diff --git a/.coderabbit.yaml b/.coderabbit.yaml
index 829f8cec571d..5e382cc35ec1 100644
--- a/.coderabbit.yaml
+++ b/.coderabbit.yaml
@@ -358,16 +358,27 @@ reviews:
           table under the checkbox is the explanation and does not change the declaration.
 
           Treat a change as breaking if the diff does any of the following:
-          - Renames, removes, or retypes a field in an API request or response shape, or changes
-            an emitted value (for example `EN` becoming `en-US`).
-          - Removes or renames an endpoint or route, or changes a webhook payload.
+          - Renames, removes, or retypes a field in an API request or response shape, requires a
+            field that was optional, or changes an emitted value (for example `EN` becoming
+            `en-US`).
+          - Removes or renames an endpoint or route, changes a webhook payload, or changes the
+            HTTP status code returned for an existing request/response case.
           - Changes a default value, or removes or renames an environment variable or config key —
             including keys in `charts/formbricks/values.yaml` and `.env.example`. Adding one counts
             only when it is required, or has no default that keeps existing installs working.
           - Adds a database migration that needs manual action, drops or renames a column or
             table, or adds a NOT NULL column with no default and no backfill.
-          - Changes an exported signature of the public SDK surface in `packages/js-core` or
-            `packages/surveys`.
+          - Changes an exported signature of the public SDK surface in `packages/js-core`,
+            `packages/survey-ui`, or `packages/surveys`.
+
+          Nothing else is breaking. In particular, a purely additive change — a new optional request
+          or response field, a new endpoint or route, an env var whose default keeps existing installs
+          working — is not, and neither is any change to code no external consumer reaches: internal
+          functions, modules, types, and workspace-package exports other than the SDK surface above,
+          however they change. "Internal API" means internal to this repo, and it is outside this
+          check. A change that matches one of the bullets above is breaking regardless of how
+          confident the author is; genuine uncertainty about which bullet applies is what the
+          inconclusive case below is for.
 
           FAIL if the diff contains at least one of the above and the checkbox is unticked, or the
           section is empty or still holds the unedited template comment. Name the specific file and
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index 0d610e6e2760..ccf34cca58f3 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -24,9 +24,28 @@ to grasp without opening files. -->
 ## Breaking changes
 
 <!-- REQUIRED. Tick the box below if — and only if — this PR breaks something for API/SDK consumers or
-self-hosters. It is breaking if it changes an API/SDK shape or emitted value (e.g. `EN` → `en-US`),
-removes or renames an endpoint, route, env var or config key, changes a default or webhook payload, or
-needs manual migration action.
+self-hosters. The test is whether someone outside this repo has to change something to keep working.
+
+**Breaking:** renaming, removing or retyping a field in a public API request or response shape,
+requiring one that was optional, or changing an emitted value (e.g. `EN` → `en-US`); removing or
+renaming an endpoint, route, env var or config key; changing a default, a webhook payload, or the
+HTTP status code returned for an existing case; adding an env var or config key that is required, or
+whose default does not keep existing installs working; changing an exported signature of the SDK
+shipped from `packages/js-core`, `packages/survey-ui`, or `packages/surveys`; or needing manual
+action on upgrade, including a migration that drops or renames a column or table.
+
+**Not breaking:** anything purely additive, and anything internal. Adding an optional field to a
+request or response, a new endpoint or route, or an env var whose default keeps existing installs
+working leaves every existing consumer working unchanged. So does any change to internal code —
+functions, modules, types, workspace-package exports other than the SDK surface above — that no
+external consumer reaches, additive or not: "internal API" means internal to this repo, and this
+section is not about it.
+
+Uncertain? That means the change isn't clearly one of the bullets above — leave it unticked and say
+why below. If it does match a bullet, tick it regardless of how you feel about it: the tick is the
+only thing that writes a migration entry, so ticking it "to be safe" when nothing above applies
+invents an upgrade step for self-hosters that does not exist; a reviewer who disagrees can still ask
+for it.
 
 The checkbox alone drives the label: ticking it applies `breaking-change`, which feeds the release notes
 and the self-hoster migration guide. Leave its wording alone — `pr-label-sync.yml` finds it by that text,
diff --git a/.github/workflows/api-v3-contract-tests.yml b/.github/workflows/api-v3-contract-tests.yml
index cdd0ad40830b..98fa700a619e 100644
--- a/.github/workflows/api-v3-contract-tests.yml
+++ b/.github/workflows/api-v3-contract-tests.yml
@@ -49,7 +49,7 @@ jobs:
           --health-timeout=5s
           --health-retries=5
       valkey:
-        image: valkey/valkey@sha256:12ba4f45a7c3e1d0f076acd616cb230834e75a77e8516dde382720af32832d6d
+        image: valkey/valkey@sha256:e0eb7c480958d32bdc4357a74bdd70653ae15f2f9b4c93c4a5a9fad1dc471c84
         ports:
           - 6379:6379
     steps:
diff --git a/.github/workflows/docker-build-validation.yml b/.github/workflows/docker-build-validation.yml
index 40cac9788020..926df270f349 100644
--- a/.github/workflows/docker-build-validation.yml
+++ b/.github/workflows/docker-build-validation.yml
@@ -35,7 +35,7 @@ jobs:
           --health-retries 5
 
       redis:
-        image: valkey/valkey@sha256:12ba4f45a7c3e1d0f076acd616cb230834e75a77e8516dde382720af32832d6d
+        image: valkey/valkey@sha256:e0eb7c480958d32bdc4357a74bdd70653ae15f2f9b4c93c4a5a9fad1dc471c84
         ports:
           - 6379:6379
 
@@ -53,6 +53,20 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
+      - name: Verify Valkey Image Platforms
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          valkey_image="$(docker compose -f docker/docker-compose.yml config --format json | jq -r '.services.redis.image')"
+          manifest="$(docker buildx imagetools inspect --raw "$valkey_image")"
+
+          jq -e '
+            .mediaType == "application/vnd.oci.image.index.v1+json" and
+            any(.manifests[]; .platform.os == "linux" and .platform.architecture == "amd64") and
+            any(.manifests[]; .platform.os == "linux" and .platform.architecture == "arm64")
+          ' <<<"$manifest"
+
       # NOTE: deliberately no `cache-from`/`cache-to: type=gha`. Measured over four runs, exporting
       # the cache cost 222-407s per run while the layers it could restore add up to 12s of work: the
       # only steps that ever reported CACHED were the apk/corepack prelude, because `COPY . .` sits
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index ff56d9854345..9ce188bd50ba 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -55,7 +55,7 @@ jobs:
           --health-timeout=5s
           --health-retries=5
       valkey:
-        image: valkey/valkey@sha256:12ba4f45a7c3e1d0f076acd616cb230834e75a77e8516dde382720af32832d6d
+        image: valkey/valkey@sha256:e0eb7c480958d32bdc4357a74bdd70653ae15f2f9b4c93c4a5a9fad1dc471c84
         ports:
           - 6379:6379
     steps:
diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index 4cf65234cd44..ca7314025a81 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -54,7 +54,7 @@ jobs:
           --health-timeout=5s
           --health-retries=5
       valkey:
-        image: valkey/valkey@sha256:12ba4f45a7c3e1d0f076acd616cb230834e75a77e8516dde382720af32832d6d
+        image: valkey/valkey@sha256:e0eb7c480958d32bdc4357a74bdd70653ae15f2f9b4c93c4a5a9fad1dc471c84
         ports:
           - 6379:6379
     steps:
diff --git a/AGENTS.md b/AGENTS.md
index 9a0caa555add..a3082b4f2f48 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -286,7 +286,10 @@ Do not:
 
 - Keep code DRY and small; remove dead code and unused imports.
 - Follow React hooks rules, keep effects focused, and avoid unnecessary `useMemo`/`useCallback`.
-- Prefer type inference, avoid `any`, and use shared types from `@formbricks/types`.
+- Prefer type inference, avoid `any`, and use shared types from `@formbricks/types`. This is enforced:
+  `@typescript-eslint/no-explicit-any` is an error in `packages/*` and a warning in `apps/web`, where the
+  typescript-eslint baseline is being ratcheted to error rule by rule (ENG-2264). Never add new `any`s —
+  a warning today becomes an error once its rule's backlog is cleared.
 - Keep components focused, avoid deep nesting, and ensure basic accessibility.
 
 ## Commit & Pull Request Guidelines
@@ -295,7 +298,7 @@ Commits follow a lightweight Conventional Commit format (`fix:`, `chore:`, `feat
 
 Every PR must use `.github/pull_request_template.md` and follow its inline guidance — the template is the source of truth for PR structure. The ticket line at the top is the only place a magic word (`Fixes`, `Ref`, `Closes`) may sit next to a ticket id: Linear and GitHub scan the whole body, so the same pair written in prose — inside backticks too — links and closes that ticket as well. When you need to name the convention in prose, write it without a resolvable id. All QA for a change happens on its own PR before review: the creator shows that every behaviour the diff changes is covered, and lists what is not under `Open gaps`; the reviewer challenges that list and asks for the missing coverage. There is no separate release QA pass per PR — release review only looks for problems arising from the interplay of several changes. Fill every section from the actual diff on PR open, and re-update it in the same turn on every change (new commits, scope or review fixes) so it never drifts — treat a stale section as a bug.
 
-The checkbox under `## Breaking changes` is a decision you own, not a formality: judge the diff against the template's list of breaking changes and tick it (`- [x]`) when one applies, leave it unticked when none does. It is the only input to the `breaking-change` label, which feeds the release notes and the self-hoster migration guide, so a wrong answer either invents a migration entry or hides one. Re-check it whenever the diff grows. `pr-label-sync.yml` reads nothing but the tick, so the prose below the checkbox cannot change the label — but it is not free-form either: the CodeRabbit `Breaking changes match the diff` check compares the tick against the diff and expects a ticked box to document each breaking change, so explain your answer there in whatever shape fits (table or prose).
+The checkbox under `## Breaking changes` is a decision you own, not a formality: judge the diff against the template's list of breaking changes and tick it (`- [x]`) when one applies, leave it unticked when none does. The template also lists what is **not** breaking — purely additive changes, and anything internal to this repo that no external consumer reaches — and an uncertain call is an unticked box with a line of reasoning, never a defensive tick. It is the only input to the `breaking-change` label, which feeds the release notes and the self-hoster migration guide, so a wrong answer either invents a migration entry or hides one. Re-check it whenever the diff grows. `pr-label-sync.yml` reads nothing but the tick, so the prose below the checkbox cannot change the label — but it is not free-form either: the CodeRabbit `Breaking changes match the diff` check compares the tick against the diff and expects a ticked box to document each breaking change, so explain your answer there in whatever shape fits (table or prose).
 
 ## Next.js Documentation
 
diff --git a/apps/web/modules/api/v2/organizations/[organizationId]/users/lib/tests/users.test.ts b/apps/web/modules/api/v2/organizations/[organizationId]/users/lib/tests/users.test.ts
index 5739b73bb00c..84b55d5bf726 100644
--- a/apps/web/modules/api/v2/organizations/[organizationId]/users/lib/tests/users.test.ts
+++ b/apps/web/modules/api/v2/organizations/[organizationId]/users/lib/tests/users.test.ts
@@ -22,6 +22,10 @@ const mockUser = {
   teamUsers: [{ team: { name: "Test Team", id: "team123", workspaceTeams: [{ workspaceId: "proj789" }] } }],
 };
 
+// getOrganizationOwnerCount (pulled in via the last-owner guard) request-caches its result with
+// React's cache(); mocked to identity so repeated calls across tests re-hit the prisma mock below.
+vi.mock("react", () => ({ cache: (fn: Function) => fn }));
+
 vi.mock("@formbricks/database", () => ({
   prisma: {
     user: {
@@ -38,6 +42,9 @@ vi.mock("@formbricks/database", () => ({
       create: vi.fn(),
       delete: vi.fn(),
     },
+    membership: {
+      count: vi.fn(),
+    },
     $transaction: vi.fn(),
   },
 }));
@@ -248,6 +255,65 @@ describe("Users Lib", () => {
         expect(result.error.type).toBe("internal_server_error");
       }
     });
+
+    test("blocks demoting the organization's last owner", async () => {
+      // The re-check runs inside the transaction, so the mock has to actually invoke the
+      // callback (against the same mocked client, standing in for `tx`) for the guard to run.
+      (prisma.$transaction as any).mockImplementationOnce((callback: any) => callback(prisma));
+      (prisma.user.findFirst as any).mockResolvedValueOnce({
+        ...mockUser,
+        memberships: [{ organizationId: "org456", role: "owner" }],
+      });
+      (prisma.membership.count as any).mockResolvedValueOnce(1);
+
+      const result = await updateUser({ email: mockUser.email, role: "member" }, "org456");
+
+      expect(result.ok).toBe(false);
+      if (!result.ok) {
+        expect(result.error.type).toBe("conflict");
+      }
+      expect(prisma.user.update).not.toHaveBeenCalled();
+    });
+
+    test("allows demoting an owner when the organization has another owner", async () => {
+      (prisma.$transaction as any).mockImplementationOnce((callback: any) => callback(prisma));
+      (prisma.user.findFirst as any).mockResolvedValueOnce({
+        ...mockUser,
+        memberships: [{ organizationId: "org456", role: "owner" }],
+        teamUsers: [],
+      });
+      (prisma.membership.count as any).mockResolvedValueOnce(2);
+      (prisma.team.findMany as any).mockResolvedValueOnce([]);
+      (prisma.user.update as any).mockResolvedValueOnce({
+        ...mockUser,
+        memberships: [{ organizationId: "org456", role: "member" }],
+      });
+
+      const result = await updateUser({ email: mockUser.email, role: "member" }, "org456");
+
+      expect(result.ok).toBe(true);
+      if (result.ok) {
+        expect(result.data.role).toBe("member");
+      }
+    });
+
+    test("allows demoting an already-inactive owner without checking the owner count", async () => {
+      (prisma.user.findFirst as any).mockResolvedValueOnce({
+        ...mockUser,
+        isActive: false,
+        memberships: [{ organizationId: "org456", role: "owner" }],
+        teamUsers: [],
+      });
+      (prisma.team.findMany as any).mockResolvedValueOnce([]);
+      (prisma.$transaction as any).mockResolvedValueOnce([
+        { ...mockUser, isActive: false, memberships: [{ organizationId: "org456", role: "member" }] },
+      ]);
+
+      const result = await updateUser({ email: mockUser.email, role: "member" }, "org456");
+
+      expect(result.ok).toBe(true);
+      expect(prisma.membership.count).not.toHaveBeenCalled();
+    });
   });
 
   describe("createUser with teams", () => {
diff --git a/apps/web/modules/api/v2/organizations/[organizationId]/users/lib/users.ts b/apps/web/modules/api/v2/organizations/[organizationId]/users/lib/users.ts
index a8070e62cb73..5ce9f5c034e9 100644
--- a/apps/web/modules/api/v2/organizations/[organizationId]/users/lib/users.ts
+++ b/apps/web/modules/api/v2/organizations/[organizationId]/users/lib/users.ts
@@ -11,6 +11,7 @@ import {
 } from "@/modules/api/v2/organizations/[organizationId]/users/types/users";
 import { ApiErrorResponseV2 } from "@/modules/api/v2/types/api-error";
 import { ApiResponseWithMeta } from "@/modules/api/v2/types/api-success";
+import { getOrganizationOwnerCount } from "@/modules/organization/settings/teams/lib/membership";
 
 export const getUsers = async (
   organizationId: string,
@@ -159,13 +160,17 @@ export const createUser = async (
   }
 };
 
+// Thrown inside updateUser's transaction to carry the last-owner conflict out through the
+// generic catch block below without it being reported as an internal_server_error.
+class LastOwnerConflictError extends Error {}
+
 export const updateUser = async (
   userInput: TUserInputPatch,
   organizationId: string
 ): Promise<Result<TUser, ApiErrorResponseV2>> => {
   const { name, email, role, teams, isActive } = userInput;
   let existingTeams: string[] = [];
-  let newTeams;
+  let newTeams: Awaited<ReturnType<typeof getExistingTeamsFromInput>>;
 
   try {
     // Restrict the lookup to a user with a membership in the authenticated organization,
@@ -200,6 +205,20 @@ export const updateUser = async (
       });
     }
 
+    const currentRole = existingUser.memberships.find(
+      (membership) => membership.organizationId === organizationId
+    )?.role;
+
+    // Mirrors the last-owner guard in modules/ee/role-management/actions.ts: without it, this
+    // route can demote an organization's only owner with no UI path back into it. Gated on
+    // existingUser.isActive because getOrganizationOwnerCount only counts active owners — demoting
+    // an already-inactive owner doesn't change that count, so guarding it would block a no-op change.
+    const isDemotingOwner =
+      currentRole === OrganizationRole.owner &&
+      existingUser.isActive &&
+      role &&
+      role !== OrganizationRole.owner;
+
     // Capture the existing team names for the user (within the authenticated organization).
     existingTeams = existingUser.teamUsers.map((teamUser) => teamUser.team.name);
 
@@ -274,26 +293,83 @@ export const updateUser = async (
       },
     };
 
-    // Update by id so the mutation is bound to the org-scoped lookup above. Email is
-    // a global unique key and using it here would defeat the membership check.
-    const updateUserOp = prisma.user.update({
-      where: { id: existingUser.id },
-      data: prismaData,
-      include: {
-        memberships: {
-          select: { role: true, organizationId: true },
+    // Matches the pre-existing looseness of `results: any[]` from the array-style transaction
+    // below rather than introducing a stricter type here that the rest of this function's
+    // (already loosely-typed) User <-> TUser mapping isn't written to satisfy.
+    let updatedUser: any;
+
+    if (isDemotingOwner) {
+      // The owner-count re-check and the role write must be one atomic unit: read then act in two
+      // separate statements lets two callers demoting different owners at once both read "more
+      // than one owner" and both writes land, leaving none. Serializable isolation makes Postgres
+      // abort one side of that race instead, surfaced here as a thrown LastOwnerConflictError.
+      updatedUser = await prisma.$transaction(
+        async (tx) => {
+          const ownerCount = await getOrganizationOwnerCount(organizationId, tx);
+          if (ownerCount <= 1) {
+            throw new LastOwnerConflictError();
+          }
+
+          // Re-run against `tx` rather than reusing deleteTeamOps/createTeamOps below: those are
+          // built against the root client, so awaiting them here would run them as separate
+          // queries outside this transaction instead of as part of it.
+          for (const teamUser of existingUser.teamUsers) {
+            if (teams && !teams.includes(teamUser.team.name)) {
+              await tx.teamUser.delete({
+                where: {
+                  teamId_userId: { teamId: teamUser.team.id, userId: existingUser.id },
+                },
+              });
+            }
+          }
+          for (const team of newTeams ?? []) {
+            if (!existingUserTeamNames.includes(team.name)) {
+              await tx.teamUser.create({
+                data: {
+                  role: TeamUserRole.contributor,
+                  user: { connect: { id: existingUser.id } },
+                  team: { connect: { id: team.id } },
+                },
+              });
+            }
+          }
+
+          // Update by id so the mutation is bound to the org-scoped lookup above. Email is
+          // a global unique key and using it here would defeat the membership check.
+          return tx.user.update({
+            where: { id: existingUser.id },
+            data: prismaData,
+            include: {
+              memberships: {
+                select: { role: true, organizationId: true },
+              },
+            },
+          });
         },
-      },
-    });
+        { isolationLevel: Prisma.TransactionIsolationLevel.Serializable }
+      );
+    } else {
+      // Update by id so the mutation is bound to the org-scoped lookup above. Email is
+      // a global unique key and using it here would defeat the membership check.
+      const updateUserOp = prisma.user.update({
+        where: { id: existingUser.id },
+        data: prismaData,
+        include: {
+          memberships: {
+            select: { role: true, organizationId: true },
+          },
+        },
+      });
 
-    // Combine all operations into one transaction.
-    const operations = [...deleteTeamOps, ...createTeamOps, updateUserOp];
+      // Combine all operations into one transaction.
+      const operations = [...deleteTeamOps, ...createTeamOps, updateUserOp];
 
-    // Execute the transaction. The result will be an array with the results in the same order.
-    const results = await prisma.$transaction(operations);
+      // Execute the transaction. The result will be an array with the results in the same order.
+      const results = await prisma.$transaction(operations);
 
-    // Retrieve the updated user result. Since the update was the last operation, it is the last item.
-    const updatedUser = results[results.length - 1];
+      // Retrieve the updated user result. Since the update was the last operation, it is the last item.
+      updatedUser = results[results.length - 1];
+    }
 
     const returnedUser = {
       id: updatedUser.id,
@@ -311,6 +387,13 @@ export const updateUser = async (
 
     return ok(returnedUser);
   } catch (error) {
+    if (error instanceof LastOwnerConflictError) {
+      return err({
+        type: "conflict",
+        details: [{ field: "role", issue: "Cannot remove the last owner of the organization" }],
+      });
+    }
+
     return err({
       type: "internal_server_error",
       details: [{ field: "user", issue: error instanceof Error ? error.message : "Unknown error occurred" }],
diff --git a/apps/web/modules/ee/role-management/actions.test.ts b/apps/web/modules/ee/role-management/actions.test.ts
new file mode 100644
index 000000000000..bc6374943dc9
--- /dev/null
+++ b/apps/web/modules/ee/role-management/actions.test.ts
@@ -0,0 +1,145 @@
+import { beforeEach, describe, expect, test, vi } from "vitest";
+import { OperationNotAllowedError, ValidationError } from "@formbricks/types/errors";
+import { updateMembershipAction } from "./actions";
+
+const mocks = vi.hoisted(() => ({
+  checkAuthorizationUpdated: vi.fn(),
+  getAccessControlPermission: vi.fn(),
+  getMembershipByUserIdOrganizationId: vi.fn(),
+  getOrganization: vi.fn(),
+  getOrganizationOwnerCount: vi.fn(),
+  updateMembership: vi.fn(),
+}));
+
+vi.mock("@formbricks/database", () => ({
+  // The last-owner guard runs the owner-count re-check and the update inside one transaction;
+  // the fake just invokes the callback with a stand-in tx so both still hit the mocks below.
+  prisma: { $transaction: vi.fn((callback: (tx: unknown) => unknown) => callback({})) },
+}));
+
+vi.mock("@formbricks/database/prisma", () => ({
+  Prisma: { TransactionIsolationLevel: { Serializable: "Serializable" } },
+}));
+
+vi.mock("@/lib/constants", () => ({
+  IS_FORMBRICKS_CLOUD: true,
+  USER_MANAGEMENT_MINIMUM_ROLE: "manager",
+}));
+
+vi.mock("@/lib/membership/service", () => ({
+  getMembershipByUserIdOrganizationId: mocks.getMembershipByUserIdOrganizationId,
+}));
+
+vi.mock("@/lib/organization/service", () => ({
+  getOrganization: mocks.getOrganization,
+}));
+
+vi.mock("@/lib/utils/action-client", () => ({
+  authenticatedActionClient: {
+    inputSchema: vi.fn(() => ({
+      action: vi.fn((fn) => fn),
+    })),
+  },
+}));
+
+vi.mock("@/lib/utils/action-client/action-client-middleware", () => ({
+  checkAuthorizationUpdated: mocks.checkAuthorizationUpdated,
+}));
+
+vi.mock("@/lib/utils/helper", () => ({
+  getOrganizationIdFromInviteId: vi.fn(),
+}));
+
+vi.mock("@/modules/ee/audit-logs/lib/handler", () => ({
+  withAuditLogging: vi.fn((_eventName, _objectType, fn) => fn),
+}));
+
+vi.mock("@/modules/ee/license-check/lib/utils", () => ({
+  getAccessControlPermission: mocks.getAccessControlPermission,
+}));
+
+vi.mock("@/modules/ee/role-management/lib/invite", () => ({
+  updateInvite: vi.fn(),
+}));
+
+vi.mock("@/modules/ee/role-management/lib/membership", () => ({
+  updateMembership: mocks.updateMembership,
+}));
+
+vi.mock("@/modules/organization/settings/teams/lib/invite", () => ({
+  getInvite: vi.fn(),
+}));
+
+vi.mock("@/modules/organization/settings/teams/lib/membership", () => ({
+  getOrganizationOwnerCount: mocks.getOrganizationOwnerCount,
+}));
+
+const organizationId = "cm9gptbhg0000192zceq9ayuc";
+const currentUserId = "cm9gptbhg0001192zceq9ayud";
+const targetUserId = "cm9gptbhg0002192zceq9ayue";
+
+const membership = (userId: string, role: string) => ({ userId, organizationId, role, accepted: true });
+
+const callUpdateMembership = (role: string) =>
+  updateMembershipAction({
+    ctx: { user: { id: currentUserId, locale: "en-US" }, auditLoggingCtx: {} },
+    parsedInput: { userId: targetUserId, organizationId, data: { role } },
+  } as any);
+
+describe("updateMembershipAction", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+
+    mocks.checkAuthorizationUpdated.mockResolvedValue(undefined);
+    mocks.getAccessControlPermission.mockResolvedValue(true);
+    mocks.getOrganization.mockResolvedValue({ id: organizationId });
+    mocks.getMembershipByUserIdOrganizationId.mockImplementation(async (userId: string) =>
+      membership(userId, "owner")
+    );
+    mocks.getOrganizationOwnerCount.mockResolvedValue(2);
+    mocks.updateMembership.mockImplementation(async (userId: string, _orgId: string, data: any) =>
+      membership(userId, data.role)
+    );
+  });
+
+  test("rejects demoting the last owner of the organization", async () => {
+    mocks.getOrganizationOwnerCount.mockResolvedValue(1);
+
+    await expect(callUpdateMembership("member")).rejects.toThrow(ValidationError);
+    expect(mocks.updateMembership).not.toHaveBeenCalled();
+  });
+
+  test("allows demoting an owner when the organization has another owner", async () => {
+    mocks.getOrganizationOwnerCount.mockResolvedValue(2);
+
+    await expect(callUpdateMembership("member")).resolves.toMatchObject({ role: "member" });
+    expect(mocks.getOrganizationOwnerCount).toHaveBeenCalledWith(organizationId, expect.anything());
+    expect(mocks.updateMembership).toHaveBeenCalledWith(
+      targetUserId,
+      organizationId,
+      { role: "member" },
+      expect.anything()
+    );
+  });
+
+  test("allows changing a non-owner's role", async () => {
+    mocks.getMembershipByUserIdOrganizationId.mockImplementation(async (userId: string) =>
+      membership(userId, userId === currentUserId ? "owner" : "member")
+    );
+
+    await expect(callUpdateMembership("manager")).resolves.toMatchObject({ role: "manager" });
+  });
+
+  test("allows keeping an owner's role unchanged", async () => {
+    await expect(callUpdateMembership("owner")).resolves.toMatchObject({ role: "owner" });
+  });
+
+  test("still rejects a manager demoting an owner before the owner count is read", async () => {
+    mocks.getMembershipByUserIdOrganizationId.mockImplementation(async (userId: string) =>
+      membership(userId, userId === currentUserId ? "manager" : "owner")
+    );
+
+    await expect(callUpdateMembership("member")).rejects.toThrow(OperationNotAllowedError);
+    expect(mocks.updateMembership).not.toHaveBeenCalled();
+  });
+});
diff --git a/apps/web/modules/ee/role-management/actions.ts b/apps/web/modules/ee/role-management/actions.ts
index 8a4b1c3a44a6..f608c38d9f9f 100644
--- a/apps/web/modules/ee/role-management/actions.ts
+++ b/apps/web/modules/ee/role-management/actions.ts
@@ -1,6 +1,8 @@
 "use server";
 
 import { z } from "zod";
+import { prisma } from "@formbricks/database";
+import { Prisma } from "@formbricks/database/prisma";
 import { ZId, ZUuid } from "@formbricks/types/common";
 import {
   AuthenticationError,
@@ -22,6 +24,7 @@ import { updateInvite } from "@/modules/ee/role-management/lib/invite";
 import { updateMembership } from "@/modules/ee/role-management/lib/membership";
 import { ZInviteUpdateInput } from "@/modules/ee/role-management/types/invites";
 import { getInvite } from "@/modules/organization/settings/teams/lib/invite";
+import { getOrganizationOwnerCount } from "@/modules/organization/settings/teams/lib/membership";
 
 export const checkRoleManagementPermission = async (organizationId: string) => {
   const organization = await getOrganization(organizationId);
@@ -143,7 +146,28 @@ export const updateMembershipAction = authenticatedActionClient.inputSchema(ZUpd
     ctx.auditLoggingCtx.organizationId = parsedInput.organizationId;
     ctx.auditLoggingCtx.membershipId = `${parsedInput.userId}-${parsedInput.organizationId}`;
     ctx.auditLoggingCtx.oldObject = targetMembership;
-    const result = await updateMembership(parsedInput.userId, parsedInput.organizationId, parsedInput.data);
+
+    const isDemotingOwner = targetMembership?.role === "owner" && parsedInput.data.role !== "owner";
+
+    // The owner count and the role update must be one atomic unit: read then act, in two separate
+    // statements, lets two owners demoting each other concurrently both read "more than one owner"
+    // and both writes land, leaving zero owners. Serializable isolation makes Postgres abort one of
+    // the two transactions instead.
+    const result = isDemotingOwner
+      ? await prisma.$transaction(
+          async (tx) => {
+            const ownerCount = await getOrganizationOwnerCount(parsedInput.organizationId, tx);
+
+            if (ownerCount <= 1) {
+              throw new ValidationError("You cannot demote the last owner of the organization");
+            }
+
+            return updateMembership(parsedInput.userId, parsedInput.organizationId, parsedInput.data, tx);
+          },
+          { isolationLevel: Prisma.TransactionIsolationLevel.Serializable }
+        )
+      : await updateMembership(parsedInput.userId, parsedInput.organizationId, parsedInput.data);
+
     ctx.auditLoggingCtx.newObject = result;
     return result;
   })
diff --git a/apps/web/modules/ee/role-management/lib/membership.ts b/apps/web/modules/ee/role-management/lib/membership.ts
index 42b5f71d4de4..18af6e0bd378 100644
--- a/apps/web/modules/ee/role-management/lib/membership.ts
+++ b/apps/web/modules/ee/role-management/lib/membership.ts
@@ -10,12 +10,14 @@ import { validateInputs } from "@/lib/utils/validate";
 export const updateMembership = async (
   userId: string,
   organizationId: string,
-  data: TMembershipUpdateInput
+  data: TMembershipUpdateInput,
+  tx?: Prisma.TransactionClient
 ): Promise<TMembership> => {
   validateInputs([userId, ZString], [organizationId, ZString], [data, ZMembershipUpdateInput]);
+  const client = tx ?? prisma;
 
   try {
-    const membership = await prisma.membership.update({
+    const membership = await client.membership.update({
       where: {
         userId_organizationId: {
           userId,
@@ -25,7 +27,7 @@ export const updateMembership = async (
       data,
     });
 
-    await prisma.teamUser.findMany({
+    await client.teamUser.findMany({
       where: {
         userId,
         team: {
@@ -38,7 +40,7 @@ export const updateMembership = async (
     });
 
     if (data.role === "owner" || data.role === "manager") {
-      await prisma.teamUser.updateMany({
+      await client.teamUser.updateMany({
         where: {
           userId,
           team: {
@@ -51,7 +53,7 @@ export const updateMembership = async (
       });
     }
 
-    await prisma.membership.findMany({
+    await client.membership.findMany({
       where: {
         organizationId,
       },
diff --git a/apps/web/modules/organization/settings/teams/lib/membership.test.ts b/apps/web/modules/organization/settings/teams/lib/membership.test.ts
index e023f8644757..e67e74a1d4f3 100644
--- a/apps/web/modules/organization/settings/teams/lib/membership.test.ts
+++ b/apps/web/modules/organization/settings/teams/lib/membership.test.ts
@@ -83,6 +83,14 @@ describe("getOrganizationOwnerCount", () => {
     const result = await getOrganizationOwnerCount(organizationId);
     expect(result).toBe(2);
   });
+  test("only counts active owners", async () => {
+    vi.mocked(prisma.membership.count).mockResolvedValue(1);
+    const result = await getOrganizationOwnerCount(organizationId);
+    expect(result).toBe(1);
+    expect(prisma.membership.count).toHaveBeenCalledWith({
+      where: { organizationId, role: "owner", user: { isActive: true } },
+    });
+  });
   test("throws DatabaseError on prisma error", async () => {
     const prismaError = new Prisma.PrismaClientKnownRequestError("db", {
       code: "P2002",
diff --git a/apps/web/modules/organization/settings/teams/lib/membership.ts b/apps/web/modules/organization/settings/teams/lib/membership.ts
index 9f8c7fddc6d8..4f6b8a29cde1 100644
--- a/apps/web/modules/organization/settings/teams/lib/membership.ts
+++ b/apps/web/modules/organization/settings/teams/lib/membership.ts
@@ -56,14 +56,21 @@ export const getMembershipByOrganizationId = reactCache(
   }
 );
 
-export const getOrganizationOwnerCount = reactCache(async (organizationId: string): Promise<number> => {
+const getOrganizationOwnerCountUncached = async (
+  organizationId: string,
+  tx?: Prisma.TransactionClient
+): Promise<number> => {
   validateInputs([organizationId, ZString]);
 
   try {
-    const ownersCount = await prisma.membership.count({
+    const ownersCount = await (tx ?? prisma).membership.count({
       where: {
         organizationId,
         role: "owner",
+        // A deactivated user can never sign in again (see modules/auth/lib/session.ts and
+        // better-auth-active-user-gate.ts), so counting them as "another owner" would let a
+        // guard pass while leaving the organization with no owner who can actually log in.
+        user: { isActive: true },
       },
     });
 
@@ -75,7 +82,27 @@ export const getOrganizationOwnerCount = reactCache(async (organizationId: strin
 
     throw error;
   }
-});
+};
+
+const getOrganizationOwnerCountCached = reactCache((organizationId: string) =>
+  getOrganizationOwnerCountUncached(organizationId)
+);
+
+/**
+ * Pass `tx` when this must be read inside the same transaction as the mutation it's guarding
+ * (see updateMembershipAction) so a Serializable transaction can catch concurrent demotions;
+ * without `tx` the result is request-cached like the rest of this module's reads.
+ */
+export const getOrganizationOwnerCount = async (
+  organizationId: string,
+  tx?: Prisma.TransactionClient
+): Promise<number> => {
+  if (tx) {
+    return getOrganizationOwnerCountUncached(organizationId, tx);
+  }
+
+  return getOrganizationOwnerCountCached(organizationId);
+};
 
 export const deleteMembership = async (
   userId: string,
diff --git a/charts/formbricks/README.md b/charts/formbricks/README.md
index c03eeae15c73..4c2828153cf0 100644
--- a/charts/formbricks/README.md
+++ b/charts/formbricks/README.md
@@ -616,7 +616,7 @@ tokens, provider response bodies, and collector URLs are never telemetry fields.
 | redis.enabled                                                      | bool   | `true`                                                                      |                                                           |
 | redis.externalRedisUrl                                             | string | `""`                                                                        |                                                           |
 | redis.fullnameOverride                                             | string | `"formbricks-redis"`                                                        |                                                           |
-| redis.image.digest                                                 | string | `"sha256:12ba4f45a7c3e1d0f076acd616cb230834e75a77e8516dde382720af32832d6d"` |                                                           |
+| redis.image.digest                                                 | string | `"sha256:e0eb7c480958d32bdc4357a74bdd70653ae15f2f9b4c93c4a5a9fad1dc471c84"` |                                                           |
 | redis.image.pullPolicy                                             | string | `"IfNotPresent"`                                                            |                                                           |
 | redis.image.repository                                             | string | `"valkey/valkey"`                                                           |                                                           |
 | redis.image.tag                                                    | string | `""`                                                                        |                                                           |
diff --git a/charts/formbricks/values.yaml b/charts/formbricks/values.yaml
index 9013f34647bb..32747e874849 100644
--- a/charts/formbricks/values.yaml
+++ b/charts/formbricks/values.yaml
@@ -817,7 +817,7 @@ redis:
   image:
     repository: "valkey/valkey"
     tag: ""
-    digest: "sha256:12ba4f45a7c3e1d0f076acd616cb230834e75a77e8516dde382720af32832d6d"
+    digest: "sha256:e0eb7c480958d32bdc4357a74bdd70653ae15f2f9b4c93c4a5a9fad1dc471c84"
     pullPolicy: IfNotPresent
   architecture: standalone
   commonConfiguration: |-
diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
index e9069a3bde04..af539e7d1b0e 100644
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -73,7 +73,7 @@ services:
       - 1025:1025
 
   valkey:
-    image: valkey/valkey@sha256:12ba4f45a7c3e1d0f076acd616cb230834e75a77e8516dde382720af32832d6d
+    image: valkey/valkey@sha256:e0eb7c480958d32bdc4357a74bdd70653ae15f2f9b4c93c4a5a9fad1dc471c84
     command: "valkey-server --maxmemory-policy noeviction"
     ports:
       - 6379:6379
diff --git a/docker/__tests__/formbricks-script.test.ts b/docker/__tests__/formbricks-script.test.ts
index 5eda21e15421..359438eb4c83 100644
--- a/docker/__tests__/formbricks-script.test.ts
+++ b/docker/__tests__/formbricks-script.test.ts
@@ -1,6 +1,6 @@
 import { load } from "js-yaml";
 import { execFileSync } from "node:child_process";
-import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -8,6 +8,10 @@ import { afterEach, describe, expect, test } from "vitest";
 
 const formbricksScriptPath = fileURLToPath(new URL("../formbricks.sh", import.meta.url));
 const dockerComposeTemplatePath = fileURLToPath(new URL("../docker-compose.yml", import.meta.url));
+const legacyValkeyImage =
+  "valkey/valkey@sha256:12ba4f45a7c3e1d0f076acd616cb230834e75a77e8516dde382720af32832d6d";
+const multiArchValkeyImage =
+  "valkey/valkey@sha256:e0eb7c480958d32bdc4357a74bdd70653ae15f2f9b4c93c4a5a9fad1dc471c84";
 
 const tempDirs: string[] = [];
 
@@ -46,6 +50,36 @@ const writeDockerComposeTemplate = (): string => {
   return composePath;
 };
 
+const migrateLegacyValkeyImage = (composePath: string, validationResult: "success" | "failure"): string => {
+  const validationLogPath = join(createTempDir(), "validation.log");
+
+  execFileSync(
+    "bash",
+    [
+      "-lc",
+      `source "$1"
+sudo() {
+  printf '%s\\n' "$*" >> "$VALIDATION_LOG_PATH"
+  [[ "$VALIDATION_RESULT" == "success" ]]
+}
+migrate_legacy_valkey_image "$2"`,
+      "bash",
+      formbricksScriptPath,
+      composePath,
+    ],
+    {
+      encoding: "utf8",
+      env: {
+        ...process.env,
+        VALIDATION_LOG_PATH: validationLogPath,
+        VALIDATION_RESULT: validationResult,
+      },
+    }
+  );
+
+  return validationLogPath;
+};
+
 const getServiceBlock = (composeContents: string, serviceName: string): string => {
   const lines = composeContents.split("\n");
   const startIndex = lines.findIndex((line) => line === `  ${serviceName}:`);
@@ -93,6 +127,74 @@ describe("docker/docker-compose.yml Redis/Valkey exposure (ENG-2184)", () => {
   });
 });
 
+describe("docker/formbricks.sh Valkey image migration", () => {
+  test("updates the known amd64-only pin and keeps a backup", () => {
+    const composePath = writeDockerComposeTemplate();
+    const originalCompose = readFileSync(composePath, "utf8");
+
+    expect(originalCompose).toContain(multiArchValkeyImage);
+    writeFileSync(composePath, originalCompose.replace(multiArchValkeyImage, legacyValkeyImage));
+    chmodSync(composePath, 0o600);
+
+    const validationLogPath = migrateLegacyValkeyImage(composePath, "success");
+
+    expect(readFileSync(composePath, "utf8")).toBe(originalCompose);
+    expect(readFileSync(`${composePath}.before-valkey-8.1.9`, "utf8")).toContain(legacyValkeyImage);
+    expect(statSync(composePath).mode & 0o777).toBe(0o600);
+    expect(statSync(`${composePath}.before-valkey-8.1.9`).mode & 0o777).toBe(0o600);
+    expect(readFileSync(validationLogPath, "utf8")).toBe(`docker compose -f ${composePath} config\n`);
+  });
+
+  test("updates the live redis service when Compose uses four-space indentation", () => {
+    const tempDir = createTempDir();
+    const composePath = join(tempDir, "docker-compose.yml");
+    writeFileSync(
+      composePath,
+      `services:
+    redis:
+        image: ${legacyValkeyImage}
+        volumes:
+            - redis:/data
+
+volumes:
+    redis:
+`
+    );
+
+    const validationLogPath = migrateLegacyValkeyImage(composePath, "success");
+
+    expect(readFileSync(composePath, "utf8")).toContain(multiArchValkeyImage);
+    expect(readFileSync(`${composePath}.before-valkey-8.1.9`, "utf8")).toContain(legacyValkeyImage);
+    expect(readFileSync(validationLogPath, "utf8")).toBe(`docker compose -f ${composePath} config\n`);
+  });
+
+  test.each([multiArchValkeyImage, "example.com/custom-valkey@sha256:custom"])(
+    "leaves the %s reference untouched",
+    (image) => {
+      const composePath = writeDockerComposeTemplate();
+      const originalCompose = readFileSync(composePath, "utf8").replace(multiArchValkeyImage, image);
+      writeFileSync(composePath, originalCompose);
+
+      migrateLegacyValkeyImage(composePath, "failure");
+
+      expect(readFileSync(composePath, "utf8")).toBe(originalCompose);
+      expect(existsSync(`${composePath}.before-valkey-8.1.9`)).toBe(false);
+    }
+  );
+
+  test("restores the original Compose file when validation fails", () => {
+    const composePath = writeDockerComposeTemplate();
+    const legacyCompose = readFileSync(composePath, "utf8").replace(multiArchValkeyImage, legacyValkeyImage);
+    writeFileSync(composePath, legacyCompose);
+
+    expect(() => migrateLegacyValkeyImage(composePath, "failure")).toThrow();
+
+    expect(readFileSync(composePath, "utf8")).toBe(legacyCompose);
+    expect(readFileSync(`${composePath}.before-valkey-8.1.9`, "utf8")).toBe(legacyCompose);
+    expect(existsSync(`${composePath}.tmp`)).toBe(false);
+  });
+});
+
 describe("docker/formbricks.sh Traefik label injection", () => {
   test("adds HTTPS Traefik labels to the formbricks service only", () => {
     const composePath = writeDockerComposeTemplate();
diff --git a/docker/__tests__/valkey-image.test.ts b/docker/__tests__/valkey-image.test.ts
new file mode 100644
index 000000000000..a2c60e890f78
--- /dev/null
+++ b/docker/__tests__/valkey-image.test.ts
@@ -0,0 +1,52 @@
+import { load } from "js-yaml";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, test } from "vitest";
+
+const repositoryRoot = fileURLToPath(new URL("../../", import.meta.url));
+const valkeyIndexDigest = "sha256:e0eb7c480958d32bdc4357a74bdd70653ae15f2f9b4c93c4a5a9fad1dc471c84";
+const valkeyImage = `valkey/valkey@${valkeyIndexDigest}`;
+const legacyValkeyImage =
+  "valkey/valkey@sha256:12ba4f45a7c3e1d0f076acd616cb230834e75a77e8516dde382720af32832d6d";
+
+const sharedDirectPinFiles = [
+  ".github/workflows/docker-build-validation.yml",
+  ".github/workflows/e2e.yml",
+  ".github/workflows/integration-tests.yml",
+  "docker-compose.dev.yml",
+  "docker/docker-compose.yml",
+  "docker/formbricks.sh",
+  "docker/migrate-to-v4.sh",
+];
+const mainOnlyDirectPinFile = ".github/workflows/api-v3-contract-tests.yml";
+
+describe("bundled Valkey image", () => {
+  test.each([
+    ...sharedDirectPinFiles,
+    ...(existsSync(join(repositoryRoot, mainOnlyDirectPinFile)) ? [mainOnlyDirectPinFile] : []),
+  ])("uses the multi-architecture index in %s", (relativePath) => {
+    expect(readFileSync(join(repositoryRoot, relativePath), "utf8")).toContain(valkeyImage);
+  });
+
+  test("uses the same index in the Helm defaults and generated values table", () => {
+    const values = load(readFileSync(join(repositoryRoot, "charts/formbricks/values.yaml"), "utf8")) as {
+      redis?: { image?: { digest?: string; repository?: string } };
+    };
+
+    expect(values.redis?.image).toMatchObject({
+      digest: valkeyIndexDigest,
+      repository: "valkey/valkey",
+    });
+    expect(readFileSync(join(repositoryRoot, "charts/formbricks/README.md"), "utf8")).toContain(
+      `\`"${valkeyIndexDigest}"\``
+    );
+  });
+
+  test("keeps the updater's current and legacy migration pins explicit", () => {
+    const updater = readFileSync(join(repositoryRoot, "docker/formbricks.sh"), "utf8");
+
+    expect(updater).toContain(`legacy_valkey_image="${legacyValkeyImage}"`);
+    expect(updater).toContain(`multi_arch_valkey_image="${valkeyImage}"`);
+  });
+});
diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index e598f51ff51b..aa0559be88c7 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -260,7 +260,7 @@ services:
   # host firewalls like ufw). Same treatment as the postgres service above.
   redis:
     restart: always
-    image: valkey/valkey@sha256:12ba4f45a7c3e1d0f076acd616cb230834e75a77e8516dde382720af32832d6d
+    image: valkey/valkey@sha256:e0eb7c480958d32bdc4357a74bdd70653ae15f2f9b4c93c4a5a9fad1dc471c84
     command: valkey-server --appendonly yes --maxmemory-policy noeviction
     volumes:
       - redis:/data
diff --git a/docker/formbricks.sh b/docker/formbricks.sh
index 106493c5f0dc..9bb6d9066a70 100755
--- a/docker/formbricks.sh
+++ b/docker/formbricks.sh
@@ -2,6 +2,8 @@
 
 set -e
 ubuntu_version=$(lsb_release -a 2>/dev/null | grep -v "No LSB modules are available." | grep "Description:" | awk -F "Description:\t" '{print $2}')
+legacy_valkey_image="valkey/valkey@sha256:12ba4f45a7c3e1d0f076acd616cb230834e75a77e8516dde382720af32832d6d"
+multi_arch_valkey_image="valkey/valkey@sha256:e0eb7c480958d32bdc4357a74bdd70653ae15f2f9b4c93c4a5a9fad1dc471c84"
 
 write_rustfs_init_script() {
   local target_path="${1:-rustfs-init.sh}"
@@ -977,9 +979,89 @@ stop_formbricks() {
   echo "🎉 Formbricks instance stopped successfully!"
 }
 
+migrate_legacy_valkey_image() {
+  local compose_file="${1:-docker-compose.yml}"
+  local backup_file="${compose_file}.before-valkey-8.1.9"
+  local temp_file="${compose_file}.tmp"
+
+  if [[ ! -f "$compose_file" ]]; then
+    echo "❌ Cannot update Valkey because $compose_file does not exist."
+    return 1
+  fi
+
+  if ! awk -v legacy_image="$legacy_valkey_image" '
+    function indentation(line) {
+      match(line, /[^ ]/)
+      return RSTART - 1
+    }
+    /^services:[[:space:]]*$/ {
+      in_services=1
+      service_indent=-1
+      next
+    }
+    in_services && /^[^[:space:]#]/ {
+      in_services=0
+      in_redis=0
+    }
+    in_services && /^[ ]+[A-Za-z0-9_-]+:[[:space:]]*$/ {
+      line_indent=indentation($0)
+      if (service_indent < 0) service_indent=line_indent
+      if (line_indent == service_indent) in_redis=($0 ~ /^[ ]+redis:[[:space:]]*$/)
+    }
+    in_redis && /^[[:space:]]+image:[[:space:]]*/ && index($0, legacy_image) { found=1 }
+    END { exit(found ? 0 : 1) }
+  ' "$compose_file"; then
+    return 0
+  fi
+
+  cp -p "$compose_file" "$backup_file"
+  cp -p "$compose_file" "$temp_file"
+
+  if ! awk -v legacy_image="$legacy_valkey_image" -v replacement_image="$multi_arch_valkey_image" '
+    function indentation(line) {
+      match(line, /[^ ]/)
+      return RSTART - 1
+    }
+    /^services:[[:space:]]*$/ {
+      in_services=1
+      service_indent=-1
+    }
+    in_services && /^[^[:space:]#]/ && !/^services:[[:space:]]*$/ {
+      in_services=0
+      in_redis=0
+    }
+    in_services && /^[ ]+[A-Za-z0-9_-]+:[[:space:]]*$/ {
+      line_indent=indentation($0)
+      if (service_indent < 0) service_indent=line_indent
+      if (line_indent == service_indent) in_redis=($0 ~ /^[ ]+redis:[[:space:]]*$/)
+    }
+    in_redis && /^[[:space:]]+image:[[:space:]]*/ && index($0, legacy_image) {
+      sub(legacy_image, replacement_image)
+      replacements++
+    }
+    { print }
+    END { exit(replacements == 1 ? 0 : 1) }
+  ' "$compose_file" >"$temp_file"; then
+    rm -f "$temp_file"
+    echo "❌ Could not update the bundled Valkey image. The original Compose file is unchanged."
+    return 1
+  fi
+
+  mv "$temp_file" "$compose_file"
+
+  if ! sudo docker compose -f "$compose_file" config >/dev/null; then
+    cp -p "$backup_file" "$compose_file"
+    echo "❌ The updated Compose file is invalid. Restored $compose_file from $backup_file."
+    return 1
+  fi
+
+  echo "✅ Updated bundled Valkey to the native amd64/arm64 image. Backup: $backup_file"
+}
+
 update_formbricks() {
   echo "🔄 Updating Formbricks..."
   cd formbricks
+  migrate_legacy_valkey_image docker-compose.yml
   sudo docker compose pull
   sudo docker compose down
   sudo docker compose up -d
diff --git a/docker/migrate-to-v4.sh b/docker/migrate-to-v4.sh
index 5c6161c57895..c2f98357a8f0 100755
--- a/docker/migrate-to-v4.sh
+++ b/docker/migrate-to-v4.sh
@@ -828,7 +828,7 @@ add_redis_service() {
     local redis_service_config="
   redis:
     restart: always
-    image: valkey/valkey@sha256:12ba4f45a7c3e1d0f076acd616cb230834e75a77e8516dde382720af32832d6d
+    image: valkey/valkey@sha256:e0eb7c480958d32bdc4357a74bdd70653ae15f2f9b4c93c4a5a9fad1dc471c84
     command: valkey-server --appendonly yes
     volumes:
       - redis:/data
diff --git a/docs/self-hosting/advanced/migration.mdx b/docs/self-hosting/advanced/migration.mdx
index 57000f2b5428..6381fdf164d5 100644
--- a/docs/self-hosting/advanced/migration.mdx
+++ b/docs/self-hosting/advanced/migration.mdx
@@ -6,15 +6,85 @@ icon: "arrow-right"
 
 ## v5.4
 
-v5.4 carries one breaking change, and it is narrow: it affects **API keys** used against the Feedback
-Records API or the MCP server, and nothing else. It needs no environment variables and no database
-migrations. If you do not use Unify Feedback, or you only reach it through the UI, there is nothing to do
-for it.
+v5.4 carries one application-level breaking change, and it is narrow: it affects **API keys** used against
+the Feedback Records API or the MCP server. It needs no environment variables and no database migrations.
+If you do not use Unify Feedback, or you only reach it through the UI, there is nothing to do for it.
 
 v5.4 also upgrades the **Better Auth** authentication core to 1.7. That upgrade needs no action at all:
 every migration is additive and applies automatically, and **your SSO callback URLs do not change** — see
 below.
 
+The bundled Valkey image moves from an amd64-only 8.1.1 image to the native amd64/arm64 Valkey 8.1.9 Alpine
+image. Fresh Docker and Helm installations receive it automatically. Existing installations that retain an
+older Compose file or explicitly reuse the previous Helm digest need the one-time update below.
+
+### Bundled Valkey 8.1.9 Upgrade (action required for some self-hosted deployments)
+
+The old bundled digest selects only `linux/amd64`. The new digest selects the matching native image on
+`linux/amd64` and `linux/arm64`, without requiring QEMU or `binfmt`. Valkey 8.1.9 also contains upstream
+security fixes that are not present in 8.1.1.
+
+<Warning>
+  Valkey stores sessions, queues, cache entries and rate-limit state in the named `redis` volume with AOF
+  enabled. Do not run `docker compose down -v`, delete the volume, or use `FLUSHDB` during this upgrade.
+  Recreating only the container preserves the volume. Expect a brief interruption while Valkey restarts.
+</Warning>
+
+<Tabs>
+  <Tab title="One-Click">
+    Download the current stable updater so it can migrate the exact old Valkey pin in your existing Compose
+    file. It creates `formbricks/docker-compose.yml.before-valkey-8.1.9`, validates the updated Compose file,
+    and restores the backup if validation fails. Custom Valkey images are left unchanged.
+
+    ```bash
+    curl -fsSL https://raw.githubusercontent.com/formbricks/formbricks/stable/docker/formbricks.sh \
+      -o formbricks.sh
+    chmod +x formbricks.sh
+    ./formbricks.sh update
+    ```
+  </Tab>
+  <Tab title="Docker Compose">
+    Back up your Compose file before changing it:
+
+    ```bash
+    cp docker-compose.yml docker-compose.yml.before-valkey-8.1.9
+    ```
+
+    Then replace the `redis` service's old image with the new multi-architecture index:
+
+    ```yaml
+    image: valkey/valkey@sha256:e0eb7c480958d32bdc4357a74bdd70653ae15f2f9b4c93c4a5a9fad1dc471c84
+    ```
+
+    Validate the file, then pull and recreate only Valkey:
+
+    ```bash
+    docker compose config >/dev/null
+    docker compose pull redis
+    docker compose up -d --no-deps --force-recreate redis
+    docker compose exec redis valkey-cli ping
+    docker compose exec redis valkey-server --version
+    redis_image_id=$(docker inspect --format '{{.Image}}' "$(docker compose ps -q redis)")
+    docker image inspect --format '{{.Architecture}}' "$redis_image_id"
+    ```
+  </Tab>
+  <Tab title="Helm">
+    A normal upgrade with the current chart uses the new default digest. If you explicitly set
+    `redis.image.digest`, pass a complete older values file, or use `--reuse-values`, override it during the
+    upgrade:
+
+    ```bash
+    helm upgrade formbricks formbricks/formbricks \
+      --reuse-values \
+      --set-string redis.image.repository=valkey/valkey \
+      --set-string redis.image.digest=sha256:e0eb7c480958d32bdc4357a74bdd70653ae15f2f9b4c93c4a5a9fad1dc471c84
+    ```
+
+    The Valkey StatefulSet rolls while its existing PVC remains attached. Check the rendered image and
+    `valkey-cli ping` after the rollout.
+  </Tab>
+</Tabs>
+
 ### Feedback Record Mutations by API Key (action required for some integrations)
 
 A feedback dataset can be assigned to more than one workspace, and the records inside it carry no workspace
diff --git a/docs/self-hosting/setup/one-click.mdx b/docs/self-hosting/setup/one-click.mdx
index 9c83fed3e594..aa3fba394078 100644
--- a/docs/self-hosting/setup/one-click.mdx
+++ b/docs/self-hosting/setup/one-click.mdx
@@ -319,21 +319,32 @@ Y
 
 ## Update
 
-To update Formbricks for a minor or patch release, run:
+To update Formbricks for a minor or patch release, first go to the directory that contains your
+`formbricks/` folder. Download the current stable updater there, replacing any older `formbricks.sh`, and
+then run it:
 
-```
+```bash
+curl -fsSL https://raw.githubusercontent.com/formbricks/formbricks/stable/docker/formbricks.sh \
+  -o formbricks.sh
+chmod +x formbricks.sh
 ./formbricks.sh update
 ```
 
 The script pulls the latest images, stops the running containers, and starts the stack again.
 
+Starting with v5.4, the updater also recognizes the old amd64-only bundled Valkey digest. It backs up your
+Compose file, replaces only that exact image reference with the native amd64/arm64 digest, and validates the
+result before pulling. An already-updated or custom Valkey image is left unchanged. The named `redis` volume
+and its AOF data are preserved.
+
 <Warning>
-  `./formbricks.sh update` does **not** rewrite your existing `formbricks/docker-compose.yml`. For a major
-  migration such as Formbricks 4.x to 5.0, follow the [migration guide](/self-hosting/advanced/migration#v5)
-  first, merge the current v5 Compose changes into your existing deployment, confirm `HUB_API_KEY` is set, and
-  only then run the update command. If your older one-click install also uses bundled MinIO for file uploads,
-  review that storage path separately before the first v5 restart; newer self-hosting updates move the bundled
-  object-storage path to RustFS, while external S3-compatible storage keeps the same `S3_*` app contract.
+  Apart from the exact v5.4 Valkey pin migration described above, `./formbricks.sh update` does **not** rewrite
+  your existing `formbricks/docker-compose.yml`. For a major migration such as Formbricks 4.x to 5.0, follow
+  the [migration guide](/self-hosting/advanced/migration#v5) first, merge the current v5 Compose changes into
+  your existing deployment, confirm `HUB_API_KEY` is set, and only then run the update command. If your older
+  one-click install also uses bundled MinIO for file uploads, review that storage path separately before the
+  first v5 restart; newer self-hosting updates move the bundled object-storage path to RustFS, while external
+  S3-compatible storage keeps the same `S3_*` app contract.
 
   The same applies to pinned third-party images. Because the update command only re-pulls what your Compose
   file already names, a bundled `rustfs` service stays on whatever version it was installed with — `docker
diff --git a/packages/config-eslint/next.mjs b/packages/config-eslint/next.mjs
index 70755795cef4..ea83ac7716c6 100644
--- a/packages/config-eslint/next.mjs
+++ b/packages/config-eslint/next.mjs
@@ -1,16 +1,50 @@
+import js from "@eslint/js";
 import nextConfig from "eslint-config-next";
-import { base, commonIgnores, typescriptParsing } from "./base.mjs";
+import tseslint from "typescript-eslint";
+import { base, commonIgnores, typescriptParsing, unusedVarsConvention } from "./base.mjs";
 
 /*
  * Flat config for the Next.js app — the successor of `legacy-next.js`:
  * eslint-config-next + turbo + prettier + the vitest convention, with the same rule
- * overrides the legacy config carried. Deliberately does not add the
- * eslint/typescript-eslint recommended baselines yet to keep rule parity with the
- * previous setup — tightening is a separate step (ENG-2264).
+ * overrides the legacy config carried.
+ *
+ * The eslint/typescript-eslint recommended baselines are active but downgraded to
+ * warnings (ENG-2264): apps/web was never linted against them, so the backlog is
+ * large and enabling them as errors in one step would block every PR. Rules are
+ * promoted to "error" individually as their violation count reaches zero — the
+ * per-rule counts and ratchet plan live on the ticket. `recommendedTypeChecked`
+ * (used by the library/react tiers) is a separate decision, also tracked there.
  */
+
+// The recommended baselines ship rules at "error"; keep their options but lower the
+// severity so the backlog surfaces without failing CI. "off" entries (e.g. the core
+// rules that eslint-recommended disables for TS files) pass through untouched.
+const isErrorSeverity = (severity) => severity === "error" || severity === 2;
+
+const downgradeToWarn = ({ rules, ...config }) => ({
+  ...config,
+  ...(rules && {
+    rules: Object.fromEntries(
+      Object.entries(rules).map(([id, entry]) => {
+        if (Array.isArray(entry)) {
+          const [severity, ...options] = entry;
+          return [id, isErrorSeverity(severity) ? ["warn", ...options] : entry];
+        }
+        return [id, isErrorSeverity(entry) ? "warn" : entry];
+      })
+    ),
+  }),
+});
+
 export const next = [
   commonIgnores,
   typescriptParsing,
+  downgradeToWarn(js.configs.recommended),
+  ...tseslint.configs.recommended.map(downgradeToWarn),
+  // Same underscore convention as the other tiers, at warning severity like the rest
+  // of the baseline; without the options, default no-unused-vars would flag the
+  // repo-sanctioned `_`-prefixed intentionally-unused bindings.
+  downgradeToWarn(unusedVarsConvention),
   ...nextConfig,
   {
     rules: {