From 6433b7609518af22352e57dfc2caba6728c48599 Mon Sep 17 00:00:00 2001
From: keegreil <keegreil@gmail.com>
Date: Sat, 12 Sep 2026 15:36:47 -0400
Subject: [PATCH 01/13] fix: advertise native SV2 appliance endpoint

---
 .github/workflows/check.yml                           |  3 +++
 README.md                                             | 11 +++++++++++
 .../templates/boot_portal_config.json.template        |  3 +++
 3 files changed, 17 insertions(+)

diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index b5480ff..dc118e3 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -30,3 +30,6 @@ jobs:
         run: |
           envsubst < gridlabs-gridpool/templates/boot_portal_config.json.template > /tmp/config.json
           jq empty /tmp/config.json
+          test "$(jq -r '.native_sv2_enabled' /tmp/config.json)" = "true"
+          test "$(jq -r '.native_sv2_public_port' /tmp/config.json)" = "34265"
+          test "$(jq -r '.enable_admin_api' /tmp/config.json)" = "false"
diff --git a/README.md b/README.md
index 12ea9f8..925a7a6 100644
--- a/README.md
+++ b/README.md
@@ -42,9 +42,20 @@ Point a native SV2 miner at:
 stratum2+noise://UMBREL_LAN_IP:34265
 ```
 
+The GridPool dashboard also shows this endpoint under **Connect miner**. The
+hostname is inferred from the browser when the package does not have a public
+hostname configured, so use the Umbrel device's LAN hostname or IP if the
+displayed browser hostname is not reachable from the miner.
+
 The per-channel SV2 username may be a valid mainnet payout address. If it is a
 worker label instead, the package payout address is used.
 
+The initial appliance package disables GridPool's administrative API. It does
+not provision an operator password; the dashboard hides operator-only controls
+and exposes the non-sensitive miner connection and health information needed
+for normal operation. Advanced operators may explicitly enable the API and set
+a strong key in local configuration.
+
 ## Persistence and backup
 
 `gridlabs-gridpool/data` contains node identity, consensus state, the local adapter
diff --git a/gridlabs-gridpool/templates/boot_portal_config.json.template b/gridlabs-gridpool/templates/boot_portal_config.json.template
index 0a457c8..154ba00 100644
--- a/gridlabs-gridpool/templates/boot_portal_config.json.template
+++ b/gridlabs-gridpool/templates/boot_portal_config.json.template
@@ -28,5 +28,8 @@
   "work_set_reserve_multiplier": 3,
   "local_adapter_token_file": "/shared/local-adapter.token",
   "local_sv2_api_url": "http://sv2:34290/api/v1/global",
+  "native_sv2_enabled": true,
+  "native_sv2_public_host": "",
+  "native_sv2_public_port": 34265,
   "enable_admin_api": false
 }

From 8811ed7ad2f465d0db331d64701b187d3c53fc6d Mon Sep 17 00:00:00 2001
From: keegreil <keegreil@gmail.com>
Date: Sat, 12 Sep 2026 17:06:49 -0400
Subject: [PATCH 02/13] fix: make Umbrel clean installs portable

---
 .github/workflows/check.yml          | 1 +
 gridlabs-gridpool/docker-compose.yml | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 2b6065f..dd94a7e 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -42,6 +42,7 @@ jobs:
       - name: Verify UI-driven payout lifecycle
         run: |
           ! grep -q 'env_file' gridlabs-gridpool/docker-compose.yml
+          grep -q 'APP_HOST: gridpool$' gridlabs-gridpool/docker-compose.yml
           test "$(grep -Fc '${APP_DATA_DIR}/templates:/templates:ro' gridlabs-gridpool/docker-compose.yml)" = "3"
           ! grep -Fq '${GRIDPOOL_PAYOUT_ADDRESS:-}' gridlabs-gridpool/templates/init.sh
           grep -q 'boot_portal_config.local.json' gridlabs-gridpool/templates/gridpool-entrypoint.sh
diff --git a/gridlabs-gridpool/docker-compose.yml b/gridlabs-gridpool/docker-compose.yml
index 9e3490e..a38487a 100644
--- a/gridlabs-gridpool/docker-compose.yml
+++ b/gridlabs-gridpool/docker-compose.yml
@@ -1,7 +1,7 @@
 services:
   app_proxy:
     environment:
-      APP_HOST: gridlabs-gridpool_gridpool_1
+      APP_HOST: gridpool
       APP_PORT: 5000
 
   init:

From 55c7d6921c8deac7ae6acc8e735e0fcc695c1583 Mon Sep 17 00:00:00 2001
From: keegreil <keegreil@gmail.com>
Date: Sat, 12 Sep 2026 20:54:45 -0400
Subject: [PATCH 03/13] release: pin onboarding runtime image

---
 .github/workflows/check.yml          | 2 +-
 gridlabs-gridpool/docker-compose.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index dd94a7e..ba491ee 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -68,7 +68,7 @@ jobs:
       fail-fast: false
       matrix:
         image:
-          - ghcr.io/gridlabs-science/boot-protocol@sha256:8672c835b14f8fcad8a358e5b80ae945d6973b5039c706437b3b1c4bdff6f5d5
+          - ghcr.io/gridlabs-science/boot-protocol@sha256:a0481ca57db41f9c88ece8f29c7f149755402c67fe1199df03e9612fd3430563
           - ghcr.io/gridlabs-science/gridpool-sv2-pool@sha256:3de54e9c51953d2b5089ae90a25b9a0fa046c18c4ae0139b768b77a4cf0ed50e
     steps:
       - uses: aquasecurity/trivy-action@v0.36.0
diff --git a/gridlabs-gridpool/docker-compose.yml b/gridlabs-gridpool/docker-compose.yml
index a38487a..132de0a 100644
--- a/gridlabs-gridpool/docker-compose.yml
+++ b/gridlabs-gridpool/docker-compose.yml
@@ -20,7 +20,7 @@ services:
       - ${APP_DATA_DIR}/templates:/templates:ro
 
   gridpool:
-    image: ghcr.io/gridlabs-science/boot-protocol@sha256:8672c835b14f8fcad8a358e5b80ae945d6973b5039c706437b3b1c4bdff6f5d5
+    image: ghcr.io/gridlabs-science/boot-protocol@sha256:a0481ca57db41f9c88ece8f29c7f149755402c67fe1199df03e9612fd3430563
     depends_on:
       init:
         condition: service_completed_successfully

From 49eddfb31166813b6dc387d84a6bbcfca00bf586 Mon Sep 17 00:00:00 2001
From: keegreil <keegreil@gmail.com>
Date: Sat, 12 Sep 2026 20:55:49 -0400
Subject: [PATCH 04/13] release: bump corrected Umbrel onboarding candidate

---
 gridlabs-gridpool/umbrel-app.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gridlabs-gridpool/umbrel-app.yml b/gridlabs-gridpool/umbrel-app.yml
index c533dd1..e8c95d0 100644
--- a/gridlabs-gridpool/umbrel-app.yml
+++ b/gridlabs-gridpool/umbrel-app.yml
@@ -3,7 +3,7 @@ id: gridlabs-gridpool
 implements: []
 category: bitcoin
 name: GridPool
-version: "0.2.2-beta.2"
+version: "0.2.2-beta.3"
 icon: https://raw.githubusercontent.com/gridlabs-science/gridpool-umbrel/main/gridlabs-gridpool/icon.svg
 tagline: Sovereign, non-custodial pooled mining
 description: >-

From 1fa4e375af363a59abc7a8fa50100fb86d8441b6 Mon Sep 17 00:00:00 2001
From: keegreil <keegreil@gmail.com>
Date: Sat, 12 Sep 2026 21:40:41 -0400
Subject: [PATCH 05/13] fix: complete Umbrel onboarding and initial sync

---
 gridlabs-gridpool/docker-compose.yml                      | 2 +-
 .../templates/boot_portal_config.json.template            | 1 +
 gridlabs-gridpool/umbrel-app.yml                          | 8 ++++----
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/gridlabs-gridpool/docker-compose.yml b/gridlabs-gridpool/docker-compose.yml
index 132de0a..3b4c784 100644
--- a/gridlabs-gridpool/docker-compose.yml
+++ b/gridlabs-gridpool/docker-compose.yml
@@ -20,7 +20,7 @@ services:
       - ${APP_DATA_DIR}/templates:/templates:ro
 
   gridpool:
-    image: ghcr.io/gridlabs-science/boot-protocol@sha256:a0481ca57db41f9c88ece8f29c7f149755402c67fe1199df03e9612fd3430563
+    image: ghcr.io/gridlabs-science/boot-protocol@sha256:5afeadca16f09800697ac425f88628b5427b72ef6a40ea220b74c6124b81e935
     depends_on:
       init:
         condition: service_completed_successfully
diff --git a/gridlabs-gridpool/templates/boot_portal_config.json.template b/gridlabs-gridpool/templates/boot_portal_config.json.template
index 384cd6d..cc46b2d 100644
--- a/gridlabs-gridpool/templates/boot_portal_config.json.template
+++ b/gridlabs-gridpool/templates/boot_portal_config.json.template
@@ -10,6 +10,7 @@
   "bitcoin_network": "mainnet",
   "enable_web_ui": true,
   "enable_legacy_ui": false,
+  "restart_after_setup": true,
   "boot_network_id": "mainnet-beta",
   "boot_protocol_version": 22,
   "v22_activation_block_height": 959500,
diff --git a/gridlabs-gridpool/umbrel-app.yml b/gridlabs-gridpool/umbrel-app.yml
index e8c95d0..72a818e 100644
--- a/gridlabs-gridpool/umbrel-app.yml
+++ b/gridlabs-gridpool/umbrel-app.yml
@@ -3,7 +3,7 @@ id: gridlabs-gridpool
 implements: []
 category: bitcoin
 name: GridPool
-version: "0.2.2-beta.3"
+version: "0.2.2-beta.4"
 icon: https://raw.githubusercontent.com/gridlabs-science/gridpool-umbrel/main/gridlabs-gridpool/icon.svg
 tagline: Sovereign, non-custodial pooled mining
 description: >-
@@ -17,10 +17,10 @@ support: https://github.com/gridlabs-science/gridpool-umbrel/issues
 dependencies:
   - bitcoin
 port: 5010
-path: ""
+path: "setup"
 defaultUsername: ""
 defaultPassword: ""
 releaseNotes: >-
-  Early beta with V2.2 security hardening, native SV2 mining, attached-node
-  safety checks, authenticated UDP relay, and digest-pinned images.
+  Early beta with automatic payout onboarding, fresh-node state bootstrap,
+  V2.2 security hardening, native SV2 mining, and digest-pinned images.
 gallery: []

From 8a980448c4ab25c99f353289e2748aa893e38071 Mon Sep 17 00:00:00 2001
From: keegreil <keegreil@gmail.com>
Date: Sun, 13 Sep 2026 08:05:45 -0400
Subject: [PATCH 06/13] release: pin mature-network bootstrap fix

---
 gridlabs-gridpool/docker-compose.yml | 2 +-
 gridlabs-gridpool/umbrel-app.yml     | 7 ++++---
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/gridlabs-gridpool/docker-compose.yml b/gridlabs-gridpool/docker-compose.yml
index 3b4c784..5a04d92 100644
--- a/gridlabs-gridpool/docker-compose.yml
+++ b/gridlabs-gridpool/docker-compose.yml
@@ -20,7 +20,7 @@ services:
       - ${APP_DATA_DIR}/templates:/templates:ro
 
   gridpool:
-    image: ghcr.io/gridlabs-science/boot-protocol@sha256:5afeadca16f09800697ac425f88628b5427b72ef6a40ea220b74c6124b81e935
+    image: ghcr.io/gridlabs-science/boot-protocol@sha256:eb58cc0a028ffa2e9ecc93ba4499974c82e74d81866563a313a9ec467a913473
     depends_on:
       init:
         condition: service_completed_successfully
diff --git a/gridlabs-gridpool/umbrel-app.yml b/gridlabs-gridpool/umbrel-app.yml
index 72a818e..22ca309 100644
--- a/gridlabs-gridpool/umbrel-app.yml
+++ b/gridlabs-gridpool/umbrel-app.yml
@@ -3,7 +3,7 @@ id: gridlabs-gridpool
 implements: []
 category: bitcoin
 name: GridPool
-version: "0.2.2-beta.4"
+version: "0.2.2-beta.5"
 icon: https://raw.githubusercontent.com/gridlabs-science/gridpool-umbrel/main/gridlabs-gridpool/icon.svg
 tagline: Sovereign, non-custodial pooled mining
 description: >-
@@ -21,6 +21,7 @@ path: "setup"
 defaultUsername: ""
 defaultPassword: ""
 releaseNotes: >-
-  Early beta with automatic payout onboarding, fresh-node state bootstrap,
-  V2.2 security hardening, native SV2 mining, and digest-pinned images.
+  Early beta with automatic payout onboarding, mature-network fresh-node
+  bootstrap, V2.2 security hardening, native SV2 mining, and digest-pinned
+  images.
 gallery: []

From b9bb8e3bf3ff150e771b56993ae7c6eb23128c6e Mon Sep 17 00:00:00 2001
From: keegreil <keegreil@gmail.com>
Date: Sun, 13 Sep 2026 08:08:35 -0400
Subject: [PATCH 07/13] ci: scan pinned onboarding runtime

---
 .github/workflows/check.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index ba491ee..095994a 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -68,7 +68,7 @@ jobs:
       fail-fast: false
       matrix:
         image:
-          - ghcr.io/gridlabs-science/boot-protocol@sha256:a0481ca57db41f9c88ece8f29c7f149755402c67fe1199df03e9612fd3430563
+          - ghcr.io/gridlabs-science/boot-protocol@sha256:eb58cc0a028ffa2e9ecc93ba4499974c82e74d81866563a313a9ec467a913473
           - ghcr.io/gridlabs-science/gridpool-sv2-pool@sha256:3de54e9c51953d2b5089ae90a25b9a0fa046c18c4ae0139b768b77a4cf0ed50e
     steps:
       - uses: aquasecurity/trivy-action@v0.36.0

From cd86ca3d5474e81e808a69fab620298f93f18947 Mon Sep 17 00:00:00 2001
From: keegreil <keegreil@gmail.com>
Date: Sun, 13 Sep 2026 08:55:15 -0400
Subject: [PATCH 08/13] fix: expose private appliance connection and
 diagnostics

---
 .github/workflows/check.yml                            |  2 +-
 README.md                                              | 10 +++++-----
 gridlabs-gridpool/docker-compose.yml                   |  2 +-
 .../templates/boot_portal_config.json.template         |  3 ++-
 gridlabs-gridpool/umbrel-app.yml                       |  8 ++++----
 scripts/verify-package.sh                              |  1 +
 6 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 095994a..0c730ca 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -68,7 +68,7 @@ jobs:
       fail-fast: false
       matrix:
         image:
-          - ghcr.io/gridlabs-science/boot-protocol@sha256:eb58cc0a028ffa2e9ecc93ba4499974c82e74d81866563a313a9ec467a913473
+          - ghcr.io/gridlabs-science/boot-protocol@sha256:1815d168e6f3c36d53af810f19058a8dcea7d326eb1cba97222e58c7119656f2
           - ghcr.io/gridlabs-science/gridpool-sv2-pool@sha256:3de54e9c51953d2b5089ae90a25b9a0fa046c18c4ae0139b768b77a4cf0ed50e
     steps:
       - uses: aquasecurity/trivy-action@v0.36.0
diff --git a/README.md b/README.md
index 7c96934..685c402 100644
--- a/README.md
+++ b/README.md
@@ -48,11 +48,11 @@ displayed browser hostname is not reachable from the miner.
 The per-channel SV2 username may be a valid mainnet payout address. If it is a
 worker label instead, the package payout address is used.
 
-The initial appliance package disables GridPool's administrative API. It does
-not provision an operator password; the dashboard hides operator-only controls
-and exposes the non-sensitive miner connection and health information needed
-for normal operation. Advanced operators may explicitly enable the API and set
-a strong key in local configuration.
+The appliance disables GridPool's destructive administrative API and does not
+provision an operator password. Because Umbrel's authenticated app proxy is the
+access boundary, the dashboard displays read-only operator diagnostics directly
+and hides the operator-unlock control. Advanced operators may explicitly enable
+the write API and set a strong key in local configuration.
 
 ## Persistence and backup
 
diff --git a/gridlabs-gridpool/docker-compose.yml b/gridlabs-gridpool/docker-compose.yml
index 5a04d92..ef73375 100644
--- a/gridlabs-gridpool/docker-compose.yml
+++ b/gridlabs-gridpool/docker-compose.yml
@@ -20,7 +20,7 @@ services:
       - ${APP_DATA_DIR}/templates:/templates:ro
 
   gridpool:
-    image: ghcr.io/gridlabs-science/boot-protocol@sha256:eb58cc0a028ffa2e9ecc93ba4499974c82e74d81866563a313a9ec467a913473
+    image: ghcr.io/gridlabs-science/boot-protocol@sha256:1815d168e6f3c36d53af810f19058a8dcea7d326eb1cba97222e58c7119656f2
     depends_on:
       init:
         condition: service_completed_successfully
diff --git a/gridlabs-gridpool/templates/boot_portal_config.json.template b/gridlabs-gridpool/templates/boot_portal_config.json.template
index cc46b2d..30fbd79 100644
--- a/gridlabs-gridpool/templates/boot_portal_config.json.template
+++ b/gridlabs-gridpool/templates/boot_portal_config.json.template
@@ -32,5 +32,6 @@
   "native_sv2_enabled": true,
   "native_sv2_public_host": "",
   "native_sv2_public_port": 34265,
-  "enable_admin_api": false
+  "enable_admin_api": false,
+  "trusted_private_dashboard_enabled": true
 }
diff --git a/gridlabs-gridpool/umbrel-app.yml b/gridlabs-gridpool/umbrel-app.yml
index 22ca309..da788a6 100644
--- a/gridlabs-gridpool/umbrel-app.yml
+++ b/gridlabs-gridpool/umbrel-app.yml
@@ -3,7 +3,7 @@ id: gridlabs-gridpool
 implements: []
 category: bitcoin
 name: GridPool
-version: "0.2.2-beta.5"
+version: "0.2.2-beta.6"
 icon: https://raw.githubusercontent.com/gridlabs-science/gridpool-umbrel/main/gridlabs-gridpool/icon.svg
 tagline: Sovereign, non-custodial pooled mining
 description: >-
@@ -21,7 +21,7 @@ path: "setup"
 defaultUsername: ""
 defaultPassword: ""
 releaseNotes: >-
-  Early beta with automatic payout onboarding, mature-network fresh-node
-  bootstrap, V2.2 security hardening, native SV2 mining, and digest-pinned
-  images.
+  Early beta with reliable payout onboarding, prominent native SV2 connection
+  guidance, private appliance diagnostics, mature-network bootstrap, and V2.2
+  security hardening.
 gallery: []
diff --git a/scripts/verify-package.sh b/scripts/verify-package.sh
index 2034765..6766def 100755
--- a/scripts/verify-package.sh
+++ b/scripts/verify-package.sh
@@ -14,6 +14,7 @@ references="$(grep -oE 'ghcr\.io/[^ @]+@sha256:[0-9a-f]{64}' "$compose" | sort -
 
 grep -q '"enable_legacy_ui": false' "$template"
 grep -q '"enable_admin_api": false' "$template"
+grep -q '"trusted_private_dashboard_enabled": true' "$template"
 ! grep -q 'env_file' "$compose"
 ! grep -Eq '(^|[[:space:]])(8332|28332|28333|34290|5000):' "$compose"
 grep -q '34265:34265/tcp' "$compose"

From 446c5a99786ddd83726d55b9733f099e6c3d90d4 Mon Sep 17 00:00:00 2001
From: keegreil <keegreil@gmail.com>
Date: Sun, 13 Sep 2026 14:46:22 -0400
Subject: [PATCH 09/13] fix: preserve private dashboard mode on upgrades

---
 .github/workflows/check.yml          | 2 +-
 gridlabs-gridpool/docker-compose.yml | 3 ++-
 scripts/verify-package.sh            | 1 +
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 0c730ca..2ca3a34 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -68,7 +68,7 @@ jobs:
       fail-fast: false
       matrix:
         image:
-          - ghcr.io/gridlabs-science/boot-protocol@sha256:1815d168e6f3c36d53af810f19058a8dcea7d326eb1cba97222e58c7119656f2
+          - ghcr.io/gridlabs-science/boot-protocol@sha256:8c4e46c8f8d7bc0bf3dca22f566f8d3b13a36d323c0e12aff8a731bd577fdf19
           - ghcr.io/gridlabs-science/gridpool-sv2-pool@sha256:3de54e9c51953d2b5089ae90a25b9a0fa046c18c4ae0139b768b77a4cf0ed50e
     steps:
       - uses: aquasecurity/trivy-action@v0.36.0
diff --git a/gridlabs-gridpool/docker-compose.yml b/gridlabs-gridpool/docker-compose.yml
index ef73375..c42a365 100644
--- a/gridlabs-gridpool/docker-compose.yml
+++ b/gridlabs-gridpool/docker-compose.yml
@@ -20,7 +20,7 @@ services:
       - ${APP_DATA_DIR}/templates:/templates:ro
 
   gridpool:
-    image: ghcr.io/gridlabs-science/boot-protocol@sha256:1815d168e6f3c36d53af810f19058a8dcea7d326eb1cba97222e58c7119656f2
+    image: ghcr.io/gridlabs-science/boot-protocol@sha256:8c4e46c8f8d7bc0bf3dca22f566f8d3b13a36d323c0e12aff8a731bd577fdf19
     depends_on:
       init:
         condition: service_completed_successfully
@@ -29,6 +29,7 @@ services:
     stop_grace_period: 30s
     environment:
       BOOT_PORTAL_LOCAL_CONFIG_PATH: /shared/boot_portal_config.local.json
+      GRIDPOOL_TRUSTED_PRIVATE_DASHBOARD_ENABLED: "true"
     volumes:
       - ${APP_DATA_DIR}/data/gridpool:/data
       - ${APP_DATA_DIR}/data/shared:/shared
diff --git a/scripts/verify-package.sh b/scripts/verify-package.sh
index 6766def..99b1c8a 100755
--- a/scripts/verify-package.sh
+++ b/scripts/verify-package.sh
@@ -15,6 +15,7 @@ references="$(grep -oE 'ghcr\.io/[^ @]+@sha256:[0-9a-f]{64}' "$compose" | sort -
 grep -q '"enable_legacy_ui": false' "$template"
 grep -q '"enable_admin_api": false' "$template"
 grep -q '"trusted_private_dashboard_enabled": true' "$template"
+grep -q 'GRIDPOOL_TRUSTED_PRIVATE_DASHBOARD_ENABLED: "true"' "$compose"
 ! grep -q 'env_file' "$compose"
 ! grep -Eq '(^|[[:space:]])(8332|28332|28333|34290|5000):' "$compose"
 grep -q '34265:34265/tcp' "$compose"

From aea4d25fea6e0e34d929c408de25a9cbef795f92 Mon Sep 17 00:00:00 2001
From: keegreil <keegreil@gmail.com>
Date: Sun, 13 Sep 2026 17:46:58 -0400
Subject: [PATCH 10/13] fix: publish complete Umbrel SV2 connection details

---
 .github/workflows/check.yml                              | 2 +-
 README.md                                                | 5 +++++
 gridlabs-gridpool/docker-compose.yml                     | 2 +-
 .../templates/boot_portal_config.json.template           | 1 +
 gridlabs-gridpool/templates/gridpool-entrypoint.sh       | 6 ++++++
 gridlabs-gridpool/templates/init.sh                      | 9 +++++++++
 gridlabs-gridpool/umbrel-app.yml                         | 8 ++++----
 scripts/verify-package.sh                                | 3 +++
 8 files changed, 30 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 2ca3a34..76b41a2 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -68,7 +68,7 @@ jobs:
       fail-fast: false
       matrix:
         image:
-          - ghcr.io/gridlabs-science/boot-protocol@sha256:8c4e46c8f8d7bc0bf3dca22f566f8d3b13a36d323c0e12aff8a731bd577fdf19
+          - ghcr.io/gridlabs-science/boot-protocol@sha256:c83601e3fd051b834b02376dbd7827652fa96826b9454050c5d2ae933f9475bc
           - ghcr.io/gridlabs-science/gridpool-sv2-pool@sha256:3de54e9c51953d2b5089ae90a25b9a0fa046c18c4ae0139b768b77a4cf0ed50e
     steps:
       - uses: aquasecurity/trivy-action@v0.36.0
diff --git a/README.md b/README.md
index 685c402..e61cbca 100644
--- a/README.md
+++ b/README.md
@@ -45,6 +45,11 @@ hostname is inferred from the browser when the package does not have a public
 hostname configured, so use the Umbrel device's LAN hostname or IP if the
 displayed browser hostname is not reachable from the miner.
 
+The dashboard also displays the pool's persisted Noise authority public key.
+AxeOS miners require this value in **Pool > Show Advanced Options > SV2
+Authority Pubkey**. The public key identifies the server and is safe to copy;
+the corresponding private key remains inside the package data directory.
+
 The per-channel SV2 username may be a valid mainnet payout address. If it is a
 worker label instead, the package payout address is used.
 
diff --git a/gridlabs-gridpool/docker-compose.yml b/gridlabs-gridpool/docker-compose.yml
index c42a365..41f04d0 100644
--- a/gridlabs-gridpool/docker-compose.yml
+++ b/gridlabs-gridpool/docker-compose.yml
@@ -20,7 +20,7 @@ services:
       - ${APP_DATA_DIR}/templates:/templates:ro
 
   gridpool:
-    image: ghcr.io/gridlabs-science/boot-protocol@sha256:8c4e46c8f8d7bc0bf3dca22f566f8d3b13a36d323c0e12aff8a731bd577fdf19
+    image: ghcr.io/gridlabs-science/boot-protocol@sha256:c83601e3fd051b834b02376dbd7827652fa96826b9454050c5d2ae933f9475bc
     depends_on:
       init:
         condition: service_completed_successfully
diff --git a/gridlabs-gridpool/templates/boot_portal_config.json.template b/gridlabs-gridpool/templates/boot_portal_config.json.template
index 30fbd79..5310d5e 100644
--- a/gridlabs-gridpool/templates/boot_portal_config.json.template
+++ b/gridlabs-gridpool/templates/boot_portal_config.json.template
@@ -32,6 +32,7 @@
   "native_sv2_enabled": true,
   "native_sv2_public_host": "",
   "native_sv2_public_port": 34265,
+  "native_sv2_authority_public_key": "${authority_public_key}",
   "enable_admin_api": false,
   "trusted_private_dashboard_enabled": true
 }
diff --git a/gridlabs-gridpool/templates/gridpool-entrypoint.sh b/gridlabs-gridpool/templates/gridpool-entrypoint.sh
index 4da4749..bd94795 100755
--- a/gridlabs-gridpool/templates/gridpool-entrypoint.sh
+++ b/gridlabs-gridpool/templates/gridpool-entrypoint.sh
@@ -3,6 +3,12 @@ set -eu
 
 setup_override=/shared/boot_portal_config.local.json
 
+if [ -s /shared/sv2-public.env ]; then
+  set -a
+  . /shared/sv2-public.env
+  set +a
+fi
+
 setup_is_complete() {
   [ -s "${setup_override}" ] &&
     grep -q '"setup_completed"[[:space:]]*:[[:space:]]*true' "${setup_override}" &&
diff --git a/gridlabs-gridpool/templates/init.sh b/gridlabs-gridpool/templates/init.sh
index 21d6858..bd6e9a6 100755
--- a/gridlabs-gridpool/templates/init.sh
+++ b/gridlabs-gridpool/templates/init.sh
@@ -14,6 +14,14 @@ if [ ! -s /data/sv2/authority.env ]; then
   /app/pool_sv2 --generate-authority-keypair > /data/sv2/authority.env
 fi
 
+authority_public_key="$(sed -n 's/^authority_public_key=//p' /data/sv2/authority.env | head -n 1)"
+if [ -z "${authority_public_key}" ]; then
+  echo "Native SV2 authority public key is missing" >&2
+  exit 1
+fi
+export authority_public_key
+printf 'GRIDPOOL_NATIVE_SV2_AUTHORITY_PUBLIC_KEY=%s\n' "${authority_public_key}" > /data/shared/sv2-public.env
+
 export BITCOIN_RPC_URL="http://${APP_BITCOIN_NODE_IP}:${APP_BITCOIN_RPC_PORT}"
 export BITCOIN_ZMQ_HASHBLOCK="tcp://${APP_BITCOIN_NODE_IP}:${APP_BITCOIN_ZMQ_HASHBLOCK_PORT}"
 export BITCOIN_ZMQ_RAWBLOCK="tcp://${APP_BITCOIN_NODE_IP}:${APP_BITCOIN_ZMQ_RAWBLOCK_PORT}"
@@ -22,4 +30,5 @@ rm -f /data/sv2/pool-config.toml
 echo "GridPool payout address will be configured through the in-app setup page."
 
 chmod 600 /data/gridpool/boot_portal_config.json /data/sv2/authority.env /data/shared/local-adapter.token
+chmod 600 /data/shared/sv2-public.env
 chown -R 1000:1000 /data/gridpool /data/sv2 /data/shared
diff --git a/gridlabs-gridpool/umbrel-app.yml b/gridlabs-gridpool/umbrel-app.yml
index da788a6..e3d4a90 100644
--- a/gridlabs-gridpool/umbrel-app.yml
+++ b/gridlabs-gridpool/umbrel-app.yml
@@ -3,7 +3,7 @@ id: gridlabs-gridpool
 implements: []
 category: bitcoin
 name: GridPool
-version: "0.2.2-beta.6"
+version: "0.2.2-beta.7"
 icon: https://raw.githubusercontent.com/gridlabs-science/gridpool-umbrel/main/gridlabs-gridpool/icon.svg
 tagline: Sovereign, non-custodial pooled mining
 description: >-
@@ -21,7 +21,7 @@ path: "setup"
 defaultUsername: ""
 defaultPassword: ""
 releaseNotes: >-
-  Early beta with reliable payout onboarding, prominent native SV2 connection
-  guidance, private appliance diagnostics, mature-network bootstrap, and V2.2
-  security hardening.
+  Early beta with explicit setup completion, complete native SV2 connection
+  details including the Noise authority key, private appliance diagnostics,
+  mature-network bootstrap, and V2.2 security hardening.
 gallery: []
diff --git a/scripts/verify-package.sh b/scripts/verify-package.sh
index 99b1c8a..743d172 100755
--- a/scripts/verify-package.sh
+++ b/scripts/verify-package.sh
@@ -16,6 +16,9 @@ grep -q '"enable_legacy_ui": false' "$template"
 grep -q '"enable_admin_api": false' "$template"
 grep -q '"trusted_private_dashboard_enabled": true' "$template"
 grep -q 'GRIDPOOL_TRUSTED_PRIVATE_DASHBOARD_ENABLED: "true"' "$compose"
+grep -q 'GRIDPOOL_NATIVE_SV2_AUTHORITY_PUBLIC_KEY' gridlabs-gridpool/templates/init.sh
+grep -q '/shared/sv2-public.env' gridlabs-gridpool/templates/gridpool-entrypoint.sh
+grep -q 'native_sv2_authority_public_key' "$template"
 ! grep -q 'env_file' "$compose"
 ! grep -Eq '(^|[[:space:]])(8332|28332|28333|34290|5000):' "$compose"
 grep -q '34265:34265/tcp' "$compose"

From 7a66fa6d0dbdfa9af1babee206672f4ef2e1535f Mon Sep 17 00:00:00 2001
From: keegreil <keegreil@gmail.com>
Date: Sun, 13 Sep 2026 17:48:37 -0400
Subject: [PATCH 11/13] fix: rerun Umbrel migrations on package upgrades

---
 gridlabs-gridpool/docker-compose.yml | 1 +
 scripts/verify-package.sh            | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/gridlabs-gridpool/docker-compose.yml b/gridlabs-gridpool/docker-compose.yml
index 41f04d0..41fd54b 100644
--- a/gridlabs-gridpool/docker-compose.yml
+++ b/gridlabs-gridpool/docker-compose.yml
@@ -9,6 +9,7 @@ services:
     user: "0:0"
     entrypoint: ["/bin/sh", "/templates/init.sh"]
     environment:
+      GRIDPOOL_PACKAGE_VERSION: "0.2.2-beta.7"
       APP_BITCOIN_NODE_IP: ${APP_BITCOIN_NODE_IP}
       APP_BITCOIN_RPC_PORT: ${APP_BITCOIN_RPC_PORT}
       APP_BITCOIN_RPC_USER: ${APP_BITCOIN_RPC_USER}
diff --git a/scripts/verify-package.sh b/scripts/verify-package.sh
index 743d172..82601e5 100755
--- a/scripts/verify-package.sh
+++ b/scripts/verify-package.sh
@@ -7,6 +7,7 @@ template="gridlabs-gridpool/templates/boot_portal_config.json.template"
 for script in gridlabs-gridpool/templates/*.sh; do sh -n "$script"; done
 ruby -e 'require "yaml"; YAML.load_file(ARGV[0])' "$compose"
 ruby -e 'require "yaml"; YAML.load_file(ARGV[0])' gridlabs-gridpool/umbrel-app.yml
+package_version="$(ruby -e 'require "yaml"; puts YAML.load_file(ARGV[0]).fetch("version")' gridlabs-gridpool/umbrel-app.yml)"
 
 references="$(grep -oE 'ghcr\.io/[^ @]+@sha256:[0-9a-f]{64}' "$compose" | sort -u)"
 [[ "$(printf '%s\n' "$references" | sed '/^$/d' | wc -l)" -eq 2 ]]
@@ -19,6 +20,7 @@ grep -q 'GRIDPOOL_TRUSTED_PRIVATE_DASHBOARD_ENABLED: "true"' "$compose"
 grep -q 'GRIDPOOL_NATIVE_SV2_AUTHORITY_PUBLIC_KEY' gridlabs-gridpool/templates/init.sh
 grep -q '/shared/sv2-public.env' gridlabs-gridpool/templates/gridpool-entrypoint.sh
 grep -q 'native_sv2_authority_public_key' "$template"
+grep -q "GRIDPOOL_PACKAGE_VERSION: \"${package_version}\"" "$compose"
 ! grep -q 'env_file' "$compose"
 ! grep -Eq '(^|[[:space:]])(8332|28332|28333|34290|5000):' "$compose"
 grep -q '34265:34265/tcp' "$compose"

From 66fb15b257e71d85809a13feeaee7793ce15a65f Mon Sep 17 00:00:00 2001
From: keegreil <keegreil@gmail.com>
Date: Sun, 13 Sep 2026 17:50:29 -0400
Subject: [PATCH 12/13] fix: bootstrap Umbrel template migrations from compose

---
 gridlabs-gridpool/docker-compose.yml | 18 ++++++++++++++++--
 scripts/verify-package.sh            |  2 ++
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/gridlabs-gridpool/docker-compose.yml b/gridlabs-gridpool/docker-compose.yml
index 41fd54b..759bd45 100644
--- a/gridlabs-gridpool/docker-compose.yml
+++ b/gridlabs-gridpool/docker-compose.yml
@@ -7,7 +7,14 @@ services:
   init:
     image: ghcr.io/gridlabs-science/gridpool-sv2-pool@sha256:3de54e9c51953d2b5089ae90a25b9a0fa046c18c4ae0139b768b77a4cf0ed50e
     user: "0:0"
-    entrypoint: ["/bin/sh", "/templates/init.sh"]
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+        /bin/sh /templates/init.sh
+        sed -n 's/^authority_public_key=/GRIDPOOL_NATIVE_SV2_AUTHORITY_PUBLIC_KEY=/p' /data/sv2/authority.env > /data/shared/sv2-public.env
+        test -s /data/shared/sv2-public.env
+        chmod 644 /data/shared/sv2-public.env
     environment:
       GRIDPOOL_PACKAGE_VERSION: "0.2.2-beta.7"
       APP_BITCOIN_NODE_IP: ${APP_BITCOIN_NODE_IP}
@@ -25,7 +32,14 @@ services:
     depends_on:
       init:
         condition: service_completed_successfully
-    entrypoint: ["/bin/sh", "/templates/gridpool-entrypoint.sh"]
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+        set -a
+        . /shared/sv2-public.env
+        set +a
+        exec /bin/sh /templates/gridpool-entrypoint.sh
     restart: unless-stopped
     stop_grace_period: 30s
     environment:
diff --git a/scripts/verify-package.sh b/scripts/verify-package.sh
index 82601e5..a244ff9 100755
--- a/scripts/verify-package.sh
+++ b/scripts/verify-package.sh
@@ -19,6 +19,8 @@ grep -q '"trusted_private_dashboard_enabled": true' "$template"
 grep -q 'GRIDPOOL_TRUSTED_PRIVATE_DASHBOARD_ENABLED: "true"' "$compose"
 grep -q 'GRIDPOOL_NATIVE_SV2_AUTHORITY_PUBLIC_KEY' gridlabs-gridpool/templates/init.sh
 grep -q '/shared/sv2-public.env' gridlabs-gridpool/templates/gridpool-entrypoint.sh
+grep -q 'GRIDPOOL_NATIVE_SV2_AUTHORITY_PUBLIC_KEY=' "$compose"
+grep -q '. /shared/sv2-public.env' "$compose"
 grep -q 'native_sv2_authority_public_key' "$template"
 grep -q "GRIDPOOL_PACKAGE_VERSION: \"${package_version}\"" "$compose"
 ! grep -q 'env_file' "$compose"

From 0f96350dd52b8dc42d6ba710a0a60532ae88d578 Mon Sep 17 00:00:00 2001
From: keegreil <keegreil@gmail.com>
Date: Mon, 14 Sep 2026 06:39:22 -0400
Subject: [PATCH 13/13] release: prepare beta.8 with SV2 runtime security
 updates

---
 .github/workflows/check.yml          | 2 +-
 gridlabs-gridpool/docker-compose.yml | 6 +++---
 gridlabs-gridpool/umbrel-app.yml     | 5 +++--
 3 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 76b41a2..789489f 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -69,7 +69,7 @@ jobs:
       matrix:
         image:
           - ghcr.io/gridlabs-science/boot-protocol@sha256:c83601e3fd051b834b02376dbd7827652fa96826b9454050c5d2ae933f9475bc
-          - ghcr.io/gridlabs-science/gridpool-sv2-pool@sha256:3de54e9c51953d2b5089ae90a25b9a0fa046c18c4ae0139b768b77a4cf0ed50e
+          - ghcr.io/gridlabs-science/gridpool-sv2-pool@sha256:894b04939da127188d97dd53aaf5e3a6514de959c827a6ba34161ed5a2fc6fb0
     steps:
       - uses: aquasecurity/trivy-action@v0.36.0
         with:
diff --git a/gridlabs-gridpool/docker-compose.yml b/gridlabs-gridpool/docker-compose.yml
index 759bd45..aa05914 100644
--- a/gridlabs-gridpool/docker-compose.yml
+++ b/gridlabs-gridpool/docker-compose.yml
@@ -5,7 +5,7 @@ services:
       APP_PORT: 5000
 
   init:
-    image: ghcr.io/gridlabs-science/gridpool-sv2-pool@sha256:3de54e9c51953d2b5089ae90a25b9a0fa046c18c4ae0139b768b77a4cf0ed50e
+    image: ghcr.io/gridlabs-science/gridpool-sv2-pool@sha256:894b04939da127188d97dd53aaf5e3a6514de959c827a6ba34161ed5a2fc6fb0
     user: "0:0"
     entrypoint:
       - /bin/sh
@@ -16,7 +16,7 @@ services:
         test -s /data/shared/sv2-public.env
         chmod 644 /data/shared/sv2-public.env
     environment:
-      GRIDPOOL_PACKAGE_VERSION: "0.2.2-beta.7"
+      GRIDPOOL_PACKAGE_VERSION: "0.2.2-beta.8"
       APP_BITCOIN_NODE_IP: ${APP_BITCOIN_NODE_IP}
       APP_BITCOIN_RPC_PORT: ${APP_BITCOIN_RPC_PORT}
       APP_BITCOIN_RPC_USER: ${APP_BITCOIN_RPC_USER}
@@ -59,7 +59,7 @@ services:
       retries: 4
 
   sv2:
-    image: ghcr.io/gridlabs-science/gridpool-sv2-pool@sha256:3de54e9c51953d2b5089ae90a25b9a0fa046c18c4ae0139b768b77a4cf0ed50e
+    image: ghcr.io/gridlabs-science/gridpool-sv2-pool@sha256:894b04939da127188d97dd53aaf5e3a6514de959c827a6ba34161ed5a2fc6fb0
     depends_on:
       init:
         condition: service_completed_successfully
diff --git a/gridlabs-gridpool/umbrel-app.yml b/gridlabs-gridpool/umbrel-app.yml
index e3d4a90..c8a7e05 100644
--- a/gridlabs-gridpool/umbrel-app.yml
+++ b/gridlabs-gridpool/umbrel-app.yml
@@ -3,7 +3,7 @@ id: gridlabs-gridpool
 implements: []
 category: bitcoin
 name: GridPool
-version: "0.2.2-beta.7"
+version: "0.2.2-beta.8"
 icon: https://raw.githubusercontent.com/gridlabs-science/gridpool-umbrel/main/gridlabs-gridpool/icon.svg
 tagline: Sovereign, non-custodial pooled mining
 description: >-
@@ -23,5 +23,6 @@ defaultPassword: ""
 releaseNotes: >-
   Early beta with explicit setup completion, complete native SV2 connection
   details including the Noise authority key, private appliance diagnostics,
-  mature-network bootstrap, and V2.2 security hardening.
+  mature-network bootstrap, V2.2 security hardening, and refreshed SV2 runtime
+  OS security libraries with the mining binary unchanged.
 gallery: []