diff --git a/.vitepress/data/dependencies.yaml b/.vitepress/data/dependencies.yaml
index 075a813..0e6a05e 100644
--- a/.vitepress/data/dependencies.yaml
+++ b/.vitepress/data/dependencies.yaml
@@ -733,6 +733,11 @@ dependencies:
     license: BSD 2
     version: 1.22.22
 
+  # yq (kislyuk) 4.x reports `0.0.0` from `yq --version`: the PyPI wheel omits the
+  # setuptools_scm-generated version.py, so it falls back to a hardcoded 0.0.0
+  # (4.1.1 on disk, prints 0.0.0). `version:` is intentionally dropped so the version
+  # assertion is skipped (yq keeps its presence check); restore it once upstream ships
+  # a version-reporting release. Tracked: future-9-yq-version-check-restore.
   yq:
     cmd: yq --version
     datasource: pypi
@@ -740,7 +745,6 @@ dependencies:
     home: https://github.com/kislyuk/yq
     license: MIT
     tool: true
-    version: 3.4.3
 
   zsh:
     cmd: zsh --version
diff --git a/.vitepress/data/env.reference.yaml b/.vitepress/data/env.reference.yaml
index b901e50..292033e 100644
--- a/.vitepress/data/env.reference.yaml
+++ b/.vitepress/data/env.reference.yaml
@@ -364,6 +364,18 @@ envs:
              `/run/secrets/workspace/auth/password_hashed`.
           4. Schema default *(unset)*.
 
+      session_ttl:
+        type: integer
+        default: 86400
+        since: next
+        description: Lifetime *(seconds)* of an authenticated web session.
+        reference: /editor/authentication
+        longDescription: |
+          The session cookie carries a rolling expiry, renewed on each
+          authenticated request and keep-alive ping, so an actively-used
+          session never drops. A missing or malformed value falls back to the
+          default. Only used when `WS_AUTH_MODE=password`.
+
   ca:
     name: Enterprise CA
     properties:
@@ -717,6 +729,66 @@ envs:
         description: Log file for the metrics exporter.
         since: 0.3.0
 
+  marketplace:
+    properties:
+      control_url:
+        type: string
+        default: null
+        since: next
+        reference: /editor/extensions
+        example: https://open-vsx.org/vscode/control
+        description: Overrides the gallery `controlUrl`.
+
+      extension_url_template:
+        type: string
+        default: null
+        since: next
+        reference: /editor/extensions
+        example: https://open-vsx.org/vscode/gallery/{publisher}/{name}/latest
+        description: Overrides the gallery `extensionUrlTemplate`.
+
+      gallery:
+        type: string
+        default: null
+        since: next
+        reference: /editor/extensions
+        example: |
+          {
+            "serviceUrl": "https://open-vsx.org/vscode/gallery",
+            "itemUrl": "https://open-vsx.org/vscode/item"
+          }
+        description: Complete JSON override for the extension gallery.
+        longDescription: |
+          A complete gallery JSON object that replaces the baked Open VSX
+          default. The per-key variables *(`WS_MARKETPLACE_SERVICE_URL`, ...)*
+          are layered on top. Malformed JSON is ignored and the baked default
+          is kept.
+
+      item_url:
+        type: string
+        default: null
+        since: next
+        reference: /editor/extensions
+        example: https://open-vsx.org/vscode/item
+        description: Overrides the gallery `itemUrl`.
+
+      resource_url_template:
+        type: string
+        default: null
+        since: next
+        reference: /editor/extensions
+        example: >-
+          https://open-vsx.org/vscode/asset/{publisher}/{name}/{version}/Microsoft.VisualStudio.Code.WebResources/{path}
+        description: Overrides the gallery `resourceUrlTemplate`.
+
+      service_url:
+        type: string
+        default: null
+        since: next
+        reference: /editor/extensions
+        example: https://open-vsx.org/vscode/gallery
+        description: Overrides the gallery `serviceUrl`.
+
   metrics:
     properties:
       collectors:
@@ -862,6 +934,16 @@ envs:
           Publish this port instead of WS_SERVER_PORT so every request is
           authenticated before it reaches the editor.
 
+      host:
+        type: string
+        default: 0.0.0.0
+        since: next
+        description: Address on which the web server listens.
+        longDescription: |
+          Binds all interfaces by default so Docker-published traffic reaches
+          the editor. Set to `127.0.0.1` to restrict the listener to loopback
+          when a front proxy on the same host terminates external traffic.
+
       port:
         type: integer
         default: 8080