diff --git a/.prettierignore b/.prettierignore
index bdf373421..23b42c81c 100644
--- a/.prettierignore
+++ b/.prettierignore
@@ -37,4 +37,7 @@ archives/
 *.mdx
 
 # Component overrides with custom formatting
-src/components/overrides/Banner.astro
\ No newline at end of file
+src/components/overrides/Banner.astro
+
+# prettier-plugin-astro bug: <script is:inline> inside JSX expression causes parse error
+src/components/ui/Tabs.astro
\ No newline at end of file
diff --git a/.simple-git-hooks.json b/.simple-git-hooks.json
index 188070908..3e3a85c66 100644
--- a/.simple-git-hooks.json
+++ b/.simple-git-hooks.json
@@ -1,4 +1,4 @@
 {
   "pre-commit": "pnpm pretty-quick --staged",
-  "pre-push": "if [ -n \"$(git status --porcelain)\" ]; then echo \"❌ Error: You have uncommitted changes. Please commit or stash them before pushing.\"; git status --short; exit 1; fi && echo \"Running build before push...\" && pnpm run generate-search-index && pnpm run build && node scripts/log-preview-url.js"
+  "pre-push": "if [ -n \"$(git status --porcelain)\" ]; then echo \"❌ Error: You have uncommitted changes. Please commit or stash them before pushing.\"; git status --short; exit 1; fi && command -v d2 >/dev/null 2>&1 || (echo \"D2 not found, installing...\" && pnpm run install:d2) && echo \"Running build before push...\" && pnpm run generate-search-index && pnpm run build && node scripts/log-preview-url.js"
 }
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 302d3c09e..8afec85da 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -47,6 +47,8 @@ A few things worth knowing before you dive in:
 npm install -g pnpm
 ```
 
+Optionally, use [Volta](https://volta.sh) to manage Node and pnpm versions automatically — the project's `package.json` already has the correct versions pinned.
+
 ### Clone and run
 
 ```bash
diff --git a/README.md b/README.md
index 08e2057ba..9d6fafd52 100644
--- a/README.md
+++ b/README.md
@@ -70,6 +70,8 @@ developer-docs/
 npm install -g pnpm
 ```
 
+Optionally, use [Volta](https://volta.sh) to manage Node and pnpm versions automatically — the project's `package.json` already has the correct versions pinned.
+
 #### Run locally
 
 ```bash
diff --git a/package.json b/package.json
index c263e40be..c3ab84ad4 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,6 @@
     "astro-og-canvas": "^0.10.1",
     "canvaskit-wasm": "0.40.0",
     "jose": "^6.2.2",
-    "pnpm": "^10.33.0",
     "react": "^19.2.5",
     "react-dom": "^19.2.5",
     "sharp": "^0.34.5",
@@ -83,6 +82,10 @@
     "simple-git-hooks": "^2.13.1",
     "unified": "^11.0.5"
   },
+  "volta": {
+    "node": "24.15.0",
+    "pnpm": "10.33.0"
+  },
   "pnpm": {
     "onlyBuiltDependencies": [
       "sharp",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 0e43abb74..3a025d4fd 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -102,9 +102,6 @@ importers:
       jose:
         specifier: ^6.2.2
         version: 6.2.2
-      pnpm:
-        specifier: ^10.33.0
-        version: 10.33.0
       react:
         specifier: ^19.2.5
         version: 19.2.5
@@ -6245,11 +6242,6 @@ packages:
   pkg-types@2.3.0:
     resolution: {integrity: sha512-SIqCzDRg0s9npO5XQ3tNZioRY1uK06lA41ynBC1YmFTmnY6FjUjVt6s4LoADmwoig1qqD0oK8h1p/8mlMx8Oig==}
 
-  pnpm@10.33.0:
-    resolution: {integrity: sha512-EFaLtKavtYyes2MNqQzJUWQXq+vT+rvmc58K55VyjaFJHp21pUTHatjrdXD1xLs9bGN7LLQb/c20f6gjyGSTGQ==}
-    engines: {node: '>=18.12'}
-    hasBin: true
-
   possible-typed-array-names@1.1.0:
     resolution: {integrity: sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==}
     engines: {node: '>= 0.4'}
@@ -15782,8 +15774,6 @@ snapshots:
       exsolve: 1.0.8
       pathe: 2.0.3
 
-  pnpm@10.33.0: {}
-
   possible-typed-array-names@1.1.0: {}
 
   postcss-nested@6.2.0(postcss@8.5.10):
diff --git a/public/d2/docs/agentkit/authentication/token-management-0.svg b/public/d2/docs/agentkit/authentication/token-management-0.svg
index 36ba4c950..e658be0fa 100644
--- a/public/d2/docs/agentkit/authentication/token-management-0.svg
+++ b/public/d2/docs/agentkit/authentication/token-management-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 693 991"><svg class="d2-1685155804 d2-svg" width="693" height="991" viewBox="-9 -12 693 991"><rect x="-9.000000" y="-12.000000" width="693.000000" height="991.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 693 991"><svg class="d2-1685155804 d2-svg" width="693" height="991" viewBox="-9 -12 693 991"><rect x="-9.000000" y="-12.000000" width="693.000000" height="991.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-1685155804 .text {
 	font-family: "d2-1685155804-font-regular";
 }
diff --git a/public/d2/docs/agentkit/mcp/configure-mcp-server-0.svg b/public/d2/docs/agentkit/mcp/configure-mcp-server-0.svg
index 6b8b8f019..f245dbb64 100644
--- a/public/d2/docs/agentkit/mcp/configure-mcp-server-0.svg
+++ b/public/d2/docs/agentkit/mcp/configure-mcp-server-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1352 344"><svg class="d2-1219939469 d2-svg" width="1352" height="344" viewBox="-37 -85 1352 344"><rect x="-37.000000" y="-85.000000" width="1352.000000" height="344.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1352 344"><svg class="d2-1219939469 d2-svg" width="1352" height="344" viewBox="-37 -85 1352 344"><rect x="-37.000000" y="-85.000000" width="1352.000000" height="344.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-1219939469 .text {
 	font-family: "d2-1219939469-font-regular";
 }
diff --git a/public/d2/docs/agentkit/mcp/configure-mcp-server-1.svg b/public/d2/docs/agentkit/mcp/configure-mcp-server-1.svg
index 95e252582..af3d1e7ca 100644
--- a/public/d2/docs/agentkit/mcp/configure-mcp-server-1.svg
+++ b/public/d2/docs/agentkit/mcp/configure-mcp-server-1.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1380 344"><svg class="d2-2287933305 d2-svg" width="1380" height="344" viewBox="-37 -85 1380 344"><rect x="-37.000000" y="-85.000000" width="1380.000000" height="344.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1380 344"><svg class="d2-2287933305 d2-svg" width="1380" height="344" viewBox="-37 -85 1380 344"><rect x="-37.000000" y="-85.000000" width="1380.000000" height="344.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-2287933305 .text {
 	font-family: "d2-2287933305-font-regular";
 }
diff --git a/public/d2/docs/agentkit/mcp/configure-mcp-server-2.svg b/public/d2/docs/agentkit/mcp/configure-mcp-server-2.svg
index ba3e0866e..e7ee4e504 100644
--- a/public/d2/docs/agentkit/mcp/configure-mcp-server-2.svg
+++ b/public/d2/docs/agentkit/mcp/configure-mcp-server-2.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1096 439"><svg class="d2-3970838783 d2-svg" width="1096" height="439" viewBox="-37 -85 1096 439"><rect x="-37.000000" y="-85.000000" width="1096.000000" height="439.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1096 439"><svg class="d2-3970838783 d2-svg" width="1096" height="439" viewBox="-37 -85 1096 439"><rect x="-37.000000" y="-85.000000" width="1096.000000" height="439.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-3970838783 .text {
 	font-family: "d2-3970838783-font-regular";
 }
diff --git a/public/d2/docs/agentkit/openclaw-0.svg b/public/d2/docs/agentkit/openclaw-0.svg
index 085fc351c..9588ffadd 100644
--- a/public/d2/docs/agentkit/openclaw-0.svg
+++ b/public/d2/docs/agentkit/openclaw-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1266 436"><svg class="d2-1676533182 d2-svg" width="1266" height="436" viewBox="6 6 1266 436"><rect x="6.000000" y="6.000000" width="1266.000000" height="436.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1266 436"><svg class="d2-1676533182 d2-svg" width="1266" height="436" viewBox="6 6 1266 436"><rect x="6.000000" y="6.000000" width="1266.000000" height="436.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-1676533182 .text {
 	font-family: "d2-1676533182-font-regular";
 }
diff --git a/public/d2/docs/agentkit/overview-0.svg b/public/d2/docs/agentkit/overview-0.svg
index 9a8551893..972472d47 100644
--- a/public/d2/docs/agentkit/overview-0.svg
+++ b/public/d2/docs/agentkit/overview-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1366 398"><svg class="d2-2124456674 d2-svg" width="1366" height="398" viewBox="6 6 1366 398"><rect x="6.000000" y="6.000000" width="1366.000000" height="398.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1366 398"><svg class="d2-2124456674 d2-svg" width="1366" height="398" viewBox="6 6 1366 398"><rect x="6.000000" y="6.000000" width="1366.000000" height="398.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-2124456674 .text {
 	font-family: "d2-2124456674-font-regular";
 }
diff --git a/public/d2/docs/agentkit/user-verification-0.svg b/public/d2/docs/agentkit/user-verification-0.svg
index a6a484167..a4187fb85 100644
--- a/public/d2/docs/agentkit/user-verification-0.svg
+++ b/public/d2/docs/agentkit/user-verification-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 945 1690"><svg class="d2-1381664539 d2-svg" width="945" height="1690" viewBox="-25 -28 945 1690"><rect x="-25.000000" y="-28.000000" width="945.000000" height="1690.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 945 1690"><svg class="d2-1381664539 d2-svg" width="945" height="1690" viewBox="-25 -28 945 1690"><rect x="-25.000000" y="-28.000000" width="945.000000" height="1690.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-1381664539 .text {
 	font-family: "d2-1381664539-font-regular";
 }
diff --git a/public/d2/docs/authenticate/auth-methods/authentication-flow-0.svg b/public/d2/docs/authenticate/auth-methods/authentication-flow-0.svg
index 067c712c8..3df7580a9 100644
--- a/public/d2/docs/authenticate/auth-methods/authentication-flow-0.svg
+++ b/public/d2/docs/authenticate/auth-methods/authentication-flow-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 628 1257"><svg class="d2-477848031 d2-svg" width="628" height="1257" viewBox="6 6 628 1257"><rect x="6.000000" y="6.000000" width="628.000000" height="1257.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 628 1257"><svg class="d2-477848031 d2-svg" width="628" height="1257" viewBox="6 6 628 1257"><rect x="6.000000" y="6.000000" width="628.000000" height="1257.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-477848031 .text-bold {
 	font-family: "d2-477848031-font-bold";
 }
diff --git a/public/d2/docs/authenticate/authz/create-roles-permissions-0.svg b/public/d2/docs/authenticate/authz/create-roles-permissions-0.svg
index edb600153..3f5a8f21e 100644
--- a/public/d2/docs/authenticate/authz/create-roles-permissions-0.svg
+++ b/public/d2/docs/authenticate/authz/create-roles-permissions-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1636 300"><svg class="d2-2419271476 d2-svg" width="1636" height="300" viewBox="6 -52 1636 300"><rect x="6.000000" y="-52.000000" width="1636.000000" height="300.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1636 300"><svg class="d2-2419271476 d2-svg" width="1636" height="300" viewBox="6 -52 1636 300"><rect x="6.000000" y="-52.000000" width="1636.000000" height="300.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-2419271476 .text {
 	font-family: "d2-2419271476-font-regular";
 }
diff --git a/public/d2/docs/authenticate/authz/implement-access-control-0.svg b/public/d2/docs/authenticate/authz/implement-access-control-0.svg
index 4718c3f25..e637e36e7 100644
--- a/public/d2/docs/authenticate/authz/implement-access-control-0.svg
+++ b/public/d2/docs/authenticate/authz/implement-access-control-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 829 749"><svg class="d2-1332306126 d2-svg" width="829" height="749" viewBox="-89 -49 829 749"><rect x="-89.000000" y="-49.000000" width="829.000000" height="749.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 829 749"><svg class="d2-1332306126 d2-svg" width="829" height="749" viewBox="-89 -49 829 749"><rect x="-89.000000" y="-49.000000" width="829.000000" height="749.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-1332306126 .text {
 	font-family: "d2-1332306126-font-regular";
 }
diff --git a/public/d2/docs/authenticate/authz/overview-0.svg b/public/d2/docs/authenticate/authz/overview-0.svg
index 5e63bdb97..ad2842497 100644
--- a/public/d2/docs/authenticate/authz/overview-0.svg
+++ b/public/d2/docs/authenticate/authz/overview-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1018 756"><svg class="d2-2731439904 d2-svg" width="1018" height="756" viewBox="-89 -49 1018 756"><rect x="-89.000000" y="-49.000000" width="1018.000000" height="756.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1018 756"><svg class="d2-2731439904 d2-svg" width="1018" height="756" viewBox="-89 -49 1018 756"><rect x="-89.000000" y="-49.000000" width="1018.000000" height="756.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-2731439904 .text {
 	font-family: "d2-2731439904-font-regular";
 }
diff --git a/public/d2/docs/authenticate/fsa/multiapp/native-app-0.svg b/public/d2/docs/authenticate/fsa/multiapp/native-app-0.svg
index ec0140f0a..f2803b58e 100644
--- a/public/d2/docs/authenticate/fsa/multiapp/native-app-0.svg
+++ b/public/d2/docs/authenticate/fsa/multiapp/native-app-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1116 893"><svg class="d2-1739929130 d2-svg" width="1116" height="893" viewBox="6 46 1116 893"><rect x="6.000000" y="46.000000" width="1116.000000" height="893.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1116 893"><svg class="d2-1739929130 d2-svg" width="1116" height="893" viewBox="6 46 1116 893"><rect x="6.000000" y="46.000000" width="1116.000000" height="893.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-1739929130 .text {
 	font-family: "d2-1739929130-font-regular";
 }
diff --git a/public/d2/docs/authenticate/fsa/multiapp/overview-0.svg b/public/d2/docs/authenticate/fsa/multiapp/overview-0.svg
index 4a999090f..ade1879ce 100644
--- a/public/d2/docs/authenticate/fsa/multiapp/overview-0.svg
+++ b/public/d2/docs/authenticate/fsa/multiapp/overview-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 809 1102"><svg class="d2-4117629434 d2-svg" width="809" height="1102" viewBox="-39 1 809 1102"><rect x="-39.000000" y="1.000000" width="809.000000" height="1102.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 809 1102"><svg class="d2-4117629434 d2-svg" width="809" height="1102" viewBox="-39 1 809 1102"><rect x="-39.000000" y="1.000000" width="809.000000" height="1102.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-4117629434 .text {
 	font-family: "d2-4117629434-font-regular";
 }
diff --git a/public/d2/docs/authenticate/fsa/multiapp/single-page-app-0.svg b/public/d2/docs/authenticate/fsa/multiapp/single-page-app-0.svg
index 772a470dc..85590d28e 100644
--- a/public/d2/docs/authenticate/fsa/multiapp/single-page-app-0.svg
+++ b/public/d2/docs/authenticate/fsa/multiapp/single-page-app-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 725 729"><svg class="d2-3420415704 d2-svg" width="725" height="729" viewBox="6 46 725 729"><rect x="6.000000" y="46.000000" width="725.000000" height="729.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 725 729"><svg class="d2-3420415704 d2-svg" width="725" height="729" viewBox="6 46 725 729"><rect x="6.000000" y="46.000000" width="725.000000" height="729.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-3420415704 .text {
 	font-family: "d2-3420415704-font-regular";
 }
diff --git a/public/d2/docs/authenticate/fsa/multiapp/web-app-0.svg b/public/d2/docs/authenticate/fsa/multiapp/web-app-0.svg
index fad8b8255..4da52e80b 100644
--- a/public/d2/docs/authenticate/fsa/multiapp/web-app-0.svg
+++ b/public/d2/docs/authenticate/fsa/multiapp/web-app-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1004 768"><svg class="d2-2402663622 d2-svg" width="1004" height="768" viewBox="6 46 1004 768"><rect x="6.000000" y="46.000000" width="1004.000000" height="768.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1004 768"><svg class="d2-2402663622 d2-svg" width="1004" height="768" viewBox="6 46 1004 768"><rect x="6.000000" y="46.000000" width="1004.000000" height="768.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-2402663622 .text {
 	font-family: "d2-2402663622-font-regular";
 }
diff --git a/public/d2/docs/authenticate/implement-workflows/implement-webhooks-0.svg b/public/d2/docs/authenticate/implement-workflows/implement-webhooks-0.svg
index 61aa3a3b4..daa170444 100644
--- a/public/d2/docs/authenticate/implement-workflows/implement-webhooks-0.svg
+++ b/public/d2/docs/authenticate/implement-workflows/implement-webhooks-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1179 728"><svg class="d2-1015148135 d2-svg" width="1179" height="728" viewBox="6 46 1179 728"><rect x="6.000000" y="46.000000" width="1179.000000" height="728.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1179 728"><svg class="d2-1015148135 d2-svg" width="1179" height="728" viewBox="6 46 1179 728"><rect x="6.000000" y="46.000000" width="1179.000000" height="728.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-1015148135 .text {
 	font-family: "d2-1015148135-font-regular";
 }
diff --git a/public/d2/docs/authenticate/interceptors/auth-flow-interceptors-0.svg b/public/d2/docs/authenticate/interceptors/auth-flow-interceptors-0.svg
index 978caf3fd..96ad91597 100644
--- a/public/d2/docs/authenticate/interceptors/auth-flow-interceptors-0.svg
+++ b/public/d2/docs/authenticate/interceptors/auth-flow-interceptors-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 775 869"><svg class="d2-3679974861 d2-svg" width="775" height="869" viewBox="-39 -44 775 869"><rect x="-39.000000" y="-44.000000" width="775.000000" height="869.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 775 869"><svg class="d2-3679974861 d2-svg" width="775" height="869" viewBox="-39 -44 775 869"><rect x="-39.000000" y="-44.000000" width="775.000000" height="869.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-3679974861 .text {
 	font-family: "d2-3679974861-font-regular";
 }
diff --git a/public/d2/docs/authenticate/m2m/api-auth-quickstart-0.svg b/public/d2/docs/authenticate/m2m/api-auth-quickstart-0.svg
index a4546efb2..f451b1044 100644
--- a/public/d2/docs/authenticate/m2m/api-auth-quickstart-0.svg
+++ b/public/d2/docs/authenticate/m2m/api-auth-quickstart-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 998 938"><svg class="d2-3957606344 d2-svg" width="998" height="938" viewBox="6 46 998 938"><rect x="6.000000" y="46.000000" width="998.000000" height="938.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 998 938"><svg class="d2-3957606344 d2-svg" width="998" height="938" viewBox="6 46 998 938"><rect x="6.000000" y="46.000000" width="998.000000" height="938.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-3957606344 .text {
 	font-family: "d2-3957606344-font-regular";
 }
diff --git a/public/d2/docs/authenticate/m2m/api-keys-0.svg b/public/d2/docs/authenticate/m2m/api-keys-0.svg
index e538bd561..82880230f 100644
--- a/public/d2/docs/authenticate/m2m/api-keys-0.svg
+++ b/public/d2/docs/authenticate/m2m/api-keys-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1091 1125"><svg class="d2-4063762114 d2-svg" width="1091" height="1125" viewBox="-25 15 1091 1125"><rect x="-25.000000" y="15.000000" width="1091.000000" height="1125.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1091 1125"><svg class="d2-4063762114 d2-svg" width="1091" height="1125" viewBox="-25 15 1091 1125"><rect x="-25.000000" y="15.000000" width="1091.000000" height="1125.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-4063762114 .text {
 	font-family: "d2-4063762114-font-regular";
 }
diff --git a/public/d2/docs/authenticate/manage-users-orgs/custom-user-attributes-0.svg b/public/d2/docs/authenticate/manage-users-orgs/custom-user-attributes-0.svg
index 934acba56..ab02c7677 100644
--- a/public/d2/docs/authenticate/manage-users-orgs/custom-user-attributes-0.svg
+++ b/public/d2/docs/authenticate/manage-users-orgs/custom-user-attributes-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1470 294"><svg class="d2-714804903 d2-svg" width="1470" height="294" viewBox="6 6 1470 294"><rect x="6.000000" y="6.000000" width="1470.000000" height="294.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1470 294"><svg class="d2-714804903 d2-svg" width="1470" height="294" viewBox="6 6 1470 294"><rect x="6.000000" y="6.000000" width="1470.000000" height="294.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-714804903 .text {
 	font-family: "d2-714804903-font-regular";
 }
diff --git a/public/d2/docs/authenticate/manage-users-orgs/email-domain-rules-0.svg b/public/d2/docs/authenticate/manage-users-orgs/email-domain-rules-0.svg
index c43c13b5c..47aad082f 100644
--- a/public/d2/docs/authenticate/manage-users-orgs/email-domain-rules-0.svg
+++ b/public/d2/docs/authenticate/manage-users-orgs/email-domain-rules-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 977 264"><svg class="d2-2165779540 d2-svg" width="977" height="264" viewBox="6 6 977 264"><rect x="6.000000" y="6.000000" width="977.000000" height="264.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 977 264"><svg class="d2-2165779540 d2-svg" width="977" height="264" viewBox="6 6 977 264"><rect x="6.000000" y="6.000000" width="977.000000" height="264.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-2165779540 .text {
 	font-family: "d2-2165779540-font-regular";
 }
diff --git a/public/d2/docs/authenticate/manage-users-orgs/email-domain-rules-1.svg b/public/d2/docs/authenticate/manage-users-orgs/email-domain-rules-1.svg
index 42c91e01e..ab42fcd0a 100644
--- a/public/d2/docs/authenticate/manage-users-orgs/email-domain-rules-1.svg
+++ b/public/d2/docs/authenticate/manage-users-orgs/email-domain-rules-1.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1228 78"><svg class="d2-2353834396 d2-svg" width="1228" height="78" viewBox="6 6 1228 78"><rect x="6.000000" y="6.000000" width="1228.000000" height="78.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1228 78"><svg class="d2-2353834396 d2-svg" width="1228" height="78" viewBox="6 6 1228 78"><rect x="6.000000" y="6.000000" width="1228.000000" height="78.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-2353834396 .text-bold {
 	font-family: "d2-2353834396-font-bold";
 }
diff --git a/public/d2/docs/authenticate/manage-users-orgs/hosted-widgets-0.svg b/public/d2/docs/authenticate/manage-users-orgs/hosted-widgets-0.svg
index e464d93de..72a7a14ff 100644
--- a/public/d2/docs/authenticate/manage-users-orgs/hosted-widgets-0.svg
+++ b/public/d2/docs/authenticate/manage-users-orgs/hosted-widgets-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1214 663"><svg class="d2-3457984671 d2-svg" width="1214" height="663" viewBox="-45 -45 1214 663"><rect x="-45.000000" y="-45.000000" width="1214.000000" height="663.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1214 663"><svg class="d2-3457984671 d2-svg" width="1214" height="663" viewBox="-45 -45 1214 663"><rect x="-45.000000" y="-45.000000" width="1214.000000" height="663.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-3457984671 .text-bold {
 	font-family: "d2-3457984671-font-bold";
 }
diff --git a/public/d2/docs/authenticate/manage-users-orgs/jit-provisioning-0.svg b/public/d2/docs/authenticate/manage-users-orgs/jit-provisioning-0.svg
index 83c0e815d..9ab5ecf38 100644
--- a/public/d2/docs/authenticate/manage-users-orgs/jit-provisioning-0.svg
+++ b/public/d2/docs/authenticate/manage-users-orgs/jit-provisioning-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 989 1308"><svg class="d2-4268157952 d2-svg" width="989" height="1308" viewBox="-39 -44 989 1308"><rect x="-39.000000" y="-44.000000" width="989.000000" height="1308.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 989 1308"><svg class="d2-4268157952 d2-svg" width="989" height="1308" viewBox="-39 -44 989 1308"><rect x="-39.000000" y="-44.000000" width="989.000000" height="1308.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-4268157952 .text {
 	font-family: "d2-4268157952-font-regular";
 }
diff --git a/public/d2/docs/authenticate/manage-users-orgs/merge-identities-0.svg b/public/d2/docs/authenticate/manage-users-orgs/merge-identities-0.svg
index 46fedcc21..118270f86 100644
--- a/public/d2/docs/authenticate/manage-users-orgs/merge-identities-0.svg
+++ b/public/d2/docs/authenticate/manage-users-orgs/merge-identities-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1104 254"><svg class="d2-1249424845 d2-svg" width="1104" height="254" viewBox="-39 -39 1104 254"><rect x="-39.000000" y="-39.000000" width="1104.000000" height="254.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1104 254"><svg class="d2-1249424845 d2-svg" width="1104" height="254" viewBox="-39 -39 1104 254"><rect x="-39.000000" y="-39.000000" width="1104.000000" height="254.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-1249424845 .text-bold {
 	font-family: "d2-1249424845-font-bold";
 }
diff --git a/public/d2/docs/authenticate/manage-users-orgs/merge-identities-1.svg b/public/d2/docs/authenticate/manage-users-orgs/merge-identities-1.svg
index 131569e3d..415a0bb79 100644
--- a/public/d2/docs/authenticate/manage-users-orgs/merge-identities-1.svg
+++ b/public/d2/docs/authenticate/manage-users-orgs/merge-identities-1.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1059 254"><svg class="d2-168677495 d2-svg" width="1059" height="254" viewBox="-39 -39 1059 254"><rect x="-39.000000" y="-39.000000" width="1059.000000" height="254.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1059 254"><svg class="d2-168677495 d2-svg" width="1059" height="254" viewBox="-39 -39 1059 254"><rect x="-39.000000" y="-39.000000" width="1059.000000" height="254.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-168677495 .text-bold {
 	font-family: "d2-168677495-font-bold";
 }
diff --git a/public/d2/docs/authenticate/manage-users-orgs/scim-provisioning-0.svg b/public/d2/docs/authenticate/manage-users-orgs/scim-provisioning-0.svg
index a124d4333..6acfe5a66 100644
--- a/public/d2/docs/authenticate/manage-users-orgs/scim-provisioning-0.svg
+++ b/public/d2/docs/authenticate/manage-users-orgs/scim-provisioning-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1357 888"><svg class="d2-1235398151 d2-svg" width="1357" height="888" viewBox="-39 -44 1357 888"><rect x="-39.000000" y="-44.000000" width="1357.000000" height="888.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1357 888"><svg class="d2-1235398151 d2-svg" width="1357" height="888" viewBox="-39 -44 1357 888"><rect x="-39.000000" y="-44.000000" width="1357.000000" height="888.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-1235398151 .text {
 	font-family: "d2-1235398151-font-regular";
 }
diff --git a/public/d2/docs/authenticate/mcp/auth-patterns-0.svg b/public/d2/docs/authenticate/mcp/auth-patterns-0.svg
index cee3cccac..f4057c8de 100644
--- a/public/d2/docs/authenticate/mcp/auth-patterns-0.svg
+++ b/public/d2/docs/authenticate/mcp/auth-patterns-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1075 898"><svg class="d2-2698783647 d2-svg" width="1075" height="898" viewBox="-25 -28 1075 898"><rect x="-25.000000" y="-28.000000" width="1075.000000" height="898.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1075 898"><svg class="d2-2698783647 d2-svg" width="1075" height="898" viewBox="-25 -28 1075 898"><rect x="-25.000000" y="-28.000000" width="1075.000000" height="898.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-2698783647 .text {
 	font-family: "d2-2698783647-font-regular";
 }
diff --git a/public/d2/docs/authenticate/mcp/auth-patterns-1.svg b/public/d2/docs/authenticate/mcp/auth-patterns-1.svg
index 0ddfc5d9b..b662daf0d 100644
--- a/public/d2/docs/authenticate/mcp/auth-patterns-1.svg
+++ b/public/d2/docs/authenticate/mcp/auth-patterns-1.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 949 603"><svg class="d2-936720068 d2-svg" width="949" height="603" viewBox="-25 -28 949 603"><rect x="-25.000000" y="-28.000000" width="949.000000" height="603.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 949 603"><svg class="d2-936720068 d2-svg" width="949" height="603" viewBox="-25 -28 949 603"><rect x="-25.000000" y="-28.000000" width="949.000000" height="603.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-936720068 .text {
 	font-family: "d2-936720068-font-regular";
 }
diff --git a/public/d2/docs/authenticate/mcp/auth-patterns-2.svg b/public/d2/docs/authenticate/mcp/auth-patterns-2.svg
index 134fff3b1..bf52a6a22 100644
--- a/public/d2/docs/authenticate/mcp/auth-patterns-2.svg
+++ b/public/d2/docs/authenticate/mcp/auth-patterns-2.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 925 603"><svg class="d2-3496481380 d2-svg" width="925" height="603" viewBox="-25 -28 925 603"><rect x="-25.000000" y="-28.000000" width="925.000000" height="603.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 925 603"><svg class="d2-3496481380 d2-svg" width="925" height="603" viewBox="-25 -28 925 603"><rect x="-25.000000" y="-28.000000" width="925.000000" height="603.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-3496481380 .text {
 	font-family: "d2-3496481380-font-regular";
 }
diff --git a/public/d2/docs/authenticate/mcp/auth-patterns-3.svg b/public/d2/docs/authenticate/mcp/auth-patterns-3.svg
index 1f107f33a..4df38082e 100644
--- a/public/d2/docs/authenticate/mcp/auth-patterns-3.svg
+++ b/public/d2/docs/authenticate/mcp/auth-patterns-3.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1050 603"><svg class="d2-750889606 d2-svg" width="1050" height="603" viewBox="-25 -28 1050 603"><rect x="-25.000000" y="-28.000000" width="1050.000000" height="603.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1050 603"><svg class="d2-750889606 d2-svg" width="1050" height="603" viewBox="-25 -28 1050 603"><rect x="-25.000000" y="-28.000000" width="1050.000000" height="603.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-750889606 .text {
 	font-family: "d2-750889606-font-regular";
 }
diff --git a/public/d2/docs/authenticate/mcp/auth-patterns-4.svg b/public/d2/docs/authenticate/mcp/auth-patterns-4.svg
index ae820e770..673c21938 100644
--- a/public/d2/docs/authenticate/mcp/auth-patterns-4.svg
+++ b/public/d2/docs/authenticate/mcp/auth-patterns-4.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1010 718"><svg class="d2-3445741799 d2-svg" width="1010" height="718" viewBox="-25 -28 1010 718"><rect x="-25.000000" y="-28.000000" width="1010.000000" height="718.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1010 718"><svg class="d2-3445741799 d2-svg" width="1010" height="718" viewBox="-25 -28 1010 718"><rect x="-25.000000" y="-28.000000" width="1010.000000" height="718.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-3445741799 .text {
 	font-family: "d2-3445741799-font-regular";
 }
diff --git a/public/d2/docs/authenticate/mcp/custom-auth-0.svg b/public/d2/docs/authenticate/mcp/custom-auth-0.svg
index b5347fe1b..a431a0f2f 100644
--- a/public/d2/docs/authenticate/mcp/custom-auth-0.svg
+++ b/public/d2/docs/authenticate/mcp/custom-auth-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1187 942"><svg class="d2-1589944796 d2-svg" width="1187" height="942" viewBox="-39 1 1187 942"><rect x="-39.000000" y="1.000000" width="1187.000000" height="942.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1187 942"><svg class="d2-1589944796 d2-svg" width="1187" height="942" viewBox="-39 1 1187 942"><rect x="-39.000000" y="1.000000" width="1187.000000" height="942.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-1589944796 .text {
 	font-family: "d2-1589944796-font-regular";
 }
diff --git a/public/d2/docs/authenticate/mcp/expressjs-quickstart-0.svg b/public/d2/docs/authenticate/mcp/expressjs-quickstart-0.svg
index 13743bafd..777568b55 100644
--- a/public/d2/docs/authenticate/mcp/expressjs-quickstart-0.svg
+++ b/public/d2/docs/authenticate/mcp/expressjs-quickstart-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 969 898"><svg class="d2-3824166842 d2-svg" width="969" height="898" viewBox="-25 -28 969 898"><rect x="-25.000000" y="-28.000000" width="969.000000" height="898.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 969 898"><svg class="d2-3824166842 d2-svg" width="969" height="898" viewBox="-25 -28 969 898"><rect x="-25.000000" y="-28.000000" width="969.000000" height="898.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-3824166842 .text {
 	font-family: "d2-3824166842-font-regular";
 }
diff --git a/public/d2/docs/authenticate/mcp/fastapi-fastmcp-quickstart-0.svg b/public/d2/docs/authenticate/mcp/fastapi-fastmcp-quickstart-0.svg
index 73737849e..0a8377a48 100644
--- a/public/d2/docs/authenticate/mcp/fastapi-fastmcp-quickstart-0.svg
+++ b/public/d2/docs/authenticate/mcp/fastapi-fastmcp-quickstart-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 971 898"><svg class="d2-1612076696 d2-svg" width="971" height="898" viewBox="-25 -28 971 898"><rect x="-25.000000" y="-28.000000" width="971.000000" height="898.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 971 898"><svg class="d2-1612076696 d2-svg" width="971" height="898" viewBox="-25 -28 971 898"><rect x="-25.000000" y="-28.000000" width="971.000000" height="898.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-1612076696 .text {
 	font-family: "d2-1612076696-font-regular";
 }
diff --git a/public/d2/docs/authenticate/mcp/fastmcp-quickstart-0.svg b/public/d2/docs/authenticate/mcp/fastmcp-quickstart-0.svg
index b6fc59f26..e8cc149c4 100644
--- a/public/d2/docs/authenticate/mcp/fastmcp-quickstart-0.svg
+++ b/public/d2/docs/authenticate/mcp/fastmcp-quickstart-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 863 783"><svg class="d2-9662996 d2-svg" width="863" height="783" viewBox="-25 -28 863 783"><rect x="-25.000000" y="-28.000000" width="863.000000" height="783.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 863 783"><svg class="d2-9662996 d2-svg" width="863" height="783" viewBox="-25 -28 863 783"><rect x="-25.000000" y="-28.000000" width="863.000000" height="783.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-9662996 .text {
 	font-family: "d2-9662996-font-regular";
 }
diff --git a/public/d2/docs/authenticate/mcp/intro-to-mcp-auth-0.svg b/public/d2/docs/authenticate/mcp/intro-to-mcp-auth-0.svg
index f23adc966..c64af80b5 100644
--- a/public/d2/docs/authenticate/mcp/intro-to-mcp-auth-0.svg
+++ b/public/d2/docs/authenticate/mcp/intro-to-mcp-auth-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1331 529"><svg class="d2-334686556 d2-svg" width="1331" height="529" viewBox="6 6 1331 529"><rect x="6.000000" y="6.000000" width="1331.000000" height="529.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1331 529"><svg class="d2-334686556 d2-svg" width="1331" height="529" viewBox="6 6 1331 529"><rect x="6.000000" y="6.000000" width="1331.000000" height="529.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-334686556 .text {
 	font-family: "d2-334686556-font-regular";
 }
diff --git a/public/d2/docs/authenticate/mcp/intro-to-mcp-auth-1.svg b/public/d2/docs/authenticate/mcp/intro-to-mcp-auth-1.svg
index 20f38cb46..6e4354b0a 100644
--- a/public/d2/docs/authenticate/mcp/intro-to-mcp-auth-1.svg
+++ b/public/d2/docs/authenticate/mcp/intro-to-mcp-auth-1.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 941 1048"><svg class="d2-2281946784 d2-svg" width="941" height="1048" viewBox="1 41 941 1048"><rect x="1.000000" y="41.000000" width="941.000000" height="1048.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 941 1048"><svg class="d2-2281946784 d2-svg" width="941" height="1048" viewBox="1 41 941 1048"><rect x="1.000000" y="41.000000" width="941.000000" height="1048.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-2281946784 .text {
 	font-family: "d2-2281946784-font-regular";
 }
diff --git a/public/d2/docs/authenticate/mcp/intro-to-mcp-auth-2.svg b/public/d2/docs/authenticate/mcp/intro-to-mcp-auth-2.svg
index 4c7e22d69..6cfee0757 100644
--- a/public/d2/docs/authenticate/mcp/intro-to-mcp-auth-2.svg
+++ b/public/d2/docs/authenticate/mcp/intro-to-mcp-auth-2.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1300 2462"><svg class="d2-196554157 d2-svg" width="1300" height="2462" viewBox="1 41 1300 2462"><rect x="1.000000" y="41.000000" width="1300.000000" height="2462.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1300 2462"><svg class="d2-196554157 d2-svg" width="1300" height="2462" viewBox="1 41 1300 2462"><rect x="1.000000" y="41.000000" width="1300.000000" height="2462.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-196554157 .text {
 	font-family: "d2-196554157-font-regular";
 }
diff --git a/public/d2/docs/authenticate/mcp/overview-0.svg b/public/d2/docs/authenticate/mcp/overview-0.svg
index 70800dfe6..81d33efa6 100644
--- a/public/d2/docs/authenticate/mcp/overview-0.svg
+++ b/public/d2/docs/authenticate/mcp/overview-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1194 847"><svg class="d2-3568705100 d2-svg" width="1194" height="847" viewBox="-25 -28 1194 847"><rect x="-25.000000" y="-28.000000" width="1194.000000" height="847.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1194 847"><svg class="d2-3568705100 d2-svg" width="1194" height="847" viewBox="-25 -28 1194 847"><rect x="-25.000000" y="-28.000000" width="1194.000000" height="847.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-3568705100 .text {
 	font-family: "d2-3568705100-font-regular";
 }
diff --git a/public/d2/docs/authenticate/mcp/overview-1.svg b/public/d2/docs/authenticate/mcp/overview-1.svg
index b7d70dbf8..62b0b2ac5 100644
--- a/public/d2/docs/authenticate/mcp/overview-1.svg
+++ b/public/d2/docs/authenticate/mcp/overview-1.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1056 963"><svg class="d2-1034877362 d2-svg" width="1056" height="963" viewBox="-25 -28 1056 963"><rect x="-25.000000" y="-28.000000" width="1056.000000" height="963.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1056 963"><svg class="d2-1034877362 d2-svg" width="1056" height="963" viewBox="-25 -28 1056 963"><rect x="-25.000000" y="-28.000000" width="1056.000000" height="963.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-1034877362 .text {
 	font-family: "d2-1034877362-font-regular";
 }
diff --git a/public/d2/docs/authenticate/mcp/overview-2.svg b/public/d2/docs/authenticate/mcp/overview-2.svg
index a1331b6c8..64f66de96 100644
--- a/public/d2/docs/authenticate/mcp/overview-2.svg
+++ b/public/d2/docs/authenticate/mcp/overview-2.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1162 873"><svg class="d2-838244068 d2-svg" width="1162" height="873" viewBox="-25 -28 1162 873"><rect x="-25.000000" y="-28.000000" width="1162.000000" height="873.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1162 873"><svg class="d2-838244068 d2-svg" width="1162" height="873" viewBox="-25 -28 1162 873"><rect x="-25.000000" y="-28.000000" width="1162.000000" height="873.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-838244068 .text {
 	font-family: "d2-838244068-font-regular";
 }
diff --git a/public/d2/docs/authenticate/mcp/overview-3.svg b/public/d2/docs/authenticate/mcp/overview-3.svg
index 9649da92e..b5dd1bb79 100644
--- a/public/d2/docs/authenticate/mcp/overview-3.svg
+++ b/public/d2/docs/authenticate/mcp/overview-3.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 765 796"><svg class="d2-4249150969 d2-svg" width="765" height="796" viewBox="-25 -28 765 796"><rect x="-25.000000" y="-28.000000" width="765.000000" height="796.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 765 796"><svg class="d2-4249150969 d2-svg" width="765" height="796" viewBox="-25 -28 765 796"><rect x="-25.000000" y="-28.000000" width="765.000000" height="796.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-4249150969 .text {
 	font-family: "d2-4249150969-font-regular";
 }
diff --git a/public/d2/docs/authenticate/mcp/topologies/agent-mcp-0.svg b/public/d2/docs/authenticate/mcp/topologies/agent-mcp-0.svg
index 1aaddc656..a8e68da04 100644
--- a/public/d2/docs/authenticate/mcp/topologies/agent-mcp-0.svg
+++ b/public/d2/docs/authenticate/mcp/topologies/agent-mcp-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 949 603"><svg class="d2-2801401272 d2-svg" width="949" height="603" viewBox="-25 -28 949 603"><rect x="-25.000000" y="-28.000000" width="949.000000" height="603.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 949 603"><svg class="d2-2801401272 d2-svg" width="949" height="603" viewBox="-25 -28 949 603"><rect x="-25.000000" y="-28.000000" width="949.000000" height="603.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-2801401272 .text {
 	font-family: "d2-2801401272-font-regular";
 }
diff --git a/public/d2/docs/authenticate/mcp/topologies/human-mcp-0.svg b/public/d2/docs/authenticate/mcp/topologies/human-mcp-0.svg
index d65ba72e6..905d0907c 100644
--- a/public/d2/docs/authenticate/mcp/topologies/human-mcp-0.svg
+++ b/public/d2/docs/authenticate/mcp/topologies/human-mcp-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1075 898"><svg class="d2-3462843988 d2-svg" width="1075" height="898" viewBox="-25 -28 1075 898"><rect x="-25.000000" y="-28.000000" width="1075.000000" height="898.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1075 898"><svg class="d2-3462843988 d2-svg" width="1075" height="898" viewBox="-25 -28 1075 898"><rect x="-25.000000" y="-28.000000" width="1075.000000" height="898.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-3462843988 .text {
 	font-family: "d2-3462843988-font-regular";
 }
diff --git a/public/d2/docs/authenticate/mcp/topologies/mcp-api-0.svg b/public/d2/docs/authenticate/mcp/topologies/mcp-api-0.svg
index 987ec4349..3f70c83c9 100644
--- a/public/d2/docs/authenticate/mcp/topologies/mcp-api-0.svg
+++ b/public/d2/docs/authenticate/mcp/topologies/mcp-api-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 925 603"><svg class="d2-3791130405 d2-svg" width="925" height="603" viewBox="-25 -28 925 603"><rect x="-25.000000" y="-28.000000" width="925.000000" height="603.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 925 603"><svg class="d2-3791130405 d2-svg" width="925" height="603" viewBox="-25 -28 925 603"><rect x="-25.000000" y="-28.000000" width="925.000000" height="603.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-3791130405 .text {
 	font-family: "d2-3791130405-font-regular";
 }
diff --git a/public/d2/docs/authenticate/mcp/topologies/mcp-api-1.svg b/public/d2/docs/authenticate/mcp/topologies/mcp-api-1.svg
index 1aaddc656..a8e68da04 100644
--- a/public/d2/docs/authenticate/mcp/topologies/mcp-api-1.svg
+++ b/public/d2/docs/authenticate/mcp/topologies/mcp-api-1.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 949 603"><svg class="d2-2801401272 d2-svg" width="949" height="603" viewBox="-25 -28 949 603"><rect x="-25.000000" y="-28.000000" width="949.000000" height="603.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 949 603"><svg class="d2-2801401272 d2-svg" width="949" height="603" viewBox="-25 -28 949 603"><rect x="-25.000000" y="-28.000000" width="949.000000" height="603.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-2801401272 .text {
 	font-family: "d2-2801401272-font-regular";
 }
diff --git a/public/d2/docs/authenticate/mcp/topologies/mcp-api-2.svg b/public/d2/docs/authenticate/mcp/topologies/mcp-api-2.svg
index 5f8ebe7fe..0b0e9ca0a 100644
--- a/public/d2/docs/authenticate/mcp/topologies/mcp-api-2.svg
+++ b/public/d2/docs/authenticate/mcp/topologies/mcp-api-2.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 873 603"><svg class="d2-1527181093 d2-svg" width="873" height="603" viewBox="-25 -28 873 603"><rect x="-25.000000" y="-28.000000" width="873.000000" height="603.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 873 603"><svg class="d2-1527181093 d2-svg" width="873" height="603" viewBox="-25 -28 873 603"><rect x="-25.000000" y="-28.000000" width="873.000000" height="603.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-1527181093 .text {
 	font-family: "d2-1527181093-font-regular";
 }
diff --git a/public/d2/docs/cookbooks/render-github-pr-summarizer-0.svg b/public/d2/docs/cookbooks/render-github-pr-summarizer-0.svg
index e78b9ad52..867834d06 100644
--- a/public/d2/docs/cookbooks/render-github-pr-summarizer-0.svg
+++ b/public/d2/docs/cookbooks/render-github-pr-summarizer-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1151 788"><svg class="d2-3220425661 d2-svg" width="1151" height="788" viewBox="-13 -16 1151 788"><rect x="-13.000000" y="-16.000000" width="1151.000000" height="788.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1151 788"><svg class="d2-3220425661 d2-svg" width="1151" height="788" viewBox="-13 -16 1151 788"><rect x="-13.000000" y="-16.000000" width="1151.000000" height="788.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-3220425661 .text {
 	font-family: "d2-3220425661-font-regular";
 }
diff --git a/public/d2/docs/dev-kit/tools/use-scalekit-credentials-0.svg b/public/d2/docs/dev-kit/tools/use-scalekit-credentials-0.svg
index 256430d62..cb46e0dd0 100644
--- a/public/d2/docs/dev-kit/tools/use-scalekit-credentials-0.svg
+++ b/public/d2/docs/dev-kit/tools/use-scalekit-credentials-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 837 454"><svg class="d2-3674154264 d2-svg" width="837" height="454" viewBox="-89 -89 837 454"><rect x="-89.000000" y="-89.000000" width="837.000000" height="454.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 837 454"><svg class="d2-3674154264 d2-svg" width="837" height="454" viewBox="-89 -89 837 454"><rect x="-89.000000" y="-89.000000" width="837.000000" height="454.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-3674154264 .text {
 	font-family: "d2-3674154264-font-regular";
 }
diff --git a/public/d2/docs/directory/guides/group-based-role-assignment-0.svg b/public/d2/docs/directory/guides/group-based-role-assignment-0.svg
index 7c8bfbc2e..d42804d3b 100644
--- a/public/d2/docs/directory/guides/group-based-role-assignment-0.svg
+++ b/public/d2/docs/directory/guides/group-based-role-assignment-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 820 309"><svg class="d2-3995120553 d2-svg" width="820" height="309" viewBox="6 -39 820 309"><rect x="6.000000" y="-39.000000" width="820.000000" height="309.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 820 309"><svg class="d2-3995120553 d2-svg" width="820" height="309" viewBox="6 -39 820 309"><rect x="6.000000" y="-39.000000" width="820.000000" height="309.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-3995120553 .text {
 	font-family: "d2-3995120553-font-regular";
 }
diff --git a/public/d2/docs/directory/scim/quickstart-0.svg b/public/d2/docs/directory/scim/quickstart-0.svg
index 386825fe8..0709010f5 100644
--- a/public/d2/docs/directory/scim/quickstart-0.svg
+++ b/public/d2/docs/directory/scim/quickstart-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1083 905"><svg class="d2-3460092668 d2-svg" width="1083" height="905" viewBox="-39 -44 1083 905"><rect x="-39.000000" y="-44.000000" width="1083.000000" height="905.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1083 905"><svg class="d2-3460092668 d2-svg" width="1083" height="905" viewBox="-39 -44 1083 905"><rect x="-39.000000" y="-44.000000" width="1083.000000" height="905.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-3460092668 .text {
 	font-family: "d2-3460092668-font-regular";
 }
diff --git a/public/d2/docs/fsa/data-modelling-0.svg b/public/d2/docs/fsa/data-modelling-0.svg
index 9d7bab27a..c84fb82a9 100644
--- a/public/d2/docs/fsa/data-modelling-0.svg
+++ b/public/d2/docs/fsa/data-modelling-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1226 192"><svg class="d2-517514947 d2-svg" width="1226" height="192" viewBox="6 6 1226 192"><rect x="6.000000" y="6.000000" width="1226.000000" height="192.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1226 192"><svg class="d2-517514947 d2-svg" width="1226" height="192" viewBox="6 6 1226 192"><rect x="6.000000" y="6.000000" width="1226.000000" height="192.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-517514947 .text {
 	font-family: "d2-517514947-font-regular";
 }
diff --git a/public/d2/docs/fsa/guides/manage-users-0.svg b/public/d2/docs/fsa/guides/manage-users-0.svg
index 0f3e9eec9..8cb532d73 100644
--- a/public/d2/docs/fsa/guides/manage-users-0.svg
+++ b/public/d2/docs/fsa/guides/manage-users-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1370 896"><svg class="d2-2987198781 d2-svg" width="1370" height="896" viewBox="6 6 1370 896"><rect x="6.000000" y="6.000000" width="1370.000000" height="896.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1370 896"><svg class="d2-2987198781 d2-svg" width="1370" height="896" viewBox="6 6 1370 896"><rect x="6.000000" y="6.000000" width="1370.000000" height="896.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-2987198781 .text {
 	font-family: "d2-2987198781-font-regular";
 }
diff --git a/public/d2/docs/fsa/guides/user-invitations-0.svg b/public/d2/docs/fsa/guides/user-invitations-0.svg
index 32b89a709..497ef1425 100644
--- a/public/d2/docs/fsa/guides/user-invitations-0.svg
+++ b/public/d2/docs/fsa/guides/user-invitations-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1009 903"><svg class="d2-2494427014 d2-svg" width="1009" height="903" viewBox="1 41 1009 903"><rect x="1.000000" y="41.000000" width="1009.000000" height="903.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1009 903"><svg class="d2-2494427014 d2-svg" width="1009" height="903" viewBox="1 41 1009 903"><rect x="1.000000" y="41.000000" width="1009.000000" height="903.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-2494427014 .text {
 	font-family: "d2-2494427014-font-regular";
 }
diff --git a/public/d2/docs/guides/integrations/auth-systems/firebase-0.svg b/public/d2/docs/guides/integrations/auth-systems/firebase-0.svg
index c47b18cf3..a020df3f9 100644
--- a/public/d2/docs/guides/integrations/auth-systems/firebase-0.svg
+++ b/public/d2/docs/guides/integrations/auth-systems/firebase-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 835 178"><svg class="d2-3588982307 d2-svg" width="835" height="178" viewBox="6 6 835 178"><rect x="6.000000" y="6.000000" width="835.000000" height="178.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 835 178"><svg class="d2-3588982307 d2-svg" width="835" height="178" viewBox="6 6 835 178"><rect x="6.000000" y="6.000000" width="835.000000" height="178.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-3588982307 .text-bold {
 	font-family: "d2-3588982307-font-bold";
 }
diff --git a/public/d2/docs/guides/integrations/auth-systems/firebase-1.svg b/public/d2/docs/guides/integrations/auth-systems/firebase-1.svg
index 07cfdeb7a..e132cb677 100644
--- a/public/d2/docs/guides/integrations/auth-systems/firebase-1.svg
+++ b/public/d2/docs/guides/integrations/auth-systems/firebase-1.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 605 1710"><svg class="d2-1858207968 d2-svg" width="605" height="1710" viewBox="6 6 605 1710"><rect x="6.000000" y="6.000000" width="605.000000" height="1710.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 605 1710"><svg class="d2-1858207968 d2-svg" width="605" height="1710" viewBox="6 6 605 1710"><rect x="6.000000" y="6.000000" width="605.000000" height="1710.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-1858207968 .text-bold {
 	font-family: "d2-1858207968-font-bold";
 }
diff --git a/public/d2/docs/guides/sso/sso-migration-strategy-0.svg b/public/d2/docs/guides/sso/sso-migration-strategy-0.svg
index f7ba12c4e..cc2df0583 100644
--- a/public/d2/docs/guides/sso/sso-migration-strategy-0.svg
+++ b/public/d2/docs/guides/sso/sso-migration-strategy-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1127 204"><svg class="d2-3164363078 d2-svg" width="1127" height="204" viewBox="-6 -6 1127 204"><rect x="-6.000000" y="-6.000000" width="1127.000000" height="204.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1127 204"><svg class="d2-3164363078 d2-svg" width="1127" height="204" viewBox="-6 -6 1127 204"><rect x="-6.000000" y="-6.000000" width="1127.000000" height="204.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-3164363078 .text-bold {
 	font-family: "d2-3164363078-font-bold";
 }
diff --git a/public/d2/docs/guides/sso/sso-migration-strategy-1.svg b/public/d2/docs/guides/sso/sso-migration-strategy-1.svg
index 08addd00e..8ed3bb6d5 100644
--- a/public/d2/docs/guides/sso/sso-migration-strategy-1.svg
+++ b/public/d2/docs/guides/sso/sso-migration-strategy-1.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1354 1384"><svg class="d2-340422961 d2-svg" width="1354" height="1384" viewBox="6 21 1354 1384"><rect x="6.000000" y="21.000000" width="1354.000000" height="1384.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1354 1384"><svg class="d2-340422961 d2-svg" width="1354" height="1384" viewBox="6 21 1354 1384"><rect x="6.000000" y="21.000000" width="1354.000000" height="1384.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-340422961 .text {
 	font-family: "d2-340422961-font-regular";
 }
diff --git a/public/d2/docs/mcp/auth-methods/custom-auth-0.svg b/public/d2/docs/mcp/auth-methods/custom-auth-0.svg
index 300543153..7f7669aed 100644
--- a/public/d2/docs/mcp/auth-methods/custom-auth-0.svg
+++ b/public/d2/docs/mcp/auth-methods/custom-auth-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1254 783"><svg class="d2-1470251190 d2-svg" width="1254" height="783" viewBox="-25 -28 1254 783"><rect x="-25.000000" y="-28.000000" width="1254.000000" height="783.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1254 783"><svg class="d2-1470251190 d2-svg" width="1254" height="783" viewBox="-25 -28 1254 783"><rect x="-25.000000" y="-28.000000" width="1254.000000" height="783.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-1470251190 .text {
 	font-family: "d2-1470251190-font-regular";
 }
diff --git a/public/d2/docs/mcp/auth-methods/enterprise-0.svg b/public/d2/docs/mcp/auth-methods/enterprise-0.svg
index 979e48c9d..c6fa068c3 100644
--- a/public/d2/docs/mcp/auth-methods/enterprise-0.svg
+++ b/public/d2/docs/mcp/auth-methods/enterprise-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1323 979"><svg class="d2-2813722037 d2-svg" width="1323" height="979" viewBox="-25 -28 1323 979"><rect x="-25.000000" y="-28.000000" width="1323.000000" height="979.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1323 979"><svg class="d2-2813722037 d2-svg" width="1323" height="979" viewBox="-25 -28 1323 979"><rect x="-25.000000" y="-28.000000" width="1323.000000" height="979.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-2813722037 .text {
 	font-family: "d2-2813722037-font-regular";
 }
diff --git a/public/d2/docs/passwordless/oidc-0.svg b/public/d2/docs/passwordless/oidc-0.svg
index f0ebca460..9507ecb07 100644
--- a/public/d2/docs/passwordless/oidc-0.svg
+++ b/public/d2/docs/passwordless/oidc-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 757 588"><svg class="d2-4038666779 d2-svg" width="757" height="588" viewBox="6 46 757 588"><rect x="6.000000" y="46.000000" width="757.000000" height="588.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 757 588"><svg class="d2-4038666779 d2-svg" width="757" height="588" viewBox="6 46 757 588"><rect x="6.000000" y="46.000000" width="757.000000" height="588.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-4038666779 .text {
 	font-family: "d2-4038666779-font-regular";
 }
diff --git a/public/d2/docs/sso/guides/idp-init-sso-0.svg b/public/d2/docs/sso/guides/idp-init-sso-0.svg
index 9af69fcf6..5b1adf59c 100644
--- a/public/d2/docs/sso/guides/idp-init-sso-0.svg
+++ b/public/d2/docs/sso/guides/idp-init-sso-0.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1094 1237"><svg class="d2-2212070255 d2-svg" width="1094" height="1237" viewBox="-39 -44 1094 1237"><rect x="-39.000000" y="-44.000000" width="1094.000000" height="1237.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1094 1237"><svg class="d2-2212070255 d2-svg" width="1094" height="1237" viewBox="-39 -44 1094 1237"><rect x="-39.000000" y="-44.000000" width="1094.000000" height="1237.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-2212070255 .text {
 	font-family: "d2-2212070255-font-regular";
 }
diff --git a/public/d2/docs/sso/guides/idp-init-sso-1.svg b/public/d2/docs/sso/guides/idp-init-sso-1.svg
index 2bd8c7312..f25538691 100644
--- a/public/d2/docs/sso/guides/idp-init-sso-1.svg
+++ b/public/d2/docs/sso/guides/idp-init-sso-1.svg
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1160 1173"><svg class="d2-1804753530 d2-svg" width="1160" height="1173" viewBox="-39 -44 1160 1173"><rect x="-39.000000" y="-44.000000" width="1160.000000" height="1173.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
+<?xml version="1.0" encoding="utf-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" data-d2-version="v0.7.1" preserveAspectRatio="xMinYMin meet" viewBox="0 0 1160 1173"><svg class="d2-1804753530 d2-svg" width="1160" height="1173" viewBox="-39 -44 1160 1173"><rect x="-39.000000" y="-44.000000" width="1160.000000" height="1173.000000" rx="0.000000" class=" fill-N7" stroke-width="0" /><style type="text/css"><![CDATA[
 .d2-1804753530 .text {
 	font-family: "d2-1804753530-font-regular";
 }
diff --git a/scripts/install-d2.sh b/scripts/install-d2.sh
index bcf366ab6..4c70db44c 100755
--- a/scripts/install-d2.sh
+++ b/scripts/install-d2.sh
@@ -32,7 +32,7 @@ esac
 # Map OS names
 case "$OS" in
   Darwin)
-    OS="darwin"
+    OS="macos"
     ;;
   Linux)
     OS="linux"
diff --git a/scripts/setup-git-hooks.js b/scripts/setup-git-hooks.js
index 79c87f8db..07beacb03 100644
--- a/scripts/setup-git-hooks.js
+++ b/scripts/setup-git-hooks.js
@@ -39,7 +39,7 @@ try {
   }
 
   // Install hooks using simple-git-hooks
-  execSync('npx simple-git-hooks', { stdio: 'ignore' })
+  execSync('pnpm exec simple-git-hooks', { stdio: 'ignore' })
 
   // Verify hooks are installed
   const hooksDir = '.git/hooks'
diff --git a/src/assets/docs/self-hosted/portal-app-config.png b/src/assets/docs/self-hosted/portal-app-config.png
new file mode 100644
index 000000000..bd0f29834
Binary files /dev/null and b/src/assets/docs/self-hosted/portal-app-config.png differ
diff --git a/src/assets/docs/self-hosted/portal-deploy-success.png b/src/assets/docs/self-hosted/portal-deploy-success.png
new file mode 100644
index 000000000..e10d76718
Binary files /dev/null and b/src/assets/docs/self-hosted/portal-deploy-success.png differ
diff --git a/src/assets/docs/self-hosted/portal-deployment-config.png b/src/assets/docs/self-hosted/portal-deployment-config.png
new file mode 100644
index 000000000..03e4909c8
Binary files /dev/null and b/src/assets/docs/self-hosted/portal-deployment-config.png differ
diff --git a/src/assets/docs/self-hosted/portal-deployments.png b/src/assets/docs/self-hosted/portal-deployments.png
new file mode 100644
index 000000000..33c4f6d7b
Binary files /dev/null and b/src/assets/docs/self-hosted/portal-deployments.png differ
diff --git a/src/assets/docs/self-hosted/portal-home.png b/src/assets/docs/self-hosted/portal-home.png
new file mode 100644
index 000000000..e41349e6a
Binary files /dev/null and b/src/assets/docs/self-hosted/portal-home.png differ
diff --git a/src/assets/docs/self-hosted/portal-login.png b/src/assets/docs/self-hosted/portal-login.png
new file mode 100644
index 000000000..664e9ad8d
Binary files /dev/null and b/src/assets/docs/self-hosted/portal-login.png differ
diff --git a/src/assets/docs/self-hosted/portal-new-deployment.png b/src/assets/docs/self-hosted/portal-new-deployment.png
new file mode 100644
index 000000000..6d0f48a9c
Binary files /dev/null and b/src/assets/docs/self-hosted/portal-new-deployment.png differ
diff --git a/src/assets/docs/self-hosted/portal-pat-created.png b/src/assets/docs/self-hosted/portal-pat-created.png
new file mode 100644
index 000000000..9cc3953b2
Binary files /dev/null and b/src/assets/docs/self-hosted/portal-pat-created.png differ
diff --git a/src/assets/docs/self-hosted/portal-pat-form.png b/src/assets/docs/self-hosted/portal-pat-form.png
new file mode 100644
index 000000000..9ba97e72d
Binary files /dev/null and b/src/assets/docs/self-hosted/portal-pat-form.png differ
diff --git a/src/assets/docs/self-hosted/portal-pat-list.png b/src/assets/docs/self-hosted/portal-pat-list.png
new file mode 100644
index 000000000..3c3280eab
Binary files /dev/null and b/src/assets/docs/self-hosted/portal-pat-list.png differ
diff --git a/src/assets/docs/self-hosted/portal-profile-icon.png b/src/assets/docs/self-hosted/portal-profile-icon.png
new file mode 100644
index 000000000..b6b0d91c2
Binary files /dev/null and b/src/assets/docs/self-hosted/portal-profile-icon.png differ
diff --git a/src/assets/docs/self-hosted/portal-profile-menu.png b/src/assets/docs/self-hosted/portal-profile-menu.png
new file mode 100644
index 000000000..889dfd2c7
Binary files /dev/null and b/src/assets/docs/self-hosted/portal-profile-menu.png differ
diff --git a/src/configs/secondary-nav.config.ts b/src/configs/secondary-nav.config.ts
index aec5d0401..838b707b1 100644
--- a/src/configs/secondary-nav.config.ts
+++ b/src/configs/secondary-nav.config.ts
@@ -15,6 +15,7 @@ import {
 import IconLucideHome from '~icons/lucide/home'
 import IconSolarLayersOutline from '~icons/solar/layers-outline'
 import IconLucideBookOpenText from '~icons/lucide/book-open-text'
+import IconLucideServer from '~icons/lucide/server'
 import IconLucideCheck from '~icons/lucide/check'
 
 export interface NavItem {
@@ -186,6 +187,41 @@ const saasKitItems: NavItem[] = [
       },
     ],
   },
+  {
+    id: 'api-reference',
+    href: '#sdks-apis',
+    label: 'SDKs & APIs',
+    iconComponent: IconMdiCubeOutline,
+    children: [
+      {
+        id: 'sdks',
+        href: '/sdks/',
+        label: 'SDKs',
+        iconComponent: IconSdk,
+        description: 'Ready-to-use libraries to implement auth in your app',
+      },
+      {
+        id: 'rest-apis',
+        href: '/apis/#description/overview',
+        label: 'REST APIs',
+        iconComponent: IconApi,
+        description: 'Programmatic control to manage users, orgs, sessions etc.',
+      },
+    ],
+  },
+  {
+    id: 'self-hosted',
+    href: '/self-hosted/overview/',
+    label: 'Self-hosted',
+    iconComponent: IconLucideServer,
+  },
+  // Temporarily hidden - Agent Auth
+  // {
+  //   id: 'agent-actions',
+  //   href: '/agent-actions/quickstart',
+  //   label: 'Agent Auth',
+  //   iconComponent: IconLucideBot,
+  // },
   sharedSdksItem,
 ]
 
diff --git a/src/configs/self-hosted.ts b/src/configs/self-hosted.ts
new file mode 100644
index 000000000..888acd83a
--- /dev/null
+++ b/src/configs/self-hosted.ts
@@ -0,0 +1,10 @@
+/**
+ * Self-hosted deployment URL constants.
+ * Update these values here when hostnames change — they propagate to all self-hosted docs.
+ */
+
+/** Container image registry hostname */
+export const REGISTRY_HOST = 'ar.scalekit.cloud'
+
+/** Scalekit distribution portal URL (Helm chart and registry token source) */
+export const DISTR_URL = 'https://repack.scalekit.cloud'
diff --git a/src/configs/sidebar.config.ts b/src/configs/sidebar.config.ts
index 08949e3a9..3afcc0ebe 100644
--- a/src/configs/sidebar.config.ts
+++ b/src/configs/sidebar.config.ts
@@ -469,6 +469,34 @@ export const sidebar = [
       },
     ],
   },
+  {
+    label: 'Self-hosted',
+    id: 'self-hosted',
+    link: '/self-hosted/overview/',
+    icon: 'server',
+    items: [
+      {
+        label: 'Getting started',
+        items: [
+          'self-hosted/overview',
+          'self-hosted/quickstart',
+          'self-hosted/system-requirements',
+        ],
+      },
+      {
+        label: 'Deploy',
+        items: [
+          'self-hosted/configuration',
+          'self-hosted/setup-script',
+          'self-hosted/installation',
+        ],
+      },
+      {
+        label: 'Maintain',
+        items: ['self-hosted/upgrades', 'self-hosted/troubleshooting'],
+      },
+    ],
+  },
   {
     label: 'SDKs & APIs',
     id: 'sdks',
@@ -579,6 +607,9 @@ export const topics = {
     '/**/*', // Catch-all: anything not matched above defaults here
   ],
 
+  // Self-hosted deployment
+  'self-hosted': ['/self-hosted/**/*'],
+
   // === Developer Kit (tools, code, SDKs, AI helpers) ===
   'dev-kit': [
     '/dev-kit/tools/**/*',
@@ -697,6 +728,9 @@ export const sidebarToSecondaryNav: Record<string, SecondaryNavMapping> = {
   // SDKs sidebar → 'SDKs' tab
   sdks: 'sdks',
 
+  // Self-hosted sidebar → 'Self-hosted' top-level nav item
+  'self-hosted': 'self-hosted',
+
   // Events reference sidebar → 'Webhooks' tab under API Reference
   'events-reference': 'webhooks-events',
 }
diff --git a/src/content/docs/self-hosted/configuration.mdx b/src/content/docs/self-hosted/configuration.mdx
new file mode 100644
index 000000000..f9714fb1e
--- /dev/null
+++ b/src/content/docs/self-hosted/configuration.mdx
@@ -0,0 +1,319 @@
+---
+title: Configure Scalekit
+description: Complete values.yaml examples and field reference for a self-hosted Scalekit deployment.
+sidebar:
+  label: Configuration
+  order: 3
+tags: [self-hosted, configuration, helm, values, kubernetes, gateway]
+tableOfContents: true
+prev:
+  label: System requirements
+  link: /self-hosted/system-requirements/
+next:
+  label: Setup script
+  link: /self-hosted/setup-script/
+---
+
+import { Tabs, TabItem, Aside } from '@astrojs/starlight/components'
+import { REGISTRY_HOST } from '../../../configs/self-hosted'
+
+Scalekit is configured through a `values.yaml` file. The [setup script](/self-hosted/setup-script/) generates this file for you — use the examples and field reference below to understand the structure or to make changes after initial setup.
+
+## Complete examples
+
+These examples show the full structure of a generated `values.yaml`. The setup script produces this file automatically — refer here when reviewing or modifying values after initial setup.
+
+<Tabs syncKey="config-mode">
+<TabItem label="Quick start (subcharts)">
+
+Use this configuration to get Scalekit running quickly without provisioning external PostgreSQL or Redis. Setting `secrets.create: true` lets the chart create all required Kubernetes secrets from values in this file — no `kubectl` secret commands needed.
+
+**Do not use this in production.** The bundled databases have no backups, no replication, and no persistent storage guarantees. See the [quick start guide](/self-hosted/quickstart/) for a step-by-step walkthrough.
+
+```yaml title="values.yaml (quick start)"
+scalekit:
+  config:
+    app:
+      domain: "<your-domain>"
+    seedData:
+      adminUser:
+        firstName: "<firstname>"
+        lastName: "<lastname>"
+        email: "<admin-email>"
+      emailServer:
+        settings:
+          fromEmail: "hi@<your-domain>"
+          fromName: "Team <Your Company>"
+          host: "<smtp-host>"
+          port: <smtp-port>
+          username: "<smtp-username>"
+
+postgresql:
+  enabled: true
+
+redis:
+  enabled: true
+
+secrets:
+  create: true
+  svix:
+    jwtSecret: "<jwt secret that signs your api token>"
+    apiToken: "<JWT signed with the above secret>"
+  registry:
+    password: "<registry access token>"
+
+gateway:
+  enabled: true
+  provider: "<provider>"           # gcp for GKE; other for all other clusters
+  className: "<gateway-class-name>"
+  annotations:
+    <annotation-key>: "<annotation-value>"
+  redirectToHttps: true
+  healthCheckPolicy:
+    enabled: true                  # GKE only
+```
+
+</TabItem>
+<TabItem label="Production (external services)">
+
+Use this configuration for production deployments with external PostgreSQL and Redis that you manage.
+
+```yaml title="values.yaml (production)"
+scalekit:
+  config:
+    app:
+      domain: "auth.example.com"    # your domain, without scheme or trailing slash
+      protocol: "https"
+      region: "us"                  # us or eu — set once, do not change after first install
+
+    database:
+      host: "pg.internal.example.com"
+      name: "scalekit"
+      user: "scalekit"
+      port: 5432
+      # Password is stored in the authentication-secret Kubernetes secret
+
+    redis:
+      host: "redis.internal.example.com"
+      port: 6379
+      db: 0
+      # Password is stored in the authentication-secret Kubernetes secret
+
+    seedData:
+      adminUser:
+        firstName: "Admin"
+        lastName: "User"
+        email: "admin@example.com"
+      emailServer:
+        serverType: "SMTP"
+        provider: "POSTMARK"        # POSTMARK, SENDGRID, or OTHER
+        enabled: true
+        settings:
+          fromEmail: "noreply@example.com"
+          fromName: "Your Company"
+          host: "smtp.postmarkapp.com"
+          port: 587
+          username: "your-smtp-api-key"
+
+# External services — disable subcharts
+postgresql:
+  enabled: false
+
+redis:
+  enabled: false
+
+gateway:
+  enabled: true
+  className: "gke-l7-global-external-managed"  # your GatewayClass
+  provider: "gcp"                              # gcp for GKE; other for all other clusters
+  redirectToHttps: true
+  healthCheckPolicy:
+    enabled: true                              # GKE only
+```
+
+</TabItem>
+</Tabs>
+
+---
+
+## Field reference
+
+### App
+
+```yaml
+scalekit:
+  config:
+    app:
+      domain: "auth.example.com"
+      protocol: "https"
+      region: "us"
+```
+
+| Field | Description |
+|-------|-------------|
+| `domain` | Base domain for your Scalekit instance. Must match your gateway hostname. |
+| `protocol` | Use `https` in production. For local HTTP dev, set to `http` and add `oidc.allow_insecure: true`. |
+| `region` | Data residency context. Set once — do not change after the initial install. |
+
+### Database
+
+```yaml
+scalekit:
+  config:
+    database:
+      host: "your-db-host"
+      name: "scalekit"
+      user: "scalekit"
+      port: 5432
+```
+
+When using external PostgreSQL (`postgresql.enabled: false`), the database password is injected via Kubernetes secret:
+
+- **`secrets.create: true`** — provide it under `secrets.database.password` in `values.yaml`; the chart creates the secret automatically
+- **`secrets.create: false`** — pre-create the `authentication-secret` with a `database_password` key using the setup script
+
+Omit this section entirely when using the bundled PostgreSQL subchart (`postgresql.enabled: true`).
+
+### Redis
+
+```yaml
+scalekit:
+  config:
+    redis:
+      host: "your-redis-host"
+      port: 6379
+      db: 0
+```
+
+When using external Redis (`redis.enabled: false`), the Redis password and DSN are injected via Kubernetes secret:
+
+- **`secrets.create: true`** — provide the DSN under `secrets.svix.redisDsn` in `values.yaml`; the chart creates the secret automatically
+- **`secrets.create: false`** — pre-create the `svix-secrets` with a `redis-dsn` key using the setup script
+
+Omit this section entirely when using the bundled Redis subchart (`redis.enabled: true`).
+
+### Seed data
+
+Seed data is applied once on first install. It creates the initial admin user and configures the email server.
+
+```yaml
+scalekit:
+  config:
+    seedData:
+      adminUser:
+        firstName: "Admin"
+        lastName: "User"
+        email: "admin@example.com"
+      emailServer:
+        serverType: "SMTP"
+        provider: "POSTMARK"      # POSTMARK, SENDGRID, or OTHER
+        enabled: true
+        settings:
+          fromEmail: "noreply@example.com"
+          fromName: "Your Company"
+          host: "smtp.postmarkapp.com"
+          port: 587
+          username: "your-smtp-api-key-or-username"
+```
+
+<Aside type="note" title="Email server password">
+  The SMTP password is not set here. Provide it via `secrets.smtp.password` in `values.yaml` when using `secrets.create: true`, or in the `authentication-secret` Kubernetes secret (`seed_data_email_server_settings_password` key) when using the setup script.
+</Aside>
+
+### Gateway
+
+Scalekit uses the Kubernetes Gateway API for ingress.
+
+```yaml
+gateway:
+  enabled: true
+  className: "gke-l7-global-external-managed"
+  provider: "gcp"
+  redirectToHttps: true
+  healthCheckPolicy:
+    enabled: true   # GKE only
+```
+
+Set `gateway.className` to the GatewayClass for your cluster:
+
+| Provider | GatewayClass |
+|----------|-------------|
+| GKE (external) | `gke-l7-global-external-managed` |
+| GKE (internal) | `gke-l7-regional-internal-managed` |
+| Istio | `istio` |
+| Envoy Gateway | `eg` |
+
+Set `provider: "gcp"` for GKE — it enables GKE-specific resources like `HealthCheckPolicy`. Set `provider: "other"` for all other clusters.
+
+## Gateway annotations
+
+Annotations on the Gateway resource are how you attach TLS certificates and configure provider-specific behavior. Add them under `gateway.annotations` in your `values.yaml`:
+
+```yaml
+gateway:
+  annotations:
+    <annotation-key>: "<annotation-value>"
+```
+
+Common annotations by provider:
+
+| Provider | Annotation | Purpose |
+|----------|-----------|---------|
+| GKE | `networking.gke.io/certmap` | Attach a GCP Certificate Manager cert map for TLS |
+| cert-manager (any cluster) | `cert-manager.io/cluster-issuer` | Provision TLS via cert-manager |
+| AWS (ALB) | `kubernetes.io/ingress.class` | Route through an ALB |
+
+### Example: GCP Certificate Manager
+
+```yaml
+gateway:
+  enabled: true
+  className: "gke-l7-global-external-managed"
+  provider: "gcp"
+  annotations:
+    networking.gke.io/certmap: "scalekit-cert-map"
+  redirectToHttps: true
+  healthCheckPolicy:
+    enabled: true
+```
+
+## Optional components
+
+### OpenFGA (fine-grained authorization)
+
+OpenFGA is disabled by default. Enable it when you need fine-grained authorization at scale:
+
+```yaml
+sidecars:
+  openfga:
+    enabled: true
+```
+
+OpenFGA requires its own PostgreSQL database (`openfga`). Credentials are stored in the `openfga-secrets` Kubernetes secret.
+
+### Directory server (SCIM)
+
+SCIM provisioning is disabled by default:
+
+```yaml
+scalekit:
+  config:
+    directoryServer:
+      enabled: true
+```
+
+## Secrets reference
+
+Scalekit uses Kubernetes secrets to inject all sensitive values into pods. There are two ways these secrets are created:
+
+- **`secrets.create: true`** (quick start) — the chart auto-creates all secrets from values you provide in `values.yaml` under the `secrets.*` block
+- **`secrets.create: false`** (full deployment) — you pre-create the secrets using the setup script
+
+| Secret name | Key fields | Created by |
+|-------------|------------|------------|
+| `authentication-service-token` | `TOKEN` — dashboard auth token | Chart or setup script |
+| `db-migrations` | `DATABASE_URL`, `DB_ADAPTER` | Chart or setup script |
+| `authentication-secret` | DB password, Redis password, OIDC keys, cookie keys, email keys, webhook API key | Chart or setup script |
+| `svix-secrets` | `db-dsn`, `jwt-secret`, `main-secret`, `redis-dsn`, `api-token` | Chart or setup script |
+| `artifact-registry-secret` | Docker registry credentials for <code>{REGISTRY_HOST}</code> | Chart or setup script |
+| `openfga-secrets` | `keys`, `uri` | Chart or setup script — only when `sidecars.openfga.enabled: true` |
diff --git a/src/content/docs/self-hosted/installation.mdx b/src/content/docs/self-hosted/installation.mdx
new file mode 100644
index 000000000..261d919a0
--- /dev/null
+++ b/src/content/docs/self-hosted/installation.mdx
@@ -0,0 +1,186 @@
+---
+title: Install Scalekit
+description: Deploy Scalekit on a Kubernetes cluster using Helm and the Gateway API.
+sidebar:
+  label: Installation
+  order: 6
+tags: [self-hosted, installation, kubernetes, helm, gateway]
+tableOfContents: true
+prev:
+  label: Setup script
+  link: /self-hosted/setup-script/
+next:
+  label: Upgrades & maintenance
+  link: /self-hosted/upgrades/
+---
+
+import { Steps, Aside, Code } from '@astrojs/starlight/components'
+import { REGISTRY_HOST, DISTR_URL } from '../../../configs/self-hosted'
+
+export const kubectlConnectCmd = `kubectl apply -n <namespace> -f "${DISTR_URL}/api/v1/connect?targetId=<targetId>&targetSecret=<targetSecret>"`
+
+Deploy Scalekit on any Kubernetes cluster using the Helm chart distributed through the <a href={DISTR_URL}>Scalekit distribution portal</a>. The chart uses the Kubernetes **Gateway API** for ingress.
+
+<Steps>
+1. ## Create a personal access token
+
+   Log in to the <a href={DISTR_URL}>Scalekit distribution portal</a>. This token authenticates your cluster to pull both the Helm chart and container images from <code>{REGISTRY_HOST}</code>.
+
+   ![Scalekit distribution portal login](@/assets/docs/self-hosted/portal-login.png)
+
+   After signing in you will see the portal home page.
+
+   ![Scalekit distribution portal home](@/assets/docs/self-hosted/portal-home.png)
+
+   Click the **profile icon** in the top-right corner.
+
+   ![Profile icon in the top-right corner](@/assets/docs/self-hosted/portal-profile-icon.png)
+
+   In the dropdown, select **Personal Access Tokens**.
+
+   ![Profile dropdown menu with Personal Access Tokens option](@/assets/docs/self-hosted/portal-profile-menu.png)
+
+   You will see the Personal Access Tokens page. Click **+ Create token**.
+
+   ![Personal Access Tokens page](@/assets/docs/self-hosted/portal-pat-list.png)
+
+   A form slides in. Enter a **Label** and set an **Expires At** date, then click **+ Create**.
+
+   ![Create a Personal Access Token form](@/assets/docs/self-hosted/portal-pat-form.png)
+
+   <Aside type="caution" title="Token expiry breaks image pulls">
+     When the token expires, your cluster can no longer pull images from <code>{REGISTRY_HOST}</code>. New deployments and upgrades will fail with `ImagePullBackOff`. Choose an expiry that gives you enough time to rotate before it lapses, and set a reminder to renew it.
+   </Aside>
+
+   Your token is displayed once. **Copy it immediately** — it cannot be retrieved after you leave this page.
+
+   ![Token displayed after creation — copy it now](@/assets/docs/self-hosted/portal-pat-created.png)
+
+2. ## Run the setup script
+
+   The [setup script](/self-hosted/setup-script/) collects your configuration interactively and generates two files: a secrets script and a `values.yaml`. Copy the script from that page, then run it:
+
+   ```bash
+   chmod +x setup-secrets.sh
+   bash setup-secrets.sh
+   ```
+
+   When prompted for environment, select the option that matches your target:
+
+   - `1` — Minikube (local, uses nginx ingress)
+   - `2` — GCP / GKE (configures GKE Gateway and NEG annotations)
+   - `3` — Other Kubernetes cluster (generic config, add your own ingress)
+   - `4` — Evaluation (bundled PostgreSQL and Redis; minimal setup)
+
+   The script walks you through namespace, PostgreSQL, Redis, SMTP, registry token, domain, and admin user settings. GKE-specific Gateway settings are only collected for option `2`.
+
+   When the script finishes, it prints the paths to two generated files. Before proceeding, open each file and verify the values are correct.
+
+   **`values-gke-<timestamp>.yaml`** — confirm:
+   - `app.domain` matches your intended domain
+   - `database.host`, `database.name`, and `database.user` point to the right PostgreSQL instance
+   - `redis.host` points to the right Redis instance
+   - `seedData.adminUser.email` is the address you want for the initial admin login
+   - `gateway.className` and `gateway.annotations` match your cluster's gateway configuration
+
+   **`scalekit-secrets-gke-<timestamp>.sh`** — confirm:
+   - The namespace at the top matches your intended namespace
+   - Database and Redis connection strings in `db-migrations` and `authentication-secret` are correct
+   - The registry token in `artifact-registry-secret` is the one you just created
+
+3. ## Apply the Kubernetes secrets
+
+   Run the secrets script the setup script generated:
+
+   ```bash
+   bash scalekit-secrets-gke-<timestamp>.sh
+   ```
+
+   Verify all secrets were created:
+
+   ```bash
+   kubectl get secrets -n <namespace>
+   ```
+
+   Expected secrets: `authentication-service-token`, `db-migrations`, `authentication-secret`, `svix-secrets`, `artifact-registry-secret`. If you ran the script with `--enable-openfga`, `openfga-secrets` will also be present.
+
+4. ## Create a deployment
+
+   Deployments are created through the <a href={DISTR_URL}>Scalekit distribution portal</a>.
+
+   #### Open Deployments
+
+   In the left sidebar, click **Deployments**, then click **+ New Deployment** in the top-right corner.
+
+   ![Deployments page](@/assets/docs/self-hosted/portal-deployments.png)
+
+   #### Select the application
+
+   In the **Create New Deployment** dialog, select **Scalekit Onprem** and click **Continue**.
+
+   ![Create New Deployment — select Scalekit Onprem](@/assets/docs/self-hosted/portal-new-deployment.png)
+
+   #### Configure the deployment
+
+   ![Deployment Configuration form](@/assets/docs/self-hosted/portal-deployment-config.png)
+
+   - **Deployment Name** — any name you choose; `scalekit` is recommended
+   - **Kubernetes Namespace** — must match the namespace you used in step 3
+   - Leave **Enable cluster-scoped permissions** checked
+   - Leave **Set custom resource requirements for the Distr agent** unchecked
+
+   Click **Continue**.
+
+   #### Select a version and add values
+
+   ![Application Configuration form](@/assets/docs/self-hosted/portal-app-config.png)
+
+   - **Version** — select the latest available version from the dropdown
+   - **Helm release name** — leave as `scalekit` or set your own
+   - **Helm values** — paste the full contents of `values-gke-<timestamp>.yaml` generated by the setup script
+
+   Click **Create Deployment**. The portal moves to the **Deploy** step and shows a `kubectl apply` command.
+
+   #### Connect your cluster
+
+   The portal shows a **Deployment Created Successfully** screen with a `kubectl apply` command.
+
+   ![Deployment created successfully — copy the kubectl command](@/assets/docs/self-hosted/portal-deploy-success.png)
+
+   Click **Copy Command** and run it on your cluster:
+
+   <Code lang="bash" code={kubectlConnectCmd} />
+
+   <Aside type="caution" title="Databases must exist before connecting">
+     The deployment triggers database migrations on connect. If any of the three PostgreSQL databases (`scalekit`, `webhooks`, `openfga`) do not exist, the migration will fail. The setup script prints the exact `CREATE DATABASE` commands to run if needed.
+   </Aside>
+
+5. ## Update DNS
+
+   Once the Gateway is up, get its external IP:
+
+   ```bash
+   kubectl get gateway -n <namespace>
+   ```
+
+   Copy the external IP from the `ADDRESS` column. In your DNS provider, create a wildcard `A` record pointing to it:
+
+   ```
+   *.<your-domain>  →  <gateway-external-ip>
+   ```
+
+   DNS propagation can take a few minutes. You can verify with:
+
+   ```bash
+   dig app.<your-domain>
+   ```
+
+6. ## Verify the deployment
+
+   ```bash
+   kubectl get pods -n <namespace>
+   ```
+
+   All pods should show `Running` status. Open the admin dashboard at `https://app.<your-domain>` and sign in with the admin credentials you provided during setup.
+
+</Steps>
diff --git a/src/content/docs/self-hosted/overview.mdx b/src/content/docs/self-hosted/overview.mdx
new file mode 100644
index 000000000..fbd2c3519
--- /dev/null
+++ b/src/content/docs/self-hosted/overview.mdx
@@ -0,0 +1,66 @@
+---
+title: Self-hosted deployment overview
+description: Deploy Scalekit on your own Kubernetes cluster to meet data residency, compliance, and network isolation requirements.
+sidebar:
+  label: Overview
+  order: 1
+  next:
+    label: Quick start
+    link: /self-hosted/quickstart/
+tags: [self-hosted, on-premises, kubernetes, helm, deployment]
+tableOfContents: true
+---
+
+import { Aside } from '@astrojs/starlight/components'
+import { DISTR_URL } from '../../../configs/self-hosted'
+
+Scalekit's self-hosted deployment lets you run the full Scalekit platform on your own Kubernetes cluster. All authentication data stays within your infrastructure — nothing leaves your network.
+
+Use self-hosted deployment when your organization requires:
+
+- **Data residency**: Auth data must remain in a specific region or on-premises location
+- **Network isolation**: The auth service must not be reachable from the public internet
+- **Compliance**: Regulations such as FedRAMP, HIPAA, or internal security policies prohibit use of SaaS auth services
+- **Air-gapped environments**: Your deployment environment has no outbound internet access
+
+## How it works
+
+Scalekit is deployed on Kubernetes via a Helm chart managed through the <a href={DISTR_URL}>Scalekit distribution portal</a>. You configure the deployment with a `values.yaml` file, apply Kubernetes secrets to your cluster, and connect the cluster to the portal — which handles chart delivery, migrations, and upgrades.
+
+## What Scalekit runs
+
+A self-hosted deployment runs as a single Kubernetes `Deployment` with multiple containers:
+
+| Component | Description |
+|-----------|-------------|
+| **Auth service** | Core service handling login, token issuance, sessions, SSO, and SCIM |
+| **Dashboard** | Admin web UI for managing your Scalekit instance |
+| **Flagd** | Feature flag sidecar for runtime configuration |
+| **Webhooks** | Webhook delivery service |
+| **OpenFGA** | Fine-grained authorization engine (optional) |
+
+## What you provide
+
+Scalekit does not bundle a database or cache in production. You provision and manage these separately:
+
+| Dependency | Requirement | Notes |
+|------------|-------------|-------|
+| **Kubernetes** | 1.27 or later | Any managed or self-managed cluster |
+| **PostgreSQL** | 15 or later | Three databases required: `scalekit`, `webhooks`, `openfga` |
+| **Redis** | 6.2 or later | Used for sessions, caching, and job queues |
+| **SMTP** | Any provider | Postmark and SendGrid have first-class support |
+
+<Aside type="note" title="Evaluation shortcut">
+  The Helm chart includes optional PostgreSQL and Redis subcharts. Enable them to spin up Scalekit quickly without provisioning external services. **Use subcharts for evaluation only** — they are not suitable for production.
+</Aside>
+
+<Aside type="note" title="Access required">
+  Self-hosted deployment requires a Scalekit enterprise license. You receive your Helm chart access and container registry token through the <a href={DISTR_URL}>Scalekit distribution portal</a> as part of onboarding.
+</Aside>
+
+## Choose your path
+
+| Path | When to use |
+|------|-------------|
+| **[Quick start](/self-hosted/quickstart/)** | Get Scalekit running fast using bundled PostgreSQL and Redis. Ideal for evaluation and proof-of-concept. No external databases or `kubectl secret` commands needed. |
+| **[Full installation](/self-hosted/system-requirements/)** | Production deployment with external PostgreSQL and Redis, full secret management, and your choice of ingress controller. |
diff --git a/src/content/docs/self-hosted/quickstart.mdx b/src/content/docs/self-hosted/quickstart.mdx
new file mode 100644
index 000000000..27966514b
--- /dev/null
+++ b/src/content/docs/self-hosted/quickstart.mdx
@@ -0,0 +1,206 @@
+---
+title: Quick start
+description: Deploy Scalekit on Kubernetes in minutes using bundled databases and a single values.yaml file.
+sidebar:
+  label: Quick start
+  order: 2
+  prev:
+    label: Overview
+    link: /self-hosted/overview/
+  next:
+    label: System requirements
+    link: /self-hosted/system-requirements/
+tags: [self-hosted, quickstart, kubernetes, helm]
+tableOfContents: true
+---
+
+import { Steps, Aside } from '@astrojs/starlight/components'
+import { REGISTRY_HOST, DISTR_URL } from '../../../configs/self-hosted'
+
+Get Scalekit running on Kubernetes quickly through the <a href={DISTR_URL}>Scalekit distribution portal</a>. This guide uses bundled PostgreSQL and Redis and auto-creates Kubernetes secrets from your `values.yaml` — no external databases or `kubectl secret` commands needed.
+
+<Aside type="caution" title="Not for production">
+  The bundled databases have no backups, no replication, and no persistent storage guarantees. For a production deployment with external services and full secret management, follow the [installation guide](/self-hosted/installation/).
+</Aside>
+
+## Before you start
+
+| Requirement | Notes |
+|-------------|-------|
+| `kubectl` 1.27+ | Configured against your target cluster |
+| Helm 3.12+ | Run `helm version` to verify |
+| Domain | Subdomains `app.<domain>` and `auth.<domain>` must resolve to your cluster |
+| Gateway class | A GatewayClass must be installed on your cluster |
+| TLS certificate | Attached via a gateway annotation (GCP cert map, cert-manager, etc.) |
+| SMTP credentials | Any provider; Postmark and SendGrid have first-class support |
+| Registry token | From the <a href={DISTR_URL}>Scalekit distribution portal</a> — see step 1 |
+| `openssl` and `python3` | To generate webhook credentials in step 2 |
+
+---
+
+<Steps>
+
+1. ## Get a registry token
+
+   Log in to the <a href={DISTR_URL}>Scalekit distribution portal</a> and create a Personal Access Token. This token authenticates your cluster to pull Scalekit images from <code>{REGISTRY_HOST}</code>.
+
+   <Aside type="caution" title="Token expiry breaks image pulls">
+     When the token expires, new deployments and upgrades will fail with `ImagePullBackOff`. Set a reminder to renew it before it lapses.
+   </Aside>
+
+   Copy the token — it is shown only once.
+
+2. ## Generate webhook credentials
+
+   Run these commands to produce a JWT secret and a signed API token. Copy both output lines — you will paste them into `values.yaml` in the next step.
+
+   ```bash frame="terminal"
+   export JWT_SECRET=$(openssl rand -base64 32)
+   echo "jwtSecret: $JWT_SECRET"
+
+   python3 << 'EOF'
+   import base64, hashlib, hmac as _hmac, json, os, secrets, string, time
+
+   secret = os.environ['JWT_SECRET']
+   chars = string.ascii_letters + string.digits
+   sub = 'org_' + ''.join(secrets.choice(chars) for _ in range(22))
+   now = int(time.time())
+   exp = now + 315360000
+
+   h = base64.urlsafe_b64encode(json.dumps({'alg':'HS256','typ':'JWT'}, separators=(',',':')).encode()).rstrip(b'=').decode()
+   p = base64.urlsafe_b64encode(json.dumps({'iat':now,'exp':exp,'nbf':now,'iss':'svix-server','sub':sub}, separators=(',',':')).encode()).rstrip(b'=').decode()
+   msg = f'{h}.{p}'
+   sig = base64.urlsafe_b64encode(_hmac.new(secret.encode(), msg.encode(), hashlib.sha256).digest()).rstrip(b'=').decode()
+   print(f'apiToken: {msg}.{sig}')
+   EOF
+   ```
+
+   The output looks like:
+
+   ```
+   jwtSecret: aB3cD4eF5gH6...
+   apiToken: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
+   ```
+
+3. ## Create values.yaml
+
+   Create a `values.yaml` file using the template below. Replace each placeholder with your actual value.
+
+   ```yaml title="values.yaml"
+   scalekit:
+     config:
+       app:
+         domain: "<your-domain>"            # e.g. scalekit.example.com — no scheme or trailing slash
+       seedData:
+         adminUser:
+           firstName: "<firstname>"
+           lastName: "<lastname>"
+           email: "<admin-email>"
+         emailServer:
+           settings:
+             fromEmail: "hi@<your-domain>"
+             fromName: "Team <Your Company>"
+             host: "<smtp-host>"
+             port: <smtp-port>
+             username: "<smtp-username>"
+
+   postgresql:
+     enabled: true
+
+   redis:
+     enabled: true
+
+   secrets:
+     create: true
+     svix:
+       jwtSecret: "<jwtSecret from step 2>"
+       apiToken: "<apiToken from step 2>"
+     registry:
+       password: "<registry token from step 1>"
+
+   gateway:
+     enabled: true
+     provider: "<provider>"                # gcp for GKE; other for all other clusters
+     className: "<gateway-class-name>"     # e.g. gke-l7-global-external-managed
+     annotations:
+       <annotation-key>: "<annotation-value>"   # e.g. networking.gke.io/certmap: your-cert-map
+     redirectToHttps: true
+     healthCheckPolicy:
+       enabled: true                       # GKE only — set false for other providers
+   ```
+
+   | Field | Description |
+   |-------|-------------|
+   | `domain` | Base domain. The chart derives `app.<domain>` and `auth.<domain>` from this. |
+   | `adminUser` | First admin account created on first boot. Use this to log in to the dashboard. |
+   | `emailServer` | SMTP settings for transactional email (invites, magic links, verification codes). The password is provided separately via `secrets.registry.password` — see [full configuration](/self-hosted/configuration/) for details. |
+   | `secrets.create` | When `true`, the chart creates all required Kubernetes secrets from the values below. |
+   | `secrets.svix` | Webhook service credentials generated in step 2. |
+   | `secrets.registry.password` | Registry access token from step 1. |
+   | `gateway.provider` | Set to `gcp` for GKE to enable GKE-specific resources. Leave empty for all other providers. |
+   | `gateway.className` | The GatewayClass installed on your cluster. |
+   | `gateway.annotations` | Attach a TLS certificate via your provider's annotation. |
+
+4. ## Create a deployment in the portal
+
+   Deployments are managed through the <a href={DISTR_URL}>Scalekit distribution portal</a>.
+
+   Create the namespace on your cluster first:
+
+   ```bash
+   kubectl create namespace <namespace>
+   ```
+
+   Then, in the portal:
+
+   - In the left sidebar, click **Deployments**, then **+ New Deployment**
+   - Select **Scalekit Onprem** and click **Continue**
+   - Set a **Deployment Name** (`scalekit` is recommended) and enter the **Kubernetes Namespace** you just created
+   - Leave **Enable cluster-scoped permissions** checked and click **Continue**
+   - Select the **Version** you want to install
+   - Under **Helm values**, paste the full contents of your `values.yaml`
+   - Click **Create Deployment**
+
+   The portal shows a **Deployment Created Successfully** screen with a `kubectl apply` command. Click **Copy Command** and run it on your cluster:
+
+   ```bash
+   kubectl apply -n <namespace> -f "<portal-provided-url>"
+   ```
+
+   This connects your cluster to the portal, which then installs the Helm chart and runs database migrations.
+
+5. ## Update DNS
+
+   Once the gateway is provisioned, get its external IP:
+
+   ```bash
+   kubectl get gateway -n scalekit
+   ```
+
+   Copy the address from the `ADDRESS` column. In your DNS provider, create a wildcard `A` record:
+
+   ```
+   *.<your-domain>  →  <gateway-external-ip>
+   ```
+
+   DNS propagation can take a few minutes. Verify with:
+
+   ```bash
+   dig app.<your-domain>
+   ```
+
+6. ## Verify
+
+   ```bash
+   kubectl get pods -n scalekit
+   ```
+
+   All pods should show `Running`. Open `https://app.<your-domain>` in a browser and sign in with the admin email you set in `values.yaml`.
+
+</Steps>
+
+## Next steps
+
+- Ready for production? Switch to external databases and full secret management — follow the [installation guide](/self-hosted/installation/).
+- Review every configuration field in the [configuration reference](/self-hosted/configuration/).
+- Learn how to upgrade and maintain your deployment in [upgrades & maintenance](/self-hosted/upgrades/).
diff --git a/src/content/docs/self-hosted/setup-script.mdx b/src/content/docs/self-hosted/setup-script.mdx
new file mode 100644
index 000000000..41595347b
--- /dev/null
+++ b/src/content/docs/self-hosted/setup-script.mdx
@@ -0,0 +1,911 @@
+---
+title: Secrets setup script
+description: Interactive script that generates all Kubernetes secrets and a values.yaml for your Scalekit deployment.
+sidebar:
+  label: Setup script
+  order: 5
+  prev:
+    label: Configure Scalekit
+    link: /self-hosted/configuration/
+  next:
+    label: Install Scalekit
+    link: /self-hosted/installation/
+tags: [self-hosted, secrets, kubernetes, helm, setup]
+tableOfContents: true
+---
+
+import { Aside } from '@astrojs/starlight/components'
+import { REGISTRY_HOST, DISTR_URL } from '../../../configs/self-hosted'
+
+The setup script is a **one-time tool for initial deployment**. Run it once to bootstrap your cluster — do not run it again on an existing installation.
+
+It collects your configuration interactively and produces two output files:
+
+- **A secrets script** (`scalekit-secrets-<env>-<timestamp>.sh`) — runs `kubectl` commands to create all five required Kubernetes secrets
+- **A values file** (`values-<env>-<timestamp>.yaml`) — paste this into the <a href={DISTR_URL}>Scalekit distribution portal</a> when creating your deployment
+
+## Prerequisites
+
+| Tool | Version | Purpose |
+|------|---------|---------|
+| `bash` | 4.0 or later | Run the script |
+| `openssl` | Any modern version | Generate cryptographic keys and tokens |
+| `python3` | 3.6 or later | Generate webhook JWT and OIDC client secret |
+| `kubectl` | 1.27 or later | Create Kubernetes secrets in your cluster |
+
+`kubectl` must be configured and pointed at the cluster you are deploying to before you run the script.
+
+On macOS, `bash` ships as version 3. Install a newer version with Homebrew:
+
+```bash
+brew install bash
+```
+
+## Run the script
+
+<Aside type="caution" title="Run this script only once">
+  The script auto-generates cryptographic keys — OIDC master key, cookie encryption keys, webhook JWT secret, and others. These are written into your Kubernetes secrets and used by the running system. If you run the script again, it generates different values and overwrites the secrets, which will break your existing deployment.
+
+  To update a single credential (for example, to rotate a database password), edit the specific Kubernetes secret directly rather than re-running the script.
+</Aside>
+
+Copy the script below, save it as `setup-secrets.sh`, make it executable, then run it:
+
+```bash
+chmod +x setup-secrets.sh
+bash setup-secrets.sh
+```
+
+When prompted to choose an environment, enter the number that matches your target:
+
+| Option | Environment | Notes |
+|--------|-------------|-------|
+| `1` | Minikube (local) | Uses nginx ingress; sets `http` protocol and `allow_insecure: true` |
+| `2` | GCP / GKE | Configures GKE Gateway API and NEG annotations |
+| `3` | Other Kubernetes cluster | Generic config — you add your own ingress or gateway |
+| `4` | Evaluation | Fast path: Helm spins up bundled PostgreSQL and Redis; only asks for webhook and registry credentials |
+
+### Evaluation mode
+
+Option `4` is a shortcut for a local or throwaway environment. The script asks only for a webhook JWT secret, a webhook API token, and a registry access token, then exits. It generates a minimal `values-eval-<timestamp>.yaml` to paste into the distribution portal. No databases or Redis instances are needed — the chart provides bundled ones.
+
+**Do not use evaluation mode in production.** The bundled databases have no backups, no replication, and no persistent storage guarantees.
+
+### Optional flags
+
+| Flag | Effect |
+|------|--------|
+| `--enable-openfga` | Includes OpenFGA secrets and database configuration |
+| `--change-defaults` | Prompts you to confirm or override default values instead of accepting them silently |
+
+## What the script collects
+
+### Full setup (options 1, 2, 3)
+
+The script walks through these sections:
+
+| Section | What it asks |
+|---------|-------------|
+| **Namespace** | Kubernetes namespace to deploy into |
+| **Environment** | Deployment target: Minikube, GCP/GKE, other K8s, or Evaluation |
+| **PostgreSQL** | Host, port, credentials, and database names (scalekit, webhooks, openfga if enabled) |
+| **Redis** | Host, port, password, and db indexes for app, background jobs, and webhooks |
+| **Email (SMTP)** | From address, host, port, username, and password |
+| **Container registry** | Registry token from the <a href={DISTR_URL}>Scalekit distribution portal</a>; server defaults to <code>{REGISTRY_HOST}</code> |
+| **GKE Gateway** | GatewayClass name and GCP certificate map (GCP/GKE only) |
+| **App settings** | Domain, region, replica count |
+| **Admin user** | First name, last name, email for the initial dashboard login |
+
+All cryptographic values (OIDC keys, cookie keys, webhook JWT, etc.) are auto-generated — you do not supply these.
+
+### Evaluation mode (option 4)
+
+The script only asks for:
+
+| Section | What it asks |
+|---------|-------------|
+| **Namespace** | Kubernetes namespace to deploy into |
+| **Webhook credentials** | JWT secret and API token |
+| **Container registry** | Registry access token |
+
+## After the script completes
+
+The script prints the paths to both generated files. Before proceeding:
+
+1. Run the secrets script to create all Kubernetes secrets:
+   ```bash
+   bash scalekit-secrets-<env>-<timestamp>.sh
+   ```
+2. Paste the contents of `values-<env>-<timestamp>.yaml` into the <a href={DISTR_URL}>Scalekit distribution portal</a> when creating or updating your deployment — see [Install Scalekit](/self-hosted/installation/) for the full portal flow.
+
+<Aside type="caution" title="Check databases exist first">
+  The script reminds you to verify that all three PostgreSQL databases exist before connecting your cluster. The migration hook will fail if any database is missing.
+</Aside>
+
+## Script
+
+```bash title="setup-secrets.sh"
+#!/usr/bin/env bash
+set -euo pipefail
+
+# ── Arguments ─────────────────────────────────────────────────────────────────
+# Usage: bash setup-secrets.sh [--enable-openfga] [--change-defaults]
+OPENFGA_ENABLED="false"
+CHANGE_DEFAULTS="false"
+for arg in "$@"; do
+  case "$arg" in
+    --enable-openfga)  OPENFGA_ENABLED="true" ;;
+    --change-defaults) CHANGE_DEFAULTS="true" ;;
+    *) echo "Unknown argument: $arg"; exit 1 ;;
+  esac
+done
+
+# ── Colours ──────────────────────────────────────────────────────────────────
+BOLD=$'\033[1m'
+DIM=$'\033[2m'
+RED=$'\033[31m'
+GREEN=$'\033[32m'
+YELLOW=$'\033[33m'
+CYAN=$'\033[36m'
+RESET=$'\033[0m'
+
+header()  { echo "\n${BOLD}${CYAN}▶ $*${RESET}"; }
+prompt()  { echo "${YELLOW}$*${RESET}"; }
+success() { echo "${GREEN}✓ $*${RESET}"; }
+dim()     { echo "${DIM}$*${RESET}"; }
+
+ask() {
+  local var="$1" msg="$2" default="${3:-}"
+  # If a default exists and --change-defaults is not set, use it silently
+  if [[ -n "$default" && "$CHANGE_DEFAULTS" == "false" ]]; then
+    eval "$var=\"$default\""
+    dim "  $msg = $default (default)"
+    return
+  fi
+  while true; do
+    if [[ -n "$default" ]]; then
+      read -rp "${YELLOW}$msg [${default}]: ${RESET}" input
+    else
+      read -rp "${YELLOW}$msg: ${RESET}" input
+    fi
+    if [[ -z "$input" && -n "$default" ]]; then
+      eval "$var=\"$default\""
+      break
+    elif [[ -n "$input" ]]; then
+      eval "$var=\"$input\""
+      break
+    else
+      echo "${RED}  ✗ This field is required. Please enter a value.${RESET}"
+    fi
+  done
+}
+
+ask_secret() {
+  local var="$1" msg="$2" default="${3:-}"
+  # If the 3rd argument was explicitly passed (even as ""), empty input is allowed
+  local allow_empty="${3+yes}"
+  while true; do
+    if [[ -n "$default" ]]; then
+      read -rp "${YELLOW}$msg [${default}]: ${RESET}" input
+    else
+      read -rp "${YELLOW}$msg: ${RESET}" input
+    fi
+    if [[ -z "$input" && -n "$default" ]]; then
+      eval "$var=\"$default\""
+      break
+    elif [[ -z "$input" && "$allow_empty" == "yes" ]]; then
+      eval "$var=\"\""
+      break
+    elif [[ -n "$input" ]]; then
+      eval "$var=\"$input\""
+      break
+    else
+      echo "${RED}  ✗ This field is required. Please enter a value.${RESET}"
+    fi
+  done
+}
+
+# ── Step 1: Namespace & environment ──────────────────────────────────────────
+header "Step 1 — Namespace & environment"
+ask NAMESPACE "Kubernetes namespace to deploy Scalekit into"
+echo
+echo -e "${YELLOW}Which environment are you deploying to?${RESET}"
+echo "  1) Minikube (local)"
+echo "  2) GCP / GKE"
+echo "  3) Other Kubernetes cluster"
+echo "  4) Evaluation (quickstart — Helm brings up PostgreSQL & Redis)"
+read -rp "${YELLOW}Enter 1, 2, 3 or 4: ${RESET}" ENV_CHOICE
+if [[ "$ENV_CHOICE" == "1" ]]; then
+  ENV_LABEL="minikube"
+elif [[ "$ENV_CHOICE" == "2" ]]; then
+  ENV_LABEL="gke"
+elif [[ "$ENV_CHOICE" == "4" ]]; then
+  ENV_LABEL="eval"
+else
+  ENV_LABEL="k8s"
+fi
+
+# ── Evaluation flow (early exit) ──────────────────────────────────────────────
+if [[ "$ENV_CHOICE" == "4" ]]; then
+  header "Step 2 — Evaluation setup"
+  dim "  Helm will spin up PostgreSQL and Redis automatically."
+  dim "  You only need a Svix API token and registry credentials."
+  echo
+
+  ask_secret SVIX_JWT_SECRET   "  Svix JWT secret (must be the secret used to sign the API token)"
+  ask_secret SVIX_API_KEY      "  Svix API token (JWT signed with the above secret)"
+  ask_secret REGISTRY_PASSWORD "  Registry access token"
+  echo
+
+  VALUES_FILE="$(pwd)/values-eval-$(date +%Y%m%d%H%M%S).yaml"
+  cat > "$VALUES_FILE" <<EOF
+secrets:
+  create: true
+  svix:
+    jwtSecret: "${SVIX_JWT_SECRET}"
+    apiToken: "${SVIX_API_KEY}"
+  registry:
+    password: "${REGISTRY_PASSWORD}"
+
+postgresql:
+  enabled: true
+
+redis:
+  enabled: true
+EOF
+
+  success "values.yaml written to: $VALUES_FILE"
+  echo
+
+  header "Step 3 — Helm install"
+  ask CHART_VERSION "  Chart version to install (e.g. 0.1.0)"
+  echo
+
+  header "Done"
+  echo
+  success "values.yaml : $VALUES_FILE"
+  echo
+  echo -e "${BOLD}${CYAN}┌─────────────────────────────────────────────────────────────┐${RESET}"
+  echo -e "${BOLD}${CYAN}│              execute the following command                   │${RESET}"
+  echo -e "${BOLD}${CYAN}└─────────────────────────────────────────────────────────────┘${RESET}"
+  echo
+  echo "  helm install scalekit oci://ar.scalekit.cloud/scalekit/charts/scalekit \\"
+  echo "    --version ${CHART_VERSION} \\"
+  echo "    -n ${NAMESPACE} \\"
+  echo "    --values=${VALUES_FILE}"
+  echo
+  echo -e "${BOLD}${CYAN}└─────────────────────────────────────────────────────────────┘${RESET}"
+  exit 0
+fi
+
+# ── Step 2: Auto-generate values ─────────────────────────────────────────────
+header "Step 2 — Generating secure values"
+
+OIDC_MASTER_KEY=$(openssl rand -hex 16)
+SECURECOOKIE_ENCRYPTKEY=$(openssl rand -hex 16)
+SECURECOOKIE_HASHKEY=$(openssl rand -hex 16)
+SVIX_JWT_SECRET=$(openssl rand -base64 32)
+SVIX_MAIN_SECRET=$(openssl rand -base64 32)
+TRAEFIK_TOKEN=$(openssl rand -hex 16)
+FGA_API_TOKEN=$(openssl rand -hex 24)
+OPENFGA_EXTRA_KEY=$(openssl rand -hex 24)
+APP_OIDC_CLIENT_ID="skc_8573429015935040"
+
+APP_OIDC_CLIENT_SECRET=$(python3 -c "
+import secrets
+print(f'sk_{secrets.token_urlsafe(48)}')
+")
+
+success "Generated: oidc_master_key, securecookie keys, svix secrets, traefik token, fga tokens, oidc client id/secret"
+
+# ── Step 3: Svix JWT ──────────────────────────────────────────────────────────
+header "Step 3 — Svix JWT token"
+dim "The Svix API token is a JWT signed with the generated svix_jwt_secret."
+
+SVIX_SUB=$(python3 -c "
+import secrets, string
+chars = string.ascii_letters + string.digits
+print('org_' + ''.join(secrets.choice(chars) for _ in range(22)))
+")
+
+SVIX_API_KEY=$(python3 -c "
+import base64, hashlib, hmac as _hmac, json, time
+
+secret = '''${SVIX_JWT_SECRET}'''
+sub    = '${SVIX_SUB}'
+now    = int(time.time())
+exp    = now + 315360000  # 10 years
+
+header  = base64.urlsafe_b64encode(json.dumps({'alg':'HS256','typ':'JWT'}, separators=(',',':')).encode()).rstrip(b'=').decode()
+payload = base64.urlsafe_b64encode(json.dumps({'iat':now,'exp':exp,'nbf':now,'iss':'svix-server','sub':sub}, separators=(',',':')).encode()).rstrip(b'=').decode()
+msg     = f'{header}.{payload}'
+sig     = base64.urlsafe_b64encode(_hmac.new(secret.encode(), msg.encode(), hashlib.sha256).digest()).rstrip(b'=').decode()
+print(f'{msg}.{sig}')
+")
+
+success "Svix JWT token generated (used as svix_api_key and svix-secrets api-token)"
+
+# ── Step 4: Collect user-provided values ─────────────────────────────────────
+header "Step 4 — Required configuration"
+dim "  The following sections collect everything needed to configure Scalekit's"
+dim "  services and generate all Kubernetes secrets and the values.yaml file."
+echo
+
+# ── Database ──────────────────────────────────────────────────────────────────
+header "  [Database] PostgreSQL"
+dim "  Scalekit uses a shared PostgreSQL server with one set of credentials"
+dim "  across all components. Each component gets its own database."
+dim ""
+dim "  These values will be used to:"
+dim "    - create the 'db-migrations' secret  (DATABASE_URL, DB_ADAPTER)"
+dim "    - create the 'authentication-secret' (database_password)"
+dim "    - create the 'svix-secrets'          (db-dsn)"
+if [[ "$OPENFGA_ENABLED" == "true" ]]; then
+dim "    - create the 'openfga-secrets'       (uri, password, username)"
+fi
+dim ""
+dim "  All databases must already exist on your server before running helm install."
+echo
+
+ask        DB_HOST           "  PostgreSQL host (IP or hostname)"
+read -rp "${YELLOW}  PostgreSQL port [5432]: ${RESET}" input; DB_PORT="${input:-5432}"
+ask        DB_USER           "  PostgreSQL username"
+ask_secret DATABASE_PASSWORD "  PostgreSQL password"
+echo
+dim "  Database names — each component gets its own isolated database:"
+ask DB_NAME_SCALEKIT  "  Scalekit main application database name" "scalekit"
+ask DB_NAME_SVIX      "  Svix webhooks database name" "webhooks"
+if [[ "$OPENFGA_ENABLED" == "true" ]]; then
+  ask DB_NAME_OPENFGA "  OpenFGA authorization database name" "openfga"
+fi
+echo
+
+# Construct all DB URLs from shared credentials
+DATABASE_URL="postgresql://${DB_USER}:${DATABASE_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_NAME_SCALEKIT}"
+SVIX_DB_DSN="postgresql://${DB_USER}:${DATABASE_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_NAME_SVIX}"
+if [[ "$OPENFGA_ENABLED" == "true" ]]; then
+  OPENFGA_DB_URI="postgresql://${DB_USER}:${DATABASE_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_NAME_OPENFGA}"
+fi
+
+# ── Redis ─────────────────────────────────────────────────────────────────────
+header "  [Redis]"
+dim "  Redis powers three isolated workloads — main app cache, the Asynq"
+dim "  background job queue, and the Svix webhook message bus. All three share"
+dim "  the same server but use different database indexes to stay isolated."
+dim ""
+dim "  These values will be used to:"
+dim "    - set redis/asynq config in values.yaml"
+dim "    - create the 'authentication-secret' (redis_password, asynq_redis_password)"
+dim "    - create the 'svix-secrets'          (redis-dsn)"
+dim ""
+dim "  Leave password empty if your Redis instance has no auth configured."
+echo
+
+ask        REDIS_HOST     "  Redis host (IP or hostname)"
+read -rp "${YELLOW}  Redis port [6379]: ${RESET}" input; REDIS_PORT="${input:-6379}"
+ask_secret REDIS_PASSWORD "  Redis password (leave empty if none)" ""
+ASYNQ_REDIS_PASSWORD="$REDIS_PASSWORD"
+echo
+dim "  Database indexes — each component gets its own slot to avoid key collisions:"
+ask REDIS_DB       "  Redis db index for main application" "10"
+ask ASYNQ_REDIS_DB "  Redis db index for Asynq background jobs" "12"
+ask SVIX_REDIS_DB  "  Redis db index for Svix webhooks" "11"
+
+SVIX_REDIS_DSN="redis://${REDIS_PASSWORD:+:${REDIS_PASSWORD}@}${REDIS_HOST}:${REDIS_PORT}/${SVIX_REDIS_DB}#insecure"
+echo
+
+# ── Email ─────────────────────────────────────────────────────────────────────
+EMAIL_KEY="na"
+SENDGRID_KEY="na"
+POSTMARK_KEY="na"
+
+header "  [Email] Outbound SMTP"
+dim "  Scalekit sends transactional emails (invites, magic links, verification"
+dim "  codes) via SMTP."
+dim ""
+dim "  These values will be used to:"
+dim "    - set seedData.emailServer in values.yaml (from, host, port, username)"
+echo
+
+ask        EMAIL_FROM      "  Sender email address (e.g. hi@yourdomain.com)"
+ask        EMAIL_FROM_NAME "  Sender display name (e.g. Team Scalekit)"
+ask_secret SMTP_HOST       "  SMTP server host" "smtp.postmarkapp.com"
+ask_secret SMTP_PORT       "  SMTP server port" "587"
+ask        SMTP_USERNAME   "  SMTP login username"
+ask_secret SMTP_PASSWORD   "  SMTP login password"
+echo
+
+# ── Image Registry ────────────────────────────────────────────────────────────
+header "  [Registry] Container Image Registry"
+dim "  Scalekit images are hosted on a private registry at ar.scalekit.cloud."
+dim "  Kubernetes needs a pull secret with your access token to download images."
+dim ""
+dim "  These values will be used to:"
+dim "    - create the 'artifact-registry-secret' (docker-registry pull secret)"
+echo
+
+ask        REGISTRY_SERVER   "  Container registry server URL" "ar.scalekit.cloud"
+dim "  Registry username is always: oauth2accesstoken"
+REGISTRY_USERNAME="oauth2accesstoken"
+ask_secret REGISTRY_PASSWORD "  Registry access token (your personal or service account token)"
+echo
+
+# ── GKE Gateway (GCP only) ────────────────────────────────────────────────────
+if [[ "$ENV_CHOICE" == "2" ]]; then
+  header "  [GKE Gateway]"
+  dim "  On GKE, all external traffic enters through a Google-managed L7 gateway."
+  dim ""
+  dim "  These values will be used to:"
+  dim "    - set gateway.className and networking.gke.io/certmap in values.yaml"
+  echo
+  ask GATEWAY_CLASS "  GKE gateway class name" "gke-l7-global-external-managed"
+  ask CERT_MAP_NAME "  GCP certificate map name covering your domain (networking.gke.io/certmap)"
+  echo
+fi
+
+# ── App ───────────────────────────────────────────────────────────────────────
+header "  [App] Application settings"
+dim "  The base domain is used to derive all subdomains (app.*, auth.*). Region"
+dim "  controls data residency labelling. Replica count sets pods per service."
+if [[ "$ENV_CHOICE" == "1" ]]; then
+  dim "  Minikube default: scalekit.local (local testing only, not internet-reachable)."
+fi
+dim ""
+dim "  These values will be used to:"
+dim "    - set scalekit.config.app.* in values.yaml  (domain, protocol, region)"
+dim "    - set replicaCount in values.yaml"
+echo
+
+if [[ "$ENV_CHOICE" == "1" ]]; then
+  ask APP_DOMAIN    "  Application base domain (subdomains app.* and auth.* will be derived from this)" "scalekit.local"
+  APP_PROTOCOL="http"
+  OIDC_ALLOW_INSECURE="true"
+else
+  ask APP_DOMAIN    "  Application base domain (e.g. onprem.scalekit.cloud)"
+  APP_PROTOCOL="https"
+  OIDC_ALLOW_INSECURE="false"
+fi
+ask APP_REGION    "  Deployment region for data residency labelling (e.g. us, eu)" "us"
+ask REPLICA_COUNT "  Number of pod replicas per service" "2"
+echo
+
+# ── Admin seed user ───────────────────────────────────────────────────────────
+header "  [Admin] Seed admin user"
+dim "  This account is created automatically on first boot. Use it to log in"
+dim "  to the Scalekit dashboard and set up your workspace."
+dim ""
+dim "  These values will be used to:"
+dim "    - set seedData.adminUser.* in values.yaml  (firstName, lastName, email)"
+echo
+
+ask ADMIN_FIRST_NAME "  Admin user first name"
+ask ADMIN_LAST_NAME  "  Admin user last name"
+ask ADMIN_EMAIL      "  Admin user email address (used to log in to the dashboard)"
+echo
+
+
+# ── Step 5: Summary ───────────────────────────────────────────────────────────
+header "Step 5 — Review all values"
+echo
+echo -e "${DIM}Auto-generated:${RESET}"
+echo "  traefik_token             = $TRAEFIK_TOKEN"
+echo "  oidc_master_key           = $OIDC_MASTER_KEY"
+echo "  securecookie_encryptkey   = $SECURECOOKIE_ENCRYPTKEY"
+echo "  securecookie_hashkey      = $SECURECOOKIE_HASHKEY"
+echo "  svix_jwt_secret           = $SVIX_JWT_SECRET"
+echo "  svix_main_secret          = $SVIX_MAIN_SECRET"
+echo "  svix_api_key              = $SVIX_API_KEY"
+echo "  fga_api_token             = $FGA_API_TOKEN"
+echo "  openfga_extra_key         = $OPENFGA_EXTRA_KEY"
+echo "  app_oidc_client_id        = $APP_OIDC_CLIENT_ID"
+echo "  app_oidc_client_secret    = $APP_OIDC_CLIENT_SECRET"
+echo
+echo -e "${DIM}Database (shared credentials):${RESET}"
+echo "  host                      = $DB_HOST:$DB_PORT"
+echo "  username                  = $DB_USER"
+echo "  password                  = $DATABASE_PASSWORD"
+echo "  scalekit db               = $DB_NAME_SCALEKIT  →  $DATABASE_URL"
+echo "  svix db                   = $DB_NAME_SVIX      →  $SVIX_DB_DSN"
+if [[ "$OPENFGA_ENABLED" == "true" ]]; then
+  echo "  openfga db                = $DB_NAME_OPENFGA   →  $OPENFGA_DB_URI"
+fi
+echo
+echo -e "${DIM}Provided by you:${RESET}"
+echo "  namespace                 = $NAMESPACE"
+echo "  environment               = $ENV_LABEL"
+echo "  redis host:port           = $REDIS_HOST:$REDIS_PORT"
+echo "  redis password            = ${REDIS_PASSWORD:-<empty>}"
+echo "  redis.db (main)           = $REDIS_DB"
+echo "  redis.db (asynq)          = $ASYNQ_REDIS_DB"
+echo "  redis.db (svix)           = $SVIX_REDIS_DB  →  $SVIX_REDIS_DSN"
+echo "  email_key                 = na (fixed)"
+echo "  smtp password             = $SMTP_PASSWORD"
+echo "  sendgrid_key              = na (fixed)"
+echo "  smtp from                 = $EMAIL_FROM_NAME <$EMAIL_FROM>"
+echo "  smtp host:port            = $SMTP_HOST:$SMTP_PORT"
+echo "  smtp username             = $SMTP_USERNAME"
+echo "  app.domain                = $APP_DOMAIN"
+echo "  app.region                = $APP_REGION"
+echo "  app.protocol              = $APP_PROTOCOL"
+echo "  replicaCount              = $REPLICA_COUNT"
+echo "  adminUser                 = $ADMIN_FIRST_NAME $ADMIN_LAST_NAME <$ADMIN_EMAIL>"
+echo "  registry_server           = $REGISTRY_SERVER"
+echo "  registry_password         = $REGISTRY_PASSWORD"
+echo
+
+# ── Step 6: Write secrets script ─────────────────────────────────────────────
+OUTPUT_FILE="$(pwd)/scalekit-secrets-${ENV_LABEL}-$(date +%Y%m%d%H%M%S).sh"
+
+cat > "$OUTPUT_FILE" <<EOF
+#!/usr/bin/env bash
+# Scalekit secrets setup — generated $(date)
+# Environment: $ENV_LABEL | Namespace: $NAMESPACE
+
+# Create namespace
+kubectl create namespace $NAMESPACE
+
+# authentication-service-token
+kubectl create secret generic authentication-service-token \\
+  --from-literal=TOKEN="$TRAEFIK_TOKEN" \\
+  --dry-run=client -o yaml | kubectl apply -f - -n $NAMESPACE
+
+# db-migrations
+kubectl create secret generic db-migrations \\
+  --from-literal=DATABASE_URL="$DATABASE_URL" \\
+  --from-literal=DB_ADAPTER="postgresql" \\
+  --dry-run=client -o yaml | kubectl apply -f - -n $NAMESPACE
+
+# authentication-secret
+kubectl create secret generic authentication-secret \\
+  --from-literal=app_oidc_client_id="$APP_OIDC_CLIENT_ID" \\
+  --from-literal=app_oidc_client_secret="$APP_OIDC_CLIENT_SECRET" \\
+  --from-literal=email_key="$EMAIL_KEY" \\
+  --from-literal=fga_config_api_token="$FGA_API_TOKEN" \\
+  --from-literal=oidc_master_key="$OIDC_MASTER_KEY" \\
+  --from-literal=postmark_key="$POSTMARK_KEY" \\
+  --from-literal=database_password="$DATABASE_PASSWORD" \\
+  --from-literal=asynq_redis_password="$ASYNQ_REDIS_PASSWORD" \\
+  --from-literal=redis_password="$REDIS_PASSWORD" \\
+  --from-literal=securecookie_encryptkey="$SECURECOOKIE_ENCRYPTKEY" \\
+  --from-literal=securecookie_hashkey="$SECURECOOKIE_HASHKEY" \\
+  --from-literal=sendgrid_key="$SENDGRID_KEY" \\
+  --from-literal=app_scalekit_traefik_token="$TRAEFIK_TOKEN" \\
+  --from-literal=svix_api_key="$SVIX_API_KEY" \\
+  --from-literal=seed_data_email_server_settings_password="$SMTP_PASSWORD" \\
+  --dry-run=client -o yaml | kubectl apply -f - -n $NAMESPACE
+
+# svix-secrets
+kubectl create secret generic svix-secrets \\
+  --from-literal=db-dsn="$SVIX_DB_DSN" \\
+  --from-literal=jwt-secret="$SVIX_JWT_SECRET" \\
+  --from-literal=main-secret="$SVIX_MAIN_SECRET" \\
+  --from-literal=redis-dsn="$SVIX_REDIS_DSN" \\
+  --from-literal=api-token="$SVIX_API_KEY" \\
+  --dry-run=client -o yaml | kubectl apply -f - -n $NAMESPACE
+
+# artifact-registry-secret
+kubectl create secret docker-registry artifact-registry-secret \\
+  --docker-server="$REGISTRY_SERVER" \\
+  --docker-username="$REGISTRY_USERNAME" \\
+  --docker-password="$REGISTRY_PASSWORD" \\
+  -n $NAMESPACE
+
+# Verify all secrets are present
+kubectl get secrets -n $NAMESPACE
+EOF
+
+if [[ "$OPENFGA_ENABLED" == "true" ]]; then
+  cat >> "$OUTPUT_FILE" <<EOF
+
+# openfga-secrets
+kubectl create secret generic openfga-secrets \\
+  --from-literal=keys="${OPENFGA_EXTRA_KEY},${FGA_API_TOKEN}" \\
+  --from-literal=password="$DATABASE_PASSWORD" \\
+  --from-literal=uri="$OPENFGA_DB_URI" \\
+  --from-literal=username="$DB_USER" \\
+  --dry-run=client -o yaml | kubectl apply -f - -n $NAMESPACE
+EOF
+fi
+
+chmod +x "$OUTPUT_FILE"
+success "Secrets script written to: $OUTPUT_FILE"
+
+# ── Step 7: Generate values.yaml ─────────────────────────────────────────────
+header "Step 7 — Generating values.yaml"
+
+# Generate CSP header from protocol + domain
+PROTO="$APP_PROTOCOL"
+CDN1="${PROTO}://cdn.scalekit.com"
+CDN2="${PROTO}://cdn.scalekit.cloud"
+WILD="${PROTO}://*.${APP_DOMAIN}"
+
+CSP_HEADER="default-src 'self' ${CDN1} ${CDN2} ${WILD}; "
+CSP_HEADER+="style-src 'self' 'unsafe-inline' ${PROTO}://fonts.googleapis.com ${CDN1} ${CDN2} ${WILD}; "
+CSP_HEADER+="script-src 'self' ${CDN1} ${CDN2} ${WILD}; "
+CSP_HEADER+="connect-src 'self' ${CDN1} ${CDN2} ${WILD} wss://*.pusher.com; "
+CSP_HEADER+="font-src ${PROTO}://fonts.gstatic.com; "
+CSP_HEADER+="worker-src 'self' blob:; "
+CSP_HEADER+="img-src 'self' ${PROTO}: data:; "
+CSP_HEADER+="frame-src 'self' ${CDN1} ${CDN2} ${WILD};"
+
+VALUES_FILE="$(pwd)/values-${ENV_LABEL}-$(date +%Y%m%d%H%M%S).yaml"
+
+if [[ "$ENV_CHOICE" == "1" ]]; then
+  cat > "$VALUES_FILE" <<EOF
+replicaCount: ${REPLICA_COUNT}
+
+scalekit:
+  config:
+    app:
+      region: ${APP_REGION}
+      domain: "${APP_DOMAIN}"
+      protocol: "${APP_PROTOCOL}"
+      oidc:
+        allow_insecure: ${OIDC_ALLOW_INSECURE}
+    database:
+      host: "${DB_HOST}"
+      name: "${DB_NAME_SCALEKIT}"
+      user: "${DB_USER}"
+      port: ${DB_PORT}
+    redis:
+      host: ${REDIS_HOST}
+      port: ${REDIS_PORT}
+      db: ${REDIS_DB}
+    seedData:
+      adminUser:
+        firstName: "${ADMIN_FIRST_NAME}"
+        lastName: "${ADMIN_LAST_NAME}"
+        email: "${ADMIN_EMAIL}"
+      emailServer:
+        serverType: "SMTP"
+        provider: "OTHER"
+        enabled: true
+        idOffset: 1
+        settings:
+          fromEmail: "${EMAIL_FROM}"
+          fromName: "${EMAIL_FROM_NAME}"
+          host: "${SMTP_HOST}"
+          port: ${SMTP_PORT}
+          username: "${SMTP_USERNAME}"
+
+sidecars:
+  dashboard:
+    securityContext:
+      runAsUser: 0
+      runAsGroup: 0
+    env:
+      - name: CSP_HEADER
+        value: "${CSP_HEADER}"
+  svix:
+    config:
+      region: "${APP_REGION}"
+      defaultRegion: "${APP_REGION}"
+
+ingress:
+  enabled: true
+  className: "nginx"
+
+resourceMetadata:
+  ingress:
+    annotations:
+      nginx.ingress.kubernetes.io/proxy-buffer-size: "50m"
+      nginx.ingress.kubernetes.io/proxy-buffers-number: "4"
+      nginx.ingress.kubernetes.io/proxy-body-size: "50m"
+EOF
+
+elif [[ "$ENV_CHOICE" == "2" ]]; then
+  cat > "$VALUES_FILE" <<EOF
+replicaCount: ${REPLICA_COUNT}
+
+scalekit:
+  service:
+    annotations:
+      cloud.google.com/neg: '{"exposed_ports":{"8888":{}}}'
+  config:
+    app:
+      region: ${APP_REGION}
+      domain: "${APP_DOMAIN}"
+    database:
+      host: "${DB_HOST}"
+      name: "${DB_NAME_SCALEKIT}"
+      user: "${DB_USER}"
+      port: ${DB_PORT}
+    redis:
+      host: ${REDIS_HOST}
+      port: ${REDIS_PORT}
+      db: ${REDIS_DB}
+    seedData:
+      adminUser:
+        firstName: "${ADMIN_FIRST_NAME}"
+        lastName: "${ADMIN_LAST_NAME}"
+        email: "${ADMIN_EMAIL}"
+      emailServer:
+        serverType: "SMTP"
+        provider: "OTHER"
+        enabled: true
+        idOffset: 1
+        settings:
+          fromEmail: "${EMAIL_FROM}"
+          fromName: "${EMAIL_FROM_NAME}"
+          host: "${SMTP_HOST}"
+          port: ${SMTP_PORT}
+          username: "${SMTP_USERNAME}"
+
+sidecars:
+  dashboard:
+    service:
+      annotations:
+        cloud.google.com/neg: '{"exposed_ports":{"8000":{}}}'
+    securityContext:
+      runAsUser: 0
+      runAsGroup: 0
+    env:
+      - name: CSP_HEADER
+        value: "${CSP_HEADER}"
+  flagd:
+    service:
+      annotations:
+        cloud.google.com/neg: '{"exposed_ports":{"8016":{}}}'
+  svix:
+    service:
+      annotations:
+        cloud.google.com/neg: '{"exposed_ports":{"8071":{}}}'
+    config:
+      region: "${APP_REGION}"
+      defaultRegion: "${APP_REGION}"
+$(if [[ "$OPENFGA_ENABLED" == "true" ]]; then echo "  openfga:
+    enabled: true
+    # storeId: \"\"
+    # modelId: \"\""; fi)
+
+gateway:
+  enabled: true
+  provider: gcp
+  className: "${GATEWAY_CLASS}"
+  annotations:
+    networking.gke.io/certmap: "${CERT_MAP_NAME}"
+  redirectToHttps: true
+  healthCheckPolicy:
+    enabled: true
+EOF
+
+else
+  cat > "$VALUES_FILE" <<EOF
+replicaCount: ${REPLICA_COUNT}
+
+scalekit:
+  config:
+    app:
+      region: ${APP_REGION}
+      domain: "${APP_DOMAIN}"
+    database:
+      host: "${DB_HOST}"
+      name: "${DB_NAME_SCALEKIT}"
+      user: "${DB_USER}"
+      port: ${DB_PORT}
+    redis:
+      host: ${REDIS_HOST}
+      port: ${REDIS_PORT}
+      db: ${REDIS_DB}
+    seedData:
+      adminUser:
+        firstName: "${ADMIN_FIRST_NAME}"
+        lastName: "${ADMIN_LAST_NAME}"
+        email: "${ADMIN_EMAIL}"
+      emailServer:
+        serverType: "SMTP"
+        provider: "OTHER"
+        enabled: true
+        idOffset: 1
+        settings:
+          fromEmail: "${EMAIL_FROM}"
+          fromName: "${EMAIL_FROM_NAME}"
+          host: "${SMTP_HOST}"
+          port: ${SMTP_PORT}
+          username: "${SMTP_USERNAME}"
+
+sidecars:
+  dashboard:
+    securityContext:
+      runAsUser: 0
+      runAsGroup: 0
+    env:
+      - name: CSP_HEADER
+        value: "${CSP_HEADER}"
+  svix:
+    config:
+      region: "${APP_REGION}"
+      defaultRegion: "${APP_REGION}"
+$(if [[ "$OPENFGA_ENABLED" == "true" ]]; then echo "  openfga:
+    enabled: true
+    # storeId: \"\"
+    # modelId: \"\""; fi)
+EOF
+fi
+
+success "values.yaml written to: $VALUES_FILE"
+
+# ── Step 8: Helm install command ─────────────────────────────────────────────
+header "Step 8 — Helm install"
+ask CHART_VERSION "Which version of the Scalekit chart do you want to install? (e.g. 0.1.0)"
+
+header "Done"
+echo
+success "Secrets script : $OUTPUT_FILE"
+success "values.yaml    : $VALUES_FILE"
+echo
+echo -e "${BOLD}${CYAN}┌─────────────────────────────────────────────────────────────┐${RESET}"
+echo -e "${BOLD}${CYAN}│                  before you proceed                         │${RESET}"
+echo -e "${BOLD}${CYAN}└─────────────────────────────────────────────────────────────┘${RESET}"
+echo
+echo -e "  Ensure the following databases exist on ${BOLD}${DB_HOST}:${DB_PORT}${RESET}"
+echo
+echo "    psql -h localhost -p $DB_PORT -U $DB_USER -d postgres -c '\l'"
+echo
+echo -e "  Expected databases:"
+echo -e "    ${GREEN}✓${RESET}  $DB_NAME_SCALEKIT    (Scalekit main application)"
+echo -e "    ${GREEN}✓${RESET}  $DB_NAME_SVIX        (Svix webhooks)"
+if [[ "$OPENFGA_ENABLED" == "true" ]]; then
+  echo -e "    ${GREEN}✓${RESET}  $DB_NAME_OPENFGA     (OpenFGA authorization)"
+fi
+echo
+echo -e "  If any database is missing, create it first:"
+echo "    psql -h localhost -p $DB_PORT -U $DB_USER -d postgres -c 'CREATE DATABASE $DB_NAME_SCALEKIT;'"
+echo "    psql -h localhost -p $DB_PORT -U $DB_USER -d postgres -c 'CREATE DATABASE $DB_NAME_SVIX;'"
+if [[ "$OPENFGA_ENABLED" == "true" ]]; then
+  echo "    psql -h localhost -p $DB_PORT -U $DB_USER -d postgres -c 'CREATE DATABASE $DB_NAME_OPENFGA;'"
+fi
+echo
+echo -e "${BOLD}${CYAN}┌─────────────────────────────────────────────────────────────┐${RESET}"
+echo -e "${BOLD}${CYAN}│              execute the following commands                  │${RESET}"
+echo -e "${BOLD}${CYAN}└─────────────────────────────────────────────────────────────┘${RESET}"
+echo
+echo "  bash $OUTPUT_FILE"
+echo
+echo "  helm install scalekit oci://ar.scalekit.cloud/scalekit/charts/scalekit \\"
+echo "    --version ${CHART_VERSION} \\"
+echo "    -n ${NAMESPACE} \\"
+echo "    --values=${VALUES_FILE}"
+echo
+echo -e "${BOLD}${CYAN}└─────────────────────────────────────────────────────────────┘${RESET}"
+
+if [[ "$ENV_CHOICE" == "1" ]]; then
+  echo
+  echo -e "${BOLD}${CYAN}┌─────────────────────────────────────────────────────────────┐${RESET}"
+  echo -e "${BOLD}${CYAN}│           Minikube — expose & access traffic                 │${RESET}"
+  echo -e "${BOLD}${CYAN}└─────────────────────────────────────────────────────────────┘${RESET}"
+  echo
+  dim "  1. Enable the ingress addon:"
+  echo "     minikube addons enable ingress"
+  echo
+  dim "  2. Patch the ingress controller to type LoadBalancer:"
+  echo "     kubectl patch svc ingress-nginx-controller \\"
+  echo "       -n ingress-nginx \\"
+  echo "       -p '{\"spec\": {\"type\": \"LoadBalancer\"}}'"
+  echo
+  dim "  3. Start Minikube tunnel (keep this running in a separate terminal):"
+  echo "     minikube tunnel"
+  echo
+  dim "  4. Add entries to /etc/hosts (requires sudo):"
+  echo "     sudo sh -c 'echo \"127.0.0.1 app.${APP_DOMAIN} auth.${APP_DOMAIN}\" >> /etc/hosts'"
+  echo
+  dim "     Or add manually — open /etc/hosts and append this line:"
+  echo "     127.0.0.1  app.${APP_DOMAIN}  auth.${APP_DOMAIN}"
+  echo
+  dim "  5. Update CoreDNS so pods inside the cluster can resolve app.${APP_DOMAIN} and auth.${APP_DOMAIN}:"
+  echo
+  dim "     Open the CoreDNS ConfigMap and find the IP already assigned to host.minikube.internal."
+  dim "     Add two more entries pointing to that same IP:"
+  echo
+  echo "        kubectl edit configmap coredns -n kube-system"
+  echo
+  echo "        # Inside the hosts { } block, add:"
+  echo "        <host.minikube.internal IP>  app.${APP_DOMAIN}"
+  echo "        <host.minikube.internal IP>  auth.${APP_DOMAIN}"
+  echo
+  dim "     Then restart CoreDNS to apply:"
+  echo "        kubectl rollout restart deployment coredns -n kube-system"
+  echo
+  echo "${BOLD}${CYAN}└─────────────────────────────────────────────────────────────┘${RESET}"
+fi
+```
diff --git a/src/content/docs/self-hosted/system-requirements.mdx b/src/content/docs/self-hosted/system-requirements.mdx
new file mode 100644
index 000000000..a096f8483
--- /dev/null
+++ b/src/content/docs/self-hosted/system-requirements.mdx
@@ -0,0 +1,110 @@
+---
+title: System requirements
+description: Kubernetes, database, and network requirements for a self-hosted Scalekit deployment.
+sidebar:
+  label: System requirements
+  order: 3
+tags: [self-hosted, requirements, kubernetes, prerequisites]
+tableOfContents: true
+prev:
+  label: Quick start
+  link: /self-hosted/quickstart/
+next:
+  label: Configure Scalekit
+  link: /self-hosted/configuration/
+---
+
+import { Aside } from '@astrojs/starlight/components'
+import { REGISTRY_HOST, DISTR_URL } from '../../../configs/self-hosted'
+
+Before installing Scalekit, confirm your infrastructure meets the requirements below.
+
+## Kubernetes
+
+| Requirement | Value |
+|-------------|-------|
+| Kubernetes version | 1.27 or later |
+| Helm version | 3.12 or later |
+| `kubectl` | Configured with cluster access |
+
+Any managed Kubernetes service works — GKE, EKS, AKS, or a self-managed cluster.
+
+Scalekit supports two ingress options — use one, not both:
+
+- **Kubernetes Gateway API** (recommended for cloud clusters): requires a GatewayClass installed on your cluster
+- **Nginx Ingress** (for local or Minikube deployments): requires the nginx ingress controller
+
+For Gateway API, common GatewayClasses:
+
+| Provider | GatewayClass |
+|----------|-------------|
+| GKE | `gke-l7-global-external-managed` (built-in) |
+| Istio | `istio` |
+| Envoy Gateway | `eg` |
+
+On GKE, the Gateway controller is enabled by default. For other clusters, install the Gateway API CRDs and a compatible controller before deploying Scalekit.
+
+## PostgreSQL
+
+Scalekit requires **three separate databases** on PostgreSQL 15 or later. These can all live on the same PostgreSQL instance.
+
+| Database | Used by |
+|----------|---------|
+| `scalekit` | Core auth service |
+| `webhooks` | Webhook delivery |
+| `openfga` | Authorization engine (if enabled) |
+
+Create a dedicated user with full privileges on each database. Scalekit runs migrations automatically on install and upgrade.
+
+<Aside type="tip" title="Evaluation without external PostgreSQL">
+  The Helm chart includes an optional PostgreSQL subchart. Set `postgresql.enabled: true` in your `values.yaml` to spin up a bundled database for evaluation. Do not use this in production.
+</Aside>
+
+<Aside type="tip" title="CockroachDB">
+  CockroachDB is also supported. Set `DB_ADAPTER=postgresql` in the `db-migrations` secret (the setup script handles this automatically).
+</Aside>
+
+## Redis
+
+| Requirement | Value |
+|-------------|-------|
+| Version | 6.2 or later |
+
+Scalekit uses Redis for session storage, token caching, and background job queues. Redis does not need persistence enabled, but enabling RDB snapshots is recommended for production.
+
+<Aside type="tip" title="Evaluation without external Redis">
+  The Helm chart includes an optional Redis subchart. Set `redis.enabled: true` in your `values.yaml` to use it for evaluation. Do not use this in production.
+</Aside>
+
+## Email (SMTP)
+
+Scalekit sends transactional email for password resets, magic links, and user invitations. You need an SMTP provider configured before first run.
+
+Supported providers with first-class integration: **Postmark**, **SendGrid**. Any SMTP server works with the `OTHER` provider type.
+
+## Node sizing
+
+| Resource | Production (per node) |
+|----------|-----------------------|
+| CPU | 4 vCPUs |
+| RAM | 8 GB |
+
+The Scalekit Deployment defaults to 2 replicas with autoscaling up to 20. Each replica includes all sidecar containers. Tune `replicaCount` and HPA settings in your `values.yaml`.
+
+## Network and DNS
+
+### DNS
+
+A wildcard DNS record pointing to your Gateway's external IP is required. You set this up after the deployment is running — see [Install Scalekit](/self-hosted/installation/#update-dns).
+
+### TLS
+
+HTTPS is required. Manage certificates through your cloud provider's certificate manager (for example, GCP Certificate Manager) and reference it via a Gateway annotation. cert-manager is also supported — add the appropriate annotation to `gateway.annotations` in your `values.yaml`.
+
+## Container registry access
+
+Scalekit container images are hosted on <code>{REGISTRY_HOST}</code>. You receive registry credentials through the <a href={DISTR_URL}>Scalekit distribution portal</a> as part of onboarding. The registry token is stored as a Kubernetes image pull secret (`artifact-registry-secret`) during setup.
+
+## Next step
+
+Once your infrastructure is ready, proceed to [configure Scalekit](/self-hosted/configuration/).
diff --git a/src/content/docs/self-hosted/troubleshooting.mdx b/src/content/docs/self-hosted/troubleshooting.mdx
new file mode 100644
index 000000000..f0c89ba3c
--- /dev/null
+++ b/src/content/docs/self-hosted/troubleshooting.mdx
@@ -0,0 +1,122 @@
+---
+title: Troubleshooting
+description: Diagnose and fix common issues with a self-hosted Scalekit deployment on Kubernetes.
+sidebar:
+  label: Troubleshooting
+  order: 6
+tags: [self-hosted, troubleshooting, kubernetes, helm, debugging]
+tableOfContents: true
+prev:
+  label: Upgrades & maintenance
+  link: /self-hosted/upgrades/
+---
+
+import { Code } from '@astrojs/starlight/components'
+import { REGISTRY_HOST } from '../../../configs/self-hosted'
+
+export const registrySecretCmd = `kubectl create secret docker-registry artifact-registry-secret \\\n  --docker-server=${REGISTRY_HOST} \\\n  --docker-username=oauth2accesstoken \\\n  --docker-password=<your-registry-token> \\\n  -n <namespace>`
+
+## Check pod status first
+
+Before investigating specific errors, confirm which pods are unhealthy:
+
+```bash
+kubectl get pods -n scalekit
+kubectl describe pod <pod-name> -n scalekit
+kubectl logs <pod-name> -n scalekit --tail=100
+```
+
+For the Scalekit pod (which runs multiple containers), specify the container:
+
+```bash
+# Main auth service
+kubectl logs <pod-name> -n scalekit -c scalekit --tail=100
+
+# Dashboard
+kubectl logs <pod-name> -n scalekit -c dashboard --tail=100
+
+# Svix
+kubectl logs <pod-name> -n scalekit -c svix --tail=100
+```
+
+---
+
+## Helm install failures
+
+### `ImagePullBackOff` or `ErrImagePull`
+
+**Cause**: The cluster cannot pull images from `ar.scalekit.cloud` — usually a missing or incorrect registry secret.
+
+**Fix**:
+
+1. Confirm the `artifact-registry-secret` exists:
+   ```bash
+   kubectl get secret artifact-registry-secret -n scalekit
+   ```
+2. If missing, re-run the setup script or recreate it manually:
+   <Code lang="bash" code={registrySecretCmd} />
+3. Verify the token is current — registry tokens from distr.sh may expire.
+
+---
+
+### Migration hook fails or times out
+
+**Cause**: The `db-migrations` pre-install hook cannot connect to PostgreSQL.
+
+**Fix**:
+
+1. Check the migration job logs:
+   ```bash
+   kubectl get jobs -n scalekit
+   kubectl logs job/scalekit-db-migrations -n scalekit
+   ```
+2. Confirm the `DATABASE_URL` in the `db-migrations` secret is correct and the database host is reachable from the cluster.
+3. Confirm the database and user exist and the user has full privileges.
+
+---
+
+### Pod stuck in `CrashLoopBackOff`
+
+**Cause**: A required secret key is missing, or a configuration value is incorrect.
+
+**Fix**:
+
+1. Check the pod logs for the startup error:
+   ```bash
+   kubectl logs <pod-name> -n scalekit -c scalekit --previous
+   ```
+2. Common causes:
+   - Missing key in `authentication-secret` — re-run `setup-secrets.sh`
+   - `database.host` or `redis.host` in `values.yaml` is unreachable from the cluster
+   - `domain` in `values.yaml` does not match the gateway hostname
+
+---
+
+## Gateway issues
+
+### Gateway has no external IP
+
+**Cause**: The GatewayClass is not installed, or the Gateway controller is not running.
+
+**Fix**:
+
+```bash
+kubectl get gateway -n scalekit
+kubectl describe gateway scalekit -n scalekit
+```
+
+Check that `gateway.className` in your `values.yaml` matches an installed GatewayClass:
+
+```bash
+kubectl get gatewayclass
+```
+
+On GKE, confirm the GKE Gateway controller is enabled in your cluster settings.
+
+---
+
+## Get support
+
+If the issue is not covered here:
+
+- **Community**: Join the [Scalekit Slack community](https://join.slack.com/t/scalekit-community/shared_invite/zt-3gsxwr4hc-0tvhwT2b_qgVSIZQBQCWRw) in the `#self-hosted` channel.
diff --git a/src/content/docs/self-hosted/upgrades.mdx b/src/content/docs/self-hosted/upgrades.mdx
new file mode 100644
index 000000000..141800138
--- /dev/null
+++ b/src/content/docs/self-hosted/upgrades.mdx
@@ -0,0 +1,77 @@
+---
+title: Upgrades & maintenance
+description: How to upgrade your self-hosted Scalekit deployment and perform routine maintenance tasks.
+sidebar:
+  label: Upgrades & maintenance
+  order: 7
+tags: [self-hosted, upgrades, maintenance, helm, kubernetes]
+tableOfContents: true
+prev:
+  label: Installation
+  link: /self-hosted/installation/
+next:
+  label: Troubleshooting
+  link: /self-hosted/troubleshooting/
+---
+
+import { Steps, Aside } from '@astrojs/starlight/components'
+import { DISTR_URL } from '../../../configs/self-hosted'
+
+## Upgrade Scalekit
+
+New versions are available through the <a href={DISTR_URL}>Scalekit distribution portal</a>. Upgrades are performed through the portal — the Distr agent running in your cluster picks up the change and applies it automatically. Database migrations run before the new pods start.
+
+<Steps>
+1. ## Select the new version in the portal
+
+   Log in to the <a href={DISTR_URL}>Scalekit distribution portal</a>. In the left sidebar, click **Deployments** and select your deployment.
+
+   - Click **Edit deployment**
+   - Under **Version**, select the new version
+   - Click **Update deployment**
+
+   The portal notifies the Distr agent in your cluster. No manual `kubectl` command is needed.
+
+2. ## Monitor the upgrade
+
+   The Distr agent handles chart delivery and migration sequencing. Check its logs to follow progress:
+
+   ```bash
+   kubectl logs -l app=distr-agent -n <namespace> --tail=100 -f
+   ```
+
+3. ## Verify the upgrade
+
+   ```bash
+   kubectl get pods -n <namespace>
+   kubectl rollout status deployment/scalekit -n <namespace>
+   ```
+
+</Steps>
+
+## Roll back an upgrade
+
+If an upgrade causes issues, roll back using Helm:
+
+```bash
+# List revisions
+helm history scalekit -n <namespace>
+
+# Roll back to the previous revision
+helm rollback scalekit -n <namespace>
+```
+
+## Renew TLS certificates
+
+TLS certificates are managed through your cloud provider's certificate manager (for example, GCP Certificate Manager) or cert-manager. Renew certificates through your provider — the gateway picks up the updated certificate automatically without restarting Scalekit.
+
+## Routine maintenance tasks
+
+| Task | Frequency | Action |
+|------|-----------|--------|
+| Review auth logs | Daily | Admin dashboard → **Audit logs** |
+| Check pod health | Daily | `kubectl get pods -n <namespace>` |
+| Rotate Redis cache | As needed | Automatic — expired keys are evicted by Redis TTL |
+| Back up databases | Regular | Take consistent backups of your PostgreSQL databases |
+| Rotate registry token | Before expiry | Create a new token in the portal, update `artifact-registry-secret`, restart pods |
+| Rotate individual secrets | Per policy | Edit the specific Kubernetes secret directly and restart pods |