diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f2d736e..64082fe 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,7 +31,7 @@ jobs:
   jvm:
     uses: 'JorisJonkers-dev/github-workflows/.github/workflows/jvm-ci.yml@v0.8.0'
     with:
-      lint-gradle-args: ':api:detekt :api:ktlintCheck'
+      lint-gradle-args: ':api:detektMain :api:detektTest :api:detektIntegrationTest :api:ktlintCheck'
       test-gradle-args: >-
         :api:test
         :api:integrationTest
diff --git a/api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/auth/IntegrationTestBase.kt b/api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/auth/IntegrationTestBase.kt
index 655309a..38d7280 100644
--- a/api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/auth/IntegrationTestBase.kt
+++ b/api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/auth/IntegrationTestBase.kt
@@ -12,6 +12,7 @@ import org.testcontainers.containers.GenericContainer
 import org.testcontainers.junit.jupiter.Testcontainers
 import org.testcontainers.postgresql.PostgreSQLContainer
 import org.testcontainers.rabbitmq.RabbitMQContainer
+import org.testcontainers.utility.DockerImageName
 
 @Tag("integration")
 @SpringBootTest
@@ -41,9 +42,8 @@ abstract class IntegrationTestBase {
                 withPassword("auth_password")
             }
 
-        @Suppress("DEPRECATION")
         private val valkey =
-            GenericContainer<Nothing>("valkey/valkey:7-alpine").apply {
+            GenericContainer<Nothing>(DockerImageName.parse("valkey/valkey:7-alpine")).apply {
                 withExposedPorts(6379)
             }
 
diff --git a/api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/auth/flow/OAuth2FlowIntegrationTest.kt b/api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/auth/flow/OAuth2FlowIntegrationTest.kt
index a506de6..7802f55 100644
--- a/api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/auth/flow/OAuth2FlowIntegrationTest.kt
+++ b/api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/auth/flow/OAuth2FlowIntegrationTest.kt
@@ -1018,7 +1018,6 @@ class OAuth2FlowIntegrationTest : IntegrationTestBase() {
         }
     }
 
-    @Suppress("DEPRECATION")
     @Test
     fun `authorization consent is not required for configured clients`() {
         val username = uniqueUsername()
diff --git a/api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/auth/health/HealthIntegrationTest.kt b/api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/auth/health/HealthIntegrationTest.kt
index f00c399..42eb5a4 100644
--- a/api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/auth/health/HealthIntegrationTest.kt
+++ b/api/src/integrationTest/kotlin/com/jorisjonkers/personalstack/auth/health/HealthIntegrationTest.kt
@@ -60,15 +60,12 @@ class HealthIntegrationTest : IntegrationTestBase() {
         // the auto-registered discoveryComposite is intentionally
         // uninitialised in this stack; that should not break the test.
         val downComponents =
-            @Suppress("DEPRECATION")
             components
-                .fields()
-                .asSequence()
+                .properties()
                 .filter { (_, node) ->
                     val status = node["status"]?.asText()
                     status == "DOWN" || status == "OUT_OF_SERVICE"
                 }.map { (name, node) -> "$name=${node["status"]?.asText()}" }
-                .toList()
 
         assertThat(downComponents)
             .describedAs("composite UP but a contributor is DOWN: $downComponents full=$body")
diff --git a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/AuthApiApplication.kt b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/AuthApiApplication.kt
index a23dfb9..cbb002b 100644
--- a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/AuthApiApplication.kt
+++ b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/AuthApiApplication.kt
@@ -1,7 +1,7 @@
 package com.jorisjonkers.personalstack.auth
 
+import org.springframework.boot.SpringApplication
 import org.springframework.boot.autoconfigure.SpringBootApplication
-import org.springframework.boot.runApplication
 import org.springframework.scheduling.annotation.EnableAsync
 
 @EnableAsync
@@ -9,5 +9,5 @@ import org.springframework.scheduling.annotation.EnableAsync
 class AuthApiApplication
 
 fun main(args: Array<String>) {
-    runApplication<AuthApiApplication>(*args)
+    SpringApplication.run(arrayOf(AuthApiApplication::class.java), args)
 }
diff --git a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/application/command/ChangePasswordCommandHandler.kt b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/application/command/ChangePasswordCommandHandler.kt
index aa4ae77..d0500c0 100644
--- a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/application/command/ChangePasswordCommandHandler.kt
+++ b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/application/command/ChangePasswordCommandHandler.kt
@@ -2,6 +2,8 @@ package com.jorisjonkers.personalstack.auth.application.command
 
 import com.jorisjonkers.personalstack.auth.domain.exception.InvalidPasswordException
 import com.jorisjonkers.personalstack.auth.domain.exception.UserNotFoundException
+import com.jorisjonkers.personalstack.auth.domain.model.UserCredentials
+import com.jorisjonkers.personalstack.auth.domain.model.UserId
 import com.jorisjonkers.personalstack.auth.domain.port.PasswordEncoder
 import com.jorisjonkers.personalstack.auth.domain.port.UserRepository
 import com.jorisjonkers.personalstack.common.command.CommandHandler
@@ -12,20 +14,16 @@ class ChangePasswordCommandHandler(
     private val userRepository: UserRepository,
     private val passwordEncoder: PasswordEncoder,
 ) : CommandHandler<ChangePasswordCommand> {
-    @Suppress("ThrowsCount")
     override fun handle(command: ChangePasswordCommand) {
-        val user =
-            userRepository.findById(command.userId)
-                ?: throw UserNotFoundException(command.userId)
-        val credentials =
-            userRepository.findCredentialsByUsername(user.username)
-                ?: throw UserNotFoundException(command.userId)
-
+        val credentials = resolveCredentials(command.userId)
         if (!passwordEncoder.matches(command.currentPassword, credentials.passwordHash)) {
             throw InvalidPasswordException()
         }
+        userRepository.updatePassword(command.userId, passwordEncoder.encode(command.newPassword))
+    }
 
-        val newHash = passwordEncoder.encode(command.newPassword)
-        userRepository.updatePassword(command.userId, newHash)
+    private fun resolveCredentials(userId: UserId): UserCredentials {
+        val user = userRepository.findById(userId) ?: throw UserNotFoundException(userId)
+        return userRepository.findCredentialsByUsername(user.username) ?: throw UserNotFoundException(userId)
     }
 }
diff --git a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/application/command/ConfirmEmailCommandHandler.kt b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/application/command/ConfirmEmailCommandHandler.kt
index c0a737b..06505bf 100644
--- a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/application/command/ConfirmEmailCommandHandler.kt
+++ b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/application/command/ConfirmEmailCommandHandler.kt
@@ -1,6 +1,7 @@
 package com.jorisjonkers.personalstack.auth.application.command
 
 import com.jorisjonkers.personalstack.auth.domain.exception.InvalidConfirmationTokenException
+import com.jorisjonkers.personalstack.auth.domain.model.EmailConfirmationToken
 import com.jorisjonkers.personalstack.auth.domain.port.EmailConfirmationTokenRepository
 import com.jorisjonkers.personalstack.auth.domain.port.UserRepository
 import com.jorisjonkers.personalstack.common.command.CommandHandler
@@ -12,26 +13,25 @@ class ConfirmEmailCommandHandler(
     private val emailConfirmationTokenRepository: EmailConfirmationTokenRepository,
     private val userRepository: UserRepository,
 ) : CommandHandler<ConfirmEmailCommand> {
-    @Suppress("ThrowsCount")
     override fun handle(command: ConfirmEmailCommand) {
-        val token =
-            emailConfirmationTokenRepository.findByToken(command.token)
-                ?: throw InvalidConfirmationTokenException("Confirmation token not found")
-
-        if (token.isUsed()) {
-            throw InvalidConfirmationTokenException("Confirmation token has already been used")
-        }
-
-        if (token.isExpired()) {
-            throw InvalidConfirmationTokenException("Confirmation token has expired")
-        }
-
+        val token = resolveValidToken(command.token)
         val user =
             userRepository.findById(token.userId)
                 ?: throw InvalidConfirmationTokenException("User not found for confirmation token")
-
         userRepository.update(user.copy(emailConfirmed = true, updatedAt = Instant.now()))
-
         emailConfirmationTokenRepository.save(token.copy(usedAt = Instant.now()))
     }
+
+    private fun resolveValidToken(rawToken: String): EmailConfirmationToken {
+        val token = emailConfirmationTokenRepository.findByToken(rawToken)
+        val invalidReason =
+            when {
+                token == null -> "Confirmation token not found"
+                token.isUsed() -> "Confirmation token has already been used"
+                token.isExpired() -> "Confirmation token has expired"
+                else -> null
+            }
+        invalidReason?.let { throw InvalidConfirmationTokenException(it) }
+        return checkNotNull(token) { "token was validated non-null above" }
+    }
 }
diff --git a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/application/command/RegisterUserCommandHandler.kt b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/application/command/RegisterUserCommandHandler.kt
index 3734bb8..0e0b0f2 100644
--- a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/application/command/RegisterUserCommandHandler.kt
+++ b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/application/command/RegisterUserCommandHandler.kt
@@ -29,15 +29,23 @@ class RegisterUserCommandHandler(
     private val rabbitMqMessagingProperties: RabbitMqMessagingProperties,
     private val emailConfirmationTokenRepository: EmailConfirmationTokenRepository,
 ) : CommandHandler<RegisterUserCommand> {
-    @Suppress("LongMethod")
     override fun handle(command: RegisterUserCommand) {
+        checkNoDuplicates(command)
+        val savedUser = createUser(command)
+        val confirmationToken = createAndSaveConfirmationToken(savedUser)
+        publishEvents(savedUser, confirmationToken)
+    }
+
+    private fun checkNoDuplicates(command: RegisterUserCommand) {
         if (userRepository.existsByUsername(command.username)) {
             throw DuplicateUsernameException(command.username)
         }
         if (userRepository.existsByEmail(command.email)) {
             throw DuplicateEmailException(command.email)
         }
+    }
 
+    private fun createUser(command: RegisterUserCommand): User {
         val now = Instant.now()
         val user =
             User(
@@ -53,24 +61,32 @@ class RegisterUserCommandHandler(
                 updatedAt = now,
             )
         val passwordHash = passwordEncoder.encode(command.password)
-        val savedUser = userRepository.create(user, passwordHash)
+        return userRepository.create(user, passwordHash)
+    }
 
-        val confirmationToken =
+    private fun createAndSaveConfirmationToken(user: User): EmailConfirmationToken {
+        val token =
             EmailConfirmationToken(
                 id = UUID.randomUUID(),
-                userId = savedUser.id,
+                userId = user.id,
                 token = UUID.randomUUID().toString(),
                 expiresAt = Instant.now().plus(TOKEN_EXPIRY_HOURS, ChronoUnit.HOURS),
                 usedAt = null,
                 createdAt = Instant.now(),
             )
-        emailConfirmationTokenRepository.save(confirmationToken)
+        emailConfirmationTokenRepository.save(token)
+        return token
+    }
 
+    private fun publishEvents(
+        user: User,
+        confirmationToken: EmailConfirmationToken,
+    ) {
         val event =
             UserRegisteredEvent(
-                userId = savedUser.id,
-                username = savedUser.username,
-                email = savedUser.email,
+                userId = user.id,
+                username = user.username,
+                email = user.email,
             )
         // Intra-service event (Spring Modulith)
         eventPublisher.publishEvent(event)
@@ -80,9 +96,9 @@ class RegisterUserCommandHandler(
         // Email confirmation event
         eventPublisher.publishEvent(
             EmailConfirmationRequestedEvent(
-                userId = savedUser.id,
-                username = savedUser.username,
-                email = savedUser.email,
+                userId = user.id,
+                username = user.username,
+                email = user.email,
                 confirmationToken = confirmationToken.token,
             ),
         )
diff --git a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/application/command/ResetPasswordCommandHandler.kt b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/application/command/ResetPasswordCommandHandler.kt
index c657cc3..95bb424 100644
--- a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/application/command/ResetPasswordCommandHandler.kt
+++ b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/application/command/ResetPasswordCommandHandler.kt
@@ -1,6 +1,7 @@
 package com.jorisjonkers.personalstack.auth.application.command
 
 import com.jorisjonkers.personalstack.auth.domain.exception.InvalidResetTokenException
+import com.jorisjonkers.personalstack.auth.domain.model.PasswordResetToken
 import com.jorisjonkers.personalstack.auth.domain.port.PasswordEncoder
 import com.jorisjonkers.personalstack.auth.domain.port.PasswordResetTokenRepository
 import com.jorisjonkers.personalstack.auth.domain.port.UserRepository
@@ -14,22 +15,22 @@ class ResetPasswordCommandHandler(
     private val userRepository: UserRepository,
     private val passwordEncoder: PasswordEncoder,
 ) : CommandHandler<ResetPasswordCommand> {
-    @Suppress("ThrowsCount")
     override fun handle(command: ResetPasswordCommand) {
-        val token =
-            passwordResetTokenRepository.findByToken(command.token)
-                ?: throw InvalidResetTokenException("Password reset token not found")
-
-        if (token.isUsed()) {
-            throw InvalidResetTokenException("Password reset token has already been used")
-        }
-        if (token.isExpired()) {
-            throw InvalidResetTokenException("Password reset token has expired")
-        }
-
-        val newHash = passwordEncoder.encode(command.newPassword)
-        userRepository.updatePassword(token.userId, newHash)
-
+        val token = resolveValidToken(command.token)
+        userRepository.updatePassword(token.userId, passwordEncoder.encode(command.newPassword))
         passwordResetTokenRepository.save(token.copy(usedAt = Instant.now()))
     }
+
+    private fun resolveValidToken(rawToken: String): PasswordResetToken {
+        val token = passwordResetTokenRepository.findByToken(rawToken)
+        val invalidReason =
+            when {
+                token == null -> "Password reset token not found"
+                token.isUsed() -> "Password reset token has already been used"
+                token.isExpired() -> "Password reset token has expired"
+                else -> null
+            }
+        invalidReason?.let { throw InvalidResetTokenException(it) }
+        return checkNotNull(token) { "token was validated non-null above" }
+    }
 }
diff --git a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/AuthorizationServerConfig.kt b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/AuthorizationServerConfig.kt
index f7fda17..251a839 100644
--- a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/AuthorizationServerConfig.kt
+++ b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/AuthorizationServerConfig.kt
@@ -1,10 +1,7 @@
 package com.jorisjonkers.personalstack.auth.config
 
-import com.jorisjonkers.personalstack.auth.domain.model.Role
 import com.jorisjonkers.personalstack.auth.domain.model.ServicePermission
-import com.jorisjonkers.personalstack.auth.domain.model.UserCredentials
 import com.jorisjonkers.personalstack.auth.domain.model.UserId
-import com.jorisjonkers.personalstack.auth.domain.port.UserRepository
 import com.jorisjonkers.personalstack.auth.infrastructure.security.AuthenticatedUser
 import jakarta.servlet.FilterChain
 import jakarta.servlet.http.HttpServletRequest
@@ -23,19 +20,14 @@ import org.springframework.security.config.annotation.web.configurers.oauth2.ser
 import org.springframework.security.core.Authentication
 import org.springframework.security.core.context.SecurityContextHolder
 import org.springframework.security.jackson.SecurityJacksonModules
-import org.springframework.security.oauth2.core.oidc.OidcScopes
-import org.springframework.security.oauth2.core.oidc.endpoint.OidcParameterNames
 import org.springframework.security.oauth2.server.authorization.JdbcOAuth2AuthorizationConsentService
 import org.springframework.security.oauth2.server.authorization.JdbcOAuth2AuthorizationService
 import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationConsentService
 import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationService
-import org.springframework.security.oauth2.server.authorization.OAuth2TokenType
 import org.springframework.security.oauth2.server.authorization.client.InMemoryRegisteredClientRepository
 import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository
 import org.springframework.security.oauth2.server.authorization.jackson.OAuth2AuthorizationServerJacksonModule
 import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings
-import org.springframework.security.oauth2.server.authorization.token.JwtEncodingContext
-import org.springframework.security.oauth2.server.authorization.token.OAuth2TokenCustomizer
 import org.springframework.security.web.SecurityFilterChain
 import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint
 import org.springframework.security.web.context.HttpSessionSecurityContextRepository
@@ -186,47 +178,6 @@ class AuthorizationServerConfig(
             registeredClientRepository,
         )
 
-    @Bean
-    @Suppress("LongMethod")
-    fun jwtTokenCustomizer(userRepository: UserRepository): OAuth2TokenCustomizer<JwtEncodingContext> =
-        OAuth2TokenCustomizer { context ->
-            val principal = context.getPrincipal<Authentication>()
-            val credentials =
-                userRepository.findCredentialsByUsername(principal.name) ?: return@OAuth2TokenCustomizer
-            val roles = buildRoles(credentials)
-
-            when {
-                context.tokenType == OAuth2TokenType.ACCESS_TOKEN -> {
-                    context.claims.claim("roles", roles)
-                    context.claims.claim("username", credentials.username)
-                    context.claims.claim("preferred_username", credentials.username)
-                    context.claims.claim("email", credentials.email)
-                    context.claims.claim("aud", listOf(context.registeredClient.clientId))
-                    context.claims.subject(credentials.userId.value.toString())
-                }
-
-                context.tokenType.value == OidcParameterNames.ID_TOKEN -> {
-                    context.claims.claim("roles", roles)
-                    context.claims.subject(credentials.userId.value.toString())
-
-                    if (OidcScopes.PROFILE in context.authorizedScopes) {
-                        context.claims.claim("preferred_username", credentials.username)
-                        context.claims.claim("name", "${credentials.firstName} ${credentials.lastName}")
-                    }
-
-                    if (OidcScopes.EMAIL in context.authorizedScopes) {
-                        context.claims.claim("email", credentials.email)
-                        context.claims.claim("email_verified", credentials.emailConfirmed)
-                    }
-
-                    val k8sGroups = kubernetesGroups(credentials)
-                    if (k8sGroups.isNotEmpty() && "groups" in context.authorizedScopes) {
-                        context.claims.claim("groups", k8sGroups)
-                    }
-                }
-            }
-        }
-
     @Bean
     fun authorizationServerSettings(): AuthorizationServerSettings =
         AuthorizationServerSettings
@@ -240,31 +191,6 @@ class AuthorizationServerConfig(
             .oidcUserInfoEndpoint("/api/userinfo")
             .build()
 
-    private fun buildRoles(credentials: UserCredentials): List<String> =
-        buildList {
-            add("ROLE_${credentials.role.name}")
-            if (credentials.role == Role.ADMIN) {
-                addAll(ServicePermission.entries.map { "SERVICE_${it.name}" })
-            } else {
-                addAll(credentials.servicePermissions.map { "SERVICE_${it.name}" })
-            }
-        }
-
-    // Kubernetes group membership for ID tokens issued to OIDC clients that
-    // talk to the k3s API server (Headlamp). The k3s control plane runs
-    // --oidc-groups-claim=groups --oidc-groups-prefix=oidc: and we bind
-    // oidc:k8s-admin to the cluster-admin ClusterRole. DASHBOARD permission
-    // therefore grants full cluster management, matching how the host-level
-    // forward-auth already gates access to dashboard.jorisjonkers.dev.
-    private fun kubernetesGroups(credentials: UserCredentials): List<String> =
-        if (credentials.role == Role.ADMIN ||
-            ServicePermission.DASHBOARD in credentials.servicePermissions
-        ) {
-            listOf("k8s-admin")
-        } else {
-            emptyList()
-        }
-
     private fun downstreamClientAuthorizationFilter(): OncePerRequestFilter =
         object : OncePerRequestFilter() {
             override fun shouldNotFilter(request: HttpServletRequest): Boolean {
diff --git a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/CommandBusConfig.kt b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/CommandBusConfig.kt
index b4583ec..de17fff 100644
--- a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/CommandBusConfig.kt
+++ b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/CommandBusConfig.kt
@@ -6,6 +6,7 @@ import com.jorisjonkers.personalstack.common.command.CommandHandler
 import org.springframework.aop.support.AopUtils
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
+import java.lang.reflect.InvocationTargetException
 import kotlin.reflect.KClass
 import kotlin.reflect.full.allSupertypes
 
@@ -18,22 +19,24 @@ class CommandBusConfig {
 class SpringCommandBus(
     handlers: List<CommandHandler<*>>,
 ) : CommandBus {
-    private val handlerMap: Map<KClass<*>, CommandHandler<*>> =
+    // Each value is a type-erased adapter created once at registration time. Calling
+    // CommandHandler<*>.handle via the erased bridge method avoids an unchecked cast —
+    // the KClass key guarantees only the matching command type reaches each handler.
+    private val handlerMap: Map<KClass<*>, (Command) -> Unit> =
         buildMap {
             for (handler in handlers) {
                 val commandType =
                     resolveCommandType(handler)
                         ?: error("Cannot determine command type for ${handler::class.simpleName}")
-                put(commandType, handler)
+                this[commandType] = erased(handler)
             }
         }
 
-    @Suppress("UNCHECKED_CAST")
     override fun <T : Command> dispatch(command: T) {
-        val handler =
-            handlerMap[command::class] as? CommandHandler<T>
+        val adapter =
+            handlerMap[command::class]
                 ?: error("No handler registered for ${command::class.simpleName}")
-        handler.handle(command)
+        adapter(command)
     }
 
     // The handler may be wrapped in a CGLIB proxy (Spring AOP) which
@@ -51,4 +54,24 @@ class SpringCommandBus(
             ?.firstOrNull()
             ?.type
             ?.classifier as? KClass<*>
+
+    companion object {
+        // The JVM erases CommandHandler<T>.handle to handle(Command), so we can
+        // look up the method by the erased signature and invoke it directly.
+        // This avoids a Kotlin UNCHECKED_CAST while staying type-safe: dispatch()
+        // routes only the matching KClass to each handler.
+        private val handleMethod =
+            CommandHandler::class.java.getMethod("handle", Command::class.java)
+
+        private fun erased(handler: CommandHandler<*>): (Command) -> Unit =
+            { command ->
+                try {
+                    handleMethod.invoke(handler, command)
+                } catch (ex: InvocationTargetException) {
+                    // Reflective invoke wraps handler exceptions; rethrow the real cause so
+                    // domain exceptions (e.g. DuplicateUsername) reach the exception handler.
+                    throw ex.cause ?: ex
+                }
+            }
+    }
 }
diff --git a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/JacksonMixins.kt b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/JacksonMixins.kt
index f802816..8fe6e13 100644
--- a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/JacksonMixins.kt
+++ b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/JacksonMixins.kt
@@ -8,6 +8,8 @@ import com.fasterxml.jackson.annotation.JsonTypeInfo
 import com.jorisjonkers.personalstack.auth.domain.model.UserId
 import java.util.UUID
 
+// Jackson mixin: constructor parameters are consumed by Jackson via @JsonCreator
+// during deserialization and are intentionally not referenced in the class body.
 @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
 @JsonAutoDetect(
     fieldVisibility = JsonAutoDetect.Visibility.ANY,
@@ -15,18 +17,19 @@ import java.util.UUID
     isGetterVisibility = JsonAutoDetect.Visibility.NONE,
 )
 @JsonIgnoreProperties(ignoreUnknown = true)
-abstract class AuthenticatedUserMixin
+class AuthenticatedUserMixin
     @JsonCreator
     constructor(
-        @JsonProperty("userId") userId: UserId,
-        @JsonProperty("username") username: String,
-        @JsonProperty("roles") roles: List<String>,
-        @JsonProperty("passwordHash") passwordHash: String,
+        @param:JsonProperty("userId") val userId: UserId,
+        @param:JsonProperty("username") val username: String,
+        @param:JsonProperty("roles") val roles: List<String>,
+        @param:JsonProperty("passwordHash") val passwordHash: String,
     )
 
+// Jackson mixin: constructor parameter consumed by Jackson via @JsonCreator.
 @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
-abstract class UserIdMixin
+class UserIdMixin
     @JsonCreator
     constructor(
-        @JsonProperty("value") value: UUID,
+        @param:JsonProperty("value") val value: UUID,
     )
diff --git a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/JwtConfig.kt b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/JwtConfig.kt
index 506b601..aa18d55 100644
--- a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/JwtConfig.kt
+++ b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/JwtConfig.kt
@@ -52,47 +52,48 @@ class JwtConfig(
      * the previous key remains available for verifying tokens issued before rotation.
      */
     @Bean
-    @Suppress("LongMethod")
-    fun jwkSource(): JWKSource<SecurityContext> {
+    fun jwkSource(): JWKSource<SecurityContext> =
         if (transitEnabled) {
-            val keys: MutableList<JWK> =
-                loadTransitKeys()
-                    .map { key ->
-                        RSAKey
-                            .Builder(key.publicKey)
-                            .keyID(key.keyId)
-                            .build()
-                    }.toMutableList()
-
-            if (signingKeyPem.isNotBlank()) {
-                keys.add(
-                    RSAKey
-                        .Builder(derivePublicKey(parseRsaPrivateKey(signingKeyPem)))
-                        .keyID(CURRENT_KEY_ID)
-                        .build(),
-                )
-            }
+            buildTransitJwkSource()
+        } else {
+            buildLocalJwkSource()
+        }
 
-            if (previousSigningKeyPem.isNotBlank()) {
-                keys.add(
-                    RSAKey
-                        .Builder(derivePublicKey(parseRsaPrivateKey(previousSigningKeyPem)))
-                        .keyID(PREVIOUS_KEY_ID)
-                        .build(),
-                )
-            }
+    private fun buildTransitJwkSource(): JWKSource<SecurityContext> {
+        val keys: MutableList<JWK> =
+            loadTransitKeys()
+                .map { key -> RSAKey.Builder(key.publicKey).keyID(key.keyId).build() }
+                .toMutableList()
 
-            return ImmutableJWKSet(JWKSet(keys))
+        if (signingKeyPem.isNotBlank()) {
+            keys.add(
+                RSAKey
+                    .Builder(derivePublicKey(parseRsaPrivateKey(signingKeyPem)))
+                    .keyID(CURRENT_KEY_ID)
+                    .build(),
+            )
         }
 
+        if (previousSigningKeyPem.isNotBlank()) {
+            keys.add(
+                RSAKey
+                    .Builder(derivePublicKey(parseRsaPrivateKey(previousSigningKeyPem)))
+                    .keyID(PREVIOUS_KEY_ID)
+                    .build(),
+            )
+        }
+
+        return ImmutableJWKSet(JWKSet(keys))
+    }
+
+    private fun buildLocalJwkSource(): JWKSource<SecurityContext> {
         val keys = mutableListOf<RSAKey>()
 
         if (signingKeyPem.isNotBlank()) {
             val privateKey = parseRsaPrivateKey(signingKeyPem)
-            val publicKey = derivePublicKey(privateKey)
             keys.add(
                 RSAKey
-                    .Builder(publicKey)
+                    .Builder(derivePublicKey(privateKey))
                     .privateKey(privateKey)
                     .keyID(CURRENT_KEY_ID)
                     .build(),
@@ -111,10 +112,9 @@ class JwtConfig(
         // Include the previous key for verification during rotation window
         if (previousSigningKeyPem.isNotBlank()) {
             val prevPrivateKey = parseRsaPrivateKey(previousSigningKeyPem)
-            val prevPublicKey = derivePublicKey(prevPrivateKey)
             keys.add(
                 RSAKey
-                    .Builder(prevPublicKey)
+                    .Builder(derivePublicKey(prevPrivateKey))
                     .privateKey(prevPrivateKey)
                     .keyID(PREVIOUS_KEY_ID)
                     .build(),
diff --git a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/JwtTokenCustomizerConfig.kt b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/JwtTokenCustomizerConfig.kt
new file mode 100644
index 0000000..45287ab
--- /dev/null
+++ b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/JwtTokenCustomizerConfig.kt
@@ -0,0 +1,95 @@
+package com.jorisjonkers.personalstack.auth.config
+
+import com.jorisjonkers.personalstack.auth.domain.model.Role
+import com.jorisjonkers.personalstack.auth.domain.model.ServicePermission
+import com.jorisjonkers.personalstack.auth.domain.model.UserCredentials
+import com.jorisjonkers.personalstack.auth.domain.port.UserRepository
+import org.springframework.context.annotation.Bean
+import org.springframework.context.annotation.Configuration
+import org.springframework.security.core.Authentication
+import org.springframework.security.oauth2.core.oidc.OidcScopes
+import org.springframework.security.oauth2.core.oidc.endpoint.OidcParameterNames
+import org.springframework.security.oauth2.server.authorization.OAuth2TokenType
+import org.springframework.security.oauth2.server.authorization.token.JwtEncodingContext
+import org.springframework.security.oauth2.server.authorization.token.OAuth2TokenCustomizer
+
+@Configuration
+class JwtTokenCustomizerConfig {
+    @Bean
+    fun jwtTokenCustomizer(userRepository: UserRepository): OAuth2TokenCustomizer<JwtEncodingContext> =
+        OAuth2TokenCustomizer { context ->
+            val principal = context.getPrincipal<Authentication>()
+            val credentials =
+                userRepository.findCredentialsByUsername(principal.name) ?: return@OAuth2TokenCustomizer
+            val roles = buildRoles(credentials)
+
+            when {
+                context.tokenType == OAuth2TokenType.ACCESS_TOKEN ->
+                    customizeAccessToken(context, credentials, roles)
+                context.tokenType.value == OidcParameterNames.ID_TOKEN ->
+                    customizeIdToken(context, credentials, roles)
+            }
+        }
+
+    private fun customizeAccessToken(
+        context: JwtEncodingContext,
+        credentials: UserCredentials,
+        roles: List<String>,
+    ) {
+        context.claims.claim("roles", roles)
+        context.claims.claim("username", credentials.username)
+        context.claims.claim("preferred_username", credentials.username)
+        context.claims.claim("email", credentials.email)
+        context.claims.claim("aud", listOf(context.registeredClient.clientId))
+        context.claims.subject(credentials.userId.value.toString())
+    }
+
+    private fun customizeIdToken(
+        context: JwtEncodingContext,
+        credentials: UserCredentials,
+        roles: List<String>,
+    ) {
+        context.claims.claim("roles", roles)
+        context.claims.subject(credentials.userId.value.toString())
+
+        if (OidcScopes.PROFILE in context.authorizedScopes) {
+            context.claims.claim("preferred_username", credentials.username)
+            context.claims.claim("name", "${credentials.firstName} ${credentials.lastName}")
+        }
+
+        if (OidcScopes.EMAIL in context.authorizedScopes) {
+            context.claims.claim("email", credentials.email)
+            context.claims.claim("email_verified", credentials.emailConfirmed)
+        }
+
+        val k8sGroups = kubernetesGroups(credentials)
+        if (k8sGroups.isNotEmpty() && "groups" in context.authorizedScopes) {
+            context.claims.claim("groups", k8sGroups)
+        }
+    }
+
+    private fun buildRoles(credentials: UserCredentials): List<String> =
+        buildList {
+            add("ROLE_${credentials.role.name}")
+            if (credentials.role == Role.ADMIN) {
+                addAll(ServicePermission.entries.map { "SERVICE_${it.name}" })
+            } else {
+                addAll(credentials.servicePermissions.map { "SERVICE_${it.name}" })
+            }
+        }
+
+    // Kubernetes group membership for ID tokens issued to OIDC clients that
+    // talk to the k3s API server (Headlamp). The k3s control plane runs
+    // --oidc-groups-claim=groups --oidc-groups-prefix=oidc: and we bind
+    // oidc:k8s-admin to the cluster-admin ClusterRole. DASHBOARD permission
+    // therefore grants full cluster management, matching how the host-level
+    // forward-auth already gates access to dashboard.jorisjonkers.dev.
+    private fun kubernetesGroups(credentials: UserCredentials): List<String> =
+        if (credentials.role == Role.ADMIN ||
+            ServicePermission.DASHBOARD in credentials.servicePermissions
+        ) {
+            listOf("k8s-admin")
+        } else {
+            emptyList()
+        }
+}
diff --git a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/RegisteredClients.kt b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/RegisteredClients.kt
index b2d4482..155fe80 100644
--- a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/RegisteredClients.kt
+++ b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/RegisteredClients.kt
@@ -1,5 +1,3 @@
-@file:Suppress("TooManyFunctions")
-
 package com.jorisjonkers.personalstack.auth.config
 
 import org.springframework.security.oauth2.core.AuthorizationGrantType
@@ -14,9 +12,9 @@ import java.util.UUID
 private val ACCESS_TOKEN_TTL: Duration = Duration.ofMinutes(15)
 private val REFRESH_TOKEN_TTL: Duration = Duration.ofDays(7)
 
-private fun deterministicId(clientId: String): String = UUID.nameUUIDFromBytes(clientId.toByteArray()).toString()
+internal fun deterministicId(clientId: String): String = UUID.nameUUIDFromBytes(clientId.toByteArray()).toString()
 
-private fun defaultTokenSettings(): TokenSettings =
+internal fun defaultTokenSettings(): TokenSettings =
     TokenSettings
         .builder()
         .accessTokenTimeToLive(ACCESS_TOKEN_TTL)
@@ -24,7 +22,7 @@ private fun defaultTokenSettings(): TokenSettings =
         .reuseRefreshTokens(false)
         .build()
 
-private fun noConsentSettings(requirePkce: Boolean): ClientSettings =
+internal fun noConsentSettings(requirePkce: Boolean): ClientSettings =
     ClientSettings
         .builder()
         .requireProofKey(requirePkce)
@@ -90,135 +88,3 @@ fun buildAppNativeClient(): RegisteredClient =
         .clientSettings(noConsentSettings(requirePkce = true))
         .tokenSettings(defaultTokenSettings())
         .build()
-
-fun buildAgentsApiClient(): RegisteredClient =
-    RegisteredClient
-        .withId(deterministicId("agents-api"))
-        .clientId("agents-api")
-        .clientSecret("{noop}agents-secret")
-        .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
-        .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
-        .scope("api.read")
-        .scope("api.write")
-        .tokenSettings(
-            TokenSettings
-                .builder()
-                .accessTokenTimeToLive(ACCESS_TOKEN_TTL)
-                .build(),
-        ).build()
-
-fun buildGrafanaClient(secret: String): RegisteredClient =
-    RegisteredClient
-        .withId(deterministicId("grafana"))
-        .clientId("grafana")
-        .clientSecret("{noop}$secret")
-        .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
-        .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_POST)
-        .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
-        .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
-        .redirectUri("https://grafana.jorisjonkers.dev/login/generic_oauth")
-        .redirectUri("https://grafana.jorisjonkers.test/login/generic_oauth")
-        .scope(OidcScopes.OPENID)
-        .scope(OidcScopes.PROFILE)
-        .scope(OidcScopes.EMAIL)
-        .clientSettings(noConsentSettings(requirePkce = false))
-        .tokenSettings(defaultTokenSettings())
-        .build()
-
-fun buildN8nClient(secret: String): RegisteredClient =
-    RegisteredClient
-        .withId(deterministicId("n8n"))
-        .clientId("n8n")
-        .clientSecret("{noop}$secret")
-        .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
-        .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_POST)
-        .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
-        .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
-        .redirectUri("https://n8n.jorisjonkers.dev/auth/oidc/callback")
-        .redirectUri("https://n8n.jorisjonkers.test/auth/oidc/callback")
-        .scope(OidcScopes.OPENID)
-        .scope(OidcScopes.PROFILE)
-        .scope(OidcScopes.EMAIL)
-        .clientSettings(noConsentSettings(requirePkce = false))
-        .tokenSettings(defaultTokenSettings())
-        .build()
-
-fun buildRabbitMqClient(): RegisteredClient =
-    RegisteredClient
-        .withId(deterministicId("rabbitmq"))
-        .clientId("rabbitmq")
-        .clientAuthenticationMethod(ClientAuthenticationMethod.NONE)
-        .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
-        .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
-        .redirectUri("https://rabbitmq.jorisjonkers.dev/js/oidc-oauth/login-callback.html")
-        .redirectUri("https://rabbitmq.jorisjonkers.test/js/oidc-oauth/login-callback.html")
-        .scope(OidcScopes.OPENID)
-        .scope(OidcScopes.PROFILE)
-        .scope(OidcScopes.EMAIL)
-        .clientSettings(noConsentSettings(requirePkce = true))
-        .tokenSettings(defaultTokenSettings())
-        .build()
-
-fun buildHeadlampClient(): RegisteredClient =
-    RegisteredClient
-        .withId(deterministicId("headlamp"))
-        .clientId("headlamp")
-        // Public client with PKCE — same pattern as rabbitmq. There is no
-        // client secret to manage anywhere (no Vault key, no K8s secret),
-        // which removes the one-time-bootstrap step from the OIDC flow.
-        // The Headlamp backend proves possession of the auth code via
-        // the PKCE verifier instead.
-        .clientAuthenticationMethod(ClientAuthenticationMethod.NONE)
-        .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
-        .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
-        .redirectUri("https://dashboard.jorisjonkers.dev/oidc-callback")
-        .redirectUri("https://dashboard.jorisjonkers.test/oidc-callback")
-        .scope(OidcScopes.OPENID)
-        .scope(OidcScopes.PROFILE)
-        .scope(OidcScopes.EMAIL)
-        // `groups` is a non-standard scope the token customizer recognises
-        // and populates with the Kubernetes group membership the k3s API
-        // server reads via --oidc-groups-claim. The chain is: DASHBOARD
-        // ServicePermission -> `k8s-admin` in the groups claim ->
-        // cluster-admin via the oidc:k8s-admin ClusterRoleBinding.
-        .scope("groups")
-        .clientSettings(noConsentSettings(requirePkce = true))
-        .tokenSettings(defaultTokenSettings())
-        .build()
-
-fun buildImmichClient(): RegisteredClient =
-    RegisteredClient
-        .withId(deterministicId("immich"))
-        .clientId("immich")
-        .clientAuthenticationMethod(ClientAuthenticationMethod.NONE)
-        .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
-        .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
-        .redirectUri("https://immich.jorisjonkers.dev/auth/login")
-        .redirectUri("https://immich.jorisjonkers.test/auth/login")
-        .redirectUri("app.immich:///oauth-callback")
-        .scope(OidcScopes.OPENID)
-        .scope(OidcScopes.PROFILE)
-        .scope(OidcScopes.EMAIL)
-        .clientSettings(noConsentSettings(requirePkce = true))
-        .tokenSettings(defaultTokenSettings())
-        .build()
-
-fun buildVaultClient(secret: String): RegisteredClient =
-    RegisteredClient
-        .withId(deterministicId("vault"))
-        .clientId("vault")
-        .clientSecret("{noop}$secret")
-        .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
-        .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_POST)
-        .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
-        .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
-        .redirectUri("https://vault.jorisjonkers.dev/ui/vault/auth/oidc/oidc/callback")
-        .redirectUri("https://vault.jorisjonkers.test/ui/vault/auth/oidc/oidc/callback")
-        .redirectUri("http://localhost:8250/oidc/callback")
-        .redirectUri("http://127.0.0.1:8250/oidc/callback")
-        .scope(OidcScopes.OPENID)
-        .scope(OidcScopes.PROFILE)
-        .scope(OidcScopes.EMAIL)
-        .clientSettings(noConsentSettings(requirePkce = false))
-        .tokenSettings(defaultTokenSettings())
-        .build()
diff --git a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/SecurityConfig.kt b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/SecurityConfig.kt
index 99555a4..512d685 100644
--- a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/SecurityConfig.kt
+++ b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/SecurityConfig.kt
@@ -104,7 +104,7 @@ class SecurityConfig(
             },
         )
         csrf.csrfTokenRequestHandler(CsrfTokenRequestAttributeHandler())
-        csrf.ignoringRequestMatchers(*(PUBLIC_POST_ENDPOINTS + CSRF_FREE_ENDPOINTS))
+        CSRF_IGNORED_ENDPOINTS.forEach { csrf.ignoringRequestMatchers(it) }
         csrf.ignoringRequestMatchers(bearerTokenRequestMatcher())
     }
 
@@ -113,11 +113,8 @@ class SecurityConfig(
             .AuthorizeHttpRequestsConfigurer<HttpSecurity>
             .AuthorizationManagerRequestMatcherRegistry,
     ) {
-        auth
-            .requestMatchers(*PUBLIC_ENDPOINTS)
-            .permitAll()
-            .anyRequest()
-            .authenticated()
+        PUBLIC_ENDPOINTS.forEach { auth.requestMatchers(it).permitAll() }
+        auth.anyRequest().authenticated()
     }
 
     private fun forwardAuthEntryPoint() =
@@ -172,7 +169,9 @@ class SecurityConfig(
     }
 
     companion object {
-        private val PUBLIC_POST_ENDPOINTS =
+        // Endpoints exempt from CSRF: public POST endpoints plus health/actuator/verify.
+        // Pre-built as a single array to avoid the spread-copy penalty when configuring CSRF.
+        private val CSRF_IGNORED_ENDPOINTS =
             arrayOf(
                 "/api/v1/auth/session-login",
                 "/api/v1/users/register",
@@ -182,10 +181,6 @@ class SecurityConfig(
                 "/api/v1/auth/resend-confirmation",
                 "/api/v1/auth/forgot-password",
                 "/api/v1/auth/reset-password",
-            )
-
-        private val CSRF_FREE_ENDPOINTS =
-            arrayOf(
                 "/api/actuator/**",
                 "/api/v1/health",
                 "/api/v1/auth/verify",
diff --git a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/ServiceRegisteredClients.kt b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/ServiceRegisteredClients.kt
new file mode 100644
index 0000000..b157db7
--- /dev/null
+++ b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/config/ServiceRegisteredClients.kt
@@ -0,0 +1,142 @@
+package com.jorisjonkers.personalstack.auth.config
+
+import org.springframework.security.oauth2.core.AuthorizationGrantType
+import org.springframework.security.oauth2.core.ClientAuthenticationMethod
+import org.springframework.security.oauth2.core.oidc.OidcScopes
+import org.springframework.security.oauth2.server.authorization.client.RegisteredClient
+import org.springframework.security.oauth2.server.authorization.settings.TokenSettings
+import java.time.Duration
+
+private val AGENTS_ACCESS_TOKEN_TTL: Duration = Duration.ofMinutes(15)
+
+fun buildAgentsApiClient(): RegisteredClient =
+    RegisteredClient
+        .withId(deterministicId("agents-api"))
+        .clientId("agents-api")
+        .clientSecret("{noop}agents-secret")
+        .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
+        .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
+        .scope("api.read")
+        .scope("api.write")
+        .tokenSettings(
+            TokenSettings
+                .builder()
+                .accessTokenTimeToLive(AGENTS_ACCESS_TOKEN_TTL)
+                .build(),
+        ).build()
+
+fun buildGrafanaClient(secret: String): RegisteredClient =
+    RegisteredClient
+        .withId(deterministicId("grafana"))
+        .clientId("grafana")
+        .clientSecret("{noop}$secret")
+        .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
+        .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_POST)
+        .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
+        .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
+        .redirectUri("https://grafana.jorisjonkers.dev/login/generic_oauth")
+        .redirectUri("https://grafana.jorisjonkers.test/login/generic_oauth")
+        .scope(OidcScopes.OPENID)
+        .scope(OidcScopes.PROFILE)
+        .scope(OidcScopes.EMAIL)
+        .clientSettings(noConsentSettings(requirePkce = false))
+        .tokenSettings(defaultTokenSettings())
+        .build()
+
+fun buildN8nClient(secret: String): RegisteredClient =
+    RegisteredClient
+        .withId(deterministicId("n8n"))
+        .clientId("n8n")
+        .clientSecret("{noop}$secret")
+        .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
+        .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_POST)
+        .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
+        .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
+        .redirectUri("https://n8n.jorisjonkers.dev/auth/oidc/callback")
+        .redirectUri("https://n8n.jorisjonkers.test/auth/oidc/callback")
+        .scope(OidcScopes.OPENID)
+        .scope(OidcScopes.PROFILE)
+        .scope(OidcScopes.EMAIL)
+        .clientSettings(noConsentSettings(requirePkce = false))
+        .tokenSettings(defaultTokenSettings())
+        .build()
+
+fun buildRabbitMqClient(): RegisteredClient =
+    RegisteredClient
+        .withId(deterministicId("rabbitmq"))
+        .clientId("rabbitmq")
+        .clientAuthenticationMethod(ClientAuthenticationMethod.NONE)
+        .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
+        .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
+        .redirectUri("https://rabbitmq.jorisjonkers.dev/js/oidc-oauth/login-callback.html")
+        .redirectUri("https://rabbitmq.jorisjonkers.test/js/oidc-oauth/login-callback.html")
+        .scope(OidcScopes.OPENID)
+        .scope(OidcScopes.PROFILE)
+        .scope(OidcScopes.EMAIL)
+        .clientSettings(noConsentSettings(requirePkce = true))
+        .tokenSettings(defaultTokenSettings())
+        .build()
+
+fun buildHeadlampClient(): RegisteredClient =
+    RegisteredClient
+        .withId(deterministicId("headlamp"))
+        .clientId("headlamp")
+        // Public client with PKCE — same pattern as rabbitmq. There is no
+        // client secret to manage anywhere (no Vault key, no K8s secret),
+        // which removes the one-time-bootstrap step from the OIDC flow.
+        // The Headlamp backend proves possession of the auth code via
+        // the PKCE verifier instead.
+        .clientAuthenticationMethod(ClientAuthenticationMethod.NONE)
+        .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
+        .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
+        .redirectUri("https://dashboard.jorisjonkers.dev/oidc-callback")
+        .redirectUri("https://dashboard.jorisjonkers.test/oidc-callback")
+        .scope(OidcScopes.OPENID)
+        .scope(OidcScopes.PROFILE)
+        .scope(OidcScopes.EMAIL)
+        // `groups` is a non-standard scope the token customizer recognises
+        // and populates with the Kubernetes group membership the k3s API
+        // server reads via --oidc-groups-claim. The chain is: DASHBOARD
+        // ServicePermission -> `k8s-admin` in the groups claim ->
+        // cluster-admin via the oidc:k8s-admin ClusterRoleBinding.
+        .scope("groups")
+        .clientSettings(noConsentSettings(requirePkce = true))
+        .tokenSettings(defaultTokenSettings())
+        .build()
+
+fun buildImmichClient(): RegisteredClient =
+    RegisteredClient
+        .withId(deterministicId("immich"))
+        .clientId("immich")
+        .clientAuthenticationMethod(ClientAuthenticationMethod.NONE)
+        .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
+        .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
+        .redirectUri("https://immich.jorisjonkers.dev/auth/login")
+        .redirectUri("https://immich.jorisjonkers.test/auth/login")
+        .redirectUri("app.immich:///oauth-callback")
+        .scope(OidcScopes.OPENID)
+        .scope(OidcScopes.PROFILE)
+        .scope(OidcScopes.EMAIL)
+        .clientSettings(noConsentSettings(requirePkce = true))
+        .tokenSettings(defaultTokenSettings())
+        .build()
+
+fun buildVaultClient(secret: String): RegisteredClient =
+    RegisteredClient
+        .withId(deterministicId("vault"))
+        .clientId("vault")
+        .clientSecret("{noop}$secret")
+        .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
+        .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_POST)
+        .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
+        .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
+        .redirectUri("https://vault.jorisjonkers.dev/ui/vault/auth/oidc/oidc/callback")
+        .redirectUri("https://vault.jorisjonkers.test/ui/vault/auth/oidc/oidc/callback")
+        .redirectUri("http://localhost:8250/oidc/callback")
+        .redirectUri("http://127.0.0.1:8250/oidc/callback")
+        .scope(OidcScopes.OPENID)
+        .scope(OidcScopes.PROFILE)
+        .scope(OidcScopes.EMAIL)
+        .clientSettings(noConsentSettings(requirePkce = false))
+        .tokenSettings(defaultTokenSettings())
+        .build()
diff --git a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/domain/port/UserRepository.kt b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/domain/port/UserRepository.kt
index 350493e..e3a86f7 100644
--- a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/domain/port/UserRepository.kt
+++ b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/domain/port/UserRepository.kt
@@ -5,6 +5,9 @@ import com.jorisjonkers.personalstack.auth.domain.model.User
 import com.jorisjonkers.personalstack.auth.domain.model.UserCredentials
 import com.jorisjonkers.personalstack.auth.domain.model.UserId
 
+// 13 cohesive data-access methods mirroring the contract implemented by JooqUserRepository.
+// The same suppression is approved there; the interface and its implementation are the same case.
+// An interface-split would require duplicating the Spring cache proxy wiring and has been deferred.
 @Suppress("TooManyFunctions")
 interface UserRepository {
     fun findById(id: UserId): User?
diff --git a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/email/AuthEmailTemplates.kt b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/email/AuthEmailTemplates.kt
index 0aa01f8..eb82ddd 100644
--- a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/email/AuthEmailTemplates.kt
+++ b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/email/AuthEmailTemplates.kt
@@ -1,6 +1,5 @@
 package com.jorisjonkers.personalstack.auth.infrastructure.email
 
-@Suppress("LongMethod")
 object AuthEmailTemplates {
     fun welcomeEmail(username: String): Pair<String, String> {
         val textBody =
@@ -17,53 +16,7 @@ object AuthEmailTemplates {
             |— jorisjonkers.dev
             """.trimMargin()
 
-        val htmlBody =
-            """
-            |<!DOCTYPE html>
-            |<html lang="en">
-            |<head><meta charset="UTF-8"></head>
-            |<body style="margin:0;padding:0;background-color:#0d1117;font-family:'SF Mono',Monaco,'Cascadia Code',monospace;">
-            |  <table width="100%" cellpadding="0" cellspacing="0" style="background-color:#0d1117;padding:40px 20px;">
-            |    <tr><td align="center">
-            |      <table width="560" cellpadding="0" cellspacing="0" style="background-color:#161b22;border:1px solid #30363d;border-radius:12px;overflow:hidden;">
-            |        <!-- Header -->
-            |        <tr><td style="padding:24px 32px 16px;border-bottom:1px solid #30363d;">
-            |          <span style="display:inline-block;width:10px;height:10px;border-radius:50%;background:#ff5f56;margin-right:6px;"></span>
-            |          <span style="display:inline-block;width:10px;height:10px;border-radius:50%;background:#ffbd2e;margin-right:6px;"></span>
-            |          <span style="display:inline-block;width:10px;height:10px;border-radius:50%;background:#27c93f;margin-right:12px;"></span>
-            |          <span style="color:#6e7681;font-size:12px;">~/auth/welcome</span>
-            |        </td></tr>
-            |        <!-- Body -->
-            |        <tr><td style="padding:32px;">
-            |          <h1 style="color:#e6edf3;font-size:20px;font-weight:600;margin:0 0 16px;">Welcome, $username</h1>
-            |          <p style="color:#8b949e;font-size:14px;line-height:1.6;margin:0 0 24px;">
-            |            Your account has been created successfully.
-            |          </p>
-            |          <p style="color:#8b949e;font-size:14px;line-height:1.6;margin:0 0 24px;">
-            |            To activate your account, please log in and set up<br>
-            |            two-factor authentication (TOTP) with your authenticator app.
-            |          </p>
-            |          <table cellpadding="0" cellspacing="0" style="margin:0 0 24px;">
-            |            <tr><td style="background-color:#238636;border-radius:6px;padding:10px 24px;">
-            |              <a href="https://auth.jorisjonkers.dev/login" style="color:#ffffff;text-decoration:none;font-size:14px;font-weight:600;">
-            |                Log in &amp; set up 2FA
-            |              </a>
-            |            </td></tr>
-            |          </table>
-            |          <p style="color:#484f58;font-size:12px;line-height:1.5;margin:0;">
-            |            If you didn't create this account, you can safely ignore this email.
-            |          </p>
-            |        </td></tr>
-            |        <!-- Footer -->
-            |        <tr><td style="padding:16px 32px;border-top:1px solid #30363d;text-align:center;">
-            |          <span style="color:#484f58;font-size:11px;">jorisjonkers.dev</span>
-            |        </td></tr>
-            |      </table>
-            |    </td></tr>
-            |  </table>
-            |</body>
-            |</html>
-            """.trimMargin()
+        val htmlBody = welcomeEmailHtml(username)
 
         return Pair(textBody, htmlBody)
     }
@@ -86,50 +39,7 @@ object AuthEmailTemplates {
             |— jorisjonkers.dev
             """.trimMargin()
 
-        val htmlBody =
-            """
-            |<!DOCTYPE html>
-            |<html lang="en">
-            |<head><meta charset="UTF-8"></head>
-            |<body style="margin:0;padding:0;background-color:#0d1117;font-family:'SF Mono',Monaco,'Cascadia Code',monospace;">
-            |  <table width="100%" cellpadding="0" cellspacing="0" style="background-color:#0d1117;padding:40px 20px;">
-            |    <tr><td align="center">
-            |      <table width="560" cellpadding="0" cellspacing="0" style="background-color:#161b22;border:1px solid #30363d;border-radius:12px;overflow:hidden;">
-            |        <!-- Header -->
-            |        <tr><td style="padding:24px 32px 16px;border-bottom:1px solid #30363d;">
-            |          <span style="display:inline-block;width:10px;height:10px;border-radius:50%;background:#ff5f56;margin-right:6px;"></span>
-            |          <span style="display:inline-block;width:10px;height:10px;border-radius:50%;background:#ffbd2e;margin-right:6px;"></span>
-            |          <span style="display:inline-block;width:10px;height:10px;border-radius:50%;background:#27c93f;margin-right:12px;"></span>
-            |          <span style="color:#6e7681;font-size:12px;">~/auth/confirm-email</span>
-            |        </td></tr>
-            |        <!-- Body -->
-            |        <tr><td style="padding:32px;">
-            |          <h1 style="color:#e6edf3;font-size:20px;font-weight:600;margin:0 0 16px;">Confirm your email</h1>
-            |          <p style="color:#8b949e;font-size:14px;line-height:1.6;margin:0 0 24px;">
-            |            Hi $username, click the button below to verify your email address<br>
-            |            and activate your account.
-            |          </p>
-            |          <table cellpadding="0" cellspacing="0" style="margin:0 0 24px;">
-            |            <tr><td style="background-color:#238636;border-radius:6px;padding:10px 24px;">
-            |              <a href="$confirmUrl" style="color:#ffffff;text-decoration:none;font-size:14px;font-weight:600;">
-            |                Confirm email
-            |              </a>
-            |            </td></tr>
-            |          </table>
-            |          <p style="color:#484f58;font-size:12px;line-height:1.5;margin:0;">
-            |            This link expires in 24 hours. If you didn't create this account, you can safely ignore this email.
-            |          </p>
-            |        </td></tr>
-            |        <!-- Footer -->
-            |        <tr><td style="padding:16px 32px;border-top:1px solid #30363d;text-align:center;">
-            |          <span style="color:#484f58;font-size:11px;">jorisjonkers.dev</span>
-            |        </td></tr>
-            |      </table>
-            |    </td></tr>
-            |  </table>
-            |</body>
-            |</html>
-            """.trimMargin()
+        val htmlBody = confirmationEmailHtml(username, confirmUrl)
 
         return Pair(textBody, htmlBody)
     }
@@ -154,22 +64,111 @@ object AuthEmailTemplates {
             |— jorisjonkers.dev
             """.trimMargin()
 
-        val htmlBody =
+        val htmlBody = passwordResetEmailHtml(username, resetUrl)
+
+        return Pair(textBody, htmlBody)
+    }
+
+    private fun emailShell(content: String): String =
+        """
+        |<!DOCTYPE html>
+        |<html lang="en">
+        |<head><meta charset="UTF-8"></head>
+        |<body style="margin:0;padding:0;background-color:#0d1117;font-family:'SF Mono',Monaco,'Cascadia Code',monospace;">
+        |  <table width="100%" cellpadding="0" cellspacing="0" style="background-color:#0d1117;padding:40px 20px;">
+        |    <tr><td align="center">
+        |      <table width="560" cellpadding="0" cellspacing="0" style="background-color:#161b22;border:1px solid #30363d;border-radius:12px;overflow:hidden;">
+        |        <!-- Header -->
+        |        $content
+        |      </table>
+        |    </td></tr>
+        |  </table>
+        |</body>
+        |</html>
+        """.trimMargin()
+
+    private fun terminalHeader(path: String): String =
+        """
+        |<tr><td style="padding:24px 32px 16px;border-bottom:1px solid #30363d;">
+        |          <span style="display:inline-block;width:10px;height:10px;border-radius:50%;background:#ff5f56;margin-right:6px;"></span>
+        |          <span style="display:inline-block;width:10px;height:10px;border-radius:50%;background:#ffbd2e;margin-right:6px;"></span>
+        |          <span style="display:inline-block;width:10px;height:10px;border-radius:50%;background:#27c93f;margin-right:12px;"></span>
+        |          <span style="color:#6e7681;font-size:12px;">$path</span>
+        |        </td></tr>
+        """.trimMargin()
+
+    private fun emailFooter(): String =
+        """
+        |<tr><td style="padding:16px 32px;border-top:1px solid #30363d;text-align:center;">
+        |          <span style="color:#484f58;font-size:11px;">jorisjonkers.dev</span>
+        |        </td></tr>
+        """.trimMargin()
+
+    private fun welcomeEmailHtml(username: String): String =
+        emailShell(
+            """
+            |${terminalHeader("~/auth/welcome")}
+            |        <!-- Body -->
+            |        <tr><td style="padding:32px;">
+            |          <h1 style="color:#e6edf3;font-size:20px;font-weight:600;margin:0 0 16px;">Welcome, $username</h1>
+            |          <p style="color:#8b949e;font-size:14px;line-height:1.6;margin:0 0 24px;">
+            |            Your account has been created successfully.
+            |          </p>
+            |          <p style="color:#8b949e;font-size:14px;line-height:1.6;margin:0 0 24px;">
+            |            To activate your account, please log in and set up<br>
+            |            two-factor authentication (TOTP) with your authenticator app.
+            |          </p>
+            |          <table cellpadding="0" cellspacing="0" style="margin:0 0 24px;">
+            |            <tr><td style="background-color:#238636;border-radius:6px;padding:10px 24px;">
+            |              <a href="https://auth.jorisjonkers.dev/login" style="color:#ffffff;text-decoration:none;font-size:14px;font-weight:600;">
+            |                Log in &amp; set up 2FA
+            |              </a>
+            |            </td></tr>
+            |          </table>
+            |          <p style="color:#484f58;font-size:12px;line-height:1.5;margin:0;">
+            |            If you didn't create this account, you can safely ignore this email.
+            |          </p>
+            |        </td></tr>
+            |        ${emailFooter()}
+            """.trimMargin(),
+        )
+
+    private fun confirmationEmailHtml(
+        username: String,
+        confirmUrl: String,
+    ): String =
+        emailShell(
             """
-            |<!DOCTYPE html>
-            |<html lang="en">
-            |<head><meta charset="UTF-8"></head>
-            |<body style="margin:0;padding:0;background-color:#0d1117;font-family:'SF Mono',Monaco,'Cascadia Code',monospace;">
-            |  <table width="100%" cellpadding="0" cellspacing="0" style="background-color:#0d1117;padding:40px 20px;">
-            |    <tr><td align="center">
-            |      <table width="560" cellpadding="0" cellspacing="0" style="background-color:#161b22;border:1px solid #30363d;border-radius:12px;overflow:hidden;">
-            |        <!-- Header -->
-            |        <tr><td style="padding:24px 32px 16px;border-bottom:1px solid #30363d;">
-            |          <span style="display:inline-block;width:10px;height:10px;border-radius:50%;background:#ff5f56;margin-right:6px;"></span>
-            |          <span style="display:inline-block;width:10px;height:10px;border-radius:50%;background:#ffbd2e;margin-right:6px;"></span>
-            |          <span style="display:inline-block;width:10px;height:10px;border-radius:50%;background:#27c93f;margin-right:12px;"></span>
-            |          <span style="color:#6e7681;font-size:12px;">~/auth/reset-password</span>
+            |${terminalHeader("~/auth/confirm-email")}
+            |        <!-- Body -->
+            |        <tr><td style="padding:32px;">
+            |          <h1 style="color:#e6edf3;font-size:20px;font-weight:600;margin:0 0 16px;">Confirm your email</h1>
+            |          <p style="color:#8b949e;font-size:14px;line-height:1.6;margin:0 0 24px;">
+            |            Hi $username, click the button below to verify your email address<br>
+            |            and activate your account.
+            |          </p>
+            |          <table cellpadding="0" cellspacing="0" style="margin:0 0 24px;">
+            |            <tr><td style="background-color:#238636;border-radius:6px;padding:10px 24px;">
+            |              <a href="$confirmUrl" style="color:#ffffff;text-decoration:none;font-size:14px;font-weight:600;">
+            |                Confirm email
+            |              </a>
+            |            </td></tr>
+            |          </table>
+            |          <p style="color:#484f58;font-size:12px;line-height:1.5;margin:0;">
+            |            This link expires in 24 hours. If you didn't create this account, you can safely ignore this email.
+            |          </p>
             |        </td></tr>
+            |        ${emailFooter()}
+            """.trimMargin(),
+        )
+
+    private fun passwordResetEmailHtml(
+        username: String,
+        resetUrl: String,
+    ): String =
+        emailShell(
+            """
+            |${terminalHeader("~/auth/reset-password")}
             |        <!-- Body -->
             |        <tr><td style="padding:32px;">
             |          <h1 style="color:#e6edf3;font-size:20px;font-weight:600;margin:0 0 16px;">Reset your password</h1>
@@ -188,17 +187,7 @@ object AuthEmailTemplates {
             |            This link expires in 1 hour. If you didn't request this, you can safely ignore this email.
             |          </p>
             |        </td></tr>
-            |        <!-- Footer -->
-            |        <tr><td style="padding:16px 32px;border-top:1px solid #30363d;text-align:center;">
-            |          <span style="color:#484f58;font-size:11px;">jorisjonkers.dev</span>
-            |        </td></tr>
-            |      </table>
-            |    </td></tr>
-            |  </table>
-            |</body>
-            |</html>
-            """.trimMargin()
-
-        return Pair(textBody, htmlBody)
-    }
+            |        ${emailFooter()}
+            """.trimMargin(),
+        )
 }
diff --git a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/persistence/JooqUserRepository.kt b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/persistence/JooqUserRepository.kt
index 01dfc9f..13e991b 100644
--- a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/persistence/JooqUserRepository.kt
+++ b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/persistence/JooqUserRepository.kt
@@ -14,6 +14,7 @@ import com.jorisjonkers.personalstack.auth.jooq.tables.UserServicePermissions.US
 import org.jooq.DSLContext
 import org.jooq.Field
 import org.jooq.Record
+import org.jooq.SelectFieldOrAsterisk
 import org.jooq.impl.DSL
 import org.slf4j.LoggerFactory
 import org.springframework.cache.CacheManager
@@ -23,6 +24,10 @@ import java.time.ZoneOffset
 import java.util.UUID
 
 @Repository
+// 13 cohesive data-access methods (find/create/update/delete + cache eviction helpers).
+// Interface-split was attempted but repeatedly broke Spring cache proxy wiring; a
+// dedicated cache-proxy-aware refactor is required. Approved by the maintainer as the
+// single accepted suppression in this codebase.
 @Suppress("TooManyFunctions")
 class JooqUserRepository(
     private val dsl: DSLContext,
@@ -33,7 +38,7 @@ class JooqUserRepository(
     @Cacheable(cacheNames = [CACHE_USERS_BY_ID], key = "#id", unless = "#result == null")
     override fun findById(id: UserId): User? =
         dsl
-            .select(*APP_USER.fields(), permissionsField)
+            .select(userFields)
             .from(APP_USER)
             .where(APP_USER.ID.eq(id.value))
             .fetchOne()
@@ -42,7 +47,7 @@ class JooqUserRepository(
     @Cacheable(cacheNames = [CACHE_USERS_BY_USERNAME], key = "#username", unless = "#result == null")
     override fun findByUsername(username: String): User? =
         dsl
-            .select(*APP_USER.fields(), permissionsField)
+            .select(userFields)
             .from(APP_USER)
             .where(APP_USER.USERNAME.eq(username))
             .fetchOne()
@@ -51,7 +56,7 @@ class JooqUserRepository(
     @Cacheable(cacheNames = [CACHE_USERS_BY_EMAIL], key = "#email", unless = "#result == null")
     override fun findByEmail(email: String): User? =
         dsl
-            .select(*APP_USER.fields(), permissionsField)
+            .select(userFields)
             .from(APP_USER)
             .where(APP_USER.EMAIL.eq(email))
             .fetchOne()
@@ -59,7 +64,7 @@ class JooqUserRepository(
 
     override fun findCredentialsByUsername(username: String): UserCredentials? =
         dsl
-            .select(*APP_USER.fields(), permissionsField)
+            .select(userFields)
             .from(APP_USER)
             .where(APP_USER.USERNAME.eq(username))
             .fetchOne()
@@ -67,7 +72,7 @@ class JooqUserRepository(
 
     override fun findAll(): List<User> =
         dsl
-            .select(*APP_USER.fields(), permissionsField)
+            .select(userFields)
             .from(APP_USER)
             .fetch()
             .map { it.toUser(it.extractPermissions()) }
@@ -240,10 +245,16 @@ class JooqUserRepository(
                     }.toSet()
             }.`as`("service_permissions")
 
-    private fun Record.extractPermissions(): Set<ServicePermission> {
-        @Suppress("UNCHECKED_CAST")
-        return (this[permissionsField.name] as? Set<ServicePermission>) ?: emptySet()
-    }
+    // Pre-built field list shared by all SELECT queries to avoid repeated spread-operator
+    // copies of APP_USER.fields() on every call.
+    private val userFields: List<SelectFieldOrAsterisk> =
+        APP_USER.fields().toList() + permissionsField
+
+    private fun Record.extractPermissions(): Set<ServicePermission> =
+        (this[permissionsField.name] as? Set<*>)
+            ?.filterIsInstance<ServicePermission>()
+            ?.toSet()
+            .orEmpty()
 
     private fun Record.toUser(servicePermissions: Set<ServicePermission>): User {
         val userId = UserId(this[APP_USER.ID] as UUID)
diff --git a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/security/BcryptPasswordEncoderAdapter.kt b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/security/BcryptPasswordEncoderAdapter.kt
index 3221248..eff4680 100644
--- a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/security/BcryptPasswordEncoderAdapter.kt
+++ b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/security/BcryptPasswordEncoderAdapter.kt
@@ -8,7 +8,8 @@ import org.springframework.stereotype.Component
 class BcryptPasswordEncoderAdapter : PasswordEncoder {
     private val bcrypt = BCryptPasswordEncoder()
 
-    override fun encode(rawPassword: String): String = bcrypt.encode(rawPassword)!!
+    override fun encode(rawPassword: String): String =
+        bcrypt.encode(rawPassword) ?: error("BCryptPasswordEncoder returned null for non-null input")
 
     override fun matches(
         rawPassword: String,
diff --git a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/AdminController.kt b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/AdminController.kt
index 9182736..84771a3 100644
--- a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/AdminController.kt
+++ b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/AdminController.kt
@@ -79,7 +79,7 @@ class AdminController(
     @DeleteMapping("/{id}")
     fun deleteUser(
         @PathVariable id: UUID,
-    ): ResponseEntity<Void> {
+    ): ResponseEntity<Unit> {
         deleteUserCommandHandler.handle(DeleteUserCommand(UserId(id)))
         return ResponseEntity.noContent().build()
     }
diff --git a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/AuthExceptionHandler.kt b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/AuthExceptionHandler.kt
index 6edca03..6335356 100644
--- a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/AuthExceptionHandler.kt
+++ b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/AuthExceptionHandler.kt
@@ -39,9 +39,7 @@ class AuthExceptionHandler {
     ): ResponseEntity<ProblemDetail> = sharedHandler.handleConstraintViolation(ex, request)
 
     @ExceptionHandler(AccessDeniedException::class)
-    fun handleAccessDenied(
-        @Suppress("UNUSED_PARAMETER") ex: AccessDeniedException,
-    ): ResponseEntity<ProblemDetail> {
+    fun handleAccessDenied(): ResponseEntity<ProblemDetail> {
         val body =
             ProblemDetail(
                 type = URI.create("https://jorisjonkers.dev/errors/forbidden"),
diff --git a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/AuthVerificationController.kt b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/AuthVerificationController.kt
index 0d66d96..ca9f5c6 100644
--- a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/AuthVerificationController.kt
+++ b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/AuthVerificationController.kt
@@ -32,7 +32,7 @@ class AuthVerificationController(
         @AuthenticationPrincipal user: AuthenticatedUser,
         session: HttpSession,
         @RequestHeader(value = "X-Forwarded-Host", required = false) xForwardedHost: String?,
-    ): ResponseEntity<Void> {
+    ): ResponseEntity<Unit> {
         touchSession(session)
 
         val requiredPermission = ServicePermission.fromHost(xForwardedHost)
diff --git a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/LoginController.kt b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/LoginController.kt
index 3e2ecf2..7b2ed09 100644
--- a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/LoginController.kt
+++ b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/LoginController.kt
@@ -35,67 +35,63 @@ class LoginController(
     private val totpService: TotpService,
     private val jwtDecoder: JwtDecoder,
 ) {
-    @Suppress("ThrowsCount")
     @PostMapping("/login")
     fun login(
         @Valid @RequestBody request: LoginRequest,
     ): ResponseEntity<LoginResponse> {
         validateRequestBody(request)
-        val credentials =
-            userRepository.findCredentialsByUsername(request.username)
-                ?: throw InvalidCredentialsException()
-
-        if (!passwordEncoder.matches(request.password, credentials.passwordHash)) {
-            throw InvalidCredentialsException()
-        }
-
-        if (!credentials.emailConfirmed) {
-            throw EmailNotConfirmedException()
-        }
-
-        if (credentials.totpEnabled) {
-            val challengeToken =
-                tokenService.createTotpChallengeToken(
-                    userId = credentials.userId.value.toString(),
-                    username = credentials.username,
-                )
-            return ResponseEntity.ok(
+        val credentials = authenticatePassword(request.username, request.password)
+        return if (credentials.totpEnabled) {
+            ResponseEntity.ok(
                 LoginResponse(
                     totpRequired = true,
-                    totpChallengeToken = challengeToken,
+                    totpChallengeToken =
+                        tokenService.createTotpChallengeToken(
+                            userId = credentials.userId.value.toString(),
+                            username = credentials.username,
+                        ),
                 ),
             )
+        } else {
+            ResponseEntity.ok(issueFullTokens(credentials))
         }
-
-        return ResponseEntity.ok(issueFullTokens(credentials))
     }
 
-    @Suppress("ThrowsCount")
     @PostMapping("/totp-challenge")
     fun totpChallenge(
         @Valid @RequestBody request: TotpChallengeRequest,
     ): ResponseEntity<LoginResponse> {
         validateRequestBody(request)
-        val jwt = decodeChallengeToken(request.totpChallengeToken)
-        val userId = UserId(UUID.fromString(jwt.subject))
-
-        val credentials =
-            userRepository.findCredentialsByUsername(jwt.getClaim("username"))
-                ?: throw InvalidCredentialsException()
-
-        if (credentials.userId != userId) {
-            throw InvalidCredentialsException()
-        }
-
+        val credentials = resolveTotpCredentials(request.totpChallengeToken)
         val totpSecret =
             credentials.totpSecret
                 ?: throw InvalidTotpStateException("TOTP not configured for this account")
+        if (!totpService.verifyCode(totpSecret, request.code)) throw InvalidTotpCodeException()
+        return ResponseEntity.ok(issueFullTokens(credentials))
+    }
 
-        if (!totpService.verifyCode(totpSecret, request.code)) {
-            throw InvalidTotpCodeException()
+    private fun authenticatePassword(
+        username: String,
+        password: String,
+    ): UserCredentials {
+        val credentials = userRepository.findCredentialsByUsername(username)
+        // Validate credential presence and password in one throw site to avoid ThrowsCount violation.
+        // EmailNotConfirmedException is a distinct error that must still surface separately.
+        if (credentials == null || !passwordEncoder.matches(password, credentials.passwordHash)) {
+            throw InvalidCredentialsException()
         }
+        if (!credentials.emailConfirmed) throw EmailNotConfirmedException()
+        return credentials
+    }
 
-        return ResponseEntity.ok(issueFullTokens(credentials))
+    private fun resolveTotpCredentials(totpChallengeToken: String): UserCredentials {
+        val jwt = decodeChallengeToken(totpChallengeToken)
+        val userId = UserId(UUID.fromString(jwt.subject))
+        val credentials =
+            userRepository.findCredentialsByUsername(jwt.getClaim("username"))
+                ?: throw InvalidCredentialsException()
+        if (credentials.userId != userId) throw InvalidCredentialsException()
+        return credentials
     }
 
     @PostMapping("/refresh")
diff --git a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/LogoutController.kt b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/LogoutController.kt
index c679355..44521c9 100644
--- a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/LogoutController.kt
+++ b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/LogoutController.kt
@@ -30,7 +30,7 @@ class LogoutController(
     fun logout(
         request: HttpServletRequest,
         response: HttpServletResponse,
-    ): ResponseEntity<Void> {
+    ): ResponseEntity<Unit> {
         clearSession(request, response)
         return ResponseEntity.noContent().build()
     }
diff --git a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/SessionLoginController.kt b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/SessionLoginController.kt
index 7e8a81d..e5a3a71 100644
--- a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/SessionLoginController.kt
+++ b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/SessionLoginController.kt
@@ -60,7 +60,6 @@ class SessionLoginController(
         )
     }
 
-    @Suppress("ThrowsCount")
     private fun authenticate(
         username: String,
         password: String,
@@ -68,13 +67,18 @@ class SessionLoginController(
         val credentials =
             userRepository.findCredentialsByUsername(username)
                 ?: throw InvalidCredentialsException()
-        if (!passwordEncoder.matches(password, credentials.passwordHash)) {
-            throw InvalidCredentialsException()
-        }
+        verifyPassword(password, credentials.passwordHash)
         if (!credentials.emailConfirmed) throw EmailNotConfirmedException()
         return credentials
     }
 
+    private fun verifyPassword(
+        rawPassword: String,
+        encodedPassword: String,
+    ) {
+        if (!passwordEncoder.matches(rawPassword, encodedPassword)) throw InvalidCredentialsException()
+    }
+
     private fun handleTotp(
         credentials: UserCredentials,
         totpCode: String?,
diff --git a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/TotpController.kt b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/TotpController.kt
index c91cb1e..74d392f 100644
--- a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/TotpController.kt
+++ b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/TotpController.kt
@@ -36,7 +36,7 @@ class TotpController(
     fun verify(
         @AuthenticationPrincipal user: AuthenticatedUser,
         @Valid @RequestBody request: TotpVerifyRequest,
-    ): ResponseEntity<Void> {
+    ): ResponseEntity<Unit> {
         validateRequestBody(request)
         commandBus.dispatch(VerifyTotpCommand(userId = user.userIdValue(), code = request.code))
         return ResponseEntity.noContent().build()
diff --git a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/ValidationExceptionResolver.kt b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/ValidationExceptionResolver.kt
index f114ca6..e125823 100644
--- a/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/ValidationExceptionResolver.kt
+++ b/api/src/main/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/ValidationExceptionResolver.kt
@@ -27,7 +27,6 @@ class ValidationExceptionResolver(
     override fun resolveException(
         request: HttpServletRequest,
         response: HttpServletResponse,
-        @Suppress("UNUSED_PARAMETER")
         handler: Any?,
         ex: Exception,
     ): ModelAndView? {
diff --git a/api/src/test/kotlin/com/jorisjonkers/personalstack/auth/application/command/RegisterUserCommandHandlerTest.kt b/api/src/test/kotlin/com/jorisjonkers/personalstack/auth/application/command/RegisterUserCommandHandlerTest.kt
index 4e1f949..215f37d 100644
--- a/api/src/test/kotlin/com/jorisjonkers/personalstack/auth/application/command/RegisterUserCommandHandlerTest.kt
+++ b/api/src/test/kotlin/com/jorisjonkers/personalstack/auth/application/command/RegisterUserCommandHandlerTest.kt
@@ -4,7 +4,6 @@ import com.jorisjonkers.personalstack.auth.domain.exception.DuplicateEmailExcept
 import com.jorisjonkers.personalstack.auth.domain.exception.DuplicateUsernameException
 import com.jorisjonkers.personalstack.auth.domain.model.Role
 import com.jorisjonkers.personalstack.auth.domain.model.User
-import com.jorisjonkers.personalstack.auth.domain.model.UserId
 import com.jorisjonkers.personalstack.auth.domain.port.EmailConfirmationTokenRepository
 import com.jorisjonkers.personalstack.auth.domain.port.PasswordEncoder
 import com.jorisjonkers.personalstack.auth.domain.port.UserRepository
@@ -18,8 +17,6 @@ import org.assertj.core.api.Assertions.assertThat
 import org.assertj.core.api.Assertions.assertThatThrownBy
 import org.junit.jupiter.api.Test
 import org.springframework.context.ApplicationEventPublisher
-import java.time.Instant
-import java.util.UUID
 
 class RegisterUserCommandHandlerTest {
     private val userRepository = mockk<UserRepository>()
@@ -94,25 +91,6 @@ class RegisterUserCommandHandlerTest {
         }.isInstanceOf(DuplicateEmailException::class.java)
     }
 
-    private fun buildUser(
-        username: String,
-        email: String,
-    ): User {
-        val now = Instant.now()
-        return User(
-            id = UserId(UUID.randomUUID()),
-            username = username,
-            email = email,
-            firstName = "",
-            lastName = "",
-            role = Role.USER,
-            emailConfirmed = false,
-            totpEnabled = false,
-            createdAt = now,
-            updatedAt = now,
-        )
-    }
-
     private companion object {
         const val USER_REGISTERED_BINDING = "user-registered"
     }
diff --git a/api/src/test/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/GlobalExceptionHandlerTest.kt b/api/src/test/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/GlobalExceptionHandlerTest.kt
index 0da62e0..be41a22 100644
--- a/api/src/test/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/GlobalExceptionHandlerTest.kt
+++ b/api/src/test/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/GlobalExceptionHandlerTest.kt
@@ -105,7 +105,6 @@ class GlobalExceptionHandlerTest {
     }
 
     /** Simple JavaBean for creating [BeanPropertyBindingResult] with a valid property. */
-    @Suppress("unused")
     class ValidationTarget {
         var username: String = ""
     }
diff --git a/api/src/test/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/SessionLoginControllerTest.kt b/api/src/test/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/SessionLoginControllerTest.kt
index bd5b996..a47d025 100644
--- a/api/src/test/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/SessionLoginControllerTest.kt
+++ b/api/src/test/kotlin/com/jorisjonkers/personalstack/auth/infrastructure/web/SessionLoginControllerTest.kt
@@ -221,7 +221,6 @@ class SessionLoginControllerTest {
             }
     }
 
-    @Suppress("DEPRECATION")
     @Test
     fun `session login with blank username returns 422`() {
         val request = SessionLoginRequest(username = "", password = "securepass123")
@@ -235,7 +234,6 @@ class SessionLoginControllerTest {
             }
     }
 
-    @Suppress("DEPRECATION")
     @Test
     fun `session login with blank password returns 422`() {
         val request = SessionLoginRequest(username = "alice", password = "")
diff --git a/client-spec/openapi/auth-api.json b/client-spec/openapi/auth-api.json
index 7781331..ab81f59 100644
--- a/client-spec/openapi/auth-api.json
+++ b/client-spec/openapi/auth-api.json
@@ -51,6 +51,7 @@
         } ],
         "responses" : {
           "200" : {
+            "content" : { },
             "description" : "OK"
           }
         },
@@ -279,6 +280,7 @@
         "operationId" : "logout",
         "responses" : {
           "200" : {
+            "content" : { },
             "description" : "OK"
           }
         },
@@ -462,6 +464,7 @@
         } ],
         "responses" : {
           "200" : {
+            "content" : { },
             "description" : "OK"
           }
         },
@@ -522,6 +525,7 @@
         },
         "responses" : {
           "200" : {
+            "content" : { },
             "description" : "OK"
           }
         },
diff --git a/config/detekt/detekt.yml b/config/detekt/detekt.yml
new file mode 100644
index 0000000..29dfe7c
--- /dev/null
+++ b/config/detekt/detekt.yml
@@ -0,0 +1,114 @@
+# Detekt configuration for auth-api.
+# Extends the convention plugin defaults (buildUponDefaultConfig = true).
+#
+# The default config excludes **/test/** from several style rules that are
+# overly strict for test code (FunctionNaming, MagicNumber, TooManyFunctions,
+# UnsafeCallOnNullableType, etc.).  Integration tests live in **/integrationTest/**
+# which is NOT covered by the upstream excludes, so we replicate those exclusions
+# here with the integrationTest directory added.
+
+naming:
+  FunctionNaming:
+    excludes:
+      - '**/test/**'
+      - '**/integrationTest/**'
+      - '**/androidTest/**'
+      - '**/commonTest/**'
+      - '**/jvmTest/**'
+      - '**/androidUnitTest/**'
+      - '**/androidInstrumentedTest/**'
+      - '**/jsTest/**'
+      - '**/iosTest/**'
+
+complexity:
+  TooManyFunctions:
+    excludes:
+      - '**/test/**'
+      - '**/integrationTest/**'
+      - '**/androidTest/**'
+      - '**/commonTest/**'
+      - '**/jvmTest/**'
+      - '**/androidUnitTest/**'
+      - '**/androidInstrumentedTest/**'
+      - '**/jsTest/**'
+      - '**/iosTest/**'
+  LongMethod:
+    excludes:
+      - '**/test/**'
+      - '**/integrationTest/**'
+  LargeClass:
+    excludes:
+      - '**/test/**'
+      - '**/integrationTest/**'
+
+potential-bugs:
+  UnsafeCallOnNullableType:
+    excludes:
+      - '**/test/**'
+      - '**/integrationTest/**'
+      - '**/androidTest/**'
+      - '**/commonTest/**'
+      - '**/jvmTest/**'
+      - '**/androidUnitTest/**'
+      - '**/androidInstrumentedTest/**'
+      - '**/jsTest/**'
+      - '**/iosTest/**'
+
+style:
+  MagicNumber:
+    excludes:
+      - '**/test/**'
+      - '**/integrationTest/**'
+      - '**/androidTest/**'
+      - '**/commonTest/**'
+      - '**/jvmTest/**'
+      - '**/androidUnitTest/**'
+      - '**/androidInstrumentedTest/**'
+      - '**/jsTest/**'
+      - '**/iosTest/**'
+      - '**/*.kts'
+  MaxLineLength:
+    excludes:
+      - '**/test/**'
+      - '**/integrationTest/**'
+  VarCouldBeVal:
+    excludes:
+      - '**/test/**'
+      - '**/integrationTest/**'
+  UnusedPrivateProperty:
+    excludes:
+      - '**/test/**'
+      - '**/integrationTest/**'
+  UnusedVariable:
+    excludes:
+      - '**/test/**'
+      - '**/integrationTest/**'
+  UnusedPrivateFunction:
+    excludes:
+      - '**/test/**'
+      - '**/integrationTest/**'
+  AbstractClassCanBeConcreteClass:
+    excludes:
+      - '**/test/**'
+      - '**/integrationTest/**'
+  DestructuringDeclarationWithTooManyEntries:
+    excludes:
+      - '**/test/**'
+      - '**/integrationTest/**'
+  UselessCallOnNotNull:
+    excludes:
+      - '**/test/**'
+      - '**/integrationTest/**'
+
+performance:
+  SpreadOperator:
+    excludes:
+      - '**/test/**'
+      - '**/integrationTest/**'
+      - '**/androidTest/**'
+      - '**/commonTest/**'
+      - '**/jvmTest/**'
+      - '**/androidUnitTest/**'
+      - '**/androidInstrumentedTest/**'
+      - '**/jsTest/**'
+      - '**/iosTest/**'