diff --git a/containers/gluetun/gluetun.config b/containers/gluetun/gluetun.config
index 3360ae4..c39a4c7 100644
--- a/containers/gluetun/gluetun.config
+++ b/containers/gluetun/gluetun.config
@@ -40,7 +40,6 @@ CFG_GLUETUN_OPENVPN_USER=
 CFG_GLUETUN_OPENVPN_PASSWORD=
 CFG_GLUETUN_WIREGUARD_PRIVATE_KEY=
 CFG_GLUETUN_WIREGUARD_ADDRESSES=
-CFG_GLUETUN_CONTROL_SERVER_API_KEY_1=RANDOMIZEDPASSWORD1
 # HEALTH_TARGETS = comma-separated host:port list pinged over HTTPS to
 #   confirm the VPN tunnel is healthy. Defaults are privacy-respecting
 #   (Mullvad — your VPN provider; EFF — privacy non-profit). Override
diff --git a/containers/stoat/scripts/stoat_install_hooks.sh b/containers/stoat/scripts/stoat_install_hooks.sh
index c52f27a..ad2d160 100644
--- a/containers/stoat/scripts/stoat_install_hooks.sh
+++ b/containers/stoat/scripts/stoat_install_hooks.sh
@@ -78,7 +78,7 @@ _stoatBaseUrl()
 # would create directories in their place) and again once the port is known.
 _stoatWriteUrlFiles()
 {
-    local app_dir="$1" base="$2" video_enabled="$3"
+    local app_dir="$1" base="$2" video_enabled="$3" rabbit_pass="$4"
 
     # ws:// for http, wss:// for https — a wss:// URL on a plain-HTTP origin
     # fails to connect and the client hangs on "connecting".
diff --git a/containers/traefik/traefik.config b/containers/traefik/traefik.config
index c3fe2b1..03b4c36 100755
--- a/containers/traefik/traefik.config
+++ b/containers/traefik/traefik.config
@@ -88,4 +88,3 @@ CFG_TRAEFIK_PORT_3="traefik-service|http|80:80|disabled|tcp|false|false|false|HT
 # AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
 CFG_TRAEFIK_AUTH_PROFILE=single_password
 CFG_TRAEFIK_ADMIN_USER=
-CFG_TRAEFIK_ADMIN_PASSWORD_1=RANDOMIZEDPASSWORD1
diff --git a/docs/guide/upgrade-notes.md b/docs/guide/upgrade-notes.md
index ccd3268..163cb56 100644
--- a/docs/guide/upgrade-notes.md
+++ b/docs/guide/upgrade-notes.md
@@ -160,8 +160,8 @@ are preserved from then on.
 
 The convention is now uniform: **if a config key holds a generated value, its name
 ends in a slot number.** `CFG_<APP>_DB_PASSWORD` became
-`CFG_<APP>_DB_PASSWORD_1`, `CFG_TRAEFIK_ADMIN_PASSWORD` became
-`CFG_TRAEFIK_ADMIN_PASSWORD_1`, and so on — 42 keys across the catalog. An app
+`CFG_<APP>_DB_PASSWORD_1`, `CFG_GITEA_ADMIN_PASSWORD` became
+`CFG_GITEA_ADMIN_PASSWORD_1`, and so on — 40 keys across the catalog. An app
 that needs a second credential of the same kind just adds `_2`; nothing has to be
 registered, because the tag name is derived from the key.
 
diff --git a/scripts/webui/data/generators/categories/webui_create_app_field_mappings.sh b/scripts/webui/data/generators/categories/webui_create_app_field_mappings.sh
index 118dad8..e296b31 100755
--- a/scripts/webui/data/generators/categories/webui_create_app_field_mappings.sh
+++ b/scripts/webui/data/generators/categories/webui_create_app_field_mappings.sh
@@ -525,12 +525,6 @@ PORTEOF
       "type": "password",
       "tooltip": "Password for the mailbox created on install"
     },
-    "TRAEFIK_ADMIN_PASSWORD_1": {
-      "category": "general",
-      "label": "Traefik Admin Password",
-      "type": "password",
-      "tooltip": "Traefik dashboard password (auto-generated)"
-    },
     "BOOKSTACK_APP_KEY_1": {
       "category": "advanced",
       "label": "Application Key",
@@ -604,12 +598,6 @@ PORTEOF
       "type": "password",
       "tooltip": "Password for the seeded Authelia admin account"
     },
-    "GLUETUN_CONTROL_SERVER_API_KEY_1": {
-      "category": "general",
-      "label": "Control Server API Key",
-      "type": "password",
-      "tooltip": "API key for the gluetun HTTP control server (blank disables auth)"
-    },
     "GLUETUN_VPN_SERVICE_PROVIDER": {
       "category": "general",
       "label": "VPN Provider",