build(deps): bump the actions group across 1 directory with 14 updates

Bumps the actions group with 14 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `7.0.1` | | [actions/setup-go](https://github.com/actions/setup-go) | `5` | `7` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.1.0` | `4.2.0` | | [actions/cache](https://github.com/actions/cache) | `4` | `6` | | [actions/setup-node](https://github.com/actions/setup-node) | `4` | `7` | | [pnpm/action-setup](https://github.com/pnpm/action-setup) | `3.0.0` | `6.0.10` | | [vmactions/freebsd-vm](https://github.com/vmactions/freebsd-vm) | `1.4.8` | `1.5.3` | | [dorny/paths-filter](https://github.com/dorny/paths-filter) | `4.0.1` | `4.0.2` | | [actions/cache/restore](https://github.com/actions/cache) | `6.0.0` | `6.1.0` | | [docker/login-action](https://github.com/docker/login-action) | `4.2.0` | `4.6.0` | | [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) | `9.2.1` | `9.3.0` | | [actions/setup-java](https://github.com/actions/setup-java) | `5.4.0` | `5.7.0` | | [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `4.1.0` | `4.2.0` | | [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `7.2.2` | `7.2.3` | Updates `actions/checkout` from 6.0.2 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6.0.2...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `actions/setup-go` from 5 to 7 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/v5...v7) Updates `docker/setup-buildx-action` from 4.1.0 to 4.2.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](d7f5e7f509...bb05f3f551) Updates `actions/cache` from 4 to 6 - [Release notes](https://github.com/actions/cache/releases) - [Commits](https://github.com/actions/cache/compare/v4...v6) Updates `actions/setup-node` from 4 to 7 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/v4...v7) Updates `pnpm/action-setup` from 3.0.0 to 6.0.10 - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](a3252b78c4...0977fd9972) Updates `vmactions/freebsd-vm` from 1.4.8 to 1.5.3 - [Release notes](https://github.com/vmactions/freebsd-vm/releases) - [Commits](b84ab5559b...83b151f58c) Updates `dorny/paths-filter` from 4.0.1 to 4.0.2 - [Release notes](https://github.com/dorny/paths-filter/releases) - [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md) - [Commits](fbd0ab8f3e...7b450fff21) Updates `actions/cache/restore` from 6.0.0 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](2c8a9bd745...55cc834586) Updates `docker/login-action` from 4.2.0 to 4.6.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](650006c6eb...dbcb813823) Updates `golangci/golangci-lint-action` from 9.2.1 to 9.3.0 - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](82606bf257...ba0d7d2ec0) Updates `actions/setup-java` from 5.4.0 to 5.7.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](1bcf9fb12c...b6effb05e4) Updates `docker/setup-qemu-action` from 4.1.0 to 4.2.0 - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](06116385d9...96fe6ef7f3) Updates `goreleaser/goreleaser-action` from 7.2.2 to 7.2.3 - [Release notes](https://github.com/goreleaser/goreleaser-action/releases) - [Commits](5daf1e915a...f06c13b6b1) --- updated-dependencies: - dependency-name: actions/cache dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/cache/restore dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-go dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-java dependency-version: 5.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/setup-node dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/login-action dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/setup-buildx-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/setup-qemu-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: dorny/paths-filter dependency-version: 4.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: golangci/golangci-lint-action dependency-version: 9.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: goreleaser/goreleaser-action dependency-version: 7.2.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: pnpm/action-setup dependency-version: 6.0.9 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: vmactions/freebsd-vm dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
2026-08-07 10:38:55 -04:00 · 2026-08-06 10:20:32 +00:00
49 changed files with 175 additions and 1157 deletions
--- a/.github/workflows/agent-network-e2e.yml
+++ b/.github/workflows/agent-network-e2e.yml
@@ -24,25 +24,25 @@ jobs:
    timeout-minutes: 45
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: "go.mod"

      # Container-driver builder so the harness can build the combined/proxy/
      # client images from source with a local layer cache.
      - name: Set up Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      # Persist the Docker layer cache across runs. This caches the base, apt,
      # and go-mod-download layers; the Go compile still re-runs, as BuildKit
      # mount caches cannot be exported to the GitHub cache.
      - name: Cache Docker layers
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: /tmp/.buildx-cache
          key: ${{ runner.os }}-anet-e2e-buildx-${{ hashFiles('go.sum', 'combined/Dockerfile.multistage', 'proxy/Dockerfile.multistage', 'e2e/harness/Dockerfile.client') }}
--- a/.github/workflows/check-license-dependencies.yml
+++ b/.github/workflows/check-license-dependencies.yml
@@ -20,7 +20,7 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

@@ -59,12 +59,12 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: "go.mod"
          cache: true
--- a/.github/workflows/frontend-ui.yml
+++ b/.github/workflows/frontend-ui.yml
@@ -32,17 +32,17 @@ jobs:
        working-directory: client/ui/frontend
    steps:
      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
        with:
          node-version: "22"

      - name: Set up pnpm
-        uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
        with:
          version: 11

@@ -50,7 +50,7 @@ jobs:
      # are not checked in (see client/ui/frontend/bindings/). Without them,
      # typecheck/build fail on missing module imports.
      - name: Set up Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: "go.mod"
          cache: false
@@ -78,7 +78,7 @@ jobs:
        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"

      - name: Cache pnpm store
-        uses: actions/cache@v4
+        uses: actions/cache@v6
        with:
          path: ${{ steps.pnpm-store.outputs.path }}
          key: ${{ runner.os }}-pnpm-${{ hashFiles('client/ui/frontend/pnpm-lock.yaml') }}
--- a/.github/workflows/git-town.yml
+++ b/.github/workflows/git-town.yml
@@ -15,7 +15,7 @@ jobs:
      pull-requests: write

    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: git-town/action@3d8b878379abb1ee393fb49865a28b4a6c2cd3b0 # v1.2.1
--- a/.github/workflows/golang-test-darwin.yml
+++ b/.github/workflows/golang-test-darwin.yml
@@ -16,18 +16,18 @@ jobs:
    runs-on: macos-latest
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: "go.mod"
          cache: false

      - name: Cache Go modules
-        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/go/pkg/mod
          key: macos-gotest-${{ hashFiles('**/go.sum') }}
--- a/.github/workflows/golang-test-freebsd.yml
+++ b/.github/workflows/golang-test-freebsd.yml
@@ -16,7 +16,7 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

@@ -28,7 +28,7 @@ jobs:
        id: test
        env:
          GO_VERSION: ${{ steps.goversion.outputs.version }}
-        uses: vmactions/freebsd-vm@b84ab5559b5a1bb4b8ee2737d2506a16e1737636 # v1.4.8
+        uses: vmactions/freebsd-vm@83b151f58c6047089f4c80eb5ba2039d158ce093 # v1.5.3
        with:
          usesh: true
          copyback: false
--- a/.github/workflows/golang-test-linux.yml
+++ b/.github/workflows/golang-test-linux.yml
@@ -18,11 +18,11 @@ jobs:
      management: ${{ steps.filter.outputs.management }}
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

-      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
        id: filter
        with:
          filters: |
@@ -30,7 +30,7 @@ jobs:
              - 'management/**'

      - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: "go.mod"
          cache: false
@@ -41,7 +41,7 @@ jobs:
          echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV

      - name: Cache Go modules
-        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache
        with:
          path: |
@@ -119,12 +119,12 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: "go.mod"
          cache: false
@@ -135,7 +135,7 @@ jobs:
          echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV

      - name: Cache Go modules
-        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ${{ env.cache }}
@@ -182,12 +182,12 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: "go.mod"
          cache: false
@@ -199,7 +199,7 @@ jobs:
          echo "modcache_dir=$(go env GOMODCACHE)" >> $GITHUB_OUTPUT

      - name: Cache Go modules
-        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache-restore
        with:
          path: |
@@ -253,12 +253,12 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: "go.mod"
          cache: false
@@ -273,7 +273,7 @@ jobs:
          echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV

      - name: Cache Go modules
-        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ${{ env.cache }}
@@ -313,12 +313,12 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: "go.mod"
          cache: false
@@ -332,7 +332,7 @@ jobs:
          echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV

      - name: Cache Go modules
-        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ${{ env.cache }}
@@ -370,12 +370,12 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: "go.mod"
          cache: false
@@ -390,7 +390,7 @@ jobs:
          echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV

      - name: Cache Go modules
-        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ${{ env.cache }}
@@ -431,12 +431,12 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: "go.mod"
          cache: false
@@ -447,7 +447,7 @@ jobs:
          echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV

      - name: Cache Go modules
-        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ${{ env.cache }}
@@ -464,7 +464,7 @@ jobs:

      - name: Login to Docker hub
        if: github.event.pull_request && github.event.pull_request.head.repo && github.event.pull_request.head.repo.full_name == '' || github.repository == github.event.pull_request.head.repo.full_name || !github.head_ref
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
@@ -536,12 +536,12 @@ jobs:
            prom/prometheus

      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: "go.mod"
          cache: false
@@ -552,7 +552,7 @@ jobs:
          echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV

      - name: Cache Go modules
-        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ${{ env.cache }}
@@ -569,7 +569,7 @@ jobs:

      - name: Login to Docker hub
        if: github.event.pull_request && github.event.pull_request.head.repo && github.event.pull_request.head.repo.full_name == '' || github.repository == github.event.pull_request.head.repo.full_name || !github.head_ref
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
@@ -631,12 +631,12 @@ jobs:
            prom/prometheus

      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: "go.mod"
          cache: false
@@ -647,7 +647,7 @@ jobs:
          echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV

      - name: Cache Go modules
-        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ${{ env.cache }}
@@ -664,7 +664,7 @@ jobs:

      - name: Login to Docker hub
        if: github.event.pull_request && github.event.pull_request.head.repo && github.event.pull_request.head.repo.full_name == '' || github.repository == github.event.pull_request.head.repo.full_name || !github.head_ref
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
@@ -701,12 +701,12 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: "go.mod"
          cache: false
@@ -717,7 +717,7 @@ jobs:
          echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV

      - name: Cache Go modules
-        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ${{ env.cache }}
--- a/.github/workflows/golang-test-windows.yml
+++ b/.github/workflows/golang-test-windows.yml
@@ -18,12 +18,12 @@ jobs:
    runs-on: windows-latest
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        id: go
        with:
          go-version-file: "go.mod"
@@ -35,7 +35,7 @@ jobs:
          echo "modcache=$(go env GOMODCACHE)" >> $env:GITHUB_ENV

      - name: Cache Go modules
-        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ${{ env.cache }}
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -15,7 +15,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: codespell
@@ -48,7 +48,7 @@ jobs:
    timeout-minutes: 25
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Check for duplicate constants
@@ -56,7 +56,7 @@ jobs:
        run: |
          ! awk '/const \(/,/)/{print $0}' management/server/activity/codes.go | grep -o '= [0-9]*' | sort | uniq -d | grep .
      - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: "go.mod"
          cache: false
@@ -73,7 +73,7 @@ jobs:
          mkdir -p client/ui/frontend/dist
          touch client/ui/frontend/dist/.embed-placeholder
      - name: golangci-lint
-        uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee #v9.2.1
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a #v9.3.0
        with:
          version: latest
          skip-cache: true
--- a/.github/workflows/install-script-test.yml
+++ b/.github/workflows/install-script-test.yml
@@ -22,7 +22,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

--- a/.github/workflows/mobile-build-validation.yml
+++ b/.github/workflows/mobile-build-validation.yml
@@ -16,11 +16,11 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: "go.mod"
      - name: Setup Android SDK
@@ -28,13 +28,13 @@ jobs:
        with:
          cmdline-tools-version: 8512546
      - name: Setup Java
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961
        with:
          java-version: "11"
          distribution: "adopt"
      - name: NDK Cache
        id: ndk-cache
-        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: /usr/local/lib/android/sdk/ndk
          key: ndk-cache-23.1.7779620
@@ -54,11 +54,11 @@ jobs:
    runs-on: macos-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: "go.mod"
      - name: install gomobile
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,7 +27,7 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

@@ -64,7 +64,7 @@ jobs:
        if: steps.check_diff.outputs.diff_exists == 'true'
        env:
          GO_VERSION: ${{ steps.goversion.outputs.version }}
-        uses: vmactions/freebsd-vm@b84ab5559b5a1bb4b8ee2737d2506a16e1737636 # v1.4.8
+        uses: vmactions/freebsd-vm@83b151f58c6047089f4c80eb5ba2039d158ce093 # v1.5.3
        with:
          usesh: true
          copyback: false
@@ -135,7 +135,7 @@ jobs:
      ghcr_images: ${{ steps.tag_and_push_images.outputs.images_markdown }}
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0 # It is required for GoReleaser to work properly
          persist-credentials: false
@@ -166,12 +166,12 @@ jobs:
          fi

      - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: "go.mod"
          cache: false
      - name: Cache Go modules
-        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/go/pkg/mod
@@ -186,18 +186,18 @@ jobs:
      - name: check git status
        run: git --no-pager diff --exit-code
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 #v4.1.0
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 #v4.2.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 #v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c #v4.2.0
      - name: Login to Docker hub
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - name: Log in to the GitHub container registry
        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -221,7 +221,7 @@ jobs:
        run: goversioninfo -arm -64 -icon client/ui/build/windows/icon.ico -manifest client/manifest.xml -product-name ${{ env.PRODUCT_NAME }} -copyright "${{ env.COPYRIGHT }}" -ver-major ${{ steps.semver_parser.outputs.major }} -ver-minor ${{ steps.semver_parser.outputs.minor }} -ver-patch ${{ steps.semver_parser.outputs.patch }} -ver-build 0 -file-version ${{ steps.semver_parser.outputs.fullversion }}.0 -product-version ${{ steps.semver_parser.outputs.fullversion }}.0 -o client/resources_windows_arm64.syso
      - name: Run GoReleaser
        id: goreleaser
-        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
        with:
          version: ${{ env.GORELEASER_VER }}
          args: release --clean ${{ env.flags }}
@@ -350,7 +350,7 @@ jobs:
      release_ui_artifact_url: ${{ steps.upload_release_ui.outputs.artifact-url }}
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0 # It is required for GoReleaser to work properly
          persist-credentials: false
@@ -377,12 +377,12 @@ jobs:
          fi

      - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: "go.mod"
          cache: false
      - name: Cache Go modules
-        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/go/pkg/mod
@@ -398,12 +398,12 @@ jobs:
        run: git --no-pager diff --exit-code

      - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
        with:
          node-version: '22'

      - name: Set up pnpm
-        uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
        with:
          version: 11

@@ -439,7 +439,7 @@ jobs:
        run: goversioninfo -arm -64 -icon client/ui/build/windows/icon.ico -manifest client/ui/build/windows/wails.exe.manifest -product-name ${{ env.PRODUCT_NAME }}-"UI" -copyright "${{ env.COPYRIGHT }}" -ver-major ${{ steps.semver_parser.outputs.major }} -ver-minor ${{ steps.semver_parser.outputs.minor }} -ver-patch ${{ steps.semver_parser.outputs.patch }} -ver-build 0 -file-version ${{ steps.semver_parser.outputs.fullversion }}.0 -product-version ${{ steps.semver_parser.outputs.fullversion }}.0 -o client/ui/resources_windows_arm64.syso

      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
        with:
          version: ${{ env.GORELEASER_VER }}
          args: release --config .goreleaser_ui.yaml --clean ${{ env.flags }}
@@ -484,7 +484,7 @@ jobs:
      release_ui_gtk3_artifact_url: ${{ steps.upload_release_ui_gtk3.outputs.artifact-url }}
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0 # It is required for GoReleaser to work properly
          persist-credentials: false
@@ -511,7 +511,7 @@ jobs:
          fi

      - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: "go.mod"
          cache: false
@@ -519,7 +519,7 @@ jobs:
        # Restore-only from the release_ui cache written by trusted runs; the
        # module cache is identical (same go.sum) and stale build-cache
        # entries just miss.
-        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/go/pkg/mod
@@ -535,12 +535,12 @@ jobs:
        run: git --no-pager diff --exit-code

      - name: Set up Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'

      - name: Set up pnpm
-        uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
        with:
          version: 11

@@ -566,7 +566,7 @@ jobs:
          go install -tags gtk3 github.com/wailsapp/wails/v3/cmd/wails3@$WAILS_VERSION

      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
        with:
          version: ${{ env.GORELEASER_VER }}
          args: release --config .goreleaser_ui_gtk3.yaml --clean ${{ env.flags }}
@@ -609,17 +609,17 @@ jobs:
      - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
        run: echo "flags=--snapshot" >> $GITHUB_ENV
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0 # It is required for GoReleaser to work properly
          persist-credentials: false
      - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: "go.mod"
          cache: false
      - name: Cache Go modules
-        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/go/pkg/mod
@@ -632,11 +632,11 @@ jobs:
      - name: check git status
        run: git --no-pager diff --exit-code
      - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
        with:
          node-version: '22'
      - name: Set up pnpm
-        uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
        with:
          version: 11
      - name: Install wails3 CLI
@@ -647,7 +647,7 @@ jobs:
          go install github.com/wailsapp/wails/v3/cmd/wails3@$WAILS_VERSION
      - name: Run GoReleaser
        id: goreleaser
-        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
        with:
          version: ${{ env.GORELEASER_VER }}
          args: release --config .goreleaser_ui_darwin.yaml --clean ${{ env.flags }}
@@ -681,7 +681,7 @@ jobs:
      downloadPath: '${{ github.workspace }}\temp'
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

@@ -755,7 +755,7 @@ jobs:
        run: 7z x -o"${{ github.workspace }}/NSIS_Plugins" "${{ github.workspace }}/ShellExecAsUser_amd64-Unicode.7z"

      - name: Set up Go for wails3 CLI
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
        with:
          go-version-file: "go.mod"
          cache: false
--- a/.github/workflows/test-infrastructure-files.yml
+++ b/.github/workflows/test-infrastructure-files.yml
@@ -68,17 +68,17 @@ jobs:
        run: sudo apt-get install -y curl

      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: "go.mod"

      - name: Cache Go modules
-        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
@@ -253,19 +253,10 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

-      - name: Verify fresh-install session cookie key hardening
-        run: |
-          grep -Fxq '  SESSION_COOKIE_ENCRYPTION_KEY=$(openssl rand -base64 32)' infrastructure_files/getting-started.sh
-          grep -Fxq '    sessionCookieEncryptionKey: "$SESSION_COOKIE_ENCRYPTION_KEY"' infrastructure_files/getting-started.sh
-          grep -Fxq '  install -m 600 /dev/null config.yaml' infrastructure_files/getting-started.sh
-          grep -Fxq '  openssl rand -base64 32' infrastructure_files/getting-started-enterprise.sh
-          grep -Fxq '  NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY=$(rand_b64_key)' infrastructure_files/getting-started-enterprise.sh
-          grep -Fxq '    sessionCookieEncryptionKey: "${NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY}"' infrastructure_files/getting-started-enterprise.sh
-
      - name: Verify Dex retirement notice
        run: |
          if infrastructure_files/getting-started-with-dex.sh >stdout.txt 2>stderr.txt; then
--- a/.github/workflows/wasm-build-validation.yml
+++ b/.github/workflows/wasm-build-validation.yml
@@ -19,17 +19,17 @@ jobs:
      GOARCH: wasm
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: "go.mod"
      - name: Install dependencies
        run: sudo apt update && sudo apt install -y -q libgtk-4-dev libwebkitgtk-6.0-dev libsoup-3.0-dev libgl1-mesa-dev xorg-dev libpcap-dev
      - name: Install golangci-lint
-        uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee #v9.2.1
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a #v9.3.0
        with:
          version: latest
          install-mode: binary
@@ -44,11 +44,11 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: "go.mod"
      - name: Build Wasm client
--- a/client/firewall/firewalld/firewalld.go
+++ b/client/firewall/firewalld/firewalld.go
@@ -2,8 +2,8 @@
 // its wg interface into firewalld's "trusted" zone. This is required because
 // firewalld's nftables chains are created with NFT_CHAIN_OWNER on recent
 // versions, which returns EPERM to any other process that tries to insert
-// rules into them. Trusting the interface makes firewalld itself add the
-// accept rules to its own chains instead.
+// rules into them. The workaround mirrors what Tailscale does: let firewalld
+// itself add the accept rules to its own chains by trusting the interface.
 package firewalld

 // TrustedZone is the firewalld zone name used for interfaces whose traffic
--- a/client/ui/frontend/src/hooks/useKeepConnectedOnQuit.ts
+++ b/client/ui/frontend/src/hooks/useKeepConnectedOnQuit.ts
@@ -1,35 +0,0 @@
-import { useCallback, useEffect, useState } from "react";
-import { Preferences } from "@bindings/services";
-
-export const useKeepConnectedOnQuit = () => {
-    const [keepConnected, setKeepConnected] = useState<boolean | null>(null);
-
-    useEffect(() => {
-        let cancelled = false;
-        Preferences.Get()
-            .then((prefs) => {
-                if (cancelled) return;
-                setKeepConnected(prefs?.keepConnectedOnQuit ?? false);
-            })
-            .catch((err: unknown) => {
-                if (cancelled) return;
-                console.warn("[useKeepConnectedOnQuit] load preferences failed", err);
-                setKeepConnected(false);
-            });
-        return () => {
-            cancelled = true;
-        };
-    }, []);
-
-    const setKeepConnectedOnQuit = useCallback(async (keep: boolean) => {
-        setKeepConnected(keep);
-        try {
-            await Preferences.SetKeepConnectedOnQuit(keep);
-        } catch (err: unknown) {
-            setKeepConnected(!keep);
-            console.error("[useKeepConnectedOnQuit] SetKeepConnectedOnQuit failed", err);
-        }
-    }, []);
-
-    return { keepConnected, setKeepConnectedOnQuit };
-};
--- a/client/ui/frontend/src/modules/settings/SettingsGeneral.tsx
+++ b/client/ui/frontend/src/modules/settings/SettingsGeneral.tsx
@@ -11,7 +11,6 @@ import { ManagementServerSwitch } from "@/components/ManagementServerSwitch.tsx"
 import { ManagementMode, useManagementUrl } from "@/hooks/useManagementUrl.ts";
 import { LanguagePicker } from "@/components/LanguagePicker.tsx";
 import { useRestrictions } from "@/contexts/RestrictionsContext.tsx";
-import { useKeepConnectedOnQuit } from "@/hooks/useKeepConnectedOnQuit.ts";

 export function SettingsGeneral() {
    const { t } = useTranslation();
@@ -20,7 +19,6 @@ export function SettingsGeneral() {
    const { mode, setMode, setUrl, displayUrl, showError, canSave, save, checking, unreachable } =
        useManagementUrl();
    const { mdm, features } = useRestrictions();
-    const { keepConnected, setKeepConnectedOnQuit } = useKeepConnectedOnQuit();

    const inputRef = useRef<HTMLInputElement>(null);
    const managementUrlId = useId();
@@ -59,15 +57,6 @@ export function SettingsGeneral() {
                        helpText={t("settings.general.autostart.help")}
                    />
                )}
-                <FancyToggleSwitch
-                    value={keepConnected ?? false}
-                    onChange={(v) => {
-                        void setKeepConnectedOnQuit(v);
-                    }}
-                    loading={keepConnected === null}
-                    label={t("settings.general.keepConnectedOnQuit.label")}
-                    helpText={t("settings.general.keepConnectedOnQuit.help")}
-                />
            </SectionGroup>

            {!mdm.managementURL && !features.disableUpdateSettings && (
--- a/client/ui/i18n/locales/de/common.json
+++ b/client/ui/i18n/locales/de/common.json
@@ -551,14 +551,6 @@
    "settings.general.autostart.errorTitle": {
        "message": "Ändern des Autostarts fehlgeschlagen"
    },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Nach dem Beenden verbunden bleiben",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "Die Verbindung bleibt im Hintergrund bestehen, nachdem Sie NetBird schließen. Sie endet erst, wenn Sie sie selbst trennen.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
    "settings.general.language.label": {
        "message": "Anzeigesprache"
    },
--- a/client/ui/i18n/locales/en/common.json
+++ b/client/ui/i18n/locales/en/common.json
@@ -735,14 +735,6 @@
        "message": "Autostart Change Failed",
        "description": "Error-dialog title when changing the autostart setting fails."
    },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Stay Connected After Quitting",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "The connection stays up in the background after you close NetBird. It only stops when you disconnect it yourself.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
    "settings.general.language.label": {
        "message": "Display Language",
        "description": "Label for the display-language picker."
--- a/client/ui/i18n/locales/es/common.json
+++ b/client/ui/i18n/locales/es/common.json
@@ -551,14 +551,6 @@
    "settings.general.autostart.errorTitle": {
        "message": "Error al cambiar el inicio automático"
    },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Permanecer conectado al salir",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "La conexión sigue activa en segundo plano después de cerrar NetBird. Solo se detiene cuando la desconectas tú.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
    "settings.general.language.label": {
        "message": "Idioma de la interfaz"
    },
--- a/client/ui/i18n/locales/fr/common.json
+++ b/client/ui/i18n/locales/fr/common.json
@@ -551,14 +551,6 @@
    "settings.general.autostart.errorTitle": {
        "message": "Échec de la modification du démarrage automatique"
    },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Rester connecté après la fermeture",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "La connexion reste active en arrière-plan après la fermeture de NetBird. Elle ne s'arrête que si vous la coupez vous-même.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
    "settings.general.language.label": {
        "message": "Langue d’affichage"
    },
--- a/client/ui/i18n/locales/hu/common.json
+++ b/client/ui/i18n/locales/hu/common.json
@@ -551,14 +551,6 @@
    "settings.general.autostart.errorTitle": {
        "message": "Az automatikus indítás módosítása sikertelen"
    },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Kapcsolat megtartása kilépéskor",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "A kapcsolat a háttérben megmarad, miután bezárod a NetBirdöt. Csak akkor szakad meg, ha te magad bontod.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
    "settings.general.language.label": {
        "message": "Megjelenítési nyelv"
    },
--- a/client/ui/i18n/locales/it/common.json
+++ b/client/ui/i18n/locales/it/common.json
@@ -551,14 +551,6 @@
    "settings.general.autostart.errorTitle": {
        "message": "Modifica avvio automatico non riuscita"
    },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Resta connesso dopo la chiusura",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "La connessione resta attiva in background dopo la chiusura di NetBird. Si interrompe solo quando la disconnetti tu.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
    "settings.general.language.label": {
        "message": "Lingua dell'interfaccia"
    },
--- a/client/ui/i18n/locales/ja/common.json
+++ b/client/ui/i18n/locales/ja/common.json
@@ -551,14 +551,6 @@
    "settings.general.autostart.errorTitle": {
        "message": "自動起動の変更に失敗しました"
    },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "終了後も接続を維持",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "NetBird を閉じたあとも接続はバックグラウンドで維持されます。自分で切断したときにだけ停止します。",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
    "settings.general.language.label": {
        "message": "表示言語"
    },
--- a/client/ui/i18n/locales/pt/common.json
+++ b/client/ui/i18n/locales/pt/common.json
@@ -551,14 +551,6 @@
    "settings.general.autostart.errorTitle": {
        "message": "Falha ao alterar o início automático"
    },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Permanecer conectado ao sair",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "A conexão continua ativa em segundo plano depois de fechar o NetBird. Ela só para quando você mesmo a desconecta.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
    "settings.general.language.label": {
        "message": "Idioma de exibição"
    },
--- a/client/ui/i18n/locales/ru/common.json
+++ b/client/ui/i18n/locales/ru/common.json
@@ -551,14 +551,6 @@
    "settings.general.autostart.errorTitle": {
        "message": "Не удалось изменить автозапуск"
    },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Оставаться подключённым после выхода",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "Соединение остаётся активным в фоне после закрытия NetBird. Оно прервётся, только когда вы отключите его сами.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
    "settings.general.language.label": {
        "message": "Язык интерфейса"
    },
--- a/client/ui/i18n/locales/zh-CN/common.json
+++ b/client/ui/i18n/locales/zh-CN/common.json
@@ -551,14 +551,6 @@
    "settings.general.autostart.errorTitle": {
        "message": "更改自启动设置失败"
    },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "退出后保持连接",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "关闭 NetBird 后，连接会在后台保持。只有你自己断开时才会停止。",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
    "settings.general.language.label": {
        "message": "显示语言"
    },
--- a/client/ui/main.go
+++ b/client/ui/main.go
@@ -180,7 +180,6 @@ func main() {
 		WindowManager:   windowManager,
 		Session:         authSession,
 		Localizer:       localizer,
-		Preferences:     prefStore,
 	})
 	listenForShowSignal(context.Background(), tray)

--- a/client/ui/preferences/store.go
+++ b/client/ui/preferences/store.go
@@ -58,10 +58,6 @@ type UIPreferences struct {
 	// decision has run for this OS user. It only ever transitions to true
 	// and is never reset, so the default-on flow runs at most once, ever.
 	AutostartInitialized bool `json:"autostartInitialized"`
-	// KeepConnectedOnQuit leaves the daemon connected when the GUI quits.
-	// Its false zero value preserves the historical disconnect-on-quit
-	// behaviour for preference files written before the field existed.
-	KeepConnectedOnQuit bool `json:"keepConnectedOnQuit"`
 }

 // LanguageValidator rejects SetLanguage inputs with no shipped bundle.
@@ -187,26 +183,6 @@ func (s *Store) SetAutostartInitialized(done bool) error {
 	return nil
 }

-// SetKeepConnectedOnQuit persists the disconnect-on-quit opt-out. No-op if unchanged.
-func (s *Store) SetKeepConnectedOnQuit(keep bool) error {
-	s.mu.Lock()
-	if s.current.KeepConnectedOnQuit == keep {
-		s.mu.Unlock()
-		return nil
-	}
-	next := s.current
-	next.KeepConnectedOnQuit = keep
-	if err := s.persistLocked(next); err != nil {
-		s.mu.Unlock()
-		return fmt.Errorf("persist preferences: %w", err)
-	}
-	s.current = next
-	s.mu.Unlock()
-
-	s.broadcast(next)
-	return nil
-}
-
 // SetLanguage validates, persists, and broadcasts. No-op if unchanged.
 func (s *Store) SetLanguage(lang i18n.LanguageCode) error {
 	if lang == "" {
--- a/client/ui/preferences/store_test.go
+++ b/client/ui/preferences/store_test.go
@@ -238,42 +238,6 @@ func TestStore_SetAutostartInitializedPersistsAcrossReload(t *testing.T) {
 	assert.True(t, reloaded.Get().AutostartInitialized, "marker must survive a reload from disk")
 }

-func TestStore_SetKeepConnectedOnQuitPersistsAcrossReload(t *testing.T) {
-	withTempConfigDir(t)
-	emitter := &recordingEmitter{}
-	s, err := NewStore(nil, emitter)
-	require.NoError(t, err)
-
-	assert.False(t, s.Get().KeepConnectedOnQuit, "quitting must disconnect by default")
-
-	require.NoError(t, s.SetKeepConnectedOnQuit(true))
-	assert.True(t, s.Get().KeepConnectedOnQuit, "Get should reflect the persisted opt-out")
-	require.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "first write should broadcast")
-
-	require.NoError(t, s.SetKeepConnectedOnQuit(true))
-	assert.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "idempotent write should not broadcast again")
-
-	reloaded, err := NewStore(nil, nil)
-	require.NoError(t, err)
-	assert.True(t, reloaded.Get().KeepConnectedOnQuit, "opt-out must survive a reload from disk")
-}
-
-func TestStore_KeepConnectedOnQuitDefaultsFalseForPreExistingFile(t *testing.T) {
-	withTempConfigDir(t)
-
-	// A preferences file written before the field existed must keep the
-	// historical disconnect-on-quit behaviour rather than silently opting out.
-	path, err := preferencesPath()
-	require.NoError(t, err)
-	require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
-	require.NoError(t, os.WriteFile(path, []byte(`{"language":"en","viewMode":"default"}`), 0o600))
-
-	s, err := NewStore(nil, nil)
-	require.NoError(t, err)
-	assert.False(t, s.Get().KeepConnectedOnQuit, "a file predating the field must not opt out of disconnect-on-quit")
-	assert.True(t, s.ExistedAtLoad(), "the pre-existing file must be seen on disk")
-}
-
 func TestStore_ExistedAtLoad(t *testing.T) {
 	withTempConfigDir(t)

--- a/client/ui/services/preferences.go
+++ b/client/ui/services/preferences.go
@@ -34,7 +34,3 @@ func (s *Preferences) SetViewMode(_ context.Context, mode preferences.ViewMode)
 func (s *Preferences) SetOnboardingCompleted(_ context.Context, done bool) error {
 	return s.store.SetOnboardingCompleted(done)
 }
-
-func (s *Preferences) SetKeepConnectedOnQuit(_ context.Context, keep bool) error {
-	return s.store.SetKeepConnectedOnQuit(keep)
-}
--- a/client/ui/tray.go
+++ b/client/ui/tray.go
@@ -16,7 +16,6 @@ import (

 	"github.com/netbirdio/netbird/client/ui/authsession"
 	"github.com/netbirdio/netbird/client/ui/i18n"
-	"github.com/netbirdio/netbird/client/ui/preferences"
 	"github.com/netbirdio/netbird/client/ui/services"
 	"github.com/netbirdio/netbird/version"
 )
@@ -51,9 +50,8 @@ type TrayServices struct {
 	WindowManager   *services.WindowManager
 	// Session is bound to authsession directly because the services wrapper
 	// only re-exposes the React subset.
-	Session     *authsession.Session
-	Localizer   *Localizer
-	Preferences *preferences.Store
+	Session   *authsession.Session
+	Localizer *Localizer
 }

 type Tray struct {
@@ -463,12 +461,10 @@ func (t *Tray) handleQuit() {
 	t.profileMu.Unlock()
 	t.svc.DaemonFeed.CancelProfileSwitch()

-	if t.svc.Preferences == nil || !t.svc.Preferences.Get().KeepConnectedOnQuit {
-		ctx, cancel := context.WithTimeout(context.Background(), quitDownTimeout)
-		defer cancel()
-		if err := t.svc.Connection.Down(ctx); err != nil {
-			log.Errorf("disconnect on quit: %v", err)
-		}
+	ctx, cancel := context.WithTimeout(context.Background(), quitDownTimeout)
+	defer cancel()
+	if err := t.svc.Connection.Down(ctx); err != nil {
+		log.Errorf("disconnect on quit: %v", err)
 	}
 	t.app.Quit()
 }
--- a/go.mod
+++ b/go.mod
@@ -340,4 +340,4 @@ replace github.com/dexidp/dex/api/v2 => github.com/netbirdio/dex/api/v2 v2.0.0-2

 replace github.com/mailru/easyjson => github.com/netbirdio/easyjson v0.9.0

-replace github.com/wailsapp/wails/v3 => github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260807055527-fc03f984d701
+replace github.com/wailsapp/wails/v3 => github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260803205919-ad21e92381f4
--- a/go.sum
+++ b/go.sum
@@ -490,8 +490,8 @@ github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502 h1:3tHlFmhTdX9ax
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502/go.mod h1:CIMRFEJVL+0DS1a3Nx06NaMn4Dz63Ng6O7dl0qH0zVM=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45 h1:ujgviVYmx243Ksy7NdSwrdGPSRNE3pb8kEDSpH0QuAQ=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45/go.mod h1:5/sjFmLb8O96B5737VCqhHyGRzNFIaN/Bu7ZodXc3qQ=
-github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260807055527-fc03f984d701 h1:QL9nupfRom0L9jcY7N9l/Bc6QK2PtC6pHzC+ftpTqpw=
-github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260807055527-fc03f984d701/go.mod h1:BzATbK71VFikMMMCo434wAi0QcaI03P+xeaWgDvQvjw=
+github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260803205919-ad21e92381f4 h1:UKztc3QjWvzU5DZk+uYaOWN0x62NSe/pkxuPvzqZIy4=
+github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260803205919-ad21e92381f4/go.mod h1:BzATbK71VFikMMMCo434wAi0QcaI03P+xeaWgDvQvjw=
 github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a h1:3CWK+yTvRKOcC0Q8VCTGy4l60TEb27CQVS7LkMxwjmw=
 github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
--- a/infrastructure_files/getting-started-enterprise.sh
+++ b/infrastructure_files/getting-started-enterprise.sh
@@ -262,7 +262,6 @@ init_environment() {
  POSTGRES_DB="netbird"
  POSTGRES_PASSWORD=$(rand_secret)
  NETBIRD_ENCRYPTION_KEY=$(rand_b64_key)
-  NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY=$(rand_b64_key)
  NETBIRD_RELAY_AUTH_SECRET=$(rand_secret)

  POSTGRES_DSN="host=postgres user=${POSTGRES_USER} password=${POSTGRES_PASSWORD} dbname=${POSTGRES_DB} port=5432 sslmode=disable TimeZone=UTC"
@@ -697,7 +696,6 @@ server:
    issuer: "https://${NETBIRD_DOMAIN}/oauth2"
    localAuthDisabled: false
    signKeyRefreshEnabled: false
-    sessionCookieEncryptionKey: "${NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY}"
    dashboardRedirectURIs:
      - "https://${NETBIRD_DOMAIN}/nb-auth"
      - "https://${NETBIRD_DOMAIN}/nb-silent-auth"
--- a/infrastructure_files/getting-started.sh
+++ b/infrastructure_files/getting-started.sh
@@ -348,7 +348,6 @@ initialize_default_values() {
  NETBIRD_RELAY_AUTH_SECRET=$(openssl rand -base64 32 | sed "$SED_STRIP_PADDING")
  # Note: DataStoreEncryptionKey must keep base64 padding (=) for Go's base64.StdEncoding
  DATASTORE_ENCRYPTION_KEY=$(openssl rand -base64 32)
-  SESSION_COOKIE_ENCRYPTION_KEY=$(openssl rand -base64 32)
  NETBIRD_STUN_PORT=3478

  # Docker images
@@ -528,8 +527,7 @@ generate_configuration_files() {

  # Common files for all configurations
  render_dashboard_env > dashboard.env
-  install -m 600 /dev/null config.yaml
-  render_combined_yaml >> config.yaml
+  render_combined_yaml > config.yaml
  return 0
 }

@@ -913,7 +911,6 @@ server:
  auth:
    issuer: "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/oauth2"
    signKeyRefreshEnabled: true
-    sessionCookieEncryptionKey: "$SESSION_COOKIE_ENCRYPTION_KEY"
    dashboardRedirectURIs:
      - "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/nb-auth"
      - "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/nb-silent-auth"
--- a/management/internals/controllers/network_map/controller/controller.go
+++ b/management/internals/controllers/network_map/controller/controller.go
@@ -176,7 +176,6 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 	semaphore := make(chan struct{}, 10)

 	c.injectAllProxyPolicies(ctx, account)
-	account.PrecomputePostureValidation(ctx)
 	dnsCache := &cache.DNSConfigCache{}
 	dnsDomain := c.GetDNSDomain(account.Settings)
 	peersCustomZone := account.GetPeersCustomZone(ctx, dnsDomain)
@@ -358,7 +357,6 @@ func (c *Controller) sendUpdateForAffectedPeers(ctx context.Context, accountID s
 	// network map that omitted the synth DNS zone, and the agent kept
 	// resolving against the stale or absent record.
 	c.injectAllProxyPolicies(ctx, account)
-	account.PrecomputePostureValidation(ctx)
 	dnsCache := &cache.DNSConfigCache{}
 	dnsDomain := c.GetDNSDomain(account.Settings)
 	peersCustomZone := account.GetPeersCustomZone(ctx, dnsDomain)
--- a/management/server/account.go
+++ b/management/server/account.go
@@ -33,7 +33,6 @@ import (
 	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/server/account"
 	"github.com/netbirdio/netbird/management/server/activity"
-	"github.com/netbirdio/netbird/management/server/affectedpeers"
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
 	"github.com/netbirdio/netbird/management/server/geolocation"
@@ -1627,9 +1626,6 @@ func (am *DefaultAccountManager) SyncUserJWTGroups(ctx context.Context, userAuth
 	var removeOldGroups []string
 	var hasChanges bool
 	var user *types.User
-	var change affectedpeers.Change
-	var snap *affectedpeers.Snapshot
-	var requiresAccountUpdate bool
 	err = am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
 		user, err = transaction.GetUserByUserID(ctx, store.LockingStrengthNone, userAuth.UserId)
 		if err != nil {
@@ -1668,11 +1664,6 @@ func (am *DefaultAccountManager) SyncUserJWTGroups(ctx context.Context, userAuth
 			return fmt.Errorf("error saving user: %w", err)
 		}

-		allGroupChanges := slices.Concat(addNewGroups, removeOldGroups)
-		// The user's auto-groups changed, so the SSH rules authorizing them ship a new
-		// group -> user mapping even when no peer moves between groups.
-		change.UserGroupIDs = allGroupChanges
-
 		// Propagate changes to peers if group propagation is enabled
 		if settings.GroupsPropagationEnabled {
 			peers, err := transaction.GetUserPeers(ctx, store.LockingStrengthNone, userAuth.AccountId, userAuth.UserId)
@@ -1681,7 +1672,6 @@ func (am *DefaultAccountManager) SyncUserJWTGroups(ctx context.Context, userAuth
 			}

 			for _, peer := range peers {
-				change.OutputPeerIDs = append(change.OutputPeerIDs, peer.ID)
 				for _, g := range addNewGroups {
 					if err := transaction.AddPeerToGroup(ctx, userAuth.AccountId, peer.ID, g); err != nil {
 						return fmt.Errorf("error adding peer %s to group %s: %w", peer.ID, g, err)
@@ -1694,12 +1684,7 @@ func (am *DefaultAccountManager) SyncUserJWTGroups(ctx context.Context, userAuth
 				}
 			}

-			change.LinkGroups = allGroupChanges
-
-			// The reconciliation reassigns IPv6 addresses across the account, which
-			// every peer that can reach the reassigned ones observes.
-			requiresAccountUpdate = ipv6ReconcileNeeded(settings, allGroupChanges)
-
+			allGroupChanges := slices.Concat(addNewGroups, removeOldGroups)
 			if err = am.reconcileIPv6ForGroupChanges(ctx, transaction, userAuth.AccountId, allGroupChanges); err != nil {
 				return fmt.Errorf("reconcile IPv6 for group changes: %w", err)
 			}
@@ -1709,10 +1694,6 @@ func (am *DefaultAccountManager) SyncUserJWTGroups(ctx context.Context, userAuth
 			}
 		}

-		if snap, err = affectedpeers.Load(ctx, transaction, userAuth.AccountId, change); err != nil {
-			return err
-		}
-
 		return nil
 	})
 	if err != nil {
@@ -1749,23 +1730,20 @@ func (am *DefaultAccountManager) SyncUserJWTGroups(ctx context.Context, userAuth
 		}
 	}

-	if requiresAccountUpdate {
-		log.WithContext(ctx).Tracef("user %s: JWT group membership changed, updating account peers", userAuth.UserId)
-		am.BufferUpdateAccountPeers(ctx, userAuth.AccountId, types.UpdateReason{Resource: types.UpdateResourceUser, Operation: types.UpdateOperationUpdate})
-		return nil
+	removedGroupAffectsPeers, err := areGroupChangesAffectPeers(ctx, am.Store, userAuth.AccountId, removeOldGroups)
+	if err != nil {
+		return err
 	}

-	log.WithContext(ctx).Tracef("user %s: JWT group membership changed, updating affected peers", userAuth.UserId)
-	bgCtx := context.WithoutCancel(ctx)
-	go func() {
-		affectedPeerIDs := snap.Expand(bgCtx, userAuth.AccountId, change)
-		if len(affectedPeerIDs) == 0 {
-			return
-		}
-		if err := am.networkMapController.BufferUpdateAffectedPeers(bgCtx, userAuth.AccountId, affectedPeerIDs, types.UpdateReason{Resource: types.UpdateResourceUser, Operation: types.UpdateOperationUpdate}); err != nil {
-			log.WithContext(bgCtx).Errorf("failed to update affected peers after JWT group sync for account %s: %v", userAuth.AccountId, err)
-		}
-	}()
+	newGroupsAffectsPeers, err := areGroupChangesAffectPeers(ctx, am.Store, userAuth.AccountId, addNewGroups)
+	if err != nil {
+		return err
+	}
+
+	if removedGroupAffectsPeers || newGroupsAffectsPeers {
+		log.WithContext(ctx).Tracef("user %s: JWT group membership changed, updating account peers", userAuth.UserId)
+		am.BufferUpdateAccountPeers(ctx, userAuth.AccountId, types.UpdateReason{Resource: types.UpdateResourceUser, Operation: types.UpdateOperationUpdate})
+	}

 	return nil
 }
@@ -2448,27 +2426,30 @@ func (am *DefaultAccountManager) reconcileIPv6ForGroupChanges(ctx context.Contex
 		return fmt.Errorf("get account settings: %w", err)
 	}

-	if !ipv6ReconcileNeeded(settings, groupIDs) {
+	if len(settings.IPv6EnabledGroups) == 0 {
+		return nil
+	}
+
+	enabledSet := make(map[string]struct{}, len(settings.IPv6EnabledGroups))
+	for _, gid := range settings.IPv6EnabledGroups {
+		enabledSet[gid] = struct{}{}
+	}
+
+	affected := false
+	for _, gid := range groupIDs {
+		if _, ok := enabledSet[gid]; ok {
+			affected = true
+			break
+		}
+	}
+
+	if !affected {
 		return nil
 	}

 	return am.updatePeerIPv6Addresses(ctx, transaction, accountID, settings)
 }

-// ipv6ReconcileNeeded reports whether changes to the given groups trigger an IPv6
-// reconciliation. A reconciliation reassigns addresses across the whole account, and a
-// peer's address is visible to everyone that reaches it through any of its groups, so
-// callers that otherwise compute an affected-peers set must fall back to updating the
-// whole account.
-func ipv6ReconcileNeeded(settings *types.Settings, groupIDs []string) bool {
-	for _, groupID := range groupIDs {
-		if slices.Contains(settings.IPv6EnabledGroups, groupID) {
-			return true
-		}
-	}
-	return false
-}
-
 func (am *DefaultAccountManager) ensureIPv6Subnet(ctx context.Context, transaction store.Store, accountID string, settings *types.Settings, network *types.Network) error {
 	if settings.NetworkRangeV6.IsValid() {
 		network.NetV6 = net.IPNet{
--- a/management/server/account_test.go
+++ b/management/server/account_test.go
@@ -1757,7 +1757,6 @@ func TestAccount_Copy(t *testing.T) {
 				AccountID: "account1",
 			},
 		},
-		PostureValidation: map[string]map[string]bool{"1": {"1": true}},
 	}
 	err := hasNilField(account)
 	if err != nil {
--- a/management/server/affected_peers_jwt_test.go
+++ b/management/server/affected_peers_jwt_test.go
@@ -1,179 +0,0 @@
-package server
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-
-	"github.com/netbirdio/netbird/management/server/affectedpeers"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/store"
-	"github.com/netbirdio/netbird/management/server/types"
-	"github.com/netbirdio/netbird/shared/auth"
-)
-
-// A user's auto-group change refreshes the destinations of the SSH rules authorizing
-// that group — they carry the group -> user mapping — even though no peer moved
-// between groups.
-func TestAffectedPeers_UserGroupChange_RefreshesSSHAuthorizedDestinations(t *testing.T) {
-	manager, s, accountID, peerIDs, groupIDs := setupAffectedPeersTest(t)
-	ctx := context.Background()
-
-	_, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:          true,
-				Sources:          []string{groupIDs[0]},
-				Destinations:     []string{groupIDs[1]},
-				Protocol:         types.PolicyRuleProtocolNetbirdSSH,
-				Action:           types.PolicyTrafficActionAccept,
-				AuthorizedGroups: map[string][]string{groupIDs[3]: {"root"}},
-			},
-		},
-	}, true)
-	require.NoError(t, err)
-
-	result := resolveAffected(t, s, accountID, affectedpeers.Change{UserGroupIDs: []string{groupIDs[3]}})
-	assert.ElementsMatch(t, []string{peerIDs[1]}, result,
-		"only the SSH rule's destination peers carry the changed group -> user mapping")
-
-	result = resolveAffected(t, s, accountID, affectedpeers.Change{UserGroupIDs: []string{groupIDs[4]}})
-	assert.Empty(t, result, "a group no SSH rule authorizes affects nobody")
-}
-
-// Creating, blocking or unblocking a user changes the account's allowed-user set, which
-// reaches only the destinations of the SSH rules that ship it.
-func TestAffectedPeers_AllowedUsersChange_RefreshesSSHDestinations(t *testing.T) {
-	manager, s, accountID, peerIDs, groupIDs := setupAffectedPeersTest(t)
-	ctx := context.Background()
-
-	// Ships the allowed-user set: an SSH rule naming no groups and no user.
-	_, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{{
-			Enabled:      true,
-			Sources:      []string{groupIDs[0]},
-			Destinations: []string{groupIDs[1]},
-			Protocol:     types.PolicyRuleProtocolNetbirdSSH,
-			Action:       types.PolicyTrafficActionAccept,
-		}},
-	}, true)
-	require.NoError(t, err)
-
-	// Does not ship it: an SSH rule that authorizes a specific group.
-	_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{{
-			Enabled:          true,
-			Sources:          []string{groupIDs[2]},
-			Destinations:     []string{groupIDs[3]},
-			Protocol:         types.PolicyRuleProtocolNetbirdSSH,
-			Action:           types.PolicyTrafficActionAccept,
-			AuthorizedGroups: map[string][]string{groupIDs[0]: {"root"}},
-		}},
-	}, true)
-	require.NoError(t, err)
-
-	result := resolveAffected(t, s, accountID, affectedpeers.Change{AllowedUsersChanged: true})
-	assert.ElementsMatch(t, []string{peerIDs[1]}, result,
-		"only the destinations of the rule shipping the allowed-user set refresh")
-}
-
-// TestAffectedPeers_SyncUserJWTGroups_OnlyAffectedPeersUpdated verifies that a JWT
-// auto-group change updates only the user's peers and the peers linked to the changed
-// group through policies, instead of fanning out to the whole account.
-func TestAffectedPeers_SyncUserJWTGroups_OnlyAffectedPeersUpdated(t *testing.T) {
-	manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
-
-	key, err := wgtypes.GeneratePrivateKey()
-	require.NoError(t, err)
-	userPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", userID, &nbpeer.Peer{
-		Key:  key.PublicKey().String(),
-		Meta: nbpeer.PeerSystemMeta{Hostname: "user-peer"},
-	}, false)
-	require.NoError(t, err)
-
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
-	}
-
-	account, err = manager.Store.GetAccount(ctx, accountID)
-	require.NoError(t, err)
-	account.Settings.JWTGroupsEnabled = true
-	account.Settings.JWTGroupsClaimName = "groups"
-	account.Settings.GroupsPropagationEnabled = true
-	require.NoError(t, manager.Store.SaveAccount(ctx, account))
-
-	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-grp", Name: "jwt-linked", Issued: types.GroupIssuedJWT, Peers: []string{}}))
-	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-dest", Name: "jwt-dest", Peers: []string{peer2.ID}}))
-
-	_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"jwt-grp"},
-				Destinations:  []string{"jwt-dest"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
-			},
-		},
-	}, true)
-	require.NoError(t, err)
-
-	updUser := updateManager.CreateChannel(ctx, userPeer.ID)
-	upd2 := updateManager.CreateChannel(ctx, peer2.ID)
-	upd3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, userPeer.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	userAuth := auth.UserAuth{
-		AccountId: accountID,
-		UserId:    userID,
-		Groups:    []string{"jwt-linked"},
-	}
-
-	t.Run("adding JWT group updates only linked peers", func(t *testing.T) {
-		drainPeerUpdates(updUser)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
-
-		require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth))
-
-		peerShouldReceiveUpdate(t, updUser)
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
-
-		user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
-		require.NoError(t, err)
-		assert.Contains(t, user.AutoGroups, "jwt-grp")
-	})
-
-	t.Run("removing JWT group updates only linked peers", func(t *testing.T) {
-		drainPeerUpdates(updUser)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
-
-		userAuth.Groups = nil
-		require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth))
-
-		peerShouldReceiveUpdate(t, updUser)
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
-
-		user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
-		require.NoError(t, err)
-		assert.NotContains(t, user.AutoGroups, "jwt-grp")
-	})
-}
--- a/management/server/affected_peers_user_test.go
+++ b/management/server/affected_peers_user_test.go
@@ -1,170 +0,0 @@
-package server
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-
-	"github.com/netbirdio/netbird/management/server/activity"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/store"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-// A user update refreshes only the peers its auto-group change reaches, and a user
-// update that changes no group membership refreshes nobody.
-func TestAffectedPeers_SaveUser_OnlyAffectedPeersUpdated(t *testing.T) {
-	manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
-
-	const targetUserID = "target-user"
-	require.NoError(t, manager.Store.SaveUser(ctx, &types.User{
-		Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-	}))
-
-	key, err := wgtypes.GeneratePrivateKey()
-	require.NoError(t, err)
-	targetPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", targetUserID, &nbpeer.Peer{
-		Key:  key.PublicKey().String(),
-		Meta: nbpeer.PeerSystemMeta{Hostname: "target-peer"},
-	}, false)
-	require.NoError(t, err)
-
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
-	}
-
-	account, err = manager.Store.GetAccount(ctx, accountID)
-	require.NoError(t, err)
-	account.Settings.GroupsPropagationEnabled = true
-	require.NoError(t, manager.Store.SaveAccount(ctx, account))
-
-	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-linked", Name: "ug-linked"}))
-	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-dest", Name: "ug-dest", Peers: []string{peer2.ID}}))
-
-	_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"ug-linked"},
-				Destinations:  []string{"ug-dest"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
-			},
-		},
-	}, true)
-	require.NoError(t, err)
-
-	updTarget := updateManager.CreateChannel(ctx, targetPeer.ID)
-	upd2 := updateManager.CreateChannel(ctx, peer2.ID)
-	upd3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, targetPeer.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("auto group change updates only linked peers", func(t *testing.T) {
-		drainPeerUpdates(updTarget)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
-
-		_, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
-			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-			AutoGroups: []string{"ug-linked"},
-		})
-		require.NoError(t, err)
-
-		peerShouldReceiveUpdate(t, updTarget)
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
-	})
-
-	t.Run("update without group changes refreshes nobody", func(t *testing.T) {
-		drainPeerUpdates(updTarget)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
-
-		_, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
-			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-			AutoGroups: []string{"ug-linked"}, Name: "renamed",
-		})
-		require.NoError(t, err)
-
-		peerShouldNotReceiveUpdate(t, updTarget)
-		peerShouldNotReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
-
-		user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID)
-		require.NoError(t, err)
-		assert.Equal(t, "renamed", user.Name)
-	})
-
-	t.Run("auto group change reassigning IPv6 refreshes the whole account", func(t *testing.T) {
-		account, err := manager.Store.GetAccount(ctx, accountID)
-		require.NoError(t, err)
-		account.Settings.IPv6EnabledGroups = []string{"ug-v6"}
-		require.NoError(t, manager.Store.SaveAccount(ctx, account))
-		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-v6", Name: "ug-v6"}))
-
-		drainPeerUpdates(updTarget)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
-
-		_, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
-			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-			AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed",
-		})
-		require.NoError(t, err)
-
-		// An IPv6 reassignment is visible to every peer that can reach the reassigned
-		// ones through any group, so peer3 refreshes even though it shares no policy.
-		peerShouldReceiveUpdate(t, updTarget)
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldReceiveUpdate(t, upd3)
-	})
-
-	t.Run("unblocking a user refreshes only the SSH rule destinations", func(t *testing.T) {
-		// An SSH rule that authorizes no group of its own ships the account's
-		// allowed-user set to its destinations, so those are the peers an unblock
-		// reaches — not the whole account.
-		_, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-			Enabled: true,
-			Rules: []*types.PolicyRule{{
-				Enabled:      true,
-				Sources:      []string{"ug-linked"},
-				Destinations: []string{"ug-dest"},
-				Protocol:     types.PolicyRuleProtocolNetbirdSSH,
-				Action:       types.PolicyTrafficActionAccept,
-			}},
-		}, true)
-		require.NoError(t, err)
-
-		blocked, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID)
-		require.NoError(t, err)
-		blocked.Blocked = true
-		require.NoError(t, manager.Store.SaveUser(ctx, blocked))
-
-		drainPeerUpdates(updTarget)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
-
-		// Same auto-groups as the previous subtest left them, so no group change and
-		// no IPv6 reconciliation interferes: the unblock alone drives the refresh.
-		_, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
-			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-			AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed",
-		})
-		require.NoError(t, err)
-
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
-	})
-}
--- a/management/server/affectedpeers/resolver.go
+++ b/management/server/affectedpeers/resolver.go
@@ -18,7 +18,6 @@ import (
 	"context"

 	log "github.com/sirupsen/logrus"
-	"golang.org/x/exp/maps"

 	nbdns "github.com/netbirdio/netbird/dns"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
@@ -84,7 +83,7 @@ func (snap *Snapshot) loadCollections(ctx context.Context, s store.Store, accoun
 	hasGroupOrPeerChange := len(c.ChangedGroupIDs) > 0 || len(c.ChangedPeerIDs) > 0 || len(c.LinkGroups) > 0 || len(c.Resources) > 0
 	hasNetworkObject := len(c.Routers) > 0 || len(c.Resources) > 0 || len(c.Networks) > 0
 	// the resource<->router bridge can fire for any of these
-	needsRoutersResources := hasGroupOrPeerChange || len(c.PostureCheckIDs) > 0 || len(c.Policies) > 0 || hasNetworkObject || len(c.UserGroupIDs) > 0 || c.AllowedUsersChanged
+	needsRoutersResources := hasGroupOrPeerChange || len(c.PostureCheckIDs) > 0 || len(c.Policies) > 0 || hasNetworkObject

 	if needsRoutersResources {
 		if err := snap.loadPolicyRoutersResources(ctx, s, accountID); err != nil {
@@ -220,18 +219,6 @@ type Change struct {
 	// (correct when the peer's own attributes changed, e.g. IP/status).
 	OutputPeerIDs []string

-	// UserGroupIDs are groups whose USER membership changed (a user's auto-groups),
-	// as opposed to their peer membership. Peers ship the group -> user mapping only
-	// for the groups an SSH rule authorizes, so these refresh the destinations of the
-	// SSH rules authorizing them — independently of any peer moving between groups.
-	UserGroupIDs []string
-
-	// AllowedUsersChanged marks a change to the set of users allowed to open SSH
-	// sessions — a user was created, blocked or unblocked. That set is account-wide,
-	// and peers receive it through the SSH rules that name no group or user of their
-	// own, so those rules' destinations refresh.
-	AllowedUsersChanged bool
-
 	// LinkGroups are groups used ONLY to match policies/routes/routers and walk to the
 	// OPPOSITE side — they are never expanded to their own members. Use this when a
 	// peer's group membership changed: pass the peer in ChangedPeerIDs and its
@@ -253,8 +240,6 @@ func (c Change) isEmpty() bool {
 		len(c.Resources) == 0 &&
 		len(c.Networks) == 0 &&
 		len(c.PostureCheckIDs) == 0 &&
-		len(c.UserGroupIDs) == 0 &&
-		!c.AllowedUsersChanged &&
 		len(c.DistributionGroupIDs) == 0 &&
 		len(c.RemovedPeersByGroup) == 0 &&
 		len(c.LinkGroups) == 0 &&
@@ -374,9 +359,6 @@ func (r *resolver) walk() {
 		r.collectFromProxyServices()
 	}

-	r.collectFromSSHAuthorizedGroups()
-	r.collectFromAllowedUsers()
-
 	r.collectFromChangedRoutes(r.change.Routes)
 	r.collectFromChangedRouters(r.change.Routers)
 	r.collectFromChangedResources(r.change.Resources)
@@ -829,59 +811,6 @@ func (r *resolver) collectFromNameServers() {
 	}
 }

-// collectFromSSHAuthorizedGroups folds the destinations of the enabled SSH rules that
-// authorize a group whose user membership changed. Those destination peers carry the
-// group -> user mapping for the groups they authorize, so they refresh even when no
-// peer moved between groups.
-func (r *resolver) collectFromSSHAuthorizedGroups() {
-	if len(r.change.UserGroupIDs) == 0 {
-		return
-	}
-
-	changed := toSet(r.change.UserGroupIDs)
-	for _, policy := range r.policies() {
-		for _, rule := range policy.Rules {
-			if !rule.Enabled || rule.Protocol != types.PolicyRuleProtocolNetbirdSSH {
-				continue
-			}
-			if !anyInSet(maps.Keys(rule.AuthorizedGroups), changed) {
-				continue
-			}
-			log.WithContext(r.ctx).Tracef("collectFromSSHAuthorizedGroups: rule %s authorizes a changed user group -> folding its destinations", rule.ID)
-			r.foldPolicySideForRule(policy, rule, sideDestination)
-		}
-	}
-}
-
-// collectFromAllowedUsers folds the destinations of the rules that make a peer carry
-// the account's allowed-user set, for a change to who is in that set.
-func (r *resolver) collectFromAllowedUsers() {
-	if !r.change.AllowedUsersChanged {
-		return
-	}
-
-	for _, policy := range r.policies() {
-		for _, rule := range policy.Rules {
-			if !rule.Enabled || !ruleShipsAllowedUsers(rule) {
-				continue
-			}
-			log.WithContext(r.ctx).Tracef("collectFromAllowedUsers: rule %s ships the allowed-user set -> folding its destinations", rule.ID)
-			r.foldPolicySideForRule(policy, rule, sideDestination)
-		}
-	}
-}
-
-// ruleShipsAllowedUsers reports whether a rule makes its destination peers carry the
-// account's allowed-user set. It mirrors the network map's SSH requirements except for
-// the destination peer's own SSH flag, which the snapshot does not hold — so it folds a
-// superset and never misses a peer.
-func ruleShipsAllowedUsers(rule *types.PolicyRule) bool {
-	if rule.Protocol == types.PolicyRuleProtocolNetbirdSSH {
-		return len(rule.AuthorizedGroups) == 0 && rule.AuthorizedUser == ""
-	}
-	return types.PolicyRuleImpliesLegacySSH(rule)
-}
-
 func (r *resolver) collectFromDNSSettings() {
 	if len(r.linkGroups) == 0 || r.snap.dnsSettings == nil {
 		return
--- a/management/server/affectedpeers/resolver_test.go
+++ b/management/server/affectedpeers/resolver_test.go
@@ -85,8 +85,6 @@ func TestChangeIsEmpty(t *testing.T) {
 	assert.False(t, Change{Resources: []*resourceTypes.NetworkResource{{ID: "r"}}}.isEmpty())
 	assert.False(t, Change{Networks: []*networkTypes.Network{{ID: "n"}}}.isEmpty())
 	assert.False(t, Change{PostureCheckIDs: []string{"pc"}}.isEmpty())
-	assert.False(t, Change{UserGroupIDs: []string{"g"}}.isEmpty())
-	assert.False(t, Change{AllowedUsersChanged: true}.isEmpty())
 }

 func TestPolicyReferencesPostureChecks(t *testing.T) {
--- a/management/server/types/account.go
+++ b/management/server/types/account.go
@@ -91,8 +91,6 @@ type Account struct {
 	Onboarding       AccountOnboarding                `gorm:"foreignKey:AccountID;references:id;constraint:OnDelete:CASCADE"`

 	ReverseProxyFreeDomainNonce string
-
-	PostureValidation map[string]map[string]bool `gorm:"-"`
 }

 // this class is used by gorm only
@@ -876,7 +874,6 @@ func (a *Account) Copy() *Account {
 		Services:               services,
 		Onboarding:             a.Onboarding,
 		Domains:                domains,
-		PostureValidation:      a.PostureValidation,
 	}
 }

--- a/management/server/types/account_components.go
+++ b/management/server/types/account_components.go
@@ -10,8 +10,6 @@ import (
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/internals/modules/zones"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/posture"
 	"github.com/netbirdio/netbird/management/server/telemetry"
 	"github.com/netbirdio/netbird/route"
 )
@@ -508,8 +506,8 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 func (a *Account) getPeersFromGroups(ctx context.Context, groups []string, peerID string, sourcePostureChecksIDs []string,
 	validatedPeersMap map[string]struct{}, postureFailedPeers *map[string]map[string]struct{}) ([]string, bool) {
 	peerInGroups := false
-	var filteredPeerIDs []string
-	var seenPeerIds map[string]struct{}
+	filteredPeerIDs := make([]string, 0, len(groups))
+	seenPeerIds := make(map[string]struct{}, len(groups))

 	for _, gid := range groups {
 		group := a.GetGroup(gid)
@@ -549,17 +547,6 @@ func (a *Account) getPeersFromGroups(ctx context.Context, groups []string, peerI
 			return filteredPeerIDs, peerInGroups
 		}

-		if seenPeerIds == nil {
-			totalGroupPeers := 0
-			for _, g := range groups {
-				if grp := a.GetGroup(g); grp != nil {
-					totalGroupPeers += len(grp.Peers)
-				}
-			}
-			filteredPeerIDs = make([]string, 0, totalGroupPeers)
-			seenPeerIds = make(map[string]struct{}, totalGroupPeers)
-		}
-
 		for _, pid := range group.Peers {
 			if _, seen := seenPeerIds[pid]; seen {
 				continue
@@ -602,109 +589,21 @@ func (a *Account) validatePostureChecksOnPeerGetFailed(ctx context.Context, sour
 	}

 	for _, postureChecksID := range sourcePostureChecksID {
-		if valid, cached := a.cachedPostureCheckResult(postureChecksID, peerID); cached {
-			if !valid {
-				return false, postureChecksID
-			}
-			continue
-		}
-
 		postureChecks := a.GetPostureChecks(postureChecksID)
 		if postureChecks == nil {
 			continue
 		}

-		if !peerPassesPostureChecks(ctx, postureChecks.GetChecks(), peer) {
-			return false, postureChecksID
+		for _, check := range postureChecks.GetChecks() {
+			isValid, _ := check.Check(ctx, *peer)
+			if !isValid {
+				return false, postureChecksID
+			}
 		}
 	}
 	return true, ""
 }

-// PrecomputePostureValidation evaluates every posture check referenced by an enabled
-// policy once against the peers of that policy's source groups and stores the results,
-// so the per-peer network map calculations that follow look them up instead of
-// re-evaluating checks for every peer pair. It must be called before the account is
-// shared across goroutines; lookups not covered by the precomputed results fall back
-// to direct evaluation.
-func (a *Account) PrecomputePostureValidation(ctx context.Context) {
-	if len(a.PostureChecks) == 0 {
-		a.PostureValidation = nil
-		return
-	}
-
-	checkPeerIDs := make(map[string]map[string]struct{})
-	for _, policy := range a.Policies {
-		if !policy.Enabled || len(policy.SourcePostureChecks) == 0 {
-			continue
-		}
-
-		peerIDs := a.getUniquePeerIDsFromGroupsIDs(ctx, policy.SourceGroups())
-		for _, rule := range policy.Rules {
-			if rule.SourceResource.Type == ResourceTypePeer && rule.SourceResource.ID != "" {
-				peerIDs = append(peerIDs, rule.SourceResource.ID)
-			}
-		}
-
-		for _, postureChecksID := range policy.SourcePostureChecks {
-			set := checkPeerIDs[postureChecksID]
-			if set == nil {
-				set = make(map[string]struct{}, len(peerIDs))
-				checkPeerIDs[postureChecksID] = set
-			}
-			for _, pid := range peerIDs {
-				set[pid] = struct{}{}
-			}
-		}
-	}
-
-	results := make(map[string]map[string]bool, len(checkPeerIDs))
-	for postureChecksID, peerIDs := range checkPeerIDs {
-		results[postureChecksID] = a.evaluatePostureChecksForPeers(ctx, postureChecksID, peerIDs)
-	}
-	a.PostureValidation = results
-}
-
-func (a *Account) evaluatePostureChecksForPeers(ctx context.Context, postureChecksID string, peerIDs map[string]struct{}) map[string]bool {
-	postureChecks := a.GetPostureChecks(postureChecksID)
-	if postureChecks == nil {
-		return nil
-	}
-
-	checks := postureChecks.GetChecks()
-	results := make(map[string]bool, len(peerIDs))
-	for peerID := range peerIDs {
-		peer, ok := a.Peers[peerID]
-		if !ok || peer == nil {
-			continue
-		}
-		results[peerID] = peerPassesPostureChecks(ctx, checks, peer)
-	}
-	return results
-}
-
-func (a *Account) cachedPostureCheckResult(postureChecksID, peerID string) (bool, bool) {
-	results, ok := a.PostureValidation[postureChecksID]
-	if !ok {
-		return false, false
-	}
-	if results == nil {
-		return true, true
-	}
-	valid, found := results[peerID]
-	return valid, found
-}
-
-func peerPassesPostureChecks(ctx context.Context, checks []posture.Check, peer *nbpeer.Peer) bool {
-	for _, check := range checks {
-		isValid, _ := check.Check(ctx, *peer)
-		if !isValid {
-			return false
-		}
-	}
-	return true
-}
-
 func (a *Account) getPostureValidPeersSaveFailed(inputPeers []string, postureChecksIDs []string, validatedPeersMap map[string]struct{}, postureFailedPeers *map[string]map[string]struct{}) []string {
 	var dest []string
 	for _, peerID := range inputPeers {
--- a/management/server/types/account_posture_validation_test.go
+++ b/management/server/types/account_posture_validation_test.go
@@ -1,72 +0,0 @@
-package types_test
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	nbdns "github.com/netbirdio/netbird/dns"
-	"github.com/netbirdio/netbird/management/server/posture"
-)
-
-func TestPrecomputePostureValidation_MatchesDirectEvaluation(t *testing.T) {
-	account, validatedPeers := scalableTestAccount(60, 5)
-
-	account.PostureChecks = append(account.PostureChecks, &posture.Checks{
-		ID: "posture-check-strict", Name: "Strict version",
-		Checks: posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{MinVersion: "0.50.0"},
-		},
-	})
-	account.Policies[0].SourcePostureChecks = []string{"posture-check-ver", "posture-check-unknown"}
-	account.Policies[1].SourcePostureChecks = []string{"posture-check-strict"}
-	account.Policies[2].SourcePostureChecks = []string{"posture-check-ver"}
-	account.Policies[2].Enabled = false
-
-	ctx := context.Background()
-	resourcePolicies := account.GetResourcePoliciesMap()
-	routers := account.GetResourceRoutersMap()
-
-	type result struct {
-		peers              map[string]struct{}
-		postureFailedPeers map[string]map[string]struct{}
-	}
-	snapshot := func() map[string]result {
-		results := make(map[string]result, len(account.Peers))
-		for peerID := range account.Peers {
-			components := account.GetPeerNetworkMapComponents(ctx, peerID, nbdns.CustomZone{}, nil, validatedPeers, resourcePolicies, routers, nil)
-			require.NotNil(t, components)
-			peerSet := make(map[string]struct{}, len(components.Peers))
-			for id := range components.Peers {
-				peerSet[id] = struct{}{}
-			}
-			results[peerID] = result{peers: peerSet, postureFailedPeers: components.PostureFailedPeers}
-		}
-		return results
-	}
-
-	direct := snapshot()
-	account.PrecomputePostureValidation(ctx)
-	memoized := snapshot()
-
-	require.Equal(t, len(direct), len(memoized))
-	for peerID, want := range direct {
-		got := memoized[peerID]
-		assert.Equal(t, want.peers, got.peers, "visible peers changed for %s", peerID)
-		assert.Equal(t, want.postureFailedPeers, got.postureFailedPeers, "posture failed peers changed for %s", peerID)
-	}
-}
-
-func TestPrecomputePostureValidation_NoPostureChecks(t *testing.T) {
-	account, validatedPeers := scalableTestAccount(10, 2)
-	account.PostureChecks = nil
-
-	ctx := context.Background()
-	account.PrecomputePostureValidation(ctx)
-
-	components := account.GetPeerNetworkMapComponents(ctx, "peer-0", nbdns.CustomZone{}, nil, validatedPeers, account.GetResourcePoliciesMap(), account.GetResourceRoutersMap(), nil)
-	require.NotNil(t, components)
-	assert.NotEmpty(t, components.Peers)
-}
--- a/management/server/types/networkmap_benchmark_test.go
+++ b/management/server/types/networkmap_benchmark_test.go
@@ -86,43 +86,6 @@ func BenchmarkNetworkMapGeneration_AllPeers(b *testing.B) {
 			b.ReportAllocs()
 			b.ResetTimer()
 			for range b.N {
-				account.PrecomputePostureValidation(ctx)
-				for _, peerID := range peerIDs {
-					_ = account.GetPeerNetworkMapFromComponents(ctx, peerID, nbdns.CustomZone{}, nil, validatedPeers, resourcePolicies, routers, nil, groupIDToUserIDs)
-				}
-			}
-		})
-	}
-}
-
-// BenchmarkNetworkMapGeneration_AllPeersPostureChecks benchmarks the UpdateAccountPeers
-// hot path with a posture check attached to the account-wide policy, so posture
-// validation runs for every source peer of every target peer's map.
-func BenchmarkNetworkMapGeneration_AllPeersPostureChecks(b *testing.B) {
-	skipCIBenchmark(b)
-	scales := []benchmarkScale{
-		{"500peers_20groups", 500, 20},
-		{"1000peers_50groups", 1000, 50},
-	}
-
-	for _, scale := range scales {
-		account, validatedPeers := scalableTestAccount(scale.peers, scale.groups)
-		account.Policies[0].SourcePostureChecks = []string{"posture-check-ver"}
-		ctx := context.Background()
-
-		peerIDs := make([]string, 0, len(account.Peers))
-		for peerID := range account.Peers {
-			peerIDs = append(peerIDs, peerID)
-		}
-
-		b.Run("components/"+scale.name, func(b *testing.B) {
-			resourcePolicies := account.GetResourcePoliciesMap()
-			routers := account.GetResourceRoutersMap()
-			groupIDToUserIDs := account.GetActiveGroupUsers()
-			b.ReportAllocs()
-			b.ResetTimer()
-			for range b.N {
-				account.PrecomputePostureValidation(ctx)
 				for _, peerID := range peerIDs {
 					_ = account.GetPeerNetworkMapFromComponents(ctx, peerID, nbdns.CustomZone{}, nil, validatedPeers, resourcePolicies, routers, nil, groupIDToUserIDs)
 				}
--- a/management/server/user.go
+++ b/management/server/user.go
@@ -593,9 +593,7 @@ func (am *DefaultAccountManager) SaveOrAddUsers(ctx context.Context, accountID,
 		return nil, err
 	}

-	var requiresAccountUpdate bool
-	var snaps []*affectedpeers.Snapshot
-	var changes []affectedpeers.Change
+	var updateAccountPeers bool
 	var peersToExpire []*nbpeer.Peer
 	var addUserEvents []func()
 	var usersToSave = make([]*types.User, 0, len(updates))
@@ -631,26 +629,20 @@ func (am *DefaultAccountManager) SaveOrAddUsers(ctx context.Context, accountID,
 		}

 		err = am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
-			effect, updatedUser, userPeersToExpire, userEvents, err := am.processUserUpdate(
+			_, updatedUser, userPeersToExpire, userEvents, err := am.processUserUpdate(
 				ctx, transaction, groupsMap, accountID, initiatorUserID, initiatorUser, update, addIfNotExists, settings,
 			)
 			if err != nil {
 				return fmt.Errorf("failed to process update for user %s: %w", update.Id, err)
 			}

+			updateAccountPeers = true
+
 			err = transaction.SaveUser(ctx, updatedUser)
 			if err != nil {
 				return fmt.Errorf("failed to save updated user %s: %w", update.Id, err)
 			}

-			snap, err := affectedpeers.Load(ctx, transaction, accountID, effect.change)
-			if err != nil {
-				return err
-			}
-
-			requiresAccountUpdate = requiresAccountUpdate || effect.requiresAccountUpdate
-			snaps = append(snaps, snap)
-			changes = append(changes, effect.change)
 			usersToSave = append(usersToSave, updatedUser)
 			addUserEvents = append(addUserEvents, userEvents...)
 			peersToExpire = append(peersToExpire, userPeersToExpire...)
@@ -691,15 +683,11 @@ func (am *DefaultAccountManager) SaveOrAddUsers(ctx context.Context, accountID,
 			log.WithContext(ctx).Errorf("failed update expired peers: %s", err)
 			return nil, err
 		}
-	} else if len(usersToSave) > 0 {
+	} else if updateAccountPeers {
 		if err = am.Store.IncrementNetworkSerial(ctx, accountID); err != nil {
 			return nil, fmt.Errorf("failed to increment network serial: %w", err)
 		}
-		if requiresAccountUpdate {
-			am.UpdateAccountPeers(ctx, accountID, types.UpdateReason{Resource: types.UpdateResourceUser, Operation: types.UpdateOperationUpdate})
-		} else {
-			go am.dispatchAffected(ctx, accountID, snaps, changes)
-		}
+		am.UpdateAccountPeers(ctx, accountID, types.UpdateReason{Resource: types.UpdateResourceUser, Operation: types.UpdateOperationUpdate})
 	}

 	return updatedUsersInfo, globalErr
@@ -770,31 +758,20 @@ func (am *DefaultAccountManager) prepareUserUpdateEvents(ctx context.Context, ac
 	return eventsToStore
 }

-// userUpdateEffect describes how a user update has to reach peers. Users only enter a
-// network map through the SSH rules, so the change resolves to those rules' peers —
-// except when the update triggers an IPv6 reconciliation, which reassigns addresses
-// across the account and so has to reach everyone.
-type userUpdateEffect struct {
-	change                affectedpeers.Change
-	requiresAccountUpdate bool
-}
-
 func (am *DefaultAccountManager) processUserUpdate(ctx context.Context, transaction store.Store, groupsMap map[string]*types.Group,
-	accountID, initiatorUserId string, initiatorUser, update *types.User, addIfNotExists bool, settings *types.Settings) (userUpdateEffect, *types.User, []*nbpeer.Peer, []func(), error) {
-
-	var effect userUpdateEffect
+	accountID, initiatorUserId string, initiatorUser, update *types.User, addIfNotExists bool, settings *types.Settings) (bool, *types.User, []*nbpeer.Peer, []func(), error) {

 	if update == nil {
-		return effect, nil, nil, nil, status.Errorf(status.InvalidArgument, "provided user update is nil")
+		return false, nil, nil, nil, status.Errorf(status.InvalidArgument, "provided user update is nil")
 	}

 	oldUser, isNewUser, err := getUserOrCreateIfNotExists(ctx, transaction, accountID, update, addIfNotExists)
 	if err != nil {
-		return effect, nil, nil, nil, err
+		return false, nil, nil, nil, err
 	}

 	if err := validateUserUpdate(groupsMap, initiatorUser, oldUser, update); err != nil {
-		return effect, nil, nil, nil, err
+		return false, nil, nil, nil, err
 	}

 	// only auto groups, revoked status, and integration reference can be updated for now
@@ -815,13 +792,13 @@ func (am *DefaultAccountManager) processUserUpdate(ctx context.Context, transact
 	var transferredOwnerRole bool
 	result, err := handleOwnerRoleTransfer(ctx, transaction, initiatorUser, update)
 	if err != nil {
-		return effect, nil, nil, nil, err
+		return false, nil, nil, nil, err
 	}
 	transferredOwnerRole = result

 	userPeers, err := transaction.GetUserPeers(ctx, store.LockingStrengthNone, updatedUser.AccountID, update.Id)
 	if err != nil {
-		return effect, nil, nil, nil, err
+		return false, nil, nil, nil, err
 	}

 	var peersToExpire []*nbpeer.Peer
@@ -830,21 +807,6 @@ func (am *DefaultAccountManager) processUserUpdate(ctx context.Context, transact
 		peersToExpire = userPeers
 	}

-	// A user reaches a peer's network map only through the SSH rules: as part of a
-	// group -> user mapping, and as part of the account's allowed-user set. Creating,
-	// blocking or unblocking a user adds it to or removes it from both, so every group
-	// it maps into changes — including the All group that holds every active user.
-	// Otherwise only the auto-groups it joined or left do.
-	if isNewUser || oldUser.IsBlocked() != updatedUser.IsBlocked() {
-		effect.change.AllowedUsersChanged = true
-		effect.change.UserGroupIDs = slices.Concat(oldUser.AutoGroups, updatedUser.AutoGroups, allGroupIDs(groupsMap))
-	} else {
-		effect.change.UserGroupIDs = slices.Concat(
-			util.Difference(oldUser.AutoGroups, updatedUser.AutoGroups),
-			util.Difference(updatedUser.AutoGroups, oldUser.AutoGroups),
-		)
-	}
-
 	var removedGroups, addedGroups []string
 	if update.AutoGroups != nil && settings.GroupsPropagationEnabled {
 		removedGroups = util.Difference(oldUser.AutoGroups, update.AutoGroups)
@@ -852,47 +814,26 @@ func (am *DefaultAccountManager) processUserUpdate(ctx context.Context, transact
 		for _, peer := range userPeers {
 			for _, groupID := range removedGroups {
 				if err := transaction.RemovePeerFromGroup(ctx, peer.ID, groupID); err != nil {
-					return effect, nil, nil, nil, fmt.Errorf("failed to remove peer %s from group %s: %w", peer.ID, groupID, err)
+					return false, nil, nil, nil, fmt.Errorf("failed to remove peer %s from group %s: %w", peer.ID, groupID, err)
 				}
 			}
 			for _, groupID := range addedGroups {
 				if err := transaction.AddPeerToGroup(ctx, accountID, peer.ID, groupID); err != nil {
-					return effect, nil, nil, nil, fmt.Errorf("failed to add peer %s to group %s: %w", peer.ID, groupID, err)
+					return false, nil, nil, nil, fmt.Errorf("failed to add peer %s to group %s: %w", peer.ID, groupID, err)
 				}
 			}
 		}

 		allGroupChanges := slices.Concat(removedGroups, addedGroups)
-		if len(allGroupChanges) > 0 {
-			effect.change.LinkGroups = allGroupChanges
-			for _, peer := range userPeers {
-				effect.change.OutputPeerIDs = append(effect.change.OutputPeerIDs, peer.ID)
-			}
-		}
-
-		// The reconciliation reassigns IPv6 addresses across the account, which every
-		// peer that can reach the reassigned ones observes.
-		effect.requiresAccountUpdate = ipv6ReconcileNeeded(settings, allGroupChanges)
-
 		if err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, allGroupChanges); err != nil {
-			return effect, nil, nil, nil, fmt.Errorf("reconcile IPv6 for group changes: %w", err)
+			return false, nil, nil, nil, fmt.Errorf("reconcile IPv6 for group changes: %w", err)
 		}
 	}

+	updateAccountPeers := len(userPeers) > 0
 	userEventsToAdd := am.prepareUserUpdateEvents(ctx, updatedUser.AccountID, initiatorUserId, oldUser, updatedUser, transferredOwnerRole, isNewUser, removedGroups, addedGroups, transaction)

-	return effect, updatedUser, peersToExpire, userEventsToAdd, nil
-}
-
-// allGroupIDs returns the ID of the account's All group, which every active user maps
-// into, as a slice so callers can concatenate it.
-func allGroupIDs(groupsMap map[string]*types.Group) []string {
-	for _, group := range groupsMap {
-		if group.IsGroupAll() {
-			return []string{group.ID}
-		}
-	}
-	return nil
+	return updateAccountPeers, updatedUser, peersToExpire, userEventsToAdd, nil
 }

 // getUserOrCreateIfNotExists retrieves the existing user or creates a new one if it doesn't exist.
--- a/release_files/darwin_pkg/preinstall
+++ b/release_files/darwin_pkg/preinstall
@@ -4,67 +4,9 @@ set -x

 LOG_FILE=/var/log/netbird/client_pre_install.log
 AGENT=/usr/local/bin/netbird
-UI_PROCESS=netbird-ui

 mkdir -p /var/log/netbird/

-# wait_for_ui_exit polls for up to $1 seconds, returning 0 as soon as no UI
-# process is left and 1 if one is still running when the time is up.
-wait_for_ui_exit() {
-    waited=0
-    while [ "$waited" -lt "$1" ]; do
-        pgrep -x "$UI_PROCESS" > /dev/null 2>&1 || return 0
-        sleep 1
-        waited=$((waited + 1))
-    done
-    return 1
-}
-
-# request_ui_quit asks the UI to quit from inside the console user's session and
-# reports whether the request could be sent at all. The installer runs as root
-# outside that session, so a quit Apple event sent straight from here always
-# fails with -600.
-request_ui_quit() {
-    console_user=$(stat -f%Su /dev/console 2>/dev/null)
-    case "$console_user" in
-        ""|root|loginwindow|_mbsetupuser)
-            echo "No active GUI user session (console user: '${console_user:-none}'); skipping the quit request."
-            return 1
-            ;;
-    esac
-
-    uid=$(id -u "$console_user" 2>/dev/null)
-    if [ -z "$uid" ]; then
-        echo "Could not resolve uid for console user '$console_user'; skipping the quit request."
-        return 1
-    fi
-
-    echo "Asking the NetBird UI to quit as console user $console_user (uid $uid)."
-    launchctl asuser "$uid" sudo -u "$console_user" -H osascript -e 'quit app "NetBird"' || true
-}
-
-# quit_ui stops a running UI so the app bundle can be replaced underneath it. A
-# UI process that survives the install keeps serving the old binary until it is
-# quit by hand, so anything still running once the quit request is out of the
-# way is signalled. Waiting for a graceful exit only makes sense when a quit
-# request was actually sent.
-quit_ui() {
-    if request_ui_quit && wait_for_ui_exit 10; then
-        return 0
-    fi
-
-    pgrep -x "$UI_PROCESS" > /dev/null 2>&1 || return 0
-
-    echo "NetBird UI still running; terminating it."
-    pkill -x "$UI_PROCESS" || true
-    if wait_for_ui_exit 3; then
-        return 0
-    fi
-
-    echo "NetBird UI ignored SIGTERM; killing it."
-    pkill -KILL -x "$UI_PROCESS" || true
-}
-
 {
    # check if it was installed with brew
    brew list --formula | grep netbird
@@ -73,9 +15,10 @@ quit_ui() {
        echo "NetBird has been installed with Brew. Please use Brew to update the package."
        exit 1
    fi
-    quit_ui
+    osascript -e 'quit app "Netbird"' || true
    $AGENT service stop || true

    echo "Preinstall complete"
    exit 0 # all good
 } &> $LOG_FILE
+