diff --git a/SHA256SUMS b/SHA256SUMS
index e7e6e27..31a6121 100644
--- a/SHA256SUMS
+++ b/SHA256SUMS
@@ -2,11 +2,11 @@
 4140a2956264b44f259e6a37fc00ba02097bbe68b09296e04d3d243c1287129b  .env.example
 9e6356475bf587091bab72246ec9e325b498f7e48a6220e9a18baa50d0a385a6  .gitignore
 ad2dc4d62a754442b775ee92f725ee39c68795ff75052cb75d797a95420b7fa2  AGENTS.md
-4e8ca84fb8efe1294e92f3c02ab23dcf9bd2b3924eb2959d771e35ef16411d16  CHANGELOG.md
+296249d11082fa03f00d2075755892ada315b190dc88b9dc0e02cc35b716a387  CHANGELOG.md
 9076d0c433202e776b22c667d3ba694f5110a182bbea65931026fc8fe7bc7a13  Cargo.lock
 9709ce361cf2855ff2aa9ad099764b276e81e87f04feb045160b10f575b04f0c  Cargo.toml
 25c7f3c8162cbf5cc156439774118a81dae9fdc52b611ec7e40c230fc99a772c  Dockerfile
-cdea894a8559ea02cc6d22b6defa43c1c46c1d0f591b00090ffc938d80527d8c  README.md
+f9f9466a7f3dbe89e6d538bfd6a23a3b9e53fae41db34947672d5b3854ede03d  README.md
 ae6d14ada6fde7d0b8514840b821678418cf5b1816c18434e3b7fb2ae27a0b21  ROADMAP.md
 da8311e3db945290666324a2f24bf4521b365272d7ac3f862ded1be993eea646  UPDATE_CHECK.toml
 f645f218dd062bf6cb54a8ee634290562cad364a4cccf09f16e3c8303582af8c  build.rs
@@ -76,8 +76,8 @@ cb01fdef286f38b442dd9252c23c4f8e44eb72e9ecdd99adb926e8e9f6318bb1  integrations/r
 96563a83e87cfb33e238c2a970ce36b1a1b51e91318d09b123c3755002ba2646  integrations/routeros-oci-build/build-routeros-oci.sh
 3f267cafa16006e5456ade78ee2d5fae02cc7ce747839523068ffd8d7c98798a  integrations/routeros-oci-build/docker-entrypoint.sh
 13189fa546c3488dddd8efc80c47f6da5241e5fc28b79cbfe795414ea05c7a4f  langs/README.md
-30eafa6d04fe09c9193e495599bb90184ed7ca4b23d960f711aed4ecf477edb6  langs/en_US.json
-58415a9b4e6380c4a34d505f274d0ab26325b4ff52fd2825e081e4dd00ba55c4  langs/pl_pl.json
+62288f4a3a0f2fccee695560f15fdc0fc0f86d2feb4f567e4d3bcf47f05af999  langs/en_US.json
+17c4009784455aaaa8d62d3dd0f7ba70631af2364b54684bacc53b76acb07e31  langs/pl_pl.json
 a99ad040be10fa028351e290b9363236b3513a1cadbdc9fb9e0260d517b9b0ae  make_zip.py
 e830d37dd1f81a4b0aa7d535f5bba69e34e433b0fd99cc8ee0b296786c32379a  migrations/0002_admin.sql
 20112cc82192098b8d602f1c4f7ca08712e9e1366c845fabb92753187c370d35  migrations/0003_certificate_renewals.sql
@@ -159,7 +159,7 @@ ae6cc6020b896a54b9ba2dcbc0fbed9f13d289ebd7ef8804008386fca8533e85  src/admin/rout
 c97881b17b7a42511868b0e48e2f25aab6fb5b613d538f5e1f1967508454e486  src/admin/status_system.rs
 cadd7dca29b9aad8c77c7bc23dd249ea37a15adfa4d636a8ef00273a91ce35dc  src/admin/tail.rs
 5e52252a8e886d8e28eed1d456cdfb7387ea6a193007043662889ff366f6d6f5  src/admin/tests.rs
-37cd17ebe7bdc01188ad9fb4941a3e0821eea19b08b6a45cee9650d56bf8301c  src/admin/web/acl-picker.js
+c18c369124368f58524652565102817ed69fd25b222b0c5e737ef7632b45dcfb  src/admin/web/acl-picker.js
 48fcd818c522fe80f2c7b2e218f87de6a7772ffd0a24e93502780b03ec78e335  src/admin/web/acme.js
 86abf50f39862d821cd2e43ca425671aa85289272915132c5a9a5dd1fc4182e2  src/admin/web/api-tokens.js
 c0d08c5b8fc13dec9bf53fd842d224b9df3874fc3bdf31413e3ab182a8cec2aa  src/admin/web/app/backend-dashboard.js
@@ -186,7 +186,7 @@ f1a764691f3e2cdb7c6c43e37dae78249561c017a1b74e973a378cb780b72835  src/admin/web/
 560a8e047182fbcee08aa4f8d999400a8a5ddca0b6a4640efd46f6b5c34fde91  src/admin/web/dashboard-defaults.json
 14213011cfb6ac334c8711b76bbdde97588a7b7ba4eb2592a1e387f877d6cbe0  src/admin/web/dashboard-widgets.json
 50d1ebcbaf4d0b2968da23bb943fc3f67131c5d32df3f61d23ff37aad9da5b81  src/admin/web/demo.html
-5addc619f310623ff62be1dd4169b2e83328770f542e76b8cef01399f1c43b8f  src/admin/web/docker.js
+0c010eb6d463b34f13f98a647ee763ea087112042c1486f577ba6e7025ebf342  src/admin/web/docker.js
 d4aef376cb44b2a13174dca1cb9383f64c04b0b93279f4f0b4805e76002548a1  src/admin/web/docs.css
 aeffd403fa1823df7d9fa4c48280b4033b2d15e4cb9f66608caff89290de0a52  src/admin/web/docs.html
 6adb291fcc98d516fd9745d9673db16e408854a32cbf41335ae956bda11d46de  src/admin/web/docs.js
@@ -219,11 +219,11 @@ a8afc6e70950bc70b98725eb049d73cff35dc3a3ee659229a15a8e08d3eb4f12  src/admin/web/
 17784875e475d6df42964d7ecfe50ca82b74bad0e942342bc17537e727224796  src/admin/web/settings.js
 8eadbada619b15087783dcfa0e889a81f88e78034d084c5ab616f7912b835940  src/admin/web/status_200.html
 c13cffe18a616fe5faa5ee945ab0d94d8d392ae8f32474c62fe41010e063ddb1  src/admin/web/streams.js
-1629afe7e3bbf9f4a511de240f9056c51a8b8962c3ea63cd71d29e2fb5b5f350  src/admin/web/style.css
+2a3c6382a3a65625654c5117f205b062a50e6c6a2b7e0bbaea7b009d786db63c  src/admin/web/style.css
 d290c048450655b3eeae7c6ec54a82d645d1965513694ab29fdf7eef796a1abd  src/admin/web/traffic-panel.js
 dfb4ded2fefb90fc1e2d33370cdef10b040a85cb43235ea9dbc1d73bef823a79  src/admin/web/transform-panel.js
 fde265c3cdc902f81b6400193d9679e738539f64dee29bb857801b13cbeed8fd  src/admin/web/vhosts/core.js
-408f2890f4de6c51b0a9c2da55ad0818716f3f21f799fe1de3db7139ca94e656  src/admin/web/vhosts/editor.js
+7a124b972a43b19184cf060ff85244fc9f7c4e0ef9b1bf28dbcb7c9b6dff391f  src/admin/web/vhosts/editor.js
 8338ce13b5e3e3f421437631124cb691aeb5b9e17409d256b4b9bcac457b3c59  src/admin/web/vhosts/health.js
 b3239e67901f1796d7a974ade0796f2e3590ff8064628a5629b78c7f6ce2f32e  src/admin/web/vhosts/protocol.js
 2170cfddf5c611672de34b0525d36ade8fcbe459cc21269281d6b615d8601b93  src/admin/web/vhosts/rates.js
diff --git a/langs/en_US.json b/langs/en_US.json
index f92bf3b..640472a 100644
--- a/langs/en_US.json
+++ b/langs/en_US.json
@@ -1089,10 +1089,8 @@
     "aclPickerDefaultDeny": "Default DENY",
     "aclPickerBlockedCountries": "Block country",
     "aclPickerAllowedCountries": "Allow country",
-    "dockerCertSection": "Frontend TLS certificate",
-    "dockerCertMismatchRisk": "Risk accepted",
     "dockerCertMismatchUnavailable": "To accept a mismatch, select a named frontend certificate in Docker agent settings. The inherited default certificate needs no override.",
-    "dockerFrontendProtocols": "Frontend protocols",
+    "dockerFrontendProtocols": "Protocols",
     "dockerFrontendProtocolsHelp": "Per Docker vhost; requires support on the agent-selected listeners. Does not change the backend HTTP/HTTPS scheme.",
     "dockerHttp1Always": "Always available",
     "dockerHttp2Enabled": "HTTP/2 (H2)",
diff --git a/langs/pl_pl.json b/langs/pl_pl.json
index 9d4fc9f..dacd515 100644
--- a/langs/pl_pl.json
+++ b/langs/pl_pl.json
@@ -1089,10 +1089,8 @@
     "aclPickerDefaultDeny": "Domyślnie BLOKUJ",
     "aclPickerBlockedCountries": "Blokuj kraj",
     "aclPickerAllowedCountries": "Zezwól kraj",
-    "dockerCertSection": "Certyfikat TLS frontendu",
-    "dockerCertMismatchRisk": "Ryzyko zaakceptowane",
     "dockerCertMismatchUnavailable": "Aby wymusić niezgodność, wybierz konkretny certyfikat w ustawieniach agenta Docker. Dziedziczony certyfikat domyślny nie wymaga wyjątku.",
-    "dockerFrontendProtocols": "Protokoły frontendu",
+    "dockerFrontendProtocols": "Protokoły",
     "dockerFrontendProtocolsHelp": "Ustawienie dla tego Docker Vhosta, zależne od wybranych listenerów agenta. Nie zmienia HTTP/HTTPS do kontenera.",
     "dockerHttp1Always": "Zawsze dostępny",
     "dockerHttp2Enabled": "HTTP/2 (H2)",
diff --git a/src/admin/web/docker.js b/src/admin/web/docker.js
index 470f286..5258cb8 100644
--- a/src/admin/web/docker.js
+++ b/src/admin/web/docker.js
@@ -335,36 +335,24 @@
     const compressionEnabled = input("", "checkbox", "docker-compression-enabled"); compressionEnabled.checked = assignment?.compression_enabled !== false; const compressionField = checkboxField("dockerCompression", compressionEnabled); compressionField.title = t("dockerCompressionHelp");
     const switches = el("div", undefined, "docker-switch-row"); switches.append(preserveLabel, forceSslField, websocketField, cacheField, compressionField, transformField);
     const certMismatch = input("", "checkbox", "docker-cert-mismatch"); certMismatch.checked = assignment?.allow_certificate_mismatch === true;
-    const mismatchField = checkboxField("dockerCertMismatchForce", certMismatch);
-    const mismatchHelp = el("p", t("dockerCertMismatchWarning"), "fine acl-stack-warning");
-    const mismatchUnavailable = el("p", t("dockerCertMismatchUnavailable"), "fine");
-    const riskPill = el("span", t("dockerCertMismatchRisk"), "acl-picker-policy is-deny docker-cert-risk-pill");
-    const syncMismatch = () => {
-      certMismatch.disabled = !agent.certificate_id;
-      if (!agent.certificate_id) certMismatch.checked = false;
-      mismatchHelp.hidden = !certMismatch.checked;
-      mismatchUnavailable.hidden = !!agent.certificate_id;
-      riskPill.hidden = !certMismatch.checked;
-    };
-    certMismatch.addEventListener("change", syncMismatch);
-    mismatchField.append(mismatchHelp, mismatchUnavailable);
+    certMismatch.disabled = !agent.certificate_id;
+    if (certMismatch.disabled) certMismatch.checked = false;
+    const mismatchLabel = el("label", undefined, "check");
+    mismatchLabel.append(certMismatch, el("span", t("dockerCertMismatchForce")));
+    mismatchLabel.title = t(certMismatch.disabled ? "dockerCertMismatchUnavailable" : "dockerCertMismatchWarning");
     const certificateBar = el("div", undefined, "docker-service-certificate-bar");
-    const tlsControl = el("div", undefined, "docker-service-certificate-control");
-    const tlsHeading = el("div", undefined, "docker-service-certificate-title");
-    tlsHeading.append(el("strong", t("dockerCertSection")), riskPill);
-    tlsControl.append(tlsHeading, mismatchField); certificateBar.append(tlsControl);
-    syncMismatch();
+    certificateBar.append(mismatchLabel);
 
     const h2Enabled = input("", "checkbox", "docker-http2-enabled"); h2Enabled.checked = assignment?.http2_enabled !== false;
-    const h3Enabled = input("", "checkbox", "docker-http3-enabled"); h3Enabled.checked = assignment?.http3_enabled !== false;
-    const protocolBox = el("section", undefined, "docker-protocol-panel");
-    const protocolHeading = el("div", undefined, "docker-protocol-heading");
-    protocolHeading.append(el("strong", t("dockerFrontendProtocols")), el("small", t("dockerFrontendProtocolsHelp"), "fine"));
+    // New publications default to H3 off; legacy assignments keep their saved behavior.
+    const h3Enabled = input("", "checkbox", "docker-http3-enabled"); h3Enabled.checked = assignment ? assignment.http3_enabled !== false : false;
+    const protocolBox = el("details", undefined, "docker-protocol-editor"), protocolSummary = el("summary");
+    protocolSummary.append(el("span", t("dockerFrontendProtocols")), el("small", t("dockerFrontendProtocolsHelp"), "fine"));
     const protocolOptions = el("div", undefined, "docker-protocol-options");
     const h1 = el("span", undefined, "docker-protocol-fixed");
     h1.append(el("strong", "HTTP/1.1"), el("small", t("dockerHttp1Always"), "fine"));
     protocolOptions.append(h1, checkboxField("dockerHttp2Enabled", h2Enabled), checkboxField("dockerHttp3Enabled", h3Enabled));
-    protocolBox.append(protocolHeading, protocolOptions);
+    protocolBox.append(protocolSummary, protocolOptions);
     route.append(labeled("dockerHostname", host, t("dockerHostnameHelp").replace("{domain}", agent.base_domain)), aliases.node, labeled("dockerBackendIp", target), labeled("dockerBackendScheme", scheme), switches);
     editor.append(certificateBar, route, protocolBox, aclEditor(assignment, agent), timeoutEditor(assignment), healthEditor(assignment), passiveHealthEditor(assignment));
     const actions = el("div", undefined, "docker-service-actions"), apply = el("button", t("dockerApplyService"), "outline docker-apply"); apply.type = "button"; apply.disabled = !publish.checked; apply.addEventListener("click", async () => { apply.disabled = true; try { await saveAssignment(agent.id, row, true); } catch (error) { toast(error.message, true); } finally { if (row.isConnected) apply.disabled = !publish.checked; } }); actions.append(apply); editor.append(actions); row.append(editor);
diff --git a/src/admin/web/style.css b/src/admin/web/style.css
index c5df6ae..65f3905 100644
--- a/src/admin/web/style.css
+++ b/src/admin/web/style.css
@@ -5887,12 +5887,14 @@ dialog .window-heading {
     gap: 8px;
 }
 
+.docker-protocol-editor,
 .docker-acl-editor,
 .docker-timeout-editor {
     border-top: 1px solid var(--line);
     padding-top: 9px;
 }
 
+.docker-protocol-editor>summary,
 .docker-acl-editor>summary,
 .docker-timeout-editor>summary {
     cursor: pointer;
@@ -12316,7 +12318,7 @@ html[data-dashboard-density=ultra] #panel-overview .stat-cache-outcomes .cache-m
 }
 
 /* Docker TLS SHA-256 values must wrap even in narrow mobile details cards. */
-.docker-agent-summary > span,
+.docker-agent-summary>span,
 .docker-agent-security-hint,
 .docker-fingerprint {
     min-width: 0;
@@ -12328,15 +12330,28 @@ html[data-dashboard-density=ultra] #panel-overview .stat-cache-outcomes .cache-m
 /* Reusable searchable ACL multi-select: identical in the ordinary vhost editor,
    Docker agent defaults and Docker per-service overrides. All internal corners
    follow the user-selected control radius; fallbacks preserve Original style. */
-.vh-acl-profile-picker, .acl-picker { min-width: 0; width: 100%; }
-.vh-acl-profile-picker > strong { display: block; margin-bottom: 8px; }
+.vh-acl-profile-picker,
+.acl-picker {
+    min-width: 0;
+    width: 100%;
+}
+
+.vh-acl-profile-picker>strong {
+    display: block;
+    margin-bottom: 8px;
+}
+
 .acl-picker-details {
     border: 1px solid var(--field-line);
     background: var(--field-bg);
     border-radius: var(--rp-radius-control, 8px);
     min-width: 0;
 }
-.acl-picker-details[open] { border-color: var(--border-hover); }
+
+.acl-picker-details[open] {
+    border-color: var(--border-hover);
+}
+
 .acl-picker-summary {
     display: flex;
     align-items: center;
@@ -12347,7 +12362,13 @@ html[data-dashboard-density=ultra] #panel-overview .stat-cache-outcomes .cache-m
     user-select: none;
     min-height: 21px;
 }
-.acl-picker-heading { flex: 1 1 auto; font-weight: 600; min-width: 0; }
+
+.acl-picker-heading {
+    flex: 1 1 auto;
+    font-weight: 600;
+    min-width: 0;
+}
+
 .acl-picker-counter {
     color: var(--accent);
     border: 1px solid var(--pill-line);
@@ -12356,15 +12377,28 @@ html[data-dashboard-density=ultra] #panel-overview .stat-cache-outcomes .cache-m
     font: 11px var(--mono);
     margin-left: auto;
 }
-.acl-picker-dropdown { padding: 10px; border-top: 1px solid var(--line); }
-.acl-picker-search, .docker-agent-grid .acl-picker-search {
+
+.acl-picker-dropdown {
+    padding: 10px;
+    border-top: 1px solid var(--line);
+}
+
+.acl-picker-search,
+.docker-agent-grid .acl-picker-search {
     width: 100%;
     box-sizing: border-box;
     min-height: 34px;
     height: 34px;
     margin: 0 0 9px;
 }
-.acl-picker-options { display: grid; max-height: 270px; overflow-y: auto; gap: 5px; }
+
+.acl-picker-options {
+    display: grid;
+    max-height: 270px;
+    overflow-y: auto;
+    gap: 5px;
+}
+
 .acl-picker-option {
     display: flex;
     align-items: flex-start;
@@ -12376,9 +12410,23 @@ html[data-dashboard-density=ultra] #panel-overview .stat-cache-outcomes .cache-m
     cursor: pointer;
     min-width: 0;
 }
-.acl-picker-option:hover, .acl-picker-option:has(input:focus-visible) { border-color: var(--border-hover); }
-.acl-picker-option:has(input:checked) { border-color: var(--pill-live-line); background: var(--nav-selected-bg); }
-.acl-picker-option[hidden], .acl-picker-empty[hidden], .acl-picker-limit[hidden] { display: none !important; }
+
+.acl-picker-option:hover,
+.acl-picker-option:has(input:focus-visible) {
+    border-color: var(--border-hover);
+}
+
+.acl-picker-option:has(input:checked) {
+    border-color: var(--pill-live-line);
+    background: var(--nav-selected-bg);
+}
+
+.acl-picker-option[hidden],
+.acl-picker-empty[hidden],
+.acl-picker-limit[hidden] {
+    display: none !important;
+}
+
 .acl-picker-option input[type=checkbox] {
     flex: 0 0 auto;
     width: 16px !important;
@@ -12386,12 +12434,42 @@ html[data-dashboard-density=ultra] #panel-overview .stat-cache-outcomes .cache-m
     min-height: 16px !important;
     margin: 2px 0 0;
 }
-.acl-picker-option input:disabled { opacity: .35; }
-.acl-picker-option:has(input:disabled) { cursor: not-allowed; opacity: .6; }
-.acl-picker-option-content { display: grid; flex: 1; min-width: 0; gap: 5px; }
-.acl-picker-option-heading { display: flex; flex-wrap: wrap; gap: 5px 9px; align-items: center; }
-.acl-picker-option-heading strong { font-size: 12px; color: var(--text); overflow-wrap: anywhere; }
-.acl-picker-id { font: 10px var(--mono); color: var(--muted); overflow-wrap: anywhere; }
+
+.acl-picker-option input:disabled {
+    opacity: .35;
+}
+
+.acl-picker-option:has(input:disabled) {
+    cursor: not-allowed;
+    opacity: .6;
+}
+
+.acl-picker-option-content {
+    display: grid;
+    flex: 1;
+    min-width: 0;
+    gap: 5px;
+}
+
+.acl-picker-option-heading {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 5px 9px;
+    align-items: center;
+}
+
+.acl-picker-option-heading strong {
+    font-size: 12px;
+    color: var(--text);
+    overflow-wrap: anywhere;
+}
+
+.acl-picker-id {
+    font: 10px var(--mono);
+    color: var(--muted);
+    overflow-wrap: anywhere;
+}
+
 .acl-picker-policy {
     font: 10px var(--mono);
     line-height: 1.4;
@@ -12401,8 +12479,17 @@ html[data-dashboard-density=ultra] #panel-overview .stat-cache-outcomes .cache-m
     color: var(--muted);
     white-space: nowrap;
 }
-.acl-picker-policy.is-deny { border-color: var(--danger-line); color: var(--red); }
-.acl-picker-policy.is-allow { border-color: var(--pill-live-line); color: var(--green); }
+
+.acl-picker-policy.is-deny {
+    border-color: var(--danger-line);
+    color: var(--red);
+}
+
+.acl-picker-policy.is-allow {
+    border-color: var(--pill-live-line);
+    color: var(--green);
+}
+
 .acl-picker-rule-preview {
     display: block;
     line-height: 1.45;
@@ -12410,7 +12497,15 @@ html[data-dashboard-density=ultra] #panel-overview .stat-cache-outcomes .cache-m
     color: var(--muted);
     font-size: 11px;
 }
-.acl-picker-selected { display: flex; gap: 6px; flex-wrap: wrap; margin: 8px 0 0; min-width: 0; }
+
+.acl-picker-selected {
+    display: flex;
+    gap: 6px;
+    flex-wrap: wrap;
+    margin: 8px 0 0;
+    min-width: 0;
+}
+
 .acl-picker-tag {
     display: inline-flex;
     align-items: center;
@@ -12422,7 +12517,12 @@ html[data-dashboard-density=ultra] #panel-overview .stat-cache-outcomes .cache-m
     background: var(--nav-selected-bg);
     font-size: 11px;
 }
-.acl-picker-tag > span { overflow-wrap: anywhere; min-width: 0; }
+
+.acl-picker-tag>span {
+    overflow-wrap: anywhere;
+    min-width: 0;
+}
+
 .acl-picker-tag .acl-picker-remove {
     border: none;
     border-radius: var(--rp-radius-control, 50%);
@@ -12434,72 +12534,105 @@ html[data-dashboard-density=ultra] #panel-overview .stat-cache-outcomes .cache-m
     padding: 0;
     cursor: pointer;
 }
-.acl-picker-tag .acl-picker-remove:hover { background: var(--panel2); color: var(--text); }
-.acl-picker-no-selection { font-size: 11px; }
-.acl-picker-limit { display: block; padding-top: 7px; }
-.acl-stack-warning { margin: 8px 0 0; font-size: 11px; line-height: 1.5; color: var(--notice-text); }
-.docker-profile-field { min-width: 0; }
-.docker-acl-grid .docker-profile-field { grid-column: span 2; }
-.docker-agent-grid .docker-profile-field { grid-column: span 2; }
 
-/* Certificate acceptance is an independent, upper-right security control. */
-.docker-service-certificate-bar { display: flex; justify-content: flex-end; margin: 0 0 12px; }
-.docker-service-certificate-control {
-    display: grid;
-    gap: 5px;
-    width: min(100%, 510px);
-    padding: 10px 12px;
-    border: 1px solid var(--notice-line);
-    border-radius: 8px;
-    background: var(--notice-bg);
+.acl-picker-tag .acl-picker-remove:hover {
+    background: var(--panel2);
+    color: var(--text);
+}
+
+.acl-picker-no-selection {
+    font-size: 11px;
+}
+
+.acl-picker-limit {
+    display: block;
+    padding-top: 7px;
+}
+
+.acl-stack-warning {
+    margin: 8px 0 0;
+    font-size: 11px;
+    line-height: 1.5;
+    color: var(--notice-text);
+}
+
+.docker-profile-field {
     min-width: 0;
 }
-.docker-service-certificate-title { display: flex; align-items: center; gap: 9px; }
-.docker-service-certificate-title strong { font-size: 11px; }
-.docker-cert-risk-pill[hidden] { display: none; }
-.docker-service-certificate-control .docker-field > span:first-child { color: var(--text); }
-.docker-service-certificate-control .docker-checkbox-field { gap: 3px; }
-.docker-service-certificate-control .docker-checkbox-field .check { font-size: 11px; }
-.docker-service-certificate-control .acl-stack-warning { color: var(--notice-text); }
-.docker-service-certificate-control .fine[hidden] { display: none; }
-.docker-cert-mismatch { flex: 0 0 auto; }
 
-.docker-protocol-panel {
-    border: 1px solid var(--line);
-    border-radius: 8px;
-    background: var(--panel);
-    padding: 11px 12px;
-    margin: 10px 0 12px;
-    min-width: 0;
+.docker-acl-grid .docker-profile-field {
+    grid-column: span 2;
 }
-.docker-protocol-heading { display: flex; align-items: baseline; flex-wrap: wrap; gap: 5px 12px; margin-bottom: 9px; }
-.docker-protocol-heading strong { font-size: 12px; }
-.docker-protocol-heading small { font-size: 11px; }
-.docker-protocol-options { display: flex; flex-wrap: wrap; gap: 8px; }
-.docker-protocol-options > * {
+
+.docker-agent-grid .docker-profile-field {
+    grid-column: span 2;
+}
+
+.docker-service-certificate-bar {
+    display: flex;
+    justify-content: flex-end;
+}
+
+.docker-protocol-options {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 8px;
+    margin-top: 12px;
+}
+
+.docker-protocol-options>* {
     display: grid;
     align-content: center;
     min-width: 130px;
     flex: 1 1 145px;
-    border-radius: 6px;
+    border-radius: var(--rp-radius-control, 6px);
     border: 1px solid var(--line);
     background: var(--panel2);
     padding: 8px 12px;
     min-height: 49px;
     box-sizing: border-box;
 }
-.docker-protocol-fixed { gap: 4px; }
-.docker-protocol-fixed strong { font-size: 11px; }
-.docker-protocol-fixed small { font-size: 10px; }
-.docker-protocol-options .docker-checkbox-field > span:first-child { color: var(--text); font-size: 11px; }
-.docker-protocol-options .docker-checkbox-field .vh-check { font-size: 11px; }
 
-@media (max-width: 760px) {
-    .docker-acl-grid .docker-profile-field, .docker-agent-grid .docker-profile-field { grid-column: auto; }
-    .docker-service-certificate-control { width: 100%; }
-    .docker-agent-summary > span, .docker-fingerprint { width: 100%; }
-    .acl-picker-option-heading { align-items: flex-start; }
+.docker-protocol-fixed {
+    gap: 4px;
 }
 
-/* Keep the editable SHA-256 input from expanding narrow settings grids. */
-.docker-agent-grid .docker-agent-fingerprint { min-width: 0; width: 100%; box-sizing: border-box; }
+.docker-protocol-fixed strong {
+    font-size: 11px;
+}
+
+.docker-protocol-fixed small {
+    font-size: 10px;
+}
+
+.docker-protocol-options .docker-checkbox-field>span:first-child {
+    color: var(--text);
+    font-size: 11px;
+}
+
+.docker-protocol-options .docker-checkbox-field .vh-check {
+    font-size: 11px;
+}
+
+@media (max-width: 760px) {
+
+    .docker-acl-grid .docker-profile-field,
+    .docker-agent-grid .docker-profile-field {
+        grid-column: auto;
+    }
+
+    .docker-agent-summary>span,
+    .docker-fingerprint {
+        width: 100%;
+    }
+
+    .acl-picker-option-heading {
+        align-items: flex-start;
+    }
+}
+
+.docker-agent-grid .docker-agent-fingerprint {
+    min-width: 0;
+    width: 100%;
+    box-sizing: border-box;
+}
\ No newline at end of file