diff --git a/.github/workflows/deploy-docker.yml b/.github/workflows/deploy-docker.yml
index 7f3be31866d..de73ee280ed 100644
--- a/.github/workflows/deploy-docker.yml
+++ b/.github/workflows/deploy-docker.yml
@@ -49,6 +49,11 @@ jobs:
           # shared Actions cache. mode=min exports only the final image layers.
           cache-to: type=gha,mode=min
           build-args: |
+            # Build-time only: next.config.ts asserts these during `next build`. The runner
+            # stage does not carry them, so the real values must come from the runtime
+            # environment - scripts/start.sh refuses to boot when they are missing.
+            NEXTAUTH_SECRET=build-time-placeholder-not-used-at-runtime
+            CALENDSO_ENCRYPTION_KEY=build-time-placeholder-not-used-at-runtime
             NEXT_PUBLIC_WEBAPP_URL=https://cal.crove.com
             NEXT_PUBLIC_API_V2_URL=http://localhost:5555/api/v2
             NEXT_PUBLIC_LICENSE_CONSENT=agree
diff --git a/Dockerfile b/Dockerfile
index b48a4747537..854f1fdea0e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -8,8 +8,12 @@ ARG NEXT_PUBLIC_WEBSITE_TERMS_URL
 ARG NEXT_PUBLIC_WEBSITE_PRIVACY_POLICY_URL
 ARG CALCOM_TELEMETRY_DISABLED
 ARG DATABASE_URL
-ARG NEXTAUTH_SECRET=secret
-ARG CALENDSO_ENCRYPTION_KEY=secret
+# CR-08: no insecure "=secret" defaults — publicly-known values must never be baked into images.
+# Build-time placeholders are supplied by CI (deploy-docker.yml) because next.config.ts requires
+# these to be set during `next build`; real values must be provided at runtime (start.sh refuses
+# to boot when they are unset or equal to the old default).
+ARG NEXTAUTH_SECRET
+ARG CALENDSO_ENCRYPTION_KEY
 ARG MAX_OLD_SPACE_SIZE=6144
 ARG NEXT_PUBLIC_API_V2_URL
 ARG CSP_POLICY
@@ -21,6 +25,8 @@ ARG NEXT_PUBLIC_ENABLE_PROFILE_SWITCHER=1
 ARG NEXT_PUBLIC_APP_NAME=Crove
 ARG NEXT_PUBLIC_COMPANY_NAME="MetaDOS LLC"
 ARG NEXT_PUBLIC_SUPPORT_MAIL_ADDRESS=help@crove.com
+ARG NEXT_PUBLIC_SENDER_ID=Crove
+ARG NEXT_PUBLIC_SENDGRID_SENDER_NAME=Crove
 ARG NEXT_PUBLIC_DOS_ID_LOGIN_ENABLED=true
 ARG OIDC_CLIENT_ID=18790ccb-4d71-48cd-ad24-aee5f3ced3da
 
@@ -33,6 +39,8 @@ ENV NEXT_PUBLIC_WEBAPP_URL=http://NEXT_PUBLIC_WEBAPP_URL_PLACEHOLDER \
   NEXT_PUBLIC_APP_NAME=$NEXT_PUBLIC_APP_NAME \
   NEXT_PUBLIC_COMPANY_NAME=$NEXT_PUBLIC_COMPANY_NAME \
   NEXT_PUBLIC_SUPPORT_MAIL_ADDRESS=$NEXT_PUBLIC_SUPPORT_MAIL_ADDRESS \
+  NEXT_PUBLIC_SENDER_ID=$NEXT_PUBLIC_SENDER_ID \
+  NEXT_PUBLIC_SENDGRID_SENDER_NAME=$NEXT_PUBLIC_SENDGRID_SENDER_NAME \
   NEXT_PUBLIC_ENABLE_PROFILE_SWITCHER=$NEXT_PUBLIC_ENABLE_PROFILE_SWITCHER \
   OIDC_CLIENT_ID=$OIDC_CLIENT_ID \
   CALCOM_TELEMETRY_DISABLED=$CALCOM_TELEMETRY_DISABLED \
diff --git a/example-apps/credential-sync/package.json b/example-apps/credential-sync/package.json
index a784cfce53d..a247fdad076 100644
--- a/example-apps/credential-sync/package.json
+++ b/example-apps/credential-sync/package.json
@@ -10,7 +10,7 @@
   "dependencies": {
     "@calcom/atoms": "workspace:*",
     "@prisma/client": "6.16.1",
-    "next": "15.5.21",
+    "next": "15.5.24",
     "prisma": "6.16.1",
     "react": "18.2.0",
     "react-dom": "18.2.0"
diff --git a/scripts/start.sh b/scripts/start.sh
index 7c00c8e6611..7e024b98aff 100644
--- a/scripts/start.sh
+++ b/scripts/start.sh
@@ -1,19 +1,21 @@
 #!/bin/sh
 set -x
 
-# CR-08 startup guard: refuse to boot when secrets are missing or equal the old
-# publicly-known insecure default "secret". Real values must come from the runtime
-# environment (docker-compose env_file / docker run -e), never from the image.
-if [ -z "$NEXTAUTH_SECRET" ] || [ "$NEXTAUTH_SECRET" = "secret" ]; then
-  echo "ERROR: NEXTAUTH_SECRET is unset or equals the insecure default 'secret'."
-  echo "Set a strong random value at runtime, e.g.: openssl rand -base64 32"
-  exit 1
-fi
-if [ -z "$CALENDSO_ENCRYPTION_KEY" ] || [ "$CALENDSO_ENCRYPTION_KEY" = "secret" ]; then
-  echo "ERROR: CALENDSO_ENCRYPTION_KEY is unset or equals the insecure default 'secret'."
-  echo "Set a strong random value at runtime, e.g.: openssl rand -base64 32"
-  exit 1
-fi
+# CR-08 startup guard: refuse to boot when a secret is missing or set to a publicly-known
+# value. The build stage passes a placeholder because next.config.ts asserts these during
+# `next build`; the runner stage does not carry them, so the real value must come from the
+# runtime environment (docker-compose env_file / docker run -e).
+reject_insecure_secret() {
+  case "$2" in
+    "" | "secret" | "build-time-placeholder-not-used-at-runtime")
+      echo "ERROR: $1 is unset or set to a publicly-known value."
+      echo "Set a strong random value at runtime, e.g.: openssl rand -base64 32"
+      exit 1
+      ;;
+  esac
+}
+reject_insecure_secret NEXTAUTH_SECRET "$NEXTAUTH_SECRET"
+reject_insecure_secret CALENDSO_ENCRYPTION_KEY "$CALENDSO_ENCRYPTION_KEY"
 
 # Replace the statically built BUILT_NEXT_PUBLIC_WEBAPP_URL with run-time NEXT_PUBLIC_WEBAPP_URL
 # NOTE: if these values are the same, this will be skipped.
diff --git a/yarn.lock b/yarn.lock
index bc88ee5954b..7e93964e688 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2424,7 +2424,7 @@ __metadata:
     "@types/react-dom": "npm:18.2.6"
     autoprefixer: "npm:10.4.19"
     dotenv: "npm:16.6.1"
-    next: "npm:15.5.21"
+    next: "npm:15.5.24"
     postcss: "npm:8.5.6"
     prisma: "npm:6.16.1"
     react: "npm:18.2.0"
@@ -8732,10 +8732,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@next/env@npm:15.5.21":
-  version: 15.5.21
-  resolution: "@next/env@npm:15.5.21"
-  checksum: 10/cac7c51fd255dbd79f32f8dd9895573207ed273e94ce92087cfa0283b0ad3a9685741e4ed934d76161914cc6259a908fd6e439cc6a9aeb8d67090f973c949d3b
+"@next/env@npm:15.5.24":
+  version: 15.5.24
+  resolution: "@next/env@npm:15.5.24"
+  checksum: 10/76da9f6dd5c890b9a7e584c9379a639e13a7ead41410c0743e23790990ef95bc1f797443b246322582535c2e9b3aa8dc88d175bf5e39e55e5ac2b9d83c497918
   languageName: node
   linkType: hard
 
@@ -8753,9 +8753,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@next/swc-darwin-arm64@npm:15.5.21":
-  version: 15.5.21
-  resolution: "@next/swc-darwin-arm64@npm:15.5.21"
+"@next/swc-darwin-arm64@npm:15.5.24":
+  version: 15.5.24
+  resolution: "@next/swc-darwin-arm64@npm:15.5.24"
   conditions: os=darwin & cpu=arm64
   languageName: node
   linkType: hard
@@ -8774,9 +8774,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@next/swc-darwin-x64@npm:15.5.21":
-  version: 15.5.21
-  resolution: "@next/swc-darwin-x64@npm:15.5.21"
+"@next/swc-darwin-x64@npm:15.5.24":
+  version: 15.5.24
+  resolution: "@next/swc-darwin-x64@npm:15.5.24"
   conditions: os=darwin & cpu=x64
   languageName: node
   linkType: hard
@@ -8795,9 +8795,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@next/swc-linux-arm64-gnu@npm:15.5.21":
-  version: 15.5.21
-  resolution: "@next/swc-linux-arm64-gnu@npm:15.5.21"
+"@next/swc-linux-arm64-gnu@npm:15.5.24":
+  version: 15.5.24
+  resolution: "@next/swc-linux-arm64-gnu@npm:15.5.24"
   conditions: os=linux & cpu=arm64 & libc=glibc
   languageName: node
   linkType: hard
@@ -8816,9 +8816,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@next/swc-linux-arm64-musl@npm:15.5.21":
-  version: 15.5.21
-  resolution: "@next/swc-linux-arm64-musl@npm:15.5.21"
+"@next/swc-linux-arm64-musl@npm:15.5.24":
+  version: 15.5.24
+  resolution: "@next/swc-linux-arm64-musl@npm:15.5.24"
   conditions: os=linux & cpu=arm64 & libc=musl
   languageName: node
   linkType: hard
@@ -8837,9 +8837,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@next/swc-linux-x64-gnu@npm:15.5.21":
-  version: 15.5.21
-  resolution: "@next/swc-linux-x64-gnu@npm:15.5.21"
+"@next/swc-linux-x64-gnu@npm:15.5.24":
+  version: 15.5.24
+  resolution: "@next/swc-linux-x64-gnu@npm:15.5.24"
   conditions: os=linux & cpu=x64 & libc=glibc
   languageName: node
   linkType: hard
@@ -8858,9 +8858,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@next/swc-linux-x64-musl@npm:15.5.21":
-  version: 15.5.21
-  resolution: "@next/swc-linux-x64-musl@npm:15.5.21"
+"@next/swc-linux-x64-musl@npm:15.5.24":
+  version: 15.5.24
+  resolution: "@next/swc-linux-x64-musl@npm:15.5.24"
   conditions: os=linux & cpu=x64 & libc=musl
   languageName: node
   linkType: hard
@@ -8879,9 +8879,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@next/swc-win32-arm64-msvc@npm:15.5.21":
-  version: 15.5.21
-  resolution: "@next/swc-win32-arm64-msvc@npm:15.5.21"
+"@next/swc-win32-arm64-msvc@npm:15.5.24":
+  version: 15.5.24
+  resolution: "@next/swc-win32-arm64-msvc@npm:15.5.24"
   conditions: os=win32 & cpu=arm64
   languageName: node
   linkType: hard
@@ -8900,9 +8900,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@next/swc-win32-x64-msvc@npm:15.5.21":
-  version: 15.5.21
-  resolution: "@next/swc-win32-x64-msvc@npm:15.5.21"
+"@next/swc-win32-x64-msvc@npm:15.5.24":
+  version: 15.5.24
+  resolution: "@next/swc-win32-x64-msvc@npm:15.5.24"
   conditions: os=win32 & cpu=x64
   languageName: node
   linkType: hard
@@ -32237,23 +32237,23 @@ __metadata:
   languageName: node
   linkType: hard
 
-"next@npm:15.5.21":
-  version: 15.5.21
-  resolution: "next@npm:15.5.21"
+"next@npm:15.5.24":
+  version: 15.5.24
+  resolution: "next@npm:15.5.24"
   dependencies:
-    "@next/env": "npm:15.5.21"
-    "@next/swc-darwin-arm64": "npm:15.5.21"
-    "@next/swc-darwin-x64": "npm:15.5.21"
-    "@next/swc-linux-arm64-gnu": "npm:15.5.21"
-    "@next/swc-linux-arm64-musl": "npm:15.5.21"
-    "@next/swc-linux-x64-gnu": "npm:15.5.21"
-    "@next/swc-linux-x64-musl": "npm:15.5.21"
-    "@next/swc-win32-arm64-msvc": "npm:15.5.21"
-    "@next/swc-win32-x64-msvc": "npm:15.5.21"
+    "@next/env": "npm:15.5.24"
+    "@next/swc-darwin-arm64": "npm:15.5.24"
+    "@next/swc-darwin-x64": "npm:15.5.24"
+    "@next/swc-linux-arm64-gnu": "npm:15.5.24"
+    "@next/swc-linux-arm64-musl": "npm:15.5.24"
+    "@next/swc-linux-x64-gnu": "npm:15.5.24"
+    "@next/swc-linux-x64-musl": "npm:15.5.24"
+    "@next/swc-win32-arm64-msvc": "npm:15.5.24"
+    "@next/swc-win32-x64-msvc": "npm:15.5.24"
     "@swc/helpers": "npm:0.5.15"
     caniuse-lite: "npm:^1.0.30001579"
     postcss: "npm:8.4.31"
-    sharp: "npm:^0.34.3"
+    sharp: "npm:^0.34.3 || ^0.35.3"
     styled-jsx: "npm:5.1.6"
   peerDependencies:
     "@opentelemetry/api": ^1.1.0
@@ -32292,7 +32292,7 @@ __metadata:
       optional: true
   bin:
     next: dist/bin/next
-  checksum: 10/caa65d7b05399092d0135738f4dd6553d025fb4701f3e0dce4693f1e92591d8c1944db6c9470ae09f65397c87c8469d278fb1fb9de1eac2fb549941d64a15690
+  checksum: 10/fb31550dba1fdef53d4cea8a59eac895011a4cc3d49c902da430d5b7fdaa46d9ec904d61aa48f2b7c8714059ca0372995060a9d94d3ff4b2bd2bea15b174e489
   languageName: node
   linkType: hard
 
@@ -37879,7 +37879,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"sharp@npm:^0.35.3":
+"sharp@npm:^0.34.3 || ^0.35.3, sharp@npm:^0.35.3":
   version: 0.35.4
   resolution: "sharp@npm:0.35.4"
   dependencies: