diff --git a/apps/docs/app/contributing/ContributingToC.tsx b/apps/docs/app/contributing/ContributingToC.tsx
index 12b19d20dfc0f..5208a236516d7 100644
--- a/apps/docs/app/contributing/ContributingToC.tsx
+++ b/apps/docs/app/contributing/ContributingToC.tsx
@@ -39,7 +39,7 @@ export function ContributingToc({ className }: { className?: string }) {
         '[--local-top-spacing:5rem]',
         'border-l thin-scrollbar overflow-y-auto px-2 hidden lg:block',
         'col-span-3 self-start sticky',
-        'top-[calc(var(--header-height)+1px+2rem)] max-h-[calc(100vh-var(--header-height)-3rem)]',
+        'top-[calc(var(--header-height)+2rem)] max-h-[calc(100vh-var(--header-height)-3rem)]',
         className
       )}
     />
diff --git a/apps/docs/components/Navigation/NavigationMenu/TopNavBar.tsx b/apps/docs/components/Navigation/NavigationMenu/TopNavBar.tsx
index 3791cb923fa09..4e5312c909119 100644
--- a/apps/docs/components/Navigation/NavigationMenu/TopNavBar.tsx
+++ b/apps/docs/components/Navigation/NavigationMenu/TopNavBar.tsx
@@ -33,7 +33,7 @@ const TopNavBar: FC = () => {
     <>
       <nav
         aria-label="top bar"
-        className="w-full z-40 flex flex-col border-b backdrop-blur-sm backdrop-filter bg-default/75"
+        className="w-full z-40 flex flex-col subhighlight-border backdrop-blur-sm backdrop-filter bg-default/75"
       >
         <div className="w-full px-5 lg:pl-10 flex justify-between h-(--header-height) gap-3">
           <div className="hidden lg:flex h-full items-center justify-center gap-2">
diff --git a/apps/docs/content/_partials/api_keys_deprecation.mdx b/apps/docs/content/_partials/api_keys_deprecation.mdx
index 74a2dd173bbd4..994ccb70cdc15 100644
--- a/apps/docs/content/_partials/api_keys_deprecation.mdx
+++ b/apps/docs/content/_partials/api_keys_deprecation.mdx
@@ -1,12 +1,7 @@
 <Admonition type="deprecation" title="Changes to API keys">
 
-Supabase has changed the way keys work to improve project security and developer experience. You can [read the full announcement on GitHub](https://github.com/orgs/supabase/discussions/29260).
+Supabase is deprecating the `anon` and `service_role` keys by the end of 2026. Use the publishable (`sb_publishable_xxx`) and secret (`sb_secret_xxx`) keys instead. For the reasoning behind the change, see [the announcement on GitHub](https://github.com/orgs/supabase/discussions/29260).
 
-**They will be deprecated by the end of 2026, and you should now use the publishable (`sb_publishable_xxx`) and secret (`sb_secret_xxx`) keys instead**.
-
-In most cases, you can get keys from [the Project's **Connect** dialog](/dashboard/project/\_?showConnect=true&connectTab={{ .tab }}&framework={{ .framework }}), but if you want a specific key, you can find them in the [**Settings > API Keys**](/dashboard/project/_/settings/api-keys/) section of the Dashboard.
-
-- **For new keys**, open the **API Keys** tab, if you don't have a publishable key already, click **Create new API Keys**, and copy the value from the **Publishable key** section for client-side operations. For server-side operations, copy the value from the **Secret keys** section.
-- **For legacy keys**, copy the `anon` key for client-side operations and the `service_role` key for server-side operations from the **Legacy API Keys** tab.
+In most cases you can get keys from your project's [**Connect** dialog](/dashboard/project/\_?showConnect=true&connectTab={{ .tab }}&framework={{ .framework }}). For every way to retrieve a key, including the CLI and the Management API, refer to [Find your keys](/docs/guides/getting-started/api-keys#find-your-keys).
 
 </Admonition>
diff --git a/apps/docs/content/_partials/api_settings.mdx b/apps/docs/content/_partials/api_settings.mdx
index 9479f2e8fac64..95b1f9eb308bc 100644
--- a/apps/docs/content/_partials/api_settings.mdx
+++ b/apps/docs/content/_partials/api_settings.mdx
@@ -7,6 +7,6 @@ To interact with data in database tables, you use the client libraries that wrap
 
 <Admonition type="note">
 
-[Read the API keys docs](/docs/guides/getting-started/api-keys) for a full explanation of all key types, their uses, and where to find them.
+See [API keys](/docs/guides/getting-started/api-keys) for a full explanation of all key types, their uses, and where to find them.
 
 </Admonition>
diff --git a/apps/docs/content/_partials/metrics_access.mdx b/apps/docs/content/_partials/metrics_access.mdx
index 4f65008ed022c..d6f9043c3c923 100644
--- a/apps/docs/content/_partials/metrics_access.mdx
+++ b/apps/docs/content/_partials/metrics_access.mdx
@@ -22,7 +22,7 @@ className="rounded-lg border border-foreground/10 bg-surface-100 text-foreground
     3. Authenticate with HTTP Basic Auth:
 
     - **Username**: `service_role`
-    - **Password**: a **Secret API key** (`sb_secret_...`). You can create/copy it in [**Project Settings → API Keys**](/dashboard/project/_/settings/api-keys). For more context, see [Understanding API keys](/docs/guides/getting-started/api-keys).
+    - **Password**: a **Secret API key** (`sb_secret_...`). You can create/copy it in [**Project Settings → API Keys**](/dashboard/project/_/settings/api-keys). For more context, see [API keys](/docs/guides/getting-started/api-keys).
 
     To test locally, run `curl` with your Secret API key:
 
diff --git a/apps/docs/content/guides/api/creating-routes.mdx b/apps/docs/content/guides/api/creating-routes.mdx
index 154d9811c3e9d..111b702e222df 100644
--- a/apps/docs/content/guides/api/creating-routes.mdx
+++ b/apps/docs/content/guides/api/creating-routes.mdx
@@ -68,7 +68,7 @@ To do this, you need to get the Project URL and key from [the project's **Connec
 
 <$Partial path="api_keys_deprecation.mdx" variables={{ "framework": "{{ .framework }}", "tab": "{{ .tab }}" }} />
 
-[Read the API keys docs](/docs/guides/getting-started/api-keys) for a full explanation of all key types and their uses.
+See [API keys](/docs/guides/getting-started/api-keys) for a full explanation of all key types and their uses.
 
 The REST API is accessible through the URL `https://<project_ref>.supabase.co/rest/v1`
 
diff --git a/apps/docs/content/guides/auth/signing-keys.mdx b/apps/docs/content/guides/auth/signing-keys.mdx
index 97518c9618a47..5c36fb584ad8d 100644
--- a/apps/docs/content/guides/auth/signing-keys.mdx
+++ b/apps/docs/content/guides/auth/signing-keys.mdx
@@ -214,7 +214,7 @@ Finally, you can use your newly minted JWT by setting the `Authorization: Bearer
 
 <Admonition type="note">
 
-A separate `apikey` header is required to access your project's APIs. This can be a [publishable, secret or the legacy `anon` or `service_role` keys](/docs/guides/getting-started/api-keys). Using your minted JWT is not possible in this header.
+A separate `apikey` header is required to access your project's APIs. Use a publishable or secret key, or a legacy `anon` or `service_role` key. See [API keys](/docs/guides/getting-started/api-keys). Using your minted JWT is not possible in this header.
 
 </Admonition>
 
diff --git a/apps/docs/content/guides/getting-started/api-keys.mdx b/apps/docs/content/guides/getting-started/api-keys.mdx
index ee97ebbe184c4..2b4218f3aa232 100644
--- a/apps/docs/content/guides/getting-started/api-keys.mdx
+++ b/apps/docs/content/guides/getting-started/api-keys.mdx
@@ -1,141 +1,353 @@
 ---
 id: 'api-keys'
-title: 'Understanding API keys'
+title: 'API keys'
 description: "First-layer protection for your project's data"
 ---
 
-Supabase gives you fine-grained control over which application components are allowed to access your project through API keys.
+Every request to your Supabase project carries an API key. The key identifies what is calling your project: a web page, a mobile app, a server, or an Edge Function. [Supabase Auth](/docs/guides/auth) identifies who is calling, when someone is signed in.
 
-<Admonition type="note" title="Looking for your API Keys?">
+This guide covers:
 
-In most cases, you can get the correct key from [the Project's **Connect** dialog](/dashboard/project/_?showConnect=true), but if you want a specific key, you can find all keys in the [**Settings > API Keys**](/dashboard/project/_/settings/api-keys/) section of the Dashboard:
+- [Which key do you use?](#which-key-do-you-use) answers that in one table.
+- [How API keys work](#how-api-keys-work) explains what each key type is and which Postgres role it maps to.
+- [Find and use your keys](#find-and-use-your-keys) covers the ways to retrieve a key, wiring it into your code, and rotating one that leaked.
+- [Security reference](#security-reference) lists what publishable keys don't protect against, how to handle secret keys, and the known limitations.
 
-</Admonition>
+## Which key do you use?
 
-API keys provide the first layer of authentication for data access. Auth then builds upon that. This chart covers the differences:
+Pick the key by asking where the code runs.
 
-| Responsibility                     | Question                           | Answer                                             |
-| ---------------------------------- | ---------------------------------- | -------------------------------------------------- |
-| API keys                           | **What** is accessing the project? | Web page, mobile app, server, Edge Function...     |
-| [Supabase Auth](/docs/guides/auth) | **Who** is accessing the project?  | Monica, Jian Yang, Gavin, Dinesh, Laurie, Fiona... |
+| Where the code runs                                   | Use this key    | Because                                                               |
+| ----------------------------------------------------- | --------------- | --------------------------------------------------------------------- |
+| Anything you ship: browser, mobile app, CLI, script   | Publishable key | Anyone can read it, so it only reaches what Row Level Security allows |
+| Anything you control: server, Edge Function, cron job | Secret key      | It bypasses Row Level Security, so it must never leave your control   |
 
-## Overview
+Think of your project's data as a building. The publishable key is taped to the front door, and it only opens the lobby. The secret key is the master key, and it stays in your pocket.
 
-An API key authenticates an application component to give it access to Supabase services. An application component might be a web page, a mobile app, or a server. The API key _does not_ distinguish between users, only between applications.
+After you know which key you need, see [Find and use your keys](#find-and-use-your-keys) to get its value and wire it in. To swap keys in an application that already ships legacy keys, follow [Migrating to new API keys](/docs/guides/getting-started/migrating-to-new-api-keys) instead.
 
-There are 4 types of API keys that you can use with Supabase:
+<$Partial path="api_keys_deprecation.mdx" />
 
-| Type                                                       | Format                                                           | Privileges | Availability                                              | Use                                                                                                                                                                                                                                                                                               |
-| ---------------------------------------------------------- | ---------------------------------------------------------------- | ---------- | --------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Publishable&nbsp;key                                       | <span className="whitespace-nowrap!">`sb_publishable_...`</span> | Low        | Platform                                                  | Safe to expose online: web page, mobile or desktop app, GitHub actions, CLIs, source code.                                                                                                                                                                                                        |
-| Secret&nbsp;keys                                           | <span className="whitespace-nowrap!">`sb_secret_...`</span>      | Elevated   | Platform                                                  | **Only use in backend components of your app:** servers, already secured APIs (admin panels), [Edge Functions](/docs/guides/functions), microservices, etc. They provide _full access_ to your project's data, bypassing [Row Level Security](/docs/guides/database/postgres/row-level-security). |
-| <span className="whitespace-nowrap!">`anon`</span>         | JWT (long lived)                                                 | Low        | <span className="whitespace-nowrap!">Platform, CLI</span> | Legacy version of publishable keys.                                                                                                                                                                                                                                                               |
-| <span className="whitespace-nowrap!">`service_role`</span> | JWT (long lived)                                                 | Elevated   | <span className="whitespace-nowrap!">Platform, CLI</span> | Legacy version of secret keys.                                                                                                                                                                                                                                                                    |
+## How API keys work
 
-<Admonition type="note" title="Creating new keys does not revoke your legacy keys">
+### What an API key identifies
 
-Both key types work simultaneously. Creating publishable and secret keys adds them _alongside_ your existing `anon` and `service_role` keys without affecting them — your legacy keys keep working. They remain valid until you explicitly disable them in the [**Settings > API Keys**](/dashboard/project/_/settings/api-keys/) section of the Dashboard which is a separate step. See [Migrating to new API keys](/docs/guides/getting-started/migrating-to-new-api-keys) for the full process.
+An API key authenticates an application component to give it access to Supabase services. An application component might be a web page, a mobile app, or a server. An API key doesn't distinguish between users but between applications.
 
-</Admonition>
+API keys provide the first layer of authentication for data access. Supabase Auth builds on top of that. This table covers the difference:
 
-<$Partial path="api_keys_deprecation.mdx" />
+| Responsibility                     | Question                       | Answer                                                  |
+| ---------------------------------- | ------------------------------ | ------------------------------------------------------- |
+| API keys                           | What is accessing the project? | A web page, a mobile app, a server, or an Edge Function |
+| [Supabase Auth](/docs/guides/auth) | Who is accessing the project?  | An individual signed-in user                            |
+
+### Key types
+
+Supabase supports four types of API keys:
+
+| Type                                                       | Format                                                           | Privileges | Availability                                              | Use                                                                                                                                                                                                                                                                                                     |
+| ---------------------------------------------------------- | ---------------------------------------------------------------- | ---------- | --------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Publishable&nbsp;key                                       | <span className="whitespace-nowrap!">`sb_publishable_...`</span> | Low        | <span className="whitespace-nowrap!">Platform, CLI</span> | Safe to expose online: web page, mobile or desktop app, GitHub actions, CLIs, source code.                                                                                                                                                                                                              |
+| Secret&nbsp;keys                                           | <span className="whitespace-nowrap!">`sb_secret_...`</span>      | Elevated   | <span className="whitespace-nowrap!">Platform, CLI</span> | Only use in backend components of your app, such as servers, APIs with their own authorization checks, [Edge Functions](/docs/guides/functions), and microservices. They provide full access to your project's data, bypassing [Row Level Security](/docs/guides/database/postgres/row-level-security). |
+| <span className="whitespace-nowrap!">`anon`</span>         | JWT (long-lived)                                                 | Low        | <span className="whitespace-nowrap!">Platform, CLI</span> | Legacy version of publishable keys.                                                                                                                                                                                                                                                                     |
+| <span className="whitespace-nowrap!">`service_role`</span> | JWT (long-lived)                                                 | Elevated   | <span className="whitespace-nowrap!">Platform, CLI</span> | Legacy version of secret keys.                                                                                                                                                                                                                                                                          |
+
+Publishable and secret keys are short strings, not JWTs. If a tool, tutorial, or AI assistant tells you to copy a long key that begins with `eyJ`, it was written for the legacy keys.
+
+Running `supabase start` prints a publishable key and a secret key for your local project. The local secret key takes the place of the local `service_role` key. See the [CLI getting started guide](/docs/guides/local-development/cli/getting-started) for the full output.
+
+### Legacy `anon` and `service_role` keys
+
+Creating publishable and secret keys doesn't revoke your legacy keys. Both key systems work at the same time.
+
+Creating a publishable or secret key adds it alongside your existing `anon` and `service_role` keys without affecting them, so your legacy keys keep working. They stay valid until you disable them in the [**Settings > API Keys**](/dashboard/project/_/settings/api-keys/) section of the Dashboard, which is a separate step.
 
-## Publishable keys
+See [Migrating to new API keys](/docs/guides/getting-started/migrating-to-new-api-keys) for the full process.
 
-Publishable keys identify the public components of your application. Public components run in environments where it is impossible to secure any secrets. These include:
+### Publishable keys and public components
+
+Publishable keys identify the public components of your application. Public components run in environments where you can't keep a secret. These include:
 
 - Web pages, where the key is bundled in source code.
 - Mobile or desktop applications, where the key is bundled inside the compiled packages or executables.
 - CLI, scripts, tools, or other pre-built executables.
-- Other publicly available APIs that return the key without prior additional authorization.
+- Public APIs that return the key without requiring authorization first.
 
 These environments are always considered public because anyone can retrieve the key from the source code or build artifacts.
 
-### Interaction with Supabase Auth
+### Postgres roles and Row Level Security
 
-Using a publishable key does not mean that your user is anonymous. You can authenticate your application with the publishable key, while your user is authenticated (via Supabase Auth) with their personal JWT:
+Every key resolves to a built-in Postgres role, and that role is what your Row Level Security policies match on. Using a publishable key doesn't mean your user is anonymous: your application authenticates with the publishable key while your user authenticates separately through Supabase Auth with their own JWT.
 
-| Key             | User logged in via Supabase Auth | Postgres role used for RLS, etc. |
-| --------------- | -------------------------------- | -------------------------------- |
-| Publishable key | No                               | `anon`                           |
-| Publishable key | Yes                              | `authenticated`                  |
+| Key             | User signed in through Supabase Auth | Postgres role   |
+| --------------- | ------------------------------------ | --------------- |
+| Publishable key | No                                   | `anon`          |
+| Publishable key | Yes                                  | `authenticated` |
+| Secret key      | Not applicable                       | `service_role`  |
 
-### Security considerations
+Write your Row Level Security policies for the `anon` and `authenticated` roles. Policies never apply to a secret key, because `service_role` has the `BYPASSRLS` attribute.
 
-Publishable keys are not intended to protect from the following, since key retrieval is always possible from a public component:
+Postgres evaluates table grants first, and only then applies Row Level Security. The two failures look different. A missing grant returns a permission error, including for `service_role`, whereas a policy that matches no rows returns an empty result. Check the grant before you debug the policy. See [Securing your API](/docs/guides/api/securing-your-api#grants-and-rls).
 
-- Static or dynamic code analysis and reverse engineering attempts.
-- Use of the Network inspector in the browser.
-- Cross-site request forgery, cross-site scripting, phishing attacks.
-- Man-in-the-middle attacks.
+### Secret keys and elevated access
 
-When using a publishable key, access to your project's data is guarded by Postgres via the built-in `anon` and `authenticated` roles. For full protection make sure:
+Unlike publishable keys, secret keys allow elevated access to your project's data. Use them only in secure, developer-controlled components of your application, such as:
 
-- You have enabled Row Level Security on all tables.
-- You regularly review your Row Level Security policies for permissions granted to the `anon` and `authenticated` roles.
-- You do not modify the role's attributes without understanding the changes you are making.
+- Servers that run their own authorization checks, such as Edge Functions, microservices, and web servers.
+- Periodic jobs, queue processors, topic subscribers.
+- Admin and back-office tools that run authorization checks first.
+- Data processing pipelines, such as for analytics, reports, backups, or database synchronization.
 
-Your project's [Security Advisor](/dashboard/project/_/advisors/security) constantly checks for common security problems with the built-in Postgres roles. Make sure you carefully review each finding before dismissing it.
+<Admonition type="danger" title="A leaked secret key exposes all of your project's data">
 
-## What secret keys allow access to
+A secret key bypasses every Row Level Security policy you have. Never put one in a browser, a shipped application, or source control. For the full list of places a secret key must never go, see [Handling secret keys safely](#handling-secret-keys-safely).
 
-Unlike publishable keys, secret keys allow elevated access to your project's data. It is meant to be used only in secure, developer-controlled components of your application, such as:
+</Admonition>
 
-- Servers that implement prior authorization themselves, such as Edge Functions, microservices, traditional or specialized web servers.
-- Periodic jobs, queue processors, topic subscribers.
-- Admin and back-office tools, with prior authorization checks only.
-- Data processing pipelines, such as for analytics, reports, backups, or database synchronization.
+Secret keys authorize access to your project's data through the built-in `service_role` Postgres role. By design, this role has full access to your project's data. It also has the [`BYPASSRLS` attribute](https://www.postgresql.org/docs/current/ddl-rowsecurity.html#:~:text=BYPASSRLS), so it skips every Row Level Security policy you attach.
 
-<Admonition type="caution">
+Secret keys improve on the old JWT-based `service_role` key, and we recommend them wherever possible. They add checks that prevent misuse:
 
-Never expose your secret keys publicly. Your data is at risk. **Do not:**
+- A secret key doesn't work in a browser. Supabase matches on the `User-Agent` header and returns HTTP 401 Unauthorized.
+- A project doesn't need any secret keys if nothing uses them.
 
-- Add it to web pages, public documents, source code, bundle in executables or packages for mobile, desktop or CLI apps.
-- Send over chat applications, email or SMS to your peers.
-- Never use in a browser, even on `localhost`.
-- Do not pass in URLs or query params, as these are often logged.
-- Be careful passing them in request headers without prior log sanitization.
-- Take extra care logging even potentially **invalid API keys**. Typos might reveal the real key in the future.
-- Reveal, copy, use or manipulate on hardware devices without full disk encryption and which you do not directly own or control (such as public computers, friend's laptop, etc.)
+## Find and use your keys
 
-Ensure you handle them with care and using [secure coding practices](https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/stable-en/).
+Getting a key into an app has two halves. You copy the value, which needs a signed-in Dashboard session, and your code reads it by name. The key itself never belongs in source code, so start by setting these names in `.env`:
 
-</Admonition>
+```bash .env
+# Safe to expose to the browser. Prefix per your framework.
+NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
+NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=sb_publishable_...
+
+# Server-only. Never prefix these, or your bundler will ship the key.
+SUPABASE_URL=https://your-project.supabase.co
+SUPABASE_SECRET_KEY=sb_secret_...
+```
+
+### Find your keys
+
+Pick the path that matches where you are working.
+
+Every path below reads keys that already exist. If your project has no publishable or secret key yet, create them first in the [**Settings > API Keys**](/dashboard/project/_/settings/api-keys/) section of the Dashboard.
+
+<Tabs
+  scrollable
+  size="small"
+  type="underlined"
+  defaultActiveId="dashboard"
+  queryGroup="retrieval-method"
+>
+<TabPanel id="dashboard" label="Dashboard">
+
+Use the Dashboard when you are setting up a project by hand. It needs nothing but a signed-in session.
+
+1. Open your project's [**Connect** dialog](/dashboard/project/_?showConnect=true). It shows the URL and publishable key for the framework you select, ready to paste into `.env`.
+2. To pick a specific key, or to see every key your project has, open the [**Settings > API Keys**](/dashboard/project/_/settings/api-keys/) section of the Dashboard instead. Every key lives there, legacy or not, and there is no separate **Settings > API** page.
+3. Copy each value into `.env` under the variable names above.
+
+</TabPanel>
+<TabPanel id="cli" label="Supabase CLI">
+
+Use the CLI to script setup, or to read the keys for a preview branch. This path needs the Supabase CLI, so [install it](/docs/guides/local-development/cli/getting-started#installing-the-supabase-cli) first.
+
+1. Sign in, if you haven't already:
+
+   ```bash
+   supabase login
+   ```
+
+2. Find the project ref, if you don't know it:
+
+   ```bash
+   supabase projects list
+   ```
+
+3. List the keys for that project:
+
+   ```bash
+   supabase projects api-keys --project-ref your-project-ref
+   ```
+
+Pass the branch's own project ref to read the keys for a preview branch. A branch has its own keys, and the command returns the linked project's keys when you omit the flag.
+
+</TabPanel>
+<TabPanel id="management-api" label="Management API">
+
+Use the Management API to fetch keys from your own tooling, such as a deploy script or an internal provisioning service.
+
+Authenticate with a [personal access token](/dashboard/account/tokens). An OAuth application needs the `secrets:read` scope, and a fine-grained token needs the `api_gateway_keys_read` permission. Without either, the request returns 403 Forbidden.
+
+```bash
+export PROJECT_REF="your-project-ref"
+export SUPABASE_ACCESS_TOKEN="your-personal-access-token"
+
+curl -X GET "https://api.supabase.com/v1/projects/$PROJECT_REF/api-keys?reveal=true" \
+  -H "Authorization: Bearer $SUPABASE_ACCESS_TOKEN" \
+  | jq '.[] | {name, type}'
+```
+
+`reveal=true` includes the key values in the response, and this `jq` filter drops them again so they stay out of your terminal. Write the values straight into your secret store rather than printing them, because anything on standard output lands in your CI logs. See [Get project API keys](/docs/reference/api/v1-get-project-api-keys) for the full response.
+
+</TabPanel>
+<TabPanel id="local" label="Local stack">
+
+A local stack mints its own keys. They are unrelated to your hosted project's keys, so a local key never grants access to your hosted data.
+
+This path needs the Supabase CLI and a container runtime. See [Running a local Supabase project](/docs/guides/local-development/cli/getting-started#running-a-local-supabase-project) for both.
+
+1. Start the stack:
+
+   ```bash
+   supabase start
+   ```
+
+   The publishable and secret keys are in the output, under **Authentication Keys**.
+
+2. Print them again at any time while the stack is running:
+
+   ```bash
+   supabase status
+   ```
+
+</TabPanel>
+</Tabs>
+
+### Use a publishable key in client code
+
+Pass the publishable key to `createClient` in any code that reaches a user's device.
+
+```ts lib/supabase.ts
+import { createClient } from '@supabase/supabase-js'
+
+export const supabase = createClient(
+  process.env.NEXT_PUBLIC_SUPABASE_URL!,
+  process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY!
+)
+```
+
+Row Level Security decides what this client can reach, so enable it on every table before you deploy.
+
+### Use a secret key in backend code
+
+Pass the secret key to `createClient` only in code that never reaches a user's device, such as a server route or a worker.
+
+```ts server/supabase.ts
+import { createClient } from '@supabase/supabase-js'
+
+export const supabaseAdmin = createClient(
+  process.env.SUPABASE_URL!,
+  process.env.SUPABASE_SECRET_KEY!
+)
+```
+
+#### Inside an Edge Function
+
+Don't read the key from the environment inside an Edge Function. Use the [`@supabase/server`](/docs/guides/functions/auth) SDK instead. It verifies the caller's secret key for you and hands back a privileged client on `ctx`, so the key never appears in your code.
+
+```ts supabase/functions/roster/index.ts
+import { withSupabase } from 'npm:@supabase/server'
+
+export default {
+  fetch: withSupabase({ auth: 'secret' }, async (_req, ctx) => {
+    // ctx.supabaseAdmin bypasses Row Level Security
+    const { data } = await ctx.supabaseAdmin.from('profiles').select('email')
+    return Response.json({ data })
+  }),
+}
+```
+
+Set `verify_jwt = false` for a function called with a secret key rather than a user's token.
+
+```toml supabase/config.toml
+[functions.roster]
+verify_jwt = false
+```
+
+If you build the client yourself instead of using the SDK, read the key from `SUPABASE_SECRET_KEYS`. The runtime injects it as a JSON dictionary keyed by key name, so pick the one you want.
+
+```ts supabase/functions/roster/index.ts
+import { createClient } from 'npm:@supabase/supabase-js@2'
+
+const secretKeys = JSON.parse(Deno.env.get('SUPABASE_SECRET_KEYS')!)
+
+const supabaseAdmin = createClient(Deno.env.get('SUPABASE_URL')!, secretKeys['default'])
+```
+
+`SUPABASE_ANON_KEY` and `SUPABASE_SERVICE_ROLE_KEY` still exist in the runtime, but they carry the legacy keys, so reading them keeps you on the deprecated path. See [Environment Variables](/docs/guides/functions/secrets) for the full list of injected variables.
+
+If you are replacing legacy keys in an existing application rather than starting fresh, follow [Migrating to new API keys](/docs/guides/getting-started/migrating-to-new-api-keys).
+
+### Rotate a leaked or compromised key [#leaked-key]
+
+This procedure covers both a leaked secret key and a leaked `service_role` key.
+
+Don't rush. Fix the root cause of the leak before you rotate anything. The [OWASP Risk Rating Methodology](https://owasp.org/www-community/OWASP_Risk_Rating_Methodology) helps you judge the severity of the incident and plan your next steps.
+
+1. Create a new secret key in the [**Settings > API Keys**](/dashboard/project/_/settings/api-keys/) section of the Dashboard.
+2. Replace the compromised key with the new one everywhere your application uses it. If the compromised key is a JWT-based `service_role` key, replace it with the new secret key.
+3. Confirm that every component now uses the new key.
+4. Retire the compromised key. Delete a secret key, which can't be undone, so don't start until step 3 is done. For a legacy `anon` or `service_role` key, deactivate the legacy keys in the same Dashboard section instead. Deactivation is reversible, so you can re-enable them if you find a client you missed.
+
+## Security reference
+
+### What publishable keys don't protect against
+
+Publishable keys aren't intended to protect against the following, because anyone can retrieve a key from a public component:
+
+- Static or dynamic code analysis and reverse engineering attempts.
+- Use of the Network inspector in the browser.
+- Cross-site request forgery, cross-site scripting, phishing attacks.
+- Man-in-the-middle attacks.
+
+When you use a publishable key, Postgres guards access to your project's data through the built-in `anon` and `authenticated` roles. For full protection, confirm that:
+
+- You have enabled Row Level Security on all tables.
+- You regularly review your Row Level Security policies for permissions granted to the `anon` and `authenticated` roles.
+- You don't change the roles' attributes without understanding what the change does.
+
+Your project's [Security Advisor](/dashboard/project/_/advisors/security) checks for common security problems with the built-in Postgres roles. Review each finding carefully before you dismiss it.
+
+### Handling secret keys safely
+
+Exposing a secret key puts all of your project's data at risk. The rules below are grouped by the kind of mistake they prevent.
 
-Secret keys authorize access to your project's data via the built-in `service_role` Postgres role. By design, this role has full access to your project's data. It also uses the [`BYPASSRLS` attribute](https://www.postgresql.org/docs/current/ddl-rowsecurity.html#:~:text=BYPASSRLS), skipping any and all Row Level Security policies you attach.
+**Where a secret key must never appear**
 
-The secret key is an improvement over the old JWT-based `service_role` key, and we recommend using it where possible. It adds more checks to prevent misuse, specifically:
+- A web page, a public document, source code, or a bundled mobile, desktop, or CLI package.
+- A browser, even on `localhost`.
 
-- You cannot use a secret key in the browser (matches on the `User-Agent` header) and it will always reply with HTTP 401 Unauthorized.
-- You don't need to have any secret keys if you are not using them.
+**How a secret key must never travel**
 
-### Best practices for handling secret keys
+- Over chat, email, or SMS.
+- In a URL or a query parameter, because those are often logged.
+- In a request header, until you have log sanitization in place.
+- Over plain HTTP, or to any host other than your project's Supabase endpoint.
 
-Below are some starting guidelines on how to securely work with secret keys:
+**What must never be written down**
 
-- Always work with secret keys on computers you fully own or control.
-- Use secure & encrypted send tools to share API keys with others (often provided by good password managers), but prefer the [**Settings > API Keys**](/dashboard/project/_/settings/api-keys/) section of the Dashboard instead.
-- Prefer encrypting them when stored in files or environment variables.
-- Do not add in source control, especially for CI scripts and tools. Prefer using the tool's native secrets capability instead.
-- Prefer using a separate secret key for each separate backend component of your application, so that if one is found to be vulnerable or to have leaked the key you will only need to change it and not all.
-- Even though a secret key will always return HTTP 401 Unauthorized error when used in a browser, it does not mean that attackers will not use it with other tools. Delete immediately!
-- If you must include them in logs, log the first few random characters (but never more than 6).
-- If you wish to log or store which valid API key was used, store it as a SHA256 hash.
+- Don't log a key, even one that looks invalid. A typo today can reveal the real key later.
+- If you must record a key, log no more than 6 characters from the random part after its prefix.
+- To record which key was used, store a SHA256 hash of it instead.
 
-### What to do if a secret key or `service_role` has been leaked or compromised?
+**Storing and sharing a secret key**
 
-Don't rush if this has happened, or you are suspecting it has. Make sure you have fully considered the situation and have remediated the root cause of the suspicion or vulnerability **first**. Consider using the [OWASP Risk Rating Methodology](https://owasp.org/www-community/OWASP_Risk_Rating_Methodology) as an easy way to identify the severity of the incident and to plan your next steps.
+- Work with secret keys only on computers you fully own or control.
+- Encrypt keys stored in files or environment variables.
+- Keep keys out of source control, including CI scripts. Use the tool's own secrets storage instead.
+- Share keys through an encrypted transfer tool, such as the one in your password manager. Better still, have the other person read the key from the [**Settings > API Keys**](/dashboard/project/_/settings/api-keys/) section of the Dashboard.
 
-To rotate a secret key (`sb_secret_...`), use the [**Settings > API Keys**](/dashboard/project/_/settings/api-keys/) section of the Dashboard to create a new secret API key, then replace it with the compromised key. Once all components are using the new key, delete the compromised one.
+**Limiting the damage of a leak**
 
-**Deleting a secret key is irreversible and once done it will be gone forever.**
+- Use a separate secret key for each backend component. If one component leaks its key, you only rotate that one.
+- Delete a leaked key immediately. The browser block returns HTTP 401 Unauthorized, but an attacker can still use the key from other tools.
 
-If you are still using the JWT-based `service_role` key, replace the `service_role` key with a new secret key instead. Follow the guide from above as if you are rotating an existing secret key.
+Handle secret keys using [secure coding practices](https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/stable-en/).
 
-## Known limitations and compatibility differences
+### Known limitations
 
-As the publishable and secret keys are no longer JWT-based, there are some known limitations and compatibility differences that you may need to plan for:
+Publishable and secret keys aren't JWTs, which creates a few compatibility differences to plan for:
 
-- You cannot send a publishable or secret key in the `Authorization: Bearer ...` header, except if the value exactly equals the `apikey` header. In this case, your request will be forwarded down to your project's database, but will be rejected as the value is not a JWT.
-- Edge Functions **only support JWT verification** via the `anon` and `service_role` JWT-based API keys. You will need to use the `--no-verify-jwt` option when using publishable and secret keys. The Supabase platform does not verify the `apikey` header when using Edge Functions in this way. Implement your own `apikey`-header authorization logic inside the Edge Function code itself.
-- Public Realtime connections are limited to 24 hours in duration, unless the connection is upgraded and further maintained with user-level authentication via Supabase Auth or a supported Third-Party Auth provider.
+- Send publishable and secret keys on the `apikey` header, not on `Authorization: Bearer`. Because the keys aren't JWTs, anything that tries to verify one as a JWT fails. For migration compatibility the `verify_jwt` platform check accepts them on either header, but passing that check doesn't authenticate the caller. See [Authorization headers](/docs/guides/functions/auth-headers).
+- Edge Functions need to authorize API keys in code. The `verify_jwt` check alone doesn't authenticate a caller that sends only an API key. Use the `@supabase/server` SDK, as shown in [Securing Edge Functions](/docs/guides/functions/auth), rather than relying on the platform check.
+- Public Realtime connections last a maximum of 24 hours, unless the connection is upgraded to user-level authentication through Supabase Auth or a supported third-party auth provider.
diff --git a/apps/docs/content/guides/getting-started/migrating-to-new-api-keys.mdx b/apps/docs/content/guides/getting-started/migrating-to-new-api-keys.mdx
index 8ad184491b256..66bec46fce7b0 100644
--- a/apps/docs/content/guides/getting-started/migrating-to-new-api-keys.mdx
+++ b/apps/docs/content/guides/getting-started/migrating-to-new-api-keys.mdx
@@ -17,7 +17,7 @@ The migration maps onto your existing keys:
 | `anon`         | Publishable key | Browsers, mobile and desktop apps, CLIs, public source |
 | `service_role` | Secret key      | Servers, Edge Functions, workers, other backend code   |
 
-For a full explanation of each key type, read [the Understanding API keys guide](/docs/guides/getting-started/api-keys).
+For a full explanation of each key type, see [API keys](/docs/guides/getting-started/api-keys).
 
 ## Step 1: Create the new API keys
 
@@ -210,8 +210,8 @@ Once you've confirmed nothing uses the legacy keys, deactivate them in the [**Se
 
 A few behaviors differ from the legacy JWT-based keys. Plan for them during the migration:
 
-- You can't send a publishable or secret key in the `Authorization: Bearer ...` header. Send it on the `apikey` header instead.
-- Edge Functions don't verify the `apikey` header for the new keys. Use `verify_jwt = false` and authorize in code, as shown in [Step 4](#step-4-update-edge-functions).
+- Send publishable and secret keys on the `apikey` header. For migration compatibility the `verify_jwt` check also accepts them on `Authorization: Bearer ...`, but passing that check doesn't authenticate the caller, and the keys aren't JWTs, so nothing downstream can verify them as one.
+- Edge Functions need to authorize API keys in code. The `verify_jwt` platform check alone doesn't authenticate a caller that sends only an API key, so authorize the key in your handler, as shown in [Step 4](#step-4-update-edge-functions).
 - Public Realtime connections are limited to 24 hours unless the connection is upgraded with user-level authentication through Supabase Auth or a supported third-party auth provider.
 
 ## Next steps
diff --git a/apps/docs/content/guides/self-hosting/self-hosted-auth-keys.mdx b/apps/docs/content/guides/self-hosting/self-hosted-auth-keys.mdx
index 9f98e695048b7..4df2feab11a5b 100644
--- a/apps/docs/content/guides/self-hosting/self-hosted-auth-keys.mdx
+++ b/apps/docs/content/guides/self-hosting/self-hosted-auth-keys.mdx
@@ -4,7 +4,7 @@ description: 'Configure new API keys and ES256 asymmetric authentication for sel
 subtitle: 'Configure new API keys and ES256 asymmetric authentication for self-hosted Supabase.'
 ---
 
-You can configure self-hosted Supabase to use the [new API keys](/docs/guides/getting-started/api-keys) alongside the legacy API keys (`ANON_KEY` and `SERVICE_ROLE_KEY` HS256-signed JWTs).
+You can configure self-hosted Supabase to use the [publishable and secret API keys](/docs/guides/getting-started/api-keys) alongside the legacy API keys (`ANON_KEY` and `SERVICE_ROLE_KEY` HS256-signed JWTs).
 
 ## Before you begin
 
@@ -77,7 +77,7 @@ sh run.sh recreate
 
 ### New API keys format
 
-The new API keys use the [same format](/docs/guides/getting-started/api-keys) as the Supabase platform:
+These keys use the same format as [API keys](/docs/guides/getting-started/api-keys) on the Supabase platform:
 
 ```
 sb_publishable_<22-char-random>_<8-char-checksum>
@@ -204,7 +204,7 @@ For details on how the API gateway routes and authenticates requests, see the [E
 
 ## Additional resources
 
-- [Understanding API keys](/docs/guides/getting-started/api-keys) - How API keys work on the Supabase platform
+- [API keys](/docs/guides/getting-started/api-keys) - How API keys work on the Supabase platform
 - [Auth architecture](/docs/guides/auth/architecture) - How the Auth service handles authentication and token signing
 - [JWT Signing Keys](/docs/guides/auth/signing-keys) - Best practices on managing keys used by Supabase Auth to create and verify JSON Web Tokens
 - [JSON Web Token (JWT)](/docs/guides/auth/jwts) - How to best use JSON Web Tokens with Supabase
diff --git a/apps/docs/content/troubleshooting/rotating-anon-service-and-jwt-secrets-1Jq6yd.mdx b/apps/docs/content/troubleshooting/rotating-anon-service-and-jwt-secrets-1Jq6yd.mdx
index 4330540795f43..00f81f3687760 100644
--- a/apps/docs/content/troubleshooting/rotating-anon-service-and-jwt-secrets-1Jq6yd.mdx
+++ b/apps/docs/content/troubleshooting/rotating-anon-service-and-jwt-secrets-1Jq6yd.mdx
@@ -9,7 +9,7 @@ database_id = "caa72a34-696c-47c6-8976-e50cf7fb396e"
 
 <Admonition type="deprecation">
 
-This troubleshooting guide is about rotating **Legacy anon, service_role API keys**. We are deprecating Legacy, and recommend migrating to New API keys. To learn more about API keys, refer to [the API documentation](/docs/guides/getting-started/api-keys).
+This troubleshooting guide is about rotating **Legacy anon, service_role API keys**. We are deprecating Legacy, and recommend migrating to New API keys. To learn more about API keys, refer to [API keys](/docs/guides/getting-started/api-keys).
 
 </Admonition>
 
@@ -38,5 +38,5 @@ If you have migrated to new symmetric JWT signing keys:
 
 ## Further readings
 
-- [What to do if a secret key or service_role has been leaked or compromised?](/docs/guides/getting-started/api-keys#what-to-do-if-a-secret-key-or-servicerole-has-been-leaked-or-compromised)
+- [Rotate a leaked or compromised key](/docs/guides/getting-started/api-keys#leaked-key)
 - [JWT Signing Keys](/docs/guides/auth/signing-keys)
diff --git a/apps/docs/content/troubleshooting/why-is-my-service-role-key-client-getting-rls-errors-or-not-returning-data-7_1K9z.mdx b/apps/docs/content/troubleshooting/why-is-my-service-role-key-client-getting-rls-errors-or-not-returning-data-7_1K9z.mdx
index 3bf968d6cd020..f7d76a6f4e680 100644
--- a/apps/docs/content/troubleshooting/why-is-my-service-role-key-client-getting-rls-errors-or-not-returning-data-7_1K9z.mdx
+++ b/apps/docs/content/troubleshooting/why-is-my-service-role-key-client-getting-rls-errors-or-not-returning-data-7_1K9z.mdx
@@ -10,7 +10,7 @@ database_id = "677f0a69-e454-4718-ad92-91053d40c085"
 <Admonition type="deprecation">
 
 This troubleshooting guide is about rotating **Legacy anon, service_role API keys**. We are deprecating the Legacy API keys, and recommend migrating to New API keys. To learn more about API
-keys, refer to [the API documentation](/docs/guides/getting-started/api-keys).
+keys, refer to [API keys](/docs/guides/getting-started/api-keys).
 
 </Admonition>
 
diff --git a/apps/docs/features/docs/GuidesMdx.template.tsx b/apps/docs/features/docs/GuidesMdx.template.tsx
index 0a3786630b6a7..142ecea3b7264 100644
--- a/apps/docs/features/docs/GuidesMdx.template.tsx
+++ b/apps/docs/features/docs/GuidesMdx.template.tsx
@@ -143,10 +143,9 @@ const GuideTemplate = ({
             'sticky',
             /**
              * --header-height: height of nav
-             * 1px: height of nav border
              * 3rem: content padding
              */
-            'top-[calc(var(--header-height)+1px+3rem)]',
+            'top-[calc(var(--header-height)+3rem)]',
             // 4rem accounts for 3rem of top padding + 1rem of extra breathing room
             'max-h-[calc(100vh-var(--header-height)-4rem)]'
           )}
diff --git a/apps/docs/features/ui/guide/Guide.tsx b/apps/docs/features/ui/guide/Guide.tsx
index 6c586e9297b48..f60bc0da19a22 100644
--- a/apps/docs/features/ui/guide/Guide.tsx
+++ b/apps/docs/features/ui/guide/Guide.tsx
@@ -53,10 +53,9 @@ export function Guide({ meta, children, className }: GuideProps) {
                 'sticky',
                 /**
                  * --header-height: height of nav
-                 * 1px: height of nav border
                  * 3rem: content padding
                  */
-                'top-[calc(var(--header-height)+1px+3rem)]',
+                'top-[calc(var(--header-height)+3rem)]',
                 // 4rem accounts for 3rem of top padding + 1rem of extra breathing room
                 'max-h-[calc(100vh-var(--header-height)-4rem)]'
               )}
diff --git a/apps/docs/layouts/MainSkeleton.tsx b/apps/docs/layouts/MainSkeleton.tsx
index 5ae70b4386cd9..0799e49106f98 100644
--- a/apps/docs/layouts/MainSkeleton.tsx
+++ b/apps/docs/layouts/MainSkeleton.tsx
@@ -324,11 +324,11 @@ const NavContainer = memo(function NavContainer({ children }: PropsWithChildren)
     >
       <div
         className={cn(
-          'top-0 lg:top-(--header-height)',
+          'top-0',
           'h-full',
-          'relative lg:sticky',
+          'relative',
           'w-full lg:w-auto',
-          'h-fit lg:h-screen overflow-y-scroll lg:overflow-auto',
+          'h-fit lg:h-full overflow-y-scroll lg:overflow-auto',
           'overscroll-contain',
           'backdrop-blur-sm backdrop-filter bg-background',
           'flex flex-col grow'
diff --git a/apps/docs/layouts/ref/RefSubLayout.tsx b/apps/docs/layouts/ref/RefSubLayout.tsx
index e30ed7989fe82..761ea65fb3e69 100644
--- a/apps/docs/layouts/ref/RefSubLayout.tsx
+++ b/apps/docs/layouts/ref/RefSubLayout.tsx
@@ -122,7 +122,7 @@ const StickyHeader: FC<StickyHeader> = ({ icon, ...props }) => {
           id={props.slug}
           data-ref-id={props.id}
           className={cn(
-            'text-2xl font-medium text-foreground scroll-mt-[calc(32px+2rem)] lg:scroll-mt-[calc(var(--header-height)+1px+4rem)]',
+            'text-2xl font-medium text-foreground scroll-mt-[calc(32px+2rem)] lg:scroll-mt-[calc(var(--header-height)+4rem)]',
             !icon && 'mb-8',
             props.monoFont && 'font-mono'
           )}
diff --git a/apps/www/_go/events/select-2026/vip-dinner-thank-you.tsx b/apps/www/_go/events/select-2026/vip-dinner-thank-you.tsx
deleted file mode 100644
index b5da7f4b01a04..0000000000000
--- a/apps/www/_go/events/select-2026/vip-dinner-thank-you.tsx
+++ /dev/null
@@ -1,34 +0,0 @@
-import type { GoPageInput } from 'marketing'
-import Link from 'next/link'
-import { Button } from 'ui'
-
-const page: GoPageInput = {
-  template: 'thank-you',
-  slug: 'select-2026/vip-dinner/thank-you',
-  metadata: {
-    title: "You're confirmed | Supabase VIP Dinner",
-    description:
-      'Your RSVP for the Supabase VIP dinner at Flour + Water in San Francisco on October 1, 2026 has been confirmed. Cocktails begin at 7:00 PM and dinner starts at 7:30 PM.',
-  },
-  hero: {
-    title: "You're confirmed",
-    description:
-      "We'll see you at Flour + Water in San Francisco on October 1, 2026. Cocktails begin at 7:00 PM and dinner starts at 7:30 PM. We look forward to seeing you.",
-  },
-  sections: [
-    {
-      type: 'single-column',
-      title: 'In the meantime',
-      description: 'Learn more about what we are building at Supabase.',
-      children: (
-        <div className="flex items-center justify-center gap-4">
-          <Button asChild variant="default" size="small">
-            <Link href="https://supabase.com">Visit supabase.com</Link>
-          </Button>
-        </div>
-      ),
-    },
-  ],
-}
-
-export default page
diff --git a/apps/www/_go/events/select-2026/vip-dinner.tsx b/apps/www/_go/events/select-2026/vip-dinner.tsx
deleted file mode 100644
index 2165bf8afc935..0000000000000
--- a/apps/www/_go/events/select-2026/vip-dinner.tsx
+++ /dev/null
@@ -1,194 +0,0 @@
-import type { GoPageInput } from 'marketing'
-import Image from 'next/image'
-import { cn } from 'ui'
-
-import authors from '@/lib/authors.json'
-
-const sugu = authors.find((a) => a.author_id === 'sugu_sougoumarane')
-const paul = authors.find((a) => a.author_id === 'paul_copplestone')
-const ant = authors.find((a) => a.author_id === 'ant_wilson')
-const deepthi = authors.find((a) => a.author_id === 'deepthi_sigireddi')
-
-const hosts = [paul, ant, sugu, deepthi]
-
-const page: GoPageInput = {
-  template: 'lead-gen',
-  slug: 'select-2026/vip-dinner',
-  metadata: {
-    title: 'VIP Dinner | Supabase Select 2026',
-    description:
-      'Join Supabase leaders for an intimate dinner at Flour + Water in San Francisco on October 1, 2026. Cocktails at 7:00 PM, dinner at 7:30 PM.',
-  },
-  hero: {
-    title: 'The future of scalable databases',
-    subtitle: 'An intimate VIP dinner hosted by Supabase',
-    description:
-      'Join Supabase product and engineering leaders for a dinner conversation about where Postgres is headed -- from scaling beyond single-node limits to managing globally distributed workloads. Expect sharp perspectives, good food, and the opportunity to connect with other engineering leaders.',
-    image: {
-      src: '/images/landing-pages/select-2026/flourwater.jpg',
-      alt: 'Private dining room at Flour + Water, San Francisco',
-      width: 600,
-      height: 450,
-    },
-    ctas: [
-      {
-        label: 'Reserve your seat',
-        href: '#rsvp',
-        variant: 'primary',
-      },
-    ],
-  },
-  sections: [
-    {
-      type: 'single-column',
-      title: 'Details',
-      children: (
-        <div className="flex flex-col items-center gap-2 text-foreground-light">
-          <p className="text-lg font-medium text-foreground">Date</p>
-          <p>October 1, 2026</p>
-          <p className="mt-4 text-lg font-medium text-foreground">Location</p>
-          <p>Flour + Water</p>
-          <p>San Francisco, CA</p>
-          <p className="mt-4 text-lg font-medium text-foreground">Schedule</p>
-          <p>7:00 PM — Cocktails and introductions</p>
-          <p>7:30 PM — Dinner and discussion</p>
-        </div>
-      ),
-    },
-    {
-      type: 'single-column',
-      title: 'Your hosts',
-      children: (
-        <div className="border border-muted rounded-xl overflow-hidden">
-          <div className="grid grid-cols-1 sm:grid-cols-2">
-            {hosts.map((host, i) => (
-              <div
-                key={host?.author_id ?? i}
-                className={cn(
-                  'flex flex-col items-center gap-4 p-6 sm:p-8 text-center',
-                  i % 2 === 0 && 'sm:border-r border-muted',
-                  i < 2 && 'sm:border-b border-muted',
-                  i < hosts.length - 1 && 'max-sm:border-b max-sm:border-muted'
-                )}
-              >
-                {host?.author_image_url && (
-                  <Image
-                    src={host.author_image_url}
-                    alt={host.author}
-                    width={192}
-                    height={192}
-                    className="rounded-full object-cover aspect-square w-48 h-48"
-                  />
-                )}
-                <div className="flex flex-col items-center gap-0">
-                  <p className="text-foreground font-medium text-base">{host?.author}</p>
-                  <p className="text-foreground-lighter text-sm mt-2 leading-relaxed">
-                    {host?.position && `${host.position}, `}Supabase
-                  </p>
-                </div>
-              </div>
-            ))}
-          </div>
-        </div>
-      ),
-    },
-    {
-      type: 'form',
-      id: 'rsvp',
-      title: 'Reserve your seat',
-      description: "Space is limited. Let us know you're coming.",
-      fields: [
-        {
-          type: 'text',
-          name: 'first_name',
-          label: 'First Name',
-          placeholder: 'First Name',
-          required: true,
-          half: true,
-        },
-        {
-          type: 'text',
-          name: 'last_name',
-          label: 'Last Name',
-          placeholder: 'Last Name',
-          required: true,
-          half: true,
-        },
-        {
-          type: 'email',
-          name: 'email_address',
-          label: 'Email',
-          placeholder: 'Work email',
-          required: true,
-        },
-        {
-          type: 'text',
-          name: 'company_name',
-          label: 'Company',
-          placeholder: 'ACME, Inc.',
-          required: true,
-        },
-        {
-          type: 'text',
-          name: 'job_title',
-          label: 'Job Title',
-          placeholder: 'VP of Engineering',
-          required: false,
-        },
-        {
-          type: 'text',
-          name: 'phone_number',
-          label: 'Phone Number',
-          placeholder: '+1 212 555 1212',
-          required: false,
-        },
-        {
-          type: 'select',
-          name: 'attending',
-          label: 'Are you attending Select 2026?',
-          placeholder: 'Select an option',
-          required: true,
-          options: [
-            { label: 'Yes', value: 'Yes' },
-            { label: 'No', value: 'No' },
-          ],
-        },
-      ],
-      submitLabel: 'Confirm RSVP',
-      successRedirect: '/go/select-2026/vip-dinner/thank-you',
-      disclaimer:
-        'By submitting this form, I confirm that I have read and understood the [Privacy Policy](https://supabase.com/privacy).',
-      crm: {
-        hubspot: {
-          formGuid: 'd0699f2e-225a-4224-91b5-341fb5336613',
-          fieldMap: {
-            first_name: 'firstname',
-            last_name: 'lastname',
-            email_address: 'email',
-            company_name: 'company',
-            job_title: 'jobtitle',
-            phone_number: 'phone',
-          },
-          // `attending` is a Notion-only field — keep it out of the HubSpot payload.
-          excludeFields: ['attending'],
-          consent:
-            'By submitting this form, I confirm that I have read and understood the Privacy Policy.',
-        },
-        notion: {
-          database_id: '37d5004b775f809e8cc4e29fdec302aa',
-          columnMap: {
-            first_name: 'First Name',
-            last_name: 'Last Name',
-            email_address: 'Email',
-            company_name: 'Company',
-            job_title: 'Job Title',
-            phone_number: 'Phone Number',
-            attending: 'Attending',
-          },
-        },
-      },
-    },
-  ],
-}
-
-export default page
diff --git a/apps/www/_go/events/select-2026/vip-experience.tsx b/apps/www/_go/events/select-2026/vip-experience.tsx
index a51eadb4d56ce..fd96755622cb6 100644
--- a/apps/www/_go/events/select-2026/vip-experience.tsx
+++ b/apps/www/_go/events/select-2026/vip-experience.tsx
@@ -1,11 +1,15 @@
 import type { GoPageInput } from 'marketing'
 import Image from 'next/image'
+import { cn } from 'ui'
 
 import authors from '@/lib/authors.json'
 
 const sugu = authors.find((a) => a.author_id === 'sugu_sougoumarane')
 const paul = authors.find((a) => a.author_id === 'paul_copplestone')
 const ant = authors.find((a) => a.author_id === 'ant_wilson')
+const deepthi = authors.find((a) => a.author_id === 'deepthi_sigireddi')
+
+const hosts = [paul, ant, sugu, deepthi]
 
 const page: GoPageInput = {
   template: 'lead-gen',
@@ -56,58 +60,34 @@ const page: GoPageInput = {
       title: 'Your hosts',
       children: (
         <div className="border border-muted rounded-xl overflow-hidden">
-          <div className="grid grid-cols-1 md:grid-cols-3">
-            <div className="flex flex-col items-center gap-4 p-6 sm:p-8 md:border-r border-muted max-md:border-b text-center">
-              {sugu?.author_image_url && (
-                <Image
-                  src={sugu.author_image_url}
-                  alt={sugu.author}
-                  width={192}
-                  height={192}
-                  className="rounded-full object-cover aspect-square w-48 h-48"
-                />
-              )}
-              <div className="flex flex-col items-center gap-0">
-                <p className="text-foreground font-medium text-base">{sugu?.author}</p>
-                <p className="text-foreground-lighter text-sm mt-2 leading-relaxed">
-                  {sugu?.position && `${sugu.position}, `}Supabase
-                </p>
-              </div>
-            </div>
-            <div className="flex flex-col items-center gap-4 p-6 sm:p-8 md:border-r border-muted max-md:border-b text-center">
-              {paul?.author_image_url && (
-                <Image
-                  src={paul.author_image_url}
-                  alt={paul.author}
-                  width={192}
-                  height={192}
-                  className="rounded-full object-cover aspect-square w-48 h-48"
-                />
-              )}
-              <div className="flex flex-col items-center gap-0">
-                <p className="text-foreground font-medium text-base">{paul?.author}</p>
-                <p className="text-foreground-lighter text-sm mt-2 leading-relaxed">
-                  {paul?.position && `${paul.position}, `}Supabase
-                </p>
-              </div>
-            </div>
-            <div className="flex flex-col items-center gap-4 p-6 sm:p-8 text-center">
-              {ant?.author_image_url && (
-                <Image
-                  src={ant.author_image_url}
-                  alt={ant.author}
-                  width={192}
-                  height={192}
-                  className="rounded-full object-cover aspect-square w-48 h-48"
-                />
-              )}
-              <div className="flex flex-col items-center gap-0">
-                <p className="text-foreground font-medium text-base">{ant?.author}</p>
-                <p className="text-foreground-lighter text-sm mt-2 leading-relaxed">
-                  {ant?.position && `${ant.position}, `}Supabase
-                </p>
+          <div className="grid grid-cols-1 sm:grid-cols-2">
+            {hosts.map((host, i) => (
+              <div
+                key={host?.author_id ?? i}
+                className={cn(
+                  'flex flex-col items-center gap-4 p-6 sm:p-8 text-center',
+                  i % 2 === 0 && 'sm:border-r border-muted',
+                  i < 2 && 'sm:border-b border-muted',
+                  i < hosts.length - 1 && 'max-sm:border-b max-sm:border-muted'
+                )}
+              >
+                {host?.author_image_url && (
+                  <Image
+                    src={host.author_image_url}
+                    alt={host.author}
+                    width={192}
+                    height={192}
+                    className="rounded-full object-cover aspect-square w-48 h-48"
+                  />
+                )}
+                <div className="flex flex-col items-center gap-0">
+                  <p className="text-foreground font-medium text-base">{host?.author}</p>
+                  <p className="text-foreground-lighter text-sm mt-2 leading-relaxed">
+                    {host?.position && `${host.position}, `}Supabase
+                  </p>
+                </div>
               </div>
-            </div>
+            ))}
           </div>
         </div>
       ),
diff --git a/apps/www/_go/index.tsx b/apps/www/_go/index.tsx
index 5e587993f9af9..197fefd01bcaf 100644
--- a/apps/www/_go/index.tsx
+++ b/apps/www/_go/index.tsx
@@ -14,8 +14,6 @@ import postgresconfContest from './events/postgresconf-sjc-2026/contest'
 import postgresconfContestThankYou from './events/postgresconf-sjc-2026/contest-thank-you'
 import selectPartnerDay from './events/select-2026/partner-day'
 import selectPartnerDayThankYou from './events/select-2026/partner-day-thank-you'
-import selectVipDinner from './events/select-2026/vip-dinner'
-import selectVipDinnerThankYou from './events/select-2026/vip-dinner-thank-you'
 import selectVipExperience from './events/select-2026/vip-experience'
 import selectVipExperienceThankYou from './events/select-2026/vip-experience-thank-you'
 import startupGrindContest from './events/startup-grind-2026/contest'
@@ -62,8 +60,6 @@ const pages: GoPageInput[] = [
   datadogDinner, // remove after June 30, 2026
   aiEngineerEuropeContest,
   aiEngineerEuropeContestThankYou,
-  selectVipDinner, // remove after Select 2026
-  selectVipDinnerThankYou, // remove after Select 2026
   selectVipExperience, // remove after Select 2026
   selectVipExperienceThankYou, // remove after Select 2026
   selectPartnerDay, // remove after Select 2026
diff --git a/apps/www/lib/authors.json b/apps/www/lib/authors.json
index b92583c76cf38..05e66f0e78970 100644
--- a/apps/www/lib/authors.json
+++ b/apps/www/lib/authors.json
@@ -872,7 +872,7 @@
     "username": "deepthi",
     "position": "Head of Databases",
     "author_url": "https://github.com/deepthi",
-    "author_image_url": "https://github.com/deepthi.png"
+    "author_image_url": "/images/avatars/deepthi-sigireddi.jpg"
   },
   {
     "author_id": "joe_sciarrino",
diff --git a/apps/www/public/images/avatars/deepthi-sigireddi.jpg b/apps/www/public/images/avatars/deepthi-sigireddi.jpg
new file mode 100644
index 0000000000000..cc95b9cc9ee58
Binary files /dev/null and b/apps/www/public/images/avatars/deepthi-sigireddi.jpg differ