diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index edaf1ca459..5c26b4fd94 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -53,7 +53,7 @@ repos:
         pass_filenames: false
         always_run: true
   - repo: https://github.com/scop/pre-commit-shfmt
-    rev: v3.13.1-1
+    rev: v3.14.1-1
     hooks:
       - id: shfmt
   - repo: https://github.com/adrienverge/yamllint.git
@@ -90,7 +90,7 @@ repos:
           - "config/keycloak/realms/ol-local-realm.json"
         additional_dependencies: ["gibberish-detector"]
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: "v0.15.21"
+    rev: "v0.16.8"
     hooks:
       - id: ruff-format
       - id: ruff
@@ -118,12 +118,12 @@ repos:
         exclude: node_modules/
         require_serial: false
   - repo: https://github.com/shellcheck-py/shellcheck-py
-    rev: v0.11.0.1
+    rev: v0.11.0.1-1
     hooks:
       - id: shellcheck
         args: ["--severity=warning"]
   - repo: https://github.com/zizmorcore/zizmor-pre-commit
-    rev: v1.29.0
+    rev: v1.30.1
     hooks:
       - id: zizmor
         args: [--no-progress, --min-severity=medium, --min-confidence=medium]
diff --git a/RELEASE.rst b/RELEASE.rst
index 852334a008..820f5acc3a 100644
--- a/RELEASE.rst
+++ b/RELEASE.rst
@@ -1,6 +1,18 @@
 Release Notes
 =============
 
+Version 0.81.2
+--------------
+
+- Fix OLL archive content ingestion (#3973)
+- Read the warehouse catalog and schema from settings (#4005)
+- Fall back to the original image before the default image (#4007)
+- feat(website-content): require SEO fields to publish, and align the published control bar (#4009)
+- Do not follow redirects when fetching OVS transcripts (#4003)
+- fix(learning_resources): gate summary/flashcards like content on ContentFileViewSet (#3999)
+- fix(widgets): remove the unused RSS Feed widget type (#4000)
+- Update pre-commit hooks and adapt to ruff 0.16 (#3993)
+
 Version 0.81.1
 --------------
 
diff --git a/docs/articles-cdn-purge.md b/docs/articles-cdn-purge.md
index 985d344722..41c134ef5a 100644
--- a/docs/articles-cdn-purge.md
+++ b/docs/articles-cdn-purge.md
@@ -150,7 +150,7 @@ article = Article.objects.create(
     title="New Article",
     content={"type": "doc", "content": []},
     is_published=True,
-    user=some_user
+    user=some_user,
 )
 # CDN purge is automatically queued!
 
@@ -168,7 +168,7 @@ You can manually trigger CDN purges:
 from articles.tasks import (
     fastly_purge_relative_url,
     fastly_purge_articles_list,
-    fastly_full_purge
+    fastly_full_purge,
 )
 
 # Purge a specific URL immediately (blocking)
@@ -192,7 +192,7 @@ For backwards compatibility, the following aliases are available but deprecated:
 # Old names (still work but discouraged)
 from articles.tasks import (
     queue_fastly_purge_articles_list,  # Use fastly_purge_articles_list
-    queue_fastly_full_purge,           # Use fastly_full_purge
+    queue_fastly_full_purge,  # Use fastly_full_purge
 )
 ```
 
@@ -260,6 +260,7 @@ All CDN purge operations are logged using Python's standard logging:
 
 ```python
 import logging
+
 logger = logging.getLogger("fastly_purge")
 ```
 
diff --git a/docs/how-to/articles-to-news.md b/docs/how-to/articles-to-news.md
index 0ab3bfe08b..22fb05507b 100644
--- a/docs/how-to/articles-to-news.md
+++ b/docs/how-to/articles-to-news.md
@@ -144,23 +144,27 @@ Article.objects.filter(is_published=True)
 ### 2. Transform
 
 ```python
-[{
-    'title': 'MIT Learn Articles',
-    'url': '/articles',
-    'feed_type': 'news',
-    'items': [{
-        'guid': 'article-1',
-        'title': 'My Article',
-        'url': '/articles/my-article',
-        'summary': 'First 500 chars...',
-        'content': 'Full text...',
-        'detail': {
-            'authors': ['John Doe'],
-            'topics': [],
-            'publish_date': '2024-01-01T00:00:00Z',
-        }
-    }]
-}]
+[
+    {
+        "title": "MIT Learn Articles",
+        "url": "/articles",
+        "feed_type": "news",
+        "items": [
+            {
+                "guid": "article-1",
+                "title": "My Article",
+                "url": "/articles/my-article",
+                "summary": "First 500 chars...",
+                "content": "Full text...",
+                "detail": {
+                    "authors": ["John Doe"],
+                    "topics": [],
+                    "publish_date": "2024-01-01T00:00:00Z",
+                },
+            }
+        ],
+    }
+]
 ```
 
 ### 3. Load
@@ -190,21 +194,20 @@ The `extract_text_from_content()` function needs customization based on your JSO
 ```python
 def extract_text_from_content(content_json: dict) -> str:
     # For Draft.js
-    blocks = content_json.get('blocks', [])
-    return ' '.join([block.get('text', '') for block in blocks])
+    blocks = content_json.get("blocks", [])
+    return " ".join([block.get("text", "") for block in blocks])
+
     # For ProseMirror
     def walk_nodes(node):
-        if node.get('type') == 'text':
-            return node.get('text', '')
-        children = node.get('content', [])
-        return ' '.join(walk_nodes(child) for child in children)
+        if node.get("type") == "text":
+            return node.get("text", "")
+        children = node.get("content", [])
+        return " ".join(walk_nodes(child) for child in children)
+
     return walk_nodes(content_json)
     # For EditorJS
-    blocks = content_json.get('blocks', [])
-    return ' '.join([
-        block.get('data', {}).get('text', '')
-        for block in blocks
-    ])
+    blocks = content_json.get("blocks", [])
+    return " ".join([block.get("data", {}).get("text", "") for block in blocks])
 ```
 
 ### 2. Add Image Support
@@ -235,7 +238,8 @@ If you add topics to your Article model:
 ```python
 class Article(TimestampedModel):
     # ... existing fields ...
-    topics = models.ManyToManyField('Topic')
+    topics = models.ManyToManyField("Topic")
+
 
 # In transform_items:
 entry = {
@@ -294,7 +298,7 @@ article = Article.objects.create(
     title="Test Article",
     content={"blocks": [{"text": "Test content"}]},
     user=user,
-    is_published=True
+    is_published=True,
 )
 ```
 
@@ -317,6 +321,7 @@ result = pipelines.articles_news_etl()
 
 # Check results
 from news_events.models import FeedSource
+
 source = FeedSource.objects.get(title="MIT Learn Articles")
 print(f"Found {source.feed_items.count()} articles in news feed")
 ```
@@ -340,6 +345,7 @@ print(f"Found {source.feed_items.count()} articles in news feed")
 3. **Check for errors:**
    ```python
    from news_events.tasks import get_articles_news
+
    get_articles_news()  # Run synchronously to see errors
    ```
 
@@ -350,6 +356,7 @@ print(f"Found {source.feed_items.count()} articles in news feed")
 - Add debug logging:
   ```python
   import logging
+
   log = logging.getLogger(__name__)
   log.info(f"Content structure: {content_json}")
   ```
diff --git a/frontends/api/src/generated/v0/api.ts b/frontends/api/src/generated/v0/api.ts
index bef5eb1592..6c81b6a9cc 100644
--- a/frontends/api/src/generated/v0/api.ts
+++ b/frontends/api/src/generated/v0/api.ts
@@ -2597,13 +2597,12 @@ export interface WidgetListRequest {
   widgets?: Array<WidgetInstance> | null
 }
 /**
- * * `Markdown` - Markdown * `URL` - URL * `RSS Feed` - RSS Feed * `People` - People
+ * * `Markdown` - Markdown * `URL` - URL * `People` - People
  */
 
 export const WidgetTypeEnumDescriptions = {
   Markdown: "Markdown",
   URL: "URL",
-  "RSS Feed": "RSS Feed",
   People: "People",
 } as const
 
@@ -2616,10 +2615,6 @@ export const WidgetTypeEnum = {
    * URL
    */
   Url: "URL",
-  /**
-   * RSS Feed
-   */
-  RssFeed: "RSS Feed",
   /**
    * People
    */
diff --git a/frontends/main/src/app-pages/ProductPages/MitxOnlineResourceCard.test.tsx b/frontends/main/src/app-pages/ProductPages/MitxOnlineResourceCard.test.tsx
index 0c6e5413d9..23d6bcd1b9 100644
--- a/frontends/main/src/app-pages/ProductPages/MitxOnlineResourceCard.test.tsx
+++ b/frontends/main/src/app-pages/ProductPages/MitxOnlineResourceCard.test.tsx
@@ -5,7 +5,7 @@ import { factories } from "api/mitxonline-test-utils"
 import { DisplayModeEnum } from "@mitodl/mitxonline-api-axios/v2"
 import { renderWithProviders } from "@/test-utils"
 import { DEFAULT_RESOURCE_IMG } from "ol-utilities"
-import { getByImageSrc } from "ol-test-utilities"
+import { getByImageSrc, queryByImageSrc } from "ol-test-utilities"
 import type { MitxOnlineResourceCardProps } from "./MitxOnlineResourceCard"
 
 const renderCard = (props: MitxOnlineResourceCardProps) =>
@@ -163,7 +163,7 @@ describe("MitxOnlineResourceCard", () => {
   })
 
   describe("image error fallback", () => {
-    test("falls back to DEFAULT_RESOURCE_IMG when course image returns 404", () => {
+    test("falls back to the original, then DEFAULT_RESOURCE_IMG, when course image fails", () => {
       const course = factories.courses.course({
         page: {
           feature_image_src: "https://example.com/course.jpg",
@@ -175,13 +175,25 @@ describe("MitxOnlineResourceCard", () => {
         resourceType: "course",
         href: "/test",
       })
+      const raw = { nextJsOriginalSrc: false }
+      expect(
+        queryByImageSrc(view.container, "https://example.com/course.jpg", raw),
+      ).toBeNull()
+      // Optimized image fails: retry the original, loaded directly
       fireEvent.error(
         getByImageSrc(view.container, "https://example.com/course.jpg"),
       )
+      const original = getByImageSrc(
+        view.container,
+        "https://example.com/course.jpg",
+        raw,
+      )
+      // Original fails too: use the default
+      fireEvent.error(original)
       getByImageSrc(view.container, DEFAULT_RESOURCE_IMG)
     })
 
-    test("falls back to DEFAULT_RESOURCE_IMG when program image returns 404", () => {
+    test("falls back to the original, then DEFAULT_RESOURCE_IMG, when program image fails", () => {
       const program = factories.programs.program({
         page: {
           feature_image_src: "https://example.com/program.jpg",
@@ -193,9 +205,21 @@ describe("MitxOnlineResourceCard", () => {
         resourceType: "program",
         href: "/test",
       })
+      const raw = { nextJsOriginalSrc: false }
+      expect(
+        queryByImageSrc(view.container, "https://example.com/program.jpg", raw),
+      ).toBeNull()
+      // Optimized image fails: retry the original, loaded directly
       fireEvent.error(
         getByImageSrc(view.container, "https://example.com/program.jpg"),
       )
+      const original = getByImageSrc(
+        view.container,
+        "https://example.com/program.jpg",
+        raw,
+      )
+      // Original fails too: use the default
+      fireEvent.error(original)
       getByImageSrc(view.container, DEFAULT_RESOURCE_IMG)
     })
   })
diff --git a/frontends/main/src/app-pages/ProductPages/MitxOnlineResourceCard.tsx b/frontends/main/src/app-pages/ProductPages/MitxOnlineResourceCard.tsx
index 106b63f1a1..bb5a18fdcb 100644
--- a/frontends/main/src/app-pages/ProductPages/MitxOnlineResourceCard.tsx
+++ b/frontends/main/src/app-pages/ProductPages/MitxOnlineResourceCard.tsx
@@ -151,7 +151,11 @@ const MitxOnlineResourceCard: React.FC<MitxOnlineResourceCardProps> = (
     label,
   } = props
 
-  const { src: imageSrc, onError: onImageError } = useImageWithFallback(
+  const {
+    src: imageSrc,
+    unoptimized: imageUnoptimized,
+    onError: onImageError,
+  } = useImageWithFallback(
     props.resource?.page?.feature_image_src,
     DEFAULT_RESOURCE_IMG,
   )
@@ -180,6 +184,7 @@ const MitxOnlineResourceCard: React.FC<MitxOnlineResourceCardProps> = (
       imageSrc={imageSrc}
       imageAlt=""
       onImageError={onImageError}
+      imageUnoptimized={imageUnoptimized}
       title={data.title}
       resourceType={data.displayType}
       resourcePrice={data.resourcePrice}
diff --git a/frontends/main/src/app-pages/ProductPages/ProductPageTemplate.test.tsx b/frontends/main/src/app-pages/ProductPages/ProductPageTemplate.test.tsx
index 78bc07ca5a..e4bd457db7 100644
--- a/frontends/main/src/app-pages/ProductPages/ProductPageTemplate.test.tsx
+++ b/frontends/main/src/app-pages/ProductPages/ProductPageTemplate.test.tsx
@@ -12,7 +12,7 @@ import { PostHogEvents } from "@/common/constants"
 import type { ResourceInfo } from "./ProductPageTemplate"
 import { PlatformEnum } from "api"
 import { DEFAULT_RESOURCE_IMG } from "ol-utilities"
-import { getAllByImageSrc } from "ol-test-utilities"
+import { getAllByImageSrc, queryAllByImageSrc } from "ol-test-utilities"
 
 jest.mock("posthog-js/react", () => ({
   ...jest.requireActual("posthog-js/react"),
@@ -74,7 +74,7 @@ const renderProductPageTemplate = (
 }
 
 describe("ProductPageTemplate image error fallback", () => {
-  it("falls back to DEFAULT_RESOURCE_IMG when imageSrc returns 404", () => {
+  it("falls back to the original image, then DEFAULT_RESOURCE_IMG, when imageSrc fails", () => {
     setMockResponse.get(urls.userMe.get(), { is_authenticated: false })
     const { view } = renderWithProviders(
       <ProductPageTemplate
@@ -90,9 +90,14 @@ describe("ProductPageTemplate image error fallback", () => {
       </ProductPageTemplate>,
     )
 
-    getAllByImageSrc(view.container, "https://example.com/image.jpg").forEach(
-      (img) => fireEvent.error(img),
-    )
+    const src = "https://example.com/image.jpg"
+    const raw = { nextJsOriginalSrc: false }
+    expect(queryAllByImageSrc(view.container, src, raw)).toHaveLength(0)
+    // Optimized image fails: retry the original, loaded directly
+    getAllByImageSrc(view.container, src).forEach((img) => fireEvent.error(img))
+    const originals = getAllByImageSrc(view.container, src, raw)
+    // Original fails too: use the default
+    originals.forEach((img) => fireEvent.error(img))
     expect(
       getAllByImageSrc(view.container, DEFAULT_RESOURCE_IMG).length,
     ).toBeGreaterThan(0)
diff --git a/frontends/main/src/app-pages/ProductPages/ProductPageTemplate.tsx b/frontends/main/src/app-pages/ProductPages/ProductPageTemplate.tsx
index 9d87d82b23..ae01e8d681 100644
--- a/frontends/main/src/app-pages/ProductPages/ProductPageTemplate.tsx
+++ b/frontends/main/src/app-pages/ProductPages/ProductPageTemplate.tsx
@@ -248,10 +248,11 @@ const SidebarMedia: React.FC<{
   title: string
   priority?: boolean
 }> = ({ videoUrl, imageSrc, title, priority }) => {
-  const { src: resolvedSrc, onError } = useImageWithFallback(
-    imageSrc,
-    DEFAULT_RESOURCE_IMG,
-  )
+  const {
+    src: resolvedSrc,
+    unoptimized,
+    onError,
+  } = useImageWithFallback(imageSrc, DEFAULT_RESOURCE_IMG)
 
   if (videoUrl) {
     const embedUrl = convertToEmbedUrl(videoUrl)
@@ -268,6 +269,7 @@ const SidebarMedia: React.FC<{
       height={306}
       src={resolvedSrc}
       alt=""
+      unoptimized={unoptimized}
       onError={onError}
     />
   )
diff --git a/frontends/main/src/app-pages/VideoPlaylistCollectionPage/VideoCard.tsx b/frontends/main/src/app-pages/VideoPlaylistCollectionPage/VideoCard.tsx
index c401c38e4c..6191d06ac6 100644
--- a/frontends/main/src/app-pages/VideoPlaylistCollectionPage/VideoCard.tsx
+++ b/frontends/main/src/app-pages/VideoPlaylistCollectionPage/VideoCard.tsx
@@ -1,4 +1,4 @@
-import React, { useState } from "react"
+import React from "react"
 import Image from "next/image"
 import Link from "next/link"
 import {
@@ -8,7 +8,7 @@ import {
   Skeleton,
   type TypographyProps,
 } from "ol-components"
-import { formatDurationClockTime } from "ol-utilities"
+import { formatDurationClockTime, useImageWithFallback } from "ol-utilities"
 import { stripAnchorTags } from "@/common/utils"
 import type { VideoResource } from "api/v1"
 import {
@@ -126,10 +126,11 @@ type VideoCardProps = {
 }
 
 const VideoCard: React.FC<VideoCardProps> = ({ resource, href }) => {
-  const [imgError, setImgError] = useState(false)
-  const imageUrl = !imgError
-    ? (resource?.image?.url ?? PLACEHOLDER_IMG)
-    : PLACEHOLDER_IMG
+  const {
+    src: imageUrl,
+    unoptimized,
+    onError,
+  } = useImageWithFallback(resource?.image?.url, PLACEHOLDER_IMG)
   const description = resource.description ?? ""
   const duration = resource.video?.duration
     ? formatDurationClockTime(resource.video.duration)
@@ -143,7 +144,8 @@ const VideoCard: React.FC<VideoCardProps> = ({ resource, href }) => {
           alt={resource.title}
           fill
           sizes="160px"
-          onError={() => setImgError(true)}
+          unoptimized={unoptimized}
+          onError={onError}
         />
         {duration && <DurationBadge>{duration}</DurationBadge>}
         <PlayOverlay className="play-overlay">
diff --git a/frontends/main/src/app-pages/WebsiteContent/WebsiteContentEditPage.happydom.test.tsx b/frontends/main/src/app-pages/WebsiteContent/WebsiteContentEditPage.happydom.test.tsx
index ee2d814956..ab2dab81ba 100644
--- a/frontends/main/src/app-pages/WebsiteContent/WebsiteContentEditPage.happydom.test.tsx
+++ b/frontends/main/src/app-pages/WebsiteContent/WebsiteContentEditPage.happydom.test.tsx
@@ -101,6 +101,9 @@ const setup = async (id: number, autosaveDelayMs = AUTOSAVE_OFF) => {
     content,
     content_type: "article",
     is_published: false,
+    /* Required to save the drawer, and not what these tests are about. */
+    seo_title: "A title for search",
+    seo_description: "A description for search results.",
   })
   setMockResponse.get(detailUrl(id), article)
 
diff --git a/frontends/main/src/page-components/ArticleSettings/ArticleSettingsDrawer.test.tsx b/frontends/main/src/page-components/ArticleSettings/ArticleSettingsDrawer.test.tsx
index e5132b36ae..1935e68c5b 100644
--- a/frontends/main/src/page-components/ArticleSettings/ArticleSettingsDrawer.test.tsx
+++ b/frontends/main/src/page-components/ArticleSettings/ArticleSettingsDrawer.test.tsx
@@ -187,7 +187,7 @@ describe("ArticleSettingsDrawer SEO fields", () => {
     mockTopics()
     const { onSave } = renderDrawer()
 
-    const field = await screen.findByLabelText("SEO Title")
+    const field = await screen.findByLabelText(/^SEO Title/)
     expect(field).toHaveAttribute("maxLength", "255")
 
     await userEvent.type(field, "x".repeat(260))
@@ -238,7 +238,7 @@ describe("ArticleSettingsDrawer SEO fields", () => {
     expect(under).toHaveAttribute("data-over-budget", "false")
 
     await userEvent.type(
-      await screen.findByLabelText("SEO Title"),
+      await screen.findByLabelText(/^SEO Title/),
       "x".repeat(50),
     )
 
diff --git a/frontends/main/src/page-components/ArticleSettings/ArticleSettingsDrawer.tsx b/frontends/main/src/page-components/ArticleSettings/ArticleSettingsDrawer.tsx
index f38743cd91..f48999651a 100644
--- a/frontends/main/src/page-components/ArticleSettings/ArticleSettingsDrawer.tsx
+++ b/frontends/main/src/page-components/ArticleSettings/ArticleSettingsDrawer.tsx
@@ -199,17 +199,21 @@ const FooterCta = styled.div({
 
 /**
  * What the topics section says about itself, which depends on which rule is
- * speaking: one that refuses to save without a topic, one that only wants them
- * before publishing, or neither.
+ * speaking: content already public that cannot be left without them, content
+ * that only needs them before it goes public, or neither.
+ *
+ * Keyed on `published` rather than on whether the save is refused: the two no
+ * longer coincide -- a draft's save is refused too while a publish is waiting
+ * on the drawer -- and telling a draft it is published would be simply wrong.
  */
 const topicsMessage = (
   contentLabel: string,
   empty: boolean,
   required: boolean,
-  mayNotBeEmptied: boolean,
+  published: boolean,
 ) => {
   const noun = contentLabel.toLowerCase()
-  if (empty && mayNotBeEmptied) {
+  if (empty && published) {
     return `A published ${noun} needs at least one topic`
   }
   if (empty && required) {
@@ -218,6 +222,31 @@ const topicsMessage = (
   return `Select one or more topics for your ${noun}`
 }
 
+/**
+ * What the SEO section says about itself, on the same three rules as topics.
+ *
+ * Named for what is missing rather than "these fields are required": the
+ * drawer opens on its own when a publish is held back, and the first thing
+ * the author needs to know is why it did.
+ */
+const seoMessage = (
+  contentLabel: string,
+  missing: boolean,
+  required: boolean,
+  published: boolean,
+) => {
+  const noun = contentLabel.toLowerCase()
+  const always =
+    "Both should be unique to this page, and they are the first thing someone reads in search results."
+  if (missing && published) {
+    return `A published ${noun} needs an SEO title and description. ${always}`
+  }
+  if (missing && required) {
+    return `Add an SEO title and description to publish your ${noun}. ${always}`
+  }
+  return `Add an SEO title and description to help search engines understand and display your ${noun}. ${always}`
+}
+
 /** Settings the drawer collects. Mirrors the fields in the design. */
 export interface ArticleSettingsValues {
   /**
@@ -261,21 +290,30 @@ export interface ArticleSettingsDrawerProps {
    */
   showTopics?: boolean
   /**
-   * Whether the content needs a topic before it can go public. The section
-   * says so while none is picked, which is what tells an editor why the
-   * drawer opened on them when they pressed Publish.
+   * Whether the content needs at least one topic.
+   *
+   * The section says so while none is picked -- which is what tells an editor
+   * why the drawer opened on them when they pressed Publish -- and the save is
+   * refused until one is. Refused rather than merely announced because this
+   * drawer is the one place a selection can be taken away, and because a
+   * caller holding a publish back is waiting on this save: letting it through
+   * incomplete would close the drawer and forget the press.
    */
   topicsRequired?: boolean
   /**
-   * Whether an empty selection may not be saved at all.
+   * Whether the content needs an SEO title and description, on exactly the
+   * same terms as `topicsRequired`.
    *
-   * This drawer is the one place a selection can be taken away, so a caller
-   * that gates only its own save buttons would still lose the topics through
-   * here. Separate from `topicsRequired` because the two do not coincide:
-   * content that is not public yet can be left without topics -- it is
-   * stopped at publishing -- while content already public cannot.
+   * Unlike topics this is not an article-only rule: a search result and a link
+   * preview are the editor's to write on news just as much.
    */
-  topicsMayNotBeEmptied?: boolean
+  seoRequired?: boolean
+  /**
+   * Whether the content is already public, which is only a matter of wording:
+   * which sentence a section shows when something it needs is missing. What is
+   * required, and what the save refuses, does not depend on it.
+   */
+  contentIsPublished?: boolean
   /** Values to open with. Re-read each time the drawer opens. */
   initialValues?: Partial<ArticleSettingsValues>
   /**
@@ -294,7 +332,8 @@ const ArticleSettingsDrawer = ({
   contentLabel = "Article",
   showTopics = true,
   topicsRequired = false,
-  topicsMayNotBeEmptied = false,
+  seoRequired = false,
+  contentIsPublished = false,
   initialValues,
   onSave,
 }: ArticleSettingsDrawerProps) => {
@@ -313,6 +352,13 @@ const ArticleSettingsDrawer = ({
    * Read here rather than at module scope, where NEXT_PUBLIC_* values are not
    * set yet. Missing, there is no suffix to reserve for.
    */
+  /**
+   * Whitespace does not count as provided: a space would satisfy a bare
+   * emptiness check and reach the page head as a blank title, which is worse
+   * than the fallback it displaced.
+   */
+  const seoMissing = !seoTitle.trim() || !seoDescription.trim()
+
   const siteName = env("NEXT_PUBLIC_SITE_NAME")
   const titleSuffix = siteName ? ` | ${siteName}` : ""
   const seoTitleBudget = SEO_TITLE_TAG_BUDGET - titleSuffix.length
@@ -514,7 +560,7 @@ const ArticleSettingsDrawer = ({
                     contentLabel,
                     selectedIds.length === 0,
                     topicsRequired,
-                    topicsMayNotBeEmptied,
+                    contentIsPublished,
                   )}
                 </Typography>
               </SectionHeading>
@@ -600,10 +646,12 @@ const ArticleSettingsDrawer = ({
                 SEO Settings
               </Typography>
               <Typography variant="body2">
-                Add an SEO title and description to help search engines
-                understand and display your {contentLabel.toLowerCase()}. Both
-                should be unique to this page, and they are the first thing
-                someone reads in search results.
+                {seoMessage(
+                  contentLabel,
+                  seoMissing,
+                  seoRequired,
+                  contentIsPublished,
+                )}
               </Typography>
             </SectionHeading>
             <div>
@@ -611,6 +659,7 @@ const ArticleSettingsDrawer = ({
                 name="seo_title"
                 label="SEO Title"
                 fullWidth
+                required={seoRequired}
                 placeholder="Enter a title for search results"
                 /* The budget belongs in the description, not only in the
                    counter: otherwise it is discoverable only by being run
@@ -635,6 +684,7 @@ const ArticleSettingsDrawer = ({
                 name="seo_description"
                 label="SEO Description"
                 fullWidth
+                required={seoRequired}
                 multiline
                 /* Sized to the budget rather than to the space: nine rows read
                    as an invitation to write far more than will ever show. */
@@ -662,10 +712,16 @@ const ArticleSettingsDrawer = ({
             </Button>
             <Button
               variant="primary"
-              /* Refused rather than silently ignored: the editor has emptied
-                 the selection on screen and has to see why it will not save. */
+              /**
+               * Refused rather than silently ignored, and refused on a draft
+               * as much as on something public: the fields are marked
+               * required and the section says they are, so letting the save
+               * through anyway would contradict both. The sections above say
+               * which one is missing.
+               */
               disabled={
-                topicsMayNotBeEmptied && showTopics && selectedIds.length === 0
+                (topicsRequired && showTopics && selectedIds.length === 0) ||
+                (seoRequired && seoMissing)
               }
               onClick={() => {
                 onSave?.({
diff --git a/frontends/main/src/page-components/LearningResourceExpanded/CallToActionSection.test.tsx b/frontends/main/src/page-components/LearningResourceExpanded/CallToActionSection.test.tsx
index 54eea7a44f..1eb8398bbe 100644
--- a/frontends/main/src/page-components/LearningResourceExpanded/CallToActionSection.test.tsx
+++ b/frontends/main/src/page-components/LearningResourceExpanded/CallToActionSection.test.tsx
@@ -5,7 +5,7 @@ import { faker } from "@faker-js/faker/locale/en"
 import { factories } from "api/test-utils"
 import type { LearningResource } from "api"
 import { DEFAULT_RESOURCE_IMG } from "ol-utilities"
-import { getByImageSrc } from "ol-test-utilities"
+import { getByImageSrc, queryByImageSrc } from "ol-test-utilities"
 import { PlatformEnum, ResourceTypeEnum } from "api"
 import { useFeatureFlagEnabled, usePostHog } from "posthog-js/react"
 import type { PostHog } from "posthog-js"
@@ -364,7 +364,7 @@ describe("CallToActionSection", () => {
       getByImageSrc(view.container, contentFileImageSrc)
     })
 
-    it("falls back to DEFAULT_RESOURCE_IMG when image.url returns 404", () => {
+    it("falls back to the original image, then DEFAULT_RESOURCE_IMG, when image.url fails", () => {
       const primaryUrl = "https://example.com/primary.jpg"
       const resource = factories.learningResources.resource({
         resource_type: ResourceTypeEnum.Document,
@@ -372,8 +372,13 @@ describe("CallToActionSection", () => {
       })
 
       const { view } = render(resource)
+      const raw = { nextJsOriginalSrc: false }
+      expect(queryByImageSrc(view.container, primaryUrl, raw)).toBeNull()
+      // Optimized image fails: retry the original, loaded directly
       fireEvent.error(getByImageSrc(view.container, primaryUrl))
-
+      const original = getByImageSrc(view.container, primaryUrl, raw)
+      // Original fails too: use the default
+      fireEvent.error(original)
       getByImageSrc(view.container, DEFAULT_RESOURCE_IMG)
     })
   })
diff --git a/frontends/main/src/page-components/LearningResourceExpanded/CallToActionSection.tsx b/frontends/main/src/page-components/LearningResourceExpanded/CallToActionSection.tsx
index 6c116a634b..fa778fcbb3 100644
--- a/frontends/main/src/page-components/LearningResourceExpanded/CallToActionSection.tsx
+++ b/frontends/main/src/page-components/LearningResourceExpanded/CallToActionSection.tsx
@@ -213,7 +213,11 @@ const ImageSection: React.FC<{
   resource?: LearningResource
   config: ImageConfig
 }> = ({ resource, config }) => {
-  const { src: imageUrl, onError: onImageError } = useImageWithFallback(
+  const {
+    src: imageUrl,
+    unoptimized,
+    onError: onImageError,
+  } = useImageWithFallback(
     resource?.image?.url ??
       (resource ? resourceContentFilesImageSrc(resource) : null),
     DEFAULT_RESOURCE_IMG,
@@ -227,6 +231,7 @@ const ImageSection: React.FC<{
           alt={resource?.image?.alt ?? ""}
           aspect={aspect}
           fill
+          unoptimized={unoptimized}
           onError={onImageError}
         />
       </ImageContainer>
diff --git a/frontends/main/src/page-components/TiptapEditor/contentTypes/article/ArticleEditor.happydom.test.tsx b/frontends/main/src/page-components/TiptapEditor/contentTypes/article/ArticleEditor.happydom.test.tsx
index d72a44e581..abf7e6bb37 100644
--- a/frontends/main/src/page-components/TiptapEditor/contentTypes/article/ArticleEditor.happydom.test.tsx
+++ b/frontends/main/src/page-components/TiptapEditor/contentTypes/article/ArticleEditor.happydom.test.tsx
@@ -121,10 +121,6 @@ describe("ArticleEditor article controls", () => {
     expect(screen.queryByRole("button", { name: "Unpublish Article" })).toBe(
       null,
     )
-    /* Unpublishing lives on the listing card's menu, not here. */
-    expect(screen.queryByRole("button", { name: "Unpublish Article" })).toBe(
-      null,
-    )
   })
 
   test("Settings opens the article settings drawer", async () => {
@@ -243,7 +239,12 @@ describe("ArticleEditor settings", () => {
     const [topic] = mainTopics.results
     setMockResponse.get(urls.topics.list({ limit: 1000 }), mainTopics)
 
-    const { article } = renderArticleEditor()
+    /* The SEO fields are required too, so they arrive already written -- this
+       test is about what the save sends, not about the requirement. */
+    const { article } = renderArticleEditor({
+      seoTitle: "A title for search",
+      seoDescription: "A description for search results.",
+    })
     setMockResponse.patch(urls.websiteContent.details(article.id), article)
 
     await userEvent.click(
@@ -262,7 +263,11 @@ describe("ArticleEditor settings", () => {
       expect(makeRequest).toHaveBeenCalledWith(
         expect.objectContaining({
           method: "patch",
-          body: { topics: [topic.id], seo_title: "", seo_description: "" },
+          body: {
+            topics: [topic.id],
+            seo_title: "A title for search",
+            seo_description: "A description for search results.",
+          },
         }),
       )
     })
@@ -273,18 +278,19 @@ describe("ArticleEditor settings", () => {
       urls.topics.list({ limit: 1000 }),
       factories.learningResources.topics({ count: 1 }),
     )
-    const { article } = renderArticleEditor()
+    /* A topic is required to save as well, so the article has one already. */
+    const { article } = renderArticleEditor({ topics: [7] })
     setMockResponse.patch(urls.websiteContent.details(article.id), article)
 
     await userEvent.click(
       await screen.findByRole("button", { name: "Settings" }),
     )
     await userEvent.type(
-      await screen.findByLabelText("SEO Title"),
+      await screen.findByLabelText(/^SEO Title/),
       "A better title for search",
     )
     await userEvent.type(
-      screen.getByLabelText("SEO Description"),
+      screen.getByLabelText(/^SEO Description/),
       "What this is about.",
     )
     await userEvent.click(screen.getByRole("button", { name: "Save Settings" }))
@@ -294,7 +300,7 @@ describe("ArticleEditor settings", () => {
         expect.objectContaining({
           method: "patch",
           body: {
-            topics: [],
+            topics: [7],
             seo_title: "A better title for search",
             seo_description: "What this is about.",
           },
@@ -317,10 +323,10 @@ describe("ArticleEditor settings", () => {
       await screen.findByRole("button", { name: "Settings" }),
     )
 
-    expect(await screen.findByLabelText("SEO Title")).toHaveValue(
+    expect(await screen.findByLabelText(/^SEO Title/)).toHaveValue(
       "Stored title",
     )
-    expect(screen.getByLabelText("SEO Description")).toHaveValue(
+    expect(screen.getByLabelText(/^SEO Description/)).toHaveValue(
       "Stored description",
     )
   })
@@ -345,13 +351,24 @@ describe("ArticleEditor settings", () => {
  * These are about the confirmation dialog, so they start from one that has
  * them -- as an article being published in earnest would.
  */
-const renderTopicalArticle = (
+/**
+ * An article that has everything publishing insists on: a topic, and an SEO
+ * title and description. Without all three the press opens the settings
+ * drawer instead, which is its own set of tests below.
+ */
+const renderPublishableArticle = (
   options: Parameters<typeof renderArticleEditor>[0] = {},
-) => renderArticleEditor({ topics: [7], ...options })
+) =>
+  renderArticleEditor({
+    topics: [7],
+    seoTitle: "A title for search",
+    seoDescription: "A description for search results.",
+    ...options,
+  })
 
 describe("ArticleEditor publish confirmation", () => {
   test("publishing a draft asks for confirmation first", async () => {
-    const { article } = renderTopicalArticle()
+    const { article } = renderPublishableArticle()
     setMockResponse.patch(urls.websiteContent.details(article.id), {
       ...article,
       is_published: true,
@@ -385,7 +402,7 @@ describe("ArticleEditor publish confirmation", () => {
   })
 
   test("cancelling the publish dialog saves nothing", async () => {
-    renderTopicalArticle()
+    renderPublishableArticle()
 
     await userEvent.click(
       await screen.findByRole("button", { name: "Publish" }),
@@ -401,7 +418,7 @@ describe("ArticleEditor publish confirmation", () => {
   test("re-saving an already published article does not ask", async () => {
     // The dialog confirms the transition to public, not every save, so editing
     // a live article and pressing Publish must save straight away.
-    const { article } = renderTopicalArticle({ isPublished: true })
+    const { article } = renderPublishableArticle({ isPublished: true })
     setMockResponse.patch(urls.websiteContent.details(article.id), article)
 
     const heading = await screen.findByRole("heading", { level: 1 })
@@ -426,7 +443,7 @@ describe("ArticleEditor publish confirmation errors", () => {
    * save was dismissed as though it had worked.
    */
   test("a failed publish leaves the confirmation open", async () => {
-    const { article } = renderTopicalArticle()
+    const { article } = renderPublishableArticle()
     setMockResponse.patch(
       urls.websiteContent.details(article.id),
       { detail: "boom" },
@@ -463,7 +480,7 @@ describe("ArticleEditor publish confirmation errors", () => {
   })
 
   test("a successful publish closes the confirmation", async () => {
-    const { article } = renderTopicalArticle()
+    const { article } = renderPublishableArticle()
     setMockResponse.patch(urls.websiteContent.details(article.id), {
       ...article,
       is_published: true,
@@ -494,7 +511,11 @@ describe("ArticleEditor topics requirement", () => {
 
   test("publishing with no topics asks for them instead", async () => {
     mockTopics()
-    renderArticleEditor()
+    /* SEO supplied, so topics are the only thing that can hold the press. */
+    renderArticleEditor({
+      seoTitle: "A title for search",
+      seoDescription: "A description for search results.",
+    })
 
     await userEvent.click(
       await screen.findByRole("button", { name: "Publish" }),
@@ -521,7 +542,8 @@ describe("ArticleEditor topics requirement", () => {
 
     await userEvent.type(await screen.findByRole("heading", { level: 1 }), "!")
 
-    // Autosave cannot stop to ask, so the requirement is the publish's alone.
+    // Autosave cannot stop to ask, so neither requirement -- topics or the
+    // SEO fields -- is the draft save's to enforce.
     await waitFor(
       () => {
         expect(makeRequest).toHaveBeenCalledWith(
@@ -540,7 +562,10 @@ describe("ArticleEditor topics requirement", () => {
 
   test("the held-back publish resumes once a topic is picked", async () => {
     const topic = mockTopics()
-    const { article } = renderArticleEditor()
+    const { article } = renderArticleEditor({
+      seoTitle: "A title for search",
+      seoDescription: "A description for search results.",
+    })
     setMockResponse.patch(urls.websiteContent.details(article.id), {
       ...article,
       is_published: true,
@@ -577,11 +602,15 @@ describe("ArticleEditor topics requirement", () => {
     })
   })
 
-  test("a draft's topics can be cleared", async () => {
+  test("a draft's topics may not be emptied either", async () => {
     const topics = factories.learningResources.topics({ count: 1 })
     const [topic] = topics.results
     setMockResponse.get(urls.topics.list({ limit: 1000 }), topics)
-    const { article } = renderArticleEditor({ topics: [topic.id] })
+    const { article } = renderArticleEditor({
+      topics: [topic.id],
+      seoTitle: "A title for search",
+      seoDescription: "A description for search results.",
+    })
     setMockResponse.patch(urls.websiteContent.details(article.id), article)
 
     await userEvent.click(
@@ -592,20 +621,14 @@ describe("ArticleEditor topics requirement", () => {
     )
 
     /**
-     * Refused only once the content is public. A draft may sit without topics
-     * -- publishing is where they are insisted on, and autosave cannot stop to
-     * ask -- so the editor is not trapped into keeping a topic they removed.
+     * Not only once the content is public. The field is marked required and
+     * the section says a topic is needed, so letting the save through on a
+     * draft would contradict both -- and the topics would be gone.
      */
-    await userEvent.click(screen.getByRole("button", { name: "Save Settings" }))
-
-    await waitFor(() => {
-      expect(makeRequest).toHaveBeenCalledWith(
-        expect.objectContaining({
-          method: "patch",
-          body: { topics: [], seo_title: "", seo_description: "" },
-        }),
-      )
-    })
+    expect(screen.getByRole("button", { name: "Save Settings" })).toBeDisabled()
+    expect(makeRequest).not.toHaveBeenCalledWith(
+      expect.objectContaining({ method: "patch" }),
+    )
   })
 
   test("the drawer will not save a published article with its topics emptied", async () => {
@@ -639,7 +662,10 @@ describe("ArticleEditor topics requirement", () => {
 
   test("closing the drawer abandons the held-back publish", async () => {
     const topic = mockTopics()
-    const { article } = renderArticleEditor()
+    const { article } = renderArticleEditor({
+      seoTitle: "A title for search",
+      seoDescription: "A description for search results.",
+    })
     setMockResponse.patch(urls.websiteContent.details(article.id), article)
 
     await userEvent.click(
@@ -663,7 +689,11 @@ describe("ArticleEditor topics requirement", () => {
       expect(makeRequest).toHaveBeenCalledWith(
         expect.objectContaining({
           method: "patch",
-          body: { topics: [topic.id], seo_title: "", seo_description: "" },
+          body: {
+            topics: [topic.id],
+            seo_title: "A title for search",
+            seo_description: "A description for search results.",
+          },
         }),
       )
     })
@@ -676,6 +706,188 @@ describe("ArticleEditor topics requirement", () => {
   })
 })
 
+/**
+ * The SEO title and description are held to the same rule as topics, and for
+ * the same reason: they are what a search result and a link preview show, and
+ * without them the page head falls back to the title and whatever the body
+ * happens to open with.
+ */
+describe("ArticleEditor SEO requirement", () => {
+  const mockTopics = () => {
+    setMockResponse.get(
+      urls.topics.list({ limit: 1000 }),
+      factories.learningResources.topics({ count: 1 }),
+    )
+  }
+
+  /** Topics supplied, so the SEO fields are the only thing left missing. */
+  const renderTopicalArticle = (
+    options: Parameters<typeof renderArticleEditor>[0] = {},
+  ) => renderArticleEditor({ topics: [7], ...options })
+
+  test("publishing without them asks for them instead", async () => {
+    mockTopics()
+    renderTopicalArticle()
+
+    await userEvent.click(
+      await screen.findByRole("button", { name: "Publish" }),
+    )
+
+    // The drawer, not the publish confirmation, and nothing saved.
+    await screen.findByRole("heading", { name: "Article Settings" })
+    expect(
+      screen.queryByRole("heading", { name: "Publish article" }),
+    ).not.toBeInTheDocument()
+    expect(makeRequest).not.toHaveBeenCalledWith(
+      expect.objectContaining({ method: "patch" }),
+    )
+    /* The section says why it opened, rather than leaving the editor to guess. */
+    await screen.findByText(
+      /Add an SEO title and description to publish your article/,
+    )
+  })
+
+  test("a description without a title is not enough", async () => {
+    mockTopics()
+    renderTopicalArticle({ seoDescription: "A description for search." })
+
+    await userEvent.click(
+      await screen.findByRole("button", { name: "Publish" }),
+    )
+
+    await screen.findByRole("heading", { name: "Article Settings" })
+    expect(
+      screen.queryByRole("heading", { name: "Publish article" }),
+    ).not.toBeInTheDocument()
+  })
+
+  test("whitespace does not pass for a title", async () => {
+    mockTopics()
+    renderTopicalArticle({
+      seoTitle: "   ",
+      seoDescription: "A description for search.",
+    })
+
+    await userEvent.click(
+      await screen.findByRole("button", { name: "Publish" }),
+    )
+
+    /* A space would satisfy a bare emptiness check and reach the page head as
+       a blank title -- worse than the fallback it displaced. */
+    await screen.findByRole("heading", { name: "Article Settings" })
+  })
+
+  test("the held-back publish resumes once both are written", async () => {
+    mockTopics()
+    const { article } = renderTopicalArticle()
+    setMockResponse.patch(urls.websiteContent.details(article.id), {
+      ...article,
+      is_published: true,
+    })
+
+    await userEvent.click(
+      await screen.findByRole("button", { name: "Publish" }),
+    )
+    await screen.findByRole("heading", { name: "Article Settings" })
+
+    await userEvent.type(
+      await screen.findByLabelText(/^SEO Title/),
+      "A title for search",
+    )
+    await userEvent.type(
+      screen.getByLabelText(/^SEO Description/),
+      "A description for search results.",
+    )
+    await userEvent.click(screen.getByRole("button", { name: "Save Settings" }))
+
+    // Picking up where the press left off, confirmation included.
+    await userEvent.click(
+      await screen.findByRole("button", { name: "Yes, Publish article" }),
+    )
+
+    await waitFor(() => {
+      expect(makeRequest).toHaveBeenCalledWith(
+        expect.objectContaining({
+          method: "patch",
+          body: expect.objectContaining({
+            is_published: true,
+            seo_title: "A title for search",
+            seo_description: "A description for search results.",
+          }),
+        }),
+      )
+    })
+  }, 30000)
+
+  /**
+   * Saving the drawer closes it, and closing forgets the press -- so a save
+   * that still left the fields blank would drop the publish with nothing on
+   * screen to say why.
+   */
+  test("the drawer will not save while the publish is still waiting", async () => {
+    mockTopics()
+    renderTopicalArticle()
+
+    await userEvent.click(
+      await screen.findByRole("button", { name: "Publish" }),
+    )
+    await screen.findByRole("heading", { name: "Article Settings" })
+
+    expect(screen.getByRole("button", { name: "Save Settings" })).toBeDisabled()
+
+    await userEvent.type(
+      await screen.findByLabelText(/^SEO Title/),
+      "A title for search",
+    )
+    /* Still only one of the two. */
+    expect(screen.getByRole("button", { name: "Save Settings" })).toBeDisabled()
+
+    await userEvent.type(
+      screen.getByLabelText(/^SEO Description/),
+      "A description.",
+    )
+    expect(screen.getByRole("button", { name: "Save Settings" })).toBeEnabled()
+  }, 30000)
+
+  test("a published article may not have them emptied", async () => {
+    mockTopics()
+    renderPublishableArticle({ isPublished: true })
+
+    await userEvent.click(
+      await screen.findByRole("button", { name: "Settings" }),
+    )
+    await userEvent.clear(await screen.findByLabelText(/^SEO Title/))
+
+    expect(screen.getByRole("button", { name: "Save Settings" })).toBeDisabled()
+    await screen.findByText(
+      /A published article needs an SEO title and description/,
+    )
+  }, 20000)
+
+  test("a draft's settings cannot be saved without them", async () => {
+    mockTopics()
+    renderArticleEditor({ topics: [7] })
+
+    await userEvent.click(
+      await screen.findByRole("button", { name: "Settings" }),
+    )
+
+    /**
+     * Refused on a draft too, not only once it is public: the fields are
+     * marked required and the section says so, so a save that went through
+     * anyway would contradict both.
+     *
+     * The draft's *content* is unaffected -- autosave keeps writing it, and
+     * only the drawer's own settings wait here.
+     */
+    await screen.findByRole("heading", { name: "Article Settings" })
+    expect(screen.getByRole("button", { name: "Save Settings" })).toBeDisabled()
+    expect(makeRequest).not.toHaveBeenCalledWith(
+      expect.objectContaining({ method: "patch" }),
+    )
+  })
+})
+
 describe("ArticleEditor autosave", () => {
   test("a draft saves itself once typing stops", async () => {
     const { article } = renderArticleEditor({
@@ -833,6 +1045,9 @@ describe("ArticleEditor autosave", () => {
     setMockResponse.get(urls.topics.list({ limit: 1000 }), topics)
     const { article } = renderArticleEditor({
       autosaveDelayMs: AUTOSAVE_DELAY_MS,
+      /* Required to save the drawer, and not what this test is about. */
+      seoTitle: "A title for search",
+      seoDescription: "A description for search results.",
     })
 
     let contentWriteFinished = false
@@ -907,8 +1122,7 @@ describe("ArticleEditor autosave", () => {
   }, 30000)
 
   test("a publish waits for the draft save already in flight", async () => {
-    const { article } = renderArticleEditor({
-      topics: [7],
+    const { article } = renderPublishableArticle({
       autosaveDelayMs: AUTOSAVE_DELAY_MS,
     })
     /**
@@ -978,9 +1192,8 @@ describe("ArticleEditor autosave", () => {
   }, 25000)
 
   test("a published article is never saved behind the author's back", async () => {
-    const { article } = renderArticleEditor({
+    const { article } = renderPublishableArticle({
       isPublished: true,
-      topics: [7],
       autosaveDelayMs: AUTOSAVE_DELAY_MS,
     })
     setMockResponse.patch(urls.websiteContent.details(article.id), article)
@@ -1072,3 +1285,50 @@ describe("ArticleEditor edit-mode control bar layout", () => {
     expect(settings.querySelector("svg")).toBeInTheDocument()
   })
 })
+
+/**
+ * The published view's bar is the same bar in the same place, so it is laid
+ * out the same way. It used to run the full width of the window with its
+ * buttons against the left edge and the status against the right, which read
+ * as a different component.
+ */
+describe("ArticleEditor published control bar layout", () => {
+  const renderPublished = () =>
+    renderArticleEditor({ readOnly: true, isPublished: true })
+
+  test("puts the status at one end and the actions at the other", async () => {
+    renderPublished()
+
+    const draft = await screen.findByRole("link", { name: "Draft" })
+    const edit = screen.getByRole("link", { name: "Edit" })
+    const settings = screen.getByRole("button", { name: "Settings" })
+    const status = screen.getByText(/Status:/)
+
+    // The status leads the row, as in edit mode; the actions follow it.
+    expect(
+      status.compareDocumentPosition(draft) & Node.DOCUMENT_POSITION_FOLLOWING,
+    ).toBeTruthy()
+    // Grouped at the far end, in the order the design has them.
+    expect(draft.nextElementSibling).toBe(edit)
+    expect(edit.nextElementSibling).toBe(settings)
+  })
+
+  test("the row is the same column the article is set in", async () => {
+    renderPublished()
+
+    const status = await screen.findByText(/Status:/)
+    const draft = screen.getByRole("link", { name: "Draft" })
+    const bar = screen.getByRole("toolbar")
+
+    /**
+     * One row inside the bar holding both ends, rather than the two sitting
+     * directly in a full-width toolbar. That row is what carries the article's
+     * 890px column, so the status lines up with the breadcrumb and the actions
+     * with the far edge of the text.
+     */
+    expect(bar.children).toHaveLength(1)
+    const [actionRow] = Array.from(bar.children)
+    expect(actionRow).toContainElement(status)
+    expect(actionRow).toContainElement(draft)
+  })
+})
diff --git a/frontends/main/src/page-components/TiptapEditor/contentTypes/news/NewsEditor.happydom.test.tsx b/frontends/main/src/page-components/TiptapEditor/contentTypes/news/NewsEditor.happydom.test.tsx
index 89f0e5e6d8..5056a953d4 100644
--- a/frontends/main/src/page-components/TiptapEditor/contentTypes/news/NewsEditor.happydom.test.tsx
+++ b/frontends/main/src/page-components/TiptapEditor/contentTypes/news/NewsEditor.happydom.test.tsx
@@ -65,6 +65,11 @@ describe("NewsEditor - Content Editing and Saving", () => {
       title,
       content,
       is_published: false,
+      /* These tests are about saving content, and publishing insists on an
+         SEO title and description -- without them the press opens the
+         settings drawer instead, which is covered on its own below. */
+      seo_title: "A title for search",
+      seo_description: "A description for search results.",
     })
     setMockResponse.get(urls.websiteContent.details(articleId), newsItem)
 
@@ -588,6 +593,26 @@ describe("NewsEditor - Content Editing and Saving", () => {
       expect(publishButton).not.toBeDisabled()
 
       fireEvent.click(publishButton!)
+
+      /**
+       * Nothing has ever been saved here, so there is no SEO title or
+       * description yet and the press opens the settings drawer first. Filling
+       * them in and saving resumes the publish, confirmation and all -- see
+       * "news is not published without an SEO title and description".
+       */
+      await screen.findByRole("heading", { name: "News Settings" })
+      await userEvent.type(
+        await screen.findByLabelText(/^SEO Title/),
+        "My Article in search",
+      )
+      await userEvent.type(
+        screen.getByLabelText(/^SEO Description/),
+        "What this article is about.",
+      )
+      await userEvent.click(
+        screen.getByRole("button", { name: "Save Settings" }),
+      )
+
       await confirmPublish()
 
       await waitFor(
@@ -1811,9 +1836,15 @@ describe("NewsEditor - shared content controls", () => {
        request for one would fail the suite. */
     setMockResponse.patch(urls.websiteContent.details(newsItem.id), newsItem)
     await userEvent.type(
-      await screen.findByLabelText("SEO Title"),
+      await screen.findByLabelText(/^SEO Title/),
       "News for search",
     )
+    /* Both are required, so the title alone does not unlock the save. */
+    expect(screen.getByRole("button", { name: "Save Settings" })).toBeDisabled()
+    await userEvent.type(
+      screen.getByLabelText(/^SEO Description/),
+      "What this is about.",
+    )
     await userEvent.click(screen.getByRole("button", { name: "Save Settings" }))
 
     /**
@@ -1825,9 +1856,104 @@ describe("NewsEditor - shared content controls", () => {
       expect(makeRequest).toHaveBeenCalledWith(
         expect.objectContaining({
           method: "patch",
-          body: { seo_title: "News for search", seo_description: "" },
+          body: {
+            seo_title: "News for search",
+            seo_description: "What this is about.",
+          },
         }),
       )
     })
   })
+
+  /**
+   * News has no topics section, so the SEO fields are the only thing
+   * publishing can be waiting on -- which makes this the case that would
+   * strand a held-back publish if the resume still tested the topic count.
+   */
+  test("news is not published without an SEO title and description", async () => {
+    const user = factories.user.user({
+      is_authenticated: true,
+      is_article_editor: true,
+    })
+    setMockResponse.get(urls.userMe.get(), user)
+
+    const newsItem = factories.websiteContent.websiteContent({
+      id: 404,
+      title: "Draft news",
+      content_type: "news",
+      is_published: false,
+      /* A real banner: the editor takes its title from that heading, and
+         Publish is disabled without one. */
+      content: {
+        type: "doc",
+        content: [
+          {
+            type: "banner",
+            content: [
+              {
+                type: "heading",
+                attrs: { level: 1 },
+                content: [{ type: "text", text: "Draft news" }],
+              },
+              { type: "paragraph", content: [] },
+            ],
+          },
+          { type: "byline" },
+          { type: "paragraph", content: [] },
+        ],
+      },
+    })
+    setMockResponse.get(urls.websiteContent.details(newsItem.id), newsItem)
+    setMockResponse.patch(urls.websiteContent.details(newsItem.id), {
+      ...newsItem,
+      is_published: true,
+    })
+
+    renderWithProviders(
+      <NewsEditor autosaveDelayMs={AUTOSAVE_OFF} newsItem={newsItem} />,
+      { user },
+    )
+    await screen.findByTestId("editor")
+
+    await userEvent.click(
+      await screen.findByRole("button", { name: "Publish" }),
+    )
+
+    // The drawer, not the publish confirmation.
+    await screen.findByRole("heading", { name: "News Settings" })
+    expect(
+      screen.queryByRole("heading", { name: "Publish news" }),
+    ).not.toBeInTheDocument()
+    await screen.findByText(
+      /Add an SEO title and description to publish your news/,
+    )
+
+    await userEvent.type(
+      await screen.findByLabelText(/^SEO Title/),
+      "What MIT built this week",
+    )
+    await userEvent.type(
+      screen.getByLabelText(/^SEO Description/),
+      "A short summary for search results.",
+    )
+    await userEvent.click(screen.getByRole("button", { name: "Save Settings" }))
+
+    /* The press picks up where it left off, with no topics involved. */
+    await userEvent.click(
+      await screen.findByRole("button", { name: "Yes, Publish news" }),
+    )
+
+    await waitFor(() => {
+      expect(makeRequest).toHaveBeenCalledWith(
+        expect.objectContaining({
+          method: "patch",
+          body: expect.objectContaining({
+            is_published: true,
+            seo_title: "What MIT built this week",
+            seo_description: "A short summary for search results.",
+          }),
+        }),
+      )
+    })
+  }, 30000)
 })
diff --git a/frontends/main/src/page-components/TiptapEditor/core/WebsiteContentEditor.tsx b/frontends/main/src/page-components/TiptapEditor/core/WebsiteContentEditor.tsx
index bd1df31be3..78b2b8fa0b 100644
--- a/frontends/main/src/page-components/TiptapEditor/core/WebsiteContentEditor.tsx
+++ b/frontends/main/src/page-components/TiptapEditor/core/WebsiteContentEditor.tsx
@@ -371,11 +371,12 @@ const WebsiteContentEditor = ({
   const [isPublishing, setIsPublishing] = useState(false)
   const [settingsOpen, setSettingsOpen] = useState(false)
   /**
-   * Whether a publish is waiting on topics. `handleSettingsSave` resumes it
-   * once one has been picked. Only a publish is ever held back: a draft saves
+   * Whether a publish is waiting on the settings drawer -- for topics, for the
+   * SEO fields, or for both. `handleSettingsSave` resumes it once everything
+   * publishing needs is there. Only a publish is ever held back: a draft saves
    * itself, and autosave cannot stop to ask.
    */
-  const [awaitingTopicsForPublish, setAwaitingTopicsForPublish] =
+  const [awaitingSettingsForPublish, setAwaitingSettingsForPublish] =
     useState(false)
   const [uploadError, setUploadError] = useState<string | null>(null)
   const [resetAttempted, setResetAttempted] = useState(false)
@@ -592,10 +593,19 @@ const WebsiteContentEditor = ({
       overrides.topics = nextTopics
     }
 
-    // A publish that was held back resumes here, carrying the drawer's values,
-    // so the content write persists them and nothing is PATCHed twice.
-    if (awaitingTopicsForPublish && (nextTopics?.length ?? 0) > 0) {
-      setAwaitingTopicsForPublish(false)
+    /**
+     * A publish that was held back resumes here, carrying the drawer's values,
+     * so the content write persists them and nothing is PATCHed twice.
+     *
+     * Judged on what the drawer just handed over rather than on state, which
+     * has not landed yet. `!topicsRequired` matters for news: its drawer sends
+     * no `topics` at all, so a length test alone would strand a publish that
+     * was only ever waiting on the SEO fields.
+     */
+    const topicsSupplied = !topicsRequired || (nextTopics?.length ?? 0) > 0
+    const seoSupplied = !!seoTitle.trim() && !!seoDescription.trim()
+    if (awaitingSettingsForPublish && topicsSupplied && seoSupplied) {
+      setAwaitingSettingsForPublish(false)
       startPublish(overrides)
       return
     }
@@ -686,9 +696,21 @@ const WebsiteContentEditor = ({
   const topicsRequired = contentType === WebsiteContentContentTypeEnum.Article
   const topicsMissing = topicsRequired && topics.length === 0
 
-  /** Hold the publish back and ask for topics. */
-  const askForTopics = () => {
-    setAwaitingTopicsForPublish(true)
+  /**
+   * The SEO title and description are held to the same rule, and for the same
+   * reason: they are what a search result and a link preview show, and without
+   * them the page head falls back to the title and whatever the body happens
+   * to open with. Required on news as well as articles -- both are pages
+   * someone finds through search.
+   *
+   * Trimmed, so a space does not pass for a title.
+   */
+  const seoRequired = true
+  const seoMissing = !seo.title.trim() || !seo.description.trim()
+
+  /** Hold the publish back and ask for whatever publishing still needs. */
+  const askForSettings = () => {
+    setAwaitingSettingsForPublish(true)
     setSettingsOpen(true)
   }
 
@@ -894,34 +916,43 @@ const WebsiteContentEditor = ({
   )
 
   /**
-   * Published view: navigation and settings sit left, the status sits right
-   * (the Spacer splits them). Unpublishing is not offered here -- it lives on
-   * the listing card's menu, next to the item it acts on.
+   * Published view: the same row as edit mode -- status at the left end,
+   * actions at the right, the Spacer between them, all within the article's
+   * own column. Laid out here rather than differently because it is the same
+   * bar in the same place, and the two looked unrelated: this one ran the
+   * full width of the window, with its buttons against the left edge and the
+   * status against the right, while edit mode lines both up with the
+   * breadcrumb and the text.
+   *
+   * Unpublishing is not offered here -- it lives on the listing card's menu,
+   * next to the item it acts on.
    */
   const readOnlyToolbarSlot = (
-    <>
-      <ButtonLink
-        variant="bordered"
-        href={websiteContentDraftsView(contentType)}
-        size={buttonSize}
-        startIcon={<RiSave3Line />}
-      >
-        Draft
-      </ButtonLink>
-      {editIdOrSlug !== undefined ? (
+    <ActionRow>
+      {statusSlot}
+      <Spacer />
+      <StyledStatusContainer>
         <ButtonLink
           variant="bordered"
-          href={websiteContentEditView(contentType, editIdOrSlug)}
+          href={websiteContentDraftsView(contentType)}
           size={buttonSize}
-          startIcon={<RiEditLine />}
+          startIcon={<RiSave3Line />}
         >
-          Edit
+          Draft
         </ButtonLink>
-      ) : null}
-      {settingsButton}
-      <Spacer />
-      {statusSlot}
-    </>
+        {editIdOrSlug !== undefined ? (
+          <ButtonLink
+            variant="bordered"
+            href={websiteContentEditView(contentType, editIdOrSlug)}
+            size={buttonSize}
+            startIcon={<RiEditLine />}
+          >
+            Edit
+          </ButtonLink>
+        ) : null}
+        {settingsButton}
+      </StyledStatusContainer>
+    </ActionRow>
   )
 
   return (
@@ -940,9 +971,9 @@ const WebsiteContentEditor = ({
           <EditorContext.Provider value={{ editor }}>
             {isArticleEditor ? (
               readOnly ? (
-                <StyledStatusContainer>
-                  <StyledToolbar>{readOnlyToolbarSlot}</StyledToolbar>
-                </StyledStatusContainer>
+                /* No wrapper: `StyledToolbar` is fixed, so the flex box that
+                   used to be here could not lay it out either way. */
+                <StyledToolbar>{readOnlyToolbarSlot}</StyledToolbar>
               ) : (
                 <StackedToolbar>
                   {/* The design puts the actions above the formatting
@@ -962,8 +993,8 @@ const WebsiteContentEditor = ({
                           (!touched && contentItem?.is_published)
                         }
                         onClick={() => {
-                          if (topicsMissing) {
-                            askForTopics()
+                          if (topicsMissing || seoMissing) {
+                            askForSettings()
                             return
                           }
                           startPublish()
@@ -994,7 +1025,7 @@ const WebsiteContentEditor = ({
                   setSettingsOpen(false)
                   // Dropped rather than kept: a press the editor walked away
                   // from must not fire the next time topics happen to be saved.
-                  setAwaitingTopicsForPublish(false)
+                  setAwaitingSettingsForPublish(false)
                 }}
                 contentLabel={contentLabel}
                 /* Only an article becomes a LearningResource, so only there do
@@ -1003,13 +1034,10 @@ const WebsiteContentEditor = ({
                   contentType === WebsiteContentContentTypeEnum.Article
                 }
                 topicsRequired={topicsRequired}
-                /* Only once it is public: a draft may be left without topics,
-                   since publishing is where they are insisted on, and autosave
-                   cannot stop to ask. Refusing the save while the selection is
-                   empty would block the SEO fields along with them. */
-                topicsMayNotBeEmptied={
-                  topicsRequired && !!contentItem?.is_published
-                }
+                seoRequired={seoRequired}
+                /* Wording only -- which sentence a section shows when
+                   something it needs is missing. */
+                contentIsPublished={!!contentItem?.is_published}
                 initialValues={{
                   topics,
                   seoTitle: seo.title,
diff --git a/frontends/ol-components/src/components/BaseLearningResourceCard/BaseLearningResourceCard.tsx b/frontends/ol-components/src/components/BaseLearningResourceCard/BaseLearningResourceCard.tsx
index b7021ae7e3..56854cfd81 100644
--- a/frontends/ol-components/src/components/BaseLearningResourceCard/BaseLearningResourceCard.tsx
+++ b/frontends/ol-components/src/components/BaseLearningResourceCard/BaseLearningResourceCard.tsx
@@ -102,6 +102,8 @@ interface BaseLearningResourceCardProps {
   imageSrc?: string
   imageAlt?: string
   onImageError?: React.ReactEventHandler<HTMLImageElement>
+  /** Load `imageSrc` directly instead of through the Next.js image optimizer. */
+  imageUnoptimized?: boolean
   title?: string
   resourceType?: string
   /**
@@ -305,6 +307,7 @@ const BaseLearningResourceCard: React.FC<BaseLearningResourceCardProps> = ({
   imageSrc,
   imageAlt = "",
   onImageError,
+  imageUnoptimized,
   title,
   resourceType,
   resourcePrice,
@@ -518,6 +521,7 @@ const BaseLearningResourceCard: React.FC<BaseLearningResourceCardProps> = ({
             src={imageSrc}
             alt={imageAlt}
             onError={onImageError}
+            unoptimized={imageUnoptimized}
             {...IMAGE_SIZES["desktop"]}
           />
         )}
@@ -607,6 +611,7 @@ const BaseLearningResourceCard: React.FC<BaseLearningResourceCardProps> = ({
           src={imageSrc}
           alt={imageAlt}
           onError={onImageError}
+          unoptimized={imageUnoptimized}
           {...getImageDimensions(size, isMedia)}
         />
       )}
diff --git a/frontends/ol-components/src/components/LearningResourceCard/LearningResourceCard.test.tsx b/frontends/ol-components/src/components/LearningResourceCard/LearningResourceCard.test.tsx
index 1925b7ee64..d109473612 100644
--- a/frontends/ol-components/src/components/LearningResourceCard/LearningResourceCard.test.tsx
+++ b/frontends/ol-components/src/components/LearningResourceCard/LearningResourceCard.test.tsx
@@ -5,7 +5,7 @@ import type { LearningResourceCardProps } from "./LearningResourceCard"
 import { DEFAULT_RESOURCE_IMG, getReadableResourceType } from "ol-utilities"
 import { ResourceTypeEnum, PlatformEnum, AvailabilityEnum } from "api"
 import { factories } from "api/test-utils"
-import { getByImageSrc } from "ol-test-utilities"
+import { getByImageSrc, queryByImageSrc } from "ol-test-utilities"
 import { renderWithTheme } from "../../test-utils"
 
 // Helper function to create a date N days from today
@@ -316,7 +316,7 @@ describe("Learning Resource Card", () => {
     getByImageSrc(view.container, contentFileImageSrc)
   })
 
-  test("Falls back to DEFAULT_RESOURCE_IMG when image.url returns 404", () => {
+  test("Falls back to the original image, then DEFAULT_RESOURCE_IMG, when image.url fails", () => {
     const primaryUrl = "https://example.com/primary.jpg"
     const resource = factories.learningResources.resource({
       resource_type: ResourceTypeEnum.Document,
@@ -324,8 +324,28 @@ describe("Learning Resource Card", () => {
     })
 
     const view = setup({ resource })
+    const raw = { nextJsOriginalSrc: false }
+    expect(queryByImageSrc(view.container, primaryUrl, raw)).toBeNull()
+    // Optimized image fails: retry the original, loaded directly
     fireEvent.error(getByImageSrc(view.container, primaryUrl))
+    const original = getByImageSrc(view.container, primaryUrl, raw)
+    // Original fails too: use the default
+    fireEvent.error(original)
+    getByImageSrc(view.container, DEFAULT_RESOURCE_IMG)
+  })
+
+  test("Falls back to DEFAULT_RESOURCE_IMG after one error for images Next.js serves unoptimized", () => {
+    // Next.js doesn't optimize SVGs, so there is no separate original to retry
+    const svgUrl = "https://example.com/logo.svg"
+    const resource = factories.learningResources.resource({
+      resource_type: ResourceTypeEnum.Document,
+      image: { url: svgUrl, alt: "logo" },
+    })
 
+    const view = setup({ resource })
+    fireEvent.error(
+      getByImageSrc(view.container, svgUrl, { nextJsOriginalSrc: false }),
+    )
     getByImageSrc(view.container, DEFAULT_RESOURCE_IMG)
   })
 
diff --git a/frontends/ol-components/src/components/LearningResourceCard/LearningResourceCard.tsx b/frontends/ol-components/src/components/LearningResourceCard/LearningResourceCard.tsx
index 4e5feb8e21..21e7243038 100644
--- a/frontends/ol-components/src/components/LearningResourceCard/LearningResourceCard.tsx
+++ b/frontends/ol-components/src/components/LearningResourceCard/LearningResourceCard.tsx
@@ -62,7 +62,11 @@ const LearningResourceCard: React.FC<LearningResourceCardProps> = ({
   list = false,
   condensed = false,
 }) => {
-  const { src: imageSrc, onError: onImageError } = useImageWithFallback(
+  const {
+    src: imageSrc,
+    unoptimized: imageUnoptimized,
+    onError: onImageError,
+  } = useImageWithFallback(
     // won't try contentFile image if resource image 404s, but that matches
     // existing behavior: contentFile is only tried when resource has no image URL
     resource?.image?.url ??
@@ -169,6 +173,7 @@ const LearningResourceCard: React.FC<LearningResourceCardProps> = ({
       imageSrc={imageSrc}
       imageAlt={resource.image?.alt ?? ""}
       onImageError={onImageError}
+      imageUnoptimized={imageUnoptimized}
       title={resource.title}
       resourceType={resource.resource_category}
       resourcePrice={prices.course.display}
diff --git a/frontends/ol-components/src/components/LearningResourceCard/LearningResourceListCard.test.tsx b/frontends/ol-components/src/components/LearningResourceCard/LearningResourceListCard.test.tsx
index bbd8b2b53b..d450c0f906 100644
--- a/frontends/ol-components/src/components/LearningResourceCard/LearningResourceListCard.test.tsx
+++ b/frontends/ol-components/src/components/LearningResourceCard/LearningResourceListCard.test.tsx
@@ -5,7 +5,7 @@ import type { LearningResourceListCardProps } from "./LearningResourceListCard"
 import { DEFAULT_RESOURCE_IMG, getReadableResourceType } from "ol-utilities"
 import { ResourceTypeEnum, PlatformEnum, AvailabilityEnum } from "api"
 import { factories } from "api/test-utils"
-import { getByImageSrc } from "ol-test-utilities"
+import { getByImageSrc, queryByImageSrc } from "ol-test-utilities"
 import { renderWithTheme } from "../../test-utils"
 
 // Helper function to create a date N days from today
@@ -421,7 +421,7 @@ describe("Learning Resource List Card", () => {
     getByImageSrc(view.container, contentFileImageSrc)
   })
 
-  test("Falls back to DEFAULT_RESOURCE_IMG when image.url returns 404", () => {
+  test("Falls back to the original image, then DEFAULT_RESOURCE_IMG, when image.url fails", () => {
     const primaryUrl = "https://example.com/primary.jpg"
     const resource = factories.learningResources.resource({
       resource_type: ResourceTypeEnum.Document,
@@ -429,8 +429,13 @@ describe("Learning Resource List Card", () => {
     })
 
     const view = setup({ resource })
+    const raw = { nextJsOriginalSrc: false }
+    expect(queryByImageSrc(view.container, primaryUrl, raw)).toBeNull()
+    // Optimized image fails: retry the original, loaded directly
     fireEvent.error(getByImageSrc(view.container, primaryUrl))
-
+    const original = getByImageSrc(view.container, primaryUrl, raw)
+    // Original fails too: use the default
+    fireEvent.error(original)
     getByImageSrc(view.container, DEFAULT_RESOURCE_IMG)
   })
 
diff --git a/frontends/ol-components/src/components/LearningResourceCard/LearningResourceListCard.tsx b/frontends/ol-components/src/components/LearningResourceCard/LearningResourceListCard.tsx
index ec42b560ec..3924a408b9 100644
--- a/frontends/ol-components/src/components/LearningResourceCard/LearningResourceListCard.tsx
+++ b/frontends/ol-components/src/components/LearningResourceCard/LearningResourceListCard.tsx
@@ -165,7 +165,11 @@ const LearningResourceListCard: React.FC<LearningResourceListCardProps> = ({
   onClick,
   headingLevel = 6,
 }) => {
-  const { src: imageSrc, onError: onImageError } = useImageWithFallback(
+  const {
+    src: imageSrc,
+    unoptimized: imageUnoptimized,
+    onError: onImageError,
+  } = useImageWithFallback(
     resource?.image?.url ??
       (resource ? resourceContentFilesImageSrc(resource) : null),
     DEFAULT_RESOURCE_IMG,
@@ -228,6 +232,7 @@ const LearningResourceListCard: React.FC<LearningResourceListCardProps> = ({
       imageSrc={imageSrc}
       imageAlt={resource.image?.alt ?? ""}
       onImageError={onImageError}
+      imageUnoptimized={imageUnoptimized}
       title={resource.title}
       parentCourseName={formattedParentCourseName(resource)}
       resourceType={resource.resource_category}
diff --git a/frontends/ol-test-utilities/src/domQueries/byImageSrc.ts b/frontends/ol-test-utilities/src/domQueries/byImageSrc.ts
index 3e3aec0a80..92b7c6abaa 100644
--- a/frontends/ol-test-utilities/src/domQueries/byImageSrc.ts
+++ b/frontends/ol-test-utilities/src/domQueries/byImageSrc.ts
@@ -40,6 +40,8 @@ type QueryAllByImageSrcOpts = {
    */
   hidden?: boolean
 }
+type ByImageSrcArgs = [src: string | RegExp, opts?: QueryAllByImageSrcOpts]
+
 const DEFAULT_BY_IMAGE_SRC_OPTS: QueryAllByImageSrcOpts = {
   nextJsOriginalSrc: true,
   hidden: false,
@@ -83,7 +85,7 @@ const getImageSrcs = (c: HTMLElement, opts?: QueryAllByImageSrcOpts) => {
     .map((el) => (nextJsOriginalSrc ? getOriginalSrc(el) : el.src))
 }
 
-const getMultipleError: GetErrorFunction = (
+const getMultipleError: GetErrorFunction<ByImageSrcArgs> = (
   c,
   src: string | RegExp,
   opts?: QueryAllByImageSrcOpts,
@@ -92,7 +94,7 @@ const getMultipleError: GetErrorFunction = (
   const srcs = getImageSrcs(c, opts).join("\n\t")
   return `Found multiple <img /> elements matching src.\nExpected rrc:\n\t${src}\nFound srcs:\n\t${srcs}`
 }
-const getMissingError: GetErrorFunction = (
+const getMissingError: GetErrorFunction<ByImageSrcArgs> = (
   c,
   src: string | RegExp,
   opts?: QueryAllByImageSrcOpts,
diff --git a/frontends/ol-utilities/src/hooks/useImageWithFallback.test.ts b/frontends/ol-utilities/src/hooks/useImageWithFallback.test.ts
new file mode 100644
index 0000000000..552b08ab6d
--- /dev/null
+++ b/frontends/ol-utilities/src/hooks/useImageWithFallback.test.ts
@@ -0,0 +1,99 @@
+import { renderHook, act } from "@testing-library/react"
+import type { SyntheticEvent } from "react"
+import { useImageWithFallback } from "./useImageWithFallback"
+
+const SRC = "https://example.com/image.jpg"
+const FALLBACK = "/images/fallback.jpg"
+
+/** An error event from an <img> whose src was `failedSrc`. */
+const errorEvent = (failedSrc: string) =>
+  ({
+    currentTarget: { src: failedSrc },
+  }) as unknown as SyntheticEvent<HTMLImageElement>
+
+/** What the optimized <img> src looks like for `src`. */
+const optimized = (src: string) =>
+  `http://localhost/_next/image?url=${encodeURIComponent(src)}&w=640&q=75`
+
+test("starts with the optimized src", () => {
+  const { result } = renderHook(() => useImageWithFallback(SRC, FALLBACK))
+  expect(result.current.src).toBe(SRC)
+  expect(result.current.unoptimized).toBe(false)
+})
+
+test.each([null, undefined, ""])("uses the fallback when src is %p", (src) => {
+  const { result } = renderHook(() => useImageWithFallback(src, FALLBACK))
+  expect(result.current.src).toBe(FALLBACK)
+  expect(result.current.unoptimized).toBe(false)
+})
+
+test("retries the original unoptimized, then uses the fallback", () => {
+  const { result } = renderHook(() => useImageWithFallback(SRC, FALLBACK))
+
+  act(() => result.current.onError(errorEvent(optimized(SRC))))
+  expect(result.current.src).toBe(SRC)
+  expect(result.current.unoptimized).toBe(true)
+
+  act(() => result.current.onError(errorEvent(SRC)))
+  expect(result.current.src).toBe(FALLBACK)
+  expect(result.current.unoptimized).toBe(false)
+
+  // Stays on the fallback if that fails too
+  act(() => result.current.onError(errorEvent(`http://localhost${FALLBACK}`)))
+  expect(result.current.src).toBe(FALLBACK)
+  expect(result.current.unoptimized).toBe(false)
+})
+
+test("skips to the fallback when the failed image was already the original", () => {
+  // e.g. Next.js serves SVGs unoptimized, so the retry would be identical
+  const { result } = renderHook(() => useImageWithFallback(SRC, FALLBACK))
+  act(() => result.current.onError(errorEvent(SRC)))
+  expect(result.current.src).toBe(FALLBACK)
+  expect(result.current.unoptimized).toBe(false)
+})
+
+test("retries the original when the failed image went through the optimizer", () => {
+  const { result } = renderHook(() =>
+    useImageWithFallback("/images/local.png", FALLBACK),
+  )
+  act(() => result.current.onError(errorEvent(optimized("/images/local.png"))))
+  expect(result.current.src).toBe("/images/local.png")
+  expect(result.current.unoptimized).toBe(true)
+})
+
+test("starts over when src changes", () => {
+  const { result, rerender } = renderHook(
+    ({ src }) => useImageWithFallback(src, FALLBACK),
+    { initialProps: { src: SRC } },
+  )
+  act(() => result.current.onError(errorEvent(optimized(SRC))))
+  act(() => result.current.onError(errorEvent(SRC)))
+  expect(result.current.src).toBe(FALLBACK)
+
+  const other = "https://example.com/other.jpg"
+  rerender({ src: other })
+  expect(result.current.src).toBe(other)
+  expect(result.current.unoptimized).toBe(false)
+})
+
+test("a new src never renders with the previous src's stage", () => {
+  const renders: { src: string; unoptimized: boolean }[] = []
+  const { result, rerender } = renderHook(
+    ({ src }) => {
+      const value = useImageWithFallback(src, FALLBACK)
+      renders.push({ src: value.src, unoptimized: value.unoptimized })
+      return value
+    },
+    { initialProps: { src: SRC } },
+  )
+  // SRC is now loading its original, unoptimized
+  act(() => result.current.onError(errorEvent(optimized(SRC))))
+  expect(result.current.unoptimized).toBe(true)
+
+  const other = "https://example.com/other.jpg"
+  renders.length = 0
+  rerender({ src: other })
+  // Every render of `other` goes through the optimizer first
+  expect(renders.filter((r) => r.src === other)).not.toHaveLength(0)
+  expect(renders.filter((r) => r.src === other && r.unoptimized)).toEqual([])
+})
diff --git a/frontends/ol-utilities/src/hooks/useImageWithFallback.ts b/frontends/ol-utilities/src/hooks/useImageWithFallback.ts
index fa784934c7..bf7715afb1 100644
--- a/frontends/ol-utilities/src/hooks/useImageWithFallback.ts
+++ b/frontends/ol-utilities/src/hooks/useImageWithFallback.ts
@@ -1,26 +1,69 @@
 "use client"
 
-import { useState, useEffect, useCallback } from "react"
+import { useState, useCallback } from "react"
+import type { SyntheticEvent } from "react"
 
 /**
- * Returns image `src` and `onError` handler to assist in loading a fallback
- * image when `src` fails to load.
+ * - "optimized": `src` through the Next.js image optimizer
+ * - "original": `src` loaded directly by the browser (`unoptimized`)
+ * - "fallback": the fallback image
  */
+type Stage = "optimized" | "original" | "fallback"
+
+const isSameUrl = (src: string, loaded: string) => {
+  try {
+    return new URL(src, loaded).href === loaded
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Returns image `src`, `unoptimized` and `onError` for a Next.js `<Image>`,
+ * falling back first to the original image and then to `fallback`.
+ *
+ * The optimizer fetches remote images server-side, which some hosts block
+ * (e.g. bot protection returning 403) even though browsers can load them. So
+ * when the optimized image fails, retry `src` unoptimized before giving up.
+ * Pass all three values to the image.
+ */
+const initialStage = (src: string | null | undefined): Stage =>
+  src ? "optimized" : "fallback"
+
 const useImageWithFallback = (
   src: string | null | undefined,
   fallback: string,
 ) => {
-  const [resolvedSrc, setResolvedSrc] = useState(src ?? fallback)
-
-  useEffect(() => {
-    setResolvedSrc(src ?? fallback)
-  }, [src, fallback])
+  // The stage reached by the `src` that last failed. A different `src` starts
+  // over, derived during render so a new `src` never renders with the old
+  // `src`'s stage.
+  const [failure, setFailure] = useState<{ src: typeof src; stage: Stage }>()
+  const stage =
+    failure && failure.src === src ? failure.stage : initialStage(src)
 
-  const onError = useCallback(() => {
-    setResolvedSrc((current) => (current === fallback ? current : fallback))
-  }, [fallback])
+  const onError = useCallback(
+    (event: SyntheticEvent<HTMLImageElement>) => {
+      // Next.js serves some images unoptimized regardless (e.g. SVGs and data:
+      // URLs). If the image that failed was already the original, retrying it
+      // would render the same <img> and never error again, so skip ahead.
+      const wasOriginal = !!src && isSameUrl(src, event.currentTarget.src)
+      setFailure((cur) => {
+        const current = cur && cur.src === src ? cur.stage : initialStage(src)
+        return {
+          src,
+          stage:
+            current === "optimized" && !wasOriginal ? "original" : "fallback",
+        }
+      })
+    },
+    [src],
+  )
 
-  return { src: resolvedSrc, onError }
+  return {
+    src: stage === "fallback" || !src ? fallback : src,
+    unoptimized: stage === "original",
+    onError,
+  }
 }
 
 export { useImageWithFallback }
diff --git a/learning_resources/data/README-topics.md b/learning_resources/data/README-topics.md
index 1b73b287fd..6a7b49b96a 100644
--- a/learning_resources/data/README-topics.md
+++ b/learning_resources/data/README-topics.md
@@ -55,36 +55,40 @@ import csv
 import yaml
 from pathlib import Path
 
+
 def _process_topic(topic, offeror_code):
-	if not topic["mappings"]:
-		topic["mappings"] = {}
+    if not topic["mappings"]:
+        topic["mappings"] = {}
+
+    if not topic["mappings"] or offeror_code not in topic["mappings"]:
+        topic["mappings"][offeror_code] = []
 
-	if not topic["mappings"] or offeror_code not in topic["mappings"]:
-		topic["mappings"][offeror_code] = []
+    for csv_topic in csv_data:
+        if (
+            topic["name"] == csv_topic[1] or topic["name"] == csv_topic[2]
+        ) and csv_topic[0] not in topic["mappings"][offeror_code]:
+            topic["mappings"][offeror_code].append(csv_topic[0].strip())
 
-	for csv_topic in csv_data:
-		if (topic["name"] == csv_topic[1] or topic["name"] == csv_topic[2]) and csv_topic[0] not in topic["mappings"][offeror_code]:
-			topic["mappings"][offeror_code].append(csv_topic[0].strip())
+    if "children" in topic and topic["children"] and len(topic["children"]) > 0:
+        for child_topic in topic["children"]:
+            _process_topic(child_topic, offeror_code) if child_topic else None
 
-	if "children" in topic and topic["children"] and len(topic["children"]) > 0:
-		for child_topic in topic["children"]:
-			_process_topic(child_topic, offeror_code) if child_topic else None
 
 def process_topics(topics_file_loc, csv_loc, offeror_code, output_location):
-	with Path(topics_file_loc).open() as yaml_input_file:
-	    topic_data = yaml.safe_load(yaml_input_file.read())
+    with Path(topics_file_loc).open() as yaml_input_file:
+        topic_data = yaml.safe_load(yaml_input_file.read())
 
-	with Path(csv_loc).open() as csv_file:
-	    csv_reader = csv.reader(csv_file)
-	    csv_data = []
-	    for data in csv_reader:
-	        csv_data.append(data)
+    with Path(csv_loc).open() as csv_file:
+        csv_reader = csv.reader(csv_file)
+        csv_data = []
+        for data in csv_reader:
+            csv_data.append(data)
 
-	for topic in topic_data["topics"]:
-	    _process_topic(topic, offeror_code)
+    for topic in topic_data["topics"]:
+        _process_topic(topic, offeror_code)
 
-	with Path(output_location).open("w") as yaml_output_file:
-		yaml.dump(topic_data, yaml_output_file)
+    with Path(output_location).open("w") as yaml_output_file:
+        yaml.dump(topic_data, yaml_output_file)
 ```
 
 You can open a Django shell or a notebook and paste that in, then run `process_topics()` to process your datafile. The result of this will be written to the output location specified.
diff --git a/learning_resources/etl/constants.py b/learning_resources/etl/constants.py
index c8be83b508..e72b4f4b21 100644
--- a/learning_resources/etl/constants.py
+++ b/learning_resources/etl/constants.py
@@ -125,6 +125,11 @@ class CourseNumberType(Enum):
     ETLSource.xpro.value,
 ]
 
+# update_index and recreate_index index these sources' content files, matching
+# what content_files_loaded indexes on ingest. OLL is kept out of
+# RESOURCE_FILE_ETL_SOURCES, which also scopes cleanup_deleted_content_files.
+REINDEX_CONTENT_FILE_ETL_SOURCES = [*RESOURCE_FILE_ETL_SOURCES, ETLSource.oll.value]
+
 MARKETING_PAGE_FILE_TYPE = "marketing_page"
 
 RESOURCE_DELIVERY_MAPPING = {
diff --git a/learning_resources/etl/edx_shared.py b/learning_resources/etl/edx_shared.py
index 0378036996..0143c51a40 100644
--- a/learning_resources/etl/edx_shared.py
+++ b/learning_resources/etl/edx_shared.py
@@ -103,6 +103,8 @@ def build_run_lookup(
                 to_attr="_published_runs",
             )
         )
+        # ties among published runs go to the lowest id, as in run_for_edx_archive
+        .order_by("id")
     )
     if ids:
         runs = runs.filter(learning_resource_id__in=ids)
@@ -111,9 +113,10 @@ def build_run_lookup(
     for run in runs:
         normalized = normalize_run_id(etl_source, run.run_id)
         lookup.setdefault(normalized, []).append(run)
-        if etl_source == ETLSource.oll.name:
-            # OLL archive filenames omit the MITx+ prefix the run_ids carry
-            lookup.setdefault(normalized.removeprefix("mitx."), []).append(run)
+        if etl_source == ETLSource.oll.name and run.run_id.count("+") > 1:
+            # OLL archive filenames omit the org segment (MITx+, OCW+, ...)
+            org_less = normalize_run_id(etl_source, run.run_id.split("+", 1)[1])
+            lookup.setdefault(org_less, []).append(run)
     return lookup
 
 
@@ -335,7 +338,7 @@ def run_for_edx_archive(etl_source: str, archive_filename: str):
     # There should be only 1 matching run per course archive, warn if not
     if runs.count() > 1:
         log.warning("There are %d runs for %s", runs.count(), normalized_run_id)
-    return runs.first()
+    return runs.order_by("-published", "id").first()
 
 
 def sync_edx_course_files(
@@ -368,7 +371,8 @@ def sync_edx_course_files(
         if len(matching_runs) > 1:
             log.warning("There are %d runs for %s", len(matching_runs), key)
 
-        run = matching_runs[0]
+        # legacy unpublished runs can share an archive id with the current run
+        run = max(matching_runs, key=lambda r: r.published)
         if process_course_archive(bucket, key, run, overwrite=overwrite):
             processed += 1
         else:
@@ -412,7 +416,7 @@ def unpublish_excluded_content_files(
         matching_runs = run_lookup.get(extract_run_id_from_key(etl_source, key))
         if not matching_runs:
             continue
-        run = matching_runs[0]
+        run = max(matching_runs, key=lambda r: r.published)
         if not ContentFile.objects.filter(run=run).exists():
             # a run with no content files has none to unpublish, and its archive
             # is a download and an extract to find that out
diff --git a/learning_resources/etl/edx_shared_test.py b/learning_resources/etl/edx_shared_test.py
index d7a49844e7..b708d8ab45 100644
--- a/learning_resources/etl/edx_shared_test.py
+++ b/learning_resources/etl/edx_shared_test.py
@@ -203,6 +203,61 @@ def test_sync_edx_course_files_skips_unchanged_archive_keys(mocker):
     )
 
 
+def test_sync_edx_course_files_prefers_published_run(mocker):
+    """When two runs normalize to the same archive id, the published one wins"""
+    source = ETLSource.oll.name
+    course = LearningResourceFactory.create(
+        etl_source=source, published=True, create_runs=False
+    )
+    # legacy run from the retired OLL API ETL, created first so it has the lower pk
+    LearningResourceRunFactory.create(
+        learning_resource=course,
+        run_id="course-v1:MITx+8.01.1x+3T2018",
+        published=False,
+    )
+    current = LearningResourceRunFactory.create(
+        learning_resource=course, run_id="MITx+8.01.1x+3T2018", published=True
+    )
+    mocker.patch("learning_resources.etl.edx_shared.get_bucket_by_name")
+    mock_process = mocker.patch(
+        "learning_resources.etl.edx_shared.process_course_archive", return_value=True
+    )
+    key = f"{get_s3_prefix_for_source(source)}/8_01_1x_3T2018_OLL.tar.gz"
+
+    sync_edx_course_files(source, [course.id], [key])
+
+    assert mock_process.call_args[0][2] == current
+
+
+def test_sync_edx_course_files_published_tie_picks_lowest_id(mocker):
+    """When two published runs match one archive, the lower id wins, as on the webhook path"""
+    source = ETLSource.oll.name
+    course = LearningResourceFactory.create(
+        etl_source=source, published=True, create_runs=False
+    )
+    first = LearningResourceRunFactory.create(
+        learning_resource=course, run_id="placeholder", published=True
+    )
+    LearningResourceRunFactory.create(
+        learning_resource=course,
+        run_id="course-v1:MITx+8.01.1x+3T2018",
+        published=True,
+    )
+    # changing an indexed column rewrites the row at the end of the table, so an
+    # unordered query would return `first` last
+    first.run_id = "course-v1:OCW+8.01.1x+3T2018"
+    first.save()
+    mocker.patch("learning_resources.etl.edx_shared.get_bucket_by_name")
+    mock_process = mocker.patch(
+        "learning_resources.etl.edx_shared.process_course_archive", return_value=True
+    )
+    key = f"{get_s3_prefix_for_source(source)}/8_01_1x_3T2018_OLL.tar.gz"
+
+    sync_edx_course_files(source, [course.id], [key])
+
+    assert mock_process.call_args[0][2] == first
+
+
 @pytest.mark.parametrize("source", [ETLSource.mitxonline.value, ETLSource.xpro.value])
 def test_sync_edx_course_files_invalid_tarfile(
     mock_course_archive_bucket, mocker, source
@@ -592,6 +647,26 @@ def test_run_for_edx_archive(etl_source, platform, archive_filename, expected_ru
     assert result == run
 
 
+def test_run_for_edx_archive_prefers_published_run():
+    """A legacy unpublished twin with a lower pk must not win over the published run"""
+    from learning_resources.etl.edx_shared import run_for_edx_archive
+
+    source = ETLSource.oll.name
+    course = LearningResourceFactory.create(
+        etl_source=source, published=True, create_runs=False
+    )
+    LearningResourceRunFactory.create(
+        learning_resource=course,
+        run_id="course-v1:MITx+8.01.1x+3T2018",
+        published=False,
+    )
+    current = LearningResourceRunFactory.create(
+        learning_resource=course, run_id="MITx+8.01.1x+3T2018", published=True
+    )
+    key = f"{get_s3_prefix_for_source(source)}/8_01_1x_3T2018_OLL.tar.gz"
+    assert run_for_edx_archive(source, key) == current
+
+
 @pytest.mark.parametrize(
     "etl_source",
     [ETLSource.mitxonline.name, ETLSource.xpro.name, ETLSource.mit_edx.name],
@@ -1173,20 +1248,39 @@ def test_build_run_lookup(source, platform):
     assert lookup[normalized][0].id == run.id
 
 
-def test_build_run_lookup_oll_strips_mitx_prefix():
-    """OLL runs are also indexed without the MITx prefix the archives omit"""
+@pytest.mark.parametrize(
+    ("run_id", "archive_stem"),
+    [
+        ("MITx+0.501x+2T2019", "0_501x_2T2019"),
+        ("OCW+6.042J+2T2019", "6_042J_2T2019"),
+        ("Varkey+INNOMITv2+2020_T1", "INNOMITv2_2020_T1"),
+    ],
+)
+def test_build_run_lookup_oll_strips_org_prefix(run_id, archive_stem):
+    """OLL runs are also indexed without the org segment the archives omit"""
     source = ETLSource.oll.name
     course = LearningResourceFactory.create(
         etl_source=source, published=True, create_runs=False
     )
     run = LearningResourceRunFactory.create(
-        learning_resource=course, run_id="MITx+0.501x+2T2019", published=True
+        learning_resource=course, run_id=run_id, published=True
     )
     lookup = build_run_lookup(source, [course.id])
-    # archive filenames like 0_501x_2T2019_OLL.tar.gz normalize without the prefix
-    assert "0.501x.2t2019" in lookup
-    assert lookup["0.501x.2t2019"][0].id == run.id
-    assert "mitx.0.501x.2t2019" in lookup
+    key = f"{get_s3_prefix_for_source(source)}/{archive_stem}_OLL.tar.gz"
+    assert lookup[extract_run_id_from_key(source, key)][0].id == run.id
+    assert normalize_run_id(source, run_id) in lookup
+
+
+def test_build_run_lookup_oll_keeps_two_segment_run_id():
+    """A run id with no org segment is not also indexed under its last segment"""
+    source = ETLSource.oll.name
+    course = LearningResourceFactory.create(
+        etl_source=source, published=True, create_runs=False
+    )
+    LearningResourceRunFactory.create(
+        learning_resource=course, run_id="Foo+2T2019", published=True
+    )
+    assert list(build_run_lookup(source, [course.id])) == ["foo.2t2019"]
 
 
 def test_build_run_lookup_filters_by_ids():
@@ -1756,6 +1850,47 @@ def test_unpublish_excluded_content_files(staff_only_run, mock_deindex_tasks):
     mock_deindex_tasks.qdrant.assert_called_once_with(run.id)
 
 
+def test_unpublish_excluded_content_files_prefers_published_run(
+    mock_course_archive_bucket, mock_deindex_tasks, mocker, tmp_path
+):
+    """With a legacy unpublished twin matching the same archive, only the published run is touched"""
+    mocker.patch(
+        "learning_resources.etl.edx_shared.get_bucket_by_name",
+        return_value=mock_course_archive_bucket.bucket,
+    )
+    source = ETLSource.oll.name
+    course = LearningResourceFactory.create(
+        etl_source=source, is_course=True, published=True, create_runs=False
+    )
+    twin = LearningResourceRunFactory.create(
+        learning_resource=course,
+        run_id="course-v1:MITx+8.01.1x+3T2018",
+        published=False,
+    )
+    current = LearningResourceRunFactory.create(
+        learning_resource=course, run_id="MITx+8.01.1x+3T2018", published=True
+    )
+    key = f"{get_s3_prefix_for_source(source)}/8_01_1x_3T2018_OLL.tar.gz"
+    mock_course_archive_bucket.bucket.put_object(
+        Key=key, Body=_staff_only_archive(tmp_path).read_bytes()
+    )
+    for run in (twin, current):
+        for name in ("html/h_ok.xml", "html/h_staff.xml"):
+            ContentFileFactory.create(
+                run=run, key=get_edx_module_id(f"course/{name}", run), published=True
+            )
+
+    rows = unpublish_excluded_content_files(source, [course.id], [key])
+
+    assert [row["unpublished"] for row in rows] == [1]
+    assert ContentFile.objects.filter(run=current, published=False).count() == 1
+    assert ContentFile.objects.filter(run=twin, published=True).count() == 2
+    mock_deindex_tasks.opensearch.assert_called_once_with(
+        current.id, unpublished_only=True
+    )
+    mock_deindex_tasks.qdrant.assert_called_once_with(current.id)
+
+
 def test_unpublish_excluded_content_files_nothing_hidden(
     staff_only_run, mock_deindex_tasks
 ):
diff --git a/learning_resources/etl/utils.py b/learning_resources/etl/utils.py
index e4c3ec7e1c..2af1f1e8c1 100644
--- a/learning_resources/etl/utils.py
+++ b/learning_resources/etl/utils.py
@@ -212,8 +212,13 @@ def extract_text_from_url(url, *, mime_type=None):
     Returns:
         str: The text contained in the URL content.
     """
-    response = requests.get(url, timeout=30)
+    # ponytail: refuse redirects outright rather than re-validating each hop;
+    # add per-hop validation if a source ever needs to redirect legitimately
+    response = requests.get(url, timeout=30, allow_redirects=False)
     response.raise_for_status()
+    if response.is_redirect:
+        msg = f"Refusing to follow redirect from {url}"
+        raise requests.HTTPError(msg, response=response)
     if response.content:
         return extract_text_metadata(
             response.content,
@@ -865,7 +870,7 @@ def pdf_is_valid(pdf_path: Path) -> bool:
         if len(reader.pages) > 0:
             reader.pages[0].extract_text()
             return True
-    except Exception:  # noqa: BLE001
+    except Exception:
         # warning, not exception: the caller raises InvalidPDFError and
         # process_olx_path emits the single Sentry event for this file
         log.warning("PDF validation error for %s", pdf_path, exc_info=True)
@@ -1052,7 +1057,7 @@ def get_title_for_content(
     return Path(source_path).stem.replace("_", " ").replace("-", " ").title()
 
 
-def _build_result(  # noqa: PLR0913
+def _build_result(  # noqa: PLR0913, PLR0917
     olx_path, metadata: dict, key: str, run, video_srt_metadata, content_dict: dict
 ) -> dict:
     """Build the final result dictionary."""
diff --git a/learning_resources/etl/utils_test.py b/learning_resources/etl/utils_test.py
index b254aa1352..9bf26fbb28 100644
--- a/learning_resources/etl/utils_test.py
+++ b/learning_resources/etl/utils_test.py
@@ -8,6 +8,7 @@
 
 import pypdf
 import pytest
+import requests
 from defusedxml import ElementTree
 
 from learning_resources.constants import (
@@ -112,18 +113,29 @@ def test_extract_text_from_url(mocker, content):
     url = "http://test.edu/file.pdf"
     mock_request = mocker.patch(
         "learning_resources.etl.utils.requests.get",
-        return_value=mocker.Mock(content=content),
+        return_value=mocker.Mock(content=content, is_redirect=False),
     )
     mock_extract = mocker.patch("learning_resources.etl.utils.extract_text_metadata")
     utils.extract_text_from_url(url, mime_type=mime_type)
 
-    mock_request.assert_called_once_with(url, timeout=30)
+    mock_request.assert_called_once_with(url, timeout=30, allow_redirects=False)
     if content:
         mock_extract.assert_called_once_with(
             content, other_headers={"Content-Type": mime_type}
         )
 
 
+def test_extract_text_from_url_refuses_redirect(mocked_responses):
+    """extract_text_from_url should not follow a redirect off the requested host"""
+    url = "https://abc.cloudfront.net/a.vtt"
+    mocked_responses.get(
+        url, status=302, headers={"Location": "http://169.254.169.254/latest/"}
+    )
+
+    with pytest.raises(requests.HTTPError):
+        utils.extract_text_from_url(url)
+
+
 @pytest.mark.parametrize(
     ("text", "readable_id"),
     [
diff --git a/learning_resources/lib/warehouse.py b/learning_resources/lib/warehouse.py
index b7cb576507..c5fb5838d8 100644
--- a/learning_resources/lib/warehouse.py
+++ b/learning_resources/lib/warehouse.py
@@ -27,6 +27,9 @@
 # (not `$`) is deliberate: `$` matches just before a trailing newline, which
 # would let a `view_name` ending in "\n" slip through this check.
 _SAFE_IDENTIFIER = re.compile(r"^[a-zA-Z0-9_.]+\Z")
+# One catalog, schema or table name. No dots: a WAREHOUSE_SCHEMA of "a.b"
+# would pass _SAFE_IDENTIFIER once composed but point at a different catalog.
+_SAFE_NAME_PART = re.compile(r"^[a-zA-Z0-9_]+\Z")
 
 # Cache alias for sync watermarks: must outlive Redis flushes (an evicted
 # watermark just makes the next incremental run fetch a wider-than-necessary
@@ -176,8 +179,12 @@ def iter_rows(conn, view_name, *, since=None, batch_size=1000):
 class BaseWarehouseETLTask(Task):
     """Celery task base class for warehouse-pull ETL jobs.
 
-    Subclasses declare ``view_name`` and implement
-    ``fetch_and_upsert(conn, *, since)``. Register concrete subclasses via
+    Subclasses declare ``table_name`` (the bare view name, e.g.
+    ``"integrations__learn__ocw_courses"``) and implement
+    ``fetch_and_upsert(conn, *, since)``. ``view_name`` qualifies it with
+    ``settings.WAREHOUSE_CATALOG`` and ``settings.WAREHOUSE_SCHEMA``, so the
+    same task reads ``ol_data_lake_qa`` in QA and ``ol_data_lake_production``
+    in production. Register concrete subclasses via
     ``app.register_task(SubclassTask())`` — a class decorated with
     ``@app.task(base=BaseWarehouseETLTask)`` does *not* work: Celery's
     function-task machinery wraps the decorated object as a ``staticmethod``
@@ -207,10 +214,7 @@ class BaseWarehouseETLTask(Task):
 
         class SyncOCWCoursesTask(BaseWarehouseETLTask):
             name = "learning_resources.tasks.SyncOCWCoursesTask"
-            view_name = (
-                "ol_data_lake_production.ol_warehouse_production_integrations"
-                ".integrations__learn__ocw_courses"
-            )
+            table_name = "integrations__learn__ocw_courses"
 
             def fetch_and_upsert(self, conn, *, since=None):
                 for row in iter_rows(conn, self.view_name, since=since):
@@ -221,13 +225,43 @@ def fetch_and_upsert(self, conn, *, since=None):
 
     abstract = True
     acks_late = True
-    view_name: str = ""
+    table_name: str = ""
+
+    def __init_subclass__(cls, **kwargs):
+        """Reject subclasses that set ``view_name``.
+
+        A class attribute would shadow the property below and read whatever
+        catalog it names, whatever environment this runs in.
+        """
+        super().__init_subclass__(**kwargs)
+        if "view_name" in cls.__dict__:
+            msg = f"{cls.__name__} must set table_name, not view_name"
+            raise TypeError(msg)
+
+    @property
+    def view_name(self) -> str:
+        """``table_name`` qualified as ``catalog.schema.table`` from settings.
+
+        Fully qualified because the connection sets no default database; see
+        ``_connect_starrocks``.
+
+        Raises:
+            ValueError: If ``table_name`` is unset, or any part is not a
+                plain identifier.
+        """
+        if not self.table_name:
+            msg = f"{self.__class__.__name__}.table_name must be set"
+            raise ValueError(msg)
+        parts = (settings.WAREHOUSE_CATALOG, settings.WAREHOUSE_SCHEMA, self.table_name)
+        for part in parts:
+            if not _SAFE_NAME_PART.match(part):
+                msg = f"Unsafe warehouse identifier: {part!r}"
+                raise ValueError(msg)
+        return ".".join(parts)
 
     def run(self, *args, full_refresh: bool = True, **kwargs):  # noqa: ARG002
         """Open a warehouse connection, delegate to ``fetch_and_upsert``, log counts."""
-        if not self.view_name:
-            msg = f"{self.__class__.__name__}.view_name must be set"
-            raise ValueError(msg)
+        view_name = self.view_name
 
         since = None if full_refresh else self._get_watermark()
         # Captured before the fetch, not after: a row modified while the
@@ -246,7 +280,7 @@ def run(self, *args, full_refresh: bool = True, **kwargs):  # noqa: ARG002
             sentry_sdk.add_breadcrumb(
                 category="warehouse_etl",
                 message=f"{self.name} failed",
-                data={"view_name": self.view_name, "full_refresh": full_refresh},
+                data={"view_name": view_name, "full_refresh": full_refresh},
                 level="error",
             )
             raise
diff --git a/learning_resources/lib/warehouse_integration_test.py b/learning_resources/lib/warehouse_integration_test.py
index 5a7041dd05..685e23b06f 100644
--- a/learning_resources/lib/warehouse_integration_test.py
+++ b/learning_resources/lib/warehouse_integration_test.py
@@ -15,6 +15,7 @@
 
 import pytest
 from django.conf import settings
+from django.test import override_settings
 
 from learning_resources.lib.warehouse import BaseWarehouseETLTask, iter_rows
 from learning_resources.lib.warehouse_factories import WarehouseTestRowFactory
@@ -86,7 +87,7 @@ def _insert_rows(conn, rows):
 
 class _CollectingTask(BaseWarehouseETLTask):
     name = "test.CollectingTask"
-    view_name = _TEST_VIEW
+    table_name = _TEST_TABLE
 
     def fetch_and_upsert(self, conn, *, since=None) -> int:
         self.collected = list(iter_rows(conn, self.view_name, since=since))
@@ -148,7 +149,12 @@ def test_base_warehouse_etl_task_runs_against_real_starrocks(mocker, starrocks_c
     _insert_rows(starrocks_conn, rows)
 
     task = _CollectingTask()
-    count = task.run()
+    # default_catalog is StarRocks' internal catalog, where the scratch
+    # table lives; this also exercises the WAREHOUSE_* composition end to end.
+    with override_settings(
+        WAREHOUSE_CATALOG="default_catalog", WAREHOUSE_SCHEMA=_TEST_DB
+    ):
+        count = task.run()
 
     assert count == len(rows)
     assert {r["id"] for r in task.collected} == {row["id"] for row in rows}
diff --git a/learning_resources/lib/warehouse_test.py b/learning_resources/lib/warehouse_test.py
index 73b0a0961c..f36fe32ac8 100644
--- a/learning_resources/lib/warehouse_test.py
+++ b/learning_resources/lib/warehouse_test.py
@@ -12,6 +12,7 @@
 import pytest
 from django.conf import settings as django_settings
 from django.core.exceptions import ImproperlyConfigured
+from django.test import override_settings
 from freezegun import freeze_time
 
 # Configure Django minimally if not already configured — keeps this test
@@ -23,6 +24,8 @@
         STARROCKS_PORT=9030,
         STARROCKS_USER="testuser",
         STARROCKS_PASSWORD="secret",  # noqa: S106
+        WAREHOUSE_CATALOG="ol_data_lake_production",
+        WAREHOUSE_SCHEMA="ol_warehouse_production_integrations",
     )
     django.setup()
 
@@ -270,7 +273,7 @@ def _fetchmany(size):
 
 class _ConcreteTask(BaseWarehouseETLTask):
     name = "test.ConcreteTask"
-    view_name = "ol_data_lake_production.ol_warehouse_production_integrations.integrations__learn__test"
+    table_name = "integrations__learn__test"
 
     def fetch_and_upsert(self, conn, *, since=None) -> int:  # noqa: ARG002
         return 42
@@ -278,7 +281,7 @@ def fetch_and_upsert(self, conn, *, since=None) -> int:  # noqa: ARG002
 
 class _ErrorTask(BaseWarehouseETLTask):
     name = "test.ErrorTask"
-    view_name = "ol_data_lake_production.ol_warehouse_production_integrations.integrations__learn__test"
+    table_name = "integrations__learn__test"
 
     def fetch_and_upsert(self, conn, *, since=None) -> int:  # noqa: ARG002
         msg = "downstream failure"
@@ -327,25 +330,94 @@ def test_base_warehouse_etl_task_adds_sentry_breadcrumb_on_error(
 
 
 @patch("learning_resources.lib.warehouse.connect_to_warehouse")
-def test_base_warehouse_etl_task_raises_when_view_name_empty(mock_connect):
-    """run() raises ValueError immediately when view_name is not set."""
+def test_base_warehouse_etl_task_raises_when_table_name_empty(mock_connect):
+    """run() raises ValueError immediately when table_name is not set."""
 
     class _NoViewTask(BaseWarehouseETLTask):
-        view_name = ""
+        table_name = ""
 
         def fetch_and_upsert(self, conn) -> int:  # noqa: ARG002
             return 0
 
-    with pytest.raises(ValueError, match="view_name must be set"):
+    with pytest.raises(ValueError, match="table_name must be set"):
         _NoViewTask().run()
 
     mock_connect.assert_not_called()
 
 
+def test_view_name_defaults_to_the_production_catalog():
+    """With no override, view_name reads the production integrations schema,
+    matching the literal every task carried before it was configurable.
+    """
+    assert _ConcreteTask().view_name == (
+        "ol_data_lake_production.ol_warehouse_production_integrations"
+        ".integrations__learn__test"
+    )
+
+
+def test_view_name_follows_warehouse_settings():
+    """WAREHOUSE_CATALOG/WAREHOUSE_SCHEMA point every task at another
+    environment's lake, e.g. QA reading ol_data_lake_qa.
+    """
+    with override_settings(
+        WAREHOUSE_CATALOG="ol_data_lake_qa",
+        WAREHOUSE_SCHEMA="ol_warehouse_qa_integrations",
+    ):
+        assert _ConcreteTask().view_name == (
+            "ol_data_lake_qa.ol_warehouse_qa_integrations.integrations__learn__test"
+        )
+
+
+@pytest.mark.parametrize(
+    ("setting", "value"),
+    [
+        ("WAREHOUSE_CATALOG", "ol_data_lake_qa.other"),
+        ("WAREHOUSE_SCHEMA", "schema; DROP TABLE x"),
+        ("WAREHOUSE_SCHEMA", ""),
+    ],
+)
+@patch("learning_resources.lib.warehouse.connect_to_warehouse")
+def test_view_name_rejects_unsafe_setting_parts(mock_connect, setting, value):
+    """Each part is checked on its own: a dotted WAREHOUSE_CATALOG would still
+    pass iter_rows's check once composed, but address a different catalog.
+    """
+    with (
+        override_settings(**{setting: value}),
+        pytest.raises(ValueError, match="Unsafe warehouse identifier"),
+    ):
+        _ConcreteTask().run()
+
+    mock_connect.assert_not_called()
+
+
+@patch("learning_resources.lib.warehouse.connect_to_warehouse")
+def test_view_name_rejects_dotted_table_name(mock_connect):
+    """A dotted table_name would reach into another schema of the same catalog."""
+
+    class _DottedTask(BaseWarehouseETLTask):
+        table_name = "other_schema.integrations__learn__test"
+
+        def fetch_and_upsert(self, conn, *, since=None) -> int:  # noqa: ARG002
+            return 0
+
+    with pytest.raises(ValueError, match="Unsafe warehouse identifier"):
+        _DottedTask().run()
+
+    mock_connect.assert_not_called()
+
+
+def test_subclass_cannot_pin_view_name():
+    """Assigning view_name on a subclass would bypass WAREHOUSE_* entirely."""
+    with pytest.raises(TypeError, match="must set table_name, not view_name"):
+
+        class _PinnedTask(BaseWarehouseETLTask):
+            view_name = "ol_data_lake_production.schema.view"
+
+
 def test_base_warehouse_etl_task_fetch_and_upsert_is_abstract():
     """fetch_and_upsert raises NotImplementedError on the base class."""
     task = BaseWarehouseETLTask()
-    task.view_name = "catalog.schema.view"
+    task.table_name = "view"
     with pytest.raises(NotImplementedError):
         task.fetch_and_upsert(conn=None)
 
@@ -361,10 +433,7 @@ def test_base_warehouse_etl_task_rejects_non_int_return(mock_connect):
 
     class _BrokenTask(BaseWarehouseETLTask):
         name = "test.BrokenTask"
-        view_name = (
-            "ol_data_lake_production.ol_warehouse_production_integrations"
-            ".integrations__learn__test"
-        )
+        table_name = "integrations__learn__test"
 
         def fetch_and_upsert(self, conn, *, since=None):
             pass  # forgot to return count
@@ -397,7 +466,7 @@ class _RecordingTask(BaseWarehouseETLTask):
     """Records the `since` it was called with instead of hitting a real view."""
 
     name = "test.RecordingTask"
-    view_name = "ol_data_lake_production.ol_warehouse_production_integrations.integrations__learn__test"
+    table_name = "integrations__learn__test"
 
     def fetch_and_upsert(self, conn, *, since=None) -> int:  # noqa: ARG002
         self.seen_since = since
@@ -501,7 +570,7 @@ def test_incremental_watermark_is_stamped_before_fetch_not_after(mock_connect):
 
         class _SlowTask(BaseWarehouseETLTask):
             name = "test.SlowTask"
-            view_name = "ol_data_lake_production.ol_warehouse_production_integrations.integrations__learn__test"
+            table_name = "integrations__learn__test"
 
             def fetch_and_upsert(self, conn, *, since=None) -> int:  # noqa: ARG002
                 # Simulate a fetch that takes real wall-clock time.
@@ -527,7 +596,7 @@ def test_incremental_does_not_advance_watermark_on_failure(mock_connect):
 
     class _FailingTask(BaseWarehouseETLTask):
         name = "test.FailingTask"
-        view_name = "ol_data_lake_production.ol_warehouse_production_integrations.integrations__learn__test"
+        table_name = "integrations__learn__test"
 
         def fetch_and_upsert(self, conn, *, since=None) -> int:  # noqa: ARG002
             msg = "boom"
diff --git a/learning_resources/migrations/0120_view_event_uuid_unique_index.py b/learning_resources/migrations/0120_view_event_uuid_unique_index.py
index e555527d01..f972353404 100644
--- a/learning_resources/migrations/0120_view_event_uuid_unique_index.py
+++ b/learning_resources/migrations/0120_view_event_uuid_unique_index.py
@@ -35,9 +35,11 @@ class Migration(migrations.Migration):
                         # leftover so a rerun rebuilds and enforces uniqueness
                         f"DROP INDEX CONCURRENTLY IF EXISTS {INDEX_NAME}",
                         # Partial: the legacy NULL rows need no index entries
-                        f"CREATE UNIQUE INDEX CONCURRENTLY {INDEX_NAME}"
-                        f" ON {TABLE_NAME} (event_uuid)"
-                        f" WHERE event_uuid IS NOT NULL",
+                        (
+                            f"CREATE UNIQUE INDEX CONCURRENTLY {INDEX_NAME}"
+                            f" ON {TABLE_NAME} (event_uuid)"
+                            f" WHERE event_uuid IS NOT NULL"
+                        ),
                     ],
                     reverse_sql=f"DROP INDEX CONCURRENTLY IF EXISTS {INDEX_NAME}",
                 ),
diff --git a/learning_resources/utils.py b/learning_resources/utils.py
index 6f631c50fb..b3dcd32656 100644
--- a/learning_resources/utils.py
+++ b/learning_resources/utils.py
@@ -510,7 +510,7 @@ def offeror_delete_actions(offeror: LearningResourceOfferor):
     hook.offeror_delete(offeror=offeror)
 
 
-def _walk_topic_map(topics: list, parent: None | LearningResourceTopic = None) -> None:
+def _walk_topic_map(topics: list, parent: LearningResourceTopic | None = None) -> None:
     """
     Walk the topic map provided and create topic records accordingly.
 
diff --git a/learning_resources/utils_test.py b/learning_resources/utils_test.py
index 5f57f1e3c8..f2c5db4262 100644
--- a/learning_resources/utils_test.py
+++ b/learning_resources/utils_test.py
@@ -1247,8 +1247,10 @@ def test_is_loggable_missing_content_id(edx_module_id, loggable):
         ("block-v1:34819-FA25 18.01L+canvas+type@g085f027c+block@2-dot-11", True),
         ("block-v1:33414-21H.363+canvas+type@+block@gfaf809b", True),
         (
-            "block-v1:28770-15.060_FA24+canvas"
-            "+type@Discrete+Nonlinear_Optimization+block@x",
+            (
+                "block-v1:28770-15.060_FA24+canvas"
+                "+type@Discrete+Nonlinear_Optimization+block@x"
+            ),
             True,
         ),
         ("asset-v1:MITxT+16.00x+0T2026+type@asset+block@lec_\t.srt", True),
@@ -1260,8 +1262,10 @@ def test_is_loggable_missing_content_id(edx_module_id, loggable):
         ("block-v1:X+type@library_content+block@y", True),
         # Never-content block types are rejected (case-insensitive)
         (
-            "block-v1:MITxT+18.03.2x+1T2025+type@discussion"
-            "+block@discussion_recitation13-tab3",
+            (
+                "block-v1:MITxT+18.03.2x+1T2025+type@discussion"
+                "+block@discussion_recitation13-tab3"
+            ),
             False,
         ),
         ("block-v1:X+type@DISCUSSION+block@y", False),
diff --git a/learning_resources/views.py b/learning_resources/views.py
index 236ba2bed2..f88f5bb04d 100644
--- a/learning_resources/views.py
+++ b/learning_resources/views.py
@@ -34,6 +34,7 @@
 from channels.models import Channel
 from learning_resources import permissions
 from learning_resources.constants import (
+    CONTENT_FILE_LARGE_FIELDS,
     GROUP_CONTENT_FILE_CONTENT_VIEWERS,
     LearningResourceRelationTypes,
     LearningResourceType,
@@ -1076,7 +1077,11 @@ class ContentFileViewSet(viewsets.ReadOnlyModelViewSet):
     )
     filter_backends = [MultipleOptionsFilterBackend]
     filterset_class = ContentFileFilter
-    private_fields = ["content"]
+    # Derived from CONTENT_FILE_LARGE_FIELDS (rather than listing "content"
+    # alone) so summary/flashcards -- LLM-derived from the same gated content,
+    # and just as sensitive -- can't silently fall out of this gate again the
+    # next time a field is added there.
+    private_fields = list(CONTENT_FILE_LARGE_FIELDS)
 
     def get_serializer(self, *args, **kwargs):
         """
diff --git a/learning_resources/views_test.py b/learning_resources/views_test.py
index a1089f7b81..76133cc124 100644
--- a/learning_resources/views_test.py
+++ b/learning_resources/views_test.py
@@ -16,6 +16,7 @@
 from channels.models import Channel
 from learning_resources.api import update_resource_view_counts
 from learning_resources.constants import (
+    CONTENT_FILE_LARGE_FIELDS,
     GROUP_CONTENT_FILE_CONTENT_VIEWERS,
     GROUP_TUTOR_PROBLEM_VIEWERS,
     LearningResourceRelationTypes,
@@ -288,7 +289,11 @@ def test_list_content_files_list_endpoint(client, user_role, django_user_model):
     content_file_ids = [
         cf.id
         for cf in ContentFileFactory.create_batch(
-            2, run=course.learning_resource.runs.first(), content="some content"
+            2,
+            run=course.learning_resource.runs.first(),
+            content="some content",
+            summary="some summary",
+            flashcards=[{"question": "q", "answer": "a"}],
         )
     ]
     # this should be filtered out
@@ -316,8 +321,12 @@ def test_list_content_files_list_endpoint(client, user_role, django_user_model):
 
         if user_role in ["admin", "group_content_file_content_viewer"]:
             assert result["content"] is not None
+            assert result["summary"] is not None
+            assert result["flashcards"] is not None
         else:
             assert result.get("content") is None
+            assert result.get("summary") is None
+            assert result.get("flashcards") is None
 
 
 def test_list_content_files_list_endpoint_with_no_runs(client):
@@ -393,7 +402,8 @@ def test_get_contentfiles_detail_endpoint(client, user_role, django_user_model):
         assert resp.data == ContentFileSerializer(instance=content_file).data
     else:
         data = ContentFileSerializer(instance=content_file).data
-        data.pop("content")
+        for field in CONTENT_FILE_LARGE_FIELDS:
+            data.pop(field)
         assert resp.data == data
 
 
diff --git a/learning_resources_search/api.py b/learning_resources_search/api.py
index c7a945abb7..0a18bfee8c 100644
--- a/learning_resources_search/api.py
+++ b/learning_resources_search/api.py
@@ -1123,7 +1123,7 @@ def get_similar_topics(
     return list(dict(counter.most_common(num_topics)).keys())
 
 
-def get_similar_resources(  # noqa: PLR0913
+def get_similar_resources(  # noqa: PLR0913, PLR0917
     value_doc: dict,
     num_resources: int,
     min_term_freq: int,
diff --git a/learning_resources_search/tasks.py b/learning_resources_search/tasks.py
index 3bf0ab87e4..0b886e3c81 100644
--- a/learning_resources_search/tasks.py
+++ b/learning_resources_search/tasks.py
@@ -21,7 +21,7 @@
 from requests.models import PreparedRequest
 
 from learning_resources.constants import LearningResourceType
-from learning_resources.etl.constants import RESOURCE_FILE_ETL_SOURCES
+from learning_resources.etl.constants import REINDEX_CONTENT_FILE_ETL_SOURCES
 from learning_resources.models import (
     ContentFile,
     Course,
@@ -698,7 +698,9 @@ def add_batch(kind, batch_key, params):
                     Q(learning_resource__published=True)
                     | Q(learning_resource__test_mode=True)
                 )
-                .filter(learning_resource__etl_source__in=RESOURCE_FILE_ETL_SOURCES)
+                .filter(
+                    learning_resource__etl_source__in=REINDEX_CONTENT_FILE_ETL_SOURCES
+                )
                 .exclude(learning_resource__readable_id__in=blocklisted_ids)
                 .order_by("learning_resource_id")
                 .values_list("learning_resource_id", flat=True),
@@ -1145,7 +1147,7 @@ def get_update_resource_files_tasks(blocklisted_ids, etl_source):
         etl_source(str): ETL source filter for the task
     """
 
-    if etl_source is None or etl_source in RESOURCE_FILE_ETL_SOURCES:
+    if etl_source is None or etl_source in REINDEX_CONTENT_FILE_ETL_SOURCES:
         course_update_query = (
             LearningResource.objects.filter(resource_type=COURSE_TYPE)
             .filter(Q(published=True) | Q(test_mode=True))
@@ -1157,7 +1159,7 @@ def get_update_resource_files_tasks(blocklisted_ids, etl_source):
             course_update_query = course_update_query.filter(etl_source=etl_source)
         else:
             course_update_query = course_update_query.filter(
-                etl_source__in=RESOURCE_FILE_ETL_SOURCES
+                etl_source__in=REINDEX_CONTENT_FILE_ETL_SOURCES
             )
 
         return [
@@ -1176,7 +1178,7 @@ def get_update_program_files_tasks(etl_source):
     Args:
         etl_source(str): ETL source filter for the task
     """
-    if etl_source is not None and etl_source not in RESOURCE_FILE_ETL_SOURCES:
+    if etl_source is not None and etl_source not in REINDEX_CONTENT_FILE_ETL_SOURCES:
         return []
 
     program_update_query = (
@@ -1189,7 +1191,7 @@ def get_update_program_files_tasks(etl_source):
         program_update_query = program_update_query.filter(etl_source=etl_source)
     else:
         program_update_query = program_update_query.filter(
-            etl_source__in=RESOURCE_FILE_ETL_SOURCES
+            etl_source__in=REINDEX_CONTENT_FILE_ETL_SOURCES
         )
 
     return [
diff --git a/learning_resources_search/tasks_test.py b/learning_resources_search/tasks_test.py
index bde182d9e3..16d06dea59 100644
--- a/learning_resources_search/tasks_test.py
+++ b/learning_resources_search/tasks_test.py
@@ -11,7 +11,7 @@
 from opensearchpy.exceptions import ConnectionError as ESConnectionError
 from opensearchpy.exceptions import ConnectionTimeout, RequestError
 
-from learning_resources.etl.constants import RESOURCE_FILE_ETL_SOURCES, ETLSource
+from learning_resources.etl.constants import REINDEX_CONTENT_FILE_ETL_SOURCES, ETLSource
 from learning_resources.factories import (
     ContentFileFactory,
     CourseFactory,
@@ -44,6 +44,7 @@
     serialize_learning_resource_for_update,
 )
 from learning_resources_search.tasks import (
+    _build_reindex_batches,
     _generate_subscription_digest_subject,
     _get_percolated_rows,
     _group_percolated_rows,
@@ -57,6 +58,7 @@
     finish_reindex_job,
     get_update_program_files_tasks,
     get_update_resource_files_tasks,
+    index_content_files,
     index_learning_resources,
     index_run_content_files,
     run_reindex_batch,
@@ -1072,7 +1074,7 @@ def test_bulk_deindex_learning_resources(mocker, with_error):
         (list(LEARNING_RESOURCE_TYPES), None),
         (["course"], ETLSource.xpro.value),
         (["content_file"], ETLSource.xpro.value),
-        (["content_file"], ETLSource.oll.value),
+        (["content_file"], ETLSource.podcast.value),
     ],
 )
 def test_start_update_index(mocker, mocked_celery, indexes, etl_source, settings):  # noqa: PLR0915
@@ -1246,7 +1248,7 @@ def test_start_update_index(mocker, mocked_celery, indexes, etl_source, settings
         )
 
     if CONTENT_FILE_TYPE in indexes:
-        if etl_source in RESOURCE_FILE_ETL_SOURCES:
+        if etl_source in REINDEX_CONTENT_FILE_ETL_SOURCES:
             # 3 run-level files + 1 resource-level (marketing page) file, in
             # chunks of 2
             assert index_content_mock.si.call_count == 2
@@ -1278,6 +1280,31 @@ def test_start_update_index(mocker, mocked_celery, indexes, etl_source, settings
     assert mocked_celery.replace.call_args[0][1] == mocked_celery.chain.return_value
 
 
+def test_oll_content_files_reindexed(mocker):
+    """update_index and recreate_index cover OLL content files, as ingest does"""
+    mocker.patch(
+        "learning_resources_search.tasks.load_course_blocklist", return_value=[]
+    )
+    course = CourseFactory.create(etl_source=ETLSource.oll.value)
+    # rebuilds index only the best run's content files
+    content_file = ContentFileFactory.create(run=course.learning_resource.best_run)
+
+    dispatched_ids = [
+        resource_id
+        for batch in _build_reindex_batches(TaskJob(params={"indexes": [COURSE_TYPE]}))
+        if batch.kind == ReindexBatchKind.dispatch_content_files.value
+        for resource_id in batch.params["learning_resource_ids"]
+    ]
+    assert dispatched_ids == [course.learning_resource_id]
+
+    indexed_ids = [
+        task.args[0]
+        for task in get_update_resource_files_tasks([], ETLSource.oll.value)
+        if task.task == index_content_files.name
+    ]
+    assert indexed_ids == [[content_file.id]]
+
+
 def test_upsert_content_file_task(mocked_api):
     """upsert_content_file routes to the correct index based on the parent resource type"""
     course = CourseFactory.create(etl_source=ETLSource.ocw.value)
diff --git a/main/settings.py b/main/settings.py
index 4530d6e1e0..f898f081e6 100644
--- a/main/settings.py
+++ b/main/settings.py
@@ -36,7 +36,7 @@
 from main.settings_pluggy import *  # noqa: F403
 from openapi.settings_spectacular import open_spectacular_settings
 
-VERSION = "0.81.1"
+VERSION = "0.81.2"
 
 log = logging.getLogger()
 
@@ -697,9 +697,6 @@ def get_all_config_keys():
 # disable the anonymous user creation
 ANONYMOUS_USER_NAME = None
 
-# Widgets
-WIDGETS_RSS_CACHE_TTL = get_int("WIDGETS_RSS_CACHE_TTL", 15 * 60)
-
 # x509 filenames
 MIT_WS_CERTIFICATE_FILE = os.path.join(STATIC_ROOT, "mit_x509.cert")  # noqa: PTH118
 MIT_WS_PRIVATE_KEY_FILE = os.path.join(STATIC_ROOT, "mit_x509.key")  # noqa: PTH118
diff --git a/main/settings_course_etl.py b/main/settings_course_etl.py
index cf616ff73c..5027d8fecd 100644
--- a/main/settings_course_etl.py
+++ b/main/settings_course_etl.py
@@ -163,3 +163,10 @@
 STARROCKS_PORT = get_int("STARROCKS_PORT", 9030)
 STARROCKS_USER = get_string("STARROCKS_USER", None)
 STARROCKS_PASSWORD = get_string("STARROCKS_PASSWORD", None)
+# Where the integrations__learn__* views live. BaseWarehouseETLTask composes
+# these with each task's table_name, so QA can read ol_data_lake_qa instead of
+# production learner data. The defaults are the production pair.
+WAREHOUSE_CATALOG = get_string("WAREHOUSE_CATALOG", "ol_data_lake_production")
+WAREHOUSE_SCHEMA = get_string(
+    "WAREHOUSE_SCHEMA", "ol_warehouse_production_integrations"
+)
diff --git a/openapi/oasdiff-err-ignore.txt b/openapi/oasdiff-err-ignore.txt
index 2eb053eb84..873b225332 100644
--- a/openapi/oasdiff-err-ignore.txt
+++ b/openapi/oasdiff-err-ignore.txt
@@ -30,3 +30,14 @@
 2026-09-15 GET /api/v0/users/{username}/ the response property `profile/email_optin` became nullable for the status `200`
 2026-09-15 PATCH /api/v0/users/{username}/ the response property `profile/email_optin` became nullable for the status `200`
 2026-09-15 PUT /api/v0/users/{username}/ the response property `profile/email_optin` became nullable for the status `200`
+
+# Removing the RSS Feed widget type entirely (dead Open-Discussions-era
+# feature, no reachable frontend UI, confirmed with the team) --
+# nobody should be able to send this value anymore.
+# https://github.com/mitodl/hq/issues/13473
+2026-09-28 PATCH /api/v0/widget_lists/{id}/ removed the enum value `RSS Feed` of the request property `widgets/items/widget_type` (media type: application/json)
+2026-09-28 PATCH /api/v0/widget_lists/{id}/ removed the enum value `RSS Feed` of the request property `widgets/items/widget_type` (media type: application/x-www-form-urlencoded)
+2026-09-28 PATCH /api/v0/widget_lists/{id}/ removed the enum value `RSS Feed` of the request property `widgets/items/widget_type` (media type: multipart/form-data)
+2026-09-28 PUT /api/v0/widget_lists/{id}/ removed the enum value `RSS Feed` of the request property `widgets/items/widget_type` (media type: application/x-www-form-urlencoded)
+2026-09-28 PUT /api/v0/widget_lists/{id}/ removed the enum value `RSS Feed` of the request property `widgets/items/widget_type` (media type: multipart/form-data)
+2026-09-28 PUT /api/v0/widget_lists/{id}/ removed the enum value `RSS Feed` of the request property `widgets/items/widget_type` (media type: application/json)
diff --git a/openapi/specs/v0.yaml b/openapi/specs/v0.yaml
index adfed4b995..751bb132da 100644
--- a/openapi/specs/v0.yaml
+++ b/openapi/specs/v0.yaml
@@ -6956,16 +6956,13 @@ components:
       enum:
       - Markdown
       - URL
-      - RSS Feed
       - People
       type: string
       description: |-
         * `Markdown` - Markdown
         * `URL` - URL
-        * `RSS Feed` - RSS Feed
         * `People` - People
       x-enum-descriptions:
       - Markdown
       - URL
-      - RSS Feed
       - People
diff --git a/profiles/tasks.py b/profiles/tasks.py
index a7187b0fa0..7aa6a03910 100644
--- a/profiles/tasks.py
+++ b/profiles/tasks.py
@@ -20,10 +20,7 @@ class SyncProgramCertificatesTask(BaseWarehouseETLTask):
     """
 
     name = "profiles.tasks.SyncProgramCertificatesTask"
-    view_name = (
-        "ol_data_lake_production.ol_warehouse_production_integrations"
-        ".integrations__learn__program_certificates"
-    )
+    table_name = "integrations__learn__program_certificates"
 
     def fetch_and_upsert(self, conn, *, since=None) -> int:
         """Upsert every row iter_rows yields; see profiles.etl for why this
diff --git a/profiles/tasks_test.py b/profiles/tasks_test.py
index 3b9c4c6fb3..8c78ed1c48 100644
--- a/profiles/tasks_test.py
+++ b/profiles/tasks_test.py
@@ -137,12 +137,15 @@ def test_sync_program_certificates_task_upserts_iterated_rows(mocker):
     mocked_upsert.assert_any_call(rows[1])
 
 
-def test_sync_program_certificates_task_view_name_is_fully_qualified():
+def test_sync_program_certificates_task_view_name_is_fully_qualified(settings):
     """view_name is a fully-qualified catalog.database.table name, per
-    learning_resources.lib.warehouse.iter_rows's contract.
+    learning_resources.lib.warehouse.iter_rows's contract, taken from the
+    WAREHOUSE_* settings so QA reads its own lake.
     """
+    settings.WAREHOUSE_CATALOG = "ol_data_lake_qa"
+    settings.WAREHOUSE_SCHEMA = "ol_warehouse_qa_integrations"
     assert SyncProgramCertificatesTask.view_name == (
-        "ol_data_lake_production.ol_warehouse_production_integrations"
+        "ol_data_lake_qa.ol_warehouse_qa_integrations"
         ".integrations__learn__program_certificates"
     )
 
diff --git a/pyproject.toml b/pyproject.toml
index 4e23a29323..e9fe48d612 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -148,7 +148,7 @@ dev = [
     "pytest-mock>=3.10.0,<4",
     "pytest-repeat>=0.9.4",
     "responses>=0.25.0,<0.26",
-    "ruff==0.16.3",
+    "ruff==0.16.8",
     "safety>=3.0.0,<4",
     "semantic-version>=2.10.0,<3",
     "freezegun>=1.4.0,<2",
@@ -193,7 +193,6 @@ lint.select = [
     "C4",  # flake8-comprehensions
     "C90",  # mccabe
     # "COM",  # flake8-commas
-    "CPY",  # flake8-copyright
     "D",  # pydocstyle
     "DJ",  # flake8-django
     "DTZ",  # flake8-datetimez
@@ -275,8 +274,8 @@ inline-quotes = "double"
 "django.contrib.auth.models.User".msg = "use get_user_model() or settings.AUTH_USER_MODEL"
 
 [tool.ruff.lint.per-file-ignores]
-"*_test.py" = ["ARG001", "E501", "S101", "PLR2004"]
-"test_*.py" = ["ARG001", "E501", "S101", "PLR2004"]
+"*_test.py" = ["ARG001", "E501", "S101", "PLR2004", "PLR0917"]
+"test_*.py" = ["ARG001", "E501", "S101", "PLR2004", "PLR0917"]
 "**/migrations/**" = ["ARG001"]
 
 [tool.bumpversion]
diff --git a/uv.lock b/uv.lock
index 67e4f75e55..5a69163e7b 100644
--- a/uv.lock
+++ b/uv.lock
@@ -7,10 +7,10 @@ exclude-newer = "0001-01-01T00:00:00Z" # This has no effect and is included for
 exclude-newer-span = "P7D"
 
 [options.exclude-newer-package]
-mitol-django-common = { timestamp = "0001-01-01T00:00:00Z", span = "PT0S" }
+mitol-drf-lint = { timestamp = "0001-01-01T00:00:00Z", span = "PT0S" }
 mitol-django-observability = { timestamp = "0001-01-01T00:00:00Z", span = "PT0S" }
 mitol-django-scim = { timestamp = "0001-01-01T00:00:00Z", span = "PT0S" }
-mitol-drf-lint = { timestamp = "0001-01-01T00:00:00Z", span = "PT0S" }
+mitol-django-common = { timestamp = "0001-01-01T00:00:00Z", span = "PT0S" }
 
 [manifest]
 overrides = [{ name = "setuptools", specifier = "<80" }]
@@ -2770,7 +2770,7 @@ dev = [
     { name = "pytest-repeat", specifier = ">=0.9.4" },
     { name = "pytest-xdist", extras = ["psutil"], specifier = ">=3.6.1,<4" },
     { name = "responses", specifier = ">=0.25.0,<0.26" },
-    { name = "ruff", specifier = "==0.16.3" },
+    { name = "ruff", specifier = "==0.16.8" },
     { name = "safety", specifier = ">=3.0.0,<4" },
     { name = "semantic-version", specifier = ">=2.10.0,<3" },
     { name = "traceback-with-variables", specifier = ">=2.1.1,<3" },
@@ -4491,27 +4491,27 @@ wheels = [
 
 [[package]]
 name = "ruff"
-version = "0.16.3"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/61/b3/3213589383f8f1b3938781bd1278713f6d18621a14992b3e81fefb8a5ef9/ruff-0.16.3.tar.gz", hash = "sha256:e76d33a347661a84b5be6d043d0347fdc745dfdcf825a8f4fed64b5e26eebdf2", size = 4891904, upload-time = "2026-08-13T15:17:13.381Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/bf/96/493770daebd68c0a67f1549fdf519f53be51fc435186c0585bcc272fd76c/ruff-0.16.3-py3-none-linux_armv6l.whl", hash = "sha256:0c5710e247a58a4521e66e124ba9a74655b414f61ba3a2e9e3811e11098f48f7", size = 10902799, upload-time = "2026-08-13T15:16:27.382Z" },
-    { url = "https://files.pythonhosted.org/packages/5e/e6/2becf3942fddc29a29b8df47691d456fb1085391a694f74d84513251418c/ruff-0.16.3-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:fe155130631a2471fd2e14a7a664a4dfbd7194b8229c3d7b2a40b21178639081", size = 11135539, upload-time = "2026-08-13T15:16:30.87Z" },
-    { url = "https://files.pythonhosted.org/packages/3e/1e/4b8b72f0d006dbf19326aa99f9ca0ee2ff374187c4d301cf529a51aa06fe/ruff-0.16.3-py3-none-macosx_11_0_arm64.whl", hash = "sha256:e2ed719e14aa64d895c2ee922594a90a43c861a93f0575a95ff8c47cdbd13eb9", size = 10475095, upload-time = "2026-08-13T15:16:33.259Z" },
-    { url = "https://files.pythonhosted.org/packages/92/32/2201fa49ba1f6c101ee321e83f051ac7a4b8d07b0ef6b4d3f2772b302275/ruff-0.16.3-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:9e0b1da805eb043654645d74d5de1e5ce2edc686e40790d2b86f56d71cc06a84", size = 10668771, upload-time = "2026-08-13T15:16:35.65Z" },
-    { url = "https://files.pythonhosted.org/packages/c3/66/4afc5c8363bd04d45effce1b7c8713ca037d7a6740b7451a2403a6e3a972/ruff-0.16.3-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:a37bdea0bbe21780f590bf437d6412c8c4e1b6cd010f91a65c2c40c5e5f5f870", size = 10699568, upload-time = "2026-08-13T15:16:38.195Z" },
-    { url = "https://files.pythonhosted.org/packages/53/fd/c67d246bf36bf1698551c56de39e95cd07f70e64433e0098e6267d77061b/ruff-0.16.3-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:09571e6d1288ed9be475207a3ac04ada404f1cd898104be0f6ab8d7df438575b", size = 11499365, upload-time = "2026-08-13T15:16:40.623Z" },
-    { url = "https://files.pythonhosted.org/packages/67/0b/00ecbceb99a263af7b12f6f05ac3c92bc47b905e91adc3f207a836e3bc01/ruff-0.16.3-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:2c18c5a101eb540010638cc1ff3c84944d3adb3df62b8d98ca8f22ba484d3413", size = 12311728, upload-time = "2026-08-13T15:16:43.564Z" },
-    { url = "https://files.pythonhosted.org/packages/54/b2/b7b3bb54f4d3f7db504e476ad4ab8de530dceebe2c061384b2757ee419e8/ruff-0.16.3-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:8457c44f15033c85ddbb77b15d451df9e24e4bd03b628396dd3610cedc3b8f82", size = 11699896, upload-time = "2026-08-13T15:16:46.209Z" },
-    { url = "https://files.pythonhosted.org/packages/c7/30/4c468429ac195addc5ee1b717b6ab1b66632786737ca3b2ed3443fb0c26a/ruff-0.16.3-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:294b95c4ae0cda9388525c2047778aa758d6b8d4bb876fd4e9eaa3ebc92343eb", size = 11058736, upload-time = "2026-08-13T15:16:48.823Z" },
-    { url = "https://files.pythonhosted.org/packages/43/67/7a113cdaddf24b64d7f75b1242a99d04c82fcef4f6921fdbb832beaffb5f/ruff-0.16.3-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:3d0c7c40c87c2a820509c31ba007968da6e1306468c067b2d82fbfdbcd0e8474", size = 11586911, upload-time = "2026-08-13T15:16:51.913Z" },
-    { url = "https://files.pythonhosted.org/packages/f1/c1/2e66f24c0f3ead25a5e660111778685e505e5da353c82802bf49f0cbe7b9/ruff-0.16.3-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:9f738c0fdfa8eed0b2ce7fb27ee7258208a92a68d7949e62aa15164bc7b389da", size = 10954265, upload-time = "2026-08-13T15:16:54.763Z" },
-    { url = "https://files.pythonhosted.org/packages/c2/ba/4cee23bf52cba9a058d3726de623624daf50ef9638868edd86f4126157f6/ruff-0.16.3-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:fb785f0be25abe69d320415cd4f833b59e17ba7613d9ba6a958023b6bceb0a50", size = 10709886, upload-time = "2026-08-13T15:16:57.339Z" },
-    { url = "https://files.pythonhosted.org/packages/82/df/7da7194fa5d9dc0a285f7e6fa5a4722e7c63faac0b45b614ded9314363a1/ruff-0.16.3-py3-none-musllinux_1_2_i686.whl", hash = "sha256:c5536e3acfbf9563085aa2be7b13c629c3077e902afc5b941ac44024dbb9f506", size = 11210392, upload-time = "2026-08-13T15:17:00.171Z" },
-    { url = "https://files.pythonhosted.org/packages/35/85/7795f6e817af050e7517bf3e7aa9b061cce70ef33d280aad902c956c1ecf/ruff-0.16.3-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:a2d85c02f9b8e165d85e6779184d38c4132de12603dab59c51c28e22584f9e4d", size = 11626910, upload-time = "2026-08-13T15:17:03.299Z" },
-    { url = "https://files.pythonhosted.org/packages/78/9b/475b927cf27a5cbbda3c7bafb69ed6ff77e1d7923d5d85f17c2749d7ae32/ruff-0.16.3-py3-none-win32.whl", hash = "sha256:388cdf2166642bd9b13d52b5932d3170f34f8abed7e8d9a855f1d84b83645a0a", size = 10931415, upload-time = "2026-08-13T15:17:05.726Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/99/e2a2bfc4fbf0a1e8a916bc9ebe6fe6c58cc34c28e0ffc6ce281d572d1c2e/ruff-0.16.3-py3-none-win_amd64.whl", hash = "sha256:e80a7d69ca2a6d1c4d352ec91458cdca6e56c83cdbcabd93e4abe1e53591d948", size = 11445993, upload-time = "2026-08-13T15:17:08.353Z" },
-    { url = "https://files.pythonhosted.org/packages/69/3e/4132e539aed78c148854d4997a2685b0ed4dc4e87110b59ce528564e184e/ruff-0.16.3-py3-none-win_arm64.whl", hash = "sha256:b8ca152da82c1acc1fa8d5874b15951935f0eef46f10e6954c83859011b6178a", size = 11399302, upload-time = "2026-08-13T15:17:10.908Z" },
+version = "0.16.8"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/ba/78/449cb84790bd5cc3823b2652ee405a4558856e5c4195aee3a16bf7b3eb5d/ruff-0.16.8.tar.gz", hash = "sha256:9247bf92b5f04d825c8639a4fe423ec2e4222acd9222e58412b0dab7e442798b", size = 4938814, upload-time = "2026-09-16T15:54:46.688Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ac/25/6071aabc530e9be7e2c195e8fe3f7aea2735405b6cf447212832d7811831/ruff-0.16.8-py3-none-linux_armv6l.whl", hash = "sha256:6ffbd6d87383c1edf5f6fa890f10200950240d7c1a16052a19a09d3a2307dd38", size = 10048966, upload-time = "2026-09-16T15:53:57.605Z" },
+    { url = "https://files.pythonhosted.org/packages/54/98/07f90ecbc74dd5fb5764f11f2bc774d6a7cffef92d2ff5f5b4e9e23c754e/ruff-0.16.8-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:42ed6b878ed61e3acca92f2730a17acff39286944ea82398544696366a6f925e", size = 10165498, upload-time = "2026-09-16T15:54:01.14Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/1f/e6a712e3b47cad4a40600134105ed193cb773f618a42eb7ba323cb812cc0/ruff-0.16.8-py3-none-macosx_11_0_arm64.whl", hash = "sha256:7ea781c7f2afba8c6a505ea0fb3f994020249e0c450635f5381286fea6b46170", size = 9830004, upload-time = "2026-09-16T15:54:03.998Z" },
+    { url = "https://files.pythonhosted.org/packages/23/f2/311a08776d75d81c7676e20b6b020ae63cbe881fcdc7a8dd64e6e18bdd93/ruff-0.16.8-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8efeae3bbe414a5efefda11a792dfb51ef90ac48d50c4830de2f644caf3e8659", size = 9986558, upload-time = "2026-09-16T15:54:06.804Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/ed/37b6cb3d3ba8c73e68ae3eb1d502383beb5aa05a582bb7bb3a922f929f54/ruff-0.16.8-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:3a79b795469fef7fc6e908b218eed2eb17332afd85031db6480dc864560e69b2", size = 9877332, upload-time = "2026-09-16T15:54:09.552Z" },
+    { url = "https://files.pythonhosted.org/packages/22/cc/40873a8f36ad084cc540d55fcca7077264d5b13b24659e9180c176fb2b08/ruff-0.16.8-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:3fdc5563cdc50555e6fba39322850860e9267c1b3d12c26a74729d8604c3c812", size = 10507125, upload-time = "2026-09-16T15:54:12.152Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/e4/fc91a642b78ccbab6b9477720f3644ae7a10a9bcce69a934679cd64f62bc/ruff-0.16.8-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:34508983c70665578dab88f5223d8e6228307e1135398ca8bfc8b7e9501e282b", size = 11336694, upload-time = "2026-09-16T15:54:15.489Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/3d/bbd2a9a600a4e73dc3e7548a249c8d1671273464b55822c6fae50f602dff/ruff-0.16.8-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:644bb578569e0ffc575741232bd385dacdd6fbe123f1a729e7a225f54aa3957f", size = 10774448, upload-time = "2026-09-16T15:54:18.16Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/41/d83af9879a7b6e8bf5fe16b1da0b134049d2f5d3afac12defb0897cb84bd/ruff-0.16.8-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:15e7d226246961db9235098333caa13063906d3851136b84c2900b82f5daa1df", size = 10323796, upload-time = "2026-09-16T15:54:20.743Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/2c/cefd07bfe914b84943ea769ade8d607bd22750b965d3228eefd7cebd15d0/ruff-0.16.8-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:a2bf6bc3e9ebdd4449abc6f06cf64b98051a2c61cf94d2fe9596518c881f1a1e", size = 10514115, upload-time = "2026-09-16T15:54:23.497Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/9d/76a2e26c79a23be6e6e3664c57bec9e9fc8de155cfb9e4b67ea91b64f9d7/ruff-0.16.8-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:6ca111ba0849539165e9e59d2b442542f3c1e8060ebbdea82494f1ffbccb1e1f", size = 10072582, upload-time = "2026-09-16T15:54:26.185Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/d4/f42edddb39668af1a559ceafa3823aedd65633a48dc9768e775485faa2c1/ruff-0.16.8-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:359a1e5b495448ee1e91018064382ebc86f90e8aac2fed222c7d0e4e8df85fd2", size = 9879644, upload-time = "2026-09-16T15:54:29.278Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/d4/913e3195d95e0378786c6656945c865f534a3560e29139da4882aff630d1/ruff-0.16.8-py3-none-musllinux_1_2_i686.whl", hash = "sha256:59e8f5681349474110b24d62e93cfda6593f5fa3473446ca3705200cac1a08b9", size = 10231569, upload-time = "2026-09-16T15:54:32.036Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/c4/8aa6ea0bdcedbd1bf87397e2fc4ed8406448ea5842f8660bc6e5f163039d/ruff-0.16.8-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:efa3e7a16d1baaa79957888dfdf8be9ef2e44db81cb032af06d76632ab59e773", size = 10663666, upload-time = "2026-09-16T15:54:34.838Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/02/7f10ef4700bc223c30a3fdd10631a29830c45524b810a3c7ed947af64591/ruff-0.16.8-py3-none-win32.whl", hash = "sha256:55793ba85c69921e89be061426d91a78652d6e50317c962240922747a4eb713f", size = 10093472, upload-time = "2026-09-16T15:54:37.47Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/5d/a509c07d714b6da88f2c518b4637cf6f1d46b074be8f0f1e5fb9ff5126fe/ruff-0.16.8-py3-none-win_amd64.whl", hash = "sha256:a6b85621fd3c81e31fc5f5add09c9c078b430db3595ca632efafdec9e64ebfaa", size = 10586899, upload-time = "2026-09-16T15:54:40.488Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/a0/50787329e4f20bf9dc9f6230015d46ec69c51a97ace5bc202dae4755365d/ruff-0.16.8-py3-none-win_arm64.whl", hash = "sha256:d075e820af612102ce217f07cc93e69f9490b10ec13ea85fa87bd03d996cef8a", size = 10386316, upload-time = "2026-09-16T15:54:43.332Z" },
 ]
 
 [[package]]
diff --git a/vector_search/views.py b/vector_search/views.py
index d329818af6..6305a9cae3 100644
--- a/vector_search/views.py
+++ b/vector_search/views.py
@@ -136,7 +136,7 @@ def _format_order_by(self, order_by_parameter):
             sort = models.Direction.DESC
         return models.OrderBy(key=order_by_parameter, direction=sort)
 
-    async def _build_search_params(  # noqa: PLR0913
+    async def _build_search_params(  # noqa: PLR0913, PLR0917
         self,
         query_string: str,
         search_collection: str,
@@ -320,7 +320,7 @@ async def _scroll_missing_order_by_key(self, client, scroll_kwargs, key, limit):
         )
         return page_points
 
-    async def _execute_scroll_search(  # noqa: PLR0913
+    async def _execute_scroll_search(  # noqa: PLR0913, PLR0917
         self,
         client,
         search_collection,
@@ -391,7 +391,7 @@ async def _execute_scroll_search(  # noqa: PLR0913
                 break
         return search_result[:limit]
 
-    async def _async_vector_hits(  # noqa: PLR0913
+    async def _async_vector_hits(  # noqa: PLR0913, PLR0917
         self,
         query_string: str,
         params: dict,
@@ -601,7 +601,7 @@ async def _async_vector_counts(
             "aggregations": aggregations or {},
         }
 
-    async def async_vector_search(  # noqa: PLR0913
+    async def async_vector_search(  # noqa: PLR0913, PLR0917
         self,
         query_string: str,
         params: dict,
diff --git a/widgets/factories.py b/widgets/factories.py
index fe78073828..4cf321b963 100644
--- a/widgets/factories.py
+++ b/widgets/factories.py
@@ -42,11 +42,6 @@ class Params:
             title="Markdown Widget",
             configuration={"source": "*Here's some basic markdown*"},
         )
-        type_rss = factory.Trait(
-            widget_type="RSS Feed",
-            title="RSS Widget",
-            configuration={"url": "http://example.com", "feed_display_limit": 10},
-        )
         type_people = factory.Trait(
             widget_type="People",
             title="People Widget",
diff --git a/widgets/serializers/rss.py b/widgets/serializers/rss.py
deleted file mode 100644
index 8477bc6851..0000000000
--- a/widgets/serializers/rss.py
+++ /dev/null
@@ -1,115 +0,0 @@
-"""RSS widget"""
-
-import logging
-import time
-
-import feedparser
-from cache_memoize import cache_memoize
-from django.conf import settings
-from rest_framework.serializers import ValidationError
-
-from main.constants import ISOFORMAT
-from widgets.serializers.react_fields import ReactIntegerField, ReactURLField
-from widgets.serializers.widget_instance import (
-    WidgetConfigSerializer,
-    WidgetInstanceSerializer,
-)
-
-MAX_FEED_ITEMS = 10
-
-log = logging.getLogger()
-
-
-class RssFeedWidgetConfigSerializer(WidgetConfigSerializer):
-    """Serializer for RssFeedWidget config"""
-
-    url = ReactURLField(help_text="RSS feed URL", label="URL")
-    feed_display_limit = ReactIntegerField(
-        min_value=1, max_value=MAX_FEED_ITEMS, default=5, label="Max number of items"
-    )
-
-
-@cache_memoize(settings.WIDGETS_RSS_CACHE_TTL, cache_alias="external_assets")
-def _fetch_rss(url):
-    """
-    Fetches the RSS feed data
-
-    Args:
-        url (str): the RSS feed url to fetch
-
-    Returns:
-        feedparser.FeedParserDict: rss feed data
-    """  # noqa: D401
-    # NOTE: if you change what this function returns you need to ensure caches are evicted  # noqa: E501
-    #       across all our environments, ideally in an automated way because cache_memoize  # noqa: E501
-    #       won't know your implementation change. One possible way is to rename the function  # noqa: E501
-    #       or change the arguments.
-    return feedparser.parse(url)
-
-
-class RssFeedWidgetSerializer(WidgetInstanceSerializer):
-    """A basic rss feed widget"""
-
-    configuration_serializer_class = RssFeedWidgetConfigSerializer
-
-    name = "RSS Feed"
-    description = "RSS Feed"
-
-    def get_json(self, instance):
-        """Obtains RSS feed data which will then be provided to the React component"""  # noqa: D401
-        try:
-            rss = _fetch_rss(instance.configuration["url"])
-            entries = getattr(rss, "entries", [])
-        except:  # pylint: disable=bare-except  # noqa: E722
-            # log an exception and coerce this to an empty list so the feed and UI don't crash  # noqa: E501
-            log.exception(
-                "Error trying to refresh cached RSS feed for widget id: %s", instance.id
-            )
-            entries = []
-
-        timestamp_key = (
-            "published_parsed"
-            if entries and "published_parsed" in entries[0]
-            else "updated_parsed"
-        )
-        sorted_feed = sorted(
-            entries, reverse=True, key=lambda entry: entry[timestamp_key]
-        )
-        display_limit = min(
-            instance.configuration["feed_display_limit"], MAX_FEED_ITEMS
-        )
-
-        return {
-            "title": instance.title,
-            "entries": [
-                {
-                    "title": entry.get("title"),
-                    "description": entry.get("description"),
-                    "link": entry.get("link"),
-                    "timestamp": (
-                        time.strftime(ISOFORMAT, entry.get(timestamp_key))
-                        if entry.get(timestamp_key)
-                        else None
-                    ),
-                }
-                for entry in sorted_feed[:display_limit]
-            ],
-        }
-
-    def save(self, **kwargs):
-        """Saves the widget settings"""  # noqa: D401
-        instance = super().save(**kwargs)
-
-        url = instance.configuration["url"]
-
-        try:
-            # force a cache refresh immediately after a successful save by invalidating and then loading it  # noqa: E501
-            _fetch_rss.invalidate(url)
-            _fetch_rss(url)
-        except:  # pylint: disable=bare-except  # noqa: E722
-            log.exception("Error trying to load new RSS feed url: %s", url)
-            raise ValidationError(  # noqa: B904
-                {"configuration": f"Unable to load the RSS feed: '{url}'"}
-            )
-
-        return instance
diff --git a/widgets/serializers/rss_test.py b/widgets/serializers/rss_test.py
deleted file mode 100644
index fd0065f572..0000000000
--- a/widgets/serializers/rss_test.py
+++ /dev/null
@@ -1,102 +0,0 @@
-"""Tests for rss widget serializer"""
-
-import time
-
-import pytest
-from rest_framework.serializers import ValidationError
-
-from main.test_utils import PickleableMock
-from widgets.factories import WidgetInstanceFactory, WidgetListFactory
-from widgets.serializers import rss
-
-
-@pytest.mark.django_db
-@pytest.mark.parametrize("raise_exception", [True, False])
-@pytest.mark.parametrize("timestamp_key", ["published_parsed", "updated_parsed"])
-@pytest.mark.parametrize("item_count", [0, 8, 15])
-@pytest.mark.parametrize("display_limit", [0, 6, 10, 14, 18])
-def test_url_widget_serialize(
-    mocker, raise_exception, timestamp_key, item_count, display_limit
-):
-    """Tests that the rss widget serializes correctly"""
-    entries = sorted(
-        [
-            {
-                "title": f"Title {idx}",
-                "description": f"Description {idx}",
-                "link": f"http://example.com/{idx}",
-                timestamp_key: time.gmtime(),
-            }
-            for idx in range(item_count)
-        ],
-        reverse=True,
-        key=lambda entry: entry[timestamp_key],
-    )
-    mock_parse = mocker.patch("feedparser.parse")
-    if raise_exception:
-        mock_parse.side_effect = Exception("bad")
-    else:
-        mock_parse.return_value = PickleableMock(entries=entries)
-    widget_instance = WidgetInstanceFactory.create(type_rss=True)
-    widget_instance.configuration["feed_display_limit"] = display_limit
-    widget_instance.save()
-
-    data = rss.RssFeedWidgetSerializer(widget_instance).data
-
-    mock_parse.assert_called_once_with(widget_instance.configuration["url"])
-
-    assert data == {
-        "id": widget_instance.id,
-        "widget_type": "RSS Feed",
-        "title": widget_instance.title,
-        "configuration": widget_instance.configuration,
-        "json": {
-            "title": widget_instance.title,
-            "entries": (
-                []
-                if raise_exception
-                else [
-                    {
-                        "title": entry["title"],
-                        "description": entry["description"],
-                        "link": entry["link"],
-                        "timestamp": time.strftime(
-                            "%Y-%m-%dT%H:%M:%SZ", entry[timestamp_key]
-                        ),
-                    }
-                    for entry in entries[: min(rss.MAX_FEED_ITEMS, display_limit)]
-                ]
-            ),
-        },
-    }
-
-
-@pytest.mark.django_db
-@pytest.mark.parametrize("raise_exception", [True, False])
-def test_url_widget_save(mocker, raise_exception):
-    """Tests that the rss widget serializes correctly"""
-    widget_list = WidgetListFactory.create()
-    url = "http://example.com"
-    data = {
-        "widget_list_id": widget_list.id,
-        "title": "Title",
-        "widget_type": "RSS Feed",
-        "position": 1,
-        "configuration": {"url": url},
-    }
-    mock_parse = mocker.patch("feedparser.parse")
-    if raise_exception:
-        mock_parse.side_effect = Exception("bad")
-    else:
-        mock_parse.return_value = PickleableMock(entries=[])
-
-    serializer = rss.RssFeedWidgetSerializer(data=data)
-    serializer.is_valid()
-
-    if raise_exception:
-        with pytest.raises(ValidationError):
-            serializer.save()
-    else:
-        serializer.save()
-
-    mock_parse.assert_called_once_with(url)
diff --git a/widgets/serializers/utils.py b/widgets/serializers/utils.py
index a9d4144ccc..3ca649a283 100644
--- a/widgets/serializers/utils.py
+++ b/widgets/serializers/utils.py
@@ -11,13 +11,11 @@ def get_widget_classes():
     # NOTE: these imports are inline to avoid circular imports
     from widgets.serializers.markdown import MarkdownWidgetSerializer
     from widgets.serializers.people import PeopleWidgetSerializer
-    from widgets.serializers.rss import RssFeedWidgetSerializer
     from widgets.serializers.url import URLWidgetSerializer
 
     return [
         MarkdownWidgetSerializer,
         URLWidgetSerializer,
-        RssFeedWidgetSerializer,
         PeopleWidgetSerializer,
     ]
 
diff --git a/widgets/serializers/widget_list.py b/widgets/serializers/widget_list.py
index 31a4c54303..d81ee46881 100644
--- a/widgets/serializers/widget_list.py
+++ b/widgets/serializers/widget_list.py
@@ -80,7 +80,11 @@ def update(self, instance, validated_data):
         for data in widgets_data:
             widget_id = data.get("id", None)
             widget = existing_widgets_by_id.get(widget_id)
-            widget_serializer_cls = _serializer_for_widget_type(data["widget_type"])
+            widget_type = data.get("widget_type")
+            widget_serializer_cls = _serializer_for_widget_type(widget_type)
+            if widget_serializer_cls is None:
+                msg = f"Unsupported widget_type: {widget_type!r}"
+                raise serializers.ValidationError({"widget_type": msg})
 
             if not widget:
                 # if the widget provided was not in the data, ensure the user isn't trying to set id or widget_list_id  # noqa: E501
diff --git a/widgets/serializers/widget_list_test.py b/widgets/serializers/widget_list_test.py
index baae443245..c098ad397f 100644
--- a/widgets/serializers/widget_list_test.py
+++ b/widgets/serializers/widget_list_test.py
@@ -1,6 +1,7 @@
 """Tests for widget list serializer"""
 
 import pytest
+from rest_framework.exceptions import ValidationError
 
 from widgets.factories import WidgetInstanceFactory, WidgetListFactory
 from widgets.serializers.widget_list import WidgetListSerializer
@@ -18,3 +19,19 @@ def test_missing_widget_type():
         "widgets": [],
         "id": widget_list.id,
     }
+
+
+@pytest.mark.parametrize("widget_type", ["not_A_real_type", "RSS Feed", None])
+def test_update_with_unsupported_widget_type(widget_type):
+    """
+    An unsupported widget_type on update() should raise a validation error,
+    not crash with TypeError trying to call a None serializer class.
+    """
+    widget_list = WidgetListFactory.create()
+    data = {"widget_type": widget_type, "title": "x", "configuration": {}}
+    if widget_type is None:
+        del data["widget_type"]
+    serializer = WidgetListSerializer(widget_list, data={"widgets": [data]})
+    assert serializer.is_valid(), serializer.errors
+    with pytest.raises(ValidationError):
+        serializer.save()
diff --git a/widgets/views_test.py b/widgets/views_test.py
index b5b413cd96..72ef56470f 100644
--- a/widgets/views_test.py
+++ b/widgets/views_test.py
@@ -65,33 +65,6 @@
         "widget_type": "URL",
         "description": "Embedded URL",
     },
-    {
-        "form_spec": [
-            {
-                "field_name": "url",
-                "input_type": "url",
-                "label": "URL",
-                "under_text": None,
-                "props": {
-                    "max_length": "",
-                    "min_length": "",
-                    "placeholder": "RSS feed URL",
-                    "show_embed": False,
-                },
-                "default": "",
-            },
-            {
-                "field_name": "feed_display_limit",
-                "input_type": "number",
-                "label": "Max number of items",
-                "under_text": None,
-                "props": {"max": 10, "min": 1},
-                "default": 5,
-            },
-        ],
-        "widget_type": "RSS Feed",
-        "description": "RSS Feed",
-    },
     {
         "description": "People",
         "form_spec": [