diff --git a/.DS_Store b/.DS_Store
index bd1b420..cf517a2 100644
Binary files a/.DS_Store and b/.DS_Store differ
diff --git a/.github/workflows/deploy-pr-staging.yml b/.github/workflows/deploy-pr-staging.yml
index 50e24ba..d46f9e9 100644
--- a/.github/workflows/deploy-pr-staging.yml
+++ b/.github/workflows/deploy-pr-staging.yml
@@ -15,6 +15,18 @@ on:
         description: 'Number of PR to deploy (only digits, e.g., 2889). Required only for PR deploy.'
         required: false
         type: string
+      billing_url:
+        description: 'Billing base URL override (e.g. https://billing1-dev.cloud.tld.ee)'
+        required: false
+        type: string
+      registrant_url:
+        description: 'Registrant base URL override (e.g. https://registrant1-dev.cloud.tld.ee)'
+        required: false
+        type: string
+      eeidmanager_url:
+        description: 'EEID Manager base URL override (e.g. https://eeidmanager1-dev.cloud.tld.ee)'
+        required: false
+        type: string
 
 permissions:
   id-token: write
@@ -98,6 +110,11 @@ jobs:
               "image_tag": "${{ steps.docker_build.outputs.IMAGE_TAG }}",
               "namespace": "eppproxy",
               "pr_number": "${{ inputs.deploy_target == 'master' && '0' || inputs.pr_number }}",
-              "source_repo": "internetee/epp_proxy"
+              "source_repo": "internetee/epp_proxy",
+              "url_overrides": {
+                "billing_url": "${{ inputs.billing_url }}",
+                "registrant_url": "${{ inputs.registrant_url }}",
+                "eeidmanager_url": "${{ inputs.eeidmanager_url }}"
+              }
             }
             
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index 4449579..6968d4f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,3 +20,7 @@ rebar3.crashdump
 
 config/dev.config
 apps/epp_proxy/priv/test_backend_app/pidfile
+
+# repowise local index and generated notes
+.repowise/
+docs/
diff --git a/Dockerfile b/Dockerfile
index a5e36b1..f741ebe 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,12 +3,14 @@ FROM debian:bullseye-slim
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 COPY ./docker/apt/sources.list /etc/apt/
 
+# Snapshot/EOL suites ship Release files whose Valid-Until has passed.
+RUN echo 'Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/99archive
+
 # Install all dependencies in a single layer to reduce image size
 RUN apt-get update && apt-get install -y -qq \
   wget \
   git \
   build-essential \
-  libncurses5-dev \
   automake \
   autoconf \
   curl \
@@ -22,7 +24,6 @@ RUN apt-get update && apt-get install -y -qq \
   perl \
   procps \
   inotify-tools \
-  libssl1.1 \
   perl-base \
   zlib1g-dev \
   # Additional dependencies for Erlang build
diff --git a/Dockerfile.release.legacy b/Dockerfile.release.legacy
index c0d68f6..f7c51eb 100644
--- a/Dockerfile.release.legacy
+++ b/Dockerfile.release.legacy
@@ -3,6 +3,7 @@ COPY . ./scr/
 
 WORKDIR /opt/erlang/epp_proxy/scr
 
+RUN asdf install rebar 3.15.2 && asdf global rebar 3.15.2
 RUN rebar3 as prod release
 
 FROM internetee/erlang-ruby:21.3.8-2.6.3
diff --git a/Dockerfile.staging b/Dockerfile.staging
index a5e36b1..80fd6da 100644
--- a/Dockerfile.staging
+++ b/Dockerfile.staging
@@ -3,6 +3,10 @@ FROM debian:bullseye-slim
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 COPY ./docker/apt/sources.list /etc/apt/
 
+# The pinned snapshot mirror that still carries the bullseye security pool
+# serves a Release that is past its Valid-Until.
+RUN echo 'Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/99archive
+
 # Install all dependencies in a single layer to reduce image size
 RUN apt-get update && apt-get install -y -qq \
   wget \
diff --git a/Dockerfile.test b/Dockerfile.test
index 8aa2c54..cf84e8d 100644
--- a/Dockerfile.test
+++ b/Dockerfile.test
@@ -3,6 +3,10 @@ FROM debian:bullseye-slim
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 COPY ./docker/apt/sources.list /etc/apt/
 
+# The pinned snapshot mirror that still carries the bullseye security pool
+# serves a Release that is past its Valid-Until.
+RUN echo 'Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/99archive
+
 # Install all dependencies in a single layer to reduce image size
 RUN apt-get update && apt-get install -y -qq \
   wget \
diff --git a/apps/.DS_Store b/apps/.DS_Store
index 10e9414..84bc4f8 100644
Binary files a/apps/.DS_Store and b/apps/.DS_Store differ
diff --git a/docker/apt/sources.list b/docker/apt/sources.list
index 4b137ea..0eb13b8 100644
--- a/docker/apt/sources.list
+++ b/docker/apt/sources.list
@@ -1,7 +1,9 @@
+# Debian 11 (bullseye) is EOL: the bullseye-security *pool* has been purged from
+# deb.debian.org / security.debian.org (indices remain, .deb files return 404) and
+# it has not been published on archive.debian.org yet. The base image already has
+# security-patched libc6/libssl1.1/perl-base installed, so a main-only source list
+# makes every "-dev" package unsatisfiable ("held broken packages").
+# Therefore: main + updates from the CDN, security from a pinned snapshot.
 deb http://deb.debian.org/debian/ bullseye main contrib non-free
-deb http://deb.debian.org/debian-security/ bullseye-security main contrib non-free
 deb http://deb.debian.org/debian/ bullseye-updates main contrib non-free
-
-# Legacy
-# deb http://deb.debian.org/debian/ buster main contrib non-free
-# deb http://deb.debian.org/debian/ buster-backports main contrib non-free
+deb http://snapshot.debian.org/archive/debian-security/20260824T000000Z bullseye-security main contrib non-free