diff --git a/docker-compose.yml b/docker-compose.yml
index d1e7e0e..4deff9b 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -53,6 +53,16 @@ services:
       postgres:
         condition: service_healthy
 
+  # One-shot: ensure the DataProtection 'keys' volume is owned by the API's non-root
+  # 'app' user (uid 1654). A volume created by an older root-running image is root-owned,
+  # which makes the app fail to read its key ring and 500s on login. Runs as root, chowns,
+  # exits; the api waits for it. Idempotent and cheap.
+  init-keys:
+    image: busybox
+    command: ["sh", "-c", "chown -R 1654:1654 /keys"]
+    volumes:
+      - keys:/keys
+
   api:
     build:
       context: .
@@ -79,6 +89,8 @@ services:
     depends_on:
       postgres:
         condition: service_healthy
+      init-keys:
+        condition: service_completed_successfully
     # V-08: bind to loopback so the API is not directly reachable from the network
     # (only via the frontend/nginx proxy over the internal compose network). This
     # prevents external clients from bypassing the proxy to spoof X-Forwarded-* headers.
diff --git a/src/InboxIntel.Api/Dockerfile b/src/InboxIntel.Api/Dockerfile
index a366fc2..5b80256 100644
--- a/src/InboxIntel.Api/Dockerfile
+++ b/src/InboxIntel.Api/Dockerfile
@@ -15,6 +15,14 @@ RUN dotnet publish src/InboxIntel.Api/InboxIntel.Api.csproj -c Release -o /app/p
 
 FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS runtime
 WORKDIR /app
+
+# The slim aspnet:10.0 image dropped libgssapi_krb5, which Npgsql tries to load during
+# connection negotiation ("Cannot load library libgssapi_krb5.so.2"). Harmless for password
+# auth but noisy and a latent failure on some paths — install the Kerberos runtime lib.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends libgssapi-krb5-2 \
+    && rm -rf /var/lib/apt/lists/*
+
 COPY --from=build /app/publish .
 
 # V-12: run as the non-root 'app' user shipped in the .NET 8 images. Pre-create the
diff --git a/src/InboxIntel.Infrastructure/Migrations/20260630140733_InitialCreate.Designer.cs b/src/InboxIntel.Infrastructure/Migrations/20260630140733_InitialCreate.Designer.cs
index fa742ee..f156b82 100644
--- a/src/InboxIntel.Infrastructure/Migrations/20260630140733_InitialCreate.Designer.cs
+++ b/src/InboxIntel.Infrastructure/Migrations/20260630140733_InitialCreate.Designer.cs
@@ -1,4 +1,4 @@
-// <auto-generated />
+// <auto-generated />
 using System;
 using InboxIntel.Infrastructure.Persistence;
 using Microsoft.EntityFrameworkCore;
diff --git a/src/InboxIntel.Infrastructure/Migrations/20260630200946_AddUserDigestFields.Designer.cs b/src/InboxIntel.Infrastructure/Migrations/20260630200946_AddUserDigestFields.Designer.cs
index 1a812aa..364d091 100644
--- a/src/InboxIntel.Infrastructure/Migrations/20260630200946_AddUserDigestFields.Designer.cs
+++ b/src/InboxIntel.Infrastructure/Migrations/20260630200946_AddUserDigestFields.Designer.cs
@@ -1,4 +1,4 @@
-// <auto-generated />
+// <auto-generated />
 using System;
 using InboxIntel.Infrastructure.Persistence;
 using Microsoft.EntityFrameworkCore;
diff --git a/src/InboxIntel.Infrastructure/Migrations/20260630201607_AddUnsubscribeConfidence.Designer.cs b/src/InboxIntel.Infrastructure/Migrations/20260630201607_AddUnsubscribeConfidence.Designer.cs
index 036a720..884d818 100644
--- a/src/InboxIntel.Infrastructure/Migrations/20260630201607_AddUnsubscribeConfidence.Designer.cs
+++ b/src/InboxIntel.Infrastructure/Migrations/20260630201607_AddUnsubscribeConfidence.Designer.cs
@@ -1,4 +1,4 @@
-// <auto-generated />
+// <auto-generated />
 using System;
 using InboxIntel.Infrastructure.Persistence;
 using Microsoft.EntityFrameworkCore;
diff --git a/src/InboxIntel.Infrastructure/Migrations/20260701192100_WeightSearchVectorSubjectBody.Designer.cs b/src/InboxIntel.Infrastructure/Migrations/20260701192100_WeightSearchVectorSubjectBody.Designer.cs
index 34a37a1..c385932 100644
--- a/src/InboxIntel.Infrastructure/Migrations/20260701192100_WeightSearchVectorSubjectBody.Designer.cs
+++ b/src/InboxIntel.Infrastructure/Migrations/20260701192100_WeightSearchVectorSubjectBody.Designer.cs
@@ -1,4 +1,4 @@
-// <auto-generated />
+// <auto-generated />
 using System;
 using InboxIntel.Infrastructure.Persistence;
 using Microsoft.EntityFrameworkCore;
diff --git a/src/InboxIntel.Infrastructure/Migrations/20260701203001_EnablePgTrgm.Designer.cs b/src/InboxIntel.Infrastructure/Migrations/20260701203001_EnablePgTrgm.Designer.cs
index 846cc5e..b1a611b 100644
--- a/src/InboxIntel.Infrastructure/Migrations/20260701203001_EnablePgTrgm.Designer.cs
+++ b/src/InboxIntel.Infrastructure/Migrations/20260701203001_EnablePgTrgm.Designer.cs
@@ -1,4 +1,4 @@
-// <auto-generated />
+// <auto-generated />
 using System;
 using InboxIntel.Infrastructure.Persistence;
 using Microsoft.EntityFrameworkCore;
diff --git a/src/InboxIntel.Infrastructure/Migrations/20260701235112_TrigramIndexesSenderDomain.Designer.cs b/src/InboxIntel.Infrastructure/Migrations/20260701235112_TrigramIndexesSenderDomain.Designer.cs
index 81e5395..57989e9 100644
--- a/src/InboxIntel.Infrastructure/Migrations/20260701235112_TrigramIndexesSenderDomain.Designer.cs
+++ b/src/InboxIntel.Infrastructure/Migrations/20260701235112_TrigramIndexesSenderDomain.Designer.cs
@@ -1,4 +1,4 @@
-// <auto-generated />
+// <auto-generated />
 using System;
 using InboxIntel.Infrastructure.Persistence;
 using Microsoft.EntityFrameworkCore;
diff --git a/src/InboxIntel.Infrastructure/Migrations/20260702002304_AddEmbeddingColumn.Designer.cs b/src/InboxIntel.Infrastructure/Migrations/20260702002304_AddEmbeddingColumn.Designer.cs
index 335c335..6ffacee 100644
--- a/src/InboxIntel.Infrastructure/Migrations/20260702002304_AddEmbeddingColumn.Designer.cs
+++ b/src/InboxIntel.Infrastructure/Migrations/20260702002304_AddEmbeddingColumn.Designer.cs
@@ -1,4 +1,4 @@
-// <auto-generated />
+// <auto-generated />
 using System;
 using InboxIntel.Infrastructure.Persistence;
 using Microsoft.EntityFrameworkCore;
diff --git a/src/InboxIntel.Infrastructure/Migrations/20260702152850_FeatureFlagsAndUserSettings.Designer.cs b/src/InboxIntel.Infrastructure/Migrations/20260702152850_FeatureFlagsAndUserSettings.Designer.cs
index a2d7e12..12ff438 100644
--- a/src/InboxIntel.Infrastructure/Migrations/20260702152850_FeatureFlagsAndUserSettings.Designer.cs
+++ b/src/InboxIntel.Infrastructure/Migrations/20260702152850_FeatureFlagsAndUserSettings.Designer.cs
@@ -1,4 +1,4 @@
-// <auto-generated />
+// <auto-generated />
 using System;
 using InboxIntel.Infrastructure.Persistence;
 using Microsoft.EntityFrameworkCore;
diff --git a/src/InboxIntel.Infrastructure/Migrations/20260702152850_FeatureFlagsAndUserSettings.cs b/src/InboxIntel.Infrastructure/Migrations/20260702152850_FeatureFlagsAndUserSettings.cs
index 013fee7..4c5f040 100644
--- a/src/InboxIntel.Infrastructure/Migrations/20260702152850_FeatureFlagsAndUserSettings.cs
+++ b/src/InboxIntel.Infrastructure/Migrations/20260702152850_FeatureFlagsAndUserSettings.cs
@@ -1,4 +1,4 @@
-using System;
+using System;
 using Microsoft.EntityFrameworkCore.Migrations;
 
 #nullable disable
diff --git a/src/InboxIntel.Infrastructure/Migrations/AppDbContextModelSnapshot.cs b/src/InboxIntel.Infrastructure/Migrations/AppDbContextModelSnapshot.cs
index c0bb4e9..549e9dd 100644
--- a/src/InboxIntel.Infrastructure/Migrations/AppDbContextModelSnapshot.cs
+++ b/src/InboxIntel.Infrastructure/Migrations/AppDbContextModelSnapshot.cs
@@ -1,4 +1,4 @@
-// <auto-generated />
+// <auto-generated />
 using System;
 using InboxIntel.Infrastructure.Persistence;
 using Microsoft.EntityFrameworkCore;