diff --git a/.github/scripts/release_helpers.sh b/.github/scripts/release_helpers.sh
new file mode 100755
index 00000000..c8c2d5db
--- /dev/null
+++ b/.github/scripts/release_helpers.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+
+delete_package_version() {
+  local endpoint=$1 tag=$2 digest=$3 attempt versions version_id
+  local retries=${RELEASE_RETRY_COUNT:-5} delay=${RELEASE_RETRY_DELAY:-2}
+
+  for ((attempt = 1; attempt <= retries; attempt++)); do
+    if versions=$(gh api --paginate --slurp "$endpoint?per_page=100") &&
+      version_id=$(jq -er --arg tag "$tag" --arg digest "$digest" \
+        '[.[][] | select(.name == $digest and ((.metadata.container.tags // []) | index($tag)))] | if length == 1 then .[0].id else empty end' \
+        <<< "$versions") &&
+      [[ $version_id =~ ^[0-9]+$ ]] &&
+      gh api --method DELETE "$endpoint/$version_id"; then
+      return 0
+    fi
+    ((attempt == retries)) || sleep "$delay"
+  done
+
+  echo "Could not delete package version for $tag at $digest" >&2
+  return 1
+}
+
+wait_for_tag_absent() {
+  local target=$1 attempt output
+  local retries=${RELEASE_RETRY_COUNT:-5} delay=${RELEASE_RETRY_DELAY:-2}
+
+  for ((attempt = 1; attempt <= retries; attempt++)); do
+    if output=$(crane digest "$target" 2>&1); then
+      :
+    elif grep -Eiq 'MANIFEST_UNKNOWN|manifest unknown|not found|404' <<< "$output"; then
+      return 0
+    fi
+    ((attempt == retries)) || sleep "$delay"
+  done
+
+  [[ -z $output ]] || printf '%s\n' "$output" >&2
+  echo "Tag still resolves after cleanup: $target" >&2
+  return 1
+}
diff --git a/.github/scripts/test_release_promotion.sh b/.github/scripts/test_release_promotion.sh
new file mode 100755
index 00000000..d4d76fc0
--- /dev/null
+++ b/.github/scripts/test_release_promotion.sh
@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
+source "$root/.github/scripts/release_helpers.sh"
+
+export RELEASE_RETRY_COUNT=5 RELEASE_RETRY_DELAY=0
+delete_attempts=0
+deleted_path=
+
+gh() {
+  if [[ $* == *'--paginate --slurp'* ]]; then
+    printf '%s\n' '[[
+      {"id": 11, "name": "sha256:correct", "metadata": {"container": {"tags": ["rollback-other"]}}},
+      {"id": 22, "name": "sha256:wrong", "metadata": {"container": {"tags": ["rollback-123-1"]}}},
+      {"id": 33, "name": "sha256:correct", "metadata": {"container": {"tags": ["rollback-123-1"]}}}
+    ]]'
+    return
+  fi
+  ((++delete_attempts))
+  deleted_path=${4:-}
+  ((delete_attempts >= 3))
+}
+
+delete_package_version /users/owner/packages/container/repo/versions rollback-123-1 sha256:correct
+[[ $delete_attempts -eq 3 ]]
+[[ $deleted_path == /users/owner/packages/container/repo/versions/33 ]]
+
+counter_file=$(mktemp)
+trap 'rm -f "$counter_file"' EXIT
+printf '0\n' > "$counter_file"
+crane() {
+  local count
+  count=$(< "$counter_file")
+  ((++count))
+  printf '%s\n' "$count" > "$counter_file"
+  if ((count < 3)); then
+    printf '%s\n' sha256:rollback
+    return
+  fi
+  echo MANIFEST_UNKNOWN >&2
+  return 1
+}
+
+wait_for_tag_absent ghcr.io/owner/repo:1.2.3
+[[ $(< "$counter_file") -eq 3 ]]
+
+python3 - "$root/.github/workflows/ci.yml" <<'PY'
+import re
+import sys
+from pathlib import Path
+
+workflow = Path(sys.argv[1]).read_text()
+release = re.search(r"(?ms)^  release:\n(.*?)(?=^  [a-zA-Z0-9_-]+:\n|\Z)", workflow)
+assert release, "release job missing"
+body = release.group(1)
+assert re.search(
+    r"(?m)^    concurrency:\n      group: release-promotion\n      cancel-in-progress: false$",
+    body,
+), "all release tags must share one non-cancelling promotion lock"
+assert "github.ref" not in re.search(r"(?ms)^    concurrency:\n(.*?)(?=^    \S)", body).group(1)
+PY
+
+echo "release promotion checks passed"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 25ef9220..e2894fe4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,21 +13,27 @@ permissions:
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
+  SHANGWUTONG_IMAGE_NAME: ${{ github.repository_owner }}/shangwutong
+  GOSEC_VERSION: v2.28.0
+  GOVULNCHECK_VERSION: v1.1.4
+  TRIVY_VERSION: v0.74.0
+  COSIGN_VERSION: v3.1.3
+  CRANE_VERSION: v0.21.9
 
 jobs:
   backend:
     name: Backend (SQLite)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
-          go-version-file: backend/go.mod
+          go-version: 1.25.13
           cache-dependency-path: backend/go.sum
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.12"
-      - uses: browser-actions/setup-chrome@v2
+      - uses: browser-actions/setup-chrome@48ad923757ca74d66703209fe939badbdf80f2f4 # v2
         id: chrome
       - name: Install browser harness
         run: python -m pip install browser-harness==0.1.9
@@ -60,7 +66,7 @@ jobs:
     runs-on: ubuntu-latest
     services:
       postgres:
-        image: pgvector/pgvector:pg16
+        image: pgvector/pgvector:pg16@sha256:ccc6e83d6e35e931dc7c5def2022729d5a6c370318d099181995567ff1fb4d6b
         env:
           POSTGRES_DB: gochat_test
           POSTGRES_USER: postgres
@@ -73,10 +79,10 @@ jobs:
           --health-timeout 5s
           --health-retries 5
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
-          go-version-file: backend/go.mod
+          go-version: 1.25.13
           cache-dependency-path: backend/go.sum
       - name: Test auto-assignment concurrency
         working-directory: backend
@@ -91,6 +97,12 @@ jobs:
             echo "PostgreSQL auto-assignment concurrency test did not run" >&2
             exit 1
           }
+      - name: Test backend against PostgreSQL
+        working-directory: backend
+        env:
+          GOCHAT_TEST_DB: postgres
+          GOCHAT_TEST_DB_URL: postgres://postgres:postgres@localhost:5432/gochat_test?sslmode=disable
+        run: go test -count=1 -timeout 10m ./internal/... ./pkg/... ./cmd/...
       - name: Test production upload migrations
         working-directory: backend
         env:
@@ -155,21 +167,58 @@ jobs:
     name: Frontend Build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20
-      - run: corepack enable
+      - run: corepack enable && corepack prepare pnpm@10.2.0 --activate
       - run: pnpm install --frozen-lockfile
+      - name: Test
+        run: pnpm --dir frontend test
       - name: ESLint representative JS/Vue files
         run: pnpm --dir frontend exec eslint app/javascript/dashboard/components-next/captain/assistant/AssistantPlayground.spec.js app/javascript/dashboard/components-next/captain/assistant/AssistantPlayground.vue
       - name: Prettier representative JS/TS/Vue files
         run: pnpm --dir frontend exec prettier --check app/javascript/dashboard/components-next/captain/assistant/AssistantPlayground.spec.js app/javascript/dashboard/components-next/captain/assistant/AssistantPlayground.vue vite.config.ts app/javascript/histoire.setup.ts
-      - run: pnpm --dir frontend build
+      - name: Build and verify artifacts
+        run: pnpm --dir frontend test:build
+
+  security:
+    name: Security (SAST/SCA)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - name: Test release promotion safeguards
+        run: .github/scripts/test_release_promotion.sh
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with:
+          go-version: 1.25.13
+          cache-dependency-path: |
+            backend/go.sum
+            channels/shangwutong/go.sum
+      - name: Install pinned Go security tools
+        env:
+          GOBIN: ${{ runner.temp }}/security-tools
+        run: |
+          go install github.com/securego/gosec/v2/cmd/gosec@"${GOSEC_VERSION}"
+          GOTOOLCHAIN=go1.26.6+auto go install golang.org/x/vuln/cmd/govulncheck@"${GOVULNCHECK_VERSION}"
+          echo "$GOBIN" >> "$GITHUB_PATH"
+      - name: Scan Go code and dependencies
+        run: |
+          (cd backend && gosec -quiet -severity high -confidence high ./... && govulncheck ./...)
+          (cd channels/shangwutong && GOTOOLCHAIN=go1.26.6+auto gosec -quiet -severity high -confidence high ./... && GOTOOLCHAIN=go1.26.6+auto govulncheck ./...)
+      - name: Scan repository dependencies
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          scanners: vuln
+          version: ${{ env.TRIVY_VERSION }}
+          severity: HIGH,CRITICAL
+          exit-code: 1
 
   production-smoke:
     name: Production image smoke
-    if: github.event_name == 'pull_request'
+    if: github.event_name == 'pull_request' || startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     env:
       GOCHAT_IMAGE_REF: gochat:production-smoke
@@ -180,11 +229,12 @@ jobs:
       MEILI_MASTER_KEY: ci-meili-secret-16
       GOCHAT_JWT_SECRET: ci-smoke-jwt-secret-at-least-32-characters
       GOCHAT_JWT_PREVIOUS_SECRETS: ci-previous-jwt-secret-at-least-32-characters
+      GOCHAT_CONNECTOR_SERVICE_TOKEN: ci-connector-service-token
       GOCHAT_BACKUP_OFFSITE_DIR: /mnt/gochat-offsite
       GOCHAT_BACKUP_OFFSITE_SOURCE: backup.example.test:/gochat
       GOCHAT_BACKUP_OFFSITE_FSTYPE: nfs4
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Build production images from repository root
         run: |
           docker build -t "$GOCHAT_IMAGE_REF" -f deploy/docker/Dockerfile .
@@ -197,20 +247,38 @@ jobs:
           docker push localhost:5000/shangwutong:production-smoke
           echo "GOCHAT_IMAGE_REF=$(docker inspect --format '{{index .RepoDigests 0}}' localhost:5000/gochat:production-smoke)" >> "$GITHUB_ENV"
           echo "SHANGWUTONG_IMAGE_REF=$(docker inspect --format '{{index .RepoDigests 0}}' localhost:5000/shangwutong:production-smoke)" >> "$GITHUB_ENV"
+      - name: Scan GoChat image
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          image-ref: gochat:production-smoke
+          scanners: vuln
+          version: ${{ env.TRIVY_VERSION }}
+          severity: HIGH,CRITICAL
+          exit-code: 1
+      - name: Scan Shangwutong image
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          image-ref: shangwutong:production-smoke
+          scanners: vuln
+          version: ${{ env.TRIVY_VERSION }}
+          severity: HIGH,CRITICAL
+          exit-code: 1
       - name: Verify artifact contents
-        run: >-
-          docker run --rm --entrypoint sh "$GOCHAT_IMAGE_REF" -c
-          'test -s /app/configs/config.production.yaml &&
-          test -d /app/migrations &&
-          test -s /app/frontend/dist/index.html'
+        run: |
+          docker run --rm --entrypoint sh "$GOCHAT_IMAGE_REF" -c \
+            'test -s /app/configs/config.production.yaml && test -d /app/migrations && test -s /app/frontend/dist/index.html'
+          docker run --rm --entrypoint sh "$SHANGWUTONG_IMAGE_REF" -c \
+            'test -x /usr/local/bin/shangwutong && test -d /data && test -d /backup && test "$(id -u)" -eq 10001'
       - name: Start production Compose and smoke core pages
         run: |
           deploy/docker/preflight_test.sh
           docker compose -f deploy/docker/docker-compose.prod.yml config --format json | python3 -c 'import json, os, sys; config = json.load(sys.stdin); assert all(config["services"][service]["environment"]["GOCHAT_JWT_PREVIOUS_SECRETS"] == os.environ["GOCHAT_JWT_PREVIOUS_SECRETS"] for service in ("gochat", "worker"))'
           docker compose -f deploy/docker/docker-compose.prod.yml --profile ops run --rm migrate
-          docker compose -f deploy/docker/docker-compose.prod.yml up -d --wait gochat
+          docker compose -f deploy/docker/docker-compose.prod.yml up -d --wait gochat shangwutong
           curl -fsS "http://127.0.0.1:$GOCHAT_PORT/health" | grep -q '"status":"healthy"'
           curl -fsS "http://127.0.0.1:$GOCHAT_PORT/app" | grep -q '/assets/'
+          docker compose -f deploy/docker/docker-compose.prod.yml exec -T shangwutong \
+            wget -q -T 3 -O - http://127.0.0.1:9100/readyz | grep -q '"status":"ready"'
       - name: Stop production Compose
         if: always()
         run: |
@@ -218,54 +286,261 @@ jobs:
           docker rm -f gochat-ci-registry || true
 
   release:
-    name: Publish immutable image
+    name: Publish signed immutable images
     if: startsWith(github.ref, 'refs/tags/v')
-    needs: [backend, backend-postgres, frontend]
+    needs: [backend, backend-postgres, frontend, security, production-smoke]
     runs-on: ubuntu-latest
+    concurrency:
+      group: release-promotion
+      cancel-in-progress: false
     permissions:
       contents: read
       packages: write
+      id-token: write
     outputs:
       image_ref: ${{ steps.ref.outputs.image_ref }}
       image_digest: ${{ steps.build.outputs.digest }}
+      shangwutong_image_ref: ${{ steps.ref.outputs.shangwutong_image_ref }}
+      shangwutong_image_digest: ${{ steps.shangwutong-build.outputs.digest }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Extract immutable tags
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           flavor: latest=false
           tags: |
             type=semver,pattern={{version}}
             type=sha
-      - name: Capture build date
+      - name: Extract Shangwutong immutable tags
+        id: shangwutong-meta
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.SHANGWUTONG_IMAGE_NAME }}
+          flavor: latest=false
+          tags: |
+            type=semver,pattern={{version}}
+            type=sha
+      - name: Capture reproducible build metadata
         id: date
-        run: echo "value=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> "$GITHUB_OUTPUT"
-      - name: Build and push
+        run: |
+          epoch=$(git show -s --format=%ct "$GITHUB_SHA")
+          echo "epoch=$epoch" >> "$GITHUB_OUTPUT"
+          echo "value=$(date -u -d "@$epoch" +'%Y-%m-%dT%H:%M:%SZ')" >> "$GITHUB_OUTPUT"
+      - name: Define isolated staging references
+        id: staging
+        run: |
+          suffix="staging-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+          echo "gochat=${REGISTRY}/${IMAGE_NAME}:$suffix" >> "$GITHUB_OUTPUT"
+          echo "shangwutong=${REGISTRY}/${SHANGWUTONG_IMAGE_NAME}:$suffix" >> "$GITHUB_OUTPUT"
+      - name: Build and push GoChat staging image
         id: build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           file: deploy/docker/Dockerfile
           push: true
-          tags: ${{ steps.meta.outputs.tags }}
+          sbom: true
+          provenance: mode=max
+          tags: ${{ steps.staging.outputs.gochat }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             VERSION=${{ github.ref_name }}
             COMMIT_SHA=${{ github.sha }}
             BUILD_DATE=${{ steps.date.outputs.value }}
+            SOURCE_DATE_EPOCH=${{ steps.date.outputs.epoch }}
           cache-from: type=gha,scope=gochat
           cache-to: type=gha,mode=max,scope=gochat
-      - name: Record digest reference
+      - name: Build and push Shangwutong staging image
+        id: shangwutong-build
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        with:
+          context: .
+          file: channels/shangwutong/Dockerfile
+          push: true
+          sbom: true
+          provenance: mode=max
+          tags: ${{ steps.staging.outputs.shangwutong }}
+          labels: ${{ steps.shangwutong-meta.outputs.labels }}
+          build-args: |
+            VERSION=${{ github.ref_name }}
+            COMMIT_SHA=${{ github.sha }}
+            BUILD_DATE=${{ steps.date.outputs.value }}
+            SOURCE_DATE_EPOCH=${{ steps.date.outputs.epoch }}
+          cache-from: type=gha,scope=shangwutong
+          cache-to: type=gha,mode=max,scope=shangwutong
+      - name: Record staging digest references
         id: ref
         run: |
           image_ref="${REGISTRY}/${IMAGE_NAME}@${{ steps.build.outputs.digest }}"
+          shangwutong_image_ref="${REGISTRY}/${SHANGWUTONG_IMAGE_NAME}@${{ steps.shangwutong-build.outputs.digest }}"
           echo "image_ref=$image_ref" >> "$GITHUB_OUTPUT"
-          echo "GoChat image: \`$image_ref\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "shangwutong_image_ref=$shangwutong_image_ref" >> "$GITHUB_OUTPUT"
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        with:
+          cosign-release: ${{ env.COSIGN_VERSION }}
+      - name: Install crane
+        uses: imjasonh/setup-crane@feee3b6bb0d4c68370f256a4502498c9227e5c6b # v0.7
+        with:
+          version: ${{ env.CRANE_VERSION }}
+      - name: Sign image digests
+        run: |
+          cosign sign --yes "${{ steps.ref.outputs.image_ref }}"
+          cosign sign --yes "${{ steps.ref.outputs.shangwutong_image_ref }}"
+      - name: Verify signatures and attestations
+        run: |
+          for image_ref in "${{ steps.ref.outputs.image_ref }}" "${{ steps.ref.outputs.shangwutong_image_ref }}"; do
+            cosign verify \
+              --certificate-identity-regexp "^https://github.com/${GITHUB_REPOSITORY}/.github/workflows/ci.yml@refs/tags/v" \
+              --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+              "$image_ref"
+            docker buildx imagetools inspect "$image_ref" --format '{{ json .SBOM }}' | grep -q '"SPDXID"'
+            provenance=$(docker buildx imagetools inspect "$image_ref" --format '{{ json .Provenance }}')
+            grep -q '"SLSA"' <<< "$provenance"
+            grep -q "$GITHUB_SHA" <<< "$provenance"
+          done
+      - name: Promote and reverify release tags
+        env:
+          GOCHAT_RELEASE_TAGS: ${{ steps.meta.outputs.tags }}
+          SHANGWUTONG_RELEASE_TAGS: ${{ steps.shangwutong-meta.outputs.tags }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PACKAGE_OWNER: ${{ github.repository_owner }}
+          PACKAGE_OWNER_TYPE: ${{ github.event.repository.owner.type }}
+        run: |
+          set -euo pipefail
+          source .github/scripts/release_helpers.sh
+
+          declare -a targets=() created=()
+          declare -A cleanup_refs=()
+          cleanup_tag_name="rollback-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+
+          add_targets() {
+            local source_ref=$1 tags=$2 repo=${1%@*} target count=0
+            while IFS= read -r target; do
+              [[ -n $target ]] || continue
+              [[ $target == "$repo:"* ]] || {
+                echo "Release tag is outside source repository: $target" >&2
+                return 1
+              }
+              targets+=("$source_ref|$target")
+              ((++count))
+            done <<< "$tags"
+            ((count > 0))
+          }
+
+          delete_cleanup_version() {
+            local repo=$1 cleanup_ref=${cleanup_refs[$1]} package endpoint
+            package=${repo#"ghcr.io/$PACKAGE_OWNER/"}
+            [[ $package != "$repo" ]] || return 1
+            package=$(jq -rn --arg value "$package" '$value | @uri')
+            case $PACKAGE_OWNER_TYPE in
+              User) endpoint="/users/$PACKAGE_OWNER/packages/container/$package/versions" ;;
+              Organization) endpoint="/orgs/$PACKAGE_OWNER/packages/container/$package/versions" ;;
+              *) return 1 ;;
+            esac
+            delete_package_version "$endpoint" "$cleanup_tag_name" "${cleanup_ref##*@}"
+          }
+
+          rollback() {
+            local status=$? entry source_ref target repo tag cleanup_ref rollback_failed=0
+            ((status != 0)) || return
+            trap - EXIT INT TERM
+            set +e
+            echo "Promotion failed; removing created release tags" >&2
+            for entry in "${created[@]}"; do
+              source_ref=${entry%%|*}
+              target=${entry#*|}
+              repo=${source_ref%@*}
+              tag=${target#"$repo:"}
+              cleanup_ref=${cleanup_refs[$repo]}
+              crane tag "$cleanup_ref" "$tag" || rollback_failed=1
+            done
+            for repo in "${!cleanup_refs[@]}"; do
+              delete_cleanup_version "$repo" || rollback_failed=1
+              wait_for_tag_absent "$repo:$cleanup_tag_name" || rollback_failed=1
+            done
+            for entry in "${created[@]}"; do
+              target=${entry#*|}
+              wait_for_tag_absent "$target" || rollback_failed=1
+            done
+            ((rollback_failed == 0)) || echo "Release-tag rollback was incomplete" >&2
+            exit "$status"
+          }
+
+          add_targets "${{ steps.ref.outputs.image_ref }}" "$GOCHAT_RELEASE_TAGS"
+          add_targets "${{ steps.ref.outputs.shangwutong_image_ref }}" "$SHANGWUTONG_RELEASE_TAGS"
+
+          trap rollback EXIT
+          trap 'exit 1' INT TERM
+          cleanup_dir=$(mktemp -d)
+          printf '%s\n' "${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" > "$cleanup_dir/rollback-marker"
+          tar -C "$cleanup_dir" -cf "$cleanup_dir/rollback.tar" rollback-marker
+          for source_ref in \
+            "${{ steps.ref.outputs.image_ref }}" \
+            "${{ steps.ref.outputs.shangwutong_image_ref }}"; do
+            repo=${source_ref%@*}
+            cleanup_tag="$repo:$cleanup_tag_name"
+            cleanup_refs["$repo"]=$(crane append \
+              --oci-empty-base \
+              --new_layer "$cleanup_dir/rollback.tar" \
+              --new_tag "$cleanup_tag")
+          done
+
+          error_file="$RUNNER_TEMP/crane-digest.err"
+          for entry in "${targets[@]}"; do
+            target=${entry#*|}
+            if digest=$(crane digest "$target" 2> "$error_file"); then
+              echo "Refusing to overwrite existing release tag $target ($digest)" >&2
+              exit 1
+            fi
+            grep -Eiq 'MANIFEST_UNKNOWN|manifest unknown|not found|404' "$error_file" || {
+              cat "$error_file" >&2
+              exit 1
+            }
+          done
+
+          for entry in "${targets[@]}"; do
+            source_ref=${entry%%|*}
+            target=${entry#*|}
+            repo=${source_ref%@*}
+            tag=${target#"$repo:"}
+            created+=("$entry")
+            crane tag "$source_ref" "$tag"
+          done
+
+          for entry in "${targets[@]}"; do
+            source_ref=${entry%%|*}
+            target=${entry#*|}
+            expected=${source_ref##*@}
+            actual=$(crane digest "$target")
+            [[ $actual == "$expected" ]] || {
+              echo "Digest mismatch: $target resolved to $actual, expected $expected" >&2
+              exit 1
+            }
+            echo "$target -> $actual"
+            cosign verify \
+              --certificate-identity-regexp "^https://github.com/${GITHUB_REPOSITORY}/.github/workflows/ci.yml@refs/tags/v" \
+              --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+              "$target"
+            docker buildx imagetools inspect "$target" --format '{{ json .SBOM }}' | grep -q '"SPDXID"'
+            provenance=$(docker buildx imagetools inspect "$target" --format '{{ json .Provenance }}')
+            grep -q '"SLSA"' <<< "$provenance"
+            grep -q "$GITHUB_SHA" <<< "$provenance"
+          done
+
+          trap - EXIT INT TERM
+          for repo in "${!cleanup_refs[@]}"; do
+            delete_cleanup_version "$repo"
+            wait_for_tag_absent "$repo:$cleanup_tag_name"
+          done
+
+          echo "GoChat image: \`${{ steps.ref.outputs.image_ref }}\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "Shangwutong image: \`${{ steps.ref.outputs.shangwutong_image_ref }}\`" >> "$GITHUB_STEP_SUMMARY"
diff --git a/backend/go.mod b/backend/go.mod
index dd74fa57..2e9be8d2 100644
--- a/backend/go.mod
+++ b/backend/go.mod
@@ -29,7 +29,7 @@ require (
 	github.com/swaggo/gin-swagger v1.6.0
 	github.com/swaggo/swag v1.16.6
 	go.uber.org/zap v1.21.0
-	golang.org/x/crypto v0.53.0
+	golang.org/x/crypto v0.55.0
 	golang.org/x/oauth2 v0.30.0
 	gorm.io/datatypes v1.2.0
 	gorm.io/driver/postgres v1.5.11
@@ -63,8 +63,8 @@ require (
 	github.com/smarty/assertions v1.16.0 // indirect
 	github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect
 	github.com/yargevad/filepathx v1.0.0 // indirect
-	golang.org/x/mod v0.37.0 // indirect
-	golang.org/x/tools v0.47.0 // indirect
+	golang.org/x/mod v0.40.0 // indirect
+	golang.org/x/tools v0.49.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gorm.io/driver/mysql v1.5.6 // indirect
 )
@@ -125,10 +125,10 @@ require (
 	go.uber.org/multierr v1.9.0 // indirect
 	golang.org/x/arch v0.15.0 // indirect
 	golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 // indirect
-	golang.org/x/net v0.56.0
-	golang.org/x/sync v0.21.0 // indirect
-	golang.org/x/sys v0.46.0 // indirect
-	golang.org/x/text v0.39.0
+	golang.org/x/net v0.58.0
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.41.0
 	google.golang.org/appengine v1.6.8 // indirect
 	google.golang.org/protobuf v1.36.8 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
diff --git a/backend/go.sum b/backend/go.sum
index b7e369d5..fbf04202 100644
--- a/backend/go.sum
+++ b/backend/go.sum
@@ -357,8 +357,8 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
-golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
 golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 h1:nDVHiLt8aIbd/VzvPWN6kSOPE7+F/fNFDSXLVYkE/Iw=
 golang.org/x/exp v0.0.0-20250305212735-054e65f0b394/go.mod h1:sIifuuw/Yco/y6yb6+bDNfyeQ/MdPUy/hKEMYQV17cM=
 golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
@@ -368,8 +368,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=
+golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
@@ -384,8 +384,8 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
-golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
 golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
 golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -397,8 +397,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
-golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -418,8 +418,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
-golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -429,8 +429,8 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
-golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -442,8 +442,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=
-golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
 golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -455,8 +455,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
-golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/backend/internal/database/upload_migration_test.go b/backend/internal/database/upload_migration_test.go
index 5e926ca8..eb9575ca 100644
--- a/backend/internal/database/upload_migration_test.go
+++ b/backend/internal/database/upload_migration_test.go
@@ -48,7 +48,7 @@ func openUploadMigrationPostgres(t *testing.T) (*gorm.DB, string) {
 	require.NoError(t, err)
 	require.NotEmpty(t, migrationURL.Scheme, "GOCHAT_TEST_DB_URL must be a PostgreSQL URL")
 	query := migrationURL.Query()
-	query.Set("search_path", schema)
+	query.Set("search_path", schema+",public")
 	migrationURL.RawQuery = query.Encode()
 
 	db, err := gorm.Open(postgres.Open(migrationURL.String()), &gorm.Config{Logger: logger.Default.LogMode(logger.Silent)})
diff --git a/backend/internal/repository/conversation_repo_pg_test.go b/backend/internal/repository/conversation_repo_pg_test.go
index 6abd3c60..c40e049d 100644
--- a/backend/internal/repository/conversation_repo_pg_test.go
+++ b/backend/internal/repository/conversation_repo_pg_test.go
@@ -82,12 +82,17 @@ func TestConversationRepo_Filter_AssigneeType_PG(t *testing.T) {
 	db := setupTestDB(t)
 	repo := NewConversationRepo(db)
 	ctx := context.Background()
-	accountID := uint(1)
+	account := createTestAccountForSearch(t, db)
+	inbox := createTestInboxForSearch(t, db, account.ID, "PG assignee filter")
+	agent := createTestUserForSearch(t, db, account.ID, "pg-agent@example.com")
+	admin := createTestUserForSearch(t, db, account.ID, "pg-admin@example.com")
+	require.NoError(t, db.Create(&model.AccountUser{AccountID: account.ID, UserID: agent.ID, Role: "agent"}).Error)
+	require.NoError(t, db.Create(&model.AccountUser{AccountID: account.ID, UserID: admin.ID, Role: "administrator"}).Error)
 
 	convs := []model.Conversation{
-		{AccountID: accountID, InboxID: 1, Status: "open", AssigneeID: uintPtr(10)},
-		{AccountID: accountID, InboxID: 1, Status: "open", AssigneeID: uintPtr(20)},
-		{AccountID: accountID, InboxID: 1, Status: "open", AssigneeID: nil}, // unassigned
+		{AccountID: account.ID, InboxID: inbox.ID, Status: "open", AssigneeID: uintPtr(agent.ID)},
+		{AccountID: account.ID, InboxID: inbox.ID, Status: "open", AssigneeID: uintPtr(admin.ID)},
+		{AccountID: account.ID, InboxID: inbox.ID, Status: "open", AssigneeID: nil}, // unassigned
 	}
 	for _, c := range convs {
 		require.NoError(t, repo.Create(ctx, &c))
@@ -95,12 +100,12 @@ func TestConversationRepo_Filter_AssigneeType_PG(t *testing.T) {
 
 	var total int64
 	db.Model(&model.Conversation{}).
-		Where("account_id = ? AND assignee_id IS NOT NULL AND assignee_id != 0", accountID).
+		Where("account_id = ? AND assignee_id IS NOT NULL AND assignee_id != 0", account.ID).
 		Count(&total)
 	assert.Equal(t, int64(2), total, "assigned conversations")
 
 	db.Model(&model.Conversation{}).
-		Where("account_id = ? AND (assignee_id IS NULL OR assignee_id = 0)", accountID).
+		Where("account_id = ? AND (assignee_id IS NULL OR assignee_id = 0)", account.ID).
 		Count(&total)
 	assert.Equal(t, int64(1), total, "unassigned conversations")
 }
diff --git a/backend/internal/service/enterprise_billing_worker.go b/backend/internal/service/enterprise_billing_worker.go
index 23c1d942..7c856b24 100644
--- a/backend/internal/service/enterprise_billing_worker.go
+++ b/backend/internal/service/enterprise_billing_worker.go
@@ -241,12 +241,14 @@ func stripeFormRequest(ctx context.Context, secret, method, path string, values
 	} else {
 		body = strings.NewReader(values.Encode())
 	}
+	// #nosec G704 -- STRIPE_API_BASE is operator-controlled and intentionally injectable for tests.
 	request, err := http.NewRequestWithContext(ctx, method, endpoint, body)
 	if err != nil {
 		return nil, err
 	}
 	request.SetBasicAuth(secret, "")
 	request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	// #nosec G704 -- the request target is the operator-controlled Stripe endpoint above.
 	response, err := http.DefaultClient.Do(request)
 	if err != nil {
 		return nil, err
diff --git a/channels/shangwutong/Dockerfile b/channels/shangwutong/Dockerfile
index 7db5dd33..9255e5fc 100644
--- a/channels/shangwutong/Dockerfile
+++ b/channels/shangwutong/Dockerfile
@@ -1,18 +1,26 @@
-FROM golang:1.26.6-alpine AS builder
+FROM golang:1.26.6-alpine@sha256:3889b425f035be855a72fb4755265311293b6d414521f0a519d819df32222d83 AS builder
+
+ARG SOURCE_DATE_EPOCH=0
+ENV SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}
 
 WORKDIR /src/channels/shangwutong
-RUN apk add --no-cache ca-certificates git
 
 COPY channels/shangwutong/go.mod channels/shangwutong/go.sum ./
 RUN go mod download
 
 COPY channels/shangwutong/ ./
-RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/shangwutong ./cmd/shangwutong
+RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -buildvcs=false -tags timetzdata -ldflags="-s -w" -o /out/shangwutong ./cmd/shangwutong
 
-FROM alpine:3.22
+FROM alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce
 
-RUN apk add --no-cache ca-certificates tzdata \
-  && addgroup -S -g 10001 connector \
+ARG VERSION=dev
+ARG COMMIT_SHA=unknown
+ARG BUILD_DATE=unknown
+LABEL org.opencontainers.image.version="${VERSION}" \
+      org.opencontainers.image.revision="${COMMIT_SHA}" \
+      org.opencontainers.image.created="${BUILD_DATE}"
+
+RUN addgroup -S -g 10001 connector \
   && adduser -S -D -H -u 10001 -G connector connector \
   && mkdir -p /data /backup \
   && chown connector:connector /data /backup \
diff --git a/channels/shangwutong/internal/command/root.go b/channels/shangwutong/internal/command/root.go
index cf27e0b5..3b99558b 100644
--- a/channels/shangwutong/internal/command/root.go
+++ b/channels/shangwutong/internal/command/root.go
@@ -220,10 +220,12 @@ func newReconcileCommand() *cobra.Command {
 			if err != nil {
 				return err
 			}
+			// #nosec G704 -- target is derived from the operator-controlled connector listen address.
 			request, err := http.NewRequestWithContext(cmd.Context(), http.MethodPost, target+"/internal/reconcile", nil)
 			if err != nil {
 				return err
 			}
+			// #nosec G704 -- the CLI intentionally calls its configured connector endpoint.
 			response, err := (&http.Client{Timeout: 5 * time.Minute}).Do(request)
 			if err != nil {
 				return err
diff --git a/deploy/docker/Dockerfile b/deploy/docker/Dockerfile
index d801a7d0..7d3a3fbc 100644
--- a/deploy/docker/Dockerfile
+++ b/deploy/docker/Dockerfile
@@ -2,7 +2,10 @@
 # Reference: Chatwoot docker/Dockerfile multi-stage pattern + security best practices
 
 # ========== Frontend Build Stage ==========
-FROM node:22-alpine AS frontend-builder
+FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS frontend-builder
+
+ARG SOURCE_DATE_EPOCH=0
+ENV SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}
 
 WORKDIR /app
 
@@ -14,18 +17,17 @@ COPY frontend/ frontend/
 RUN pnpm --dir frontend test:build
 
 # ========== Go Build Stage ==========
-FROM golang:1.25.13-alpine AS builder
+FROM golang:1.25.13-alpine@sha256:1e0126852075c9c60731c8ba49088448b91f63e2aed97ca9d1a9791622a05946 AS builder
 
 # Build arguments for version injection
 ARG VERSION=dev
 ARG COMMIT_SHA=unknown
 ARG BUILD_DATE=unknown
+ARG SOURCE_DATE_EPOCH=0
+ENV SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}
 
 WORKDIR /app
 
-# Install git for go mod download with private repos
-RUN apk add --no-cache git
-
 # Dependency layer — cached unless go.mod/go.sum change
 COPY backend/go.mod backend/go.sum ./
 COPY backend/internal/pgvector_stub/ ./internal/pgvector_stub/
@@ -36,7 +38,7 @@ COPY backend/ .
 
 # Build with version info injected via ldflags
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
-    go build -ldflags="-s -w \
+    go build -trimpath -buildvcs=false -tags timetzdata -ldflags="-s -w \
     -X github.com/gochat/gochat/internal/config.Version=${VERSION} \
     -X github.com/gochat/gochat/internal/config.CommitSHA=${COMMIT_SHA} \
     -X github.com/gochat/gochat/internal/config.BuildDate=${BUILD_DATE}" \
@@ -44,7 +46,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
 
 # Build worker binary (same source, --worker-only flag in main)
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
-    go build -ldflags="-s -w \
+    go build -trimpath -buildvcs=false -tags timetzdata -ldflags="-s -w \
     -X github.com/gochat/gochat/internal/config.Version=${VERSION} \
     -X github.com/gochat/gochat/internal/config.CommitSHA=${COMMIT_SHA} \
     -X github.com/gochat/gochat/internal/config.BuildDate=${BUILD_DATE}" \
@@ -54,7 +56,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
     go build -ldflags="-s -w" -o /migrate ./cmd/migrate/
 
 # ========== Production Stage ==========
-FROM alpine:3.21
+FROM alpine:3.21@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d65087abc07d
 
 ARG VERSION=dev
 ARG COMMIT_SHA=unknown
@@ -87,7 +89,8 @@ RUN mkdir -p /app/storage/uploads && chown -R gochat:gochat /app/storage
 USER gochat
 
 # Health check — references the /health endpoint we will add
-HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3     CMD curl -f http://localhost:3000/ready || exit 1
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD wget -q -T 3 -O /dev/null http://127.0.0.1:3000/ready || exit 1
 
 EXPOSE 3000
 
diff --git a/deploy/docker/docker-compose.prod.yml b/deploy/docker/docker-compose.prod.yml
index 972cb6ef..cc8c0c3b 100644
--- a/deploy/docker/docker-compose.prod.yml
+++ b/deploy/docker/docker-compose.prod.yml
@@ -91,7 +91,7 @@ services:
     volumes:
       - gochat_storage:/app/storage
     healthcheck:
-      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:3000/ready"]
+      test: ["CMD", "wget", "-q", "-T", "3", "-O", "/dev/null", "http://127.0.0.1:3000/ready"]
       interval: 10s
       timeout: 5s
       start_period: 15s
diff --git a/frontend/app/javascript/dashboard/routes/index.spec.js b/frontend/app/javascript/dashboard/routes/index.spec.js
index c60e5441..0e3f16fa 100644
--- a/frontend/app/javascript/dashboard/routes/index.spec.js
+++ b/frontend/app/javascript/dashboard/routes/index.spec.js
@@ -32,14 +32,9 @@ describe('#validateAuthenticateRoutePermission', () => {
       // Mock the store to simulate user not logged in
       store.getters.isLoggedIn = false;
 
-      // Mock window.location.assign
-      const mockAssign = vi.fn();
-      delete window.location;
-      window.location = { assign: mockAssign };
-
       validateAuthenticateRoutePermission(to, next);
 
-      expect(mockAssign).toHaveBeenCalledWith('/app/login');
+      expect(next).toHaveBeenCalledWith('/app/login');
     });
   });
 
diff --git a/frontend/app/javascript/dashboard/store/modules/specs/notifications/actions.spec.js b/frontend/app/javascript/dashboard/store/modules/specs/notifications/actions.spec.js
index b81d9c68..c2ac2043 100644
--- a/frontend/app/javascript/dashboard/store/modules/specs/notifications/actions.spec.js
+++ b/frontend/app/javascript/dashboard/store/modules/specs/notifications/actions.spec.js
@@ -66,6 +66,7 @@ describe('#actions', () => {
       expect(commit.mock.calls).toEqual([
         [types.SET_NOTIFICATIONS_UI_FLAG, { isFetching: true }],
         [types.SET_NOTIFICATIONS_UI_FLAG, { isFetching: false }],
+        [types.SET_ALL_NOTIFICATIONS_LOADED],
       ]);
     });
   });
diff --git a/frontend/app/javascript/dashboard/store/storeFactory.spec.js b/frontend/app/javascript/dashboard/store/storeFactory.spec.js
index 3dc2eedd..2bb23b57 100644
--- a/frontend/app/javascript/dashboard/store/storeFactory.spec.js
+++ b/frontend/app/javascript/dashboard/store/storeFactory.spec.js
@@ -299,7 +299,7 @@ describe('storeFactory', () => {
           updatingItem: true,
         });
         expect(API.update).toHaveBeenCalledWith(1, { name: 'Updated' });
-        expect(commit).toHaveBeenCalledWith(mutationTypes.EDIT, data);
+        expect(commit).toHaveBeenCalledWith(mutationTypes.UPSERT, data);
         expect(commit).toHaveBeenCalledWith(mutationTypes.SET_UI_FLAG, {
           updatingItem: false,
         });
diff --git a/frontend/app/javascript/dashboard/store/utils/specs/api.spec.js b/frontend/app/javascript/dashboard/store/utils/specs/api.spec.js
index b0b53400..a49c655a 100644
--- a/frontend/app/javascript/dashboard/store/utils/specs/api.spec.js
+++ b/frontend/app/javascript/dashboard/store/utils/specs/api.spec.js
@@ -35,7 +35,7 @@ describe('#parseAPIErrorResponse', () => {
     ).toBe('Error Message [error]');
 
     expect(parseAPIErrorResponse('Error: 422 Failed')).toBe(
-      'Error: 422 Failed'
+      'Request failed. Please try again.'
     );
   });
 });
diff --git a/frontend/app/javascript/portal/specs/portalTheme.spec.js b/frontend/app/javascript/portal/specs/portalTheme.spec.js
index d936996b..aab1a5d3 100644
--- a/frontend/app/javascript/portal/specs/portalTheme.spec.js
+++ b/frontend/app/javascript/portal/specs/portalTheme.spec.js
@@ -90,7 +90,7 @@ describe('portalThemeHelper', () => {
       );
       removeQueryParamsFromUrl('theme');
       expect(window.history.replaceState).toHaveBeenCalledWith(
-        {},
+        null,
         '',
         'http://localhost:3000/?show_plain_layout=true'
       );