diff --git a/.claude/launch.json b/.claude/launch.json
new file mode 100644
index 0000000000..c7114451db
--- /dev/null
+++ b/.claude/launch.json
@@ -0,0 +1,11 @@
+{
+  "version": "0.0.1",
+  "configurations": [
+    {
+      "name": "web",
+      "runtimeExecutable": "npm",
+      "runtimeArgs": ["run", "dev", "--", "--port", "5199", "--strictPort"],
+      "port": 5199
+    }
+  ]
+}
diff --git a/internal/httpapi/auth.go b/internal/httpapi/auth.go
index 5c1b711a65..0c61aab56f 100644
--- a/internal/httpapi/auth.go
+++ b/internal/httpapi/auth.go
@@ -2,11 +2,16 @@ package httpapi
 
 import (
 	"crypto/subtle"
+	"encoding/json"
 	"net/http"
 	"strings"
 )
 
-// requireAuth gates protected endpoints behind a static bearer token.
+const sessionCookieName = "dm_session"
+
+// requireAuth gates protected endpoints behind a static bearer token, supplied
+// either as an Authorization header or as the HttpOnly session cookie set by
+// the login endpoint.
 //
 // The token is supplied via the API_TOKEN environment variable. Local
 // development can explicitly disable auth through AUTH_DISABLED=true.
@@ -14,7 +19,7 @@ func requireAuth(token string) func(http.Handler) http.Handler {
 	expected := []byte(token)
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			if !validBearerToken(r.Header.Get("Authorization"), expected) {
+			if !validBearerToken(r.Header.Get("Authorization"), expected) && !validSessionRequest(r, expected) {
 				w.Header().Set("WWW-Authenticate", "Bearer")
 				writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "unauthorized"})
 				return
@@ -35,3 +40,77 @@ func validBearerToken(header string, expected []byte) bool {
 	}
 	return subtle.ConstantTimeCompare(presented, expected) == 1
 }
+
+// ponytail: the cookie stores the API token itself (HttpOnly, so scripts can't
+// read it). Move to signed random session IDs if per-session revocation is needed.
+func validSessionCookie(r *http.Request, expected []byte) bool {
+	cookie, err := r.Cookie(sessionCookieName)
+	if err != nil || cookie.Value == "" {
+		return false
+	}
+	return subtle.ConstantTimeCompare([]byte(cookie.Value), expected) == 1
+}
+
+func validSessionRequest(r *http.Request, expected []byte) bool {
+	if !validSessionCookie(r, expected) {
+		return false
+	}
+	switch r.Method {
+	case http.MethodGet, http.MethodHead, http.MethodOptions:
+		return true
+	default:
+		origin := strings.TrimSpace(r.Header.Get("Origin"))
+		return strings.HasPrefix(strings.ToLower(origin), "https://") && sameHostOrigin(origin, r.Host)
+	}
+}
+
+func sessionCookie(r *http.Request, auth AuthConfig, value string, maxAge int) *http.Cookie {
+	return &http.Cookie{
+		Name:     sessionCookieName,
+		Value:    value,
+		Path:     "/",
+		MaxAge:   maxAge,
+		HttpOnly: true,
+		Secure:   !auth.Disabled || r.TLS != nil,
+		SameSite: http.SameSiteLaxMode,
+	}
+}
+
+// login exchanges the API token for the HttpOnly session cookie.
+func login(auth AuthConfig) http.HandlerFunc {
+	expected := []byte(auth.Token)
+	return func(w http.ResponseWriter, r *http.Request) {
+		var body struct {
+			Token string `json:"token"`
+		}
+		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+			writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request body"})
+			return
+		}
+		if !auth.Disabled && subtle.ConstantTimeCompare([]byte(body.Token), expected) != 1 {
+			writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "invalid token"})
+			return
+		}
+		http.SetCookie(w, sessionCookie(r, auth, auth.Token, 30*24*60*60))
+		w.WriteHeader(http.StatusNoContent)
+	}
+}
+
+func logout(auth AuthConfig) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		http.SetCookie(w, sessionCookie(r, auth, "", -1))
+		w.WriteHeader(http.StatusNoContent)
+	}
+}
+
+// session reports whether the request is authenticated so the SPA can decide
+// between the login page and the app shell without triggering a 401.
+func session(auth AuthConfig) http.HandlerFunc {
+	expected := []byte(auth.Token)
+	return func(w http.ResponseWriter, r *http.Request) {
+		authenticated := auth.Disabled ||
+			validBearerToken(r.Header.Get("Authorization"), expected) ||
+			validSessionCookie(r, expected)
+		writeJSON(w, http.StatusOK, map[string]bool{"authenticated": authenticated})
+	}
+}
diff --git a/internal/httpapi/auth_test.go b/internal/httpapi/auth_test.go
index 30481f4f89..a567082160 100644
--- a/internal/httpapi/auth_test.go
+++ b/internal/httpapi/auth_test.go
@@ -3,6 +3,7 @@ package httpapi
 import (
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 )
 
@@ -90,6 +91,100 @@ func TestAuthRejectsQueryToken(t *testing.T) {
 	}
 }
 
+func TestLoginLogoutSessionFlow(t *testing.T) {
+	const token = "supersecrettoken123"
+	handler := New(nil, nil, nil, nil, nil, GitHubWebhookConfig{}, nil, "", AuthConfig{Token: token})
+
+	// Wrong token is rejected and sets no cookie.
+	response := httptest.NewRecorder()
+	request := httptest.NewRequest(http.MethodPost, "/api/login", strings.NewReader(`{"token":"wrong"}`))
+	handler.ServeHTTP(response, request)
+	if response.Code != http.StatusUnauthorized {
+		t.Fatalf("expected 401 for wrong login token, got %d", response.Code)
+	}
+	if len(response.Result().Cookies()) != 0 {
+		t.Fatal("failed login must not set a cookie")
+	}
+
+	// Correct token sets the HttpOnly session cookie.
+	response = httptest.NewRecorder()
+	request = httptest.NewRequest(http.MethodPost, "/api/login", strings.NewReader(`{"token":"`+token+`"}`))
+	handler.ServeHTTP(response, request)
+	if response.Code != http.StatusNoContent {
+		t.Fatalf("expected 204 for valid login, got %d", response.Code)
+	}
+	cookies := response.Result().Cookies()
+	if len(cookies) != 1 || cookies[0].Name != sessionCookieName || !cookies[0].HttpOnly || !cookies[0].Secure {
+		t.Fatalf("expected one HttpOnly Secure %s cookie, got %+v", sessionCookieName, cookies)
+	}
+
+	// The session endpoint recognizes the cookie.
+	response = httptest.NewRecorder()
+	request = httptest.NewRequest(http.MethodGet, "/api/session", nil)
+	request.AddCookie(cookies[0])
+	handler.ServeHTTP(response, request)
+	if response.Code != http.StatusOK || !strings.Contains(response.Body.String(), `"authenticated":true`) {
+		t.Fatalf("expected authenticated session with cookie, got %d %s", response.Code, response.Body.String())
+	}
+
+	// Logout clears the cookie.
+	response = httptest.NewRecorder()
+	request = httptest.NewRequest(http.MethodPost, "/api/logout", nil)
+	handler.ServeHTTP(response, request)
+	cleared := response.Result().Cookies()
+	if len(cleared) != 1 || cleared[0].Value != "" || cleared[0].MaxAge >= 0 || !cleared[0].Secure {
+		t.Fatalf("expected logout to expire the session cookie, got %+v", cleared)
+	}
+
+	// Without a cookie the session reports unauthenticated.
+	response = httptest.NewRecorder()
+	request = httptest.NewRequest(http.MethodGet, "/api/session", nil)
+	handler.ServeHTTP(response, request)
+	if response.Code != http.StatusOK || !strings.Contains(response.Body.String(), `"authenticated":false`) {
+		t.Fatalf("expected unauthenticated session without cookie, got %d %s", response.Code, response.Body.String())
+	}
+}
+
+func TestCookieAuthRequiresSameOriginForUnsafeMethods(t *testing.T) {
+	const token = "supersecrettoken123"
+	protected := requireAuth(token)(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	tests := []struct {
+		name   string
+		method string
+		origin string
+		bearer bool
+		want   int
+	}{
+		{name: "safe cookie request", method: http.MethodGet, want: http.StatusNoContent},
+		{name: "same-origin cookie request", method: http.MethodPost, origin: "https://deploy.internal.prosights.co", want: http.StatusNoContent},
+		{name: "missing origin", method: http.MethodPost, want: http.StatusUnauthorized},
+		{name: "insecure same-host origin", method: http.MethodPost, origin: "http://deploy.internal.prosights.co", want: http.StatusUnauthorized},
+		{name: "cross-origin cookie request", method: http.MethodPost, origin: "https://other.prosights.co", want: http.StatusUnauthorized},
+		{name: "bearer automation", method: http.MethodPost, bearer: true, want: http.StatusNoContent},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			response := httptest.NewRecorder()
+			request := httptest.NewRequest(test.method, "https://deploy.internal.prosights.co/api/protected", nil)
+			if test.bearer {
+				request.Header.Set("Authorization", "Bearer "+token)
+			} else {
+				request.AddCookie(&http.Cookie{Name: sessionCookieName, Value: token})
+			}
+			if test.origin != "" {
+				request.Header.Set("Origin", test.origin)
+			}
+			protected.ServeHTTP(response, request)
+			if response.Code != test.want {
+				t.Fatalf("expected %d, got %d", test.want, response.Code)
+			}
+		})
+	}
+}
+
 func TestValidBearerTokenConstantTime(t *testing.T) {
 	expected := []byte("supersecrettoken123")
 	cases := []struct {
diff --git a/internal/httpapi/security.go b/internal/httpapi/security.go
index 7c01da4a4b..3abb23af18 100644
--- a/internal/httpapi/security.go
+++ b/internal/httpapi/security.go
@@ -1,6 +1,9 @@
 package httpapi
 
-import "net/http"
+import (
+	"net/http"
+	"strings"
+)
 
 func securityHeaders(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -12,3 +15,8 @@ func securityHeaders(next http.Handler) http.Handler {
 		next.ServeHTTP(w, r)
 	})
 }
+
+func sameHostOrigin(origin string, host string) bool {
+	origin = strings.TrimSpace(strings.TrimPrefix(strings.TrimPrefix(origin, "http://"), "https://"))
+	return strings.EqualFold(origin, host)
+}
diff --git a/internal/httpapi/server.go b/internal/httpapi/server.go
index 172308b85a..9e4a8d8b98 100644
--- a/internal/httpapi/server.go
+++ b/internal/httpapi/server.go
@@ -88,6 +88,10 @@ func New(queries *db.Queries, tx transactionStarter, queue DeploymentQueue, logs
 		r.Get("/healthz", server.health)
 		r.Get("/readyz", server.readyz)
 		r.Get("/version", server.version)
+		// Tighter limit on login: it is the only credential-guessing surface.
+		r.With(rateLimit(20, 1*time.Minute)).Post("/login", login(auth))
+		r.Post("/logout", logout(auth))
+		r.Get("/session", session(auth))
 		r.Post("/webhooks/github", server.githubWebhook)
 		r.Post("/github/webhook", server.githubWebhook)
 		r.Get("/github/install/callback", server.githubInstallCallback)
diff --git a/internal/httpapi/server_terminal.go b/internal/httpapi/server_terminal.go
index ffb2197555..609fd76cec 100644
--- a/internal/httpapi/server_terminal.go
+++ b/internal/httpapi/server_terminal.go
@@ -273,11 +273,6 @@ func websocketUpgrader() websocket.Upgrader {
 	}
 }
 
-func sameHostOrigin(origin string, host string) bool {
-	origin = strings.TrimSpace(strings.TrimPrefix(strings.TrimPrefix(origin, "http://"), "https://"))
-	return strings.EqualFold(origin, host)
-}
-
 type terminalWriter struct {
 	mu   sync.Mutex
 	conn *websocket.Conn
diff --git a/package-lock.json b/package-lock.json
index df89468a7a..5368bb4324 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6,7 +6,7 @@
     "": {
       "name": "deploy-manager",
       "dependencies": {
-        "@fontsource/uncut-sans": "^5.2.5",
+        "@fontsource-variable/inter": "^5.3.0",
         "@radix-ui/react-dialog": "^1.1.19",
         "@radix-ui/react-dropdown-menu": "^2.1.20",
         "@radix-ui/react-select": "^2.3.3",
@@ -143,6 +143,7 @@
       "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz",
       "integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.29.7",
         "@babel/generator": "^7.29.7",
@@ -476,6 +477,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=20.19.0"
       },
@@ -524,6 +526,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=20.19.0"
       }
@@ -1128,10 +1131,10 @@
       "integrity": "sha512-HpCo8tmWzLVad5s2d19EhAz5zqrrQ6s69qd6moPMQvkOuSwDT1YgRfWSVuc4ennqrgv3OHppiOGMQ7oC13yIww==",
       "license": "MIT"
     },
-    "node_modules/@fontsource/uncut-sans": {
-      "version": "5.2.5",
-      "resolved": "https://registry.npmjs.org/@fontsource/uncut-sans/-/uncut-sans-5.2.5.tgz",
-      "integrity": "sha512-3T4+r2JHVpPsDLMCPR9uhgIxIEyvRmP0TQKerHiUUHJqgxlGfjjOs35gXHhkrXk3sbHGIUCJ6bFx47Ttk/7kvA==",
+    "node_modules/@fontsource-variable/inter": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/@fontsource-variable/inter/-/inter-5.3.0.tgz",
+      "integrity": "sha512-OupL48va4JNofb97w6NYeF9S7W/kHNKM0Er8Dem5nqi4jeOLrVJDoE8tZEpnMJmtkvNbB1EIPPwHcdkF6b1oUA==",
       "license": "OFL-1.1",
       "funding": {
         "url": "https://github.com/sponsors/ayuhito"
@@ -2977,8 +2980,7 @@
       "resolved": "https://registry.npmjs.org/@types/aria-query/-/aria-query-5.0.4.tgz",
       "integrity": "sha512-rfT93uj5s0PRL7EzccGMs3brplhcrghnDoV26NqKhCAS1hVo+WdNsPvE/yb6ilfr5hi2MEk6d5EWJTKdxg8jVw==",
       "dev": true,
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/@types/babel__core": {
       "version": "7.20.5",
@@ -3065,6 +3067,7 @@
       "integrity": "sha512-dszCsrKb5U7ZsVZBWiHFklTloVl0mSEnWH/iZXfZUlI4rzCUnsvGmgqfuVRHL54ugE7/wRuxEIXRa2iMZ+BG6g==",
       "devOptional": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "undici-types": ">=7.24.0 <7.24.7"
       }
@@ -3075,6 +3078,7 @@
       "integrity": "sha512-MXfmqaVPEVgkBT/aY0aGCkRWWtByiYQXo3xdQ8r5RzuFrPiRn8Gar2tQdXSUQ2GKV3bkXckek89V8wQBY2Q/Aw==",
       "devOptional": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "csstype": "^3.2.2"
       }
@@ -3085,6 +3089,7 @@
       "integrity": "sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ==",
       "devOptional": true,
       "license": "MIT",
+      "peer": true,
       "peerDependencies": {
         "@types/react": "^19.2.0"
       }
@@ -3134,6 +3139,7 @@
       "integrity": "sha512-dzHeT2gySzZtLDsuqxU9AkYgIsQoHAHtRBpOqM+Ofzx1Bwrd2RcCjQJ+6iQbsHOIR6NS33bF2W1k3blN1zLDrA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@typescript-eslint/scope-manager": "8.62.0",
         "@typescript-eslint/types": "8.62.0",
@@ -3486,6 +3492,7 @@
       "integrity": "sha512-xRQbDb9BnwDafYNn6Vwl839DYVjqXYb1XVGtWAZ1kcDc6iwAL4hg3B1dZlRiuENFeO2H53gFG3in621AdERVAg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -3536,7 +3543,6 @@
       "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=8"
       }
@@ -3547,7 +3553,6 @@
       "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=10"
       },
@@ -3651,6 +3656,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "baseline-browser-mapping": "^2.10.38",
         "caniuse-lite": "^1.0.30001799",
@@ -3882,8 +3888,7 @@
       "resolved": "https://registry.npmjs.org/dom-accessibility-api/-/dom-accessibility-api-0.5.16.tgz",
       "integrity": "sha512-X7BJ2yElsnOJ30pZF4uIIDfBEVgF4XEBxL9Bxhy6dnrm5hkzqmsWHGTiHqRiITNhMyFLyAiWndIJP7Z1NTteDg==",
       "dev": true,
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/electron-to-chromium": {
       "version": "1.5.377",
@@ -3993,6 +3998,7 @@
       "integrity": "sha512-6lVbcqSodALYo+4ELD0heG6lFiFxnLMuLkiMi2qV8LMp54N8tE8FT1GMH+ev4Ti00nFjNze2+Su6DsV5OQW3Dg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "workspaces": [
         "packages/*"
       ],
@@ -4500,6 +4506,7 @@
       "integrity": "sha512-mjzqwWRD9Y1J1KUi7W97Gja1bwOOM5Ug0EZ6UDK3xS7j7mndrkwozHtSblfomlzyB4NepioNt+B2sOSzczVgtQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@acemir/cssom": "^0.9.28",
         "@asamuzakjp/dom-selector": "^6.7.6",
@@ -4643,7 +4650,6 @@
       "integrity": "sha512-h5bgJWpxJNswbU7qCrV0tIKQCaS3blPDrqKWx+QxzuzL1zGUzij9XCWLrSLsJPu5t+eWA/ycetzYAO5IOMcWAQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "bin": {
         "lz-string": "bin/bin.js"
       }
@@ -4845,6 +4851,7 @@
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
       "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -4896,7 +4903,6 @@
       "integrity": "sha512-Qb1gy5OrP5+zDf2Bvnzdl3jsTf1qXVMazbvCoKhtKqVs4/YK4ozX4gKQJJVyNe+cajNPn0KoC0MC3FUmaHWEmQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "ansi-regex": "^5.0.1",
         "ansi-styles": "^5.0.0",
@@ -4921,6 +4927,7 @@
       "resolved": "https://registry.npmjs.org/react/-/react-19.2.7.tgz",
       "integrity": "sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=0.10.0"
       }
@@ -4930,6 +4937,7 @@
       "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.7.tgz",
       "integrity": "sha512-t0BRVXvbiE/o20Hfw669rLbMCDWtYZLvmJigy2f0MxsXF+71pxhR3xOkspmsO8h3ZlNzyibAmtCa3l4lYKk6gQ==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "scheduler": "^0.27.0"
       },
@@ -4942,8 +4950,7 @@
       "resolved": "https://registry.npmjs.org/react-is/-/react-is-17.0.2.tgz",
       "integrity": "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w==",
       "dev": true,
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/react-refresh": {
       "version": "0.18.0",
@@ -5124,6 +5131,7 @@
       "resolved": "https://registry.npmjs.org/seroval/-/seroval-1.5.4.tgz",
       "integrity": "sha512-46uFvgrXTVxZcUorgSSRZ4y+ieqLLQRMlG4bnCZKW3qI6BZm7Rg4ntMW4p1mILEEBZWrFlcpp0AyIIlM6jD9iw==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=10"
       }
@@ -5378,6 +5386,7 @@
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "dev": true,
       "license": "Apache-2.0",
+      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -5514,6 +5523,7 @@
       "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.5.tgz",
       "integrity": "sha512-KuOaNhcnGFN2zIPGA7wRmzF+lJA1sea7rHq17aiJ++9lzY1WWG6Jpwqwe1KNbRVPIqHmr8GLYx7jbrQcN/7/ww==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "esbuild": "^0.27.0",
         "fdir": "^6.5.0",
@@ -5827,6 +5837,7 @@
       "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
       }
diff --git a/package.json b/package.json
index 49da0586a5..7bd29b8630 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
     "lint": "eslint web/src"
   },
   "dependencies": {
-    "@fontsource/uncut-sans": "^5.2.5",
+    "@fontsource-variable/inter": "^5.3.0",
     "@radix-ui/react-dialog": "^1.1.19",
     "@radix-ui/react-dropdown-menu": "^2.1.20",
     "@radix-ui/react-select": "^2.3.3",
diff --git a/web/src/components/app-shell.test.tsx b/web/src/components/app-shell.test.tsx
index 474f523a46..02b56d15d6 100644
--- a/web/src/components/app-shell.test.tsx
+++ b/web/src/components/app-shell.test.tsx
@@ -83,14 +83,14 @@ describe('AppShell', () => {
     expect(screen.queryByRole('link', { name: 'Back to projects' })).not.toBeInTheDocument()
   })
 
-  it('opens the account menu with identity only', () => {
+  it('opens the account menu with identity and logout', () => {
     render(<AppShell />)
 
     fireEvent.pointerDown(screen.getByRole('button', { name: / account$/ }), { button: 0, ctrlKey: false })
 
     expect(screen.getByText('User')).toBeInTheDocument()
     expect(screen.getByText(/\S+@\S+\.\S+/)).toBeInTheDocument()
-    expect(screen.queryByText('Log Out')).not.toBeInTheDocument()
+    expect(screen.getByText('Log Out')).toBeInTheDocument()
     fireEvent.keyDown(document, { key: 'Escape' })
   })
 })
diff --git a/web/src/components/app-shell.tsx b/web/src/components/app-shell.tsx
index 1389b3e500..d9818cc8d1 100644
--- a/web/src/components/app-shell.tsx
+++ b/web/src/components/app-shell.tsx
@@ -1,13 +1,16 @@
 import { Link, Outlet, useLocation } from '@tanstack/react-router'
-import { Bell, Cable, Ellipsis, FileClock, FolderKanban, Monitor, Moon, PanelLeftClose, PanelLeftOpen, Rocket, Server, Sun } from 'lucide-react'
+import { Bell, Cable, Ellipsis, FileClock, FolderKanban, LogOut, Monitor, Moon, PanelLeftClose, PanelLeftOpen, Rocket, Server, Sun } from 'lucide-react'
 import { useQuery, useSuspenseQueries } from '@tanstack/react-query'
 import { Suspense, useEffect, useState } from 'react'
 import { appVersionQuery, projectsQuery } from '../lib/queries'
 import { nextTheme, useUiStore } from '../store/ui'
 import { Button } from './ui/button'
+import { logout } from '../lib/api'
 import {
   DropdownMenu,
   DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuSeparator,
   DropdownMenuTrigger,
 } from './ui/dropdown-menu'
 import {
@@ -64,8 +67,11 @@ export function AppShell() {
       }}
       className="text-prosights-text"
     >
-      <Sidebar collapsible="icon" className="border-prosights-border bg-prosights-surface">
-        <SidebarHeader className="h-[60px] justify-center border-b border-prosights-border px-3 py-0">
+      {/* No right border and no header border inside the sidebar: the surface
+          color change divides chrome from content, so the main header's
+          border-b starts at the content column and never crosses the nav. */}
+      <Sidebar collapsible="icon">
+        <SidebarHeader className="justify-center px-3 pb-1 pt-3">
           <div className="flex h-9 items-center gap-2 rounded-prosights-md px-1.5 group-data-[collapsible=icon]:justify-center group-data-[collapsible=icon]:px-0">
             <Link to="/projects" className="flex min-w-0 flex-1 items-center gap-2 text-left group-data-[collapsible=icon]:hidden">
               <div className="flex size-7 shrink-0 items-center justify-center">
@@ -95,7 +101,7 @@ export function AppShell() {
                     asChild
                     isActive={active}
                     tooltip={item.label}
-                    className="group/sidebar-item h-8 rounded-prosights-md px-2 text-[13px] font-medium text-prosights-muted transition-colors hover:bg-prosights-surface-muted hover:text-prosights-text data-[active=true]:bg-prosights-surface-muted data-[active=true]:text-prosights-text [&>svg]:size-4"
+                    className="group/sidebar-item h-8 rounded-prosights-md px-2 text-[13px] font-medium text-prosights-muted transition-colors hover:bg-sidebar-hover hover:text-prosights-text data-[active=true]:bg-sidebar-selected data-[active=true]:text-prosights-text [&>svg]:size-4"
                   >
                     <Link to={item.to}>
                       <Icon className={active ? 'text-prosights-text' : 'text-prosights-muted group-hover/sidebar-item:text-prosights-text'} aria-hidden="true" />
@@ -110,7 +116,7 @@ export function AppShell() {
           </SidebarGroup>
         </SidebarContent>
 
-        <SidebarFooter className="border-t border-prosights-border p-3 group-data-[collapsible=icon]:items-center group-data-[collapsible=icon]:px-2">
+        <SidebarFooter className="p-3 group-data-[collapsible=icon]:items-center group-data-[collapsible=icon]:px-2">
           <div
             className="flex min-w-0 items-center justify-between gap-2 px-1.5 text-[11px] text-prosights-muted group-data-[collapsible=icon]:hidden"
             title={`${versionLabel(appVersion?.version)} · ${appVersion?.commit_sha || 'development build'}`}
@@ -123,7 +129,7 @@ export function AppShell() {
               <DropdownMenu>
                 <DropdownMenuTrigger
                   aria-label={`${userName} account`}
-                  className="flex h-12 w-full min-w-0 items-center gap-2 overflow-hidden rounded-prosights-md px-1.5 text-left transition-colors hover:bg-prosights-surface-muted data-[state=open]:bg-prosights-surface-muted data-[state=open]:text-prosights-text group-data-[collapsible=icon]:h-8 group-data-[collapsible=icon]:w-8 group-data-[collapsible=icon]:justify-center group-data-[collapsible=icon]:gap-0 group-data-[collapsible=icon]:p-0"
+                  className="flex h-12 w-full min-w-0 items-center gap-2 overflow-hidden rounded-prosights-md px-1.5 text-left transition-colors hover:bg-sidebar-hover data-[state=open]:bg-sidebar-selected data-[state=open]:text-prosights-text group-data-[collapsible=icon]:h-8 group-data-[collapsible=icon]:w-8 group-data-[collapsible=icon]:justify-center group-data-[collapsible=icon]:gap-0 group-data-[collapsible=icon]:p-0"
                 >
                   <div className="flex size-8 shrink-0 items-center justify-center rounded-[10px] bg-prosights-surface-muted text-sm font-semibold text-prosights-text">
                     {(userName || userEmail || 'User').charAt(0).toUpperCase()}
@@ -146,6 +152,17 @@ export function AppShell() {
                     <span className="truncate text-[13px] font-semibold leading-5">{userName}</span>
                     <span className="truncate text-[12px] leading-4 text-prosights-muted">{userEmail}</span>
                   </div>
+                  <DropdownMenuSeparator className="my-0" />
+                  <DropdownMenuItem
+                    className="gap-2 rounded-none px-3.5 py-2.5 text-[13px]"
+                    onClick={() => {
+                      // Full reload so every cached query is dropped with the session.
+                      void logout().finally(() => window.location.assign('/login'))
+                    }}
+                  >
+                    <LogOut className="size-4 text-prosights-muted" aria-hidden="true" />
+                    <span>Log Out</span>
+                  </DropdownMenuItem>
                 </DropdownMenuContent>
               </DropdownMenu>
             </SidebarMenuItem>
diff --git a/web/src/components/ui/sidebar.tsx b/web/src/components/ui/sidebar.tsx
index 3fe7d03bed..d8c3dfc847 100644
--- a/web/src/components/ui/sidebar.tsx
+++ b/web/src/components/ui/sidebar.tsx
@@ -8,8 +8,6 @@ import { Button } from './button'
 import { Sheet, SheetContent, SheetDescription, SheetHeader, SheetTitle } from './sheet'
 import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from './tooltip'
 
-const SIDEBAR_COOKIE_NAME = 'sidebar_state'
-const SIDEBAR_COOKIE_MAX_AGE = 60 * 60 * 24 * 7
 const SIDEBAR_WIDTH = '16rem'
 const SIDEBAR_WIDTH_MOBILE = '18rem'
 const SIDEBAR_WIDTH_ICON = '3rem'
@@ -54,7 +52,6 @@ export function SidebarProvider({
     const openState = typeof value === 'function' ? value(open) : value
     if (setOpenProp) setOpenProp(openState)
     else _setOpen(openState)
-    document.cookie = `${SIDEBAR_COOKIE_NAME}=${openState}; path=/; max-age=${SIDEBAR_COOKIE_MAX_AGE}`
   }, [setOpenProp, open])
 
   const toggleSidebar = React.useCallback(() => {
@@ -168,7 +165,7 @@ export function Sidebar({
             : 'right-0 group-data-[collapsible=offcanvas]:right-[calc(var(--sidebar-width)*-1)]',
           variant === 'floating' || variant === 'inset'
             ? 'p-2 group-data-[collapsible=icon]:w-[calc(var(--sidebar-width-icon)+(--spacing(4))+2px)]'
-            : 'group-data-[collapsible=icon]:w-(--sidebar-width-icon) group-data-[side=left]:border-r group-data-[side=right]:border-l',
+            : 'group-data-[collapsible=icon]:w-(--sidebar-width-icon)',
           className,
         )}
         {...props}
diff --git a/web/src/features/deployments/components.test.ts b/web/src/features/deployments/components.test.ts
deleted file mode 100644
index a7e1fbf117..0000000000
--- a/web/src/features/deployments/components.test.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { blueGreenHealthCheckError } from './components'
-
-describe('blueGreenHealthCheckError', () => {
-  it('requires color and assigned-port placeholders', () => {
-    expect(blueGreenHealthCheckError('http://127.0.0.1:{port}/healthz?color={color}')).toBe('')
-    expect(blueGreenHealthCheckError('https://api-{color}.example.com/healthz')).toContain('{color} and {port}')
-  })
-})
diff --git a/web/src/features/deployments/components.tsx b/web/src/features/deployments/components.tsx
deleted file mode 100644
index d76cd51ab2..0000000000
--- a/web/src/features/deployments/components.tsx
+++ /dev/null
@@ -1,387 +0,0 @@
-import * as DialogPrimitive from '@radix-ui/react-dialog'
-import { Ban, History, RotateCcw, Rocket, Save, ScrollText, X } from 'lucide-react'
-import { Badge } from '../../components/ui/badge'
-import { Button } from '../../components/ui/button'
-import { Panel } from '../../components/ui/panel'
-import { SelectInput } from '../../components/ui/select-input'
-import { TextInput } from '../../components/ui/text-input'
-import type { Application, ContainerRegistry, Deployment, DeploymentLog, DeploymentSlot } from '../../lib/api'
-import { validateHealthCheckURL } from '../../lib/urls'
-import { statusTone } from '../status'
-import { DeploymentLogStream } from './logs'
-
-type DeploymentQueuePanelProps = {
-  applications: Application[]
-  target?: Application
-  deploymentSlots: DeploymentSlot[]
-  healthCheckDraft: string
-  commitSha: string
-  imageRef: string
-  imageName: string
-  imageTag: string
-  selectedRegistry?: ContainerRegistry
-  registries: ContainerRegistry[]
-  imageDigest: string
-  actor: string
-  isQueueing: boolean
-  isRollingBack: boolean
-  isSavingHealthCheck: boolean
-  onApplicationChange: (applicationID: string) => void
-  onHealthCheckDraftChange: (healthCheckURL: string) => void
-  onSaveHealthCheck: () => void
-  onCommitShaChange: (commitSha: string) => void
-  onImageRefChange: (imageRef: string) => void
-  onRegistryChange: (registryID: string) => void
-  onImageNameChange: (imageName: string) => void
-  onImageTagChange: (imageTag: string) => void
-  onImageDigestChange: (imageDigest: string) => void
-  onActorChange: (actor: string) => void
-  onQueue: () => void
-  onRollback: () => void
-}
-
-export function DeploymentQueuePanel({
-  applications,
-  target,
-  deploymentSlots,
-  healthCheckDraft,
-  commitSha,
-  imageRef,
-  imageName,
-  imageTag,
-  selectedRegistry,
-  registries,
-  imageDigest,
-  actor,
-  isQueueing,
-  isRollingBack,
-  isSavingHealthCheck,
-  onApplicationChange,
-  onHealthCheckDraftChange,
-  onSaveHealthCheck,
-  onCommitShaChange,
-  onImageRefChange,
-  onRegistryChange,
-  onImageNameChange,
-  onImageTagChange,
-  onImageDigestChange,
-  onActorChange,
-  onQueue,
-  onRollback,
-}: DeploymentQueuePanelProps) {
-  const blueGreenError = blueGreenHealthCheckError(target?.health_check_url ?? '')
-  const blueGreenReady = blueGreenError === ''
-  const activeSlot = deploymentSlots.find((slot) => slot.status === 'active')
-  const standbySlot = deploymentSlots.find((slot) => slot.status === 'standby')
-  const rollbackReady = blueGreenReady && Boolean(standbySlot)
-
-  return (
-    <Panel title="Deploy and rollback">
-      <div className="grid gap-3 p-4 md:grid-cols-[minmax(220px,1fr)_150px_180px_180px]">
-        <SelectInput label="Application" value={target?.id ?? ''} onChange={onApplicationChange} disabled={applications.length === 0}>
-          {applications.map((application) => (
-            <option key={application.id} value={application.id}>{application.name} / {application.server_name}</option>
-          ))}
-        </SelectInput>
-        <div className="flex flex-col justify-end">
-          <span className="mb-1 text-xs font-medium text-muted">Strategy</span>
-          <span className="rounded-md border bg-panel px-3 py-2 text-sm text-ink">Blue-green</span>
-        </div>
-        <TextInput label="Commit SHA" value={commitSha} onChange={onCommitShaChange} placeholder="optional" />
-        <TextInput label="Actor" value={actor} onChange={onActorChange} placeholder="optional" />
-      </div>
-      <RollbackSlots
-        activeSlot={activeSlot}
-        standbySlot={standbySlot}
-        blueGreenReady={blueGreenReady}
-        isRollingBack={isRollingBack}
-        onRollback={onRollback}
-      />
-      {blueGreenError && (
-        <div className="grid gap-3 border-t p-4 md:grid-cols-[minmax(280px,1fr)_auto]">
-          <TextInput
-            label="Health check URL"
-            value={healthCheckDraft}
-            onChange={onHealthCheckDraftChange}
-            placeholder="http://127.0.0.1:{port}/healthz?color={color}"
-          />
-          <div className="flex items-end">
-            <Button variant="secondary" disabled={!target || isSavingHealthCheck} onClick={onSaveHealthCheck}>
-              <Save className="size-4" />
-              {isSavingHealthCheck ? 'Saving...' : 'Save health check'}
-            </Button>
-          </div>
-          <div className="md:col-span-2 text-sm text-danger">{blueGreenError}</div>
-        </div>
-      )}
-      <div className="grid gap-3 border-t p-4 md:grid-cols-[minmax(220px,0.8fr)_minmax(180px,0.7fr)_120px_minmax(220px,0.8fr)_auto_auto]">
-        <SelectInput label="Registry" value={selectedRegistry?.id ?? ''} onChange={onRegistryChange} disabled={registries.length === 0}>
-          <option value="">Manual ref</option>
-          {registries.filter((registry) => registry.enabled).map((registry) => (
-            <option key={registry.id} value={registry.id}>{registry.name}</option>
-          ))}
-        </SelectInput>
-        <TextInput label="Image" value={imageName} onChange={onImageNameChange} placeholder={selectedRegistry?.default_image || 'workflows-server'} />
-        <TextInput label="Tag" value={imageTag} onChange={onImageTagChange} placeholder="v2" />
-        <TextInput label="Image digest" value={imageDigest} onChange={onImageDigestChange} placeholder="sha256:..." />
-        <div className="flex items-end">
-          <Button variant="primary" disabled={!target || isQueueing || !blueGreenReady} onClick={onQueue}>
-            <Rocket className="size-4" />
-            {isQueueing ? 'Queueing...' : 'Queue deploy'}
-          </Button>
-        </div>
-        <div className="flex items-end text-xs text-muted">
-          {rollbackReady ? 'Rollback is ready.' : 'Rollback needs a standby slot.'}
-        </div>
-      </div>
-      <div className="border-t px-4 py-3 text-sm text-muted">
-        {selectedRegistry
-          ? <>Resolved image ref: <span className="font-mono text-ink">{resolvedImageRef(selectedRegistry, imageName, imageTag) || 'choose image and tag'}</span></>
-          : <>Manual image ref: <span className="font-mono text-ink">{imageRef || 'optional full image reference'}</span></>
-        }
-      </div>
-      {!selectedRegistry && (
-        <div className="grid gap-3 border-t p-4 md:grid-cols-[minmax(280px,1fr)]">
-          <TextInput label="Manual image ref" value={imageRef} onChange={onImageRefChange} placeholder="us-east1-docker.pkg.dev/project/repo/image:tag" />
-          {canBuildFromSource(target) && !imageRef.trim() && (
-            <p className="text-xs text-muted">
-              Leave blank to build from the application repository (<span className="font-mono text-ink">{target?.repository_url}</span>) on the target server using <span className="font-mono text-ink">{target?.compose_path}</span>.
-            </p>
-          )}
-        </div>
-      )}
-      <div className="border-t px-4 py-3 text-sm text-muted">
-        Blue-green compose targets must use <span className="font-mono text-ink">DEPLOY_COLOR</span> for color-specific service names, labels, or ports, and the application health check URL must include <span className="font-mono text-ink">{'{color}'}</span> and <span className="font-mono text-ink">{'{port}'}</span>.
-      </div>
-    </Panel>
-  )
-}
-
-type RollbackSlotsProps = {
-  activeSlot?: DeploymentSlot
-  standbySlot?: DeploymentSlot
-  blueGreenReady: boolean
-  isRollingBack: boolean
-  onRollback: () => void
-}
-
-function RollbackSlots({ activeSlot, standbySlot, blueGreenReady, isRollingBack, onRollback }: RollbackSlotsProps) {
-  return (
-    <div className="grid gap-3 border-t p-4 md:grid-cols-[minmax(0,1fr)_minmax(0,1fr)_auto]">
-      <SlotCard label="Live now" slot={activeSlot} empty="No active slot yet." />
-      <SlotCard label="Rollback target" slot={standbySlot} empty="No standby slot yet. Complete two successful deploys to create one." />
-      <div className="flex items-end">
-        <Button variant="secondary" disabled={!standbySlot || !blueGreenReady || isRollingBack} onClick={onRollback}>
-          <RotateCcw className="size-4" />
-          {isRollingBack ? 'Rolling back...' : standbySlot ? `Rollback to ${standbySlot.color}` : 'Rollback'}
-        </Button>
-      </div>
-    </div>
-  )
-}
-
-type SlotCardProps = {
-  label: string
-  slot?: DeploymentSlot
-  empty: string
-}
-
-function SlotCard({ label, slot, empty }: SlotCardProps) {
-  return (
-    <div className="rounded-md border bg-surface px-3 py-2">
-      <div className="flex items-center gap-2 text-xs font-medium text-muted">
-        <History className="size-3.5" />
-        {label}
-      </div>
-      {slot ? (
-        <div className="mt-2 space-y-1">
-          <div className="flex items-center gap-2">
-            <Badge tone={slot.status === 'active' ? 'success' : 'warning'}>{slot.color}</Badge>
-            <span className="text-xs text-muted">{slot.status}</span>
-          </div>
-          <div className="truncate font-mono text-xs text-ink">{slot.image_ref}</div>
-          <div className="font-mono text-[11px] text-muted">{slot.image_digest?.slice(0, 19) ?? slot.deployment_id?.slice(0, 8) ?? 'not pinned'}</div>
-        </div>
-      ) : (
-        <div className="mt-2 text-sm text-muted">{empty}</div>
-      )}
-    </div>
-  )
-}
-
-function resolvedImageRef(registry: ContainerRegistry, imageName: string, imageTag: string): string {
-  const image = cleanImagePath(imageName || registry.default_image)
-  const tag = imageTag.trim()
-  if (!image || !tag) {
-    return ''
-  }
-  return `${registryBasePath(registry)}/${image}:${tag}`
-}
-
-function registryBasePath(registry: ContainerRegistry): string {
-  return [registry.registry_host, registry.namespace, registry.repository].map(cleanImagePath).filter(Boolean).join('/')
-}
-
-function cleanImagePath(value: string): string {
-  return value.trim().replace(/^\/+|\/+$/g, '')
-}
-
-function canBuildFromSource(target: Application | undefined): boolean {
-  return Boolean(target?.repository_url?.trim() && target?.compose_path?.trim())
-}
-
-export function blueGreenHealthCheckError(value: string): string {
-  if (!value.trim().includes('{color}') || !value.trim().includes('{port}')) {
-    return 'Configure a health check URL with {color} and {port} before queueing blue-green deployments.'
-  }
-  try {
-    validateHealthCheckURL(value)
-  } catch (error) {
-    return error instanceof Error ? error.message : 'Health check URL is invalid.'
-  }
-  return ''
-}
-
-type DeploymentListProps = {
-  deployments: Deployment[]
-  selectedDeployment?: Deployment
-  selectedDeploymentLogs: DeploymentLog[]
-  selectedDeploymentLive: boolean
-  isCancelling: boolean
-  isRetrying: boolean
-  onInspect: (deploymentID: string) => void
-  onCancel: (deploymentID: string) => void
-  onRetry: (deploymentID: string) => void
-}
-
-export function DeploymentList({
-  deployments,
-  selectedDeployment,
-  selectedDeploymentLogs,
-  selectedDeploymentLive,
-  isCancelling,
-  isRetrying,
-  onInspect,
-  onCancel,
-  onRetry,
-}: DeploymentListProps) {
-  return (
-    <Panel>
-      <div className="overflow-x-auto">
-        <table className="w-full text-left text-sm">
-          <thead className="text-xs text-muted">
-            <tr>
-              <th className="px-4 py-3 font-medium">Deployment</th>
-              <th className="px-4 py-3 font-medium">Target</th>
-              <th className="px-4 py-3 font-medium">Strategy</th>
-              <th className="px-4 py-3 font-medium">Trigger</th>
-              <th className="px-4 py-3 font-medium">Status</th>
-              <th className="px-4 py-3 font-medium">Actor</th>
-              <th className="px-4 py-3 font-medium">Commit</th>
-              <th className="px-4 py-3 font-medium">Actions</th>
-            </tr>
-          </thead>
-          <tbody>
-            {deployments.map((deployment) => {
-              return (
-                <tr key={deployment.id} className="border-t">
-                    <td className="px-4 py-3 font-mono text-xs text-muted">{deployment.id.slice(0, 8)}</td>
-                    <td className="px-4 py-3">
-                      <div className="font-medium">{deployment.application_name}</div>
-                      <div className="text-xs text-muted">{deployment.server_name}</div>
-                    </td>
-                    <td className="px-4 py-3 text-muted">{deployment.strategy}</td>
-                    <td className="px-4 py-3 text-muted">{deployment.trigger}</td>
-                    <td className="px-4 py-3">
-                      <Badge tone={statusTone(deployment.status)}>{deployment.status}</Badge>
-                    </td>
-                    <td className="px-4 py-3 text-muted">{deployment.actor ?? 'system'}</td>
-                    <td className="max-w-60 truncate px-4 py-3 font-mono text-xs text-muted">{deployment.image_digest?.slice(0, 19) ?? deployment.image_ref ?? deployment.commit_sha?.slice(0, 12) ?? 'n/a'}</td>
-                    <td className="px-4 py-3">
-                      <div className="flex flex-wrap gap-2">
-                        <Button
-                          variant="ghost"
-                          onClick={() => onInspect(deployment.id)}
-                        >
-                          <ScrollText className="size-4" />
-                          Inspect
-                        </Button>
-                        {deployment.status === 'queued' && (
-                          <Button variant="ghost" disabled={isCancelling} onClick={() => onCancel(deployment.id)}>
-                            <Ban className="size-4" />
-                            Cancel
-                          </Button>
-                        )}
-                        {(deployment.status === 'failed' || deployment.status === 'cancelled') && (
-                          <Button variant="ghost" disabled={isRetrying} onClick={() => onRetry(deployment.id)}>
-                            <RotateCcw className="size-4" />
-                            Retry
-                          </Button>
-                        )}
-                      </div>
-                    </td>
-                  </tr>
-              )
-            })}
-          </tbody>
-        </table>
-      </div>
-      {deployments.length === 0 && <div className="border-t px-4 py-6 text-sm text-muted">No deployments found.</div>}
-      <DeploymentLogDialog
-        deployment={selectedDeployment}
-        logs={selectedDeploymentLogs}
-        live={selectedDeploymentLive}
-        onOpenChange={(open) => {
-          if (!open) onInspect('')
-        }}
-      />
-    </Panel>
-  )
-}
-
-function DeploymentLogDialog({
-  deployment,
-  logs,
-  live,
-  onOpenChange,
-}: {
-  deployment?: Deployment
-  logs: DeploymentLog[]
-  live: boolean
-  onOpenChange: (open: boolean) => void
-}) {
-  return (
-    <DialogPrimitive.Root open={Boolean(deployment)} onOpenChange={onOpenChange}>
-      <DialogPrimitive.Portal>
-        <DialogPrimitive.Overlay className="fixed inset-0 z-50 bg-black/60 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:duration-100 data-[state=closed]:ease-out data-[state=open]:animate-in data-[state=open]:fade-in-0 data-[state=open]:duration-150 data-[state=open]:ease-out" />
-        <DialogPrimitive.Content className="fixed left-1/2 top-1/2 z-50 flex h-[min(82svh,760px)] w-[calc(100%-2rem)] max-w-5xl -translate-x-1/2 -translate-y-1/2 flex-col overflow-hidden rounded-prosights-xl border border-prosights-border bg-prosights-surface shadow-prosights-float outline-none data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:duration-100 data-[state=closed]:ease-out data-[state=open]:animate-in data-[state=open]:fade-in-0 data-[state=open]:duration-150 data-[state=open]:ease-out">
-          {deployment && (
-            <>
-              <header className="flex shrink-0 items-start justify-between gap-4 border-b border-prosights-border px-5 py-4 pr-14">
-                <div className="min-w-0">
-                  <DialogPrimitive.Title className="truncate text-[17px] font-semibold tracking-[-0.01em] text-prosights-text">
-                    {deployment.application_name} deployment
-                  </DialogPrimitive.Title>
-                  <DialogPrimitive.Description className="mt-1 truncate font-mono text-xs text-prosights-muted">
-                    {deployment.id} · {deployment.server_name}
-                  </DialogPrimitive.Description>
-                </div>
-                <Badge tone={statusTone(deployment.status)}>{deployment.status}</Badge>
-              </header>
-              <DialogPrimitive.Close asChild>
-                <button
-                  type="button"
-                  aria-label="Close deployment logs"
-                  className="absolute right-4 top-4 inline-flex size-8 items-center justify-center rounded-prosights-md bg-black text-white hover:bg-black/80 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-prosights-ring"
-                >
-                  <X className="size-4" aria-hidden="true" />
-                </button>
-              </DialogPrimitive.Close>
-              <DeploymentLogStream deployment={deployment} logs={logs} live={live} className="min-h-0 flex-1" />
-            </>
-          )}
-        </DialogPrimitive.Content>
-      </DialogPrimitive.Portal>
-    </DialogPrimitive.Root>
-  )
-}
diff --git a/web/src/features/deployments/logs.tsx b/web/src/features/deployments/logs.tsx
index a102cee2f0..be10c3fe5c 100644
--- a/web/src/features/deployments/logs.tsx
+++ b/web/src/features/deployments/logs.tsx
@@ -4,7 +4,6 @@ import { useEffect, useMemo, useState } from 'react'
 import { Panel } from '../../components/ui/panel'
 import { cn } from '../../lib/cn'
 import type { DeploymentLog } from '../../lib/api'
-import { withAccessToken } from '../../lib/api'
 import { deploymentLogsQuery } from '../../lib/queries'
 
 type DeploymentSummary = {
@@ -36,7 +35,7 @@ export function useDeploymentLogs(deploymentID: string | undefined) {
       return
     }
 
-    const events = new EventSource(withAccessToken(`/api/deployments/${deploymentID}/events`))
+    const events = new EventSource(`/api/deployments/${deploymentID}/events`)
     events.addEventListener('open', () => setLiveDeploymentID(deploymentID))
     events.addEventListener('error', () => {
       // EventSource auto-reconnects unless the connection is permanently closed.
diff --git a/web/src/lib/api.ts b/web/src/lib/api.ts
index 037834bc78..52cf71b6ee 100644
--- a/web/src/lib/api.ts
+++ b/web/src/lib/api.ts
@@ -516,25 +516,31 @@ export class ApiError extends Error {
   }
 }
 
-function authHeaders(): Record<string, string> {
-  return {}
+export function webSocketURL(path: string): string {
+  const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:'
+  return `${protocol}//${window.location.host}${path}`
 }
 
-export function withAccessToken(path: string): string {
-  return path
+export function login(token: string) {
+  return api<void>('/api/login', { method: 'POST', body: JSON.stringify({ token }) })
 }
 
-export function webSocketURL(path: string): string {
-  const authenticatedPath = withAccessToken(path)
-  const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:'
-  return `${protocol}//${window.location.host}${authenticatedPath}`
+export function logout() {
+  return api<void>('/api/logout', { method: 'POST' })
+}
+
+export function getSession(init?: RequestInit) {
+  return api<{ authenticated: boolean }>('/api/session', init)
 }
 
 export async function api<T>(path: string, init?: RequestInit): Promise<T> {
   const response = await fetch(path, {
-    headers: { 'Content-Type': 'application/json', ...authHeaders(), ...init?.headers },
+    headers: { 'Content-Type': 'application/json', ...init?.headers },
     ...init,
   })
+  if (response.status === 401 && path !== '/api/login' && window.location.pathname !== '/login') {
+    window.location.assign('/login')
+  }
   if (!response.ok) {
     throw new ApiError(await errorMessage(response), response.status, path)
   }
diff --git a/web/src/lib/queries.ts b/web/src/lib/queries.ts
index 226e6914a0..30e47d242e 100644
--- a/web/src/lib/queries.ts
+++ b/web/src/lib/queries.ts
@@ -1,5 +1,11 @@
 import { queryOptions } from '@tanstack/react-query'
-import { api, getDopplerStatus, getGitHubRepositoryCommit, getGitHubStatus, listApplicationServiceRuntimeConfigs, listBuildRuns, listDeploymentLogs, listDeploymentSlots, listDopplerConfigs, listDopplerProjects, listGitHubRepositories, type Application, type ApplicationServiceRuntimeConfig, type AppVersion, type AuditEvent, type BuildRun, type ConnectorAccount, type ContainerRegistry, type Deployment, type DeploymentSlot, type DopplerIntegrationStatus, type Environment, type GitHubIntegrationStatus, type GitHubRepository, type Project, type ProxyRoute, type Server, type TailscaleDevicesResponse } from './api'
+import { api, getDopplerStatus, getSession, getGitHubRepositoryCommit, getGitHubStatus, listApplicationServiceRuntimeConfigs, listBuildRuns, listDeploymentLogs, listDeploymentSlots, listDopplerConfigs, listDopplerProjects, listGitHubRepositories, type Application, type ApplicationServiceRuntimeConfig, type AppVersion, type AuditEvent, type BuildRun, type ConnectorAccount, type ContainerRegistry, type Deployment, type DeploymentSlot, type DopplerIntegrationStatus, type Environment, type GitHubIntegrationStatus, type GitHubRepository, type Project, type ProxyRoute, type Server, type TailscaleDevicesResponse } from './api'
+
+export const sessionQuery = queryOptions({
+  queryKey: ['session'],
+  queryFn: ({ signal }) => getSession({ signal }),
+  staleTime: 60_000,
+})
 
 export const appVersionQuery = queryOptions({
   queryKey: ['app-version'],
diff --git a/web/src/router.tsx b/web/src/router.tsx
index 87e9c24c0f..efbd77f7bc 100644
--- a/web/src/router.tsx
+++ b/web/src/router.tsx
@@ -18,7 +18,9 @@ import {
   projectsQuery,
   proxyRoutesQuery,
   serversQuery,
+  sessionQuery,
 } from './lib/queries'
+import { LoginRoute } from './routes/login'
 import { ProjectsRoute } from './routes/projects'
 import { ProjectDetailRoute } from './routes/project-detail'
 import { ServersRoute } from './routes/servers'
@@ -37,24 +39,38 @@ function load(...queries: Array<{ queryKey: readonly unknown[] }>) {
 }
 
 const rootRoute = createRootRoute({
-  component: AppShell,
   errorComponent: AppError,
   notFoundComponent: AppNotFound,
+})
+
+// Everything except /login lives under this pathless layout, which renders the
+// shell and redirects unauthenticated visitors to the login page.
+const appRoute = createRoute({
+  getParentRoute: () => rootRoute,
+  id: 'app',
+  component: AppShell,
+  beforeLoad: async () => {
+    const session = await queryClient.ensureQueryData(sessionQuery)
+    if (!session.authenticated) throw redirect({ to: '/login' })
+  },
   loader: load(projectsQuery, environmentsQuery),
 })
 
 const routeTree = rootRoute.addChildren([
-  createRoute({ getParentRoute: () => rootRoute, path: '/', beforeLoad: () => { throw redirect({ to: '/projects' }) } }),
-  createRoute({ getParentRoute: () => rootRoute, path: '/projects', component: ProjectsRoute, loader: load(projectsQuery, environmentsQuery, applicationsQuery, deploymentsQuery) }),
-  createRoute({ getParentRoute: () => rootRoute, path: '/projects/$projectId', component: ProjectDetailRoute, loader: load(projectsQuery, environmentsQuery, applicationsQuery, deploymentsQuery, buildRunsQuery, serversQuery, containerRegistriesQuery, proxyRoutesQuery, githubRepositoriesQuery, githubStatusQuery) }),
-  createRoute({ getParentRoute: () => rootRoute, path: '/servers', component: ServersRoute, loader: load(serversQuery) }),
-  createRoute({ getParentRoute: () => rootRoute, path: '/applications', component: ApplicationsRoute, loader: load(applicationsQuery, serversQuery, environmentsQuery) }),
-  createRoute({ getParentRoute: () => rootRoute, path: '/deployments', component: DeploymentsRoute, loader: load(deploymentsQuery, applicationsQuery) }),
-  createRoute({ getParentRoute: () => rootRoute, path: '/notifications', component: NotificationsRoute, loader: load(connectorsQuery) }),
-  createRoute({ getParentRoute: () => rootRoute, path: '/connectors', component: ConnectorsRoute, loader: load(githubStatusQuery, dopplerStatusQuery, githubRepositoriesQuery, buildRunsQuery, containerRegistriesQuery, connectorsQuery) }),
-  createRoute({ getParentRoute: () => rootRoute, path: '/registries', component: RegistriesRoute, loader: load(containerRegistriesQuery, projectsQuery) }),
-  createRoute({ getParentRoute: () => rootRoute, path: '/proxy', component: ProxyRoute, loader: load(proxyRoutesQuery, serversQuery, applicationsQuery) }),
-  createRoute({ getParentRoute: () => rootRoute, path: '/audit', component: AuditRoute, loader: load(auditEventsQuery) }),
+  createRoute({ getParentRoute: () => rootRoute, path: '/login', component: LoginRoute }),
+  appRoute.addChildren([
+    createRoute({ getParentRoute: () => appRoute, path: '/', beforeLoad: () => { throw redirect({ to: '/projects' }) } }),
+    createRoute({ getParentRoute: () => appRoute, path: '/projects', component: ProjectsRoute, loader: load(projectsQuery, environmentsQuery, applicationsQuery, deploymentsQuery) }),
+    createRoute({ getParentRoute: () => appRoute, path: '/projects/$projectId', component: ProjectDetailRoute, loader: load(projectsQuery, environmentsQuery, applicationsQuery, deploymentsQuery, buildRunsQuery, serversQuery, containerRegistriesQuery, proxyRoutesQuery, githubRepositoriesQuery, githubStatusQuery) }),
+    createRoute({ getParentRoute: () => appRoute, path: '/servers', component: ServersRoute, loader: load(serversQuery) }),
+    createRoute({ getParentRoute: () => appRoute, path: '/applications', component: ApplicationsRoute, loader: load(applicationsQuery, serversQuery, environmentsQuery) }),
+    createRoute({ getParentRoute: () => appRoute, path: '/deployments', component: DeploymentsRoute, loader: load(deploymentsQuery, applicationsQuery) }),
+    createRoute({ getParentRoute: () => appRoute, path: '/notifications', component: NotificationsRoute, loader: load(connectorsQuery) }),
+    createRoute({ getParentRoute: () => appRoute, path: '/connectors', component: ConnectorsRoute, loader: load(githubStatusQuery, dopplerStatusQuery, githubRepositoriesQuery, buildRunsQuery, containerRegistriesQuery, connectorsQuery) }),
+    createRoute({ getParentRoute: () => appRoute, path: '/registries', component: RegistriesRoute, loader: load(containerRegistriesQuery, projectsQuery) }),
+    createRoute({ getParentRoute: () => appRoute, path: '/proxy', component: ProxyRoute, loader: load(proxyRoutesQuery, serversQuery, applicationsQuery) }),
+    createRoute({ getParentRoute: () => appRoute, path: '/audit', component: AuditRoute, loader: load(auditEventsQuery) }),
+  ]),
 ])
 
 export const router = createRouter({
diff --git a/web/src/routes/applications.tsx b/web/src/routes/applications.tsx
index ecbaed8dbc..8224049ed0 100644
--- a/web/src/routes/applications.tsx
+++ b/web/src/routes/applications.tsx
@@ -5,36 +5,16 @@ import { ApplicationCreatePanel, ApplicationList, defaultApplicationForm, type A
 import { createApplication, type CreateApplicationInput } from '../lib/api'
 import { validateDomain } from '../lib/domains'
 import { applicationsQuery, environmentsQuery, serversQuery } from '../lib/queries'
-import { matchesSearch } from '../lib/search'
 import { validateHealthCheckURL } from '../lib/urls'
-import { useUiStore } from '../store/ui'
 
 export function ApplicationsRoute() {
   const queryClient = useQueryClient()
   const [{ data: applications }, { data: servers }, { data: environments }] = useSuspenseQueries({
     queries: [applicationsQuery, serversQuery, environmentsQuery],
   })
-  const searchQuery = useUiStore((state) => state.searchQuery)
   const [form, setForm] = useState(defaultApplicationForm(servers[0]?.id, environments[0]?.id))
   const [formError, setFormError] = useState<string>()
-  const visibleApplications = applications.filter((application) => matchesSearch(searchQuery, [
-    application.name,
-    application.project_name,
-    application.environment_name,
-    application.environment_kind,
-    application.server_name,
-    application.repository_url,
-    application.branch,
-    application.compose_path,
-    application.remote_directory,
-    application.domain,
-    application.health_check_url,
-    application.doppler_project,
-    application.doppler_config,
-    application.status,
-    application.current_version,
-    application.target_version,
-  ]))
+  const visibleApplications = applications
   const create = useMutation({
     mutationFn: () => createApplication(applicationInput(form)),
     onSuccess: async () => {
diff --git a/web/src/routes/audit.tsx b/web/src/routes/audit.tsx
index 049b189649..6bb5a97146 100644
--- a/web/src/routes/audit.tsx
+++ b/web/src/routes/audit.tsx
@@ -5,17 +5,13 @@ import { Badge } from '../components/ui/badge'
 import { Button } from '../components/ui/button'
 import { Panel } from '../components/ui/panel'
 import { auditEventsQuery } from '../lib/queries'
-import { matchesSearch } from '../lib/search'
-import { useUiStore } from '../store/ui'
 
 const pageSize = 10
 
 export function AuditRoute() {
   const { data: events } = useSuspenseQuery(auditEventsQuery)
-  const searchQuery = useUiStore((state) => state.searchQuery)
   const [page, setPage] = useState(1)
-  const rows = useMemo(() => events.map(auditEventRow), [events])
-  const visibleRows = useMemo(() => rows.filter((row) => matchesSearch(searchQuery, row.searchValues)), [rows, searchQuery])
+  const visibleRows = useMemo(() => events.map(auditEventRow), [events])
   const pageCount = Math.max(1, Math.ceil(visibleRows.length / pageSize))
   const currentPage = Math.min(page, pageCount)
   const pageRows = visibleRows.slice((currentPage - 1) * pageSize, currentPage * pageSize)
diff --git a/web/src/routes/login.tsx b/web/src/routes/login.tsx
new file mode 100644
index 0000000000..fd701ca047
--- /dev/null
+++ b/web/src/routes/login.tsx
@@ -0,0 +1,67 @@
+import { useNavigate } from '@tanstack/react-router'
+import { useState } from 'react'
+import { ApiError, login } from '../lib/api'
+import { queryClient } from '../lib/query-client'
+import { Button } from '../components/ui/button'
+
+export function LoginRoute() {
+  const navigate = useNavigate()
+  const [token, setToken] = useState('')
+  const [error, setError] = useState('')
+  const [pending, setPending] = useState(false)
+
+  async function submit(event: React.FormEvent) {
+    event.preventDefault()
+    setPending(true)
+    setError('')
+    try {
+      await login(token.trim())
+      queryClient.clear()
+      await navigate({ to: '/projects' })
+    } catch (err) {
+      setError(err instanceof ApiError && err.status === 401 ? 'Invalid token.' : 'Login failed. Try again.')
+    } finally {
+      setPending(false)
+    }
+  }
+
+  return (
+    <div className="flex min-h-svh items-center justify-center bg-prosights-canvas p-6">
+      <form
+        onSubmit={submit}
+        className="w-full max-w-sm rounded-prosights-xl border border-prosights-border bg-prosights-surface p-6"
+      >
+        <div className="mb-5 flex items-center gap-2.5">
+          <img className="logo-mark size-8 object-contain" src="/branding/prosights/prosights-co-logo.png" alt="" />
+          <div>
+            <h1 className="text-[16px] font-semibold leading-5 text-prosights-text">Deploy Manager</h1>
+            <p className="text-[12px] text-prosights-muted">Sign in with your API token</p>
+          </div>
+        </div>
+        <label className="mb-1.5 block text-[12px] font-medium text-prosights-muted" htmlFor="api-token">
+          API token
+        </label>
+        <input
+          id="api-token"
+          type="password"
+          autoComplete="current-password"
+          autoFocus
+          required
+          value={token}
+          aria-invalid={Boolean(error)}
+          aria-describedby={error ? 'api-token-error' : undefined}
+          onChange={(event) => {
+            setToken(event.target.value)
+            setError('')
+          }}
+          placeholder="Paste the API token"
+          className="h-9 w-full rounded-prosights-lg border border-prosights-border bg-prosights-surface px-3 text-sm text-prosights-text outline-none placeholder:text-prosights-muted focus-visible:border-prosights-text focus-visible:ring-2 focus-visible:ring-prosights-ring"
+        />
+        {error && <p id="api-token-error" role="alert" className="mt-2 text-[12px] text-danger">{error}</p>}
+        <Button type="submit" className="mt-4 w-full" disabled={pending || !token.trim()}>
+          {pending ? 'Signing in…' : 'Sign in'}
+        </Button>
+      </form>
+    </div>
+  )
+}
diff --git a/web/src/routes/notifications.tsx b/web/src/routes/notifications.tsx
index c693057681..75c9f1e1cb 100644
--- a/web/src/routes/notifications.tsx
+++ b/web/src/routes/notifications.tsx
@@ -9,8 +9,6 @@ import { Panel } from '../components/ui/panel'
 import { TextInput } from '../components/ui/text-input'
 import { upsertConnector, type ConnectorAccount, type UpsertConnectorInput } from '../lib/api'
 import { connectorsQuery } from '../lib/queries'
-import { matchesSearch } from '../lib/search'
-import { useUiStore } from '../store/ui'
 
 type NotificationProvider = 'slack' | 'resend'
 
@@ -48,19 +46,12 @@ const notificationProviders: Array<{
 export function NotificationsRoute() {
   const queryClient = useQueryClient()
   const { data: connectors } = useSuspenseQuery(connectorsQuery)
-  const searchQuery = useUiStore((state) => state.searchQuery)
   const [form, setForm] = useState<DestinationForm>(() => defaultDestinationForm())
   const [formError, setFormError] = useState<string>()
-  const destinations = useMemo(
+  const visibleDestinations = useMemo(
     () => connectors.filter((connector) => connector.provider === 'slack' || connector.provider === 'resend'),
     [connectors],
   )
-  const visibleDestinations = destinations.filter((destination) => matchesSearch(searchQuery, [
-    destination.name,
-    destination.provider,
-    destination.enabled ? 'enabled' : 'disabled',
-    destinationSummary(destination),
-  ]))
   const save = useMutation({
     mutationFn: (input: UpsertConnectorInput) => upsertConnector(input),
     onSuccess: async () => {
diff --git a/web/src/routes/project-detail.test.tsx b/web/src/routes/project-detail.test.tsx
index 20316da6c9..4c325937f5 100644
--- a/web/src/routes/project-detail.test.tsx
+++ b/web/src/routes/project-detail.test.tsx
@@ -77,7 +77,6 @@ vi.mock('../lib/api', () => ({
   updateApplication: vi.fn(async (applicationID, input) => ({ id: applicationID, ...input })),
   updateProject: vi.fn(async (projectID, input) => ({ id: projectID, ...input })),
   updateProjectRegistry: vi.fn(async (projectID, defaultRegistryID) => ({ id: projectID, default_registry_id: defaultRegistryID })),
-  withAccessToken: (path: string) => path,
 }))
 
 const project = {
diff --git a/web/src/routes/proxy.tsx b/web/src/routes/proxy.tsx
index d3d8d5e81f..284eaadaec 100644
--- a/web/src/routes/proxy.tsx
+++ b/web/src/routes/proxy.tsx
@@ -5,27 +5,16 @@ import { defaultProxyForm, ProxyRouteForm, ProxyRouteList } from '../features/pr
 import { applyProxyRoute, createProxyRoute } from '../lib/api'
 import { validateDomain } from '../lib/domains'
 import { applicationsQuery, proxyRoutesQuery, serversQuery } from '../lib/queries'
-import { matchesSearch } from '../lib/search'
-import { useUiStore } from '../store/ui'
 
 export function ProxyRoute() {
   const queryClient = useQueryClient()
   const [{ data: routes }, { data: servers }, { data: applications }] = useSuspenseQueries({
     queries: [proxyRoutesQuery, serversQuery, applicationsQuery],
   })
-  const searchQuery = useUiStore((state) => state.searchQuery)
   const defaultServerID = servers[0]?.id ?? ''
   const [form, setForm] = useState(defaultProxyForm(defaultServerID))
   const [formError, setFormError] = useState<string>()
-  const visibleRoutes = routes.filter((route) => matchesSearch(searchQuery, [
-    route.domain,
-    route.upstream_url,
-    route.status,
-    route.server_name,
-    route.proxy_type,
-    route.application_name,
-    route.tls_enabled ? 'tls on' : 'tls off',
-  ]))
+  const visibleRoutes = routes
   const selectedApplication = useMemo(
     () => applications.find((application) => application.id === form.application_id),
     [applications, form.application_id],
diff --git a/web/src/routes/registries.tsx b/web/src/routes/registries.tsx
index 18f5949ec8..5d97a33387 100644
--- a/web/src/routes/registries.tsx
+++ b/web/src/routes/registries.tsx
@@ -10,8 +10,6 @@ import { SelectInput } from '../components/ui/select-input'
 import { TextInput } from '../components/ui/text-input'
 import { updateProjectRegistry, upsertContainerRegistry, type ContainerRegistry, type Project, type UpsertContainerRegistryInput } from '../lib/api'
 import { containerRegistriesQuery, projectsQuery } from '../lib/queries'
-import { matchesSearch } from '../lib/search'
-import { useUiStore } from '../store/ui'
 
 type RegistryForm = {
   name: string
@@ -38,19 +36,9 @@ export function RegistriesRoute() {
   const [{ data: registries }, { data: projects }] = useSuspenseQueries({
     queries: [containerRegistriesQuery, projectsQuery],
   })
-  const searchQuery = useUiStore((state) => state.searchQuery)
   const [form, setForm] = useState<RegistryForm>(defaultRegistryForm)
   const [formError, setFormError] = useState<string>()
   const [assignmentError, setAssignmentError] = useState<string>()
-  const visibleRegistries = registries.filter((registry) => matchesSearch(searchQuery, [
-    registry.name,
-    registry.provider,
-    registry.registry_host,
-    registry.namespace,
-    registry.repository,
-    registry.default_image,
-    registry.enabled ? 'enabled' : 'disabled',
-  ]))
 
   const saveRegistry = useMutation({
     mutationFn: () => upsertContainerRegistry(registryInput(form)),
@@ -102,7 +90,7 @@ export function RegistriesRoute() {
           }}
         />
       </div>
-      <RegistryList registries={visibleRegistries} />
+      <RegistryList registries={registries} />
     </div>
   )
 }
diff --git a/web/src/store/ui.ts b/web/src/store/ui.ts
index 320c839374..3c2db36f90 100644
--- a/web/src/store/ui.ts
+++ b/web/src/store/ui.ts
@@ -11,9 +11,7 @@ export function nextTheme(current: Theme): Theme {
 
 type UiState = {
   sidebarCollapsed: boolean
-  searchQuery: string
   theme: Theme
-  setSearchQuery: (searchQuery: string) => void
   toggleSidebar: () => void
   setTheme: (theme: Theme) => void
 }
@@ -55,9 +53,7 @@ applyTheme(initialTheme)
 
 export const useUiStore = create<UiState>((set) => ({
   sidebarCollapsed: false,
-  searchQuery: '',
   theme: initialTheme,
-  setSearchQuery: (searchQuery) => set({ searchQuery }),
   toggleSidebar: () => set((state) => ({ sidebarCollapsed: !state.sidebarCollapsed })),
   setTheme: (theme) => {
     applyTheme(theme, true)
diff --git a/web/src/styles.css b/web/src/styles.css
index 94994e10cc..915c9e6cfb 100644
--- a/web/src/styles.css
+++ b/web/src/styles.css
@@ -1,9 +1,9 @@
-@import "@fontsource/uncut-sans/latin.css";
+@import "@fontsource-variable/inter";
 @import "tailwindcss";
 @import "tw-animate-css";
 
 @theme {
-  --font-sans: "Uncut Sans", ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+  --font-sans: "Inter Variable", Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
   --font-mono: "SFMono-Regular", Consolas, "Liberation Mono", Menlo, monospace;
   --color-background: #171716;
   --color-surface: #1d1d1b;
@@ -32,12 +32,14 @@
 }
 
 @theme inline {
-  --color-sidebar: var(--prosights-surface);
+  --color-sidebar: var(--prosights-sidebar);
   --color-sidebar-foreground: var(--prosights-text);
-  --color-sidebar-accent: var(--prosights-surface-muted);
+  --color-sidebar-accent: var(--prosights-sidebar-hover);
   --color-sidebar-accent-foreground: var(--prosights-text);
   --color-sidebar-border: var(--prosights-border);
   --color-sidebar-ring: var(--prosights-ring);
+  --color-sidebar-hover: var(--prosights-sidebar-hover);
+  --color-sidebar-selected: var(--prosights-sidebar-selected);
   --color-prosights-canvas: var(--prosights-canvas);
   --color-prosights-surface: var(--prosights-surface);
   --color-prosights-surface-muted: var(--prosights-surface-muted);
@@ -53,16 +55,22 @@
   --radius-prosights-xl: var(--prosights-radius-xl);
 }
 
+/* Light palette: one cool blue-grey hue family (oklch hue 245) for every
+   neutral. The sidebar surface is a slightly violet-grey hex on purpose —
+   the temperature split separates chrome from content without any border. */
 :root,
 html.light {
-  --prosights-canvas: #f6f6f7;
+  --prosights-canvas: oklch(0.966 0.004 245);
   --prosights-surface: #ffffff;
-  --prosights-surface-muted: #f1f1f0;
-  --prosights-border: #ddddda;
-  --prosights-text: #080808;
-  --prosights-muted: #4c4e4e;
-  --prosights-subtle: #9f9fa0;
-  --prosights-ring: rgba(8, 8, 8, 0.12);
+  --prosights-surface-muted: oklch(0.965 0.006 245);
+  --prosights-border: oklch(0.905 0.009 245);
+  --prosights-text: oklch(0.205 0.012 245);
+  --prosights-muted: oklch(0.52 0.014 245);
+  --prosights-subtle: oklch(0.71 0.012 245);
+  --prosights-ring: oklch(0.6 0.1 245 / 0.35);
+  --prosights-sidebar: #f9f9fb;
+  --prosights-sidebar-hover: #f4f3f7;
+  --prosights-sidebar-selected: #f0eff5;
   --prosights-radius-xs: 4px;
   --prosights-radius-sm: 6px;
   --prosights-radius-md: 8px;
@@ -79,15 +87,18 @@ html.dark {
   --prosights-muted: #b9bbb3;
   --prosights-subtle: #85877f;
   --prosights-ring: rgba(245, 245, 242, 0.18);
+  --prosights-sidebar: #141413;
+  --prosights-sidebar-hover: #1f1f1d;
+  --prosights-sidebar-selected: #242421;
 }
 
 html.light {
-  --color-background: #f6f6f7;
+  --color-background: oklch(0.966 0.004 245);
   --color-surface: #ffffff;
-  --color-panel: #f1f1f0;
-  --color-border: #ddddda;
-  --color-ink: #080808;
-  --color-muted: #4c4e4e;
+  --color-panel: oklch(0.965 0.006 245);
+  --color-border: oklch(0.905 0.009 245);
+  --color-ink: oklch(0.205 0.012 245);
+  --color-muted: oklch(0.52 0.014 245);
   --color-accent-fg: #ffffff;
   --color-base: #ffffff;
   --color-coolgray-100: #f8f9fa;
@@ -171,7 +182,7 @@ button:disabled {
 
 .architecture-grid {
   background-color: var(--prosights-canvas);
-  background-image: radial-gradient(color-mix(in srgb, var(--prosights-subtle) 42%, transparent) 1px, transparent 1px);
+  background-image: radial-gradient(color-mix(in srgb, var(--prosights-subtle) 30%, transparent) 1px, transparent 1px);
   background-size: 22px 22px;
 }