diff --git a/.travis.yml b/.travis.yml
index 37d6e1c3b7..132dad0731 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,10 +16,9 @@ env:
       PKGTOOLS_COMMIT: origin/${TRAVIS_BRANCH}
       UPLOAD: scp
   jobs:
-    - REPOSITORY: bullseye
+    - REPOSITORY: trixie
       ARCHITECTURE: amd64
-    - REPOSITORY: bullseye
-      ARCHITECTURE: arm64
+      NO_CLEAN: 1
 
 before_install:
 - echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin
diff --git a/Dockerfile.trixie-base b/Dockerfile.trixie-base
new file mode 100644
index 0000000000..55f00c0814
--- /dev/null
+++ b/Dockerfile.trixie-base
@@ -0,0 +1,28 @@
+FROM debian:trixie
+LABEL maintainer="Rohit Singh <rohit@arista.com>"
+
+ENV REPOSITORY=trixie
+ENV STABLE_VERSION=19.0.0
+
+USER root
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN echo 'APT::Install-Recommends "false";' > /etc/apt/apt.conf.d/no-recommends && \
+    echo 'APT::Install-Suggests "false";' >> /etc/apt/apt.conf.d/no-recommends
+
+RUN apt update -q
+RUN apt dist-upgrade -y
+RUN apt install -y gnupg dirmngr
+
+# cleanup
+RUN apt clean
+RUN rm -rf /var/lib/apt/lists/*
+
+# NGFW-15749: trixie's sqv (replacement for apt-key) rejects keybox-format
+# .gpg files. Export ASCII-armored .asc instead (sqv accepts .asc and .pgp,
+# not .gpg keybox). Same fix shipped in ngfw_pkgs untangle-archive-keyring
+# commit aa164ae57.
+RUN mkdir -p /root/.gnupg && chmod 700 /root/.gnupg && \
+    gpg --keyserver keyserver.ubuntu.com --recv-keys 735A9E18E8F62EDF413592460B9D6AE3627BF103 && \
+    gpg --export --armor 735A9E18E8F62EDF413592460B9D6AE3627BF103 \
+        > /etc/apt/trusted.gpg.d/untangle.asc
diff --git a/Dockerfile.trixie-build b/Dockerfile.trixie-build
new file mode 100644
index 0000000000..e1cf940fa3
--- /dev/null
+++ b/Dockerfile.trixie-build
@@ -0,0 +1,85 @@
+FROM untangleinc/ngfw:trixie-base-multiarch
+LABEL maintainer="Rohit Singh <rohit@arista.com>"
+
+# do not gzip apt lists files (for apt-show-versions)
+RUN rm -f /etc/apt/apt.conf.d/docker-gzip-indexes
+
+RUN apt update -q
+
+# add foreign architectures and their corresponding crossbuild package
+RUN dpkg --add-architecture arm64
+RUN apt install --yes crossbuild-essential-arm64
+
+# install required packages
+RUN apt install --yes build-essential
+RUN apt install --yes debhelper
+RUN apt install --yes devscripts
+RUN apt install --yes git
+# NGFW-15749: git 2.47 (trixie) enforces safe.directory stricter than bookworm's 2.39.
+# Bind-mounted /opt/untangle/build at runtime triggers "dubious ownership" → empty git log
+# → empty timestamp → malformed debian/changelog → libapache2-mod-python setup.py fails.
+RUN git config --system --add safe.directory '*'
+RUN apt install --yes apt-show-versions
+RUN apt install --yes openssh-client
+RUN apt install --yes dput
+RUN apt install --yes curl
+RUN apt install --yes procps
+RUN apt install --yes gawk
+RUN apt install --yes apt-utils
+
+# kernel build dependencies
+RUN apt install --yes kernel-wedge
+RUN apt install --yes quilt
+RUN apt install --yes bc
+RUN apt install --yes flex
+RUN apt install --yes bison
+RUN apt install --yes libelf-dev
+RUN apt install --yes libssl-dev
+RUN apt install --yes rsync
+RUN apt install --yes kmod
+RUN apt install --yes cpio
+RUN apt install --yes python3
+RUN apt install --yes python3-jinja2
+RUN apt install --yes dwarves
+RUN apt install --yes dh-exec
+
+# ISO build dependencies
+RUN apt install --yes simple-cdd
+RUN apt install --yes reprepro
+RUN apt install --yes dose-distcheck
+RUN apt install --yes mtools
+RUN apt install --yes dosfstools
+RUN apt install --yes xorriso
+RUN apt install --yes debian-archive-keyring
+RUN apt install --yes fakeroot
+# NGFW-15749: Travis CI Docker container's IPC namespace restricts SysV semaphores,
+# causing fakeroot (default sysv backend) to hang indefinitely on `fakeroot debian/rules
+# clean` after dput. Switch to the TCP backend which uses sockets instead and works in
+# any IPC environment. Local builds also unaffected (libfakeroot-tcp.so is upstream-shipped).
+RUN update-alternatives --set fakeroot /usr/bin/fakeroot-tcp
+RUN apt install --yes dpkg-dev
+
+# cleanup
+RUN apt clean
+RUN rm -rf /var/lib/apt/lists/* /var/cache/apt-show-versions/*
+
+# do not use official Debian mirrors during build
+RUN rm -f /etc/apt/sources.list
+
+# base dir
+ENV UNTANGLE=/opt/untangle
+RUN mkdir -p ${UNTANGLE}
+
+# pkgtools
+ENV PKGTOOLS=${UNTANGLE}/ngfw_pkgtools
+VOLUME ${PKGTOOLS}
+
+# source to build
+ENV SRC=/opt/untangle/build
+RUN mkdir -p ${SRC}
+VOLUME ${SRC}
+
+WORKDIR ${SRC}
+
+
+CMD [ "bash", "-c", "${PKGTOOLS}/build.sh" ]
diff --git a/branding-manager/hier/usr/lib/python3/dist-packages/tests/test_branding_manager.py b/branding-manager/hier/usr/lib/python3/dist-packages/tests/test_branding_manager.py
index 70087cafeb..7a0b523797 100644
--- a/branding-manager/hier/usr/lib/python3/dist-packages/tests/test_branding_manager.py
+++ b/branding-manager/hier/usr/lib/python3/dist-packages/tests/test_branding_manager.py
@@ -1,6 +1,7 @@
 """branding_manager tests"""
 import json
 import re
+import time
 import unittest
 import urllib.error
 import urllib.request
@@ -24,6 +25,50 @@
 default_banner_message = ""
 
 default_policy_id = 1
+
+
+def _fetch_uvm_root_with_retry(retries=10, retry_sleep=2, all_parameters=True):
+    """
+    GET the UVM root URL via remote wget and retry until the response body
+    looks like the UVM login page (contains a populated <title> with company
+    name in it), not Apache's mod_python "Permission denied" fallback.
+
+    Right after untangle-vm restart Apache mod_python's DbmSession isn't fully
+    initialized for some seconds and any unauthenticated GET to / returns the
+    "<title>Server</title> ... Permission denied" page instead of the actual
+    login HTML. Observed as 2 branding-manager failures (test_020/021) at T+9m
+    in the 2026-05-28 ATS bookworm->trixie post-upgrade run; both pages render
+    correctly on re-run minutes later.
+
+    Returns the (string) response body. Raises AssertionError if no retry
+    succeeds.
+    """
+    title_re = re.compile(r'<title>(.*?)</title>', re.IGNORECASE | re.DOTALL)
+    last = ""
+    for attempt in range(retries):
+        result = remote_control.run_command(
+            global_functions.build_wget_command(
+                output_file="-",
+                ignore_certificate=True,
+                all_parameters=all_parameters,
+                uri=global_functions.get_http_url(),
+            ),
+            stdout=True,
+        ) or ""
+        m = title_re.search(result)
+        title = m.group(1).strip() if m else ""
+        # Apache fallback page renders as "<title>Server</title>"; UVM login
+        # renders with the company name in the title (e.g. "Arista Administrator
+        # Login"). Any non-"Server" title with content means the UVM stack served.
+        if title and title.lower() != "server":
+            return result
+        last = result
+        time.sleep(retry_sleep)
+    raise AssertionError(
+        f"UVM root never returned the login page after {retries} attempts; "
+        f"last body title was empty or 'Server' (mod_python fallback). "
+        f"Apache mod_python likely not warm after untangle-vm restart."
+    )
     
 @pytest.mark.branding_manager
 class BrandingManagerTests(NGFWTestCase):
@@ -162,8 +207,8 @@ def test_019_valid_contact_renders_on_blockpage(self):
     @pytest.mark.failure_behind_ngfw
     def test_020_check_login_page_branding(self):
         # Check login page for branding
-        result = remote_control.run_command(global_functions.build_wget_command(output_file="-", ignore_certificate=True, all_parameters=True, uri=global_functions.get_http_url()),stdout=True)
-        
+        result = _fetch_uvm_root_with_retry()
+
         # Verify Title of blockpage as company name
         myRegex = re.compile('<title>(.*?)</title>', re.IGNORECASE|re.DOTALL)
         matchText = myRegex.search(result).group(1)
@@ -175,17 +220,17 @@ def test_020_check_login_page_branding(self):
 
     def test_021_changeBranding_bannerMessage(self):
         global app, appWeb, appData
-        
+
         # TODO Just like the changes above, I think this may be unnecessary. Not sure though. Do we need to test multi-line?
         appData['bannerMessage'] = "A regulation banner requirement containing a mix of text including <b>html</b> and\nmultiple\nlines"
         app.setSettings(appData)
-        result = remote_control.run_command(global_functions.build_wget_command(output_file="-", all_parameters=True, uri=global_functions.get_http_url()),stdout=True)
+        result = _fetch_uvm_root_with_retry()
         myRegex = re.compile('.*A regulation banner requirement containing a mix of text including <b>html</b> and<br/>multiple<br/>lines.*', re.DOTALL|re.MULTILINE)
         assert(re.match(myRegex, result))
-            
+
         appData['bannerMessage'] = default_banner_message
         app.setSettings(appData)
-        result = remote_control.run_command(global_functions.build_wget_command(output_file="-", ignore_certificate=True, all_parameters=True, uri=global_functions.get_http_url()),stdout=True)
+        result = _fetch_uvm_root_with_retry()
         myRegex = re.compile('.*A regulation banner requirement containing a mix of text including <b>html</b> and<br/>multiple<br/>lines.*', re.DOTALL|re.MULTILINE)
         assert(not re.match(myRegex, result))
         
diff --git a/build-order.txt b/build-order.txt
index cb1ce00c07..2882ebb8bb 100644
--- a/build-order.txt
+++ b/build-order.txt
@@ -1 +1 @@
-.     bullseye
+.     trixie
diff --git a/buildtools/buildtools.rb b/buildtools/buildtools.rb
index 9f2956c077..d28f775526 100644
--- a/buildtools/buildtools.rb
+++ b/buildtools/buildtools.rb
@@ -5,6 +5,7 @@
 openjdk8 = "java-8-openjdk-#{arch}"
 openjdk11 = "java-11-openjdk-#{arch}"
 openjdk17 = "java-17-openjdk-#{arch}"
+openjdk21 = "java-21-openjdk-#{arch}"
 
 jvm = case arch
       when "armel"
@@ -13,7 +14,13 @@
       when "armhf"
         File.exist?("/usr/lib/jvm/#{openjdk8}") ? openjdk8 : "jdk-7-oracle-arm-vfp-hflt"
       else
-        File.exist?("/usr/lib/jvm/#{openjdk17}") ? openjdk17 : openjdk11
+        if File.exist?("/usr/lib/jvm/#{openjdk21}")
+          openjdk21
+        elsif File.exist?("/usr/lib/jvm/#{openjdk17}")
+          openjdk17
+        else
+          openjdk11
+        end
       end
 warn "JVM = #{jvm}"
 ENV['JAVA_HOME'] = "/usr/lib/jvm/#{jvm}"
diff --git a/buildtools/jars.rb b/buildtools/jars.rb
index 56974351d0..12ef360808 100644
--- a/buildtools/jars.rb
+++ b/buildtools/jars.rb
@@ -41,7 +41,7 @@ def Jars.findJars
     const_set(:GetText, [ Jars.downloadTarget('gettext-commons-0.9.1/gettext-commons-0.9.1.jar') ])
     const_set(:JakartaActivation, [ Jars.downloadTarget('jakarta.activation-1.2.1/jakarta.activation-1.2.1.jar') ])
     const_set(:JavaTransaction, [ Jars.downloadTarget('jta-1.1/jta-1.1.jar') ])
-    const_set(:Slf4j, [ Jars.downloadTarget( 'slf4j-2.0.9/slf4j-reload4j-2.0.9.jar'), 
+    const_set(:Slf4j, [ Jars.downloadTarget( 'slf4j-2.0.9/slf4j-nop-2.0.9.jar'),
                         Jars.downloadTarget( 'slf4j-2.0.9/slf4j-api-2.0.9.jar' ) ])
 
     const_set(:TomcatCommon, [ 'tomcat-embed-jasper.jar',
diff --git a/buildtools/target.rb b/buildtools/target.rb
index 9cc5a60ed3..2ae02e98b4 100644
--- a/buildtools/target.rb
+++ b/buildtools/target.rb
@@ -256,7 +256,7 @@ def initialize(package, moveSpecs, taskName, filterset = nil, destBase = nil)
         
         if File.symlink?(src)
           ## Handling symbolic links that don't resolve until in place.
-          file dest => src if File.exists?( src )
+          file dest => src if File.exist?( src )
 
           file dest do
             ensureDirectory(File.dirname(dest)) if !File.exist?(dest)
diff --git a/captive-portal/hier/usr/share/untangle/web/capture/handler.py b/captive-portal/hier/usr/share/untangle/web/capture/handler.py
index ca08a53a5f..ec6250f94e 100644
--- a/captive-portal/hier/usr/share/untangle/web/capture/handler.py
+++ b/captive-portal/hier/usr/share/untangle/web/capture/handler.py
@@ -10,7 +10,7 @@
 from uvm import Uvm
 import urllib.request, urllib.parse, urllib.error
 import pprint
-import imp
+import importlib.util
 import time
 import os
 import uvm.i18n_helper
@@ -19,7 +19,8 @@
 
 from uvm import settings_reader
 
-_ = uvm.i18n_helper.get_translation('untangle').lgettext
+_trans = uvm.i18n_helper.get_translation('untangle')
+_ = getattr(_trans, 'lgettext', _trans.gettext)
 
 # Dictionary of Oauth providers by name, each with the following fields:
 # platform  Identifier to pass to auth-relay
@@ -244,7 +245,17 @@ def index(req):
 # Arguments include username and password along with several hidden fields
 # that store the details of the page originally requested.
 
-def authpost(req,username,password,method,nonce,appid,host,uri):
+def authpost(req,username=None,password=None,method=None,nonce=None,appid=None,host=None,uri=None):
+    # On Python 3.11, mod_python FieldStorage returns bytes keys
+    if username is None or method is None:
+        fields = _get_form_fields(req)
+        if username is None: username = fields.get('username', '')
+        if password is None: password = fields.get('password', '')
+        if method is None: method = fields.get('method', '')
+        if nonce is None: nonce = fields.get('nonce', '')
+        if appid is None: appid = fields.get('appid', '')
+        if host is None: host = fields.get('host', '')
+        if uri is None: uri = fields.get('uri', '')
     if type(username) == bytes:
         username = username.decode('utf-8')
     if type(password) == bytes:
@@ -322,7 +333,17 @@ def authpost(req,username,password,method,nonce,appid,host,uri):
 # in the POST data.  To handle this scenario, we use a function parameter
 # default of 'empty' which will cause app.userActivate to return false.
 
-def infopost(req,method,nonce,appid,host,uri,agree=b'empty'):
+def infopost(req,method=None,nonce=None,appid=None,host=None,uri=None,agree=b'empty'):
+    # On Python 3.11, mod_python FieldStorage returns bytes keys which
+    # don't match str parameter names in apply_fs_data, so args are empty
+    if method is None or nonce is None or appid is None or host is None or uri is None:
+        fields = _get_form_fields(req)
+        if method is None: method = fields.get('method', '')
+        if nonce is None: nonce = fields.get('nonce', '')
+        if appid is None: appid = fields.get('appid', '')
+        if host is None: host = fields.get('host', '')
+        if uri is None: uri = fields.get('uri', '')
+        if agree == b'empty': agree = fields.get('agree', 'empty')
     if type(method) == bytes:
         method = method.decode('utf-8')
     if type(nonce) == bytes:
@@ -622,6 +643,23 @@ def extjs_reply(status,message,filename=""):
 
     return(result)
 
+#-----------------------------------------------------------------------------
+# Extract form fields from req.form, handling bytes keys from Python 3.11
+
+def _get_form_fields(req):
+    fields = {}
+    form = getattr(req, 'form', None)
+    if form is not None and hasattr(form, 'list') and form.list:
+        for field in form.list:
+            name = field.name
+            value = field.value
+            if type(name) == bytes:
+                name = name.decode('utf-8')
+            if type(value) == bytes:
+                value = value.decode('utf-8')
+            fields[name] = value
+    return fields
+
 #-----------------------------------------------------------------------------
 # forces stuff loaded from settings files to be UTF-8 when plugged
 # into the page template files
@@ -688,5 +726,7 @@ def custom_handler(req):
 def _import_file(filename):
     (path, name) = os.path.split(filename)
     (name, ext) = os.path.splitext(name)
-    (file, filename, data) = imp.find_module(name, [path])
-    return imp.load_module(name, file, filename, data)
+    spec = importlib.util.spec_from_file_location(name, os.path.join(path, name + ext))
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
diff --git a/captive-portal/hier/usr/share/untangle/web/capture/logout/logout.py b/captive-portal/hier/usr/share/untangle/web/capture/logout/logout.py
index 4d4333b47b..42239135c3 100644
--- a/captive-portal/hier/usr/share/untangle/web/capture/logout/logout.py
+++ b/captive-portal/hier/usr/share/untangle/web/capture/logout/logout.py
@@ -11,7 +11,8 @@
 
 from uvm import settings_reader
 
-_ = uvm.i18n_helper.get_translation('untangle').lgettext
+_trans = uvm.i18n_helper.get_translation('untangle')
+_ = getattr(_trans, 'lgettext', _trans.gettext)
 
 #-----------------------------------------------------------------------------
 # This is the default function that gets called for a client logout request
diff --git a/debian/changelog b/debian/changelog
index 716da274ef..e6633895fb 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,21 @@
+untangle-vm (18.0.0.20260429T064446Z.c59ed45571+localdiff20260511T113424-1trixie) current; urgency=medium
+
+  * auto build
+
+ -- Untangle Buildbot <buildbot@untangle.com>  Wed, 29 Apr 2026 06:44:46 +0000
+
+untangle-vm (18.0.0.20260429T064446Z.c59ed45571+localdiff20260511T112649-1trixie) current; urgency=medium
+
+  * auto build
+
+ -- Untangle Buildbot <buildbot@untangle.com>  Wed, 29 Apr 2026 06:44:46 +0000
+
+untangle-vm (18.0.0.20260429T064446Z.c59ed45571+localdiff20260511T111712-1trixie) current; urgency=medium
+
+  * auto build
+
+ -- Untangle Buildbot <buildbot@untangle.com>  Wed, 29 Apr 2026 06:44:46 +0000
+
 untangle-vm (10.0.0~svn20130320r34349trunk-1squeeze) dmorris; urgency=low
 
   * 10.0
diff --git a/debian/control b/debian/control
index 00a50cce78..1172589183 100644
--- a/debian/control
+++ b/debian/control
@@ -15,9 +15,10 @@ Build-Depends: debhelper (>= 10),
          libssl-dev,
          libxml2-dev,
          lintian,
-	 openjdk-17-jdk-headless:native,
-	 gettext (>= 0.21.0-1~untangle1bullseye),
+	 openjdk-21-jdk-headless:native | openjdk-17-jdk-headless:native,
+	 gettext (>= 0.21),
 	 python3-javalang:native | python3-javalang,
+	 python3-six,
 	 python3-pytest:native | python3-pytest,
 	 python3-setuptools,
          rake (>= 10),
@@ -119,7 +120,7 @@ Architecture: all
 Conflicts: untangle-node-virus-blocker
 Replaces: untangle-node-virus-blocker
 Provides: untangle-node-virus-blocker
-Depends: ${misc:Depends}, untangle-vm, untangle-base-virus-blocker, untangle-clamav-config | untangle-kernel-modules-buster | untangle-kernel-modules-bullseye, untangle-app-http, untangle-app-ftp, untangle-app-smtp, untangle-app-license
+Depends: ${misc:Depends}, untangle-vm, untangle-base-virus-blocker, untangle-clamav-config | untangle-kernel-modules-trixie | untangle-kernel-modules-bookworm | untangle-kernel-modules-bullseye, untangle-app-http, untangle-app-ftp, untangle-app-smtp, untangle-app-license
 Description: Virus Blocker
  The Virus Blocker application.
 
@@ -300,7 +301,7 @@ Architecture: all
 Conflicts: untangle-node-wireguard-vpn
 Replaces: untangle-node-wireguard-vpn
 Provides: untangle-node-wireguard-vpn
-Depends: ${misc:Depends}, untangle-vm, wireguard-tools, wireguard-dkms, qrencode
+Depends: ${misc:Depends}, untangle-vm, wireguard-tools, qrencode
 Description: WireGuard VPN application
  The WireGuard VPN application.
 
@@ -383,6 +384,7 @@ Conflicts: untangle-libnetfilter-queue-dev, untangle-libnetfilter-queue0
 Depends: ${misc:Depends},
 	 ipset,
 	 python3,
+         python3-legacycrypt | python3 (<< 3.13),
          python3-pem,
          python3-pyotp,
          python3-mechanicalsoup,
diff --git a/directory-connector/hier/usr/lib/python3/dist-packages/tests/test_directory_connector.py b/directory-connector/hier/usr/lib/python3/dist-packages/tests/test_directory_connector.py
index cd9b50a7d2..91a0f3421e 100644
--- a/directory-connector/hier/usr/lib/python3/dist-packages/tests/test_directory_connector.py
+++ b/directory-connector/hier/usr/lib/python3/dist-packages/tests/test_directory_connector.py
@@ -504,7 +504,14 @@ def test_051_checkListOfADUsers_Secure(self):
 
     def test_060_user_authentication_adlm(self):
         """
-        Authenticate against an active directory server with Active Directory Login monitor installed
+        Authenticate against an active directory server with Active Directory Login monitor installed.
+
+        Note: this test does NOT require kinit to succeed. AD audits attempted
+        Kerberos authentications (including those with expired passwords) and
+        ADLM forwards those audit events; the test asserts the event appears.
+        If both this test AND its preceding kinit fail with "Password incorrect"
+        (rather than "Password expired"), the AD test account credentials have
+        likely been reset/locked -- not an NGFW regression.
         """
         if global_functions.verify_kerberos() is False:
             raise unittest.SkipTest("kerberos not installed")
diff --git a/docker-compose-dev.yml b/docker-compose-dev.yml
new file mode 100644
index 0000000000..357d42bc5c
--- /dev/null
+++ b/docker-compose-dev.yml
@@ -0,0 +1,64 @@
+# Local development build for Bookworm
+# Usage: docker-compose -f docker-compose-dev.yml run build
+# Usage: docker-compose -f docker-compose-dev.yml run dev-build
+version: '3'
+
+services:
+    build:
+      image: untangleinc/ngfw:${REPOSITORY:-bookworm}-build-multiarch
+      environment:
+        BUILD_TYPE: ${BUILD_TYPE:-rake}
+        REPOSITORY: ${REPOSITORY:-bookworm}
+        GIT_CONFIG_GLOBAL: /tmp/gitconfig
+        DISTRIBUTION: ${DISTRIBUTION}
+        ARCHITECTURE: ${ARCHITECTURE}
+        VERBOSE: ${VERBOSE}
+        PACKAGE: ${PACKAGE}
+        DEBUG: ${DEBUG}
+        SSH_KEY: ${SSH_KEY}
+        NO_CLEAN: ${NO_CLEAN}
+        UPLOAD: ${UPLOAD}
+        FORCE: ${FORCE}
+        TRAVIS_BRANCH: ${TRAVIS_BRANCH:-ngfw-bookworm}
+        TRAVIS_PULL_REQUEST_BRANCH:
+        TRAVIS_REPO_SLUG:
+      privileged: ${PRIVILEGED:-false}
+      network_mode: host
+      volumes:
+        - .:/opt/untangle/build
+        - /home/rohit/Arista-Workspace/Bookworm-Assemble/ngfw_pkgtools:/opt/untangle/ngfw_pkgtools:ro
+        - /tmp/travis-buildbot.rsa:/tmp/travis-buildbot.rsa
+        - /etc/apt/apt.conf.d/01proxy:/etc/apt/apt.conf.d/01proxy
+        - /tmp/docker-gitconfig:/tmp/gitconfig:ro
+        - /tmp/local-debs:/opt/local-debs:ro
+        - /tmp/local-debs.list:/etc/apt/sources.list.d/local-debs.list:ro
+
+    dev-build:
+      image: untangleinc/ngfw:${REPOSITORY:-bookworm}-build-multiarch
+      environment:
+        BUILD_TYPE: ${BUILD_TYPE:-rake}
+        REPOSITORY: ${REPOSITORY:-bookworm}
+        GIT_CONFIG_GLOBAL: /tmp/gitconfig
+        DISTRIBUTION: ${DISTRIBUTION}
+        ARCHITECTURE: ${ARCHITECTURE}
+        VERBOSE: ${VERBOSE}
+        PACKAGE: ${PACKAGE}
+        DEBUG: ${DEBUG}
+        SSH_KEY: ${SSH_KEY}
+        NO_CLEAN: ${NO_CLEAN}
+        UPLOAD: ${UPLOAD}
+        FORCE: ${FORCE}
+        TRAVIS_BRANCH: ${TRAVIS_BRANCH:-ngfw-bookworm}
+        TRAVIS_PULL_REQUEST_BRANCH:
+        TRAVIS_REPO_SLUG:
+        RAKE_LOG: ${RAKE_LOG}
+        DEV_ENVIRONMENT: ${DEV_ENVIRONMENT:-remote}
+      privileged: ${PRIVILEGED:-false}
+      network_mode: host
+      volumes:
+        - .:/opt/untangle/build
+        - /home/rohit/Arista-Workspace/Bookworm-Assemble/ngfw_pkgtools:/opt/untangle/ngfw_pkgtools:ro
+        - /tmp/travis-buildbot.rsa:/tmp/travis-buildbot.rsa
+        - /etc/apt/apt.conf.d/01proxy:/etc/apt/apt.conf.d/01proxy
+        - /tmp/docker-gitconfig:/tmp/gitconfig:ro
+      entrypoint: ./buildtools/remote-dev-build.sh
diff --git a/docker-compose.build.yml b/docker-compose.build.yml
index f2a169aca9..904f4369e6 100644
--- a/docker-compose.build.yml
+++ b/docker-compose.build.yml
@@ -17,10 +17,10 @@ services:
         git checkout $${PKGTOOLS_COMMIT} || true"
 
     build:
-      image: untangleinc/ngfw:${REPOSITORY:-bullseye}-build-multiarch
+      image: untangleinc/ngfw:${REPOSITORY:-bookworm}-build-multiarch
       environment:
         BUILD_TYPE: ${BUILD_TYPE:-rake}
-        REPOSITORY: ${REPOSITORY:-bullseye}
+        REPOSITORY: ${REPOSITORY:-bookworm}
         DISTRIBUTION: ${DISTRIBUTION} # defaults to empty: let pkgtools do the right thing
         ARCHITECTURE: ${ARCHITECTURE} # defaults to empty: build.sh will use host arch
         VERBOSE: ${VERBOSE} # defaults to empty: "not verbose"
@@ -35,7 +35,7 @@ services:
         # empty: "do not force the build when that version is already
         # present on the target mirror (default)"
         FORCE: ${FORCE}
-        TRAVIS_BRANCH: ${TRAVIS_BRANCH:-master}
+        TRAVIS_BRANCH: ${TRAVIS_BRANCH:-ngfw-bookworm}
         TRAVIS_PULL_REQUEST_BRANCH:
         TRAVIS_REPO_SLUG:
       privileged: ${PRIVILEGED:-false}
@@ -49,10 +49,10 @@ services:
         - /etc/apt/apt.conf.d/01proxy:/etc/apt/apt.conf.d/01proxy
 
     dev-build:
-      image: untangleinc/ngfw:${REPOSITORY:-bullseye}-build-multiarch
+      image: untangleinc/ngfw:${REPOSITORY:-bookworm}-build-multiarch
       environment:
         BUILD_TYPE: ${BUILD_TYPE:-rake}
-        REPOSITORY: ${REPOSITORY:-bullseye}
+        REPOSITORY: ${REPOSITORY:-bookworm}
         DISTRIBUTION: ${DISTRIBUTION} # defaults to empty: let pkgtools do the right thing
         ARCHITECTURE: ${ARCHITECTURE} # defaults to empty: build.sh will use host arch
         VERBOSE: ${VERBOSE} # defaults to empty: "not verbose"
@@ -67,7 +67,7 @@ services:
         # empty: "do not force the build when that version is already
         # present on the target mirror (default)"
         FORCE: ${FORCE}
-        TRAVIS_BRANCH: ${TRAVIS_BRANCH:-master}
+        TRAVIS_BRANCH: ${TRAVIS_BRANCH:-ngfw-bookworm}
         TRAVIS_PULL_REQUEST_BRANCH:
         TRAVIS_REPO_SLUG:
         RAKE_LOG: ${RAKE_LOG}
diff --git a/intrusion-prevention/hier/usr/lib/python3/dist-packages/intrusion_prevention/suricata_conf.py b/intrusion-prevention/hier/usr/lib/python3/dist-packages/intrusion_prevention/suricata_conf.py
index 685e2db7cf..5095cad0b3 100644
--- a/intrusion-prevention/hier/usr/lib/python3/dist-packages/intrusion_prevention/suricata_conf.py
+++ b/intrusion-prevention/hier/usr/lib/python3/dist-packages/intrusion_prevention/suricata_conf.py
@@ -4,7 +4,11 @@
 import os
 import re
 import ruamel.yaml
-from ruamel.yaml.compat import text_type
+try:
+    from ruamel.yaml.compat import text_type
+except ImportError:
+    # ruamel.yaml 0.17+ removed text_type from compat
+    text_type = str
 
 from ruamel.yaml import YAML
 
@@ -54,8 +58,10 @@ def load(self):
         """
         with open(SuricataConf.file_name, 'r') as stream:
             try:
-                # self.conf = yaml.load(stream)
-                self.conf = ruamel.yaml.load(stream, ruamel.yaml.RoundTripLoader, preserve_quotes=True)
+                # NGFW-15749: ruamel.yaml 0.18+ removed module-level load(); use YAML() instance.
+                _yaml = ruamel.yaml.YAML(typ='rt')
+                _yaml.preserve_quotes = True
+                self.conf = _yaml.load(stream)
             except ruamel.yaml.YAMLError as yaml_error:
                 print(yaml_error)
 
@@ -63,12 +69,19 @@ def save(self):
         """
         Save suricata configuration
         """
+        for group in list(self.conf.get("vars", {})):
+            bad_keys = [k for k in self.conf["vars"][group] if not re.match(r'^[A-Z][A-Z0-9_]+$', k.strip())]
+            for k in bad_keys:
+                del self.conf["vars"][group][k]
         temp_file_name = SuricataConf.file_name + ".tmp"
         with open(temp_file_name, 'w') as stream:
             try:
-                #yaml.dump(self.conf, stream, default_flow_style=False)
-                ruamel.yaml.dump(self.conf, stream=stream, Dumper=ruamel.yaml.RoundTripDumper, version=(1, 1), explicit_start=True)
-                #, Dumper=ruamel.yaml.RoundTripDumper)
+                # NGFW-15749: ruamel.yaml 0.18+ removed module-level dump(); use YAML() instance.
+                _yaml = ruamel.yaml.YAML(typ='rt')
+                _yaml.version = (1, 1)
+                _yaml.explicit_start = True
+                _yaml.preserve_quotes = True
+                _yaml.dump(self.conf, stream)
             except ruamel.yaml.YAMLError as yaml_error:
                 print(yaml_error)
 
diff --git a/intrusion-prevention/hier/usr/lib/python3/dist-packages/intrusion_prevention/suricata_signature.py b/intrusion-prevention/hier/usr/lib/python3/dist-packages/intrusion_prevention/suricata_signature.py
index ea868b7bc4..636feb2e63 100644
--- a/intrusion-prevention/hier/usr/lib/python3/dist-packages/intrusion_prevention/suricata_signature.py
+++ b/intrusion-prevention/hier/usr/lib/python3/dist-packages/intrusion_prevention/suricata_signature.py
@@ -8,7 +8,7 @@ class SuricataSignature:
     """
     Process signature from the suricata format.
     """
-    text_regex = re.compile(r'^(?i)([#\s]+|)(alert|log|pass|activate|dynamic|drop|reject|sdrop)\s+(([^\s]+)\s+([^\s]+)\s+([^\s]+)\s+(\-\>|\<\>)\s+([^\s]+)\s+([^\s]+)\s+|)\((.+)\)')
+    text_regex = re.compile(r'^([#\s]+|)(alert|log|pass|activate|dynamic|drop|reject|sdrop)\s+(([^\s]+)\s+([^\s]+)\s+([^\s]+)\s+(\-\>|\<\>)\s+([^\s]+)\s+([^\s]+)\s+|)\((.+)\)', re.IGNORECASE)
     var_regex = re.compile(r'^\$(.+)')
     custom_gid = 2400
 
diff --git a/intrusion-prevention/hier/usr/lib/python3/dist-packages/tests/test_intrusion_prevention.py b/intrusion-prevention/hier/usr/lib/python3/dist-packages/tests/test_intrusion_prevention.py
index c344c27409..1d1a4b5ae9 100644
--- a/intrusion-prevention/hier/usr/lib/python3/dist-packages/tests/test_intrusion_prevention.py
+++ b/intrusion-prevention/hier/usr/lib/python3/dist-packages/tests/test_intrusion_prevention.py
@@ -222,6 +222,9 @@ def test_031_rule_modify(self):
         if runtests.quick_tests_only:
             raise unittest.SkipTest('Skipping a time consuming test')
 
+        if len(appSettings['rules']['list']) == 0:
+            appSettings['rules']['list'].insert(0, create_rule(action="block", rule_type="CATEGORY", type_value="compromised"))
+            app.setSettings(appSettings, True, True)
         appSettings['rules']['list'][0]['action'] = "log"
         app.setSettings(appSettings, True, True)
 
@@ -646,8 +649,11 @@ def test_300_flow_established_toggle(self):
         global app, appSettings
         flow_established_enabled_flag_filename = "/usr/share/untangle/conf/intrusion-prevention-signatures-flow-established"
         rules_filename = "/etc/suricata/ngfw.rules"
+        # Match `established` only inside the flow: option's value (up to the next `;`).
+        # The previous `flow:.*established` was greedy and matched any rule whose msg/content
+        # mentioned "established" after a flow: clause. \bestablished\b excludes not_established.
         # Add "|| true" because if grep doesn't find anything, it will exit with an error code causing an exception
-        command = f"grep -v 'not_established' {rules_filename} | grep -c 'flow:.*established' || true"
+        command = f"grep -cE 'flow:[^;]*\\bestablished\\b' {rules_filename} || true"
 
         # Flag enabled
         Path(flow_established_enabled_flag_filename).touch()
diff --git a/intrusion-prevention/hier/usr/share/untangle/bin/intrusion-prevention-create-config.py b/intrusion-prevention/hier/usr/share/untangle/bin/intrusion-prevention-create-config.py
index 7c4087b344..4f958100c0 100755
--- a/intrusion-prevention/hier/usr/share/untangle/bin/intrusion-prevention-create-config.py
+++ b/intrusion-prevention/hier/usr/share/untangle/bin/intrusion-prevention-create-config.py
@@ -161,7 +161,9 @@ def main(argv):
     ## for settings_variable in settings.get_variables():
     ##
     for settings_variable in settings["variables"]["list"]:
-        name = settings_variable["name"]
+        name = settings_variable["name"].strip()
+        if not re.match(r'^[A-Z][A-Z0-9_]+$', name):
+            continue
         value = settings_variable["value"]
         if settings_variable["name"] == "HOME_NET":
             value = re.sub(r"\b\bdefault\b\b", default_home_net, value)
diff --git a/intrusion-prevention/hier/usr/share/untangle/bin/intrusion-prevention-get-updates b/intrusion-prevention/hier/usr/share/untangle/bin/intrusion-prevention-get-updates
index b95fc48832..c3f125a0c7 100755
--- a/intrusion-prevention/hier/usr/share/untangle/bin/intrusion-prevention-get-updates
+++ b/intrusion-prevention/hier/usr/share/untangle/bin/intrusion-prevention-get-updates
@@ -42,7 +42,7 @@ def get_signature_template_uri():
 		return 'https://ids.edge.arista.com/suricatasignatures.tar.gz'
 
 try:
-    Uvm_context = Uvm().getUvmContext(hostname="localhost", username=None, password=None)
+    Uvm_context = Uvm().getUvmContext(hostname="127.0.0.1", username=None, password=None)
 except:
     Logger.message("Unable to get uvm context", sys.exc_info(), target="log")
     sys.exit(1)
diff --git a/intrusion-prevention/src/com/untangle/app/intrusion_prevention/IntrusionPreventionApp.java b/intrusion-prevention/src/com/untangle/app/intrusion_prevention/IntrusionPreventionApp.java
index a2292a3e5f..96e6fb2180 100644
--- a/intrusion-prevention/src/com/untangle/app/intrusion_prevention/IntrusionPreventionApp.java
+++ b/intrusion-prevention/src/com/untangle/app/intrusion_prevention/IntrusionPreventionApp.java
@@ -503,8 +503,20 @@ public boolean synchronizeSettingsWithVariables(){
         }
 
         List<IntrusionPreventionVariable> variables = this.settings.getVariables();
+        variables.removeIf(v -> !v.getName().trim().matches("[A-Z][A-Z0-9_]+"));
         for ( String line : result.getOutput().split("\\r?\\n") ){
             String variableLine[] = line.split("=");
+            // NGFW-15749: guard against empty/malformed lines. On first install
+            // (and on first UVM restart post-upgrade) sync-settings may be
+            // mid-rewrite of /etc/suricata/suricata.yaml when get-config runs,
+            // producing empty output. Without this guard variableLine[1] throws
+            // IndexOutOfBoundsException and settings never persist.
+            if (variableLine.length < 2) continue;
+            String varName = variableLine[0].trim();
+            if (!varName.matches("[A-Z][A-Z0-9_]+")) {
+                logger.warn("synchronizeSettingsWithVariables: skipping invalid variable name: " + varName);
+                continue;
+            }
 
             Boolean found = false;
             for( IntrusionPreventionVariable variable : variables){
diff --git a/ipsec-vpn/hier/etc/ppp/ip-down.d/untangle-l2tp b/ipsec-vpn/hier/etc/ppp/ip-down.d/untangle-l2tp
index 56902570c3..6f4842798f 100755
--- a/ipsec-vpn/hier/etc/ppp/ip-down.d/untangle-l2tp
+++ b/ipsec-vpn/hier/etc/ppp/ip-down.d/untangle-l2tp
@@ -26,11 +26,11 @@ if [ "$PPP_IPPARAM" != "L2TP" ]; then
     exit
 fi
 
-/bin/echo -e "[INFO: `date`] Removing iptables rules for ${PPP_IFACE}"
+/bin/echo -e "[INFO: `date`] Removing mark rules for ${PPP_IFACE}"
 
 # remove the mark rules for the interface that is going away
-iptables -t mangle -D mark-src-intf -i ${PPP_IFACE} -j MARK --set-mark 0xfb/0xff -m comment --comment "Set src interface mark for l2tp"
-iptables -t mangle -D mark-dst-intf -o ${PPP_IFACE} -j MARK --set-mark 0xfb00/0xff00 -m comment --comment "Set dst interface mark for l2tp"
+iptables -t mangle -D mark-src-intf -i ${PPP_IFACE} -j MARK --set-mark 0xfb/0xff -m comment --comment "Set src interface mark for l2tp" 2>/dev/null || true
+iptables -t mangle -D mark-dst-intf -o ${PPP_IFACE} -j MARK --set-mark 0xfb00/0xff00 -m comment --comment "Set dst interface mark for l2tp" 2>/dev/null || true
 
 # call the goodbye function in the app
 /usr/share/untangle/bin/ipsec-virtual-user-event GOODBYE L2TP $IPREMOTE $PEERNAME $BYTES_SENT $BYTES_RCVD
diff --git a/ipsec-vpn/hier/etc/ppp/ip-up.d/untangle-l2tp b/ipsec-vpn/hier/etc/ppp/ip-up.d/untangle-l2tp
index 32f5a82f54..c704e82973 100755
--- a/ipsec-vpn/hier/etc/ppp/ip-up.d/untangle-l2tp
+++ b/ipsec-vpn/hier/etc/ppp/ip-up.d/untangle-l2tp
@@ -26,11 +26,11 @@ if [ "$PPP_IPPARAM" != "L2TP" ]; then
     exit
 fi
 
-/bin/echo -e "[INFO: `date`] Adding iptables rules for ${PPP_IFACE}"
+/bin/echo -e "[INFO: `date`] Adding mark rules for ${PPP_IFACE}"
 
 # mark traffic on the ppp interface with ID 251
-iptables -t mangle -I mark-src-intf 3 -i ${PPP_IFACE} -j MARK --set-mark 0xfb/0xff -m comment --comment "Set src interface mark for l2tp"
-iptables -t mangle -I mark-dst-intf 3 -o ${PPP_IFACE} -j MARK --set-mark 0xfb00/0xff00 -m comment --comment "Set dst interface mark for l2tp"
+iptables -t mangle -I mark-src-intf 3 -i ${PPP_IFACE} -j MARK --set-mark 0xfb/0xff -m comment --comment "Set src interface mark for l2tp" 2>/dev/null || true
+iptables -t mangle -I mark-dst-intf 3 -o ${PPP_IFACE} -j MARK --set-mark 0xfb00/0xff00 -m comment --comment "Set dst interface mark for l2tp" 2>/dev/null || true
 
 # call the connect function in the app
 /usr/share/untangle/bin/ipsec-virtual-user-event CONNECT L2TP $IPREMOTE $PEERNAME $IFNAME $PPPD_PID
diff --git a/ipsec-vpn/hier/usr/lib/python3/dist-packages/tests/test_ipsec_vpn.py b/ipsec-vpn/hier/usr/lib/python3/dist-packages/tests/test_ipsec_vpn.py
index 05ce680ca0..e200d624da 100644
--- a/ipsec-vpn/hier/usr/lib/python3/dist-packages/tests/test_ipsec_vpn.py
+++ b/ipsec-vpn/hier/usr/lib/python3/dist-packages/tests/test_ipsec_vpn.py
@@ -35,10 +35,11 @@
 IPSEC_HOST_NAME = overrides.get("IPSEC_HOST_NAME", default="ipsecsite.untangle.int")
 IPSEC_CONFIGURED_HOST_IPS = overrides.get("IPSEC_CONFIGURED_HOST_IPS", default=
                         [('10.112.13.168','192.168.10.1','192.168.10.1/24'), # ATS
-                        ('10.112.56.89','10.112.56.89','10.112.56.0/24'),  # QA 3 Bridged
+                        ('10.112.56.89','10.112.56.89','10.112.56.0/24'),   # QA 3 Bridged
                         ('10.112.56.57','192.168.10.1','192.168.10.0/24'),  # QA box .57
                         ('10.112.56.58','192.168.10.1','192.168.10.0/24'),  # QA box .58
-                        ('10.112.56.59','192.168.10.1','192.168.10.0/24')] # QA box Dual .59
+                        ('10.112.56.59','192.168.10.1','192.168.10.0/24'),  # QA box Dual .59
+                        ('10.112.56.180','192.168.10.1','192.168.10.0/24')] # trixie server
 )
 
 default_policy_id = 1
diff --git a/ipsec-vpn/hier/usr/share/untangle/bin/ipsec-vti-updown b/ipsec-vpn/hier/usr/share/untangle/bin/ipsec-vti-updown
index dde1a30a13..1da739d1dc 100755
--- a/ipsec-vpn/hier/usr/share/untangle/bin/ipsec-vti-updown
+++ b/ipsec-vpn/hier/usr/share/untangle/bin/ipsec-vti-updown
@@ -89,7 +89,7 @@ case "${PLUTO_VERB}" in
                 echo "$(date) [$SCRIPT_ID] inserting nat masquerade rule for ${PLUTO_MY_SOURCEIP} on ${VTI_IF}"
 
                 # This mode is pretty much a guarantee to need NAT for clients on our local networks
-                iptables -t nat -D tunnel-postrouting-rules -o ${VTI_IF} -j MASQUERADE
+                iptables -t nat -D tunnel-postrouting-rules -o ${VTI_IF} -j MASQUERADE 2>/dev/null || true
                 iptables -t nat -I tunnel-postrouting-rules -o ${VTI_IF} -j MASQUERADE
         fi
 
@@ -120,10 +120,10 @@ case "${PLUTO_VERB}" in
         ;;
     down-client)
         echo "$(date) [$SCRIPT_ID] removing tunnel"
-        iptables -t nat -D tunnel-postrouting-rules -o ${VTI_IF} -j MASQUERADE
-        ip tunnel del "${VTI_IF}"
-	ip route delete table ipsec default via "${PLUTO_PEER}"
-        ip route flush table uplink.ipsec
+        iptables -t nat -D tunnel-postrouting-rules -o ${VTI_IF} -j MASQUERADE 2>/dev/null || true
+        ip tunnel del "${VTI_IF}" 2>/dev/null || true
+        ip route delete table ipsec default via "${PLUTO_PEER}" 2>/dev/null || true
+        ip route flush table uplink.ipsec 2>/dev/null || true
         ;;
 esac
 
diff --git a/libnetcap/src/netcap_init.c b/libnetcap/src/netcap_init.c
index a2aaa499df..e21585e957 100644
--- a/libnetcap/src/netcap_init.c
+++ b/libnetcap/src/netcap_init.c
@@ -158,9 +158,19 @@ static int _netcap_init()
         ip_sendnfmark = 28;
         is_new_kernel = 510;
     }
+    else if ( strstr(utsn.release,"6.1.") != NULL ) {
+        ip_saddr = 27;
+        ip_sendnfmark = 28;
+        is_new_kernel = 610;
+    }
+    else if ( strstr(utsn.release,"6.12.") != NULL ) {
+        ip_saddr = 27;
+        ip_sendnfmark = 28;
+        is_new_kernel = 612;
+    }
     else {
         errlog( ERR_WARNING, "Unknown kernel: %s\n", utsn.release );
-        errlog( ERR_WARNING, "Assuming 5.10.0\n" );
+        errlog( ERR_WARNING, "Assuming 6.1.0\n" );
         /* unknown kernel */ 
         ip_saddr = 27;
         ip_sendnfmark = 28;
diff --git a/openvpn/hier/usr/share/untangle/bin/openvpn-generate-certs b/openvpn/hier/usr/share/untangle/bin/openvpn-generate-certs
index 0ea75ecf68..99112a85b4 100755
--- a/openvpn/hier/usr/share/untangle/bin/openvpn-generate-certs
+++ b/openvpn/hier/usr/share/untangle/bin/openvpn-generate-certs
@@ -44,7 +44,10 @@ generateServerKey()
     export KEY_DN_QUALIFIER="server"
     
     ## Generate the server private key and the certificate signing request
-    openssl req -days ${CERT_DURATION} -nodes -new -keyout ${SERVER_KEY} -out ${serverCsrTmp} -extensions server -config ${OPENSSL_CFG_FILE} -batch
+    # NGFW-15749: drop -extensions on req (CSR creation). OpenSSL 3.5 (trixie) rejects
+    # authorityKeyIdentifier=keyid,issuer:always at CSR time (no issuer cert exists yet);
+    # extensions are still applied at signing time by the openssl ca call below.
+    openssl req -days ${CERT_DURATION} -nodes -new -keyout ${SERVER_KEY} -out ${serverCsrTmp} -config ${OPENSSL_CFG_FILE} -batch
 
     # create the "database" file for openssl.cnf
     rm -f @PREFIX@/usr/share/untangle/settings/openvpn/index.txt*
diff --git a/openvpn/src/com/untangle/app/openvpn/OpenVpnManager.java b/openvpn/src/com/untangle/app/openvpn/OpenVpnManager.java
index 31de55cb60..3d7b222609 100644
--- a/openvpn/src/com/untangle/app/openvpn/OpenVpnManager.java
+++ b/openvpn/src/com/untangle/app/openvpn/OpenVpnManager.java
@@ -627,7 +627,6 @@ private void buildCommonConfiguration(OpenVpnSettings settings, StringBuilder sb
         } else {
             fallback = fallbackRaw.split(":", 2)[0].trim();
             if (fallback.isEmpty()) {
-                // Pathological input like ":X" - first colon-token is empty; use default so .conf stays valid.
                 logger.warn("data-ciphers-fallback started with a colon ('{}') - falling back to default '{}'", fallbackRaw, OpenVpnSettings.DEFAULT_CIPHER);
                 fallback = OpenVpnSettings.DEFAULT_CIPHER;
             } else if (fallbackRaw.contains(":")) {
@@ -788,6 +787,8 @@ private void writeRemoteServerFiles(List<OpenVpnRemoteServer> remoteServers)
                 cfgReader = new BufferedReader(new FileReader(readFile));
                 cfgWriter = new BufferedWriter(new FileWriter(writeFile));
                 String line;
+                String importedCipher = null;
+                boolean hasDataCiphers = false;
 
                 while ((line = cfgReader.readLine()) != null) {
                     // remove any existing auth-user-pass
@@ -801,10 +802,34 @@ private void writeRemoteServerFiles(List<OpenVpnRemoteServer> remoteServers)
                         continue;
                     }
 
+                    // capture imported cipher info so we can synthesize a
+                    // backward-compatible data-ciphers list afterwards
+                    String trimmed = line.trim();
+                    if (trimmed.startsWith("cipher ") && importedCipher == null) {
+                        String[] parts = trimmed.split("\\s+", 2);
+                        if (parts.length == 2) importedCipher = parts[1].trim();
+                    } else if (trimmed.startsWith("data-ciphers ") || trimmed.startsWith("data-ciphers-fallback ")) {
+                        hasDataCiphers = true;
+                    }
+
                     // no special handling so write the line as-is
                     cfgWriter.write(line + LINE_BREAK);
                 }
 
+                // OpenVPN 2.6 ignores --cipher unless the same cipher is also in
+                // --data-ciphers. Imported configs from older NGFWs only have
+                // --cipher, so synthesize a backward-compatible data-ciphers list
+                // (modern AEAD first, legacy cipher appended) when the imported
+                // file did not already specify one.
+                if (!hasDataCiphers && importedCipher != null) {
+                    String dataCiphers = "AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305";
+                    if (!dataCiphers.contains(importedCipher)) {
+                        dataCiphers = dataCiphers + ":" + importedCipher;
+                    }
+                    cfgWriter.write("data-ciphers " + dataCiphers + LINE_BREAK);
+                    cfgWriter.write("data-ciphers-fallback " + importedCipher + LINE_BREAK);
+                }
+
                 // if user+pass auth is enabled add the auth-user-pass option
                 if (server.getAuthUserPass()) {
                     cfgWriter.write("auth-user-pass " + name + ".auth" + LINE_BREAK);
diff --git a/rakefile b/rakefile
index 9f5e4eeaef..b6e0530d90 100644
--- a/rakefile
+++ b/rakefile
@@ -109,7 +109,7 @@ task :targets => :download do
   require "#{SRC_HOME}/wan-failover/package.rb"
   require "#{SRC_HOME}/web-cache/package.rb"
   require "#{SRC_HOME}/license/package.rb"
-  if File.exists?("#{SRC_HOME}/plugins/package.rb")
+  if File.exist?("#{SRC_HOME}/plugins/package.rb")
     require "#{SRC_HOME}/plugins/package.rb"
   end
 end
@@ -128,10 +128,10 @@ task :devel => [:build, :hier, :installuvmcore] do
   Rake::Task[BuildEnv::SRC.installTarget].invoke
   ## Ad Blocker hack to rename ad-blocker.js to ab.js NGFW-10728
   ## Make this copy target and put it in the first servlet after admin
-  if File.exists?("#{SRC_HOME}/dist/usr/share/untangle/web/admin/script/apps/ad-blocker.js")
+  if File.exist?("#{SRC_HOME}/dist/usr/share/untangle/web/admin/script/apps/ad-blocker.js")
     FileUtils.cp("#{SRC_HOME}/dist/usr/share/untangle/web/admin/script/apps/ad-blocker.js", "#{SRC_HOME}/dist/usr/share/untangle/web/admin/script/apps/ab.js")
   end
-  if File.exists?("#{SRC_HOME}/debian/untangle-libuvm/usr/share/untangle/web/admin/script/apps/ad-blocker.js")
+  if File.exist?("#{SRC_HOME}/debian/untangle-libuvm/usr/share/untangle/web/admin/script/apps/ad-blocker.js")
     FileUtils.cp("#{SRC_HOME}/debian/untangle-libuvm/usr/share/untangle/web/admin/script/apps/ad-blocker.js", "#{SRC_HOME}/debian/untangle-libuvm/usr/share/untangle/web/admin/script/apps/ab.js")
   end
 end
diff --git a/ssl-inspector/src/com/untangle/app/ssl_inspector/SslInspectorApp.java b/ssl-inspector/src/com/untangle/app/ssl_inspector/SslInspectorApp.java
index 5caccf972c..c9105bbd46 100644
--- a/ssl-inspector/src/com/untangle/app/ssl_inspector/SslInspectorApp.java
+++ b/ssl-inspector/src/com/untangle/app/ssl_inspector/SslInspectorApp.java
@@ -180,19 +180,27 @@ protected void preInit()
                 if (readSettings.getVersion().intValue() < 3) {
                     readSettings.getIgnoreRules().addFirst(createDefaultRule(0, "Inspect Duck Duck Go", SslInspectorRuleCondition.ConditionType.SSL_INSPECTOR_SUBJECT_DN, "*Duck Duck Go*", null, null, null, null, SslInspectorRuleAction.ActionType.INSPECT, true));
                     readSettings.getIgnoreRules().addFirst(createDefaultRule(0, "Inspect KidzSearch", SslInspectorRuleCondition.ConditionType.SSL_INSPECTOR_SUBJECT_DN, "*kidzsearch*", null, null, null, null, SslInspectorRuleAction.ActionType.INSPECT, true));
-                    
+
                     readSettings.setVersion(3);
                     setSettings(readSettings);
                     renumberRules = true;
                 }
 
-                // v3 to v4: add hostname verification settings and port 25 IGNORE rule
+                // v3 to v4: add hostname verification, port 25 IGNORE rule,
+                // and force-disable TLSv1/TLSv1.1 for JDK21 compatibility
                 if (readSettings.getVersion().intValue() < 4) {
                     logger.info("Migrating settings from v{} to v4: adding hostname verification", readSettings.getVersion());
                     readSettings.setVerifyServerCertHostname(false);
                     readSettings.setHostnameVerificationBypassList(new LinkedList<>());
                     readSettings.getIgnoreRules().addFirst(createDefaultRule(0, "Ignore SMTP", SslInspectorRuleCondition.ConditionType.DST_PORT, "25", null, null, null, null, SslInspectorRuleAction.ActionType.IGNORE, true));
 
+                    boolean changed = false;
+                    if (readSettings.getClient_TLSv10()) { readSettings.setClient_TLSv10(false); changed = true; }
+                    if (readSettings.getClient_TLSv11()) { readSettings.setClient_TLSv11(false); changed = true; }
+                    if (readSettings.getServer_TLSv10()) { readSettings.setServer_TLSv10(false); changed = true; }
+                    if (readSettings.getServer_TLSv11()) { readSettings.setServer_TLSv11(false); changed = true; }
+                    if (changed) logger.warn("NGFW-15749: forced TLSv1/TLSv1.1 off on upgrade to v4 (JDK21 compatibility)");
+
                     readSettings.setVersion(4);
                     setSettings(readSettings);
                     renumberRules = true;
diff --git a/ssl-inspector/src/com/untangle/app/ssl_inspector/SslInspectorManager.java b/ssl-inspector/src/com/untangle/app/ssl_inspector/SslInspectorManager.java
index 0660714993..24055af617 100644
--- a/ssl-inspector/src/com/untangle/app/ssl_inspector/SslInspectorManager.java
+++ b/ssl-inspector/src/com/untangle/app/ssl_inspector/SslInspectorManager.java
@@ -603,21 +603,29 @@ public String[] generateProtocolList(ProtocolList listType)
     {
         ArrayList<String> protoList = new ArrayList<>();
 
+        // NGFW-15749: TLSv1 and TLSv1.1 are unconditionally stripped from the
+        // JSSE protocol list regardless of UI flag. JDK21 (trixie) rejects the
+        // entire protocol list if these are included, breaking SSL Inspector
+        // for ALL HTTPS traffic — not just legacy sites. The UI flags exist
+        // only as historical fields; toggling them on is a footgun that we
+        // refuse to honor. Customers needing to MITM a legacy-TLS-only intranet
+        // server should add an SSL Inspector rule with Action=IGNORE for that
+        // destination so NGFW passes the encrypted bytes through without JSSE.
         switch (listType)
         {
         case CLIENT:
             if (app.getSettings().getClient_SSLv2Hello()) protoList.add("SSLv2Hello");
             if (app.getSettings().getClient_SSLv3()) protoList.add("SSLv3");
-            if (app.getSettings().getClient_TLSv10()) protoList.add("TLSv1");
-            if (app.getSettings().getClient_TLSv11()) protoList.add("TLSv1.1");
+            if (app.getSettings().getClient_TLSv10()) logger.warn("NGFW-15749: ignoring client_TLSv10=true (incompatible with JDK21 JSSE); use IGNORE rule for legacy targets");
+            if (app.getSettings().getClient_TLSv11()) logger.warn("NGFW-15749: ignoring client_TLSv11=true (incompatible with JDK21 JSSE); use IGNORE rule for legacy targets");
             if (app.getSettings().getClient_TLSv12()) protoList.add("TLSv1.2");
             if (app.getSettings().getClient_TLSv13()) protoList.add("TLSv1.3");
             break;
         case SERVER:
             if (app.getSettings().getServer_SSLv2Hello()) protoList.add("SSLv2Hello");
             if (app.getSettings().getServer_SSLv3()) protoList.add("SSLv3");
-            if (app.getSettings().getServer_TLSv10()) protoList.add("TLSv1");
-            if (app.getSettings().getServer_TLSv11()) protoList.add("TLSv1.1");
+            if (app.getSettings().getServer_TLSv10()) logger.warn("NGFW-15749: ignoring server_TLSv10=true (incompatible with JDK21 JSSE); use IGNORE rule for legacy targets");
+            if (app.getSettings().getServer_TLSv11()) logger.warn("NGFW-15749: ignoring server_TLSv11=true (incompatible with JDK21 JSSE); use IGNORE rule for legacy targets");
             if (app.getSettings().getServer_TLSv12()) protoList.add("TLSv1.2");
             if (app.getSettings().getServer_TLSv13()) protoList.add("TLSv1.3");
             break;
diff --git a/ssl-inspector/src/com/untangle/app/ssl_inspector/SslInspectorSettings.java b/ssl-inspector/src/com/untangle/app/ssl_inspector/SslInspectorSettings.java
index 1192688846..8932ef6396 100644
--- a/ssl-inspector/src/com/untangle/app/ssl_inspector/SslInspectorSettings.java
+++ b/ssl-inspector/src/com/untangle/app/ssl_inspector/SslInspectorSettings.java
@@ -62,15 +62,19 @@ public SslInspectorSettings()
 
         client_SSLv2Hello = false;
         client_SSLv3 = false;
-        client_TLSv10 = true;
-        client_TLSv11 = true;
+        // NGFW-15749: TLSv1 and TLSv1.1 default-disabled. JDK21 (trixie) rejects
+        // the JSSE protocol list if these are included, breaking SSL Inspector
+        // for ALL HTTPS traffic, not just legacy. See SslInspectorManager
+        // generateProtocolList() for the corresponding defensive guard.
+        client_TLSv10 = false;
+        client_TLSv11 = false;
         client_TLSv12 = true;
         client_TLSv13 = true;
 
         server_SSLv2Hello = false;
         server_SSLv3 = false;
-        server_TLSv10 = true;
-        server_TLSv11 = true;
+        server_TLSv10 = false;
+        server_TLSv11 = false;
         server_TLSv12 = true;
         server_TLSv13 = true;
     }
diff --git a/uvm/api/com/untangle/uvm/network/InterfaceSettings.java b/uvm/api/com/untangle/uvm/network/InterfaceSettings.java
index d4d3ae37f9..8c329a5338 100644
--- a/uvm/api/com/untangle/uvm/network/InterfaceSettings.java
+++ b/uvm/api/com/untangle/uvm/network/InterfaceSettings.java
@@ -125,7 +125,7 @@ public static enum DhcpType { SERVER, RELAY, DISABLED };
     private Integer     dhcpPrefixOverride; /* DHCP netmask override, if null defaults to this interface's netmask */
     @SafeCheck(SafeType.IP_OR_CIDR_LIST)
     private String dhcpDnsOverride; /* DHCP DNS override, if null defaults to this interface's IP */
-    private List<DhcpOption> dhcpOptions; /* DHCP dnsmasq options */
+    private List<DhcpOption> dhcpOptions = new LinkedList<>(); /* DHCP dnsmasq options */
 
     private InetAddress dhcpRelayAddress; /* DHCP relay server IP address */
 
diff --git a/uvm/api/com/untangle/uvm/util/Pulse.java b/uvm/api/com/untangle/uvm/util/Pulse.java
index 61d3087708..22467613e2 100644
--- a/uvm/api/com/untangle/uvm/util/Pulse.java
+++ b/uvm/api/com/untangle/uvm/util/Pulse.java
@@ -194,8 +194,12 @@ public Pulse(String name, Runnable task, long delay, long extraInitialDelay, int
      */
     public synchronized void start()
     {
-        /* Can't start unless it is in the unborn state */
-        if (PulseState.UNBORN != this.state && PulseState.KILLED != this.state) {
+        /* Allow restart from UNBORN, KILLED, or DEAD states.
+         * DEAD occurs when the Pulse thread exits its run loop after stop().
+         * Static singletons like WebrootDaemon reuse the same Pulse instance
+         * across app enable/disable cycles — without allowing DEAD restart,
+         * re-enabling web-filter after disabling it can permanently fail. */
+        if (PulseState.UNBORN != this.state && PulseState.KILLED != this.state && PulseState.DEAD != this.state) {
             throw new IllegalStateException("Unable to start a pulse. Unexpected state: " + this.state);
         }
 
diff --git a/uvm/hier/usr/bin/uvm b/uvm/hier/usr/bin/uvm
index 3b6c70e894..a550043bb4 100755
--- a/uvm/hier/usr/bin/uvm
+++ b/uvm/hier/usr/bin/uvm
@@ -261,11 +261,10 @@ def prepareSystem():
 def checkSystem():
     #debug("checkSystem()")
 
-    # check tune is loaded
+    # check tune is loaded (optional - custom kernel module, not available on bookworm 6.1+)
     ret = os.system('/sbin/modprobe -q iptable_tune || /bin/lsmod | grep -q iptable_tune');
     if ret != 0:
-        debug("ERROR: Incompatible kernel detected (no tune)");
-        sys.exit(1);
+        debug("WARNING: iptable_tune module not available (expected on bookworm 6.1+ kernels)");
 
     # check nfnetlink_queue is loaded
     if not os.path.exists("/proc/net/netfilter/nfnetlink_queue"):
diff --git a/uvm/hier/usr/lib/python3/dist-packages/tests/common.py b/uvm/hier/usr/lib/python3/dist-packages/tests/common.py
index e71743156c..ed114b1e41 100644
--- a/uvm/hier/usr/lib/python3/dist-packages/tests/common.py
+++ b/uvm/hier/usr/lib/python3/dist-packages/tests/common.py
@@ -115,7 +115,15 @@ def initial_setup(cls, unused=None):
             if not cls.no_settings:
                 cls._appSettings = cls._app.getSettings()
 
-        cls.initial_extra_setup()
+        try:
+            cls.initial_extra_setup()
+        except Exception as e:
+            print("initial_extra_setup failed: %s -- cleaning up" % e)
+            try:
+                cls.final_extra_tear_down()
+            except Exception:
+                pass
+            raise
 
     @classmethod
     def final_extra_tear_down(cls):
diff --git a/uvm/hier/usr/lib/python3/dist-packages/tests/global_functions.py b/uvm/hier/usr/lib/python3/dist-packages/tests/global_functions.py
index 105f4bbc6f..1fd1b6e079 100644
--- a/uvm/hier/usr/lib/python3/dist-packages/tests/global_functions.py
+++ b/uvm/hier/usr/lib/python3/dist-packages/tests/global_functions.py
@@ -874,9 +874,32 @@ def restart_uvm():
     """
     Restart uvm.
     IMPORTANT: This changes uvmContext!
+
+    Uses explicit stop → wait-for-java-dead → start instead of init.d restart.
+    On trixie (JDK21) the java process takes longer to release NFQUEUE sockets
+    than on bullseye (JDK11). If a new UVM starts before the old java process
+    fully exits, netcap initialization fails ("Unable to initialize netcap")
+    because NFQUEUE 1981/1982 are still held by the dying process.
     """
     global uvmContext, uvmContextLongTimeout
-    subprocess.call(["/etc/init.d/untangle-vm","restart"],stdout=subprocess.PIPE,stderr=subprocess.PIPE)
+
+    subprocess.call(["/etc/init.d/untangle-vm", "stop"],
+                    stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+
+    for i in range(60):
+        result = subprocess.run(
+            "ps awwx | grep 'java.*com.untangle.uvm.Main' | grep -v grep",
+            shell=True, capture_output=True)
+        if result.returncode != 0:
+            break
+        time.sleep(1)
+    else:
+        subprocess.call("kill -9 $(ps awwx | awk '/[j]ava.*com.untangle.uvm.Main/{print $1}') 2>/dev/null",
+                        shell=True)
+        time.sleep(2)
+
+    subprocess.call(["/etc/init.d/untangle-vm", "start"],
+                    stdout=subprocess.PIPE, stderr=subprocess.PIPE)
 
     uvmContext = None
     max_tries = 60
diff --git a/uvm/hier/usr/lib/python3/dist-packages/tests/test_administration.py b/uvm/hier/usr/lib/python3/dist-packages/tests/test_administration.py
index ebfebebb87..366147d085 100644
--- a/uvm/hier/usr/lib/python3/dist-packages/tests/test_administration.py
+++ b/uvm/hier/usr/lib/python3/dist-packages/tests/test_administration.py
@@ -2,6 +2,7 @@
 import unittest
 import json
 import os
+import time
 from glob import glob
 from os.path import join, getctime
 from tests.common import NGFWTestCase
@@ -175,6 +176,42 @@
 invalid_certificate_payload={"certData": "-----BEGIN CERTIFICATE----\n-----END CERTIFICATE-----\n", "keyData": "-----BEGIN PRIVATE KEY-----\n-----END PRIVATE KEY-----\n"}
 username = overrides.get("Login_username", default="admin")
 password = overrides.get("Login_password", default="passwd")
+
+def _login_and_upload_cert(cert_path, retries=20, retry_sleep=3):
+    """
+    Authenticate to /auth/login then POST cert_path as multipart to /admin/upload.
+    Returns the parsed JSON response.
+    """
+    url = global_functions.get_http_url().rstrip('/')
+    headers = {'accept': 'application/json'}
+    last_status = None
+    for attempt in range(retries):
+        with open(cert_path, 'rb') as fh:
+            files = {
+                'type': (None, 'certificate_upload'),
+                'argument': (None, 'upload_server'),
+                'filename': ('uploadcert.pem', fh, 'application/x-x509-ca-cert'),
+            }
+            s = requests.Session()
+            s.post(
+                f"{url}/auth/login?url=/admin&realm=Administrator",
+                data=f"fragment=&username={username}&password={password}",
+                verify=False,
+            )
+            response = s.post(f"{url}/admin/upload", headers=headers, files=files)
+        last_status = response.status_code
+        if response.text:
+            try:
+                return json.loads(response.text)
+            except json.JSONDecodeError:
+                pass
+        time.sleep(retry_sleep)
+    raise AssertionError(
+        f"/admin/upload returned non-JSON body after {retries} attempts "
+        f"(last HTTP={last_status}); Apache mod_python session store likely "
+        f"not warm after untangle-vm restart"
+    )
+
 @pytest.mark.administration_tests
 class AdministrationTests(NGFWTestCase):
     not_an_app = True
@@ -222,8 +259,6 @@ def test_021_validate_import_server_certificate(self):
         isFile = os.path.exists(f"{certificates_dir}/apache.pem")
         if not isDir and not isFile:
             pytest.skip('%s certificate directory or certificate not present' % self.appName())
-        url = global_functions.get_http_url()
-        headers = {'accept': 'application/json',}
         output_file_path = '/tmp/uploadcertificate.pem'
 
         with open(f"{certificates_dir}/apache.pem", 'r') as input_file:
@@ -235,29 +270,9 @@ def test_021_validate_import_server_certificate(self):
         with open(output_file_path, 'w') as output_file:
             output_file.writelines(lines_with_spaces)
 
-        files = {
-            'type': (None, 'certificate_upload'),
-            'argument': (None, 'upload_server'),
-            'filename': ('uploadcert.pem', open(f"{output_file_path}", 'rb') , 'application/x-x509-ca-cert')
-        }
-        rpc_url = f"{url}/admin/upload"
-        s = requests.Session()
-        # Log in
-        response = s.post(
-            f"{url}/auth/login?url=/admin&realm=Administrator",
-            data=f"fragment=&username={username}&password={password}",
-            verify=False
-        )
-        # Upload pem file containing cert and key files
-        response = s.post(
-            f"{rpc_url}",
-            headers=headers,
-            files=files
-
-        )
+        certificate_upload_response = _login_and_upload_cert(output_file_path)
         files_list = []
         try:
-            certificate_upload_response = json.loads(response.text)
             cert_upload_json = json.loads(certificate_upload_response.get('msg', None))
         except (json.JSONDecodeError, ValueError, TypeError):
             cert_upload_json = {}
@@ -290,8 +305,6 @@ def test_022_validate_import_server_certificate(self):
         isFile = os.path.exists(f"{certificates_dir}/apache.pem")
         if not isDir and not isFile:
             pytest.skip('%s certificate directory or certificate not present' % self.appName())
-        url = global_functions.get_http_url()
-        headers = {'accept': 'application/json',}
         output_file_path = '/tmp/uploadcertificate.pem'
 
         with open(f"{certificates_dir}/apache.pem", 'r') as input_file:
@@ -303,30 +316,9 @@ def test_022_validate_import_server_certificate(self):
         with open(f"{output_file_path}", 'w') as output_file:
             output_file.write(modified_content)
 
-        files = {
-            'type': (None, 'certificate_upload'),
-            'argument': (None, 'upload_server'),
-            'filename': ('uploadcert.pem', open(f"{output_file_path}", 'rb') , 'application/x-x509-ca-cert')
-        }
-        rpc_url = f"{url}/admin/upload"
-        s = requests.Session()
-        # Log in
-        response = s.post(
-            f"{url}/auth/login?url=/admin&realm=Administrator",
-            data=f"fragment=&username={username}&password={password}",
-            verify=False
-        )
-        # Upload pem file containing cert and key files
-        response = s.post(
-            f"{rpc_url}",
-            headers=headers,
-            files=files
-
-        )
-
+        certificate_upload_response = _login_and_upload_cert(output_file_path)
         files_list = []
         try:
-            certificate_upload_response = json.loads(response.text)
             cert_upload_json = json.loads(certificate_upload_response.get('msg', None))
         except (json.JSONDecodeError, ValueError, TypeError):
             cert_upload_json = {}
@@ -359,8 +351,6 @@ def test_023_validate_import_server_certificate(self):
         isFile = os.path.exists(f"{certificates_dir}/apache.pem")
         if not isDir and not isFile:
             pytest.skip('%s certificate directory or certificate not present' % self.appNameWF())
-        url = global_functions.get_http_url()
-        headers = {'accept': 'application/json',}
         output_file_path = '/tmp/uploadcertificate.pem'
 
         with open(f"{certificates_dir}/apache.pem", 'r') as input_file:
@@ -371,30 +361,9 @@ def test_023_validate_import_server_certificate(self):
         with open(f"{output_file_path}", 'w') as output_file:
             output_file.write(modified_content)
 
-        files = {
-            'type': (None, 'certificate_upload'),
-            'argument': (None, 'upload_server'),
-            'filename': ('uploadcert.pem', open(f"{output_file_path}", 'rb') , 'application/x-x509-ca-cert')
-        }
-        rpc_url = f"{url}/admin/upload"
-        s = requests.Session()
-        # Log in
-        response = s.post(
-            f"{url}/auth/login?url=/admin&realm=Administrator",
-            data=f"fragment=&username={username}&password={password}",
-            verify=False
-        )
-        # Upload pem file containing cert and key files
-        response = s.post(
-            f"{rpc_url}",
-            headers=headers,
-            files=files
-
-        )
-
+        certificate_upload_response = _login_and_upload_cert(output_file_path)
         files_list = []
         try:
-            certificate_upload_response = json.loads(response.text)
             cert_upload_json = json.loads(certificate_upload_response.get('msg', None))
         except (json.JSONDecodeError, ValueError, TypeError):
             cert_upload_json = {}
@@ -440,40 +409,9 @@ def test_025_validate_import_invalid_server_certificate(self):
         isFile = os.path.exists(f"{certificates_dir}/apache.pfx")
         if not isDir and not isFile:
             pytest.skip('%s certificate directory or certificate not present' % self.appNameWF())
-        url = global_functions.get_http_url()
-        headers = {'accept': 'application/json',}
-        files = {
-            'type': (None, 'certificate_upload'),
-            'argument': (None, 'upload_server'),
-            'filename': ('uploadcert.pem', open(f"{certificates_dir}/apache.pfx", 'rb') , 'application/x-x509-ca-cert')
-        }
-        rpc_url = f"{url}/admin/upload"
-        s = requests.Session()
-        # Log in
-        response = s.post(
-            f"{url}/auth/login?url=/admin&realm=Administrator",
-            data=f"fragment=&username={username}&password={password}",
-            verify=False
-        )
-        # Upload pem file containing cert and key files
-        response = s.post(
-            f"{rpc_url}",
-            headers=headers,
-            files=files
-
-        )
-        # The PFX payload must be rejected. Two acceptable outcomes:
-        #   (a) legacy: upload servlet returns JSON with the "no valid certs/keys" msg
-        #   (b) hardened: upload servlet rejects the payload before producing JSON
-        # In both cases the request must NOT result in a successfully uploaded cert.
-        try:
-            certificate_upload_response = json.loads(response.text)
-            msg = certificate_upload_response.get('msg', '') or ''
-            assert "The file does not contain any valid certificates or keys" in msg, \
-                f"unexpected upload response: {msg}"
-        except (json.JSONDecodeError, ValueError):
-            # Hardened servlet rejected the upload before emitting JSON — acceptable.
-            pass
+        certificate_upload_response = _login_and_upload_cert(f"{certificates_dir}/apache.pfx")
+        #for invalid certificated files should get following error
+        assert "The file does not contain any valid certificates or keys" in certificate_upload_response.get('msg', None)
 
     #Test to validate chained certificate json upload uploadCerificate API
     def test_025_validate_upload_certificate_api(self):
diff --git a/uvm/hier/usr/lib/python3/dist-packages/tests/test_network.py b/uvm/hier/usr/lib/python3/dist-packages/tests/test_network.py
index 46b22b2167..3fcbdcd8bb 100644
--- a/uvm/hier/usr/lib/python3/dist-packages/tests/test_network.py
+++ b/uvm/hier/usr/lib/python3/dist-packages/tests/test_network.py
@@ -1434,6 +1434,20 @@ def test_120_mtu(self):
         print(f"wan_pppoe_devices={wan_pppoe_devices}")
         print(f"default_mtu_values={default_mtu_values}")
 
+        # Probe each WAN device's hardware-enforced maxmtu (vNIC/driver dependent — e.g. virtio_net
+        # without host_mtu rejects jumbo frames; vmxnet3 / most physical NICs accept 9000).
+        # Drop MTU values that exceed any device's cap so the test stays portable across
+        # hypervisors and prod hardware without false-failing on jumbo where unsupported.
+        device_max_mtus = []
+        for device in wan_physical_devices:
+            link_show = subprocess.check_output(f"ip -d link show {device}", shell=True).decode("utf-8")
+            max_mtu_match = re.search(r'maxmtu\s+(\d+)', link_show)
+            device_max_mtus.append(int(max_mtu_match.group(1)) if max_mtu_match else 1500)
+        min_supported_mtu = min(device_max_mtus) if device_max_mtus else 1500
+        print(f"device_max_mtus={device_max_mtus} min_supported_mtu={min_supported_mtu}")
+        mtus = [m for m in mtus if m is None or m == 0 or m <= min_supported_mtu]
+        print(f"effective mtus={mtus}")
+
         # Most tests use asserts to stop the test on the first failure.
         # However, because we're trying to preserve the concept of a "default"
         # MTU value, we can't break out of the test.
diff --git a/uvm/hier/usr/lib/python3/dist-packages/tests/test_uvm.py b/uvm/hier/usr/lib/python3/dist-packages/tests/test_uvm.py
index 74349d610d..d3c146fc39 100644
--- a/uvm/hier/usr/lib/python3/dist-packages/tests/test_uvm.py
+++ b/uvm/hier/usr/lib/python3/dist-packages/tests/test_uvm.py
@@ -303,6 +303,7 @@ def test_012_help_links(self):
                    'Connection': 'keep-alive'}
 
             ctx = ssl.create_default_context()
+            ctx.maximum_version = ssl.TLSVersion.TLSv1_2
             ctx.check_hostname = False
             ctx.verify_mode = ssl.CERT_NONE
 
@@ -2018,7 +2019,8 @@ def test_307_geo_ip_address(self):
 
     def test_310_system_logs(self):
         subprocess.call(global_functions.build_wget_command(log_file="/dev/null", output_file="/tmp/system_logs.zip", post_data="type=SystemSupportLogs", uri="http://localhost/admin/download"), shell=True)
-        subprocess.call("unzip -q /tmp/system_logs -d /tmp/system_logs && rm -rf /tmp/system_logs.zip", shell=True)
+        subprocess.call("rm -rf /tmp/system_logs", shell=True)
+        subprocess.call("unzip -o -q /tmp/system_logs.zip -d /tmp/system_logs && rm -rf /tmp/system_logs.zip", shell=True)
         uvm = subprocess.check_output("ls /tmp/system_logs | grep -c uvm", shell=True, stderr=subprocess.STDOUT)
         app = subprocess.check_output("ls /tmp/system_logs | grep -c app", shell=True, stderr=subprocess.STDOUT)
         console = subprocess.check_output("ls /tmp/system_logs | grep -c console", shell=True, stderr=subprocess.STDOUT)
diff --git a/uvm/hier/usr/lib/python3/dist-packages/unit_tests/test_web_auth_index.py b/uvm/hier/usr/lib/python3/dist-packages/unit_tests/test_web_auth_index.py
index d25e011351..cfeed97ec7 100644
--- a/uvm/hier/usr/lib/python3/dist-packages/unit_tests/test_web_auth_index.py
+++ b/uvm/hier/usr/lib/python3/dist-packages/unit_tests/test_web_auth_index.py
@@ -1,6 +1,9 @@
 from uvm import login_tools
 import pytest
-import crypt
+try:
+    import crypt
+except ImportError:
+    import legacycrypt as crypt
 import hashlib
 import base64
 
diff --git a/uvm/hier/usr/lib/python3/dist-packages/uvm/i18n_helper.py b/uvm/hier/usr/lib/python3/dist-packages/uvm/i18n_helper.py
index 81073a25a2..565382bc1a 100644
--- a/uvm/hier/usr/lib/python3/dist-packages/uvm/i18n_helper.py
+++ b/uvm/hier/usr/lib/python3/dist-packages/uvm/i18n_helper.py
@@ -33,7 +33,10 @@ def get_uvm_settings_item(a,b):
 def get_translation(domain):
 #    return gettext.translation(domain, fallback=True)
     lang = get_uvm_language()
-    return gettext.translation(domain, fallback=True, codeset='utf-8',languages=[lang])
+    try:
+        return gettext.translation(domain, fallback=True, codeset='utf-8', languages=[lang])
+    except TypeError:
+        return gettext.translation(domain, fallback=True, languages=[lang])
         
 def get_uvm_language():
     lang = 'us'
diff --git a/uvm/hier/usr/lib/python3/dist-packages/uvm/login_tools.py b/uvm/hier/usr/lib/python3/dist-packages/uvm/login_tools.py
index 54e3b2a6c4..4d84b5af84 100644
--- a/uvm/hier/usr/lib/python3/dist-packages/uvm/login_tools.py
+++ b/uvm/hier/usr/lib/python3/dist-packages/uvm/login_tools.py
@@ -4,7 +4,10 @@
 import sys
 import requests
 import json
-import crypt
+try:
+    import crypt
+except ImportError:
+    import legacycrypt as crypt
 import time
 import os
 import urllib
diff --git a/uvm/hier/usr/lib/python3/dist-packages/uvm_login.py b/uvm/hier/usr/lib/python3/dist-packages/uvm_login.py
index 4088e20f05..7478fff78f 100644
--- a/uvm/hier/usr/lib/python3/dist-packages/uvm_login.py
+++ b/uvm/hier/usr/lib/python3/dist-packages/uvm_login.py
@@ -168,18 +168,21 @@ def is_local_process_uid_authorized(req):
 
     if remote_ip != "127.0.0.1" and remote_ip != "::1":
         return False
-    # If came in from ipv6, set to ipv4
-    remote_ip = "127.0.0.1"
 
     # This determines the PID of the connecting process
     # and determines if it is from a process who is owned by root
     # or a user in uvm_login group. If so, auto-authenticate it.
     uids = get_uvmlogin_uids()
 
-    q = remote_ip.split(".")
-    q.reverse()
-    n = reduce(lambda a, b: int(a) * 256 + int(b), q)
-    hexaddr = "%08X" % n
+    if remote_ip == "::1":
+        hexaddr = "00000000000000000000000001000000"
+        proc_net_file = "/proc/net/tcp6"
+    else:
+        q = remote_ip.split(".")
+        q.reverse()
+        n = reduce(lambda a, b: int(a) * 256 + int(b), q)
+        hexaddr = "%08X" % n
+        proc_net_file = "/proc/net/tcp"
     hexport = "%04X" % remote_port
 
     # We have to attempt to read /proc/net/tcp several times.
@@ -187,7 +190,7 @@ def is_local_process_uid_authorized(req):
     uid = None
     for count in range(0, 5):
         try:
-            infile = open("/proc/net/tcp", "r")
+            infile = open(proc_net_file, "r")
             # for l in infile.read(500000).splitlines():
             for l in infile.readlines():
                 a = l.split()
@@ -218,11 +221,11 @@ def is_local_process_uid_authorized(req):
                                 return False
                     except Exception as e:
                         apache.log_error(
-                            'Bad line in /proc/net/tcp: %s: %s' % (line, traceback.format_exc(e)))
+                            'Bad line in %s: %s: %s' % (proc_net_file, line, traceback.format_exc(e)))
 
         except Exception as e:
-            apache.log_error('Exception reading /proc/net/tcp: %s' %
-                             traceback.format_exc(e))
+            apache.log_error('Exception reading %s: %s' % (proc_net_file,
+                             traceback.format_exc(e)))
         finally:
             infile.close()
 
diff --git a/uvm/hier/usr/share/untangle/bin/qos-status.py b/uvm/hier/usr/share/untangle/bin/qos-status.py
index 3fc8cbd412..b842b9ca02 100755
--- a/uvm/hier/usr/share/untangle/bin/qos-status.py
+++ b/uvm/hier/usr/share/untangle/bin/qos-status.py
@@ -27,7 +27,7 @@ def format_tc_output(lines, wan_name, direction):
 def statusToJSON(input):
     #Parse patterns for qos-service.py status output
     firstLine='interface: {} class {} {} {} rate {} ceil {} burst {} cburst {}'
-    secondLine=' Sent {:d} bytes {:d} pkt (dropped {:d}, overlimits {:d} requeues {:d}) '
+    secondLine=' Sent {:d} bytes {:d} pkt (dropped {:d}, overlimits {:d} requeues {:d})'
     lastLine=' tokens: {} ctokens:{}'
     priorityParser='parent {} leaf {} prio {:d}'
     indexMap={1:firstLine, 2:secondLine, 3:lastLine}
@@ -38,6 +38,7 @@ def statusToJSON(input):
     entry = {}
     skipEntry=False
     for line in input:
+        line = line.rstrip()
         if count <= 3:
             res=parse.parse(indexMap[count],line)
             if res == None:
@@ -76,20 +77,22 @@ def status( qos_interfaces, wan_intfs ):
         result=''
         wan_dev = wan_intf.get('systemDev')
         imq_dev = wan_intf.get('imqDev')
+        ifb_dev = imq_dev.replace('imq', 'ifb') if imq_dev else None
         wan_name = wan_intf.get('name')
+
         result = format_tc_output(get_tc_output(wan_dev), wan_name, "Outbound")
-        result.extend(format_tc_output(get_tc_output(imq_dev), wan_name, "Inbound"))
+        result.extend(format_tc_output(get_tc_output(ifb_dev), wan_name, "Inbound"))
         json_objs.extend( statusToJSON(result) )
 
         #run("echo ------ Qdisc  ------")
         #run("tc -s qdisc ls dev %s" % wan_dev)
-        #run("tc -s qdisc ls dev %s" % imq_dev)
+        #run("tc -s qdisc ls dev %s" % ifb_dev)
         #run("echo ------ Class  ------")
         #run("tc -s class ls dev %s" % wan_dev)
-        #run("tc -s class ls dev %s" % imq_dev)
+        #run("tc -s class ls dev %s" % ifb_dev)
         #run("echo ------ Filter ------")
         #run("tc -s filter ls dev %s" % wan_dev)
-        #run("tc -s filter ls dev %s" % imq_dev)
+        #run("tc -s filter ls dev %s" % ifb_dev)
     print(json_objs)
 
 
@@ -129,6 +132,7 @@ def status( qos_interfaces, wan_intfs ):
         if intf.get('imqDev') == None:
             print("Failed to read imqDev on %s" % intf.get('name'))
             sys.exit(1)
+        # IFB device is derived from imqDev (imq0 -> ifb0)
         if intf.get('downloadBandwidthKbps') == None:
             print("Failed to read downloadBandwidthKbps on %s" % intf.get('name'))
             sys.exit(1)
diff --git a/uvm/hier/usr/share/untangle/bin/ut-certgen b/uvm/hier/usr/share/untangle/bin/ut-certgen
index 1473f6376a..07793777fc 100755
--- a/uvm/hier/usr/share/untangle/bin/ut-certgen
+++ b/uvm/hier/usr/share/untangle/bin/ut-certgen
@@ -103,7 +103,10 @@ case $1 in
     # Here we generate a new CSR for this server to be signed by a third party
     # using the existing private key file that was previously created
     # when the original Apache server certificate was generated
-        $OPENSSL_TOOL req -batch -nodes -config $OPENSSL_CONF -extensions v3_cert -new -key $UT_ROOT_PATH/apache.key -out $UT_ROOT_PATH/request.csr -subj "$2"
+        # NGFW-15749: drop -extensions on req. OpenSSL 3.5 (trixie) rejects
+        # authorityKeyIdentifier=keyid,issuer:always at CSR time. Third-party
+        # signers apply their own extension policy at issuance.
+        $OPENSSL_TOOL req -batch -nodes -config $OPENSSL_CONF -new -key $UT_ROOT_PATH/apache.key -out $UT_ROOT_PATH/request.csr -subj "$2"
         if [ $? != 0 ]; then
             echo "REQUEST: Error generating certificate signing request"
             exit 4
@@ -116,7 +119,10 @@ case $1 in
     # generate a CSR for this server, and we also combine them to make
     # the PEM file that we copy into the Apache directory.  Finally we create
     # the PFX file that can be loaded by apps using the SSLEngine stuff.
-        $OPENSSL_TOOL req -batch -nodes -config $OPENSSL_CONF -extensions v3_host -newkey rsa:2048 -keyout $UT_ROOT_PATH/apache.key -out $UT_ROOT_PATH/apache.csr -subj "$2"
+        # NGFW-15749: drop -extensions on req (CSR creation). OpenSSL 3.5 (trixie)
+        # rejects AKI in extension section at CSR time. Extensions still applied
+        # at signing time by the openssl ca call below.
+        $OPENSSL_TOOL req -batch -nodes -config $OPENSSL_CONF -newkey rsa:2048 -keyout $UT_ROOT_PATH/apache.key -out $UT_ROOT_PATH/apache.csr -subj "$2"
         if [ $? != 0 ]; then
             echo "APACHE: Error generating certificate signing request"
             exit 5
@@ -137,7 +143,9 @@ case $1 in
     SERVER)
     # Server certificates are handled just like the default APACHE cert but we
     # put everything into files using the base filename passed to the script
-        $OPENSSL_TOOL req -batch -nodes -config $OPENSSL_CONF -extensions v3_host -newkey rsa:2048 -keyout $UT_ROOT_PATH/$4.key -out $UT_ROOT_PATH/$4.csr -subj "$2"
+        # NGFW-15749: drop -extensions on req (CSR creation). OpenSSL 3.5 (trixie)
+        # rejects AKI at CSR time; extensions applied at signing time below.
+        $OPENSSL_TOOL req -batch -nodes -config $OPENSSL_CONF -newkey rsa:2048 -keyout $UT_ROOT_PATH/$4.key -out $UT_ROOT_PATH/$4.csr -subj "$2"
         if [ $? != 0 ]; then
             echo "SERVER: Error generating certificate signing request"
             exit 8
@@ -159,7 +167,10 @@ case $1 in
     # In all other cases we are making a fake MITM certificate so we generate
     # a new CSR and sign it with our CA and put the server key and signed
     # cert into a PKCS12 file that can be loaded by the Java code
-        $OPENSSL_TOOL req -batch -nodes -config $OPENSSL_CONF -extensions v3_fake -newkey rsa:2048 -keyout $TEMP/server.key -out $TEMP/server.csr -subj "$2"
+        # NGFW-15749: drop -extensions on req (CSR creation). OpenSSL 3.5 (trixie)
+        # rejects AKI at CSR time. SSL Inspector hot path — every TLS leaf cert
+        # forge runs this. Extensions still applied at signing time below.
+        $OPENSSL_TOOL req -batch -nodes -config $OPENSSL_CONF -newkey rsa:2048 -keyout $TEMP/server.key -out $TEMP/server.csr -subj "$2"
         if [ $? != 0 ]; then
             echo "MITM: Error generating certificate signing request"
             exit 11
diff --git a/uvm/hier/usr/share/untangle/bin/ut-force-time-sync b/uvm/hier/usr/share/untangle/bin/ut-force-time-sync
index 990a6c303f..82c931fe35 100755
--- a/uvm/hier/usr/share/untangle/bin/ut-force-time-sync
+++ b/uvm/hier/usr/share/untangle/bin/ut-force-time-sync
@@ -6,9 +6,9 @@ pkill -9 ntpd
 # stop the daemon first
 systemctl stop ntp	
 
-# force time sync with time.nist.gov server
+# force time sync with time.nist.gov server (timeout after 30s to avoid blocking UVM startup)
 echo "Syncing time..."
-ntpd -q -g time.nist.gov
+timeout 30 ntpd -q -g time.nist.gov
 CODE=$?
 
 # start the daemon
diff --git a/uvm/hier/usr/share/untangle/bin/ut-textui.py b/uvm/hier/usr/share/untangle/bin/ut-textui.py
index 5d8b9f8f9c..1be4b02554 100755
--- a/uvm/hier/usr/share/untangle/bin/ut-textui.py
+++ b/uvm/hier/usr/share/untangle/bin/ut-textui.py
@@ -11,7 +11,10 @@
 import signal
 import sys
 import traceback
-import crypt
+try:
+    import crypt
+except ImportError:
+    import legacycrypt as crypt
 
 if "@PREFIX@" != '':
     sys.path.insert(0, '@PREFIX@/usr/lib/python3/dist-packages')
@@ -43,7 +46,7 @@ def __init__(self, tries=30, wait=10):
         """
         while tries > 0:
             try:
-                self.context = uvm.Uvm().getUvmContext( "localhost", None, None, 60 )
+                self.context = uvm.Uvm().getUvmContext( "127.0.0.1", None, None, 60 )
                 return
             except (JSONRPCException, JSONDecodeException) as e:
                 self.context = None
diff --git a/uvm/hier/usr/share/untangle/bin/ut-upgrade.py b/uvm/hier/usr/share/untangle/bin/ut-upgrade.py
index 52526ac571..6e0c2ca336 100755
--- a/uvm/hier/usr/share/untangle/bin/ut-upgrade.py
+++ b/uvm/hier/usr/share/untangle/bin/ut-upgrade.py
@@ -378,6 +378,10 @@ def post_upgrade_fixups():
 
 # ---- Trixie upgrade helpers ---- #
 
+def is_trixie_system():
+    """Return True if running on a trixie kernel (6.12.x+), regardless of upgrade state."""
+    return platform.release().startswith("6.12.")
+
 def is_trixie_upgrade():
     """
     Detect if the apt repository serves trixie packages while the system
@@ -746,11 +750,12 @@ def protect_untangle_packages_from_autoremove():
     log("apt-get -s dist-upgrade returned an error (%i). Abort." % r)
     sys.exit(1)
 if r == 1:
-    # Packages kept back. Tolerate for trixie major-version upgrade where
-    # a transitional library (e.g. libmanette-0.2-0) commonly can't be
-    # reconciled by apt's resolver mid-hop; abort otherwise.
-    if trixie_upgrade:
-        log("Packages kept back during trixie upgrade -- proceeding anyway (may need manual install post-upgrade)")
+    # Packages kept back. Tolerate on trixie systems (both mid-upgrade and
+    # steady-state) — dist-upgrade with changed dependencies is normal for
+    # regular updates. Only abort on bullseye/bookworm where kept-back
+    # packages signal a resolver conflict that needs manual intervention.
+    if trixie_upgrade or is_trixie_system():
+        log("Packages kept back on trixie -- proceeding (dist-upgrade will resolve)")
     else:
         log("Packages have been kept back. Abort.")
         sys.exit(1)
diff --git a/uvm/hier/usr/share/untangle/bin/ut-uvm-update-rules.sh b/uvm/hier/usr/share/untangle/bin/ut-uvm-update-rules.sh
index 305c94d591..10274e02c4 100755
--- a/uvm/hier/usr/share/untangle/bin/ut-uvm-update-rules.sh
+++ b/uvm/hier/usr/share/untangle/bin/ut-uvm-update-rules.sh
@@ -86,14 +86,16 @@ insert_iptables_rules()
     ${IPTABLES} -t nat -N uvm-tcp-redirect >/dev/null 2>&1
     ${IPTABLES} -t nat -F uvm-tcp-redirect >/dev/null 2>&1
 
-    ${IPTABLES} -t tune -N queue-to-uvm >/dev/null 2>&1
-    ${IPTABLES} -t tune -F queue-to-uvm >/dev/null 2>&1
+    # Create nftables tune table with postrouting hook at priority 999
+    # Replaces iptable_tune kernel module (patch 0004) - no custom kernel module needed
+    # Priority 999 runs after NAT (100) and conntrack state is visible (tested/verified)
+    nft delete table inet tune 2>/dev/null
+    nft add table inet tune
+    nft 'add chain inet tune queue-to-uvm { type filter hook postrouting priority 999 ; policy accept ; }'
 
     # Insert redirect table in beginning of PREROUTING
     ${IPTABLES} -I PREROUTING -t nat -i ${TUN_DEV} -p tcp -g uvm-tcp-redirect -m comment --comment 'Redirect utun traffic to untangle-vm'
 
-    ${IPTABLES} -A POSTROUTING -t tune -j queue-to-uvm -m comment --comment 'Queue packets to the Untangle-VM'
-
     # Pull and call insert calls from other iptables scripts that
     # want to be added to the top of the uvm-tcp-direct chain.
     # Most notably, ipsec.
@@ -124,31 +126,38 @@ EOT
     # Redirect TCP traffic to the local ports (where the untangle-vm is listening)
     ${IPTABLES} -A uvm-tcp-redirect -t nat -i ${TUN_DEV} -t nat -p tcp -j REDIRECT --to-ports ${TCP_REDIRECT_PORTS} -m comment --comment 'Redirect reinjected packets to the untangle-vm'
 
+    # DROP all packets exiting the server with the source address of TUN_IP_ADDR
+    # This happens whenever conntrack does not properly remap the reply packet from the redirect
+    # Must be first rule in chain (was iptables -I, i.e. insert at top)
+    nft "add rule inet tune queue-to-uvm ip saddr ${TUN_IP_ADDR} drop comment \"Drop unmapped packets leaving server\""
+
     # Ignore loopback traffic
-    ${IPTABLES} -A queue-to-uvm -t tune -i lo -j RETURN -m comment --comment 'Do not queue loopback traffic'
-    ${IPTABLES} -A queue-to-uvm -t tune -o lo -j RETURN -m comment --comment 'Do not queue loopback traffic'
+    nft 'add rule inet tune queue-to-uvm iifname "lo" return comment "Do not queue loopback traffic"'
+    nft 'add rule inet tune queue-to-uvm oifname "lo" return comment "Do not queue loopback traffic"'
 
     # Ignore traffic that is related to a session we are not watching.
-    # If its "related" according to iptables, then original session must have been bypassed
-    ${IPTABLES} -A queue-to-uvm -t tune -m conntrack --ctstate RELATED  -j RETURN -m comment --comment 'Do not queue (bypass) sessions related to other bypassed sessions'
+    # If its "related" according to conntrack, then original session must have been bypassed
+    nft 'add rule inet tune queue-to-uvm ct state related return comment "Do not queue (bypass) sessions related to other bypassed sessions"'
 
     # Ignore traffic that has no conntrack info because we cant NAT it.
-    ${IPTABLES} -A queue-to-uvm -t tune -m conntrack --ctstate INVALID  -j RETURN -m comment --comment 'Do not queue (bypass) sessions without conntrack info'
+    nft 'add rule inet tune queue-to-uvm ct state invalid return comment "Do not queue (bypass) sessions without conntrack info"'
 
     # Ignore bypassed traffic.
-    ${IPTABLES} -A queue-to-uvm -t tune -m mark --mark ${MASK_BYPASS}/${MASK_BYPASS} -j RETURN -m comment --comment 'Do not queue (bypass) all packets with bypass bit set'
+    nft "add rule inet tune queue-to-uvm meta mark and ${MASK_BYPASS} == ${MASK_BYPASS} return comment \"Do not queue (bypass) all packets with bypass bit set\""
 
     # Queue all of the SYN packets.
-    ${IPTABLES} -A queue-to-uvm -t tune -p tcp --syn -j NFQUEUE --queue-num 1981 -m comment --comment 'Queue TCP SYN packets to the untangle-vm'
+    nft 'add rule inet tune queue-to-uvm tcp flags syn / fin,syn,rst,ack queue num 1981 comment "Queue TCP SYN packets to the untangle-vm"'
 
     # Queue all of the UDP packets.
-    ${IPTABLES} -A queue-to-uvm -t tune -m addrtype --dst-type unicast -p udp -j NFQUEUE --queue-num 1982 -m comment --comment 'Queue Unicast UDP packets to the untange-vm'
-
-    # DROP all packets exiting the server with the source address of TUN_IP_ADDR
-    # This happens whenever conntrack does not properly remap the reply packet from the redirect
-    # I have not been able to figure out the conditions in which this happens, but regardless its pointless to send a packet with this source address
-    # as the destination will simply ignore it
-    ${IPTABLES} -I queue-to-uvm -t tune -s ${TUN_IP_ADDR} -j DROP -m comment --comment 'Drop unmapped packets leaving server'
+    nft 'add rule inet tune queue-to-uvm fib daddr type unicast meta l4proto udp queue num 1982 comment "Queue Unicast UDP packets to the untangle-vm"'
+
+    # NGFW-15749: QoS connmark save for UDP — preserve QoS priority across packets in same flow.
+    # Gated by flag file managed by sync-settings/qos_manager.py. Was previously emitted by
+    # 300-qos but raced against 010-flush deleting the inet tune table before this script
+    # (= 800-uvm symlink) recreated it, so the rule was never installed.
+    if [ -f /usr/share/untangle/conf/qos-enabled ]; then
+        nft 'add rule inet tune queue-to-uvm meta l4proto udp meta mark & 0x000f0000 != 0 ct mark set mark comment "save non-zero QoS mark"'
+    fi
 
     # Redirect packets destined to non-local sockets to local
     ${IPTABLES} -I prerouting-untangle-vm -t mangle -p tcp -m socket -j MARK --set-mark 0xFE00/0xFF00 -m comment --comment "route traffic to non-locally bound sockets to local"
@@ -184,7 +193,7 @@ EOT
 remove_iptables_rules()
 {
     ${IPTABLES} -t nat -F uvm-tcp-redirect >/dev/null 2>&1
-    ${IPTABLES} -t tune -F queue-to-uvm >/dev/null 2>&1
+    nft delete table inet tune >/dev/null 2>&1
 
     KERNVER=$(uname -r | awk -F. '{ printf("%02d%02d%02d\n",$1,$2,$3); }')
     ORIGVER=30000
@@ -197,7 +206,7 @@ remove_iptables_rules()
     ${IPTABLES} -D output-untangle-vm -t mangle -p udp -j MARK --set-mark ${MASK_BOGUS}/${MASK_BOGUS} -m comment --comment 'change the mark of all UDP packets to force re-route after OUTPUT' >/dev/null 2>&1
     ${IPTABLES} -D input-untangle-vm -t mangle -i utun -j MARK --set-mark 0x10000000/0x10000000 -m comment --comment "Set reinjected packet mark" >/dev/null 2>&1
     ${IPTABLES} -D PREROUTING -t nat -i ${TUN_DEV} -p tcp -g uvm-tcp-redirect -m comment --comment 'Redirect utun traffic to untangle-vm' >/dev/null 2>&1
-    ${IPTABLES} -D POSTROUTING -t tune -j queue-to-uvm -m comment --comment 'Queue packets to the Untangle-VM' >/dev/null 2>&1
+    # tune table cleanup handled by 'nft delete table inet tune' above
     ${IPTABLES} -D prerouting-untangle-vm -t mangle -p tcp -m socket -j MARK --set-mark 0xFE00/0xFF00 -m comment --comment "route traffic to non-locally bound sockets to local" >/dev/null 2>&1
     ${IPTABLES} -D prerouting-untangle-vm -t mangle -p icmp --icmp-type 3/4 -m socket -j MARK --set-mark 0xFE00/0xFF00 -m comment --comment "route ICMP Unreachable Frag needed traffic to local" >/dev/null 2>&1
     
diff --git a/uvm/hier/usr/share/untangle/web/auth/index.py b/uvm/hier/usr/share/untangle/web/auth/index.py
index 85bdd16064..6e13f157e9 100644
--- a/uvm/hier/usr/share/untangle/web/auth/index.py
+++ b/uvm/hier/usr/share/untangle/web/auth/index.py
@@ -6,7 +6,10 @@
 import re
 import pycurl
 import json
-import crypt
+try:
+    import crypt
+except ImportError:
+    import legacycrypt as crypt
 import urllib.parse
 import time
 from io import StringIO
diff --git a/uvm/impl/com/untangle/uvm/AppManagerImpl.java b/uvm/impl/com/untangle/uvm/AppManagerImpl.java
index 71e39e44a0..f2328bf641 100644
--- a/uvm/impl/com/untangle/uvm/AppManagerImpl.java
+++ b/uvm/impl/com/untangle/uvm/AppManagerImpl.java
@@ -920,6 +920,7 @@ public AppsView getAppsView(Integer policyId)
         installableAppsMap.remove("Web Filter Lite"); /*
                                                        * hide web filter lite
                                                        * from left hand nav
+                                                       */
         /**
          * SPECIAL CASE: Spam Blocker Lite is being deprecated - hide it
          */
@@ -1645,33 +1646,7 @@ private AppManagerSettings loadSettings()
                 if (item.getAppName().equals("ips")) continue;
                 if (item.getAppName().equals("spam-blocker-lite")) continue;
                 if (item.getAppName().equals("idps")) continue;
-                if (item.getAppName().equals("virus-blocker-lite")) {
-                    // One-time 17.4 -> 17.5 upgrade migration; can be removed in the next release
-                    // once 17.4 is no longer a supported upgrade path.
-                    // If Lite was running, ensure Virus Blocker (same clamav backend) is also running.
-                    if (AppSettings.AppState.RUNNING.equals(item.getTargetState())) {
-                        final Integer policyId = item.getPolicyId();
-                        Optional<AppSettings> existingVb = readSettings.getApps().stream()
-                            .filter(s -> "virus-blocker".equals(s.getAppName())
-                                      && Objects.equals(s.getPolicyId(), policyId))
-                            .findFirst();
-                        if (existingVb.isPresent()) {
-                            existingVb.get().setTargetState(AppSettings.AppState.RUNNING);
-                        } else {
-                            // VB was never installed for this policy. Create an entry so the
-                            // customer retains virus protection after VBL is removed in 17.5.
-                            // restartUnloaded() picks this up; postInit() creates default
-                            // settings via initializeSettings() if no settings file exists.
-                            long newId = readSettings.getNextAppId();
-                            readSettings.setNextAppId(newId + 1);
-                            AppSettings newVb = new AppSettings(newId, policyId, "virus-blocker");
-                            newVb.setTargetState(AppSettings.AppState.RUNNING);
-                            cleanList.add(newVb);
-                        }
-                        settingsModified = true;
-                    }
-                    continue;
-                }
+                if (item.getAppName().equals("virus-blocker-lite")) continue;
                 cleanList.add(item);
             }
 
diff --git a/web-filter/hier/usr/lib/python3/dist-packages/tests/test_web_filter.py b/web-filter/hier/usr/lib/python3/dist-packages/tests/test_web_filter.py
index 0b7e83a430..7c09ee0166 100644
--- a/web-filter/hier/usr/lib/python3/dist-packages/tests/test_web_filter.py
+++ b/web-filter/hier/usr/lib/python3/dist-packages/tests/test_web_filter.py
@@ -380,8 +380,8 @@ def test_202_url_filtering_global_vs_instance_specific_rules_reflection(self):
         # Initial state: check that both web app blocked URL lists are empty
         web_app_2_blocked_rules = web_app_2.getBlockedUrls()
         web_app_1_blocked_rules = self._app.getBlockedUrls()
-        self.assertEquals(len(web_app_1_blocked_rules['list']),0)
-        self.assertEquals(len(web_app_2_blocked_rules['list']), 0)
+        self.assertEqual(len(web_app_1_blocked_rules['list']),0)
+        self.assertEqual(len(web_app_2_blocked_rules['list']), 0)
 
         # Add blocked URLs
         self.block_url_list_add("http://www.amazon.com", blocked=True, flagged=True, isGlobal=True, description="description")
@@ -391,8 +391,8 @@ def test_202_url_filtering_global_vs_instance_specific_rules_reflection(self):
         web_app_2_blocked_rules = web_app_2.getBlockedUrls()
         web_app_1_blocked_rules = self._app.getBlockedUrls()
 
-        self.assertEquals(len(web_app_1_blocked_rules['list']), 2)  # web_app_1 should have 2 blocked URLs
-        self.assertEquals(len(web_app_2_blocked_rules['list']), 1)  # web_app_2 should have 1 blocked URL
+        self.assertEqual(len(web_app_1_blocked_rules['list']), 2)  # web_app_1 should have 2 blocked URLs
+        self.assertEqual(len(web_app_2_blocked_rules['list']), 1)  # web_app_2 should have 1 blocked URL
 
         # Clear global blocked URLs
         self.block_global_url_list_clear()
@@ -401,8 +401,8 @@ def test_202_url_filtering_global_vs_instance_specific_rules_reflection(self):
         web_app_2_blocked_rules = web_app_2.getBlockedUrls()
         web_app_1_blocked_rules = self._app.getBlockedUrls()
 
-        self.assertEquals(len(web_app_1_blocked_rules['list']), 1)  # web_app_1 should still have 1 blocked URL
-        self.assertEquals(len(web_app_2_blocked_rules['list']), 0)  # web_app_2 should have 0 blocked URLs
+        self.assertEqual(len(web_app_1_blocked_rules['list']), 1)  # web_app_1 should still have 1 blocked URL
+        self.assertEqual(len(web_app_2_blocked_rules['list']), 0)  # web_app_2 should have 0 blocked URLs
 
         # Revert to original settings
         self.block_url_list_clear()
@@ -412,8 +412,8 @@ def test_202_url_filtering_global_vs_instance_specific_rules_reflection(self):
         web_app_1_passed_rules = self._app.getPassedUrls()
         
         # Verify that both lists are empty initially
-        self.assertEquals(len(web_app_1_passed_rules['list']), 0)
-        self.assertEquals(len(web_app_2_passed_rules['list']), 0)
+        self.assertEqual(len(web_app_1_passed_rules['list']), 0)
+        self.assertEqual(len(web_app_2_passed_rules['list']), 0)
     
         # Add passed URLs
         self.pass_url_list_add("http://www.amazon.com", enabled=True, isGlobal=True, description="description")
@@ -424,8 +424,8 @@ def test_202_url_filtering_global_vs_instance_specific_rules_reflection(self):
         web_app_1_passed_rules = self._app.getPassedUrls()
 
         # Verify the passed URL counts after addition
-        self.assertEquals(len(web_app_1_passed_rules['list']), 2)  # Web App 1 should have 2 passed URLs
-        self.assertEquals(len(web_app_2_passed_rules['list']), 1)  # Web App 2 should have 1 passed URL
+        self.assertEqual(len(web_app_1_passed_rules['list']), 2)  # Web App 1 should have 2 passed URLs
+        self.assertEqual(len(web_app_2_passed_rules['list']), 1)  # Web App 2 should have 1 passed URL
 
         # Clear global passed URLs
         self.pass_global_url_list_clear()
@@ -435,8 +435,8 @@ def test_202_url_filtering_global_vs_instance_specific_rules_reflection(self):
         web_app_1_passed_rules = self._app.getPassedUrls()
 
         # Verify the passed URL counts after clearing global passed URLs
-        self.assertEquals(len(web_app_1_passed_rules['list']), 1)  # Web App 1 should still have 1 passed URL
-        self.assertEquals(len(web_app_2_passed_rules['list']), 0)  # Web App 2 should have 0 passed URLs
+        self.assertEqual(len(web_app_1_passed_rules['list']), 1)  # Web App 1 should still have 1 passed URL
+        self.assertEqual(len(web_app_2_passed_rules['list']), 0)  # Web App 2 should have 0 passed URLs
 
         # Revert to original settings
         self.pass_url_list_clear()
@@ -527,8 +527,8 @@ def test_205_global_settings_consistency_under_concurrent_updates(self):
         # Validate initial global rules are present in the new instance
         web_app_3_blocked_rules = web_app_3.getBlockedUrls()
         web_app_3_passed_rules =  web_app_3.getPassedUrls()
-        self.assertEquals(len(web_app_3_blocked_rules['list']), 1)
-        self.assertEquals(len(web_app_3_passed_rules['list']), 1)
+        self.assertEqual(len(web_app_3_blocked_rules['list']), 1)
+        self.assertEqual(len(web_app_3_passed_rules['list']), 1)
 
         # Clear global block/pass rules before concurrent modifications
         self.block_url_list_clear()
@@ -561,13 +561,18 @@ def test_205_global_settings_consistency_under_concurrent_updates(self):
             match = pattern.match(latest_file)
             app_id = match.group(1)
             print(f" \n Last modified settings file: {latest_file} \n  Corresponding app_id: {app_id} \n")
-        # Verify web_app_3 received the latest global rule updates
+        # Verify web_app_3 sees exactly one surviving global rule -- which of the
+        # three workers wins is implementation-defined under concurrent setBlockedUrls
+        # (settings-file mtime is NOT a reliable proxy for winning-rule ownership
+        # because settings persist cascades across instances). What the test really
+        # cares about: exactly one rule survives AND it came from one of our workers.
         web_app_3_blocked_rules = web_app_3.getBlockedUrls()
-        self.assertEquals(len(web_app_3_blocked_rules['list']), 1)
+        self.assertEqual(len(web_app_3_blocked_rules['list']), 1)
         print("web_app_3_blocked_rules['list']  ==>   ", web_app_3_blocked_rules['list'])
-        expected_prefix = f"Rule-{app_id}"
-        match_found = any(rule.get("string", "").startswith(expected_prefix) for rule in web_app_3_blocked_rules['list'])
-        assert match_found, f"No rule starting with '{expected_prefix}' found in blocked rules."
+        valid_prefixes = tuple(f"Rule-{aid}" for aid in app_ids_to_run)
+        survivor = web_app_3_blocked_rules['list'][0].get("string", "")
+        assert survivor.startswith(valid_prefixes), \
+            f"Surviving rule '{survivor}' did not come from any worker {app_ids_to_run}"
 
         # Revert to original setting
         self.block_url_list_clear()
diff --git a/webroot-base/src/com/untangle/app/webroot/WebrootQuery.java b/webroot-base/src/com/untangle/app/webroot/WebrootQuery.java
index d812b533ee..b958d319ae 100644
--- a/webroot-base/src/com/untangle/app/webroot/WebrootQuery.java
+++ b/webroot-base/src/com/untangle/app/webroot/WebrootQuery.java
@@ -138,7 +138,14 @@ public class WebrootQuery
     private static long BctidSocketPoolMaxWaitSeconds = 5L;
 
     private static int BctidClientConnectTimeout = 250;
-    private static int BctidClientReadTimeout = 5000;
+    // NGFW-15749: raised from 5000 to 30000 to absorb first-install DNS stalls when
+    // the upstream resolver silently drops AAAA queries (common on VBox-NAT virtual
+    // DNS and some consumer routers). glibc parallel A+AAAA can block ~15s before
+    // returning to bctid; the prior 5s timeout fired first, declared Pulse dead,
+    // and triggered systemctl restart untangle-bctid in a loop that wiped bctid's
+    // resolved-IP cache on every cycle. 30s lets the first lookup complete; once
+    // bctid caches the IP, all subsequent queries are sub-millisecond.
+    private static int BctidClientReadTimeout = 30000;
 
     private int failures = 0;