs_dir" PMX_BACKUP_LOCK_DIR="$lock_dir" \
+      bash "$RUNNER" t1 >>"$REPORT_FILE" 2>&1; then
+      :
+    else
+      fail "Runner execution #$i for t1"
+      return
+    fi
+    sleep 1
+  done
+
+  local archive_count
+  archive_count="$(find "$archives_dir" -maxdepth 1 -type f -name 't1-*.tar.gz' | wc -l | tr -d ' ')"
+  if [[ "$archive_count" == "2" ]]; then
+    pass "Retention KEEP_LAST=2 keeps exactly 2 archives"
+  else
+    fail "Retention expected 2 archives, got $archive_count"
+  fi
+
+  if assert_file_contains "$logs_dir/t1-last.status" "RESULT=ok"; then
+    pass "t1-last.status reports RESULT=ok"
+  else
+    fail "t1-last.status does not report RESULT=ok"
+  fi
+
+  cat > "$jobs_dir/tbad.env" <<EOJ
+JOB_ID=tbad
+BACKEND=invalid
+PROFILE_MODE=custom
+KEEP_LAST=1
+EOJ
+  echo "/etc/hosts" > "$jobs_dir/tbad.paths"
+
+  run_cmd_expect_fail "Invalid backend fails" \
+    env PMX_BACKUP_JOBS_DIR="$jobs_dir" PMX_BACKUP_LOG_DIR="$logs_dir" PMX_BACKUP_LOCK_DIR="$lock_dir" \
+    bash "$RUNNER" tbad
+
+  if assert_file_contains "$logs_dir/tbad-last.status" "RESULT=failed"; then
+    pass "tbad-last.status reports RESULT=failed"
+  else
+    fail "tbad-last.status does not report RESULT=failed"
+  fi
+
+  cat > "$jobs_dir/tempty.env" <<EOJ
+JOB_ID=tempty
+BACKEND=local
+PROFILE_MODE=custom
+LOCAL_DEST_DIR=${archives_dir}
+LOCAL_ARCHIVE_EXT=tar.gz
+KEEP_LAST=1
+EOJ
+  : > "$jobs_dir/tempty.paths"
+
+  run_cmd_expect_fail "Empty paths fails" \
+    env PMX_BACKUP_JOBS_DIR="$jobs_dir" PMX_BACKUP_LOG_DIR="$logs_dir" PMX_BACKUP_LOCK_DIR="$lock_dir" \
+    bash "$RUNNER" tempty
+
+  if assert_file_contains "$logs_dir/tempty-last.status" "RESULT=failed"; then
+    pass "tempty-last.status reports RESULT=failed"
+  else
+    fail "tempty-last.status does not report RESULT=failed"
+  fi
+}
+
+pending_restore_tests() {
+  log "\n=== Pending restore E2E (sandbox) ==="
+  local pending_base="$TMP_ROOT/restore-pending"
+  local logs_dir="$TMP_ROOT/restore-logs"
+  local target_root="$TMP_ROOT/target"
+  local pre_backup_base="$TMP_ROOT/pre-restore"
+  local recovery_base="$TMP_ROOT/recovery"
+
+  mkdir -p "$pending_base/r1/rootfs/etc/pve" "$pending_base/r1/rootfs/etc/zfs" "$pending_base/r1/rootfs/etc" "$target_root/etc"
+
+  echo "new-value" > "$pending_base/r1/rootfs/etc/test.conf"
+  echo "cluster-data" > "$pending_base/r1/rootfs/etc/pve/cluster.cfg"
+  echo "zfs-data" > "$pending_base/r1/rootfs/etc/zfs/zpool.cache"
+  echo "old-value" > "$target_root/etc/test.conf"
+
+  cat > "$pending_base/r1/apply-on-boot.list" <<EOL
+etc/test.conf
+etc/pve/cluster.cfg
+etc/zfs/zpool.cache
+EOL
+
+  cat > "$pending_base/r1/plan.env" <<EOP
+HB_RESTORE_INCLUDE_ZFS=0
+EOP
+
+  ln -sfn "$pending_base/r1" "$pending_base/current"
+
+  if PMX_RESTORE_PENDING_BASE="$pending_base" PMX_RESTORE_LOG_DIR="$logs_dir" \
+     PMX_RESTORE_DEST_PREFIX="$target_root" PMX_RESTORE_PRE_BACKUP_BASE="$pre_backup_base" \
+     PMX_RESTORE_RECOVERY_BASE="$recovery_base" \
+     bash "$APPLY_ONBOOT" >>"$REPORT_FILE" 2>&1; then
+    pass "apply_pending_restore completes"
+  else
+    fail "apply_pending_restore completes"
+    return
+  fi
+
+  if assert_file_contains "$target_root/etc/test.conf" "new-value"; then
+    pass "Regular file restored into target prefix"
+  else
+    fail "Regular file was not restored"
+  fi
+
+  if [[ -e "$target_root/etc/pve/cluster.cfg" ]]; then
+    fail "Cluster file should not be restored live"
+  else
+    pass "Cluster file skipped from live restore"
+  fi
+
+  if find "$recovery_base" -type f -name cluster.cfg 2>/dev/null | grep -q .; then
+    pass "Cluster file extracted to recovery directory"
+  else
+    fail "Cluster file not found in recovery directory"
+  fi
+
+  if assert_file_contains "$pending_base/completed/r1/state" "completed"; then
+    pass "Pending restore state marked completed"
+  else
+    fail "Pending restore state not marked completed"
+  fi
+
+  if [[ -e "$pending_base/current" ]]; then
+    fail "current symlink should be removed"
+  else
+    pass "current symlink removed"
+  fi
+}
+
+pending_jobs_restore_tests() {
+  log "\n=== Pending restore of scheduled jobs (sandbox) ==="
+  if ! help mapfile >/dev/null 2>&1; then
+    skip "Pending scheduled-job restore test requires the Linux runtime."
+    return
+  fi
+  local pending_base="$TMP_ROOT/jobs-restore-pending"
+  local logs_dir="$TMP_ROOT/jobs-restore-logs"
+  local target_root="$TMP_ROOT/jobs-restore-target"
+  local pre_backup_base="$TMP_ROOT/jobs-pre-restore"
+  local recovery_base="$TMP_ROOT/jobs-recovery"
+  local restored_jobs="$target_root/var/lib/proxmenux/backup-jobs"
+  local source_jobs="$pending_base/r2/rootfs/var/lib/proxmenux/backup-jobs"
+
+  mkdir -p "$source_jobs" "$target_root"
+  cat > "$source_jobs/restored.env" <<'EOJ'
+JOB_ID=restored
+BACKEND=local
+ON_CALENDAR=daily
+PROFILE_MODE=custom
+ENABLED=1
+LOCAL_DEST_DIR=/var/lib/vz/dump
+LOCAL_ARCHIVE_EXT=tar.gz
+EOJ
+  echo "/etc/hosts" > "$source_jobs/restored.paths"
+  echo "var/lib/proxmenux/backup-jobs" > "$pending_base/r2/apply-on-boot.list"
+  echo "HB_RESTORE_INCLUDE_ZFS=0" > "$pending_base/r2/plan.env"
+  ln -sfn "$pending_base/r2" "$pending_base/current"
+
+  if PMX_RESTORE_PENDING_BASE="$pending_base" PMX_RESTORE_LOG_DIR="$logs_dir" \
+     PMX_RESTORE_DEST_PREFIX="$target_root" PMX_RESTORE_PRE_BACKUP_BASE="$pre_backup_base" \
+     PMX_RESTORE_RECOVERY_BASE="$recovery_base" \
+     bash "$APPLY_ONBOOT" >>"$REPORT_FILE" 2>&1; then
+    pass "Pending restore applies scheduled job definitions"
+  else
+    fail "Pending restore failed while applying scheduled job definitions"
+    return
+  fi
+
+  if [[ -f "$restored_jobs/restored.env" && \
+        -f "$target_root/etc/systemd/system/proxmenux-backup-restored.timer" ]]; then
+    pass "Pending restore reconstructs the scheduled timer"
+  else
+    fail "Pending restore did not reconstruct the scheduled timer"
+  fi
+}
+
+main() {
+  log "ProxMenux backup/restore test matrix"
+  log "Report: $REPORT_FILE"
+  log "Temp root: $TMP_ROOT"
+
+  syntax_tests
+  certificate_restore_tests
+  staging_state_tests
+  restored_job_reconcile_tests
+  scheduler_e2e_tests
+  pending_restore_tests
+  pending_jobs_restore_tests
+
+  log "\n=== Summary ==="
+  log "PASS=$PASS"
+  log "FAIL=$FAIL"
+  log "SKIP=$SKIP"
+
+  if [[ "$FAIL" -eq 0 ]]; then
+    log "RESULT=OK"
+    exit 0
+  else
+    log "RESULT=FAILED"
+    exit 1
+  fi
+}
+
+main "$@"
diff --git a/scripts/gpu_tpu/tests/test_nvidia_per_bdf_state.sh b/scripts/gpu_tpu/tests/test_nvidia_per_bdf_state.sh
new file mode 100644
index 00000000..38e2e5dd
--- /dev/null
+++ b/scripts/gpu_tpu/tests/test_nvidia_per_bdf_state.sh
@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+TEST_ROOT=$(mktemp -d)
+trap 'rm -rf "$TEST_ROOT"' EXIT
+
+export PROXMENUX_SYSFS_ROOT="$TEST_ROOT/sys"
+export PROXMENUX_ETC_ROOT="$TEST_ROOT/etc"
+export PROXMENUX_STATE_ROOT="$TEST_ROOT/usr/local/share/proxmenux"
+export PROXMENUX_VFIO_BIND_STATE="$PROXMENUX_ETC_ROOT/proxmenux/vfio-bind.bdfs"
+export PROXMENUX_VFIO_BIND_UDEV_RULE="$PROXMENUX_ETC_ROOT/udev/rules.d/10-proxmenux-vfio-bind.rules"
+export PROXMENUX_VFIO_CONF="$PROXMENUX_ETC_ROOT/modprobe.d/vfio.conf"
+export PROXMENUX_NVIDIA_VFIO_BLACKLIST="$PROXMENUX_ETC_ROOT/modprobe.d/proxmenux-nvidia-vfio-blacklist.conf"
+export PROXMENUX_NVIDIA_SERVICE_STATE="$PROXMENUX_STATE_ROOT/nvidia-host-services.state"
+export PROXMENUX_NVIDIA_SERVICE_LEGACY_STATE="$TEST_ROOT/var/lib/proxmenux/nvidia-host-services.state"
+export PROXMENUX_VFIO_BIND_LEGACY_HOOK="$PROXMENUX_ETC_ROOT/initramfs-tools/scripts/init-top/proxmenux-vfio-bind"
+export SYSTEMCTL_LOG="$TEST_ROOT/systemctl.log"
+
+mkdir -p "$PROXMENUX_SYSFS_ROOT/bus/pci/devices" "$PROXMENUX_ETC_ROOT/modprobe.d" "$TEST_ROOT/bin"
+
+# The policy helper manages systemd services on a real host. Unit tests must
+# never touch them, so provide an inert command before sourcing the helper.
+cat > "$TEST_ROOT/bin/systemctl" <<'EOF'
+#!/usr/bin/env bash
+case "${1:-}" in
+  is-enabled|is-active) exit 1 ;;
+  *) printf '%s\n' "$*" >> "$SYSTEMCTL_LOG"; exit 0 ;;
+esac
+EOF
+chmod +x "$TEST_ROOT/bin/systemctl"
+export PATH="$TEST_ROOT/bin:$PATH"
+
+make_pci_device() {
+  local bdf="$1" vendor="$2" device="$3" class="$4"
+  local path="$PROXMENUX_SYSFS_ROOT/bus/pci/devices/$bdf"
+  mkdir -p "$path"
+  printf '0x%s\n' "$vendor" > "$path/vendor"
+  printf '0x%s\n' "$device" > "$path/device"
+  printf '0x%s\n' "$class" > "$path/class"
+}
+
+# Two identical NVIDIA GPUs reproduce the collision that vendor:device
+# binding caused: both share 10de:2484 but must be independently reversible.
+make_pci_device 0000:01:00.0 10de 2484 030000
+make_pci_device 0000:01:00.1 10de 228b 040300
+make_pci_device 0000:02:00.0 10de 2484 030000
+make_pci_device 0000:02:00.1 10de 228b 040300
+make_pci_device 0000:00:1f.3 8086 7ad0 040300
+
+cat > "$PROXMENUX_VFIO_CONF" <<'EOF'
+options vfio-pci ids=10DE:2484,10DE:228B,8086:7ad0 disable_vga=1
+EOF
+
+HOST_CONFIG_CHANGED=false
+SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+# shellcheck source=../../global/pci_passthrough_helpers.sh
+source "$SCRIPT_DIR/../../global/pci_passthrough_helpers.sh"
+
+_proxmenux_vfio_bind_migrate_legacy_nvidia_ids
+
+grep -qxF '0000:01:00.0' "$PROXMENUX_VFIO_BIND_STATE"
+grep -qxF '0000:01:00.1' "$PROXMENUX_VFIO_BIND_STATE"
+grep -qxF '0000:02:00.0' "$PROXMENUX_VFIO_BIND_STATE"
+grep -qxF '0000:02:00.1' "$PROXMENUX_VFIO_BIND_STATE"
+grep -q 'ids=8086:7ad0' "$PROXMENUX_VFIO_CONF"
+! grep -qi '10de:2484' "$PROXMENUX_VFIO_CONF"
+! grep -qi '10de:228b' "$PROXMENUX_VFIO_CONF"
+_proxmenux_all_nvidia_in_vfio
+[[ -f "$PROXMENUX_NVIDIA_VFIO_BLACKLIST" ]]
+
+# Returning only one GPU to the host must keep the other exact BDF in VFIO,
+# remove the global NVIDIA blacklist, retain NVIDIA softdeps, and restore any
+# service state captured by the short-lived /var/lib implementation.
+mkdir -p "$(dirname "$PROXMENUX_NVIDIA_SERVICE_LEGACY_STATE")"
+printf '%s\n' 'nvidia-persistenced.service enabled=1 active=1' \
+  > "$PROXMENUX_NVIDIA_SERVICE_LEGACY_STATE"
+_proxmenux_vfio_bind_remove_bdfs 0000:01:00.0 0000:01:00.1
+! _proxmenux_vfio_bind_has_bdf 0000:01:00.0
+! _proxmenux_vfio_bind_has_bdf 0000:01:00.1
+_proxmenux_vfio_bind_has_bdf 0000:02:00.0
+_proxmenux_vfio_bind_has_bdf 0000:02:00.1
+! _proxmenux_all_nvidia_in_vfio
+[[ ! -e "$PROXMENUX_NVIDIA_VFIO_BLACKLIST" ]]
+grep -qFx 'softdep nvidia pre: vfio-pci' "$PROXMENUX_VFIO_CONF"
+[[ ! -e "$PROXMENUX_NVIDIA_SERVICE_LEGACY_STATE" ]]
+[[ ! -e "$PROXMENUX_NVIDIA_SERVICE_STATE" ]]
+grep -qFx 'enable nvidia-persistenced.service' "$SYSTEMCTL_LOG"
+grep -qFx 'start nvidia-persistenced.service' "$SYSTEMCTL_LOG"
+
+# Returning the final NVIDIA GPU removes the remaining per-BDF policy while
+# leaving unrelated Intel VFIO configuration untouched.
+_proxmenux_vfio_bind_remove_bdfs 0000:02:00.0 0000:02:00.1
+! _proxmenux_vfio_bind_has_entries
+! grep -qFx 'softdep nvidia pre: vfio-pci' "$PROXMENUX_VFIO_CONF"
+grep -q 'ids=8086:7ad0' "$PROXMENUX_VFIO_CONF"
+
+echo "PASS: NVIDIA per-BDF migration and selective restore"
diff --git a/scripts/oci/manage_instance.sh b/scripts/oci/manage_instance.sh
new file mode 100755
index 00000000..05c4ab72
--- /dev/null
+++ b/scripts/oci/manage_instance.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+# ==========================================================
+# ProxMenux - Update or recreate one OCI instance
+# ==========================================================
+# Author      : MacRimi
+# Copyright   : (c) 2024 MacRimi
+# License     : GPL-3.0
+#               https://github.com/MacRimi/ProxMenux/blob/main/LICENSE
+# Version     : 1.0
+# ==========================================================
+# Description:
+# Runs in the ProxMenux Monitor terminal. Opens the same flow as
+# OCI manager Apps -> Manage installed OCI applications for one
+# container, without the list:
+#
+#   VMID         - the container (required)
+#   ACTION       - "update" or "recreate" (required)
+#   KEEP_BACKUP  - storage where the backup taken before the
+#                  update is kept (optional)
+# ==========================================================
+
+LOCAL_SCRIPTS="/usr/local/share/proxmenux/scripts"
+BASE_DIR="/usr/local/share/proxmenux"
+UTILS_FILE="$BASE_DIR/utils.sh"
+
+if [[ -f "$UTILS_FILE" ]]; then
+    source "$UTILS_FILE"
+fi
+load_language
+initialize_cache
+
+if [[ ! ${VMID:-} =~ ^[0-9]{1,9}$ ]]; then
+    msg_error "$(translate "Invalid VMID")"
+    exit 1
+fi
+if [[ ${ACTION:-} != "update" && ${ACTION:-} != "recreate" ]]; then
+    msg_error "$(translate "Invalid action")"
+    exit 1
+fi
+
+args=(manage "$VMID" --action "$ACTION")
+if [[ -n ${KEEP_BACKUP:-} ]]; then
+    if [[ ! $KEEP_BACKUP =~ ^[A-Za-z0-9._-]{1,64}$ ]]; then
+        msg_error "$(translate "Invalid storage name")"
+        exit 1
+    fi
+    args+=(--keep-backup "$KEEP_BACKUP")
+fi
+
+exec bash "$LOCAL_SCRIPTS/oci/oci_manager_apps.sh" "${args[@]}"
diff --git a/scripts/post_install/customizable_post_install.sh b/scripts/post_install/customizable_post_install.sh
index 55db86e3..4e8f3903 100644
--- a/scripts/post_install/customizable_post_install.sh
+++ b/scripts/post_install/customizable_post_install.sh
@@ -291,7 +291,7 @@ RateLimitIntervalSec=30s
 RateLimitBurst=1000
 # Disable Journald forwarding to syslog
 ForwardToSyslog=no
-# Don't forward to wall (para evitar mensajes en terminales)
+# Don't forward to wall: it would print on every open terminal
 ForwardToWall=no
 # Disable signing of the logs, save cpu resources
 Seal=no
diff --git a/scripts/post_install/tests/test_post_install_audit_fixes.sh b/scripts/post_install/tests/test_post_install_audit_fixes.sh
new file mode 100755
index 00000000..b2e8eb09
--- /dev/null
+++ b/scripts/post_install/tests/test_post_install_audit_fixes.sh
@@ -0,0 +1,201 @@
+#!/bin/bash
+
+set -euo pipefail
+
+SCRIPT_ROOT="${1:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
+CUSTOM_SCRIPT="$SCRIPT_ROOT/customizable_post_install.sh"
+UNINSTALL_SCRIPT="$SCRIPT_ROOT/uninstall-tools.sh"
+TEST_ROOT="$(mktemp -d)"
+trap 'rm -rf "$TEST_ROOT"' EXIT
+
+fail() {
+    printf 'FAIL: %s\n' "$*" >&2
+    exit 1
+}
+
+assert_eq() {
+    [[ "$1" == "$2" ]] || fail "expected '$2', got '$1'"
+}
+
+for script in "$CUSTOM_SCRIPT" "$UNINSTALL_SCRIPT"; do
+    [[ -r "$script" ]] || fail "missing script: $script"
+done
+
+# Load only the function libraries. Redirecting the built-in installation
+# paths keeps the test isolated from a real ProxMenux installation.
+load_language() { :; }
+initialize_cache() { :; }
+translate() { printf '%s' "$1"; }
+msg_info() { :; }
+msg_info2() { :; }
+msg_ok() { :; }
+msg_warn() { :; }
+msg_error() { :; }
+msg_success() { :; }
+show_proxmenux_logo() { :; }
+clear() { :; }
+
+sed \
+    -e "s|^LOCAL_SCRIPTS=.*|LOCAL_SCRIPTS=\"$TEST_ROOT/missing-scripts\"|" \
+    -e "s|^BASE_DIR=.*|BASE_DIR=\"$TEST_ROOT/state\"|" \
+    -e "s|^UTILS_FILE=.*|UTILS_FILE=\"$TEST_ROOT/missing-utils.sh\"|" \
+    -e "s|^TOOLS_JSON=.*|TOOLS_JSON=\"$TEST_ROOT/installed_tools.json\"|" \
+    "$CUSTOM_SCRIPT" > "$TEST_ROOT/customizable.sh"
+# shellcheck disable=SC1090
+source "$TEST_ROOT/customizable.sh"
+
+BASE_DIR="$TEST_ROOT/state"
+TOOLS_JSON="$TEST_ROOT/installed_tools.json"
+mkdir -p "$BASE_DIR"
+printf '{}\n' > "$TOOLS_JSON"
+REGISTRY_LOG="$TEST_ROOT/registry.log"
+register_tool() { printf '%s|%s|%s\n' "$1" "$2" "${3:-}" >> "$REGISTRY_LOG"; }
+
+# RPC: preserve asymmetric service/socket states and expose rollback even if
+# a later disable operation were to fail.
+declare -A UNIT_ENABLED=(
+    [rpcbind.socket]="enabled"
+    [rpcbind.service]="disabled"
+)
+declare -A UNIT_ACTIVE=(
+    [rpcbind.socket]="active"
+    [rpcbind.service]="inactive"
+)
+
+systemctl() {
+    local action="$1"
+    shift
+    case "$action" in
+        show)
+            local unit="${@: -1}"
+            printf 'loaded\n'
+            ;;
+        is-enabled)
+            printf '%s\n' "${UNIT_ENABLED[$1]:-disabled}"
+            ;;
+        is-active)
+            printf '%s\n' "${UNIT_ACTIVE[$1]:-inactive}"
+            ;;
+        disable)
+            [[ "${1:-}" == "--now" ]] && shift
+            local unit
+            for unit in "$@"; do
+                UNIT_ENABLED[$unit]="disabled"
+                UNIT_ACTIVE[$unit]="inactive"
+            done
+            ;;
+        enable)
+            local runtime=false
+            if [[ "${1:-}" == "--runtime" ]]; then
+                runtime=true
+                shift
+            fi
+            UNIT_ENABLED[$1]="$([[ "$runtime" == true ]] && printf 'enabled-runtime' || printf 'enabled')"
+            ;;
+        mask)
+            local runtime=false
+            if [[ "${1:-}" == "--runtime" ]]; then
+                runtime=true
+                shift
+            fi
+            UNIT_ENABLED[$1]="$([[ "$runtime" == true ]] && printf 'masked-runtime' || printf 'masked')"
+            ;;
+        start) UNIT_ACTIVE[$1]="active" ;;
+        stop) UNIT_ACTIVE[$1]="inactive" ;;
+        *) return 0 ;;
+    esac
+}
+
+disable_rpc
+grep -Fqx 'rpcbind.socket|enabled|active' "$BASE_DIR/rpcbind.state" || fail "rpcbind.socket state was not recorded"
+grep -Fqx 'rpcbind.service|disabled|inactive' "$BASE_DIR/rpcbind.state" || fail "rpcbind.service state was not recorded"
+grep -Fqx 'rpc|true|1.1' "$REGISTRY_LOG" || fail "RPC was not registered with version 1.1"
+assert_eq "${UNIT_ENABLED[rpcbind.socket]}" "disabled"
+assert_eq "${UNIT_ACTIVE[rpcbind.socket]}" "inactive"
+
+# Source uninstall functions without launching their interactive menu.
+sed \
+    -e "s|^LOCAL_SCRIPTS=.*|LOCAL_SCRIPTS=\"$TEST_ROOT/missing-scripts\"|" \
+    -e "s|^BASE_DIR=.*|BASE_DIR=\"$TEST_ROOT/state\"|" \
+    -e "s|^UTILS_FILE=.*|UTILS_FILE=\"$TEST_ROOT/missing-utils.sh\"|" \
+    -e "s|^TOOLS_JSON=.*|TOOLS_JSON=\"$TEST_ROOT/installed_tools.json\"|" \
+    -e '/^show_uninstall_menu$/d' \
+    "$UNINSTALL_SCRIPT" > "$TEST_ROOT/uninstall.sh"
+# shellcheck disable=SC1090
+source "$TEST_ROOT/uninstall.sh"
+BASE_DIR="$TEST_ROOT/state"
+TOOLS_JSON="$TEST_ROOT/installed_tools.json"
+register_tool() { printf '%s|%s|%s\n' "$1" "$2" "${3:-}" >> "$REGISTRY_LOG"; }
+
+uninstall_rpc
+assert_eq "${UNIT_ENABLED[rpcbind.socket]}" "enabled"
+assert_eq "${UNIT_ACTIVE[rpcbind.socket]}" "active"
+assert_eq "${UNIT_ENABLED[rpcbind.service]}" "disabled"
+assert_eq "${UNIT_ACTIVE[rpcbind.service]}" "inactive"
+[[ ! -e "$BASE_DIR/rpcbind.state" ]] || fail "RPC state was not removed after a successful restore"
+
+# MOTD: verify both an existing file and a previously absent file are
+# restored byte-for-byte to their original state.
+PROXMENUX_MOTD_FILE="$TEST_ROOT/motd"
+export PROXMENUX_MOTD_FILE
+printf 'Original line\n\nSecond line\n' > "$PROXMENUX_MOTD_FILE"
+cp "$PROXMENUX_MOTD_FILE" "$TEST_ROOT/motd.expected"
+rm -f "$BASE_DIR/motd.state" "$BASE_DIR/motd.original"
+setup_motd
+uninstall_motd
+cmp -s "$PROXMENUX_MOTD_FILE" "$TEST_ROOT/motd.expected" || fail "existing MOTD was not restored exactly"
+
+rm -f "$PROXMENUX_MOTD_FILE" "$BASE_DIR/motd.state" "$BASE_DIR/motd.original"
+setup_motd
+uninstall_motd
+[[ ! -e "$PROXMENUX_MOTD_FILE" ]] || fail "previously absent MOTD was not removed on restore"
+
+# System utilities: only packages absent before this invocation may be
+# recorded for a later purge.
+INSTALLED_PACKAGES="$TEST_ROOT/installed-packages"
+printf 'curl\n' > "$INSTALLED_PACKAGES"
+PROXMENUX_UTILS=(
+    'curl:curl:curl client'
+    'htop:htop:process viewer'
+)
+dialog() { printf '"curl" "htop"' >&2; }
+ensure_repositories() { return 0; }
+dpkg-query() {
+    local package="${@: -1}"
+    if grep -Fqx "$package" "$INSTALLED_PACKAGES"; then
+        printf 'install ok installed\n'
+        return 0
+    fi
+    return 1
+}
+install_single_package() {
+    local package="$1"
+    grep -Fqx "$package" "$INSTALLED_PACKAGES" || printf '%s\n' "$package" >> "$INSTALLED_PACKAGES"
+    return 0
+}
+rm -f "$BASE_DIR/system_utils.packages"
+install_system_utils
+grep -Fqx 'htop' "$BASE_DIR/system_utils.packages" || fail "new utility was not tracked"
+if grep -Fqx 'curl' "$BASE_DIR/system_utils.packages"; then
+    fail "pre-existing utility was incorrectly tracked for removal"
+fi
+
+# Static contracts from the audit. Capture function bodies first so
+# `set -o pipefail` cannot mistake grep -q's early exit for a failure in
+# `declare -f` caused by SIGPIPE.
+install_ceph_body="$(declare -f install_ceph)"
+enable_kexec_body="$(declare -f enable_kexec)"
+if grep -q 'apt-key' <<< "$install_ceph_body"; then
+    fail "install_ceph still contains apt-key"
+fi
+grep -q 'Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg' <<< "$install_ceph_body" || fail "Ceph deb822 keyring is missing"
+grep -q 'is already installed' <<< "$enable_kexec_body" || fail "kexec package state message is missing"
+grep -q 'service file is already configured' <<< "$enable_kexec_body" || fail "kexec service state message is missing"
+if grep -Eq '^[[:space:]]*(lvm_repair|repo_cleanup|apt_upgrade)\)' "$UNINSTALL_SCRIPT"; then
+    fail "orphaned uninstall menu entries remain"
+fi
+if declare -F uninstall_apt_upgrade >/dev/null; then
+    fail "unsafe apt full-upgrade uninstaller remains"
+fi
+
+printf 'PASS: post-install audit fixes\n'
diff --git a/scripts/storage/import-disk-image.sh b/scripts/storage/import-disk-image.sh
index 83fea26c..aa9a3e11 100644
--- a/scripts/storage/import-disk-image.sh
+++ b/scripts/storage/import-disk-image.sh
@@ -166,8 +166,7 @@ done <<< "$IMAGES"
 # `--separate-output` prints each selected tag on its own line with no
 # quoting, so we never need `eval` to split the output. The previous form
 # `eval "declare -a A=($SELECTED)"` would execute backticks / $(...) baked
-# into a filename — perfectly legal on ext4 — as shell commands. Audit
-# Tier 6 — `import-disk-image.sh` `eval` sobre salida del dialog.
+# into a filename — perfectly legal on ext4 — as shell commands.
 SELECTED_IMAGES_STR=$(dialog --backtitle "$BACKTITLE" \
   --separate-output \
   --title "$(translate 'Select Disk Images')" \
diff --git a/scripts/vm/guest_agent_config.sh b/scripts/vm/guest_agent_config.sh
index 92cb0f87..660d3e43 100644
--- a/scripts/vm/guest_agent_config.sh
+++ b/scripts/vm/guest_agent_config.sh
@@ -3,8 +3,7 @@
 # ==========================================================
 # Guest Agent Configurator - ProxMenux
 # ==========================================================
-# Añade soporte al QEMU Guest Agent y dispositivos útiles.
-# Se adapta según el sistema operativo.
+# Adds QEMU Guest Agent support and the useful devices, per guest OS.
 # ==========================================================
 
 BASE_DIR="/usr/local/share/proxmenux"
@@ -28,7 +27,7 @@ function configure_guest_agent() {
 
   msg_info "$(translate "Adding QEMU Guest Agent support...")"
 
-  # Habilitar el agente en la VM
+  # Enable the agent on the VM
   qm set "$VMID" -agent enabled=1 >/dev/null 2>&1
 
   # Añadir canal de comunicación virtio
diff --git a/scripts/vm/vm_creator.sh b/scripts/vm/vm_creator.sh
index 7d9bfb02..4120b68b 100644
--- a/scripts/vm/vm_creator.sh
+++ b/scripts/vm/vm_creator.sh
@@ -211,7 +211,7 @@ function configure_guest_agent() {
 
   msg_info "$(translate "Adding QEMU Guest Agent support...")"
 
-  # Habilitar el agente en la VM
+  # Enable the agent on the VM
   qm set "$VMID" -agent enabled=1 >/dev/null 2>&1
 
   # Añadir canal de comunicación virtio
diff --git a/web/app/[locale]/docs/hardware/gpu-vm-passthrough/page.tsx b/web/app/[locale]/docs/hardware/gpu-vm-passthrough/page.tsx
index 3d55bb45..f93b4470 100644
--- a/web/app/[locale]/docs/hardware/gpu-vm-passthrough/page.tsx
+++ b/web/app/[locale]/docs/hardware/gpu-vm-passthrough/page.tsx
@@ -288,7 +288,7 @@ export default async function GpuVmPassthroughPage({
           <p className="mb-3 text-gray-800">{t("walkthrough.switchMode.intro")}</p>
           <ul className="list-disc pl-6 space-y-1 text-gray-800 mb-3">
             {switchModeItems.map((_, idx) => (
-              <li key={idx}>{t.rich(`walkthrough.switchMode.items.${idx}`, { strong, code })}</li>
+              <li key={idx}>{t.rich(`walkthrough.switchMode.items.${idx}`, { strong, code, em })}</li>
             ))}
           </ul>
           <Image
@@ -333,7 +333,7 @@ export default async function GpuVmPassthroughPage({
           <p className="mb-3 text-gray-800">{t("walkthrough.hostApply.intro")}</p>
           <ul className="list-disc pl-6 space-y-1 text-gray-800 mb-3">
             {hostApplyItems.map((_, idx) => (
-              <li key={idx}>{t.rich(`walkthrough.hostApply.items.${idx}`, { strong, code })}</li>
+              <li key={idx}>{t.rich(`walkthrough.hostApply.items.${idx}`, { strong, code, em })}</li>
             ))}
           </ul>
         </Steps.Step>
diff --git a/web/app/[locale]/docs/hardware/nvidia-host/page.tsx b/web/app/[locale]/docs/hardware/nvidia-host/page.tsx
index d4372658..03c158a3 100644
--- a/web/app/[locale]/docs/hardware/nvidia-host/page.tsx
+++ b/web/app/[locale]/docs/hardware/nvidia-host/page.tsx
@@ -249,7 +249,7 @@ export default async function NvidiaHostPage({
         </Steps.Step>
 
         <Steps.Step title={t("walkthrough.version.title")}>
-          <p className="mb-3 text-gray-800">{t.rich("walkthrough.version.body1", { strong, em })}</p>
+          <p className="mb-3 text-gray-800">{t.rich("walkthrough.version.body1", { strong, em, code })}</p>
           <p className="mb-3 text-gray-800">{t("walkthrough.version.body2")}</p>
 
           <Callout variant="tip" title={t("walkthrough.version.whyTitle")}>
@@ -312,7 +312,7 @@ sh NVIDIA-Linux-x86_64-<version>.run \\
 
         <Steps.Step title={t("walkthrough.propagate.title")}>
           <p className="mb-3 text-gray-800">{t.rich("walkthrough.propagate.body1", { code, strong })}</p>
-          <p className="mb-3 text-gray-800">{t.rich("walkthrough.propagate.body2", { code })}</p>
+          <p className="mb-3 text-gray-800">{t.rich("walkthrough.propagate.body2", { code, strong })}</p>
           <Image
             src="/gpu-tpu/nvidia-host-05-lxc-update.png"
             alt={t("walkthrough.propagate.imageAlt")}
@@ -353,7 +353,7 @@ sh NVIDIA-Linux-x86_64-<version>.run \\
       <p className="mb-4 text-gray-800 leading-relaxed">{t("reinstallUninstall.uninstallIntro")}</p>
       <ul className="list-disc pl-6 mb-4 text-gray-800 leading-relaxed space-y-1">
         {uninstallItems.map((_, idx) => (
-          <li key={idx}>{t.rich(`reinstallUninstall.uninstallItems.${idx}`, { code })}</li>
+          <li key={idx}>{t.rich(`reinstallUninstall.uninstallItems.${idx}`, { code, em })}</li>
         ))}
       </ul>
 
diff --git a/web/app/[locale]/docs/hardware/switch-gpu-mode/page.tsx b/web/app/[locale]/docs/hardware/switch-gpu-mode/page.tsx
index 9c5c9e6d..1ba82743 100644
--- a/web/app/[locale]/docs/hardware/switch-gpu-mode/page.tsx
+++ b/web/app/[locale]/docs/hardware/switch-gpu-mode/page.tsx
@@ -119,7 +119,7 @@ export default async function SwitchGpuModePage({
         items={[
           { label: <>{t.rich("prereqs.assigned", { strong })}</> },
           {
-            label: <>{t.rich("prereqs.iommu", { strong, em })}</>,
+            label: <>{t.rich("prereqs.iommu", { strong, em, code })}</>,
             check: t("prereqs.iommuCheck"),
           },
           { label: <>{t.rich("prereqs.reboot", { strong })}</> },
diff --git a/web/app/[locale]/docs/monitor/api/page.tsx b/web/app/[locale]/docs/monitor/api/page.tsx
index d650c60d..e3a6a83a 100644
--- a/web/app/[locale]/docs/monitor/api/page.tsx
+++ b/web/app/[locale]/docs/monitor/api/page.tsx
@@ -63,7 +63,7 @@ export default async function MonitorApiPage({
       auth: { rows: EndpointRow[]; items: string[] }
       conventions: { items: string[] }
       system: { rows: EndpointRow[] }
-      actions: { rows: EndpointRow[] }
+      actions: { rows: EndpointRow[]; shapeCode: string; curlCode: string; haCode: string }
       health: { rows: EndpointRow[] }
       storage: { rows: EndpointRow[] }
       network: { rows: EndpointRow[] }
@@ -188,7 +188,7 @@ export default async function MonitorApiPage({
 
       <h3 className="text-lg font-semibold mt-6 mb-2 text-gray-900">{t("actions.shapeTitle")}</h3>
       <p className="mb-2 text-gray-800 leading-relaxed">{t("actions.shapeIntro")}</p>
-      <CopyableCode code={t("actions.shapeCode")} className="my-4" />
+      <CopyableCode code={messages.docs.monitor.apiReference.actions.shapeCode} className="my-4" />
 
       <h3 className="text-lg font-semibold mt-6 mb-2 text-gray-900">{t("actions.concurrencyTitle")}</h3>
       <p className="mb-4 text-gray-800 leading-relaxed">{t.rich("actions.concurrencyBody", { code })}</p>
@@ -200,11 +200,11 @@ export default async function MonitorApiPage({
 
       <h3 className="text-lg font-semibold mt-6 mb-2 text-gray-900">{t("actions.curlTitle")}</h3>
       <p className="mb-2 text-gray-800 leading-relaxed">{t("actions.curlBody")}</p>
-      <CopyableCode code={t("actions.curlCode")} className="my-4" />
+      <CopyableCode code={messages.docs.monitor.apiReference.actions.curlCode} className="my-4" />
 
       <h3 className="text-lg font-semibold mt-6 mb-2 text-gray-900">{t("actions.haTitle")}</h3>
       <p className="mb-2 text-gray-800 leading-relaxed">{t.rich("actions.haBody", { code })}</p>
-      <CopyableCode code={t("actions.haCode")} className="my-4" />
+      <CopyableCode code={messages.docs.monitor.apiReference.actions.haCode} className="my-4" />
 
       <h2 className="text-2xl font-semibold mt-10 mb-4 text-gray-900">{t("health.heading")}</h2>
       {endpointTable(healthRows, "health.rows")}
diff --git a/web/app/[locale]/docs/monitor/audit-report/assessment/page.tsx b/web/app/[locale]/docs/monitor/audit-report/assessment/page.tsx
new file mode 100644
index 00000000..96596ba9
--- /dev/null
+++ b/web/app/[locale]/docs/monitor/audit-report/assessment/page.tsx
@@ -0,0 +1,26 @@
+import type { Metadata } from "next"
+import { getTranslations, setRequestLocale } from "next-intl/server"
+import { DocPage } from "@/components/docs/DocBlocks"
+
+const NAMESPACE = "docs.monitor.auditReport.assessment"
+const LINKS = {
+  reportsLink: "/docs/monitor/audit-report/reports",
+}
+const URL = "https://proxmenux.com/docs/monitor/audit-report/assessment"
+
+export async function generateMetadata({ params }: { params: Promise<{ locale: string }> }): Promise<Metadata> {
+  const { locale } = await params
+  const t = await getTranslations({ locale, namespace: `${NAMESPACE}.meta` })
+  return {
+    title: t("title"),
+    description: t("description"),
+    alternates: { canonical: URL },
+    openGraph: { title: t("title"), description: t("description"), type: "article", url: URL },
+  }
+}
+
+export default async function Page({ params }: { params: Promise<{ locale: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+  return <DocPage locale={locale} namespace={NAMESPACE} minutes={6} links={LINKS} />
+}
diff --git a/web/app/[locale]/docs/monitor/audit-report/changes/page.tsx b/web/app/[locale]/docs/monitor/audit-report/changes/page.tsx
new file mode 100644
index 00000000..6036c42e
--- /dev/null
+++ b/web/app/[locale]/docs/monitor/audit-report/changes/page.tsx
@@ -0,0 +1,23 @@
+import type { Metadata } from "next"
+import { getTranslations, setRequestLocale } from "next-intl/server"
+import { DocPage } from "@/components/docs/DocBlocks"
+
+const NAMESPACE = "docs.monitor.auditReport.changes"
+const URL = "https://proxmenux.com/docs/monitor/audit-report/changes"
+
+export async function generateMetadata({ params }: { params: Promise<{ locale: string }> }): Promise<Metadata> {
+  const { locale } = await params
+  const t = await getTranslations({ locale, namespace: `${NAMESPACE}.meta` })
+  return {
+    title: t("title"),
+    description: t("description"),
+    alternates: { canonical: URL },
+    openGraph: { title: t("title"), description: t("description"), type: "article", url: URL },
+  }
+}
+
+export default async function Page({ params }: { params: Promise<{ locale: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+  return <DocPage locale={locale} namespace={NAMESPACE} minutes={5} />
+}
diff --git a/web/app/[locale]/docs/monitor/audit-report/page.tsx b/web/app/[locale]/docs/monitor/audit-report/page.tsx
new file mode 100644
index 00000000..79750d8b
--- /dev/null
+++ b/web/app/[locale]/docs/monitor/audit-report/page.tsx
@@ -0,0 +1,26 @@
+import type { Metadata } from "next"
+import { getTranslations, setRequestLocale } from "next-intl/server"
+import { DocPage } from "@/components/docs/DocBlocks"
+
+const NAMESPACE = "docs.monitor.auditReport"
+const LINKS = {
+  healthLink: "/docs/monitor/health-monitor",
+}
+const URL = "https://proxmenux.com/docs/monitor/audit-report"
+
+export async function generateMetadata({ params }: { params: Promise<{ locale: string }> }): Promise<Metadata> {
+  const { locale } = await params
+  const t = await getTranslations({ locale, namespace: `${NAMESPACE}.meta` })
+  return {
+    title: t("title"),
+    description: t("description"),
+    alternates: { canonical: URL },
+    openGraph: { title: t("title"), description: t("description"), type: "article", url: URL },
+  }
+}
+
+export default async function Page({ params }: { params: Promise<{ locale: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+  return <DocPage locale={locale} namespace={NAMESPACE} minutes={3} links={LINKS} />
+}
diff --git a/web/app/[locale]/docs/monitor/audit-report/policy/page.tsx b/web/app/[locale]/docs/monitor/audit-report/policy/page.tsx
new file mode 100644
index 00000000..7d817f85
--- /dev/null
+++ b/web/app/[locale]/docs/monitor/audit-report/policy/page.tsx
@@ -0,0 +1,23 @@
+import type { Metadata } from "next"
+import { getTranslations, setRequestLocale } from "next-intl/server"
+import { DocPage } from "@/components/docs/DocBlocks"
+
+const NAMESPACE = "docs.monitor.auditReport.policy"
+const URL = "https://proxmenux.com/docs/monitor/audit-report/policy"
+
+export async function generateMetadata({ params }: { params: Promise<{ locale: string }> }): Promise<Metadata> {
+  const { locale } = await params
+  const t = await getTranslations({ locale, namespace: `${NAMESPACE}.meta` })
+  return {
+    title: t("title"),
+    description: t("description"),
+    alternates: { canonical: URL },
+    openGraph: { title: t("title"), description: t("description"), type: "article", url: URL },
+  }
+}
+
+export default async function Page({ params }: { params: Promise<{ locale: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+  return <DocPage locale={locale} namespace={NAMESPACE} minutes={4} />
+}
diff --git a/web/app/[locale]/docs/monitor/audit-report/reports/page.tsx b/web/app/[locale]/docs/monitor/audit-report/reports/page.tsx
new file mode 100644
index 00000000..c360dbff
--- /dev/null
+++ b/web/app/[locale]/docs/monitor/audit-report/reports/page.tsx
@@ -0,0 +1,23 @@
+import type { Metadata } from "next"
+import { getTranslations, setRequestLocale } from "next-intl/server"
+import { DocPage } from "@/components/docs/DocBlocks"
+
+const NAMESPACE = "docs.monitor.auditReport.reports"
+const URL = "https://proxmenux.com/docs/monitor/audit-report/reports"
+
+export async function generateMetadata({ params }: { params: Promise<{ locale: string }> }): Promise<Metadata> {
+  const { locale } = await params
+  const t = await getTranslations({ locale, namespace: `${NAMESPACE}.meta` })
+  return {
+    title: t("title"),
+    description: t("description"),
+    alternates: { canonical: URL },
+    openGraph: { title: t("title"), description: t("description"), type: "article", url: URL },
+  }
+}
+
+export default async function Page({ params }: { params: Promise<{ locale: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+  return <DocPage locale={locale} namespace={NAMESPACE} minutes={6} />
+}
diff --git a/web/app/[locale]/docs/monitor/audit-report/scope/page.tsx b/web/app/[locale]/docs/monitor/audit-report/scope/page.tsx
new file mode 100644
index 00000000..17afb8ac
--- /dev/null
+++ b/web/app/[locale]/docs/monitor/audit-report/scope/page.tsx
@@ -0,0 +1,23 @@
+import type { Metadata } from "next"
+import { getTranslations, setRequestLocale } from "next-intl/server"
+import { DocPage } from "@/components/docs/DocBlocks"
+
+const NAMESPACE = "docs.monitor.auditReport.scope"
+const URL = "https://proxmenux.com/docs/monitor/audit-report/scope"
+
+export async function generateMetadata({ params }: { params: Promise<{ locale: string }> }): Promise<Metadata> {
+  const { locale } = await params
+  const t = await getTranslations({ locale, namespace: `${NAMESPACE}.meta` })
+  return {
+    title: t("title"),
+    description: t("description"),
+    alternates: { canonical: URL },
+    openGraph: { title: t("title"), description: t("description"), type: "article", url: URL },
+  }
+}
+
+export default async function Page({ params }: { params: Promise<{ locale: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+  return <DocPage locale={locale} namespace={NAMESPACE} minutes={3} />
+}
diff --git a/web/app/[locale]/docs/monitor/dashboard/vms-lxcs/page.tsx b/web/app/[locale]/docs/monitor/dashboard/vms-lxcs/page.tsx
index 99ab76ef..a874f33a 100644
--- a/web/app/[locale]/docs/monitor/dashboard/vms-lxcs/page.tsx
+++ b/web/app/[locale]/docs/monitor/dashboard/vms-lxcs/page.tsx
@@ -292,6 +292,16 @@ export default async function VmsLxcsTabPage({
         {t("drillIn.mountsCalloutBody")}
       </Callout>
 
+      <h3 className="text-lg font-semibold mt-8 mb-2 text-gray-900">{t("drillIn.logsTitle")}</h3>
+      <p className="mb-4 text-gray-800 leading-relaxed">
+        {t.rich("drillIn.logsBody", {
+          code,
+          ociLink: (chunks: React.ReactNode) => (
+            <Link href="/docs/oci-manager/monitor" className="text-blue-600 hover:underline">{chunks}</Link>
+          ),
+        })}
+      </p>
+
       <h3 className="text-lg font-semibold mt-8 mb-2 text-gray-900">{t("drillIn.backupsTitle")}</h3>
 
       <figure className="my-4">
diff --git a/web/app/[locale]/docs/monitor/health-monitor/page.tsx b/web/app/[locale]/docs/monitor/health-monitor/page.tsx
index 3afc57ee..a8d61efb 100644
--- a/web/app/[locale]/docs/monitor/health-monitor/page.tsx
+++ b/web/app/[locale]/docs/monitor/health-monitor/page.tsx
@@ -173,7 +173,7 @@ export default async function HealthMonitorPage({
               <tr key={row.category} className={idx < categoryRows.length - 1 ? "border-b border-gray-100" : ""}>
                 <td className="px-3 py-2 align-top whitespace-nowrap"><strong>{row.category}</strong></td>
                 <td className="px-3 py-2 align-top">{t.rich(`categories.rows.${idx}.checks`, { code })}</td>
-                <td className="px-3 py-2 align-top">{t.rich(`categories.rows.${idx}.events`, { code })}</td>
+                <td className="px-3 py-2 align-top">{t.rich(`categories.rows.${idx}.events`, { code, em })}</td>
               </tr>
             ))}
           </tbody>
diff --git a/web/app/[locale]/docs/oci-manager/architecture/page.tsx b/web/app/[locale]/docs/oci-manager/architecture/page.tsx
new file mode 100644
index 00000000..bd79d9f4
--- /dev/null
+++ b/web/app/[locale]/docs/oci-manager/architecture/page.tsx
@@ -0,0 +1,23 @@
+import type { Metadata } from "next"
+import { getTranslations, setRequestLocale } from "next-intl/server"
+import { DocPage } from "@/components/docs/DocBlocks"
+
+const NAMESPACE = "docs.ociManager.architecture"
+const URL = "https://proxmenux.com/docs/oci-manager/architecture"
+
+export async function generateMetadata({ params }: { params: Promise<{ locale: string }> }): Promise<Metadata> {
+  const { locale } = await params
+  const t = await getTranslations({ locale, namespace: `${NAMESPACE}.meta` })
+  return {
+    title: t("title"),
+    description: t("description"),
+    alternates: { canonical: URL },
+    openGraph: { title: t("title"), description: t("description"), type: "article", url: URL },
+  }
+}
+
+export default async function Page({ params }: { params: Promise<{ locale: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+  return <DocPage locale={locale} namespace={NAMESPACE} minutes={6} />
+}
diff --git a/web/app/[locale]/docs/oci-manager/custom-image/page.tsx b/web/app/[locale]/docs/oci-manager/custom-image/page.tsx
new file mode 100644
index 00000000..d54ca0b8
--- /dev/null
+++ b/web/app/[locale]/docs/oci-manager/custom-image/page.tsx
@@ -0,0 +1,23 @@
+import type { Metadata } from "next"
+import { getTranslations, setRequestLocale } from "next-intl/server"
+import { DocPage } from "@/components/docs/DocBlocks"
+
+const NAMESPACE = "docs.ociManager.customImage"
+const URL = "https://proxmenux.com/docs/oci-manager/custom-image"
+
+export async function generateMetadata({ params }: { params: Promise<{ locale: string }> }): Promise<Metadata> {
+  const { locale } = await params
+  const t = await getTranslations({ locale, namespace: `${NAMESPACE}.meta` })
+  return {
+    title: t("title"),
+    description: t("description"),
+    alternates: { canonical: URL },
+    openGraph: { title: t("title"), description: t("description"), type: "article", url: URL },
+  }
+}
+
+export default async function Page({ params }: { params: Promise<{ locale: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+  return <DocPage locale={locale} namespace={NAMESPACE} minutes={6} />
+}
diff --git a/web/app/[locale]/docs/oci-manager/hardware/page.tsx b/web/app/[locale]/docs/oci-manager/hardware/page.tsx
new file mode 100644
index 00000000..bb0bb9c9
--- /dev/null
+++ b/web/app/[locale]/docs/oci-manager/hardware/page.tsx
@@ -0,0 +1,29 @@
+import type { Metadata } from "next"
+import { getTranslations, setRequestLocale } from "next-intl/server"
+import { DocPage } from "@/components/docs/DocBlocks"
+
+const NAMESPACE = "docs.ociManager.hardware"
+const URL = "https://proxmenux.com/docs/oci-manager/hardware"
+
+const LINKS = {
+  nvidiaLink: "/docs/hardware/nvidia-host",
+  auditLink: "/docs/monitor/audit-report/changes",
+  toolkitLink: "https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/install-guide.html",
+}
+
+export async function generateMetadata({ params }: { params: Promise<{ locale: string }> }): Promise<Metadata> {
+  const { locale } = await params
+  const t = await getTranslations({ locale, namespace: `${NAMESPACE}.meta` })
+  return {
+    title: t("title"),
+    description: t("description"),
+    alternates: { canonical: URL },
+    openGraph: { title: t("title"), description: t("description"), type: "article", url: URL },
+  }
+}
+
+export default async function Page({ params }: { params: Promise<{ locale: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+  return <DocPage locale={locale} namespace={NAMESPACE} minutes={9} links={LINKS} />
+}
diff --git a/web/app/[locale]/docs/oci-manager/lifecycle/page.tsx b/web/app/[locale]/docs/oci-manager/lifecycle/page.tsx
new file mode 100644
index 00000000..472fbbae
--- /dev/null
+++ b/web/app/[locale]/docs/oci-manager/lifecycle/page.tsx
@@ -0,0 +1,27 @@
+import type { Metadata } from "next"
+import { getTranslations, setRequestLocale } from "next-intl/server"
+import { DocPage } from "@/components/docs/DocBlocks"
+
+const NAMESPACE = "docs.ociManager.lifecycle"
+const URL = "https://proxmenux.com/docs/oci-manager/lifecycle"
+
+const LINKS = {
+  monitorLink: "/docs/oci-manager/monitor",
+}
+
+export async function generateMetadata({ params }: { params: Promise<{ locale: string }> }): Promise<Metadata> {
+  const { locale } = await params
+  const t = await getTranslations({ locale, namespace: `${NAMESPACE}.meta` })
+  return {
+    title: t("title"),
+    description: t("description"),
+    alternates: { canonical: URL },
+    openGraph: { title: t("title"), description: t("description"), type: "article", url: URL },
+  }
+}
+
+export default async function Page({ params }: { params: Promise<{ locale: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+  return <DocPage locale={locale} namespace={NAMESPACE} minutes={7} links={LINKS} />
+}
diff --git a/web/app/[locale]/docs/oci-manager/monitor/page.tsx b/web/app/[locale]/docs/oci-manager/monitor/page.tsx
new file mode 100644
index 00000000..ec1a2c19
--- /dev/null
+++ b/web/app/[locale]/docs/oci-manager/monitor/page.tsx
@@ -0,0 +1,30 @@
+import type { Metadata } from "next"
+import { getTranslations, setRequestLocale } from "next-intl/server"
+import { DocPage } from "@/components/docs/DocBlocks"
+
+const NAMESPACE = "docs.ociManager.monitor"
+const URL = "https://proxmenux.com/docs/oci-manager/monitor"
+
+const LINKS = {
+  appLink: "/docs/monitor/dashboard/vms-lxcs/app",
+  notificationsLink: "/docs/monitor/notifications",
+  lifecycleLink: "/docs/oci-manager/lifecycle",
+  mountsLink: "/docs/monitor/dashboard/vms-lxcs",
+}
+
+export async function generateMetadata({ params }: { params: Promise<{ locale: string }> }): Promise<Metadata> {
+  const { locale } = await params
+  const t = await getTranslations({ locale, namespace: `${NAMESPACE}.meta` })
+  return {
+    title: t("title"),
+    description: t("description"),
+    alternates: { canonical: URL },
+    openGraph: { title: t("title"), description: t("description"), type: "article", url: URL },
+  }
+}
+
+export default async function Page({ params }: { params: Promise<{ locale: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+  return <DocPage locale={locale} namespace={NAMESPACE} minutes={6} links={LINKS} />
+}
diff --git a/web/app/[locale]/docs/oci-manager/page.tsx b/web/app/[locale]/docs/oci-manager/page.tsx
new file mode 100644
index 00000000..744578b4
--- /dev/null
+++ b/web/app/[locale]/docs/oci-manager/page.tsx
@@ -0,0 +1,23 @@
+import type { Metadata } from "next"
+import { getTranslations, setRequestLocale } from "next-intl/server"
+import { DocPage } from "@/components/docs/DocBlocks"
+
+const NAMESPACE = "docs.ociManager"
+const URL = "https://proxmenux.com/docs/oci-manager"
+
+export async function generateMetadata({ params }: { params: Promise<{ locale: string }> }): Promise<Metadata> {
+  const { locale } = await params
+  const t = await getTranslations({ locale, namespace: `${NAMESPACE}.meta` })
+  return {
+    title: t("title"),
+    description: t("description"),
+    alternates: { canonical: URL },
+    openGraph: { title: t("title"), description: t("description"), type: "article", url: URL },
+  }
+}
+
+export default async function Page({ params }: { params: Promise<{ locale: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+  return <DocPage locale={locale} namespace={NAMESPACE} minutes={4} />
+}
diff --git a/web/app/[locale]/docs/oci-manager/stacks/page.tsx b/web/app/[locale]/docs/oci-manager/stacks/page.tsx
new file mode 100644
index 00000000..98ec09e6
--- /dev/null
+++ b/web/app/[locale]/docs/oci-manager/stacks/page.tsx
@@ -0,0 +1,23 @@
+import type { Metadata } from "next"
+import { getTranslations, setRequestLocale } from "next-intl/server"
+import { DocPage } from "@/components/docs/DocBlocks"
+
+const NAMESPACE = "docs.ociManager.stacks"
+const URL = "https://proxmenux.com/docs/oci-manager/stacks"
+
+export async function generateMetadata({ params }: { params: Promise<{ locale: string }> }): Promise<Metadata> {
+  const { locale } = await params
+  const t = await getTranslations({ locale, namespace: `${NAMESPACE}.meta` })
+  return {
+    title: t("title"),
+    description: t("description"),
+    alternates: { canonical: URL },
+    openGraph: { title: t("title"), description: t("description"), type: "article", url: URL },
+  }
+}
+
+export default async function Page({ params }: { params: Promise<{ locale: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+  return <DocPage locale={locale} namespace={NAMESPACE} minutes={10} />
+}
diff --git a/web/app/[locale]/docs/oci-manager/storage-network/page.tsx b/web/app/[locale]/docs/oci-manager/storage-network/page.tsx
new file mode 100644
index 00000000..f3a3c968
--- /dev/null
+++ b/web/app/[locale]/docs/oci-manager/storage-network/page.tsx
@@ -0,0 +1,23 @@
+import type { Metadata } from "next"
+import { getTranslations, setRequestLocale } from "next-intl/server"
+import { DocPage } from "@/components/docs/DocBlocks"
+
+const NAMESPACE = "docs.ociManager.storageNetwork"
+const URL = "https://proxmenux.com/docs/oci-manager/storage-network"
+
+export async function generateMetadata({ params }: { params: Promise<{ locale: string }> }): Promise<Metadata> {
+  const { locale } = await params
+  const t = await getTranslations({ locale, namespace: `${NAMESPACE}.meta` })
+  return {
+    title: t("title"),
+    description: t("description"),
+    alternates: { canonical: URL },
+    openGraph: { title: t("title"), description: t("description"), type: "article", url: URL },
+  }
+}
+
+export default async function Page({ params }: { params: Promise<{ locale: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+  return <DocPage locale={locale} namespace={NAMESPACE} minutes={8} />
+}
diff --git a/web/app/[locale]/docs/utils/system-update/page.tsx b/web/app/[locale]/docs/utils/system-update/page.tsx
index 4507e5fd..1d821548 100644
--- a/web/app/[locale]/docs/utils/system-update/page.tsx
+++ b/web/app/[locale]/docs/utils/system-update/page.tsx
@@ -175,11 +175,11 @@ export default async function SystemUpdatePage({
 
       <h2 className="text-2xl font-semibold mt-10 mb-4 text-gray-900">{t("noSub.heading")}</h2>
       <p className="mb-6 text-gray-800 leading-relaxed">
-        {t.rich("noSub.intro", { code })}
+        {t.rich("noSub.intro", { code, strong })}
       </p>
       <ol className="list-decimal pl-6 mb-6 text-gray-800 leading-relaxed space-y-1">
         {noSubItems.map((_, idx) => (
-          <li key={idx}>{t.rich(`noSub.items.${idx}`, { code })}</li>
+          <li key={idx}>{t.rich(`noSub.items.${idx}`, { code, strong })}</li>
         ))}
       </ol>
       <p className="mb-6 text-gray-800 leading-relaxed">{t("noSub.outro")}</p>
diff --git a/web/components/DocSidebar.tsx b/web/components/DocSidebar.tsx
index 936cd768..c9219391 100644
--- a/web/components/DocSidebar.tsx
+++ b/web/components/DocSidebar.tsx
@@ -80,6 +80,19 @@ export const sidebarItems: MenuItem[] = [
         ],
       },
       { title: "Health Monitor", i18nKey: "healthMonitor", href: "/docs/monitor/health-monitor" },
+      {
+        title: "Audit & Report",
+        i18nKey: "auditReport",
+        href: "/docs/monitor/audit-report",
+        submenu: [
+          { title: "Overview", i18nKey: "auditReportOverview", href: "/docs/monitor/audit-report" },
+          { title: "Assessment & inventory", i18nKey: "auditReportAssessment", href: "/docs/monitor/audit-report/assessment" },
+          { title: "Changes", i18nKey: "auditReportChanges", href: "/docs/monitor/audit-report/changes" },
+          { title: "Policy", i18nKey: "auditReportPolicy", href: "/docs/monitor/audit-report/policy" },
+          { title: "Reports & comparisons", i18nKey: "auditReportReports", href: "/docs/monitor/audit-report/reports" },
+          { title: "Scope & guarantees", i18nKey: "auditReportScope", href: "/docs/monitor/audit-report/scope" },
+        ],
+      },
       { title: "Notifications", i18nKey: "notifications", href: "/docs/monitor/notifications" },
       { title: "AI Assistant", i18nKey: "aiAssistant", href: "/docs/monitor/ai-assistant" },
       { title: "API Reference", i18nKey: "apiReference", href: "/docs/monitor/api" },
@@ -87,6 +100,22 @@ export const sidebarItems: MenuItem[] = [
     ],
   },
 
+  {
+    title: "OCI manager Apps",
+    i18nKey: "ociManager",
+    href: "/docs/oci-manager",
+    submenu: [
+      { title: "Overview", i18nKey: "ociOverview", href: "/docs/oci-manager" },
+      { title: "How an OCI image is translated", i18nKey: "ociArchitecture", href: "/docs/oci-manager/architecture" },
+      { title: "Image not in the catalog", i18nKey: "ociCustomImage", href: "/docs/oci-manager/custom-image" },
+      { title: "Data, paths and networking", i18nKey: "ociStorageNetwork", href: "/docs/oci-manager/storage-network" },
+      { title: "Devices and acceleration", i18nKey: "ociHardware", href: "/docs/oci-manager/hardware" },
+      { title: "Multi-container applications", i18nKey: "ociStacks", href: "/docs/oci-manager/stacks" },
+      { title: "Install, update and recreate", i18nKey: "ociLifecycle", href: "/docs/oci-manager/lifecycle" },
+      { title: "In ProxMenux Monitor", i18nKey: "ociMonitor", href: "/docs/oci-manager/monitor" },
+    ],
+  },
+
   {
     title: "ProxMenux Scripts",
     i18nKey: "proxmenuxScripts",
diff --git a/web/components/docs/DocBlocks.tsx b/web/components/docs/DocBlocks.tsx
new file mode 100644
index 00000000..047c3e23
--- /dev/null
+++ b/web/components/docs/DocBlocks.tsx
@@ -0,0 +1,334 @@
+import type { ReactNode } from "react"
+import Image from "next/image"
+import { getMessages, getTranslations } from "next-intl/server"
+import {
+  Archive,
+  Boxes,
+  Braces,
+  CheckCircle2,
+  Cpu,
+  Database,
+  Download,
+  ExternalLink,
+  FileText,
+  FolderTree,
+  HardDrive,
+  Layers3,
+  Network,
+  RefreshCw,
+  ShieldCheck,
+  SquareTerminal,
+  Waypoints,
+} from "lucide-react"
+import { Link } from "@/i18n/navigation"
+import { Callout } from "@/components/ui/callout"
+import { DataFlowDiagram } from "@/components/ui/data-flow-diagram"
+import { DocHeader } from "@/components/ui/doc-header"
+import { Mermaid } from "@/components/ui/mermaid"
+import { STACK_DEPENDENCY_HOOK_SOURCE } from "@/components/oci/stackDependencyHookSource"
+
+/*
+ * A documentation page described entirely by its message file.
+ *
+ * The page JSON holds `header` and an ordered list of `sections`, each with
+ * an optional title and intro and a list of blocks. A block is an object
+ * with a single key naming its kind ({"p": "..."}, {"table": {...}}), so no
+ * structural value is ever a translatable string. Values the translation
+ * pipeline must leave alone live under keys it copies verbatim: `code`,
+ * `chartCode`, `icon`, `src`, `href`, `id`.
+ *
+ * Prose goes through t.rich, so it may use <code>, <strong>, <em> and the
+ * link tags the page declares.
+ */
+
+type Rich = (chunks: ReactNode) => ReactNode
+type Json = Record<string, any>
+
+const ICONS: Record<string, ReactNode> = {
+  archive: <Archive className="h-5 w-5" />,
+  boxes: <Boxes className="h-5 w-5" />,
+  braces: <Braces className="h-5 w-5" />,
+  cpu: <Cpu className="h-5 w-5" />,
+  database: <Database className="h-5 w-5" />,
+  fileText: <FileText className="h-5 w-5" />,
+  folderTree: <FolderTree className="h-5 w-5" />,
+  hardDrive: <HardDrive className="h-5 w-5" />,
+  layers: <Layers3 className="h-5 w-5" />,
+  network: <Network className="h-5 w-5" />,
+  refresh: <RefreshCw className="h-5 w-5" />,
+  shield: <ShieldCheck className="h-5 w-5" />,
+  terminal: <SquareTerminal className="h-5 w-5" />,
+  waypoints: <Waypoints className="h-5 w-5" />,
+}
+
+const CALLOUTS = {
+  calloutInfo: "info",
+  calloutTip: "tip",
+  calloutWarning: "warning",
+  calloutDanger: "danger",
+} as const
+
+const SNIPPETS: Record<string, string> = {
+  stackDependencyHook: STACK_DEPENDENCY_HOOK_SOURCE,
+}
+
+function at(root: Json, path: string): any {
+  return path.split(".").reduce((node, key) => (node == null ? undefined : node[key]), root as any)
+}
+
+export async function DocPage({
+  locale,
+  namespace,
+  minutes,
+  links = {},
+}: {
+  locale: string
+  namespace: string
+  minutes: number
+  links?: Record<string, string>
+}) {
+  const t = await getTranslations({ locale, namespace })
+  const messages = (await getMessages({ locale })) as Json
+  const page = at(messages, namespace) as Json
+
+  const tags: Record<string, Rich> = {
+    code: (chunks) => <code>{chunks}</code>,
+    strong: (chunks) => <strong>{chunks}</strong>,
+    em: (chunks) => <em>{chunks}</em>,
+  }
+  for (const [name, href] of Object.entries(links)) {
+    tags[name] = href.startsWith("http")
+      ? (chunks) => (
+          <a href={href} target="_blank" rel="noopener noreferrer" className="inline-flex items-center gap-1 text-blue-600 hover:underline">
+            {chunks}
+            <ExternalLink className="h-3.5 w-3.5" />
+          </a>
+        )
+      : (chunks) => <Link href={href} className="text-blue-600 hover:underline">{chunks}</Link>
+  }
+  const rich = (key: string) => t.rich(key, tags)
+
+  const block = (key: string, value: Json, index: number): ReactNode => {
+    const [kind] = Object.keys(value)
+    const base = `${key}.${kind}`
+    const data = value[kind]
+    switch (kind) {
+      case "p":
+        return <p key={index} className="mb-4 text-gray-800 leading-relaxed">{rich(base)}</p>
+
+      case "calloutInfo":
+      case "calloutTip":
+      case "calloutWarning":
+      case "calloutDanger":
+        return (
+          <Callout key={index} variant={CALLOUTS[kind]} title={t(`${base}.title`)}>
+            {rich(`${base}.body`)}
+          </Callout>
+        )
+
+      case "list":
+        return (
+          <ul key={index} className="mb-6 space-y-2 text-gray-800">
+            {data.items.map((_: string, i: number) => (
+              <li key={i} className="flex gap-3 leading-relaxed">
+                <CheckCircle2 className="mt-1 h-4 w-4 shrink-0 text-blue-600" />
+                <span>{rich(`${base}.items.${i}`)}</span>
+              </li>
+            ))}
+          </ul>
+        )
+
+      case "steps":
+        return (
+          <ol key={index} className="mb-6 space-y-3">
+            {data.items.map((_: Json, i: number) => (
+              <li key={i} className="grid grid-cols-[2.25rem_1fr] gap-4 rounded-lg border border-gray-200 bg-gray-50 p-4">
+                <span className="flex h-9 w-9 items-center justify-center rounded-full bg-blue-700 text-sm font-bold text-white">{i + 1}</span>
+                <div>
+                  <h3 className="font-semibold text-gray-900">{t(`${base}.items.${i}.title`)}</h3>
+                  <p className="mt-1 text-sm leading-6 text-gray-700">{rich(`${base}.items.${i}.body`)}</p>
+                </div>
+              </li>
+            ))}
+          </ol>
+        )
+
+      case "cards":
+        return (
+          <div key={index} className="mb-6 grid gap-4 md:grid-cols-2">
+            {data.items.map((item: Json, i: number) => (
+              <article key={i} className="rounded-lg border border-gray-200 bg-white p-5">
+                {item.icon && ICONS[item.icon] && (
+                  <div className="mb-3 inline-flex rounded-lg border border-blue-100 bg-blue-50 p-2 text-blue-700">{ICONS[item.icon]}</div>
+                )}
+                <h3 className="font-semibold text-gray-900">{t(`${base}.items.${i}.title`)}</h3>
+                <p className="mt-2 text-sm leading-6 text-gray-700">{rich(`${base}.items.${i}.body`)}</p>
+              </article>
+            ))}
+          </div>
+        )
+
+      case "table":
+        return (
+          <div key={index} className="mb-6 overflow-x-auto">
+            <table className="w-full text-sm border border-gray-200 rounded-md">
+              <thead className="bg-gray-50 text-gray-900">
+                <tr>
+                  {data.headers.map((_: string, i: number) => (
+                    <th key={i} className="text-left px-3 py-2 border-b border-gray-200 font-semibold">{t(`${base}.headers.${i}`)}</th>
+                  ))}
+                </tr>
+              </thead>
+              <tbody className="text-gray-800">
+                {data.rows.map((row: string[], r: number) => (
+                  <tr key={r} className={r < data.rows.length - 1 ? "border-b border-gray-100" : ""}>
+                    {row.map((_: string, c: number) => (
+                      <td key={c} className={`px-3 py-2 align-top leading-6 ${c === 0 ? "font-medium text-gray-900" : ""}`}>
+                        {rich(`${base}.rows.${r}.${c}`)}
+                      </td>
+                    ))}
+                  </tr>
+                ))}
+              </tbody>
+            </table>
+          </div>
+        )
+
+      case "flow":
+        return (
+          <DataFlowDiagram
+            key={index}
+            className="mb-6"
+            nodes={data.nodes.map((_: Json, i: number) => ({
+              label: t(`${base}.nodes.${i}.label`),
+              detail: data.nodes[i].detail ? t(`${base}.nodes.${i}.detail`) : undefined,
+              variant: i === 0 ? "source" : i === data.nodes.length - 1 ? "target" : "bridge",
+            }))}
+            caption={data.caption ? t(`${base}.caption`) : undefined}
+          />
+        )
+
+      case "code":
+        return (
+          <div key={index} className="mb-6 overflow-hidden rounded-lg border border-gray-200">
+            {data.title && <div className="border-b border-gray-200 bg-gray-50 px-4 py-2 text-sm font-semibold text-gray-900">{t(`${base}.title`)}</div>}
+            <pre className="overflow-x-auto bg-white p-4 text-xs leading-6 text-gray-800">{data.code}</pre>
+          </div>
+        )
+
+      case "codeGrid":
+        return (
+          <div key={index} className="mb-6 grid gap-4 lg:grid-cols-2">
+            {data.items.map((item: Json, i: number) => (
+              <div key={i} className="overflow-hidden rounded-lg border border-gray-200">
+                <div className="border-b border-gray-200 bg-gray-50 px-4 py-2 text-sm font-semibold text-gray-900">{t(`${base}.items.${i}.title`)}</div>
+                <pre className="overflow-x-auto bg-white p-4 text-xs leading-6 text-gray-800">{item.code}</pre>
+              </div>
+            ))}
+          </div>
+        )
+
+      case "shell":
+        return (
+          <pre key={index} className="mb-6 overflow-x-auto rounded-lg bg-gray-950 p-4 text-xs leading-6 text-gray-100">{data.code}</pre>
+        )
+
+      case "mermaid": {
+        let chart: string = data.chartCode
+        for (const name of Object.keys(data.labels ?? {})) {
+          chart = chart.split(`{{${name}}}`).join(t(`${base}.labels.${name}`).replace(/"/g, "'"))
+        }
+        return <div key={index} className="mb-6"><Mermaid chart={chart} /></div>
+      }
+
+      case "figure":
+        return (
+          <figure key={index} className="my-6">
+            <Image
+              src={data.src}
+              alt={t(`${base}.alt`)}
+              width={data.width ?? 1600}
+              height={data.height ?? 1000}
+              className="rounded-lg border border-gray-200 shadow-sm w-full h-auto"
+            />
+            {data.caption && (
+              <figcaption className="text-sm text-gray-500 mt-2 text-center italic">{rich(`${base}.caption`)}</figcaption>
+            )}
+          </figure>
+        )
+
+      case "snippet":
+        return (
+          <details key={index} className="group mb-6 overflow-hidden rounded-lg border border-blue-200 bg-white">
+            <summary className="flex cursor-pointer list-none items-center justify-between gap-4 bg-blue-50 px-5 py-3 font-semibold text-gray-900 marker:content-none">
+              <span>{t(`${base}.summary`)}</span>
+              <code className="text-xs font-normal text-gray-600">{data.pathCode}</code>
+            </summary>
+            <pre className="max-h-[42rem] overflow-auto border-t border-blue-200 bg-gray-950 p-5 text-xs leading-6 text-gray-100">
+              <code>{SNIPPETS[data.snippetCode] ?? ""}</code>
+            </pre>
+          </details>
+        )
+
+      case "downloads":
+        return (
+          <div key={index} className="mb-6 space-y-4">
+            {data.items.map((item: Json, i: number) => (
+              <article key={i} className="overflow-hidden rounded-lg border border-gray-200 bg-white">
+                <div className="flex items-start gap-4 border-b border-gray-200 bg-gray-50 px-4 py-3">
+                  <div className="min-w-0 flex-1">
+                    <h3 className="font-semibold text-gray-900">{t(`${base}.items.${i}.title`)}</h3>
+                    <p className="mt-1 text-sm leading-6 text-gray-700">{rich(`${base}.items.${i}.body`)}</p>
+                  </div>
+                  <a href={item.href} target="_blank" rel="noopener noreferrer" className="inline-flex shrink-0 items-center gap-2 rounded-md border border-blue-200 bg-blue-50 px-3 py-2 text-sm font-medium text-blue-800 hover:bg-blue-100">
+                    <Download className="h-4 w-4" />PDF
+                  </a>
+                </div>
+                <dl className="grid text-sm md:grid-cols-[11rem_1fr]">
+                  {(item.facts ?? []).map((_: Json, f: number) => (
+                    <div key={f} className="contents">
+                      <dt className="border-t border-gray-200 bg-white px-4 py-2 font-semibold text-gray-900">{t(`${base}.items.${i}.facts.${f}.label`)}</dt>
+                      <dd className="border-t border-gray-200 bg-white px-4 py-2 leading-6 text-gray-700">{rich(`${base}.items.${i}.facts.${f}.value`)}</dd>
+                    </div>
+                  ))}
+                </dl>
+              </article>
+            ))}
+          </div>
+        )
+
+      case "next":
+        return (
+          <ul key={index} className="mb-6 list-disc pl-6 space-y-1 text-gray-800">
+            {data.items.map((item: Json, i: number) => (
+              <li key={i}>
+                <Link href={item.href} className="text-blue-600 hover:underline">{t(`${base}.items.${i}.label`)}</Link>
+                {item.tail ? <> — {t(`${base}.items.${i}.tail`)}</> : null}
+              </li>
+            ))}
+          </ul>
+        )
+
+      default:
+        return null
+    }
+  }
+
+  return (
+    <div className="pb-16">
+      <DocHeader
+        title={t("header.title")}
+        description={t("header.description")}
+        section={t("header.section")}
+        estimatedMinutes={minutes}
+      />
+      {(page.sections as Json[]).map((section, s) => (
+        <section key={s} id={section.id} className="scroll-mt-24">
+          {section.title && <h2 className="text-2xl font-semibold mt-10 mb-4 text-gray-900">{t(`sections.${s}.title`)}</h2>}
+          {section.intro && <p className="mb-4 text-gray-800 leading-relaxed">{rich(`sections.${s}.intro`)}</p>}
+          {(section.blocks as Json[]).map((value, b) => block(`sections.${s}.blocks.${b}`, value, b))}
+        </section>
+      ))}
+    </div>
+  )
+}
diff --git a/web/components/oci/stackDependencyHookSource.ts b/web/components/oci/stackDependencyHookSource.ts
new file mode 100644
index 00000000..fd5b2b46
--- /dev/null
+++ b/web/components/oci/stackDependencyHookSource.ts
@@ -0,0 +1,4 @@
+// Generated documentation snapshot of oci/remote/stack_dependency_hook.sh.
+// Keep this file synchronized when the installed hook changes.
+export const STACK_DEPENDENCY_HOOK_SOURCE = "#!/usr/bin/env bash\nset -Eeuo pipefail\n\nPATH=/usr/sbin:/usr/bin:/sbin:/bin\n\ndie() {\n  printf 'ERROR: %s\\n' \"$*\" >&2\n  exit 1\n}\n\nfind_snippet_storage() {\n  local storage\n  if pvesm status --content snippets 2>/dev/null \\\n    | awk 'NR > 1 && $1 == \"local\" && $3 == \"active\" {found=1} END {exit !found}'; then\n    printf 'local'\n    return\n  fi\n  storage=$(pvesm status --content snippets 2>/dev/null \\\n    | awk 'NR > 1 && $3 == \"active\" {print $1; exit}')\n  [[ -n $storage ]] || die \"No active storage supports snippets\"\n  printf '%s' \"$storage\"\n}\n\ninstall_hook() {\n  local main_id=${1:?missing main VMID} source_config=${2:?missing lifecycle JSON}\n  local storage hook_volume hook_path target_config\n  [[ $main_id =~ ^[0-9]+$ ]] || die \"Invalid main VMID\"\n  jq -e '\n    .schema == 1 and\n    (.dependencies | type == \"array\") and\n    (.dependencies | length > 0) and\n    (all(.dependencies[];\n      (.vmid | type == \"number\") and\n      (.label | type == \"string\") and\n      (.healthcheck.type | IN(\"exec\", \"http\", \"running\")) and\n      (.healthcheck.timeout_seconds | type == \"number\")\n    ))\n  ' \"$source_config\" >/dev/null || die \"Invalid dependency contract\"\n\n  storage=$(find_snippet_storage)\n  hook_volume=\"${storage}:snippets/proxmenux-stack-dependencies.sh\"\n  hook_path=$(pvesm path \"$hook_volume\")\n  install -D -m 0755 \"$0\" \"$hook_path\"\n\n  target_config=\"/etc/pve/priv/proxmenux-stack-${main_id}.json\"\n  umask 077\n  cat \"$source_config\" >\"$target_config\"\n  pct set \"$main_id\" --hookscript \"$hook_volume\" >/dev/null\n  printf 'Proxmox hookscript installed: CT %s starts its dependencies through %s\\n' \\\n    \"$main_id\" \"$hook_volume\"\n}\n\ndependency_is_healthy() {\n  local id=$1 healthcheck=$2 type url\n  type=$(jq -r '.type' <<<\"$healthcheck\")\n  case \"$type\" in\n    running)\n      [[ $(pct status \"$id\" 2>/dev/null || true) == \"status: running\" ]]\n      ;;\n    exec)\n      local -a command=()\n      mapfile -t command < <(jq -r '.argv[]' <<<\"$healthcheck\")\n      ((${#command[@]} > 0)) || return 1\n      pct exec \"$id\" -- \"${command[@]}\" >/dev/null 2>&1\n      ;;\n    http)\n      url=$(jq -r '.url' <<<\"$healthcheck\")\n      curl -fsS --max-time 3 \"$url\" >/dev/null 2>&1\n      ;;\n    *) return 1 ;;\n  esac\n}\n\nstart_dependencies() {\n  local main_id=$1 config=\"/etc/pve/priv/proxmenux-stack-${1}.json\"\n  local encoded dependency id label healthcheck timeout elapsed\n  [[ -r $config ]] || die \"Missing dependency contract for main CT $main_id\"\n\n  exec 9>\"/run/lock/proxmenux-stack-${main_id}.lock\"\n  flock 9\n  while IFS= read -r encoded; do\n    [[ -n $encoded ]] || continue\n    dependency=$(base64 -d <<<\"$encoded\")\n    id=$(jq -r '.vmid' <<<\"$dependency\")\n    label=$(jq -r '.label' <<<\"$dependency\")\n    healthcheck=$(jq -c '.healthcheck' <<<\"$dependency\")\n    timeout=$(jq -r '.healthcheck.timeout_seconds' <<<\"$dependency\")\n    [[ $id =~ ^[0-9]+$ && $timeout =~ ^[0-9]+$ && $timeout -gt 0 ]] \\\n      || die \"Invalid dependency in $config\"\n    pct config \"$id\" >/dev/null 2>&1 \\\n      || die \"Dependency $label (CT $id) does not exist\"\n\n    if [[ $(pct status \"$id\" 2>/dev/null || true) != \"status: running\" ]]; then\n      printf 'Starting dependency %s (CT %s)...\\n' \"$label\" \"$id\"\n      pct start \"$id\" || die \"Could not start $label (CT $id)\"\n    else\n      printf 'Dependency %s (CT %s) was already running.\\n' \"$label\" \"$id\"\n    fi\n\n    elapsed=0\n    while (( elapsed < timeout )); do\n      if dependency_is_healthy \"$id\" \"$healthcheck\"; then\n        printf 'Dependency %s (CT %s): ready.\\n' \"$label\" \"$id\"\n        break\n      fi\n      [[ $(pct status \"$id\" 2>/dev/null || true) == \"status: running\" ]] \\\n        || die \"$label (CT $id) stopped while starting\"\n      sleep 2\n      elapsed=$((elapsed + 2))\n    done\n    (( elapsed < timeout )) \\\n      || die \"$label (CT $id) did not pass its health check within ${timeout}s\"\n  done < <(jq -r '.dependencies[] | @base64' \"$config\")\n}\n\nif [[ ${1:-} == \"--install\" ]]; then\n  shift\n  install_hook \"$@\"\n  exit 0\nfi\n\nvmid=${1:?missing VMID}\nphase=${2:?missing lifecycle phase}\ncase \"$phase\" in\n  pre-start) start_dependencies \"$vmid\" ;;\n  post-start|pre-stop|post-stop) ;;\n  *) die \"Unknown lifecycle phase: $phase\" ;;\nesac\n"
+
diff --git a/web/messages/en/common.json b/web/messages/en/common.json
index 23e18b3b..b5b963bd 100644
--- a/web/messages/en/common.json
+++ b/web/messages/en/common.json
@@ -71,10 +71,26 @@
       "dashboardSecurity": "Security tab",
       "dashboardSettings": "Settings tab",
       "healthMonitor": "Health Monitor",
+      "auditReport": "Audit & Report",
+      "auditReportOverview": "Overview",
+      "auditReportAssessment": "Assessment & inventory",
+      "auditReportPolicy": "Policy",
+      "auditReportChanges": "Changes",
+      "auditReportReports": "Reports & comparisons",
+      "auditReportScope": "Scope & guarantees",
       "notifications": "Notifications",
       "aiAssistant": "AI Assistant",
       "apiReference": "API Reference",
       "integrations": "Integrations",
+      "ociManager": "OCI manager Apps",
+      "ociOverview": "Overview",
+      "ociArchitecture": "How an OCI image is translated",
+      "ociCustomImage": "Image not in the catalog",
+      "ociStorageNetwork": "Data, paths and networking",
+      "ociHardware": "Devices and acceleration",
+      "ociStacks": "Multi-container applications",
+      "ociLifecycle": "Install, update and recreate",
+      "ociMonitor": "In ProxMenux Monitor",
       "proxmenuxScripts": "ProxMenux Scripts",
       "postInstallScript": "Post-Install Script",
       "postInstallOverview": "Overview",
diff --git a/web/messages/en/docs/monitor/api-reference.json b/web/messages/en/docs/monitor/api-reference.json
index 416db038..5663b739 100644
--- a/web/messages/en/docs/monitor/api-reference.json
+++ b/web/messages/en/docs/monitor/api-reference.json
@@ -157,12 +157,12 @@
       {
         "endpoint": "/api/vms/<vmid>/control",
         "method": "POST",
-        "use": "Start / stop / shutdown / reboot a VM or LXC container (the same operations the Monitor's VM & LXC modal exposes). Body: {\"action\": \"start|stop|shutdown|reboot\"}. Synchronous — returns the outcome directly with no polling needed."
+        "use": "Start / stop / shutdown / reboot a VM or LXC container (the same operations the Monitor's VM & LXC modal exposes). The body carries <code>action</code>: <code>start</code>, <code>stop</code>, <code>shutdown</code> or <code>reboot</code>. Synchronous — returns the outcome directly with no polling needed."
       },
       {
         "endpoint": "/api/vms/<vmid>/backup",
         "method": "POST",
-        "use": "Create a vzdump backup of a VM or LXC. Body (all optional except when the defaults don't match your storage layout): {\"storage\": \"<pve-storage>\", \"mode\": \"snapshot|suspend|stop\", \"compress\": \"zstd|lzo|gz|none\", \"protected\": true, \"notes\": \"…\", \"notification\": \"auto|always|failure|never\", \"pbs_change_detection\": \"default|legacy|data\"}. Returns the PVE task UPID."
+        "use": "Create a vzdump backup of a VM or LXC. Body fields, all optional unless the defaults do not match the storage layout: <code>storage</code> (a PVE storage), <code>mode</code> (<code>snapshot</code>, <code>suspend</code> or <code>stop</code>), <code>compress</code> (<code>zstd</code>, <code>lzo</code>, <code>gz</code> or <code>none</code>), <code>protected</code> (<code>true</code> or <code>false</code>), <code>notes</code>, <code>notification</code> (<code>auto</code>, <code>always</code>, <code>failure</code> or <code>never</code>) and <code>pbs_change_detection</code> (<code>default</code>, <code>legacy</code> or <code>data</code>). Returns the PVE task UPID."
       },
       {
         "endpoint": "/api/vms/<vmid>/backups",
diff --git a/web/messages/en/docs/monitor/audit-report/assessment.json b/web/messages/en/docs/monitor/audit-report/assessment.json
new file mode 100644
index 00000000..adc3a201
--- /dev/null
+++ b/web/messages/en/docs/monitor/audit-report/assessment.json
@@ -0,0 +1,146 @@
+{
+  "meta": {
+    "title": "Assessment and inventory | Audit & Report",
+    "description": "The Audit & Report assessment: report profiles, how results are classified, accepted risks, unreadable sources, Lynis and the inventory of the node."
+  },
+  "header": {
+    "title": "Assessment and inventory",
+    "description": "The assessment inspects the node, keeps its findings and answers different questions depending on the report profile.",
+    "section": "Audit & Report"
+  },
+  "sections": [
+    {
+      "id": "read-only",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "An assessment inspects; it does not change the configuration",
+            "body": "It reads the configuration and state of the host. It writes its results, reports and logs, and the boot checks can mount EFI system partitions for a moment. The configuration it assesses is not modified."
+          }
+        },
+        {
+          "p": "<strong>Run assessment</strong> starts a run with the profile selected in <strong>Report</strong>. The view shows the date of the last run and how long ago it was."
+        }
+      ]
+    },
+    {
+      "id": "profiles",
+      "title": "Report profiles",
+      "intro": "Each profile answers a different question. The checks and sections are selected before the document is composed.",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Profile", "What it covers"],
+            "rows": [
+              ["Full audit", "Every check and all the structure available."],
+              ["Quick diagnosis", "Every check; the result opens with the critical findings, the warnings and the readings that could not be verified."],
+              ["Inventory", "A description of the node, with no checks and no classification."],
+              ["Security review", "Exposure, access, privileges, certificates, updates, repositories and Lynis."],
+              ["Backup assurance", "Coverage, age, results, verification, retention and recovery of the backups."],
+              ["Capacity and wear", "Growth margin, memory, space usage and the service life of the disks."]
+            ]
+          }
+        },
+        {
+          "p": "The contents of each document are described in <reportsLink>Reports and comparisons</reportsLink>."
+        }
+      ]
+    },
+    {
+      "id": "results",
+      "title": "How results are classified",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Classification", "Meaning"],
+            "rows": [
+              ["Critical", "A failed condition that has priority."],
+              ["Warning", "A condition that needs a review, given the evidence or the policy."],
+              ["Observation", "Information about the node that is not reported as a failure."],
+              ["Unverified", "The source the check needs could not be read. It does not mean the problem is absent."],
+              ["Conformant", "The condition meets the criterion applied."],
+              ["Not applicable", "Nothing within the scope of the check applies."],
+              ["Accepted risk", "The finding exists and a decision about it has been recorded."],
+              ["Excluded by policy", "The policy declares that the element is left out of the count."]
+            ]
+          }
+        },
+        {
+          "p": "Findings can be filtered by area: System, Storage, Network, Security, Backup, Guests and Hardware. Each finding keeps its evidence, with the source it was read from."
+        }
+      ]
+    },
+    {
+      "id": "unverified",
+      "title": "When a source cannot be read",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Case", "Behaviour"],
+            "rows": [
+              ["Unverified", "The check keeps its identity, states in its evidence which source failed and does not turn missing data into a conformant result."],
+              ["Incomplete evidence", "The report names the source and the time of collection, so a real problem can be told apart from an insufficient reading."],
+              ["A new run", "Once the access, package or service is corrected, the same profile runs again and the comparison shows whether the result could be verified."]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "lynis",
+      "title": "Lynis",
+      "blocks": [
+        {
+          "p": "The security review uses the Lynis report of the host. When Lynis has not been run yet, or its report is older than the threshold of the policy, a dialog offers <strong>Run with Lynis</strong>, which takes a few minutes longer, or <strong>Run without Lynis</strong>, which uses the existing report."
+        },
+        {
+          "figure": {
+            "src": "/monitor/audit/lynis-dialog.png",
+            "alt": "Dialog that offers to run the assessment with or without Lynis",
+            "caption": "The Lynis dialog before a security review."
+          }
+        }
+      ]
+    },
+    {
+      "id": "accept",
+      "title": "Accepting a risk",
+      "blocks": [
+        {
+          "p": "<strong>Accept risk</strong> records a decision on a finding. The reason is required and is stored with the author and the date."
+        },
+        {
+          "table": {
+            "headers": ["Field", "Options"],
+            "rows": [
+              ["Reason", "Free text, required."],
+              ["Stops applying after", "90 days, 180 days, 1 year or does not expire. When the period ends the finding becomes active again."],
+              ["Remind me to review", "A reminder that brings the decision back to attention while it stays in force."]
+            ]
+          }
+        },
+        {
+          "p": "An accepted finding stays visible with its decision, and <strong>Return to active</strong> revokes it. An accepted risk is not a correction: the comparison reports it as accepted, not as resolved."
+        }
+      ]
+    },
+    {
+      "id": "inventory",
+      "title": "Inventory",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Identity, Proxmox VE version, kernel, subscription and cluster.",
+              "CPU, memory, board, BIOS, controllers and IOMMU.",
+              "Disks, SMART, power-on hours and recorded events.",
+              "Adapters, bonds, bridges, latency and connections.",
+              "Storage, guests with their disks and interfaces, and backups.",
+              "PCI passthrough and the software ProxMenux manages."
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/en/docs/monitor/audit-report/changes.json b/web/messages/en/docs/monitor/audit-report/changes.json
new file mode 100644
index 00000000..28969330
--- /dev/null
+++ b/web/messages/en/docs/monitor/audit-report/changes.json
@@ -0,0 +1,148 @@
+{
+  "meta": {
+    "title": "Changes | Audit & Report",
+    "description": "The change journal of Audit & Report: what ProxMenux changed on the host, what was there before, the difference and whether it can be undone."
+  },
+  "header": {
+    "title": "Changes",
+    "description": "The journal of the operations ProxMenux performs on the host and, where it was captured, the state before and after each one.",
+    "section": "Audit & Report"
+  },
+  "sections": [
+    {
+      "id": "purpose",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "From the script that ran to the change it made",
+            "body": "A long function may change only two lines. The journal keeps each concrete operation with the script, function and version responsible, the resource affected, the difference and whether it can be undone."
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              { "label": "Script", "detail": "function + version" },
+              { "label": "Capture", "detail": "content before" },
+              { "label": "Operation", "detail": "file · package · service" },
+              { "label": "Journal", "detail": "attribution + difference" }
+            ],
+            "caption": "The capture is taken when the operation runs and is consolidated when the Monitor reads the journal."
+          }
+        },
+        {
+          "figure": {
+            "src": "/monitor/audit/changes-view.png",
+            "alt": "Changes view of Audit & Report with the entries grouped by post-install option and script",
+            "caption": "The Changes view, with the difference of a file edited by ProxMenux."
+          }
+        }
+      ]
+    },
+    {
+      "id": "types",
+      "title": "Kinds of entry",
+      "intro": "The filter at the top separates the entries by kind.",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Kind", "What it records"],
+            "rows": [
+              ["Configuration", "ProxMenux wrote, edited or removed a file, changed a setting or altered a service."],
+              ["Installations", "ProxMenux added a package or component, and the packages that actually appeared are recorded."],
+              ["Executions", "ProxMenux ran a command; what it changed is up to the command itself."],
+              ["Applied", "A function was applied before the journal existed; the state before it was not captured."]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "groups",
+      "title": "How the view is organised",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Section", "Contents"],
+            "rows": [
+              ["Post-install optimizations", "Grouped by the post-install option the user selected."],
+              ["ProxMenux scripts", "GPU, Coral, network, storage, security, utilities and the other instrumented scripts, including the ProxMenux installer and ProxMenux Monitor."],
+              ["Installed packages and utilities", "Software ProxMenux installed on the host."]
+            ]
+          }
+        },
+        {
+          "p": "Within each section, <strong>By function</strong> groups the entries under the function that made them."
+        }
+      ]
+    },
+    {
+      "id": "entry",
+      "title": "What each entry shows",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "The script, function and version responsible.",
+              "The date and the affected resource.",
+              "The known state before and after the change.",
+              "The lines added and removed.",
+              "The packages that were actually added.",
+              "The state transition of a service.",
+              "<strong>Undoing this</strong>: <em>Restores exactly what was there</em>, <em>Deletes the file (there was none before)</em>, <em>The package can be uninstalled</em>, a partial undo, or <em>Cannot be undone from the journal</em>."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "before",
+      "title": "What the state before means",
+      "blocks": [
+        {
+          "p": "The state before can be captured content, a file created for the first time or an unknown state. Changes made before the journal existed cannot be reconstructed; running the function again captures first the state found at that moment."
+        }
+      ]
+    },
+    {
+      "id": "limits",
+      "title": "Scope of the journal",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Manual changes and changes made by other software are not recorded.",
+              "Only operations that go through the ProxMenux audit primitives are covered.",
+              "Recording never blocks the operation it describes: if the entry cannot be written, the operation goes on.",
+              "Successive changes to one resource are shown as the known origin against the current state."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "retention",
+      "title": "Stored evidence",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Element", "Behaviour"],
+            "rows": [
+              ["Entries", "They are kept on the host; nothing is removed from the journal automatically."],
+              ["Captured content", "A captured object is kept while an entry refers to it."],
+              ["Size of a capture", "Content above 1 MiB is not stored whole; the entry records that the capture was skipped because of its size."],
+              ["Reading", "The Monitor does not load stored objects above 2 MiB."],
+              ["Difference", "At most 400 lines are shown, and a longer difference is marked as truncated."],
+              ["Listing", "The API returns 200 entries per request by default and up to 1000."]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Kept content is not an automatic undo",
+            "body": "The content before a change can be inspected and restored by hand, but the Changes view does not revert operations. An execution entry records the command without knowing every effect of the tool it ran."
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/en/docs/monitor/audit-report/index.json b/web/messages/en/docs/monitor/audit-report/index.json
new file mode 100644
index 00000000..2fa3acb4
--- /dev/null
+++ b/web/messages/en/docs/monitor/audit-report/index.json
@@ -0,0 +1,83 @@
+{
+  "meta": {
+    "title": "Audit & Report | ProxMenux Monitor",
+    "description": "Assess a Proxmox VE node, record what ProxMenux changed on it and declare what is expected from its guests and storage, with printable reports."
+  },
+  "header": {
+    "title": "Audit & Report",
+    "description": "An assessment of the node, the journal of what ProxMenux changed on it and the declaration of what is expected from it, with documents that can be printed or saved as PDF.",
+    "section": "ProxMenux Monitor"
+  },
+  "sections": [
+    {
+      "id": "views",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Three views, three questions",
+            "body": "Audit & Report keeps apart the facts of the node, the interventions of ProxMenux and the expectations declared for it. A configuration the assessment cannot place against a declared purpose is described, not reported as a failure."
+          }
+        },
+        {
+          "cards": {
+            "items": [
+              { "icon": "shield", "title": "Assessment — how is the node?", "body": "Runs the checks of the chosen profile, composes the inventory and classifies what needs attention, with the evidence of each result." },
+              { "icon": "refresh", "title": "Changes — what did ProxMenux do?", "body": "Lists the files, packages, services and commands the instrumented ProxMenux scripts changed, with what was there before when it was captured." },
+              { "icon": "fileText", "title": "Policy — what is expected?", "body": "Declares which guests need a backup or must start with the host, which storage is essential and the thresholds of the checks." }
+            ]
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              { "label": "Assessment", "detail": "facts" },
+              { "label": "Policy", "detail": "context" },
+              { "label": "Changes", "detail": "interventions" }
+            ],
+            "caption": "The assessment provides the facts, the policy gives them context and the journal records what ProxMenux did."
+          }
+        },
+        {
+          "figure": {
+            "src": "/monitor/audit/assessment-view.png",
+            "alt": "Audit & Report in ProxMenux Monitor with the Assessment, Changes and Policy views",
+            "caption": "Audit & Report, with the Assessment view open."
+          }
+        }
+      ]
+    },
+    {
+      "id": "boundaries",
+      "title": "Three different functions",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Function", "What it does"],
+            "rows": [
+              ["<healthLink>Health Monitor</healthLink>", "Observes metrics and events continuously and can raise notifications."],
+              ["Audit & Report", "Runs an assessment when it is asked for, documents the node and compares runs with each other."],
+              ["Change journal", "Records the operations ProxMenux performs through its audit primitives."]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "pages",
+      "title": "Pages of this section",
+      "blocks": [
+        {
+          "next": {
+            "items": [
+              { "label": "Assessment and inventory", "href": "/docs/monitor/audit-report/assessment", "tail": "profiles, results, accepted risks and inventory." },
+              { "label": "Changes", "href": "/docs/monitor/audit-report/changes", "tail": "the journal of what ProxMenux changed on the host." },
+              { "label": "Policy", "href": "/docs/monitor/audit-report/policy", "tail": "guests, storage and thresholds." },
+              { "label": "Reports and comparisons", "href": "/docs/monitor/audit-report/reports", "tail": "the six documents and the reference run." },
+              { "label": "Scope and guarantees", "href": "/docs/monitor/audit-report/scope", "tail": "sources, limits and stored data." }
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/en/docs/monitor/audit-report/policy.json b/web/messages/en/docs/monitor/audit-report/policy.json
new file mode 100644
index 00000000..f7fc25b9
--- /dev/null
+++ b/web/messages/en/docs/monitor/audit-report/policy.json
@@ -0,0 +1,111 @@
+{
+  "meta": {
+    "title": "Policy | Audit & Report",
+    "description": "The node policy of Audit & Report: backup, autostart and recovery objective of each guest, the role of each storage and the thresholds of the checks."
+  },
+  "header": {
+    "title": "Policy",
+    "description": "The policy declares what no inspection can deduce: what each guest and storage is for and the thresholds the checks apply.",
+    "section": "Audit & Report"
+  },
+  "sections": [
+    {
+      "id": "principle",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "With no declaration, the report describes; with one, it assesses",
+            "body": "An assessment sees what the host does, not what it is for. A guest without a backup whose purpose is not declared is reported as an observation. If its backup is declared required, the same absence is reported as a warning. Nothing has to be declared."
+          }
+        },
+        {
+          "figure": {
+            "src": "/monitor/audit/policy-view.png",
+            "alt": "Policy view with the guests, the storage and the thresholds of the node",
+            "caption": "The Policy view."
+          }
+        }
+      ]
+    },
+    {
+      "id": "guests",
+      "title": "Guests",
+      "intro": "Each VM and LXC of the node has three fields. A value left as default takes the general value, shown next to it.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Field",
+              "Values",
+              "Effect on the assessment"
+            ],
+            "rows": [
+              [
+                "Backup",
+                "Required, Not required, Not stated",
+                "A missing backup is a warning when it is required, an observation when it is not stated, and it is left out of the count when it is not required."
+              ],
+              [
+                "Autostart",
+                "Required, Not required, Not stated",
+                "Whether the guest has to start with the host."
+              ],
+              [
+                "Recovery objective",
+                "Hours",
+                "The maximum acceptable age of the last backup."
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "storage",
+      "title": "Storage",
+      "blocks": [
+        {
+          "p": "An unreachable storage is reported as critical when it is declared essential or serves a running guest, as a warning when its role is not stated, and as an observation when it is declared optional."
+        }
+      ],
+      "intro": "Each storage of the node is declared Essential, Optional or Not stated."
+    },
+    {
+      "id": "thresholds",
+      "title": "Thresholds",
+      "intro": "An empty threshold uses the shipped value, shown as its placeholder.",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Storage capacity review (%) and thin pool fill review (%).",
+              "Thin overprovisioning ratio and memory overcommit ratio.",
+              "ZFS scrub interval (days).",
+              "Backup age fallback (days) and schedule grace (ratio).",
+              "Certificate expiry notice (days).",
+              "Disk service life (hours) and recent disk error window (days).",
+              "Lynis report age (days) and package index age (days).",
+              "Journal against its cap (%).",
+              "Filesystem space review (%) and filesystem inode review (%)."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "save",
+      "title": "How the policy is saved",
+      "blocks": [
+        {
+          "p": "The declaration is validated and saved atomically in <code>/usr/local/share/proxmenux/audit_policy.json</code>. Each save carries a revision: if the declaration changed in another session, the draft is not saved and the view offers to reload the saved declaration."
+        },
+        {
+          "calloutWarning": {
+            "title": "The policy is never inferred",
+            "body": "ProxMenux adds no requirement on its own. An empty field keeps the shipped value or stays not stated, and a partial declaration only affects the elements it names."
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/en/docs/monitor/audit-report/reports.json b/web/messages/en/docs/monitor/audit-report/reports.json
new file mode 100644
index 00000000..0a168a77
--- /dev/null
+++ b/web/messages/en/docs/monitor/audit-report/reports.json
@@ -0,0 +1,160 @@
+{
+  "meta": {
+    "title": "Reports and comparisons | Audit & Report",
+    "description": "The six Audit & Report documents, how they are printed or saved as PDF, and how runs are compared with a reference run."
+  },
+  "header": {
+    "title": "Reports and comparisons",
+    "description": "Six documents, each composed for a different question, and the comparison of every run with a reference run.",
+    "section": "Audit & Report"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Six documents, not six styles",
+            "body": "The engine selects checks and sections before composing the document. A quick diagnosis is not a full audit with fewer pages, and an inventory presents no assessment results. The sample documents below use fictitious data."
+          }
+        }
+      ]
+    },
+    {
+      "id": "documents",
+      "title": "The six documents",
+      "blocks": [
+        {
+          "downloads": {
+            "items": [
+              {
+                "title": "Full audit",
+                "body": "Documents the node end to end as a technical record.",
+                "href": "/monitor/audit/sample-audit-full-report.pdf",
+                "facts": [
+                  { "label": "Checks", "value": "Every available check." },
+                  { "label": "Contents", "value": "Executive summary; identity and cluster; hardware; network and latency; storage; guests; passthrough; applications; findings with evidence; sources and scope." }
+                ]
+              },
+              {
+                "title": "Quick diagnosis",
+                "body": "Shows what needs attention without the complete inventory.",
+                "href": "/monitor/audit/sample-audit-diagnostic-report.pdf",
+                "facts": [
+                  { "label": "Checks", "value": "The same checks as the full audit." },
+                  { "label": "Contents", "value": "Minimal identity; critical findings; warnings; relevant observations; unverified readings and priority actions. Diagrams, inventory and long annexes are left out." }
+                ]
+              },
+              {
+                "title": "Inventory",
+                "body": "Describes what exists on the node without assessing it.",
+                "href": "/monitor/audit/sample-audit-inventory-report.pdf",
+                "facts": [
+                  { "label": "Checks", "value": "None; no finding is classified." },
+                  { "label": "Contents", "value": "Identity; cluster; CPU and memory; board, BIOS and controllers; network; storage; VMs and LXCs; passthrough; applications and elements managed by ProxMenux." }
+                ]
+              },
+              {
+                "title": "Security review",
+                "body": "Covers exposure and the controls over access to the node.",
+                "href": "/monitor/audit/sample-audit-security-report.pdf",
+                "facts": [
+                  { "label": "Checks", "value": "The security area, plus container privileges, updates, repositories and the APT chain." },
+                  { "label": "Contents", "value": "Identity and cluster; network and latency; access; firewall; 2FA; certificates; privileges; updates; repositories; state and age of Lynis." }
+                ]
+              },
+              {
+                "title": "Backup assurance",
+                "body": "Checks that the declared protection exists and that its backups are usable.",
+                "href": "/monitor/audit/sample-audit-backup-report.pdf",
+                "facts": [
+                  { "label": "Checks", "value": "The backup area, plus storage connectivity and notification delivery." },
+                  { "label": "Contents", "value": "Coverage per guest; declared recovery objective; age and result; destination; retention; verification; failed jobs; recovery and incomplete sources." }
+                ]
+              },
+              {
+                "title": "Capacity and wear",
+                "body": "Measures growth margin and signs of exhaustion or ageing.",
+                "href": "/monitor/audit/sample-audit-capacity-report.pdf",
+                "facts": [
+                  { "label": "Checks", "value": "The storage and hardware areas, plus memory, swap, journal and the host filesystem." },
+                  { "label": "Contents", "value": "Usage and thresholds; thin pools; overprovisioning; memory; inodes; ZFS; temperatures; power-on hours; SMART errors and NVMe/SSD service life." }
+                ]
+              }
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/monitor/audit/audit-report-preview.png",
+            "alt": "First page of a full audit report",
+            "caption": "Every document shares the report identifier, numbered sections, date, node, profile and footer."
+          }
+        },
+        {
+          "p": "A document contains the identity of the node and the date of the assessment, the executive result, a summary by area, the structure of hardware, network and storage, the protection of the guests, the findings with their evidence, the sources that could not be read, and the scope and policy applied, in the measure each profile includes them."
+        }
+      ]
+    },
+    {
+      "id": "print",
+      "title": "Printing or saving as PDF",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              { "title": "Run", "body": "An assessment runs with the profile selected in <strong>Report</strong>." },
+              { "title": "Review", "body": "The finished run shows its findings, the sources it could not read and the policy it applied." },
+              { "title": "Generate report", "body": "<strong>Generate report</strong> opens the view prepared as a document." },
+              { "title": "Print", "body": "<strong>Print or save as PDF</strong> opens the print dialog of the browser, where a printer or <em>Save as PDF</em> is selected." }
+            ]
+          }
+        },
+        {
+          "calloutTip": {
+            "title": "The printout is a document, not a screenshot",
+            "body": "The action bar is hidden, a table that continues on the next page repeats its header, blocks avoid unnecessary breaks and every page keeps the identification and numbering."
+          }
+        }
+      ]
+    },
+    {
+      "id": "compare",
+      "title": "Comparing with a reference run",
+      "intro": "<strong>Use as reference</strong> marks a finished run as the reference. Later runs are compared with it and their findings are separated into:",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Group", "Meaning"],
+            "rows": [
+              ["New", "Reported now and not before."],
+              ["Worse", "Still reported, and graver or reaching further than before."],
+              ["Better", "Still reported, but less grave or reaching less far than before."],
+              ["Resolved", "No longer reported, and nobody accepted them."],
+              ["Accepted", "No longer counted because a risk was accepted, not because the host changed."],
+              ["No longer assessed", "Present before and absent from this run; nothing verified that they stopped."]
+            ]
+          }
+        },
+        {
+          "table": {
+            "headers": ["Reference run", "Behaviour"],
+            "rows": [
+              ["Setting it", "Any finished run can be marked; none is marked automatically."],
+              ["Changing it", "Marking another run moves the reference without deleting the history."],
+              ["Comparing", "When no two runs are selected, the comparison uses the reference and the selected or most recent run."],
+              ["Keeping runs", "The 30 most recent runs are kept, and the reference run is never removed."],
+              ["Without a reference", "The view states that no reference run has been chosen yet, so there is nothing to compare against."]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "A report describes one moment",
+            "body": "An assessment does not certify a whole period. Older results stop describing the current state; the view shows the age of the last run and each source keeps the time it was collected."
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/en/docs/monitor/audit-report/scope.json b/web/messages/en/docs/monitor/audit-report/scope.json
new file mode 100644
index 00000000..7bf98c55
--- /dev/null
+++ b/web/messages/en/docs/monitor/audit-report/scope.json
@@ -0,0 +1,97 @@
+{
+  "meta": {
+    "title": "Scope and guarantees | Audit & Report",
+    "description": "Where the data of Audit & Report comes from, what is outside its view, the guarantees of its design and where its data is stored."
+  },
+  "header": {
+    "title": "Scope and guarantees",
+    "description": "Where the data of an assessment comes from, what stays outside its view and where Audit & Report keeps its data.",
+    "section": "Audit & Report"
+  },
+  "sections": [
+    {
+      "id": "sees",
+      "title": "What it observes",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "The configuration and state of the local node.",
+              "The declared configuration of the VMs and LXCs.",
+              "The state of the storage as Proxmox VE knows it.",
+              "The available history of backups and verifications.",
+              "SMART data and the events the Monitor has collected.",
+              "The state of services, cluster, HA and local sources."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "outside",
+      "title": "What is outside its view",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "The interior of the guests, beyond what they declare to Proxmox VE.",
+              "Network equipment outside the host.",
+              "Remote dependencies the node cannot observe.",
+              "Physical state the hardware does not expose.",
+              "Manual actions or actions of other software, in the change journal."
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Missing evidence is not evidence of absence",
+            "body": "A source that cannot be read gives an unverified or incomplete result, never a conformant one. The report lists the sources that were not available."
+          }
+        }
+      ]
+    },
+    {
+      "id": "guarantees",
+      "title": "Guarantees of the design",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Stable identifiers for the checks.",
+              "History of runs and findings.",
+              "A validated policy, saved atomically.",
+              "Accepted risks with a reason, visible.",
+              "Attribution of changes to script and function.",
+              "Capture before and after, where it is available.",
+              "An explicit result when something cannot be measured or captured."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "storage",
+      "title": "Where the data is stored",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Data", "Location"],
+            "rows": [
+              ["Policy", "<code>/usr/local/share/proxmenux/audit_policy.json</code>"],
+              ["Assessments", "The audit database of the Monitor"],
+              ["Captured objects", "<code>/usr/local/share/proxmenux/changes/objects/</code>"],
+              ["Pending entries", "<code>/usr/local/share/proxmenux/changes/spool/</code>"],
+              ["Consolidated journal", "<code>/usr/local/share/proxmenux/changes.db</code>"]
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "A tool to review, not a certification",
+            "body": "Audit & Report reviews, compares and documents the node. Its results are read together with the purpose of the system, the declared policy and the sources available."
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/en/docs/monitor/dashboard/vms-lxcs-app.json b/web/messages/en/docs/monitor/dashboard/vms-lxcs-app.json
index 4918d086..69874eec 100644
--- a/web/messages/en/docs/monitor/dashboard/vms-lxcs-app.json
+++ b/web/messages/en/docs/monitor/dashboard/vms-lxcs-app.json
@@ -96,7 +96,8 @@
       { "method": "docker label / docker exec", "use": "Reads an OCI version label or runs a version command inside a Docker container." },
       { "method": "python distribution", "use": "Uses importlib.metadata through the selected Python interpreter." },
       { "method": "command", "use": "Runs an advanced argv-style command without a shell and extracts the version from its output." },
-      { "method": "manual", "use": "Stores a version entered manually; it must be changed after upgrading the app." }
+      { "method": "manual", "use": "Stores a version entered manually; it must be changed after upgrading the app." },
+      { "method": "OCI image", "use": "For containers installed by OCI manager Apps. Reads the application and image versions from the installation record and compares the installed digest with the one the registry publishes; it needs no configuration." }
     ],
     "sourcesHeading": "Available-version sources",
     "sources": [
diff --git a/web/messages/en/docs/monitor/dashboard/vms-lxcs.json b/web/messages/en/docs/monitor/dashboard/vms-lxcs.json
index 439f89c5..71efdf0d 100644
--- a/web/messages/en/docs/monitor/dashboard/vms-lxcs.json
+++ b/web/messages/en/docs/monitor/dashboard/vms-lxcs.json
@@ -52,7 +52,7 @@
   },
   "drillIn": {
     "heading": "Per-guest drill-in modal",
-    "intro": "The modal opens with the guest name, VMID, type, state and uptime. Its navigation adapts to the guest: <strong>Status</strong>, <strong>App</strong> and <strong>Updates</strong> for LXC application management, <strong>Mounts</strong> when an LXC has mount points, plus <strong>Backups</strong> and <strong>Firewall</strong>. The fixed action bar keeps the lifecycle controls and the LXC terminal available from every tab.",
+    "intro": "The modal opens with the guest name, VMID, type, state and uptime. Its navigation adapts to the guest: <strong>Status</strong>, <strong>App</strong> and <strong>Updates</strong> for LXC application management, <strong>Mounts</strong> when an LXC has mount points, <strong>Logs</strong> for containers installed by OCI manager Apps, plus <strong>Backups</strong> and <strong>Firewall</strong>. The fixed action bar keeps the lifecycle controls and the LXC terminal available from every tab.",
     "statusTitle": "Tab 1 — Status",
     "statusImageAlt": "Per-guest drill-in modal — Status tab with CPU / Memory / Disk live cards, Disk and Network I/O totals, the OS distro logo, and the Resources / IP Addresses block",
     "statusImageCaption": "Status tab — live CPU / Memory / Disk with progress bars at the top, accumulated I/O totals (disk read/write, network down/up) below, then the static Resources block with Notes and + Info expansions and the IP Addresses pill list.",
@@ -106,7 +106,9 @@
     ],
     "mountsCalloutTitle": "What this gives you over the native UI",
     "mountsCalloutBody": "A truthful, capacity-aware view of every place the container reads or writes. NFS or CIFS shares mounted from inside the CT — invisible to the Proxmox web UI — appear here with the same look and the same health probe as any configured mount point. Stale remote mounts and zombie binds are flagged before they bite during a backup.",
-    "backupsTitle": "Tab 5 — Backups",
+    "logsTitle": "Tab 5 — Logs (OCI containers only)",
+    "logsBody": "Appears only for containers installed by OCI manager Apps. It shows the console output of the main process of the image, kept on the host in <code>/var/log/proxmenux/oci/VMID.console.log</code>: the last 100, 500 or 1000 lines, followed live while the container runs, with a filter and a download. It reads the file on every open, so it also works with the container stopped. The details are in <ociLink>OCI containers in ProxMenux Monitor</ociLink>.",
+    "backupsTitle": "Tab 6 — Backups",
     "backupsImageAlt": "Per-guest drill-in modal — Backups tab with the available backups list, destination tag, sizes and the Create Backup button",
     "backupsImageCaption": "Backups tab — every backup stored on configured Proxmox storages for this guest, sorted newest first. The tab header carries the count badge.",
     "backupsIntro": "Lists every backup stored across configured Proxmox storages for this guest, sorted newest first. The tab title carries a count badge so you see at a glance whether the guest is backed up. Per row:",
@@ -116,7 +118,7 @@
       "<strong>Size</strong> — final on-disk size of the backup."
     ],
     "backupsOutro": "The <strong>+ Create Backup</strong> button at the top right kicks off a new run on the storage marked as \"Backup target\" in the Proxmox storage config. Restore lives in the Proxmox web UI — the Monitor exposes the \"is this guest backed up recently?\" view, not the recovery flow.",
-    "firewallTitle": "Tab 6 — Firewall",
+    "firewallTitle": "Tab 7 — Firewall",
     "firewallIntro": "Reads the per-guest Proxmox firewall log straight from the host (no extra service, no polling). The tab is always present in the navigation strip; the panel decides what to render depending on whether the firewall is enabled for that guest and whether any rule is actually logging:",
     "firewallItems": [
       "<strong>Firewall disabled</strong> — an amber notice explains exactly where to enable it in the Proxmox UI (<em>&lt;Container|VM&gt; → Firewall → Options</em>) and reminds you that at least one rule needs <code>log: info</code> (or higher) before packets show up.",
diff --git a/web/messages/en/docs/oci-manager/architecture.json b/web/messages/en/docs/oci-manager/architecture.json
new file mode 100644
index 00000000..16937db9
--- /dev/null
+++ b/web/messages/en/docs/oci-manager/architecture.json
@@ -0,0 +1,114 @@
+{
+  "meta": {
+    "title": "How an OCI image is translated | ProxMenux",
+    "description": "From the image repository and its Compose file to a reviewable template, a deployment plan and a native Proxmox VE LXC, without Docker inside."
+  },
+  "header": {
+    "title": "How an OCI image is translated",
+    "description": "From the image repository and its Compose file to a reviewable template, a deployment plan and a native LXC, without installing Docker inside.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "pipeline",
+      "title": "The translation pipeline",
+      "blocks": [
+        {
+          "mermaid": {
+            "chartCode": "flowchart LR\n A[\"{{repo}}\"] --> B[\"Compose + README\"]\n B --> C[\"{{converter}}\"]\n C --> D[\"{{template}}\"]\n D --> E{\"{{blockers}}\"}\n E -- \"{{no}}\" --> F[\"{{review}}\"]\n F --> D\n E -- \"{{yes}}\" --> G[\"{{plan}}\"]\n G --> H[\"pct create\"]\n H --> I[\"{{lxc}}\"]",
+            "labels": {
+              "repo": "Image repository",
+              "converter": "Converter",
+              "template": "JSON template",
+              "blockers": "No blockers?",
+              "no": "No",
+              "yes": "Yes",
+              "review": "Review / overlay",
+              "plan": "Deployment plan",
+              "lxc": "Native LXC"
+            }
+          }
+        },
+        {
+          "p": "The converter reads the image and the Compose file its project publishes and writes a JSON template. A template with untranslated blockers goes through review, where a curated overlay resolves them, before it is published in the catalog. Only templates without blockers are offered for installation."
+        }
+      ]
+    },
+    {
+      "id": "template",
+      "title": "What the template keeps",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              { "icon": "archive", "title": "Image identity", "body": "Repository, rolling tag, architecture, resolved digest and source revision." },
+              { "icon": "braces", "title": "Container contract", "body": "Entrypoint, Cmd, environment, user, working directory, stop signal, ports and volumes." },
+              { "icon": "layers", "title": "Proxmox VE translation", "body": "Resources, security, mount points, devices, sysctls, healthchecks and the adaptations each one needs, with their reason." },
+              { "icon": "shield", "title": "Compatibility", "body": "Supported keys, untranslated blockers and the state of each validation." }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "sources",
+      "title": "OCI provides the process; Compose provides the environment",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Source", "Example", "Native result"],
+            "rows": [
+              ["OCI metadata", "<code>Entrypoint</code>, <code>Cmd</code>, <code>User</code>", "Proxmox VE imports them when the CT is created"],
+              ["Docker Compose", "<code>environment</code>, <code>volumes</code>, <code>devices</code>", "LXC environment entries, <code>mpN</code> and <code>devN</code>"],
+              ["ProxMenux profile", "GPU, healthcheck, credentials", "questions and reviewed adaptations"],
+              ["User", "VMID, storage, network", "the instance contract"]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "install",
+      "title": "What happens during an installation",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              { "title": "Resolve", "body": "The registry is queried, the host architecture is selected and the effective digest of the rolling tag is fixed." },
+              { "title": "Download and verify", "body": "Skopeo downloads the image as an OCI archive, and every layer is checked against its digest and decompressed before anything is created. A damaged download is fetched a second time before the installation stops." },
+              { "title": "Build", "body": "<code>pct create</code> builds the rootfs from the archive and keeps the official process metadata of the image." },
+              { "title": "Connect", "body": "The declared volumes, network, environment, devices and security profiles are attached." },
+              { "title": "Console", "body": "The console output of the container is kept on the host, and the Proxmox VE console opens a shell when the image ships one." },
+              { "title": "Check", "body": "The first start waits for an address and for the service to answer; a failure is not reported as a successful installation." },
+              { "title": "Register", "body": "The effective configuration is written to the instance contract that updates and recreations use." }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "example",
+      "title": "Example: an image with /config and /downloads",
+      "intro": "A common Compose definition and the Proxmox VE configuration it becomes. The paths the application expects do not change.",
+      "blocks": [
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Docker Compose",
+                "code": "image: lscr.io/linuxserver/example:latest\nenvironment:\n  - PUID=1000\n  - PGID=1000\nvolumes:\n  - config:/config\n  - /srv/downloads:/downloads\nports:\n  - 8080:8080"
+              },
+              {
+                "title": "/etc/pve/lxc/VMID.conf (excerpt)",
+                "code": "entrypoint: /init\nmp0: local-lvm:vm-VMID-disk-1,mp=/config,backup=1,size=8G\nmp1: /srv/downloads,mp=/downloads\nnet0: name=eth0,bridge=vmbr0,ip=dhcp,type=veth\nlxc.environment.runtime: PUID=1000\nlxc.environment.runtime: PGID=1000"
+              }
+            ]
+          }
+        },
+        {
+          "p": "<code>mp0</code> is a second disk that belongs to the container, named <code>vm-VMID-disk-N</code> on the selected storage. It is mounted at <code>/config</code> and, with <code>backup=1</code>, it is part of the container backup. <code>mp1</code> creates no disk: it binds the host directory <code>/srv/downloads</code> to <code>/downloads</code> inside the LXC. Port 8080 is not mapped: the LXC has an address of its own and the service answers on it."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/en/docs/oci-manager/custom-image.json b/web/messages/en/docs/oci-manager/custom-image.json
new file mode 100644
index 00000000..740acf45
--- /dev/null
+++ b/web/messages/en/docs/oci-manager/custom-image.json
@@ -0,0 +1,134 @@
+{
+  "meta": {
+    "title": "Install an image that is not in the catalog | ProxMenux",
+    "description": "Translate an OCI image from a Compose file, a URL, a docker run command or an image reference, and review what ProxMenux can reproduce before installing it."
+  },
+  "header": {
+    "title": "Install an image that is not in the catalog",
+    "description": "An image of your own is translated from its Compose file, a docker run command or its reference alone, and the result is shown for review before any LXC is created.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Same converter, same installer",
+            "body": "The option <strong>Install an image that is not in the catalog</strong> uses the converter and the installer of the catalog templates. The difference is that the contract is generated at that moment from the definition given, and validated before any LXC is created."
+          }
+        }
+      ]
+    },
+    {
+      "id": "sources",
+      "title": "How the image is described",
+      "intro": "The first screen asks how the image is described. There are four ways to give a complete definition and a fifth that uses only the image name.",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Option", "What it reads"],
+            "rows": [
+              ["Paste its Compose file in the terminal", "The YAML is pasted in the terminal and ends with Ctrl+D on an empty line."],
+              ["Read its Compose file from a file of this host", "A path on the node, <code>/root/docker-compose.yml</code> by default. The file must exist and be at most 256 KiB."],
+              ["Download its Compose file from an address", "An <code>http://</code> or <code>https://</code> address that serves the raw YAML. At most 256 KiB are downloaded."],
+              ["Paste its docker run command in the terminal", "The command published by the project. Ports, environment, volumes, devices, capabilities, user, shared memory and the other supported options are translated."],
+              ["Only the image reference, with no Compose file", "A reference such as <code>ghcr.io/user/application:latest</code>. The registry is queried and the OCI metadata of the image is kept."]
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/custom-source-menu.png",
+            "alt": "Menu that asks how an image that is not in the catalog is described",
+            "caption": "The five ways to describe an image that is not in the catalog."
+          }
+        }
+      ]
+    },
+    {
+      "id": "reference-only",
+      "title": "What an image reference alone provides",
+      "intro": "An image carries its process metadata, but not everything a Compose file usually adds around it.",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Read from the image", "Not in the image", "Consequence"],
+            "rows": [
+              ["<code>Entrypoint</code>, <code>Cmd</code>, <code>User</code>, <code>WorkingDir</code> and embedded environment", "Variables that only appear in the documentation", "They are added during the installation or a recreation"],
+              ["Volumes declared by the image", "Host directories that only a Compose file names", "Additional paths are added before installing"],
+              ["<code>EXPOSE</code> ports", "The URL, protocol or functional healthcheck", "The port and the way the service is checked are confirmed"],
+              ["Architectures and digest in the registry", "Devices, privileges or external dependencies", "None of them is enabled without a definition that asks for it"]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "review",
+      "title": "Review before installing",
+      "intro": "After translating the definition, ProxMenux shows what it understood before asking for VMID, resources or storage.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              { "title": "Analyse", "body": "Services, image, ports, paths, environment, devices, security and healthcheck are read." },
+              { "title": "Query the registry", "body": "The image must exist in a public registry, and its published architectures are listed." },
+              { "title": "List what is not applied", "body": "Labels, Docker networks, Swarm settings and other keys that have no effect on an LXC are listed." },
+              { "title": "Block what cannot be translated", "body": "A key with no safe equivalent is shown under <strong>What cannot be translated</strong> and the installation does not continue. Nothing is dropped silently." },
+              { "title": "Ask for secrets", "body": "Variables whose names read as a password, token or key become sensitive questions of the installation." }
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/custom-review.png",
+            "alt": "Summary of what ProxMenux understood from a Compose file",
+            "caption": "The summary shown before the installation asks for VMID and resources."
+          }
+        },
+        {
+          "p": "After accepting the summary, the flow is the one of the catalog: name, default or advanced mode, VMID, CPU, memory, network, start with the node, persistent paths, additional paths, compatible devices and a final summary."
+        }
+      ]
+    },
+    {
+      "id": "examples",
+      "title": "Input examples",
+      "blocks": [
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Compose",
+                "code": "services:\n  app:\n    image: ghcr.io/example/app:latest\n    ports:\n      - \"8080:8080\"\n    volumes:\n      - ./config:/config\n      - /srv/media:/media\n    environment:\n      TZ: Europe/Madrid"
+              },
+              {
+                "title": "docker run",
+                "code": "docker run -d \\\n  --name app \\\n  -p 8080:8080 \\\n  -e TZ=Europe/Madrid \\\n  -v app-config:/config \\\n  -v /srv/media:/media \\\n  ghcr.io/example/app:latest"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "limits",
+      "title": "Definitions that are not installed",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Images in private registries: registry credentials are not requested.",
+              "A Dockerfile without a published image: the image has to be built and published in an OCI registry first.",
+              "A Compose file with several services: it is blocked because it describes more than one image. This option installs a single container.",
+              "<code>configs</code>, external secrets or device formats that cannot be translated unambiguously.",
+              "Shell substitutions such as <code>$(command)</code>: the resulting value has to be written instead.",
+              "<code>docker run</code> options that are not recognised, and <code>--env-file</code>: an explicit Compose file is read instead."
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/en/docs/oci-manager/hardware.json b/web/messages/en/docs/oci-manager/hardware.json
new file mode 100644
index 00000000..29dbb4a3
--- /dev/null
+++ b/web/messages/en/docs/oci-manager/hardware.json
@@ -0,0 +1,232 @@
+{
+  "meta": {
+    "title": "Devices and acceleration | ProxMenux",
+    "description": "How OCI manager Apps passes GPU, NVIDIA, Coral, USB, FUSE and other devices to an OCI container as validated native Proxmox VE resources."
+  },
+  "header": {
+    "title": "Devices and acceleration",
+    "description": "GPU, NVIDIA, Coral, USB, FUSE and block devices become validated native Proxmox VE resources of the container.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "principle",
+      "title": "The device the application needs, not the whole host",
+      "blocks": [
+        {
+          "p": "A device requested by the Compose file or by the application profile becomes a concrete <code>devN</code> entry or LXC mount. Asking for a GPU, a USB device or a Coral does not make the container privileged."
+        },
+        {
+          "flow": {
+            "nodes": [
+              { "label": "Host inventory", "detail": "/dev/dri/renderD128\nGID 993 · Intel" },
+              { "label": "ProxMenux", "detail": "vendor and\npermissions checked" },
+              { "label": "LXC", "detail": "same device\neffective GID" }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "origin",
+      "title": "Where the device request comes from",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Source", "What is read", "What the installer does"],
+            "rows": [
+              ["Docker Compose", "<code>devices</code>, <code>group_add</code>, <code>deploy.resources</code> and NVIDIA requests", "Each requirement becomes a device request shown for review"],
+              ["Catalog profile", "The GPU, Coral, OpenCL, USB or FUSE support the application actually has", "Only the options validated for that image are offered"],
+              ["Image metadata and documentation", "VA-API, Selkies, LinuxServer mods or the NVIDIA runtime", "The documented variables and preparation are added"],
+              ["User selection", "CPU only, Intel/AMD, OpenCL, NVIDIA or an optional device", "The selection is stored in the instance contract"]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Detected devices are not attached on their own",
+            "body": "The host is inventoried, but only devices declared by the Compose file or by a compatible profile are offered and attached. A GPU, USB dongle or Coral present on the host is not exposed to every LXC."
+          }
+        }
+      ]
+    },
+    {
+      "id": "identify",
+      "title": "How the host device is identified",
+      "intro": "Before the LXC is modified, the device is read on the host and matched against the chosen profile.",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Type", "Identity", "Validation"],
+            "rows": [
+              ["Intel/AMD DRM", "<code>/dev/dri/renderD*</code> and <code>/sys/class/drm/NODE/device/vendor</code>", "A character device with vendor <code>0x8086</code> (Intel) or <code>0x1002</code> (AMD)"],
+              ["AMD OpenCL", "The render node, plus <code>/dev/kfd</code> when the profile needs it", "Existence, type, vendor, permissions and declared compatibility"],
+              ["NVIDIA", "<code>nvidia-smi</code> and <code>nvidia-container-cli</code>", "GPU, UUID, PCI bus, driver version, Toolkit, <code>/dev/nvidia*</code> nodes, binaries and libraries"],
+              ["Coral PCIe/M.2", "<code>/dev/apex_N</code> and its link in <code>/sys/dev/char/MAJOR:MINOR</code>", "Character node, major/minor, owner, GID and permissions"],
+              ["USB and serial", "<code>/dev/ttyUSB*</code>, <code>/dev/ttyACM*</code> or <code>/dev/bus/usb/BBB/DDD</code>", "Character node; for USB also vendor, product and serial when sysfs publishes them"],
+              ["KVM, TUN, FUSE, video and generic SCSI", "<code>/dev/kvm</code>, <code>/dev/net/tun</code>, <code>/dev/fuse</code>, <code>/dev/videoN</code> or <code>/dev/sgN</code>", "Supported path, node type and effective permissions"],
+              ["Optical drive", "<code>/dev/srN</code>", "A block device"]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "install",
+      "title": "What happens during the installation",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              { "title": "The template offers its profiles", "body": "For example CPU only, Intel/AMD VA-API, AMD OpenCL, Intel OpenCL or NVIDIA. The options belong to the image, not to a common menu." },
+              { "title": "A profile is chosen", "body": "It defines the device nodes, environment, mods or runtime the application needs." },
+              { "title": "A path is proposed", "body": "For DRM, <code>/dev/dri/renderD128</code>, which can be changed on a host with several render nodes. For USB or serial, the concrete node is selected." },
+              { "title": "Validation", "body": "Existence, type, allowed vendor, permissions and GID are checked. A mismatch stops the operation." },
+              { "title": "The contract is written", "body": "Path, mode, GID, write access and profile are recorded for updates and recreations." },
+              { "title": "Attach and test", "body": "<code>pct set</code> adds the <code>devN</code> entry and access is then checked inside the LXC. LinuxServer images are also checked as user <code>abc</code>." }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "config",
+      "title": "How it appears in the LXC configuration",
+      "intro": "Illustrative values: <code>dev0</code> and <code>dev1</code> are the free slots Proxmox VE assigns, and <code>renderD128</code>, <code>apex_0</code> and the GID depend on the hardware of the node.",
+      "blocks": [
+        {
+          "codeGrid": {
+            "items": [
+              { "title": "Intel/AMD VA-API", "code": "dev0: path=/dev/dri/renderD128,mode=0660,gid=993,deny-write=0" },
+              { "title": "Coral PCIe/M.2", "code": "dev0: path=/dev/apex_0,mode=0660,gid=GID,deny-write=0" },
+              { "title": "A specific USB device", "code": "dev0: path=/dev/bus/usb/003/004,mode=0660,gid=GID,deny-write=0" },
+              { "title": "AMD OpenCL", "code": "dev0: path=/dev/dri/renderD128,mode=0660,gid=GID,deny-write=0\ndev1: path=/dev/kfd,mode=0660,gid=GID,deny-write=0" }
+            ]
+          }
+        },
+        {
+          "p": "The GID is read with <code>stat</code> on the host and written to the <code>devN</code> entry; the <code>render</code> and <code>video</code> groups are not assumed to have a fixed number. The device keeps the same <code>/dev</code> path inside the LXC, where the application's own mechanisms look for it."
+        }
+      ]
+    },
+    {
+      "id": "profiles",
+      "title": "Profiles an image can offer",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Profile", "Translation", "Offered when"],
+            "rows": [
+              ["Intel/AMD VA-API", "<code>/dev/dri</code> render node", "The application supports video acceleration"],
+              ["OpenCL", "Render node, <code>/dev/kfd</code> when needed and the official mod", "The image or profile documents it"],
+              ["NVIDIA", "Driver devices and libraries of the host", "The host has a working driver and the NVIDIA Container Toolkit"],
+              ["Coral", "<code>/dev/apex_0</code> or the USB bus", "The profile declares Coral support (Frigate)"],
+              ["USB, serial, FUSE", "A single device, a validated tree or an LXC feature", "The contract asks for it"]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "nvidia",
+      "title": "NVIDIA",
+      "blocks": [
+        {
+          "calloutWarning": {
+            "title": "Node requirement: NVIDIA Container Toolkit",
+            "body": "A working driver on Proxmox VE is not enough to give an NVIDIA GPU to an OCI image. OCI manager Apps uses <code>nvidia-container-cli</code>, from the NVIDIA Container Toolkit, to identify the devices and to obtain the binaries and libraries that match the loaded driver."
+          }
+        },
+        {
+          "p": "The <nvidiaLink>ProxMenux NVIDIA installer</nvidiaLink> installs the NVIDIA Container Toolkit from the official NVIDIA repository together with the driver. It checks its four packages, validates <code>nvidia-container-cli</code> and records the result in the change journal of <auditLink>Audit & Report</auditLink>."
+        },
+        {
+          "p": "These two commands on the host show whether the driver and the Toolkit are available:"
+        },
+        {
+          "shell": { "code": "nvidia-smi -L\nnvidia-container-cli --version" }
+        },
+        {
+          "p": "On a host where the driver was installed by other means, the Toolkit is installed from the official stable repository:"
+        },
+        {
+          "shell": {
+            "code": "apt-get update\napt-get install -y --no-install-recommends ca-certificates curl gnupg2\n\ncurl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey \\\n  | gpg --dearmor -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg\n\ncurl -s -L https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list \\\n  | sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' \\\n  > /etc/apt/sources.list.d/nvidia-container-toolkit.list\n\napt-get update\napt-get install -y nvidia-container-toolkit libnvidia-container-tools"
+          }
+        },
+        {
+          "p": "The inventory OCI manager Apps uses is the output of:"
+        },
+        {
+          "shell": { "code": "nvidia-container-cli list --device all --libraries --binaries --firmwares --ipcs" }
+        },
+        {
+          "calloutInfo": {
+            "title": "Docker runtime configuration is not involved",
+            "body": "The containers are native LXCs and no Docker daemon is used, so <code>nvidia-ctk runtime configure --runtime=docker</code> plays no part: ProxMenux queries <code>nvidia-container-cli</code> directly and writes the LXC devices and mounts. The commands and supported platforms are maintained in the <toolkitLink>NVIDIA Container Toolkit installation guide</toolkitLink>."
+          }
+        },
+        {
+          "cards": {
+            "items": [
+              { "icon": "cpu", "title": "Inventory from the driver", "body": "<code>nvidia-container-cli</code> lists the device nodes, binaries, firmware and libraries of the installed driver." },
+              { "icon": "refresh", "title": "No fixed version", "body": "The template does not name library files. The profile is generated from the current host." },
+              { "icon": "shield", "title": "Read-only mounts", "body": "The host libraries are mounted read-only instead of being copied into the container." },
+              { "icon": "hardDrive", "title": "Driver changes", "body": "After a driver change the inventory is generated again before the affected LXCs start." }
+            ]
+          }
+        },
+        {
+          "code": {
+            "title": "NVIDIA result (simplified)",
+            "code": "devN: path=/dev/nvidia0,...\ndevN: path=/dev/nvidiactl,...\ndevN: path=/dev/nvidia-uvm,...\nlxc.mount.entry: HOST_LIBRARY CONTAINER_LIBRARY none ro,bind,create=file 0 0"
+          }
+        },
+        {
+          "p": "Passing only <code>/dev/nvidia0</code> is not enough. The user-space components of the loaded driver are mounted read-only, and <code>nvidia-smi</code> then runs inside the LXC to compare GPU, UUID, PCI bus and version with the host inventory."
+        }
+      ]
+    },
+    {
+      "id": "usb",
+      "title": "USB, serial and USB Coral",
+      "blocks": [
+        {
+          "calloutWarning": {
+            "title": "USB numbering can change",
+            "body": "A path such as <code>/dev/bus/usb/003/004</code> can change when the device is reconnected or the host restarts. The profile records vendor, product and serial when they are available, but a new bus address is not remapped automatically."
+          }
+        },
+        {
+          "p": "A peripheral is given by its concrete node: <code>/dev/ttyUSB0</code>, <code>/dev/ttyACM0</code>, <code>/dev/apex_0</code> or <code>/dev/bus/usb/BBB/DDD</code>. Passing the whole of <code>/dev</code> is not accepted. Coral is offered only to applications whose profile declares it."
+        }
+      ]
+    },
+    {
+      "id": "trees",
+      "title": "Device trees and LXC features",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Request", "Translation", "Scope"],
+            "rows": [
+              ["<code>/dev/dvb</code>, <code>/dev/snd</code> or <code>/dev/bus/usb</code>", "Each character node of the tree gets its own <code>devN</code> entry with the host mode and GID", "Only the requested tree, not the rest of <code>/dev</code>"],
+              ["<code>/dev/fuse</code>", "The node and, when the profile needs it, the <code>fuse=1</code> feature", "FUSE alone does not publish mounts to other LXCs"],
+              ["<code>/dev/net/tun</code>", "A <code>devN</code> entry at the same path inside the LXC", "The VPN or network configuration stays in the application"],
+              ["<code>/dev/kvm</code>", "A validated <code>devN</code> entry", "Offered only when the contract asks for it"]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "security",
+      "title": "Confirmations by level of risk",
+      "blocks": [
+        {
+          "p": "Concrete devices, optional privilege, required privilege, AppArmor or seccomp relaxation and access to the host PID namespace are treated as separate cases, not under one generic privileged label. Each option with a risk is explained and confirmed during the installation."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/en/docs/oci-manager/index.json b/web/messages/en/docs/oci-manager/index.json
new file mode 100644
index 00000000..32646212
--- /dev/null
+++ b/web/messages/en/docs/oci-manager/index.json
@@ -0,0 +1,116 @@
+{
+  "meta": {
+    "title": "OCI manager Apps | ProxMenux",
+    "description": "Run official OCI images as native Proxmox VE LXC containers, with persistent data, devices, multi-container applications and transactional updates."
+  },
+  "header": {
+    "title": "OCI manager Apps",
+    "description": "Official OCI images run as native Proxmox VE LXC containers. The image stays the one its maintainer publishes; ProxMenux reproduces the environment Docker Compose would have created around it.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "model",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "One OCI image, one native LXC",
+            "body": "No Docker engine runs inside the containers. Proxmox VE imports the image's filesystem and its OCI metadata, and the application becomes the main process of a native LXC, managed with the same tools as any other container of the node."
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              { "label": "Source", "detail": "OCI image\nCompose and documentation" },
+              { "label": "ProxMenux", "detail": "JSON contract\nvalidation and plan" },
+              { "label": "Proxmox VE", "detail": "native LXC\nvolumes and devices" }
+            ],
+            "caption": "The application is not rebuilt: its environment is reproduced declaratively."
+          }
+        }
+      ]
+    },
+    {
+      "id": "where",
+      "title": "Where it is",
+      "intro": "OCI manager Apps opens from option <strong>OCI manager Apps (beta)</strong> of the ProxMenux main menu, on the Proxmox node and as root. Its first screen offers:",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "<strong>Search applications</strong> — search by name across the catalog.",
+              "<strong>All applications</strong> — the complete catalog, with the number of applications.",
+              "<strong>Manage installed OCI applications</strong> — update, recreate, remove or recover what was installed.",
+              "<strong>Install an image that is not in the catalog</strong> — translate a Compose file, a <code>docker run</code> command or an image reference.",
+              "The catalog categories, each with its number of applications."
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/main-menu.png",
+            "alt": "Main screen of OCI manager Apps with search, all applications, management, custom image and the catalog categories",
+            "caption": "Main screen of OCI manager Apps."
+          }
+        },
+        {
+          "p": "Selecting an application shows its description, the image it runs and two installation modes: <strong>Install with default settings</strong>, which asks almost nothing, and <strong>Install with advanced settings</strong>, which offers the real storage, bridge and resource selectors of the node."
+        }
+      ]
+    },
+    {
+      "id": "translation",
+      "title": "What Docker expresses and what OCI manager Apps turns it into",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Requirement", "Docker expresses it as", "OCI manager Apps turns it into"],
+            "rows": [
+              ["Run the application", "<code>image</code>, <code>entrypoint</code>, <code>command</code>", "OCI rootfs and the main process of the LXC"],
+              ["Keep configuration", "<code>volumes: /config</code>", "a persistent <code>mpN</code> disk included in the backup, or a host directory"],
+              ["Publish the service", "<code>ports</code>", "an address of its own for the LXC and the access URL of the service"],
+              ["Use hardware", "<code>devices</code>, <code>group_add</code>", "<code>devN</code> entries with the effective host GID and a validated profile"],
+              ["Connect dependencies", "<code>networks</code>, <code>depends_on</code>", "a private bridge, fixed addresses, start order and healthchecks"],
+              ["Update", "<code>pull</code> and recreate", "a new rootfs with the same persistent contract"]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "kept",
+      "title": "What is kept and what changes",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              { "icon": "archive", "title": "Kept", "body": "The official image, its internal paths, its environment, its startup process and its functional documentation." },
+              { "icon": "boxes", "title": "Adapted", "body": "The runtime environment: network, persistence, devices, permissions and dependencies use native Proxmox VE LXC primitives." },
+              { "icon": "shield", "title": "Not translated", "body": "A Compose key with no safe equivalent is listed as a blocker. Templates with blockers are not offered, and sensitive options are confirmed during the installation." },
+              { "icon": "refresh", "title": "Recorded", "body": "Image digest, resources, paths, network, devices and stack membership are stored in the instance contract, which updates and recreations reproduce." }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "pages",
+      "title": "Pages of this section",
+      "blocks": [
+        {
+          "next": {
+            "items": [
+              { "label": "How an OCI image is translated", "href": "/docs/oci-manager/architecture", "tail": "from the image and its Compose file to a native LXC." },
+              { "label": "Install an image that is not in the catalog", "href": "/docs/oci-manager/custom-image", "tail": "Compose, docker run or an image reference." },
+              { "label": "Data, paths and networking", "href": "/docs/oci-manager/storage-network", "tail": "container disks, host directories, Rclone mounts and addresses." },
+              { "label": "Devices and acceleration", "href": "/docs/oci-manager/hardware", "tail": "GPU, NVIDIA, Coral, USB and other devices." },
+              { "label": "Multi-container applications", "href": "/docs/oci-manager/stacks", "tail": "application, database and cache as coordinated LXCs." },
+              { "label": "Install, update and recreate", "href": "/docs/oci-manager/lifecycle", "tail": "the instance contract and its operations." },
+              { "label": "In ProxMenux Monitor", "href": "/docs/oci-manager/monitor", "tail": "versions, updates, console output and terminal." }
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/en/docs/oci-manager/lifecycle.json b/web/messages/en/docs/oci-manager/lifecycle.json
new file mode 100644
index 00000000..25a32a1b
--- /dev/null
+++ b/web/messages/en/docs/oci-manager/lifecycle.json
@@ -0,0 +1,243 @@
+{
+  "meta": {
+    "title": "Install, update and recreate | ProxMenux",
+    "description": "The instance contract of an OCI container and the operations that use it: update, recreate, remove and recovery of an interrupted operation."
+  },
+  "header": {
+    "title": "Install, update and recreate",
+    "description": "Each instance keeps a reproducible contract, so its rootfs can be replaced without losing configuration or persistent data.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "contract",
+      "title": "The instance contract",
+      "blocks": [
+        {
+          "p": "After an installation, the effective configuration is stored in <code>/usr/local/share/proxmenux/oci/instances/VMID/oci-compose.json</code>. It is not a copy of the original Compose file: it is the reproducible contract of the LXC that exists on this host."
+        },
+        {
+          "code": {
+            "code": "instances/\n└── 105/\n    └── oci-compose.json\n        ├── image and resolved digest\n        ├── resources and network\n        ├── environment (secrets protected)\n        ├── container disks and host directories\n        ├── hardware profile and devices\n        ├── console log and terminal mode\n        └── stack membership and lifecycle"
+          }
+        }
+      ]
+    },
+    {
+      "id": "manage",
+      "title": "Manage installed OCI applications",
+      "intro": "This option of the main screen lists the registered instances with their application and image. Each one is checked against its contract before any action; a CT that no longer matches its record is neither modified nor deleted. The same update and recreation are offered in the Updates tab of <monitorLink>ProxMenux Monitor</monitorLink>.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Option",
+              "What changes",
+              "What is kept"
+            ],
+            "rows": [
+              [
+                "Update the image with the saved configuration",
+                "The rootfs is replaced by the image the saved channel publishes today",
+                "Contract, container disks, host directories, network and devices"
+              ],
+              [
+                "Recreate: edit resources, network, paths and GPU",
+                "The editor opens with the current contract; the CT is rebuilt with the changes",
+                "The data of container disks and host directories"
+              ],
+              [
+                "Remove: delete the application and its containers",
+                "The LXC, or every member of a stack, and their contracts are deleted",
+                "Host directories, with their content"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "For a multi-container application the menu offers <strong>Update every container of the application</strong> and the removal. A stack is not recreated."
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/manage-menu.png",
+            "alt": "List of installed OCI applications and the update, recreate and remove options",
+            "caption": "Manage installed OCI applications."
+          }
+        }
+      ]
+    },
+    {
+      "id": "update",
+      "title": "A transactional update",
+      "blocks": [
+        {
+          "mermaid": {
+            "chartCode": "sequenceDiagram\n participant U as {{user}}\n participant P as ProxMenux\n participant R as {{registry}}\n participant X as Proxmox VE\n U->>P: {{update}}\n P->>R: {{resolve}}\n R-->>P: digest\n P->>P: {{verify}}\n P->>X: {{backup}}\n P->>X: {{import}}\n P->>X: {{reapply}}\n X-->>P: healthcheck\n alt {{healthy}}\n  P-->>U: {{commit}}\n else {{failure}}\n  P->>X: Rollback\n  P-->>U: {{restored}}\n end",
+            "labels": {
+              "user": "User",
+              "registry": "OCI registry",
+              "update": "Update instance",
+              "resolve": "Resolve the tag",
+              "verify": "Verify archive and preflight",
+              "backup": "Stop and back up the CT",
+              "import": "Import the new rootfs",
+              "reapply": "Apply the contract again",
+              "healthy": "healthy",
+              "failure": "failure",
+              "commit": "Contract published with the new digest",
+              "restored": "Previous instance restored"
+            }
+          }
+        },
+        {
+          "list": {
+            "items": [
+              "When the registry still serves the installed digest, nothing is downloaded and the instance is not touched.",
+              "The new image is verified layer by layer before the CT stops. A download that arrives damaged is fetched a second time; an image already cached that fails the check is downloaded again.",
+              "Settings changed in Proxmox VE after the installation (memory, swap, cores, CPU limit, CPU priority, start with the node) are kept and carried into the new contract.",
+              "Any other difference between the CT and its contract stops the update before the CT is stopped."
+            ]
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Before",
+                "detail": "rootfs A\n/config mp0\n/media host directory"
+              },
+              {
+                "label": "Update",
+                "detail": "replaces only\nthe rootfs"
+              },
+              {
+                "label": "After",
+                "detail": "rootfs B\n/config mp0\n/media host directory"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "recovery",
+      "title": "Recovering an interrupted operation",
+      "intro": "Update and recreation use a persistent transaction. If the process, the terminal or the node is interrupted after the CT stops, the operation is not taken as finished.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Pending marker",
+                "body": "When Manage installed OCI applications opens, the saved state shows that the replacement was never published."
+              },
+              {
+                "title": "View status",
+                "body": "Shows the phase that was reached without changing containers or data."
+              },
+              {
+                "title": "Recover the previous installation",
+                "body": "Restores the verified native backup taken before the replacement and the previous contract."
+              },
+              {
+                "title": "Stacks as a unit",
+                "body": "For a multi-container application, every member is recovered from the same transaction point, not only the selected one."
+              }
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Host directories are outside the rollback",
+            "body": "The backup covers the rootfs and the container disks it includes. A host directory is not reverted, because other LXCs may use its data. Updating, recreating or recovering an instance with host directories asks for a confirmation of this first."
+          }
+        }
+      ]
+    },
+    {
+      "id": "remove",
+      "title": "Removing an OCI application",
+      "blocks": [
+        {
+          "p": "Before the confirmation, a summary is built from the real configuration: the containers that are removed, the data deleted with them, the private network that is released and the host directories that are kept. The confirmation defaults to <strong>No</strong>, since the data of the deleted disks cannot be recovered afterwards."
+        },
+        {
+          "table": {
+            "headers": [
+              "Resource",
+              "On removal",
+              "Reason"
+            ],
+            "rows": [
+              [
+                "rootfs and container disks",
+                "Deleted",
+                "They belong only to the container"
+              ],
+              [
+                "Host directory",
+                "Kept, with its content",
+                "Other applications may use it"
+              ],
+              [
+                "Instance contract",
+                "Retired after a successful removal",
+                "No CT is associated with it any more"
+              ],
+              [
+                "Private bridge of a stack",
+                "Released with the stack",
+                "It has no members left to connect"
+              ],
+              [
+                "A single member of a stack",
+                "Not removed on its own",
+                "The whole application is removed, so no stack is left incomplete"
+              ]
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/remove-summary.png",
+            "alt": "Removal summary with the containers, data and host directories affected",
+            "caption": "The removal summary, built from the real configuration."
+          }
+        }
+      ]
+    },
+    {
+      "id": "archives",
+      "title": "Downloaded images and host space",
+      "blocks": [
+        {
+          "p": "The OCI archive is used to build the rootfs; the running CT does not read it. After an installation or an update, the downloaded archives of that operation are listed with their size and their deletion is offered. Deleting them frees the space without affecting the container or its data."
+        },
+        {
+          "calloutInfo": {
+            "title": "Updates do not need the archive",
+            "body": "Without the archive, an update resolves the saved channel and downloads the new digest. With it, an archive is reused only when its reference and integrity match what is requested."
+          }
+        }
+      ]
+    },
+    {
+      "id": "registry",
+      "title": "Registry and cleanup",
+      "blocks": [
+        {
+          "p": "The registered contracts are compared with the real CTs. A contract is orphaned only when its VMID no longer exists or no longer carries the expected instance identity. The cleanup does not delete volumes or external data by inference."
+        }
+      ]
+    },
+    {
+      "id": "channel",
+      "title": "A rolling tag is not an unattended update",
+      "blocks": [
+        {
+          "p": "The catalog installs the rolling tag its maintainer publishes, but the effective digest is resolved, recorded and changed only through an explicit update with preflight and rollback. <monitorLink>ProxMenux Monitor</monitorLink> compares the installed digest with the one the registry publishes and shows, and notifies, when a new image is available."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/en/docs/oci-manager/monitor.json b/web/messages/en/docs/oci-manager/monitor.json
new file mode 100644
index 00000000..0d121145
--- /dev/null
+++ b/web/messages/en/docs/oci-manager/monitor.json
@@ -0,0 +1,203 @@
+{
+  "meta": {
+    "title": "OCI containers in ProxMenux Monitor | ProxMenux",
+    "description": "What ProxMenux Monitor shows for a container installed by OCI manager Apps: application and image versions, new images, console output and the Proxmox VE terminal."
+  },
+  "header": {
+    "title": "In ProxMenux Monitor",
+    "description": "A container installed by OCI manager Apps appears in VMs & LXCs like any other LXC. Its modal reads the installation record: application and image versions, new images, console output and terminal.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "The record is the source",
+            "body": "OCI manager Apps knows what it installed and where it came from. The Monitor reads that installation record instead of probing the container, so the data is the same whether the container is running or stopped."
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "Tab",
+              "What changes for an OCI container"
+            ],
+            "rows": [
+              [
+                "App",
+                "The application is identified from the record, and updates are tracked by image"
+              ],
+              [
+                "Updates",
+                "The image is updated or the container recreated, with the same flow as the OCI menu"
+              ],
+              [
+                "Mounts",
+                "Container disks and host directories, with their usage"
+              ],
+              [
+                "Logs",
+                "Only for OCI containers: the console output of the application"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "app",
+      "title": "App",
+      "intro": "The <appLink>App</appLink> tab offers the installed application as a detection, with the name, logo, port and scheme of the record. Registering it opens the editor with the method <strong>OCI image (installed by ProxMenux)</strong>, which needs no configuration.",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "boxes",
+                "title": "Application",
+                "body": "The version of the application inside the image, read from the image itself: its environment or its <code>org.opencontainers.image.version</code> label. It is informative."
+              },
+              {
+                "icon": "archive",
+                "title": "Image",
+                "body": "The build date and digest of the installed image. The update is decided here: the installed digest is compared with the one the registry publishes today for the same tag."
+              }
+            ]
+          }
+        },
+        {
+          "list": {
+            "items": [
+              "When the registry publishes a new digest, the card shows <strong>New image</strong> with its date and digest, even if the application version inside did not change: a rebuild on an updated base is an update.",
+              "When the digests match, the card reads <strong>Version</strong>.",
+              "The card links to the repository of the image: its GitHub project, or its Docker Hub page for an official image.",
+              "The access link uses the LAN address of the container, also for the main member of a multi-container application, which has a second address on its private network.",
+              "The button <strong>Refresh data</strong> reads the record and the registry again. The options to search for applications or register another one are not offered: the container holds exactly the application of its record."
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/monitor-app-tab.png",
+            "alt": "App tab of an OCI container with the application version, the image and the repository link",
+            "caption": "App tab of a container installed by OCI manager Apps."
+          }
+        },
+        {
+          "p": "The check runs once a day with the update checks of the Monitor, and <strong>Refresh data</strong> runs it at once. A new image is sent as a notification through the channels configured in <notificationsLink>Notifications</notificationsLink>. The update is applied from the Updates tab."
+        }
+      ]
+    },
+    {
+      "id": "updates",
+      "title": "Updates",
+      "intro": "For a container installed by OCI manager Apps the Updates tab shows the application with its installed image and, when the registry publishes one, the new image, in the same format as any other application. The package and application updaters of an ordinary LXC do not appear.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Button",
+              "What it opens"
+            ],
+            "rows": [
+              [
+                "Update",
+                "The update of <lifecycleLink>Manage installed OCI applications</lifecycleLink> for this container, in the Monitor terminal. It can run whether or not there is a new image; with none, nothing is changed. In a multi-container application it updates every member."
+              ],
+              [
+                "Recreate",
+                "The recreation editor (resources, network, paths and GPU). It is not offered for a multi-container application."
+              ],
+              [
+                "Recover",
+                "Replaces Update when an operation on the container was interrupted, and opens its recovery."
+              ]
+            ]
+          }
+        },
+        {
+          "p": "External changes, host directories and multi-container applications are handled as in the OCI menu. When the terminal closes, the image, the record and the mounts are read again."
+        },
+        {
+          "table": {
+            "headers": [
+              "Option",
+              "Behaviour"
+            ],
+            "rows": [
+              [
+                "Keep the backup taken before updating",
+                "Every update backs up the container to restore it if the update fails. With this option that same backup is kept in the chosen storage and appears among the backups of the CT; on Proxmox Backup Server a backup is written before the update."
+              ],
+              [
+                "Scheduled updates",
+                "The image is updated at the chosen time only when the registry publishes a new one, and optionally only once it is 1, 3, 7 or 14 days old. A container with changes made outside ProxMenux is skipped and reported; one with host directories runs only when that was confirmed when the schedule was saved."
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "logs",
+      "title": "Logs",
+      "intro": "The Logs tab appears only for containers installed by OCI manager Apps, between Mounts and Backups. It shows the standard output and error of the main process of the image, the same output <code>docker logs</code> shows for a Docker container.",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "The output is kept on the host in <code>/var/log/proxmenux/oci/VMID.console.log</code> (mode 0600), from the first start and across restarts, so it can be read with the container stopped.",
+              "The file is rotated at 10 MB, keeping three compressed copies (<code>/etc/logrotate.d/proxmenux-oci</code>).",
+              "The last 100, 500 or 1000 lines are shown. While the container runs, new lines are followed live; scrolling up pauses the follow, and <strong>Follow</strong> resumes it.",
+              "A filter shows only the lines that contain a text, and <strong>Download</strong> saves the lines loaded.",
+              "Colour codes are removed and a line that a progress bar redraws is shown in its final state.",
+              "The tab reads the file on every open; it is not cached."
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "First-start credentials",
+            "body": "Images that print a generated password on their first start leave it in this output, as <code>docker logs</code> does. The installer reads it from there to show it in its summary."
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/monitor-logs-tab.png",
+            "alt": "Logs tab with the console output of an OCI container, the line selector, the filter and the follow button",
+            "caption": "Console output of an OCI container."
+          }
+        }
+      ]
+    },
+    {
+      "id": "terminal",
+      "title": "Proxmox VE console",
+      "blocks": [
+        {
+          "p": "An OCI image runs its own process as PID 1 and no login service, so the default console of an LXC would open a terminal nothing answers on. Containers installed by OCI manager Apps are created with <code>cmode: shell</code>: the Proxmox VE console opens a shell with <code>lxc-attach</code>, the equivalent of <code>docker exec</code>, with the running application untouched."
+        },
+        {
+          "list": {
+            "items": [
+              "The shell is the one <code>/etc/passwd</code> gives to root in the image. An image whose root has no shell, or ships none, keeps the default console.",
+              "The shell is root inside the container, without a password. Who can open it is decided by the <code>VM.Console</code> permission of Proxmox VE.",
+              "The terminal of the Monitor enters the container with <code>pct enter</code>, which works the same way."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "mounts",
+      "title": "Mounts",
+      "blocks": [
+        {
+          "p": "The <mountsLink>Mounts</mountsLink> tab lists the container disks and host directories of the container. The usage of a container disk on block storage such as LVM-thin is read from the filesystem of the disk, which is mounted only inside the container."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/en/docs/oci-manager/stacks.json b/web/messages/en/docs/oci-manager/stacks.json
new file mode 100644
index 00000000..c09bbac4
--- /dev/null
+++ b/web/messages/en/docs/oci-manager/stacks.json
@@ -0,0 +1,383 @@
+{
+  "meta": {
+    "title": "Multi-container applications | ProxMenux",
+    "description": "How OCI manager Apps turns an application with its database and cache into coordinated native LXCs: plan, private network, dependency hook, validation and transactional updates."
+  },
+  "header": {
+    "title": "Multi-container applications",
+    "description": "An application with its database, cache and other services becomes several coordinated native LXCs, installed and updated as one.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "One application for the user, several LXCs for Proxmox VE",
+            "body": "A multi-container definition is one entry of the catalog. The installer creates one native LXC per service and keeps their dependencies explicit. Immich, Nextcloud, Paperless-ngx and Tandoor are installed this way."
+          }
+        },
+        {
+          "mermaid": {
+            "chartCode": "flowchart LR\n C[\"Docker Compose\"] --> O[\"{{plan}}\"]\n O --> A[\"{{app}}<br/>{{appNet}}\"]\n O --> D[\"{{db}}<br/>{{private}}\"]\n O --> R[\"{{cache}}<br/>{{private}}\"]\n V1[(\"config\")] --> A\n V2[(\"database\")] --> D\n V3[(\"cache\")] --> R\n D --> A\n R --> A",
+            "labels": {
+              "plan": "Stack plan",
+              "app": "Application LXC",
+              "appNet": "LAN + private",
+              "db": "PostgreSQL LXC",
+              "cache": "Valkey LXC",
+              "private": "private"
+            }
+          }
+        }
+      ]
+    },
+    {
+      "id": "plan",
+      "title": "1. The plan, before any container exists",
+      "blocks": [
+        {
+          "p": "No LXC is created while the Compose definition is interpreted. A complete plan comes first, with every member, image, VMID, network, path, secret, order and health check. If the plan is not consistent, the installation does not start."
+        },
+        {
+          "table": {
+            "headers": [
+              "Plan element",
+              "Contents",
+              "Checked before creating anything"
+            ],
+            "rows": [
+              [
+                "Members",
+                "Main application, database, cache, machine learning and other dependencies",
+                "Unique VMIDs, known roles and exactly one main member"
+              ],
+              [
+                "Images",
+                "Rolling reference, architecture and resolved digest of each service",
+                "All exist, support the architecture and pass the OCI integrity check"
+              ],
+              [
+                "Network",
+                "Private bridge, subnet, a fixed address per service and LAN access for the main member",
+                "No collision with existing bridges or subnets and no repeated address"
+              ],
+              [
+                "Persistence",
+                "Container disks, host directories, owners and backup",
+                "No overlapping paths, storage available and declared permissions"
+              ],
+              [
+                "Secrets",
+                "Database password, application keys and initial credentials",
+                "Generated once and given only to the members that use them"
+              ],
+              [
+                "Lifecycle",
+                "Start order, stop order and a health check per member",
+                "The main application starts last and stops first"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "create",
+      "title": "2. Creation, member by member",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Reserve every VMID",
+                "body": "The Proxmox VE inventory and the instance registry are checked. An existing CT is not adopted and a contract that still belongs to another instance is not reused."
+              },
+              {
+                "title": "Prepare every image",
+                "body": "All images are resolved, downloaded and verified before the first container is created."
+              },
+              {
+                "title": "Create each rootfs",
+                "body": "The official OCI metadata is imported, and the ProxMenux instance identity and the member role are added."
+              },
+              {
+                "title": "Private network",
+                "body": "A bridge and subnet are created and each member gets its fixed address; only the main member also gets the LAN interface."
+              },
+              {
+                "title": "Persistence",
+                "body": "Each database and configuration gets its own container disk; only data meant to be shared uses host directories."
+              },
+              {
+                "title": "Environment",
+                "body": "Internal endpoints, shared secrets and service variables are written. The application reaches its dependencies at their reserved private addresses."
+              },
+              {
+                "title": "Record",
+                "body": "Each member records its native configuration, the rootfs changes that updates have to reproduce and its relation to the stack."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "checks",
+      "title": "3. Start and check each container",
+      "intro": "A created LXC does not mean a ready service. Dependencies start in order and each one passes a check specific to its service.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Service",
+              "Check",
+              "What it shows"
+            ],
+            "rows": [
+              [
+                "PostgreSQL",
+                "<code>pg_isready</code> in the CT with the expected host, user and database",
+                "The server accepts connections for the configured database"
+              ],
+              [
+                "Redis / Valkey",
+                "<code>redis-cli</code> or <code>valkey-cli</code> <code>PING</code> against its private address",
+                "The broker listens and answers"
+              ],
+              [
+                "Immich machine learning",
+                "HTTP <code>GET /ping</code>, plus a check of the selected GPU runtime",
+                "The service answers and the requested acceleration has not fallen back to CPU"
+              ],
+              [
+                "Nextcloud",
+                "<code>GET /status.php</code> with <code>installed=true</code>, <code>maintenance=false</code> and <code>needsDbUpgrade=false</code>",
+                "Initialisation finished with no pending migration"
+              ],
+              [
+                "Paperless-ngx / Tandoor",
+                "HTTP on the LAN address and real port of the service",
+                "The frontend and its dependencies serve the application"
+              ],
+              [
+                "Main application",
+                "The endpoint of its template, for example <code>/api/server/ping</code> in Immich",
+                "The whole stack works through the application that uses the dependencies"
+              ]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "running is not healthy",
+            "body": "The running state only says that the LXC process exists. Where the service offers a better check, an exec or HTTP check with a timeout is used. If a member stops or fails its check, the stack is not declared installed."
+          }
+        }
+      ]
+    },
+    {
+      "id": "hook",
+      "title": "4. The dependency hook",
+      "blocks": [
+        {
+          "p": "The hook is set only on the main container of a dependent stack. Proxmox VE keeps the script as a snippet and runs it as the <code>hookscript</code> of that CT. The stack recipe is not written in the script: it lives in a separate private contract."
+        },
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Main CT configuration",
+                "code": "hookscript: local:snippets/proxmenux-stack-dependencies.sh"
+              },
+              {
+                "title": "Private contract (example)",
+                "code": "/etc/pve/priv/proxmenux-stack-VMID.json\n{\n  \"schema\": 1,\n  \"stack\": \"immich\",\n  \"dependencies\": [\n    {\"vmid\": 107, \"label\": \"PostgreSQL\", \"healthcheck\": {...}},\n    {\"vmid\": 108, \"label\": \"Valkey\", \"healthcheck\": {...}},\n    {\"vmid\": 106, \"label\": \"Machine Learning\", \"healthcheck\": {...}}\n  ]\n}"
+              }
+            ]
+          }
+        },
+        {
+          "snippet": {
+            "summary": "Complete source of proxmenux-stack-dependencies.sh",
+            "pathCode": "local:snippets/proxmenux-stack-dependencies.sh",
+            "snippetCode": "stackDependencyHook"
+          }
+        },
+        {
+          "p": "The script is the same for every stack. VMIDs, names, check types and timeouts come from the private contract <code>/etc/pve/priv/proxmenux-stack-VMID.json</code> of each stack."
+        },
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Proxmox VE calls pre-start",
+                "body": "Before the main CT starts, the hook runs with its VMID and the lifecycle phase."
+              },
+              {
+                "title": "A lock per stack",
+                "body": "<code>flock</code> on <code>/run/lock/proxmenux-stack-VMID.lock</code> prevents two start sequences at the same time."
+              },
+              {
+                "title": "The contract is read and validated",
+                "body": "A known schema, numeric dependencies, labels, an exec, http or running check and a positive timeout are required."
+              },
+              {
+                "title": "Dependencies in order",
+                "body": "Each CT must exist; a stopped one is started and one already running is not restarted."
+              },
+              {
+                "title": "Wait for health",
+                "body": "The check runs every two seconds, and the CT is also confirmed to be still running."
+              },
+              {
+                "title": "The main CT starts",
+                "body": "When every dependency is ready, pre-start ends and Proxmox VE starts the application."
+              }
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "The hook does not stop dependencies",
+            "body": "The post-start, pre-stop and post-stop phases do nothing. Stopping the main CT leaves PostgreSQL, Redis, Valkey or machine learning running. The hook orders the start; it does not turn several LXCs into one process."
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "Type",
+              "Example",
+              "Later starts"
+            ],
+            "rows": [
+              [
+                "Dependent stack",
+                "Immich, Nextcloud, application with PostgreSQL",
+                "The hook of the main CT starts the dependencies and waits for them"
+              ],
+              [
+                "Application suite",
+                "Arr suite",
+                "No main member: each LXC follows its own <code>onboot</code>"
+              ],
+              [
+                "Single application",
+                "Jellyfin",
+                "Proxmox VE starts that LXC directly"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "stack-checks",
+      "title": "5. Checks on the stack as a whole",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Every VMID exists, is unique and keeps the expected instance identity.",
+              "Every contract belongs to the same stack, keeps its role and its recorded native configuration.",
+              "The main member is last in <code>start_order</code> and first in <code>stop_order</code>.",
+              "No member, volume or rootfs adaptation is missing.",
+              "The hook points to the official snippet, its content is unchanged and its contract matches the stack recipe.",
+              "The observed images and digests match the prepared OCI archives.",
+              "Devices, GPU profiles, mounts, secrets and endpoints still match the contracts.",
+              "After every dependency passes, the endpoint of the main application checks the integration between members."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "manage",
+      "title": "Managing an installed stack",
+      "intro": "In <strong>Manage installed OCI applications</strong>, any member leads to the whole stack. The menu of a stack offers <strong>Update every container of the application</strong> and <strong>Remove: delete the application and its containers</strong>.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Any member",
+                "body": "The contract of the member names the main VMID and the complete list of members."
+              },
+              {
+                "title": "The stack is reproducible",
+                "body": "Identities, contracts, hook, adaptations and a coordinated replay for that recipe are validated."
+              },
+              {
+                "title": "Images first",
+                "body": "The application is not stopped until every digest has been resolved, downloaded and verified."
+              },
+              {
+                "title": "Stop and back up the set",
+                "body": "Verified native backups are taken with the stack stopped, so application and databases belong to the same moment."
+              },
+              {
+                "title": "Update and check each member",
+                "body": "Adaptation, network, mounts, secrets and devices are applied again before the health check of each member."
+              },
+              {
+                "title": "Publish or recover everything",
+                "body": "The new contracts are published only when every member passes. If one fails, every member is restored."
+              }
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "A stack without a coordinated replay is not updated",
+            "body": "If the preparation of a stack cannot be reproduced, the update is refused before the stack is stopped. The application keeps running as it is."
+          }
+        }
+      ]
+    },
+    {
+      "id": "failure",
+      "title": "6. When something fails",
+      "blocks": [
+        {
+          "p": "During an installation, an error stops and removes the incomplete containers that operation created, and the private bridge if the operation created it. A stack is not published as valid until the whole sequence finishes."
+        },
+        {
+          "p": "An update is transactional: all images are prepared first, then the stack stops, each member is backed up and the backup verified, and only then is each rootfs replaced. Members start one by one with their health check; if one fails, every member is restored from the same set of backups, so the database and the application never belong to different moments."
+        },
+        {
+          "mermaid": {
+            "chartCode": "flowchart LR\n P[\"{{prepare}}\"] --> S[\"{{stop}}\"]\n S --> B[\"{{backup}}\"]\n B --> R[\"{{replace}}\"]\n R --> H{\"{{healthy}}\"}\n H -- \"{{yes}}\" --> C[\"{{commit}}\"]\n H -- \"{{no}}\" --> X[\"{{rollback}}\"]",
+            "labels": {
+              "prepare": "Prepare every image",
+              "stop": "Stop, main member first",
+              "backup": "Verified backup of every CT",
+              "replace": "Replace rootfs",
+              "healthy": "All healthy?",
+              "yes": "Yes",
+              "no": "No",
+              "commit": "Publish contracts",
+              "rollback": "Restore every member"
+            }
+          }
+        }
+      ]
+    },
+    {
+      "id": "not-assumed",
+      "title": "What a stack does not include",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "A suite installed in one flow, such as the Arr suite, is not a dependent stack: its containers have no start order between them.",
+              "The private network does not replace authentication, TLS or the configuration of each application.",
+              "The backup of one LXC does not contain the bridge, the hook or the contracts of the rest of the stack.",
+              "Prowlarr, Sonarr or Radarr receive no indexers, profiles or providers from ProxMenux."
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/en/docs/oci-manager/storage-network.json b/web/messages/en/docs/oci-manager/storage-network.json
new file mode 100644
index 00000000..68666cf9
--- /dev/null
+++ b/web/messages/en/docs/oci-manager/storage-network.json
@@ -0,0 +1,190 @@
+{
+  "meta": {
+    "title": "Data, paths and networking | ProxMenux",
+    "description": "How OCI manager Apps keeps the data of an OCI container: container disks, host directories, Rclone mounts, addresses and private networks."
+  },
+  "header": {
+    "title": "Data, paths and networking",
+    "description": "What lives in the rootfs, what survives its replacement, how data is shared between containers and how each container gets its address.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Persistence is decided before the LXC exists",
+            "body": "The volumes published by the image and by its Compose file are read before the container is created. Every path that has to survive an update becomes a mount point independent of the rootfs, so the rootfs only holds what belongs to the image and can be replaced."
+          }
+        }
+      ]
+    },
+    {
+      "id": "questions",
+      "title": "What the installer asks",
+      "intro": "The template supplies the paths the application needs. Each one is placed on a container disk or on a host directory, and more paths can be added before the summary.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              { "title": "Required paths", "body": "<code>/config</code>, <code>/data</code>, libraries, downloads and every volume the application declares are listed." },
+              { "title": "Location", "body": "Each path is placed on a disk of the container or on an existing host directory." },
+              { "title": "Storage and size", "body": "A container disk is created on a Proxmox VE storage, <code>local-lvm</code> by default, with the size given. It appears as <code>vm-VMID-disk-N</code> and is attached as <code>mpN</code>." },
+              { "title": "Host directory", "body": "A host directory is given by its path. A directory that does not exist is created, owned by the user the container maps." },
+              { "title": "Additional paths", "body": "More pairs of host path or volume and container path can be added before installing." },
+              { "title": "Summary", "body": "The complete mapping is shown before the CT is created and is stored in its instance contract." }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "options",
+      "title": "The two persistent locations",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Property", "Container disk", "Host directory"],
+            "rows": [
+              ["In the configuration", "<code>mpN: STORAGE:vm-VMID-disk-N,mp=/config,backup=1,size=16G</code>", "<code>mpN: /mnt/oci-shared/media,mp=/data/media</code>"],
+              ["Container backup (vzdump)", "Included, with <code>backup=1</code>", "Not included"],
+              ["Size", "Fixed; grown with a resize of the mount point", "The free space of the host filesystem or dataset"],
+              ["Other containers", "Mounted only by its own container", "The same directory can be mounted in several containers"],
+              ["Snapshots and restore", "Managed by Proxmox VE together with the CT", "Managed on the host storage"],
+              ["Removing the application", "Deleted with the container", "Kept, with its content"],
+              ["Moving the CT to another node", "Moves with the CT", "The same path has to exist on the other node"]
+            ]
+          }
+        },
+        {
+          "p": "The rootfs is reserved for the binaries and the content of the image. An update or a recreation replaces it without touching either kind of mount point."
+        }
+      ]
+    },
+    {
+      "id": "example",
+      "title": "Example: a container with both locations",
+      "blocks": [
+        {
+          "code": {
+            "title": "Jellyfin installed as CT 151 on local-lvm (excerpt)",
+            "code": "rootfs: local-lvm:vm-151-disk-0,size=8G\n# Container disk, part of the CT backup\nmp0: local-lvm:vm-151-disk-1,mp=/config,backup=1,size=16G\n\n# Host directory, outside the CT backup\nmp1: /mnt/oci-shared/media,mp=/data/media"
+          }
+        },
+        {
+          "p": "An update or a recreation replaces only the rootfs: <code>mp0</code> keeps users, libraries and settings, and <code>mp1</code> keeps showing the same media. Restoring the CT backup brings back <code>/config</code>; the media directory is restored, if needed, from the backup of the host storage."
+        },
+        {
+          "flow": {
+            "nodes": [
+              { "label": "Contract", "detail": "/config" },
+              { "label": "Location", "detail": "container disk\nor host directory" },
+              { "label": "LXC", "detail": "always /config\nfor the application" }
+            ],
+            "caption": "The application sees the path the image publishes; only where it is stored changes."
+          }
+        }
+      ]
+    },
+    {
+      "id": "shared",
+      "title": "One host directory, several containers",
+      "blocks": [
+        {
+          "mermaid": {
+            "chartCode": "flowchart TB\n H[\"{{host}}<br/>/mnt/oci-shared/media\"]\n H --> Q[\"qBittorrent<br/>/data\"]\n H --> J[\"Jellyfin<br/>/data\"]\n H --> R[\"Radarr / Sonarr<br/>/data\"]\n Q -. \"{{config}}\" .-> QV[(\"/config mpN\")]\n J -. \"{{config}}\" .-> JV[(\"/config mpN\")]\n R -. \"{{config}}\" .-> RV[(\"/config mpN\")]",
+            "labels": { "host": "Host directory", "config": "own configuration" }
+          }
+        },
+        {
+          "p": "Each container keeps its configuration on its own disk. The library or the downloads are one host directory mounted at the same internal path in every container, so a path that one application writes is the same path another one reads."
+        }
+      ]
+    },
+    {
+      "id": "rclone",
+      "title": "Cloud storage through the Rclone application",
+      "intro": "The Rclone application of the catalog offers, besides its installation, <strong>Enable a mount on an existing Rclone OCI container</strong>. It mounts a remote already created and authorised in the Rclone web UI and publishes it on the host, where other containers can use it as a host directory.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              { "title": "Container and remote", "body": "The VMID of the Rclone container, the exact name of the remote and, optionally, a path inside it." },
+              { "title": "Mount name and cache", "body": "The name of the mount and the VFS cache mode: <code>off</code>, <code>minimal</code>, <code>writes</code> or <code>full</code> (default)." },
+              { "title": "Published views", "body": "A common root, <code>/mnt/oci-shared</code> by default, holds a read/write view in <code>/mnt/oci-shared/remotes/NAME</code> and a read-only view in <code>/mnt/oci-shared/remotes-ro/NAME</code>." },
+              { "title": "Activation", "body": "After a confirmation, the CT is stopped, its start command and a Proxmox VE hookscript are set, and it is started again. The operation waits until both views are mounted on the host." }
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "If the mount does not come up",
+            "body": "The previous configuration of the container is restored and it is started again, so a failed activation leaves Rclone as it was."
+          }
+        }
+      ]
+    },
+    {
+      "id": "network",
+      "title": "Addresses and networks",
+      "intro": "A single application needs an address. A multi-container application also needs a stable network between its members.",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              { "icon": "network", "title": "Single application", "body": "Bridge and DHCP or a fixed CIDR address are chosen. The LXC has an address of its own and the summary shows the complete URLs of the services." },
+              { "icon": "waypoints", "title": "Multi-container application", "body": "A free subnet is found, a persistent private bridge is created and each member (application, database, cache) gets a fixed address on it." }
+            ]
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              { "label": "LAN", "detail": "reachable address\nmain service only" },
+              { "label": "Main LXC", "detail": "web / API\nLAN + private network" },
+              { "label": "Private network", "detail": "PostgreSQL · Valkey · ML\nfixed addresses" }
+            ],
+            "caption": "Dependencies talk over the private network and have no address on the LAN."
+          }
+        },
+        {
+          "p": "The stack contract stores bridge, subnet, addresses and the relations between services. Updating or recreating a member reuses the same topology. ProxMenux Monitor opens the main container at its LAN address, not at its address on the private network."
+        }
+      ]
+    },
+    {
+      "id": "ownership",
+      "title": "Ownership",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "New directories are created with the UID and GID the unprivileged LXC maps.",
+              "Existing directories are not re-owned recursively.",
+              "Sockets, system files and sensitive paths are not offered as generic host directories."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "backup",
+      "title": "What a container backup contains",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Element", "In the CT vzdump", "Where it is kept"],
+            "rows": [
+              ["OCI rootfs", "Yes", "The CT backup; it can also be rebuilt from the image and the contract"],
+              ["Container disk with <code>backup=1</code>", "Yes", "The CT backup"],
+              ["Host directory", "No", "The backup of the host storage"],
+              ["Instance contract", "No", "<code>/usr/local/share/proxmenux/oci/instances/VMID/</code> on the host"],
+              ["Multi-container application", "Each member in its own backup", "The backups of every member, plus the stack contract and its bridge on the host"]
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/en/docs/settings/change-language.json b/web/messages/en/docs/settings/change-language.json
index d11e6c8b..782fd5ae 100644
--- a/web/messages/en/docs/settings/change-language.json
+++ b/web/messages/en/docs/settings/change-language.json
@@ -64,7 +64,7 @@
     "heading": "How it works under the hood",
     "items": [
       "Dialog menu lists the 6 codes; you pick one.",
-      "If <code>config.json</code> exists: <code>jq --arg lang \"$new_language\" '.language = $lang'</code> updates the field in place.",
+      "If <code>config.json</code> exists: <code>jq --arg lang \"$new_language\" '.language = $lang''</code> updates the field in place.",
       "If <code>config.json</code> doesn't exist: a fresh one is created with the language code in a single-field object.",
       "Confirmation dialog: <em>\"Language changed to [code]\"</em>.",
       "<code>exec bash config_menu.sh</code> reloads the Settings menu with the new language active."
diff --git a/web/messages/es/common.json b/web/messages/es/common.json
index f8bf030b..129e4680 100644
--- a/web/messages/es/common.json
+++ b/web/messages/es/common.json
@@ -71,10 +71,26 @@
       "dashboardSecurity": "Pestaña Seguridad",
       "dashboardSettings": "Pestaña Ajustes",
       "healthMonitor": "Monitor de salud",
+      "auditReport": "Auditoría e informes",
+      "auditReportOverview": "Resumen",
+      "auditReportAssessment": "Evaluación e inventario",
+      "auditReportPolicy": "Política",
+      "auditReportChanges": "Cambios",
+      "auditReportReports": "Informes y comparaciones",
+      "auditReportScope": "Alcance y garantías",
       "notifications": "Notificaciones",
       "aiAssistant": "Asistente de IA",
       "apiReference": "Referencia API",
       "integrations": "Integraciones",
+      "ociManager": "OCI manager Apps",
+      "ociOverview": "Resumen",
+      "ociArchitecture": "Cómo se traduce una imagen OCI",
+      "ociCustomImage": "Imagen fuera del catálogo",
+      "ociStorageNetwork": "Datos, rutas y red",
+      "ociHardware": "Dispositivos y aceleración",
+      "ociStacks": "Aplicaciones multicontenedor",
+      "ociLifecycle": "Instalar, actualizar y recrear",
+      "ociMonitor": "En ProxMenux Monitor",
       "proxmenuxScripts": "ProxMenux Scripts",
       "postInstallScript": "Script Post-instalación",
       "postInstallOverview": "Resumen",
diff --git a/web/messages/es/docs/monitor/api-reference.json b/web/messages/es/docs/monitor/api-reference.json
index aef3f56a..b2906347 100644
--- a/web/messages/es/docs/monitor/api-reference.json
+++ b/web/messages/es/docs/monitor/api-reference.json
@@ -157,12 +157,12 @@
       {
         "endpoint": "/api/vms/<vmid>/control",
         "method": "POST",
-        "use": "Encender / apagar / apagar limpio / reiniciar una VM o contenedor LXC (las mismas operaciones que expone la modal VM & LXC del Monitor). Body: {\"action\": \"start|stop|shutdown|reboot\"}. Síncrono — devuelve el resultado directo sin necesidad de polling."
+        "use": "Encender / apagar / apagar limpio / reiniciar una VM o contenedor LXC (las mismas operaciones que expone la modal VM & LXC del Monitor). El cuerpo lleva <code>action</code>: <code>start</code>, <code>stop</code>, <code>shutdown</code> o <code>reboot</code>. Síncrono — devuelve el resultado directo sin necesidad de polling."
       },
       {
         "endpoint": "/api/vms/<vmid>/backup",
         "method": "POST",
-        "use": "Crear un backup vzdump de una VM o LXC. Body (todo opcional excepto cuando los defaults no encajan con tu layout de storage): {\"storage\": \"<pve-storage>\", \"mode\": \"snapshot|suspend|stop\", \"compress\": \"zstd|lzo|gz|none\", \"protected\": true, \"notes\": \"…\", \"notification\": \"auto|always|failure|never\", \"pbs_change_detection\": \"default|legacy|data\"}. Devuelve el UPID de la tarea PVE."
+        "use": "Crear un backup vzdump de una VM o LXC. Campos del cuerpo, todos opcionales salvo cuando los valores por defecto no encajan con la distribución del almacenamiento: <code>storage</code> (un almacenamiento de PVE), <code>mode</code> (<code>snapshot</code>, <code>suspend</code> o <code>stop</code>), <code>compress</code> (<code>zstd</code>, <code>lzo</code>, <code>gz</code> o <code>none</code>), <code>protected</code> (<code>true</code> o <code>false</code>), <code>notes</code>, <code>notification</code> (<code>auto</code>, <code>always</code>, <code>failure</code> o <code>never</code>) y <code>pbs_change_detection</code> (<code>default</code>, <code>legacy</code> o <code>data</code>). Devuelve el UPID de la tarea PVE."
       },
       {
         "endpoint": "/api/vms/<vmid>/backups",
diff --git a/web/messages/es/docs/monitor/audit-report/assessment.json b/web/messages/es/docs/monitor/audit-report/assessment.json
new file mode 100644
index 00000000..ca43cf02
--- /dev/null
+++ b/web/messages/es/docs/monitor/audit-report/assessment.json
@@ -0,0 +1,146 @@
+{
+  "meta": {
+    "title": "Evaluación e inventario | Auditoría e informes",
+    "description": "La evaluación de Auditoría e informes: perfiles de informe, clasificación de los resultados, riesgos aceptados, fuentes ilegibles, Lynis e inventario del nodo."
+  },
+  "header": {
+    "title": "Evaluación e inventario",
+    "description": "La evaluación inspecciona el nodo, conserva sus hallazgos y responde a preguntas distintas según el perfil de informe.",
+    "section": "Auditoría e informes"
+  },
+  "sections": [
+    {
+      "id": "read-only",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Una evaluación inspecciona; no cambia la configuración",
+            "body": "Lee la configuración y el estado del host. Escribe sus resultados, informes y logs, y las comprobaciones de arranque pueden montar un momento las particiones de sistema EFI. La configuración que evalúa no se modifica."
+          }
+        },
+        {
+          "p": "<strong>Ejecutar evaluación</strong> inicia una ejecución con el perfil seleccionado en <strong>Informe</strong>. La vista muestra la fecha de la última ejecución y cuánto tiempo ha pasado."
+        }
+      ]
+    },
+    {
+      "id": "profiles",
+      "title": "Perfiles de informe",
+      "intro": "Cada perfil responde a una pregunta distinta. Las comprobaciones y las secciones se seleccionan antes de componer el documento.",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Perfil", "Qué abarca"],
+            "rows": [
+              ["Auditoría completa", "Todas las comprobaciones y toda la estructura disponible."],
+              ["Diagnóstico rápido", "Todas las comprobaciones; el resultado empieza por los hallazgos críticos, las advertencias y las lecturas que no pudieron verificarse."],
+              ["Inventario", "Una descripción del nodo, sin comprobaciones ni clasificación."],
+              ["Revisión de seguridad", "Exposición, acceso, privilegios, certificados, actualizaciones, repositorios y Lynis."],
+              ["Garantía de backups", "Cobertura, antigüedad, resultados, verificación, retención y recuperación de los backups."],
+              ["Capacidad y desgaste", "Margen de crecimiento, memoria, ocupación y vida útil de los discos."]
+            ]
+          }
+        },
+        {
+          "p": "El contenido de cada documento se describe en <reportsLink>Informes y comparaciones</reportsLink>."
+        }
+      ]
+    },
+    {
+      "id": "results",
+      "title": "Cómo se clasifican los resultados",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Clasificación", "Significado"],
+            "rows": [
+              ["Crítico", "Una condición fallida con prioridad."],
+              ["Advertencia", "Una condición que requiere revisión, según la evidencia o la política."],
+              ["Observación", "Información sobre el nodo que no se presenta como fallo."],
+              ["Sin verificar", "La fuente que necesita la comprobación no pudo leerse. No significa que el problema no exista."],
+              ["Conforme", "La condición cumple el criterio aplicado."],
+              ["No aplicable", "Dentro del alcance de la comprobación no hay nada a lo que aplicarla."],
+              ["Riesgo aceptado", "El hallazgo existe y hay registrada una decisión sobre él."],
+              ["Excluido por política", "La política declara que el elemento queda fuera del recuento."]
+            ]
+          }
+        },
+        {
+          "p": "Los hallazgos pueden filtrarse por área: Sistema, Almacenamiento, Red, Seguridad, Backups, Invitados y Hardware. Cada hallazgo conserva su evidencia, con la fuente de la que se leyó."
+        }
+      ]
+    },
+    {
+      "id": "unverified",
+      "title": "Cuando una fuente no puede leerse",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Caso", "Comportamiento"],
+            "rows": [
+              ["Sin verificar", "La comprobación conserva su identidad, indica en su evidencia qué fuente falló y no convierte la falta de datos en un resultado conforme."],
+              ["Evidencia incompleta", "El informe nombra la fuente y el momento de la recogida, de modo que un problema real puede distinguirse de una lectura insuficiente."],
+              ["Una nueva ejecución", "Una vez corregido el acceso, el paquete o el servicio, el mismo perfil se ejecuta de nuevo y la comparación muestra si el resultado pudo verificarse."]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "lynis",
+      "title": "Lynis",
+      "blocks": [
+        {
+          "p": "La revisión de seguridad usa el informe de Lynis del host. Cuando Lynis no se ha ejecutado todavía, o su informe supera el umbral de antigüedad de la política, un diálogo ofrece <strong>Ejecutar con Lynis</strong>, que tarda unos minutos más, o <strong>Ejecutar sin Lynis</strong>, que usa el informe existente."
+        },
+        {
+          "figure": {
+            "src": "/monitor/audit/lynis-dialog.png",
+            "alt": "Diálogo que ofrece ejecutar la evaluación con o sin Lynis",
+            "caption": "El diálogo de Lynis antes de una revisión de seguridad."
+          }
+        }
+      ]
+    },
+    {
+      "id": "accept",
+      "title": "Aceptar un riesgo",
+      "blocks": [
+        {
+          "p": "<strong>Aceptar riesgo</strong> registra una decisión sobre un hallazgo. El motivo es obligatorio y se guarda junto al autor y la fecha."
+        },
+        {
+          "table": {
+            "headers": ["Campo", "Opciones"],
+            "rows": [
+              ["Motivo", "Texto libre, obligatorio."],
+              ["Deja de aplicarse tras", "90 días, 180 días, 1 año o no caduca. Al cumplirse el plazo, el hallazgo vuelve a estar activo."],
+              ["Recordarme revisarla", "Un recordatorio que devuelve la decisión a la atención mientras sigue en vigor."]
+            ]
+          }
+        },
+        {
+          "p": "Un hallazgo aceptado sigue visible con su decisión, y <strong>Volver a activo</strong> la revoca. Un riesgo aceptado no es una corrección: la comparación lo presenta como aceptado, no como resuelto."
+        }
+      ]
+    },
+    {
+      "id": "inventory",
+      "title": "Inventario",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Identidad, versión de Proxmox VE, kernel, suscripción y clúster.",
+              "CPU, memoria, placa, BIOS, controladoras e IOMMU.",
+              "Discos, SMART, horas de funcionamiento y eventos registrados.",
+              "Adaptadores, bonds, bridges, latencia y conexiones.",
+              "Almacenamiento, invitados con sus discos e interfaces, y backups.",
+              "Passthrough PCI y el software que gestiona ProxMenux."
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/es/docs/monitor/audit-report/changes.json b/web/messages/es/docs/monitor/audit-report/changes.json
new file mode 100644
index 00000000..9c6d4364
--- /dev/null
+++ b/web/messages/es/docs/monitor/audit-report/changes.json
@@ -0,0 +1,148 @@
+{
+  "meta": {
+    "title": "Cambios | Auditoría e informes",
+    "description": "El registro de cambios de Auditoría e informes: qué ha cambiado ProxMenux en el host, qué había antes, la diferencia y si puede deshacerse."
+  },
+  "header": {
+    "title": "Cambios",
+    "description": "El registro de las operaciones que ProxMenux realiza en el host y, cuando se capturó, el estado antes y después de cada una.",
+    "section": "Auditoría e informes"
+  },
+  "sections": [
+    {
+      "id": "purpose",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Del script que se ejecutó al cambio que hizo",
+            "body": "Una función extensa puede cambiar solo dos líneas. El registro conserva cada operación concreta con el script, la función y la versión responsables, el recurso afectado, la diferencia y si puede deshacerse."
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              { "label": "Script", "detail": "función + versión" },
+              { "label": "Captura", "detail": "contenido previo" },
+              { "label": "Operación", "detail": "archivo · paquete · servicio" },
+              { "label": "Registro", "detail": "atribución + diferencia" }
+            ],
+            "caption": "La captura se toma al ejecutarse la operación y se consolida cuando el Monitor lee el registro."
+          }
+        },
+        {
+          "figure": {
+            "src": "/monitor/audit/changes-view.png",
+            "alt": "Vista Cambios de Auditoría e informes con las entradas agrupadas por opción de post-install y por script",
+            "caption": "La vista Cambios, con la diferencia de un archivo editado por ProxMenux."
+          }
+        }
+      ]
+    },
+    {
+      "id": "types",
+      "title": "Tipos de entrada",
+      "intro": "El filtro de la parte superior separa las entradas por tipo.",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Tipo", "Qué registra"],
+            "rows": [
+              ["Configuración", "ProxMenux escribió, editó o eliminó un archivo, cambió un ajuste o alteró un servicio."],
+              ["Instalaciones", "ProxMenux añadió un paquete o componente, y se registran los paquetes que aparecieron realmente."],
+              ["Ejecuciones", "ProxMenux ejecutó un comando; lo que cambió depende del propio comando."],
+              ["Aplicado", "Una función se aplicó antes de que existiera el registro; el estado previo no se capturó."]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "groups",
+      "title": "Cómo se organiza la vista",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Sección", "Contenido"],
+            "rows": [
+              ["Optimizaciones de post-install", "Agrupadas por la opción de post-install que seleccionó el usuario."],
+              ["Scripts de ProxMenux", "GPU, Coral, red, almacenamiento, seguridad, utilidades y el resto de scripts instrumentados, incluidos el instalador de ProxMenux y ProxMenux Monitor."],
+              ["Paquetes y utilidades instalados", "Software que ProxMenux instaló en el host."]
+            ]
+          }
+        },
+        {
+          "p": "Dentro de cada sección, <strong>Por función</strong> agrupa las entradas bajo la función que las hizo."
+        }
+      ]
+    },
+    {
+      "id": "entry",
+      "title": "Qué muestra cada entrada",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "El script, la función y la versión responsables.",
+              "La fecha y el recurso afectado.",
+              "El estado conocido antes y después del cambio.",
+              "Las líneas añadidas y eliminadas.",
+              "Los paquetes que se añadieron realmente.",
+              "La transición de estado de un servicio.",
+              "<strong>Deshacer esto</strong>: <em>Restaura exactamente lo que había</em>, <em>Elimina el fichero (no había ninguno antes)</em>, <em>Se puede desinstalar el paquete</em>, un deshacer parcial o <em>No se puede deshacer desde el registro</em>."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "before",
+      "title": "Qué significa el estado previo",
+      "blocks": [
+        {
+          "p": "El estado previo puede ser contenido capturado, un archivo creado por primera vez o un estado desconocido. Los cambios hechos antes de que existiera el registro no pueden reconstruirse; al volver a ejecutar la función se captura primero el estado encontrado en ese momento."
+        }
+      ]
+    },
+    {
+      "id": "limits",
+      "title": "Alcance del registro",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Los cambios manuales y los de otro software no se registran.",
+              "Solo se cubren las operaciones que pasan por las primitivas de auditoría de ProxMenux.",
+              "El registro nunca bloquea la operación que describe: si la entrada no puede escribirse, la operación continúa.",
+              "Los cambios sucesivos de un mismo recurso se muestran como el origen conocido frente al estado actual."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "retention",
+      "title": "Evidencia guardada",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Elemento", "Comportamiento"],
+            "rows": [
+              ["Entradas", "Se conservan en el host; del registro no se elimina nada automáticamente."],
+              ["Contenido capturado", "Un objeto capturado se conserva mientras alguna entrada lo referencia."],
+              ["Tamaño de una captura", "El contenido de más de 1 MiB no se guarda entero; la entrada registra que la captura se omitió por su tamaño."],
+              ["Lectura", "El Monitor no carga objetos guardados de más de 2 MiB."],
+              ["Diferencia", "Se muestran como máximo 400 líneas, y una diferencia más larga se marca como truncada."],
+              ["Listado", "La API devuelve 200 entradas por petición por defecto y hasta 1000."]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Conservar el contenido no es deshacer automáticamente",
+            "body": "El contenido previo a un cambio puede consultarse y restaurarse a mano, pero la vista Cambios no revierte operaciones. Una entrada de ejecución registra el comando sin conocer todos los efectos de la herramienta que ejecutó."
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/es/docs/monitor/audit-report/index.json b/web/messages/es/docs/monitor/audit-report/index.json
new file mode 100644
index 00000000..520624fe
--- /dev/null
+++ b/web/messages/es/docs/monitor/audit-report/index.json
@@ -0,0 +1,83 @@
+{
+  "meta": {
+    "title": "Auditoría e informes | ProxMenux Monitor",
+    "description": "Evaluación de un nodo Proxmox VE, registro de lo que ProxMenux ha cambiado en él y declaración de lo que se espera de sus invitados y almacenamientos, con informes imprimibles."
+  },
+  "header": {
+    "title": "Auditoría e informes",
+    "description": "Una evaluación del nodo, el registro de lo que ProxMenux ha cambiado en él y la declaración de lo que se espera de él, con documentos que pueden imprimirse o guardarse como PDF.",
+    "section": "ProxMenux Monitor"
+  },
+  "sections": [
+    {
+      "id": "views",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Tres vistas, tres preguntas",
+            "body": "Auditoría e informes separa los hechos del nodo, las intervenciones de ProxMenux y las expectativas declaradas para él. Una configuración que la evaluación no puede contrastar con una finalidad declarada se describe, no se presenta como un fallo."
+          }
+        },
+        {
+          "cards": {
+            "items": [
+              { "icon": "shield", "title": "Evaluación: ¿cómo está el nodo?", "body": "Ejecuta las comprobaciones del perfil elegido, compone el inventario y clasifica lo que requiere atención, con la evidencia de cada resultado." },
+              { "icon": "refresh", "title": "Cambios: ¿qué ha hecho ProxMenux?", "body": "Enumera los archivos, paquetes, servicios y comandos que han cambiado los scripts instrumentados de ProxMenux, con lo que había antes cuando se capturó." },
+              { "icon": "fileText", "title": "Política: ¿qué se espera?", "body": "Declara qué invitados necesitan backup o deben arrancar con el host, qué almacenamiento es esencial y los umbrales de las comprobaciones." }
+            ]
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              { "label": "Evaluación", "detail": "hechos" },
+              { "label": "Política", "detail": "contexto" },
+              { "label": "Cambios", "detail": "intervenciones" }
+            ],
+            "caption": "La evaluación aporta los hechos, la política les da contexto y el registro recoge lo que ha hecho ProxMenux."
+          }
+        },
+        {
+          "figure": {
+            "src": "/monitor/audit/assessment-view.png",
+            "alt": "Auditoría e informes en ProxMenux Monitor con las vistas Evaluación, Cambios y Política",
+            "caption": "Auditoría e informes, con la vista Evaluación abierta."
+          }
+        }
+      ]
+    },
+    {
+      "id": "boundaries",
+      "title": "Tres funciones distintas",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Función", "Qué hace"],
+            "rows": [
+              ["<healthLink>Health Monitor</healthLink>", "Observa métricas y eventos de forma continua y puede generar notificaciones."],
+              ["Auditoría e informes", "Ejecuta una evaluación cuando se pide, documenta el nodo y compara ejecuciones entre sí."],
+              ["Registro de cambios", "Registra las operaciones que ProxMenux realiza a través de sus primitivas de auditoría."]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "pages",
+      "title": "Páginas de esta sección",
+      "blocks": [
+        {
+          "next": {
+            "items": [
+              { "label": "Evaluación e inventario", "href": "/docs/monitor/audit-report/assessment", "tail": "perfiles, resultados, riesgos aceptados e inventario." },
+              { "label": "Cambios", "href": "/docs/monitor/audit-report/changes", "tail": "el registro de lo que ProxMenux ha cambiado en el host." },
+              { "label": "Política", "href": "/docs/monitor/audit-report/policy", "tail": "invitados, almacenamiento y umbrales." },
+              { "label": "Informes y comparaciones", "href": "/docs/monitor/audit-report/reports", "tail": "los seis documentos y la ejecución de referencia." },
+              { "label": "Alcance y garantías", "href": "/docs/monitor/audit-report/scope", "tail": "fuentes, límites y datos guardados." }
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/es/docs/monitor/audit-report/policy.json b/web/messages/es/docs/monitor/audit-report/policy.json
new file mode 100644
index 00000000..e15244d7
--- /dev/null
+++ b/web/messages/es/docs/monitor/audit-report/policy.json
@@ -0,0 +1,95 @@
+{
+  "meta": {
+    "title": "Política | Auditoría e informes",
+    "description": "La política del nodo en Auditoría e informes: backup, arranque y objetivo de recuperación de cada invitado, el papel de cada almacenamiento y los umbrales de las comprobaciones."
+  },
+  "header": {
+    "title": "Política",
+    "description": "La política declara lo que ninguna inspección puede deducir: para qué sirve cada invitado y almacenamiento y los umbrales que aplican las comprobaciones.",
+    "section": "Auditoría e informes"
+  },
+  "sections": [
+    {
+      "id": "principle",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Sin declaración, el informe describe; con ella, evalúa",
+            "body": "Una evaluación ve lo que hace el host, no para qué sirve. Un invitado sin backup cuya finalidad no está declarada se presenta como observación. Si su backup se declara obligatorio, la misma ausencia se presenta como advertencia. No es obligatorio declarar nada."
+          }
+        },
+        {
+          "figure": {
+            "src": "/monitor/audit/policy-view.png",
+            "alt": "Vista Política con los invitados, el almacenamiento y los umbrales del nodo",
+            "caption": "La vista Política."
+          }
+        }
+      ]
+    },
+    {
+      "id": "guests",
+      "title": "Invitados",
+      "intro": "Cada VM y LXC del nodo tiene tres campos. Un valor que se deja por defecto toma el valor general, que se muestra a su lado.",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Campo", "Valores", "Efecto en la evaluación"],
+            "rows": [
+              ["Backup", "Obligatorio, No obligatorio, Sin especificar", "La falta de backup es una advertencia si es obligatorio, una observación si no se especifica, y queda fuera del recuento si no es obligatorio."],
+              ["Arranque", "Obligatorio, No obligatorio, Sin especificar", "Si el invitado debe arrancar con el host."],
+              ["Objetivo de recuperación", "Horas", "La antigüedad máxima aceptable del último backup."]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "storage",
+      "title": "Almacenamiento",
+      "intro": "Cada almacenamiento del nodo se declara Esencial, Opcional o Sin especificar.",
+      "blocks": [
+        {
+          "p": "Un almacenamiento inaccesible se presenta como crítico cuando se declara esencial o sirve a un invitado en marcha, como advertencia cuando su papel no se especifica, y como observación cuando se declara opcional."
+        }
+      ]
+    },
+    {
+      "id": "thresholds",
+      "title": "Umbrales",
+      "intro": "Un umbral vacío usa el valor de fábrica, que se muestra como texto de ejemplo.",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Revisión de capacidad de almacenamiento (%) y revisión de ocupación de thin pool (%).",
+              "Ratio de sobreaprovisionamiento thin y ratio de sobreasignación de memoria.",
+              "Intervalo de scrub de ZFS (días).",
+              "Plazo de respaldo para la antigüedad (días) y margen sobre el calendario (ratio).",
+              "Aviso de caducidad de certificado (días).",
+              "Vida útil del disco (horas) y ventana de errores de disco recientes (días).",
+              "Antigüedad del informe de Lynis (días) y antigüedad de los índices de paquetes (días).",
+              "Journal frente a su tope (%).",
+              "Revisión de espacio del sistema de archivos (%) y revisión de inodos del sistema de archivos (%)."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "save",
+      "title": "Cómo se guarda la política",
+      "blocks": [
+        {
+          "p": "La declaración se valida y se guarda de forma atómica en <code>/usr/local/share/proxmenux/audit_policy.json</code>. Cada guardado lleva una revisión: si la declaración cambió en otra sesión, el borrador no se guarda y la vista ofrece recargar la declaración guardada."
+        },
+        {
+          "calloutWarning": {
+            "title": "La política nunca se deduce",
+            "body": "ProxMenux no añade ningún requisito por su cuenta. Un campo vacío conserva el valor de fábrica o queda sin especificar, y una declaración parcial solo afecta a los elementos que nombra."
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/es/docs/monitor/audit-report/reports.json b/web/messages/es/docs/monitor/audit-report/reports.json
new file mode 100644
index 00000000..07b63261
--- /dev/null
+++ b/web/messages/es/docs/monitor/audit-report/reports.json
@@ -0,0 +1,160 @@
+{
+  "meta": {
+    "title": "Informes y comparaciones | Auditoría e informes",
+    "description": "Los seis documentos de Auditoría e informes, cómo se imprimen o guardan como PDF y cómo se comparan las ejecuciones con una ejecución de referencia."
+  },
+  "header": {
+    "title": "Informes y comparaciones",
+    "description": "Seis documentos, cada uno compuesto para una pregunta distinta, y la comparación de cada ejecución con una ejecución de referencia.",
+    "section": "Auditoría e informes"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Seis documentos, no seis estilos",
+            "body": "El motor selecciona las comprobaciones y las secciones antes de componer el documento. Un diagnóstico rápido no es una auditoría completa con menos páginas, y un inventario no presenta resultados de evaluación. Los documentos de muestra usan datos ficticios."
+          }
+        }
+      ]
+    },
+    {
+      "id": "documents",
+      "title": "Los seis documentos",
+      "blocks": [
+        {
+          "downloads": {
+            "items": [
+              {
+                "title": "Auditoría completa",
+                "body": "Documenta el nodo de extremo a extremo como registro técnico.",
+                "href": "/monitor/audit/sample-audit-full-report.pdf",
+                "facts": [
+                  { "label": "Comprobaciones", "value": "Todas las disponibles." },
+                  { "label": "Contenido", "value": "Resumen ejecutivo; identidad y clúster; hardware; red y latencia; almacenamiento; invitados; passthrough; aplicaciones; hallazgos con evidencia; fuentes y alcance." }
+                ]
+              },
+              {
+                "title": "Diagnóstico rápido",
+                "body": "Muestra lo que requiere atención sin el inventario completo.",
+                "href": "/monitor/audit/sample-audit-diagnostic-report.pdf",
+                "facts": [
+                  { "label": "Comprobaciones", "value": "Las mismas que la auditoría completa." },
+                  { "label": "Contenido", "value": "Identidad mínima; hallazgos críticos; advertencias; observaciones relevantes; lecturas sin verificar y acciones prioritarias. Deja fuera diagramas, inventario y anexos extensos." }
+                ]
+              },
+              {
+                "title": "Inventario",
+                "body": "Describe lo que existe en el nodo sin evaluarlo.",
+                "href": "/monitor/audit/sample-audit-inventory-report.pdf",
+                "facts": [
+                  { "label": "Comprobaciones", "value": "Ninguna; no se clasifica ningún hallazgo." },
+                  { "label": "Contenido", "value": "Identidad; clúster; CPU y memoria; placa, BIOS y controladoras; red; almacenamiento; VM y LXC; passthrough; aplicaciones y elementos gestionados por ProxMenux." }
+                ]
+              },
+              {
+                "title": "Revisión de seguridad",
+                "body": "Abarca la exposición y los controles de acceso al nodo.",
+                "href": "/monitor/audit/sample-audit-security-report.pdf",
+                "facts": [
+                  { "label": "Comprobaciones", "value": "El área de seguridad, más los privilegios de los contenedores, las actualizaciones, los repositorios y la cadena APT." },
+                  { "label": "Contenido", "value": "Identidad y clúster; red y latencia; acceso; cortafuegos; 2FA; certificados; privilegios; actualizaciones; repositorios; estado y antigüedad de Lynis." }
+                ]
+              },
+              {
+                "title": "Garantía de backups",
+                "body": "Comprueba que la protección declarada existe y que sus backups son utilizables.",
+                "href": "/monitor/audit/sample-audit-backup-report.pdf",
+                "facts": [
+                  { "label": "Comprobaciones", "value": "El área de backups, más la conectividad del almacenamiento y la entrega de notificaciones." },
+                  { "label": "Contenido", "value": "Cobertura por invitado; objetivo de recuperación declarado; antigüedad y resultado; destino; retención; verificación; trabajos fallidos; recuperación y fuentes incompletas." }
+                ]
+              },
+              {
+                "title": "Capacidad y desgaste",
+                "body": "Mide el margen de crecimiento y las señales de agotamiento o envejecimiento.",
+                "href": "/monitor/audit/sample-audit-capacity-report.pdf",
+                "facts": [
+                  { "label": "Comprobaciones", "value": "Las áreas de almacenamiento y hardware, más memoria, swap, journal y el sistema de archivos del host." },
+                  { "label": "Contenido", "value": "Ocupación y umbrales; thin pools; sobreaprovisionamiento; memoria; inodos; ZFS; temperaturas; horas de funcionamiento; errores SMART y vida útil de NVMe/SSD." }
+                ]
+              }
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/monitor/audit/audit-report-preview.png",
+            "alt": "Primera página de un informe de auditoría completa",
+            "caption": "Todos los documentos comparten el identificador del informe, las secciones numeradas, la fecha, el nodo, el perfil y el pie de página."
+          }
+        },
+        {
+          "p": "Un documento contiene la identidad del nodo y la fecha de la evaluación, el resultado ejecutivo, un resumen por áreas, la estructura de hardware, red y almacenamiento, la protección de los invitados, los hallazgos con su evidencia, las fuentes que no pudieron leerse, y el alcance y la política aplicada, en la medida en que cada perfil los incluye."
+        }
+      ]
+    },
+    {
+      "id": "print",
+      "title": "Imprimir o guardar como PDF",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              { "title": "Ejecutar", "body": "Una evaluación se ejecuta con el perfil seleccionado en <strong>Informe</strong>." },
+              { "title": "Revisar", "body": "La ejecución terminada muestra sus hallazgos, las fuentes que no pudo leer y la política que aplicó." },
+              { "title": "Generar informe", "body": "<strong>Generar informe</strong> abre la vista preparada como documento." },
+              { "title": "Imprimir", "body": "<strong>Imprimir o guardar como PDF</strong> abre el diálogo de impresión del navegador, donde se selecciona una impresora o <em>Guardar como PDF</em>." }
+            ]
+          }
+        },
+        {
+          "calloutTip": {
+            "title": "La impresión es un documento, no una captura",
+            "body": "La barra de acciones se oculta, una tabla que continúa en la página siguiente repite su cabecera, los bloques evitan cortes innecesarios y cada página conserva la identificación y la numeración."
+          }
+        }
+      ]
+    },
+    {
+      "id": "compare",
+      "title": "Comparar con una ejecución de referencia",
+      "intro": "<strong>Usar como referencia</strong> marca una ejecución terminada como referencia. Las ejecuciones posteriores se comparan con ella y sus hallazgos se separan en:",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Grupo", "Significado"],
+            "rows": [
+              ["Nuevos", "Presentes ahora y no antes."],
+              ["Empeoraron", "Siguen presentes, y son más graves o afectan a más que antes."],
+              ["Mejoraron", "Siguen presentes, pero son menos graves o afectan a menos que antes."],
+              ["Resueltos", "Ya no aparecen, y nadie los aceptó."],
+              ["Aceptados", "Ya no cuentan porque se aceptó un riesgo, no porque haya cambiado el host."],
+              ["Ya no se evalúan", "Estaban antes y no aparecen en esta ejecución; nada ha verificado que hayan dejado de existir."]
+            ]
+          }
+        },
+        {
+          "table": {
+            "headers": ["Ejecución de referencia", "Comportamiento"],
+            "rows": [
+              ["Marcarla", "Puede marcarse cualquier ejecución terminada; ninguna se marca automáticamente."],
+              ["Cambiarla", "Marcar otra ejecución mueve la referencia sin borrar el historial."],
+              ["Comparar", "Si no se seleccionan dos ejecuciones, la comparación usa la referencia y la ejecución seleccionada o la más reciente."],
+              ["Conservar ejecuciones", "Se conservan las 30 ejecuciones más recientes, y la ejecución de referencia nunca se elimina."],
+              ["Sin referencia", "La vista indica que todavía no se ha elegido una ejecución de referencia, así que no hay con qué comparar."]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Un informe describe un momento",
+            "body": "Una evaluación no certifica un periodo completo. Los resultados antiguos dejan de describir el estado actual; la vista muestra la antigüedad de la última ejecución y cada fuente conserva el momento en que se recogió."
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/es/docs/monitor/audit-report/scope.json b/web/messages/es/docs/monitor/audit-report/scope.json
new file mode 100644
index 00000000..a63870a3
--- /dev/null
+++ b/web/messages/es/docs/monitor/audit-report/scope.json
@@ -0,0 +1,97 @@
+{
+  "meta": {
+    "title": "Alcance y garantías | Auditoría e informes",
+    "description": "De dónde proceden los datos de Auditoría e informes, qué queda fuera de su alcance, las garantías de su diseño y dónde se guardan sus datos."
+  },
+  "header": {
+    "title": "Alcance y garantías",
+    "description": "De dónde proceden los datos de una evaluación, qué queda fuera de su alcance y dónde guarda Auditoría e informes sus datos.",
+    "section": "Auditoría e informes"
+  },
+  "sections": [
+    {
+      "id": "sees",
+      "title": "Qué observa",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "La configuración y el estado del nodo local.",
+              "La configuración declarada de las VM y los LXC.",
+              "El estado del almacenamiento tal como lo conoce Proxmox VE.",
+              "El historial disponible de backups y verificaciones.",
+              "Los datos SMART y los eventos que ha recogido el Monitor.",
+              "El estado de los servicios, el clúster, HA y las fuentes locales."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "outside",
+      "title": "Qué queda fuera de su alcance",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "El interior de los invitados, más allá de lo que declaran a Proxmox VE.",
+              "El equipamiento de red fuera del host.",
+              "Las dependencias remotas que el nodo no puede observar.",
+              "El estado físico que el hardware no expone.",
+              "Las acciones manuales o de otro software, en el registro de cambios."
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "La ausencia de evidencia no es evidencia de ausencia",
+            "body": "Una fuente que no puede leerse da un resultado sin verificar o incompleto, nunca uno conforme. El informe enumera las fuentes que no estuvieron disponibles."
+          }
+        }
+      ]
+    },
+    {
+      "id": "guarantees",
+      "title": "Garantías del diseño",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Identificadores estables para las comprobaciones.",
+              "Historial de ejecuciones y hallazgos.",
+              "Una política validada y guardada de forma atómica.",
+              "Riesgos aceptados con motivo y visibles.",
+              "Atribución de los cambios al script y a la función.",
+              "Captura del estado anterior y posterior cuando está disponible.",
+              "Un resultado explícito cuando algo no puede medirse o capturarse."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "storage",
+      "title": "Dónde se guardan los datos",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Datos", "Ubicación"],
+            "rows": [
+              ["Política", "<code>/usr/local/share/proxmenux/audit_policy.json</code>"],
+              ["Evaluaciones", "La base de datos de auditoría del Monitor"],
+              ["Objetos capturados", "<code>/usr/local/share/proxmenux/changes/objects/</code>"],
+              ["Entradas pendientes", "<code>/usr/local/share/proxmenux/changes/spool/</code>"],
+              ["Registro consolidado", "<code>/usr/local/share/proxmenux/changes.db</code>"]
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Una herramienta de revisión, no una certificación",
+            "body": "Auditoría e informes revisa, compara y documenta el nodo. Sus resultados se leen junto con la finalidad del sistema, la política declarada y las fuentes disponibles."
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/es/docs/monitor/dashboard/vms-lxcs-app.json b/web/messages/es/docs/monitor/dashboard/vms-lxcs-app.json
index 77b1bddd..08895a8f 100644
--- a/web/messages/es/docs/monitor/dashboard/vms-lxcs-app.json
+++ b/web/messages/es/docs/monitor/dashboard/vms-lxcs-app.json
@@ -96,7 +96,8 @@
       { "method": "docker label / docker exec", "use": "Lee una etiqueta de versión OCI o ejecuta un comando de versión dentro de un contenedor Docker." },
       { "method": "python distribution", "use": "Usa importlib.metadata mediante el intérprete de Python seleccionado." },
       { "method": "command", "use": "Ejecuta un comando avanzado en formato argv, sin shell, y extrae la versión de su salida." },
-      { "method": "manual", "use": "Guarda una versión introducida manualmente; debe cambiarse después de actualizar la app." }
+      { "method": "manual", "use": "Guarda una versión introducida manualmente; debe cambiarse después de actualizar la app." },
+      { "method": "OCI image", "use": "Para contenedores instalados por OCI manager Apps. Lee las versiones de la aplicación y de la imagen del registro de la instalación y compara el digest instalado con el que publica el registro; no necesita configuración." }
     ],
     "sourcesHeading": "Fuentes para la versión disponible",
     "sources": [
diff --git a/web/messages/es/docs/monitor/dashboard/vms-lxcs.json b/web/messages/es/docs/monitor/dashboard/vms-lxcs.json
index dc7a215e..eb46abd8 100644
--- a/web/messages/es/docs/monitor/dashboard/vms-lxcs.json
+++ b/web/messages/es/docs/monitor/dashboard/vms-lxcs.json
@@ -52,8 +52,8 @@
   },
   "drillIn": {
     "heading": "Modal de vista en detalle por guest",
-    "intro": "El modal se abre con el nombre, VMID, tipo, estado y tiempo de actividad del sistema. La navegación se adapta al elemento: <strong>Estado</strong>, <strong>App</strong> y <strong>Actualizaciones</strong> para gestionar aplicaciones LXC, <strong>Montajes</strong> cuando existen puntos de montaje, además de <strong>Copias</strong> y <strong>Cortafuegos</strong>. La barra inferior mantiene los controles de ciclo de vida y el terminal LXC disponibles desde cualquier pestaña.",
-    "statusTitle": "Pestaña 1 — Status",
+    "intro": "El modal se abre con el nombre, VMID, tipo, estado y tiempo de actividad del sistema. La navegación se adapta al elemento: <strong>Estado</strong>, <strong>App</strong> y <strong>Actualizaciones</strong> para gestionar aplicaciones LXC, <strong>Montajes</strong> cuando existen puntos de montaje, <strong>Logs</strong> en los contenedores instalados por OCI manager Apps, además de <strong>Backups</strong> y <strong>Cortafuegos</strong>. La barra inferior mantiene los controles de ciclo de vida y el terminal LXC disponibles desde cualquier pestaña.",
+    "statusTitle": "Pestaña 1 — Estado",
     "statusImageAlt": "Modal de vista en detalle por guest — pestaña Status con tarjetas en vivo de CPU / Memoria / Disco, totales de E/S de disco y red, el logo de distro del SO y el bloque Resources / IP Addresses",
     "statusImageCaption": "Pestaña Status — CPU / Memoria / Disco en vivo con barras de progreso arriba, totales de E/S acumulados (lectura/escritura de disco, descarga/subida de red) abajo, después el bloque estático Resources con expansiones de Notes y + Info y la lista de pastillas IP Addresses.",
     "statusIntro": "La pestaña por defecto — la vista \"¿este guest se está portando?\". Tres bloques:",
@@ -106,7 +106,9 @@
     ],
     "mountsCalloutTitle": "Lo que esto te da sobre la UI nativa",
     "mountsCalloutBody": "Una vista veraz y consciente de la capacidad de cada sitio donde el contenedor lee o escribe. Shares NFS o CIFS montados desde dentro del CT — invisibles para la UI web de Proxmox — aparecen aquí con el mismo aspecto y la misma sonda de salud que cualquier mount point configurado. Mounts remotos stale y zombie binds salen marcados antes de que muerdan durante un backup.",
-    "backupsTitle": "Pestaña 5 — Copias",
+    "logsTitle": "Pestaña 5 — Logs (solo contenedores OCI)",
+    "logsBody": "Solo aparece en los contenedores instalados por OCI manager Apps. Muestra la salida de consola del proceso principal de la imagen, guardada en el host en <code>/var/log/proxmenux/oci/VMID.console.log</code>: las últimas 100, 500 o 1000 líneas, seguidas en directo con el contenedor en marcha, con un filtro y una descarga. Lee el archivo cada vez que se abre, así que también funciona con el contenedor detenido. Los detalles están en <ociLink>Contenedores OCI en ProxMenux Monitor</ociLink>.",
+    "backupsTitle": "Pestaña 6 — Backups",
     "backupsImageAlt": "Modal de vista en detalle por guest — pestaña Backups con la lista de backups disponibles, etiqueta de destino, tamaños y el botón Create Backup",
     "backupsImageCaption": "Pestaña Backups — cada backup almacenado en los almacenamientos Proxmox configurados para este guest, ordenados de más nuevo a más viejo. La cabecera de la pestaña lleva la insignia de recuento.",
     "backupsIntro": "Lista cada backup almacenado en los almacenamientos Proxmox configurados para este guest, ordenados de más nuevo a más viejo. El título de la pestaña lleva una insignia de recuento para que veas de un vistazo si el guest está backupeado. Por fila:",
@@ -116,7 +118,7 @@
       "<strong>Size</strong> — tamaño final en disco del backup."
     ],
     "backupsOutro": "El botón <strong>+ Create Backup</strong> arriba a la derecha arranca una nueva ejecución en el almacenamiento marcado como \"Backup target\" en la config de almacenamiento de Proxmox. El restore vive en la UI web de Proxmox — el Monitor expone la vista \"¿este guest tiene backup reciente?\", no el flujo de recuperación.",
-    "firewallTitle": "Pestaña 6 — Cortafuegos",
+    "firewallTitle": "Pestaña 7 — Cortafuegos",
     "firewallIntro": "Lee el log de firewall de Proxmox por guest directamente del host (sin servicio extra, sin polling). La pestaña siempre está presente en la barra de navegación; el panel decide qué renderizar dependiendo de si el firewall está activo para ese guest y si alguna regla está logueando realmente:",
     "firewallItems": [
       "<strong>Firewall disabled</strong> — un aviso ámbar explica exactamente dónde activarlo en la UI de Proxmox (<em>&lt;Container|VM&gt; → Firewall → Options</em>) y te recuerda que al menos una regla necesita <code>log: info</code> (o superior) antes de que aparezcan paquetes.",
diff --git a/web/messages/es/docs/oci-manager/architecture.json b/web/messages/es/docs/oci-manager/architecture.json
new file mode 100644
index 00000000..b9b22769
--- /dev/null
+++ b/web/messages/es/docs/oci-manager/architecture.json
@@ -0,0 +1,114 @@
+{
+  "meta": {
+    "title": "Cómo se traduce una imagen OCI | ProxMenux",
+    "description": "Del repositorio de la imagen y su archivo Compose a una plantilla revisable, un plan de despliegue y un LXC nativo de Proxmox VE, sin Docker dentro."
+  },
+  "header": {
+    "title": "Cómo se traduce una imagen OCI",
+    "description": "Del repositorio de la imagen y su archivo Compose a una plantilla revisable, un plan de despliegue y un LXC nativo, sin instalar Docker dentro.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "pipeline",
+      "title": "La cadena de traducción",
+      "blocks": [
+        {
+          "mermaid": {
+            "chartCode": "flowchart LR\n A[\"{{repo}}\"] --> B[\"Compose + README\"]\n B --> C[\"{{converter}}\"]\n C --> D[\"{{template}}\"]\n D --> E{\"{{blockers}}\"}\n E -- \"{{no}}\" --> F[\"{{review}}\"]\n F --> D\n E -- \"{{yes}}\" --> G[\"{{plan}}\"]\n G --> H[\"pct create\"]\n H --> I[\"{{lxc}}\"]",
+            "labels": {
+              "repo": "Repositorio de la imagen",
+              "converter": "Conversor",
+              "template": "Plantilla JSON",
+              "blockers": "¿Sin bloqueos?",
+              "no": "No",
+              "yes": "Sí",
+              "review": "Revisión / overlay",
+              "plan": "Plan de despliegue",
+              "lxc": "LXC nativo"
+            }
+          }
+        },
+        {
+          "p": "El conversor lee la imagen y el archivo Compose que publica su proyecto y escribe una plantilla JSON. Una plantilla con bloqueos sin traducir pasa por revisión, donde un overlay curado los resuelve, antes de publicarse en el catálogo. Solo las plantillas sin bloqueos se ofrecen para instalar."
+        }
+      ]
+    },
+    {
+      "id": "template",
+      "title": "Qué conserva la plantilla",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              { "icon": "archive", "title": "Identidad de la imagen", "body": "Repositorio, etiqueta rolling, arquitectura, digest resuelto y revisión del origen." },
+              { "icon": "braces", "title": "Contrato del contenedor", "body": "Entrypoint, Cmd, entorno, usuario, directorio de trabajo, señal de parada, puertos y volúmenes." },
+              { "icon": "layers", "title": "Traducción a Proxmox VE", "body": "Recursos, seguridad, puntos de montaje, dispositivos, sysctls, healthchecks y las adaptaciones que necesita cada uno, con su motivo." },
+              { "icon": "shield", "title": "Compatibilidad", "body": "Claves admitidas, bloqueos sin traducir y el estado de cada validación." }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "sources",
+      "title": "OCI aporta el proceso; Compose aporta el entorno",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Origen", "Ejemplo", "Resultado nativo"],
+            "rows": [
+              ["Metadatos OCI", "<code>Entrypoint</code>, <code>Cmd</code>, <code>User</code>", "Proxmox VE los importa al crear el CT"],
+              ["Docker Compose", "<code>environment</code>, <code>volumes</code>, <code>devices</code>", "entradas de entorno del LXC, <code>mpN</code> y <code>devN</code>"],
+              ["Perfil de ProxMenux", "GPU, healthcheck, credenciales", "preguntas y adaptaciones revisadas"],
+              ["Usuario", "VMID, almacenamiento, red", "el contrato de la instancia"]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "install",
+      "title": "Qué ocurre durante una instalación",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              { "title": "Resolver", "body": "Se consulta el registro, se selecciona la arquitectura del host y se fija el digest efectivo de la etiqueta rolling." },
+              { "title": "Descargar y verificar", "body": "Skopeo descarga la imagen como archivo OCI, y cada capa se comprueba contra su digest y se descomprime antes de crear nada. Una descarga dañada se repite una vez antes de detener la instalación." },
+              { "title": "Construir", "body": "<code>pct create</code> construye el rootfs a partir del archivo y conserva los metadatos oficiales de proceso de la imagen." },
+              { "title": "Conectar", "body": "Se añaden los volúmenes, la red, el entorno, los dispositivos y los perfiles de seguridad declarados." },
+              { "title": "Consola", "body": "La salida de consola del contenedor se guarda en el host, y la consola de Proxmox VE abre un shell cuando la imagen incluye uno." },
+              { "title": "Comprobar", "body": "El primer arranque espera una dirección y la respuesta del servicio; un fallo no se presenta como instalación correcta." },
+              { "title": "Registrar", "body": "La configuración efectiva se escribe en el contrato de la instancia que usan las actualizaciones y las recreaciones." }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "example",
+      "title": "Ejemplo: una imagen con /config y /downloads",
+      "intro": "Una definición habitual de Compose y la configuración de Proxmox VE en la que se convierte. Las rutas que espera la aplicación no cambian.",
+      "blocks": [
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Docker Compose",
+                "code": "image: lscr.io/linuxserver/example:latest\nenvironment:\n  - PUID=1000\n  - PGID=1000\nvolumes:\n  - config:/config\n  - /srv/downloads:/downloads\nports:\n  - 8080:8080"
+              },
+              {
+                "title": "/etc/pve/lxc/VMID.conf (extracto)",
+                "code": "entrypoint: /init\nmp0: local-lvm:vm-VMID-disk-1,mp=/config,backup=1,size=8G\nmp1: /srv/downloads,mp=/downloads\nnet0: name=eth0,bridge=vmbr0,ip=dhcp,type=veth\nlxc.environment.runtime: PUID=1000\nlxc.environment.runtime: PGID=1000"
+              }
+            ]
+          }
+        },
+        {
+          "p": "<code>mp0</code> es un segundo disco que pertenece al contenedor, con el nombre <code>vm-VMID-disk-N</code> en el almacenamiento elegido. Se monta en <code>/config</code> y, con <code>backup=1</code>, forma parte del backup del contenedor. <code>mp1</code> no crea ningún disco: enlaza el directorio del host <code>/srv/downloads</code> con <code>/downloads</code> dentro del LXC. El puerto 8080 no se mapea: el LXC tiene una dirección propia y el servicio responde en ella."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/es/docs/oci-manager/custom-image.json b/web/messages/es/docs/oci-manager/custom-image.json
new file mode 100644
index 00000000..786a9890
--- /dev/null
+++ b/web/messages/es/docs/oci-manager/custom-image.json
@@ -0,0 +1,134 @@
+{
+  "meta": {
+    "title": "Instalar una imagen que no está en el catálogo | ProxMenux",
+    "description": "Traducción de una imagen OCI desde un archivo Compose, una URL, un comando docker run o una referencia de imagen, con revisión de lo que ProxMenux puede reproducir antes de instalarla."
+  },
+  "header": {
+    "title": "Instalar una imagen que no está en el catálogo",
+    "description": "Una imagen propia se traduce desde su archivo Compose, un comando docker run o solo su referencia, y el resultado se presenta para revisión antes de crear ningún LXC.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "El mismo conversor, el mismo instalador",
+            "body": "La opción <strong>Instalar una imagen que no está en el catálogo</strong> utiliza el conversor y el instalador de las plantillas del catálogo. La diferencia es que el contrato se genera en ese momento a partir de la definición aportada y se valida antes de crear ningún LXC."
+          }
+        }
+      ]
+    },
+    {
+      "id": "sources",
+      "title": "Cómo se describe la imagen",
+      "intro": "La primera pantalla pregunta cómo se describe la imagen. Hay cuatro formas de aportar una definición completa y una quinta que usa solo el nombre de la imagen.",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Opción", "Qué lee"],
+            "rows": [
+              ["Pegar su archivo Compose en la terminal", "El YAML se pega en la terminal y termina con Ctrl+D en una línea vacía."],
+              ["Leer su archivo Compose desde un archivo de este host", "Una ruta del nodo, <code>/root/docker-compose.yml</code> por defecto. El archivo debe existir y ocupar como máximo 256 KiB."],
+              ["Descargar su archivo Compose desde una dirección", "Una dirección <code>http://</code> o <code>https://</code> que sirva el YAML sin procesar. Se descargan como máximo 256 KiB."],
+              ["Pegar su comando docker run en la terminal", "El comando que publica el proyecto. Se traducen puertos, entorno, volúmenes, dispositivos, capacidades, usuario, memoria compartida y el resto de opciones admitidas."],
+              ["Solo la referencia de la imagen, sin archivo Compose", "Una referencia como <code>ghcr.io/usuario/aplicacion:latest</code>. Se consulta el registro y se conservan los metadatos OCI de la imagen."]
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/custom-source-menu.png",
+            "alt": "Menú que pregunta cómo se describe una imagen que no está en el catálogo",
+            "caption": "Las cinco formas de describir una imagen que no está en el catálogo."
+          }
+        }
+      ]
+    },
+    {
+      "id": "reference-only",
+      "title": "Qué aporta solo la referencia de la imagen",
+      "intro": "Una imagen lleva sus metadatos de proceso, pero no todo lo que un archivo Compose suele añadir a su alrededor.",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Se lee de la imagen", "No está en la imagen", "Consecuencia"],
+            "rows": [
+              ["<code>Entrypoint</code>, <code>Cmd</code>, <code>User</code>, <code>WorkingDir</code> y entorno integrado", "Variables que solo aparecen en la documentación", "Se añaden durante la instalación o una recreación"],
+              ["Volúmenes declarados por la imagen", "Directorios del host que solo nombra un archivo Compose", "Las rutas adicionales se añaden antes de instalar"],
+              ["Puertos <code>EXPOSE</code>", "La URL, el protocolo o un healthcheck funcional", "Se confirman el puerto y la forma de comprobar el servicio"],
+              ["Arquitecturas y digest del registro", "Dispositivos, privilegios o dependencias externas", "Ninguno se activa sin una definición que lo pida"]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "review",
+      "title": "Revisión antes de instalar",
+      "intro": "Tras traducir la definición, ProxMenux muestra lo que ha entendido antes de pedir VMID, recursos o almacenamiento.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              { "title": "Analizar", "body": "Se leen servicios, imagen, puertos, rutas, entorno, dispositivos, seguridad y healthcheck." },
+              { "title": "Consultar el registro", "body": "La imagen debe existir en un registro público, y se enumeran las arquitecturas que publica." },
+              { "title": "Enumerar lo que no se aplica", "body": "Se enumeran las etiquetas, las redes Docker, los ajustes de Swarm y el resto de claves que no tienen efecto en un LXC." },
+              { "title": "Bloquear lo que no puede traducirse", "body": "Una clave sin equivalencia segura aparece en <strong>Lo que no puede traducirse</strong> y la instalación no continúa. Nada se descarta en silencio." },
+              { "title": "Pedir los secretos", "body": "Las variables cuyo nombre corresponde a una contraseña, un token o una clave se convierten en preguntas sensibles de la instalación." }
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/custom-review.png",
+            "alt": "Resumen de lo que ProxMenux ha entendido de un archivo Compose",
+            "caption": "El resumen que se muestra antes de que la instalación pida VMID y recursos."
+          }
+        },
+        {
+          "p": "Tras aceptar el resumen, el recorrido es el del catálogo: nombre, modo predeterminado o avanzado, VMID, CPU, memoria, red, arranque con el nodo, rutas persistentes, rutas adicionales, dispositivos compatibles y resumen final."
+        }
+      ]
+    },
+    {
+      "id": "examples",
+      "title": "Ejemplos de entrada",
+      "blocks": [
+        {
+          "codeGrid": {
+            "items": [
+              {
+                "title": "Compose",
+                "code": "services:\n  app:\n    image: ghcr.io/example/app:latest\n    ports:\n      - \"8080:8080\"\n    volumes:\n      - ./config:/config\n      - /srv/media:/media\n    environment:\n      TZ: Europe/Madrid"
+              },
+              {
+                "title": "docker run",
+                "code": "docker run -d \\\n  --name app \\\n  -p 8080:8080 \\\n  -e TZ=Europe/Madrid \\\n  -v app-config:/config \\\n  -v /srv/media:/media \\\n  ghcr.io/example/app:latest"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "limits",
+      "title": "Definiciones que no se instalan",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Imágenes en registros privados: no se piden credenciales del registro.",
+              "Un Dockerfile sin imagen publicada: la imagen debe construirse y publicarse antes en un registro OCI.",
+              "Un archivo Compose con varios servicios: queda bloqueado porque describe más de una imagen. Esta opción instala un único contenedor.",
+              "<code>configs</code>, secretos externos o formatos de dispositivo que no pueden traducirse sin ambigüedad.",
+              "Sustituciones del shell como <code>$(comando)</code>: debe escribirse el valor resultante.",
+              "Opciones de <code>docker run</code> no reconocidas y <code>--env-file</code>: se lee en su lugar un archivo Compose explícito."
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/es/docs/oci-manager/hardware.json b/web/messages/es/docs/oci-manager/hardware.json
new file mode 100644
index 00000000..8dbe837a
--- /dev/null
+++ b/web/messages/es/docs/oci-manager/hardware.json
@@ -0,0 +1,232 @@
+{
+  "meta": {
+    "title": "Dispositivos y aceleración | ProxMenux",
+    "description": "Cómo entrega OCI manager Apps GPU, NVIDIA, Coral, USB, FUSE y otros dispositivos a un contenedor OCI como recursos nativos y validados de Proxmox VE."
+  },
+  "header": {
+    "title": "Dispositivos y aceleración",
+    "description": "GPU, NVIDIA, Coral, USB, FUSE y dispositivos de bloques se convierten en recursos nativos y validados de Proxmox VE del contenedor.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "principle",
+      "title": "El dispositivo que necesita la aplicación, no todo el host",
+      "blocks": [
+        {
+          "p": "Un dispositivo solicitado por el archivo Compose o por el perfil de la aplicación se convierte en una entrada <code>devN</code> o un montaje LXC concreto. Pedir una GPU, un dispositivo USB o un Coral no convierte el contenedor en privilegiado."
+        },
+        {
+          "flow": {
+            "nodes": [
+              { "label": "Inventario del host", "detail": "/dev/dri/renderD128\nGID 993 · Intel" },
+              { "label": "ProxMenux", "detail": "fabricante y\npermisos comprobados" },
+              { "label": "LXC", "detail": "mismo dispositivo\nGID efectivo" }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "origin",
+      "title": "De dónde procede la petición de un dispositivo",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Origen", "Qué se lee", "Qué hace el instalador"],
+            "rows": [
+              ["Docker Compose", "<code>devices</code>, <code>group_add</code>, <code>deploy.resources</code> y peticiones NVIDIA", "Cada requisito se convierte en una petición de dispositivo que se muestra para revisión"],
+              ["Perfil del catálogo", "El soporte de GPU, Coral, OpenCL, USB o FUSE que tiene realmente la aplicación", "Solo se ofrecen las opciones validadas para esa imagen"],
+              ["Metadatos y documentación de la imagen", "VA-API, Selkies, mods de LinuxServer o el runtime NVIDIA", "Se añaden las variables y la preparación documentadas"],
+              ["Selección del usuario", "Solo CPU, Intel/AMD, OpenCL, NVIDIA o un dispositivo opcional", "La selección se guarda en el contrato de la instancia"]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Los dispositivos detectados no se conectan por sí solos",
+            "body": "El host se inventaría, pero solo se ofrecen y conectan los dispositivos que declaran el archivo Compose o un perfil compatible. Una GPU, un dongle USB o un Coral presentes en el host no se exponen a todos los LXC."
+          }
+        }
+      ]
+    },
+    {
+      "id": "identify",
+      "title": "Cómo se identifica el dispositivo en el host",
+      "intro": "Antes de modificar el LXC, el dispositivo se lee en el host y se compara con el perfil elegido.",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Tipo", "Identificación", "Validación"],
+            "rows": [
+              ["Intel/AMD DRM", "<code>/dev/dri/renderD*</code> y <code>/sys/class/drm/NODO/device/vendor</code>", "Un dispositivo de caracteres con fabricante <code>0x8086</code> (Intel) o <code>0x1002</code> (AMD)"],
+              ["OpenCL AMD", "El render node, más <code>/dev/kfd</code> cuando el perfil lo necesita", "Existencia, tipo, fabricante, permisos y compatibilidad declarada"],
+              ["NVIDIA", "<code>nvidia-smi</code> y <code>nvidia-container-cli</code>", "GPU, UUID, bus PCI, versión del driver, Toolkit, nodos <code>/dev/nvidia*</code>, binarios y librerías"],
+              ["Coral PCIe/M.2", "<code>/dev/apex_N</code> y su enlace en <code>/sys/dev/char/MAJOR:MINOR</code>", "Nodo de caracteres, major/minor, propietario, GID y permisos"],
+              ["USB y serie", "<code>/dev/ttyUSB*</code>, <code>/dev/ttyACM*</code> o <code>/dev/bus/usb/BBB/DDD</code>", "Nodo de caracteres; en USB también fabricante, producto y número de serie cuando sysfs los publica"],
+              ["KVM, TUN, FUSE, vídeo y SCSI genérico", "<code>/dev/kvm</code>, <code>/dev/net/tun</code>, <code>/dev/fuse</code>, <code>/dev/videoN</code> o <code>/dev/sgN</code>", "Ruta admitida, tipo de nodo y permisos efectivos"],
+              ["Unidad óptica", "<code>/dev/srN</code>", "Un dispositivo de bloques"]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "install",
+      "title": "Qué ocurre durante la instalación",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              { "title": "La plantilla ofrece sus perfiles", "body": "Por ejemplo solo CPU, Intel/AMD VA-API, OpenCL AMD, OpenCL Intel o NVIDIA. Las opciones pertenecen a la imagen, no a un menú común." },
+              { "title": "Se elige un perfil", "body": "Define los nodos de dispositivo, el entorno, los mods o el runtime que necesita la aplicación." },
+              { "title": "Se propone una ruta", "body": "Para DRM, <code>/dev/dri/renderD128</code>, que puede cambiarse en un host con varios render nodes. Para USB o serie se selecciona el nodo concreto." },
+              { "title": "Validación", "body": "Se comprueban existencia, tipo, fabricante admitido, permisos y GID. Una discrepancia detiene la operación." },
+              { "title": "Se escribe el contrato", "body": "Ruta, modo, GID, acceso de escritura y perfil quedan registrados para las actualizaciones y las recreaciones." },
+              { "title": "Conexión y prueba", "body": "<code>pct set</code> añade la entrada <code>devN</code> y después se comprueba el acceso dentro del LXC. Las imágenes de LinuxServer se comprueban también como usuario <code>abc</code>." }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "config",
+      "title": "Cómo aparece en la configuración del LXC",
+      "intro": "Valores ilustrativos: <code>dev0</code> y <code>dev1</code> son las posiciones libres que asigna Proxmox VE, y <code>renderD128</code>, <code>apex_0</code> y el GID dependen del hardware del nodo.",
+      "blocks": [
+        {
+          "codeGrid": {
+            "items": [
+              { "title": "Intel/AMD VA-API", "code": "dev0: path=/dev/dri/renderD128,mode=0660,gid=993,deny-write=0" },
+              { "title": "Coral PCIe/M.2", "code": "dev0: path=/dev/apex_0,mode=0660,gid=GID,deny-write=0" },
+              { "title": "Un dispositivo USB concreto", "code": "dev0: path=/dev/bus/usb/003/004,mode=0660,gid=GID,deny-write=0" },
+              { "title": "OpenCL AMD", "code": "dev0: path=/dev/dri/renderD128,mode=0660,gid=GID,deny-write=0\ndev1: path=/dev/kfd,mode=0660,gid=GID,deny-write=0" }
+            ]
+          }
+        },
+        {
+          "p": "El GID se lee con <code>stat</code> en el host y se escribe en la entrada <code>devN</code>; no se da por hecho que los grupos <code>render</code> y <code>video</code> tengan un número fijo. El dispositivo conserva la misma ruta <code>/dev</code> dentro del LXC, que es donde lo buscan los mecanismos propios de la aplicación."
+        }
+      ]
+    },
+    {
+      "id": "profiles",
+      "title": "Perfiles que puede ofrecer una imagen",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Perfil", "Traducción", "Se ofrece cuando"],
+            "rows": [
+              ["Intel/AMD VA-API", "Render node de <code>/dev/dri</code>", "La aplicación admite aceleración de vídeo"],
+              ["OpenCL", "Render node, <code>/dev/kfd</code> si hace falta y el mod oficial", "La imagen o el perfil lo documentan"],
+              ["NVIDIA", "Dispositivos y librerías del driver del host", "El host tiene un driver operativo y NVIDIA Container Toolkit"],
+              ["Coral", "<code>/dev/apex_0</code> o el bus USB", "El perfil declara soporte de Coral (Frigate)"],
+              ["USB, serie, FUSE", "Un dispositivo concreto, un árbol validado o una función LXC", "El contrato lo pide"]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "nvidia",
+      "title": "NVIDIA",
+      "blocks": [
+        {
+          "calloutWarning": {
+            "title": "Requisito del nodo: NVIDIA Container Toolkit",
+            "body": "Un driver operativo en Proxmox VE no basta para entregar una GPU NVIDIA a una imagen OCI. OCI manager Apps usa <code>nvidia-container-cli</code>, de NVIDIA Container Toolkit, para identificar los dispositivos y obtener los binarios y las librerías que corresponden al driver cargado."
+          }
+        },
+        {
+          "p": "El <nvidiaLink>instalador NVIDIA de ProxMenux</nvidiaLink> instala NVIDIA Container Toolkit desde el repositorio oficial de NVIDIA junto con el driver. Comprueba sus cuatro paquetes, valida <code>nvidia-container-cli</code> y registra el resultado en el diario de cambios de <auditLink>Auditoría e informes</auditLink>."
+        },
+        {
+          "p": "Estos dos comandos, en el host, muestran si el driver y el Toolkit están disponibles:"
+        },
+        {
+          "shell": { "code": "nvidia-smi -L\nnvidia-container-cli --version" }
+        },
+        {
+          "p": "En un host cuyo driver se instaló por otros medios, el Toolkit se instala desde el repositorio estable oficial:"
+        },
+        {
+          "shell": {
+            "code": "apt-get update\napt-get install -y --no-install-recommends ca-certificates curl gnupg2\n\ncurl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey \\\n  | gpg --dearmor -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg\n\ncurl -s -L https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list \\\n  | sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' \\\n  > /etc/apt/sources.list.d/nvidia-container-toolkit.list\n\napt-get update\napt-get install -y nvidia-container-toolkit libnvidia-container-tools"
+          }
+        },
+        {
+          "p": "El inventario que usa OCI manager Apps es la salida de:"
+        },
+        {
+          "shell": { "code": "nvidia-container-cli list --device all --libraries --binaries --firmwares --ipcs" }
+        },
+        {
+          "calloutInfo": {
+            "title": "La configuración del runtime de Docker no interviene",
+            "body": "Los contenedores son LXC nativos y no se usa ningún daemon de Docker, así que <code>nvidia-ctk runtime configure --runtime=docker</code> no forma parte del proceso: ProxMenux consulta directamente <code>nvidia-container-cli</code> y escribe los dispositivos y montajes del LXC. Los comandos y las plataformas compatibles se mantienen en la <toolkitLink>guía de instalación de NVIDIA Container Toolkit</toolkitLink>."
+          }
+        },
+        {
+          "cards": {
+            "items": [
+              { "icon": "cpu", "title": "Inventario desde el driver", "body": "<code>nvidia-container-cli</code> enumera los nodos de dispositivo, los binarios, el firmware y las librerías del driver instalado." },
+              { "icon": "refresh", "title": "Sin versión fija", "body": "La plantilla no nombra archivos de librería. El perfil se genera a partir del host actual." },
+              { "icon": "shield", "title": "Montajes de solo lectura", "body": "Las librerías del host se montan en solo lectura en lugar de copiarse dentro del contenedor." },
+              { "icon": "hardDrive", "title": "Cambios de driver", "body": "Tras un cambio de driver, el inventario se genera de nuevo antes de que arranquen los LXC afectados." }
+            ]
+          }
+        },
+        {
+          "code": {
+            "title": "Resultado NVIDIA (simplificado)",
+            "code": "devN: path=/dev/nvidia0,...\ndevN: path=/dev/nvidiactl,...\ndevN: path=/dev/nvidia-uvm,...\nlxc.mount.entry: HOST_LIBRARY CONTAINER_LIBRARY none ro,bind,create=file 0 0"
+          }
+        },
+        {
+          "p": "Entregar solo <code>/dev/nvidia0</code> no es suficiente. Los componentes de espacio de usuario del driver cargado se montan en solo lectura y después <code>nvidia-smi</code> se ejecuta dentro del LXC para comparar GPU, UUID, bus PCI y versión con el inventario del host."
+        }
+      ]
+    },
+    {
+      "id": "usb",
+      "title": "USB, serie y Coral USB",
+      "blocks": [
+        {
+          "calloutWarning": {
+            "title": "La numeración USB puede cambiar",
+            "body": "Una ruta como <code>/dev/bus/usb/003/004</code> puede cambiar al reconectar el dispositivo o reiniciar el host. El perfil registra fabricante, producto y número de serie cuando están disponibles, pero una nueva dirección de bus no se reasigna automáticamente."
+          }
+        },
+        {
+          "p": "Un periférico se indica por su nodo concreto: <code>/dev/ttyUSB0</code>, <code>/dev/ttyACM0</code>, <code>/dev/apex_0</code> o <code>/dev/bus/usb/BBB/DDD</code>. No se admite entregar todo <code>/dev</code>. Coral solo se ofrece a las aplicaciones cuyo perfil lo declara."
+        }
+      ]
+    },
+    {
+      "id": "trees",
+      "title": "Árboles de dispositivos y funciones LXC",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Petición", "Traducción", "Alcance"],
+            "rows": [
+              ["<code>/dev/dvb</code>, <code>/dev/snd</code> o <code>/dev/bus/usb</code>", "Cada nodo de caracteres del árbol recibe su propia entrada <code>devN</code> con el modo y el GID del host", "Solo el árbol pedido, no el resto de <code>/dev</code>"],
+              ["<code>/dev/fuse</code>", "El nodo y, cuando el perfil lo necesita, la función <code>fuse=1</code>", "FUSE por sí solo no publica montajes a otros LXC"],
+              ["<code>/dev/net/tun</code>", "Una entrada <code>devN</code> en la misma ruta dentro del LXC", "La configuración de la VPN o de la red queda en la aplicación"],
+              ["<code>/dev/kvm</code>", "Una entrada <code>devN</code> validada", "Solo se ofrece cuando el contrato lo pide"]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "security",
+      "title": "Confirmaciones según el nivel de riesgo",
+      "blocks": [
+        {
+          "p": "Los dispositivos concretos, el privilegio opcional, el privilegio obligatorio, la relajación de AppArmor o seccomp y el acceso al espacio de nombres PID del host se tratan como casos distintos, no bajo una etiqueta genérica de privilegiado. Cada opción con riesgo se explica y se confirma durante la instalación."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/es/docs/oci-manager/index.json b/web/messages/es/docs/oci-manager/index.json
new file mode 100644
index 00000000..c6deb37e
--- /dev/null
+++ b/web/messages/es/docs/oci-manager/index.json
@@ -0,0 +1,116 @@
+{
+  "meta": {
+    "title": "OCI manager Apps | ProxMenux",
+    "description": "Imágenes OCI oficiales ejecutadas como contenedores LXC nativos de Proxmox VE, con datos persistentes, dispositivos, aplicaciones multicontenedor y actualizaciones transaccionales."
+  },
+  "header": {
+    "title": "OCI manager Apps",
+    "description": "Las imágenes OCI oficiales se ejecutan como contenedores LXC nativos de Proxmox VE. La imagen sigue siendo la que publica su responsable; ProxMenux reproduce el entorno que Docker Compose habría creado a su alrededor.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "model",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Una imagen OCI, un LXC nativo",
+            "body": "Dentro de los contenedores no se ejecuta ningún motor Docker. Proxmox VE importa el sistema de archivos de la imagen y sus metadatos OCI, y la aplicación pasa a ser el proceso principal de un LXC nativo, gestionado con las mismas herramientas que cualquier otro contenedor del nodo."
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              { "label": "Origen", "detail": "Imagen OCI\nCompose y documentación" },
+              { "label": "ProxMenux", "detail": "Contrato JSON\nvalidación y plan" },
+              { "label": "Proxmox VE", "detail": "LXC nativo\nvolúmenes y dispositivos" }
+            ],
+            "caption": "La aplicación no se reconstruye: su entorno se reproduce de forma declarativa."
+          }
+        }
+      ]
+    },
+    {
+      "id": "where",
+      "title": "Dónde se encuentra",
+      "intro": "OCI manager Apps se abre desde la opción <strong>OCI manager Apps (beta)</strong> del menú principal de ProxMenux, en el nodo Proxmox y como root. Su primera pantalla ofrece:",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "<strong>Buscar aplicaciones</strong>: búsqueda por nombre en todo el catálogo.",
+              "<strong>Todas las aplicaciones</strong>: el catálogo completo, con el número de aplicaciones.",
+              "<strong>Gestionar aplicaciones OCI instaladas</strong>: actualizar, recrear, eliminar o recuperar lo instalado.",
+              "<strong>Instalar una imagen que no está en el catálogo</strong>: traducción de un archivo Compose, un comando <code>docker run</code> o una referencia de imagen.",
+              "Las categorías del catálogo, cada una con su número de aplicaciones."
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/main-menu.png",
+            "alt": "Pantalla principal de OCI manager Apps con la búsqueda, todas las aplicaciones, la gestión, la imagen propia y las categorías del catálogo",
+            "caption": "Pantalla principal de OCI manager Apps."
+          }
+        },
+        {
+          "p": "Al seleccionar una aplicación se muestra su descripción, la imagen que ejecuta y dos modos de instalación: <strong>Instalar con la configuración predeterminada</strong>, que apenas hace preguntas, e <strong>Instalar con la configuración avanzada</strong>, que ofrece los selectores reales de almacenamiento, bridge y recursos del nodo."
+        }
+      ]
+    },
+    {
+      "id": "translation",
+      "title": "Lo que Docker expresa y en qué lo convierte OCI manager Apps",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Necesidad", "Docker la expresa como", "OCI manager Apps la convierte en"],
+            "rows": [
+              ["Ejecutar la aplicación", "<code>image</code>, <code>entrypoint</code>, <code>command</code>", "rootfs OCI y proceso principal del LXC"],
+              ["Conservar la configuración", "<code>volumes: /config</code>", "un disco <code>mpN</code> persistente incluido en el backup, o un directorio del host"],
+              ["Publicar el servicio", "<code>ports</code>", "una dirección propia del LXC y la URL de acceso al servicio"],
+              ["Usar hardware", "<code>devices</code>, <code>group_add</code>", "entradas <code>devN</code> con el GID efectivo del host y un perfil validado"],
+              ["Conectar dependencias", "<code>networks</code>, <code>depends_on</code>", "un bridge privado, direcciones fijas, orden de arranque y healthchecks"],
+              ["Actualizar", "<code>pull</code> y recrear", "un rootfs nuevo con el mismo contrato persistente"]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "kept",
+      "title": "Qué se mantiene y qué cambia",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              { "icon": "archive", "title": "Se mantiene", "body": "La imagen oficial, sus rutas internas, su entorno, su proceso de arranque y su documentación funcional." },
+              { "icon": "boxes", "title": "Se adapta", "body": "El entorno de ejecución: red, persistencia, dispositivos, permisos y dependencias usan primitivas LXC nativas de Proxmox VE." },
+              { "icon": "shield", "title": "No se traduce", "body": "Una clave de Compose sin equivalencia segura figura como bloqueo. Las plantillas con bloqueos no se ofrecen, y las opciones sensibles se confirman durante la instalación." },
+              { "icon": "refresh", "title": "Se registra", "body": "Digest de la imagen, recursos, rutas, red, dispositivos y pertenencia a una pila quedan en el contrato de la instancia, que las actualizaciones y las recreaciones reproducen." }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "pages",
+      "title": "Páginas de esta sección",
+      "blocks": [
+        {
+          "next": {
+            "items": [
+              { "label": "Cómo se traduce una imagen OCI", "href": "/docs/oci-manager/architecture", "tail": "de la imagen y su archivo Compose a un LXC nativo." },
+              { "label": "Instalar una imagen que no está en el catálogo", "href": "/docs/oci-manager/custom-image", "tail": "Compose, docker run o una referencia de imagen." },
+              { "label": "Datos, rutas y red", "href": "/docs/oci-manager/storage-network", "tail": "discos del contenedor, directorios del host, montajes Rclone y direcciones." },
+              { "label": "Dispositivos y aceleración", "href": "/docs/oci-manager/hardware", "tail": "GPU, NVIDIA, Coral, USB y otros dispositivos." },
+              { "label": "Aplicaciones multicontenedor", "href": "/docs/oci-manager/stacks", "tail": "aplicación, base de datos y caché como LXC coordinados." },
+              { "label": "Instalar, actualizar y recrear", "href": "/docs/oci-manager/lifecycle", "tail": "el contrato de la instancia y sus operaciones." },
+              { "label": "En ProxMenux Monitor", "href": "/docs/oci-manager/monitor", "tail": "versiones, actualizaciones, salida de consola y terminal." }
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/es/docs/oci-manager/lifecycle.json b/web/messages/es/docs/oci-manager/lifecycle.json
new file mode 100644
index 00000000..0ccddbae
--- /dev/null
+++ b/web/messages/es/docs/oci-manager/lifecycle.json
@@ -0,0 +1,243 @@
+{
+  "meta": {
+    "title": "Instalar, actualizar y recrear | ProxMenux",
+    "description": "El contrato de instancia de un contenedor OCI y las operaciones que lo usan: actualizar, recrear, eliminar y recuperar una operación interrumpida."
+  },
+  "header": {
+    "title": "Instalar, actualizar y recrear",
+    "description": "Cada instancia conserva un contrato reproducible, de modo que su rootfs puede sustituirse sin perder la configuración ni los datos persistentes.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "contract",
+      "title": "El contrato de la instancia",
+      "blocks": [
+        {
+          "p": "Tras una instalación, la configuración efectiva se guarda en <code>/usr/local/share/proxmenux/oci/instances/VMID/oci-compose.json</code>. No es una copia del archivo Compose original: es el contrato reproducible del LXC que existe en este host."
+        },
+        {
+          "code": {
+            "code": "instances/\n└── 105/\n    └── oci-compose.json\n        ├── imagen y digest resuelto\n        ├── recursos y red\n        ├── entorno (secretos protegidos)\n        ├── discos del contenedor y directorios del host\n        ├── perfil de hardware y dispositivos\n        ├── log de consola y modo de terminal\n        └── pertenencia a una pila y ciclo de vida"
+          }
+        }
+      ]
+    },
+    {
+      "id": "manage",
+      "title": "Gestionar aplicaciones OCI instaladas",
+      "intro": "Esta opción de la pantalla principal enumera las instancias registradas con su aplicación y su imagen. Cada una se contrasta con su contrato antes de cualquier acción; un CT que ya no coincide con su registro no se modifica ni se elimina. La misma actualización y la misma recreación se ofrecen en la pestaña Actualizaciones de <monitorLink>ProxMenux Monitor</monitorLink>.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Opción",
+              "Qué cambia",
+              "Qué se conserva"
+            ],
+            "rows": [
+              [
+                "Actualizar la imagen con la configuración guardada",
+                "El rootfs se sustituye por la imagen que publica hoy el canal guardado",
+                "Contrato, discos del contenedor, directorios del host, red y dispositivos"
+              ],
+              [
+                "Recrear: editar recursos, red, rutas y GPU",
+                "El editor se abre con el contrato actual; el CT se reconstruye con los cambios",
+                "Los datos de los discos del contenedor y de los directorios del host"
+              ],
+              [
+                "Eliminar: la aplicación y sus contenedores",
+                "Se eliminan el LXC, o todos los miembros de una pila, y sus contratos",
+                "Los directorios del host, con su contenido"
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Para una aplicación multicontenedor el menú ofrece <strong>Actualizar cada contenedor de la aplicación</strong> y la eliminación. Una pila no se recrea."
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/manage-menu.png",
+            "alt": "Lista de aplicaciones OCI instaladas y las opciones de actualizar, recrear y eliminar",
+            "caption": "Gestionar aplicaciones OCI instaladas."
+          }
+        }
+      ]
+    },
+    {
+      "id": "update",
+      "title": "Una actualización transaccional",
+      "blocks": [
+        {
+          "mermaid": {
+            "chartCode": "sequenceDiagram\n participant U as {{user}}\n participant P as ProxMenux\n participant R as {{registry}}\n participant X as Proxmox VE\n U->>P: {{update}}\n P->>R: {{resolve}}\n R-->>P: digest\n P->>P: {{verify}}\n P->>X: {{backup}}\n P->>X: {{import}}\n P->>X: {{reapply}}\n X-->>P: healthcheck\n alt {{healthy}}\n  P-->>U: {{commit}}\n else {{failure}}\n  P->>X: Rollback\n  P-->>U: {{restored}}\n end",
+            "labels": {
+              "user": "Usuario",
+              "registry": "Registro OCI",
+              "update": "Actualizar la instancia",
+              "resolve": "Resolver la etiqueta",
+              "verify": "Verificar el archivo y preflight",
+              "backup": "Detener y respaldar el CT",
+              "import": "Importar el rootfs nuevo",
+              "reapply": "Aplicar de nuevo el contrato",
+              "healthy": "correcto",
+              "failure": "fallo",
+              "commit": "Contrato publicado con el digest nuevo",
+              "restored": "Instancia anterior restaurada"
+            }
+          }
+        },
+        {
+          "list": {
+            "items": [
+              "Cuando el registro sigue sirviendo el digest instalado, no se descarga nada y la instancia no se toca.",
+              "La imagen nueva se verifica capa a capa antes de detener el CT. Una descarga que llega dañada se repite una vez; una imagen ya almacenada que no supera la comprobación se descarga de nuevo.",
+              "Los ajustes cambiados en Proxmox VE después de la instalación (memoria, swap, núcleos, límite de CPU, prioridad de CPU, arranque con el nodo) se conservan y pasan al contrato nuevo.",
+              "Cualquier otra diferencia entre el CT y su contrato detiene la actualización antes de detener el CT."
+            ]
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              {
+                "label": "Antes",
+                "detail": "rootfs A\n/config mp0\n/media directorio del host"
+              },
+              {
+                "label": "Actualización",
+                "detail": "sustituye solo\nel rootfs"
+              },
+              {
+                "label": "Después",
+                "detail": "rootfs B\n/config mp0\n/media directorio del host"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "recovery",
+      "title": "Recuperar una operación interrumpida",
+      "intro": "La actualización y la recreación usan una transacción persistente. Si el proceso, la terminal o el nodo se interrumpen después de detener el CT, la operación no se da por terminada.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              {
+                "title": "Marcador pendiente",
+                "body": "Al abrir Gestionar aplicaciones OCI instaladas, el estado guardado indica que la sustitución no llegó a publicarse."
+              },
+              {
+                "title": "Ver estado",
+                "body": "Muestra la fase alcanzada sin modificar contenedores ni datos."
+              },
+              {
+                "title": "Recuperar la instalación anterior",
+                "body": "Restaura el backup nativo verificado tomado antes de la sustitución y el contrato anterior."
+              },
+              {
+                "title": "Pilas como una unidad",
+                "body": "En una aplicación multicontenedor se recuperan todos los miembros desde el mismo punto de la transacción, no solo el seleccionado."
+              }
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Los directorios del host quedan fuera de la restauración",
+            "body": "El backup cubre el rootfs y los discos del contenedor que incluye. Un directorio del host no se revierte, porque otros LXC pueden usar sus datos. Actualizar, recrear o recuperar una instancia con directorios del host pide antes una confirmación de ello."
+          }
+        }
+      ]
+    },
+    {
+      "id": "remove",
+      "title": "Eliminar una aplicación OCI",
+      "blocks": [
+        {
+          "p": "Antes de la confirmación se compone un resumen a partir de la configuración real: los contenedores que se eliminan, los datos que se eliminan con ellos, la red privada que se libera y los directorios del host que se conservan. La confirmación sale en <strong>No</strong> por defecto, porque los datos de los discos eliminados no pueden recuperarse después."
+        },
+        {
+          "table": {
+            "headers": [
+              "Recurso",
+              "Al eliminar",
+              "Motivo"
+            ],
+            "rows": [
+              [
+                "rootfs y discos del contenedor",
+                "Se eliminan",
+                "Solo pertenecen al contenedor"
+              ],
+              [
+                "Directorio del host",
+                "Se conserva, con su contenido",
+                "Otras aplicaciones pueden usarlo"
+              ],
+              [
+                "Contrato de la instancia",
+                "Se retira tras una eliminación correcta",
+                "Ya no tiene ningún CT asociado"
+              ],
+              [
+                "Bridge privado de una pila",
+                "Se libera con la pila",
+                "Ya no le quedan miembros que conectar"
+              ],
+              [
+                "Un único miembro de una pila",
+                "No se elimina por separado",
+                "Se elimina la aplicación completa, para no dejar ninguna pila incompleta"
+              ]
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/remove-summary.png",
+            "alt": "Resumen de eliminación con los contenedores, los datos y los directorios del host afectados",
+            "caption": "El resumen de eliminación, compuesto a partir de la configuración real."
+          }
+        }
+      ]
+    },
+    {
+      "id": "archives",
+      "title": "Imágenes descargadas y espacio del host",
+      "blocks": [
+        {
+          "p": "El archivo OCI se usa para construir el rootfs; el CT en marcha no lo lee. Tras una instalación o una actualización se enumeran los archivos descargados en esa operación con su tamaño y se ofrece eliminarlos. Eliminarlos libera el espacio sin afectar al contenedor ni a sus datos."
+        },
+        {
+          "calloutInfo": {
+            "title": "Las actualizaciones no necesitan el archivo",
+            "body": "Sin el archivo, una actualización resuelve el canal guardado y descarga el digest nuevo. Con él, un archivo solo se reutiliza cuando su referencia y su integridad coinciden con lo pedido."
+          }
+        }
+      ]
+    },
+    {
+      "id": "registry",
+      "title": "Registro y limpieza",
+      "blocks": [
+        {
+          "p": "Los contratos registrados se comparan con los CT reales. Un contrato solo queda huérfano cuando su VMID ya no existe o ya no lleva la identidad de instancia esperada. La limpieza no elimina volúmenes ni datos externos por deducción."
+        }
+      ]
+    },
+    {
+      "id": "channel",
+      "title": "Una etiqueta rolling no es una actualización desatendida",
+      "blocks": [
+        {
+          "p": "El catálogo instala la etiqueta rolling que publica su responsable, pero el digest efectivo se resuelve, se registra y solo cambia con una actualización explícita, con preflight y restauración. <monitorLink>ProxMenux Monitor</monitorLink> compara el digest instalado con el que publica el registro y muestra, y notifica, cuándo hay una imagen nueva."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/es/docs/oci-manager/monitor.json b/web/messages/es/docs/oci-manager/monitor.json
new file mode 100644
index 00000000..472a8456
--- /dev/null
+++ b/web/messages/es/docs/oci-manager/monitor.json
@@ -0,0 +1,203 @@
+{
+  "meta": {
+    "title": "Contenedores OCI en ProxMenux Monitor | ProxMenux",
+    "description": "Qué muestra ProxMenux Monitor de un contenedor instalado por OCI manager Apps: versiones de la aplicación y de la imagen, imágenes nuevas, salida de consola y terminal de Proxmox VE."
+  },
+  "header": {
+    "title": "En ProxMenux Monitor",
+    "description": "Un contenedor instalado por OCI manager Apps aparece en VMs y LXCs como cualquier otro LXC. Su ventana lee el registro de la instalación: versiones de la aplicación y de la imagen, imágenes nuevas, salida de consola y terminal.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "El registro es la fuente",
+            "body": "OCI manager Apps sabe qué instaló y de dónde procede. El Monitor lee ese registro de la instalación en lugar de sondear el contenedor, así que los datos son los mismos con el contenedor en marcha o detenido."
+          }
+        },
+        {
+          "table": {
+            "headers": [
+              "Pestaña",
+              "Qué cambia en un contenedor OCI"
+            ],
+            "rows": [
+              [
+                "App",
+                "La aplicación se identifica desde el registro y sus actualizaciones se siguen por la imagen"
+              ],
+              [
+                "Actualizaciones",
+                "Se actualiza la imagen o se recrea el contenedor, con el mismo recorrido que el menú OCI"
+              ],
+              [
+                "Montajes",
+                "Discos del contenedor y directorios del host, con su uso"
+              ],
+              [
+                "Logs",
+                "Solo en contenedores OCI: la salida de consola de la aplicación"
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "app",
+      "title": "App",
+      "intro": "La pestaña <appLink>App</appLink> ofrece la aplicación instalada como una detección, con el nombre, el logo, el puerto y el esquema del registro. Al registrarla se abre el editor con el método <strong>Imagen OCI (instalada por ProxMenux)</strong>, que no necesita configuración.",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              {
+                "icon": "boxes",
+                "title": "Aplicación",
+                "body": "La versión de la aplicación dentro de la imagen, leída de la propia imagen: su entorno o su etiqueta <code>org.opencontainers.image.version</code>. Es informativa."
+              },
+              {
+                "icon": "archive",
+                "title": "Imagen",
+                "body": "La fecha de construcción y el digest de la imagen instalada. La actualización se decide aquí: el digest instalado se compara con el que publica hoy el registro para la misma etiqueta."
+              }
+            ]
+          }
+        },
+        {
+          "list": {
+            "items": [
+              "Cuando el registro publica un digest nuevo, la tarjeta muestra <strong>Nueva imagen</strong> con su fecha y su digest, aunque la versión de la aplicación no haya cambiado: una reconstrucción sobre una base actualizada es una actualización.",
+              "Cuando los digests coinciden, la tarjeta indica <strong>Versión</strong>.",
+              "La tarjeta enlaza con el repositorio de la imagen: su proyecto en GitHub, o su página de Docker Hub en una imagen oficial.",
+              "El enlace de acceso usa la dirección de la LAN del contenedor, también en el miembro principal de una aplicación multicontenedor, que tiene una segunda dirección en su red privada.",
+              "El botón <strong>Actualizar datos</strong> vuelve a leer el registro y el registro de imágenes. No se ofrecen las opciones de buscar aplicaciones ni de registrar otra: el contenedor contiene exactamente la aplicación de su registro."
+            ]
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/monitor-app-tab.png",
+            "alt": "Pestaña App de un contenedor OCI con la versión de la aplicación, la imagen y el enlace al repositorio",
+            "caption": "Pestaña App de un contenedor instalado por OCI manager Apps."
+          }
+        },
+        {
+          "p": "La comprobación se ejecuta una vez al día con las comprobaciones de actualizaciones del Monitor, y <strong>Actualizar datos</strong> la ejecuta al momento. Una imagen nueva se envía como notificación por los canales configurados en <notificationsLink>Notificaciones</notificationsLink>. La actualización se aplica desde la pestaña Actualizaciones."
+        }
+      ]
+    },
+    {
+      "id": "updates",
+      "title": "Actualizaciones",
+      "intro": "En un contenedor instalado por OCI manager Apps, la pestaña Actualizaciones muestra la aplicación con su imagen instalada y, cuando el registro publica una, la imagen nueva, con el mismo formato que cualquier otra aplicación. Los actualizadores de paquetes y de aplicaciones de un LXC normal no aparecen.",
+      "blocks": [
+        {
+          "table": {
+            "headers": [
+              "Botón",
+              "Qué abre"
+            ],
+            "rows": [
+              [
+                "Actualizar",
+                "La actualización de <lifecycleLink>Gestionar aplicaciones OCI instaladas</lifecycleLink> para este contenedor, en la terminal del Monitor. Puede ejecutarse haya o no imagen nueva; sin ella, no cambia nada. En una aplicación multicontenedor actualiza todos los miembros."
+              ],
+              [
+                "Recrear",
+                "El editor de la recreación (recursos, red, rutas y GPU). No se ofrece en una aplicación multicontenedor."
+              ],
+              [
+                "Recuperar",
+                "Sustituye a Actualizar cuando una operación sobre el contenedor quedó interrumpida, y abre su recuperación."
+              ]
+            ]
+          }
+        },
+        {
+          "p": "Los cambios externos, los directorios del host y las aplicaciones multicontenedor se tratan como en el menú OCI. Al cerrar la terminal se vuelven a leer la imagen, el registro y los montajes."
+        },
+        {
+          "table": {
+            "headers": [
+              "Opción",
+              "Comportamiento"
+            ],
+            "rows": [
+              [
+                "Conservar el backup previo a la actualización",
+                "Cada actualización hace un backup del contenedor para restaurarlo si falla. Con esta opción ese mismo backup se conserva en el almacenamiento elegido y aparece entre los backups del CT; en Proxmox Backup Server se escribe un backup antes de actualizar."
+              ],
+              [
+                "Actualizaciones programadas",
+                "La imagen se actualiza a la hora elegida solo cuando el registro publica una nueva y, opcionalmente, solo cuando tiene 1, 3, 7 o 14 días. Un contenedor con cambios hechos fuera de ProxMenux se salta y se notifica; uno con directorios del host solo se actualiza si se confirmó al guardar la programación."
+              ]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "logs",
+      "title": "Logs",
+      "intro": "La pestaña Logs solo aparece en los contenedores instalados por OCI manager Apps, entre Montajes y Backups. Muestra la salida estándar y de errores del proceso principal de la imagen, la misma que muestra <code>docker logs</code> en un contenedor Docker.",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "La salida se guarda en el host en <code>/var/log/proxmenux/oci/VMID.console.log</code> (modo 0600), desde el primer arranque y entre reinicios, así que puede leerse con el contenedor detenido.",
+              "El archivo se rota al llegar a 10 MB y se conservan tres copias comprimidas (<code>/etc/logrotate.d/proxmenux-oci</code>).",
+              "Se muestran las últimas 100, 500 o 1000 líneas. Con el contenedor en marcha, las líneas nuevas se siguen en directo; al desplazarse hacia arriba el seguimiento se pausa, y <strong>Seguir</strong> lo reanuda.",
+              "Un filtro muestra solo las líneas que contienen un texto, y <strong>Descargar</strong> guarda las líneas cargadas.",
+              "Los códigos de color se eliminan y una línea que redibuja una barra de progreso se muestra en su estado final.",
+              "La pestaña lee el archivo cada vez que se abre; no se guarda en caché."
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Credenciales del primer arranque",
+            "body": "Las imágenes que imprimen una contraseña generada en su primer arranque la dejan en esta salida, como hace <code>docker logs</code>. El instalador la lee de ahí para mostrarla en su resumen."
+          }
+        },
+        {
+          "figure": {
+            "src": "/oci-manager/monitor-logs-tab.png",
+            "alt": "Pestaña Logs con la salida de consola de un contenedor OCI, el selector de líneas, el filtro y el botón de seguimiento",
+            "caption": "Salida de consola de un contenedor OCI."
+          }
+        }
+      ]
+    },
+    {
+      "id": "terminal",
+      "title": "Consola de Proxmox VE",
+      "blocks": [
+        {
+          "p": "Una imagen OCI ejecuta su propio proceso como PID 1 y ningún servicio de inicio de sesión, así que la consola predeterminada de un LXC abriría un terminal en el que no responde nadie. Los contenedores instalados por OCI manager Apps se crean con <code>cmode: shell</code>: la consola de Proxmox VE abre un shell con <code>lxc-attach</code>, el equivalente a <code>docker exec</code>, sin tocar la aplicación en marcha."
+        },
+        {
+          "list": {
+            "items": [
+              "El shell es el que <code>/etc/passwd</code> asigna a root en la imagen. Una imagen cuyo root no tiene shell, o que no incluye ninguno, mantiene la consola predeterminada.",
+              "El shell es root dentro del contenedor, sin contraseña. Quién puede abrirlo lo decide el permiso <code>VM.Console</code> de Proxmox VE.",
+              "La terminal del Monitor entra en el contenedor con <code>pct enter</code>, que funciona del mismo modo."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "mounts",
+      "title": "Montajes",
+      "blocks": [
+        {
+          "p": "La pestaña <mountsLink>Montajes</mountsLink> enumera los discos del contenedor y los directorios del host. El uso de un disco del contenedor en almacenamiento de bloques, como LVM-thin, se lee del sistema de archivos del disco, que solo está montado dentro del contenedor."
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/es/docs/oci-manager/stacks.json b/web/messages/es/docs/oci-manager/stacks.json
new file mode 100644
index 00000000..bcf1a50a
--- /dev/null
+++ b/web/messages/es/docs/oci-manager/stacks.json
@@ -0,0 +1,241 @@
+{
+  "meta": {
+    "title": "Aplicaciones multicontenedor | ProxMenux",
+    "description": "Cómo convierte OCI manager Apps una aplicación con su base de datos y su caché en LXC nativos coordinados: plan, red privada, hook de dependencias, validación y actualizaciones transaccionales."
+  },
+  "header": {
+    "title": "Aplicaciones multicontenedor",
+    "description": "Una aplicación con su base de datos, su caché y otros servicios se convierte en varios LXC nativos coordinados, que se instalan y actualizan como uno solo.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "Una aplicación para el usuario, varios LXC para Proxmox VE",
+            "body": "Una definición multicontenedor es una sola entrada del catálogo. El instalador crea un LXC nativo por servicio y mantiene explícitas sus dependencias. Immich, Nextcloud, Paperless-ngx y Tandoor se instalan de esta forma."
+          }
+        },
+        {
+          "mermaid": {
+            "chartCode": "flowchart LR\n C[\"Docker Compose\"] --> O[\"{{plan}}\"]\n O --> A[\"{{app}}<br/>{{appNet}}\"]\n O --> D[\"{{db}}<br/>{{private}}\"]\n O --> R[\"{{cache}}<br/>{{private}}\"]\n V1[(\"config\")] --> A\n V2[(\"database\")] --> D\n V3[(\"cache\")] --> R\n D --> A\n R --> A",
+            "labels": { "plan": "Plan de la pila", "app": "LXC de la aplicación", "appNet": "LAN + privada", "db": "LXC PostgreSQL", "cache": "LXC Valkey", "private": "privada" }
+          }
+        }
+      ]
+    },
+    {
+      "id": "plan",
+      "title": "1. El plan, antes de que exista ningún contenedor",
+      "blocks": [
+        {
+          "p": "Mientras se interpreta la definición Compose no se crea ningún LXC. Primero se construye un plan completo con cada miembro, imagen, VMID, red, ruta, secreto, orden y comprobación de salud. Si el plan no es coherente, la instalación no empieza."
+        },
+        {
+          "table": {
+            "headers": ["Elemento del plan", "Contenido", "Comprobado antes de crear nada"],
+            "rows": [
+              ["Miembros", "Aplicación principal, base de datos, caché, aprendizaje automático y demás dependencias", "VMID únicos, roles conocidos y exactamente un miembro principal"],
+              ["Imágenes", "Referencia rolling, arquitectura y digest resuelto de cada servicio", "Todas existen, admiten la arquitectura y superan la verificación de integridad OCI"],
+              ["Red", "Bridge privado, subred, una dirección fija por servicio y acceso LAN para el miembro principal", "Sin colisión con bridges o subredes existentes y sin direcciones repetidas"],
+              ["Persistencia", "Discos del contenedor, directorios del host, propietarios y backup", "Rutas sin solapamientos, almacenamiento disponible y permisos declarados"],
+              ["Secretos", "Contraseña de la base de datos, claves de la aplicación y credenciales iniciales", "Se generan una vez y solo se entregan a los miembros que los usan"],
+              ["Ciclo de vida", "Orden de arranque, orden de parada y una comprobación de salud por miembro", "La aplicación principal arranca la última y se detiene la primera"]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "create",
+      "title": "2. Creación, miembro a miembro",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              { "title": "Reservar todos los VMID", "body": "Se comprueban el inventario de Proxmox VE y el registro de instancias. No se adopta un CT existente ni se reutiliza un contrato que todavía pertenece a otra instancia." },
+              { "title": "Preparar todas las imágenes", "body": "Todas las imágenes se resuelven, descargan y verifican antes de crear el primer contenedor." },
+              { "title": "Crear cada rootfs", "body": "Se importan los metadatos OCI oficiales y se añaden la identidad de instancia de ProxMenux y el rol del miembro." },
+              { "title": "Red privada", "body": "Se crean un bridge y una subred y cada miembro recibe su dirección fija; solo el miembro principal recibe además la interfaz de la LAN." },
+              { "title": "Persistencia", "body": "Cada base de datos y configuración recibe su propio disco del contenedor; solo los datos destinados a compartirse usan directorios del host." },
+              { "title": "Entorno", "body": "Se escriben los endpoints internos, los secretos compartidos y las variables de servicio. La aplicación llega a sus dependencias en sus direcciones privadas reservadas." },
+              { "title": "Registro", "body": "Cada miembro registra su configuración nativa, los cambios del rootfs que las actualizaciones deben reproducir y su relación con la pila." }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "checks",
+      "title": "3. Arranque y comprobación de cada contenedor",
+      "intro": "Un LXC creado no significa un servicio listo. Las dependencias arrancan en orden y cada una supera una comprobación propia de su servicio.",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Servicio", "Comprobación", "Qué demuestra"],
+            "rows": [
+              ["PostgreSQL", "<code>pg_isready</code> en el CT con el host, el usuario y la base de datos esperados", "El servidor acepta conexiones para la base de datos configurada"],
+              ["Redis / Valkey", "<code>redis-cli</code> o <code>valkey-cli</code> <code>PING</code> contra su dirección privada", "El broker escucha y responde"],
+              ["Aprendizaje automático de Immich", "HTTP <code>GET /ping</code>, más una comprobación del runtime GPU seleccionado", "El servicio responde y la aceleración pedida no ha pasado a CPU"],
+              ["Nextcloud", "<code>GET /status.php</code> con <code>installed=true</code>, <code>maintenance=false</code> y <code>needsDbUpgrade=false</code>", "La inicialización terminó sin migraciones pendientes"],
+              ["Paperless-ngx / Tandoor", "HTTP en la dirección de la LAN y el puerto real del servicio", "El frontend y sus dependencias sirven la aplicación"],
+              ["Aplicación principal", "El endpoint de su plantilla, por ejemplo <code>/api/server/ping</code> en Immich", "La pila completa funciona a través de la aplicación que usa las dependencias"]
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "running no significa healthy",
+            "body": "El estado running solo indica que existe el proceso del LXC. Cuando el servicio ofrece una comprobación mejor, se usa una comprobación exec o HTTP con un tiempo límite. Si un miembro se detiene o no supera su comprobación, la pila no se declara instalada."
+          }
+        }
+      ]
+    },
+    {
+      "id": "hook",
+      "title": "4. El hook de dependencias",
+      "blocks": [
+        {
+          "p": "El hook solo se configura en el contenedor principal de una pila dependiente. Proxmox VE guarda el script como snippet y lo ejecuta como <code>hookscript</code> de ese CT. La receta de la pila no está escrita en el script: vive en un contrato privado aparte."
+        },
+        {
+          "codeGrid": {
+            "items": [
+              { "title": "Configuración del CT principal", "code": "hookscript: local:snippets/proxmenux-stack-dependencies.sh" },
+              { "title": "Contrato privado (ejemplo)", "code": "/etc/pve/priv/proxmenux-stack-VMID.json\n{\n  \"schema\": 1,\n  \"stack\": \"immich\",\n  \"dependencies\": [\n    {\"vmid\": 107, \"label\": \"PostgreSQL\", \"healthcheck\": {...}},\n    {\"vmid\": 108, \"label\": \"Valkey\", \"healthcheck\": {...}},\n    {\"vmid\": 106, \"label\": \"Machine Learning\", \"healthcheck\": {...}}\n  ]\n}" }
+            ]
+          }
+        },
+        {
+          "snippet": {
+            "summary": "Código completo de proxmenux-stack-dependencies.sh",
+            "pathCode": "local:snippets/proxmenux-stack-dependencies.sh",
+            "snippetCode": "stackDependencyHook"
+          }
+        },
+        {
+          "p": "El script es el mismo para todas las pilas. Los VMID, los nombres, los tipos de comprobación y los tiempos límite proceden del contrato privado <code>/etc/pve/priv/proxmenux-stack-VMID.json</code> de cada pila."
+        },
+        {
+          "steps": {
+            "items": [
+              { "title": "Proxmox VE llama a pre-start", "body": "Antes de arrancar el CT principal, el hook se ejecuta con su VMID y la fase del ciclo de vida." },
+              { "title": "Un bloqueo por pila", "body": "<code>flock</code> sobre <code>/run/lock/proxmenux-stack-VMID.lock</code> impide dos secuencias de arranque a la vez." },
+              { "title": "Se lee y valida el contrato", "body": "Se exigen un esquema conocido, dependencias numéricas, etiquetas, una comprobación exec, http o running y un tiempo límite positivo." },
+              { "title": "Dependencias en orden", "body": "Cada CT debe existir; uno detenido se arranca y uno que ya está en marcha no se reinicia." },
+              { "title": "Espera de salud", "body": "La comprobación se ejecuta cada dos segundos y se confirma además que el CT sigue en marcha." },
+              { "title": "Arranca el CT principal", "body": "Cuando todas las dependencias están listas, pre-start termina y Proxmox VE arranca la aplicación." }
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "El hook no detiene dependencias",
+            "body": "Las fases post-start, pre-stop y post-stop no hacen nada. Detener el CT principal deja en marcha PostgreSQL, Redis, Valkey o el aprendizaje automático. El hook ordena el arranque; no convierte varios LXC en un único proceso."
+          }
+        },
+        {
+          "table": {
+            "headers": ["Tipo", "Ejemplo", "Arranques posteriores"],
+            "rows": [
+              ["Pila dependiente", "Immich, Nextcloud, aplicación con PostgreSQL", "El hook del CT principal arranca las dependencias y las espera"],
+              ["Suite de aplicaciones", "Suite Arr", "Sin miembro principal: cada LXC sigue su propio <code>onboot</code>"],
+              ["Aplicación simple", "Jellyfin", "Proxmox VE arranca directamente ese LXC"]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "stack-checks",
+      "title": "5. Comprobaciones sobre la pila completa",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Cada VMID existe, es único y conserva la identidad de instancia esperada.",
+              "Cada contrato pertenece a la misma pila y conserva su rol y su configuración nativa registrada.",
+              "El miembro principal es el último en <code>start_order</code> y el primero en <code>stop_order</code>.",
+              "No falta ningún miembro, volumen ni adaptación del rootfs.",
+              "El hook apunta al snippet oficial, su contenido no ha cambiado y su contrato coincide con la receta de la pila.",
+              "Las imágenes y los digests observados coinciden con los archivos OCI preparados.",
+              "Dispositivos, perfiles GPU, montajes, secretos y endpoints siguen coincidiendo con los contratos.",
+              "Cuando todas las dependencias pasan, el endpoint de la aplicación principal comprueba la integración entre miembros."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "manage",
+      "title": "Gestión de una pila instalada",
+      "intro": "En <strong>Gestionar aplicaciones OCI instaladas</strong>, cualquier miembro lleva a la pila completa. El menú de una pila ofrece <strong>Actualizar cada contenedor de la aplicación</strong> y <strong>Eliminar: la aplicación y sus contenedores</strong>.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              { "title": "Cualquier miembro", "body": "El contrato del miembro indica el VMID principal y la lista completa de miembros." },
+              { "title": "La pila es reproducible", "body": "Se validan identidades, contratos, hook, adaptaciones y la existencia de una reproducción coordinada para esa receta." },
+              { "title": "Primero las imágenes", "body": "La aplicación no se detiene hasta que todos los digests están resueltos, descargados y verificados." },
+              { "title": "Detener y respaldar el conjunto", "body": "Los backups nativos verificados se toman con la pila detenida, de modo que aplicación y bases de datos corresponden al mismo momento." },
+              { "title": "Actualizar y comprobar cada miembro", "body": "Adaptación, red, montajes, secretos y dispositivos se aplican de nuevo antes de la comprobación de salud de cada miembro." },
+              { "title": "Publicar o recuperar todo", "body": "Los contratos nuevos solo se publican cuando todos los miembros pasan. Si uno falla, se restauran todos." }
+            ]
+          }
+        },
+        {
+          "calloutWarning": {
+            "title": "Una pila sin reproducción coordinada no se actualiza",
+            "body": "Si la preparación de una pila no puede reproducirse, la actualización se rechaza antes de detenerla. La aplicación sigue funcionando tal como está."
+          }
+        }
+      ]
+    },
+    {
+      "id": "failure",
+      "title": "6. Cuando algo falla",
+      "blocks": [
+        {
+          "p": "Durante una instalación, un error detiene y elimina los contenedores incompletos que creó esa operación, y el bridge privado si lo creó ella. Una pila no se publica como válida hasta que termina la secuencia completa."
+        },
+        {
+          "p": "Una actualización es transaccional: primero se preparan todas las imágenes, después se detiene la pila, se hace el backup de cada miembro y se verifica, y solo entonces se sustituye cada rootfs. Los miembros arrancan uno a uno con su comprobación de salud; si uno falla, se restauran todos desde el mismo conjunto de backups, de modo que la base de datos y la aplicación nunca corresponden a momentos distintos."
+        },
+        {
+          "mermaid": {
+            "chartCode": "flowchart LR\n P[\"{{prepare}}\"] --> S[\"{{stop}}\"]\n S --> B[\"{{backup}}\"]\n B --> R[\"{{replace}}\"]\n R --> H{\"{{healthy}}\"}\n H -- \"{{yes}}\" --> C[\"{{commit}}\"]\n H -- \"{{no}}\" --> X[\"{{rollback}}\"]",
+            "labels": {
+              "prepare": "Preparar todas las imágenes",
+              "stop": "Detener, primero el principal",
+              "backup": "Backup verificado de cada CT",
+              "replace": "Sustituir el rootfs",
+              "healthy": "¿Todos sanos?",
+              "yes": "Sí",
+              "no": "No",
+              "commit": "Publicar los contratos",
+              "rollback": "Restaurar todos los miembros"
+            }
+          }
+        }
+      ]
+    },
+    {
+      "id": "not-assumed",
+      "title": "Qué no incluye una pila",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Una suite instalada en un único recorrido, como la Suite Arr, no es una pila dependiente: sus contenedores no tienen orden de arranque entre ellos.",
+              "La red privada no sustituye la autenticación, TLS ni la configuración de cada aplicación.",
+              "El backup de un LXC no contiene el bridge, el hook ni los contratos del resto de la pila.",
+              "Prowlarr, Sonarr o Radarr no reciben indexadores, perfiles ni proveedores de ProxMenux."
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/es/docs/oci-manager/storage-network.json b/web/messages/es/docs/oci-manager/storage-network.json
new file mode 100644
index 00000000..8359ee28
--- /dev/null
+++ b/web/messages/es/docs/oci-manager/storage-network.json
@@ -0,0 +1,190 @@
+{
+  "meta": {
+    "title": "Datos, rutas y red | ProxMenux",
+    "description": "Cómo conserva OCI manager Apps los datos de un contenedor OCI: discos del contenedor, directorios del host, montajes Rclone, direcciones y redes privadas."
+  },
+  "header": {
+    "title": "Datos, rutas y red",
+    "description": "Qué vive en el rootfs, qué sobrevive a su sustitución, cómo se comparten datos entre contenedores y cómo obtiene cada contenedor su dirección.",
+    "section": "OCI manager Apps"
+  },
+  "sections": [
+    {
+      "id": "intro",
+      "blocks": [
+        {
+          "calloutInfo": {
+            "title": "La persistencia se decide antes de que exista el LXC",
+            "body": "Los volúmenes que publican la imagen y su archivo Compose se leen antes de crear el contenedor. Cada ruta que debe sobrevivir a una actualización se convierte en un punto de montaje independiente del rootfs, de modo que el rootfs solo contiene lo que pertenece a la imagen y puede sustituirse."
+          }
+        }
+      ]
+    },
+    {
+      "id": "questions",
+      "title": "Qué pregunta el instalador",
+      "intro": "La plantilla aporta las rutas que necesita la aplicación. Cada una se sitúa en un disco del contenedor o en un directorio del host, y pueden añadirse más rutas antes del resumen.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              { "title": "Rutas requeridas", "body": "Se enumeran <code>/config</code>, <code>/data</code>, bibliotecas, descargas y cualquier volumen que declare la aplicación." },
+              { "title": "Ubicación", "body": "Cada ruta se sitúa en un disco del contenedor o en un directorio existente del host." },
+              { "title": "Almacenamiento y tamaño", "body": "Un disco del contenedor se crea en un almacenamiento de Proxmox VE, <code>local-lvm</code> por defecto, con el tamaño indicado. Aparece como <code>vm-VMID-disk-N</code> y se conecta como <code>mpN</code>." },
+              { "title": "Directorio del host", "body": "Un directorio del host se indica por su ruta. Si no existe, se crea con el propietario que mapea el contenedor." },
+              { "title": "Rutas adicionales", "body": "Antes de instalar pueden añadirse más pares de ruta del host o volumen y ruta del contenedor." },
+              { "title": "Resumen", "body": "La relación completa se muestra antes de crear el CT y se guarda en su contrato de instancia." }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "options",
+      "title": "Las dos ubicaciones persistentes",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Propiedad", "Disco del contenedor", "Directorio del host"],
+            "rows": [
+              ["En la configuración", "<code>mpN: STORAGE:vm-VMID-disk-N,mp=/config,backup=1,size=16G</code>", "<code>mpN: /mnt/oci-shared/media,mp=/data/media</code>"],
+              ["Backup del contenedor (vzdump)", "Incluido, con <code>backup=1</code>", "No incluido"],
+              ["Tamaño", "Fijo; crece con un redimensionado del punto de montaje", "El espacio libre del sistema de archivos o dataset del host"],
+              ["Otros contenedores", "Solo lo monta su propio contenedor", "El mismo directorio puede montarse en varios contenedores"],
+              ["Snapshots y restauración", "Los gestiona Proxmox VE junto con el CT", "Se gestionan en el almacenamiento del host"],
+              ["Al eliminar la aplicación", "Se elimina con el contenedor", "Se conserva, con su contenido"],
+              ["Al mover el CT a otro nodo", "Se mueve con el CT", "La misma ruta debe existir en el otro nodo"]
+            ]
+          }
+        },
+        {
+          "p": "El rootfs queda reservado para los binarios y el contenido de la imagen. Una actualización o una recreación lo sustituye sin tocar ninguno de los dos tipos de punto de montaje."
+        }
+      ]
+    },
+    {
+      "id": "example",
+      "title": "Ejemplo: un contenedor con las dos ubicaciones",
+      "blocks": [
+        {
+          "code": {
+            "title": "Jellyfin instalado como CT 151 en local-lvm (extracto)",
+            "code": "rootfs: local-lvm:vm-151-disk-0,size=8G\n# Disco del contenedor, incluido en el backup del CT\nmp0: local-lvm:vm-151-disk-1,mp=/config,backup=1,size=16G\n\n# Directorio del host, fuera del backup del CT\nmp1: /mnt/oci-shared/media,mp=/data/media"
+          }
+        },
+        {
+          "p": "Una actualización o una recreación sustituye solo el rootfs: <code>mp0</code> conserva usuarios, bibliotecas y ajustes, y <code>mp1</code> sigue mostrando los mismos archivos multimedia. Restaurar el backup del CT devuelve <code>/config</code>; el directorio multimedia se restaura, si hace falta, desde el backup del almacenamiento del host."
+        },
+        {
+          "flow": {
+            "nodes": [
+              { "label": "Contrato", "detail": "/config" },
+              { "label": "Ubicación", "detail": "disco del contenedor\no directorio del host" },
+              { "label": "LXC", "detail": "siempre /config\npara la aplicación" }
+            ],
+            "caption": "La aplicación ve la ruta que publica la imagen; solo cambia dónde se guarda."
+          }
+        }
+      ]
+    },
+    {
+      "id": "shared",
+      "title": "Un directorio del host, varios contenedores",
+      "blocks": [
+        {
+          "mermaid": {
+            "chartCode": "flowchart TB\n H[\"{{host}}<br/>/mnt/oci-shared/media\"]\n H --> Q[\"qBittorrent<br/>/data\"]\n H --> J[\"Jellyfin<br/>/data\"]\n H --> R[\"Radarr / Sonarr<br/>/data\"]\n Q -. \"{{config}}\" .-> QV[(\"/config mpN\")]\n J -. \"{{config}}\" .-> JV[(\"/config mpN\")]\n R -. \"{{config}}\" .-> RV[(\"/config mpN\")]",
+            "labels": { "host": "Directorio del host", "config": "configuración propia" }
+          }
+        },
+        {
+          "p": "Cada contenedor guarda su configuración en su propio disco. La biblioteca o las descargas son un único directorio del host montado en la misma ruta interna de todos los contenedores, de modo que la ruta en la que escribe una aplicación es la misma en la que lee otra."
+        }
+      ]
+    },
+    {
+      "id": "rclone",
+      "title": "Almacenamiento en la nube con la aplicación Rclone",
+      "intro": "La aplicación Rclone del catálogo ofrece, además de su instalación, <strong>Activar un montaje en un contenedor Rclone OCI existente</strong>. Monta un remoto ya creado y autorizado en la interfaz web de Rclone y lo publica en el host, donde otros contenedores pueden usarlo como directorio del host.",
+      "blocks": [
+        {
+          "steps": {
+            "items": [
+              { "title": "Contenedor y remoto", "body": "El VMID del contenedor Rclone, el nombre exacto del remoto y, opcionalmente, una ruta dentro de él." },
+              { "title": "Nombre y caché", "body": "El nombre del montaje y el modo de caché VFS: <code>off</code>, <code>minimal</code>, <code>writes</code> o <code>full</code> (por defecto)." },
+              { "title": "Vistas publicadas", "body": "Una raíz común, <code>/mnt/oci-shared</code> por defecto, contiene una vista de lectura y escritura en <code>/mnt/oci-shared/remotes/NOMBRE</code> y una de solo lectura en <code>/mnt/oci-shared/remotes-ro/NOMBRE</code>." },
+              { "title": "Activación", "body": "Tras una confirmación, el CT se detiene, se configuran su orden de arranque y un hookscript de Proxmox VE, y se vuelve a iniciar. La operación espera hasta que las dos vistas están montadas en el host." }
+            ]
+          }
+        },
+        {
+          "calloutInfo": {
+            "title": "Si el montaje no llega a activarse",
+            "body": "Se restaura la configuración anterior del contenedor y se vuelve a iniciar, de modo que una activación fallida deja Rclone como estaba."
+          }
+        }
+      ]
+    },
+    {
+      "id": "network",
+      "title": "Direcciones y redes",
+      "intro": "Una aplicación simple necesita una dirección. Una aplicación multicontenedor necesita además una red estable entre sus miembros.",
+      "blocks": [
+        {
+          "cards": {
+            "items": [
+              { "icon": "network", "title": "Aplicación simple", "body": "Se eligen el bridge y DHCP o una dirección CIDR fija. El LXC tiene una dirección propia y el resumen muestra las URL completas de los servicios." },
+              { "icon": "waypoints", "title": "Aplicación multicontenedor", "body": "Se busca una subred libre, se crea un bridge privado persistente y cada miembro (aplicación, base de datos, caché) recibe en él una dirección fija." }
+            ]
+          }
+        },
+        {
+          "flow": {
+            "nodes": [
+              { "label": "LAN", "detail": "dirección accesible\nsolo el servicio principal" },
+              { "label": "LXC principal", "detail": "web / API\nLAN + red privada" },
+              { "label": "Red privada", "detail": "PostgreSQL · Valkey · ML\ndirecciones fijas" }
+            ],
+            "caption": "Las dependencias se comunican por la red privada y no tienen dirección en la LAN."
+          }
+        },
+        {
+          "p": "El contrato de la pila guarda el bridge, la subred, las direcciones y las relaciones entre servicios. Actualizar o recrear un miembro reutiliza la misma topología. ProxMenux Monitor abre el contenedor principal en su dirección de la LAN, no en la de la red privada."
+        }
+      ]
+    },
+    {
+      "id": "ownership",
+      "title": "Propietarios",
+      "blocks": [
+        {
+          "list": {
+            "items": [
+              "Los directorios nuevos se crean con el UID y el GID que mapea el LXC no privilegiado.",
+              "Los directorios existentes no cambian de propietario de forma recursiva.",
+              "Los sockets, los archivos del sistema y las rutas sensibles no se ofrecen como directorios del host genéricos."
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "id": "backup",
+      "title": "Qué contiene el backup de un contenedor",
+      "blocks": [
+        {
+          "table": {
+            "headers": ["Elemento", "En el vzdump del CT", "Dónde se conserva"],
+            "rows": [
+              ["rootfs OCI", "Sí", "El backup del CT; también puede reconstruirse desde la imagen y el contrato"],
+              ["Disco del contenedor con <code>backup=1</code>", "Sí", "El backup del CT"],
+              ["Directorio del host", "No", "El backup del almacenamiento del host"],
+              ["Contrato de la instancia", "No", "<code>/usr/local/share/proxmenux/oci/instances/VMID/</code> en el host"],
+              ["Aplicación multicontenedor", "Cada miembro en su propio backup", "Los backups de cada miembro, más el contrato de la pila y su bridge en el host"]
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/web/messages/es/docs/settings/change-language.json b/web/messages/es/docs/settings/change-language.json
index 7ebc28dc..573abf8b 100644
--- a/web/messages/es/docs/settings/change-language.json
+++ b/web/messages/es/docs/settings/change-language.json
@@ -64,7 +64,7 @@
     "heading": "Cómo funciona por dentro",
     "items": [
       "El menú de diálogo lista los 6 códigos; eliges uno.",
-      "Si <code>config.json</code> existe: <code>jq --arg lang \"$new_language\" '.language = $lang'</code> actualiza el campo en sitio.",
+      "Si <code>config.json</code> existe: <code>jq --arg lang \"$new_language\" '.language = $lang''</code> actualiza el campo en sitio.",
       "Si <code>config.json</code> no existe: se crea uno nuevo con el código de idioma en un objeto de un solo campo.",
       "Diálogo de confirmación: <em>\"Idioma cambiado a [code]\"</em>.",
       "<code>exec bash config_menu.sh</code> recarga el menú Settings con el nuevo idioma activo."