diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7815743..078befd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,14 +4,17 @@ on:
   push:
     branches:
       - main
+      - develop
   pull_request:
     branches:
       - main
+      - develop
 
 permissions:
   contents: read
   security-events: write
   packages: write
+  actions: read
 
 # Run Node20-based actions on Node24 (GitHub force-migrates 2026-06-16). Silences the
 # deprecation warnings and future-proofs the workflow.
@@ -31,13 +34,10 @@ jobs:
       - name: Run TruffleHog (verified secrets only)
         uses: trufflesecurity/trufflehog@main
         with:
-          path: ./
-          # On a PR: scan the PR diff. On a push/merge to main: scan the pushed range
-          # (before..after). The previous default-branch/HEAD config made base==head on
-          # main pushes, so TruffleHog scanned nothing.
-          base: ${{ github.event.pull_request.base.sha || github.event.before }}
-          head: ${{ github.event.pull_request.head.sha || github.sha }}
-          extra_args: --results=verified,unknown
+          # The action mounts the workspace at /tmp inside the scanner container.
+          # .trufflehog-exclude.txt skips deploy docs whose placeholder connection
+          # strings (Password=__DB__) false-positive the SQLServer detector.
+          extra_args: --results=verified,unknown --exclude-paths=/tmp/.trufflehog-exclude.txt
 
   quality:
     name: Lint, Test, Build
@@ -252,14 +252,13 @@ jobs:
           ignore-unfixed: true
           exit-code: "1"
 
-      - name: Upload Trivy SARIF report
-        # Code-scanning SARIF upload requires GitHub Advanced Security (not available on
-        # private repos by default). Keep it non-fatal — the Trivy image scans above are
-        # the real gate; this step only feeds the Security tab when GHAS is enabled.
-        continue-on-error: true
-        uses: github/codeql-action/upload-sarif@v3
+      - name: Upload Trivy SARIF report (artifact)
+        if: always()
+        uses: actions/upload-artifact@v4
         with:
-          sarif_file: trivy-results.sarif
+          name: trivy-sarif
+          path: trivy-results.sarif
+          retention-days: 30
 
   build-images:
     name: Build & Push Docker Images
diff --git a/.trufflehog-exclude.txt b/.trufflehog-exclude.txt
new file mode 100644
index 0000000..6eba4c8
--- /dev/null
+++ b/.trufflehog-exclude.txt
@@ -0,0 +1,6 @@
+# Paths excluded from TruffleHog secret scanning (regex per line).
+# These are deploy DOCUMENTATION containing placeholder connection strings
+# (Password=$DB / Password=__DB__) that pattern-match the SQLServer detector
+# but contain no real credentials. Never put real values in these files.
+devops/k8s/project-01/README\.md
+devops/k8s/project-01/secret\.example\.yaml
diff --git a/backend/src/Loopless.Api/Endpoints/FileEndpoints.cs b/backend/src/Loopless.Api/Endpoints/FileEndpoints.cs
index 5b69308..1a91dee 100644
--- a/backend/src/Loopless.Api/Endpoints/FileEndpoints.cs
+++ b/backend/src/Loopless.Api/Endpoints/FileEndpoints.cs
@@ -1,4 +1,5 @@
 using Loopless.Application.DTOs;
+using Loopless.Application.Features.Files.GetFileDownload;
 using Loopless.Application.Features.Files.GetProjectFiles;
 using Loopless.Application.Features.Files.Upload;
 using MediatR;
@@ -59,6 +60,25 @@ public static IEndpointRouteBuilder MapFileEndpoints(this IEndpointRouteBuilder
         .Produces(StatusCodes.Status404NotFound)
         .ProducesValidationProblem();
 
+        // Streams the file through the API so the browser downloads it directly,
+        // instead of redirecting to a presigned storage URL whose host (e.g.
+        // minio:9000) is unreachable outside the Docker network.
+        group.MapGet("/{projectId:guid}/files/{fileId:guid}/download", async (
+            [FromRoute] Guid projectId,
+            [FromRoute] Guid fileId,
+            ISender sender,
+            CancellationToken ct) =>
+        {
+            var file = await sender.Send(new GetFileDownloadQuery(projectId, fileId), ct);
+            return Results.File(file.Content, file.ContentType, file.FileName);
+        })
+        .WithName("DownloadProjectFile")
+        .Produces(StatusCodes.Status200OK)
+        .Produces(StatusCodes.Status401Unauthorized)
+        .Produces(StatusCodes.Status403Forbidden)
+        .Produces(StatusCodes.Status404NotFound)
+        .ProducesValidationProblem();
+
         return app;
     }
 
diff --git a/backend/src/Loopless.Api/Endpoints/MessageEndpoints.cs b/backend/src/Loopless.Api/Endpoints/MessageEndpoints.cs
index fe80d0f..d4e6b39 100644
--- a/backend/src/Loopless.Api/Endpoints/MessageEndpoints.cs
+++ b/backend/src/Loopless.Api/Endpoints/MessageEndpoints.cs
@@ -3,6 +3,7 @@
 using Loopless.Application.Features.Messages.GetConversations;
 using Loopless.Application.Features.Messages.GetHistory;
 using Loopless.Application.Features.Messages.MarkAsRead;
+using Loopless.Application.Features.Messages.MarkConversationRead;
 using Loopless.Application.Features.Messages.Send;
 using MediatR;
 using Microsoft.AspNetCore.Mvc;
@@ -92,6 +93,20 @@ public static IEndpointRouteBuilder MapMessageEndpoints(this IEndpointRouteBuild
         .Produces(StatusCodes.Status404NotFound)
         .Produces(StatusCodes.Status409Conflict);
 
+        group.MapPut("/conversations/{id:guid}/read", async (
+            [FromRoute] Guid id,
+            ISender sender,
+            CancellationToken ct) =>
+        {
+            await sender.Send(new MarkConversationReadCommand(id), ct);
+            return Results.NoContent();
+        })
+        .WithName("MarkConversationRead")
+        .Produces(StatusCodes.Status204NoContent)
+        .Produces(StatusCodes.Status401Unauthorized)
+        .Produces(StatusCodes.Status404NotFound)
+        .ProducesValidationProblem();
+
         return app;
     }
 
diff --git a/backend/src/Loopless.Api/Endpoints/ProjectEndpoints.cs b/backend/src/Loopless.Api/Endpoints/ProjectEndpoints.cs
index 73b254c..f605532 100644
--- a/backend/src/Loopless.Api/Endpoints/ProjectEndpoints.cs
+++ b/backend/src/Loopless.Api/Endpoints/ProjectEndpoints.cs
@@ -11,6 +11,7 @@
 using Loopless.Application.Features.Projects.GenerateSummary;
 using Loopless.Application.Features.Projects.GetCommits;
 using Loopless.Application.Features.Projects.GetDashboard;
+using Loopless.Application.Features.Projects.GetMyApplications;
 using Loopless.Application.Features.Projects.GetMyInvitations;
 using Loopless.Application.Features.Projects.GetProjectInvitations;
 using Loopless.Application.Features.Projects.GetProjectLinks;
@@ -501,6 +502,22 @@ public static IEndpointRouteBuilder MapInvitationEndpoints(this IEndpointRouteBu
         .Produces<IReadOnlyList<InvitationDto>>(StatusCodes.Status200OK)
         .Produces(StatusCodes.Status401Unauthorized);
 
+        // Applications the freelancer initiated themselves. Kept separate from
+        // /invitations/me so the projects "Pending invitations" view (which lists
+        // invitations to accept/decline) is not polluted with outgoing applications.
+        app.MapGet("/api/v1/applications/me", async (
+            ISender sender,
+            CancellationToken ct) =>
+        {
+            var result = await sender.Send(new GetMyApplicationsQuery(), ct);
+            return Results.Ok(result);
+        })
+        .WithTags("Invitations")
+        .RequireAuthorization()
+        .WithName("GetMyApplications")
+        .Produces<IReadOnlyList<InvitationDto>>(StatusCodes.Status200OK)
+        .Produces(StatusCodes.Status401Unauthorized);
+
         group.MapPut("/{invitationId:guid}/accept", async (
             [FromRoute] Guid invitationId,
             ISender sender,
diff --git a/backend/src/Loopless.Api/Endpoints/SettingsEndpoints.cs b/backend/src/Loopless.Api/Endpoints/SettingsEndpoints.cs
index 20022b9..68cc1c8 100644
--- a/backend/src/Loopless.Api/Endpoints/SettingsEndpoints.cs
+++ b/backend/src/Loopless.Api/Endpoints/SettingsEndpoints.cs
@@ -1,3 +1,4 @@
+using Loopless.Application.Features.Settings.ChangePassword;
 using Loopless.Application.Features.Settings.UpdateNotificationSettings;
 using MediatR;
 using Microsoft.AspNetCore.Mvc;
@@ -20,5 +21,20 @@ public static void MapSettingsEndpoints(this IEndpointRouteBuilder app)
         })
         .WithName("UpdateNotificationSettings")
         .WithSummary("Toggle email notification preferences for the current user.");
+
+        group.MapPost("/password", async (
+            [FromBody] ChangePasswordCommand command,
+            IMediator mediator,
+            CancellationToken ct) =>
+        {
+            await mediator.Send(command, ct);
+            return Results.NoContent();
+        })
+        .RequireRateLimiting("auth")
+        .WithName("ChangePassword")
+        .WithSummary("Change the current user's password after verifying the existing one.")
+        .Produces(StatusCodes.Status204NoContent)
+        .Produces(StatusCodes.Status401Unauthorized)
+        .ProducesValidationProblem();
     }
 }
diff --git a/backend/src/Loopless.Api/Program.cs b/backend/src/Loopless.Api/Program.cs
index 72a9d24..0ef4a11 100644
--- a/backend/src/Loopless.Api/Program.cs
+++ b/backend/src/Loopless.Api/Program.cs
@@ -248,8 +248,13 @@
     app.MapFeaturesEndpoints();
     app.MapNotificationEndpoints();
     app.MapProfileEndpoints();
-    app.MapHub<MessagingHub>(MessagingHub.HubPath).RequireAuthorization();
-    app.MapHub<NotificationsHub>(NotificationsHub.HubPath).RequireAuthorization();
+    // Exempt SignalR hubs from the global HTTP rate limiter. Connection
+    // negotiation + reconnect attempts are connection management, not API calls,
+    // and would otherwise exhaust the per-IP budget and 429 the negotiate request
+    // (which then fails the WebSocket handshake). Hub method calls travel over the
+    // socket, so they aren't covered by the HTTP limiter anyway.
+    app.MapHub<MessagingHub>(MessagingHub.HubPath).RequireAuthorization().DisableRateLimiting();
+    app.MapHub<NotificationsHub>(NotificationsHub.HubPath).RequireAuthorization().DisableRateLimiting();
 
     _ = builder.Configuration.GetConnectionString("PostgreSQL")
         ?? throw new InvalidOperationException("PostgreSQL connection string is required. Set ConnectionStrings__PostgreSQL in configuration.");
@@ -266,24 +271,26 @@
             app.MapHangfireDashboard("/hangfire").RequireAuthorization(KeycloakAuthExtensions.AdminPolicy);
     }
 
-    if (!app.Environment.IsEnvironment("Test"))
+    if (!app.Environment.IsEnvironment("Test") && !string.IsNullOrEmpty(pgConnForHangfire))
     {
-        RecurringJob.AddOrUpdate<StandupReminderJob>(
+        var recurringJobs = app.Services.GetRequiredService<IRecurringJobManager>();
+
+        recurringJobs.AddOrUpdate<StandupReminderJob>(
             StandupReminderJob.RecurringJobId,
             job => job.RunAsync(CancellationToken.None),
             "0 9 * * 1-5");
 
-        RecurringJob.AddOrUpdate<BlockerDetectionJob>(
+        recurringJobs.AddOrUpdate<BlockerDetectionJob>(
             BlockerDetectionJob.RecurringJobId,
             job => job.RunAsync(CancellationToken.None),
             Cron.Daily);
 
-        RecurringJob.AddOrUpdate<GitHubSyncJob>(
+        recurringJobs.AddOrUpdate<GitHubSyncJob>(
             GitHubSyncJob.RecurringJobId,
             job => job.SyncAllAsync(CancellationToken.None),
             "*/30 * * * *");
 
-        RecurringJob.AddOrUpdate<UnreadMessageEmailJob>(
+        recurringJobs.AddOrUpdate<UnreadMessageEmailJob>(
             UnreadMessageEmailJob.RecurringJobId,
             job => job.RunAsync(CancellationToken.None),
             "*/5 * * * *");
diff --git a/backend/src/Loopless.Application/Features/Files/GetFileDownload/GetFileDownloadQuery.cs b/backend/src/Loopless.Application/Features/Files/GetFileDownload/GetFileDownloadQuery.cs
new file mode 100644
index 0000000..847f09e
--- /dev/null
+++ b/backend/src/Loopless.Application/Features/Files/GetFileDownload/GetFileDownloadQuery.cs
@@ -0,0 +1,10 @@
+using MediatR;
+
+namespace Loopless.Application.Features.Files.GetFileDownload;
+
+public sealed record GetFileDownloadQuery(Guid ProjectId, Guid FileId)
+    : IRequest<FileDownloadResult>;
+
+/// <summary>Open read stream for a stored file plus the metadata needed to return it
+/// as an attachment. The stream is owned by the caller (the endpoint disposes it).</summary>
+public sealed record FileDownloadResult(Stream Content, string FileName, string ContentType);
diff --git a/backend/src/Loopless.Application/Features/Files/GetFileDownload/GetFileDownloadQueryHandler.cs b/backend/src/Loopless.Application/Features/Files/GetFileDownload/GetFileDownloadQueryHandler.cs
new file mode 100644
index 0000000..1d5e7a5
--- /dev/null
+++ b/backend/src/Loopless.Application/Features/Files/GetFileDownload/GetFileDownloadQueryHandler.cs
@@ -0,0 +1,52 @@
+using Loopless.Application.Common.Exceptions;
+using Loopless.Application.Interfaces;
+using Loopless.Domain.Enums;
+using MediatR;
+using Microsoft.EntityFrameworkCore;
+
+namespace Loopless.Application.Features.Files.GetFileDownload;
+
+public sealed class GetFileDownloadQueryHandler(
+    IAppDbContext db,
+    ICurrentUser currentUser,
+    IFileStorageService storage) : IRequestHandler<GetFileDownloadQuery, FileDownloadResult>
+{
+    public async Task<FileDownloadResult> Handle(
+        GetFileDownloadQuery request,
+        CancellationToken cancellationToken)
+    {
+        var keycloakId = currentUser.KeycloakId
+            ?? throw new UnauthorizedException("Missing subject claim.");
+
+        var user = await db.Users
+            .FirstOrDefaultAsync(u => u.KeycloakId == keycloakId, cancellationToken)
+            ?? throw new NotFoundException("User not found.");
+
+        var project = await db.Projects
+            .FirstOrDefaultAsync(p => p.Id == request.ProjectId, cancellationToken)
+            ?? throw new NotFoundException("Project not found.");
+
+        var isOwner = project.OwnerId == user.Id;
+        var isAcceptedMember = await db.ProjectInvitations
+            .AnyAsync(
+                i => i.ProjectId == project.Id
+                    && (i.EnterpriseId == user.Id || i.FreelancerId == user.Id)
+                    && i.Status == InvitationStatus.Accepted,
+                cancellationToken);
+
+        if (!isOwner && !isAcceptedMember)
+            throw new ForbiddenException("Only project members can download files.");
+
+        var file = await db.ProjectFiles
+            .FirstOrDefaultAsync(
+                f => f.Id == request.FileId && f.ProjectId == project.Id,
+                cancellationToken)
+            ?? throw new NotFoundException("File not found.");
+
+        var stream = await storage.OpenReadAsync(file.FileUrl, cancellationToken);
+
+        // application/octet-stream + a download name forces a download rather than
+        // inline rendering, which is the desired behaviour for project files.
+        return new FileDownloadResult(stream, file.FileName, "application/octet-stream");
+    }
+}
diff --git a/backend/src/Loopless.Application/Features/Messages/MarkConversationRead/MarkConversationReadCommand.cs b/backend/src/Loopless.Application/Features/Messages/MarkConversationRead/MarkConversationReadCommand.cs
new file mode 100644
index 0000000..0ffc562
--- /dev/null
+++ b/backend/src/Loopless.Application/Features/Messages/MarkConversationRead/MarkConversationReadCommand.cs
@@ -0,0 +1,7 @@
+using MediatR;
+
+namespace Loopless.Application.Features.Messages.MarkConversationRead;
+
+/// <summary>Marks every unread message the current user received in a conversation as read.
+/// Returns the number of messages updated.</summary>
+public sealed record MarkConversationReadCommand(Guid ConversationId) : IRequest<int>;
diff --git a/backend/src/Loopless.Application/Features/Messages/MarkConversationRead/MarkConversationReadCommandHandler.cs b/backend/src/Loopless.Application/Features/Messages/MarkConversationRead/MarkConversationReadCommandHandler.cs
new file mode 100644
index 0000000..8228b06
--- /dev/null
+++ b/backend/src/Loopless.Application/Features/Messages/MarkConversationRead/MarkConversationReadCommandHandler.cs
@@ -0,0 +1,47 @@
+using Loopless.Application.Common.Exceptions;
+using Loopless.Application.Interfaces;
+using MediatR;
+using Microsoft.EntityFrameworkCore;
+
+namespace Loopless.Application.Features.Messages.MarkConversationRead;
+
+public sealed class MarkConversationReadCommandHandler(
+    IAppDbContext db,
+    ICurrentUser currentUser) : IRequestHandler<MarkConversationReadCommand, int>
+{
+    public async Task<int> Handle(MarkConversationReadCommand request, CancellationToken cancellationToken)
+    {
+        var keycloakId = currentUser.KeycloakId
+            ?? throw new UnauthorizedException("Missing subject claim.");
+
+        var me = await db.Users
+            .FirstOrDefaultAsync(u => u.KeycloakId == keycloakId, cancellationToken)
+            ?? throw new NotFoundException("User not found.");
+
+        var conversation = await db.Conversations
+            .FirstOrDefaultAsync(c => c.Id == request.ConversationId, cancellationToken)
+            ?? throw new NotFoundException("Conversation not found.");
+
+        if (conversation.Participant1Id != me.Id && conversation.Participant2Id != me.Id)
+            throw new UnauthorizedException("Not a participant of this conversation.");
+
+        var unread = await db.Messages
+            .Where(m => m.ConversationId == conversation.Id
+                && m.SenderId != me.Id
+                && m.ReadAt == null)
+            .ToListAsync(cancellationToken);
+
+        if (unread.Count == 0)
+            return 0;
+
+        var now = DateTimeOffset.UtcNow;
+        foreach (var message in unread)
+        {
+            message.ReadAt = now;
+            message.UpdatedAt = now;
+        }
+
+        await db.SaveChangesAsync(cancellationToken);
+        return unread.Count;
+    }
+}
diff --git a/backend/src/Loopless.Application/Features/Messages/MarkConversationRead/MarkConversationReadCommandValidator.cs b/backend/src/Loopless.Application/Features/Messages/MarkConversationRead/MarkConversationReadCommandValidator.cs
new file mode 100644
index 0000000..f476747
--- /dev/null
+++ b/backend/src/Loopless.Application/Features/Messages/MarkConversationRead/MarkConversationReadCommandValidator.cs
@@ -0,0 +1,11 @@
+using FluentValidation;
+
+namespace Loopless.Application.Features.Messages.MarkConversationRead;
+
+public sealed class MarkConversationReadCommandValidator : AbstractValidator<MarkConversationReadCommand>
+{
+    public MarkConversationReadCommandValidator()
+    {
+        RuleFor(x => x.ConversationId).NotEmpty();
+    }
+}
diff --git a/backend/src/Loopless.Application/Features/Projects/GetMyApplications/GetMyApplicationsQuery.cs b/backend/src/Loopless.Application/Features/Projects/GetMyApplications/GetMyApplicationsQuery.cs
new file mode 100644
index 0000000..77b26b0
--- /dev/null
+++ b/backend/src/Loopless.Application/Features/Projects/GetMyApplications/GetMyApplicationsQuery.cs
@@ -0,0 +1,6 @@
+using Loopless.Application.DTOs;
+using MediatR;
+
+namespace Loopless.Application.Features.Projects.GetMyApplications;
+
+public sealed record GetMyApplicationsQuery() : IRequest<IReadOnlyList<InvitationDto>>;
diff --git a/backend/src/Loopless.Application/Features/Projects/GetMyApplications/GetMyApplicationsQueryHandler.cs b/backend/src/Loopless.Application/Features/Projects/GetMyApplications/GetMyApplicationsQueryHandler.cs
new file mode 100644
index 0000000..5065708
--- /dev/null
+++ b/backend/src/Loopless.Application/Features/Projects/GetMyApplications/GetMyApplicationsQueryHandler.cs
@@ -0,0 +1,61 @@
+using Loopless.Application.Common.Exceptions;
+using Loopless.Application.DTOs;
+using Loopless.Application.Interfaces;
+using Loopless.Domain.Enums;
+using MediatR;
+using Microsoft.EntityFrameworkCore;
+
+namespace Loopless.Application.Features.Projects.GetMyApplications;
+
+public sealed class GetMyApplicationsQueryHandler(
+    IAppDbContext db,
+    ICurrentUser currentUser) : IRequestHandler<GetMyApplicationsQuery, IReadOnlyList<InvitationDto>>
+{
+    public async Task<IReadOnlyList<InvitationDto>> Handle(GetMyApplicationsQuery request, CancellationToken cancellationToken)
+    {
+        var keycloakId = currentUser.KeycloakId
+            ?? throw new UnauthorizedException("Missing subject claim.");
+
+        var user = await db.Users
+            .FirstOrDefaultAsync(u => u.KeycloakId == keycloakId, cancellationToken)
+            ?? throw new NotFoundException("User not found.");
+
+        // Only freelancers apply to projects; everyone else has no applications of their own.
+        if (user.Role != UserRole.Freelancer)
+            return [];
+
+        var rows = await db.ProjectInvitations
+            .Where(i => i.FreelancerId == user.Id && i.InitiatedBy == "Freelancer")
+            .Join(db.Projects.Where(p => !p.IsDeleted),
+                  i => i.ProjectId, p => p.Id,
+                  (i, p) => new { i, ProjectTitle = p.Title })
+            .Join(db.Users.Where(u => !u.IsDeleted),
+                  x => x.i.EnterpriseId, u => u.Id,
+                  (x, e) => new { x.i, x.ProjectTitle, EnterpriseName = e.Name })
+            .GroupJoin(db.Users.Where(u => !u.IsDeleted),
+                  x => x.i.FreelancerId, u => u.Id,
+                  (x, freelancers) => new { x.i, x.ProjectTitle, x.EnterpriseName, Freelancers = freelancers })
+            .SelectMany(x => x.Freelancers.DefaultIfEmpty(),
+                  (x, f) => new
+                  {
+                      x.i.Id,
+                      x.i.ProjectId,
+                      x.ProjectTitle,
+                      x.i.EnterpriseId,
+                      x.EnterpriseName,
+                      x.i.FreelancerId,
+                      FreelancerName = f != null ? f.Name : null,
+                      x.i.InitiatedBy,
+                      x.i.Status,
+                      x.i.InvitedAt,
+                  })
+            .OrderByDescending(r => r.InvitedAt)
+            .ToListAsync(cancellationToken);
+
+        return rows.Select(r => new InvitationDto(
+            r.Id, r.ProjectId, r.ProjectTitle,
+            r.EnterpriseId, r.EnterpriseName,
+            r.FreelancerId, r.FreelancerName,
+            r.InitiatedBy, r.Status, r.InvitedAt)).ToList();
+    }
+}
diff --git a/backend/src/Loopless.Application/Features/Settings/ChangePassword/ChangePasswordCommand.cs b/backend/src/Loopless.Application/Features/Settings/ChangePassword/ChangePasswordCommand.cs
new file mode 100644
index 0000000..b93d8a8
--- /dev/null
+++ b/backend/src/Loopless.Application/Features/Settings/ChangePassword/ChangePasswordCommand.cs
@@ -0,0 +1,5 @@
+using MediatR;
+
+namespace Loopless.Application.Features.Settings.ChangePassword;
+
+public sealed record ChangePasswordCommand(string CurrentPassword, string NewPassword) : IRequest;
diff --git a/backend/src/Loopless.Application/Features/Settings/ChangePassword/ChangePasswordCommandHandler.cs b/backend/src/Loopless.Application/Features/Settings/ChangePassword/ChangePasswordCommandHandler.cs
new file mode 100644
index 0000000..9bd30d5
--- /dev/null
+++ b/backend/src/Loopless.Application/Features/Settings/ChangePassword/ChangePasswordCommandHandler.cs
@@ -0,0 +1,36 @@
+using Loopless.Application.Common.Exceptions;
+using Loopless.Application.Interfaces;
+using MediatR;
+using Microsoft.EntityFrameworkCore;
+
+namespace Loopless.Application.Features.Settings.ChangePassword;
+
+public sealed class ChangePasswordCommandHandler(
+    IAppDbContext db,
+    ICurrentUser currentUser,
+    IKeycloakAdminClient keycloak) : IRequestHandler<ChangePasswordCommand>
+{
+    public async Task Handle(ChangePasswordCommand request, CancellationToken cancellationToken)
+    {
+        var keycloakId = currentUser.KeycloakId
+            ?? throw new UnauthorizedException("Missing subject claim.");
+
+        var user = await db.Users
+            .FirstOrDefaultAsync(u => u.KeycloakId == keycloakId, cancellationToken)
+            ?? throw new NotFoundException("User not found.");
+
+        // Verify the current password by attempting a password grant. Translate a
+        // mismatch into a 400 (BadRequest) rather than a 401 — a wrong password here
+        // must NOT trip the frontend's 401 interceptor (token refresh / logout).
+        try
+        {
+            await keycloak.PasswordGrantAsync(user.Email, request.CurrentPassword, cancellationToken);
+        }
+        catch (UnauthorizedException)
+        {
+            throw new BadRequestException("Current password is incorrect.");
+        }
+
+        await keycloak.ResetPasswordAsync(keycloakId, request.NewPassword, cancellationToken);
+    }
+}
diff --git a/backend/src/Loopless.Application/Features/Settings/ChangePassword/ChangePasswordCommandValidator.cs b/backend/src/Loopless.Application/Features/Settings/ChangePassword/ChangePasswordCommandValidator.cs
new file mode 100644
index 0000000..9763291
--- /dev/null
+++ b/backend/src/Loopless.Application/Features/Settings/ChangePassword/ChangePasswordCommandValidator.cs
@@ -0,0 +1,20 @@
+using FluentValidation;
+
+namespace Loopless.Application.Features.Settings.ChangePassword;
+
+public sealed class ChangePasswordCommandValidator : AbstractValidator<ChangePasswordCommand>
+{
+    public ChangePasswordCommandValidator()
+    {
+        RuleFor(x => x.CurrentPassword)
+            .NotEmpty();
+
+        RuleFor(x => x.NewPassword)
+            .NotEmpty()
+            .MinimumLength(8).WithMessage("Password must be at least 8 characters.")
+            .Matches("[A-Z]").WithMessage("Password must contain an uppercase letter.")
+            .Matches("[a-z]").WithMessage("Password must contain a lowercase letter.")
+            .Matches("[0-9]").WithMessage("Password must contain a number.")
+            .NotEqual(x => x.CurrentPassword).WithMessage("New password must differ from the current one.");
+    }
+}
diff --git a/backend/src/Loopless.Application/Interfaces/IFileStorageService.cs b/backend/src/Loopless.Application/Interfaces/IFileStorageService.cs
index c6c3e58..60ae884 100644
--- a/backend/src/Loopless.Application/Interfaces/IFileStorageService.cs
+++ b/backend/src/Loopless.Application/Interfaces/IFileStorageService.cs
@@ -15,6 +15,12 @@ Task<string> GetDownloadUrlAsync(
         TimeSpan expiresIn,
         CancellationToken cancellationToken = default);
 
+    /// <summary>Opens a read stream for an object. Used to stream downloads through
+    /// the API, avoiding presigned URLs whose host may be unreachable from the browser.</summary>
+    Task<Stream> OpenReadAsync(
+        string objectKey,
+        CancellationToken cancellationToken = default);
+
     /// <summary>Fetch an object's bytes + content type (for proxying through the API).</summary>
     Task<StorageObject> GetObjectAsync(
         string objectKey,
diff --git a/backend/src/Loopless.Application/Interfaces/IKeycloakAdminClient.cs b/backend/src/Loopless.Application/Interfaces/IKeycloakAdminClient.cs
index 54ba91c..1bf8850 100644
--- a/backend/src/Loopless.Application/Interfaces/IKeycloakAdminClient.cs
+++ b/backend/src/Loopless.Application/Interfaces/IKeycloakAdminClient.cs
@@ -50,6 +50,14 @@ Task RemoveRoleAsync(
     Task SendResetPasswordEmailAsync(
         string keycloakId,
         CancellationToken cancellationToken = default);
+
+    /// <summary>Sets a new permanent password for a user via the admin API.
+    /// Used by the authenticated "change password" flow after the current
+    /// password has been verified.</summary>
+    Task ResetPasswordAsync(
+        string keycloakId,
+        string newPassword,
+        CancellationToken cancellationToken = default);
 }
 
 public sealed record TokenResponse(
diff --git a/backend/src/Loopless.Infrastructure/Identity/KeycloakAdminClient.cs b/backend/src/Loopless.Infrastructure/Identity/KeycloakAdminClient.cs
index e864013..17a00b8 100644
--- a/backend/src/Loopless.Infrastructure/Identity/KeycloakAdminClient.cs
+++ b/backend/src/Loopless.Infrastructure/Identity/KeycloakAdminClient.cs
@@ -326,6 +326,35 @@ public async Task SendResetPasswordEmailAsync(
         }
     }
 
+    public async Task ResetPasswordAsync(
+        string keycloakId,
+        string newPassword,
+        CancellationToken cancellationToken = default)
+    {
+        var adminToken = await GetAdminTokenAsync(cancellationToken);
+
+        using var req = new HttpRequestMessage(
+            HttpMethod.Put,
+            BuildAdminUri($"users/{keycloakId}/reset-password"))
+        {
+            Content = JsonContent.Create(new
+            {
+                type = "password",
+                value = newPassword,
+                temporary = false,
+            }),
+        };
+        req.Headers.Authorization = new AuthenticationHeaderValue("Bearer", adminToken);
+
+        using var res = await http.SendAsync(req, cancellationToken);
+        if (!res.IsSuccessStatusCode)
+        {
+            var body = await res.Content.ReadAsStringAsync(cancellationToken);
+            throw new KeycloakOperationException(
+                $"Failed to reset password ({(int)res.StatusCode}): {body}");
+        }
+    }
+
     private static string RoleName(UserRole role) => role switch
     {
         UserRole.Freelancer => "freelancer",
diff --git a/backend/src/Loopless.Infrastructure/Messaging/Consumers/InvitationEventConsumer.cs b/backend/src/Loopless.Infrastructure/Messaging/Consumers/InvitationEventConsumer.cs
index 8be0810..6ff2c0e 100644
--- a/backend/src/Loopless.Infrastructure/Messaging/Consumers/InvitationEventConsumer.cs
+++ b/backend/src/Loopless.Infrastructure/Messaging/Consumers/InvitationEventConsumer.cs
@@ -49,7 +49,7 @@ protected override async Task HandleMessageAsync(string routingKey, byte[] body,
         var (userId, title, message, actionUrl) = routingKey switch
         {
             "invitation.created" => initiatedBy == "Freelancer"
-                ? (e.EnterpriseId, "New Application", $"{e.FreelancerName} applied to your project \"{e.ProjectName}\"", (string?)$"/projects/{e.ProjectId}/invitations")
+                ? (e.EnterpriseId, "New Application", $"{e.FreelancerName} applied to your project \"{e.ProjectName}\"", (string?)$"/projects/{e.ProjectId}?tab=invitations")
                 : (e.FreelancerId, "Project Invitation", $"{e.EnterpriseName} invited you to join \"{e.ProjectName}\"", (string?)"/projects"),
             "invitation.accepted" => initiatedBy == "Freelancer"
                 ? (e.FreelancerId, "Application Accepted", $"Your application to \"{e.ProjectName}\" was accepted.", (string?)$"/projects/{e.ProjectId}")
diff --git a/backend/src/Loopless.Infrastructure/Storage/FileStorageService.cs b/backend/src/Loopless.Infrastructure/Storage/FileStorageService.cs
index 66ee19d..8a9fa0c 100644
--- a/backend/src/Loopless.Infrastructure/Storage/FileStorageService.cs
+++ b/backend/src/Loopless.Infrastructure/Storage/FileStorageService.cs
@@ -69,6 +69,23 @@ public Task<string> GetDownloadUrlAsync(
         return Task.FromResult(url);
     }
 
+    public async Task<Stream> OpenReadAsync(
+        string objectKey,
+        CancellationToken cancellationToken = default)
+    {
+        EnsureConfigured();
+
+        var response = await _client.GetObjectAsync(
+            new GetObjectRequest
+            {
+                BucketName = _options.BucketName,
+                Key = objectKey,
+            },
+            cancellationToken);
+
+        return response.ResponseStream;
+    }
+
     public async Task<StorageObject> GetObjectAsync(
         string objectKey,
         CancellationToken cancellationToken = default)
diff --git a/devops/k8s/overlays/production/kustomization.yaml b/devops/k8s/overlays/production/kustomization.yaml
index 12c5381..b6eb989 100644
--- a/devops/k8s/overlays/production/kustomization.yaml
+++ b/devops/k8s/overlays/production/kustomization.yaml
@@ -1,3 +1,7 @@
+# NOTE: NOT the active production deploy path. Production deploys to the
+# `project-01` namespace via the Helm chart at devops/helm/loopless
+# (see devops/k8s/project-01/README.md and .github/workflows/cd.yml).
+# This overlay is kept as a reference for a future self-managed cluster.
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
@@ -7,7 +11,6 @@ resources:
   - ../../base
   - configmap.yaml
   - secret-store.yaml
-  - secrets.yaml
   - external-secret.yaml
 
 labels:
diff --git a/devops/k8s/overlays/staging/kustomization.yaml b/devops/k8s/overlays/staging/kustomization.yaml
index 7fd3955..178ccbb 100644
--- a/devops/k8s/overlays/staging/kustomization.yaml
+++ b/devops/k8s/overlays/staging/kustomization.yaml
@@ -1,3 +1,6 @@
+# NOTE: NOT an active deploy path — there is no staging cluster. Production
+# deploys to the `project-01` namespace via the Helm chart at devops/helm/loopless.
+# Kept as a reference for a future staging environment.
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
@@ -7,7 +10,6 @@ resources:
   - ../../base
   - configmap.yaml
   - secret-store.yaml
-  - secrets.yaml
   - external-secret.yaml
 
 labels:
diff --git a/frontend/client/app/(protected)/help/actions.ts b/frontend/client/app/(protected)/help/actions.ts
new file mode 100644
index 0000000..8976567
--- /dev/null
+++ b/frontend/client/app/(protected)/help/actions.ts
@@ -0,0 +1,36 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+
+export type QuickFeedbackResult =
+  | { ok: true }
+  | { ok: false; error: string };
+
+const MIN_LEN = 5;
+const MAX_LEN = 1000;
+
+export async function submitQuickFeedback(
+  _prev: QuickFeedbackResult | null,
+  formData: FormData,
+): Promise<QuickFeedbackResult> {
+  const message = formData.get("message")?.toString().trim() ?? "";
+
+  if (message.length < MIN_LEN) {
+    return { ok: false, error: `Message must be at least ${MIN_LEN} characters.` };
+  }
+  if (message.length > MAX_LEN) {
+    return { ok: false, error: `Message must be under ${MAX_LEN} characters.` };
+  }
+
+  console.info(
+    JSON.stringify({
+      event: "quick_feedback",
+      at: new Date().toISOString(),
+      length: message.length,
+      preview: message.slice(0, 120),
+    }),
+  );
+
+  revalidatePath("/help");
+  return { ok: true };
+}
diff --git a/frontend/client/app/(protected)/help/page.tsx b/frontend/client/app/(protected)/help/page.tsx
index 1e68486..b6468b6 100644
--- a/frontend/client/app/(protected)/help/page.tsx
+++ b/frontend/client/app/(protected)/help/page.tsx
@@ -1,10 +1,11 @@
 "use client";
 
-import { useState } from "react";
+import { useActionState, useState } from "react";
 import { motion } from "framer-motion";
 import { NavigationHeader } from "@/components/ui/NavigationHeader";
 import { useCreateSupportTicket, useMySupportTickets } from "@/hooks/useAdmin";
 import type { SupportTicketPriority, SupportTicketStatus } from "@/types/admin";
+import { submitQuickFeedback } from "./actions";
 
 const PRIORITY_OPTIONS: SupportTicketPriority[] = ["Low", "Normal", "High", "Urgent"];
 
@@ -32,6 +33,10 @@ export default function HelpPage() {
   const [submitted, setSubmitted] = useState(false);
   const { data: mine, isLoading } = useMySupportTickets();
   const create = useCreateSupportTicket();
+  const [feedbackState, feedbackAction, feedbackPending] = useActionState(
+    submitQuickFeedback,
+    null,
+  );
 
   const canSubmit = subject.trim().length > 0 && body.trim().length > 0 && !create.isPending;
 
@@ -139,6 +144,43 @@ export default function HelpPage() {
           </form>
         </section>
 
+        <section className="rounded-2xl border border-[var(--line)] bg-[var(--surface)] p-6">
+          <h2 className="text-sm font-semibold uppercase tracking-wide text-[var(--mute)]">
+            Quick anonymous feedback
+          </h2>
+          <p className="mt-1 text-xs text-[var(--mute)]">
+            Server Action — runs on the Next.js server, no client API call.
+          </p>
+          <form action={feedbackAction} className="mt-4 space-y-3">
+            <textarea
+              name="message"
+              required
+              rows={3}
+              minLength={5}
+              maxLength={1000}
+              placeholder="What could be better?"
+              className="w-full rounded-lg border border-[var(--line)] bg-[var(--surface)] px-3 py-2 text-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)]"
+            />
+            {feedbackState && !feedbackState.ok && (
+              <p role="alert" className="text-sm text-[var(--danger)]">
+                {feedbackState.error}
+              </p>
+            )}
+            {feedbackState?.ok && (
+              <p className="text-sm text-[var(--success)]">Thanks — recorded.</p>
+            )}
+            <div className="flex justify-end">
+              <button
+                type="submit"
+                disabled={feedbackPending}
+                className="rounded-full bg-[var(--indigo)] px-4 py-2 text-xs font-semibold text-white hover:opacity-90 disabled:opacity-50"
+              >
+                {feedbackPending ? "Sending…" : "Send feedback"}
+              </button>
+            </div>
+          </form>
+        </section>
+
         <section>
           <h2 className="text-sm font-semibold uppercase tracking-wide text-[var(--mute)]">
             My tickets
diff --git a/frontend/client/app/(protected)/messages/page.tsx b/frontend/client/app/(protected)/messages/page.tsx
index bae2dfc..b0818c6 100644
--- a/frontend/client/app/(protected)/messages/page.tsx
+++ b/frontend/client/app/(protected)/messages/page.tsx
@@ -25,7 +25,7 @@ const ChatView = dynamic(
 import { useConversations } from "@/hooks/useConversations";
 import { flattenMessageHistory, useMessageHistory } from "@/hooks/useMessageHistory";
 import { useMessaging } from "@/hooks/useMessaging";
-import { sendMessage as apiSendMessage, markMessageRead } from "@/lib/api/messaging";
+import { sendMessage as apiSendMessage, markConversationRead } from "@/lib/api/messaging";
 import { useAuthStore } from "@/stores/authStore";
 import type {
   ConversationDto,
@@ -155,31 +155,19 @@ export default function MessagesPage() {
     };
   }, []);
 
-  // When a conversation is open, mark its unread incoming messages as read so the
-  // message badge clears live (the only persisting path is PUT /messages/{id}/read).
-  const markedReadRef = useRef<Set<string>>(new Set());
+  // Mark a conversation's incoming messages as read when it's opened, then
+  // refresh the list so the unread badge clears. Without this, unread counts
+  // never decrease after viewing.
   useEffect(() => {
-    if (!selectedId || !currentUserId) return;
-    const unread = messages.filter(
-      (m) =>
-        m.senderId !== currentUserId &&
-        !m.readAt &&
-        !markedReadRef.current.has(m.id) &&
-        !m.id.startsWith("live-") &&
-        !m.id.startsWith("temp-"),
-    );
-    if (unread.length === 0) return;
-    unread.forEach((m) => markedReadRef.current.add(m.id));
-
-    // Optimistically clear this conversation's unread badge.
-    queryClient.setQueryData<ConversationDto[]>(["messaging", "conversations"], (prev) =>
-      prev?.map((c) => (c.id === selectedId ? { ...c, unreadCount: 0 } : c)),
-    );
-
-    Promise.allSettled(unread.map((m) => markMessageRead(m.id))).finally(() => {
-      queryClient.invalidateQueries({ queryKey: ["messaging", "conversations"] });
-    });
-  }, [selectedId, currentUserId, messages, queryClient]);
+    if (!selectedId) return;
+    markConversationRead(selectedId)
+      .then(() => {
+        queryClient.invalidateQueries({ queryKey: ["messaging", "conversations"] });
+      })
+      .catch(() => {
+        // Non-critical; the badge will reconcile on the next fetch.
+      });
+  }, [selectedId, queryClient]);
 
   const [inputByConv, setInputByConv] = useState<Record<string, string>>({});
   const inputValue = selectedId ? (inputByConv[selectedId] ?? "") : "";
diff --git a/frontend/client/app/(protected)/projects/[id]/page.tsx b/frontend/client/app/(protected)/projects/[id]/page.tsx
index 3433755..3d0c178 100644
--- a/frontend/client/app/(protected)/projects/[id]/page.tsx
+++ b/frontend/client/app/(protected)/projects/[id]/page.tsx
@@ -2,7 +2,7 @@
 
 import { use, useState } from "react";
 import Link from "next/link";
-import { useRouter } from "next/navigation";
+import { useRouter, useSearchParams } from "next/navigation";
 import { motion } from "framer-motion";
 import {
   ArrowLeft,
@@ -66,6 +66,10 @@ function getInitials(name: string): string {
     .slice(0, 2);
 }
 
+function isTab(value: string | null): value is Tab {
+  return value !== null && TABS.some((t) => t.key === value);
+}
+
 export default function ProjectDashboardPage({
   params,
 }: {
@@ -73,8 +77,14 @@ export default function ProjectDashboardPage({
 }) {
   const { id } = use(params);
   const router = useRouter();
+  const searchParams = useSearchParams();
   const { user } = useAuthStore();
-  const [activeTab, setActiveTab] = useState<Tab>("overview");
+  // Deep-link support: notifications (e.g. "New Application") link to
+  // /projects/{id}?tab=invitations. Seed the initial tab from the query param.
+  const [activeTab, setActiveTab] = useState<Tab>(() => {
+    const tabParam = searchParams.get("tab");
+    return isTab(tabParam) ? tabParam : "overview";
+  });
   const [showEditForm, setShowEditForm] = useState(false);
   const [showInviteModal, setShowInviteModal] = useState(false);
   const [editForm, setEditForm] = useState<UpdateProjectRequest>({});
diff --git a/frontend/client/app/(protected)/settings/page.tsx b/frontend/client/app/(protected)/settings/page.tsx
index 9ddf35a..2805141 100644
--- a/frontend/client/app/(protected)/settings/page.tsx
+++ b/frontend/client/app/(protected)/settings/page.tsx
@@ -1,22 +1,16 @@
 "use client";
 
-import { useRef, useState } from "react";
+import { useEffect, useState } from "react";
 import Link from "next/link";
-import { Camera, ExternalLink, Loader2 } from "lucide-react";
-import { useMutation } from "@tanstack/react-query";
+import { Monitor, Moon, Sun } from "lucide-react";
+import { useTheme } from "next-themes";
 import { AppNavigation } from "@/components/ui/AppNavigation";
 import { apiClient } from "@/lib/api/client";
-import { useMe, useUpdateCurrentUser } from "@/hooks/useAuth";
-import { uploadAvatar } from "@/lib/api/profile";
+import { changePassword } from "@/lib/api/auth";
+import { changePasswordSchema } from "@/lib/schemas/auth";
+import { useMe } from "@/hooks/useAuth";
 import { useAuthStore } from "@/stores/authStore";
 
-function resolveAvatar(raw: string | null | undefined): string | null {
-  if (!raw) return null;
-  if (raw.startsWith("http://") || raw.startsWith("https://")) return raw;
-  const base = process.env.NEXT_PUBLIC_API_BASE_URL ?? "http://localhost:8080";
-  return `${base}/api/v1/profile/avatars/${raw.split("/").pop()}`;
-}
-
 export default function SettingsPage() {
   const storeUser = useAuthStore((s) => s.user);
   const meQuery = useMe();
@@ -32,19 +26,37 @@ export default function SettingsPage() {
         </p>
 
         <div className="mt-8 space-y-8">
-          <AccountSection
-            name={me?.name ?? ""}
-            avatarUrl={me?.avatarUrl ?? null}
-            userId={me?.id ?? null}
-          />
+          <AppearanceSection />
+          <SecuritySection />
           <NotificationsSection />
         </div>
+
+        {me?.id && (
+          <p className="mt-8 text-xs text-[var(--mute)]">
+            Looking to update your name, avatar, or bio?{" "}
+            <Link
+              href={`/profile/${me.id}`}
+              className="font-medium text-[var(--indigo)] hover:underline"
+            >
+              Edit your profile
+            </Link>
+            .
+          </p>
+        )}
       </div>
     </main>
   );
 }
 
-function Section({ title, description, children }: { title: string; description?: string; children: React.ReactNode }) {
+function Section({
+  title,
+  description,
+  children,
+}: {
+  title: string;
+  description?: string;
+  children: React.ReactNode;
+}) {
   return (
     <section className="rounded-2xl border border-[var(--line)] bg-[var(--surface)] p-6">
       <header className="mb-5">
@@ -56,15 +68,6 @@ function Section({ title, description, children }: { title: string; description?
   );
 }
 
-function Field({ label, children }: { label: string; children: React.ReactNode }) {
-  return (
-    <label className="block">
-      <span className="block text-xs font-semibold uppercase tracking-wide text-[var(--mute)]">{label}</span>
-      <div className="mt-1">{children}</div>
-    </label>
-  );
-}
-
 function SaveStatus({ saving, saved, error }: { saving: boolean; saved: boolean; error: string | null }) {
   if (saving) return <span className="text-xs text-[var(--mute)]">Saving…</span>;
   if (saved) return <span className="text-xs text-[var(--success)]">Saved</span>;
@@ -72,132 +75,156 @@ function SaveStatus({ saving, saved, error }: { saving: boolean; saved: boolean;
   return null;
 }
 
-function AccountSection({
-  name: initialName,
-  avatarUrl: initialAvatar,
-  userId,
-}: {
-  name: string;
-  avatarUrl: string | null;
-  userId: string | null;
-}) {
-  const [name, setName] = useState(initialName);
-  const [saved, setSaved] = useState(false);
-  const [err, setErr] = useState<string | null>(null);
-  const [prevInitialName, setPrevInitialName] = useState(initialName);
-  const updateUser = useUpdateCurrentUser();
-  const fileRef = useRef<HTMLInputElement>(null);
+const THEME_OPTIONS = [
+  { value: "light", label: "Light", icon: Sun },
+  { value: "dark", label: "Dark", icon: Moon },
+  { value: "system", label: "System", icon: Monitor },
+] as const;
 
-  if (prevInitialName !== initialName) {
-    setPrevInitialName(initialName);
-    setName(initialName);
-  }
+function AppearanceSection() {
+  const { theme, setTheme } = useTheme();
+  const [mounted, setMounted] = useState(false);
+  // Avoid a hydration mismatch: the active theme is only known on the client.
+  // queueMicrotask defers the setState out of the effect body (matches ThemeToggle).
+  useEffect(() => {
+    queueMicrotask(() => setMounted(true));
+  }, []);
 
-  const avatarMutation = useMutation({ mutationFn: (file: File) => uploadAvatar(file) });
+  return (
+    <Section title="Appearance" description="Choose how Loopless looks. Dark is the default.">
+      <div
+        role="radiogroup"
+        aria-label="Theme"
+        className="inline-flex rounded-xl border border-[var(--line)] bg-[var(--bg)] p-1"
+      >
+        {THEME_OPTIONS.map(({ value, label, icon: Icon }) => {
+          const active = mounted && theme === value;
+          return (
+            <button
+              key={value}
+              type="button"
+              role="radio"
+              aria-checked={active}
+              onClick={() => setTheme(value)}
+              className={`inline-flex items-center gap-1.5 rounded-lg px-3 py-1.5 text-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)] ${
+                active
+                  ? "bg-[var(--indigo)] text-white"
+                  : "text-[var(--mute)] hover:text-[var(--ink)]"
+              }`}
+            >
+              <Icon className="h-4 w-4" aria-hidden="true" />
+              {label}
+            </button>
+          );
+        })}
+      </div>
+    </Section>
+  );
+}
+
+function SecuritySection() {
+  const [currentPassword, setCurrentPassword] = useState("");
+  const [newPassword, setNewPassword] = useState("");
+  const [confirmPassword, setConfirmPassword] = useState("");
+  const [saving, setSaving] = useState(false);
+  const [saved, setSaved] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const reset = () => {
+    setCurrentPassword("");
+    setNewPassword("");
+    setConfirmPassword("");
+  };
 
-  const handleSave = async (e: React.FormEvent) => {
+  const handleSubmit = async (e: React.FormEvent) => {
     e.preventDefault();
-    setErr(null);
+    setError(null);
     setSaved(false);
-    try {
-      await updateUser.mutateAsync({ name: name.trim() });
-      setSaved(true);
-      setTimeout(() => setSaved(false), 2000);
-    } catch (e) {
-      setErr((e as { message?: string } | undefined)?.message ?? "Failed");
+
+    const parsed = changePasswordSchema.safeParse({
+      currentPassword,
+      newPassword,
+      confirmPassword,
+    });
+    if (!parsed.success) {
+      setError(parsed.error.issues[0]?.message ?? "Invalid input");
+      return;
     }
-  };
 
-  const handleAvatar = async (file: File) => {
-    setErr(null);
+    setSaving(true);
     try {
-      await avatarMutation.mutateAsync(file);
+      await changePassword(parsed.data.currentPassword, parsed.data.newPassword);
       setSaved(true);
-      setTimeout(() => setSaved(false), 2000);
+      reset();
+      setTimeout(() => setSaved(false), 2500);
     } catch (e) {
-      setErr((e as { message?: string } | undefined)?.message ?? "Avatar upload failed");
+      setError((e as { message?: string } | undefined)?.message ?? "Failed to change password");
+    } finally {
+      setSaving(false);
     }
   };
 
-  const resolvedAvatar = resolveAvatar(initialAvatar);
-
   return (
-    <Section title="Account" description="Display name + avatar shown to other users.">
-      <form onSubmit={handleSave} className="space-y-4">
-        <div className="flex items-center gap-4">
-          <div className="relative">
-            <div className="flex h-16 w-16 items-center justify-center overflow-hidden rounded-full bg-[var(--indigo-soft)] text-sm font-semibold text-[var(--indigo)]">
-              {resolvedAvatar ? (
-                /* eslint-disable-next-line @next/next/no-img-element */
-                <img src={resolvedAvatar} alt="" className="h-full w-full object-cover" />
-              ) : (
-                name.split(" ").map((p) => p[0]).join("").toUpperCase().slice(0, 2)
-              )}
-            </div>
-            <button
-              type="button"
-              onClick={() => fileRef.current?.click()}
-              aria-label="Change avatar"
-              className="absolute -bottom-1 -right-1 rounded-full border border-[var(--line)] bg-[var(--surface)] p-1.5 text-[var(--mute)] shadow hover:text-[var(--ink)]"
-            >
-              {avatarMutation.isPending ? (
-                <Loader2 className="h-3.5 w-3.5 animate-spin" aria-hidden="true" />
-              ) : (
-                <Camera className="h-3.5 w-3.5" aria-hidden="true" />
-              )}
-            </button>
-            <input
-              ref={fileRef}
-              type="file"
-              accept="image/*"
-              className="hidden"
-              onChange={(e) => {
-                const f = e.target.files?.[0];
-                if (f) void handleAvatar(f);
-                e.target.value = "";
-              }}
-            />
-          </div>
-          <div className="flex-1">
-            <Field label="Display name">
-              <input
-                type="text"
-                value={name}
-                onChange={(e) => setName(e.target.value)}
-                maxLength={120}
-                className="w-full rounded-lg border border-[var(--line)] bg-[var(--surface)] px-3 py-2 text-sm"
-              />
-            </Field>
-          </div>
-        </div>
-
-        <div className="flex items-center justify-between pt-2">
-          <SaveStatus saving={updateUser.isPending} saved={saved} error={err} />
+    <Section title="Security" description="Change your account password.">
+      <form onSubmit={handleSubmit} className="space-y-4">
+        <PasswordField
+          label="Current password"
+          value={currentPassword}
+          onChange={setCurrentPassword}
+          autoComplete="current-password"
+        />
+        <PasswordField
+          label="New password"
+          value={newPassword}
+          onChange={setNewPassword}
+          autoComplete="new-password"
+        />
+        <PasswordField
+          label="Confirm new password"
+          value={confirmPassword}
+          onChange={setConfirmPassword}
+          autoComplete="new-password"
+        />
+        <div className="flex items-center justify-between pt-1">
+          <SaveStatus saving={saving} saved={saved} error={error} />
           <button
             type="submit"
-            disabled={updateUser.isPending || name.trim().length === 0}
+            disabled={saving || !currentPassword || !newPassword || !confirmPassword}
             className="rounded-full bg-[var(--indigo)] px-4 py-2 text-xs font-semibold text-white hover:opacity-90 disabled:opacity-50"
           >
-            {updateUser.isPending ? "Saving…" : "Save"}
+            {saving ? "Updating…" : "Update password"}
           </button>
         </div>
       </form>
-
-      {userId && (
-        <div className="mt-5 border-t border-[var(--line)] pt-4">
-          <Link
-            href={`/profile/${userId}`}
-            className="inline-flex items-center gap-1.5 text-xs font-medium text-[var(--indigo)] hover:underline"
-          >
-            <ExternalLink className="h-3 w-3" aria-hidden="true" />
-            View your public profile to edit bio, skills, and links
-          </Link>
-        </div>
-      )}
     </Section>
   );
 }
 
+function PasswordField({
+  label,
+  value,
+  onChange,
+  autoComplete,
+}: {
+  label: string;
+  value: string;
+  onChange: (v: string) => void;
+  autoComplete: string;
+}) {
+  return (
+    <label className="block">
+      <span className="block text-xs font-semibold uppercase tracking-wide text-[var(--mute)]">{label}</span>
+      <input
+        type="password"
+        value={value}
+        autoComplete={autoComplete}
+        onChange={(e) => onChange(e.target.value)}
+        className="mt-1 w-full rounded-lg border border-[var(--line)] bg-[var(--bg)] px-3 py-2 text-sm text-[var(--ink)] outline-none focus:border-[var(--indigo)] focus:ring-[3px] focus:ring-[var(--indigo-soft)]"
+      />
+    </label>
+  );
+}
+
 function NotificationsSection() {
   const [enabled, setEnabled] = useState(true);
   const [saving, setSaving] = useState(false);
diff --git a/frontend/client/components/messaging/NewMessageDialog.tsx b/frontend/client/components/messaging/NewMessageDialog.tsx
index 331fa7e..da4734e 100644
--- a/frontend/client/components/messaging/NewMessageDialog.tsx
+++ b/frontend/client/components/messaging/NewMessageDialog.tsx
@@ -3,9 +3,12 @@
 import { useEffect, useState } from "react";
 import { useRouter } from "next/navigation";
 import { X, Search } from "lucide-react";
-import { useQuery } from "@tanstack/react-query";
+import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { createConversation, searchUsers } from "@/lib/api/messaging";
 import type { UserSearchResult } from "@/lib/api/messaging";
+import type { ConversationDto } from "@/types/messaging";
+
+const CONVERSATIONS_QUERY_KEY = ["messaging", "conversations"] as const;
 
 type Props = {
   open: boolean;
@@ -18,6 +21,7 @@ function initials(name: string): string {
 
 export function NewMessageDialog({ open, onClose }: Props) {
   const router = useRouter();
+  const queryClient = useQueryClient();
   const [query, setQuery] = useState("");
   const [debounced, setDebounced] = useState("");
   const [opening, setOpening] = useState<string | null>(null);
@@ -51,6 +55,15 @@ export function NewMessageDialog({ open, onClose }: Props) {
     setError(null);
     try {
       const conv = await createConversation(u.id);
+      // Seed the new (or existing) conversation into the list so the messages
+      // page can select it immediately, then refetch to stay authoritative.
+      // Without this, navigating to ?c={id} finds nothing in the stale list and
+      // the thread pane renders empty — i.e. clicking a user "does nothing".
+      queryClient.setQueryData<ConversationDto[]>(CONVERSATIONS_QUERY_KEY, (old) => {
+        if (!old) return [conv];
+        return old.some((c) => c.id === conv.id) ? old : [conv, ...old];
+      });
+      queryClient.invalidateQueries({ queryKey: CONVERSATIONS_QUERY_KEY });
       onClose();
       router.push(`/messages?c=${conv.id}`);
     } catch (e) {
diff --git a/frontend/client/components/onboarding/ProficienciesStep.tsx b/frontend/client/components/onboarding/ProficienciesStep.tsx
index 5d61ddc..2815f8f 100644
--- a/frontend/client/components/onboarding/ProficienciesStep.tsx
+++ b/frontend/client/components/onboarding/ProficienciesStep.tsx
@@ -5,7 +5,7 @@ import { useOnboardingStore } from "@/stores/onboardingStore";
 import { useAuthStore } from "@/stores/authStore";
 import { useSkills } from "@/hooks/useOnboarding";
 import SkillChip from "@/components/ui/SkillChip";
-import { useMemo, useState } from "react";
+import { useMemo, useReducer } from "react";
 
 type Props = {
   onNext?: () => void;
@@ -13,12 +13,42 @@ type Props = {
   direction?: 1 | -1;
 };
 
+type StepState = {
+  selectedSkills: string[];
+  exitMode: "none" | "next" | "back";
+};
+
+type StepAction =
+  | { type: "toggle"; id: string }
+  | { type: "exitNext" }
+  | { type: "exitBack" };
+
+function stepReducer(state: StepState, action: StepAction): StepState {
+  switch (action.type) {
+    case "toggle":
+      return {
+        ...state,
+        selectedSkills: state.selectedSkills.includes(action.id)
+          ? state.selectedSkills.filter((s) => s !== action.id)
+          : [...state.selectedSkills, action.id],
+      };
+    case "exitNext":
+      return { ...state, exitMode: "next" };
+    case "exitBack":
+      return { ...state, exitMode: "back" };
+  }
+}
+
 export default function ProficienciesStep({ onNext, onBack, direction = 1 }: Props) {
   const { role } = useOnboardingStore();
   const { proficiencies, setProficiencies } = useAuthStore();
-  const [selectedSkills, setSelectedSkills] = useState<string[]>(proficiencies);
-  const [isExiting, setIsExiting] = useState(false);
-  const [isGoingBack, setIsGoingBack] = useState(false);
+  const [state, dispatch] = useReducer(stepReducer, {
+    selectedSkills: proficiencies,
+    exitMode: "none",
+  });
+  const { selectedSkills, exitMode } = state;
+  const isExiting = exitMode !== "none";
+  const isGoingBack = exitMode === "back";
 
   const { data: allSkills, isLoading, isError, refetch, isFetching } = useSkills();
 
@@ -38,13 +68,13 @@ export default function ProficienciesStep({ onNext, onBack, direction = 1 }: Pro
   const canContinue = hasSelections && !isLoading && !isError;
 
   const toggleSkill = (id: string) => {
-    setSelectedSkills((prev) => (prev.includes(id) ? prev.filter((skill) => skill !== id) : [...prev, id]));
+    dispatch({ type: "toggle", id });
   };
 
   const handleContinue = () => {
     if (!canContinue || isExiting) return;
     setProficiencies(validSelectedSkills);
-    setIsExiting(true);
+    dispatch({ type: "exitNext" });
   };
 
   return (
@@ -149,8 +179,7 @@ export default function ProficienciesStep({ onNext, onBack, direction = 1 }: Pro
             type="button"
             onClick={() => {
               if (isExiting) return;
-              setIsGoingBack(true);
-              setIsExiting(true);
+              dispatch({ type: "exitBack" });
             }}
             disabled={isExiting}
             className="rounded-full px-2 py-1 text-sm text-[var(--mute)] transition-colors hover:text-[var(--ink)] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)] focus-visible:ring-offset-2 disabled:opacity-50"
diff --git a/frontend/client/components/profile/EnterpriseProfileCard.tsx b/frontend/client/components/profile/EnterpriseProfileCard.tsx
index 6b25404..5009c80 100644
--- a/frontend/client/components/profile/EnterpriseProfileCard.tsx
+++ b/frontend/client/components/profile/EnterpriseProfileCard.tsx
@@ -23,6 +23,7 @@ import {
 import type { PublicUser } from "@/types/auth";
 import { useAuthStore } from "@/stores/authStore";
 import { StartConversationButton } from "@/components/messaging/StartConversationButton";
+import { useUpdateCurrentUser } from "@/hooks/useAuth";
 import {
   updateEnterpriseProfile,
   uploadAvatar,
@@ -89,6 +90,8 @@ export function EnterpriseProfileCard({ profile, isSelf }: Props) {
     location: profile.enterpriseLocation ?? "",
   });
 
+  const updateName = useUpdateCurrentUser();
+
   const mutation = useMutation({
     mutationFn: (payload: UpdateEnterpriseProfilePayload) => updateEnterpriseProfile(payload),
     onSuccess: () => {
@@ -131,6 +134,12 @@ export function EnterpriseProfileCard({ profile, isSelf }: Props) {
   }
 
   function handleSave() {
+    // For an enterprise, the company name is their display identity everywhere
+    // (nav, messages), so keep the account display name in sync with it.
+    const trimmedCompany = form.companyName.trim();
+    if (trimmedCompany && trimmedCompany !== profile.name) {
+      updateName.mutate({ name: trimmedCompany });
+    }
     mutation.mutate({
       companyName: form.companyName || companyName,
       industry: form.industry || null,
diff --git a/frontend/client/components/profile/FreelancerProfileCard.tsx b/frontend/client/components/profile/FreelancerProfileCard.tsx
index 456e59b..3f91e3c 100644
--- a/frontend/client/components/profile/FreelancerProfileCard.tsx
+++ b/frontend/client/components/profile/FreelancerProfileCard.tsx
@@ -26,6 +26,7 @@ import { StartConversationButton } from "@/components/messaging/StartConversatio
 import { InviteToProjectButton } from "@/components/profile/InviteToProjectButton";
 import { SkillsEditor } from "@/components/profile/SkillsEditor";
 import { useSkills } from "@/hooks/useOnboarding";
+import { useUpdateCurrentUser } from "@/hooks/useAuth";
 import {
   updateFreelancerProfile,
   uploadAvatar,
@@ -61,6 +62,7 @@ function formatMemberSince(iso: string): string {
 }
 
 type EditState = {
+  name: string;
   title: string;
   bio: string;
   hourlyRate: string;
@@ -83,6 +85,7 @@ export function FreelancerProfileCard({ profile, isSelf }: Props) {
   const [editing, setEditing] = useState(false);
   const [avatarPreview, setAvatarPreview] = useState<string | null>(null);
   const [form, setForm] = useState<EditState>({
+    name: profile.name ?? "",
     title: profile.title ?? "",
     bio: profile.bio ?? "",
     hourlyRate: profile.hourlyRate?.toString() ?? "",
@@ -93,6 +96,8 @@ export function FreelancerProfileCard({ profile, isSelf }: Props) {
     portfolioUrl: profile.portfolioUrl ?? "",
   });
 
+  const updateName = useUpdateCurrentUser();
+
   const mutation = useMutation({
     mutationFn: (payload: UpdateFreelancerProfilePayload) => updateFreelancerProfile(payload),
     onSuccess: () => {
@@ -135,6 +140,10 @@ export function FreelancerProfileCard({ profile, isSelf }: Props) {
   }
 
   function handleSave() {
+    const trimmedName = form.name.trim();
+    if (trimmedName && trimmedName !== profile.name) {
+      updateName.mutate({ name: trimmedName });
+    }
     mutation.mutate({
       title: form.title || null,
       bio: form.bio || null,
@@ -149,6 +158,7 @@ export function FreelancerProfileCard({ profile, isSelf }: Props) {
 
   function handleCancel() {
     setForm({
+      name: profile.name ?? "",
       title: profile.title ?? "",
       bio: profile.bio ?? "",
       hourlyRate: profile.hourlyRate?.toString() ?? "",
@@ -224,9 +234,20 @@ export function FreelancerProfileCard({ profile, isSelf }: Props) {
 
           {/* Identity */}
           <div className="min-w-0 pt-1">
-            <h1 className="text-[28px] font-bold leading-tight tracking-tight text-[var(--ink)]">
-              {profile.name}
-            </h1>
+            {editing ? (
+              <input
+                value={form.name}
+                maxLength={120}
+                onChange={(e) => setForm((f) => ({ ...f, name: e.target.value }))}
+                placeholder="Your name"
+                aria-label="Display name"
+                className="w-full rounded-[10px] border border-[var(--line)] bg-[var(--bg)] px-3 py-2 text-[28px] font-bold leading-tight tracking-tight text-[var(--ink)] outline-none focus:border-[var(--indigo)] focus:ring-[3px] focus:ring-[var(--indigo-soft)]"
+              />
+            ) : (
+              <h1 className="text-[28px] font-bold leading-tight tracking-tight text-[var(--ink)]">
+                {profile.name}
+              </h1>
+            )}
 
             {editing ? (
               <input
diff --git a/frontend/client/components/projects/FileList.tsx b/frontend/client/components/projects/FileList.tsx
index 5f516e7..7594cb6 100644
--- a/frontend/client/components/projects/FileList.tsx
+++ b/frontend/client/components/projects/FileList.tsx
@@ -1,7 +1,10 @@
 "use client";
 
+import { useState } from "react";
 import { FileText } from "lucide-react";
 import { useProjectFiles } from "@/hooks/useProjects";
+import { apiClient } from "@/lib/api/client";
+import type { ProjectFileDto } from "@/types/project";
 
 function formatBytes(bytes: number): string {
   if (bytes < 1024) return `${bytes} B`;
@@ -23,6 +26,30 @@ type Props = {
 
 export function FileList({ projectId }: Props) {
   const { data: files, isLoading } = useProjectFiles(projectId);
+  const [downloadingId, setDownloadingId] = useState<string | null>(null);
+
+  // Download through the API (authenticated) and save via a blob URL. The DTO's
+  // fileUrl is a presigned storage URL whose host can be unreachable from the
+  // browser, and an <a download> is ignored cross-origin — both just navigate.
+  const handleDownload = async (file: ProjectFileDto) => {
+    setDownloadingId(file.id);
+    try {
+      const res = await apiClient.get<Blob>(
+        `/api/v1/projects/${projectId}/files/${file.id}/download`,
+        { responseType: "blob" },
+      );
+      const url = URL.createObjectURL(res.data);
+      const anchor = document.createElement("a");
+      anchor.href = url;
+      anchor.download = file.fileName;
+      document.body.appendChild(anchor);
+      anchor.click();
+      anchor.remove();
+      URL.revokeObjectURL(url);
+    } finally {
+      setDownloadingId(null);
+    }
+  };
 
   if (isLoading) {
     return (
@@ -48,13 +75,15 @@ export function FileList({ projectId }: Props) {
         <li key={file.id} className="flex items-center gap-3 px-4 py-3">
           <FileText aria-hidden="true" className="h-5 w-5 shrink-0 text-[var(--mute)]" />
           <div className="min-w-0 flex-1">
-            <a
-              href={file.fileUrl}
-              download={file.fileName}
-              className="truncate text-sm font-medium text-[var(--indigo)] hover:underline focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)]"
+            <button
+              type="button"
+              onClick={() => handleDownload(file)}
+              disabled={downloadingId === file.id}
+              className="block max-w-full truncate text-left text-sm font-medium text-[var(--indigo)] hover:underline focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)] disabled:opacity-50"
             >
               {file.fileName}
-            </a>
+              {downloadingId === file.id && " · Downloading…"}
+            </button>
             <p className="text-xs text-[var(--mute)]">
               {file.uploadedByName} · {formatDate(file.uploadedAt)} · {formatBytes(file.sizeBytes)}
             </p>
diff --git a/frontend/client/components/providers/ThemeProvider.tsx b/frontend/client/components/providers/ThemeProvider.tsx
index 1e89f83..4f50e56 100644
--- a/frontend/client/components/providers/ThemeProvider.tsx
+++ b/frontend/client/components/providers/ThemeProvider.tsx
@@ -10,7 +10,7 @@ export function ThemeProvider({ children }: { children: ReactNode }) {
     // data-theme="dark"   → drives [data-theme="dark"] CSS var block in globals.css
     <NextThemesProvider
       attribute={["class", "data-theme"]}
-      defaultTheme="system"
+      defaultTheme="dark"
       enableSystem
       disableTransitionOnChange
     >
diff --git a/frontend/client/components/ui/GettingStartedChecklist.tsx b/frontend/client/components/ui/GettingStartedChecklist.tsx
index 546e631..dc07010 100644
--- a/frontend/client/components/ui/GettingStartedChecklist.tsx
+++ b/frontend/client/components/ui/GettingStartedChecklist.tsx
@@ -11,21 +11,6 @@ export function GettingStartedBadge() {
     useGettingStartedChecklist();
   const [open, setOpen] = useState(false);
   const containerRef = useRef<HTMLDivElement>(null);
-  const [celebrating, setCelebrating] = useState(false);
-  const prevAllDoneRef = useRef(false);
-
-  useEffect(() => {
-    if (allDone && !prevAllDoneRef.current && visible) {
-      queueMicrotask(() => setCelebrating(true));
-      const t = setTimeout(() => {
-        dismiss();
-        setOpen(false);
-      }, 2500);
-      return () => clearTimeout(t);
-    }
-    prevAllDoneRef.current = allDone;
-    return undefined;
-  }, [allDone, visible, dismiss]);
 
   useEffect(() => {
     function handleClickOutside(e: MouseEvent) {
@@ -43,16 +28,46 @@ export function GettingStartedBadge() {
 
   return (
     <div ref={containerRef} className="relative">
-      <button
+      <motion.button
         type="button"
         onClick={() => setOpen((v) => !v)}
-        aria-label={`Getting started: ${doneCount} of ${total} complete`}
+        aria-label={
+          allDone
+            ? "Getting started complete"
+            : `Getting started: ${doneCount} of ${total} complete`
+        }
         aria-expanded={open}
-        className="relative inline-flex items-center gap-1.5 rounded-full px-2.5 py-1.5 text-sm font-medium text-[var(--mute)] transition hover:bg-[var(--surface-2)] hover:text-[var(--ink)] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)]"
+        animate={
+          allDone
+            ? {
+                boxShadow: [
+                  "0 0 0 0 rgba(99,102,241,0)",
+                  "0 0 0 4px rgba(99,102,241,0.25)",
+                  "0 0 0 0 rgba(99,102,241,0)",
+                ],
+              }
+            : {}
+        }
+        transition={
+          allDone ? { duration: 2, repeat: Infinity, ease: "easeInOut" } : {}
+        }
+        className={`relative inline-flex items-center gap-1.5 rounded-full px-2.5 py-1.5 text-sm font-medium transition focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)] ${
+          allDone
+            ? "text-[var(--indigo)] hover:bg-[var(--surface-2)]"
+            : "text-[var(--mute)] hover:bg-[var(--surface-2)] hover:text-[var(--ink)]"
+        }`}
       >
         <motion.span
-          animate={celebrating ? { scale: [1, 1.5, 1], rotate: [0, 20, -20, 0] } : {}}
-          transition={{ duration: 0.6, repeat: celebrating ? 2 : 0 }}
+          animate={
+            allDone
+              ? { scale: [1, 1.25, 1], rotate: [0, 12, -12, 0] }
+              : {}
+          }
+          transition={
+            allDone
+              ? { duration: 1.8, repeat: Infinity, ease: "easeInOut" }
+              : {}
+          }
         >
           <Sparkles className="h-4 w-4" aria-hidden="true" />
         </motion.span>
@@ -62,7 +77,7 @@ export function GettingStartedBadge() {
             {doneCount}/{total}
           </span>
         )}
-      </button>
+      </motion.button>
 
       <AnimatePresence>
         {open && (
@@ -137,11 +152,7 @@ export function GettingStartedBadge() {
                     </div>
                   );
                   if (item.done || !item.href) {
-                    return (
-                      <li key={item.id}>
-                        {inner}
-                      </li>
-                    );
+                    return <li key={item.id}>{inner}</li>;
                   }
                   return (
                     <li key={item.id}>
@@ -154,12 +165,31 @@ export function GettingStartedBadge() {
               </ul>
             </div>
 
-            {celebrating && (
-              <div className="border-t border-[var(--line)] px-4 py-3 text-center">
+            {allDone && (
+              <motion.div
+                initial={{ opacity: 0, y: 6 }}
+                animate={{ opacity: 1, y: 0 }}
+                transition={{ duration: 0.25 }}
+                className="border-t border-[var(--line)] px-4 py-4 text-center"
+              >
                 <p className="text-sm font-semibold text-[var(--indigo)]">
                   🎉 You&apos;re all set!
                 </p>
-              </div>
+                <p className="mt-1 text-xs text-[var(--mute)]">
+                  Nice work — you&apos;ve finished everything to get started on Loopless.
+                </p>
+                <button
+                  type="button"
+                  onClick={() => {
+                    dismiss();
+                    setOpen(false);
+                  }}
+                  className="mt-3 inline-flex w-full items-center justify-center gap-1.5 rounded-full bg-[var(--indigo)] px-4 py-2 text-sm font-semibold text-white shadow-[var(--shadow-cta)] transition-[background,transform] duration-[220ms] hover:-translate-y-px hover:bg-[var(--indigo-deep)] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--indigo)] focus-visible:ring-offset-2"
+                >
+                  <Check className="h-4 w-4" aria-hidden="true" />
+                  Complete
+                </button>
+              </motion.div>
             )}
           </motion.div>
         )}
diff --git a/frontend/client/hooks/useGettingStartedChecklist.ts b/frontend/client/hooks/useGettingStartedChecklist.ts
index fbc8600..f88f424 100644
--- a/frontend/client/hooks/useGettingStartedChecklist.ts
+++ b/frontend/client/hooks/useGettingStartedChecklist.ts
@@ -1,18 +1,39 @@
 "use client";
 
-import { useMemo, useState, useEffect, useCallback } from "react";
-import { useQuery, useQueryClient, type InfiniteData } from "@tanstack/react-query";
+import {
+  useCallback,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+  useSyncExternalStore,
+} from "react";
+import {
+  useQuery,
+  useQueryClient,
+  type InfiniteData,
+  type QueryClient,
+} from "@tanstack/react-query";
 import { useAuthStore } from "@/stores/authStore";
-import { normalizeRole } from "@/lib/auth/role";
-import { useMyInvitations } from "@/hooks/useProjects";
+import { useMyApplications, useMyInvitations } from "@/hooks/useProjects";
 import { useProfileCompleteness } from "@/hooks/useProfileCompleteness";
+import { normalizeRole } from "@/lib/auth/role";
 import { fetchProjects } from "@/lib/api/projects";
 import { fetchConversations } from "@/lib/api/messaging";
 import type { PagedResult, MatchDto } from "@/types/matching";
-import type { ProjectInvitationDto } from "@/types/project";
+import type { DiscoverProjectDto, ProjectInvitationDto } from "@/types/project";
 
 const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1000;
-export const CHECKLIST_DISMISS_KEY = "loopless.checklist-dismissed";
+const DISMISS_KEY_PREFIX = "loopless.checklist-dismissed";
+
+// "Complete your profile" ticks at this weighted-completeness score (0–100).
+// Lower than 100 so a freelancer who fills the essentials sees progress without
+// having to fill every optional field. Tune here if the bar feels off.
+const PROFILE_DONE_THRESHOLD = 60;
+
+function dismissKeyFor(userId: string | undefined): string {
+  return userId ? `${DISMISS_KEY_PREFIX}:${userId}` : DISMISS_KEY_PREFIX;
+}
 
 export type ChecklistItem = {
   id: string;
@@ -21,30 +42,109 @@ export type ChecklistItem = {
   href?: string;
 };
 
-export function useGettingStartedChecklist() {
-  const user = useAuthStore((s) => s.user);
-  const role = user?.role;
+type CacheFlags = {
+  hasMatches: boolean;
+  hasRecommendedProjects: boolean;
+  hasInvitedFreelancer: boolean;
+};
+
+const EMPTY_FLAGS: CacheFlags = {
+  hasMatches: false,
+  hasRecommendedProjects: false,
+  hasInvitedFreelancer: false,
+};
+
+function computeCacheFlags(qc: QueryClient): CacheFlags {
+  const matchEntries = qc.getQueriesData<InfiniteData<PagedResult<MatchDto>>>({
+    queryKey: ["matching", "discover"],
+  });
+  const hasMatches = matchEntries.some(
+    ([, data]) => (data?.pages?.[0]?.totalCount ?? 0) > 0,
+  );
+
+  const projectEntries = qc.getQueriesData<DiscoverProjectDto[]>({
+    queryKey: ["projects", "discover"],
+  });
+  const hasRecommendedProjects = projectEntries.some(
+    ([, data]) => Array.isArray(data) && data.length > 0,
+  );
+
+  const invitationEntries = qc.getQueriesData<ProjectInvitationDto[]>({
+    queryKey: ["projects"],
+  });
+  const hasInvitedFreelancer = invitationEntries.some(
+    ([key, data]) =>
+      Array.isArray(key) &&
+      key[2] === "invitations" &&
+      Array.isArray(data) &&
+      data.length > 0,
+  );
+
+  return { hasMatches, hasRecommendedProjects, hasInvitedFreelancer };
+}
+
+/**
+ * Reactively derives booleans from query-cache entries that the checklist does
+ * not own (discover matches/projects, per-project invitation lists). Uses
+ * useSyncExternalStore to subscribe to the TanStack query cache so values update
+ * when those queries land — the earlier useMemo([qc]) read never recomputed
+ * (why "Get your first match" never flipped), and a subscribe()+setState version
+ * fired setState during other components' renders. getSnapshot returns a cached
+ * reference when nothing changed, keeping the store snapshot stable.
+ */
+function useCacheFlags(): CacheFlags {
   const qc = useQueryClient();
+  const snapshotRef = useRef<CacheFlags>(EMPTY_FLAGS);
+
+  const subscribe = useCallback(
+    (onStoreChange: () => void) => qc.getQueryCache().subscribe(onStoreChange),
+    [qc],
+  );
+
+  const getSnapshot = useCallback((): CacheFlags => {
+    const next = computeCacheFlags(qc);
+    const prev = snapshotRef.current;
+    if (
+      prev.hasMatches === next.hasMatches &&
+      prev.hasRecommendedProjects === next.hasRecommendedProjects &&
+      prev.hasInvitedFreelancer === next.hasInvitedFreelancer
+    ) {
+      return prev;
+    }
+    snapshotRef.current = next;
+    return next;
+  }, [qc]);
+
+  return useSyncExternalStore(subscribe, getSnapshot, () => EMPTY_FLAGS);
+}
 
-  const [dismissed, setDismissed] = useState(false);
+export function useGettingStartedChecklist() {
+  const user = useAuthStore((s) => s.user);
+  const role = normalizeRole(user?.role);
+  const isEnterprise = role === "enterprise";
+
+  // Badge visibility depends on browser-only state — the persisted dismissal
+  // (localStorage) and the current time (account age) — neither available
+  // during SSR, so we resolve it once on mount. Reading the user via getState()
+  // keeps this mount-only. This is a legitimate init-from-browser effect; the
+  // experimental set-state-in-effect rule over-flags this single-shot init.
+  const [hidden, setHidden] = useState(false);
   useEffect(() => {
-    // Read persisted dismissal only after mount to avoid an SSR hydration mismatch.
+    const u = useAuthStore.getState().user;
+    const dismissed = localStorage.getItem(dismissKeyFor(u?.id)) === "1";
+    const stale =
+      !!u?.createdAt && Date.now() - new Date(u.createdAt).getTime() >= SEVEN_DAYS_MS;
     // eslint-disable-next-line react-hooks/set-state-in-effect
-    setDismissed(localStorage.getItem(CHECKLIST_DISMISS_KEY) === "1");
+    setHidden(dismissed || stale);
   }, []);
 
-  // Capture "now" once at mount via a lazy initializer (allowed to be impure);
-  // the comparison itself is pure, so it's safe to derive during render.
-  const [now] = useState(() => Date.now());
-  const isWithin7Days =
-    !user?.createdAt || now - new Date(user.createdAt).getTime() < SEVEN_DAYS_MS;
-
-  const visible = !dismissed && isWithin7Days && !!user;
+  const visible = !hidden && !!user;
 
-  // Already fetched by AppNavigation — deduped by TanStack Query
+  // Invitations the user received (freelancer: from enterprises).
   const { data: invitations } = useMyInvitations();
+  // Applications the freelancer initiated themselves (gated to freelancers).
+  const { data: applications } = useMyApplications(!isEnterprise);
 
-  // Pure Zustand — no network call
   const { score } = useProfileCompleteness();
 
   const { data: projects } = useQuery({
@@ -61,30 +161,9 @@ export function useGettingStartedChecklist() {
     staleTime: 60_000,
   });
 
-  // Non-reactive cache reads for complex query shapes
-  const hasMatches = useMemo(() => {
-    const entries = qc.getQueriesData<InfiniteData<PagedResult<MatchDto>>>({
-      queryKey: ["matching", "discover"],
-    });
-    return entries.some(([, data]) => (data?.pages?.[0]?.totalCount ?? 0) > 0);
-  }, [qc]);
-
-  const hasInvitedFreelancer = useMemo(() => {
-    const entries = qc.getQueriesData<ProjectInvitationDto[]>({
-      queryKey: ["projects"],
-    });
-    return entries.some(
-      ([key, data]) =>
-        Array.isArray(key) &&
-        key[2] === "invitations" &&
-        Array.isArray(data) &&
-        data.length > 0,
-    );
-  }, [qc]);
+  const { hasMatches, hasRecommendedProjects, hasInvitedFreelancer } = useCacheFlags();
 
   const items: ChecklistItem[] = useMemo(() => {
-    const isEnterprise = normalizeRole(role) === "enterprise";
-
     if (isEnterprise) {
       return [
         { id: "account", label: "Created account", done: true },
@@ -114,31 +193,43 @@ export function useGettingStartedChecklist() {
       {
         id: "profile",
         label: "Complete your profile",
-        done: score >= 80,
+        done: score >= PROFILE_DONE_THRESHOLD,
         href: "/profile/me",
       },
       {
         id: "match",
-        label: "Get your first match",
-        done: hasMatches,
+        label: "Find a project or get matched",
+        done: hasMatches || hasRecommendedProjects,
         href: "/discover",
       },
       {
-        id: "invitation",
-        label: "Receive your first project invitation",
-        done: (invitations?.length ?? 0) > 0,
-        href: "/projects",
+        id: "apply",
+        label: "Apply for a project",
+        // Whichever comes first: the freelancer applies, or an enterprise
+        // invites them. Both satisfy this step.
+        done: (applications?.length ?? 0) > 0 || (invitations?.length ?? 0) > 0,
+        href: "/discover",
       },
     ];
-  }, [role, projects, invitations, conversations, score, hasMatches, hasInvitedFreelancer]);
+  }, [
+    isEnterprise,
+    projects,
+    invitations,
+    applications,
+    conversations,
+    score,
+    hasMatches,
+    hasRecommendedProjects,
+    hasInvitedFreelancer,
+  ]);
 
   const doneCount = items.filter((i) => i.done).length;
   const allDone = doneCount === items.length;
 
   const dismiss = useCallback(() => {
-    localStorage.setItem(CHECKLIST_DISMISS_KEY, "1");
-    setDismissed(true);
-  }, []);
+    localStorage.setItem(dismissKeyFor(user?.id), "1");
+    setHidden(true);
+  }, [user?.id]);
 
   return { items, doneCount, total: items.length, allDone, visible, dismiss };
 }
diff --git a/frontend/client/hooks/useMessaging.ts b/frontend/client/hooks/useMessaging.ts
index 39aee40..720b72b 100644
--- a/frontend/client/hooks/useMessaging.ts
+++ b/frontend/client/hooks/useMessaging.ts
@@ -85,7 +85,7 @@ export function useMessaging(handlers: Handlers = {}): UseMessagingResult {
       if (err) setError(err);
     });
 
-    connection
+    const startPromise = connection
       .start()
       .then(() => {
         if (!disposed) {
@@ -102,8 +102,13 @@ export function useMessaging(handlers: Handlers = {}): UseMessagingResult {
 
     return () => {
       disposed = true;
-      connection.stop().catch(() => {
-        // Ignore stop errors during teardown.
+      // Wait for start()/negotiation to settle before stopping. Calling stop()
+      // mid-negotiation throws "The connection was stopped during negotiation"
+      // — which is what React Strict Mode's dev double-mount triggers.
+      startPromise.finally(() => {
+        connection.stop().catch(() => {
+          // Ignore stop errors during teardown.
+        });
       });
       connectionRef.current = null;
     };
diff --git a/frontend/client/hooks/useNotifications.ts b/frontend/client/hooks/useNotifications.ts
index b7d46b2..f7c2dad 100644
--- a/frontend/client/hooks/useNotifications.ts
+++ b/frontend/client/hooks/useNotifications.ts
@@ -81,7 +81,7 @@ export function useNotifications(handlers: Handlers = {}): UseNotificationsResul
       if (err) setError(err);
     });
 
-    connection
+    const startPromise = connection
       .start()
       .then(() => {
         if (!disposed) {
@@ -98,7 +98,12 @@ export function useNotifications(handlers: Handlers = {}): UseNotificationsResul
 
     return () => {
       disposed = true;
-      connection.stop().catch(() => {});
+      // Wait for start()/negotiation to settle before stopping. Calling stop()
+      // mid-negotiation throws "The connection was stopped during negotiation"
+      // — which is what React Strict Mode's dev double-mount triggers.
+      startPromise.finally(() => {
+        connection.stop().catch(() => {});
+      });
       connectionRef.current = null;
     };
   }, []);
diff --git a/frontend/client/hooks/useProjects.ts b/frontend/client/hooks/useProjects.ts
index 2f4703e..090c2b8 100644
--- a/frontend/client/hooks/useProjects.ts
+++ b/frontend/client/hooks/useProjects.ts
@@ -11,6 +11,7 @@ import {
   deleteProjectLink,
   deleteProjectTask,
   fetchDiscoverProjects,
+  fetchMyApplications,
   fetchMyInvitations,
   fetchProject,
   fetchProjectCommits,
@@ -263,6 +264,14 @@ export function useMyInvitations() {
   });
 }
 
+export function useMyApplications(enabled: boolean = true) {
+  return useQuery({
+    queryKey: ["applications", "mine"],
+    queryFn: ({ signal }) => fetchMyApplications(signal),
+    enabled,
+  });
+}
+
 export function useApplyToProject() {
   const qc = useQueryClient();
   return useMutation({
@@ -271,6 +280,7 @@ export function useApplyToProject() {
       trackEvent("project_applied");
       qc.invalidateQueries({ queryKey: ["projects", "discover"] });
       qc.invalidateQueries({ queryKey: ["invitations", "mine"] });
+      qc.invalidateQueries({ queryKey: ["applications", "mine"] });
     },
   });
 }
diff --git a/frontend/client/jest.config.js b/frontend/client/jest.config.js
index 289c299..b17c8de 100644
--- a/frontend/client/jest.config.js
+++ b/frontend/client/jest.config.js
@@ -1,7 +1,7 @@
 // CommonJS config so Jest does not require ts-node to load it.
 // Test files are still transformed by ts-jest (see transform below).
 /** @type {import('jest').Config} */
-const config = {
+module.exports = {
   testEnvironment: "jsdom",
   testPathIgnorePatterns: ["/node_modules/", "<rootDir>/e2e/"],
   transform: {
@@ -21,5 +21,3 @@ const config = {
   },
   setupFilesAfterEnv: ["<rootDir>/jest.setup.ts"],
 };
-
-module.exports = config;
diff --git a/frontend/client/lib/api/auth.ts b/frontend/client/lib/api/auth.ts
index 3108fb5..5583a88 100644
--- a/frontend/client/lib/api/auth.ts
+++ b/frontend/client/lib/api/auth.ts
@@ -63,6 +63,13 @@ export async function setUserRole(role: "freelancer" | "enterprise"): Promise<vo
   await apiClient.put("/api/v1/users/me/role", { role });
 }
 
+export async function changePassword(
+  currentPassword: string,
+  newPassword: string,
+): Promise<void> {
+  await apiClient.post("/api/v1/settings/password", { currentPassword, newPassword });
+}
+
 export async function refreshToken(token: string): Promise<RefreshTokenResponse> {
   const { data } = await axios.post<RefreshTokenResponse>(`${baseURL}/api/v1/auth/refresh`, {
     refreshToken: token,
diff --git a/frontend/client/lib/api/client.ts b/frontend/client/lib/api/client.ts
index f520ce8..1886d7e 100644
--- a/frontend/client/lib/api/client.ts
+++ b/frontend/client/lib/api/client.ts
@@ -49,11 +49,14 @@ function processQueue(error: unknown, token: string | null): void {
 }
 
 function toApiError(error: AxiosError): ApiError {
+  // Domain errors are serialized as { error }, validation as { message }/{ title };
+  // check all shapes so callers surface the real message instead of a generic one.
+  const data = error.response?.data as
+    | { message?: string; error?: string; title?: string }
+    | undefined;
   return {
     status: error.response?.status ?? 0,
-    message:
-      (error.response?.data as { message?: string } | undefined)?.message ??
-      error.message,
+    message: data?.message ?? data?.error ?? data?.title ?? error.message,
     details: error.response?.data,
   };
 }
diff --git a/frontend/client/lib/api/messaging.ts b/frontend/client/lib/api/messaging.ts
index 7e402c2..1bd3d6e 100644
--- a/frontend/client/lib/api/messaging.ts
+++ b/frontend/client/lib/api/messaging.ts
@@ -61,6 +61,10 @@ export async function createConversation(
   return data;
 }
 
+export async function markConversationRead(conversationId: string): Promise<void> {
+  await apiClient.put(`/api/v1/messages/conversations/${conversationId}/read`);
+}
+
 export type UserSearchResult = {
   id: string;
   name: string;
diff --git a/frontend/client/lib/api/projects.ts b/frontend/client/lib/api/projects.ts
index 6ebbf7f..4c52aa7 100644
--- a/frontend/client/lib/api/projects.ts
+++ b/frontend/client/lib/api/projects.ts
@@ -281,6 +281,11 @@ export async function fetchMyInvitations(signal?: AbortSignal): Promise<ProjectI
   return data;
 }
 
+export async function fetchMyApplications(signal?: AbortSignal): Promise<ProjectInvitationDto[]> {
+  const { data } = await apiClient.get<ProjectInvitationDto[]>(`/api/v1/applications/me`, { signal });
+  return data;
+}
+
 export async function acceptInvitation(invitationId: string): Promise<void> {
   await apiClient.put(`/api/v1/invitations/${invitationId}/accept`);
 }
diff --git a/frontend/client/lib/schemas/auth.ts b/frontend/client/lib/schemas/auth.ts
index 671fdf9..fa9574d 100644
--- a/frontend/client/lib/schemas/auth.ts
+++ b/frontend/client/lib/schemas/auth.ts
@@ -26,3 +26,25 @@ password: z
   });
 
 export type SignupFormValues = z.infer<typeof signupSchema>;
+
+export const changePasswordSchema = z
+  .object({
+    currentPassword: z.string().min(1, "Enter your current password"),
+    newPassword: z
+      .string()
+      .min(8, "Password must be at least 8 characters")
+      .regex(/[A-Z]/, "Password must contain an uppercase letter")
+      .regex(/[a-z]/, "Password must contain a lowercase letter")
+      .regex(/\d/, "Password must contain a number"),
+    confirmPassword: z.string(),
+  })
+  .refine((data) => data.newPassword === data.confirmPassword, {
+    message: "Passwords do not match",
+    path: ["confirmPassword"],
+  })
+  .refine((data) => data.newPassword !== data.currentPassword, {
+    message: "New password must differ from the current one",
+    path: ["newPassword"],
+  });
+
+export type ChangePasswordFormValues = z.infer<typeof changePasswordSchema>;