diff --git a/services/homebox.sh b/services/homebox.sh
index 8c71238..3fe95c1 100644
--- a/services/homebox.sh
+++ b/services/homebox.sh
@@ -301,6 +301,16 @@ networks:
 "
     fi
 
+    # Required since a newer homebox release, not optional — confirmed
+    # live: without it the container panics on every start ("auth.
+    # api_key_pepper must be set to at least 32 bytes") and crash-loops.
+    # generate_password's default alphanumeric output is 1 byte/char, so
+    # 48 chars comfortably clears the 32-byte minimum. Rotating this later
+    # invalidates every issued API key, per homebox's own panic message —
+    # generated once here, never touched again on a rerun.
+    local HB_PEPPER
+    HB_PEPPER="$(generate_password 48)"
+
     cat > docker-compose.yml << HB_COMPOSE
 name: $CONTAINER
 
@@ -313,6 +323,7 @@ services:
     environment:
       - HBOX_LOG_LEVEL=info
       - HBOX_WEB_MAX_UPLOAD_SIZE=10
+      - HBOX_AUTH_API_KEY_PEPPER=\${HBOX_AUTH_API_KEY_PEPPER}
     volumes:
       - ./data:/data
     ports:
@@ -322,7 +333,11 @@ HB_COMPOSE
 
     cat > .env << HB_ENV
 CADDY_NET=$SITE_CADDY_NET
+
+# Rotating this invalidates every issued API key.
+HBOX_AUTH_API_KEY_PEPPER=$HB_PEPPER
 HB_ENV
+    chmod 600 .env
 
     chown -R "$ACTUAL_USER:$ACTUAL_USER" "$HB_DIR"
 
diff --git a/services/koha.sh b/services/koha.sh
index ecd5db0..591926c 100644
--- a/services/koha.sh
+++ b/services/koha.sh
@@ -440,10 +440,16 @@ ${_CADDY_NET_ENTRY}
     hostname: koha-db
     restart: unless-stopped
     environment:
-      MYSQL_ROOT_PASSWORD: \${DB_ROOT_PASS}
-      MYSQL_DATABASE: koha_default
-      MYSQL_USER: koha_default
-      MYSQL_PASSWORD: \${DB_PASS}
+      # MARIADB_* not MYSQL_* — confirmed live, this image version's
+      # entrypoint doesn't recognize MYSQL_ROOT_PASSWORD as any of its
+      # accepted root-password options at all ("Database is uninitialized
+      # and password option is not specified"), so the container crash-
+      # loops even though DB_ROOT_PASS is correctly generated and present
+      # in .env the whole time. Switched all four for consistency.
+      MARIADB_ROOT_PASSWORD: \${DB_ROOT_PASS}
+      MARIADB_DATABASE: koha_default
+      MARIADB_USER: koha_default
+      MARIADB_PASSWORD: \${DB_PASS}
     volumes:
       - ./data:/var/lib/mysql
     networks:
diff --git a/services/vaultwarden.sh b/services/vaultwarden.sh
index 7509eee..1cb635e 100644
--- a/services/vaultwarden.sh
+++ b/services/vaultwarden.sh
@@ -324,6 +324,17 @@ install_vaultwarden() {
         prompt_text "SMTP from address:" "" SMTP_FROM
         prompt_text "SMTP username:" "" SMTP_USER
         prompt_text "SMTP password:" "" SMTP_PASS
+        # Vaultwarden refuses to start at all if SMTP_HOST is set without
+        # SMTP_FROM ("Both SMTP_HOST and SMTP_FROM need to be set") —
+        # confirmed live, crash-loops on every start, not just a warning at
+        # runtime. SMTP_FROM's own prompt has no default, so leaving it
+        # blank here writes exactly that broken half-state. Disable SMTP
+        # entirely rather than let it reach a config known to crash the
+        # container — better than guessing a from-address on your behalf.
+        if [ -z "$SMTP_FROM" ]; then
+            log_warning "No SMTP from address entered — disabling SMTP entirely (Vaultwarden requires both or neither). Re-run this installer to set it up later."
+            SMTP_HOST=""; SMTP_PORT="587"; SMTP_USER=""; SMTP_PASS=""
+        fi
     fi
 
     # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):