diff --git a/.coderabbit.yaml b/.coderabbit.yaml
index c4e0871db8ff..cdbe5780b8de 100644
--- a/.coderabbit.yaml
+++ b/.coderabbit.yaml
@@ -320,14 +320,17 @@ reviews:
       mode: warning
     issue_assessment:
       mode: warning
-    # `pr-label-sync.yml` reads what the Breaking changes section says; these check whether
-    # what it says is true of the diff, and whether the PR's own QA covers every behaviour it
-    # changes. Both are advisory — nothing here blocks a merge.
+    # `pr-label-sync.yml` reads the checkbox in the Breaking changes section; these check whether
+    # what the author ticked is true of the diff, and whether the PR's own QA covers every behaviour
+    # it changes. Both are advisory — nothing here blocks a merge.
     custom_checks:
       - name: Breaking changes match the diff
         mode: warning
         instructions: |
-          Compare the PR description's "## Breaking changes" section against the actual diff.
+          Compare the checkbox in the PR description's "## Breaking changes" section against the
+          actual diff. A ticked box (`- [x] This PR contains breaking changes`) is the author's
+          declaration that the PR has one; an unticked box declares that it has none. The prose or
+          table under the checkbox is the explanation and does not change the declaration.
 
           Treat a change as breaking if the diff does any of the following:
           - Renames, removes, or retypes a field in an API request or response shape, or changes
@@ -341,15 +344,15 @@ reviews:
           - Changes an exported signature of the public SDK surface in `packages/js-core` or
             `packages/surveys`.
 
-          FAIL if the diff contains at least one of the above and the "Breaking changes" section
-          says "None", is empty, or still holds the unedited template comment. Name the specific
-          file and line that is breaking.
+          FAIL if the diff contains at least one of the above and the checkbox is unticked, or the
+          section is empty or still holds the unedited template comment. Name the specific file and
+          line that is breaking, and ask the author to tick the box.
 
-          FAIL if the section claims a breaking change that has no corresponding change in the diff.
+          FAIL if the checkbox is ticked but no change in the diff matches the list above.
 
-          PASS if the section describes, in a table or in prose, each breaking change present in
-          the diff — `.github/pull_request_template.md` accepts either shape — or if the diff
-          contains none of the above and the section says "None".
+          PASS if the checkbox is ticked and the section documents each breaking change present in
+          the diff, in a table or in prose, or if the checkbox is unticked and the diff contains
+          none of the above — however the author words the explanation underneath.
 
           Return inconclusive rather than failing when the diff alone does not let you determine
           an API response shape — for example when the shape comes from a serializer or type that
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index 3b894a9c0b06..0cb5bb5cfc0b 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -23,15 +23,24 @@ to grasp without opening files. -->
 
 ## Breaking changes
 
-<!-- REQUIRED. Leave "None" if nothing changes for API/SDK consumers or self-hosters. It is breaking
-if it changes an API/SDK shape or emitted value, removes or renames an endpoint, route, env var or
-config key, changes a default or webhook payload, or needs manual migration action. If YES, fill the
-table below — it feeds the release notes and the self-hoster migration guide, and applies the
-`breaking-change` label automatically. -->
+<!-- REQUIRED. Tick the box below if — and only if — this PR breaks something for API/SDK consumers or
+self-hosters. It is breaking if it changes an API/SDK shape or emitted value (e.g. `EN` → `en-US`),
+removes or renames an endpoint, route, env var or config key, changes a default or webhook payload, or
+needs manual migration action.
+
+The checkbox alone drives the label: ticking it applies `breaking-change`, which feeds the release notes
+and the self-hoster migration guide. Leave its wording alone — `pr-label-sync.yml` finds it by that text,
+ignores every other checkbox in this section, and never reads the prose. What you write underneath is
+still read: by reviewers, and by the CodeRabbit "Breaking changes match the diff" check, which compares
+the tick against the diff and expects a ticked box to be explained. Ticked → replace "None" with the
+table below, one row per change, written for an external integrator; not ticked → keep "None" and say in
+a line why. -->
+
+- [ ] This PR contains breaking changes
 
 None
 
-<!-- Delete "None" above and use this table when there IS a breaking change:
+<!-- Delete "None" above and use this table when the box IS ticked:
 | Change | Before | After | Who's affected | Action required |
 | --- | --- | --- | --- | --- |
 | `language` field on responses | `EN`, `DE` | `en-US`, `de-DE` | API v1 consumers | Map the new BCP-47 locale codes in your integration |
diff --git a/.github/workflows/pr-label-sync.yml b/.github/workflows/pr-label-sync.yml
index 23715795e295..e7a1628bed7b 100644
--- a/.github/workflows/pr-label-sync.yml
+++ b/.github/workflows/pr-label-sync.yml
@@ -1,11 +1,11 @@
 name: PR Label Sync
 
-# Keeps PR labels in sync with declared sections in the PR body (see .github/pull_request_template.md).
+# Keeps PR labels in sync with checkboxes in the PR body (see .github/pull_request_template.md).
 # Generic engine: to drive a new label from a new "## <heading>" section, add one entry to RULES
 # below — no other changes needed.
 #
 # Currently configured:
-#   - "Breaking changes" section (a filled table / any content other than "None") -> `breaking-change`
+#   - the checkbox in the "Breaking changes" section -> `breaking-change`
 #     Release notes and the self-hoster migration guide are compiled from the PRs carrying it.
 #
 # Uses pull_request_target because adding a label needs a write-scoped token (incl. fork PRs). This is
@@ -40,48 +40,54 @@ jobs:
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
-            // A section is "declared" when it holds real content — a filled table or prose.
+            // A section drives its label from a GitHub task-list checkbox:
             //
-            // The template asks for a bare "None" when there is nothing to declare, but authors
-            // routinely add a clause: "None — docs only", "N/A", "No breaking changes". Accepting only
-            // the exact word labelled those PRs as breaking, and this label feeds the GitHub release
-            // notes and the self-hoster migration guide, so a false positive is expensive.
+            //     - [x] This PR contains breaking changes
             //
-            // A negative opener alone is not enough to clear the section, because "No breaking changes,
-            // but the response shape changed" declares a real one. So an aside after the opener counts
-            // as "nothing here" only when *every* word in it is a scope word — docs, tests, internal,
-            // only… One unrecognised word (endpoint, renamed, shape) makes the section declared.
+            // Ticked -> the label belongs on the PR. Unticked -> it does not. The prose around the
+            // checkbox is never read, and that is the whole point. The previous version inferred intent
+            // from the section text, so any explanation after "None" ("None — same public API, only
+            // out-of-workspace deletions are refused") read as a declaration and mislabelled the PR.
+            // Deciding is now the author's (or agent's) job, stated in one unambiguous bit; the text can
+            // say whatever it needs to.
             //
-            // That asymmetry is deliberate. A missed breaking change silently omits a migration-guide
-            // entry that self-hosters need; a spurious label is caught by whoever reads the release
-            // notes. So anything the vocabulary does not recognise errs towards labelling, and an
-            // unusual way of writing "nothing here" costs one label removal by hand.
-            const NEGATIVE_OPENER = /^(?:none|n\/?a|not applicable|no breaking changes?)\b/i;
-            const SCOPE_WORD =
-              /^(?:a|and|is|the|this|pr|no|not|nothing|none|n\/?a|applicable|only|just|pure|purely|docs?|documentation|readme|comments?|tests?|ci|chore|refactor(?:ing)?|typos?|styling?|formatting|internal|product|code|changes?)$/i;
+            // The trade-off: a forgotten tick silently omits a migration-guide entry that self-hosters
+            // need, where the old heuristic erred towards a spurious label instead. So the template asks
+            // for a deliberate answer, and PR review is the backstop.
+            //
+            // No checkbox in the section at all -> leave the label alone rather than assume "not
+            // breaking", so a restructured section or a hand-applied label survives.
+            //
+            // Each rule matches its own checkbox by the label text the template ships, rather than
+            // taking the first checkbox in the section: an unrelated item above it ("- [x] I read the
+            // list above") would otherwise flip the label. That couples this workflow to the template's
+            // wording, so a section that holds checkboxes but not *this* one warns rather than passing
+            // silently — the drift is then visible in the run instead of freezing the label.
+            const CHECKBOX_LINE = /^[ \t]*[-*+][ \t]+\[([ xX])\][ \t]*(.*)$/gm;
 
-            const isDeclared = (content) => {
-              const normalized = content
-                .replace(/^\s*[-*+]\s+/, "") // a leading list marker ("- none")
-                .replace(/[*_`]/g, "") // markdown emphasis / code ticks ("**None**")
-                .trim();
-              if (normalized === "") return false;
-              const opener = NEGATIVE_OPENER.exec(normalized);
-              if (!opener) return true;
-              // Split on whitespace and the punctuation that introduces an aside, but not on "/", so
-              // an "N/A" inside the aside survives as one token.
-              const aside = normalized
-                .slice(opener[0].length)
-                .split(/[\s—–:,.;()\[\]-]+/)
-                .filter(Boolean);
-              if (aside.length === 0) return false; // "None", "None.", "N/A"
-              return !(aside.length <= 6 && aside.every((word) => SCOPE_WORD.test(word)));
+            const checkboxFor = (declaration) => (content) => {
+              const boxes = [...content.matchAll(CHECKBOX_LINE)];
+              const box = boxes.find(([, , text]) => declaration.test(text.replace(/[*_`]/g, "").trim()));
+              if (box) return box[1].toLowerCase() === "x";
+              if (boxes.length > 0) {
+                core.warning(
+                  `Found ${boxes.length} checkbox(es) but none matching ${declaration} — the PR ` +
+                    "template and pr-label-sync.yml have drifted. Label left unchanged."
+                );
+              }
+              return null; // no signal in this section
             };
 
             // Label rules. Add an entry to sync a new label from a new "## <heading>" PR-body section.
-            // `isActive(content)` decides whether the label should be present for the given section text.
+            // `isActive(content)` returns true/false to set the label, or null to leave it unchanged.
             const RULES = [
-              { heading: "Breaking changes", label: "breaking-change", isActive: isDeclared },
+              {
+                heading: "Breaking changes",
+                label: "breaking-change",
+                // Prefix, not exact: an author who appends a clause ("… (see the table)") still gets a
+                // working label, while "I read the list above" still does not match.
+                isActive: checkboxFor(/^this pr contains breaking changes/i),
+              },
             ];
 
             const pr = context.payload.pull_request;
@@ -107,6 +113,10 @@ jobs:
                 continue;
               }
               const active = rule.isActive(content);
+              if (active === null) {
+                core.info(`[${rule.label}] no checkbox under "## ${rule.heading}"; leaving unchanged.`);
+                continue;
+              }
               const has = current.has(rule.label);
               if (active && !has) {
                 await github.rest.issues.addLabels({
diff --git a/AGENTS.md b/AGENTS.md
index 38456cfeeb1a..7ad2093e92a5 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -227,6 +227,8 @@ Commits follow a lightweight Conventional Commit format (`fix:`, `chore:`, `feat
 
 Every PR must use `.github/pull_request_template.md` and follow its inline guidance — the template is the source of truth for PR structure. The ticket line at the top is the only place a magic word (`Fixes`, `Ref`, `Closes`) may sit next to a ticket id: Linear and GitHub scan the whole body, so the same pair written in prose — inside backticks too — links and closes that ticket as well. When you need to name the convention in prose, write it without a resolvable id. All QA for a change happens on its own PR before review: the creator shows that every behaviour the diff changes is covered, and lists what is not under `Open gaps`; the reviewer challenges that list and asks for the missing coverage. There is no separate release QA pass per PR — release review only looks for problems arising from the interplay of several changes. Fill every section from the actual diff on PR open, and re-update it in the same turn on every change (new commits, scope or review fixes) so it never drifts — treat a stale section as a bug.
 
+The checkbox under `## Breaking changes` is a decision you own, not a formality: judge the diff against the template's list of breaking changes and tick it (`- [x]`) when one applies, leave it unticked when none does. It is the only input to the `breaking-change` label, which feeds the release notes and the self-hoster migration guide, so a wrong answer either invents a migration entry or hides one. Re-check it whenever the diff grows. `pr-label-sync.yml` reads nothing but the tick, so the prose below the checkbox cannot change the label — but it is not free-form either: the CodeRabbit `Breaking changes match the diff` check compares the tick against the diff and expects a ticked box to document each breaking change, so explain your answer there in whatever shape fits (table or prose).
+
 ## Next.js Documentation
 
 Do not rely on training data for Next.js behavior in this repo. For any Next.js-related work (routing, layouts, server/client components, caching, next.config, etc.), use the `nextjs-docs` skill, which indexes the version-pinned local docs in `.next-docs/`.
diff --git a/apps/web/app/(app)/workspaces/[workspaceId]/settings/account/notifications/components/EditAlerts.tsx b/apps/web/app/(app)/workspaces/[workspaceId]/settings/account/notifications/components/EditAlerts.tsx
index 7eae57adbe5c..6bc32a22d62c 100644
--- a/apps/web/app/(app)/workspaces/[workspaceId]/settings/account/notifications/components/EditAlerts.tsx
+++ b/apps/web/app/(app)/workspaces/[workspaceId]/settings/account/notifications/components/EditAlerts.tsx
@@ -1,11 +1,13 @@
 "use client";
 
+import type { TFunction } from "i18next";
 import { HelpCircleIcon, UsersIcon } from "lucide-react";
 import Link from "next/link";
 import { useTranslation } from "react-i18next";
-import { TUser } from "@formbricks/types/user";
+import { TUser, TUserNotificationSettings } from "@formbricks/types/user";
 import { organizationSettingsPath } from "@/modules/settings/lib/routes";
 import { EmptyState } from "@/modules/ui/components/empty-state";
+import { SettingsTable, type TSettingsTableColumn } from "@/modules/ui/components/settings-table";
 import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "@/modules/ui/components/tooltip";
 import { Membership } from "../types";
 import { NotificationSwitch } from "./NotificationSwitch";
@@ -17,102 +19,149 @@ interface EditAlertsProps {
   autoDisableNotificationElementId: string;
 }
 
+/** A survey to alert on, carrying the workspace it belongs to for the row's sub-line. */
+type TAlertRow = { surveyId: string; surveyName: string; workspaceName: string };
+
+/**
+ * Defined at module level rather than inside the component: an inline `cell` that returns JSX reads as a
+ * nested component definition to Sonar (typescript:S6478). One array serves every organization's table.
+ */
+const getAlertColumns = ({
+  t,
+  notificationSettings,
+  autoDisableNotificationType,
+  autoDisableNotificationElementId,
+}: Readonly<{
+  t: TFunction;
+  notificationSettings: TUserNotificationSettings;
+  autoDisableNotificationType: string;
+  autoDisableNotificationElementId: string;
+}>): TSettingsTableColumn<TAlertRow>[] => [
+  {
+    id: "survey",
+    header: t("common.surveys"),
+    headerClassName: "w-[70%]",
+    skeletonWidth: "w-48",
+    cell: (row) => (
+      <>
+        <div className="font-medium text-slate-900">{row.surveyName}</div>
+        <div className="text-xs text-slate-400">{row.workspaceName}</div>
+      </>
+    ),
+  },
+  {
+    id: "alert",
+    // `inline-flex`, not `flex`: the column is centred with `align`, which only moves inline-level
+    // content. A block-level trigger would ignore it.
+    header: (
+      <TooltipProvider delayDuration={50}>
+        <Tooltip>
+          <TooltipTrigger className="inline-flex cursor-default items-center gap-x-2">
+            <span>{t("workspace.settings.notifications.every_response")}</span>
+            <HelpCircleIcon className="size-4 shrink-0 text-slate-500" />
+          </TooltipTrigger>
+          <TooltipContent>{t("workspace.settings.notifications.every_response_tooltip")}</TooltipContent>
+        </Tooltip>
+      </TooltipProvider>
+    ),
+    headerClassName: "w-[30%]",
+    align: "center",
+    skeletonWidth: "w-10",
+    cell: (row) => (
+      <div className="flex justify-center">
+        <NotificationSwitch
+          surveyOrWorkspaceOrOrganizationId={row.surveyId}
+          notificationSettings={notificationSettings}
+          notificationType={"alert"}
+          autoDisableNotificationType={autoDisableNotificationType}
+          autoDisableNotificationElementId={autoDisableNotificationElementId}
+        />
+      </div>
+    ),
+  },
+];
+
 export const EditAlerts = ({
   memberships,
   user,
   autoDisableNotificationType,
   autoDisableNotificationElementId,
-}: EditAlertsProps) => {
+}: Readonly<EditAlertsProps>) => {
   const { t } = useTranslation();
 
   if (memberships.length === 0) {
     return <EmptyState text={t("common.no_surveys_found")} variant="simple" />;
   }
 
+  const columns = getAlertColumns({
+    t,
+    notificationSettings: user.notificationSettings!,
+    autoDisableNotificationType,
+    autoDisableNotificationElementId,
+  });
+
   return (
     <>
-      {memberships.map((membership) => (
-        <div key={membership.organization.id}>
-          <div className="mb-5 grid grid-cols-6 items-center gap-x-3">
-            <div className="col-span-3 flex items-center gap-x-3">
-              <UsersIcon className="h-6 w-7 text-slate-600" />
+      {memberships.map((membership) => {
+        // One row list per organization: the surveys were nested one level deeper, under workspaces, and
+        // the workspace only contributes a sub-line to each row.
+        const rows: TAlertRow[] = membership.organization.workspaces.flatMap((workspace) =>
+          workspace.surveys.map((survey) => ({
+            surveyId: survey.id,
+            surveyName: survey.name,
+            workspaceName: workspace.name,
+          }))
+        );
 
-              <p className="text-sm font-medium text-slate-800">{membership.organization.name}</p>
-            </div>
+        return (
+          <div key={membership.organization.id}>
+            <div className="mb-5 grid grid-cols-6 items-center gap-x-3">
+              <div className="col-span-3 flex items-center gap-x-3">
+                <UsersIcon className="h-6 w-7 text-slate-600" />
+                <p className="text-sm font-medium text-slate-800">{membership.organization.name}</p>
+              </div>
 
-            <div className="col-span-3 flex items-center justify-end pr-2">
-              <p className="pr-4 text-sm text-slate-600">
-                {t("workspace.settings.notifications.auto_subscribe_to_new_surveys")}
-              </p>
-              <NotificationSwitch
-                surveyOrWorkspaceOrOrganizationId={membership.organization.id}
-                notificationSettings={user.notificationSettings!}
-                notificationType={"unsubscribedOrganizationIds"}
-                autoDisableNotificationType={autoDisableNotificationType}
-                autoDisableNotificationElementId={autoDisableNotificationElementId}
-              />
-            </div>
-          </div>
-          <div className="mb-6 rounded-lg border border-slate-200">
-            <div className="grid h-12 grid-cols-3 content-center rounded-t-lg bg-slate-100 px-4 text-left text-sm font-semibold text-slate-900">
-              <div className="col-span-2 flex items-center">{t("common.surveys")}</div>
-              <TooltipProvider delayDuration={50}>
-                <Tooltip>
-                  <TooltipTrigger>
-                    <div className="col-span-1 flex cursor-default items-center justify-center gap-x-2">
-                      <span>{t("workspace.settings.notifications.every_response")}</span>
-                      <HelpCircleIcon className="size-4 shrink-0 text-slate-500" />
-                    </div>
-                  </TooltipTrigger>
-                  <TooltipContent>
-                    {t("workspace.settings.notifications.every_response_tooltip")}
-                  </TooltipContent>
-                </Tooltip>
-              </TooltipProvider>
+              <div className="col-span-3 flex items-center justify-end pr-2">
+                <p className="pr-4 text-sm text-slate-600">
+                  {t("workspace.settings.notifications.auto_subscribe_to_new_surveys")}
+                </p>
+                <NotificationSwitch
+                  surveyOrWorkspaceOrOrganizationId={membership.organization.id}
+                  notificationSettings={user.notificationSettings!}
+                  notificationType={"unsubscribedOrganizationIds"}
+                  autoDisableNotificationType={autoDisableNotificationType}
+                  autoDisableNotificationElementId={autoDisableNotificationElementId}
+                />
+              </div>
             </div>
 
-            {membership.organization.workspaces.some((workspace) => workspace.surveys.length > 0) ? (
-              <div className="grid-cols-8 space-y-1 p-2">
-                {membership.organization.workspaces.map((workspace) => (
-                  <div key={workspace.id}>
-                    {workspace.surveys.map((survey) => (
-                      <div
-                        className="grid h-auto w-full cursor-pointer grid-cols-3 place-content-center rounded-lg px-2 py-2 text-left text-sm text-slate-900 hover:bg-slate-50"
-                        key={survey.name}>
-                        <div className="col-span-2 text-left">
-                          <div className="font-medium text-slate-900">{survey.name}</div>
-                          <div className="text-xs text-slate-400">{workspace.name}</div>
-                        </div>
-                        <div className="col-span-1 text-center">
-                          <NotificationSwitch
-                            surveyOrWorkspaceOrOrganizationId={survey.id}
-                            notificationSettings={user.notificationSettings!}
-                            notificationType={"alert"}
-                            autoDisableNotificationType={autoDisableNotificationType}
-                            autoDisableNotificationElementId={autoDisableNotificationElementId}
-                          />
-                        </div>
-                      </div>
-                    ))}
-                  </div>
-                ))}
-              </div>
-            ) : (
-              <div className="m-2 flex h-16 items-center justify-center rounded-sm bg-slate-50 text-sm text-slate-500">
-                <p>{t("common.no_surveys_found")}</p>
-              </div>
-            )}
-            <p className="pb-3 pl-4 text-xs text-slate-400">
-              {t("workspace.settings.notifications.want_to_loop_in_organization_mates")}{" "}
-              <Link
-                className="font-semibold"
-                href={organizationSettingsPath(membership.organization.id, "teams")}>
-                {t("common.invite_them")}
-              </Link>
-            </p>
+            {/*
+              `frame="card"` rather than a flush card body: this page stacks one table per organization
+              inside a single settings card, each with its own header block above it, so the tables carry
+              their own frames and the card keeps its padding.
+            */}
+            <SettingsTable
+              columns={columns}
+              rows={rows}
+              getRowId={(row) => row.surveyId}
+              emptyMessage={t("common.no_surveys_found")}
+              frame="card"
+              containerClassName="mb-6"
+              aria-label={membership.organization.name}
+              footer={
+                <p className="pb-3 pl-4 text-xs text-slate-400">
+                  {t("workspace.settings.notifications.want_to_loop_in_organization_mates")}{" "}
+                  <Link
+                    className="font-semibold"
+                    href={organizationSettingsPath(membership.organization.id, "teams")}>
+                    {t("common.invite_them")}
+                  </Link>
+                </p>
+              }
+            />
           </div>
-        </div>
-      ))}
+        );
+      })}
     </>
   );
 };
diff --git a/apps/web/app/(app)/workspaces/[workspaceId]/settings/workspace/tags/layout.tsx b/apps/web/app/(app)/workspaces/[workspaceId]/settings/workspace/tags/layout.tsx
new file mode 100644
index 000000000000..51c9956b30e5
--- /dev/null
+++ b/apps/web/app/(app)/workspaces/[workspaceId]/settings/workspace/tags/layout.tsx
@@ -0,0 +1,8 @@
+import { type ReactNode } from "react";
+import { TagsQueryClientProvider } from "./query-client-provider";
+
+const TagsSettingsLayout = ({ children }: Readonly<{ children: ReactNode }>) => {
+  return <TagsQueryClientProvider>{children}</TagsQueryClientProvider>;
+};
+
+export default TagsSettingsLayout;
diff --git a/apps/web/app/(app)/workspaces/[workspaceId]/settings/workspace/tags/query-client-provider.tsx b/apps/web/app/(app)/workspaces/[workspaceId]/settings/workspace/tags/query-client-provider.tsx
new file mode 100644
index 000000000000..de9b46141457
--- /dev/null
+++ b/apps/web/app/(app)/workspaces/[workspaceId]/settings/workspace/tags/query-client-provider.tsx
@@ -0,0 +1,16 @@
+"use client";
+
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { type ReactNode, useState } from "react";
+
+/**
+ * There is no app-wide `QueryClientProvider` — each route segment that uses TanStack Query mounts its
+ * own, as `surveys/`, `workflows/` and the onboarding template pages do. The tags settings page is the
+ * first query consumer under `settings/`, so it needs one: without it `useTags` throws on render and the
+ * route falls back to the "Error loading resources" boundary.
+ */
+export const TagsQueryClientProvider = ({ children }: Readonly<{ children: ReactNode }>) => {
+  const [queryClient] = useState(() => new QueryClient());
+
+  return <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>;
+};
diff --git a/apps/web/app/api/auth/[...all]/route.test.ts b/apps/web/app/api/auth/[...all]/route.test.ts
index ff258fbd1415..be90526c695c 100644
--- a/apps/web/app/api/auth/[...all]/route.test.ts
+++ b/apps/web/app/api/auth/[...all]/route.test.ts
@@ -1,16 +1,36 @@
 import { beforeEach, describe, expect, test, vi } from "vitest";
+import { getBetterAuthRequestContext } from "@/modules/auth/lib/better-auth-request-context";
 import { GET, POST } from "./route";
 
 // Mock the BA instance + the SSO request-context wrapper so the route's delegation can be asserted
 // without the real auth graph. The wrapper's own AsyncLocalStorage behavior is covered in
 // sso-request-context's tests + the cutover integration check (runbook §4); here we assert the route
 // runs `auth.handler` INSIDE `runWithSsoRequestContext` for both verbs.
+//
+// The observability context (`better-auth-request-context` + `better-auth-path-label`) is deliberately
+// NOT mocked: what needs proving is that this route wires them correctly, and a mock of either would
+// assert the test's own arrangement instead. `api` mirrors the shape route.ts reads the label
+// vocabulary from — each endpoint function carries its declared path.
 const { handlerMock, runWithCtxMock } = vi.hoisted(() => ({
   handlerMock: vi.fn(async () => new Response("ok", { status: 200 })),
   runWithCtxMock: vi.fn((fn: () => unknown) => fn()),
 }));
 
-vi.mock("@/modules/auth/lib/auth", () => ({ auth: { handler: handlerMock } }));
+vi.mock("@/modules/auth/lib/auth", () => ({
+  auth: {
+    handler: handlerMock,
+    api: {
+      getSession: { path: "/get-session" },
+      signInEmail: { path: "/sign-in/email" },
+      resetPassword: { path: "/reset-password" },
+      resetPasswordCallback: { path: "/reset-password/:token" },
+      // A nullish entry, deliberately. The label vocabulary is built at MODULE LOAD from this object,
+      // so `endpoint.path` on a null would throw there and take down every `/api/auth/*` request — the
+      // route, not just the tag. Importing this file at all is what asserts it does not.
+      nullishEndpoint: null,
+    },
+  },
+}));
 vi.mock("@/modules/ee/sso/lib/sso-request-context", () => ({
   runWithSsoRequestContext: runWithCtxMock,
 }));
@@ -55,3 +75,43 @@ describe("[...all] Better Auth route (ENG-1054 cutover)", () => {
     expect(GET).toBe(POST);
   });
 });
+
+// ENG-2259: the Sentry capture in better-auth-observability.ts reads this context, so if the route
+// stops opening it the fault reports with no endpoint again — exactly the state that left
+// FORMBRICKS-183 untriageable at ~242 events.
+describe("[...all] Better Auth route — observability context (ENG-2259)", () => {
+  beforeEach(() => {
+    handlerMock.mockClear();
+    runWithCtxMock.mockClear();
+  });
+
+  const captureContextDuringHandler = async (request: Request) => {
+    let seen: ReturnType<typeof getBetterAuthRequestContext>;
+    handlerMock.mockImplementationOnce(async () => {
+      seen = getBetterAuthRequestContext();
+      return new Response("ok", { status: 200 });
+    });
+    await POST(request);
+    return seen;
+  };
+
+  test("exposes the endpoint label and method to the handler", async () => {
+    const seen = await captureContextDuringHandler(
+      new Request("http://localhost/api/auth/sign-in/email", { method: "POST" })
+    );
+
+    expect(seen).toEqual({ path: "/sign-in/email", method: "POST" });
+  });
+
+  test("never exposes the token from /reset-password/:token", async () => {
+    const token = "faketokenfaketokenfaketoken00001";
+
+    const seen = await captureContextDuringHandler(
+      new Request(`http://localhost/api/auth/reset-password/${token}`, { method: "POST" })
+    );
+
+    // The endpoint is still identified; the credential in its path is not carried anywhere.
+    expect(seen).toEqual({ path: "/reset-password/*", method: "POST" });
+    expect(JSON.stringify(seen)).not.toContain(token);
+  });
+});
diff --git a/apps/web/app/api/auth/[...all]/route.ts b/apps/web/app/api/auth/[...all]/route.ts
index 0f7b36025532..dc30d561c3a1 100644
--- a/apps/web/app/api/auth/[...all]/route.ts
+++ b/apps/web/app/api/auth/[...all]/route.ts
@@ -1,10 +1,25 @@
 import { auth } from "@/modules/auth/lib/auth";
+import { createAuthPathLabeller } from "@/modules/auth/lib/better-auth-path-label";
+import { runWithBetterAuthRequestContext } from "@/modules/auth/lib/better-auth-request-context";
 import { runWithSsoRequestContext } from "@/modules/ee/sso/lib/sso-request-context";
 
 // Force-no-store so Better Auth's outbound SSO fetches (token exchange, userinfo, JWKS) are never
 // served from Next's fetch cache — carried over from the NextAuth [...nextauth] route.
 export const fetchCache = "force-no-store";
 
+/**
+ * Derived once from Better Auth's own endpoint registry (each endpoint function carries its DECLARED
+ * path), so the label vocabulary tracks plugin and version changes with no hand-maintained list — and
+ * a parameterized route can never be emitted with its parameter filled in. See
+ * better-auth-path-label.ts; `/reset-password/:token` is why this is not the raw pathname.
+ */
+// `endpoint?.path`, not `endpoint.path`: this runs at MODULE LOAD in the `/api/auth/*` catch-all, so a
+// single null or undefined entry in `auth.api` would throw here and take down every auth request — the
+// whole route, not just the label. That is the one thing this file must not do for the sake of a Sentry
+// tag (see the same principle in better-auth-request-context.ts). The labeller already ignores any
+// non-string, so a nullish entry degrades that one endpoint to `unknown` instead of breaking sign-in.
+const labelAuthPath = createAuthPathLabeller(Object.values(auth.api).map((endpoint) => endpoint?.path));
+
 /**
  * Better Auth HTTP handler (ENG-1054 cutover) — replaces the NextAuth `[...nextauth]` catch-all (the
  * two cannot coexist: both own `/api/auth/*`). More specific `/api/auth/*` routes (the SAML bridge,
@@ -17,11 +32,21 @@ export const fetchCache = "force-no-store";
  * loud when the context is missing). The store survives the awaited handler because the async work
  * starts synchronously inside `run()`.
  *
+ * `runWithBetterAuthRequestContext` sits OUTSIDE that so it also covers the middleware Better Auth
+ * runs ahead of `hooks.before` (origin check, CSRF, rate limiter): it carries the endpoint label into
+ * the Sentry capture in better-auth-observability.ts, which otherwise reports a bare exception with no
+ * route at all (ENG-2259 / FORMBRICKS-183).
+ *
  * NOTE (S2 / observability): the old route also emitted the failed-`signedIn` audit + Sentry capture
- * on thrown errors. Success audit is covered by `signInAuditDatabaseHook`; the failure path is ported
- * separately via `onAPIError.onError` (+ a before-hook request stash).
+ * on thrown errors. The success audit is covered by `signInAuditDatabaseHook`; the failure audit by
+ * `auditFailedAuthAfter` in `hooks.after`, because a rejected sign-in is a handled `APIError`
+ * *response* rather than a throw. `onAPIError.onError` is deliberately NOT configured: Better Auth
+ * calls it and `return`s (`better-auth/dist/api/index.mjs:194-197`), skipping the logger path
+ * entirely — wiring it would silence the very capture that surfaces genuine internal faults.
  */
 const handler = (request: Request): Promise<Response> =>
-  runWithSsoRequestContext(() => auth.handler(request));
+  runWithBetterAuthRequestContext({ path: labelAuthPath(request.url), method: request.method }, () =>
+    runWithSsoRequestContext(() => auth.handler(request))
+  );
 
 export { handler as GET, handler as POST };
diff --git a/apps/web/app/api/v1/management/surveys/[surveyId]/route.ts b/apps/web/app/api/v1/management/surveys/[surveyId]/route.ts
index 911c3e8550ca..a43410ebc869 100644
--- a/apps/web/app/api/v1/management/surveys/[surveyId]/route.ts
+++ b/apps/web/app/api/v1/management/surveys/[surveyId]/route.ts
@@ -9,6 +9,10 @@ import {
   addLegacyProjectOverwrites,
   normaliseProjectOverwritesToWorkspace,
 } from "@/app/lib/api/api-backwards-compat";
+import {
+  addLegacyEnvironmentId,
+  addLegacyEnvironmentIdBestEffort,
+} from "@/app/lib/api/legacy-environment-id";
 import { RequestBodyTooLargeError, parseJsonBodyWithLimit } from "@/app/lib/api/request-body";
 import { responses } from "@/app/lib/api/response";
 import {
@@ -65,7 +69,9 @@ export const GET = withV1ApiWrapper({
       // consumers get a consistent shape regardless of how the survey was built.
       return {
         response: responses.successResponse(
-          addLegacyProjectOverwrites(resolveStorageUrlsInObject(withDerivedQuestions(result.survey)))
+          await addLegacyEnvironmentId(
+            addLegacyProjectOverwrites(resolveStorageUrlsInObject(withDerivedQuestions(result.survey)))
+          )
         ),
       };
     } catch (error) {
@@ -94,6 +100,8 @@ export const DELETE = withV1ApiWrapper({
     if (auditLog) {
       auditLog.targetId = params.surveyId;
     }
+
+    let deletedSurvey: Awaited<ReturnType<typeof deleteSurvey>>;
     try {
       const result = await fetchAndAuthorizeSurvey(params.surveyId, authentication, "DELETE");
       if (result.error) {
@@ -105,13 +113,16 @@ export const DELETE = withV1ApiWrapper({
         auditLog.oldObject = result.survey;
       }
 
-      const deletedSurvey = await deleteSurvey(params.surveyId);
-      return {
-        response: responses.successResponse(deletedSurvey),
-      };
+      deletedSurvey = await deleteSurvey(params.surveyId);
     } catch (error) {
       return handleErrorResponse(error);
     }
+
+    // Enrich outside the delete's try/catch: the survey is already gone, so a lookup failure here
+    // must not mask a successful delete behind a generic error response.
+    return {
+      response: responses.successResponse(await addLegacyEnvironmentIdBestEffort(deletedSurvey)),
+    };
   },
   action: "deleted",
   targetType: "survey",
@@ -218,8 +229,13 @@ export const PUT = withV1ApiWrapper({
         }
 
         return {
+          // Best-effort, not strict: the update has committed by now, so a failed workspace lookup
+          // would report a failure for an update that succeeded — and mark the audit entry failed
+          // with it.
           response: responses.successResponse(
-            addLegacyProjectOverwrites(resolveStorageUrlsInObject(withDerivedQuestions(updatedSurvey)))
+            await addLegacyEnvironmentIdBestEffort(
+              addLegacyProjectOverwrites(resolveStorageUrlsInObject(withDerivedQuestions(updatedSurvey)))
+            )
           ),
         };
       } catch (error) {
diff --git a/apps/web/app/api/v1/management/surveys/route.ts b/apps/web/app/api/v1/management/surveys/route.ts
index 24f245c391eb..b83ea2dda63a 100644
--- a/apps/web/app/api/v1/management/surveys/route.ts
+++ b/apps/web/app/api/v1/management/surveys/route.ts
@@ -8,6 +8,10 @@ import {
   normaliseProjectOverwritesToWorkspace,
 } from "@/app/lib/api/api-backwards-compat";
 import { handleApiError } from "@/app/lib/api/handle-api-error";
+import {
+  addLegacyEnvironmentIdBestEffort,
+  addLegacyEnvironmentIdToList,
+} from "@/app/lib/api/legacy-environment-id";
 import { RequestBodyTooLargeError, parseJsonBodyWithLimit } from "@/app/lib/api/request-body";
 import { responses } from "@/app/lib/api/response";
 import {
@@ -47,7 +51,9 @@ export const GET = withV1ApiWrapper({
 
       return {
         response: responses.successResponse(
-          addLegacyProjectOverwritesToList(resolveStorageUrlsInObject(surveysWithQuestions))
+          await addLegacyEnvironmentIdToList(
+            addLegacyProjectOverwritesToList(resolveStorageUrlsInObject(surveysWithQuestions))
+          )
         ),
       };
     } catch (error) {
@@ -146,8 +152,13 @@ export const POST = withV1ApiWrapper({
       }
 
       return {
+        // Best-effort, not strict: the insert has committed by now, so a failed workspace lookup here
+        // would return an error for a survey that exists. `Survey` has no unique constraint to dedup
+        // on, so a client retrying that false error creates a second survey.
         response: responses.successResponse(
-          addLegacyProjectOverwrites(resolveStorageUrlsInObject(withDerivedQuestions(survey)))
+          await addLegacyEnvironmentIdBestEffort(
+            addLegacyProjectOverwrites(resolveStorageUrlsInObject(withDerivedQuestions(survey)))
+          )
         ),
       };
     } catch (error) {
diff --git a/apps/web/app/api/v1/webhooks/[webhookId]/route.ts b/apps/web/app/api/v1/webhooks/[webhookId]/route.ts
index 988a0832ddbd..7325424c26ae 100644
--- a/apps/web/app/api/v1/webhooks/[webhookId]/route.ts
+++ b/apps/web/app/api/v1/webhooks/[webhookId]/route.ts
@@ -1,5 +1,9 @@
 import { logger } from "@formbricks/logger";
 import { deleteWebhook, getWebhook } from "@/app/api/v1/webhooks/[webhookId]/lib/webhook";
+import {
+  addLegacyEnvironmentId,
+  addLegacyEnvironmentIdBestEffort,
+} from "@/app/lib/api/legacy-environment-id";
 import { responses } from "@/app/lib/api/response";
 import { THandlerParams, withV1ApiWrapper } from "@/app/lib/api/with-api-logging";
 import { hasPermission } from "@/modules/organization/settings/api-keys/lib/utils";
@@ -24,7 +28,7 @@ export const GET = withV1ApiWrapper({
       };
     }
     return {
-      response: responses.successResponse(webhook),
+      response: responses.successResponse(await addLegacyEnvironmentId(webhook)),
     };
   },
 });
@@ -63,11 +67,9 @@ export const DELETE = withV1ApiWrapper({
     }
 
     // delete webhook from database
+    let deletedWebhook: Awaited<ReturnType<typeof deleteWebhook>>;
     try {
-      const deletedWebhook = await deleteWebhook(params.webhookId);
-      return {
-        response: responses.successResponse(deletedWebhook),
-      };
+      deletedWebhook = await deleteWebhook(params.webhookId);
     } catch (e) {
       if (auditLog) {
         auditLog.status = "failure";
@@ -77,6 +79,12 @@ export const DELETE = withV1ApiWrapper({
         response: responses.notFoundResponse("Webhook", params.webhookId),
       };
     }
+
+    // Enrich outside the delete's try/catch: the webhook is already gone, so a lookup failure here
+    // must not report a failed delete (a false 404 plus a "failure" audit entry).
+    return {
+      response: responses.successResponse(await addLegacyEnvironmentIdBestEffort(deletedWebhook)),
+    };
   },
   action: "deleted",
   targetType: "webhook",
diff --git a/apps/web/app/api/v1/webhooks/route.ts b/apps/web/app/api/v1/webhooks/route.ts
index 75822c7b3cd6..a033d15f1443 100644
--- a/apps/web/app/api/v1/webhooks/route.ts
+++ b/apps/web/app/api/v1/webhooks/route.ts
@@ -2,6 +2,10 @@ import { resolveBodyIds } from "@/app/api/v1/management/lib/workspace-resolver";
 import { createWebhook, getWebhooks } from "@/app/api/v1/webhooks/lib/webhook";
 import { ZWebhookInput } from "@/app/api/v1/webhooks/types/webhooks";
 import { handleApiError } from "@/app/lib/api/handle-api-error";
+import {
+  addLegacyEnvironmentIdBestEffort,
+  addLegacyEnvironmentIdToList,
+} from "@/app/lib/api/legacy-environment-id";
 import { RequestBodyTooLargeError, parseJsonBodyWithLimit } from "@/app/lib/api/request-body";
 import { responses } from "@/app/lib/api/response";
 import { transformErrorToDetails } from "@/app/lib/api/validator";
@@ -20,7 +24,7 @@ export const GET = withV1ApiWrapper({
       ];
       const webhooks = await getWebhooks(workspaceIds);
       return {
-        response: responses.successResponse(webhooks),
+        response: responses.successResponse(await addLegacyEnvironmentIdToList(webhooks)),
       };
     } catch (error) {
       return handleApiError(error);
@@ -84,8 +88,13 @@ export const POST = withV1ApiWrapper({
         auditLog.newObject = webhook;
       }
 
+      // Best-effort, not strict: the insert has committed by now, and a failed workspace lookup here
+      // (e.g. a P2024 pool timeout on the helper's own connection checkout) would surface as a 500 for
+      // a webhook that exists. Zapier retries on that, and `Webhook` has no uniqueness on
+      // `(url, workspaceId)`, so the retry would silently create a second subscription and duplicate
+      // every delivery.
       return {
-        response: responses.successResponse(webhook),
+        response: responses.successResponse(await addLegacyEnvironmentIdBestEffort(webhook)),
       };
     } catch (error) {
       return handleApiError(error);
diff --git a/apps/web/app/api/v3/tags/[tagId]/merge/route.ts b/apps/web/app/api/v3/tags/[tagId]/merge/route.ts
new file mode 100644
index 000000000000..051fa48c6844
--- /dev/null
+++ b/apps/web/app/api/v3/tags/[tagId]/merge/route.ts
@@ -0,0 +1,23 @@
+/**
+ * POST /api/v3/tags/{tagId}/merge — move every response tagged `{tagId}` onto `newTagId`, then drop
+ * `{tagId}`. Both tags must belong to the same workspace; the operation rejects a cross-workspace merge.
+ */
+import { withV3ApiWrapper } from "@/app/api/v3/lib/api-wrapper";
+import { mergeV3Tags } from "../../lib/operations";
+import { ZV3MergeTagBody, ZV3TagIdParams } from "../../lib/schemas";
+
+export const POST = withV3ApiWrapper({
+  auth: "session",
+  action: "merged",
+  targetType: "tag",
+  schemas: { params: ZV3TagIdParams, body: ZV3MergeTagBody },
+  handler: async ({ authentication, parsedInput, auditLog, requestId, instance }) =>
+    mergeV3Tags({
+      authentication,
+      tagId: parsedInput.params.tagId,
+      newTagId: parsedInput.body.newTagId,
+      auditLog,
+      requestId,
+      instance,
+    }),
+});
diff --git a/apps/web/app/api/v3/tags/[tagId]/route.ts b/apps/web/app/api/v3/tags/[tagId]/route.ts
new file mode 100644
index 000000000000..151082f09e76
--- /dev/null
+++ b/apps/web/app/api/v3/tags/[tagId]/route.ts
@@ -0,0 +1,41 @@
+/**
+ * PATCH  /api/v3/tags/{tagId} — rename a tag.
+ * DELETE /api/v3/tags/{tagId} — delete a tag and its response links.
+ *
+ * The workspace is resolved from the tag, never from the request, so the caller cannot supply the scope
+ * it is authorized against. Session-only, matching the actions these replace.
+ */
+import { withV3ApiWrapper } from "@/app/api/v3/lib/api-wrapper";
+import { deleteV3Tag, renameV3Tag } from "../lib/operations";
+import { ZV3RenameTagBody, ZV3TagIdParams } from "../lib/schemas";
+
+export const PATCH = withV3ApiWrapper({
+  auth: "session",
+  action: "updated",
+  targetType: "tag",
+  schemas: { params: ZV3TagIdParams, body: ZV3RenameTagBody },
+  handler: async ({ authentication, parsedInput, auditLog, requestId, instance }) =>
+    renameV3Tag({
+      authentication,
+      tagId: parsedInput.params.tagId,
+      name: parsedInput.body.name,
+      auditLog,
+      requestId,
+      instance,
+    }),
+});
+
+export const DELETE = withV3ApiWrapper({
+  auth: "session",
+  action: "deleted",
+  targetType: "tag",
+  schemas: { params: ZV3TagIdParams },
+  handler: async ({ authentication, parsedInput, auditLog, requestId, instance }) =>
+    deleteV3Tag({
+      authentication,
+      tagId: parsedInput.params.tagId,
+      auditLog,
+      requestId,
+      instance,
+    }),
+});
diff --git a/apps/web/app/api/v3/tags/lib/operations.test.ts b/apps/web/app/api/v3/tags/lib/operations.test.ts
new file mode 100644
index 000000000000..565a0e06d31e
--- /dev/null
+++ b/apps/web/app/api/v3/tags/lib/operations.test.ts
@@ -0,0 +1,322 @@
+import { beforeEach, describe, expect, test, vi } from "vitest";
+import { requireV3WorkspaceAccess } from "@/app/api/v3/lib/auth";
+import { getTag, getTagsByWorkspaceId } from "@/lib/tag/service";
+import { getTagsOnResponsesCount } from "@/lib/tagOnResponse/service";
+import { deleteTag, mergeTags, updateTagName } from "@/modules/workspaces/settings/lib/tag";
+import { deleteV3Tag, listV3Tags, mergeV3Tags, renameV3Tag } from "./operations";
+
+vi.mock("server-only", () => ({}));
+
+vi.mock("@/app/api/v3/lib/auth", () => ({ requireV3WorkspaceAccess: vi.fn() }));
+vi.mock("@/lib/tag/service", () => ({ getTag: vi.fn(), getTagsByWorkspaceId: vi.fn() }));
+vi.mock("@/lib/tagOnResponse/service", () => ({ getTagsOnResponsesCount: vi.fn() }));
+vi.mock("@/modules/workspaces/settings/lib/tag", () => ({
+  deleteTag: vi.fn(),
+  mergeTags: vi.fn(),
+  updateTagName: vi.fn(),
+}));
+vi.mock("@formbricks/logger", () => ({
+  logger: { withContext: vi.fn(() => ({ error: vi.fn(), warn: vi.fn() })) },
+}));
+
+const workspaceId = "clxx1234567890123456789012";
+const otherWorkspaceId = "clyy1234567890123456789012";
+const organizationId = "clzz1234567890123456789012";
+const tagId = "cltt1234567890123456789012";
+const otherTagId = "cluu1234567890123456789012";
+
+const tag = {
+  id: tagId,
+  name: "Bug report",
+  workspaceId,
+  createdAt: new Date("2026-04-21T10:00:00.000Z"),
+  updatedAt: new Date("2026-04-21T10:00:00.000Z"),
+};
+
+const base = { authentication: null, requestId: "req_1", instance: "/api/v3/tags" };
+
+const grantAccess = () =>
+  vi
+    .mocked(requireV3WorkspaceAccess)
+    .mockResolvedValue({ workspaceId, organizationId } as Awaited<
+      ReturnType<typeof requireV3WorkspaceAccess>
+    >);
+
+beforeEach(() => {
+  vi.resetAllMocks();
+  // Rename reads the workspace's counts to fill `TagResource.count`, so every rename test needs this
+  // resolved. Tests where the count itself is the subject override it.
+  vi.mocked(getTagsOnResponsesCount).mockResolvedValue([]);
+});
+
+describe("listV3Tags", () => {
+  test("joins each tag to its response count, defaulting to zero", async () => {
+    grantAccess();
+    vi.mocked(getTagsByWorkspaceId).mockResolvedValue([tag, { ...tag, id: otherTagId, name: "Churn" }]);
+    vi.mocked(getTagsOnResponsesCount).mockResolvedValue([{ tagId, count: 7 }]);
+
+    const response = await listV3Tags({ ...base, workspaceId });
+    const body = await response.json();
+
+    expect(response.status).toBe(200);
+    expect(body.data).toHaveLength(2);
+    expect(body.data[0]).toMatchObject({ id: tagId, name: "Bug report", count: 7 });
+    // A tag nobody has applied still has to appear, with a zero rather than a missing count.
+    expect(body.data[1]).toMatchObject({ id: otherTagId, count: 0 });
+  });
+
+  test("propagates the authorization failure instead of listing", async () => {
+    vi.mocked(requireV3WorkspaceAccess).mockResolvedValue(new Response(null, { status: 403 }));
+
+    const response = await listV3Tags({ ...base, workspaceId });
+
+    expect(response.status).toBe(403);
+    expect(getTagsByWorkspaceId).not.toHaveBeenCalled();
+  });
+});
+
+describe("renameV3Tag", () => {
+  test("renames a tag the caller may write to", async () => {
+    vi.mocked(getTag).mockResolvedValue(tag);
+    grantAccess();
+    vi.mocked(updateTagName).mockResolvedValue({ ok: true, data: { ...tag, name: "Renamed" } } as Awaited<
+      ReturnType<typeof updateTagName>
+    >);
+
+    const response = await renameV3Tag({ ...base, tagId, name: "Renamed" });
+    const body = await response.json();
+
+    expect(response.status).toBe(200);
+    expect(body.data).toMatchObject({ id: tagId, name: "Renamed" });
+    expect(updateTagName).toHaveBeenCalledWith(tagId, "Renamed");
+  });
+
+  test("authorizes against the tag's own workspace, never a caller-supplied one", async () => {
+    vi.mocked(getTag).mockResolvedValue(tag);
+    grantAccess();
+    vi.mocked(updateTagName).mockResolvedValue({ ok: true, data: tag } as Awaited<
+      ReturnType<typeof updateTagName>
+    >);
+
+    await renameV3Tag({ ...base, tagId, name: "Renamed" });
+
+    expect(requireV3WorkspaceAccess).toHaveBeenCalledWith(
+      null,
+      workspaceId,
+      "readWrite",
+      "req_1",
+      "/api/v3/tags"
+    );
+  });
+
+  test("403s an unknown tag, so tag ids cannot be probed for existence", async () => {
+    vi.mocked(getTag).mockResolvedValue(null);
+
+    const response = await renameV3Tag({ ...base, tagId, name: "Renamed" });
+
+    expect(response.status).toBe(403);
+    expect(requireV3WorkspaceAccess).not.toHaveBeenCalled();
+    expect(updateTagName).not.toHaveBeenCalled();
+  });
+
+  test("surfaces a duplicate name as 422 rather than a server fault", async () => {
+    vi.mocked(getTag).mockResolvedValue(tag);
+    grantAccess();
+    vi.mocked(updateTagName).mockResolvedValue({
+      ok: false,
+      error: { code: "tag_name_already_exists" },
+    } as unknown as Awaited<ReturnType<typeof updateTagName>>);
+
+    const response = await renameV3Tag({ ...base, tagId, name: "Bug report" });
+
+    expect(response.status).toBe(422);
+  });
+
+  test("reports the tag's real response count, not a hardcoded zero", async () => {
+    vi.mocked(getTag).mockResolvedValue(tag);
+    grantAccess();
+    vi.mocked(updateTagName).mockResolvedValue({ ok: true, data: { ...tag, name: "Renamed" } } as Awaited<
+      ReturnType<typeof updateTagName>
+    >);
+    vi.mocked(getTagsOnResponsesCount).mockResolvedValue([{ tagId, count: 4 }]);
+
+    const response = await renameV3Tag({ ...base, tagId, name: "Renamed" });
+    const body = await response.json();
+
+    // `count` is part of the documented TagResource; answering 0 for a tag in use is false data.
+    expect(body.data).toMatchObject({ id: tagId, name: "Renamed", count: 4 });
+    expect(getTagsOnResponsesCount).toHaveBeenCalledWith(workspaceId);
+  });
+
+  test("falls back to zero when the renamed tag is on no responses", async () => {
+    vi.mocked(getTag).mockResolvedValue(tag);
+    grantAccess();
+    vi.mocked(updateTagName).mockResolvedValue({ ok: true, data: tag } as Awaited<
+      ReturnType<typeof updateTagName>
+    >);
+    vi.mocked(getTagsOnResponsesCount).mockResolvedValue([{ tagId: otherTagId, count: 9 }]);
+
+    const body = await (await renameV3Tag({ ...base, tagId, name: "Renamed" })).json();
+
+    expect(body.data.count).toBe(0);
+  });
+
+  test("records the before and after objects for the audit log", async () => {
+    vi.mocked(getTag).mockResolvedValue(tag);
+    grantAccess();
+    const renamed = { ...tag, name: "Renamed" };
+    vi.mocked(updateTagName).mockResolvedValue({ ok: true, data: renamed } as Awaited<
+      ReturnType<typeof updateTagName>
+    >);
+    const auditLog = {} as Parameters<typeof renameV3Tag>[0]["auditLog"];
+
+    await renameV3Tag({ ...base, tagId, name: "Renamed", auditLog });
+
+    expect(auditLog).toMatchObject({ organizationId, targetId: tagId, oldObject: tag, newObject: renamed });
+  });
+});
+
+describe("deleteV3Tag", () => {
+  test("deletes and reports the removed id", async () => {
+    vi.mocked(getTag).mockResolvedValue(tag);
+    grantAccess();
+    vi.mocked(deleteTag).mockResolvedValue({ ok: true, data: tag } as Awaited<ReturnType<typeof deleteTag>>);
+
+    const response = await deleteV3Tag({ ...base, tagId });
+    const body = await response.json();
+
+    expect(response.status).toBe(200);
+    expect(body.data).toEqual({ id: tagId });
+  });
+
+  test("does not delete when authorization fails", async () => {
+    vi.mocked(getTag).mockResolvedValue(tag);
+    vi.mocked(requireV3WorkspaceAccess).mockResolvedValue(new Response(null, { status: 403 }));
+
+    const response = await deleteV3Tag({ ...base, tagId });
+
+    expect(response.status).toBe(403);
+    expect(deleteTag).not.toHaveBeenCalled();
+  });
+
+  test("records the removed tag for the audit log", async () => {
+    vi.mocked(getTag).mockResolvedValue(tag);
+    grantAccess();
+    vi.mocked(deleteTag).mockResolvedValue({ ok: true, data: tag } as Awaited<ReturnType<typeof deleteTag>>);
+    const auditLog = {} as Parameters<typeof deleteV3Tag>[0]["auditLog"];
+
+    await deleteV3Tag({ ...base, tagId, auditLog });
+
+    // A delete has no "after", so the removed row is the whole record of what happened.
+    expect(auditLog).toMatchObject({ organizationId, targetId: tagId, oldObject: tag });
+  });
+
+  test("reports a failed delete as a server fault, not a success", async () => {
+    vi.mocked(getTag).mockResolvedValue(tag);
+    grantAccess();
+    vi.mocked(deleteTag).mockResolvedValue({ ok: false, error: { code: "unexpected" } } as unknown as Awaited<
+      ReturnType<typeof deleteTag>
+    >);
+
+    const response = await deleteV3Tag({ ...base, tagId });
+
+    expect(response.status).toBe(500);
+  });
+});
+
+describe("mergeV3Tags", () => {
+  test("merges two tags in the same workspace", async () => {
+    vi.mocked(getTag).mockImplementation(async (id: string) =>
+      id === tagId ? tag : { ...tag, id: otherTagId, name: "Churn" }
+    );
+    grantAccess();
+    vi.mocked(mergeTags).mockResolvedValue({ ok: true, data: tag } as Awaited<ReturnType<typeof mergeTags>>);
+
+    const response = await mergeV3Tags({ ...base, tagId, newTagId: otherTagId });
+    const body = await response.json();
+
+    expect(response.status).toBe(200);
+    expect(body.data).toEqual({ id: otherTagId });
+    expect(mergeTags).toHaveBeenCalledWith(tagId, otherTagId);
+  });
+
+  test("refuses a cross-workspace merge, which would move responses across a tenant boundary", async () => {
+    vi.mocked(getTag).mockImplementation(async (id: string) =>
+      id === tagId ? tag : { ...tag, id: otherTagId, workspaceId: otherWorkspaceId }
+    );
+    grantAccess();
+
+    const response = await mergeV3Tags({ ...base, tagId, newTagId: otherTagId });
+
+    expect(response.status).toBe(403);
+    expect(mergeTags).not.toHaveBeenCalled();
+  });
+
+  test("403s when the merge target does not exist, rather than confirming it is absent", async () => {
+    vi.mocked(getTag).mockImplementation(async (id: string) => (id === tagId ? tag : null));
+    grantAccess();
+
+    const response = await mergeV3Tags({ ...base, tagId, newTagId: otherTagId });
+
+    expect(response.status).toBe(403);
+    expect(mergeTags).not.toHaveBeenCalled();
+  });
+
+  test("rejects a self-merge as a client error rather than a server fault", async () => {
+    vi.mocked(getTag).mockResolvedValue(tag);
+    grantAccess();
+
+    const response = await mergeV3Tags({ ...base, tagId, newTagId: tagId });
+
+    // `mergeTags` would reject this itself, but that path maps to 500 — the caller's bad input must not
+    // be reported as our failure.
+    expect(response.status).toBe(400);
+    expect(mergeTags).not.toHaveBeenCalled();
+  });
+
+  test("does not merge when authorization fails, and never loads the target", async () => {
+    vi.mocked(getTag).mockResolvedValue(tag);
+    vi.mocked(requireV3WorkspaceAccess).mockResolvedValue(new Response(null, { status: 403 }));
+
+    const response = await mergeV3Tags({ ...base, tagId, newTagId: otherTagId });
+
+    expect(response.status).toBe(403);
+    // Bailing before the second lookup is what stops a rejected caller probing the target's existence.
+    expect(getTag).toHaveBeenCalledTimes(1);
+    expect(mergeTags).not.toHaveBeenCalled();
+  });
+
+  test("records both tag ids and the source row for the audit log", async () => {
+    const target = { ...tag, id: otherTagId, name: "Churn" };
+    vi.mocked(getTag).mockImplementation(async (id: string) => (id === tagId ? tag : target));
+    grantAccess();
+    vi.mocked(mergeTags).mockResolvedValue({ ok: true, data: target } as Awaited<
+      ReturnType<typeof mergeTags>
+    >);
+    const auditLog = {} as Parameters<typeof mergeV3Tags>[0]["auditLog"];
+
+    await mergeV3Tags({ ...base, tagId, newTagId: otherTagId, auditLog });
+
+    // A merge touches two rows, so the target id belongs in the audit trail alongside the source.
+    expect(auditLog).toMatchObject({
+      organizationId,
+      targetId: `${tagId}-${otherTagId}`,
+      oldObject: tag,
+      newObject: target,
+    });
+  });
+
+  test("reports a failed merge as a server fault, not a success", async () => {
+    vi.mocked(getTag).mockImplementation(async (id: string) =>
+      id === tagId ? tag : { ...tag, id: otherTagId }
+    );
+    grantAccess();
+    vi.mocked(mergeTags).mockResolvedValue({ ok: false, error: { code: "unexpected" } } as unknown as Awaited<
+      ReturnType<typeof mergeTags>
+    >);
+
+    const response = await mergeV3Tags({ ...base, tagId, newTagId: otherTagId });
+
+    expect(response.status).toBe(500);
+  });
+});
diff --git a/apps/web/app/api/v3/tags/lib/operations.ts b/apps/web/app/api/v3/tags/lib/operations.ts
new file mode 100644
index 000000000000..e9e47c65f476
--- /dev/null
+++ b/apps/web/app/api/v3/tags/lib/operations.ts
@@ -0,0 +1,173 @@
+import "server-only";
+import { requireV3WorkspaceAccess } from "@/app/api/v3/lib/auth";
+import {
+  problemBadRequest,
+  problemForbidden,
+  problemInternalError,
+  problemUnprocessableContent,
+  successResponse,
+} from "@/app/api/v3/lib/response";
+import type { TV3AuditLog, TV3Authentication } from "@/app/api/v3/lib/types";
+import { getTag, getTagsByWorkspaceId } from "@/lib/tag/service";
+import { getTagsOnResponsesCount } from "@/lib/tagOnResponse/service";
+import { deleteTag, mergeTags, updateTagName } from "@/modules/workspaces/settings/lib/tag";
+import { serializeV3Tag } from "../serializers";
+
+type TBaseParams = {
+  authentication: TV3Authentication;
+  requestId: string;
+  instance?: string;
+};
+
+/**
+ * Every mutation resolves the workspace from the tag itself rather than trusting a client-supplied
+ * `workspaceId`. That keeps the scope unforgeable: a caller cannot pair someone else's tag id with a
+ * workspace they happen to have access to. It also reproduces what the server actions did via
+ * `getWorkspaceIdFromTagId`, so the authorization matrix is unchanged — organization owners and managers,
+ * or a workspace team member with `readWrite`.
+ *
+ * An unknown tag answers 403, not 404, matching `/api/v3/surveys/{surveyId}` and
+ * `/api/v3/workflows/{workflowId}`: a 404 here would let any signed-in user probe tag ids across the
+ * whole instance and learn which exist.
+ */
+async function authorizeTagMutation(
+  tagId: string,
+  { authentication, requestId, instance }: TBaseParams
+): Promise<Response | { tag: NonNullable<Awaited<ReturnType<typeof getTag>>>; organizationId: string }> {
+  const tag = await getTag(tagId);
+  if (!tag) {
+    return problemForbidden(requestId, "You are not authorized to access this resource", instance);
+  }
+
+  const access = await requireV3WorkspaceAccess(
+    authentication,
+    tag.workspaceId,
+    "readWrite",
+    requestId,
+    instance
+  );
+  if (access instanceof Response) return access;
+
+  return { tag, organizationId: access.organizationId };
+}
+
+export async function listV3Tags(params: TBaseParams & { workspaceId: string }): Promise<Response> {
+  const { authentication, workspaceId, requestId, instance } = params;
+
+  const access = await requireV3WorkspaceAccess(authentication, workspaceId, "read", requestId, instance);
+  if (access instanceof Response) return access;
+
+  const [tags, counts] = await Promise.all([
+    getTagsByWorkspaceId(access.workspaceId),
+    getTagsOnResponsesCount(access.workspaceId),
+  ]);
+
+  const countByTagId = new Map(counts.map((entry) => [entry.tagId, entry.count]));
+
+  return successResponse(
+    tags.map((tag) => serializeV3Tag(tag, countByTagId.get(tag.id) ?? 0)),
+    { requestId }
+  );
+}
+
+export async function renameV3Tag(
+  params: TBaseParams & { tagId: string; name: string; auditLog?: TV3AuditLog }
+): Promise<Response> {
+  const { tagId, name, auditLog, requestId, instance } = params;
+
+  const authorized = await authorizeTagMutation(tagId, params);
+  if (authorized instanceof Response) return authorized;
+
+  if (auditLog) {
+    auditLog.organizationId = authorized.organizationId;
+    auditLog.targetId = tagId;
+    auditLog.oldObject = authorized.tag;
+  }
+
+  const result = await updateTagName(tagId, name);
+  if (!result.ok) {
+    // A duplicate name is the caller's problem, not a server fault: the component surfaces it inline.
+    return problemUnprocessableContent(requestId, "Unable to update tag", {
+      instance,
+      invalid_params: [{ name: "name", reason: result.error.code ?? "invalid" }],
+    });
+  }
+
+  if (auditLog) auditLog.newObject = result.data;
+
+  // `count` is part of the documented `TagResource`, so a rename cannot answer 0 for a tag that is in
+  // use — that would be false data, not merely an omission. A rename does not change the count, so this
+  // reads the current one. `getTagsOnResponsesCount` is workspace-wide and `reactCache`d, the same call
+  // the list route makes.
+  const counts = await getTagsOnResponsesCount(authorized.tag.workspaceId);
+  const count = counts.find((entry) => entry.tagId === tagId)?.count ?? 0;
+
+  return successResponse(serializeV3Tag(result.data, count), { requestId });
+}
+
+export async function deleteV3Tag(
+  params: TBaseParams & { tagId: string; auditLog?: TV3AuditLog }
+): Promise<Response> {
+  const { tagId, auditLog, requestId, instance } = params;
+
+  const authorized = await authorizeTagMutation(tagId, params);
+  if (authorized instanceof Response) return authorized;
+
+  if (auditLog) {
+    auditLog.organizationId = authorized.organizationId;
+    auditLog.targetId = tagId;
+  }
+
+  const result = await deleteTag(tagId);
+  if (!result.ok) {
+    return problemInternalError(requestId, "Unable to delete tag", instance);
+  }
+
+  if (auditLog) auditLog.oldObject = result.data;
+
+  return successResponse({ id: tagId }, { requestId });
+}
+
+export async function mergeV3Tags(
+  params: TBaseParams & { tagId: string; newTagId: string; auditLog?: TV3AuditLog }
+): Promise<Response> {
+  const { tagId, newTagId, auditLog, requestId, instance } = params;
+
+  const authorized = await authorizeTagMutation(tagId, params);
+  if (authorized instanceof Response) return authorized;
+
+  // Merging a tag into itself is a malformed request, not a server fault. `mergeTags` does reject it
+  // with `MERGE_SAME_TAG`, but every service failure below maps to 500, so without this check the
+  // caller would get a 500 for their own bad input. 400 is what the OpenAPI document already promises.
+  if (tagId === newTagId) {
+    return problemBadRequest(requestId, "A tag cannot be merged into itself", {
+      instance,
+      invalid_params: [{ name: "newTagId", reason: "must differ from the tag being merged away" }],
+    });
+  }
+
+  // Both tags must live in the same workspace, or merging would move responses across a tenant
+  // boundary. The server action checked this too; it is the one rule that needs the second tag loaded.
+  const target = await getTag(newTagId);
+  if (!target) {
+    return problemForbidden(requestId, "You are not authorized to access this resource", instance);
+  }
+  if (target.workspaceId !== authorized.tag.workspaceId) {
+    return problemForbidden(requestId, "Tags must be in the same workspace", instance);
+  }
+
+  if (auditLog) {
+    auditLog.organizationId = authorized.organizationId;
+    auditLog.targetId = `${tagId}-${newTagId}`;
+    auditLog.oldObject = authorized.tag;
+  }
+
+  const result = await mergeTags(tagId, newTagId);
+  if (!result.ok) {
+    return problemInternalError(requestId, "Unable to merge tags", instance);
+  }
+
+  if (auditLog) auditLog.newObject = result.data;
+
+  return successResponse({ id: newTagId }, { requestId });
+}
diff --git a/apps/web/app/api/v3/tags/lib/schemas.test.ts b/apps/web/app/api/v3/tags/lib/schemas.test.ts
new file mode 100644
index 000000000000..1fbb03827b2d
--- /dev/null
+++ b/apps/web/app/api/v3/tags/lib/schemas.test.ts
@@ -0,0 +1,44 @@
+import { describe, expect, test } from "vitest";
+import { ZV3MergeTagBody, ZV3RenameTagBody, ZV3TagIdParams, ZV3TagListQuery } from "./schemas";
+
+describe("ZV3RenameTagBody", () => {
+  test("trims the name, so a padded rename does not store its whitespace", () => {
+    expect(ZV3RenameTagBody.parse({ name: "  Bug report  " })).toEqual({ name: "Bug report" });
+  });
+
+  test("rejects a name that is empty once trimmed", () => {
+    // The old server action took a bare string and relied on the component trimming first, so a
+    // whitespace-only rename could store an unnamed tag. Rejecting here makes that a 422.
+    expect(ZV3RenameTagBody.safeParse({ name: "   " }).success).toBe(false);
+    expect(ZV3RenameTagBody.safeParse({ name: "" }).success).toBe(false);
+  });
+
+  test("rejects a name past 255 characters but accepts one exactly at the limit", () => {
+    expect(ZV3RenameTagBody.safeParse({ name: "a".repeat(255) }).success).toBe(true);
+    expect(ZV3RenameTagBody.safeParse({ name: "a".repeat(256) }).success).toBe(false);
+  });
+
+  test("rejects unknown keys rather than ignoring them", () => {
+    expect(ZV3RenameTagBody.safeParse({ name: "Bug report", workspaceId: "cl000" }).success).toBe(false);
+  });
+});
+
+describe("id schemas", () => {
+  const id = "clxx1234567890123456789012";
+
+  test("accept a well-formed id", () => {
+    expect(ZV3TagIdParams.parse({ tagId: id })).toEqual({ tagId: id });
+    expect(ZV3TagListQuery.parse({ workspaceId: id })).toEqual({ workspaceId: id });
+    expect(ZV3MergeTagBody.parse({ newTagId: id })).toEqual({ newTagId: id });
+  });
+
+  test("reject an id that is not a cuid", () => {
+    expect(ZV3TagIdParams.safeParse({ tagId: "not a cuid" }).success).toBe(false);
+    expect(ZV3TagListQuery.safeParse({ workspaceId: "" }).success).toBe(false);
+    expect(ZV3MergeTagBody.safeParse({ newTagId: "tag_ABC" }).success).toBe(false);
+  });
+
+  test("the merge body carries only the target id, so the workspace cannot be supplied by the caller", () => {
+    expect(ZV3MergeTagBody.safeParse({ newTagId: id, workspaceId: id }).success).toBe(false);
+  });
+});
diff --git a/apps/web/app/api/v3/tags/lib/schemas.ts b/apps/web/app/api/v3/tags/lib/schemas.ts
new file mode 100644
index 000000000000..f4e17388c075
--- /dev/null
+++ b/apps/web/app/api/v3/tags/lib/schemas.ts
@@ -0,0 +1,17 @@
+import { z } from "zod";
+
+export const ZV3TagIdParams = z.object({ tagId: z.cuid2() }).strict();
+
+export const ZV3TagListQuery = z.object({ workspaceId: z.cuid2() }).strict();
+
+/**
+ * The old `updateTagNameAction` accepted a bare `z.string()` and the component trimmed before calling.
+ * Trimming and rejecting empty here instead means a blank rename is a 422 rather than a tag silently
+ * named "".
+ */
+export const ZV3RenameTagBody = z.object({ name: z.string().trim().min(1).max(255) }).strict();
+
+export const ZV3MergeTagBody = z.object({ newTagId: z.cuid2() }).strict();
+
+export type TV3TagIdParams = z.infer<typeof ZV3TagIdParams>;
+export type TV3TagListQuery = z.infer<typeof ZV3TagListQuery>;
diff --git a/apps/web/app/api/v3/tags/route.ts b/apps/web/app/api/v3/tags/route.ts
new file mode 100644
index 000000000000..6b35426a3688
--- /dev/null
+++ b/apps/web/app/api/v3/tags/route.ts
@@ -0,0 +1,22 @@
+/**
+ * GET /api/v3/tags — list a workspace's tags with their response counts.
+ *
+ * Session-only, deliberately. These endpoints replace `authenticatedActionClient` server actions that
+ * only ever ran for a signed-in user, so accepting `x-api-key` here would widen the surface rather than
+ * migrate it.
+ */
+import { withV3ApiWrapper } from "@/app/api/v3/lib/api-wrapper";
+import { listV3Tags } from "./lib/operations";
+import { ZV3TagListQuery } from "./lib/schemas";
+
+export const GET = withV3ApiWrapper({
+  auth: "session",
+  schemas: { query: ZV3TagListQuery },
+  handler: async ({ authentication, parsedInput, requestId, instance }) =>
+    listV3Tags({
+      authentication,
+      workspaceId: parsedInput.query.workspaceId,
+      requestId,
+      instance,
+    }),
+});
diff --git a/apps/web/app/api/v3/tags/serializers.ts b/apps/web/app/api/v3/tags/serializers.ts
new file mode 100644
index 000000000000..e4108dd3c5c6
--- /dev/null
+++ b/apps/web/app/api/v3/tags/serializers.ts
@@ -0,0 +1,20 @@
+import type { TTag } from "@formbricks/types/tags";
+
+export type TV3Tag = {
+  id: string;
+  name: string;
+  workspaceId: string;
+  createdAt: string;
+  updatedAt: string;
+  /** Responses currently carrying this tag. Zero when the tag has never been applied. */
+  count: number;
+};
+
+export const serializeV3Tag = (tag: TTag, count: number): TV3Tag => ({
+  id: tag.id,
+  name: tag.name,
+  workspaceId: tag.workspaceId,
+  createdAt: tag.createdAt.toISOString(),
+  updatedAt: tag.updatedAt.toISOString(),
+  count,
+});
diff --git a/apps/web/app/lib/api/legacy-environment-id.test.ts b/apps/web/app/lib/api/legacy-environment-id.test.ts
new file mode 100644
index 000000000000..05efc1fef80a
--- /dev/null
+++ b/apps/web/app/lib/api/legacy-environment-id.test.ts
@@ -0,0 +1,133 @@
+import { beforeEach, describe, expect, test, vi } from "vitest";
+import { prisma } from "@formbricks/database";
+import {
+  addLegacyEnvironmentId,
+  addLegacyEnvironmentIdBestEffort,
+  addLegacyEnvironmentIdToList,
+} from "./legacy-environment-id";
+
+vi.mock("@formbricks/database", () => ({
+  prisma: {
+    workspace: {
+      findMany: vi.fn(),
+    },
+  },
+}));
+
+vi.mock("@formbricks/logger", () => ({
+  logger: { error: vi.fn() },
+}));
+
+const findManyMock = vi.mocked(prisma.workspace.findMany);
+
+describe("addLegacyEnvironmentIdToList", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  test("uses the workspace's legacyEnvironmentId when the workspace was migrated", async () => {
+    findManyMock.mockResolvedValue([{ id: "ws_1", legacyEnvironmentId: "env_1" }] as never);
+
+    const result = await addLegacyEnvironmentIdToList([{ id: "survey_1", workspaceId: "ws_1" }]);
+
+    expect(result).toEqual([{ id: "survey_1", workspaceId: "ws_1", environmentId: "env_1" }]);
+  });
+
+  test("falls back to the workspace id when there is no legacy environment id", async () => {
+    findManyMock.mockResolvedValue([{ id: "ws_1", legacyEnvironmentId: null }] as never);
+
+    const result = await addLegacyEnvironmentIdToList([{ id: "survey_1", workspaceId: "ws_1" }]);
+
+    expect(result[0].environmentId).toBe("ws_1");
+  });
+
+  test("falls back to the workspace id when the workspace row is missing", async () => {
+    findManyMock.mockResolvedValue([] as never);
+
+    const result = await addLegacyEnvironmentIdToList([{ id: "survey_1", workspaceId: "ws_1" }]);
+
+    expect(result[0].environmentId).toBe("ws_1");
+  });
+
+  test("resolves each entity against its own workspace and queries unique ids once", async () => {
+    findManyMock.mockResolvedValue([
+      { id: "ws_1", legacyEnvironmentId: "env_1" },
+      { id: "ws_2", legacyEnvironmentId: "env_2" },
+    ] as never);
+
+    const result = await addLegacyEnvironmentIdToList([
+      { id: "a", workspaceId: "ws_1" },
+      { id: "b", workspaceId: "ws_2" },
+      { id: "c", workspaceId: "ws_1" },
+    ]);
+
+    expect(result.map((entity) => entity.environmentId)).toEqual(["env_1", "env_2", "env_1"]);
+    // Three entities across two workspaces must cost one query for two ids. Deduping has no form in
+    // the return value — the mapping above passes either way — so the query is the only place it is
+    // observable. Matched loosely so adding a selected column doesn't break this.
+    expect(findManyMock).toHaveBeenCalledTimes(1);
+    expect(findManyMock).toHaveBeenCalledWith(
+      expect.objectContaining({ where: { id: { in: ["ws_1", "ws_2"] } } })
+    );
+  });
+
+  test("returns an empty list without querying", async () => {
+    const result = await addLegacyEnvironmentIdToList([]);
+
+    expect(result).toEqual([]);
+    expect(findManyMock).not.toHaveBeenCalled();
+  });
+});
+
+describe("addLegacyEnvironmentId", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  test("adds environmentId to a single entity while preserving its other fields", async () => {
+    findManyMock.mockResolvedValue([{ id: "ws_1", legacyEnvironmentId: "env_1" }] as never);
+
+    const result = await addLegacyEnvironmentId({
+      id: "webhook_1",
+      workspaceId: "ws_1",
+      url: "https://x.co",
+    });
+
+    expect(result).toEqual({
+      id: "webhook_1",
+      workspaceId: "ws_1",
+      url: "https://x.co",
+      environmentId: "env_1",
+    });
+  });
+
+  test("propagates lookup failures so a wrong id is never handed to a client", async () => {
+    findManyMock.mockRejectedValue(new Error("connection lost"));
+
+    await expect(addLegacyEnvironmentId({ id: "survey_1", workspaceId: "ws_1" })).rejects.toThrow(
+      "connection lost"
+    );
+  });
+});
+
+describe("addLegacyEnvironmentIdBestEffort", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  test("enriches like addLegacyEnvironmentId when the lookup succeeds", async () => {
+    findManyMock.mockResolvedValue([{ id: "ws_1", legacyEnvironmentId: "env_1" }] as never);
+
+    const result = await addLegacyEnvironmentIdBestEffort({ id: "webhook_1", workspaceId: "ws_1" });
+
+    expect(result).toEqual({ id: "webhook_1", workspaceId: "ws_1", environmentId: "env_1" });
+  });
+
+  test("returns the un-enriched entity when the lookup throws, so a committed write still reports success", async () => {
+    findManyMock.mockRejectedValue(new Error("connection lost"));
+
+    const result = await addLegacyEnvironmentIdBestEffort({ id: "webhook_1", workspaceId: "ws_1" });
+
+    expect(result).toEqual({ id: "webhook_1", workspaceId: "ws_1" });
+  });
+});
diff --git a/apps/web/app/lib/api/legacy-environment-id.ts b/apps/web/app/lib/api/legacy-environment-id.ts
new file mode 100644
index 000000000000..e4c831f1c668
--- /dev/null
+++ b/apps/web/app/lib/api/legacy-environment-id.ts
@@ -0,0 +1,66 @@
+import "server-only";
+import { prisma } from "@formbricks/database";
+import { logger } from "@formbricks/logger";
+
+/**
+ * Backwards compatibility layer for the environment → workspace rename in API v1 responses.
+ *
+ * Before Formbricks 5, v1 surveys and webhooks carried an `environmentId`. Long-lived integrations
+ * built against v1 (Zapier, Make, n8n) still read that field — e.g. the Zapier "Response Finished"
+ * trigger derives the subscription's environment id from the surveys it lists — so v1 keeps emitting
+ * it as `legacyEnvironmentId ?? workspaceId`.
+ *
+ * That is the same id `GET /api/v1/management/me` returns and the one `resolveBodyIds` accepts back
+ * on writes, so a client can round-trip it without knowing about workspaces (ENG-2270).
+ */
+export const addLegacyEnvironmentIdToList = async <T extends { workspaceId: string }>(
+  entities: T[]
+): Promise<(T & { environmentId: string })[]> => {
+  if (entities.length === 0) return [];
+
+  const workspaceIds = [...new Set(entities.map((entity) => entity.workspaceId))];
+
+  const workspaces = await prisma.workspace.findMany({
+    where: { id: { in: workspaceIds } },
+    select: { id: true, legacyEnvironmentId: true },
+  });
+
+  const legacyEnvironmentIdByWorkspaceId = new Map(
+    workspaces.map((workspace) => [workspace.id, workspace.legacyEnvironmentId])
+  );
+
+  return entities.map((entity) => ({
+    ...entity,
+    // Workspaces created after the migration have no legacy id; their own id is the v1 environment id.
+    environmentId: legacyEnvironmentIdByWorkspaceId.get(entity.workspaceId) ?? entity.workspaceId,
+  }));
+};
+
+export const addLegacyEnvironmentId = async <T extends { workspaceId: string }>(
+  entity: T
+): Promise<T & { environmentId: string }> => {
+  const [entityWithLegacyId] = await addLegacyEnvironmentIdToList([entity]);
+  return entityWithLegacyId;
+};
+
+/**
+ * Variant for responses that echo an already-committed write.
+ *
+ * The write cannot be undone by the time this runs, so a failed workspace lookup must not turn it
+ * into an error response — the caller would retry an operation that already happened. On a delete
+ * that means deleting twice; on a create it means a duplicate row, since `Webhook` has no
+ * uniqueness on `(url, workspaceId)`. Degrades to the un-enriched entity instead.
+ */
+export const addLegacyEnvironmentIdBestEffort = async <T extends { workspaceId: string }>(
+  entity: T
+): Promise<T & { environmentId?: string }> => {
+  try {
+    return await addLegacyEnvironmentId(entity);
+  } catch (error) {
+    logger.error(
+      { error, workspaceId: entity.workspaceId },
+      "Failed to resolve legacy environmentId for a committed write"
+    );
+    return entity;
+  }
+};
diff --git a/apps/web/i18n.lock b/apps/web/i18n.lock
index d024f5c4c937..f31022014fbf 100644
--- a/apps/web/i18n.lock
+++ b/apps/web/i18n.lock
@@ -188,7 +188,6 @@ checksums:
     common/code: 343bc5386149b97cece2b093c39034b2
     common/collapse_rows: 24988527f9180f37aa55d2aa183ccb21
     common/column_n: b98315f0e504fad7e784d77f153a7d9d
-    common/coming_soon: ee2b0671e00972773210c5be5a9ccb89
     common/completed: 0e4bbce9985f25eb673d9a054c8d5334
     common/confirm: 90930b51154032f119fa75c1bd422d8b
     common/connect: 8778ee245078a8be4a2ce855c8c56edc
@@ -3781,7 +3780,6 @@ checksums:
     workspace/unify/allowed_values: 430e0721aa2c52745ef8f8b6918bb7d2
     workspace/unify/api_ingestion: a14642d27bbb6843f9f4903b6555dfbb
     workspace/unify/api_ingestion_settings_description: b4d3f00729154c01d0dd46b551c1f402
-    workspace/unify/api_ingestion_setup_description: d18a267d0e50198682950f5341307fa3
     workspace/unify/auto_generated: 6e83e8febd63275692c444cb8074531d
     workspace/unify/change_file: c5163ac18bf443370228a8ecbb0b07da
     workspace/unify/clear_mapping: 9bd7c716667838b9f203f5af0ac2d651
diff --git a/apps/web/lib/response/service.ts b/apps/web/lib/response/service.ts
index b5b5dcc84e27..d4aa98796cd0 100644
--- a/apps/web/lib/response/service.ts
+++ b/apps/web/lib/response/service.ts
@@ -4,7 +4,6 @@ import { z } from "zod";
 import { prisma } from "@formbricks/database";
 import { Prisma } from "@formbricks/database/prisma";
 import { PrismaErrorType } from "@formbricks/database/types/error";
-import { logger } from "@formbricks/logger";
 import { ZId, ZOptionalNumber, ZString } from "@formbricks/types/common";
 import { DatabaseError, ResourceNotFoundError } from "@formbricks/types/errors";
 import {
@@ -16,14 +15,12 @@ import {
   ZResponseFilterCriteria,
   ZResponseUpdateInput,
 } from "@formbricks/types/responses";
-import { TSurveyElementTypeEnum } from "@formbricks/types/surveys/elements";
 import { TSurvey } from "@formbricks/types/surveys/types";
 import { TTag } from "@formbricks/types/tags";
-import { getElementsFromBlocks } from "@/lib/survey/utils";
 import { getIsQuotasEnabled } from "@/modules/ee/license-check/lib/utils";
 import { reduceQuotaLimits } from "@/modules/ee/quotas/lib/quotas";
-import { deleteFile } from "@/modules/storage/service";
-import { parseStorageFileUrl, resolveStorageUrlsInObject } from "@/modules/storage/utils";
+import { deleteResponseFileUrls } from "@/modules/storage/lib/delete-response-files";
+import { getSurveyFileUploadConfigs, resolveStorageUrlsInObject } from "@/modules/storage/utils";
 import { getOrganizationIdFromWorkspaceId } from "@/modules/survey/lib/organization";
 import { getOrganizationBilling } from "@/modules/survey/lib/survey";
 import { ITEMS_PER_PAGE } from "../constants";
@@ -633,36 +630,20 @@ export const updateResponse = async (
 };
 
 const findAndDeleteUploadedFilesInResponse = async (response: TResponse, survey: TSurvey): Promise<void> => {
-  const elements = getElementsFromBlocks(survey.blocks);
-
-  const fileUploadElements = new Set(
-    elements.filter((element) => element.type === TSurveyElementTypeEnum.FileUpload).map((q) => q.id)
+  // Match write-time validation: a survey holds file uploads in either blocks or questions, so build
+  // the id set from the union of both rather than one shape (getSurveyFileUploadConfigs is exactly what
+  // validateClientFileUploads uses). Keying off a single shape silently skips deletes for the other.
+  const fileUploadElementIds = new Set(
+    getSurveyFileUploadConfigs({ blocks: survey.blocks, questions: survey.questions }).map(
+      (config) => config.id
+    )
   );
 
   const fileUrls = Object.entries(response.data)
-    .filter(([elementId]) => fileUploadElements.has(elementId))
+    .filter(([elementId]) => fileUploadElementIds.has(elementId))
     .flatMap(([, elementResponse]) => elementResponse as string[]);
 
-  const deletionPromises = fileUrls.map(async (fileUrl) => {
-    try {
-      const storageFile = parseStorageFileUrl(fileUrl);
-
-      if (!storageFile) {
-        throw new Error(`Invalid storage file URL: ${fileUrl}`);
-      }
-
-      return deleteFile(
-        storageFile.storageId,
-        storageFile.accessType,
-        storageFile.fileName,
-        survey.workspaceId
-      );
-    } catch (error) {
-      logger.error(error, `Failed to delete file ${fileUrl}`);
-    }
-  });
-
-  await Promise.all(deletionPromises);
+  await deleteResponseFileUrls(fileUrls, survey.workspaceId);
 };
 
 export const deleteResponse = async (
diff --git a/apps/web/locales/en-US.json b/apps/web/locales/en-US.json
index 2be22469a2cb..e126e1c680f4 100644
--- a/apps/web/locales/en-US.json
+++ b/apps/web/locales/en-US.json
@@ -217,7 +217,6 @@
     "code": "Code",
     "collapse_rows": "Collapse rows",
     "column_n": "Column {n}",
-    "coming_soon": "Coming soon",
     "completed": "Completed",
     "confirm": "Confirm",
     "connect": "Connect",
@@ -3941,7 +3940,6 @@
       "allowed_values": "Allowed values: {values}",
       "api_ingestion": "API ingestion",
       "api_ingestion_settings_description": "Create feedback records using the Management API",
-      "api_ingestion_setup_description": "Use the REST API to send feedback records directly into Formbricks. The API ingestion docs include the endpoint, payload shape, and authentication details.",
       "auto_generated": "Auto-generated",
       "change_file": "Change file",
       "clear_mapping": "Clear mapping",
diff --git a/apps/web/modules/api/v2/management/responses/[responseId]/lib/response.ts b/apps/web/modules/api/v2/management/responses/[responseId]/lib/response.ts
index e2381e2eedcc..d066b5a8ac1c 100644
--- a/apps/web/modules/api/v2/management/responses/[responseId]/lib/response.ts
+++ b/apps/web/modules/api/v2/management/responses/[responseId]/lib/response.ts
@@ -114,7 +114,7 @@ export const deleteResponse = async (responseId: string): Promise<Result<Respons
 
     await findAndDeleteUploadedFilesInResponse(
       deletedResponse.data,
-      surveyQuestionsResult.data.questions,
+      surveyQuestionsResult.data,
       surveyQuestionsResult.data.workspaceId
     );
 
diff --git a/apps/web/modules/api/v2/management/responses/[responseId]/lib/tests/response.test.ts b/apps/web/modules/api/v2/management/responses/[responseId]/lib/tests/response.test.ts
index 18f932329162..c355eb045882 100644
--- a/apps/web/modules/api/v2/management/responses/[responseId]/lib/tests/response.test.ts
+++ b/apps/web/modules/api/v2/management/responses/[responseId]/lib/tests/response.test.ts
@@ -320,7 +320,7 @@ describe("Response Lib", () => {
       expect(getSurveyQuestions).toHaveBeenCalledWith(response.surveyId);
       expect(findAndDeleteUploadedFilesInResponse).toHaveBeenCalledWith(
         response.data,
-        survey.questions,
+        survey,
         survey.workspaceId
       );
       expect(result.ok).toBe(true);
diff --git a/apps/web/modules/api/v2/management/responses/[responseId]/lib/tests/utils.test.ts b/apps/web/modules/api/v2/management/responses/[responseId]/lib/tests/utils.test.ts
index 35a1cbf11158..d1d69d7d3ac7 100644
--- a/apps/web/modules/api/v2/management/responses/[responseId]/lib/tests/utils.test.ts
+++ b/apps/web/modules/api/v2/management/responses/[responseId]/lib/tests/utils.test.ts
@@ -2,6 +2,8 @@ import { fileUploadQuestion, openTextQuestion, responseData, workspaceId } from
 import { beforeEach, describe, expect, test, vi } from "vitest";
 import { logger } from "@formbricks/logger";
 import { okVoid } from "@formbricks/types/error-handlers";
+import { TSurveyElementTypeEnum } from "@formbricks/types/surveys/elements";
+import { findWorkspaceByIdOrLegacyEnvId } from "@/lib/utils/resolve-client-id";
 import { deleteFile } from "@/modules/storage/service";
 import { findAndDeleteUploadedFilesInResponse } from "../utils";
 
@@ -11,28 +13,89 @@ vi.mock("@formbricks/logger", () => ({
   },
 }));
 
+vi.mock("@/lib/utils/resolve-client-id", () => ({
+  findWorkspaceByIdOrLegacyEnvId: vi.fn(),
+}));
+
 vi.mock("@/modules/storage/service", () => ({
   deleteFile: vi.fn(),
 }));
 
+// The delete helper takes a survey shape ({ blocks, questions }); most cases here only use questions.
+const questionsSurvey = (questions: unknown[]) => ({ questions, blocks: [] }) as any;
+
 describe("findAndDeleteUploadedFilesInResponse", () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    // Default: every storage id resolves back to the survey's own workspace, so deletion is authorized.
+    vi.mocked(findWorkspaceByIdOrLegacyEnvId).mockResolvedValue({
+      id: workspaceId,
+      organizationId: "org-1",
+    });
+    vi.mocked(deleteFile).mockResolvedValue({ ok: true, data: undefined });
   });
 
   test("delete files for file upload questions and return okVoid", async () => {
-    vi.mocked(deleteFile).mockResolvedValue({ ok: true, data: undefined });
-
-    const result = await findAndDeleteUploadedFilesInResponse(responseData, [fileUploadQuestion]);
+    const result = await findAndDeleteUploadedFilesInResponse(
+      responseData,
+      questionsSurvey([fileUploadQuestion]),
+      workspaceId
+    );
 
     expect(deleteFile).toHaveBeenCalledTimes(2);
-    expect(deleteFile).toHaveBeenCalledWith(workspaceId, "private", "file1.png", undefined);
-    expect(deleteFile).toHaveBeenCalledWith(workspaceId, "private", "file2.pdf", undefined);
+    expect(deleteFile).toHaveBeenCalledWith(workspaceId, "private", "file1.png", workspaceId);
+    expect(deleteFile).toHaveBeenCalledWith(workspaceId, "private", "file2.pdf", workspaceId);
+    expect(result).toEqual(okVoid());
+  });
+
+  // File uploads can live in blocks instead of questions; this path used to key off questions only, so
+  // it silently deleted nothing for block-based surveys and leaked their uploads.
+  test("delete files for block-based file-upload elements", async () => {
+    const elementId = "block-file-upload-element";
+    const blockSurvey = {
+      questions: [],
+      blocks: [{ id: "block-1", elements: [{ id: elementId, type: TSurveyElementTypeEnum.FileUpload }] }],
+    } as any;
+    const blockResponseData = {
+      [elementId]: [`https://example.com/storage/${workspaceId}/private/block-file.png`],
+    } as any;
+
+    const result = await findAndDeleteUploadedFilesInResponse(blockResponseData, blockSurvey, workspaceId);
+
+    expect(deleteFile).toHaveBeenCalledTimes(1);
+    expect(deleteFile).toHaveBeenCalledWith(workspaceId, "private", "block-file.png", workspaceId);
     expect(result).toEqual(okVoid());
   });
 
   test("not call deleteFile if no file upload questions match response data", async () => {
-    const result = await findAndDeleteUploadedFilesInResponse(responseData, [openTextQuestion]);
+    const result = await findAndDeleteUploadedFilesInResponse(
+      responseData,
+      questionsSurvey([openTextQuestion]),
+      workspaceId
+    );
+
+    expect(deleteFile).not.toHaveBeenCalled();
+    expect(result).toEqual(okVoid());
+  });
+
+  // A planted URL pointing into another tenant's storage prefix must not be deleted, even though the
+  // survey now lists a file-upload question whose id matches the planted response key (the TOCTOU).
+  test("refuse to delete a file whose storage id belongs to a different workspace", async () => {
+    const foreignWorkspaceId = "foreign-workspace-id";
+    vi.mocked(findWorkspaceByIdOrLegacyEnvId).mockResolvedValue({
+      id: foreignWorkspaceId,
+      organizationId: "org-2",
+    });
+
+    const plantedData = {
+      [fileUploadQuestion.id]: [`https://example.com/storage/${foreignWorkspaceId}/public/victim.png`],
+    } as any;
+
+    const result = await findAndDeleteUploadedFilesInResponse(
+      plantedData,
+      questionsSurvey([fileUploadQuestion]),
+      workspaceId
+    );
 
     expect(deleteFile).not.toHaveBeenCalled();
     expect(result).toEqual(okVoid());
@@ -40,13 +103,17 @@ describe("findAndDeleteUploadedFilesInResponse", () => {
 
   test("handle invalid file URLs and log errors", async () => {
     const invalidFileUrl = "https://example.com/invalid-url";
-    const responseData = {
+    const invalidResponseData = {
       [fileUploadQuestion.id]: [invalidFileUrl],
-    };
+    } as any;
 
     const loggerSpy = vi.spyOn(logger, "error");
 
-    const result = await findAndDeleteUploadedFilesInResponse(responseData, [fileUploadQuestion]);
+    const result = await findAndDeleteUploadedFilesInResponse(
+      invalidResponseData,
+      questionsSurvey([fileUploadQuestion]),
+      workspaceId
+    );
 
     expect(deleteFile).not.toHaveBeenCalled();
     expect(loggerSpy).toHaveBeenCalled();
@@ -56,13 +123,15 @@ describe("findAndDeleteUploadedFilesInResponse", () => {
   });
 
   test("process multiple file URLs", async () => {
-    vi.mocked(deleteFile).mockResolvedValue({ ok: true, data: undefined });
-
-    const result = await findAndDeleteUploadedFilesInResponse(responseData, [fileUploadQuestion]);
+    const result = await findAndDeleteUploadedFilesInResponse(
+      responseData,
+      questionsSurvey([fileUploadQuestion]),
+      workspaceId
+    );
 
     expect(deleteFile).toHaveBeenCalledTimes(2);
-    expect(deleteFile).toHaveBeenNthCalledWith(1, workspaceId, "private", "file1.png", undefined);
-    expect(deleteFile).toHaveBeenNthCalledWith(2, workspaceId, "private", "file2.pdf", undefined);
+    expect(deleteFile).toHaveBeenCalledWith(workspaceId, "private", "file1.png", workspaceId);
+    expect(deleteFile).toHaveBeenCalledWith(workspaceId, "private", "file2.pdf", workspaceId);
     expect(result).toEqual(okVoid());
   });
 });
diff --git a/apps/web/modules/api/v2/management/responses/[responseId]/lib/utils.ts b/apps/web/modules/api/v2/management/responses/[responseId]/lib/utils.ts
index 435d6d4d273b..50c36299f337 100644
--- a/apps/web/modules/api/v2/management/responses/[responseId]/lib/utils.ts
+++ b/apps/web/modules/api/v2/management/responses/[responseId]/lib/utils.ts
@@ -1,42 +1,29 @@
 import { Response, Survey } from "@formbricks/database/prisma";
-import { logger } from "@formbricks/logger";
 import { Result, okVoid } from "@formbricks/types/error-handlers";
-import { TSurveyQuestionTypeEnum } from "@formbricks/types/surveys/types";
 import { ApiErrorResponseV2 } from "@/modules/api/v2/types/api-error";
-import { deleteFile } from "@/modules/storage/service";
-import { parseStorageFileUrl } from "@/modules/storage/utils";
+import { deleteResponseFileUrls } from "@/modules/storage/lib/delete-response-files";
+import { getSurveyFileUploadConfigs } from "@/modules/storage/utils";
 
 export const findAndDeleteUploadedFilesInResponse = async (
   responseData: Response["data"],
-  questions: Survey["questions"],
+  survey: Pick<Survey, "blocks" | "questions">,
   workspaceId?: string
 ): Promise<Result<void, ApiErrorResponseV2>> => {
-  const fileUploadQuestions = new Set(
-    questions
-      .filter(
-        (question: { type: string; id: string }) => question.type === TSurveyQuestionTypeEnum.FileUpload
-      )
-      .map((q: { type: string; id: string }) => q.id)
+  // A survey holds file uploads in either blocks or questions, so build the id set from the union of
+  // both — the same source write-time validation uses. A questions-only set silently skipped deletes
+  // for block-based surveys (the common shape), leaking their uploads.
+  const fileUploadElementIds = new Set(
+    getSurveyFileUploadConfigs({
+      blocks: survey.blocks,
+      questions: survey.questions,
+    }).map((config) => config.id)
   );
 
   const fileUrls = Object.entries(responseData)
-    .filter(([questionId]) => fileUploadQuestions.has(questionId))
-    .flatMap(([, questionResponse]) => questionResponse as string[]);
+    .filter(([elementId]) => fileUploadElementIds.has(elementId))
+    .flatMap(([, elementResponse]) => elementResponse as string[]);
 
-  const deletionPromises = fileUrls.map(async (fileUrl) => {
-    try {
-      const storageFile = parseStorageFileUrl(fileUrl);
-
-      if (!storageFile) {
-        throw new Error(`Invalid storage file URL: ${fileUrl}`);
-      }
-      return deleteFile(storageFile.storageId, storageFile.accessType, storageFile.fileName, workspaceId);
-    } catch (error) {
-      logger.error({ error, fileUrl }, "Failed to delete file");
-    }
-  });
-
-  await Promise.all(deletionPromises);
+  await deleteResponseFileUrls(fileUrls, workspaceId);
 
   return okVoid();
 };
diff --git a/apps/web/modules/auth/lib/better-auth-error-context.integration.test.ts b/apps/web/modules/auth/lib/better-auth-error-context.integration.test.ts
new file mode 100644
index 000000000000..95992856aaf2
--- /dev/null
+++ b/apps/web/modules/auth/lib/better-auth-error-context.integration.test.ts
@@ -0,0 +1,169 @@
+import * as Sentry from "@sentry/nextjs";
+import { APIError } from "better-auth/api";
+import { beforeEach, describe, expect, test, vi } from "vitest";
+import { GET, POST } from "@/app/api/auth/[...all]/route";
+import { auth } from "@/modules/auth/lib/auth";
+import { createAuthPathLabeller } from "@/modules/auth/lib/better-auth-path-label";
+
+/**
+ * ENG-2259 / FORMBRICKS-183 — the endpoint label must survive the real Better Auth request.
+ *
+ * This has to be an integration test. The question is whether the AsyncLocalStorage store opened by
+ * the route is still readable by the time better-call's router catches an unexpected throw and calls
+ * our logger — a chain that lives entirely inside `auth.handler`. A unit test with a mocked handler
+ * asserts its own arrangement; only the real router can answer it.
+ *
+ * Kept in its own file rather than folded into better-auth-observability.integration.test.ts so the
+ * IS_PRODUCTION override below cannot perturb that file's audit assertions.
+ */
+
+// betterAuthLogger only captures when SENTRY_DSN && IS_PRODUCTION; force both on for this file.
+vi.mock("@/lib/constants", async (importActual) => ({
+  ...(await importActual<typeof import("@/lib/constants")>()),
+  IS_PRODUCTION: true,
+  SENTRY_DSN: "https://examplePublicKey@o0.ingest.sentry.io/0",
+}));
+
+vi.mock("@sentry/nextjs", () => ({ captureException: vi.fn() }));
+
+// Fault injection: `ssoLicenseGateBeforeHandler` is the first thing hooks.before awaits and it runs on
+// every request, so throwing here produces a genuine non-APIError inside the router on whatever path
+// we drive — the same shape as the production fault (a TypeError from an awaited async auth path).
+// Spread the real module so ssoDatabaseHooks and the rest of auth.ts's wiring stay intact.
+const FAULT_MESSAGE = "Cannot read properties of null (reading 'id')";
+vi.mock("@/modules/ee/sso/lib/better-auth-hooks", async (importActual) => ({
+  ...(await importActual<typeof import("@/modules/ee/sso/lib/better-auth-hooks")>()),
+  ssoLicenseGateBeforeHandler: vi.fn(async () => {
+    throw new TypeError(FAULT_MESSAGE);
+  }),
+}));
+
+const capturedFault = () => {
+  const call = vi
+    .mocked(Sentry.captureException)
+    .mock.calls.find(([error]) => error instanceof TypeError && error.message === FAULT_MESSAGE);
+  if (!call) throw new Error("the injected fault never reached Sentry.captureException");
+  return { error: call[0], context: call[1] as { tags?: Record<string, unknown> } | undefined };
+};
+
+describe("Better Auth internal fault — Sentry capture carries the endpoint (real router)", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  test("tags the capture with the endpoint the request was for", async () => {
+    const response = await POST(
+      new Request("http://localhost/api/auth/sign-in/email", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ email: "someone@example.com", password: "irrelevant" }),
+      })
+    );
+
+    // The fault is internal, so Better Auth answers 500 — and before ENG-2259 that was all we knew.
+    expect(response.status).toBe(500);
+
+    const { context } = capturedFault();
+    expect(context?.tags).toMatchObject({
+      component: "better-auth",
+      "auth.path": "/sign-in/email",
+      "http.method": "POST",
+    });
+  });
+
+  test("never carries the token from /reset-password/:token, or anything from the query string", async () => {
+    // A real password-reset token: better-auth declares this endpoint with the token as a PATH
+    // segment, so an unsanitized capture would put a live account-takeover credential into Sentry.
+    const token = "faketokenfaketokenfaketoken00001";
+    const callbackSecret = "fakestatefakestatefakestate00001";
+
+    await GET(
+      new Request(
+        `http://localhost/api/auth/reset-password/${token}?callbackURL=/auth/forgot-password/reset&state=${callbackSecret}`
+      )
+    );
+
+    const { context } = capturedFault();
+    // The endpoint is still named — only the secret in its path is dropped.
+    expect(context?.tags).toMatchObject({ "auth.path": "/reset-password/*", "http.method": "GET" });
+    // Belt and braces: nothing anywhere in the captured payload, tags or extra.
+    expect(JSON.stringify(context)).not.toContain(token);
+    expect(JSON.stringify(context)).not.toContain(callbackSecret);
+  });
+
+  test("a handled APIError is still not captured — the ENG-2037 gate is unchanged", async () => {
+    const { ssoLicenseGateBeforeHandler } = await import("@/modules/ee/sso/lib/better-auth-hooks");
+    vi.mocked(ssoLicenseGateBeforeHandler).mockImplementationOnce(async () => {
+      throw new APIError("FORBIDDEN", { message: "SSO is not enabled for this instance." });
+    });
+
+    const response = await POST(
+      new Request("http://localhost/api/auth/sign-in/email", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ email: "someone@example.com", password: "irrelevant" }),
+      })
+    );
+
+    expect(response.status).toBe(403);
+    expect(Sentry.captureException).not.toHaveBeenCalled();
+  });
+});
+
+/**
+ * The labeller's unit tests prove the rules against a hand-written fixture, which cannot notice the
+ * registry changing underneath them: a Better Auth upgrade that adds a parameterized endpoint — or
+ * moves a parameter to the first segment — leaves every one of them green. These bind the same rules
+ * to the REAL registry, so the upgrade breaks a test instead of leaking quietly.
+ */
+describe("the label vocabulary matches the real Better Auth registry", () => {
+  const endpoints = Object.values(auth.api) as { path?: string; options?: { metadata?: unknown } }[];
+  const declaredPaths = endpoints
+    .map((endpoint) => endpoint.path)
+    .filter((path): path is string => typeof path === "string");
+  const label = createAuthPathLabeller(declaredPaths);
+
+  test("the vocabulary is actually populated, and names a real endpoint in full", () => {
+    // Guards the degenerate failure: if `auth` ever became lazy, the module-scope build in route.ts
+    // would read an empty registry and label every request "unknown" — degraded, not leaky, but
+    // silently useless.
+    expect(declaredPaths.length).toBeGreaterThan(50);
+    expect(label("http://localhost/api/auth/sign-in/email")).toBe("/sign-in/email");
+  });
+
+  test("no declared parameter sits in the first segment", () => {
+    // The fallback emits the first segment, so a first-segment parameter is the one shape that could
+    // put a caller-supplied value in a tag. It cannot today (a random value is not in the vocabulary,
+    // so it labels "unknown"), but this keeps the assumption stated rather than assumed.
+    const firstSegmentParams = declaredPaths.filter((path) => path.split("/")[1]?.startsWith(":"));
+
+    expect(firstSegmentParams).toEqual([]);
+  });
+
+  test("every parameterized endpoint in the real registry degrades instead of emitting its parameter", () => {
+    const parameterized = declaredPaths.filter((path) => path.includes(":"));
+    // /callback/:id, /reset-password/:token, /oauth2/callback/:providerId at better-auth 1.6.23.
+    expect(parameterized.length).toBeGreaterThan(0);
+
+    for (const pattern of parameterized) {
+      const secret = "faketokenfaketokenfaketoken00001";
+      const concrete = pattern.replace(/:[^/]+/g, secret);
+
+      expect(label(`http://localhost/api/auth${concrete}`)).not.toContain(secret);
+    }
+  });
+
+  test("endpoints with no declared path are all server-only, so the vocabulary covers the HTTP surface", () => {
+    // The vocabulary is derived from declared paths, so anything routable that lacks one would label
+    // "unknown". Today the only path-less endpoints are SERVER_ONLY (setPassword, signJWT, verifyJWT,
+    // generateTOTP, viewBackupCodes) and unreachable through auth.handler. better-call is moving
+    // toward path-less endpoints in general, so if a routable one ever loses its path this fails.
+    const routablePathless = endpoints.filter((endpoint) => {
+      if (typeof endpoint.path === "string") return false;
+      const metadata = endpoint.options?.metadata as { SERVER_ONLY?: boolean } | undefined;
+      return metadata?.SERVER_ONLY !== true;
+    });
+
+    expect(routablePathless).toEqual([]);
+  });
+});
diff --git a/apps/web/modules/auth/lib/better-auth-observability.test.ts b/apps/web/modules/auth/lib/better-auth-observability.test.ts
index 0b106f29ea40..7176ec1d23ae 100644
--- a/apps/web/modules/auth/lib/better-auth-observability.test.ts
+++ b/apps/web/modules/auth/lib/better-auth-observability.test.ts
@@ -13,6 +13,7 @@ import {
   redactEmailsInLogMessage,
   signInAuditDatabaseHook,
 } from "./better-auth-observability";
+import { runWithBetterAuthRequestContext } from "./better-auth-request-context";
 import { finalizeSuccessfulSignIn } from "./sign-in-tracking";
 import { logAuthAttempt, shouldLogAuthFailure } from "./utils";
 
@@ -344,7 +345,11 @@ describe("betterAuthLogger (Sentry capture gating, ENG-2037)", () => {
 
     log("error", "Better auth was unable to query your database.\nError: ", dbError);
 
-    expect(Sentry.captureException).toHaveBeenCalledWith(dbError);
+    // Outside the HTTP handler there is no request context, so the endpoint tags are absent — the
+    // capture still happens, which is what keeps `auth.api.*` faults reportable (ENG-2259).
+    expect(Sentry.captureException).toHaveBeenCalledWith(dbError, {
+      tags: { component: "better-auth" },
+    });
   });
 
   test("captures the deadlock DriverAdapterError so the ENG-2038 signal stays visible", () => {
@@ -353,7 +358,9 @@ describe("betterAuthLogger (Sentry capture gating, ENG-2037)", () => {
 
     log("error", deadlock);
 
-    expect(Sentry.captureException).toHaveBeenCalledWith(deadlock);
+    expect(Sentry.captureException).toHaveBeenCalledWith(deadlock, {
+      tags: { component: "better-auth" },
+    });
   });
 
   test("warn-level logs are never captured", () => {
@@ -370,3 +377,81 @@ describe("betterAuthLogger (Sentry capture gating, ENG-2037)", () => {
     expect(contextLoggerMock.info).toHaveBeenCalledWith("some info");
   });
 });
+
+// ENG-2259: Better Auth's router logs a non-APIError as `(e.name, e)` and drops the endpoint, so the
+// capture arrived with no transaction, URL or route and FORMBRICKS-183 could not be triaged at all.
+// The request context supplies the endpoint; these cases pin that it reaches Sentry AND the local log,
+// and that its absence degrades rather than breaking the capture.
+describe("betterAuthLogger (request-path tagging, ENG-2259)", () => {
+  const log = betterAuthLogger.log!;
+  const fault = () => new TypeError("Cannot read properties of null (reading 'id')");
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  test("tags the capture with the endpoint label and method", () => {
+    const cause = fault();
+
+    runWithBetterAuthRequestContext({ path: "/oauth2/userinfo", method: "GET" }, () => {
+      log("error", "TypeError", cause);
+    });
+
+    expect(Sentry.captureException).toHaveBeenCalledWith(cause, {
+      tags: { component: "better-auth", "auth.path": "/oauth2/userinfo", "http.method": "GET" },
+    });
+  });
+
+  test("puts the endpoint in the local log context too, for self-hosters with no Sentry", () => {
+    runWithBetterAuthRequestContext({ path: "/sign-in/email", method: "POST" }, () => {
+      log("error", "TypeError", fault());
+    });
+
+    // `httpMethod`, not `authMethod`: the latter already means the authentication method
+    // (password / sso) in this very file's sign-in audit, and overloading it would mix HTTP verbs
+    // into a field self-hosters query for auth methods.
+    expect(logger.withContext).toHaveBeenCalledWith({
+      source: "better-auth",
+      authPath: "/sign-in/email",
+      httpMethod: "POST",
+    });
+  });
+
+  test("still captures, untagged, when there is no request context", () => {
+    const cause = fault();
+
+    log("error", "TypeError", cause);
+
+    expect(Sentry.captureException).toHaveBeenCalledWith(cause, {
+      tags: { component: "better-auth" },
+    });
+    // An untagged capture is itself diagnostic: it means the throw did not come through auth.handler.
+    // Array form, not `"tags.auth.path"`: vitest reads a dotted string as a property PATH, so it would
+    // look for `tags` → `auth` → `path`, a nesting that never exists, and pass whether or not the tag
+    // is set. The key is flat — `tags["auth.path"]` — and only the array form escapes the dot.
+    const [, captureContext] = vi.mocked(Sentry.captureException).mock.calls[0];
+    expect(captureContext).not.toHaveProperty(["tags", "auth.path"]);
+    expect(logger.withContext).toHaveBeenCalledWith({ source: "better-auth" });
+  });
+
+  test("never forwards the Better Auth message to Sentry, only tags", () => {
+    // `redactEmailsInLogMessage` strips emails and nothing else, so a message string is not a safe
+    // Sentry payload — a plugin logging a token in one would forward it verbatim. The capture stays
+    // `Error` + bounded tags, which is what keeps the module header's claim true.
+    runWithBetterAuthRequestContext({ path: "/sign-in/email", method: "POST" }, () => {
+      log("error", "failure for reset token faketokenfaketokenfaketoken00001", fault());
+    });
+
+    const [, captureContext] = vi.mocked(Sentry.captureException).mock.calls[0];
+    expect(captureContext).not.toHaveProperty("extra");
+    expect(JSON.stringify(captureContext)).not.toContain("faketokenfaketokenfaketoken00001");
+  });
+
+  test("does not tag a handled APIError into Sentry — the ENG-2037 gate still wins", () => {
+    runWithBetterAuthRequestContext({ path: "/sign-in/email", method: "POST" }, () => {
+      log("error", "Invalid email or password", new APIError("UNAUTHORIZED", { message: "nope" }));
+    });
+
+    expect(Sentry.captureException).not.toHaveBeenCalled();
+  });
+});
diff --git a/apps/web/modules/auth/lib/better-auth-observability.ts b/apps/web/modules/auth/lib/better-auth-observability.ts
index 4b12e3b3bcba..cc5c5d2ce8fd 100644
--- a/apps/web/modules/auth/lib/better-auth-observability.ts
+++ b/apps/web/modules/auth/lib/better-auth-observability.ts
@@ -8,6 +8,7 @@ import { IS_PRODUCTION, SENTRY_DSN } from "@/lib/constants";
 import { queueAuditEventBackground } from "@/modules/ee/audit-logs/lib/handler";
 import { UNKNOWN_DATA } from "@/modules/ee/audit-logs/types/audit-log";
 import type { AuthHookContext } from "@/modules/ee/sso/lib/better-auth-hooks";
+import { getBetterAuthRequestContext } from "./better-auth-request-context";
 import { finalizeSuccessfulSignIn } from "./sign-in-tracking";
 import { logAuthAttempt, shouldLogAuthFailure } from "./utils";
 
@@ -149,7 +150,16 @@ export const betterAuthLogger: NonNullable<BetterAuthOptions["logger"]> = {
   level: "warn",
   disableColors: true,
   log: (level, message, ...args) => {
-    const contextLogger = logger.withContext({ source: "better-auth" });
+    // Endpoint label for the request being served, or undefined outside the HTTP handler (instance
+    // construction, a server-side `auth.api.*` call). Already reduced to a safe label — never a raw
+    // path, which on `/reset-password/:token` would be a live credential (better-auth-path-label.ts).
+    const request = getBetterAuthRequestContext();
+    const contextLogger = logger.withContext({
+      source: "better-auth",
+      // Self-hosters have no Sentry, so the label has to reach the application log too — otherwise
+      // their copy of this fault stays as untriageable as FORMBRICKS-183 was.
+      ...(request && { authPath: request.path, httpMethod: request.method }),
+    });
     const safeMessage = redactEmailsInLogMessage(message);
     if (level === "error") {
       contextLogger.error(safeMessage);
@@ -159,7 +169,21 @@ export const betterAuthLogger: NonNullable<BetterAuthOptions["logger"]> = {
         // Skip handled rejections: a bare string code (no Error) or a client-facing APIError. Capture
         // only genuine internal faults so Sentry stays actionable (see the reason-split above).
         if (cause && !isAPIError(cause)) {
-          Sentry.captureException(cause);
+          // ENG-2259: Better Auth's router logs a non-APIError as `(e.name, e)` and discards the
+          // endpoint (`better-auth/dist/api/index.mjs:210`), so a bare capture arrives with no
+          // transaction, URL or route — which is why FORMBRICKS-183 sat at ~242 events untriageable.
+          // Tags don't affect grouping, so the issue stays one issue with `auth.path` as a facet.
+          Sentry.captureException(cause, {
+            tags: {
+              component: "better-auth",
+              ...(request && { "auth.path": request.path, "http.method": request.method }),
+            },
+            // No `extra`. Forwarding `message` was considered and dropped: `redactEmailsInLogMessage`
+            // strips emails and nothing else, so a plugin logging `error("… <token> …", err)` would
+            // put that token in Sentry verbatim — while the message adds nothing, being either the
+            // error's own name or a sentence accompanying the Error already captured here. Keeping
+            // Sentry to `Error`-or-nothing is what makes the header note above stay true.
+          });
         }
       }
     } else if (level === "warn") {
diff --git a/apps/web/modules/auth/lib/better-auth-path-label.test.ts b/apps/web/modules/auth/lib/better-auth-path-label.test.ts
new file mode 100644
index 000000000000..6f466a184529
--- /dev/null
+++ b/apps/web/modules/auth/lib/better-auth-path-label.test.ts
@@ -0,0 +1,129 @@
+import { describe, expect, test } from "vitest";
+import { UNKNOWN_AUTH_PATH_LABEL, createAuthPathLabeller } from "./better-auth-path-label";
+
+// Mirrors the real registry's shape: literal endpoints plus the four routes better-auth@1.6.23
+// declares with a path parameter. `/reset-password/:token` is the dangerous one — its parameter is a
+// live password-reset token.
+const DECLARED_PATHS = [
+  "/get-session",
+  "/sign-in/email",
+  "/sign-up/email",
+  "/two-factor/verify-totp",
+  "/request-password-reset",
+  "/reset-password",
+  "/reset-password/:token",
+  "/callback/:id",
+  "/oauth2/authorize",
+  "/oauth2/token",
+  "/oauth2/userinfo",
+  "/oauth2/callback/:providerId",
+  "/oauth2/client/:id",
+];
+
+const label = createAuthPathLabeller(DECLARED_PATHS);
+
+// Shaped like a real reset token — 32 lowercase alphanumerics — so no character-class heuristic could
+// tell it apart from a literal path segment; only the exact-match rule can. Deliberately repetitive
+// and low-entropy so secret scanners don't flag the fixture itself.
+const RESET_TOKEN = "faketokenfaketokenfaketoken00001";
+
+describe("createAuthPathLabeller — the security invariant (ENG-2259)", () => {
+  test("never emits the token from /reset-password/:token", () => {
+    const result = label(`https://app.formbricks.com/api/auth/reset-password/${RESET_TOKEN}`);
+
+    // The endpoint is still named — only the secret in it is dropped.
+    expect(result).toBe("/reset-password/*");
+    expect(result).not.toContain(RESET_TOKEN);
+  });
+
+  test("never emits the parameter of ANY declared parameterized route", () => {
+    // The general form of the case above: whatever better-auth declares with a `:param` today or after
+    // an upgrade, a concrete request for it cannot exact-match the pattern, so it degrades. This is the
+    // property that makes the labeller safe without a hand-maintained list of sensitive paths.
+    const parameterized = DECLARED_PATHS.filter((path) => path.includes(":"));
+    expect(parameterized.length).toBeGreaterThan(0);
+
+    for (const pattern of parameterized) {
+      const concrete = pattern.replace(/:[^/]+/g, RESET_TOKEN);
+      expect(label(`https://app.formbricks.com/api/auth${concrete}`)).not.toContain(RESET_TOKEN);
+    }
+  });
+
+  test("drops the query string, which carries OAuth codes and verification tokens", () => {
+    const result = label(`https://app.formbricks.com/api/auth/oauth2/token?code=${RESET_TOKEN}&state=abc123`);
+
+    expect(result).toBe("/oauth2/token");
+    expect(result).not.toContain(RESET_TOKEN);
+    expect(result).not.toContain("abc123");
+  });
+});
+
+describe("createAuthPathLabeller — labelling rules", () => {
+  test("emits a parameter-free declared path whole", () => {
+    expect(label("https://app.formbricks.com/api/auth/sign-in/email")).toBe("/sign-in/email");
+    expect(label("https://app.formbricks.com/api/auth/get-session")).toBe("/get-session");
+  });
+
+  test("keeps the oauth2 endpoints distinct, which is what the MCP-OAuth lead needs", () => {
+    const labels = ["/oauth2/token", "/oauth2/userinfo", "/oauth2/authorize"].map((path) =>
+      label(`https://app.formbricks.com/api/auth${path}`)
+    );
+
+    expect(labels).toEqual(["/oauth2/token", "/oauth2/userinfo", "/oauth2/authorize"]);
+  });
+
+  test("falls back to the first segment for an undeclared deeper path", () => {
+    expect(label("https://app.formbricks.com/api/auth/sign-in/passkey")).toBe("/sign-in/*");
+  });
+
+  test("labels an unrecognized first segment unknown, bounding tag cardinality", () => {
+    expect(label("https://app.formbricks.com/api/auth/not-an-endpoint")).toBe(UNKNOWN_AUTH_PATH_LABEL);
+    expect(label("https://app.formbricks.com/api/auth/%2e%2e/etc/passwd")).toBe(UNKNOWN_AUTH_PATH_LABEL);
+  });
+
+  test("resolves the path when the app is served from a Next.js basePath subpath", () => {
+    expect(label("https://example.com/formbricks/api/auth/sign-in/email")).toBe("/sign-in/email");
+  });
+
+  test("labels a URL outside the auth base path, or an unparseable one, unknown", () => {
+    expect(label("https://app.formbricks.com/api/v1/surveys")).toBe(UNKNOWN_AUTH_PATH_LABEL);
+    expect(label("not-a-url")).toBe(UNKNOWN_AUTH_PATH_LABEL);
+  });
+
+  test("every emitted label is rooted or the unknown marker, so one Sentry facet stays filterable", () => {
+    const labels = [
+      "/api/auth/sign-in/email",
+      "/api/auth/sign-in/passkey",
+      "/api/auth/reset-password",
+      `/api/auth/reset-password/${RESET_TOKEN}`,
+      "/api/auth/oauth2/token",
+      "/api/auth/not-an-endpoint",
+    ].map((path) => label(`https://app.formbricks.com${path}`));
+
+    for (const emitted of labels) {
+      expect(emitted === UNKNOWN_AUTH_PATH_LABEL || emitted.startsWith("/")).toBe(true);
+    }
+  });
+
+  test("a trailing slash does not split a known endpoint across two facet values", () => {
+    expect(label("https://app.formbricks.com/api/auth/get-session/")).toBe("/get-session");
+    expect(label("https://app.formbricks.com/api/auth/sign-in/email//")).toBe("/sign-in/email");
+  });
+
+  test("a truncated label never collides with the same-named literal endpoint", () => {
+    // `/reset-password` (POST, performs the reset) and `/reset-password/:token` (GET callback) are
+    // different endpoints; merging them into one bucket would lose the distinction that matters when
+    // reading which one is throwing.
+    expect(label("https://app.formbricks.com/api/auth/reset-password")).toBe("/reset-password");
+    expect(label(`https://app.formbricks.com/api/auth/reset-password/${RESET_TOKEN}`)).toBe(
+      "/reset-password/*"
+    );
+  });
+
+  test("ignores declared entries that are not usable paths", () => {
+    const tolerant = createAuthPathLabeller(["/get-session", "", "no-leading-slash", undefined as never]);
+
+    expect(tolerant("https://app.formbricks.com/api/auth/get-session")).toBe("/get-session");
+    expect(tolerant("https://app.formbricks.com/api/auth/no-leading-slash")).toBe(UNKNOWN_AUTH_PATH_LABEL);
+  });
+});
diff --git a/apps/web/modules/auth/lib/better-auth-path-label.ts b/apps/web/modules/auth/lib/better-auth-path-label.ts
new file mode 100644
index 000000000000..2169c160b92d
--- /dev/null
+++ b/apps/web/modules/auth/lib/better-auth-path-label.ts
@@ -0,0 +1,87 @@
+import "server-only";
+
+/**
+ * Reduce a Better Auth request URL to a label that is safe to put in a Sentry tag and an application
+ * log (ENG-2259).
+ *
+ * Why a labeller and not the raw path: Better Auth declares
+ * `createAuthEndpoint("/reset-password/:token")`, so on that endpoint the password-reset token is a
+ * PATH SEGMENT — and better-call resolves both `request.url` and `ctx.path` to the CONCRETE path, not
+ * the route pattern (better-call `router.mjs`, `path = pathname.slice(basePath.length)` → `context.mjs`).
+ * Emitting either would write a live account-takeover credential into Sentry and the logs.
+ *
+ * The vocabulary is therefore derived from Better Auth's own endpoint registry rather than
+ * hand-maintained: better-call stamps each endpoint function with its DECLARED path
+ * (better-call `endpoint.mjs`, `internalHandler.path = path`), so every parameterized route arrives
+ * here containing `:` and can never be matched verbatim by a concrete request.
+ * `/reset-password/<token>` degrades to
+ * `/reset-password/*`, and a token-bearing endpoint added by a future Better Auth upgrade is covered the
+ * same way with no code change here — which is the point, since the version is not pinned forever.
+ *
+ * Full paths are kept where they carry diagnostic value: `/oauth2/userinfo`, `/oauth2/token` and
+ * `/oauth2/authorize` stay distinct, and telling them apart is exactly what the ENG-2259 MCP-OAuth
+ * lead needs. A first-segment-only scheme would collapse them into `oauth2`.
+ *
+ * The query string is never read. `/verify-email?token=…` and OAuth callbacks with `?code=&state=`
+ * carry credentials there.
+ *
+ * Two emitted shapes, both starting with `/` so they sort and filter together in one Sentry facet:
+ * an exact declared path (`/sign-in/email`), or a truncated one (`/reset-password/*`) when the request
+ * named an endpoint we will not spell out in full. Anything else is `unknown`.
+ */
+
+// Deliberately a local copy of the literal in oauth-urls.ts rather than an import: that module reads
+// `@/lib/env`, and pulling env validation into this one would cost it the property that makes it
+// exhaustively testable — no dependencies, no environment. Both sites are grep-findable as
+// "/api/auth" if the base path ever becomes configurable (ENG-606).
+const AUTH_BASE_PATH = "/api/auth";
+
+/** Emitted when the URL is unparseable or names no endpoint we serve. Bounds tag cardinality. */
+export const UNKNOWN_AUTH_PATH_LABEL = "unknown";
+
+const getFirstSegment = (path: string): string | undefined => path.split("/")[1] || undefined;
+
+export const createAuthPathLabeller = (declaredPaths: Iterable<string>): ((url: string) => string) => {
+  // Only parameter-free declared paths may be emitted verbatim. Patterns still contribute their first
+  // segment, so `/reset-password/<token>` degrades to a recognized `/reset-password/*` rather than to
+  // `unknown` — the endpoint is still named, just not the secret in it.
+  const literalPaths = new Set<string>();
+  const knownFirstSegments = new Set<string>();
+
+  for (const declaredPath of declaredPaths) {
+    if (typeof declaredPath !== "string" || !declaredPath.startsWith("/")) continue;
+    const firstSegment = getFirstSegment(declaredPath);
+    if (firstSegment) knownFirstSegments.add(firstSegment);
+    if (!declaredPath.includes(":")) literalPaths.add(declaredPath);
+  }
+
+  return (url: string): string => {
+    let pathname: string;
+    try {
+      pathname = new URL(url).pathname;
+    } catch {
+      return UNKNOWN_AUTH_PATH_LABEL;
+    }
+
+    // `indexOf` rather than `startsWith` so a Next.js basePath deployment (the app served from a
+    // subpath) still resolves to the Better Auth path instead of labelling every request `unknown`.
+    const baseIndex = pathname.indexOf(AUTH_BASE_PATH);
+    if (baseIndex === -1) return UNKNOWN_AUTH_PATH_LABEL;
+
+    // Trailing slashes are trimmed before matching: the declared set holds `/get-session`, so
+    // `/api/auth/get-session/` would otherwise miss the exact match and degrade to `/get-session/*`,
+    // splitting one endpoint across two facet values for nothing.
+    const authPath = pathname.slice(baseIndex + AUTH_BASE_PATH.length).replace(/\/+$/, "");
+    if (literalPaths.has(authPath)) return authPath;
+
+    // `/<segment>/*`, not a bare segment: the emitted values all land in one Sentry facet, so a mix of
+    // `/sign-in/email` and `sign-in` would make `auth.path:/sign-in*` miss the truncated bucket. The
+    // trailing `*` also keeps the degraded form distinct from a same-named literal — `/reset-password`
+    // (the POST that performs the reset) and `/reset-password/*` (the GET callback carrying a token)
+    // are different endpoints and must not merge into one bucket.
+    const firstSegment = getFirstSegment(authPath);
+    if (firstSegment && knownFirstSegments.has(firstSegment)) return `/${firstSegment}/*`;
+
+    return UNKNOWN_AUTH_PATH_LABEL;
+  };
+};
diff --git a/apps/web/modules/auth/lib/better-auth-request-context.test.ts b/apps/web/modules/auth/lib/better-auth-request-context.test.ts
new file mode 100644
index 000000000000..08a961f16ad0
--- /dev/null
+++ b/apps/web/modules/auth/lib/better-auth-request-context.test.ts
@@ -0,0 +1,54 @@
+import { describe, expect, test } from "vitest";
+import { getBetterAuthRequestContext, runWithBetterAuthRequestContext } from "./better-auth-request-context";
+
+describe("better-auth request context", () => {
+  test("is undefined outside a run — a fault raised outside the HTTP handler stays reportable", () => {
+    expect(getBetterAuthRequestContext()).toBeUndefined();
+  });
+
+  test("exposes the context inside the run", () => {
+    const context = runWithBetterAuthRequestContext({ path: "/sign-in/email", method: "POST" }, () =>
+      getBetterAuthRequestContext()
+    );
+
+    expect(context).toEqual({ path: "/sign-in/email", method: "POST" });
+  });
+
+  test("survives an await, which is the whole reason it can reach the router's error handler", async () => {
+    // The Sentry capture happens deep inside `auth.handler`, several awaits after the store is opened.
+    const seen = await runWithBetterAuthRequestContext(
+      { path: "/oauth2/token", method: "POST" },
+      async () => {
+        await Promise.resolve();
+        await new Promise((resolve) => setTimeout(resolve, 0));
+        return getBetterAuthRequestContext();
+      }
+    );
+
+    expect(seen).toEqual({ path: "/oauth2/token", method: "POST" });
+  });
+
+  test("keeps concurrent requests isolated", async () => {
+    const [first, second] = await Promise.all([
+      runWithBetterAuthRequestContext({ path: "/sign-in/email", method: "POST" }, async () => {
+        await new Promise((resolve) => setTimeout(resolve, 5));
+        return getBetterAuthRequestContext()?.path;
+      }),
+      runWithBetterAuthRequestContext({ path: "/get-session", method: "GET" }, async () => {
+        await Promise.resolve();
+        return getBetterAuthRequestContext()?.path;
+      }),
+    ]);
+
+    expect(first).toBe("/sign-in/email");
+    expect(second).toBe("/get-session");
+  });
+
+  test("returns to undefined after the run completes", async () => {
+    await runWithBetterAuthRequestContext({ path: "/get-session", method: "GET" }, async () =>
+      Promise.resolve()
+    );
+
+    expect(getBetterAuthRequestContext()).toBeUndefined();
+  });
+});
diff --git a/apps/web/modules/auth/lib/better-auth-request-context.ts b/apps/web/modules/auth/lib/better-auth-request-context.ts
new file mode 100644
index 000000000000..4cdfdfaec3c3
--- /dev/null
+++ b/apps/web/modules/auth/lib/better-auth-request-context.ts
@@ -0,0 +1,41 @@
+import "server-only";
+import { AsyncLocalStorage } from "node:async_hooks";
+
+/**
+ * Request scope for Better Auth observability (ENG-2259).
+ *
+ * Better Auth's router discards the endpoint before our logger is called — for a non-`APIError` it does
+ * `ctx.logger?.error(e.name, e)` (`better-auth/dist/api/index.mjs:210`) — so the Sentry event raised in
+ * `better-auth-observability.ts` carries an exception and nothing else: no transaction, no URL, no
+ * route. That is why FORMBRICKS-183 has ~242 events and cannot be triaged. This store carries the
+ * request identity across the handler so the capture can name its endpoint.
+ *
+ * The `[...all]` route opens it around `auth.handler`, which means it covers every throw inside the
+ * handler — including the middleware that runs AHEAD of `hooks.before` (origin check, CSRF, rate
+ * limiter), which a before-hook stash cannot see. The store survives the awaited handler because the
+ * async work starts synchronously inside `run()`, the same guarantee `sso-request-context.ts` relies
+ * on.
+ *
+ * `path` is already reduced to a safe label by `createAuthPathLabeller` — never a raw path. See
+ * `better-auth-path-label.ts` for why that matters (`/reset-password/:token`).
+ */
+export interface BetterAuthRequestContext {
+  /** Safe endpoint label from `createAuthPathLabeller`, e.g. `/sign-in/email` or `/reset-password/*`. */
+  path: string;
+  /** HTTP method, e.g. `POST`. */
+  method: string;
+}
+
+const betterAuthRequestContext = new AsyncLocalStorage<BetterAuthRequestContext>();
+
+export const runWithBetterAuthRequestContext = <T>(context: BetterAuthRequestContext, fn: () => T): T =>
+  betterAuthRequestContext.run(context, fn);
+
+/**
+ * Best-effort by design: `undefined` when the fault is raised outside the HTTP handler — Better Auth
+ * instance construction, or a server-side `auth.api.*` call. Observability must never be the thing
+ * that breaks an auth request, and that absence is itself diagnostic: an untagged capture means the
+ * throw did not come through `auth.handler`.
+ */
+export const getBetterAuthRequestContext = (): BetterAuthRequestContext | undefined =>
+  betterAuthRequestContext.getStore();
diff --git a/apps/web/modules/ee/license-check/lib/utils.test.ts b/apps/web/modules/ee/license-check/lib/utils.test.ts
index c3c5d5463354..1cfe7b29c830 100644
--- a/apps/web/modules/ee/license-check/lib/utils.test.ts
+++ b/apps/web/modules/ee/license-check/lib/utils.test.ts
@@ -579,7 +579,7 @@ describe("License Utils", () => {
       expect(result).toBe(5);
     });
 
-    test("returns 3 for self-hosted without active workspace entitlement", async () => {
+    test("returns Infinity for self-hosted when an active license grants unlimited workspaces", async () => {
       vi.mocked(constants).IS_FORMBRICKS_CLOUD = false;
       vi.mocked(getOrganizationEntitlementsContext).mockResolvedValue({
         ...defaultEntitlementsContext,
@@ -590,6 +590,34 @@ describe("License Utils", () => {
 
       const result = await getOrganizationWorkspacesLimit("org_1");
 
+      expect(result).toBe(Infinity);
+    });
+
+    test("returns 3 for self-hosted when the license is not active", async () => {
+      vi.mocked(constants).IS_FORMBRICKS_CLOUD = false;
+      vi.mocked(getOrganizationEntitlementsContext).mockResolvedValue({
+        ...defaultEntitlementsContext,
+        source: "self_hosted_license",
+        licenseStatus: "expired",
+        licenseFeatures: { ...defaultFeatures, workspaces: null },
+      });
+
+      const result = await getOrganizationWorkspacesLimit("org_1");
+
+      expect(result).toBe(3);
+    });
+
+    test("returns 3 for self-hosted when there are no license features", async () => {
+      vi.mocked(constants).IS_FORMBRICKS_CLOUD = false;
+      vi.mocked(getOrganizationEntitlementsContext).mockResolvedValue({
+        ...defaultEntitlementsContext,
+        source: "self_hosted_license",
+        licenseStatus: "active",
+        licenseFeatures: null,
+      });
+
+      const result = await getOrganizationWorkspacesLimit("org_1");
+
       expect(result).toBe(3);
     });
   });
diff --git a/apps/web/modules/ee/license-check/lib/utils.ts b/apps/web/modules/ee/license-check/lib/utils.ts
index 9c21170e72f2..e4ab67264a14 100644
--- a/apps/web/modules/ee/license-check/lib/utils.ts
+++ b/apps/web/modules/ee/license-check/lib/utils.ts
@@ -193,11 +193,9 @@ export const getOrganizationWorkspacesLimit = async (organizationId: string): Pr
     return entitlementsContext.limits.workspaces ?? Infinity;
   }
 
-  if (
-    entitlementsContext.licenseStatus === "active" &&
-    entitlementsContext.licenseFeatures?.workspaces != null
-  ) {
-    return entitlementsContext.licenseFeatures.workspaces;
+  // `workspaces: null` on an active license means unlimited, mirroring the cloud branch above.
+  if (entitlementsContext.licenseStatus === "active" && entitlementsContext.licenseFeatures) {
+    return entitlementsContext.licenseFeatures.workspaces ?? Infinity;
   }
 
   return 3;
diff --git a/apps/web/modules/ee/unify-feedback/sources/components/create-feedback-source-modal.tsx b/apps/web/modules/ee/unify-feedback/sources/components/create-feedback-source-modal.tsx
index 77df5a1d6d08..78c6448bdbd0 100644
--- a/apps/web/modules/ee/unify-feedback/sources/components/create-feedback-source-modal.tsx
+++ b/apps/web/modules/ee/unify-feedback/sources/components/create-feedback-source-modal.tsx
@@ -67,8 +67,8 @@ import { FeedbackSourceTypeSelector } from "./feedback-source-type-selector";
 import { FormbricksQuestionList } from "./formbricks-question-list";
 import { ImportModeField } from "./import-mode-field";
 
-const API_INGESTION_DOCS_URL = "https://formbricks.com/docs/unify-feedback/api/rest-api";
-const FEEDBACK_RECORD_MCP_DOCS_URL = "https://formbricks.com/docs/unify-feedback/api/mcp";
+const API_INGESTION_DOCS_URL = "https://formbricks.com/docs/unify-feedback/feedback-sources";
+const FEEDBACK_RECORD_MCP_DOCS_URL = "https://formbricks.com/docs/platform/mcp/overview";
 
 interface CreateFeedbackSourceModalProps {
   open: boolean;
diff --git a/apps/web/modules/ee/unify-feedback/sources/components/feedback-source-type-selector.tsx b/apps/web/modules/ee/unify-feedback/sources/components/feedback-source-type-selector.tsx
index 3843c2812405..089c4c2a09a8 100644
--- a/apps/web/modules/ee/unify-feedback/sources/components/feedback-source-type-selector.tsx
+++ b/apps/web/modules/ee/unify-feedback/sources/components/feedback-source-type-selector.tsx
@@ -3,7 +3,6 @@
 import Link from "next/link";
 import { Trans, useTranslation } from "react-i18next";
 import { Alert, AlertButton, AlertDescription, AlertTitle } from "@/modules/ui/components/alert";
-import { Badge } from "@/modules/ui/components/badge";
 import { TFeedbackSourceOptionId, getFeedbackSourceOptions } from "../utils";
 
 interface FeedbackSourceTypeSelectorProps {
@@ -15,17 +14,12 @@ interface FeedbackSourceTypeSelectorProps {
 
 const getOptionClassName = (
   selectedType: TFeedbackSourceOptionId | null,
-  optionId: TFeedbackSourceOptionId,
-  disabled: boolean
+  optionId: TFeedbackSourceOptionId
 ): string => {
   if (selectedType === optionId) {
     return "border-brand-dark bg-slate-50";
   }
 
-  if (disabled) {
-    return "cursor-not-allowed border-slate-200 bg-slate-50 opacity-60";
-  }
-
   return "border-slate-200 hover:border-slate-300 hover:bg-slate-50";
 };
 
@@ -44,23 +38,18 @@ export function FeedbackSourceTypeSelector({
         {feedbackSourceOptions.map((option) => {
           const showNoSurveysAlert =
             surveyCount === 0 && option.id === "formbricks_survey" && selectedType === "formbricks_survey";
-          const showApiIngestionSetupAlert =
-            option.id === "api_ingestion" && selectedType === "api_ingestion";
           return (
             <div key={option.id} className="space-y-2">
               <button
                 type="button"
-                disabled={option.disabled}
                 onClick={() => onSelectType(option.id)}
                 className={`flex w-full items-center justify-between rounded-lg border p-3.5 text-left text-sm transition-colors ${getOptionClassName(
                   selectedType,
-                  option.id,
-                  option.disabled
+                  option.id
                 )}`}>
                 <div className="flex-1">
                   <div className="flex items-center gap-2">
                     <span className="leading-5 font-medium text-slate-900">{option.name}</span>
-                    {option.badge && <Badge text={option.badge.text} type={option.badge.type} size="tiny" />}
                   </div>
                   <p className="mt-0.5 text-xs text-slate-500">{option.description}</p>
                 </div>
@@ -76,7 +65,6 @@ export function FeedbackSourceTypeSelector({
                 </div>
               </button>
               {showNoSurveysAlert && <NoFormbricksSurveysAlert workspaceId={workspaceId} />}
-              {showApiIngestionSetupAlert && <ApiIngestionSetupAlert />}
             </div>
           );
         })}
@@ -97,20 +85,6 @@ export function FeedbackSourceTypeSelector({
   );
 }
 
-const ApiIngestionSetupAlert = () => {
-  const { t } = useTranslation();
-
-  return (
-    <Alert variant="info" size="small">
-      <div className="min-w-0 space-y-1">
-        <AlertDescription className="overflow-visible whitespace-normal">
-          <p>{t("workspace.unify.api_ingestion_setup_description")}</p>
-        </AlertDescription>
-      </div>
-    </Alert>
-  );
-};
-
 const NoFormbricksSurveysAlert = ({ workspaceId }: Readonly<{ workspaceId: string }>) => {
   return (
     <Alert variant="info" size="small">
diff --git a/apps/web/modules/ee/unify-feedback/sources/components/feedback-sources-table-data-row.tsx b/apps/web/modules/ee/unify-feedback/sources/components/feedback-sources-table-data-row.tsx
deleted file mode 100644
index 099a7fa07041..000000000000
--- a/apps/web/modules/ee/unify-feedback/sources/components/feedback-sources-table-data-row.tsx
+++ /dev/null
@@ -1,162 +0,0 @@
-"use client";
-
-import Link from "next/link";
-import { useTranslation } from "react-i18next";
-import {
-  TFeedbackSourceStatus,
-  TFeedbackSourceType,
-  TFeedbackSourceWithMappings,
-} from "@formbricks/types/feedback-source";
-import { Badge } from "@/modules/ui/components/badge";
-import { getFeedbackSourceIcon, getFeedbackSourceTypeLabelKey } from "./feedback-source-display";
-import { FeedbackSourceRowDropdown } from "./feedback-source-row-dropdown";
-
-const RELATIVE_TIME_DIVISIONS: { amount: number; unit: Intl.RelativeTimeFormatUnit }[] = [
-  { amount: 60, unit: "seconds" },
-  { amount: 60, unit: "minutes" },
-  { amount: 24, unit: "hours" },
-  { amount: 7, unit: "days" },
-  { amount: 4.345, unit: "weeks" },
-  { amount: 12, unit: "months" },
-  { amount: Number.POSITIVE_INFINITY, unit: "years" },
-];
-
-function getRelativeTime(date: Date, locale: string) {
-  const formatter = new Intl.RelativeTimeFormat(locale, { numeric: "auto" });
-  let duration = (date.getTime() - Date.now()) / 1000;
-
-  for (const division of RELATIVE_TIME_DIVISIONS) {
-    if (Math.abs(duration) < division.amount) {
-      return formatter.format(Math.round(duration), division.unit);
-    }
-    duration /= division.amount;
-  }
-
-  return formatter.format(Math.round(duration), "years");
-}
-
-interface FeedbackSourcesTableDataRowProps {
-  feedbackSource: TFeedbackSourceWithMappings;
-  surveyNameById: Record<string, string>;
-  onEdit: () => void;
-  onCsvImport?: () => void;
-  onToggleStatus: () => Promise<void>;
-  onDelete: () => Promise<void>;
-  isReadOnly?: boolean;
-}
-
-const STATUS_BADGE_TYPE: Record<TFeedbackSourceStatus, "success" | "warning" | "error"> = {
-  active: "success",
-  paused: "warning",
-  error: "error",
-};
-
-export function FeedbackSourcesTableDataRow({
-  feedbackSource,
-  surveyNameById,
-  onEdit,
-  onCsvImport,
-  onToggleStatus,
-  onDelete,
-  isReadOnly = false,
-}: Readonly<FeedbackSourcesTableDataRowProps>) {
-  const { t, i18n } = useTranslation();
-  // "Data origin": for Formbricks-survey sources, link to the survey summary (like the record level).
-  const originSurveyId = feedbackSource.formbricksMappings[0]?.surveyId;
-  const originSurveyName = originSurveyId ? surveyNameById[originSurveyId] : undefined;
-  const showSurveyOrigin =
-    feedbackSource.type === "formbricks_survey" && Boolean(originSurveyId) && Boolean(originSurveyName);
-  const handleRowClick = () => {
-    if (!isReadOnly && feedbackSource.type === "csv" && onCsvImport) {
-      onCsvImport();
-      return;
-    }
-
-    onEdit();
-  };
-
-  const getStatusLabel = (s: TFeedbackSourceStatus, feedbackSourceType: TFeedbackSourceType) => {
-    switch (s) {
-      case "active":
-        if (feedbackSourceType === "csv") {
-          return t("workspace.unify.status_ready");
-        }
-        return t("workspace.unify.status_live_sync");
-      case "paused":
-        return t("common.disabled");
-      case "error":
-        return t("workspace.unify.status_error");
-    }
-  };
-
-  return (
-    <div className="grid h-12 min-h-12 grid-cols-12 content-center transition-colors ease-in-out hover:bg-slate-50">
-      <button
-        type="button"
-        className="col-span-4 grid cursor-pointer grid-cols-4 content-center p-2 text-left"
-        onClick={handleRowClick}>
-        <div
-          className="col-span-2 flex items-center gap-2 pl-4"
-          title={t(getFeedbackSourceTypeLabelKey(feedbackSource.type))}>
-          {getFeedbackSourceIcon(feedbackSource.type, "h-4 w-4 shrink-0 text-slate-500")}
-          <Badge
-            text={
-              feedbackSource.type === "csv"
-                ? t("workspace.unify.source_type_csv")
-                : t("workspace.unify.source_type_survey")
-            }
-            type="gray"
-            size="tiny"
-          />
-        </div>
-        <div className="col-span-2 flex items-center">
-          <span className="truncate text-sm font-medium text-slate-900">{feedbackSource.name}</span>
-        </div>
-      </button>
-
-      <div className="col-span-2 hidden min-w-0 items-center px-2 sm:flex">
-        {showSurveyOrigin ? (
-          <Link
-            href={`/workspaces/${feedbackSource.workspaceId}/surveys/${originSurveyId}/summary`}
-            title={originSurveyName}
-            className="truncate text-sm text-slate-700 underline underline-offset-2 hover:text-slate-900">
-            {originSurveyName}
-          </Link>
-        ) : (
-          <span className="text-sm text-slate-400">—</span>
-        )}
-      </div>
-
-      <button
-        type="button"
-        className="col-span-5 grid cursor-pointer grid-cols-5 content-center p-2 text-left"
-        onClick={handleRowClick}>
-        <div className="col-span-2 hidden items-center justify-center sm:flex">
-          <Badge
-            text={getStatusLabel(feedbackSource.status, feedbackSource.type)}
-            type={STATUS_BADGE_TYPE[feedbackSource.status]}
-            size="tiny"
-          />
-        </div>
-        <div className="col-span-2 hidden items-center justify-center text-sm text-slate-500 sm:flex">
-          {getRelativeTime(feedbackSource.updatedAt, i18n.language)}
-        </div>
-        <div className="col-span-1 hidden items-center justify-center text-sm text-slate-500 sm:flex">
-          <span className="truncate">{feedbackSource.creatorName ?? "—"}</span>
-        </div>
-      </button>
-
-      <div className="col-span-1 flex items-center justify-end pr-2">
-        {!isReadOnly && (
-          <FeedbackSourceRowDropdown
-            feedbackSource={feedbackSource}
-            onEdit={onEdit}
-            onCsvImport={onCsvImport}
-            onToggleStatus={onToggleStatus}
-            onDelete={onDelete}
-          />
-        )}
-      </div>
-    </div>
-  );
-}
diff --git a/apps/web/modules/ee/unify-feedback/sources/components/feedback-sources-table-rows-container.tsx b/apps/web/modules/ee/unify-feedback/sources/components/feedback-sources-table-rows-container.tsx
deleted file mode 100644
index a465fb16818f..000000000000
--- a/apps/web/modules/ee/unify-feedback/sources/components/feedback-sources-table-rows-container.tsx
+++ /dev/null
@@ -1,50 +0,0 @@
-import { useTranslation } from "react-i18next";
-import { TFeedbackSourceWithMappings } from "@formbricks/types/feedback-source";
-import { FeedbackSourcesTableDataRow } from "./feedback-sources-table-data-row";
-
-interface FeedbackSourcesTableRowsContainerProps {
-  feedbackSources: TFeedbackSourceWithMappings[];
-  surveyNameById: Record<string, string>;
-  onFeedbackSourceClick: (feedbackSource: TFeedbackSourceWithMappings) => void;
-  onCsvImport: (feedbackSource: TFeedbackSourceWithMappings) => void;
-  onToggleStatus: (feedbackSource: TFeedbackSourceWithMappings) => Promise<void>;
-  onDelete: (feedbackSourceId: string) => Promise<void>;
-  isReadOnly?: boolean;
-}
-
-export const FeedbackSourcesTableRowsContainer = ({
-  feedbackSources,
-  surveyNameById,
-  onFeedbackSourceClick,
-  onCsvImport,
-  onToggleStatus,
-  onDelete,
-  isReadOnly = false,
-}: FeedbackSourcesTableRowsContainerProps) => {
-  const { t } = useTranslation();
-
-  if (feedbackSources.length === 0) {
-    return (
-      <div className="flex h-32 items-center justify-center">
-        <p className="text-sm text-slate-500">{t("workspace.unify.no_sources_connected")}</p>
-      </div>
-    );
-  }
-
-  return (
-    <div className="divide-y divide-slate-100">
-      {feedbackSources.map((feedbackSource) => (
-        <FeedbackSourcesTableDataRow
-          key={feedbackSource.id}
-          feedbackSource={feedbackSource}
-          surveyNameById={surveyNameById}
-          onEdit={() => onFeedbackSourceClick(feedbackSource)}
-          onCsvImport={feedbackSource.type === "csv" ? () => onCsvImport(feedbackSource) : undefined}
-          onToggleStatus={() => onToggleStatus(feedbackSource)}
-          onDelete={() => onDelete(feedbackSource.id)}
-          isReadOnly={isReadOnly}
-        />
-      ))}
-    </div>
-  );
-};
diff --git a/apps/web/modules/ee/unify-feedback/sources/components/feedback-sources-table.tsx b/apps/web/modules/ee/unify-feedback/sources/components/feedback-sources-table.tsx
index ff319cd76c37..723582569900 100644
--- a/apps/web/modules/ee/unify-feedback/sources/components/feedback-sources-table.tsx
+++ b/apps/web/modules/ee/unify-feedback/sources/components/feedback-sources-table.tsx
@@ -1,11 +1,189 @@
 "use client";
 
-import { Loader2Icon } from "lucide-react";
+import type { TFunction } from "i18next";
+import Link from "next/link";
 import { useTranslation } from "react-i18next";
-import { TFeedbackSourceWithMappings } from "@formbricks/types/feedback-source";
+import {
+  TFeedbackSourceStatus,
+  TFeedbackSourceType,
+  TFeedbackSourceWithMappings,
+} from "@formbricks/types/feedback-source";
+import { timeSinceDate } from "@/lib/time";
+import { Badge } from "@/modules/ui/components/badge";
+import { SettingsTable, type TSettingsTableColumn } from "@/modules/ui/components/settings-table";
 import { TUnifySurvey } from "../types";
+import { getFeedbackSourceIcon, getFeedbackSourceTypeLabelKey } from "./feedback-source-display";
+import { FeedbackSourceRowDropdown } from "./feedback-source-row-dropdown";
 import { FeedbackSourceSuggestions } from "./feedback-source-suggestions";
-import { FeedbackSourcesTableRowsContainer } from "./feedback-sources-table-rows-container";
+
+const STATUS_BADGE_TYPE: Record<TFeedbackSourceStatus, "success" | "warning" | "error"> = {
+  active: "success",
+  paused: "warning",
+  error: "error",
+};
+
+const getStatusLabel = (
+  status: TFeedbackSourceStatus,
+  feedbackSourceType: TFeedbackSourceType,
+  t: TFunction
+): string => {
+  switch (status) {
+    case "active":
+      return feedbackSourceType === "csv"
+        ? t("workspace.unify.status_ready")
+        : t("workspace.unify.status_live_sync");
+    case "paused":
+      return t("common.disabled");
+    case "error":
+      return t("workspace.unify.status_error");
+  }
+};
+
+/**
+ * Defined at module level rather than inside the component: an inline `cell` that returns JSX reads as a
+ * nested component definition to Sonar (typescript:S6478).
+ *
+ * The seven columns replace a `grid-cols-12` header in one file and a `grid-cols-12` row in another, whose
+ * spans had to be kept in step by hand across two nested sub-grids.
+ */
+const getFeedbackSourceColumns = ({
+  t,
+  locale,
+  surveyNameById,
+  onCsvImport,
+  onToggleStatus,
+  onDelete,
+  onFeedbackSourceClick,
+  isReadOnly,
+}: Readonly<{
+  t: TFunction;
+  locale: string;
+  surveyNameById: Record<string, string>;
+  onCsvImport: (feedbackSource: TFeedbackSourceWithMappings) => void;
+  onToggleStatus: (feedbackSource: TFeedbackSourceWithMappings) => Promise<void>;
+  onDelete: (feedbackSourceId: string) => Promise<void>;
+  onFeedbackSourceClick: (feedbackSource: TFeedbackSourceWithMappings) => void;
+  isReadOnly: boolean;
+}>): TSettingsTableColumn<TFeedbackSourceWithMappings>[] => [
+  {
+    id: "type",
+    header: t("common.type"),
+    headerClassName: "w-[14%]",
+    skeletonWidth: "w-16",
+    cell: (feedbackSource) => (
+      <div className="flex items-center gap-2" title={t(getFeedbackSourceTypeLabelKey(feedbackSource.type))}>
+        {getFeedbackSourceIcon(feedbackSource.type, "h-4 w-4 shrink-0 text-slate-500")}
+        <Badge
+          text={
+            feedbackSource.type === "csv"
+              ? t("workspace.unify.source_type_csv")
+              : t("workspace.unify.source_type_survey")
+          }
+          type="gray"
+          size="tiny"
+        />
+      </div>
+    ),
+  },
+  {
+    id: "name",
+    header: t("common.name"),
+    headerClassName: "w-[20%]",
+    cellClassName: "font-medium text-slate-900",
+    skeletonWidth: "w-32",
+    cell: (feedbackSource) => feedbackSource.name,
+  },
+  {
+    id: "origin",
+    header: t("workspace.unify.data_origin"),
+    headerClassName: "w-[20%]",
+    hideBelow: "sm",
+    skeletonWidth: "w-24",
+    // The whole reason the old row had *two* separate `<button>`s wrapping the columns either side of
+    // this one: a nested link cannot live inside a button. `stopRowClick` expresses that with one table
+    // row instead, which is what collapses two tab stops into one.
+    stopRowClick: true,
+    cell: (feedbackSource) => {
+      const originSurveyId = feedbackSource.formbricksMappings[0]?.surveyId;
+      const originSurveyName = originSurveyId ? surveyNameById[originSurveyId] : undefined;
+
+      if (feedbackSource.type !== "formbricks_survey" || !originSurveyId || !originSurveyName) {
+        return <span className="text-sm text-slate-400">—</span>;
+      }
+
+      return (
+        <Link
+          href={`/workspaces/${feedbackSource.workspaceId}/surveys/${originSurveyId}/summary`}
+          title={originSurveyName}
+          className="text-sm text-slate-700 underline underline-offset-2 hover:text-slate-900">
+          {originSurveyName}
+        </Link>
+      );
+    },
+  },
+  {
+    id: "status",
+    header: t("common.status"),
+    headerClassName: "w-[14%]",
+    hideBelow: "sm",
+    align: "center",
+    skeletonWidth: "w-20",
+    cell: (feedbackSource) => (
+      <Badge
+        text={getStatusLabel(feedbackSource.status, feedbackSource.type, t)}
+        type={STATUS_BADGE_TYPE[feedbackSource.status]}
+        size="tiny"
+      />
+    ),
+  },
+  {
+    id: "updatedAt",
+    header: t("workspace.unify.updated_at"),
+    // `whitespace-nowrap` makes the header's min-content width its text width, so `table-auto`
+    // has to allocate at least that and a two-word label cannot wrap in a narrow column.
+    headerClassName: "w-[14%] whitespace-nowrap",
+    hideBelow: "sm",
+    align: "center",
+    cellClassName: "text-slate-500",
+    skeletonWidth: "w-20",
+    // The shared helper, replacing a local `getRelativeTime` built on `Intl.RelativeTimeFormat` that
+    // duplicated it and bypassed the repo's date-rendering rule.
+    cell: (feedbackSource) => timeSinceDate(feedbackSource.updatedAt, locale),
+  },
+  {
+    id: "createdBy",
+    header: t("workspace.unify.created_by"),
+    // `whitespace-nowrap` makes the header's min-content width its text width, so `table-auto`
+    // has to allocate at least that and a two-word label cannot wrap in a narrow column.
+    headerClassName: "w-[12%] whitespace-nowrap",
+    hideBelow: "sm",
+    align: "center",
+    cellClassName: "text-slate-500",
+    skeletonWidth: "w-16",
+    cell: (feedbackSource) => feedbackSource.creatorName ?? "—",
+  },
+  {
+    id: "actions",
+    header: null,
+    srLabel: t("common.actions"),
+    headerClassName: "w-[6%]",
+    stopRowClick: true,
+    skeletonWidth: "w-8",
+    cell: (feedbackSource) =>
+      isReadOnly ? null : (
+        // Flex on a wrapper, not on `cellClassName`, which would stop the `<td>` being a table cell.
+        <div className="flex justify-end">
+          <FeedbackSourceRowDropdown
+            feedbackSource={feedbackSource}
+            onEdit={() => onFeedbackSourceClick(feedbackSource)}
+            onCsvImport={feedbackSource.type === "csv" ? () => onCsvImport(feedbackSource) : undefined}
+            onToggleStatus={() => onToggleStatus(feedbackSource)}
+            onDelete={() => onDelete(feedbackSource.id)}
+          />
+        </div>
+      ),
+  },
+];
 
 interface FeedbackSourcesTableProps {
   feedbackSources: TFeedbackSourceWithMappings[];
@@ -38,44 +216,50 @@ export function FeedbackSourcesTable({
   isLoading = false,
   isReadOnly = false,
 }: Readonly<FeedbackSourcesTableProps>) {
-  const { t } = useTranslation();
+  const { t, i18n } = useTranslation();
+
+  // A CSV source opens the import flow instead of the edit modal; everything else edits.
+  const handleRowClick = (feedbackSource: TFeedbackSourceWithMappings) => {
+    if (!isReadOnly && feedbackSource.type === "csv") {
+      onCsvImport(feedbackSource);
+      return;
+    }
+
+    onFeedbackSourceClick(feedbackSource);
+  };
 
   return (
-    <div className="overflow-hidden rounded-xl border border-slate-200 bg-white shadow-xs">
-      <div className="grid h-12 grid-cols-12 content-center border-b border-slate-200 text-left text-sm font-semibold text-slate-900">
-        <div className="col-span-2 pl-6">{t("common.type")}</div>
-        <div className="col-span-2">{t("common.name")}</div>
-        <div className="col-span-2 hidden sm:block">{t("workspace.unify.data_origin")}</div>
-        <div className="col-span-2 hidden text-center sm:block">{t("common.status")}</div>
-        <div className="col-span-2 hidden text-center sm:block">{t("workspace.unify.updated_at")}</div>
-        <div className="col-span-1 hidden text-center sm:block">{t("workspace.unify.created_by")}</div>
-        <div className="col-span-1" />
-      </div>
-      {isLoading ? (
-        <div className="flex h-32 items-center justify-center">
-          <Loader2Icon className="size-6 animate-spin text-slate-500" />
-        </div>
-      ) : (
-        <>
-          <FeedbackSourcesTableRowsContainer
-            feedbackSources={feedbackSources}
-            surveyNameById={surveyNameById}
-            onFeedbackSourceClick={onFeedbackSourceClick}
-            onCsvImport={onCsvImport}
-            onToggleStatus={onToggleStatus}
-            onDelete={onDelete}
-            isReadOnly={isReadOnly}
+    // `frame="card"` because this table stands on its own under `PageContentWrapper` rather than inside a
+    // settings card — the only table in the series that draws its own frame.
+    <SettingsTable
+      columns={getFeedbackSourceColumns({
+        t,
+        locale: i18n.language,
+        surveyNameById,
+        onCsvImport,
+        onToggleStatus,
+        onDelete,
+        onFeedbackSourceClick,
+        isReadOnly,
+      })}
+      rows={feedbackSources}
+      getRowId={(feedbackSource) => feedbackSource.id}
+      emptyMessage={t("workspace.unify.no_sources_connected")}
+      frame="card"
+      isLoading={isLoading}
+      aria-label={t("workspace.unify.feedback_sources")}
+      onRowClick={handleRowClick}
+      getRowLabel={(feedbackSource) => feedbackSource.name}
+      footer={
+        isReadOnly ? undefined : (
+          <FeedbackSourceSuggestions
+            suggestedSurveys={suggestedSurveys}
+            workspaceId={workspaceId}
+            onImportResponses={onImportResponses}
+            onSelectQuestions={onSelectQuestions}
           />
-          {!isReadOnly && (
-            <FeedbackSourceSuggestions
-              suggestedSurveys={suggestedSurveys}
-              workspaceId={workspaceId}
-              onImportResponses={onImportResponses}
-              onSelectQuestions={onSelectQuestions}
-            />
-          )}
-        </>
-      )}
-    </div>
+        )
+      }
+    />
   );
 }
diff --git a/apps/web/modules/ee/unify-feedback/sources/utils.test.ts b/apps/web/modules/ee/unify-feedback/sources/utils.test.ts
index 12e65ead5dcd..79a021eff4ac 100644
--- a/apps/web/modules/ee/unify-feedback/sources/utils.test.ts
+++ b/apps/web/modules/ee/unify-feedback/sources/utils.test.ts
@@ -79,17 +79,6 @@ describe("getFeedbackSourceOptions", () => {
     expect(options[3].id).toBe("feedback_record_mcp");
   });
 
-  test("formbricks and csv are enabled; api ingestion and mcp are coming soon (disabled)", () => {
-    const options = getFeedbackSourceOptions(mockT as never);
-    const byId = Object.fromEntries(options.map((o) => [o.id, o]));
-    expect(byId.formbricks_survey.disabled).toBe(false);
-    expect(byId.csv.disabled).toBe(false);
-    expect(byId.api_ingestion.disabled).toBe(true);
-    expect(byId.api_ingestion.badge?.text).toBe("common.coming_soon");
-    expect(byId.feedback_record_mcp.disabled).toBe(true);
-    expect(byId.feedback_record_mcp.badge?.text).toBe("common.coming_soon");
-  });
-
   test("uses translation keys for name and description", () => {
     const options = getFeedbackSourceOptions(mockT as never);
     expect(options[0].name).toBe("workspace.unify.formbricks_surveys");
diff --git a/apps/web/modules/ee/unify-feedback/sources/utils.ts b/apps/web/modules/ee/unify-feedback/sources/utils.ts
index b21dca1ce0e6..7b7086e450c6 100644
--- a/apps/web/modules/ee/unify-feedback/sources/utils.ts
+++ b/apps/web/modules/ee/unify-feedback/sources/utils.ts
@@ -44,8 +44,6 @@ export interface TFeedbackSourceOption {
   id: TFeedbackSourceOptionId;
   name: string;
   description: string;
-  disabled: boolean;
-  badge?: { text: string; type: "success" | "gray" | "warning" };
 }
 
 export const getFeedbackSourceOptions = (t: TFunction): TFeedbackSourceOption[] => [
@@ -53,27 +51,21 @@ export const getFeedbackSourceOptions = (t: TFunction): TFeedbackSourceOption[]
     id: "formbricks_survey",
     name: t("workspace.unify.formbricks_surveys"),
     description: t("workspace.unify.source_connect_formbricks_description"),
-    disabled: false,
   },
   {
     id: "csv",
     name: t("workspace.unify.csv_import"),
     description: t("workspace.unify.source_connect_csv_description"),
-    disabled: false,
   },
   {
     id: "api_ingestion",
     name: t("workspace.unify.api_ingestion"),
     description: t("workspace.unify.api_ingestion_settings_description"),
-    disabled: true,
-    badge: { text: t("common.coming_soon"), type: "gray" },
   },
   {
     id: "feedback_record_mcp",
     name: t("workspace.unify.feedback_record_mcp"),
     description: t("workspace.unify.source_connect_feedback_record_mcp_description"),
-    disabled: true,
-    badge: { text: t("common.coming_soon"), type: "gray" },
   },
 ];
 
diff --git a/apps/web/modules/entitlements/lib/self-hosted-provider.test.ts b/apps/web/modules/entitlements/lib/self-hosted-provider.test.ts
index c41c2de006e5..be2108906641 100644
--- a/apps/web/modules/entitlements/lib/self-hosted-provider.test.ts
+++ b/apps/web/modules/entitlements/lib/self-hosted-provider.test.ts
@@ -1,7 +1,9 @@
 import { beforeEach, describe, expect, test, vi } from "vitest";
 import { ResourceNotFoundError } from "@formbricks/types/errors";
+import type { TOrganization } from "@formbricks/types/organizations";
 import { getOrganization } from "@/lib/organization/service";
 import { getEnterpriseLicense } from "@/modules/ee/license-check/lib/license";
+import { TEnterpriseLicenseFeatures } from "@/modules/ee/license-check/types/enterprise-license";
 import { getSelfHostedOrganizationEntitlementsContext } from "./self-hosted-provider";
 
 vi.mock("server-only", () => ({}));
@@ -17,6 +19,79 @@ vi.mock("@/modules/ee/license-check/lib/license", () => ({
 const mockGetOrg = vi.mocked(getOrganization);
 const mockGetLicense = vi.mocked(getEnterpriseLicense);
 
+type TLicenseResult = Awaited<ReturnType<typeof getEnterpriseLicense>>;
+
+/**
+ * The provider reads nothing off the organization — it only rejects a missing one — so this exists to
+ * satisfy the return type rather than to carry meaningful values. Typed so it still has to be a real
+ * `TOrganization` if the shape changes.
+ */
+const organization: TOrganization = {
+  id: "org1",
+  name: "Test Organization",
+  createdAt: new Date(),
+  updatedAt: new Date(),
+  billing: {
+    stripeCustomerId: null,
+    limits: {
+      workspaces: 3,
+      monthly: { responses: 1500, workflowRuns: null },
+    },
+    usageCycleAnchor: null,
+  },
+  isAISmartToolsEnabled: false,
+};
+
+/**
+ * Complete feature set, everything off. Typed rather than cast so a new field on
+ * `ZEnterpriseLicenseFeatures` breaks this file instead of silently defaulting to absent — the tests
+ * below assert on which entitlements a flag does and does not produce, which only means something if
+ * the unnamed flags are genuinely off.
+ */
+const licenseFeatures = (
+  overrides: Partial<TEnterpriseLicenseFeatures> = {}
+): TEnterpriseLicenseFeatures => ({
+  isMultiOrgEnabled: false,
+  contacts: false,
+  workspaces: 3,
+  whitelabel: false,
+  removeBranding: false,
+  twoFactorAuth: false,
+  sso: false,
+  saml: false,
+  spamProtection: false,
+  aiSmartTools: false,
+  auditLogs: false,
+  accessControl: false,
+  quotas: false,
+  feedbackDirectories: false,
+  dashboards: false,
+  workflows: false,
+  ...overrides,
+});
+
+const activeLicense = (features: Partial<TEnterpriseLicenseFeatures> = {}): TLicenseResult => ({
+  status: "active",
+  active: true,
+  features: licenseFeatures(features),
+  lastChecked: new Date(),
+  isPendingDowngrade: false,
+  fallbackLevel: "live",
+});
+
+const expiredLicense = (features: Partial<TEnterpriseLicenseFeatures> = {}): TLicenseResult => ({
+  ...activeLicense(features),
+  status: "expired",
+  active: false,
+});
+
+const noLicense = (): TLicenseResult => ({
+  ...activeLicense(),
+  status: "no-license",
+  active: false,
+  features: null,
+});
+
 beforeEach(() => {
   vi.clearAllMocks();
 });
@@ -24,14 +99,14 @@ beforeEach(() => {
 describe("getSelfHostedOrganizationEntitlementsContext", () => {
   test("throws ResourceNotFoundError when organization is null", async () => {
     mockGetOrg.mockResolvedValue(null);
-    mockGetLicense.mockResolvedValue({ status: "no-license", features: null, active: false } as any);
+    mockGetLicense.mockResolvedValue(noLicense());
 
     await expect(getSelfHostedOrganizationEntitlementsContext("org1")).rejects.toThrow(ResourceNotFoundError);
   });
 
   test("returns context with no license features", async () => {
-    mockGetOrg.mockResolvedValue({ id: "org1" } as any);
-    mockGetLicense.mockResolvedValue({ status: "no-license", features: null, active: false } as any);
+    mockGetOrg.mockResolvedValue(organization);
+    mockGetLicense.mockResolvedValue(noLicense());
 
     const result = await getSelfHostedOrganizationEntitlementsContext("org1");
 
@@ -49,19 +124,17 @@ describe("getSelfHostedOrganizationEntitlementsContext", () => {
   });
 
   test("maps license features to entitlements", async () => {
-    mockGetOrg.mockResolvedValue({ id: "org1" } as any);
-    mockGetLicense.mockResolvedValue({
-      status: "active",
-      active: true,
-      features: {
+    mockGetOrg.mockResolvedValue(organization);
+    mockGetLicense.mockResolvedValue(
+      activeLicense({
         removeBranding: true,
         accessControl: true,
         quotas: false,
         spamProtection: true,
         contacts: true,
         workspaces: 10,
-      },
-    } as any);
+      })
+    );
 
     const result = await getSelfHostedOrganizationEntitlementsContext("org1");
 
@@ -73,13 +146,20 @@ describe("getSelfHostedOrganizationEntitlementsContext", () => {
     expect(result.limits.workspaces).toBe(10);
   });
 
+  test("keeps workspaces null (unlimited) when an active license grants unlimited workspaces", async () => {
+    mockGetOrg.mockResolvedValue(organization);
+    mockGetLicense.mockResolvedValue(activeLicense({ workspaces: null, contacts: true }));
+
+    const result = await getSelfHostedOrganizationEntitlementsContext("org1");
+
+    expect(result.limits.workspaces).toBeNull();
+  });
+
   test("defaults workspaces to 3 when license is inactive", async () => {
-    mockGetOrg.mockResolvedValue({ id: "org1" } as any);
-    mockGetLicense.mockResolvedValue({
-      status: "expired",
-      active: false,
-      features: { workspaces: 10, contacts: true, spamProtection: true },
-    } as any);
+    mockGetOrg.mockResolvedValue(organization);
+    mockGetLicense.mockResolvedValue(
+      expiredLicense({ workspaces: 10, contacts: true, spamProtection: true })
+    );
 
     const result = await getSelfHostedOrganizationEntitlementsContext("org1");
 
@@ -88,12 +168,8 @@ describe("getSelfHostedOrganizationEntitlementsContext", () => {
   });
 
   test("maps whitelabel feature to hide-branding", async () => {
-    mockGetOrg.mockResolvedValue({ id: "org1" } as any);
-    mockGetLicense.mockResolvedValue({
-      status: "active",
-      active: true,
-      features: { whitelabel: true },
-    } as any);
+    mockGetOrg.mockResolvedValue(organization);
+    mockGetLicense.mockResolvedValue(activeLicense({ whitelabel: true }));
 
     const result = await getSelfHostedOrganizationEntitlementsContext("org1");
 
@@ -101,12 +177,8 @@ describe("getSelfHostedOrganizationEntitlementsContext", () => {
   });
 
   test("maps aiSmartTools feature to ai-smart-tools entitlement", async () => {
-    mockGetOrg.mockResolvedValue({ id: "org1" } as any);
-    mockGetLicense.mockResolvedValue({
-      status: "active",
-      active: true,
-      features: { aiSmartTools: true },
-    } as any);
+    mockGetOrg.mockResolvedValue(organization);
+    mockGetLicense.mockResolvedValue(activeLicense({ aiSmartTools: true }));
 
     const result = await getSelfHostedOrganizationEntitlementsContext("org1");
 
@@ -114,12 +186,8 @@ describe("getSelfHostedOrganizationEntitlementsContext", () => {
   });
 
   test("maps feedbackDirectories feature to feedback-directories entitlement", async () => {
-    mockGetOrg.mockResolvedValue({ id: "org1" } as any);
-    mockGetLicense.mockResolvedValue({
-      status: "active",
-      active: true,
-      features: { feedbackDirectories: true },
-    } as any);
+    mockGetOrg.mockResolvedValue(organization);
+    mockGetLicense.mockResolvedValue(activeLicense({ feedbackDirectories: true }));
 
     const result = await getSelfHostedOrganizationEntitlementsContext("org1");
 
@@ -128,12 +196,8 @@ describe("getSelfHostedOrganizationEntitlementsContext", () => {
   });
 
   test("maps dashboards feature to dashboards entitlement", async () => {
-    mockGetOrg.mockResolvedValue({ id: "org1" } as any);
-    mockGetLicense.mockResolvedValue({
-      status: "active",
-      active: true,
-      features: { dashboards: true },
-    } as any);
+    mockGetOrg.mockResolvedValue(organization);
+    mockGetLicense.mockResolvedValue(activeLicense({ dashboards: true }));
 
     const result = await getSelfHostedOrganizationEntitlementsContext("org1");
 
@@ -142,12 +206,8 @@ describe("getSelfHostedOrganizationEntitlementsContext", () => {
   });
 
   test("maps workflows feature to workflows entitlement", async () => {
-    mockGetOrg.mockResolvedValue({ id: "org1" } as any);
-    mockGetLicense.mockResolvedValue({
-      status: "active",
-      active: true,
-      features: { workflows: true },
-    } as any);
+    mockGetOrg.mockResolvedValue(organization);
+    mockGetLicense.mockResolvedValue(activeLicense({ workflows: true }));
 
     const result = await getSelfHostedOrganizationEntitlementsContext("org1");
 
@@ -156,12 +216,8 @@ describe("getSelfHostedOrganizationEntitlementsContext", () => {
   });
 
   test("does not map workflows entitlement when the license flag is off", async () => {
-    mockGetOrg.mockResolvedValue({ id: "org1" } as any);
-    mockGetLicense.mockResolvedValue({
-      status: "active",
-      active: true,
-      features: { workflows: false, dashboards: true },
-    } as any);
+    mockGetOrg.mockResolvedValue(organization);
+    mockGetLicense.mockResolvedValue(activeLicense({ workflows: false, dashboards: true }));
 
     const result = await getSelfHostedOrganizationEntitlementsContext("org1");
 
@@ -169,12 +225,8 @@ describe("getSelfHostedOrganizationEntitlementsContext", () => {
   });
 
   test("maps both Hub features when all enabled", async () => {
-    mockGetOrg.mockResolvedValue({ id: "org1" } as any);
-    mockGetLicense.mockResolvedValue({
-      status: "active",
-      active: true,
-      features: { feedbackDirectories: true, dashboards: true },
-    } as any);
+    mockGetOrg.mockResolvedValue(organization);
+    mockGetLicense.mockResolvedValue(activeLicense({ feedbackDirectories: true, dashboards: true }));
 
     const result = await getSelfHostedOrganizationEntitlementsContext("org1");
 
@@ -183,12 +235,8 @@ describe("getSelfHostedOrganizationEntitlementsContext", () => {
   });
 
   test("does not map Hub features when license inactive even if flags are true", async () => {
-    mockGetOrg.mockResolvedValue({ id: "org1" } as any);
-    mockGetLicense.mockResolvedValue({
-      status: "expired",
-      active: false,
-      features: { feedbackDirectories: true, dashboards: true },
-    } as any);
+    mockGetOrg.mockResolvedValue(organization);
+    mockGetLicense.mockResolvedValue(expiredLicense({ feedbackDirectories: true, dashboards: true }));
 
     const result = await getSelfHostedOrganizationEntitlementsContext("org1");
 
diff --git a/apps/web/modules/entitlements/lib/self-hosted-provider.ts b/apps/web/modules/entitlements/lib/self-hosted-provider.ts
index 723306907f46..adaed940ff92 100644
--- a/apps/web/modules/entitlements/lib/self-hosted-provider.ts
+++ b/apps/web/modules/entitlements/lib/self-hosted-provider.ts
@@ -60,7 +60,8 @@ export const getSelfHostedOrganizationEntitlementsContext = async (
     source: "self_hosted_license",
     features: license.active ? mapLicenseFeaturesToEntitlements(license.features) : [],
     limits: {
-      workspaces: license.active ? (license.features?.workspaces ?? 3) : 3,
+      // null = unlimited; only an inactive or feature-less license falls back to the community default.
+      workspaces: license.active && license.features ? license.features.workspaces : 3,
       // Self-hosted response limits are not license-server-managed today.
       monthlyResponses: null,
       // Self-hosted workflows are gated by the boolean license feature, not metered (ENG-1936).
diff --git a/apps/web/modules/storage/lib/delete-response-files.test.ts b/apps/web/modules/storage/lib/delete-response-files.test.ts
new file mode 100644
index 000000000000..86423ba889ab
--- /dev/null
+++ b/apps/web/modules/storage/lib/delete-response-files.test.ts
@@ -0,0 +1,140 @@
+import { beforeEach, describe, expect, test, vi } from "vitest";
+import { logger } from "@formbricks/logger";
+import { findWorkspaceByIdOrLegacyEnvId } from "@/lib/utils/resolve-client-id";
+import { deleteFile } from "@/modules/storage/service";
+import { deleteResponseFileUrls } from "./delete-response-files";
+
+vi.mock("server-only", () => ({}));
+
+vi.mock("@formbricks/logger", () => ({
+  logger: {
+    error: vi.fn(),
+  },
+}));
+
+vi.mock("@/lib/utils/resolve-client-id", () => ({
+  findWorkspaceByIdOrLegacyEnvId: vi.fn(),
+}));
+
+vi.mock("@/modules/storage/service", () => ({
+  deleteFile: vi.fn(),
+}));
+
+const mockedResolve = vi.mocked(findWorkspaceByIdOrLegacyEnvId);
+const mockedDeleteFile = vi.mocked(deleteFile);
+
+const OWN_WORKSPACE = "ws-own";
+const FOREIGN_WORKSPACE = "ws-victim";
+
+describe("deleteResponseFileUrls", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockedDeleteFile.mockResolvedValue({ ok: true, data: undefined } as any);
+  });
+
+  test("deletes a file whose URL storage id belongs to the survey's workspace", async () => {
+    mockedResolve.mockResolvedValue({ id: OWN_WORKSPACE, organizationId: "org-1" });
+
+    await deleteResponseFileUrls([`/storage/${OWN_WORKSPACE}/private/answer.png`], OWN_WORKSPACE);
+
+    expect(mockedDeleteFile).toHaveBeenCalledTimes(1);
+    expect(mockedDeleteFile).toHaveBeenCalledWith(OWN_WORKSPACE, "private", "answer.png", OWN_WORKSPACE);
+  });
+
+  // The core cross-tenant guard: a planted URL pointing into another tenant's storage prefix must not be
+  // deleted, even though it survived write-time validation via the element-id flip TOCTOU.
+  test("refuses to delete a planted URL that resolves to a different workspace", async () => {
+    mockedResolve.mockResolvedValue({ id: FOREIGN_WORKSPACE, organizationId: "org-2" });
+
+    await deleteResponseFileUrls([`/storage/${FOREIGN_WORKSPACE}/public/bg--fid--uuid.png`], OWN_WORKSPACE);
+
+    expect(mockedDeleteFile).not.toHaveBeenCalled();
+  });
+
+  // Legacy uploads were prefixed with the environment id; the resolver maps that back to the owning
+  // workspace, so a same-workspace legacy prefix is still deletable — using its real (legacy) prefix.
+  test("allows a legacy environment-id prefix that maps back to the survey's workspace", async () => {
+    const legacyEnvId = "env-legacy";
+    mockedResolve.mockResolvedValue({ id: OWN_WORKSPACE, organizationId: "org-1" });
+
+    await deleteResponseFileUrls([`/storage/${legacyEnvId}/private/old.png`], OWN_WORKSPACE);
+
+    expect(mockedResolve).toHaveBeenCalledWith(legacyEnvId);
+    expect(mockedDeleteFile).toHaveBeenCalledWith(legacyEnvId, "private", "old.png", OWN_WORKSPACE);
+  });
+
+  test("refuses when the storage id resolves to no workspace", async () => {
+    mockedResolve.mockResolvedValue(null);
+
+    await deleteResponseFileUrls(["/storage/ws-unknown/public/x.png"], OWN_WORKSPACE);
+
+    expect(mockedDeleteFile).not.toHaveBeenCalled();
+  });
+
+  test("deletes nothing and never resolves when no survey workspace id is given", async () => {
+    await deleteResponseFileUrls([`/storage/${OWN_WORKSPACE}/private/answer.png`], undefined);
+
+    expect(mockedResolve).not.toHaveBeenCalled();
+    expect(mockedDeleteFile).not.toHaveBeenCalled();
+  });
+
+  test("skips an unparseable URL without throwing", async () => {
+    await deleteResponseFileUrls(["not-a-storage-url"], OWN_WORKSPACE);
+
+    expect(mockedResolve).not.toHaveBeenCalled();
+    expect(mockedDeleteFile).not.toHaveBeenCalled();
+  });
+
+  test("in a mixed batch, deletes the owned file and refuses the foreign one", async () => {
+    mockedResolve.mockImplementation(async (id: string) =>
+      id === OWN_WORKSPACE
+        ? { id: OWN_WORKSPACE, organizationId: "org-1" }
+        : { id: id, organizationId: "org-2" }
+    );
+
+    await deleteResponseFileUrls(
+      [`/storage/${OWN_WORKSPACE}/private/mine.png`, `/storage/${FOREIGN_WORKSPACE}/public/theirs.png`],
+      OWN_WORKSPACE
+    );
+
+    expect(mockedDeleteFile).toHaveBeenCalledTimes(1);
+    expect(mockedDeleteFile).toHaveBeenCalledWith(OWN_WORKSPACE, "private", "mine.png", OWN_WORKSPACE);
+  });
+
+  // deleteFile returns an error result instead of throwing, so a failed storage deletion must still be
+  // logged — otherwise a leftover object looks like a clean success.
+  test("logs when deleteFile returns a failure result", async () => {
+    mockedResolve.mockResolvedValue({ id: OWN_WORKSPACE, organizationId: "org-1" });
+    mockedDeleteFile.mockResolvedValue({ ok: false, error: { code: "s3_client_error" } } as any);
+
+    await deleteResponseFileUrls([`/storage/${OWN_WORKSPACE}/private/answer.png`], OWN_WORKSPACE);
+
+    expect(mockedDeleteFile).toHaveBeenCalledTimes(1);
+    expect(logger.error).toHaveBeenCalledWith(
+      expect.objectContaining({ error: { code: "s3_client_error" } }),
+      "Failed to delete a response file from storage"
+    );
+  });
+
+  test("resolves each distinct storage id only once for multiple files under it", async () => {
+    mockedResolve.mockResolvedValue({ id: OWN_WORKSPACE, organizationId: "org-1" });
+
+    await deleteResponseFileUrls(
+      [`/storage/${OWN_WORKSPACE}/private/one.png`, `/storage/${OWN_WORKSPACE}/private/two.png`],
+      OWN_WORKSPACE
+    );
+
+    expect(mockedResolve).toHaveBeenCalledTimes(1);
+    expect(mockedDeleteFile).toHaveBeenCalledTimes(2);
+  });
+
+  // The URL carries a percent-encoded file name but the object is stored under the decoded name, so the
+  // helper must decode before building the S3 key, or files with spaces/non-ASCII names never delete.
+  test("decodes the percent-encoded file name before deleting", async () => {
+    mockedResolve.mockResolvedValue({ id: OWN_WORKSPACE, organizationId: "org-1" });
+
+    await deleteResponseFileUrls([`/storage/${OWN_WORKSPACE}/private/my%20file%20(1).png`], OWN_WORKSPACE);
+
+    expect(mockedDeleteFile).toHaveBeenCalledWith(OWN_WORKSPACE, "private", "my file (1).png", OWN_WORKSPACE);
+  });
+});
diff --git a/apps/web/modules/storage/lib/delete-response-files.ts b/apps/web/modules/storage/lib/delete-response-files.ts
new file mode 100644
index 000000000000..cf713f998f8e
--- /dev/null
+++ b/apps/web/modules/storage/lib/delete-response-files.ts
@@ -0,0 +1,89 @@
+import "server-only";
+import { logger } from "@formbricks/logger";
+import { findWorkspaceByIdOrLegacyEnvId } from "@/lib/utils/resolve-client-id";
+import { deleteFile } from "@/modules/storage/service";
+import { parseStorageFileUrl } from "@/modules/storage/utils";
+
+/**
+ * Deletes the storage objects a response's file-upload answers point at, restricted to the survey's own
+ * workspace.
+ *
+ * The file URLs come out of `response.data`, i.e. from whoever wrote the response, and the S3 key is
+ * built from the id in the *URL* rather than the survey's workspace. Write-time validation
+ * (`validateClientFileUploads` -> `isScopedPrivateUploadUrl`) does pin uploaded URLs to the survey's
+ * workspace, but it only inspects keys that match a file-upload element that exists *at write time*. A
+ * caller can therefore plant a foreign URL under a key that is not yet an element, then edit the survey
+ * to turn that key into a file-upload element — a time-of-check/time-of-use gap that makes the planted,
+ * unvalidated URL look like a real answer at delete time.
+ *
+ * So the delete side cannot trust the URL's id. Re-resolve each URL's storage id here and drop anything
+ * that does not belong to this survey's workspace, regardless of which write path produced the data. The
+ * id may be a workspace id or a legacy environment id (older uploads were prefixed with the environment
+ * id), which is why it goes through `findWorkspaceByIdOrLegacyEnvId` rather than a plain string compare.
+ */
+export const deleteResponseFileUrls = async (
+  fileUrls: string[],
+  surveyWorkspaceId: string | undefined
+): Promise<void> => {
+  if (!surveyWorkspaceId) {
+    // Without the owning workspace there is nothing to authorize against, so delete nothing.
+    logger.error({ fileCount: fileUrls.length }, "Skipping response file deletion: no workspace id given");
+    return;
+  }
+
+  // Several files in one response usually share a storage id (same survey/workspace prefix). Cache the
+  // resolution promise per id so the batch does one lookup per distinct id instead of one per file.
+  const workspaceByStorageId = new Map<string, ReturnType<typeof findWorkspaceByIdOrLegacyEnvId>>();
+  const resolveStorageWorkspace = (storageId: string) => {
+    const cached = workspaceByStorageId.get(storageId);
+    if (cached) return cached;
+
+    const pending = findWorkspaceByIdOrLegacyEnvId(storageId);
+    workspaceByStorageId.set(storageId, pending);
+    return pending;
+  };
+
+  await Promise.all(
+    fileUrls.map(async (fileUrl) => {
+      try {
+        const storageFile = parseStorageFileUrl(fileUrl);
+
+        if (!storageFile) {
+          throw new Error(`Invalid storage file URL: ${fileUrl}`);
+        }
+
+        const storageWorkspace = await resolveStorageWorkspace(storageFile.storageId);
+        if (storageWorkspace?.id !== surveyWorkspaceId) {
+          logger.error(
+            { fileUrl, surveyWorkspaceId, storageId: storageFile.storageId },
+            "Refusing to delete a response file stored outside the survey's workspace"
+          );
+          return;
+        }
+
+        // The URL carries the percent-encoded file name, but the object is stored under the decoded
+        // name (upload encodes it into the URL; the download path decodes before hitting S3). Decode
+        // here too, or files with spaces/non-ASCII names miss their key and never get deleted. Decoding
+        // before deleteFile also lets its hasTraversalSegment check run on the decoded segments.
+        const fileName = decodeURIComponent(storageFile.fileName);
+
+        // deleteFile returns an error result (it does not throw) on S3 failures, so a discarded result
+        // would treat a failed deletion as a success and leave the object behind unlogged.
+        const result = await deleteFile(
+          storageFile.storageId,
+          storageFile.accessType,
+          fileName,
+          surveyWorkspaceId
+        );
+        if (!result.ok) {
+          logger.error(
+            { fileUrl, surveyWorkspaceId, error: result.error },
+            "Failed to delete a response file from storage"
+          );
+        }
+      } catch (error) {
+        logger.error({ error, fileUrl }, "Failed to delete file");
+      }
+    })
+  );
+};
diff --git a/apps/web/modules/storage/utils.ts b/apps/web/modules/storage/utils.ts
index 661a294d77b6..10a1e446a8b4 100644
--- a/apps/web/modules/storage/utils.ts
+++ b/apps/web/modules/storage/utils.ts
@@ -119,7 +119,7 @@ const getAllowedFileExtensionFromFileName = (fileName: string): TAllowedFileExte
   return extensionValidation.success ? extensionValidation.data : null;
 };
 
-const getSurveyFileUploadConfigs = ({
+export const getSurveyFileUploadConfigs = ({
   blocks,
   questions,
 }: {
diff --git a/apps/web/modules/workspaces/settings/(setup)/components/ActionClassesTable.tsx b/apps/web/modules/workspaces/settings/(setup)/components/ActionClassesTable.tsx
index 4848cad68c56..caf83e397b38 100644
--- a/apps/web/modules/workspaces/settings/(setup)/components/ActionClassesTable.tsx
+++ b/apps/web/modules/workspaces/settings/(setup)/components/ActionClassesTable.tsx
@@ -1,60 +1,87 @@
 "use client";
 
-import { type JSX, useState } from "react";
+import type { TFunction } from "i18next";
+import { useState } from "react";
 import { useTranslation } from "react-i18next";
 import { TActionClass } from "@formbricks/types/action-classes";
+import { TUserLocale } from "@formbricks/types/user";
+import { timeSince } from "@/lib/time";
+import { SettingsTable, type TSettingsTableColumn } from "@/modules/ui/components/settings-table";
+import { ACTION_TYPE_ICON_LOOKUP } from "@/modules/workspaces/settings/(setup)/app-connection/utils";
 import { ActionDetailModal } from "./ActionDetailModal";
 
 interface ActionClassesTableProps {
   actionClasses: TActionClass[];
-  children: [JSX.Element, JSX.Element[]];
   isReadOnly: boolean;
+  locale: TUserLocale;
 }
 
+/**
+ * Defined at module level rather than inside the component: an inline `cell` that returns JSX reads as a
+ * nested component definition to Sonar (typescript:S6478).
+ *
+ * This replaces a `children: [JSX.Element, JSX.Element[]]` tuple, where the header lived in
+ * `ActionTableHeading` and the rows in `ActionClassDataRow`, each with its own `grid-cols-6` that had to
+ * be kept in step by hand.
+ */
+const getActionClassColumns = ({
+  t,
+  locale,
+}: Readonly<{ t: TFunction; locale: TUserLocale }>): TSettingsTableColumn<TActionClass>[] => [
+  {
+    id: "name",
+    header: t("workspace.actions.user_actions"),
+    headerClassName: "w-[65%]",
+    skeletonWidth: "w-64",
+    cell: (actionClass) => (
+      // `title` is load-bearing, not decoration: `action.spec.ts` locates every row with
+      // `getByTitle(name)` — five call sites, four of which click it to open the detail modal. The click
+      // bubbles from here through the row activator to the row's own handler.
+      <div className="flex items-center gap-4" title={actionClass.name}>
+        <div className="size-5 shrink-0 text-slate-500">{ACTION_TYPE_ICON_LOOKUP[actionClass.type]}</div>
+        <div className="text-left">
+          <div className="font-medium wrap-break-word text-slate-900">{actionClass.name}</div>
+          <div className="text-xs wrap-break-word text-slate-400">{actionClass.description}</div>
+        </div>
+      </div>
+    ),
+  },
+  {
+    id: "createdAt",
+    header: t("common.created"),
+    headerClassName: "w-[35%]",
+    align: "center",
+    cellClassName: "whitespace-nowrap text-slate-500",
+    skeletonWidth: "w-20",
+    cell: (actionClass) => timeSince(actionClass.createdAt.toString(), locale),
+  },
+];
+
 export const ActionClassesTable = ({
   actionClasses,
-  children: [TableHeading, actionRows],
   isReadOnly,
-}: ActionClassesTableProps) => {
+  locale,
+}: Readonly<ActionClassesTableProps>) => {
   const { t } = useTranslation();
   const [isActionDetailModalOpen, setIsActionDetailModalOpen] = useState(false);
-
   const [activeActionClass, setActiveActionClass] = useState<TActionClass>();
 
-  const handleOpenActionDetailModalClick = (
-    e: React.MouseEvent<HTMLButtonElement>,
-    actionClass: TActionClass
-  ) => {
-    e.preventDefault();
+  const handleOpenActionDetailModal = (actionClass: TActionClass) => {
     setActiveActionClass(actionClass);
     setIsActionDetailModalOpen(true);
   };
 
   return (
     <>
-      <div className="rounded-xl border border-slate-200 bg-white shadow-xs">
-        {TableHeading}
-        <div id="actionClassesWrapper" className="flex flex-col">
-          {actionClasses.length > 0 ? (
-            actionClasses.map((actionClass, index) => (
-              <button
-                type="button"
-                onClick={(e: React.MouseEvent<HTMLButtonElement>) => {
-                  handleOpenActionDetailModalClick(e, actionClass);
-                }}
-                className="w-full"
-                title={actionClass.name}
-                key={actionClass.id}>
-                {actionRows[index]}
-              </button>
-            ))
-          ) : (
-            <div className="py-8 text-center">
-              <span className="text-sm text-slate-500">{t("common.no_actions_found")}</span>
-            </div>
-          )}
-        </div>
-      </div>
+      <SettingsTable
+        columns={getActionClassColumns({ t, locale })}
+        rows={actionClasses}
+        getRowId={(actionClass) => actionClass.id}
+        emptyMessage={t("common.no_actions_found")}
+        aria-label={t("common.actions")}
+        onRowClick={handleOpenActionDetailModal}
+        getRowLabel={(actionClass) => actionClass.name}
+      />
       {activeActionClass && (
         <ActionDetailModal
           open={isActionDetailModalOpen}
diff --git a/apps/web/modules/workspaces/settings/(setup)/components/ActionRowData.tsx b/apps/web/modules/workspaces/settings/(setup)/components/ActionRowData.tsx
deleted file mode 100644
index 840cdb790b24..000000000000
--- a/apps/web/modules/workspaces/settings/(setup)/components/ActionRowData.tsx
+++ /dev/null
@@ -1,31 +0,0 @@
-import { TActionClass } from "@formbricks/types/action-classes";
-import { TUserLocale } from "@formbricks/types/user";
-import { timeSince } from "@/lib/time";
-import { ACTION_TYPE_ICON_LOOKUP } from "@/modules/workspaces/settings/(setup)/app-connection/utils";
-
-export const ActionClassDataRow = ({
-  actionClass,
-  locale,
-}: {
-  actionClass: TActionClass;
-  locale: TUserLocale;
-}) => {
-  return (
-    <div className="m-2 grid grid-cols-6 content-center rounded-lg transition-colors ease-in-out hover:bg-slate-100">
-      <div className="col-span-4 flex items-start py-3 pl-6 text-sm">
-        <div className="flex w-full items-center gap-4">
-          <div className="mt-1 size-5 shrink-0 text-slate-500">
-            {ACTION_TYPE_ICON_LOOKUP[actionClass.type]}
-          </div>
-          <div className="text-left">
-            <div className="font-medium wrap-break-word text-slate-900">{actionClass.name}</div>
-            <div className="text-xs wrap-break-word text-slate-400">{actionClass.description}</div>
-          </div>
-        </div>
-      </div>
-      <div className="col-span-2 my-auto text-center text-sm whitespace-nowrap text-slate-500">
-        {timeSince(actionClass.createdAt.toString(), locale)}
-      </div>
-    </div>
-  );
-};
diff --git a/apps/web/modules/workspaces/settings/(setup)/components/ActionTableHeading.tsx b/apps/web/modules/workspaces/settings/(setup)/components/ActionTableHeading.tsx
deleted file mode 100644
index fe50f726b7d5..000000000000
--- a/apps/web/modules/workspaces/settings/(setup)/components/ActionTableHeading.tsx
+++ /dev/null
@@ -1,14 +0,0 @@
-"use client";
-
-import { useTranslation } from "react-i18next";
-
-export const ActionTableHeading = () => {
-  const { t } = useTranslation();
-  return (
-    <div className="grid h-12 grid-cols-6 content-center border-b border-slate-200 text-left text-sm font-semibold text-slate-900">
-      <span className="sr-only">{t("common.edit")}</span>
-      <div className="col-span-4 pl-6">{t("workspace.actions.user_actions")}</div>
-      <div className="col-span-2 text-center">{t("common.created")}</div>
-    </div>
-  );
-};
diff --git a/apps/web/modules/workspaces/settings/(setup)/components/action-settings-card.tsx b/apps/web/modules/workspaces/settings/(setup)/components/action-settings-card.tsx
index 7f5624aed380..b83afbc3ea8e 100644
--- a/apps/web/modules/workspaces/settings/(setup)/components/action-settings-card.tsx
+++ b/apps/web/modules/workspaces/settings/(setup)/components/action-settings-card.tsx
@@ -6,8 +6,6 @@ import { TActionClass } from "@formbricks/types/action-classes";
 import { TUserLocale } from "@formbricks/types/user";
 import { SettingsCard } from "@/app/(app)/workspaces/[workspaceId]/settings/components/SettingsCard";
 import { ActionClassesTable } from "@/modules/workspaces/settings/(setup)/components/ActionClassesTable";
-import { ActionClassDataRow } from "@/modules/workspaces/settings/(setup)/components/ActionRowData";
-import { ActionTableHeading } from "@/modules/workspaces/settings/(setup)/components/ActionTableHeading";
 import { AddActionModal } from "@/modules/workspaces/settings/(setup)/components/AddActionModal";
 
 interface ActionSettingsCardProps {
@@ -33,13 +31,11 @@ export const ActionSettingsCard = ({
           text: t("common.add_action"),
           onClick: () => setIsActionModalOpen(true),
           variant: "default",
-        }}>
-        <ActionClassesTable actionClasses={actionClasses} isReadOnly={isReadOnly}>
-          <ActionTableHeading />
-          {actionClasses.map((actionClass) => (
-            <ActionClassDataRow key={actionClass.id} actionClass={actionClass} locale={locale} />
-          ))}
-        </ActionClassesTable>
+        }}
+        // The "Add action" control lives in the card's header, so the table is the only body content and
+        // can run edge to edge with nothing above it needing a gutter.
+        bodyVariant="flush">
+        <ActionClassesTable actionClasses={actionClasses} isReadOnly={isReadOnly} locale={locale} />
       </SettingsCard>
       <AddActionModal
         workspaceId={workspaceId}
diff --git a/apps/web/modules/workspaces/settings/tags/actions.ts b/apps/web/modules/workspaces/settings/tags/actions.ts
deleted file mode 100644
index 4ea2825967dc..000000000000
--- a/apps/web/modules/workspaces/settings/tags/actions.ts
+++ /dev/null
@@ -1,135 +0,0 @@
-"use server";
-
-import { z } from "zod";
-import { ZId } from "@formbricks/types/common";
-import { getTag } from "@/lib/tag/service";
-import { authenticatedActionClient } from "@/lib/utils/action-client";
-import { checkAuthorizationUpdated } from "@/lib/utils/action-client/action-client-middleware";
-import {
-  getOrganizationIdFromTagId,
-  getOrganizationIdFromWorkspaceId,
-  getWorkspaceIdFromTagId,
-} from "@/lib/utils/helper";
-import { withAuditLogging } from "@/modules/ee/audit-logs/lib/handler";
-import { deleteTag, mergeTags, updateTagName } from "@/modules/workspaces/settings/lib/tag";
-
-const ZDeleteTagAction = z.object({
-  tagId: ZId,
-});
-
-export const deleteTagAction = authenticatedActionClient.inputSchema(ZDeleteTagAction).action(
-  withAuditLogging("deleted", "tag", async ({ ctx, parsedInput }) => {
-    const organizationId = await getOrganizationIdFromTagId(parsedInput.tagId);
-    await checkAuthorizationUpdated({
-      userId: ctx.user.id,
-      organizationId,
-      access: [
-        {
-          type: "organization",
-          roles: ["owner", "manager"],
-        },
-        {
-          type: "workspaceTeam",
-          minPermission: "readWrite",
-          workspaceId: await getWorkspaceIdFromTagId(parsedInput.tagId),
-        },
-      ],
-    });
-
-    ctx.auditLoggingCtx.organizationId = organizationId;
-    ctx.auditLoggingCtx.tagId = parsedInput.tagId;
-
-    const result = await deleteTag(parsedInput.tagId);
-    if (result.ok) {
-      ctx.auditLoggingCtx.oldObject = result.data;
-    } else {
-      ctx.auditLoggingCtx.oldObject = null;
-    }
-    return result;
-  })
-);
-
-const ZUpdateTagNameAction = z.object({
-  tagId: ZId,
-  name: z.string(),
-});
-
-export const updateTagNameAction = authenticatedActionClient.inputSchema(ZUpdateTagNameAction).action(
-  withAuditLogging("updated", "tag", async ({ ctx, parsedInput }) => {
-    const organizationId = await getOrganizationIdFromTagId(parsedInput.tagId);
-    await checkAuthorizationUpdated({
-      userId: ctx.user.id,
-      organizationId,
-      access: [
-        {
-          type: "organization",
-          roles: ["owner", "manager"],
-        },
-        {
-          type: "workspaceTeam",
-          minPermission: "readWrite",
-          workspaceId: await getWorkspaceIdFromTagId(parsedInput.tagId),
-        },
-      ],
-    });
-
-    ctx.auditLoggingCtx.organizationId = organizationId;
-    ctx.auditLoggingCtx.tagId = parsedInput.tagId;
-    ctx.auditLoggingCtx.oldObject = await getTag(parsedInput.tagId);
-
-    const result = await updateTagName(parsedInput.tagId, parsedInput.name);
-
-    if (result.ok) {
-      ctx.auditLoggingCtx.newObject = result.data;
-    } else {
-      ctx.auditLoggingCtx.newObject = null;
-    }
-    return result;
-  })
-);
-
-const ZMergeTagsAction = z.object({
-  originalTagId: ZId,
-  newTagId: ZId,
-});
-
-export const mergeTagsAction = authenticatedActionClient.inputSchema(ZMergeTagsAction).action(
-  withAuditLogging("merged", "tag", async ({ ctx, parsedInput }) => {
-    const originalTagWorkspaceId = await getWorkspaceIdFromTagId(parsedInput.originalTagId);
-    const newTagWorkspaceId = await getWorkspaceIdFromTagId(parsedInput.newTagId);
-
-    if (originalTagWorkspaceId !== newTagWorkspaceId) {
-      throw new Error("Tags must be in the same workspace");
-    }
-
-    const workspaceId = newTagWorkspaceId;
-    const organizationId = await getOrganizationIdFromWorkspaceId(workspaceId);
-    await checkAuthorizationUpdated({
-      userId: ctx.user.id,
-      organizationId,
-      access: [
-        {
-          type: "organization",
-          roles: ["owner", "manager"],
-        },
-        {
-          type: "workspaceTeam",
-          minPermission: "readWrite",
-          workspaceId,
-        },
-      ],
-    });
-
-    ctx.auditLoggingCtx.organizationId = organizationId;
-    ctx.auditLoggingCtx.tagId = `${parsedInput.originalTagId}-${parsedInput.newTagId}`;
-
-    const result = await mergeTags(parsedInput.originalTagId, parsedInput.newTagId);
-
-    if (result.ok) {
-      ctx.auditLoggingCtx.newObject = result.data;
-    } else {
-      ctx.auditLoggingCtx.newObject = null;
-    }
-    return result;
-  })
-);
diff --git a/apps/web/modules/workspaces/settings/tags/components/edit-tags-wrapper.tsx b/apps/web/modules/workspaces/settings/tags/components/edit-tags-wrapper.tsx
index 684a69065a76..b2618125abd9 100644
--- a/apps/web/modules/workspaces/settings/tags/components/edit-tags-wrapper.tsx
+++ b/apps/web/modules/workspaces/settings/tags/components/edit-tags-wrapper.tsx
@@ -1,45 +1,115 @@
 "use client";
 
-import React from "react";
+import type { TFunction } from "i18next";
 import { useTranslation } from "react-i18next";
-import { TTag, TTagsCount } from "@formbricks/types/tags";
-import { EmptyState } from "@/modules/ui/components/empty-state";
-import { SingleTag } from "@/modules/workspaces/settings/tags/components/single-tag";
+import type { TV3Tag } from "@/app/api/v3/tags/serializers";
+import { getV3ApiErrorMessage } from "@/modules/api/lib/v3-client";
+import { Button } from "@/modules/ui/components/button";
+import { SettingsTable, type TSettingsTableColumn } from "@/modules/ui/components/settings-table";
+import { TagNameInput } from "@/modules/workspaces/settings/tags/components/tag-name-input";
+import { TagRowActions } from "@/modules/workspaces/settings/tags/components/tag-row-actions";
+import { useTags } from "@/modules/workspaces/settings/tags/hooks/use-tags";
 
 interface EditTagsWrapperProps {
-  environmentTags: TTag[];
-  environmentTagsCount: TTagsCount;
+  workspaceId: string;
   isReadOnly: boolean;
 }
 
-export const EditTagsWrapper: React.FC<EditTagsWrapperProps> = (props) => {
-  const { t } = useTranslation();
-  const { environmentTags, environmentTagsCount, isReadOnly } = props;
+/**
+ * Exported so `loading.tsx` builds its skeleton from the same array. That skeleton used to hand-roll the
+ * header and had already drifted: it rendered the actions column unconditionally while the real table
+ * gates it on `!isReadOnly`, so a read-only viewer saw a three-column skeleton resolve into a two-column
+ * table.
+ *
+ * Defined at module level rather than inside the component: an inline `cell` that returns JSX reads as a
+ * nested component definition to Sonar (typescript:S6478).
+ */
+export const getTagColumns = ({
+  t,
+  workspaceId,
+  tags,
+  isReadOnly,
+}: Readonly<{
+  t: TFunction;
+  workspaceId: string;
+  tags: TV3Tag[];
+  isReadOnly: boolean;
+}>): TSettingsTableColumn<TV3Tag>[] => {
+  const columns: TSettingsTableColumn<TV3Tag>[] = [
+    {
+      id: "tag",
+      header: t("workspace.tags.tag"),
+      headerClassName: "w-[50%]",
+      skeletonWidth: "w-full",
+      cell: (tag) => (
+        <TagNameInput tagId={tag.id} tagName={tag.name} workspaceId={workspaceId} isReadOnly={isReadOnly} />
+      ),
+    },
+    {
+      id: "count",
+      header: t("workspace.tags.count"),
+      headerClassName: "w-[15%]",
+      align: "center",
+      cellClassName: "whitespace-nowrap text-slate-900",
+      skeletonWidth: "w-8",
+      cell: (tag) => tag.count,
+    },
+  ];
 
-  if (!environmentTags?.length) {
-    return <EmptyState text={t("workspace.tags.no_tag_found")} />;
+  if (!isReadOnly) {
+    columns.push({
+      id: "actions",
+      header: t("common.actions"),
+      headerClassName: "w-[35%]",
+      align: "center",
+      skeletonWidth: "w-40",
+      cell: (tag) => (
+        <TagRowActions
+          tagId={tag.id}
+          tagName={tag.name}
+          workspaceId={workspaceId}
+          mergeableTags={tags
+            .filter((candidate) => candidate.id !== tag.id)
+            .map((candidate) => ({ label: candidate.name, value: candidate.id }))}
+        />
+      ),
+    });
   }
 
-  return (
-    <div className="">
-      <div className="grid grid-cols-4 content-center rounded-lg bg-white text-left text-sm font-semibold text-slate-900">
-        <div className="col-span-2">{t("workspace.tags.tag")}</div>
-        <div className="col-span-1 text-center">{t("workspace.tags.count")}</div>
-        {!isReadOnly && (
-          <div className="col-span-1 flex justify-center text-center">{t("common.actions")}</div>
-        )}
+  return columns;
+};
+
+export const EditTagsWrapper = ({ workspaceId, isReadOnly }: Readonly<EditTagsWrapperProps>) => {
+  const { t } = useTranslation();
+  // The tag list lives in the query cache, so a rename, merge or delete invalidates it instead of
+  // calling `router.refresh()` to revalidate the whole route.
+  const { data: tags = [], isPending, isError, error, refetch } = useTags(workspaceId);
+
+  // A failed fetch must not fall through to the table: `data` defaults to `[]`, so the empty state would
+  // claim the workspace has no tags when the request merely failed. Same shape as `survey-list.tsx` and
+  // `workflow-runs-table.tsx`.
+  if (isError && tags.length === 0) {
+    return (
+      <div className="flex w-full flex-col items-center justify-center gap-4 py-16 text-slate-600">
+        <p>{getV3ApiErrorMessage(error, t("common.something_went_wrong_please_try_again"))}</p>
+        <Button variant="secondary" size="sm" onClick={() => refetch()}>
+          {t("common.try_again")}
+        </Button>
       </div>
+    );
+  }
 
-      {environmentTags.map((tag) => (
-        <SingleTag
-          key={tag.id}
-          tagId={tag.id}
-          tagName={tag.name}
-          tagCount={environmentTagsCount?.find((count) => count.tagId === tag.id)?.count ?? 0}
-          environmentTags={environmentTags}
-          isReadOnly={isReadOnly}
-        />
-      ))}
-    </div>
+  return (
+    <SettingsTable
+      columns={getTagColumns({ t, workspaceId, tags, isReadOnly })}
+      rows={tags}
+      getRowId={(tag) => tag.id}
+      // Keyed by the id the API returned, so `settings-tags.spec.ts` can address a row without matching
+      // on the name — the one thing a rename changes.
+      getRowProps={(tag) => ({ "data-testid": `tag-row-${tag.id}` })}
+      isLoading={isPending}
+      emptyMessage={t("workspace.tags.no_tag_found")}
+      aria-label={t("common.tags")}
+    />
   );
 };
diff --git a/apps/web/modules/workspaces/settings/tags/components/single-tag.tsx b/apps/web/modules/workspaces/settings/tags/components/single-tag.tsx
deleted file mode 100644
index c5e7c3cead4f..000000000000
--- a/apps/web/modules/workspaces/settings/tags/components/single-tag.tsx
+++ /dev/null
@@ -1,172 +0,0 @@
-"use client";
-
-import { AlertCircleIcon } from "lucide-react";
-import { useRouter } from "next/navigation";
-import React, { useState } from "react";
-import { toast } from "react-hot-toast";
-import { useTranslation } from "react-i18next";
-import { TTag } from "@formbricks/types/tags";
-import { cn } from "@/lib/cn";
-import { getFormattedErrorMessage } from "@/lib/utils/helper";
-import { Button } from "@/modules/ui/components/button";
-import { DeleteDialog } from "@/modules/ui/components/delete-dialog";
-import { Input } from "@/modules/ui/components/input";
-import { LoadingSpinner } from "@/modules/ui/components/loading-spinner";
-import {
-  deleteTagAction,
-  mergeTagsAction,
-  updateTagNameAction,
-} from "@/modules/workspaces/settings/tags/actions";
-import { MergeTagsCombobox } from "@/modules/workspaces/settings/tags/components/merge-tags-combobox";
-import { TagError } from "@/modules/workspaces/settings/types/tag";
-
-interface SingleTagProps {
-  tagId: string;
-  tagName: string;
-  tagCount?: number;
-  tagCountLoading?: boolean;
-  updateTagsCount?: () => void;
-  environmentTags: TTag[];
-  isReadOnly?: boolean;
-}
-
-export const SingleTag: React.FC<SingleTagProps> = ({
-  tagId,
-  tagName,
-  tagCount = 0,
-  tagCountLoading = false,
-  updateTagsCount = () => {},
-  environmentTags,
-  isReadOnly = false,
-}) => {
-  const { t } = useTranslation();
-  const router = useRouter();
-  const [updateTagError, setUpdateTagError] = useState(false);
-  const [isMergingTags, setIsMergingTags] = useState(false);
-  const [openDeleteTagDialog, setOpenDeleteTagDialog] = useState(false);
-
-  const confirmDeleteTag = async () => {
-    const deleteTagResponse = await deleteTagAction({ tagId });
-    if (deleteTagResponse?.data) {
-      if (deleteTagResponse.data.ok) {
-        toast.success(t("workspace.tags.tag_deleted"));
-        updateTagsCount();
-        router.refresh();
-      } else {
-        const errorMessage = deleteTagResponse.data?.error?.message;
-        toast.error(errorMessage);
-      }
-    } else {
-      const errorMessage = getFormattedErrorMessage(deleteTagResponse);
-      toast.error(errorMessage ?? t("common.something_went_wrong_please_try_again"));
-    }
-  };
-
-  const handleUpdateTagName = async (e: React.FocusEvent<HTMLInputElement>) => {
-    const result = await updateTagNameAction({ tagId, name: e.target.value.trim() });
-    if (result?.data) {
-      if (result.data.ok) {
-        setUpdateTagError(false);
-        toast.success(t("workspace.tags.tag_updated"));
-      } else if (result.data?.error?.code === TagError.TAG_NAME_ALREADY_EXISTS) {
-        toast.error(t("workspace.tags.tag_already_exists"), {
-          duration: 2000,
-          icon: <AlertCircleIcon className="size-5 text-orange-500" />,
-        });
-        setUpdateTagError(true);
-      } else {
-        const errorMessage = result.data?.error?.message;
-        toast.error(errorMessage);
-        setUpdateTagError(true);
-      }
-    } else {
-      const errorMessage = getFormattedErrorMessage(result);
-      toast.error(errorMessage ?? t("common.something_went_wrong_please_try_again"));
-      setUpdateTagError(true);
-    }
-  };
-
-  const handleMergeTags = async (newTagId: string) => {
-    setIsMergingTags(true);
-    const mergeTagsResponse = await mergeTagsAction({ originalTagId: tagId, newTagId });
-
-    if (mergeTagsResponse?.data) {
-      if (mergeTagsResponse.data.ok) {
-        toast.success(t("workspace.tags.tags_merged"));
-        updateTagsCount();
-        router.refresh();
-      } else {
-        const errorMessage = mergeTagsResponse.data?.error?.message;
-        toast.error(errorMessage ?? t("common.something_went_wrong_please_try_again"));
-      }
-    } else {
-      const errorMessage = getFormattedErrorMessage(mergeTagsResponse);
-      toast.error(errorMessage ?? t("common.something_went_wrong_please_try_again"));
-    }
-    setIsMergingTags(false);
-  };
-
-  return (
-    <div className="w-full" key={tagId}>
-      <div className="grid h-16 grid-cols-4 content-center rounded-lg">
-        <div className="col-span-2 flex items-center text-sm">
-          <div className="w-full text-left">
-            <Input
-              disabled={isReadOnly}
-              className={cn(
-                "w-full border font-medium text-slate-900",
-                updateTagError
-                  ? "border-red-500 focus:border-red-500"
-                  : "border-slate-200 focus:border-slate-500"
-              )}
-              defaultValue={tagName}
-              onBlur={handleUpdateTagName}
-            />
-          </div>
-        </div>
-
-        <div className="col-span-1 my-auto text-center text-sm whitespace-nowrap text-slate-500">
-          <div className="text-slate-900">{tagCountLoading ? <LoadingSpinner /> : <p>{tagCount}</p>}</div>
-        </div>
-
-        {!isReadOnly && (
-          <div className="col-span-1 my-auto flex items-center justify-center gap-2 text-center text-sm whitespace-nowrap text-slate-500">
-            <div>
-              {isMergingTags ? (
-                <div className="w-24">
-                  <LoadingSpinner />
-                </div>
-              ) : (
-                <MergeTagsCombobox
-                  tags={
-                    environmentTags
-                      ?.filter((tag) => tag.id !== tagId)
-                      ?.map((tag) => ({ label: tag.name, value: tag.id })) ?? []
-                  }
-                  onSelect={handleMergeTags}
-                />
-              )}
-            </div>
-
-            <div>
-              <Button
-                variant="destructive"
-                size="sm"
-                className="font-medium text-slate-50 focus:border-transparent focus:ring-0 focus:shadow-transparent focus:ring-transparent focus:outline-transparent"
-                onClick={() => setOpenDeleteTagDialog(true)}>
-                {t("common.delete")}
-              </Button>
-              <DeleteDialog
-                open={openDeleteTagDialog}
-                setOpen={setOpenDeleteTagDialog}
-                deleteWhat={tagName}
-                text={t("workspace.tags.delete_tag_confirmation")}
-                onDelete={confirmDeleteTag}
-              />
-            </div>
-          </div>
-        )}
-      </div>
-    </div>
-  );
-};
diff --git a/apps/web/modules/workspaces/settings/tags/components/tag-name-input.tsx b/apps/web/modules/workspaces/settings/tags/components/tag-name-input.tsx
new file mode 100644
index 000000000000..93159bdb56a7
--- /dev/null
+++ b/apps/web/modules/workspaces/settings/tags/components/tag-name-input.tsx
@@ -0,0 +1,69 @@
+"use client";
+
+import { AlertCircleIcon } from "lucide-react";
+import { useState } from "react";
+import { toast } from "react-hot-toast";
+import { useTranslation } from "react-i18next";
+import { cn } from "@/lib/cn";
+import { getV3ApiErrorMessage } from "@/modules/api/lib/v3-client";
+import { Input } from "@/modules/ui/components/input";
+import { useRenameTag } from "@/modules/workspaces/settings/tags/hooks/use-rename-tag";
+import { isDuplicateTagNameError } from "@/modules/workspaces/settings/tags/lib/errors";
+
+interface TagNameInputProps {
+  tagId: string;
+  tagName: string;
+  workspaceId: string;
+  isReadOnly: boolean;
+}
+
+/**
+ * The tag column's cell. Split out of the old `SingleTag` row so the table can be driven by a column
+ * config: the row's two interactive cells never shared state, so each now owns its own — this one holds
+ * the rename error, the actions cell holds the merge and delete state.
+ */
+export const TagNameInput = ({ tagId, tagName, workspaceId, isReadOnly }: Readonly<TagNameInputProps>) => {
+  const { t } = useTranslation();
+  const [updateTagError, setUpdateTagError] = useState(false);
+  const renameTag = useRenameTag(workspaceId);
+
+  const handleUpdateTagName = async (event: React.FocusEvent<HTMLInputElement>) => {
+    const name = event.target.value.trim();
+    if (name === tagName) {
+      // Blurring without editing is not a rename. Skipping the request also stops a tab-through from
+      // firing one write per row.
+      return;
+    }
+
+    try {
+      await renameTag.mutateAsync({ tagId, name });
+      setUpdateTagError(false);
+      toast.success(t("workspace.tags.tag_updated"));
+    } catch (error) {
+      setUpdateTagError(true);
+      if (isDuplicateTagNameError(error)) {
+        toast.error(t("workspace.tags.tag_already_exists"), {
+          duration: 2000,
+          icon: <AlertCircleIcon className="size-5 text-orange-500" />,
+        });
+        return;
+      }
+      toast.error(getV3ApiErrorMessage(error, t("common.something_went_wrong_please_try_again")));
+    }
+  };
+
+  return (
+    <Input
+      // Disabled while the rename is in flight, which is what serializes it: a second blur could
+      // otherwise start a request that completes out of order and leave the earlier name in storage.
+      disabled={isReadOnly || renameTag.isPending}
+      aria-label={t("workspace.tags.tag")}
+      className={cn(
+        "w-full border font-medium text-slate-900",
+        updateTagError ? "border-red-500 focus:border-red-500" : "border-slate-200 focus:border-slate-500"
+      )}
+      defaultValue={tagName}
+      onBlur={handleUpdateTagName}
+    />
+  );
+};
diff --git a/apps/web/modules/workspaces/settings/tags/components/tag-row-actions.tsx b/apps/web/modules/workspaces/settings/tags/components/tag-row-actions.tsx
new file mode 100644
index 000000000000..9cf598ea7e29
--- /dev/null
+++ b/apps/web/modules/workspaces/settings/tags/components/tag-row-actions.tsx
@@ -0,0 +1,83 @@
+"use client";
+
+import { useState } from "react";
+import { toast } from "react-hot-toast";
+import { useTranslation } from "react-i18next";
+import { getV3ApiErrorMessage } from "@/modules/api/lib/v3-client";
+import { Button } from "@/modules/ui/components/button";
+import { DeleteDialog } from "@/modules/ui/components/delete-dialog";
+import { LoadingSpinner } from "@/modules/ui/components/loading-spinner";
+import { MergeTagsCombobox } from "@/modules/workspaces/settings/tags/components/merge-tags-combobox";
+import { useDeleteTag } from "@/modules/workspaces/settings/tags/hooks/use-delete-tag";
+import { useMergeTags } from "@/modules/workspaces/settings/tags/hooks/use-merge-tags";
+
+interface TagRowActionsProps {
+  tagId: string;
+  tagName: string;
+  workspaceId: string;
+  mergeableTags: { label: string; value: string }[];
+}
+
+/**
+ * The actions column's cell — merge and delete. Split out of the old `SingleTag` row along with
+ * `TagNameInput`; it owns the merge-in-flight and delete-dialog state that used to sit on the whole row.
+ */
+export const TagRowActions = ({
+  tagId,
+  tagName,
+  workspaceId,
+  mergeableTags,
+}: Readonly<TagRowActionsProps>) => {
+  const { t } = useTranslation();
+  const [openDeleteTagDialog, setOpenDeleteTagDialog] = useState(false);
+  const deleteTag = useDeleteTag(workspaceId);
+  const mergeTags = useMergeTags(workspaceId);
+
+  const confirmDeleteTag = async () => {
+    try {
+      await deleteTag.mutateAsync({ tagId });
+      toast.success(t("workspace.tags.tag_deleted"));
+    } catch (error) {
+      toast.error(getV3ApiErrorMessage(error, t("common.something_went_wrong_please_try_again")));
+    }
+  };
+
+  const handleMergeTags = async (newTagId: string) => {
+    try {
+      await mergeTags.mutateAsync({ tagId, newTagId });
+      toast.success(t("workspace.tags.tags_merged"));
+    } catch (error) {
+      toast.error(getV3ApiErrorMessage(error, t("common.something_went_wrong_please_try_again")));
+    }
+  };
+
+  return (
+    // The flex sits here rather than on `cellClassName`, which would land on the `<td>` and stop it being
+    // a table cell.
+    <div className="flex items-center justify-center gap-2">
+      {mergeTags.isPending ? (
+        <div className="w-24">
+          <LoadingSpinner />
+        </div>
+      ) : (
+        <MergeTagsCombobox tags={mergeableTags} onSelect={handleMergeTags} />
+      )}
+      <Button
+        variant="destructive"
+        size="sm"
+        loading={deleteTag.isPending}
+        className="font-medium text-slate-50 focus:border-transparent focus:ring-0 focus:shadow-transparent focus:ring-transparent focus:outline-transparent"
+        onClick={() => setOpenDeleteTagDialog(true)}>
+        {t("common.delete")}
+      </Button>
+      <DeleteDialog
+        open={openDeleteTagDialog}
+        setOpen={setOpenDeleteTagDialog}
+        deleteWhat={tagName}
+        text={t("workspace.tags.delete_tag_confirmation")}
+        onDelete={confirmDeleteTag}
+        isDeleting={deleteTag.isPending}
+      />
+    </div>
+  );
+};
diff --git a/apps/web/modules/workspaces/settings/tags/hooks/use-delete-tag.test.ts b/apps/web/modules/workspaces/settings/tags/hooks/use-delete-tag.test.ts
new file mode 100644
index 000000000000..963d6801ce82
--- /dev/null
+++ b/apps/web/modules/workspaces/settings/tags/hooks/use-delete-tag.test.ts
@@ -0,0 +1,70 @@
+/**
+ * @vitest-environment jsdom
+ */
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { renderHook, waitFor } from "@testing-library/react";
+import { type ReactNode, createElement } from "react";
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import { tagKeys } from "../lib/query";
+import { useDeleteTag } from "./use-delete-tag";
+
+const wrapper = (queryClient: QueryClient) => {
+  const Wrapper = ({ children }: Readonly<{ children: ReactNode }>) =>
+    createElement(QueryClientProvider, { client: queryClient }, children);
+  Wrapper.displayName = "useDeleteTagTestWrapper";
+  return Wrapper;
+};
+
+const newQueryClient = () =>
+  new QueryClient({ defaultOptions: { mutations: { retry: false }, queries: { retry: false } } });
+
+describe("useDeleteTag", () => {
+  beforeEach(() => {
+    (globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT =
+      true;
+    vi.stubGlobal("fetch", vi.fn());
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  test("deletes through the tag route, then invalidates exactly this workspace's tag list", async () => {
+    vi.mocked(global.fetch).mockResolvedValue(
+      new Response(JSON.stringify({ data: { id: "cltt1234567890123456789012" } }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      })
+    );
+    const queryClient = newQueryClient();
+    const invalidate = vi.spyOn(queryClient, "invalidateQueries");
+
+    const { result } = renderHook(() => useDeleteTag("ws_1"), { wrapper: wrapper(queryClient) });
+    result.current.mutate({ tagId: "cltt1234567890123456789012" });
+
+    await waitFor(() => expect(result.current.isSuccess).toBe(true));
+    expect(vi.mocked(global.fetch).mock.calls[0][0]).toBe("/api/v3/tags/cltt1234567890123456789012");
+    expect(vi.mocked(global.fetch).mock.calls[0][1]).toMatchObject({ method: "DELETE" });
+    // The exact tuple matters: a key that does not match `useTags` leaves the table showing stale rows,
+    // which is the whole reason this replaced `router.refresh()`.
+    expect(invalidate).toHaveBeenCalledWith({ queryKey: tagKeys.list("ws_1") });
+  });
+
+  test("surfaces a rejected request instead of reporting success", async () => {
+    vi.mocked(global.fetch).mockResolvedValue(
+      new Response(
+        JSON.stringify({ title: "Forbidden", status: 403, detail: "not yours", code: "forbidden" }),
+        { status: 403, headers: { "Content-Type": "application/problem+json" } }
+      )
+    );
+    const queryClient = newQueryClient();
+    const invalidate = vi.spyOn(queryClient, "invalidateQueries");
+
+    const { result } = renderHook(() => useDeleteTag("ws_1"), { wrapper: wrapper(queryClient) });
+
+    await expect(result.current.mutateAsync({ tagId: "cltt1234567890123456789012" })).rejects.toThrow(
+      "not yours"
+    );
+    expect(invalidate).not.toHaveBeenCalled();
+  });
+});
diff --git a/apps/web/modules/workspaces/settings/tags/hooks/use-delete-tag.ts b/apps/web/modules/workspaces/settings/tags/hooks/use-delete-tag.ts
new file mode 100644
index 000000000000..b5fc01acabc5
--- /dev/null
+++ b/apps/web/modules/workspaces/settings/tags/hooks/use-delete-tag.ts
@@ -0,0 +1,14 @@
+"use client";
+
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+import { deleteTag } from "../lib/api-client";
+import { tagKeys } from "../lib/query";
+
+/** Delete a tag, then invalidate the list — replacing a `router.refresh()` full-page revalidation. */
+export const useDeleteTag = (workspaceId: string) => {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (variables: { tagId: string }) => deleteTag(variables),
+    onSuccess: () => queryClient.invalidateQueries({ queryKey: tagKeys.list(workspaceId) }),
+  });
+};
diff --git a/apps/web/modules/workspaces/settings/tags/hooks/use-merge-tags.test.ts b/apps/web/modules/workspaces/settings/tags/hooks/use-merge-tags.test.ts
new file mode 100644
index 000000000000..03256dc437ab
--- /dev/null
+++ b/apps/web/modules/workspaces/settings/tags/hooks/use-merge-tags.test.ts
@@ -0,0 +1,73 @@
+/**
+ * @vitest-environment jsdom
+ */
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { renderHook, waitFor } from "@testing-library/react";
+import { type ReactNode, createElement } from "react";
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import { tagKeys } from "../lib/query";
+import { useMergeTags } from "./use-merge-tags";
+
+const wrapper = (queryClient: QueryClient) => {
+  const Wrapper = ({ children }: Readonly<{ children: ReactNode }>) =>
+    createElement(QueryClientProvider, { client: queryClient }, children);
+  Wrapper.displayName = "useMergeTagsTestWrapper";
+  return Wrapper;
+};
+
+const newQueryClient = () =>
+  new QueryClient({ defaultOptions: { mutations: { retry: false }, queries: { retry: false } } });
+
+describe("useMergeTags", () => {
+  beforeEach(() => {
+    (globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT =
+      true;
+    vi.stubGlobal("fetch", vi.fn());
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  test("merges through the merge sub-route, then invalidates exactly this workspace's tag list", async () => {
+    vi.mocked(global.fetch).mockResolvedValue(
+      new Response(JSON.stringify({ data: { id: "cltt1234567890123456789012" } }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      })
+    );
+    const queryClient = newQueryClient();
+    const invalidate = vi.spyOn(queryClient, "invalidateQueries");
+
+    const { result } = renderHook(() => useMergeTags("ws_1"), { wrapper: wrapper(queryClient) });
+    result.current.mutate({ tagId: "cltt1234567890123456789012", newTagId: "clyy1234567890123456789012" });
+
+    await waitFor(() => expect(result.current.isSuccess).toBe(true));
+    expect(vi.mocked(global.fetch).mock.calls[0][0]).toBe("/api/v3/tags/cltt1234567890123456789012/merge");
+    expect(vi.mocked(global.fetch).mock.calls[0][1]).toMatchObject({ method: "POST" });
+    // The exact tuple matters: a key that does not match `useTags` leaves the table showing stale rows,
+    // which is the whole reason this replaced `router.refresh()`.
+    expect(invalidate).toHaveBeenCalledWith({ queryKey: tagKeys.list("ws_1") });
+  });
+
+  test("surfaces a rejected request instead of reporting success", async () => {
+    vi.mocked(global.fetch).mockResolvedValue(
+      new Response(
+        JSON.stringify({ title: "Forbidden", status: 403, detail: "not yours", code: "forbidden" }),
+        { status: 403, headers: { "Content-Type": "application/problem+json" } }
+      )
+    );
+    const queryClient = newQueryClient();
+    const invalidate = vi.spyOn(queryClient, "invalidateQueries");
+
+    const { result } = renderHook(() => useMergeTags("ws_1"), { wrapper: wrapper(queryClient) });
+
+    await expect(
+      result.current.mutateAsync({
+        tagId: "cltt1234567890123456789012",
+        newTagId: "clyy1234567890123456789012",
+      })
+    ).rejects.toThrow("not yours");
+    expect(invalidate).not.toHaveBeenCalled();
+  });
+});
diff --git a/apps/web/modules/workspaces/settings/tags/hooks/use-merge-tags.ts b/apps/web/modules/workspaces/settings/tags/hooks/use-merge-tags.ts
new file mode 100644
index 000000000000..0e659c4cae5a
--- /dev/null
+++ b/apps/web/modules/workspaces/settings/tags/hooks/use-merge-tags.ts
@@ -0,0 +1,17 @@
+"use client";
+
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+import { mergeTags } from "../lib/api-client";
+import { tagKeys } from "../lib/query";
+
+/**
+ * Merge one tag into another, then invalidate the list. A merge changes two rows — the source disappears
+ * and the target's count grows — so it invalidates rather than patching the cache by hand.
+ */
+export const useMergeTags = (workspaceId: string) => {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (variables: { tagId: string; newTagId: string }) => mergeTags(variables),
+    onSuccess: () => queryClient.invalidateQueries({ queryKey: tagKeys.list(workspaceId) }),
+  });
+};
diff --git a/apps/web/modules/workspaces/settings/tags/hooks/use-rename-tag.test.ts b/apps/web/modules/workspaces/settings/tags/hooks/use-rename-tag.test.ts
new file mode 100644
index 000000000000..9541e0f0934d
--- /dev/null
+++ b/apps/web/modules/workspaces/settings/tags/hooks/use-rename-tag.test.ts
@@ -0,0 +1,70 @@
+/**
+ * @vitest-environment jsdom
+ */
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { renderHook, waitFor } from "@testing-library/react";
+import { type ReactNode, createElement } from "react";
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import { tagKeys } from "../lib/query";
+import { useRenameTag } from "./use-rename-tag";
+
+const wrapper = (queryClient: QueryClient) => {
+  const Wrapper = ({ children }: Readonly<{ children: ReactNode }>) =>
+    createElement(QueryClientProvider, { client: queryClient }, children);
+  Wrapper.displayName = "useRenameTagTestWrapper";
+  return Wrapper;
+};
+
+const newQueryClient = () =>
+  new QueryClient({ defaultOptions: { mutations: { retry: false }, queries: { retry: false } } });
+
+describe("useRenameTag", () => {
+  beforeEach(() => {
+    (globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT =
+      true;
+    vi.stubGlobal("fetch", vi.fn());
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  test("renames through the tag route, then invalidates exactly this workspace's tag list", async () => {
+    vi.mocked(global.fetch).mockResolvedValue(
+      new Response(JSON.stringify({ data: { id: "cltt1234567890123456789012" } }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      })
+    );
+    const queryClient = newQueryClient();
+    const invalidate = vi.spyOn(queryClient, "invalidateQueries");
+
+    const { result } = renderHook(() => useRenameTag("ws_1"), { wrapper: wrapper(queryClient) });
+    result.current.mutate({ tagId: "cltt1234567890123456789012", name: "Renamed" });
+
+    await waitFor(() => expect(result.current.isSuccess).toBe(true));
+    expect(vi.mocked(global.fetch).mock.calls[0][0]).toBe("/api/v3/tags/cltt1234567890123456789012");
+    expect(vi.mocked(global.fetch).mock.calls[0][1]).toMatchObject({ method: "PATCH" });
+    // The exact tuple matters: a key that does not match `useTags` leaves the table showing stale rows,
+    // which is the whole reason this replaced `router.refresh()`.
+    expect(invalidate).toHaveBeenCalledWith({ queryKey: tagKeys.list("ws_1") });
+  });
+
+  test("surfaces a rejected request instead of reporting success", async () => {
+    vi.mocked(global.fetch).mockResolvedValue(
+      new Response(
+        JSON.stringify({ title: "Forbidden", status: 403, detail: "not yours", code: "forbidden" }),
+        { status: 403, headers: { "Content-Type": "application/problem+json" } }
+      )
+    );
+    const queryClient = newQueryClient();
+    const invalidate = vi.spyOn(queryClient, "invalidateQueries");
+
+    const { result } = renderHook(() => useRenameTag("ws_1"), { wrapper: wrapper(queryClient) });
+
+    await expect(
+      result.current.mutateAsync({ tagId: "cltt1234567890123456789012", name: "Renamed" })
+    ).rejects.toThrow("not yours");
+    expect(invalidate).not.toHaveBeenCalled();
+  });
+});
diff --git a/apps/web/modules/workspaces/settings/tags/hooks/use-rename-tag.ts b/apps/web/modules/workspaces/settings/tags/hooks/use-rename-tag.ts
new file mode 100644
index 000000000000..0fde2b154b86
--- /dev/null
+++ b/apps/web/modules/workspaces/settings/tags/hooks/use-rename-tag.ts
@@ -0,0 +1,20 @@
+"use client";
+
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+import { renameTag } from "../lib/api-client";
+import { tagKeys } from "../lib/query";
+
+/**
+ * Rename a tag, then invalidate the list.
+ *
+ * `useMutation` is what serializes renames: the input is disabled while `isPending`, so a second blur
+ * cannot start a request that races the first. Two concurrent renames could otherwise land out of order
+ * and leave the earlier name in storage.
+ */
+export const useRenameTag = (workspaceId: string) => {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (variables: { tagId: string; name: string }) => renameTag(variables),
+    onSuccess: () => queryClient.invalidateQueries({ queryKey: tagKeys.list(workspaceId) }),
+  });
+};
diff --git a/apps/web/modules/workspaces/settings/tags/hooks/use-tags.test.ts b/apps/web/modules/workspaces/settings/tags/hooks/use-tags.test.ts
new file mode 100644
index 000000000000..6c8658d5e2fb
--- /dev/null
+++ b/apps/web/modules/workspaces/settings/tags/hooks/use-tags.test.ts
@@ -0,0 +1,64 @@
+/**
+ * @vitest-environment jsdom
+ */
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { renderHook, waitFor } from "@testing-library/react";
+import { type ReactNode, createElement } from "react";
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import { tagKeys } from "../lib/query";
+import { useTags } from "./use-tags";
+
+const wrapper = (queryClient: QueryClient) => {
+  const Wrapper = ({ children }: Readonly<{ children: ReactNode }>) =>
+    createElement(QueryClientProvider, { client: queryClient }, children);
+  Wrapper.displayName = "UseTagsTestWrapper";
+  return Wrapper;
+};
+
+const newQueryClient = () => new QueryClient({ defaultOptions: { queries: { retry: false } } });
+
+const tag = { id: "cltt1234567890123456789012", name: "Bug report", count: 3 };
+
+describe("useTags", () => {
+  beforeEach(() => {
+    (globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT =
+      true;
+    vi.stubGlobal("fetch", vi.fn());
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  test("loads a workspace's tags and caches them under the shared list key", async () => {
+    vi.mocked(global.fetch).mockResolvedValue(
+      new Response(JSON.stringify({ data: [tag] }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      })
+    );
+    const queryClient = newQueryClient();
+
+    const { result } = renderHook(() => useTags("ws_1"), { wrapper: wrapper(queryClient) });
+
+    await waitFor(() => expect(result.current.isSuccess).toBe(true));
+    expect(result.current.data).toEqual([tag]);
+    expect(vi.mocked(global.fetch).mock.calls[0][0]).toBe("/api/v3/tags?workspaceId=ws_1");
+    // Written under the same key the mutation hooks invalidate — otherwise a write never refreshes this.
+    expect(queryClient.getQueryData(tagKeys.list("ws_1"))).toEqual([tag]);
+  });
+
+  test("reports a failure rather than rendering an empty table as if there were no tags", async () => {
+    vi.mocked(global.fetch).mockResolvedValue(
+      new Response(
+        JSON.stringify({ title: "Forbidden", status: 403, detail: "not yours", code: "forbidden" }),
+        { status: 403, headers: { "Content-Type": "application/problem+json" } }
+      )
+    );
+
+    const { result } = renderHook(() => useTags("ws_1"), { wrapper: wrapper(newQueryClient()) });
+
+    await waitFor(() => expect(result.current.isError).toBe(true));
+    expect(result.current.data).toBeUndefined();
+  });
+});
diff --git a/apps/web/modules/workspaces/settings/tags/hooks/use-tags.ts b/apps/web/modules/workspaces/settings/tags/hooks/use-tags.ts
new file mode 100644
index 000000000000..10e4478b53e6
--- /dev/null
+++ b/apps/web/modules/workspaces/settings/tags/hooks/use-tags.ts
@@ -0,0 +1,12 @@
+"use client";
+
+import { useQuery } from "@tanstack/react-query";
+import { getTags } from "../lib/api-client";
+import { tagKeys } from "../lib/query";
+
+/** A workspace's tags with their response counts — the table's only data source. */
+export const useTags = (workspaceId: string) =>
+  useQuery({
+    queryKey: tagKeys.list(workspaceId),
+    queryFn: ({ signal }) => getTags({ workspaceId, signal }),
+  });
diff --git a/apps/web/modules/workspaces/settings/tags/lib/api-client.test.ts b/apps/web/modules/workspaces/settings/tags/lib/api-client.test.ts
new file mode 100644
index 000000000000..ec94e9b069d0
--- /dev/null
+++ b/apps/web/modules/workspaces/settings/tags/lib/api-client.test.ts
@@ -0,0 +1,126 @@
+import { afterEach, describe, expect, test, vi } from "vitest";
+import { deleteTag, getTags, mergeTags, renameTag } from "./api-client";
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  vi.unstubAllGlobals();
+});
+
+const jsonResponse = (body: unknown, status = 200): Response =>
+  new Response(JSON.stringify(body), { status, headers: { "Content-Type": "application/json" } });
+
+const problemResponse = (status: number, detail: string, invalid_params?: unknown): Response =>
+  new Response(
+    JSON.stringify({ title: "Error", status, detail, code: "error", requestId: "req_1", invalid_params }),
+    {
+      status,
+      headers: { "Content-Type": "application/problem+json" },
+    }
+  );
+
+const tag = { id: "cltt1234567890123456789012", name: "Bug report", count: 3 };
+
+describe("getTags", () => {
+  test("returns body.data and passes the workspace as a query parameter", async () => {
+    const fetchMock = vi.fn().mockResolvedValue(jsonResponse({ data: [tag] }));
+    vi.stubGlobal("fetch", fetchMock);
+
+    await expect(getTags({ workspaceId: "ws_1" })).resolves.toEqual([tag]);
+    expect(fetchMock).toHaveBeenCalledWith(
+      "/api/v3/tags?workspaceId=ws_1",
+      expect.objectContaining({ method: "GET", cache: "no-store" })
+    );
+  });
+
+  test("forwards the abort signal, so a superseded list request is cancelled", async () => {
+    const fetchMock = vi.fn().mockResolvedValue(jsonResponse({ data: [] }));
+    vi.stubGlobal("fetch", fetchMock);
+    const signal = new AbortController().signal;
+
+    await getTags({ workspaceId: "ws_1", signal });
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      "/api/v3/tags?workspaceId=ws_1",
+      expect.objectContaining({ signal })
+    );
+  });
+
+  test("encodes a workspace id rather than splicing it into the URL raw", async () => {
+    const fetchMock = vi.fn().mockResolvedValue(jsonResponse({ data: [] }));
+    vi.stubGlobal("fetch", fetchMock);
+
+    await getTags({ workspaceId: "a b&c=d" });
+
+    expect(fetchMock.mock.calls[0][0]).toBe("/api/v3/tags?workspaceId=a+b%26c%3Dd");
+  });
+});
+
+describe("renameTag", () => {
+  test("PATCHes the tag route with the new name as JSON", async () => {
+    const fetchMock = vi.fn().mockResolvedValue(jsonResponse({ data: { ...tag, name: "Renamed" } }));
+    vi.stubGlobal("fetch", fetchMock);
+
+    await expect(renameTag({ tagId: tag.id, name: "Renamed" })).resolves.toMatchObject({ name: "Renamed" });
+    expect(fetchMock).toHaveBeenCalledWith(
+      `/api/v3/tags/${tag.id}`,
+      expect.objectContaining({
+        method: "PATCH",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ name: "Renamed" }),
+      })
+    );
+  });
+
+  test("throws a parsed V3ApiError carrying invalid_params, which is how a duplicate is recognised", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi
+        .fn()
+        .mockResolvedValue(
+          problemResponse(422, "Unable to update tag", [{ name: "name", reason: "tag_name_already_exists" }])
+        )
+    );
+
+    await expect(renameTag({ tagId: tag.id, name: "Taken" })).rejects.toMatchObject({
+      status: 422,
+      invalid_params: [{ name: "name", reason: "tag_name_already_exists" }],
+    });
+  });
+});
+
+describe("deleteTag", () => {
+  test("issues a DELETE and returns the removed id", async () => {
+    const fetchMock = vi.fn().mockResolvedValue(jsonResponse({ data: { id: tag.id } }));
+    vi.stubGlobal("fetch", fetchMock);
+
+    await expect(deleteTag({ tagId: tag.id })).resolves.toEqual({ id: tag.id });
+    expect(fetchMock).toHaveBeenCalledWith(
+      `/api/v3/tags/${tag.id}`,
+      expect.objectContaining({ method: "DELETE" })
+    );
+  });
+
+  test("throws on a forbidden response instead of resolving as if it worked", async () => {
+    vi.stubGlobal("fetch", vi.fn().mockResolvedValue(problemResponse(403, "not yours")));
+
+    await expect(deleteTag({ tagId: tag.id })).rejects.toMatchObject({ status: 403 });
+  });
+});
+
+describe("mergeTags", () => {
+  test("POSTs to the merge sub-route with the target id in the body", async () => {
+    const fetchMock = vi.fn().mockResolvedValue(jsonResponse({ data: { id: "clyy1234567890123456789012" } }));
+    vi.stubGlobal("fetch", fetchMock);
+
+    await mergeTags({ tagId: tag.id, newTagId: "clyy1234567890123456789012" });
+
+    // The source is in the path and the target in the body: the route authorizes on the path id.
+    expect(fetchMock).toHaveBeenCalledWith(
+      `/api/v3/tags/${tag.id}/merge`,
+      expect.objectContaining({
+        method: "POST",
+        body: JSON.stringify({ newTagId: "clyy1234567890123456789012" }),
+      })
+    );
+  });
+});
diff --git a/apps/web/modules/workspaces/settings/tags/lib/api-client.ts b/apps/web/modules/workspaces/settings/tags/lib/api-client.ts
new file mode 100644
index 000000000000..91ec2dadf260
--- /dev/null
+++ b/apps/web/modules/workspaces/settings/tags/lib/api-client.ts
@@ -0,0 +1,45 @@
+import type { TV3Tag } from "@/app/api/v3/tags/serializers";
+import { parseV3ApiError } from "@/modules/api/lib/v3-client";
+
+/**
+ * Client fetchers for the tags v3 routes. Reads forward the TanStack `signal`; every call throws a parsed
+ * `V3ApiError` on a non-2xx response, so the hooks can surface the server's own message.
+ */
+
+const BASE_PATH = "/api/v3/tags";
+
+async function request<T>(url: string, init: RequestInit): Promise<T> {
+  const response = await fetch(url, { cache: "no-store", ...init });
+  if (!response.ok) {
+    throw await parseV3ApiError(response);
+  }
+  return ((await response.json()) as { data: T }).data;
+}
+
+export async function getTags(params: { workspaceId: string; signal?: AbortSignal }): Promise<TV3Tag[]> {
+  const query = new URLSearchParams({ workspaceId: params.workspaceId });
+  return request<TV3Tag[]>(`${BASE_PATH}?${query.toString()}`, {
+    method: "GET",
+    signal: params.signal,
+  });
+}
+
+export async function renameTag(params: { tagId: string; name: string }): Promise<TV3Tag> {
+  return request<TV3Tag>(`${BASE_PATH}/${params.tagId}`, {
+    method: "PATCH",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ name: params.name }),
+  });
+}
+
+export async function deleteTag(params: { tagId: string }): Promise<{ id: string }> {
+  return request<{ id: string }>(`${BASE_PATH}/${params.tagId}`, { method: "DELETE" });
+}
+
+export async function mergeTags(params: { tagId: string; newTagId: string }): Promise<{ id: string }> {
+  return request<{ id: string }>(`${BASE_PATH}/${params.tagId}/merge`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ newTagId: params.newTagId }),
+  });
+}
diff --git a/apps/web/modules/workspaces/settings/tags/lib/errors.test.ts b/apps/web/modules/workspaces/settings/tags/lib/errors.test.ts
new file mode 100644
index 000000000000..2579b8216f97
--- /dev/null
+++ b/apps/web/modules/workspaces/settings/tags/lib/errors.test.ts
@@ -0,0 +1,30 @@
+import { describe, expect, test } from "vitest";
+import { V3ApiError } from "@/modules/api/lib/v3-client";
+import { isDuplicateTagNameError } from "./errors";
+
+const problem = (invalid_params?: { name: string; reason: string }[]) =>
+  new V3ApiError({ status: 422, detail: "Unable to update tag", invalid_params });
+
+describe("isDuplicateTagNameError", () => {
+  test("recognises the duplicate-name code the route reports in invalid_params", () => {
+    expect(isDuplicateTagNameError(problem([{ name: "name", reason: "tag_name_already_exists" }]))).toBe(
+      true
+    );
+  });
+
+  test("does not treat another field-level reason as a duplicate", () => {
+    expect(isDuplicateTagNameError(problem([{ name: "name", reason: "invalid" }]))).toBe(false);
+  });
+
+  test("does not treat a 422 with no invalid_params as a duplicate", () => {
+    expect(isDuplicateTagNameError(problem())).toBe(false);
+  });
+
+  test("ignores errors that are not a V3ApiError at all", () => {
+    // The previous version read a `details.code` property, which `V3ApiError` does not have — so the
+    // duplicate case fell through to the generic toast. A plain object must not satisfy this check.
+    expect(isDuplicateTagNameError({ details: { code: "tag_name_already_exists" } })).toBe(false);
+    expect(isDuplicateTagNameError(new Error("boom"))).toBe(false);
+    expect(isDuplicateTagNameError(undefined)).toBe(false);
+  });
+});
diff --git a/apps/web/modules/workspaces/settings/tags/lib/errors.ts b/apps/web/modules/workspaces/settings/tags/lib/errors.ts
new file mode 100644
index 000000000000..b851231a74bf
--- /dev/null
+++ b/apps/web/modules/workspaces/settings/tags/lib/errors.ts
@@ -0,0 +1,14 @@
+import { V3ApiError } from "@/modules/api/lib/v3-client";
+import { TagError } from "@/modules/workspaces/settings/types/tag";
+
+/**
+ * Whether a rename was refused because another tag already has that name.
+ *
+ * `PATCH /api/v3/tags/{tagId}` reports it as an RFC 9457 `invalid_params` entry whose `reason` carries the
+ * service's error code, and deliberately keeps the top-level `detail` generic. So `invalid_params` is the
+ * only place the duplicate case is distinguishable from any other 422 — matching
+ * `use-workflow-builder.ts`, which reads the same extension for the same reason.
+ */
+export const isDuplicateTagNameError = (error: unknown): boolean =>
+  error instanceof V3ApiError &&
+  (error.invalid_params ?? []).some((param) => param.reason === TagError.TAG_NAME_ALREADY_EXISTS);
diff --git a/apps/web/modules/workspaces/settings/tags/lib/query.test.ts b/apps/web/modules/workspaces/settings/tags/lib/query.test.ts
new file mode 100644
index 000000000000..0e0d16828f75
--- /dev/null
+++ b/apps/web/modules/workspaces/settings/tags/lib/query.test.ts
@@ -0,0 +1,18 @@
+import { describe, expect, test } from "vitest";
+import { tagKeys } from "./query";
+
+describe("tagKeys", () => {
+  test("scopes the list key to one workspace", () => {
+    expect(tagKeys.list("ws_1")).toEqual(["workspace-tags", "list", "ws_1"]);
+  });
+
+  test("the list key starts with the shared base, so `all` invalidates every list", () => {
+    // The mutation hooks invalidate `list(workspaceId)`. If that tuple ever stops being prefixed by
+    // `all`, a broad invalidation silently stops reaching it and the table goes stale after a write.
+    expect(tagKeys.list("ws_1").slice(0, tagKeys.all.length)).toEqual([...tagKeys.all]);
+  });
+
+  test("different workspaces get different keys, so one workspace's tags never serve another's", () => {
+    expect(tagKeys.list("ws_1")).not.toEqual(tagKeys.list("ws_2"));
+  });
+});
diff --git a/apps/web/modules/workspaces/settings/tags/lib/query.ts b/apps/web/modules/workspaces/settings/tags/lib/query.ts
new file mode 100644
index 000000000000..0ff5a90cfff9
--- /dev/null
+++ b/apps/web/modules/workspaces/settings/tags/lib/query.ts
@@ -0,0 +1,7 @@
+/** Typed query-key factory. Never inline string keys — the mutation hooks invalidate these exact tuples. */
+const tagCacheKeyBase = ["workspace-tags"] as const;
+
+export const tagKeys = {
+  all: tagCacheKeyBase,
+  list: (workspaceId: string) => [...tagCacheKeyBase, "list", workspaceId] as const,
+};
diff --git a/apps/web/modules/workspaces/settings/tags/loading.tsx b/apps/web/modules/workspaces/settings/tags/loading.tsx
index 9f32eef74f0d..fc7ba72efc90 100644
--- a/apps/web/modules/workspaces/settings/tags/loading.tsx
+++ b/apps/web/modules/workspaces/settings/tags/loading.tsx
@@ -4,6 +4,8 @@ import { useTranslation } from "react-i18next";
 import { SettingsCard } from "@/app/(app)/workspaces/[workspaceId]/settings/components/SettingsCard";
 import { PageContentWrapper } from "@/modules/ui/components/page-content-wrapper";
 import { PageHeader } from "@/modules/ui/components/page-header";
+import { SettingsTableSkeleton } from "@/modules/ui/components/settings-table";
+import { getTagColumns } from "@/modules/workspaces/settings/tags/components/edit-tags-wrapper";
 
 export const TagsLoading = () => {
   const { t } = useTranslation();
@@ -12,29 +14,21 @@ export const TagsLoading = () => {
       <PageHeader pageTitle={t("common.tags")} />
       <SettingsCard
         title={t("workspace.tags.manage_tags")}
-        description={t("workspace.tags.manage_tags_description")}>
-        <div className="w-full">
-          <div className="grid grid-cols-4 content-center rounded-lg bg-white text-left text-sm font-semibold text-slate-900">
-            <div className="col-span-2">{t("workspace.tags.tag")}</div>
-            <div className="col-span-1 text-center">{t("workspace.tags.count")}</div>
-            <div className="col-span-1 flex justify-center text-center">{t("common.actions")}</div>
-          </div>
-          <div className="w-full">
-            {[...Array(3)].map((_, idx) => (
-              <div key={`tag-skeleton-${idx}`} className="grid h-16 w-full grid-cols-4 content-center">
-                <div className="col-span-2 h-10 animate-pulse rounded-md bg-slate-200" />
+        description={t("workspace.tags.manage_tags_description")}
+        bodyVariant="flush">
+        {/*
+          Columns come from the table's own factory, so the skeleton cannot drift from the header the way
+          the hand-rolled one had.
 
-                <div className="flex items-center justify-center">
-                  <div className="size-5 animate-pulse rounded-md bg-slate-200" />
-                </div>
-                <div className="flex items-center gap-2">
-                  <div className="h-8 w-1/2 animate-pulse rounded-md bg-slate-200" />
-                  <div className="h-8 w-1/2 animate-pulse rounded-md bg-slate-200" />
-                </div>
-              </div>
-            ))}
-          </div>
-        </div>
+          `isReadOnly: false` is a genuine limitation rather than a choice: a route `loading.tsx` receives
+          no props and has no auth context, so it cannot know whether the actions column will be there. It
+          renders the editor's three columns, which is the common case. The widths do not rely on summing
+          to exactly 100% — `table-auto` rescales the rest when a column is absent.
+
+          `workspaceId` and `tags` are never read: the skeleton renders headers and placeholder bars, and
+          never calls `cell`.
+        */}
+        <SettingsTableSkeleton columns={getTagColumns({ t, workspaceId: "", tags: [], isReadOnly: false })} />
       </SettingsCard>
     </PageContentWrapper>
   );
diff --git a/apps/web/modules/workspaces/settings/tags/page.tsx b/apps/web/modules/workspaces/settings/tags/page.tsx
index f51a550f3d8d..3b57a1500619 100644
--- a/apps/web/modules/workspaces/settings/tags/page.tsx
+++ b/apps/web/modules/workspaces/settings/tags/page.tsx
@@ -1,6 +1,4 @@
 import { SettingsCard } from "@/app/(app)/workspaces/[workspaceId]/settings/components/SettingsCard";
-import { getTagsByWorkspaceId } from "@/lib/tag/service";
-import { getTagsOnResponsesCount } from "@/lib/tagOnResponse/service";
 import { getTranslate } from "@/lingodotdev/server";
 import { PageContentWrapper } from "@/modules/ui/components/page-content-wrapper";
 import { PageHeader } from "@/modules/ui/components/page-header";
@@ -11,24 +9,18 @@ export const TagsPage = async (props: { params: Promise<{ workspaceId: string }>
   const params = await props.params;
   const t = await getTranslate();
 
+  // The tags themselves are fetched client-side through `/api/v3/tags`, so this page only resolves the
+  // permission that decides whether the actions column renders.
   const { isReadOnly } = await getWorkspaceAuth(params.workspaceId);
 
-  const [tags, environmentTagsCount] = await Promise.all([
-    getTagsByWorkspaceId(params.workspaceId),
-    getTagsOnResponsesCount(params.workspaceId),
-  ]);
-
   return (
     <PageContentWrapper>
       <PageHeader pageTitle={t("common.tags")} />
       <SettingsCard
         title={t("workspace.tags.manage_tags")}
-        description={t("workspace.tags.manage_tags_description")}>
-        <EditTagsWrapper
-          environmentTags={tags}
-          environmentTagsCount={environmentTagsCount}
-          isReadOnly={isReadOnly}
-        />
+        description={t("workspace.tags.manage_tags_description")}
+        bodyVariant="flush">
+        <EditTagsWrapper workspaceId={params.workspaceId} isReadOnly={isReadOnly} />
       </SettingsCard>
     </PageContentWrapper>
   );
diff --git a/apps/web/playwright/api/management/legacy-environment-id.spec.ts b/apps/web/playwright/api/management/legacy-environment-id.spec.ts
new file mode 100644
index 000000000000..479f33eefc89
--- /dev/null
+++ b/apps/web/playwright/api/management/legacy-environment-id.spec.ts
@@ -0,0 +1,131 @@
+import { expect } from "@playwright/test";
+import { logger } from "@formbricks/logger";
+import { test } from "../../lib/fixtures";
+import { loginAndGetApiKey } from "../../lib/utils";
+import { SURVEYS_API_URL } from "../constants";
+
+const V1_WEBHOOKS_API_URL = "/api/v1/webhooks";
+
+// ENG-2270: integrations built against API v1 (Zapier, Make, n8n) read `environmentId` off the
+// surveys they list and post it back when subscribing a webhook. This walks that exact path so the
+// legacy field can't silently disappear from v1 again.
+test.describe("API v1 legacy environmentId", () => {
+  test("Zapier-style webhook subscription round-trips environmentId from the survey list", async ({
+    page,
+    users,
+    request,
+  }) => {
+    let workspaceId: string;
+    let apiKey: string;
+
+    try {
+      ({ workspaceId, apiKey } = await loginAndGetApiKey(page, users));
+    } catch (error) {
+      logger.error(error, "Error during login and getting API key");
+      throw error;
+    }
+
+    let surveyId: string;
+
+    await test.step("Create Survey via API", async () => {
+      const response = await request.post(SURVEYS_API_URL, {
+        headers: {
+          "Content-Type": "application/json",
+          "x-api-key": apiKey,
+        },
+        data: {
+          workspaceId,
+          type: "link",
+          name: "Survey for legacy environmentId",
+          questions: [
+            {
+              id: "jpvm9b73u06xdrhzi11k2h76",
+              type: "openText",
+              headline: { default: "What would you like to know?" },
+              required: true,
+              inputType: "text",
+            },
+          ],
+        },
+      });
+
+      expect(response.ok()).toBe(true);
+      const responseBody = await response.json();
+      surveyId = responseBody.data.id;
+      expect(responseBody.data.environmentId).toBeTruthy();
+    });
+
+    let environmentId: string;
+
+    await test.step("Survey list exposes environmentId alongside workspaceId", async () => {
+      const response = await request.get(SURVEYS_API_URL, {
+        headers: { "x-api-key": apiKey },
+      });
+
+      expect(response.ok()).toBe(true);
+      const responseBody = await response.json();
+      const survey = responseBody.data.find((item: { id: string }) => item.id === surveyId);
+
+      expect(survey).toBeTruthy();
+      expect(survey.workspaceId).toBe(workspaceId);
+      expect(typeof survey.environmentId).toBe("string");
+      expect(survey.environmentId).not.toBe("undefined");
+
+      environmentId = survey.environmentId;
+    });
+
+    let createdWebhookId: string;
+
+    await test.step("Create webhook with environmentId only", async () => {
+      const response = await request.post(V1_WEBHOOKS_API_URL, {
+        headers: {
+          "Content-Type": "application/json",
+          "x-api-key": apiKey,
+        },
+        data: {
+          environmentId,
+          name: "Zapier Response Finished",
+          url: "https://example.com/zapier-webhook",
+          source: "zapier",
+          triggers: ["responseFinished"],
+          surveyIds: [surveyId],
+        },
+      });
+
+      expect(response.ok()).toBe(true);
+      const responseBody = await response.json();
+      expect(responseBody.data.workspaceId).toBe(workspaceId);
+      expect(responseBody.data.environmentId).toBe(environmentId);
+      createdWebhookId = responseBody.data.id;
+    });
+
+    await test.step("Webhook list and detail expose environmentId", async () => {
+      const listResponse = await request.get(V1_WEBHOOKS_API_URL, {
+        headers: { "x-api-key": apiKey },
+      });
+
+      expect(listResponse.ok()).toBe(true);
+      const listBody = await listResponse.json();
+      const webhook = listBody.data.find((item: { id: string }) => item.id === createdWebhookId);
+      expect(webhook.environmentId).toBe(environmentId);
+
+      const detailResponse = await request.get(`${V1_WEBHOOKS_API_URL}/${createdWebhookId}`, {
+        headers: { "x-api-key": apiKey },
+      });
+
+      expect(detailResponse.ok()).toBe(true);
+      const detailBody = await detailResponse.json();
+      expect(detailBody.data.environmentId).toBe(environmentId);
+    });
+
+    await test.step("Delete webhook via API", async () => {
+      const response = await request.delete(`${V1_WEBHOOKS_API_URL}/${createdWebhookId}`, {
+        headers: { "x-api-key": apiKey },
+      });
+
+      expect(response.ok()).toBe(true);
+      const responseBody = await response.json();
+      expect(responseBody.data.environmentId).toBe(environmentId);
+    });
+  });
+});
diff --git a/apps/web/playwright/settings-tags.spec.ts b/apps/web/playwright/settings-tags.spec.ts
new file mode 100644
index 000000000000..22aecdd2bf07
--- /dev/null
+++ b/apps/web/playwright/settings-tags.spec.ts
@@ -0,0 +1,153 @@
+import { expect } from "@playwright/test";
+import { prisma } from "@formbricks/database";
+import { test } from "./lib/fixtures";
+
+/**
+ * Covers the tags settings table end to end after its move onto `/api/v3/tags` + TanStack Query: the list
+ * now arrives from the API rather than server props, and rename/merge/delete invalidate the query instead
+ * of calling `router.refresh()`. Each assertion below is a thing that silently breaks if the query key,
+ * the invalidation, or the route's authorization scope is wrong.
+ *
+ * The first test walks one table through one journey — list, rename, merge, delete — because every phase
+ * needs the same three seeded tags and the same signed-in user, and each phase's *starting* state is the
+ * previous phase's result. Splitting it would repeat a full `users.create` (organization, workspace,
+ * attribute keys, seed survey) plus a login four more times for no extra coverage. The phases are
+ * `test.step`s so a failure names the phase it happened in rather than just a line number.
+ */
+
+// Unique per run *and* per worker: two workers starting in the same millisecond would otherwise collide on
+// the user email, and `Tag` is unique on `[workspaceId, name]`.
+const stamp = () => `${Date.now()}-${Math.round(Math.random() * 1e6)}`;
+
+test.describe("Workspace tags settings @slow", () => {
+  test("lists tags from the API, renames, merges and deletes without a page reload", async ({
+    page,
+    users,
+  }) => {
+    const run = stamp();
+    const user = await users.create({
+      email: `tags-${run}@example.com`,
+      name: `tags-${run}`,
+      workspaceName: `Tags Workspace ${run}`,
+    });
+    const { workspaceId } = user;
+    if (!workspaceId) {
+      throw new Error("Workspace not seeded for the test user");
+    }
+
+    const keep = await prisma.tag.create({ data: { workspaceId, name: `Keep ${run}` } });
+    const mergeAway = await prisma.tag.create({ data: { workspaceId, name: `Merge ${run}` } });
+    const doomed = await prisma.tag.create({ data: { workspaceId, name: `Doomed ${run}` } });
+
+    await user.login();
+    await page.waitForURL(/\/workspaces\/[^/]+\/surveys/);
+    await page.goto(`/workspaces/${workspaceId}/settings/workspace/tags`, {
+      waitUntil: "domcontentloaded",
+    });
+
+    // Rows are addressed by the id the API returned, and names are read with `toHaveValue`, which reads
+    // the live value. An `input[value="…"]` selector would match the *attribute* instead — `fill()` never
+    // updates that, so such a locator passes before a rename and fails after one for the wrong reason.
+    const rowFor = (tagId: string) => page.getByTestId(`tag-row-${tagId}`);
+    const nameFieldFor = (tagId: string) => rowFor(tagId).getByRole("textbox", { name: "Tag" });
+    const renamed = `Renamed ${run}`;
+
+    await test.step("the table renders the workspace's tags from the API", async () => {
+      // Seeing all three proves GET /api/v3/tags resolved and its response populated the table. It also
+      // proves the route has a QueryClientProvider: without one `useTags` throws and the page renders the
+      // error boundary instead, with no rows at all.
+      for (const tag of [keep, mergeAway, doomed]) {
+        await expect(nameFieldFor(tag.id)).toHaveValue(tag.name, { timeout: 15000 });
+      }
+    });
+
+    const renames: string[] = [];
+    page.on("request", (request) => {
+      if (request.method() === "PATCH" && request.url().includes("/api/v3/tags/")) {
+        renames.push(request.url());
+      }
+    });
+
+    await test.step("a blur with no edit writes nothing, and a real rename writes once", async () => {
+      // Counted rather than timed: the no-op blur is followed immediately by one real rename of the same
+      // row, so a stray request makes the count 2.
+      await nameFieldFor(keep.id).click();
+      await nameFieldFor(keep.id).blur();
+
+      await nameFieldFor(keep.id).fill(renamed);
+      await nameFieldFor(keep.id).blur();
+      await expect(page.locator(".formbricks__toast__success")).toBeVisible({ timeout: 15000 });
+      await expect(nameFieldFor(keep.id)).toHaveValue(renamed);
+      expect(await prisma.tag.findUnique({ where: { id: keep.id } })).toMatchObject({ name: renamed });
+      expect(renames).toHaveLength(1);
+    });
+
+    await test.step("renaming onto a name already in use is rejected by its own message", async () => {
+      // Asserting the *specific* copy matters: the route reports the duplicate as an `invalid_params`
+      // reason, and reading the wrong property there still produces an error toast — just the generic one.
+      // Matching only `.formbricks__toast__error` passed while that branch was broken.
+      await nameFieldFor(doomed.id).fill(renamed);
+      await nameFieldFor(doomed.id).blur();
+      await expect(page.locator(".formbricks__toast__error")).toContainText("Tag already exists", {
+        timeout: 15000,
+      });
+      expect(await prisma.tag.findUnique({ where: { id: doomed.id } })).toMatchObject({
+        name: doomed.name,
+      });
+    });
+
+    await test.step("merging removes the source row with no reload", async () => {
+      await rowFor(mergeAway.id).getByRole("button", { name: "Merge" }).click();
+      await page.getByRole("option", { name: renamed }).click();
+      await expect(rowFor(mergeAway.id)).toHaveCount(0, { timeout: 15000 });
+      expect(await prisma.tag.findUnique({ where: { id: mergeAway.id } })).toBeNull();
+    });
+
+    await test.step("deleting removes the row with no reload", async () => {
+      // Scoped to the dialog because the row's own trigger carries the same accessible name.
+      await rowFor(doomed.id).getByRole("button", { name: "Delete" }).click();
+      await page.getByRole("dialog").getByRole("button", { name: "Delete", exact: true }).click();
+      await expect(rowFor(doomed.id)).toHaveCount(0, { timeout: 15000 });
+      expect(await prisma.tag.findUnique({ where: { id: doomed.id } })).toBeNull();
+    });
+
+    // The surviving tag is untouched by either removal.
+    await expect(nameFieldFor(keep.id)).toHaveValue(renamed);
+  });
+
+  test("rejects a tag mutation from a workspace the caller cannot write to", async ({ page, users }) => {
+    const run = stamp();
+    const owner = await users.create({
+      email: `tags-owner-${run}@example.com`,
+      name: `tags-owner-${run}`,
+      workspaceName: `Owner Workspace ${run}`,
+    });
+    const outsider = await users.create({
+      email: `tags-outsider-${run}@example.com`,
+      name: `tags-outsider-${run}`,
+      workspaceName: `Outsider Workspace ${run}`,
+    });
+
+    const ownerWorkspaceId = owner.workspaceId;
+    if (!ownerWorkspaceId) {
+      throw new Error("Workspace not seeded for the owner");
+    }
+    const foreignTag = await prisma.tag.create({
+      data: { workspaceId: ownerWorkspaceId, name: `Foreign ${run}` },
+    });
+
+    // The route resolves the workspace from the tag itself, so holding a valid tag id is not enough. A 404
+    // here instead of a 403 would leak that the tag exists to anyone who can guess an id.
+    await page.context().clearCookies();
+    await outsider.login();
+    await page.waitForURL(/\/workspaces\/[^/]+\/surveys/);
+
+    const response = await page.request.patch(`/api/v3/tags/${foreignTag.id}`, {
+      data: { name: `Hijacked ${run}` },
+    });
+    expect(response.status()).toBe(403);
+    expect(await prisma.tag.findUnique({ where: { id: foreignTag.id } })).toMatchObject({
+      name: foreignTag.name,
+    });
+  });
+});
diff --git a/apps/web/playwright/survey-accessibility.spec.ts b/apps/web/playwright/survey-accessibility.spec.ts
index edf46ff4aea2..1bd9c14c2fd5 100644
--- a/apps/web/playwright/survey-accessibility.spec.ts
+++ b/apps/web/playwright/survey-accessibility.spec.ts
@@ -3,8 +3,12 @@ import { type Locator, type Page, expect } from "@playwright/test";
 import { logger } from "@formbricks/logger";
 import { test } from "./lib/fixtures";
 import {
+  A11Y_SURVEY_NAME,
   ENDING_CARD_HEADLINE,
+  OPEN_TEXT_HEADLINE,
+  SINGLE_SELECT_HEADLINE,
   type SeededAccessibilitySurveys,
+  WELCOME_CARD_HEADLINE,
   seedAccessibilitySurveys,
 } from "./utils/accessibility";
 import { mockStorageUploads } from "./utils/helper";
@@ -241,13 +245,13 @@ const getActiveCardId = async (page: Page): Promise<string | null> => {
 
 const advanceButton = (card: Locator): Locator => card.locator(ADVANCE_BUTTON_SELECTOR);
 
-// The ending card renders its (fixture-controlled) headline as the page's <h1>; that
-// is a stable positive signal that the survey completed (unlike "no nav button",
-// which is also briefly true during the 600ms card transition animation). The welcome
-// card also renders an <h1>, so the ending is matched by its exact headline text —
-// endings are not language-patched, so this holds in the RTL variant too.
+// The ending card renders its (fixture-controlled) headline as an <h2>; that is a stable
+// positive signal that the survey completed (unlike "no nav button", which is also briefly
+// true during the 600ms card transition animation). Every card headline is an h2 — the survey
+// name is the page's only h1 (ENG-2336) — so the ending is matched by its exact headline text.
+// Endings are not language-patched, so this holds in the RTL variant too.
 const endingCardLocator = (page: Page): Locator =>
-  page.getByRole("heading", { level: 1, name: ENDING_CARD_HEADLINE });
+  page.getByRole("heading", { level: 2, name: ENDING_CARD_HEADLINE });
 
 const isOnEndingCard = (page: Page): Promise<boolean> =>
   endingCardLocator(page)
@@ -282,6 +286,32 @@ const waitForSettled = async (page: Page, selector: string): Promise<void> => {
 const waitForCardSettled = (page: Page, cardId: string): Promise<void> =>
   waitForSettled(page, `[id="${cardId}"]`);
 
+/**
+ * Locator-based twin of `waitForSettled`, for elements that cannot be named by a stable CSS
+ * selector. The ending card is matched by role + heading text because peeking cards carry
+ * identical markup, so `document.querySelector` would settle on the wrong one.
+ */
+const waitForLocatorSettled = async (locator: Locator): Promise<void> => {
+  await expect
+    .poll(
+      () =>
+        locator
+          .evaluate((node: HTMLElement) => {
+            let el: HTMLElement | null = node;
+            while (el) {
+              if (getComputedStyle(el).opacity !== "1") return false;
+              el = el.parentElement;
+            }
+            return true;
+          })
+          .catch(() => false),
+      { timeout: 5000, intervals: [100] }
+    )
+    .toBe(true)
+    // Mirrors waitForSettled: a timeout is not an error here, the caller's assertions decide.
+    .catch(() => undefined);
+};
+
 /**
  * After clicking advance, wait for a STABLE next state: either a different active card
  * id confirmed on two consecutive polls (so we don't latch onto the mid-animation gap
@@ -425,7 +455,7 @@ const walkAndScan = async (
     endingCardLocator(page).first(),
     `ending card should be visible for variant "${variant}"`
   ).toBeVisible({ timeout: CARD_TIMEOUT });
-  await waitForSettled(page, "#fbjs h1");
+  await waitForLocatorSettled(endingCardLocator(page).first());
   await scan(page, variant, "ending-card", failSink);
 };
 
@@ -577,6 +607,63 @@ test.describe("Survey accessibility (axe-core) @slow", () => {
     });
   });
 
+  /**
+   * Heading structure (ENG-2336, WCAG 2.4.6). axe cannot gate this: `page-has-heading-one` and
+   * `heading-order` are best-practice rules, so they only WARN in this suite. The three things
+   * that can silently regress are asserted directly — the single h1, the absence of a skipped
+   * level, and the two associations the heading wrapper had to preserve (`htmlFor` on the nested
+   * label, and `headlineId` still naming the radiogroup through aria-labelledby).
+   */
+  test("heading structure: one h1 names the survey, card headlines are h2", async ({ page }) => {
+    test.setTimeout(120_000);
+    const widget = page.locator("#fbjs");
+
+    await page.goto(seeded.surveyUrl, { waitUntil: "domcontentloaded" });
+    await expect(activeCard(page).first(), "welcome card should render").toBeVisible({
+      timeout: CARD_TIMEOUT,
+    });
+
+    // One h1 for the whole survey, carrying the survey name. Without it every card headline is an
+    // orphaned h2 and heading navigation gives the respondent no idea what they are answering.
+    await expect(widget.getByRole("heading", { level: 1 })).toHaveCount(1);
+    await expect(widget.getByRole("heading", { level: 1 })).toHaveText(A11Y_SURVEY_NAME);
+
+    // Nothing deeper than h2 anywhere, so h1 -> h2 cannot become a skipped level.
+    await expect(widget.locator("h3, h4, h5, h6")).toHaveCount(0);
+
+    await expect(
+      page.getByRole("heading", { level: 2, name: WELCOME_CARD_HEADLINE }),
+      "welcome card headline should be an h2, not a styled div"
+    ).toBeVisible();
+
+    const firstCardId = await openFirstQuestionCard(page, seeded.surveyUrl);
+    const firstCard = page.locator(`[id="${firstCardId}"]`);
+
+    // Still exactly one h1 on a question card: the heading lives on the container, so the stacked
+    // layout's peeking cards must not each contribute their own.
+    await expect(widget.getByRole("heading", { level: 1 })).toHaveCount(1);
+
+    // The open-text prompt is an h2 that WRAPS the <label> bound to the input. If a future refactor
+    // turns the label itself into the heading, the input loses its accessible name — hence both
+    // halves are asserted: the heading contains a real label[for], and the input resolves by label.
+    const promptHeading = firstCard.getByRole("heading", { level: 2, name: OPEN_TEXT_HEADLINE });
+    await expect(promptHeading).toBeVisible();
+    await expect(promptHeading.locator("label[for]")).toHaveCount(1);
+    await expect(firstCard.getByLabel(OPEN_TEXT_HEADLINE)).toBeVisible();
+
+    // Advance to the single-select card: its radiogroup is named through aria-labelledby pointing at
+    // the headline id, which now sits on an element nested inside the h2.
+    await answerCurrentCard(page, firstCard);
+    await advanceButton(firstCard).first().click({ timeout: ACTION_TIMEOUT });
+    await waitForCardTransition(page, firstCardId);
+
+    await expect(
+      page.getByRole("radiogroup", { name: SINGLE_SELECT_HEADLINE }),
+      "the radiogroup must still be named by its headline via aria-labelledby"
+    ).toBeVisible({ timeout: CARD_TIMEOUT });
+    await expect(page.getByRole("heading", { level: 2, name: SINGLE_SELECT_HEADLINE })).toBeVisible();
+  });
+
   test("rtl multi-language (Arabic): full walk has no WCAG AA violations", async ({ page }) => {
     test.setTimeout(180_000);
     // Confirm the survey actually renders right-to-left before scanning, so this
diff --git a/apps/web/playwright/utils/accessibility.ts b/apps/web/playwright/utils/accessibility.ts
index 5acd676e5f36..4872de7d6954 100644
--- a/apps/web/playwright/utils/accessibility.ts
+++ b/apps/web/playwright/utils/accessibility.ts
@@ -48,7 +48,7 @@ const buildKitchenSinkQuestions = (baseURL: string) => [
   {
     id: createId(),
     type: "openText",
-    headline: i18nValue("What feedback do you have for us?"),
+    headline: i18nValue(OPEN_TEXT_HEADLINE),
     subheader: i18nValue("Share anything that comes to mind."),
     placeholder: i18nValue("Type your answer here..."),
     required: true,
@@ -58,7 +58,7 @@ const buildKitchenSinkQuestions = (baseURL: string) => [
   {
     id: createId(),
     type: "multipleChoiceSingle",
-    headline: i18nValue("Which plan are you on?"),
+    headline: i18nValue(SINGLE_SELECT_HEADLINE),
     required: true,
     choices: [
       { id: createId(), label: i18nValue("Free") },
@@ -151,17 +151,32 @@ const buildKitchenSinkQuestions = (baseURL: string) => [
   },
 ];
 
+/**
+ * Survey name of the single-language kitchen-sink fixture. The public survey exposes it as its
+ * one top-level `<h1>` (ENG-2336), so the heading-structure spec asserts against it.
+ */
+export const A11Y_SURVEY_NAME = "A11y Kitchen Sink";
+
+/** Welcome-card headline, exposed as an `<h2>` like every other card headline. */
+export const WELCOME_CARD_HEADLINE = "Welcome to our feedback survey";
+
+/** Headline of the first (open text) question — an `<h2>` wrapping a real `<label>`. */
+export const OPEN_TEXT_HEADLINE = "What feedback do you have for us?";
+
+/** Headline of the single-select question, which names its radiogroup via aria-labelledby. */
+export const SINGLE_SELECT_HEADLINE = "Which plan are you on?";
+
 const buildWelcomeCard = () => ({
   enabled: true,
-  headline: i18nValue("Welcome to our feedback survey"),
+  headline: i18nValue(WELCOME_CARD_HEADLINE),
   subheader: i18nValue("It only takes a minute."),
   timeToFinish: true,
   showResponseCount: false,
 });
 
 /**
- * Ending-card headline, exported so the spec can positively detect survey completion
- * via the rendered `<h1>` (the ending card no longer carries a dedicated DOM hook).
+ * Ending-card headline, exported so the spec can positively detect survey completion via the
+ * rendered `<h2>` (the ending card carries no dedicated DOM hook of its own).
  */
 export const ENDING_CARD_HEADLINE = "Thank you!";
 
@@ -313,8 +328,8 @@ export const seedAccessibilitySurveys = async (
   }
 
   const [mainSurveyId, rtlSurveyId] = await Promise.all([
-    createKitchenSinkSurvey(workspaceId, user.id, "A11y Kitchen Sink", baseURL),
-    createKitchenSinkSurvey(workspaceId, user.id, "A11y Kitchen Sink (RTL)", baseURL),
+    createKitchenSinkSurvey(workspaceId, user.id, A11Y_SURVEY_NAME, baseURL),
+    createKitchenSinkSurvey(workspaceId, user.id, `${A11Y_SURVEY_NAME} (RTL)`, baseURL),
   ]);
   await attachArabicLanguage(rtlSurveyId, workspaceId);
 
diff --git a/apps/web/playwright/utils/helper.ts b/apps/web/playwright/utils/helper.ts
index 403cea2abb2e..107133ed5b63 100644
--- a/apps/web/playwright/utils/helper.ts
+++ b/apps/web/playwright/utils/helper.ts
@@ -1,7 +1,7 @@
 import { expect } from "@playwright/test";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
-import { Page } from "playwright";
+import { Locator, Page } from "playwright";
 import { logger } from "@formbricks/logger";
 import { CreateSurveyParams, CreateSurveyWithLogicParams } from "@/playwright/utils/mock";
 
@@ -671,6 +671,18 @@ export const createSurvey = async (page: Page, params: CreateSurveyParams) => {
   await page.getByPlaceholder("Option 5").fill(params.ranking.choices[4]);
 };
 
+/**
+ * A question's collapsed card heading inside the survey editor's element list.
+ *
+ * Scoped to the editor `<main>` on purpose. The editor renders a LIVE PREVIEW of the survey into
+ * the same document (the `<aside>` holding `#survey-preview`, visible from the `md` breakpoint up),
+ * and since ENG-2336 that preview exposes each element prompt as an `<h2>`. An unscoped
+ * `getByRole("heading", { name })` would then match both the accordion heading and the preview's
+ * prompt whenever the previewed card is the one being edited, failing Playwright's strict mode.
+ */
+const editorElementHeading = (page: Page, name: string): Locator =>
+  page.getByRole("main").getByRole("heading", { name });
+
 export const createSurveyWithLogic = async (page: Page, params: CreateSurveyWithLogicParams) => {
   const addBlock = "Add BlockChoose the first question on your Block";
 
@@ -892,7 +904,7 @@ export const createSurveyWithLogic = async (page: Page, params: CreateSurveyWith
 
   // Adding logic to blocks
   // Block 1 (Open Text Question)
-  await page.getByRole("heading", { name: params.openTextQuestion.question }).click();
+  await editorElementHeading(page, params.openTextQuestion.question).click();
   await page.getByText("Show Block settings").first().click();
   await page.getByRole("button", { name: "Add logic" }).first().click();
   await page.locator("#condition-0-0-conditionValue").first().click();
@@ -931,7 +943,7 @@ export const createSurveyWithLogic = async (page: Page, params: CreateSurveyWith
     .click();
 
   // Block 2 (Single Select Question)
-  await page.getByRole("heading", { name: params.singleSelectQuestion.question }).click();
+  await editorElementHeading(page, params.singleSelectQuestion.question).click();
   await page.getByText("Show Block settings").first().click();
   await page.getByRole("button", { name: "Add logic" }).first().click();
   await page.locator("#condition-0-0-conditionValue").first().click();
@@ -969,7 +981,7 @@ export const createSurveyWithLogic = async (page: Page, params: CreateSurveyWith
     .click();
 
   // Block 3 (Multi Select Question)
-  await page.getByRole("heading", { name: params.multiSelectQuestion.question }).click();
+  await editorElementHeading(page, params.multiSelectQuestion.question).click();
   await page.getByText("Show Block settings").first().click();
   await page.getByRole("button", { name: "Add logic" }).first().click();
   await page.locator("#condition-0-0-conditionValue").click();
@@ -1020,7 +1032,7 @@ export const createSurveyWithLogic = async (page: Page, params: CreateSurveyWith
     .click();
 
   // Block 4 (Picture Select Question)
-  await page.getByRole("heading", { name: params.pictureSelectQuestion.question }).click();
+  await editorElementHeading(page, params.pictureSelectQuestion.question).click();
   await page.getByText("Show Block settings").first().click();
   await page.getByRole("button", { name: "Add logic" }).first().click();
   await page.locator("#condition-0-0-conditionValue").click();
@@ -1053,7 +1065,7 @@ export const createSurveyWithLogic = async (page: Page, params: CreateSurveyWith
     .click();
 
   // Block 5 (Rating Question)
-  await page.getByRole("heading", { name: params.ratingQuestion.question }).click();
+  await editorElementHeading(page, params.ratingQuestion.question).click();
   await page.getByText("Show Block settings").first().click();
   await page.getByRole("button", { name: "Add logic" }).first().click();
   await page.locator("#condition-0-0-conditionValue").click();
@@ -1088,7 +1100,7 @@ export const createSurveyWithLogic = async (page: Page, params: CreateSurveyWith
     .click();
 
   // Block 6 (NPS Question)
-  await page.getByRole("heading", { name: params.npsQuestion.question }).click();
+  await editorElementHeading(page, params.npsQuestion.question).click();
   await page.getByText("Show Block settings").first().click();
   await page.getByRole("button", { name: "Add logic" }).first().click();
   await page.locator("#condition-0-0-conditionValue").click();
@@ -1162,7 +1174,7 @@ export const createSurveyWithLogic = async (page: Page, params: CreateSurveyWith
     .click();
 
   // Block 7 (Ranking Question)
-  await page.getByRole("heading", { name: params.ranking.question }).click();
+  await editorElementHeading(page, params.ranking.question).click();
   await page.getByText("Show Block settings").first().click();
   await page.getByRole("button", { name: "Add logic" }).first().click();
   await page.locator("#condition-0-0-conditionValue").click();
@@ -1195,7 +1207,7 @@ export const createSurveyWithLogic = async (page: Page, params: CreateSurveyWith
     .click();
 
   // Block 8 (Matrix Question)
-  await page.getByRole("heading", { name: params.matrix.question }).click();
+  await editorElementHeading(page, params.matrix.question).click();
   await page.getByText("Show Block settings").first().click();
   await page.getByRole("button", { name: "Add logic" }).first().click();
   await page.locator("#condition-0-0-conditionValue").first().click();
@@ -1239,7 +1251,7 @@ export const createSurveyWithLogic = async (page: Page, params: CreateSurveyWith
     .click();
 
   // Block 9 (CTA Question)
-  await page.getByRole("heading", { name: params.ctaQuestion.question }).click();
+  await editorElementHeading(page, params.ctaQuestion.question).click();
   await page.getByText("Show Block settings").first().click();
   await page.getByRole("button", { name: "Add logic" }).first().click();
   await page.locator("#condition-0-0-conditionValue").click();
@@ -1278,7 +1290,7 @@ export const createSurveyWithLogic = async (page: Page, params: CreateSurveyWith
     .click();
 
   // Block 10 (Consent Question)
-  await page.getByRole("heading", { name: params.consentQuestion.question }).click();
+  await editorElementHeading(page, params.consentQuestion.question).click();
   await page.getByText("Show Block settings").first().click();
   await page.getByRole("button", { name: "Add logic" }).first().click();
   await page.locator("#action-0-objective").first().click();
@@ -1297,7 +1309,7 @@ export const createSurveyWithLogic = async (page: Page, params: CreateSurveyWith
     .click();
 
   // Block 11 (File Upload Question)
-  await page.getByRole("heading", { name: params.fileUploadQuestion.question }).click();
+  await editorElementHeading(page, params.fileUploadQuestion.question).click();
   await page.getByText("Show Block settings").first().click();
   await page.getByRole("button", { name: "Add logic" }).first().click();
   await page.locator("#action-0-objective").first().click();
@@ -1364,7 +1376,7 @@ export const createSurveyWithLogic = async (page: Page, params: CreateSurveyWith
     .click();
 
   // Block 13 (Cal Question)
-  await page.getByRole("heading", { name: params.cal.question }).click();
+  await editorElementHeading(page, params.cal.question).click();
   await page.getByText("Show Block settings").first().click();
   await page.getByRole("button", { name: "Add logic" }).first().click();
   await page.locator("#condition-0-0-conditionValue").click();
@@ -1387,7 +1399,7 @@ export const createSurveyWithLogic = async (page: Page, params: CreateSurveyWith
     .click();
 
   // Block 14 (Address Question)
-  await page.getByRole("heading", { name: params.address.question }).click();
+  await editorElementHeading(page, params.address.question).click();
   await page.getByText("Show Block settings").first().click();
   await page.getByRole("button", { name: "Add logic" }).first().click();
   await page.locator("#action-0-objective").first().click();
diff --git a/docs/api-v3-reference/openapi.yml b/docs/api-v3-reference/openapi.yml
index d437f6a49136..77edef8d2649 100644
--- a/docs/api-v3-reference/openapi.yml
+++ b/docs/api-v3-reference/openapi.yml
@@ -2217,6 +2217,233 @@ paths:
       security:
         - sessionAuth: []
         - apiKeyAuth: []
+  /api/v3/tags:
+    get:
+      operationId: listTagsV3
+      summary: List tags
+      description: |
+        Returns a workspace's response tags, each with the number of responses currently carrying it.
+
+        Session cookie only. Tags are managed from the Formbricks app (Workspace settings → Tags); these
+        endpoints back that screen, so they do not accept `x-api-key`.
+      tags:
+        - V3 Tags
+      parameters:
+        - in: query
+          name: workspaceId
+          required: true
+          schema:
+            type: string
+            format: cuid2
+          description: |
+            Workspace identifier. This is the canonical container ID for v3 APIs.
+      responses:
+        '200':
+          description: Tags retrieved successfully
+          headers:
+            X-Request-Id:
+              schema:
+                type: string
+              description: Request correlation ID
+            Cache-Control:
+              schema:
+                type: string
+              example: private, no-store
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - data
+                properties:
+                  data:
+                    type: array
+                    items:
+                      $ref: '#/components/schemas/TagResource'
+        '400':
+          $ref: '#/components/responses/V3BadRequest'
+        '401':
+          $ref: '#/components/responses/V3Unauthorized'
+        '403':
+          $ref: '#/components/responses/V3Forbidden'
+        '429':
+          $ref: '#/components/responses/V3TooManyRequests'
+        '500':
+          $ref: '#/components/responses/V3InternalServerError'
+      security:
+        - sessionAuth: []
+  /api/v3/tags/{tagId}:
+    patch:
+      operationId: renameTagV3
+      summary: Rename a tag
+      description: |
+        Renames a tag. The workspace is resolved from the tag itself, so the caller cannot choose which scope
+        it is authorized against. Requires organization owner/manager, or a workspace team membership with
+        read-write permission.
+
+        An unknown `tagId` answers `403`, not `404`, so tag ids cannot be probed for existence. A name that
+        collides with another tag in the same workspace answers `422`.
+      tags:
+        - V3 Tags
+      parameters:
+        - in: path
+          name: tagId
+          required: true
+          schema:
+            type: string
+            format: cuid2
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required:
+                - name
+              properties:
+                name:
+                  type: string
+                  minLength: 1
+                  maxLength: 255
+                  description: New label. Trimmed; must not be empty.
+      responses:
+        '200':
+          description: Tag renamed successfully
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - data
+                properties:
+                  data:
+                    $ref: '#/components/schemas/TagResource'
+        '400':
+          $ref: '#/components/responses/V3BadRequest'
+        '401':
+          $ref: '#/components/responses/V3Unauthorized'
+        '403':
+          $ref: '#/components/responses/V3Forbidden'
+        '422':
+          $ref: '#/components/responses/V3UnprocessableContent'
+        '429':
+          $ref: '#/components/responses/V3TooManyRequests'
+        '500':
+          $ref: '#/components/responses/V3InternalServerError'
+      security:
+        - sessionAuth: []
+    delete:
+      operationId: deleteTagV3
+      summary: Delete a tag
+      description: |
+        Deletes a tag and removes it from every response carrying it. Same authorization as rename.
+      tags:
+        - V3 Tags
+      parameters:
+        - in: path
+          name: tagId
+          required: true
+          schema:
+            type: string
+            format: cuid2
+      responses:
+        '200':
+          description: Tag deleted successfully
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - data
+                properties:
+                  data:
+                    type: object
+                    required:
+                      - id
+                    properties:
+                      id:
+                        type: string
+                        format: cuid2
+                        description: The deleted tag's id.
+        '400':
+          $ref: '#/components/responses/V3BadRequest'
+        '401':
+          $ref: '#/components/responses/V3Unauthorized'
+        '403':
+          $ref: '#/components/responses/V3Forbidden'
+        '429':
+          $ref: '#/components/responses/V3TooManyRequests'
+        '500':
+          $ref: '#/components/responses/V3InternalServerError'
+      security:
+        - sessionAuth: []
+  /api/v3/tags/{tagId}/merge:
+    post:
+      operationId: mergeTagsV3
+      summary: Merge a tag into another
+      description: |
+        Moves every response tagged `{tagId}` onto `newTagId`, then deletes `{tagId}`.
+
+        Both tags must belong to the same workspace — a cross-workspace merge answers `403`, since it would
+        move responses across a tenant boundary. Same authorization as rename.
+
+        Merging a tag into itself answers `400`.
+      tags:
+        - V3 Tags
+      parameters:
+        - in: path
+          name: tagId
+          required: true
+          schema:
+            type: string
+            format: cuid2
+          description: The tag being merged away.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required:
+                - newTagId
+              properties:
+                newTagId:
+                  type: string
+                  format: cuid2
+                  description: The surviving tag.
+      responses:
+        '200':
+          description: Tags merged successfully
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - data
+                properties:
+                  data:
+                    type: object
+                    required:
+                      - id
+                    properties:
+                      id:
+                        type: string
+                        format: cuid2
+                        description: The surviving tag's id.
+        '400':
+          $ref: '#/components/responses/V3BadRequest'
+        '401':
+          $ref: '#/components/responses/V3Unauthorized'
+        '403':
+          $ref: '#/components/responses/V3Forbidden'
+        '429':
+          $ref: '#/components/responses/V3TooManyRequests'
+        '500':
+          $ref: '#/components/responses/V3InternalServerError'
+      security:
+        - sessionAuth: []
 components:
   securitySchemes:
     sessionAuth:
@@ -5261,6 +5488,35 @@ components:
             - number
             - date
       additionalProperties: false
+    TagResource:
+      type: object
+      required:
+        - id
+        - name
+        - workspaceId
+        - createdAt
+        - updatedAt
+        - count
+      properties:
+        id:
+          type: string
+          format: cuid2
+        name:
+          type: string
+          description: Tag label as shown in the app. Unique within a workspace.
+        workspaceId:
+          type: string
+          format: cuid2
+        createdAt:
+          type: string
+          format: date-time
+        updatedAt:
+          type: string
+          format: date-time
+        count:
+          type: integer
+          minimum: 0
+          description: Responses currently carrying this tag. `0` when the tag exists but has never been applied.
   responses:
     V3BadRequest:
       description: Bad Request — malformed JSON, invalid query/body/params, duplicate name, or unsupported field.
diff --git a/docs/api-v3-reference/src/components/schemas/TagResource.yml b/docs/api-v3-reference/src/components/schemas/TagResource.yml
new file mode 100644
index 000000000000..0fc87d4dcbd0
--- /dev/null
+++ b/docs/api-v3-reference/src/components/schemas/TagResource.yml
@@ -0,0 +1,29 @@
+type: object
+required:
+  - id
+  - name
+  - workspaceId
+  - createdAt
+  - updatedAt
+  - count
+properties:
+  id:
+    type: string
+    format: cuid2
+  name:
+    type: string
+    description: Tag label as shown in the app. Unique within a workspace.
+  workspaceId:
+    type: string
+    format: cuid2
+  createdAt:
+    type: string
+    format: date-time
+  updatedAt:
+    type: string
+    format: date-time
+  count:
+    type: integer
+    minimum: 0
+    description: >-
+      Responses currently carrying this tag. `0` when the tag exists but has never been applied.
diff --git a/docs/api-v3-reference/src/openapi.yml b/docs/api-v3-reference/src/openapi.yml
index 0a383f0d0fbb..d872caff97df 100644
--- a/docs/api-v3-reference/src/openapi.yml
+++ b/docs/api-v3-reference/src/openapi.yml
@@ -203,6 +203,12 @@ paths:
     $ref: paths/api_v3_action-classes.yml
   /api/v3/contact-attribute-keys:
     $ref: paths/api_v3_contact-attribute-keys.yml
+  /api/v3/tags:
+    $ref: paths/api_v3_tags.yml
+  /api/v3/tags/{tagId}:
+    $ref: paths/api_v3_tags_{tagId}.yml
+  /api/v3/tags/{tagId}/merge:
+    $ref: paths/api_v3_tags_{tagId}_merge.yml
 components:
   securitySchemes:
     sessionAuth:
diff --git a/docs/api-v3-reference/src/paths/api_v3_tags.yml b/docs/api-v3-reference/src/paths/api_v3_tags.yml
new file mode 100644
index 000000000000..5cbfd37f99f8
--- /dev/null
+++ b/docs/api-v3-reference/src/paths/api_v3_tags.yml
@@ -0,0 +1,54 @@
+get:
+  operationId: listTagsV3
+  summary: List tags
+  description: |
+    Returns a workspace's response tags, each with the number of responses currently carrying it.
+
+    Session cookie only. Tags are managed from the Formbricks app (Workspace settings → Tags); these
+    endpoints back that screen, so they do not accept `x-api-key`.
+  tags:
+    - V3 Tags
+  parameters:
+    - in: query
+      name: workspaceId
+      required: true
+      schema:
+        type: string
+        format: cuid2
+      description: |
+        Workspace identifier. This is the canonical container ID for v3 APIs.
+  responses:
+    "200":
+      description: Tags retrieved successfully
+      headers:
+        X-Request-Id:
+          schema:
+            type: string
+          description: Request correlation ID
+        Cache-Control:
+          schema:
+            type: string
+          example: private, no-store
+      content:
+        application/json:
+          schema:
+            type: object
+            required:
+              - data
+            properties:
+              data:
+                type: array
+                items:
+                  $ref: ../components/schemas/TagResource.yml
+    "400":
+      $ref: ../components/responses/V3BadRequest.yml
+    "401":
+      $ref: ../components/responses/V3Unauthorized.yml
+    "403":
+      $ref: ../components/responses/V3Forbidden.yml
+    "429":
+      $ref: ../components/responses/V3TooManyRequests.yml
+    "500":
+      $ref: ../components/responses/V3InternalServerError.yml
+  security:
+    - sessionAuth: []
diff --git a/docs/api-v3-reference/src/paths/api_v3_tags_{tagId}.yml b/docs/api-v3-reference/src/paths/api_v3_tags_{tagId}.yml
new file mode 100644
index 000000000000..6c12d6cc9893
--- /dev/null
+++ b/docs/api-v3-reference/src/paths/api_v3_tags_{tagId}.yml
@@ -0,0 +1,105 @@
+patch:
+  operationId: renameTagV3
+  summary: Rename a tag
+  description: |
+    Renames a tag. The workspace is resolved from the tag itself, so the caller cannot choose which scope
+    it is authorized against. Requires organization owner/manager, or a workspace team membership with
+    read-write permission.
+
+    An unknown `tagId` answers `403`, not `404`, so tag ids cannot be probed for existence. A name that
+    collides with another tag in the same workspace answers `422`.
+  tags:
+    - V3 Tags
+  parameters:
+    - in: path
+      name: tagId
+      required: true
+      schema:
+        type: string
+        format: cuid2
+  requestBody:
+    required: true
+    content:
+      application/json:
+        schema:
+          type: object
+          additionalProperties: false
+          required:
+            - name
+          properties:
+            name:
+              type: string
+              minLength: 1
+              maxLength: 255
+              description: New label. Trimmed; must not be empty.
+  responses:
+    "200":
+      description: Tag renamed successfully
+      content:
+        application/json:
+          schema:
+            type: object
+            required:
+              - data
+            properties:
+              data:
+                $ref: ../components/schemas/TagResource.yml
+    "400":
+      $ref: ../components/responses/V3BadRequest.yml
+    "401":
+      $ref: ../components/responses/V3Unauthorized.yml
+    "403":
+      $ref: ../components/responses/V3Forbidden.yml
+    "422":
+      $ref: ../components/responses/V3UnprocessableContent.yml
+    "429":
+      $ref: ../components/responses/V3TooManyRequests.yml
+    "500":
+      $ref: ../components/responses/V3InternalServerError.yml
+  security:
+    - sessionAuth: []
+delete:
+  operationId: deleteTagV3
+  summary: Delete a tag
+  description: |
+    Deletes a tag and removes it from every response carrying it. Same authorization as rename.
+  tags:
+    - V3 Tags
+  parameters:
+    - in: path
+      name: tagId
+      required: true
+      schema:
+        type: string
+        format: cuid2
+  responses:
+    "200":
+      description: Tag deleted successfully
+      content:
+        application/json:
+          schema:
+            type: object
+            required:
+              - data
+            properties:
+              data:
+                type: object
+                required:
+                  - id
+                properties:
+                  id:
+                    type: string
+                    format: cuid2
+                    description: The deleted tag's id.
+    "400":
+      $ref: ../components/responses/V3BadRequest.yml
+    "401":
+      $ref: ../components/responses/V3Unauthorized.yml
+    "403":
+      $ref: ../components/responses/V3Forbidden.yml
+    "429":
+      $ref: ../components/responses/V3TooManyRequests.yml
+    "500":
+      $ref: ../components/responses/V3InternalServerError.yml
+  security:
+    - sessionAuth: []
diff --git a/docs/api-v3-reference/src/paths/api_v3_tags_{tagId}_merge.yml b/docs/api-v3-reference/src/paths/api_v3_tags_{tagId}_merge.yml
new file mode 100644
index 000000000000..024434d6bf15
--- /dev/null
+++ b/docs/api-v3-reference/src/paths/api_v3_tags_{tagId}_merge.yml
@@ -0,0 +1,65 @@
+post:
+  operationId: mergeTagsV3
+  summary: Merge a tag into another
+  description: |
+    Moves every response tagged `{tagId}` onto `newTagId`, then deletes `{tagId}`.
+
+    Both tags must belong to the same workspace — a cross-workspace merge answers `403`, since it would
+    move responses across a tenant boundary. Same authorization as rename.
+
+    Merging a tag into itself answers `400`.
+  tags:
+    - V3 Tags
+  parameters:
+    - in: path
+      name: tagId
+      required: true
+      schema:
+        type: string
+        format: cuid2
+      description: The tag being merged away.
+  requestBody:
+    required: true
+    content:
+      application/json:
+        schema:
+          type: object
+          additionalProperties: false
+          required:
+            - newTagId
+          properties:
+            newTagId:
+              type: string
+              format: cuid2
+              description: The surviving tag.
+  responses:
+    "200":
+      description: Tags merged successfully
+      content:
+        application/json:
+          schema:
+            type: object
+            required:
+              - data
+            properties:
+              data:
+                type: object
+                required:
+                  - id
+                properties:
+                  id:
+                    type: string
+                    format: cuid2
+                    description: The surviving tag's id.
+    "400":
+      $ref: ../components/responses/V3BadRequest.yml
+    "401":
+      $ref: ../components/responses/V3Unauthorized.yml
+    "403":
+      $ref: ../components/responses/V3Forbidden.yml
+    "429":
+      $ref: ../components/responses/V3TooManyRequests.yml
+    "500":
+      $ref: ../components/responses/V3InternalServerError.yml
+  security:
+    - sessionAuth: []
diff --git a/docs/surveys/link-surveys/single-use-links.mdx b/docs/surveys/link-surveys/single-use-links.mdx
index ffb98d3c0c73..e1de552ad3c5 100644
--- a/docs/surveys/link-surveys/single-use-links.mdx
+++ b/docs/surveys/link-surveys/single-use-links.mdx
@@ -5,35 +5,178 @@ description:
 icon: "link"
 ---
 
-This guide will help you understand how to generate and use single-use links within our application.
+A single-use link is a survey link that accepts exactly one completed response. Instead of sharing
+one URL with everyone, you hand each respondent their own URL. Once that URL has been used to
+finish the survey, it stops working — everyone else's links are unaffected.
 
-## Purpose
+Use them when you invite a known list of people (customers, panelists, employees) and want one
+response per invitation, without asking anyone to log in.
 
-- Single-use links (or one-time / disposable links) are URLs that grant access to a survey only once.
+<Note>
+  **Looking for responses tied to a specific person? Use
+  [Personal Links](/surveys/link-surveys/personal-links) instead.**
+
+  Single-use links are anonymous. Formbricks limits each link to one response but does not know who
+  is behind it, so it is on you to track which link you sent to whom (a custom single-use ID makes
+  that easier).
+
+  Personal links are generated for contacts in a segment. Each response is automatically attributed
+  to that contact, links can be given an expiry date, and the CSV export maps every link to a name
+  and email. Formbricks also blocks a second response from the same contact on its own, so you get
+  the one-response-per-person guarantee whether or not single-use links are switched on.
+</Note>
+
+## How a single-use link works
+
+Every single-use link is your normal survey link plus a **single-use ID** (`suId`), and — depending
+on the mode — a **signature** (`suToken`):
+
+```
+https://app.formbricks.com/s/<surveyId>?suId=<single-use-id>&suToken=<signature>
+```
 
-- The primary purpose of single-use links is to assure that no respondent submits a survey twice.
+When someone opens the link, Formbricks:
+
+<Steps>
+  <Step title="Validates the suId">
+    The `suId` must be one Formbricks issued for this survey. If it is missing, malformed, or
+    tampered with, the respondent sees a *"This survey can only be taken by invitation"* page and
+    cannot answer.
+  </Step>
+  <Step title="Looks for an existing response">
+    Formbricks checks whether a response with this `suId` already exists for the survey.
+  </Step>
+  <Step title="Serves, resumes, or blocks">
+    No response yet → the survey opens. An unfinished response → it resumes where the respondent
+    left off. A finished response → they see *"The survey has already been answered."*
+  </Step>
+</Steps>
 
 <Note>
-  Want to create up to 5,000 single-use links? Use our [API endpoint for
-  that.](https://documenter.getpostman.com/view/11026000/2sA3Bq5XEh#c49ef758-a78a-4ef4-a282-262621151f08)
+  A link is only spent once the response is **finished**. If a respondent drops off halfway, they
+  can reopen the same link and continue — they do not lose their answers and do not need a new
+  link.
 </Note>
 
-## How to use single-use links
+The `suId` is stored on the response, and the database enforces one response per `suId` per survey.
+So even if two people open the same link at the same time, only the first submission is accepted.
+
+## Encrypted vs. custom single-use IDs
+
+Single-use links come in two modes, controlled by the **URL encryption of single-use ID** toggle.
+Both are equally tamper-proof. The difference is who chooses the ID and whether it is readable.
+
+| | **URL encryption on** (default) | **URL encryption off** |
+|---|---|---|
+| What `suId` looks like | An AES-encrypted, URL-encoded blob | Whatever you choose, e.g. `?suId=CUSTOMER-4711` |
+| `suToken` in the URL | Not used | Required. An HMAC signature over the survey ID and `suId` |
+| Who creates the ID | Formbricks (UI or API) | You |
+| Best for | Bulk invites where the ID carries no meaning | Mapping responses back to a record in your own system |
+
+<Warning>
+  Both modes are signed or encrypted with your instance's `ENCRYPTION_KEY`, so respondents cannot
+  forge a valid link by guessing an ID. They *can* forward their own link to someone else, so
+  treat a single-use link as a credential.
+</Warning>
+
+## Create single-use links in the app
+
+<Steps>
+  <Step title="Open the share modal">
+    On the survey summary page, click **Share survey** in the top right corner and go to the
+    **Anonymous links** tab.
+  </Step>
+  <Step title="Turn on Single-use links">
+    Toggle **Single-use links** on and confirm.
 
-Using single-use links with Formbricks is quite straight-forward:
+    ![Single use link survey settings](/images/surveys/link-surveys/single-use-links/single-use-links.webp)
 
-1. On the Summary page, hit "Share survey" in the top right corner to open the sharing modal.
+    <Warning>
+      Single-use and multi-use links are mutually exclusive. Enabling single-use links disables the
+      multi-use link, which also disables anything built on it: website and email embeds, social
+      media shares, and QR codes.
+    </Warning>
+  </Step>
+  <Step title="Generate a batch of links">
+    URL encryption is on by default. Enter how many links you need (1–5,000) and click
+    **Generate & download links**. You get a CSV with one link per row.
+  </Step>
+  <Step title="Or set your own single-use ID">
+    Turn **URL encryption of single-use ID** off, type your own ID (e.g. an invoice or customer
+    number), and click **Copy** to get the signed link for it.
+  </Step>
+</Steps>
 
-2. Toggle "Single Use Link" on in the Anonymous Links tab:
+<Warning>
+  Formbricks does not store the generated links. Save the CSV — links cannot be re-downloaded, and
+  regenerating creates a different set of IDs.
+</Warning>
 
-   ![Single use link survey settings](/images/surveys/link-surveys/single-use-links/single-use-links.webp)
+## Generate links via the API
 
-3. If you'd like to use URL encryption, toggle "URL Encryption" on. You can then customize the number of links you'd like to generate and download as CSV.
+To generate links programmatically — or more than the UI batch limit in one workflow — use the
+Management API:
 
-4. If you'd like to set a custom single-use ID, deactivate the "Enable URL Encryption" toggle. You can then customize the single-use ID in the URL or programmatically.
+```bash
+curl -X GET \
+  'https://app.formbricks.com/api/v1/management/surveys/<surveyId>/singleUseIds?limit=100' \
+  -H 'x-api-key: <your-api-key>'
+```
 
-## Check suId of a submission
+```json
+{
+  "data": [
+    "https://app.formbricks.com/s/clzqym2l3...?suId=ohkj3qx6d0wdo9r3nfpm3bgj&suToken=9f2b...",
+    "https://app.formbricks.com/s/clzqym2l3...?suId=ci6la2lzj63pvsp6x3eqbhff&suToken=41ce..."
+  ]
+}
+```
+
+The sample above is from a survey with URL encryption off, so each link carries a readable `suId`
+plus its `suToken`. With encryption on, the `suId` is an encrypted blob and there is no `suToken`.
+
+- `limit` defaults to `10` and accepts up to `5000` per call.
+- The survey must be a link survey with single-use links enabled, otherwise the endpoint returns a
+  400.
+- The API key needs **write** access to the survey's workspace. Even though this is a `GET`, it
+  mints links that can be used to submit responses, so read-only keys are rejected.
+- Links follow the survey's encryption setting. With encryption off, each returned URL also carries
+  its `suToken`.
+
+See the [API reference](/api-reference/management-api--survey/get-singleuse-links) for the full
+endpoint definition.
+
+## Find the single-use ID of a response
+
+Each response records the `suId` it came from. In the responses table it appears as its own column,
+and in the single response card you'll see it in the metadata when hovering over the avatar:
+
+![Single use link survey metadata](/images/surveys/link-surveys/single-use-links/suid-metadata.webp)
+
+Responses fetched via the API expose the same value as the `singleUseId` field, which is how you
+match a response back to the person you sent that link to.
+
+## Submitting responses programmatically
+
+If you build your own survey frontend and post responses to the client API, a single-use survey
+requires two things in the request:
+
+- `singleUseId` in the request body
+- `meta.url` set to the full link the respondent opened, including its `suId` and `suToken`
+
+Formbricks re-validates the URL and rejects the response if the two do not match.
+
+<Note>
+  With URL encryption on, the `suId` in the URL is encrypted while the API expects the decrypted
+  ID, which your backend cannot derive. For programmatic submission, turn URL encryption off and
+  use custom single-use IDs.
+</Note>
 
-You can find the suId of each submission in the submission meta data. You'll find it both in the table as well as in the meta data when hovering over the Avatar:
+## Good to know
 
-   ![Single use link survey metadata](/images/surveys/link-surveys/single-use-links/suid-metadata.webp)
\ No newline at end of file
+- **Self-hosting**: single-use links require `ENCRYPTION_KEY` to be set. Rotating that key
+  invalidates every single-use link that was already handed out.
+- **Since Formbricks 5.0**, unencrypted single-use links must carry a valid `suToken`. Links
+  generated before 5.0 without a token are rejected — regenerate them.
+- The *"already answered"* screen can be customized via the `singleUse.heading` and
+  `singleUse.subheading` fields on the survey in the Management API.
diff --git a/packages/survey-ui/src/components/general/element-header.tsx b/packages/survey-ui/src/components/general/element-header.tsx
index f6f706f0f30d..94dd5aa28d5d 100644
--- a/packages/survey-ui/src/components/general/element-header.tsx
+++ b/packages/survey-ui/src/components/general/element-header.tsx
@@ -21,6 +21,12 @@ interface ElementHeaderProps extends React.ComponentProps<"div"> {
    * (media, etc.) inside a <legend> (invalid HTML).
    */
   headlineId?: string;
+  /**
+   * Heading level the element prompt is exposed at (WCAG 2.4.6). Defaults to 2: the survey name
+   * is the page's only h1, so every card prompt sits one level under it. A block that renders
+   * several elements gets sibling headings at the same level, never a nested run.
+   */
+  headingLevel?: 2 | 3;
 }
 
 function ElementHeader({
@@ -35,9 +41,16 @@ function ElementHeader({
   videoUrl,
   imageAltText,
   headlineId,
+  headingLevel = 2,
   ...props
 }: Readonly<ElementHeaderProps>): React.JSX.Element {
   const isMediaAvailable = Boolean(imageUrl) || Boolean(videoUrl);
+  // The heading WRAPS the Label rather than replacing it: the six call sites that pass `htmlFor`
+  // need the prompt to stay a real <label> bound to their input, the grouped questions need
+  // `headlineId` to stay on the element whose text names the fieldset via aria-labelledby, and
+  // user theming targets the `label-headline` class (styles.ts `addCustomThemeToDom`), not the tag.
+  // A <label> nested inside a heading is valid HTML and changes neither association.
+  const HeadingTag = `h${headingLevel.toString()}` as "h2" | "h3";
 
   return (
     <div className={cn("space-y-2", className)} {...props}>
@@ -49,11 +62,11 @@ function ElementHeader({
       {/* Headline */}
       <div>
         <div>{required ? <span className="label-card mb-[3px]">{requiredLabel}</span> : null}</div>
-        <div className="flex">
+        <HeadingTag className="flex" data-slot="element-headline">
           <Label htmlFor={htmlFor} id={headlineId} variant="headline">
             {headline}
           </Label>
-        </div>
+        </HeadingTag>
       </div>
 
       {/* Description/Subheader */}
diff --git a/packages/survey-ui/src/styles/globals.css b/packages/survey-ui/src/styles/globals.css
index deb206faccb3..58585d21e12e 100644
--- a/packages/survey-ui/src/styles/globals.css
+++ b/packages/survey-ui/src/styles/globals.css
@@ -180,6 +180,25 @@
   font-size: var(--fb-button-font-size);
 }
 
+/*
+ * Element prompts are wrapped in a real heading for WCAG 2.4.6 (see element-header.tsx). The
+ * heading is a semantic wrapper only — the visible text is still the <Label> inside it — so the
+ * UA's own heading typography and margins have to be neutralised or the prompt gains size and
+ * spacing it never had. `packages/surveys/preflight.css` already does this for the bundled
+ * survey, but that preflight ships with the surveys package and this stylesheet is consumed on
+ * its own too (Storybook, and any standalone React consumer), so survey-ui declares it itself.
+ */
+#fbjs h1,
+#fbjs h2,
+#fbjs h3,
+#fbjs h4,
+#fbjs h5,
+#fbjs h6 {
+  font-size: inherit;
+  font-weight: inherit;
+  margin: 0;
+}
+
 #fbjs .label-headline,
 #fbjs .label-headline * {
   font-family: var(--fb-element-headline-font-family);
diff --git a/packages/surveys/src/components/elements/cal-element.tsx b/packages/surveys/src/components/elements/cal-element.tsx
index fc5722fff839..815ed556de84 100644
--- a/packages/surveys/src/components/elements/cal-element.tsx
+++ b/packages/surveys/src/components/elements/cal-element.tsx
@@ -53,11 +53,7 @@ export function CalElement({
       className="w-full">
       <div>
         {isMediaAvailable ? <ElementMedia imgUrl={element.imageUrl} videoUrl={element.videoUrl} /> : null}
-        <Headline
-          headline={getLocalizedValue(element.headline, languageCode)}
-          elementId={element.id}
-          required={element.required}
-        />
+        <Headline headline={getLocalizedValue(element.headline, languageCode)} required={element.required} />
         <Subheader subheader={element.subheader ? getLocalizedValue(element.subheader, languageCode) : ""} />
         <CalEmbed key={element.id} element={element} onSuccessfulBooking={onSuccessfulBooking} />
         {errorMessage ? (
diff --git a/packages/surveys/src/components/general/ending-card.tsx b/packages/surveys/src/components/general/ending-card.tsx
index 4cc7e62ad4a8..df676ef72252 100644
--- a/packages/surveys/src/components/general/ending-card.tsx
+++ b/packages/surveys/src/components/general/ending-card.tsx
@@ -167,7 +167,6 @@ export function EndingCard({
                       variablesData,
                       languageCode
                     )}
-                    elementId="EndingCard"
                   />
                   <Subheader
                     subheader={replaceRecallInfo(
@@ -200,11 +199,7 @@ export function EndingCard({
               <>
                 {isPreviewMode ? (
                   <div>
-                    <Headline
-                      alignTextCenter
-                      headline={t("common.respondents_will_not_see_this_card")}
-                      elementId="EndingCard"
-                    />
+                    <Headline alignTextCenter headline={t("common.respondents_will_not_see_this_card")} />
                     <Subheader subheader={t("common.they_will_be_redirected_immediately")} />
                   </div>
                 ) : (
@@ -220,7 +215,9 @@ export function EndingCard({
             <div className="my-3">
               <LoadingSpinner />
             </div>
-            <h1 className="text-brand">{t("common.sending_responses")}</h1>
+            {/* A transient status message, not a section heading — it used to be an <h1>, which
+                put a second top-level heading on the page and skipped the survey's structure. */}
+            <p className="text-brand">{t("common.sending_responses")}</p>
           </>
         )}
         {isOfflineWithPending && isResponseSendingFinished && (
diff --git a/packages/surveys/src/components/general/headline.tsx b/packages/surveys/src/components/general/headline.tsx
index 210ecef6ef7a..731b353c8414 100644
--- a/packages/surveys/src/components/general/headline.tsx
+++ b/packages/surveys/src/components/general/headline.tsx
@@ -3,23 +3,25 @@ import { isValidHTML, sanitizeSurveyHtml, stripInlineStyles } from "@/lib/html-u
 
 interface HeadlineProps {
   headline: string;
-  elementId: string;
   required?: boolean;
   alignTextCenter?: boolean;
+  /**
+   * Heading level this prompt is exposed at (WCAG 2.4.6). Defaults to 2: the survey name is the
+   * page's only h1 (rendered once by SurveyContainer), so every card headline — welcome, element
+   * prompt, ending — is one level under it.
+   */
+  headingLevel?: 1 | 2;
 }
 
 export function Headline({
   headline,
-  elementId,
   required = false,
   alignTextCenter = false,
+  headingLevel = 2,
 }: Readonly<HeadlineProps>) {
   const hasRequiredRule = required;
   const { t } = useTranslation();
-  const isQuestionCard = elementId !== "EndingCard" && elementId !== "welcomeCard";
-  // Welcome / ending cards are the top of the screen (h1); question cards sit
-  // under the survey form region, so their prompt is an h2.
-  const HeadingTag = isQuestionCard ? "h2" : "h1";
+  const HeadingTag = `h${headingLevel.toString()}` as "h1" | "h2";
   // Strip inline styles BEFORE parsing to avoid CSP violations
   const strippedHeadline = stripInlineStyles(headline);
   const isHeadlineHtml = isValidHTML(strippedHeadline);
@@ -27,7 +29,7 @@ export function Headline({
 
   return (
     <div className="text-heading mb-[3px] flex flex-col">
-      {hasRequiredRule && isQuestionCard && (
+      {hasRequiredRule && (
         <span
           className="label-card mb-[3px] text-xs leading-6 font-normal"
           tabIndex={-1}
diff --git a/packages/surveys/src/components/general/render-survey.tsx b/packages/surveys/src/components/general/render-survey.tsx
index 4e86aaac02cd..739ea6bdf74e 100644
--- a/packages/surveys/src/components/general/render-survey.tsx
+++ b/packages/surveys/src/components/general/render-survey.tsx
@@ -68,7 +68,8 @@ export function RenderSurvey(props: SurveyContainerProps) {
       clickOutside={props.clickOutside}
       onClose={close}
       isOpen={isOpen}
-      dir={dir}>
+      dir={dir}
+      surveyName={props.survey.name}>
       <Survey
         {...props}
         autoFocus={autoFocus}
diff --git a/packages/surveys/src/components/general/welcome-card.tsx b/packages/surveys/src/components/general/welcome-card.tsx
index ec4570ba57ec..b1bdaa5f1cf5 100644
--- a/packages/surveys/src/components/general/welcome-card.tsx
+++ b/packages/surveys/src/components/general/welcome-card.tsx
@@ -162,7 +162,6 @@ export function WelcomeCard({
             variablesData,
             languageCode
           )}
-          elementId="welcomeCard"
         />
         <Subheader
           subheader={replaceRecallInfo(
diff --git a/packages/surveys/src/components/wrappers/survey-container.tsx b/packages/surveys/src/components/wrappers/survey-container.tsx
index 628c0aef6b7e..008eba9fc127 100644
--- a/packages/surveys/src/components/wrappers/survey-container.tsx
+++ b/packages/surveys/src/components/wrappers/survey-container.tsx
@@ -19,6 +19,8 @@ interface SurveyContainerProps {
   clickOutside?: boolean;
   isOpen?: boolean;
   dir?: "ltr" | "rtl" | "auto";
+  /** Survey name, exposed as the survey's single top-level heading (WCAG 2.4.6). */
+  surveyName?: string;
 }
 
 export function SurveyContainer({
@@ -30,6 +32,7 @@ export function SurveyContainer({
   clickOutside,
   isOpen = true,
   dir = "auto",
+  surveyName,
 }: Readonly<SurveyContainerProps>) {
   const isModal = mode === "modal";
   const { t } = useTranslation();
@@ -127,9 +130,22 @@ export function SurveyContainer({
 
   if (!isOpen) return null;
 
+  // The survey's one top-level heading. Card headlines (welcome, element prompts, ending) are all
+  // h2, so without this they would be orphaned: a screen reader user pressing H would land inside
+  // the survey with nothing naming what they are answering. It lives here rather than in
+  // survey.tsx's getCardContent, which runs once per card and would emit one h1 per peeking card
+  // in the stacked layout. Visually hidden because the card designs have no room for a title — the
+  // survey name is already the document title on link surveys.
+  //
+  // It is rendered as a sibling of `children` in BOTH branches so that it always ends up inside the
+  // dialog on the modal path: `aria-modal="true"` makes assistive tech ignore everything outside
+  // the dialog element, so a heading placed on the #fbjs root would be unreachable there.
+  const surveyHeading = surveyName ? <h1 className="sr-only">{surveyName}</h1> : null;
+
   if (!isModal) {
     return (
       <div id="fbjs" className="formbricks-form" style={{ height: "100%", width: "100%" }} dir={dir}>
+        {surveyHeading}
         {children}
       </div>
     );
@@ -165,7 +181,10 @@ export function SurveyContainer({
               isOpen ? "opacity-100" : "opacity-0",
               "rounded-custom pointer-events-auto absolute bottom-0 h-fit w-full overflow-visible bg-white shadow-lg transition-all duration-500 ease-in-out sm:m-4 sm:max-w-sm"
             )}>
-            <div>{children}</div>
+            <div>
+              {surveyHeading}
+              {children}
+            </div>
           </div>
         </div>
       </div>