diff --git a/ci/scripts/common/bump_version.sh b/ci/scripts/common/bump_version.sh
index c179872..f33acc4 100755
--- a/ci/scripts/common/bump_version.sh
+++ b/ci/scripts/common/bump_version.sh
@@ -83,6 +83,7 @@ normalize_machine() {
     s#^[[:alpha:]][[:alnum:]+.-]*://##;
     s#^[^@]*@##;
     s#/.*$##;
+    s#:[0-9]+$##;
   '
 }
 
@@ -95,6 +96,8 @@ if [ -z "${NETRC_MACHINE}" ] && [ -n "${REMOTE_URL}" ]; then
 fi
 
 if [ -n "${NETRC_MACHINE}" ] && [ -n "${NETRC_USERNAME}" ] && [ -n "${NETRC_PASSWORD}" ]; then
+  MASKED_USER="$(printf '%s' "${NETRC_USERNAME}" | cut -c1-2)***"
+  echo "[bump-version] configuring credentials for ${NETRC_MACHINE} (user ${MASKED_USER})"
   NETRC_FILE="${HOME:-/root}/.netrc"
   {
     printf 'machine %s\n' "${NETRC_MACHINE}"
@@ -102,7 +105,8 @@ if [ -n "${NETRC_MACHINE}" ] && [ -n "${NETRC_USERNAME}" ] && [ -n "${NETRC_PASS
     printf 'password %s\n' "${NETRC_PASSWORD}"
   } > "${NETRC_FILE}"
   chmod 600 "${NETRC_FILE}"
-  echo "[bump-version] configured credentials for ${NETRC_MACHINE}"
+else
+  echo "[bump-version] no netrc credentials available"
 fi
 
 if [ -n "${REMOTE_URL}" ]; then
diff --git a/frontend/pshared/lib/.DS_Store b/frontend/pshared/lib/.DS_Store
new file mode 100644
index 0000000..bb09868
Binary files /dev/null and b/frontend/pshared/lib/.DS_Store differ
diff --git a/frontend/pshared/lib/api/.DS_Store b/frontend/pshared/lib/api/.DS_Store
new file mode 100644
index 0000000..0b15936
Binary files /dev/null and b/frontend/pshared/lib/api/.DS_Store differ
diff --git a/frontend/pshared/lib/models/.DS_Store b/frontend/pshared/lib/models/.DS_Store
new file mode 100644
index 0000000..f9c58c7
Binary files /dev/null and b/frontend/pshared/lib/models/.DS_Store differ
diff --git a/frontend/pweb/caddy/Caddyfile b/frontend/pweb/caddy/Caddyfile
index 7d7e91a..84a79f7 100644
--- a/frontend/pweb/caddy/Caddyfile
+++ b/frontend/pweb/caddy/Caddyfile
@@ -11,8 +11,6 @@
 ########################################
 (sendico_site) {
   vars static_root /usr/share/pweb
-  # Allow overriding upstream via API_UPSTREAM, default to the BFF container.
-  vars api_upstream {$API_UPSTREAM:sendico-bff:8081}
 
   encode zstd gzip
 
@@ -25,7 +23,8 @@
     # Backend API
     ########################################
     handle /api/v1/* {
-      reverse_proxy {vars.api_upstream} {
+      # Allow overriding upstream via API_UPSTREAM, default to the BFF container.
+      reverse_proxy {$API_UPSTREAM:sendico-bff:8081} {
         health_uri /api/v1/health
         health_interval 15s
         health_timeout 4s