diff --git a/core/archipelago/src/appgate/mod.rs b/core/archipelago/src/appgate/mod.rs
index d9f01ca9..a3ed00ef 100644
--- a/core/archipelago/src/appgate/mod.rs
+++ b/core/archipelago/src/appgate/mod.rs
@@ -932,7 +932,10 @@ mod tests {
             );
         }
         // Every referenced asset must be one the gate will actually serve.
-        assert!(read_ui_asset("logo-archipelago.svg").is_some() || cfg!(not(debug_assertions)));
+        // The logo is the sidebar A mark (favico-black-v2.svg) since the
+        // 2026-08-05 login-page rework — the old wordmark is off the
+        // allowlist on purpose.
+        assert!(read_ui_asset("favico-black-v2.svg").is_some() || cfg!(not(debug_assertions)));
     }
 
     /// The allowlist is the whole security boundary for asset serving: the
diff --git a/core/container/src/manifest.rs b/core/container/src/manifest.rs
index 09c3f731..7b3fc1ac 100644
--- a/core/container/src/manifest.rs
+++ b/core/container/src/manifest.rs
@@ -1717,9 +1717,17 @@ app:
             }
         }
         exempt.sort();
+        // 25 as of the v1.7.123 port-policy round: bitcoin p2p (8333 ×2),
+        // core-lightning 9736/9835, electrumx 50001, fedimint 8173/8174,
+        // fedimint-gateway 8176/9737, gitea ssh 2222, lightning-stack
+        // 8091/9738/10010, lnd 9735/10009/18080, netbird 3478/8086/8087,
+        // pine TLS 10381 + the three voice ports (10200/10300/10400 — the
+        // disclosed known gap), router SSDP/mDNS 1900/5353. Every one is a
+        // deliberate, rationale-carrying exemption; the release-gate test
+        // stage timed out that cycle, so the count here lagged at 17.
         assert_eq!(
             exempt.len(),
-            17,
+            25,
             "unauthenticated port set changed — review before updating this count: {exempt:?}"
         );
     }