diff --git a/.github/workflows/build-static-image.yml b/.github/workflows/build-static-image.yml
index e1853c0..33b8d40 100644
--- a/.github/workflows/build-static-image.yml
+++ b/.github/workflows/build-static-image.yml
@@ -7,7 +7,7 @@ on:
       - "osm"
     paths:
       - "versions.txt"
-      - "prepare.sh"
+      - "static.sh"
       - "Dockerfile-static"
 
 jobs:
diff --git a/.github/workflows/check-deps-versions.yml b/.github/workflows/check-deps-versions.yml
index 006b335..763a07f 100644
--- a/.github/workflows/check-deps-versions.yml
+++ b/.github/workflows/check-deps-versions.yml
@@ -1,4 +1,6 @@
 on:
+  repository_dispatch:
+    types: [client-released]
   schedule:
     - cron: "0 1 * * *"
   push:
@@ -44,15 +46,47 @@ jobs:
       - name: Checkout existing branch or create new one
         run: |
           if [ "$branch_exists" == "true" ]; then
-            git checkout pr@${{ matrix.branch }}@upgrade_client
+            git checkout -B pr@${{ matrix.branch }}@upgrade_client origin/${{ matrix.branch }}
           else
             git checkout -b pr@${{ matrix.branch }}@upgrade_client
           fi
 
-      - name: Check client version
+      - name: Check Luna release version
+        env:
+          RELEASED_CLIENT_VERSION: ${{ github.event.client_payload.version }}
         run: |
-          version=$(curl -s https://api.github.com/repos/jumpserver/clients/releases/latest | jq -r .tag_name)
-          sed -i "s/Client_VERSION=.*/Client_VERSION=${version}/g" versions.txt
+          if [ -n "$RELEASED_CLIENT_VERSION" ]; then
+            version="$RELEASED_CLIENT_VERSION"
+          else
+            version=$(curl --fail --silent --show-error 'https://api.github.com/repos/jumpserver/luna/releases?per_page=100' | jq -r '
+              first(
+                .[]
+                | . as $release
+                | (.tag_name | ltrimstr("v")) as $version
+                | select(
+                    any(
+                      .assets[]?;
+                      .name == "JumpServer-\($version)-Setup.exe"
+                    )
+                    and any(
+                      .assets[]?;
+                      .name == "JumpServer-\($version)-arm64.dmg"
+                    )
+                    and any(
+                      .assets[]?;
+                      .name == "JumpServer-WebLite-\($version)-x64.msi"
+                    )
+                  )
+                | .tag_name
+              ) // empty
+            ')
+          fi
+          version="${version#v}"
+          if [ -n "$version" ]; then
+            sed -i "s/CLIENT_VERSION=.*/CLIENT_VERSION=${version}/g" client-version.txt
+          else
+            echo "No published Luna release with desktop client and WebLite assets found"
+          fi
 
       - name: Check tinker version
         run: |
@@ -72,4 +106,8 @@ jobs:
         run: |
           git add .
           git commit -m "Update pkg versions"
-          git push origin pr@${{ matrix.branch }}@upgrade_client
+          if [ "$branch_exists" == "true" ]; then
+            git push --force-with-lease origin pr@${{ matrix.branch }}@upgrade_client
+          else
+            git push origin pr@${{ matrix.branch }}@upgrade_client
+          fi
diff --git a/Dockerfile b/Dockerfile
index 807b2a5..e0d050b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -21,8 +21,7 @@ RUN set -ex \
     && apt-get -y install --no-install-recommends ${TOOLS} \
     && wget https://github.com/jumpserver-dev/healthcheck/releases/latest/download/check_linux_${TARGETARCH}.deb \
     && dpkg -i check_linux_${TARGETARCH}.deb \
-    && apt-get purge -y wget \
-        curl \
+    && apt-get purge -y curl \
         nginx-module-xslt \
         nginx-module-njs \
         libxml2 \
@@ -38,8 +37,10 @@ WORKDIR /opt
 COPY --from=lina /opt/lina /opt/lina
 COPY --from=luna /opt/luna /opt/luna
 COPY versions.txt /opt/download/versions.txt
+COPY client-version.txt /opt/download/client-version.txt
 COPY nginx.conf /etc/nginx/nginx.conf
 COPY includes /etc/nginx/includes
+COPY example /etc/nginx/example
 COPY default.conf /etc/nginx/conf.d/default.conf
-COPY http_server.conf /etc/nginx/sites-enabled/http_server.conf
+COPY https_server.conf /etc/nginx/sites-enabled/https_server.conf
 COPY init.sh /docker-entrypoint.d/40-init-config.sh
diff --git a/Dockerfile-ee b/Dockerfile-ee
index 0a3cfed..f3eea6f 100644
--- a/Dockerfile-ee
+++ b/Dockerfile-ee
@@ -1,5 +1,10 @@
 ARG VERSION=dev
-FROM jumpserver/web-static:20260819_065947 AS static
+FROM jumpserver/web-static:20260916_053751 AS static
 FROM jumpserver/web:${VERSION}-ce
 
 COPY --from=static /opt/ /opt/
+COPY client.sh client-version.txt /tmp/
+
+RUN set -ex \
+    && /tmp/client.sh \
+    && rm -f /tmp/client.sh /tmp/client-version.txt
diff --git a/Dockerfile-static b/Dockerfile-static
index ae84f32..30f4997 100644
--- a/Dockerfile-static
+++ b/Dockerfile-static
@@ -2,8 +2,8 @@ FROM alpine:3.20
 ARG TARGETARCH
 
 WORKDIR /tmp
-COPY . .
+COPY static.sh versions.txt ./
 
 RUN set -ex \
     && apk add --no-cache bash \
-    && bash ./prepare.sh
+    && bash ./static.sh
diff --git a/README.md b/README.md
index 3649462..bff1495 100644
--- a/README.md
+++ b/README.md
@@ -2,6 +2,13 @@
 
 JumpServer 的 LB Nginx Build 项目，其中包含 Lina, Luna 和一些静态安装包文件
 
+桌面客户端和 WebLite 由 Luna 独立发布，不包含在 `web-static` 和 CE 镜像中。
+`Dockerfile-ee` 构建时通过 `client.sh` 下载客户端到 `/opt/download/public/`，并将
+WebLite MSI 下载到 `/opt/download/applets/`。
+现有 `/download/public/Client_<version>_...` 下载地址保持不变；CE 镜像中本地文件不存在时，
+Nginx 会回源到公共静态文件服务。客户端和 WebLite 共用 `client-version.txt` 中的 Luna 版本，
+更新该文件不会触发 `web-static` 重建。
+
 ## Docker 构建
 
 ```bash
diff --git a/client-version.txt b/client-version.txt
new file mode 100644
index 0000000..9a2b652
--- /dev/null
+++ b/client-version.txt
@@ -0,0 +1,3 @@
+# Client and WebLite installers are downloaded only while building Dockerfile-ee.
+CLIENT_VERSION=5.0.0
+CLIENT_NAME=JumpServer
diff --git a/client.sh b/client.sh
new file mode 100755
index 0000000..20b598d
--- /dev/null
+++ b/client.sh
@@ -0,0 +1,33 @@
+#!/bin/sh
+set -eu
+
+PROJECT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+
+. "${PROJECT_DIR}/client-version.txt"
+
+: "${CLIENT_VERSION:?CLIENT_VERSION is required}"
+: "${CLIENT_NAME:?CLIENT_NAME is required}"
+
+RELEASE_URL=${CLIENT_RELEASE_URL:-https://github.com/jumpserver/luna/releases/download/v${CLIENT_VERSION}}
+DOWNLOAD_DIR=${CLIENT_DOWNLOAD_DIR:-/opt/download/public}
+WEBLITE_DOWNLOAD_DIR=${WEBLITE_DOWNLOAD_DIR:-/opt/download/applets}
+
+mkdir -p "${DOWNLOAD_DIR}" "${WEBLITE_DOWNLOAD_DIR}"
+cd "${DOWNLOAD_DIR}"
+
+windows_file="${CLIENT_NAME}Client_${CLIENT_VERSION}_x64-setup.exe"
+macos_arm64_file="${CLIENT_NAME}Client_${CLIENT_VERSION}_aarch64.dmg"
+weblite_file="JumpServer-WebLite-${CLIENT_VERSION}-x64.msi"
+
+wget --https-only \
+    --output-document="${windows_file}" \
+    "${RELEASE_URL}/${CLIENT_NAME}-${CLIENT_VERSION}-Setup.exe"
+wget --https-only \
+    --output-document="${macos_arm64_file}" \
+    "${RELEASE_URL}/${CLIENT_NAME}-${CLIENT_VERSION}-arm64.dmg"
+wget --https-only \
+    --output-document="${WEBLITE_DOWNLOAD_DIR}/${weblite_file}" \
+    "${RELEASE_URL}/${weblite_file}"
+
+ln -s "${windows_file}" "Client_${CLIENT_VERSION}_x64-setup.exe"
+ln -s "${macos_arm64_file}" "Client_${CLIENT_VERSION}_aarch64.dmg"
diff --git a/default.conf b/default.conf
index 5356604..8a481b0 100644
--- a/default.conf
+++ b/default.conf
@@ -1,5 +1,5 @@
 server {
-    listen 51980; # 如果不开启 https, 这里会 sed 成 80
+    listen 51980; # 容器内部 Web 服务端口，不对外映射
     # listen [::]:51980;
 
     client_max_body_size 4096m;
diff --git a/example/example.crt b/example/example.crt
new file mode 100644
index 0000000..5aa6549
--- /dev/null
+++ b/example/example.crt
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDCTCCAfGgAwIBAgIUDuZGvwzXjUIKAuB993+Z4RNZXoEwDQYJKoZIhvcNAQEL
+BQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTI2MDgyNjA1MjQxMFoXDTM2MDgy
+MzA1MjQxMVowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAwLeA47PjnHxFoJEQcAnphRoAz5WQ/IbEMFXRZUC/DH4G
+r8B25rOblfH7w5zdowgqM5LSzdMAEFTtJt9Z5IFmYgFwijxTE04NBSAo6JFXVQeW
+0MMzi/7Q/p4+6UMRmDTglkfiiRlBRIrx2rUdCezj1BntrdVZuvCS4JfJ19iW0dUR
+VqvuloUDmluhv18Nv7O/Sr7dedZWG3t1EuKrpc8HnWuCHwR3lm3V9jJxcJUBKTu6
+B+LM2JxHa7XjQlLIQNvFa6LB7zQ+DKr4TAuzuzfpZhysXAX/sVIwBiKKnQ+6Gcuj
+0CSuy8wiE0vEA8vbYWNqdAVski0Zoes88Cu5InPKhQIDAQABo1MwUTAdBgNVHQ4E
+FgQUPmhCIuDVL7+Eu86oCngoxnBkAYswHwYDVR0jBBgwFoAUPmhCIuDVL7+Eu86o
+CngoxnBkAYswDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAi9AF
+GeYJz+0DVRIlqwX7FcBbs2jQkLvGb1sxWUixCekBEWa3d4481Qb76MlUPvTQOqVE
+3i7Jf1kaJoEsRUVF8wjmCAe6cc2vinCzBn9Vz+f1H6yKdZNcH9yEUnaO8SyzKT7w
+ejMoT/C5/7kVGrPF9JH6j6o/UqASgJAzn7F5jhnMeySfR7h7qaaHOutrnUeDcxa6
+t0NfN5x8eT7ufza6+6gC98eayb0RqUrTaQ45HXa1mYwio4EJbzRjitDjaII2RxXm
+kdXagY3AGR6nkycOGhm1MBCsoM5xW7c+/qdCl9EryDWDf2mvI6Q9j0XsAhBkjveP
+DJ4A4buX9HRk6elihw==
+-----END CERTIFICATE-----
diff --git a/example/example.key b/example/example.key
new file mode 100644
index 0000000..4eeb400
--- /dev/null
+++ b/example/example.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDAt4Djs+OcfEWg
+kRBwCemFGgDPlZD8hsQwVdFlQL8MfgavwHbms5uV8fvDnN2jCCozktLN0wAQVO0m
+31nkgWZiAXCKPFMTTg0FICjokVdVB5bQwzOL/tD+nj7pQxGYNOCWR+KJGUFEivHa
+tR0J7OPUGe2t1Vm68JLgl8nX2JbR1RFWq+6WhQOaW6G/Xw2/s79Kvt151lYbe3US
+4qulzweda4IfBHeWbdX2MnFwlQEpO7oH4szYnEdrteNCUshA28VrosHvND4MqvhM
+C7O7N+lmHKxcBf+xUjAGIoqdD7oZy6PQJK7LzCITS8QDy9thY2p0BWySLRmh6zzw
+K7kic8qFAgMBAAECggEAA4nn3vm1pNdcIlenkp1/LgeAZ+kAkYwaXCNA36tLSfwI
+1jKIvGTxGjuOrbsN3GmEK0N3hXoDY6/IVWqY6JFyHNVj7wkU79ZpQzFulUURJamP
+AzEiaC0UqPULUkmXloQaDG7J4efJ0AVkU+mRdlYx1McCtN3YpcGD7bkImfykwFOX
+p8ol3PgHQJkPxaHuGGk9yDaNUmPRz9JBAQz/fd3BLTX7ue9YtatS2gCSmaY4/kbX
+oI6VOavBwV5SRaeOgsfFi1IAsgPJ2dI9W/WCHRBqHM7Hgsi9f+gHrUEewXSC7Dh7
+2FHVrHxiHlCD1IQei+8nFjg3ZK218T52t3RAdJt5PQKBgQD248PnRjrWjHjIRJ6T
+cwMXtNa36xzfMd1R4nC0jmbpNJxeyUNnwg0twl9/scTtMULvpX7/w7hRNreeDQT/
+64Dy6TVKENPxzf7RT3s5Ly3g5owMRrue9sLLQImacVzkgoytgCIRpfYjROg9wi26
+FSzOaSkFSgwYCYXxu3qpGRVG9wKBgQDH0/7zHzbwzajoem6tSEdavFcJJiiYN60F
+8BKL53KIkb89OGykDpLV9I2CL0zFiPYhbxECl9nqT1sDI6Qdsb9VEF9st8Tc5kjw
+W441VJMJYxUA7QfyDm76IiLJE3m9/f5SFXMmVVkJVjs+usy/TXf0tuVAE5ralxNQ
+1uJZq94vYwKBgQDyXYXjdD4ugJfRggtqFG3kx9JBmr0tHnZ1/CVIGsNMDCm1oz5Y
+jVcCpN27LXh0oPdk6sJRsoEuuNhof794vGhKDkYR/5MQvXh5Yd1FtdsD/U9efdGR
+rAxuG1z6EG9wo/gWGsNXL+UBmpOijQz2r/Lcbr+mQZq9vhuPwswXVFhe4QKBgErX
+yeuBS3CRdqvr/zwDkEYZuHeCxT2NzM4mhqvDuhAQlpH1aitgEfr0p3OVB6oMjDMl
+iDdybHnn0uywEq3Ufxb7FOKBSch6r+LmR7MNxCyF4b4BCTLN2R7yXhj1pGlWkkRo
+KEK5QKnQlEwAZuNXvo/3WJHRRfSNFPz4Hrr7NjKFAoGAB3aDQUDGfWE1CdB0XDPL
++/IB/BRIuxjvwyg1eFHHSMc6C1FFmn3mG65oCC18DmZMPFag4lPuXW5ylR0LJkSz
+IchcUKO5dlr64cwBSmVAJKR8Gtj7kcp9hAhIMQKDNWE1h93RuSz2VFBd00n1fwlT
+/toLw7peVpKft+Y+k/SGhXo=
+-----END PRIVATE KEY-----
diff --git a/http_server.conf b/http_server.conf
deleted file mode 100644
index 8f41c05..0000000
--- a/http_server.conf
+++ /dev/null
@@ -1,23 +0,0 @@
-server {
-    listen 80;
-    # listen [::]:80;
-    # server_name demo.jumpserver.org;  # 取消注释并自行修改成你自己的域名
-
-    client_max_body_size 5000m;
-
-    location / {
-        proxy_pass http://localhost:51980;
-        proxy_buffering off;
-        proxy_request_buffering off;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection $http_connection;
-        proxy_set_header X-Forwarded-For $remote_addr;
-        proxy_ignore_client_abort on;
-        proxy_connect_timeout 600;
-        proxy_send_timeout 600;
-        proxy_read_timeout 600;
-        send_timeout 6000;
-    }
-}
\ No newline at end of file
diff --git a/https_server.conf b/https_server.conf
new file mode 100644
index 0000000..3eb5559
--- /dev/null
+++ b/https_server.conf
@@ -0,0 +1,68 @@
+# Todo: May be can auto discovery
+upstream http_server {
+  ip_hash;
+  server web:8080;  # 这个是可以通过容器访问, 外部访问是 80端口
+}
+
+server {
+  listen 80;  # 容器内部固定端口，对外映射由 installer 控制
+  # listen [::]:80;
+  # server_name demo.jumpserver.org;  # 取消注释并自行修改成你自己的域名
+  # HTTPS_REDIRECT
+
+  client_max_body_size 5000m;
+
+  location / {
+    proxy_pass http://http_server;
+    proxy_buffering off;
+    proxy_request_buffering off;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $http_connection;
+    # 默认作为第一层；仅显式 USE_LB=0 时由启动脚本改为信任上游代理头。
+    proxy_set_header X-Forwarded-For $remote_addr;
+
+    proxy_ignore_client_abort on;
+    proxy_connect_timeout 600;
+    proxy_send_timeout 600;
+    proxy_read_timeout 600;
+    send_timeout 6000;
+  }
+}
+
+server {
+  listen 443 ssl;  # 容器内部固定端口，对外映射由 installer 控制
+  http2 on;
+  # listen [::]:443 ssl;
+  # server_name demo.jumpserver.org;      # 取消注释并自行修改成你自己的域名
+  server_tokens off;
+  ssl_certificate cert/server.crt;        # 修改 server.crt 为你的证书, 不要改路径 cert/
+  ssl_certificate_key cert/server.key;    # 修改 server.key 为你的证书, 不要改路径 cert/
+  ssl_session_timeout 1d;
+  ssl_session_cache shared:MozSSL:10m;
+  ssl_session_tickets off;
+  ssl_protocols TLSv1.2 TLSv1.3;
+  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+  ssl_prefer_server_ciphers off;
+
+  client_max_body_size 5000m;
+
+  location / {
+    proxy_pass http://http_server;
+    proxy_buffering off;
+    proxy_request_buffering off;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $http_connection;
+    # 默认作为第一层；仅显式 USE_LB=0 时由启动脚本改为信任上游代理头。
+    proxy_set_header X-Forwarded-For $remote_addr;
+
+    proxy_ignore_client_abort on;
+    proxy_connect_timeout 600;
+    proxy_send_timeout 600;
+    proxy_read_timeout 600;
+    send_timeout 6000;
+  }
+}
diff --git a/includes/facelive.conf.disabled b/includes/facelive.conf.disabled
deleted file mode 100644
index 45ebe87..0000000
--- a/includes/facelive.conf.disabled
+++ /dev/null
@@ -1,15 +0,0 @@
-location /facelive/ {
-    proxy_pass http://facelive:9999;
-    proxy_buffering off;
-    proxy_http_version 1.1;
-    proxy_request_buffering off;
-    proxy_set_header Upgrade $http_upgrade;
-    proxy_set_header Connection "upgrade";
-    proxy_set_header Host $host;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_ignore_client_abort on;
-    proxy_connect_timeout 600;
-    proxy_send_timeout 600;
-    proxy_read_timeout 600;
-    send_timeout 6000;
-}
diff --git a/includes/kotl.conf.disabled b/includes/jdmc.conf.disabled
similarity index 100%
rename from includes/kotl.conf.disabled
rename to includes/jdmc.conf.disabled
diff --git a/includes/kael.conf.disabled b/includes/kael.conf.disabled
new file mode 100644
index 0000000..b30aeac
--- /dev/null
+++ b/includes/kael.conf.disabled
@@ -0,0 +1,14 @@
+location ^~ /kael/ {
+    proxy_pass http://kael:8083;
+    proxy_buffering off;
+    proxy_cache off;
+    proxy_request_buffering off;
+    proxy_http_version 1.1;
+    proxy_set_header Host $http_host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_connect_timeout 60;
+    proxy_send_timeout 600;
+    proxy_read_timeout 600;
+    send_timeout 600;
+}
diff --git a/includes/lion.conf b/includes/lion.conf
deleted file mode 100644
index 4f83ddd..0000000
--- a/includes/lion.conf
+++ /dev/null
@@ -1,15 +0,0 @@
-location /lion/ {
-    proxy_pass http://lion:8081;
-    proxy_buffering off;
-    proxy_http_version 1.1;
-    proxy_request_buffering off;
-    proxy_set_header Upgrade $http_upgrade;
-    proxy_set_header Connection "upgrade";
-    proxy_set_header Host $host;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_ignore_client_abort on;
-    proxy_connect_timeout 600;
-    proxy_send_timeout 600;
-    proxy_read_timeout 600;
-    send_timeout 6000;
-}
diff --git a/init.sh b/init.sh
index dda08c1..7debed4 100755
--- a/init.sh
+++ b/init.sh
@@ -1,8 +1,5 @@
 #!/bin/bash
 #
-https_port=${HTTPS_PORT:-443}
-
-
 function config_nginx() {
   config_file=$1
   if [ ! -f "${config_file}" ]; then
@@ -10,10 +7,6 @@ function config_nginx() {
     exit 1
   fi
 
-  if [ -z "${USE_LB}" ]; then
-    USE_LB=1
-  fi
-
   if [ "${USE_IPV6}" == "1" ]; then
     sed -i "s@# listen \[::\]:80;@listen \[::\]:80;@g" "${config_file}"
     if [ -f "/etc/nginx/conf.d/default.conf" ]; then
@@ -30,10 +23,13 @@ function config_nginx() {
     sed -i "s@client_max_body_size .*;@client_max_body_size ${CLIENT_MAX_BODY_SIZE};@g" /etc/nginx/conf.d/*.conf
   fi
 
-  if [ "${USE_LB}" == "1" ]; then
-    sed -i 's@proxy_set_header X-Forwarded-For .*;@proxy_set_header X-Forwarded-For $remote_addr;@g' "${config_file}"
-  else
+  # Only an explicit USE_LB=0 means there is a trusted proxy in front of us.
+  # Otherwise this server is the trust boundary and must discard client-supplied
+  # X-Forwarded-For values.
+  if [ "${USE_LB:-1}" == "0" ]; then
     sed -i 's@proxy_set_header X-Forwarded-For .*;@proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;@g' "${config_file}"
+  else
+    sed -i 's@proxy_set_header X-Forwarded-For .*;@proxy_set_header X-Forwarded-For $remote_addr;@g' "${config_file}"
   fi
 }
 
@@ -52,16 +48,39 @@ function config_helm() {
   fi
 }
 
-# Installer mount
-# https://github.com/jumpserver/installer/blob/dev/compose/docker-compose-lb.yml#L14
-function config_http() {
-  config_file=/etc/nginx/conf.d/http_server.conf
-  if [ -f "${config_file}" ]; then
-    rm -f "${config_file}"
+function config_certificate() {
+  cert_dir=/etc/nginx/cert
+  example_dir=/etc/nginx/example
+  default_cert_name=server.crt
+  default_key_name=server.key
+  cert_name=${SSL_CERTIFICATE:-${default_cert_name}}
+  key_name=${SSL_CERTIFICATE_KEY:-${default_key_name}}
+  cert_file=${cert_dir}/${cert_name}
+  key_file=${cert_dir}/${key_name}
+
+  mkdir -p "${cert_dir}"
+
+  if [[ ! -f "${cert_file}" || ! -f "${key_file}" ]]; then
+    if [[ -n "${SSL_CERTIFICATE}" || -n "${SSL_CERTIFICATE_KEY}" ]]; then
+      echo "Warning: SSL certificate or private key not found: ${cert_file}, ${key_file}"
+      echo "Falling back to the default certificate pair: ${default_cert_name}, ${default_key_name}"
+    fi
+
+    cert_name=${default_cert_name}
+    key_name=${default_key_name}
+    cert_file=${cert_dir}/${cert_name}
+    key_file=${cert_dir}/${key_name}
   fi
-  cp -f /etc/nginx/sites-enabled/http_server.conf "${config_file}"
 
-  config_nginx "${config_file}"
+  if [[ ! -f "${cert_file}" && ! -f "${key_file}" ]]; then
+    cp -f "${example_dir}/example.crt" "${cert_file}"
+    cp -f "${example_dir}/example.key" "${key_file}"
+  elif [[ ! -f "${cert_file}" || ! -f "${key_file}" ]]; then
+    echo "SSL certificate and private key must both exist: ${cert_file}, ${key_file}"
+    exit 1
+  fi
+
+  chmod 600 "${cert_file}" "${key_file}"
 }
 
 function config_https() {
@@ -71,26 +90,25 @@ function config_https() {
   fi
   cp -f /etc/nginx/sites-enabled/https_server.conf "${config_file}"
 
+  config_certificate
   config_nginx "${config_file}"
 
   sed -i "s@server web:.*;@server localhost:51980;@g" "${config_file}"
-  if [ "${HTTPS_PORT}" != "443" ]; then
-    # Old 
-    sed -i "s@https://\$server_name\$request_uri;@https://\$host:${HTTPS_PORT}\$request_uri;@g" "${config_file}"
-    # New 
-    sed -i "s@https://\$host\$request_uri;@https://\$host:${HTTPS_PORT}\$request_uri;@g" "${config_file}"
+  if [[ -n "${HTTPS_PORT}" && "${HTTPS_PORT}" != "0" ]]; then
+    if [ "${HTTPS_PORT}" == "443" ]; then
+      redirect_url='https://$host$request_uri'
+    else
+      redirect_url="https://\$host:${HTTPS_PORT}\$request_uri"
+    fi
+    sed -i "s@  # HTTPS_REDIRECT@  return 307 ${redirect_url};@g" "${config_file}"
   fi
 
   if [ "${USE_IPV6}" == "1" ]; then
-    sed -i "s@# listen \[::\]:443@listen \[::\]:443@g" "${config_file}"
+    sed -i "s@# listen \[::\]:443 ssl;@listen [::]:443 ssl;@g" "${config_file}"
   fi
 
-  if [ -n "${SSL_CERTIFICATE}" ] && [ -f "/etc/nginx/cert/${SSL_CERTIFICATE}" ]; then
-    sed -i "s@ssl_certificate .*;@ssl_certificate cert/${SSL_CERTIFICATE};@g" "${config_file}"
-  fi
-  if [ -n "${SSL_CERTIFICATE_KEY}" ] && [ -f "/etc/nginx/cert/${SSL_CERTIFICATE_KEY}" ]; then
-    sed -i "s@ssl_certificate_key .*;@ssl_certificate_key cert/${SSL_CERTIFICATE_KEY};@g" "${config_file}"
-  fi
+  sed -i "s@ssl_certificate .*;@ssl_certificate cert/${cert_name};@g" "${config_file}"
+  sed -i "s@ssl_certificate_key .*;@ssl_certificate_key cert/${key_name};@g" "${config_file}"
   if [ -n "${CLIENT_MAX_BODY_SIZE}" ]; then
     sed -i "s@client_max_body_size .*;@client_max_body_size ${CLIENT_MAX_BODY_SIZE};@g" "${config_file}"
   fi
@@ -108,40 +126,37 @@ function config_components() {
     safe_move /etc/nginx/includes/core.conf /etc/nginx/includes/core.conf.disabled
   fi
 
-  if [ "${KOKO_ENABLED}" == "0" ]; then
-    safe_move /etc/nginx/includes/koko.conf /etc/nginx/includes/koko.conf.disabled
+  if [ "${KAEL_ENABLED}" == "0" ]; then
+    safe_move /etc/nginx/includes/kael.conf /etc/nginx/includes/kael.conf.disabled
+  else
+    safe_move /etc/nginx/includes/kael.conf.disabled /etc/nginx/includes/kael.conf
   fi
 
-  if [ "${LION_ENABLED}" == "0" ]; then
-    safe_move /etc/nginx/includes/lion.conf /etc/nginx/includes/lion.conf.disabled
+  if [ "${KOKO_ENABLED}" == "0" ]; then
+    safe_move /etc/nginx/includes/koko.conf /etc/nginx/includes/koko.conf.disabled
   fi
 
   if [ "${CHEN_ENABLED}" == "0" ]; then
     safe_move /etc/nginx/includes/chen.conf /etc/nginx/includes/chen.conf.disabled
   fi
 
-  if [ "${KOTL_ENABLED}" == "1" ]; then
-    safe_move /etc/nginx/includes/kotl.conf.disabled /etc/nginx/includes/kotl.conf
+  if [ "${USE_XPACK}" == "1" ]; then
+    safe_move /etc/nginx/includes/jdmc.conf.disabled /etc/nginx/includes/jdmc.conf
   else
-    safe_move /etc/nginx/includes/kotl.conf /etc/nginx/includes/kotl.conf.disabled
-  fi
-
-  if [ "${FACELIVE_ENABLED}" == "0" ]; then
-    safe_move /etc/nginx/includes/facelive.conf /etc/nginx/includes/facelive.conf.disabled
+    safe_move /etc/nginx/includes/jdmc.conf /etc/nginx/includes/jdmc.conf.disabled
   fi
 
   if [[ "${USE_XPACK}" == "1" && "${RAZOR_ENABLED}" != "0" ]]; then
     safe_move /etc/nginx/includes/razor.conf.disabled /etc/nginx/includes/razor.conf
   fi
-
-  if [[ "${USE_XPACK}" == "1" && "${FACELIVE_ENABLED}" == "1" ]]; then
-    safe_move /etc/nginx/includes/facelive.conf.disabled /etc/nginx/includes/facelive.conf
-  fi
 }
 
 function copy_versions_to_core() {
   if [[ -f "/opt/download/versions.txt" && -d "/opt/jumpserver/data/"  ]]; then
     cp -f /opt/download/versions.txt /opt/jumpserver/data/version.txt
+    if [[ -f "/opt/download/client-version.txt" ]]; then
+      cat /opt/download/client-version.txt >> /opt/jumpserver/data/version.txt
+    fi
   fi
 }
 
@@ -157,11 +172,7 @@ function main() {
     exit 0
   fi
 
-  if [ -f "/etc/nginx/sites-enabled/https_server.conf" ]; then
-    config_https
-  else
-    config_http
-  fi
+  config_https
   config_components
 
   if [ -f "/etc/init.d/cron" ]; then
diff --git a/prepare.sh b/static.sh
similarity index 82%
rename from prepare.sh
rename to static.sh
index 767fb1f..edf482d 100755
--- a/prepare.sh
+++ b/static.sh
@@ -36,21 +36,8 @@ cd ${DOWNLOAD_DIR}/public || exit 1
 # wget ${DOWNLOAD_URL}/public/Microsoft_Remote_Desktop_${MRD_VERSION}_installer.pkg
 wget https://github.com/PowerShell/Win32-OpenSSH/releases/download/${OPENSSH_VERSION}p1-Beta/OpenSSH-Win64-${OPENSSH_VERSION}.msi
 
-clients=(
-    "${CLIENT_NAME}Client_${CLIENT_VERSION}_x64-setup.exe"
-    "${CLIENT_NAME}Client_${CLIENT_VERSION}_aarch64.dmg"
-)
-for client in "${clients[@]}"; do
-    wget "https://github.com/jumpserver/clients/releases/download/v${CLIENT_VERSION}/${client}"
-done
-
 for arch in x64 arm64; do
     wget https://downloads.mongodb.com/compass/mongosh-${MONGOSH_VERSION}-linux-${arch}.tgz
 done
 
-for i in $(ls ${CLIENT_NAME}*);do
-   to=${i/${CLIENT_NAME}/}
-   ln -s ${i} ${to}
-done
-
-cp "${PROJECT_DIR}"/versions.txt ${DOWNLOAD_DIR}
\ No newline at end of file
+cp "${PROJECT_DIR}"/versions.txt ${DOWNLOAD_DIR}
diff --git a/versions.txt b/versions.txt
index 380b796..8627055 100644
--- a/versions.txt
+++ b/versions.txt
@@ -9,6 +9,4 @@ DBEAVER_VERSION=22.3.4
 MRD_VERSION=10.6.7
 OPENSSH_VERSION=v9.4.0.0
 MONGOSH_VERSION=2.2.12
-TINKER_VERSION=v0.2.3
-CLIENT_VERSION=4.1.6
-CLIENT_NAME=JumpServer
+TINKER_VERSION=v0.3.0