diff --git a/apps/bitcoin-ui/manifest.yml b/apps/bitcoin-ui/manifest.yml
index 6fb05656..fc96095b 100644
--- a/apps/bitcoin-ui/manifest.yml
+++ b/apps/bitcoin-ui/manifest.yml
@@ -43,6 +43,10 @@ app:
       protocol: tcp
       bind: 127.0.0.1
       auth: gated
+      # First-party companion UI: its nginx forwards the node session cookie
+      # to the daemon's authenticated endpoints; without passthrough the gate
+      # strips it and every data call 401s while the page shell renders.
+      session_passthrough: true
 
   volumes:
     # Bind-mount the rendered nginx.conf read-only. The prod orchestrator
diff --git a/apps/electrs-ui/manifest.yml b/apps/electrs-ui/manifest.yml
index 4f224565..d1bff168 100644
--- a/apps/electrs-ui/manifest.yml
+++ b/apps/electrs-ui/manifest.yml
@@ -35,6 +35,10 @@ app:
       protocol: tcp
       bind: 127.0.0.1
       auth: gated
+      # First-party companion UI: its nginx forwards the node session cookie
+      # to the daemon's authenticated endpoints; without passthrough the gate
+      # strips it and every data call 401s while the page shell renders.
+      session_passthrough: true
 
   volumes: []
 
diff --git a/apps/fips-ui/manifest.yml b/apps/fips-ui/manifest.yml
index e16c49f9..c4c8474a 100644
--- a/apps/fips-ui/manifest.yml
+++ b/apps/fips-ui/manifest.yml
@@ -39,6 +39,10 @@ app:
       protocol: tcp
       bind: 127.0.0.1
       auth: gated
+      # First-party companion UI: its nginx forwards the node session cookie
+      # to the daemon's authenticated endpoints; without passthrough the gate
+      # strips it and every data call 401s while the page shell renders.
+      session_passthrough: true
 
   volumes: []
 
diff --git a/apps/indeedhub-redis/manifest.yml b/apps/indeedhub-redis/manifest.yml
index c9997b0a..a2b84c29 100644
--- a/apps/indeedhub-redis/manifest.yml
+++ b/apps/indeedhub-redis/manifest.yml
@@ -22,7 +22,13 @@ app:
     memory_limit: 256Mi
 
   security:
-    capabilities: [SETGID, SETUID]
+    # The alpine entrypoint runs as container-root, `find`s /data to chown
+    # anything not owned by the redis user, then su-execs to it. Under the
+    # orchestrator's --cap-drop=ALL, root cannot traverse the 0700
+    # appendonlydir owned by uid 999 without DAC_OVERRIDE (observed
+    # crash-looping ~4k restarts on archi-dev-box) — CHOWN is what the find's
+    # -exec chown needs on adopted legacy data.
+    capabilities: [CHOWN, DAC_OVERRIDE, SETGID, SETUID]
     readonly_root: false
     network_policy: isolated
 
diff --git a/apps/lnd-ui/manifest.yml b/apps/lnd-ui/manifest.yml
index cf186bcf..397f1b0b 100644
--- a/apps/lnd-ui/manifest.yml
+++ b/apps/lnd-ui/manifest.yml
@@ -47,6 +47,10 @@ app:
       protocol: tcp
       bind: 127.0.0.1
       auth: gated
+      # First-party companion UI: its nginx forwards the node session cookie
+      # to the daemon's authenticated endpoints; without passthrough the gate
+      # strips it and every data call 401s while the page shell renders.
+      session_passthrough: true
 
   volumes: []