diff --git a/apps/mobile/src/features/connection/ConnectionDiagnosisDetails.tsx b/apps/mobile/src/features/connection/ConnectionDiagnosisDetails.tsx
index b3922c4a95eda..e4862b2f367d3 100644
--- a/apps/mobile/src/features/connection/ConnectionDiagnosisDetails.tsx
+++ b/apps/mobile/src/features/connection/ConnectionDiagnosisDetails.tsx
@@ -4,6 +4,7 @@ import {
   type ConnectionDiagnosis,
   connectionDiagnosisText,
   connectionRoutes,
+  environmentDisplayLabel,
   hasRelayRoute,
   presentConnectionDiagnosis,
   type EnvironmentPresentation,
@@ -37,7 +38,7 @@ export function useConnectionDiagnosis(
   const relayOnly =
     connectionRoutes(presentation.entry).length === 1 && hasRelayRoute(presentation.entry);
   const diagnosis = presentConnectionDiagnosis({
-    hostLabel: presentation.entry.target.label,
+    hostLabel: environmentDisplayLabel(presentation.entry, presentation.serverConfig),
     state,
     via: relayOnly ? "relay" : "direct",
     clientVersion: Constants.expoConfig?.version,
diff --git a/apps/mobile/src/features/connection/ConnectionEnvironmentRow.tsx b/apps/mobile/src/features/connection/ConnectionEnvironmentRow.tsx
index c7866cea6ce06..fbcb82f7cd8ea 100644
--- a/apps/mobile/src/features/connection/ConnectionEnvironmentRow.tsx
+++ b/apps/mobile/src/features/connection/ConnectionEnvironmentRow.tsx
@@ -3,7 +3,11 @@ import { ConnectionTraceId } from "./ConnectionTraceId";
 import { SymbolView } from "../../components/ui/AppSymbol";
 import { hasSavedBearerRoute, hostFreezeNotice } from "@t3tools/client-runtime/connection";
 import type { AtomCommandResult } from "@t3tools/client-runtime/state/runtime";
-import { type EnvironmentId, resolveEnvironmentMachineKind } from "@t3tools/contracts";
+import {
+  type EnvironmentId,
+  type ServerConfig,
+  resolveEnvironmentMachineKind,
+} from "@t3tools/contracts";
 import { useAtomValue } from "@effect/atom-react";
 import * as Cause from "effect/Cause";
 import { AsyncResult } from "effect/reactivity";
@@ -24,6 +28,7 @@ import { ConnectionDiagnosisDetails, useConnectionDiagnosis } from "./Connection
 import { ConnectionFormField } from "./ConnectionFormField";
 import { ConnectionStatusDot } from "./ConnectionStatusDot";
 import { environmentStatusText } from "./environmentStatusText";
+import { environmentCatalog } from "../../connection/catalog";
 
 function connectionStatusLabel(environment: ConnectedEnvironmentSummary): string | null {
   if (!environment.isEnabled && environment.connectionState !== "unsupported") {
@@ -36,7 +41,7 @@ function connectionStatusLabel(environment: ConnectedEnvironmentSummary): string
   });
 }
 
-export function ConnectionEnvironmentRow(props: {
+interface ConnectionEnvironmentRowProps {
   readonly environment: ConnectedEnvironmentSummary;
   readonly expanded: boolean;
   readonly opensDetails?: boolean;
@@ -48,9 +53,12 @@ export function ConnectionEnvironmentRow(props: {
     environmentId: EnvironmentId,
     updates: { readonly label: string; readonly displayUrl: string },
   ) => Promise<AtomCommandResult<unknown, unknown>>;
-}) {
-  const [label, setLabel] = useState(props.environment.environmentLabel);
-  const [url, setUrl] = useState(props.environment.displayUrl);
+}
+
+export function ConnectionEnvironmentRow(props: ConnectionEnvironmentRowProps) {
+  const catalog = useAtomValue(environmentCatalog.catalogValueAtom);
+  const isHostName =
+    catalog.entries.get(props.environment.environmentId)?.target._tag === "RelayConnectionTarget";
   const serverConfig = useAtomValue(
     serverEnvironment.configValueAtom(props.environment.environmentId),
   );
@@ -74,21 +82,6 @@ export function ConnectionEnvironmentRow(props: {
     enabled &&
     (props.environment.connectionState === "connecting" ||
       props.environment.connectionState === "reconnecting");
-  const handleSave = async () => {
-    const result = await props.onUpdate(props.environment.environmentId, {
-      label: label.trim(),
-      displayUrl: url.trim(),
-    });
-    if (AsyncResult.isSuccess(result)) {
-      props.onToggle();
-      return;
-    }
-    const error = Cause.squash(result.cause);
-    Dialog.alert(
-      "Could not update environment",
-      error instanceof Error ? error.message : "The environment could not be updated.",
-    );
-  };
 
   return (
     <Animated.View layout={LinearTransition.duration(250)} className="bg-grouped-card">
@@ -121,7 +114,7 @@ export function ConnectionEnvironmentRow(props: {
               {props.environment.environmentLabel}
             </Text>
           </View>
-          {!props.environment.isRelayManaged && props.environment.displayUrl.trim() ? (
+          {!isHostName && props.environment.displayUrl.trim() ? (
             <Text className="text-xs text-foreground-muted" numberOfLines={1}>
               {props.environment.displayUrl}
             </Text>
@@ -197,124 +190,192 @@ export function ConnectionEnvironmentRow(props: {
       </View>
 
       {props.expanded ? (
-        <Animated.View
-          entering={FadeIn.duration(200)}
-          exiting={FadeOut.duration(150)}
-          className="gap-3 px-4 pb-4"
-        >
-          {diagnosis ? (
-            <ConnectionDiagnosisDetails
-              hostLabel={props.environment.environmentLabel}
-              diagnosis={diagnosis}
-            />
-          ) : null}
-          {props.environment.isRelayManaged ? (
-            <Text className="text-sm text-foreground-muted">
-              Managed by T3 Connect. Tunnel details update automatically.
-            </Text>
-          ) : (
-            <>
-              <ConnectionFormField
-                label="Label"
-                autoCapitalize="words"
-                autoCorrect={false}
-                placeholder="My MacBook"
-                value={label}
-                onChangeText={setLabel}
-              />
+        <ConnectionEnvironmentEditor
+          key={isHostName ? "host" : "local"}
+          {...props}
+          isHostName={isHostName}
+          enabled={enabled}
+          serverConfig={serverConfig}
+          diagnosis={diagnosis}
+        />
+      ) : null}
+    </Animated.View>
+  );
+}
 
-              <ConnectionFormField
-                label="URL"
-                autoCapitalize="none"
-                autoCorrect={false}
-                keyboardType="url"
-                placeholder="192.168.1.100:8080"
-                value={url}
-                onChangeText={setUrl}
-              />
-            </>
-          )}
+/** Mounted only while expanded, so each opening starts from the latest saved values. */
+function ConnectionEnvironmentEditor(
+  props: ConnectionEnvironmentRowProps & {
+    readonly isHostName: boolean;
+    readonly enabled: boolean;
+    readonly serverConfig: ServerConfig | null;
+    readonly diagnosis: ReturnType<typeof useConnectionDiagnosis>["diagnosis"];
+  },
+) {
+  const { isHostName, enabled, serverConfig, diagnosis } = props;
+  const [draft, setDraft] = useState<{ readonly label?: string; readonly url?: string }>({});
+  const [saving, setSaving] = useState(false);
+  const label =
+    draft.label ??
+    (isHostName
+      ? (serverConfig?.settings.environmentLabel ?? "")
+      : props.environment.environmentLabel);
+  const url = draft.url ?? props.environment.displayUrl;
+  const canUpdateSettings = useAtomValue(
+    serverEnvironment.updateSettings.permissionAtom(props.environment.environmentId, {
+      patch: { environmentLabel: label.trim() },
+    }),
+  );
+  const canEditHost =
+    props.environment.connectionState === "connected" &&
+    serverConfig?.environment.capabilities.environmentLabel === true &&
+    canUpdateSettings;
+  const canSave = !saving && (!isHostName || canEditHost);
+  async function handleSave() {
+    if (!canSave) return;
+    setSaving(true);
+    const result = await props
+      .onUpdate(props.environment.environmentId, {
+        label: label.trim(),
+        displayUrl: url.trim(),
+      })
+      .finally(() => setSaving(false));
+    if (AsyncResult.isSuccess(result)) {
+      props.onToggle();
+      return;
+    }
+    const error = Cause.squash(result.cause);
+    Dialog.alert(
+      "Could not update environment",
+      error instanceof Error ? error.message : "The environment could not be updated.",
+    );
+  }
 
-          {Platform.OS === "android" ? (
-            <View className="flex-row items-center justify-end gap-2">
-              {props.environment.isRelayManaged ? null : (
-                <View className="flex-1">
-                  <Button
-                    label="Save"
-                    tone="primary"
-                    fullWidth
-                    onPress={() => {
-                      void handleSave();
-                    }}
-                  />
-                </View>
-              )}
-              <IconButton
-                accessibilityLabel="Reconnect environment"
-                icon="arrow.clockwise"
-                variant="tonal"
-                disabled={!enabled}
-                onPress={() => props.onReconnect(props.environment.environmentId)}
-              />
-              <IconButton
-                accessibilityLabel="Remove environment"
-                icon="trash"
-                variant="danger"
-                onPress={() => props.onRemove(props.environment.environmentId)}
-              />
-            </View>
-          ) : (
-            <View className="flex-row justify-end gap-2">
-              {props.environment.isRelayManaged ? null : (
-                <Pressable
-                  className="min-h-[42px] flex-1 flex-row items-center justify-center gap-1.5 rounded-[14px] bg-primary px-3.5 py-2.5 active:opacity-70"
-                  onPress={handleSave}
-                >
-                  <SymbolView
-                    name="checkmark"
-                    size={13}
-                    tintColorClassName="accent-primary-foreground"
-                    type="monochrome"
-                  />
-                  <Text className="text-xs font-t3-bold tracking-[0.8px] uppercase text-primary-foreground">
-                    Save
-                  </Text>
-                </Pressable>
-              )}
+  return (
+    <Animated.View
+      entering={FadeIn.duration(200)}
+      exiting={FadeOut.duration(150)}
+      className="gap-3 px-4 pb-4"
+    >
+      {diagnosis ? (
+        <ConnectionDiagnosisDetails
+          hostLabel={props.environment.environmentLabel}
+          diagnosis={diagnosis}
+        />
+      ) : null}
+      <ConnectionFormField
+        label={isHostName ? "Host name" : "Label"}
+        autoCapitalize="words"
+        autoCorrect={false}
+        placeholder="My MacBook"
+        value={label}
+        editable={!saving && (!isHostName || canEditHost)}
+        onChangeText={(value) => {
+          setDraft((previous) => ({ ...previous, label: value }));
+        }}
+      />
 
-              <Pressable
-                accessibilityRole="button"
-                accessibilityLabel="Reconnect environment"
-                accessibilityState={{ disabled: !enabled }}
-                className="h-[42px] w-[42px] items-center justify-center rounded-[14px] border border-input-border bg-input active:opacity-70 disabled:opacity-40"
-                disabled={!enabled}
-                onPress={() => props.onReconnect(props.environment.environmentId)}
-              >
-                <SymbolView
-                  name="arrow.clockwise"
-                  size={14}
-                  tintColorClassName="accent-icon-subtle"
-                  type="monochrome"
-                />
-              </Pressable>
+      {isHostName ? (
+        <Text className="text-sm text-foreground-muted">
+          {props.environment.connectionState !== "connected"
+            ? "Connect to this environment to change its host name."
+            : serverConfig?.environment.capabilities.environmentLabel !== true
+              ? "Update the host server to change its name."
+              : !canUpdateSettings
+                ? "You need permission to update this environment’s settings."
+                : "Shared with all connected clients. Leave empty to use the machine name."}
+        </Text>
+      ) : (
+        <ConnectionFormField
+          label="URL"
+          autoCapitalize="none"
+          autoCorrect={false}
+          keyboardType="url"
+          placeholder="192.168.1.100:8080"
+          value={url}
+          editable={!saving}
+          onChangeText={(value) => {
+            setDraft((previous) => ({ ...previous, url: value }));
+          }}
+        />
+      )}
 
-              <Pressable
-                accessibilityRole="button"
-                accessibilityLabel="Remove environment"
-                className="h-[42px] w-[42px] items-center justify-center rounded-[14px] border border-danger-border bg-danger active:opacity-70"
-                onPress={() => props.onRemove(props.environment.environmentId)}
-              >
-                <SymbolView
-                  name="trash"
-                  size={14}
-                  tintColorClassName="accent-danger-foreground"
-                  type="monochrome"
-                />
-              </Pressable>
-            </View>
-          )}
-        </Animated.View>
-      ) : null}
+      {Platform.OS === "android" ? (
+        <View className="flex-row items-center justify-end gap-2">
+          <View className="flex-1">
+            <Button
+              label="Save"
+              tone="primary"
+              fullWidth
+              disabled={!canSave}
+              onPress={() => {
+                void handleSave();
+              }}
+            />
+          </View>
+          <IconButton
+            accessibilityLabel="Reconnect environment"
+            icon="arrow.clockwise"
+            variant="tonal"
+            disabled={!enabled}
+            onPress={() => props.onReconnect(props.environment.environmentId)}
+          />
+          <IconButton
+            accessibilityLabel="Remove environment"
+            icon="trash"
+            variant="danger"
+            onPress={() => props.onRemove(props.environment.environmentId)}
+          />
+        </View>
+      ) : (
+        <View className="flex-row justify-end gap-2">
+          <Pressable
+            className="min-h-[42px] flex-1 flex-row items-center justify-center gap-1.5 rounded-[14px] bg-primary px-3.5 py-2.5 active:opacity-70 disabled:opacity-40"
+            disabled={!canSave}
+            onPress={handleSave}
+          >
+            <SymbolView
+              name="checkmark"
+              size={13}
+              tintColorClassName="accent-primary-foreground"
+              type="monochrome"
+            />
+            <Text className="text-xs font-t3-bold tracking-[0.8px] uppercase text-primary-foreground">
+              Save
+            </Text>
+          </Pressable>
+
+          <Pressable
+            accessibilityRole="button"
+            accessibilityLabel="Reconnect environment"
+            accessibilityState={{ disabled: !enabled }}
+            className="h-[42px] w-[42px] items-center justify-center rounded-[14px] border border-input-border bg-input active:opacity-70 disabled:opacity-40"
+            disabled={!enabled}
+            onPress={() => props.onReconnect(props.environment.environmentId)}
+          >
+            <SymbolView
+              name="arrow.clockwise"
+              size={14}
+              tintColorClassName="accent-icon-subtle"
+              type="monochrome"
+            />
+          </Pressable>
+
+          <Pressable
+            accessibilityRole="button"
+            accessibilityLabel="Remove environment"
+            className="h-[42px] w-[42px] items-center justify-center rounded-[14px] border border-danger-border bg-danger active:opacity-70"
+            onPress={() => props.onRemove(props.environment.environmentId)}
+          >
+            <SymbolView
+              name="trash"
+              size={14}
+              tintColorClassName="accent-danger-foreground"
+              type="monochrome"
+            />
+          </Pressable>
+        </View>
+      )}
     </Animated.View>
   );
 }
diff --git a/apps/mobile/src/features/connection/PullRequestRoutingSettings.tsx b/apps/mobile/src/features/connection/PullRequestRoutingSettings.tsx
index 44383db74b2ad..b594323e65130 100644
--- a/apps/mobile/src/features/connection/PullRequestRoutingSettings.tsx
+++ b/apps/mobile/src/features/connection/PullRequestRoutingSettings.tsx
@@ -13,6 +13,7 @@ import { Pressable, View } from "react-native";
 import { AppText as Text } from "../../components/ui/AppText";
 import { SymbolView } from "../../components/ui/AppSymbol";
 import { environmentCatalog } from "../../connection/catalog";
+import { useEnvironments } from "../../state/environments";
 import { useAtomCommand } from "../../state/use-atom-command";
 import { SettingsSection } from "../settings/components/SettingsSection";
 
@@ -36,18 +37,18 @@ const options: ReadonlyArray<{
 ];
 
 export function PullRequestRoutingSettings() {
+  const { environments } = useEnvironments();
   const catalog = useAtomValue(environmentCatalog.catalogValueAtom);
   const permissions = useAtomValue(environmentCatalog.pullRequestRoutingPermissionsValueAtom);
   const update = useAtomCommand(environmentCatalog.setPullRequestRoutingPermission);
   const [expanded, setExpanded] = useState<string | null>(null);
   const [saving, setSaving] = useState(false);
-  if (catalog.entries.size === 0) return null;
+  if (environments.length === 0) return null;
 
   return (
     <View className="mt-5 gap-3">
       <SettingsSection title="Pull request routing">
-        {[...catalog.entries.values()].map((entry) => {
-          const environmentId = entry.target.environmentId;
+        {environments.map(({ environmentId, entry, label }) => {
           const selected = pullRequestRoutingPermissionFor(entry, permissions);
           const disabled =
             !catalog.isReady || saving || pullRequestRoutingConnectionKey(entry) === null;
@@ -55,15 +56,13 @@ export function PullRequestRoutingSettings() {
             <View key={environmentId}>
               <Pressable
                 accessibilityRole="button"
-                accessibilityLabel={`${entry.target.label} pull request routing`}
+                accessibilityLabel={`${label} pull request routing`}
                 accessibilityState={{ expanded: expanded === environmentId }}
                 className="flex-row items-center gap-3 p-4"
                 onPress={() => setExpanded(expanded === environmentId ? null : environmentId)}
               >
                 <View className="min-w-0 flex-1 gap-0.5">
-                  <Text className="text-base font-t3-bold text-foreground">
-                    {entry.target.label}
-                  </Text>
+                  <Text className="text-base font-t3-bold text-foreground">{label}</Text>
                   <Text className="text-xs text-foreground-muted" numberOfLines={1}>
                     {connectionCatalogDisplayUrl(entry) ?? "T3 Connect"}
                   </Text>
diff --git a/apps/mobile/src/features/connection/environmentUpdate.test.ts b/apps/mobile/src/features/connection/environmentUpdate.test.ts
new file mode 100644
index 0000000000000..6014afd7b9dad
--- /dev/null
+++ b/apps/mobile/src/features/connection/environmentUpdate.test.ts
@@ -0,0 +1,118 @@
+import { describe, expect, it } from "@effect/vitest";
+import {
+  BearerConnectionTarget,
+  RelayConnectionTarget,
+  type ConnectionCatalogEntry,
+} from "@t3tools/client-runtime/connection";
+import { EnvironmentId } from "@t3tools/contracts";
+import * as Option from "effect/Option";
+
+import { updateConnectionEnvironment } from "./environmentUpdate";
+
+const environmentId = EnvironmentId.make("studio");
+const relay = new RelayConnectionTarget({ environmentId, label: "Studio" });
+const bearer = new BearerConnectionTarget({
+  environmentId,
+  label: "My Mac",
+  connectionId: "direct",
+});
+const relayEntry: ConnectionCatalogEntry = { target: relay, profile: Option.none(), enabled: true };
+
+function harness() {
+  const settingsByEnvironment = new Map<EnvironmentId, string>();
+  const aliasesByEnvironment = new Map<EnvironmentId, { label: string; url: string }>();
+  let failure: string | null = null;
+  const commands = {
+    updateHost: async (target: {
+      environmentId: EnvironmentId;
+      input: { patch: { environmentLabel: string } };
+    }) => {
+      if (failure !== null) return { status: "failure" as const, message: failure };
+      settingsByEnvironment.set(target.environmentId, target.input.patch.environmentLabel);
+      return { status: "success" as const };
+    },
+    updateBearer: async (input: {
+      environmentId: EnvironmentId;
+      label: string;
+      httpBaseUrl: string;
+    }) => {
+      aliasesByEnvironment.set(input.environmentId, { label: input.label, url: input.httpBaseUrl });
+      return { status: "success" as const };
+    },
+  };
+  return {
+    commands,
+    settingsByEnvironment,
+    aliasesByEnvironment,
+    fail: (message: string) => {
+      failure = message;
+    },
+  };
+}
+
+describe("editing an environment connection", () => {
+  it("renames and clears the chosen Connect host without changing its local routes", async () => {
+    const h = harness();
+    h.aliasesByEnvironment.set(environmentId, { label: "My Mac", url: "http://studio.test" });
+    h.settingsByEnvironment.set(EnvironmentId.make("other"), "Other host");
+    await updateConnectionEnvironment(
+      relayEntry,
+      environmentId,
+      { label: "  Studio Mac  ", displayUrl: "ignored" },
+      h.commands,
+    );
+    expect(h.settingsByEnvironment.get(environmentId)).toBe("Studio Mac");
+    expect(h.settingsByEnvironment.get(EnvironmentId.make("other"))).toBe("Other host");
+    expect(h.aliasesByEnvironment.get(environmentId)).toEqual({
+      label: "My Mac",
+      url: "http://studio.test",
+    });
+    await updateConnectionEnvironment(
+      relayEntry,
+      environmentId,
+      { label: "  ", displayUrl: "" },
+      h.commands,
+    );
+    expect(h.settingsByEnvironment.get(environmentId)).toBe("");
+  });
+
+  it("keeps a manual alias local even when the environment also has a relay route", async () => {
+    const h = harness();
+    h.settingsByEnvironment.set(environmentId, "Shared host");
+    const entry = {
+      ...relayEntry,
+      target: bearer,
+      alternateRoutes: [
+        { target: bearer, profile: Option.none() },
+        { target: relay, profile: Option.none() },
+      ],
+    };
+    await updateConnectionEnvironment(
+      entry,
+      environmentId,
+      { label: "Travel Mac", displayUrl: "http://travel.test" },
+      h.commands,
+    );
+    expect(h.aliasesByEnvironment.get(environmentId)).toEqual({
+      label: "Travel Mac",
+      url: "http://travel.test",
+    });
+    expect(h.settingsByEnvironment.get(environmentId)).toBe("Shared host");
+  });
+
+  it("returns a denied remote update without falling back to a local alias edit", async () => {
+    const h = harness();
+    h.settingsByEnvironment.set(environmentId, "Studio");
+    h.fail("Missing settings permission");
+    expect(
+      await updateConnectionEnvironment(
+        relayEntry,
+        environmentId,
+        { label: "New name", displayUrl: "http://studio.test" },
+        h.commands,
+      ),
+    ).toEqual({ status: "failure", message: "Missing settings permission" });
+    expect(h.settingsByEnvironment.get(environmentId)).toBe("Studio");
+    expect(h.aliasesByEnvironment.size).toBe(0);
+  });
+});
diff --git a/apps/mobile/src/features/connection/environmentUpdate.ts b/apps/mobile/src/features/connection/environmentUpdate.ts
new file mode 100644
index 0000000000000..805e6e9251f6b
--- /dev/null
+++ b/apps/mobile/src/features/connection/environmentUpdate.ts
@@ -0,0 +1,30 @@
+import type {
+  ConnectionCatalogEntry,
+  ConnectionOnboarding,
+} from "@t3tools/client-runtime/connection";
+import type { EnvironmentId } from "@t3tools/contracts";
+
+/** A Connect name belongs to the host; a manual connection alias belongs to this device. */
+export function updateConnectionEnvironment<A, B>(
+  entry: ConnectionCatalogEntry | undefined,
+  environmentId: EnvironmentId,
+  updates: { readonly label: string; readonly displayUrl: string },
+  commands: {
+    readonly updateHost: (target: {
+      readonly environmentId: EnvironmentId;
+      readonly input: { readonly patch: { readonly environmentLabel: string } };
+    }) => Promise<A>;
+    readonly updateBearer: (input: ConnectionOnboarding.BearerConnectionUpdateInput) => Promise<B>;
+  },
+): Promise<A | B> {
+  return entry?.target._tag === "RelayConnectionTarget"
+    ? commands.updateHost({
+        environmentId,
+        input: { patch: { environmentLabel: updates.label.trim() } },
+      })
+    : commands.updateBearer({
+        environmentId,
+        label: updates.label,
+        httpBaseUrl: updates.displayUrl,
+      });
+}
diff --git a/apps/mobile/src/features/connection/useConnectionController.ts b/apps/mobile/src/features/connection/useConnectionController.ts
index 626892d447569..d8f306d4f640e 100644
--- a/apps/mobile/src/features/connection/useConnectionController.ts
+++ b/apps/mobile/src/features/connection/useConnectionController.ts
@@ -1,4 +1,4 @@
-import { useAtomValue } from "@effect/atom-react";
+import { RegistryContext, useAtomValue } from "@effect/atom-react";
 import {
   RelayConnectionRegistration,
   RelayConnectionTarget,
@@ -9,7 +9,7 @@ import type {
   RelayEnvironmentStatusResponse,
 } from "@t3tools/contracts/relay";
 import * as Option from "effect/Option";
-import { useMemo } from "react";
+import { useContext, useMemo } from "react";
 
 import { environmentCatalog } from "../../connection/catalog";
 import {
@@ -20,6 +20,8 @@ import { useWorkspaceEnvironments } from "../../state/workspace";
 import { relayEnvironmentDiscovery } from "../../state/relay";
 import { useAtomCommand } from "../../state/use-atom-command";
 import { relayManagedEnvironmentIds } from "./environmentSections";
+import { serverEnvironment } from "../../state/server";
+import { updateConnectionEnvironment } from "./environmentUpdate";
 
 export interface RelayEnvironmentView {
   readonly environment: RelayClientEnvironmentRecord;
@@ -30,12 +32,14 @@ export interface RelayEnvironmentView {
 }
 
 export function useConnectionController() {
+  const registry = useContext(RegistryContext);
   const connectedEnvironments = useWorkspaceEnvironments();
   const discovery = useAtomValue(relayEnvironmentDiscovery.stateValueAtom);
   const connectPairingUrlMutation = useAtomCommand(connectPairingUrlAtom, {
     reportFailure: false,
   });
   const updateBearer = useAtomCommand(updateBearerConnection, { reportFailure: false });
+  const updateHost = useAtomCommand(serverEnvironment.updateSettings, { reportFailure: false });
   const registerEnvironment = useAtomCommand(environmentCatalog.register, "environment register");
   const removeEnvironmentMutation = useAtomCommand(environmentCatalog.remove, "environment remove");
   const retryEnvironmentMutation = useAtomCommand(environmentCatalog.retryNow, "environment retry");
@@ -92,11 +96,12 @@ export function useConnectionController() {
     environmentId: EnvironmentId,
     updates: { readonly label: string; readonly displayUrl: string },
   ) =>
-    updateBearer({
+    updateConnectionEnvironment(
+      registry.get(environmentCatalog.catalogValueAtom).entries.get(environmentId),
       environmentId,
-      label: updates.label,
-      httpBaseUrl: updates.displayUrl,
-    });
+      updates,
+      { updateHost, updateBearer },
+    );
 
   return {
     connectedEnvironments,
diff --git a/apps/mobile/src/features/files/WorkspaceFilePreviewError.tsx b/apps/mobile/src/features/files/WorkspaceFilePreviewError.tsx
index 63c3e7be0c65e..0d96bdc5b0782 100644
--- a/apps/mobile/src/features/files/WorkspaceFilePreviewError.tsx
+++ b/apps/mobile/src/features/files/WorkspaceFilePreviewError.tsx
@@ -1,3 +1,4 @@
+import { environmentDisplayLabel } from "@t3tools/client-runtime/connection";
 import type { EnvironmentId } from "@t3tools/contracts";
 import { View } from "react-native";
 
@@ -25,7 +26,14 @@ export function WorkspaceFilePreviewError(props: {
     return (
       <View className="flex-1 bg-sheet">
         <EnvironmentConnectionNotice
-          environmentLabel={environment.presentation?.entry.target.label ?? "Environment"}
+          environmentLabel={
+            environment.presentation
+              ? environmentDisplayLabel(
+                  environment.presentation.entry,
+                  environment.presentation.serverConfig,
+                )
+              : "Environment"
+          }
           connection={
             environment.presentation?.connection ?? {
               phase: "available",
diff --git a/apps/mobile/src/features/review/ReviewSheet.tsx b/apps/mobile/src/features/review/ReviewSheet.tsx
index 08a2fe5795889..f0ca51b35c43b 100644
--- a/apps/mobile/src/features/review/ReviewSheet.tsx
+++ b/apps/mobile/src/features/review/ReviewSheet.tsx
@@ -1,5 +1,6 @@
 import { settlePromise, squashAtomCommandFailure } from "@t3tools/client-runtime/state/runtime";
 import { AsyncResult } from "effect/reactivity";
+import { environmentDisplayLabel } from "@t3tools/client-runtime/connection";
 import type { EnvironmentId, ThreadId } from "@t3tools/contracts";
 import { formatDiffCount } from "@t3tools/client-runtime/diff-count";
 import { useNavigation, type StaticScreenProps } from "@react-navigation/native";
@@ -699,7 +700,14 @@ export function ReviewSheet(props: ReviewSheetProps) {
           {showConnectionNotice ? (
             <View className="flex-1" style={{ paddingTop: topContentInset }}>
               <EnvironmentConnectionNotice
-                environmentLabel={environment.presentation?.entry.target.label ?? "Environment"}
+                environmentLabel={
+                  environment.presentation
+                    ? environmentDisplayLabel(
+                        environment.presentation.entry,
+                        environment.presentation.serverConfig,
+                      )
+                    : "Environment"
+                }
                 connection={
                   environment.presentation?.connection ?? {
                     phase: "available",
diff --git a/apps/mobile/src/features/terminal/ThreadTerminalRouteScreen.tsx b/apps/mobile/src/features/terminal/ThreadTerminalRouteScreen.tsx
index 016b75cfb3056..f67c66ac2622c 100644
--- a/apps/mobile/src/features/terminal/ThreadTerminalRouteScreen.tsx
+++ b/apps/mobile/src/features/terminal/ThreadTerminalRouteScreen.tsx
@@ -1,4 +1,5 @@
 import * as Dialog from "../../components/ui/Dialog";
+import { environmentDisplayLabel } from "@t3tools/client-runtime/connection";
 import {
   AuthTerminalReadScope,
   AuthTerminalOperateScope,
@@ -867,9 +868,12 @@ function ThreadTerminal(props: {
           {!isEnvironmentReady ? (
             <EnvironmentConnectionNotice
               environmentLabel={
-                environment.presentation?.entry.target.label ??
-                selectedEnvironmentConnection?.environmentLabel ??
-                "Environment"
+                environment.presentation
+                  ? environmentDisplayLabel(
+                      environment.presentation.entry,
+                      environment.presentation.serverConfig,
+                    )
+                  : (selectedEnvironmentConnection?.environmentLabel ?? "Environment")
               }
               connection={
                 environment.presentation?.connection ?? {
diff --git a/apps/mobile/src/features/usage/UsageLimitsSection.tsx b/apps/mobile/src/features/usage/UsageLimitsSection.tsx
index 7f9c6bf28ff3c..e31113b998f1f 100644
--- a/apps/mobile/src/features/usage/UsageLimitsSection.tsx
+++ b/apps/mobile/src/features/usage/UsageLimitsSection.tsx
@@ -1,3 +1,4 @@
+import { environmentDisplayLabel } from "@t3tools/client-runtime/connection";
 import * as Dialog from "../../components/ui/Dialog";
 import { RegistryContext, useAtomMount, useAtomValue } from "@effect/atom-react";
 import { normalizeProviderAccentColor } from "@t3tools/client-runtime/state/provider-instance-display";
@@ -343,7 +344,9 @@ export function useRefreshLimits(
   );
   const failedLabels = selected
     .filter(([environmentId]) => failedIds.has(environmentId))
-    .map(([, presentation]) => presentation.entry.target.label);
+    .map(([, presentation]) =>
+      environmentDisplayLabel(presentation.entry, presentation.serverConfig),
+    );
 
   const refresh = (afterPending: boolean) =>
     Promise.all(
diff --git a/apps/mobile/src/state/environments.ts b/apps/mobile/src/state/environments.ts
index a1295496dce5e..6a5bef2ec9053 100644
--- a/apps/mobile/src/state/environments.ts
+++ b/apps/mobile/src/state/environments.ts
@@ -1,6 +1,7 @@
 import { useAtomValue } from "@effect/atom-react";
 import {
   connectionCatalogDisplayUrl,
+  environmentDisplayLabel,
   hasRelayRoute,
   type EnvironmentPresentation as BaseEnvironmentPresentation,
 } from "@t3tools/client-runtime/connection";
@@ -24,7 +25,7 @@ export function projectEnvironmentPresentation(
   return {
     ...presentation,
     environmentId,
-    label: presentation.entry.target.label,
+    label: environmentDisplayLabel(presentation.entry, presentation.serverConfig),
     displayUrl: connectionCatalogDisplayUrl(presentation.entry),
     relayManaged: hasRelayRoute(presentation.entry),
   };
diff --git a/apps/mobile/src/state/presentation.ts b/apps/mobile/src/state/presentation.ts
index 68b2d278cd95b..024d886161055 100644
--- a/apps/mobile/src/state/presentation.ts
+++ b/apps/mobile/src/state/presentation.ts
@@ -10,11 +10,13 @@ import { Atom } from "effect/reactivity";
 import { environmentCatalog } from "../connection/catalog";
 import { environmentServerConfigsAtom, serverEnvironment } from "./server";
 import { createThreadListEnvironmentsAtom } from "./thread-list-environments";
+import { relayEnvironmentDiscovery } from "./relay";
 
 export const environmentPresentations = createEnvironmentPresentationAtoms({
   catalogValueAtom: environmentCatalog.catalogValueAtom,
   stateAtom: environmentCatalog.stateAtom,
   serverConfigValueAtom: serverEnvironment.configValueAtom,
+  relayDiscoveryValueAtom: relayEnvironmentDiscovery.stateValueAtom,
 });
 
 export const { connectedEnvironmentIdsAtom } = createEnvironmentSummaryAtoms({
diff --git a/apps/mobile/src/state/remote-environment-projections.test.ts b/apps/mobile/src/state/remote-environment-projections.test.ts
index 92fbd512e15b1..646a728b203cd 100644
--- a/apps/mobile/src/state/remote-environment-projections.test.ts
+++ b/apps/mobile/src/state/remote-environment-projections.test.ts
@@ -2,7 +2,11 @@ import type {
   EnvironmentPresentation,
   PreparedConnection,
 } from "@t3tools/client-runtime/connection";
-import { PrimaryConnectionTarget } from "@t3tools/client-runtime/connection";
+import {
+  PrimaryConnectionTarget,
+  RelayConnectionTarget,
+  BearerConnectionTarget,
+} from "@t3tools/client-runtime/connection";
 import type { ServerConfig } from "@t3tools/contracts";
 import { EnvironmentId } from "@t3tools/contracts";
 import { describe, expect, it } from "@effect/vitest";
@@ -76,6 +80,56 @@ function makeHarness() {
 }
 
 describe("remote environment projections", () => {
+  it("updates a Connect label live while keeping manual aliases and credentials stable", () => {
+    const harness = makeHarness();
+    const relay = presentation(ENVIRONMENT_ID);
+    const manual = presentation(OTHER_ENVIRONMENT_ID);
+    const relayPresentation = {
+      ...relay,
+      entry: {
+        ...relay.entry,
+        target: new RelayConnectionTarget({ environmentId: ENVIRONMENT_ID, label: "Catalog host" }),
+      },
+    };
+    const manualPresentation = {
+      ...manual,
+      entry: {
+        ...manual.entry,
+        target: new BearerConnectionTarget({
+          environmentId: OTHER_ENVIRONMENT_ID,
+          label: "My alias",
+          connectionId: "manual",
+        }),
+      },
+    };
+    harness.registry.set(harness.presentationAtom(ENVIRONMENT_ID), relayPresentation);
+    harness.registry.set(harness.presentationAtom(OTHER_ENVIRONMENT_ID), manualPresentation);
+    harness.registry.set(
+      harness.preparedConnectionAtom(ENVIRONMENT_ID),
+      Option.some(prepared(ENVIRONMENT_ID, "direct-fallback", "test-token")),
+    );
+    const relayAtom = harness.projections.savedConnectionAtom(ENVIRONMENT_ID);
+    const manualAtom = harness.projections.savedConnectionAtom(OTHER_ENVIRONMENT_ID);
+    const manualBefore = harness.registry.get(manualAtom);
+    const routeBefore = harness.registry.get(relayAtom);
+    for (const label of ["Studio Mac", "Detected Mac"]) {
+      const config = { environment: { label } } as ServerConfig;
+      harness.registry.set(harness.presentationAtom(ENVIRONMENT_ID), {
+        ...relayPresentation,
+        serverConfig: config,
+      });
+      harness.registry.set(harness.presentationAtom(OTHER_ENVIRONMENT_ID), {
+        ...manualPresentation,
+        serverConfig: config,
+      });
+      expect(harness.registry.get(relayAtom)?.environmentLabel).toBe(label);
+      expect(harness.registry.get(relayAtom)?.bearerToken).toBe(routeBefore?.bearerToken);
+      expect(harness.registry.get(relayAtom)?.httpBaseUrl).toBe(routeBefore?.httpBaseUrl);
+      expect(harness.registry.get(manualAtom)).toBe(manualBefore);
+      expect(harness.registry.get(manualAtom)?.environmentLabel).toBe("My alias");
+    }
+    harness.registry.dispose();
+  });
   it("shares each environment projection and invalidates only changed inputs", () => {
     const harness = makeHarness();
     const firstConsumer = Atom.make((get) =>
diff --git a/apps/mobile/src/state/remote-environment-projections.ts b/apps/mobile/src/state/remote-environment-projections.ts
index c70acce6d932f..4f7293be1a571 100644
--- a/apps/mobile/src/state/remote-environment-projections.ts
+++ b/apps/mobile/src/state/remote-environment-projections.ts
@@ -2,7 +2,10 @@ import type {
   EnvironmentPresentation,
   PreparedConnection,
 } from "@t3tools/client-runtime/connection";
-import { connectionCatalogDisplayUrl } from "@t3tools/client-runtime/connection";
+import {
+  connectionCatalogDisplayUrl,
+  environmentDisplayLabel,
+} from "@t3tools/client-runtime/connection";
 import type { EnvironmentId, ServerConfig } from "@t3tools/contracts";
 import * as Option from "effect/Option";
 import { Atom } from "effect/reactivity";
@@ -34,10 +37,15 @@ export function createRemoteEnvironmentProjectionAtoms(input: {
       }
 
       const prepared = Option.getOrNull(get(input.preparedConnectionAtom(environmentId)));
+      const environmentLabel = environmentDisplayLabel(
+        presentation.entry,
+        presentation.serverConfig,
+      );
       if (
         previous !== null &&
         presentation.entry === previousEntry &&
-        prepared === previousPrepared
+        prepared === previousPrepared &&
+        environmentLabel === previous.environmentLabel
       ) {
         return previous;
       }
@@ -61,7 +69,7 @@ export function createRemoteEnvironmentProjectionAtoms(input: {
       previousPrepared = prepared;
       previous = {
         environmentId,
-        environmentLabel: presentation.entry.target.label,
+        environmentLabel,
         pairingUrl: displayUrl,
         displayUrl,
         httpBaseUrl,
diff --git a/apps/mobile/src/state/usage.ts b/apps/mobile/src/state/usage.ts
index 9851b841c88c5..6b4719ca53ec8 100644
--- a/apps/mobile/src/state/usage.ts
+++ b/apps/mobile/src/state/usage.ts
@@ -1,4 +1,5 @@
 import { useAtomValue } from "@effect/atom-react";
+import { environmentDisplayLabel } from "@t3tools/client-runtime/connection";
 import {
   AuthDiagnosticsReadScope,
   USAGE_CONTRACT_VERSION,
@@ -44,7 +45,7 @@ const usageByWindowAtom = Atom.family((windowKey: string) =>
       if (!access.canReadDiagnostics) {
         statuses.push({
           environmentId,
-          label: presentation.entry.target.label,
+          label: environmentDisplayLabel(presentation.entry, presentation.serverConfig),
           isConnected: presentation.connection.phase === "connected",
           ...access,
           summary: null,
@@ -56,7 +57,7 @@ const usageByWindowAtom = Atom.family((windowKey: string) =>
       const summary = AsyncResult.getOrElse(result, () => null);
       statuses.push({
         environmentId,
-        label: presentation.entry.target.label,
+        label: environmentDisplayLabel(presentation.entry, presentation.serverConfig),
         isPending: result.waiting,
         isConnected: presentation.connection.phase === "connected",
         canReadDiagnostics: true,
diff --git a/apps/mobile/src/state/workspace-connection-atoms.test.ts b/apps/mobile/src/state/workspace-connection-atoms.test.ts
index 9593e6b69b46c..de65e30368680 100644
--- a/apps/mobile/src/state/workspace-connection-atoms.test.ts
+++ b/apps/mobile/src/state/workspace-connection-atoms.test.ts
@@ -82,7 +82,16 @@ describe("workspace connection subscriptions", () => {
       expect(broadChanges).toBe(20);
       expect(connectionChanges).toBe(0);
       for (let index = 0; index < 4; index++) {
-        const config = { cwd: `/workspace-${index}` } as ServerConfig;
+        const config = {
+          cwd: `/workspace-${index}`,
+          environment: {
+            environmentId: ID,
+            label: "Mac",
+            platform: { os: "darwin", arch: "arm64" },
+            serverVersion: "0.0.0-test",
+            capabilities: { repositoryIdentity: true },
+          },
+        } as ServerConfig;
         h.registry.set(h.source, { ...presentation(), serverConfig: config });
         expect(h.registry.get(h.source)?.serverConfig).toBe(config);
         expect(h.registry.get(h.stateAtom)).toBe(initial);
diff --git a/apps/server/src/auth/RpcAuthorization.test.ts b/apps/server/src/auth/RpcAuthorization.test.ts
index 8044740a7e2ee..ff9ac724a3053 100644
--- a/apps/server/src/auth/RpcAuthorization.test.ts
+++ b/apps/server/src/auth/RpcAuthorization.test.ts
@@ -19,6 +19,7 @@ import {
 } from "@t3tools/contracts";
 import { describe, expect, it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
+import * as Duration from "effect/Duration";
 import * as Layer from "effect/Layer";
 import * as Stream from "effect/Stream";
 import * as RpcTest from "effect/rpc/RpcTest";
@@ -147,6 +148,56 @@ describe("settings mutation authorization", () => {
     instanceId: ProviderInstanceId.make("codex_work"),
   };
 
+  it.effect("allows a remote host rename only with settings permission", () =>
+    Effect.gen(function* () {
+      const renamed: Array<string | undefined> = [];
+      const handlers = group.toLayerHandler(WS_METHODS.serverUpdateSettings, (input) =>
+        Effect.sync(() => {
+          renamed.push(input.patch.environmentLabel);
+          return DEFAULT_SERVER_SETTINGS;
+        }),
+      );
+      const denied = yield* RpcTest.makeClient(group).pipe(
+        Effect.provide(
+          Layer.mergeAll(handlers, RpcAuthorization.layer([AuthProvidersManageScope])),
+        ),
+      );
+      expect(
+        yield* denied[WS_METHODS.serverUpdateSettings]({
+          patch: { environmentLabel: "Studio Mac" },
+        }).pipe(Effect.flip),
+      ).toMatchObject({ requiredPermission: AuthSettingsWriteScope });
+      expect(renamed).toEqual([]);
+      const allowed = yield* RpcTest.makeClient(group).pipe(
+        Effect.provide(Layer.mergeAll(handlers, RpcAuthorization.layer([AuthSettingsWriteScope]))),
+      );
+      yield* allowed[WS_METHODS.serverUpdateSettings]({
+        patch: { environmentLabel: "Studio Mac" },
+      });
+      yield* allowed[WS_METHODS.serverUpdateSettings]({ patch: { environmentLabel: "" } });
+      expect(renamed).toEqual(["Studio Mac", ""]);
+    }).pipe(Effect.scoped),
+  );
+
+  it.effect("authorizes decoded duration settings without decoding them as wire numbers", () =>
+    Effect.gen(function* () {
+      const received: Array<number> = [];
+      const handlers = group.toLayerHandler(WS_METHODS.serverUpdateSettings, (input) =>
+        Effect.sync(() => {
+          received.push(Duration.toMillis(input.patch.automaticGitFetchInterval!));
+          return DEFAULT_SERVER_SETTINGS;
+        }),
+      );
+      const client = yield* RpcTest.makeClient(group).pipe(
+        Effect.provide(Layer.mergeAll(handlers, RpcAuthorization.layer([AuthSettingsWriteScope]))),
+      );
+      yield* client[WS_METHODS.serverUpdateSettings]({
+        patch: { automaticGitFetchInterval: Duration.seconds(30) },
+      });
+      expect(received).toEqual([30_000]);
+    }).pipe(Effect.scoped),
+  );
+
   it.effect("allows provider-only mutations while denying mixed settings without their grant", () =>
     Effect.gen(function* () {
       let handled = 0;
diff --git a/apps/server/src/auth/RpcAuthorization.ts b/apps/server/src/auth/RpcAuthorization.ts
index 6049121b41a5d..cb2c5dfab1f51 100644
--- a/apps/server/src/auth/RpcAuthorization.ts
+++ b/apps/server/src/auth/RpcAuthorization.ts
@@ -5,9 +5,6 @@ import {
   authScopeRequiredResponse,
   AssetCreateUrlInput,
   AuthAccessReadScope,
-  ServerSettingsPatch,
-  ProviderInstanceMutation,
-  requiredScopesForServerSettingsPatch,
   requiredScopesForProjectMutation,
   ProjectMutation,
   AuthSettingsWriteScope,
@@ -227,22 +224,6 @@ export const rpcAuthorizationError = (requiredScope: AuthEnvironmentScope) =>
     ...authScopeRequiredResponse(requiredScope),
   });
 
-const SettingsUpdate = Schema.Struct({
-  patch: ServerSettingsPatch,
-  providerInstanceMutation: Schema.optionalKey(ProviderInstanceMutation),
-});
-// Middleware receives the payload already decoded, so it is checked against the decoded shape.
-const decodeSettingsUpdate = Schema.decodeUnknownSync(Schema.toType(SettingsUpdate));
-
-const requiredScopesForSettingsUpdate = (payload: unknown) => {
-  const input = decodeSettingsUpdate(payload);
-  const scopes = requiredScopesForServerSettingsPatch(input.patch);
-  if (input.providerInstanceMutation === undefined) return scopes;
-  return Object.values(input.patch).every((value) => value === undefined)
-    ? [AuthProvidersManageScope]
-    : [...new Set([...scopes, AuthProvidersManageScope])];
-};
-
 const decodeProjectMutation = Schema.decodeUnknownSync(ProjectMutation);
 const decodeAssetCreateUrlInput = Schema.decodeUnknownSync(AssetCreateUrlInput);
 
@@ -263,7 +244,6 @@ const requiredScopesForRpcCall = (
         : AuthOrchestrationReadScope,
     ];
   }
-  if (method === WS_METHODS.serverUpdateSettings) return requiredScopesForSettingsUpdate(payload);
   if (method === WS_METHODS.projectsMutate) {
     return requiredScopesForProjectMutation(decodeProjectMutation(payload));
   }
diff --git a/apps/server/src/cloud/CloudLink.lifecycle.test.ts b/apps/server/src/cloud/CloudLink.lifecycle.test.ts
index facd9f8912e53..83d438f864424 100644
--- a/apps/server/src/cloud/CloudLink.lifecycle.test.ts
+++ b/apps/server/src/cloud/CloudLink.lifecycle.test.ts
@@ -177,6 +177,7 @@ describe("releaseManagedTunnelOnShutdown", () => {
           ServerEnvironment.ServerEnvironment.of({
             getEnvironmentId: Effect.succeed(EnvironmentId.make("env_123")),
             getDescriptor: Effect.die("unused"),
+            getDescriptorForSettings: () => Effect.die("unused"),
           }),
         ),
         Effect.provideService(
diff --git a/apps/server/src/device/DeviceService.test.ts b/apps/server/src/device/DeviceService.test.ts
index 9b680280d3298..ea0719b45e101 100644
--- a/apps/server/src/device/DeviceService.test.ts
+++ b/apps/server/src/device/DeviceService.test.ts
@@ -294,6 +294,9 @@ const fixture = Effect.fn("fixture")(function* (
         start: Effect.void,
         ready: Effect.void,
         getSettings: Ref.get(settings),
+        getEnvironmentLabel: Ref.get(settings).pipe(
+          Effect.map((current) => current.environmentLabel),
+        ),
         updateSettings: (patch) =>
           Ref.updateAndGet(settings, (current) => ({
             ...current,
diff --git a/apps/server/src/environment/ServerEnvironment.test.ts b/apps/server/src/environment/ServerEnvironment.test.ts
index 7cebccb2a1f7c..0326c3d28d8d8 100644
--- a/apps/server/src/environment/ServerEnvironment.test.ts
+++ b/apps/server/src/environment/ServerEnvironment.test.ts
@@ -1,5 +1,5 @@
 import * as NodeServices from "@effect/platform-node/NodeServices";
-import { ORCHESTRATION_PROTOCOL_VERSION } from "@t3tools/contracts";
+import { ORCHESTRATION_PROTOCOL_VERSION, ServerSettingsError } from "@t3tools/contracts";
 import { expect, it } from "@effect/vitest";
 import * as Crypto from "effect/Crypto";
 import * as Deferred from "effect/Deferred";
@@ -18,10 +18,12 @@ import {
   RELAY_URL_SECRET,
 } from "../cloud/config.ts";
 import * as ServerConfig from "../config.ts";
+import * as ServerSettings from "../serverSettings.ts";
 import * as ServerEnvironment from "./ServerEnvironment.ts";
 
 const layerServerEnvironment = (baseDir: string) =>
   ServerEnvironment.layer.pipe(
+    Layer.provideMerge(ServerSettings.layerTest()),
     Layer.provide(ServerSecretStore.layer),
     Layer.provide(ServerConfig.layerTest(process.cwd(), baseDir)),
   );
@@ -97,6 +99,7 @@ it.layer(NodeServices.layer)("ServerEnvironmentLive", (it) => {
         }).pipe(
           Effect.provide(
             ServerEnvironment.layer.pipe(
+              Layer.provide(ServerSettings.layerTest()),
               Layer.provide(layerEmptySecretStore),
               Layer.provide(ServerConfig.layer({ ...config, mode })),
             ),
@@ -235,7 +238,10 @@ it.layer(NodeServices.layer)("ServerEnvironmentLive", (it) => {
         prefix: "t3-server-environment-publish-test-",
       });
       const layerTest = Layer.mergeAll(
-        ServerEnvironment.layer.pipe(Layer.provide(ServerSecretStore.layer)),
+        ServerEnvironment.layer.pipe(
+          Layer.provide(ServerSettings.layerTest()),
+          Layer.provide(ServerSecretStore.layer),
+        ),
         ServerSecretStore.layer,
       ).pipe(Layer.provide(ServerConfig.layerTest(process.cwd(), baseDir)));
 
@@ -259,6 +265,11 @@ it.layer(NodeServices.layer)("ServerEnvironmentLive", (it) => {
         yield* secrets.set(RELAY_URL_SECRET, encode("https://relay.example"));
         const linked = yield* serverEnvironment.getDescriptor;
         expect(linked.capabilities.agentActivityPublishing).toBe(true);
+        const snapshot = yield* serverEnvironment.getDescriptorForSettings({
+          environmentLabel: "Studio Mac",
+        });
+        expect(snapshot.label).toBe("Studio Mac");
+        expect(snapshot.capabilities).toEqual(linked.capabilities);
 
         yield* secrets.set(PUBLISH_AGENT_ACTIVITY_SECRET, encode("false"));
         const disabled = yield* serverEnvironment.getDescriptor;
@@ -266,4 +277,67 @@ it.layer(NodeServices.layer)("ServerEnvironmentLive", (it) => {
       }).pipe(Effect.provide(layerTest));
     }),
   );
+
+  it.effect("retains the configured host name when provider settings cannot materialize", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const baseDir = yield* fs.makeTempDirectoryScoped();
+      const settings = Layer.effect(
+        ServerSettings.ServerSettingsService,
+        Effect.gen(function* () {
+          const current = yield* ServerSettings.ServerSettingsService;
+          return {
+            ...current,
+            getSettings: Effect.fail(
+              new ServerSettingsError({
+                settingsPath: "test settings",
+                operation: "read-secret",
+                cause: new Error("Provider secret unavailable"),
+              }),
+            ),
+          };
+        }),
+      ).pipe(Layer.provide(ServerSettings.layerTest({ environmentLabel: "Studio Mac" })));
+      const descriptor = yield* ServerEnvironment.ServerEnvironment.use(
+        (environment) => environment.getDescriptor,
+      ).pipe(
+        Effect.provide(
+          ServerEnvironment.layer.pipe(
+            Layer.provide(settings),
+            Layer.provide(layerEmptySecretStore),
+            Layer.provide(ServerConfig.layerTest(process.cwd(), baseDir)),
+          ),
+        ),
+      );
+      expect(descriptor.label).toBe("Studio Mac");
+    }),
+  );
+
+  it.effect("applies configured environment label updates without a restart", () =>
+    Effect.gen(function* () {
+      const fileSystem = yield* FileSystem.FileSystem;
+      const baseDir = yield* fileSystem.makeTempDirectoryScoped({
+        prefix: "t3-server-environment-label-test-",
+      });
+      yield* Effect.gen(function* () {
+        const serverEnvironment = yield* ServerEnvironment.ServerEnvironment;
+        const serverSettings = yield* ServerSettings.ServerSettingsService;
+        const initial = yield* serverEnvironment.getDescriptor;
+
+        yield* serverSettings.updateSettings({ environmentLabel: "Studio Mac" });
+        const renamed = yield* serverEnvironment.getDescriptor;
+        yield* serverSettings.updateSettings({ environmentLabel: "" });
+        const reset = yield* serverEnvironment.getDescriptor;
+        // A queued settings event must describe its own snapshot even after another write.
+        const previousSnapshot = yield* serverEnvironment.getDescriptorForSettings({
+          environmentLabel: "Studio Mac",
+        });
+
+        expect(previousSnapshot).toEqual(renamed);
+        expect(yield* serverEnvironment.getDescriptor).toEqual(initial);
+        expect(renamed).toEqual({ ...initial, label: "Studio Mac" });
+        expect(reset).toEqual(initial);
+      }).pipe(Effect.provide(layerServerEnvironment(baseDir)));
+    }),
+  );
 });
diff --git a/apps/server/src/environment/ServerEnvironment.ts b/apps/server/src/environment/ServerEnvironment.ts
index 72d7f0c2de7ef..7f3ca62a6ec25 100644
--- a/apps/server/src/environment/ServerEnvironment.ts
+++ b/apps/server/src/environment/ServerEnvironment.ts
@@ -22,6 +22,7 @@ import { resolveServiceLauncherMode } from "../cloud/serviceLauncherClient.ts";
 import * as ServerConfig from "../config.ts";
 import { databaseMigrationHead } from "../persistence/databaseMigrationHead.ts";
 import * as ProcessRunner from "../processRunner.ts";
+import * as ServerSettings from "../serverSettings.ts";
 import { resolveServerEnvironmentLabel } from "./ServerEnvironmentLabel.ts";
 import { detectServerEnvironmentMachineKind } from "./ServerEnvironmentMachine.ts";
 
@@ -46,6 +47,9 @@ export class ServerEnvironment extends Context.Service<
   {
     readonly getEnvironmentId: Effect.Effect<EnvironmentId>;
     readonly getDescriptor: Effect.Effect<ExecutionEnvironmentDescriptor>;
+    readonly getDescriptorForSettings: (settings: {
+      readonly environmentLabel: string;
+    }) => Effect.Effect<ExecutionEnvironmentDescriptor>;
   }
 >()("t3/environment/ServerEnvironment") {}
 
@@ -186,12 +190,13 @@ export const make = Effect.gen(function* () {
   const path = yield* Path.Path;
   const serverConfig = yield* ServerConfig.ServerConfig;
   const secrets = yield* ServerSecretStore.ServerSecretStore;
+  const serverSettings = yield* ServerSettings.ServerSettingsService;
   const identity = yield* ServerEnvironmentIdentity;
   const hostPlatform = yield* HostProcess.Platform;
   const hostArchitecture = yield* HostProcess.Architecture;
   const environmentId = yield* identity.getEnvironmentId;
   const cwdBaseName = path.basename(serverConfig.cwd).trim();
-  const label = yield* resolveServerEnvironmentLabel({ cwdBaseName });
+  const defaultLabel = yield* resolveServerEnvironmentLabel({ cwdBaseName });
   const machine = yield* detectServerEnvironmentMachineKind();
   const launcher = yield* resolveServiceLauncherMode();
   const serverSelfUpdate = resolveServerSelfUpdateCapability({
@@ -205,9 +210,9 @@ export const make = Effect.gen(function* () {
     serverSelfUpdate === "desktop-managed" && serverConfig.desktopTelemetryControlFd !== undefined;
 
   const databaseMigration = databaseMigrationHead(serverConfig.dbPath);
-  const descriptor: ExecutionEnvironmentDescriptor = {
+  const defaultDescriptor: ExecutionEnvironmentDescriptor = {
     environmentId,
-    label,
+    label: defaultLabel,
     platform: {
       os: platformOs(hostPlatform),
       arch: platformArch(hostArchitecture),
@@ -263,6 +268,7 @@ export const make = Effect.gen(function* () {
       threadStop: true,
       ...(hostPlatform === "win32" ? {} : { localServerStop: true }),
       environmentIcon: true,
+      environmentLabel: true,
       projectCloneTracking: true,
       projectOrganization: true,
       ignoredFileListing: true,
@@ -280,16 +286,24 @@ export const make = Effect.gen(function* () {
       linkFence: true,
     },
   };
+  // Relay publishing can change while the server is running; read it for every descriptor.
+  const getDescriptorForSettings = Effect.fn("ServerEnvironment.getDescriptorForSettings")(
+    (settings: { readonly environmentLabel: string }) =>
+      readAgentActivityPublishingActive(secrets).pipe(
+        Effect.map((agentActivityPublishing): ExecutionEnvironmentDescriptor => ({
+          ...defaultDescriptor,
+          label: settings.environmentLabel || defaultLabel,
+          capabilities: { ...defaultDescriptor.capabilities, agentActivityPublishing },
+        })),
+      ),
+  );
 
   return ServerEnvironment.of({
     getEnvironmentId: Effect.succeed(environmentId),
-    // Publishing opt-in and relay links change at runtime; read the capability per request.
-    getDescriptor: readAgentActivityPublishingActive(secrets).pipe(
-      Effect.map((agentActivityPublishing) => ({
-        ...descriptor,
-        capabilities: { ...descriptor.capabilities, agentActivityPublishing },
-      })),
+    getDescriptor: serverSettings.getEnvironmentLabel.pipe(
+      Effect.flatMap((environmentLabel) => getDescriptorForSettings({ environmentLabel })),
     ),
+    getDescriptorForSettings,
   });
 });
 
diff --git a/apps/server/src/mcp/McpSessionRegistry.test.ts b/apps/server/src/mcp/McpSessionRegistry.test.ts
index 282c3dffd6d64..cd215da792e61 100644
--- a/apps/server/src/mcp/McpSessionRegistry.test.ts
+++ b/apps/server/src/mcp/McpSessionRegistry.test.ts
@@ -18,6 +18,7 @@ const fakeHttpServer = makeFakeHttpServer("127.0.0.1");
 const fakeEnvironment = ServerEnvironment.ServerEnvironment.of({
   getEnvironmentId: Effect.succeed(environmentId),
   getDescriptor: Effect.die("unused"),
+  getDescriptorForSettings: () => Effect.die("unused"),
 });
 
 const makeRegistry = (now: () => number, httpServer = fakeHttpServer) =>
diff --git a/apps/server/src/orchestration-v2/ProviderSessionManager.test.ts b/apps/server/src/orchestration-v2/ProviderSessionManager.test.ts
index 5bbb3926e2b66..611fcad17dc79 100644
--- a/apps/server/src/orchestration-v2/ProviderSessionManager.test.ts
+++ b/apps/server/src/orchestration-v2/ProviderSessionManager.test.ts
@@ -588,6 +588,7 @@ const fakeHttpServer = HttpServer.HttpServer.of({
 const fakeEnvironment = ServerEnvironment.ServerEnvironment.of({
   getEnvironmentId: Effect.succeed(EnvironmentId.make("environment-provider-session-manager")),
   getDescriptor: Effect.die("unused"),
+  getDescriptorForSettings: () => Effect.die("unused"),
 });
 
 const layerTestMcpRegistry = Layer.effect(
diff --git a/apps/server/src/orchestration-v2/ThreadSettlementService.test.ts b/apps/server/src/orchestration-v2/ThreadSettlementService.test.ts
index e55d585c307db..bd7db6955a12d 100644
--- a/apps/server/src/orchestration-v2/ThreadSettlementService.test.ts
+++ b/apps/server/src/orchestration-v2/ThreadSettlementService.test.ts
@@ -644,6 +644,7 @@ const makeHarness = Effect.fn("makeThreadSettlementHarness")(function* (options:
     getSettings: Ref.update(settingsReadCount, (count) => count + 1).pipe(
       Effect.andThen(Ref.get(settings)),
     ),
+    getEnvironmentLabel: Ref.get(settings).pipe(Effect.map((current) => current.environmentLabel)),
     updateSettings,
     updateProviderInstance: () => Effect.die("Unexpected provider mutation"),
     withSettingsSnapshot: (use) => Ref.get(settings).pipe(Effect.flatMap(use)),
diff --git a/apps/server/src/peer/PeerLinks.testkit.ts b/apps/server/src/peer/PeerLinks.testkit.ts
index 0f7e39355b95d..6b514a908e41d 100644
--- a/apps/server/src/peer/PeerLinks.testkit.ts
+++ b/apps/server/src/peer/PeerLinks.testkit.ts
@@ -69,6 +69,13 @@ export const servePeer = <E, R>(
     const layerEnvironment = Layer.succeed(ServerEnvironment.ServerEnvironment, {
       getEnvironmentId: Ref.get(descriptor).pipe(Effect.map((current) => current.environmentId)),
       getDescriptor: Ref.get(descriptor),
+      getDescriptorForSettings: (settings) =>
+        Ref.get(descriptor).pipe(
+          Effect.map((current) => ({
+            ...current,
+            label: settings.environmentLabel || current.label,
+          })),
+        ),
     });
     const authContext = yield* EnvironmentAuth.layer.pipe(
       Layer.provideMerge(ServerSettings.layerTest({ linkedEnvironmentsEnabled: true })),
@@ -166,6 +173,8 @@ export const layerLinkingEnvironment = (
       Layer.succeed(ServerEnvironment.ServerEnvironment, {
         getEnvironmentId: Effect.succeed(descriptor.environmentId),
         getDescriptor: Effect.succeed(descriptor),
+        getDescriptorForSettings: (settings) =>
+          Effect.succeed({ ...descriptor, label: settings.environmentLabel || descriptor.label }),
       }),
     ),
     Layer.provide(ServerConfig.layerTest(process.cwd(), { prefix: "t3-peer-link-here-" })),
diff --git a/apps/server/src/preview/ServerBrowser.test.ts b/apps/server/src/preview/ServerBrowser.test.ts
index 4b21b6f3421da..422256a42b045 100644
--- a/apps/server/src/preview/ServerBrowser.test.ts
+++ b/apps/server/src/preview/ServerBrowser.test.ts
@@ -339,6 +339,7 @@ const dependencies = Layer.mergeAll(
   Layer.succeed(ServerEnvironment.ServerEnvironment, {
     getEnvironmentId: Effect.succeed(scope.environmentId),
     getDescriptor: Effect.die("unused descriptor"),
+    getDescriptorForSettings: () => Effect.die("unused descriptor"),
   }),
   Layer.succeed(PreviewBrowser.PreviewBrowser, {
     executable: Effect.die("mock Chromium does not need an executable"),
diff --git a/apps/server/src/provider/ProviderRegistry.test.ts b/apps/server/src/provider/ProviderRegistry.test.ts
index 5e1bc9e962b5f..a2717033dfbf2 100644
--- a/apps/server/src/provider/ProviderRegistry.test.ts
+++ b/apps/server/src/provider/ProviderRegistry.test.ts
@@ -282,6 +282,9 @@ function makeMutableServerSettingsService(
       start: Effect.void,
       ready: Effect.void,
       getSettings: Ref.get(settingsRef),
+      getEnvironmentLabel: Ref.get(settingsRef).pipe(
+        Effect.map((settings) => settings.environmentLabel),
+      ),
       updateSettings: (patch) =>
         Effect.gen(function* () {
           const current = yield* Ref.get(settingsRef);
diff --git a/apps/server/src/relay/AgentAwarenessRelay.test.ts b/apps/server/src/relay/AgentAwarenessRelay.test.ts
index 4bbaa85fc3b16..9c5b22b64a002 100644
--- a/apps/server/src/relay/AgentAwarenessRelay.test.ts
+++ b/apps/server/src/relay/AgentAwarenessRelay.test.ts
@@ -263,6 +263,7 @@ const makeTestRelay = Effect.fnUntraced(function* (
     Effect.provideService(ServerEnvironment.ServerEnvironment, {
       getEnvironmentId: Effect.succeed(EnvironmentId.make("relay-environment")),
       getDescriptor: unused(),
+      getDescriptorForSettings: unused,
     }),
     Effect.provideService(ProjectService.ProjectService, {
       create: unused,
diff --git a/apps/server/src/relay/EnvironmentLabelRelaySync.test.ts b/apps/server/src/relay/EnvironmentLabelRelaySync.test.ts
new file mode 100644
index 0000000000000..f1ea75f9d038d
--- /dev/null
+++ b/apps/server/src/relay/EnvironmentLabelRelaySync.test.ts
@@ -0,0 +1,122 @@
+import { EnvironmentId, type ServerSettings } from "@t3tools/contracts";
+import { assert, it } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as PubSub from "effect/PubSub";
+import * as Queue from "effect/Queue";
+import * as Stream from "effect/Stream";
+import * as TestClock from "effect/testing/TestClock";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+
+import * as ServerSecretStore from "../auth/ServerSecretStore.ts";
+import { RELAY_ENVIRONMENT_CREDENTIAL_SECRET, RELAY_URL_SECRET } from "../cloud/config.ts";
+import * as ServerEnvironment from "../environment/ServerEnvironment.ts";
+import * as ServerSettingsService from "../serverSettings.ts";
+import * as EnvironmentLabelRelaySync from "./EnvironmentLabelRelaySync.ts";
+
+const settingsWith = (environmentLabel: string, enableProviderUpdateChecks = true) =>
+  ({ environmentLabel, enableProviderUpdateChecks }) as ServerSettings;
+
+it.effect("sends the current host name at startup and only changed names thereafter", () =>
+  Effect.gen(function* () {
+    const changes = yield* PubSub.unbounded<ServerSettings>();
+    const pushed = yield* Queue.unbounded<{ readonly url: string; readonly body: unknown }>();
+    const failedAttempts = yield* Queue.unbounded<void>();
+    const unlinkedReads = yield* Queue.unbounded<void>();
+    let remainingFailures = 0;
+    const fetch: typeof globalThis.fetch = Object.assign(
+      (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => {
+        if (remainingFailures > 0) {
+          remainingFailures -= 1;
+          Queue.offerUnsafe(failedAttempts, undefined);
+          return Promise.reject(new Error("Relay unavailable"));
+        }
+        Queue.offerUnsafe(pushed, {
+          url: String(input instanceof Request ? input.url : input),
+          body: JSON.parse(String(init?.body)),
+        });
+        return Promise.resolve(Response.json({ ok: true }));
+      },
+      { preconnect: () => {} },
+    );
+    const stored = new Map([
+      [RELAY_URL_SECRET, new TextEncoder().encode("https://relay.test")],
+      [RELAY_ENVIRONMENT_CREDENTIAL_SECRET, new TextEncoder().encode("credential")],
+    ]);
+    const layerDependencies = Layer.mergeAll(
+      Layer.mock(ServerSecretStore.ServerSecretStore)({
+        get: (name) =>
+          Effect.sync(() => {
+            const value = stored.get(name);
+            if (name === RELAY_ENVIRONMENT_CREDENTIAL_SECRET && value === undefined) {
+              Queue.offerUnsafe(unlinkedReads, undefined);
+            }
+            return Option.fromNullishOr(value);
+          }),
+      }),
+      Layer.mock(ServerEnvironment.ServerEnvironment)({
+        getDescriptorForSettings: ({ environmentLabel }) =>
+          Effect.succeed({
+            environmentId: EnvironmentId.make("environment-1"),
+            label: environmentLabel || "Detected Mac",
+          } as never),
+      }),
+      Layer.mock(ServerSettingsService.ServerSettingsService)({
+        getEnvironmentLabel: Effect.succeed("Saved Mac"),
+        subscribeChanges: PubSub.subscribe(changes).pipe(Effect.map(Stream.fromSubscription)),
+      }),
+    );
+    yield* Layer.build(EnvironmentLabelRelaySync.layer.pipe(Layer.provide(layerDependencies))).pipe(
+      Effect.provideService(FetchHttpClient.Fetch, fetch),
+    );
+
+    yield* PubSub.publish(changes, settingsWith("Saved Mac", false));
+    yield* PubSub.publish(changes, settingsWith("Studio Mac"));
+    const initial = yield* Queue.take(pushed);
+    assert.equal(initial.url, "https://relay.test/v1/environments/environment-1/label");
+    assert.deepEqual(initial.body, { label: "Saved Mac" });
+    const renamed = yield* Queue.take(pushed);
+    assert.equal(renamed.url, "https://relay.test/v1/environments/environment-1/label");
+    assert.deepEqual(renamed.body, { label: "Studio Mac" });
+
+    // An unrelated setting does not resend the name; clearing it sends the detected one.
+    yield* PubSub.publish(changes, settingsWith("Studio Mac", false));
+    yield* PubSub.publish(changes, settingsWith("", false));
+    assert.deepEqual((yield* Queue.take(pushed)).body, { label: "Detected Mac" });
+
+    const exhaustPush = Effect.fn("RelayLabelTest.exhaustPush")(function* (label: string) {
+      remainingFailures = 4;
+      yield* PubSub.publish(changes, settingsWith(label));
+      yield* Queue.take(failedAttempts);
+      for (const delay of ["2 seconds", "4 seconds", "8 seconds"] as const) {
+        yield* TestClock.adjust(delay);
+        yield* Queue.take(failedAttempts);
+      }
+    });
+    yield* exhaustPush("Retry Mac");
+    yield* PubSub.publish(changes, settingsWith("Retry Mac", false));
+    yield* PubSub.publish(changes, settingsWith("Retry Mac", true));
+    yield* PubSub.publish(changes, settingsWith("After Retry"));
+    assert.deepEqual((yield* Queue.take(pushed)).body, { label: "Retry Mac" });
+    assert.deepEqual((yield* Queue.take(pushed)).body, { label: "After Retry" });
+
+    yield* exhaustPush("Unconfirmed name");
+    yield* PubSub.publish(changes, settingsWith("After Retry"));
+    yield* PubSub.publish(changes, settingsWith("Recovered"));
+    assert.deepEqual((yield* Queue.take(pushed)).body, { label: "After Retry" });
+    assert.deepEqual((yield* Queue.take(pushed)).body, { label: "Recovered" });
+
+    stored.delete(RELAY_ENVIRONMENT_CREDENTIAL_SECRET);
+    yield* PubSub.publish(changes, settingsWith("Unlinked name"));
+    yield* Queue.take(unlinkedReads);
+    stored.set(
+      RELAY_ENVIRONMENT_CREDENTIAL_SECRET,
+      new TextEncoder().encode("relinked-credential"),
+    );
+    yield* PubSub.publish(changes, settingsWith("Recovered"));
+    yield* PubSub.publish(changes, settingsWith("Relinked"));
+    assert.deepEqual((yield* Queue.take(pushed)).body, { label: "Recovered" });
+    assert.deepEqual((yield* Queue.take(pushed)).body, { label: "Relinked" });
+  }).pipe(Effect.scoped),
+);
diff --git a/apps/server/src/relay/EnvironmentLabelRelaySync.ts b/apps/server/src/relay/EnvironmentLabelRelaySync.ts
new file mode 100644
index 0000000000000..515e40a65aa4d
--- /dev/null
+++ b/apps/server/src/relay/EnvironmentLabelRelaySync.ts
@@ -0,0 +1,58 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Ref from "effect/Ref";
+import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
+
+import { readRelayConnection } from "../cloud/config.ts";
+import * as ServerEnvironment from "../environment/ServerEnvironment.ts";
+import * as ServerSettings from "../serverSettings.ts";
+import { makeRelayEnvironmentClient } from "./relayEnvironmentClient.ts";
+
+const pushEnvironmentLabel = Effect.fn("EnvironmentLabelRelaySync.push")(function* (
+  environmentLabel: string,
+) {
+  const connection = yield* readRelayConnection;
+  if (connection === null) return false;
+  const environment = yield* ServerEnvironment.ServerEnvironment;
+  const descriptor = yield* environment.getDescriptorForSettings({ environmentLabel });
+  const client = yield* makeRelayEnvironmentClient(connection);
+  yield* client.server.updateEnvironmentLabel({
+    params: { environmentId: descriptor.environmentId },
+    payload: { label: descriptor.label },
+  });
+  return true;
+});
+
+/**
+ * Pushes the current host name to T3 Connect at startup and when it changes.
+ * Managed tunnel status checks also correct lost pushes.
+ * Pushes run one at a time so an older name cannot land after a newer one.
+ */
+export const layer = Layer.effectDiscard(
+  Effect.gen(function* () {
+    const settings = yield* ServerSettings.ServerSettingsService;
+    const changes = yield* settings.subscribeChanges;
+    const initial = yield* settings.getEnvironmentLabel;
+    const lastPushedLabel = yield* Ref.make<string | null>(null);
+    const push = Effect.fn("EnvironmentLabelRelaySync.sync")(function* (environmentLabel: string) {
+      if ((yield* Ref.get(lastPushedLabel)) === environmentLabel) return;
+      yield* pushEnvironmentLabel(environmentLabel).pipe(
+        Effect.timeout("10 seconds"),
+        Effect.retry({ schedule: Schedule.exponential("2 seconds"), times: 3 }),
+        Effect.tap((sent) => Ref.set(lastPushedLabel, sent ? environmentLabel : null)),
+        Effect.catchCause((cause) =>
+          Ref.set(lastPushedLabel, null).pipe(
+            Effect.andThen(
+              Effect.logWarning("Could not send the host name to T3 Connect", { cause }),
+            ),
+          ),
+        ),
+      );
+    });
+    yield* Stream.concat(
+      Stream.make(initial),
+      changes.pipe(Stream.map((next) => next.environmentLabel)),
+    ).pipe(Stream.runForEach(push), Effect.forkScoped);
+  }),
+);
diff --git a/apps/server/src/server.ts b/apps/server/src/server.ts
index 452addfb4a667..05d81c228263e 100644
--- a/apps/server/src/server.ts
+++ b/apps/server/src/server.ts
@@ -136,6 +136,7 @@ import * as ServerSecretStore from "./auth/ServerSecretStore.ts";
 import * as CodexManagedTokenBroker from "./provider/CodexManagedTokenBroker.ts";
 import * as WebhookRoute from "./scheduledTasks/webhookRoute.ts";
 import * as RelayDeliveryProof from "./scheduledTasks/RelayDeliveryProof.ts";
+import * as EnvironmentLabelRelaySync from "./relay/EnvironmentLabelRelaySync.ts";
 import * as HeldHooksWaker from "./relay/HeldHooksWaker.ts";
 import * as McpOAuth from "./auth/McpOAuth.ts";
 import * as McpOAuthHttp from "./auth/mcpOAuthHttp.ts";
@@ -479,7 +480,10 @@ const layerProjectFaviconResolver = ProjectFaviconResolver.layer.pipe(
   Layer.provide(T3ProjectFileLoader.layer),
 );
 
-const layerServerEnvironment = ServerEnvironment.layer.pipe(Layer.provide(ServerSecretStore.layer));
+const layerServerEnvironment = ServerEnvironment.layer.pipe(
+  Layer.provide(layerServerSettings),
+  Layer.provide(ServerSecretStore.layer),
+);
 
 const layerAuth = EnvironmentAuth.layer.pipe(
   Layer.provideMerge(layerPersistence),
@@ -584,6 +588,7 @@ const layerProviderInstallationRefresh = Layer.effectDiscard(
 const layerRuntimeCoreDependenciesBase = Layer.mergeAll(
   AgentAwarenessRelay.layer,
   HeldHooksWaker.layer,
+  EnvironmentLabelRelaySync.layer,
   layerThreadSettlementWorker,
   layerIdleCompactionWorker,
   StorageCleanup.layer.pipe(Layer.provide(ProjectionStoreV2.layer)),
@@ -1093,11 +1098,7 @@ const layerMakeServer = Layer.unwrap(
     return layerServerApplication.pipe(
       Layer.provide(CloudLink.layer.pipe(Layer.provideMerge(ConnectReachability.layer))),
       Layer.provideMerge(layerRuntimeServices),
-      Layer.provideMerge(
-        McpSessionRegistry.layer.pipe(
-          Layer.provide(ServerEnvironment.layer.pipe(Layer.provide(ServerSecretStore.layer))),
-        ),
-      ),
+      Layer.provideMerge(McpSessionRegistry.layer.pipe(Layer.provide(layerServerEnvironment))),
       Layer.provide(layerActivation),
       Layer.provideMerge(RelayTracing.layerServerRelayBroker),
       Layer.provideMerge(layerHttpServer),
diff --git a/apps/server/src/serverSettings.test.ts b/apps/server/src/serverSettings.test.ts
index ef8b4d6afae79..2be72c628bd96 100644
--- a/apps/server/src/serverSettings.test.ts
+++ b/apps/server/src/serverSettings.test.ts
@@ -24,6 +24,7 @@ import * as Path from "effect/Path";
 import * as PlatformError from "effect/PlatformError";
 import * as Schema from "effect/Schema";
 import * as Stream from "effect/Stream";
+import * as TestClock from "effect/testing/TestClock";
 import * as SqlClient from "effect/sql/SqlClient";
 import * as ServerSecretStore from "./auth/ServerSecretStore.ts";
 import { sourceControlHostSecretName } from "./sourceControl/sourceControlHostSecrets.ts";
@@ -97,6 +98,155 @@ const recordProviderUsage = (provider: string, instanceId: string | null = provi
   });
 
 it.layer(NodeServices.layer)("server settings", (it) => {
+  it.effect("reads the configured host label without materializing provider secrets", () => {
+    const cause = new ServerSecretStore.SecretStoreReadError({
+      resource: "provider secret",
+      cause: PlatformError.systemError({
+        _tag: "PermissionDenied",
+        module: "FileSystem",
+        method: "readFile",
+        pathOrDescriptor: "provider secret",
+        description: "Secret backend unavailable.",
+      }),
+    });
+    const layerSettings = ServerSettingsModule.layer.pipe(
+      Layer.provide(layerFailingSecretStore(cause)),
+      Layer.provideMerge(Layer.fresh(SqlitePersistence.layerMemory)),
+      Layer.provideMerge(
+        Layer.fresh(
+          ServerConfig.layerTest(process.cwd(), {
+            prefix: "t3-host-label-secret-test-",
+          }),
+        ),
+      ),
+    );
+    return Effect.gen(function* () {
+      const config = yield* ServerConfig.ServerConfig;
+      const fs = yield* FileSystem.FileSystem;
+      const service = yield* ServerSettingsModule.ServerSettingsService;
+      yield* fs.writeFileString(
+        config.settingsPath,
+        JSON.stringify({
+          environmentLabel: "Studio Mac",
+          providerInstances: {
+            codex: {
+              driver: "codex",
+              environment: [
+                { name: "OPENAI_API_KEY", value: "", sensitive: true, valueRedacted: true },
+              ],
+            },
+          },
+        }),
+      );
+      assert.equal(yield* service.getEnvironmentLabel, "Studio Mac");
+      const error = yield* service.getSettings.pipe(Effect.flip);
+      assert.equal(error.operation, "read-secret");
+      assert.equal(yield* service.getEnvironmentLabel, "Studio Mac");
+    }).pipe(Effect.provide(layerSettings));
+  });
+
+  it.effect("retains the latest committed host name across settings read failures", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      let failReads = true;
+      let settingsPath: string | undefined;
+      const failure = PlatformError.systemError({
+        _tag: "PermissionDenied",
+        module: "FileSystem",
+        method: "readFileString",
+      });
+      const layerSettings = layerServerSettings().pipe(
+        Layer.provideMerge(
+          Layer.succeed(FileSystem.FileSystem, {
+            ...fs,
+            readFileString: (path, encoding) =>
+              Effect.suspend(() =>
+                failReads && path === settingsPath
+                  ? Effect.fail(failure)
+                  : fs.readFileString(path, encoding),
+              ),
+          }),
+        ),
+      );
+      yield* Effect.gen(function* () {
+        const service = yield* ServerSettingsModule.ServerSettingsService;
+        settingsPath = (yield* ServerConfig.ServerConfig).settingsPath;
+        yield* fs.writeFileString(settingsPath, '{"environmentLabel":"Studio Mac"}');
+        assert.equal(yield* service.getEnvironmentLabel, "");
+        failReads = false;
+        assert.equal(yield* service.getEnvironmentLabel, "Studio Mac");
+
+        for (const label of ["Renamed Mac", ""]) {
+          yield* service.updateSettings({ environmentLabel: label });
+          failReads = true;
+          const error = yield* service
+            .updateSettings({ environmentLabel: "Unsaved" })
+            .pipe(Effect.flip);
+          assert.equal(error.operation, "read-file");
+          assert.equal(yield* service.getEnvironmentLabel, label);
+          failReads = false;
+        }
+      }).pipe(Effect.provide(layerSettings));
+    }),
+  );
+
+  it.effect("retains the trusted host name in malformed-file reads and watch events", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const changed = yield* Deferred.make<FileSystem.WatchEvent>();
+      const watchersReady = yield* Deferred.make<void>();
+      let watcherCount = 0;
+      const layerSettings = layerServerSettings().pipe(
+        Layer.provideMerge(
+          Layer.succeed(FileSystem.FileSystem, {
+            ...fs,
+            watch: () =>
+              Stream.fromEffect(
+                Effect.gen(function* () {
+                  if (++watcherCount === 2) yield* Deferred.succeed(watchersReady, undefined);
+                  return yield* Deferred.await(changed);
+                }),
+              ).pipe(Stream.concat(Stream.never)),
+          }),
+        ),
+      );
+      yield* Effect.gen(function* () {
+        const config = yield* ServerConfig.ServerConfig;
+        const service = yield* ServerSettingsModule.ServerSettingsService;
+        const broken = '{"environmentLabel":';
+        yield* fs.writeFileString(config.settingsPath, broken);
+        assert.equal(yield* service.getEnvironmentLabel, "");
+        yield* fs.writeFileString(config.settingsPath, '{"environmentLabel":"Studio Mac"}');
+        yield* service.start;
+        yield* Deferred.await(watchersReady);
+        const changes = yield* service.subscribeChanges;
+        yield* fs.writeFileString(config.settingsPath, broken);
+        yield* Deferred.succeed(changed, { _tag: "Update" as const, path: config.settingsPath });
+        yield* TestClock.adjust("100 millis");
+        const event = Option.getOrThrow(yield* Stream.runHead(changes));
+        assert.equal(event.environmentLabel, "Studio Mac");
+        assert.equal(yield* service.getEnvironmentLabel, "Studio Mac");
+        assert.equal((yield* service.getSettings).environmentLabel, "Studio Mac");
+        assert.equal(
+          yield* service.withSettingsSnapshot((settings) =>
+            Effect.succeed(settings.environmentLabel),
+          ),
+          "Studio Mac",
+        );
+        assert.equal(yield* fs.readFileString(config.settingsPath), broken);
+
+        yield* fs.writeFileString(config.settingsPath, '{"environmentLabel":""}');
+        yield* service.updateSettings({ environmentLabel: "" });
+        assert.equal(Option.getOrThrow(yield* Stream.runHead(changes)).environmentLabel, "");
+        assert.equal(yield* service.getEnvironmentLabel, "");
+        yield* fs.writeFileString(config.settingsPath, broken);
+        yield* service.updateSettings({ environmentLabel: "Unsaved" }).pipe(Effect.flip);
+        assert.equal((yield* service.getSettings).environmentLabel, "");
+        assert.equal(yield* service.getEnvironmentLabel, "");
+      }).pipe(Effect.provide(layerSettings));
+    }),
+  );
+
   it.effect("serializes concurrent model preference edits without cancelling duplicate adds", () =>
     Effect.gen(function* () {
       const service = yield* ServerSettingsModule.ServerSettingsService;
diff --git a/apps/server/src/serverSettings.ts b/apps/server/src/serverSettings.ts
index 67a1c3c3414f3..774d2f9ad0197 100644
--- a/apps/server/src/serverSettings.ts
+++ b/apps/server/src/serverSettings.ts
@@ -226,6 +226,7 @@ export class ServerSettingsService extends Context.Service<
     readonly ready: Effect.Effect<void, ServerSettingsError>;
 
     readonly getSettings: Effect.Effect<ServerSettings, ServerSettingsError>;
+    readonly getEnvironmentLabel: Effect.Effect<string>;
 
     readonly updateSettings: (
       patch: ServerSettingsPatch,
@@ -284,6 +285,9 @@ const makeTest = Effect.fn("serverSettings.makeTest")(function* (
     start: Effect.void,
     ready: Effect.void,
     getSettings,
+    getEnvironmentLabel: Ref.get(currentSettingsRef).pipe(
+      Effect.map((settings) => settings.environmentLabel),
+    ),
     updateSettings: (patch) =>
       updateTestSettings((currentSettings) =>
         Effect.succeed(applyServerSettingsPatch(currentSettings, patch)),
@@ -614,6 +618,7 @@ const make = Effect.gen(function* () {
   const cacheKey = "settings" as const;
   const changesPubSub = yield* PubSub.unbounded<ServerSettings>();
   const startedRef = yield* Ref.make(false);
+  const trustedEnvironmentLabel = yield* Ref.make(DEFAULT_SERVER_SETTINGS.environmentLabel);
   const startedDeferred = yield* Deferred.make<void, ServerSettingsError>();
   const watcherScope = yield* Scope.make("sequential");
   yield* Effect.addFinalizer(() => Scope.close(watcherScope, Exit.void));
@@ -717,7 +722,11 @@ const make = Effect.gen(function* () {
       if (decoded._tag === "Failure" || legacySettings._tag === "Failure") {
         const failure = decoded._tag === "Failure" ? decoded : legacySettings;
         // The file may hold an opt-out we can no longer read; never resume threads on a guess.
-        settings = { ...DEFAULT_SERVER_SETTINGS, continueThreadsAfterServerUpdate: false };
+        settings = {
+          ...DEFAULT_SERVER_SETTINGS,
+          environmentLabel: yield* Ref.get(trustedEnvironmentLabel),
+          continueThreadsAfterServerUpdate: false,
+        };
         if (failure._tag === "Failure") {
           parseFailure = Option.some(Cause.squash(failure.cause));
           yield* Effect.logWarning("failed to parse settings.json, using defaults", {
@@ -834,6 +843,9 @@ const make = Effect.gen(function* () {
         yield* secretStore.remove(move.from).pipe(Effect.ignore);
       }
     }
+    if (settingsFileTrusted) {
+      yield* Ref.set(trustedEnvironmentLabel, migrated.environmentLabel);
+    }
     return { settings: migrated, parseFailure };
   });
 
@@ -1099,6 +1111,7 @@ const make = Effect.gen(function* () {
               yield* rollbackSecretChanges;
               return yield* Effect.failCause(writeExit.cause);
             }
+            yield* Ref.set(trustedEnvironmentLabel, next.environmentLabel);
             return materializedExit.value;
           }).pipe(Effect.ensuring(invalidateMaterialized)),
         );
@@ -1217,6 +1230,10 @@ const make = Effect.gen(function* () {
     start,
     ready: Deferred.await(startedDeferred),
     getSettings: getMaterializedSettings,
+    getEnvironmentLabel: getSettingsFromCache.pipe(
+      Effect.map((settings) => settings.environmentLabel),
+      Effect.catch(() => Ref.get(trustedEnvironmentLabel)),
+    ),
     updateSettings: (patch) =>
       updateAndPersistSettings((current) =>
         ensureSecretProviderWritesAllowed(patch, settingsPath).pipe(
diff --git a/apps/server/src/ws.test.ts b/apps/server/src/ws.test.ts
index ba647514ecef4..30153ee418be5 100644
--- a/apps/server/src/ws.test.ts
+++ b/apps/server/src/ws.test.ts
@@ -133,18 +133,29 @@ import {
 const snapshotConfig = (fields: Partial<ServerConfig>) =>
   ({ availableEditors: [], settings: {}, ...fields }) as unknown as ServerConfig;
 
-const settingsUpdated = (settings: object): ServerConfigStreamEvent => ({
+const settingsUpdated = (
+  settings: object,
+  environment?: ServerConfig["environment"],
+): ServerConfigStreamEvent => ({
   version: 1,
   type: "settingsUpdated",
-  payload: { settings: settings as ServerConfig["settings"] },
+  payload: {
+    settings: settings as ServerConfig["settings"],
+    ...(environment === undefined ? {} : { environment }),
+  },
 });
 
 it.effect("resends late editors without rolling back updates already sent", () =>
   Effect.gen(function* () {
     const settingsSent = yield* Deferred.make<void>();
     const events = yield* withLateEditorConfig(
-      snapshotConfig({ settings: { enableProviderUpdateChecks: true } as never }),
-      Stream.make(settingsUpdated({ enableProviderUpdateChecks: false })),
+      snapshotConfig({
+        settings: { enableProviderUpdateChecks: true } as never,
+        environment: { label: "Initial host" } as never,
+      }),
+      Stream.make(
+        settingsUpdated({ enableProviderUpdateChecks: false }, { label: "Renamed host" } as never),
+      ),
       {
         resolveAvailableEditors: () => Effect.succeed(["file-manager"]),
         resolveFileManagerRevealKind: () =>
@@ -165,6 +176,7 @@ it.effect("resends late editors without rolling back updates already sent", () =
       assert.deepEqual(second.config.availableEditors, ["file-manager"]);
       assert.equal(second.config.shellRevealInFileManagerKind, "file-explorer");
       assert.deepEqual(second.config.settings, { enableProviderUpdateChecks: false } as never);
+      assert.equal(second.config.environment.label, "Renamed host");
     }
   }),
 );
@@ -604,6 +616,13 @@ it.effect(
   "preserves settings during discovery and keybindings during snapshot ACK at the config RPC boundary",
   () =>
     Effect.gen(function* () {
+      const configTestDescriptor = {
+        environmentId: EnvironmentId.make("config-test"),
+        label: "Config test",
+        platform: { os: "linux" as const, arch: "x64" as const },
+        serverVersion: "0.0.0",
+        capabilities: { repositoryIdentity: false },
+      };
       const keybindings = yield* Keybindings.Keybindings;
       const settings = yield* ServerSettings.ServerSettingsService;
       const keybindingsSubscribed = yield* Deferred.make<void>();
@@ -644,13 +663,8 @@ it.effect(
         }),
         Layer.mock(ScratchThreadPromotion.ScratchThreadPromotion)({}),
         Layer.mock(ServerEnvironment.ServerEnvironment)({
-          getDescriptor: Effect.succeed({
-            environmentId: EnvironmentId.make("config-test"),
-            label: "Config test",
-            platform: { os: "linux", arch: "x64" },
-            serverVersion: "0.0.0",
-            capabilities: { repositoryIdentity: false },
-          }),
+          getDescriptor: Effect.succeed(configTestDescriptor),
+          getDescriptorForSettings: () => Effect.succeed(configTestDescriptor),
         }),
         Layer.mock(EnvironmentAuth.EnvironmentAuth)({
           getDescriptor: () =>
diff --git a/apps/server/src/ws.ts b/apps/server/src/ws.ts
index 8373bbfae0c55..c8fa9e4c45c5d 100644
--- a/apps/server/src/ws.ts
+++ b/apps/server/src/ws.ts
@@ -357,8 +357,16 @@ export const withLateEditorConfig = <E, R>(
           case "providerStatuses":
             return [{ ...current, providers: event.payload.providers }, [event]];
           case "settingsUpdated":
-            return [{ ...current, settings: event.payload.settings }, [event]];
-          // Themes and usage-limit sources survive snapshots because snapshots never include them.
+            return [
+              {
+                ...current,
+                settings: event.payload.settings,
+                environment: event.payload.environment ?? current.environment,
+              },
+              [event],
+            ];
+          // Themes and usage-limit sources never ride in a snapshot; clients
+          // carry their projected values across one.
           default:
             return [current, [event]];
         }
@@ -3196,12 +3204,18 @@ export const layerWsRpc = (
                     )
                   : Stream.empty;
               const settingsUpdates = settingsChanges.pipe(
-                Stream.map((settings) => ServerSettings.redactServerSettingsForClient(settings)),
-                Stream.map((settings) => ({
-                  version: 1 as const,
-                  type: "settingsUpdated" as const,
-                  payload: { settings },
-                })),
+                Stream.mapEffect((settings) =>
+                  serverEnvironment.getDescriptorForSettings(settings).pipe(
+                    Effect.map((environment) => ({
+                      version: 1 as const,
+                      type: "settingsUpdated" as const,
+                      payload: {
+                        settings: ServerSettings.redactServerSettingsForClient(settings),
+                        environment,
+                      },
+                    })),
+                  ),
+                ),
               );
 
               const liveUpdates = Stream.merge(
diff --git a/apps/web/src/components/ChatMarkdown.tsx b/apps/web/src/components/ChatMarkdown.tsx
index 928d21fc46b97..238688024ce48 100644
--- a/apps/web/src/components/ChatMarkdown.tsx
+++ b/apps/web/src/components/ChatMarkdown.tsx
@@ -153,6 +153,9 @@ import { resolveRemoteOpenState, useRemoteOpenResolution } from "../remoteOpen";
 import { useRightPanelStore } from "../rightPanelStore";
 import { readThreadShell, useProjects } from "../state/entities";
 import { serverEnvironment } from "../state/server";
+import { environmentPresentations } from "../state/presentation";
+import { environmentDisplayLabel } from "@t3tools/client-runtime/connection";
+import { appAtomRegistry } from "../rpc/atomRegistry";
 import { shellEnvironment } from "../state/shell";
 import { assetEnvironment } from "../state/assets";
 import {
@@ -613,7 +616,13 @@ function useChatMarkdownState({
               isDesktopRenderer: window.desktopBridge !== undefined,
             }).mode !== "local-exec"
           ) {
-            description = `The file was not found on ${target.label} at ${error.checkedPath ?? error.resource.path}.`;
+            const presentation = appAtomRegistry.get(
+              environmentPresentations.presentationAtom(environmentId),
+            );
+            const host = presentation
+              ? environmentDisplayLabel(presentation.entry, presentation.serverConfig)
+              : "the remote environment";
+            description = `The file was not found on ${host} at ${error.checkedPath ?? error.resource.path}.`;
           }
         }
         toastManager.add(
diff --git a/apps/web/src/components/SlowRpcRequestToastCoordinator.tsx b/apps/web/src/components/SlowRpcRequestToastCoordinator.tsx
index 4536987ab3b7d..0851dcae93615 100644
--- a/apps/web/src/components/SlowRpcRequestToastCoordinator.tsx
+++ b/apps/web/src/components/SlowRpcRequestToastCoordinator.tsx
@@ -1,5 +1,7 @@
 import { type SlowRpcAckRequest, subscribeSlowRpcAckRequests } from "../rpc/requestLatencyState";
 import { toastManager } from "./ui/toast";
+import { useAtomValue } from "@effect/atom-react";
+import { environmentSummaries } from "../state/presentation";
 
 function describeSlowRequests(requests: ReadonlyArray<SlowRpcAckRequest>): string {
   const count = requests.length;
@@ -11,6 +13,10 @@ function describeSlowRequests(requests: ReadonlyArray<SlowRpcAckRequest>): strin
 }
 
 function SlowRequestDetails({ requests }: { requests: ReadonlyArray<SlowRpcAckRequest> }) {
+  const identities = useAtomValue(environmentSummaries.identitiesAtom);
+  const labels = new Map<string, string>(
+    identities.map(({ environmentId, label }) => [environmentId, label]),
+  );
   return (
     <ul className="space-y-2.5 text-xs text-muted-foreground">
       {requests.map((request) => (
@@ -18,7 +24,11 @@ function SlowRequestDetails({ requests }: { requests: ReadonlyArray<SlowRpcAckRe
           className="min-w-0 border-border/50 border-b pb-2 last:border-b-0 last:pb-0"
           key={request.requestId}
         >
-          <div className="wrap-break-word font-medium text-foreground">{request.tag}</div>
+          <div className="wrap-break-word font-medium text-foreground">
+            {request.environmentId === undefined
+              ? request.tag
+              : `${request.tag} · ${labels.get(request.environmentId) ?? "disconnected environment"}`}
+          </div>
           <div className="mt-0.5 text-3xs opacity-75">
             Started {new Date(request.startedAt).toLocaleTimeString()}
           </div>
diff --git a/apps/web/src/components/chat/useComposerSend.ts b/apps/web/src/components/chat/useComposerSend.ts
index b22c313f6932b..bc3de7371bd43 100644
--- a/apps/web/src/components/chat/useComposerSend.ts
+++ b/apps/web/src/components/chat/useComposerSend.ts
@@ -15,6 +15,7 @@ import {
   makeThreadErrorSetter,
 } from "../ChatView.logic";
 import { isUsageLimitsCommand } from "@t3tools/shared/usageLimits";
+import { environmentDisplayLabel } from "@t3tools/client-runtime/connection";
 import {
   AuthOrchestrationOperateScope,
   DEFAULT_MODEL,
@@ -614,9 +615,10 @@ export function useComposerSend(input: ComposerSendInput) {
       linkedEnvironments,
     })[0];
     if (strandedThread) {
-      const owner =
-        readEnvironmentPresentation(strandedThread.environmentId)?.entry.target.label ??
-        "its machine";
+      const presentation = readEnvironmentPresentation(strandedThread.environmentId);
+      const owner = presentation
+        ? environmentDisplayLabel(presentation.entry, presentation.serverConfig)
+        : "its machine";
       toastManager.add(
         stackedThreadToast({
           type: "warning",
diff --git a/apps/web/src/components/settings/ChatGptWelcomeCoordinator.tsx b/apps/web/src/components/settings/ChatGptWelcomeCoordinator.tsx
index 6b449407abb26..4b53ae11d92e0 100644
--- a/apps/web/src/components/settings/ChatGptWelcomeCoordinator.tsx
+++ b/apps/web/src/components/settings/ChatGptWelcomeCoordinator.tsx
@@ -1,3 +1,4 @@
+import { environmentDisplayLabel } from "@t3tools/client-runtime/connection";
 import { useAtomValue } from "@effect/atom-react";
 import { usesChatGptSharing } from "@t3tools/shared/usageLimits";
 import { useState } from "react";
@@ -41,7 +42,10 @@ export function ChatGptWelcomeCoordinator() {
               provider.instanceId,
               provider.auth.profileId ?? provider.auth.email ?? "default",
             ]),
-            environmentLabel: presentation.entry.target.label,
+            environmentLabel: environmentDisplayLabel(
+              presentation.entry,
+              presentation.serverConfig,
+            ),
             providerName: provider.displayName ?? "Codex",
           })),
   );
diff --git a/apps/web/src/components/settings/ConnectionsSettings.tsx b/apps/web/src/components/settings/ConnectionsSettings.tsx
index a0ebd148453d6..a8ee8b0ec8d32 100644
--- a/apps/web/src/components/settings/ConnectionsSettings.tsx
+++ b/apps/web/src/components/settings/ConnectionsSettings.tsx
@@ -69,6 +69,7 @@ import { Switch } from "../ui/switch";
 import { stackedThreadToast, toastManager } from "../ui/toast";
 import { Tooltip, TooltipPopup, TooltipTrigger } from "../ui/tooltip";
 import { Button } from "../ui/button";
+import { DraftInput } from "../ui/draft-input";
 import { EnvironmentMachineIcon } from "../EnvironmentMachineIcon";
 import {
   revokeOtherServerClientSessions,
@@ -105,6 +106,7 @@ import { requestConfirmDialog } from "~/confirmDialog";
 import { useAtomCommand } from "../../state/use-atom-command";
 import { environmentIdsKey } from "~/state/environmentAtomList";
 import { environmentUpdateStatesAtom, serverEnvironment } from "~/state/server";
+import { usePrimarySettings, useUpdatePrimarySettings } from "../../hooks/useSettings";
 import {
   ServerUpdateAction,
   ServerUpdateProgress,
@@ -157,6 +159,8 @@ export function ConnectionsSettings({ view }: { readonly view: "environments" |
   const desktopBridge = window.desktopBridge;
   const { environments } = useEnvironments();
   const primaryEnvironment = usePrimaryEnvironment();
+  const environmentLabel = usePrimarySettings((settings) => settings.environmentLabel);
+  const updatePrimarySettings = useUpdatePrimarySettings();
   const peerLinkHosts = usePeerLinkHosts();
   const removeEnvironment = useAtomCommand(environmentCatalog.remove, { reportFailure: false });
   const setEnvironmentEnabled = useAtomCommand(environmentCatalog.setEnabled, {
@@ -285,6 +289,11 @@ export function ConnectionsSettings({ view }: { readonly view: "environments" |
   const canMaintain = useEnvironmentScope(primaryEnvironmentId, AuthEnvironmentMaintainScope);
   const canManageRelay = useEnvironmentScope(primaryEnvironmentId, AuthRelayWriteScope);
   const canManageLocalBackend = !isLocalEnvironmentDisabled() && canMaintain;
+  const canEditEnvironmentLabel = useAtomValue(
+    serverEnvironment.updateSettings.permissionAtom(primaryEnvironmentId, {
+      patch: { environmentLabel },
+    }),
+  );
   const showsAccess = view === "access";
   const authAccessChanges = useEnvironmentQuery(
     showsAccess && canReadAccess && primaryEnvironmentId !== null
@@ -635,6 +644,37 @@ export function ConnectionsSettings({ view }: { readonly view: "environments" |
       aria-label="Enable network access"
     />
   );
+  const renderEnvironmentLabelRow = () => (
+    <SettingsRow
+      title="Host name"
+      description={
+        primaryServerConfig === null || primaryEnvironment?.connection.phase !== "connected"
+          ? "Connect to this environment to set its host name."
+          : primaryServerConfig.environment.capabilities.environmentLabel !== true
+            ? "Update this environment to set its host name."
+            : !canEditEnvironmentLabel
+              ? "You need permission to update this environment’s settings."
+              : "Shown to connected clients and in T3 Connect. Clear it to use this computer’s name."
+      }
+      control={
+        <div className="w-full sm:w-64">
+          <DraftInput
+            size="sm"
+            value={environmentLabel}
+            onCommit={(next) => updatePrimarySettings({ environmentLabel: next })}
+            placeholder="Use this computer’s name"
+            aria-label="Host name"
+            disabled={
+              !canEditEnvironmentLabel ||
+              primaryEnvironment?.connection.phase !== "connected" ||
+              primaryServerConfig?.environment.capabilities.environmentLabel !== true
+            }
+            spellCheck={false}
+          />
+        </div>
+      }
+    />
+  );
   const renderEndpointRows = () =>
     isAdvertisedEndpointListExpanded
       ? visibleDesktopNetworkAdvertisedEndpoints.map((endpoint) => {
@@ -1102,6 +1142,7 @@ export function ConnectionsSettings({ view }: { readonly view: "environments" |
                 }
               />
             ) : null}
+            {renderEnvironmentLabelRow()}
             {canManageLocalBackend && desktopBridge ? (
               <>
                 {renderNetworkAccessRow()}
diff --git a/apps/web/src/components/settings/SavedEnvironmentRows.tsx b/apps/web/src/components/settings/SavedEnvironmentRows.tsx
index fee5b9857a6ae..c03127f95a5f8 100644
--- a/apps/web/src/components/settings/SavedEnvironmentRows.tsx
+++ b/apps/web/src/components/settings/SavedEnvironmentRows.tsx
@@ -40,6 +40,7 @@ import { Switch } from "../ui/switch";
 import { stackedThreadToast, toastManager } from "../ui/toast";
 import { Tooltip, TooltipPopup, TooltipTrigger } from "../ui/tooltip";
 import { Button, InlineButton } from "../ui/button";
+import { DraftInput } from "../ui/draft-input";
 import { Empty, EmptyDescription, EmptyHeader, EmptyMedia, EmptyTitle } from "../ui/empty";
 import {
   resolveServerConfigVersionMismatch,
@@ -109,6 +110,48 @@ function savedBackendStatus(environment: EnvironmentPresentation): {
   }
 }
 
+/**
+ * Renames a Connect host for every client. Manual connections keep the label
+ * saved on this device, so only Connect rows offer this.
+ */
+function RemoteHostNameField({ environment }: { readonly environment: EnvironmentPresentation }) {
+  const environmentId = environment.environmentId;
+  const updateSettings = useAtomCommand(serverEnvironment.updateSettings, "Update host name");
+  const canUpdateSettings = useAtomValue(
+    serverEnvironment.updateSettings.permissionAtom(environmentId),
+  );
+  const connected = environment.connection.phase === "connected";
+  const supported = environment.serverConfig?.environment.capabilities.environmentLabel === true;
+  return (
+    <div className="mt-2 flex flex-col gap-1.5 border-t border-border/50 py-2">
+      <DraftInput
+        size="sm"
+        className="w-full sm:w-64"
+        value={environment.serverConfig?.settings.environmentLabel ?? ""}
+        onCommit={(next) =>
+          void updateSettings({
+            environmentId,
+            input: { patch: { environmentLabel: next.trim() } },
+          })
+        }
+        placeholder="Use the machine’s name"
+        aria-label={`Host name for ${environment.label}`}
+        disabled={!connected || !supported || !canUpdateSettings}
+        spellCheck={false}
+      />
+      <p className="text-xs text-muted-foreground">
+        {!connected
+          ? "Connect to this environment to change its host name."
+          : !supported
+            ? "Update this environment to change its host name."
+            : !canUpdateSettings
+              ? "You need permission to update this environment’s settings."
+              : "Shown to every client. Clear it to use the machine’s name."}
+      </p>
+    </div>
+  );
+}
+
 export function SavedBackendListRow({
   environment,
   removingEnvironmentId,
@@ -119,7 +162,9 @@ export function SavedBackendListRow({
   const [routesOpen, setRoutesOpen] = useState(false);
   const [permissionsOpen, setPermissionsOpen] = useState(false);
   const [diagnosisOpen, setDiagnosisOpen] = useState(false);
+  const [hostNameOpen, setHostNameOpen] = useState(false);
   const environmentId = environment.environmentId;
+  const isConnectHost = environment.entry.target._tag === "RelayConnectionTarget";
   const unsupported = environment.connection.phase === "unsupported";
   const blocked = unsupported && !hasSavedBearerRoute(environment.entry);
   const enabled = environment.entry.enabled && !unsupported;
@@ -328,6 +373,7 @@ export function SavedBackendListRow({
       }
       detail={
         <>
+          {hostNameOpen && isConnectHost && <RemoteHostNameField environment={environment} />}
           {diagnosis && diagnosisOpen ? (
             <ConnectionDiagnosisPanel
               hostLabel={environment.label}
@@ -415,6 +461,11 @@ export function SavedBackendListRow({
             environmentId={environmentId}
             serverConfig={environment.serverConfig}
           />
+          {isConnectHost ? (
+            <MenuItem onClick={() => setHostNameOpen((open) => !open)}>
+              {hostNameOpen ? "Hide host name" : "Host name"}
+            </MenuItem>
+          ) : null}
           <MenuItem onClick={() => setRoutesOpen((open) => !open)}>
             <RouteIcon />
             {routesOpen ? "Hide routes" : "Routes"}
diff --git a/apps/web/src/components/settings/settingsSearch.test.ts b/apps/web/src/components/settings/settingsSearch.test.ts
index ee22671ee1f6d..901ba0880a98a 100644
--- a/apps/web/src/components/settings/settingsSearch.test.ts
+++ b/apps/web/src/components/settings/settingsSearch.test.ts
@@ -58,6 +58,12 @@ const ITEMS: ReadonlyArray<SettingsSearchItem> = [
 ];
 
 describe("searchSettings", () => {
+  it("opens host-name search results on the view containing the host settings", () => {
+    expect(searchSettings("host name")).toContainEqual(
+      expect.objectContaining({ title: "Host name", to: "/settings/access" }),
+    );
+  });
+
   it("matches titles, sections, and remembered setting details", () => {
     expect(searchSettings("word", ITEMS).map((item) => item.id)).toEqual(["word-wrap"]);
     expect(searchSettings("network", ITEMS).map((item) => item.id)).toEqual(["network-access"]);
diff --git a/apps/web/src/components/settings/settingsSearch.ts b/apps/web/src/components/settings/settingsSearch.ts
index dda759f860e5b..0ad00d8cc9fc7 100644
--- a/apps/web/src/components/settings/settingsSearch.ts
+++ b/apps/web/src/components/settings/settingsSearch.ts
@@ -1050,6 +1050,13 @@ export const SETTINGS_SEARCH_ITEMS = [
     to: "/settings/projects",
     searchTerms: ["commands scripts setup run dev server checkout worktree t3.json import"],
   },
+  {
+    id: "environment-label",
+    title: "Host name",
+    to: "/settings/access",
+    targetId: "connections-environment",
+    searchTerms: ["rename environment machine name hostname t3 connect"],
+  },
   {
     id: "environment-icon",
     title: "Environment icon",
diff --git a/apps/web/src/components/usage/UsagePriceOverrides.tsx b/apps/web/src/components/usage/UsagePriceOverrides.tsx
index eb47ac5586ed3..7be1ea231206b 100644
--- a/apps/web/src/components/usage/UsagePriceOverrides.tsx
+++ b/apps/web/src/components/usage/UsagePriceOverrides.tsx
@@ -1,3 +1,4 @@
+import { environmentDisplayLabel } from "@t3tools/client-runtime/connection";
 import { useAtomValue } from "@effect/atom-react";
 import { AuthSettingsWriteScope, type EnvironmentId, sessionGrantsScope } from "@t3tools/contracts";
 import { ChevronDownIcon, PlusIcon, RotateCcwIcon, XIcon } from "lucide-react";
@@ -58,7 +59,7 @@ const priceTargetsAtom = Atom.make((get): readonly UsagePriceTarget[] =>
             : "denied";
     return {
       environmentId,
-      label: environment.entry.target.label,
+      label: environmentDisplayLabel(environment.entry, environment.serverConfig),
       prices: settings?.usagePriceOverrides ?? null,
       aliases:
         environment.serverConfig?.environment.capabilities.usageModelAliases === true
diff --git a/apps/web/src/connection/platform.ts b/apps/web/src/connection/platform.ts
index e60ed172e9260..5a1c9a141039d 100644
--- a/apps/web/src/connection/platform.ts
+++ b/apps/web/src/connection/platform.ts
@@ -803,11 +803,11 @@ const layerRpcRequestObserver = Layer.succeed(
   EnvironmentRpcRequestObserver,
   EnvironmentRpcRequestObserver.of({
     // Every RPC passes through this observer; the request owns its span.
-    observe: Effect.fnUntraced(function* ({ environmentId, environmentLabel, method }) {
+    observe: Effect.fnUntraced(function* ({ environmentId, method }) {
       return yield* Effect.sync(() => {
         nextObservedRpcRequestId += 1;
         const requestId = `${environmentId}:${nextObservedRpcRequestId}`;
-        trackRpcRequestSent(requestId, method, `${method} · ${environmentLabel}`);
+        trackRpcRequestSent(requestId, method, method, environmentId);
         return Effect.sync(() => {
           acknowledgeRpcRequest(requestId);
         });
diff --git a/apps/web/src/hooks/useSettings.ts b/apps/web/src/hooks/useSettings.ts
index 2c24f13760092..9a55c59480eea 100644
--- a/apps/web/src/hooks/useSettings.ts
+++ b/apps/web/src/hooks/useSettings.ts
@@ -570,7 +570,7 @@ function useSharedSettingsSyncTargetIds(includePending = false): ReadonlyArray<E
   const results = useAtomValue(environmentSessionStatesAtom(environmentIdsKey(targetIds)));
   return targetIds.flatMap((environmentId, index) => {
     const result = results[index]!;
-    // Let the server authorize shared edits with cold grants; suggestions still need confirmed grants.
+    // Edits can wait for pending grants; suggestions need confirmed grants.
     if (includePending && result._tag === "Initial") {
       return [environmentId];
     }
diff --git a/apps/web/src/rpc/requestLatencyState.ts b/apps/web/src/rpc/requestLatencyState.ts
index c95ddae2afcde..94439d5e69cc5 100644
--- a/apps/web/src/rpc/requestLatencyState.ts
+++ b/apps/web/src/rpc/requestLatencyState.ts
@@ -17,6 +17,7 @@ export interface SlowRpcAckRequest {
   readonly startedAt: string;
   readonly startedAtMs: number;
   readonly tag: string;
+  readonly environmentId?: string;
   readonly thresholdMs: number;
 }
 
@@ -68,7 +69,12 @@ function rpcAckThresholdMs(method: string): number {
     : slowRpcAckThresholdMs;
 }
 
-export function trackRpcRequestSent(requestId: string, method: string, tag = method): void {
+export function trackRpcRequestSent(
+  requestId: string,
+  method: string,
+  tag = method,
+  environmentId?: string,
+): void {
   if (!shouldTrackRpcAck(method)) {
     return;
   }
@@ -83,6 +89,7 @@ export function trackRpcRequestSent(requestId: string, method: string, tag = met
     startedAt: new Date(startedAtMs).toISOString(),
     startedAtMs,
     tag,
+    ...(environmentId === undefined ? {} : { environmentId }),
     thresholdMs,
   };
   const timeoutId = setTimeout(() => {
diff --git a/apps/web/src/state/environments.ts b/apps/web/src/state/environments.ts
index a35af5e094a00..f8002eb66c53a 100644
--- a/apps/web/src/state/environments.ts
+++ b/apps/web/src/state/environments.ts
@@ -1,6 +1,7 @@
 import { useAtomValue } from "@effect/atom-react";
 import {
   connectionCatalogDisplayUrl,
+  environmentDisplayLabel,
   hasRelayRoute,
   type EnvironmentPresentation as BaseEnvironmentPresentation,
 } from "@t3tools/client-runtime/connection";
@@ -33,7 +34,7 @@ function projectEnvironmentPresentation(
   return {
     ...presentation,
     environmentId,
-    label: presentation.entry.target.label,
+    label: environmentDisplayLabel(presentation.entry, presentation.serverConfig),
     displayUrl: connectionCatalogDisplayUrl(presentation.entry),
     relayManaged: hasRelayRoute(presentation.entry),
   };
diff --git a/apps/web/src/state/presentation.ts b/apps/web/src/state/presentation.ts
index e970c64f23c7e..7afa75c27f4f1 100644
--- a/apps/web/src/state/presentation.ts
+++ b/apps/web/src/state/presentation.ts
@@ -9,11 +9,13 @@ import { Atom } from "effect/reactivity";
 
 import { environmentCatalog } from "../connection/catalog";
 import { serverEnvironment } from "./server";
+import { relayEnvironmentDiscovery } from "./relay";
 
 export const environmentPresentations = createEnvironmentPresentationAtoms({
   catalogValueAtom: environmentCatalog.catalogValueAtom,
   stateAtom: environmentCatalog.stateAtom,
   serverConfigValueAtom: serverEnvironment.configValueAtom,
+  relayDiscoveryValueAtom: relayEnvironmentDiscovery.stateValueAtom,
 });
 
 export const environmentSummaries = createEnvironmentSummaryAtoms({
diff --git a/apps/web/src/state/usage.ts b/apps/web/src/state/usage.ts
index 9a68a5fa724f7..8f24943fc113c 100644
--- a/apps/web/src/state/usage.ts
+++ b/apps/web/src/state/usage.ts
@@ -1,4 +1,5 @@
 import { useAtomValue } from "@effect/atom-react";
+import { environmentDisplayLabel } from "@t3tools/client-runtime/connection";
 import {
   AuthDiagnosticsReadScope,
   USAGE_CONTRACT_VERSION,
@@ -47,7 +48,7 @@ const usageByWindowAtom = Atom.family((windowKey: string) =>
       if (!access.canReadDiagnostics) {
         statuses.push({
           environmentId,
-          label: presentation.entry.target.label,
+          label: environmentDisplayLabel(presentation.entry, presentation.serverConfig),
           isConnected,
           ...access,
           summary: null,
@@ -59,7 +60,7 @@ const usageByWindowAtom = Atom.family((windowKey: string) =>
       const summary = AsyncResult.getOrElse(result, () => null);
       statuses.push({
         environmentId,
-        label: presentation.entry.target.label,
+        label: environmentDisplayLabel(presentation.entry, presentation.serverConfig),
         isPending: result.waiting,
         canReadDiagnostics: true,
         isConnected,
diff --git a/docs/user/remote-access.md b/docs/user/remote-access.md
index c7e69989e0493..4bae0e79a945d 100644
--- a/docs/user/remote-access.md
+++ b/docs/user/remote-access.md
@@ -64,6 +64,20 @@ opens and approve. The new limit applies the next time you add a machine. If you
 cancel or downgrade T3 Chat, machines you already linked stay linked, but you
 cannot add more until you are under the limit again.
 
+## Name this host
+
+In the web or desktop app, open **Settings → Sharing & access** and edit
+**Host name**. Connected clients and T3 Connect use the new name without a server restart.
+
+To rename another T3 Connect host, open its row menu in **Settings → Environments**
+and choose **Host name**. On mobile, open **Settings → Environments**, choose a T3 Connect
+host, and edit **Host name**.
+You need permission to update that environment’s settings. Labels on manually paired
+connections remain local to your device.
+
+Clear the field to return to the name detected from the host operating system. This setting changes
+the environment name shown by T3 Code; it does not change the machine's operating-system hostname.
+
 ## Pair over a LAN or private network
 
 Use direct pairing when the other device can reach the host's network address.
diff --git a/infra/relay/migrations/postgres/20261029044631_environment_label_updated_at/migration.sql b/infra/relay/migrations/postgres/20261029044631_environment_label_updated_at/migration.sql
new file mode 100644
index 0000000000000..c27e27f2ca78c
--- /dev/null
+++ b/infra/relay/migrations/postgres/20261029044631_environment_label_updated_at/migration.sql
@@ -0,0 +1 @@
+ALTER TABLE "relay_environment_links" ADD COLUMN "label_updated_at" varchar(64);
\ No newline at end of file
diff --git a/infra/relay/migrations/postgres/20261029044631_environment_label_updated_at/snapshot.json b/infra/relay/migrations/postgres/20261029044631_environment_label_updated_at/snapshot.json
new file mode 100644
index 0000000000000..e66f6b2d38a26
--- /dev/null
+++ b/infra/relay/migrations/postgres/20261029044631_environment_label_updated_at/snapshot.json
@@ -0,0 +1,1584 @@
+{
+  "version": "8",
+  "dialect": "postgres",
+  "id": "815c4c68-68a8-4615-9029-68f322474b39",
+  "prevIds": ["4413755a-63f1-4f93-bdc9-d1357283c23e"],
+  "ddl": [
+    {
+      "isRlsEnabled": false,
+      "name": "relay_agent_activity_rows",
+      "entityType": "tables",
+      "schema": "public"
+    },
+    {
+      "isRlsEnabled": false,
+      "name": "relay_delivery_attempts",
+      "entityType": "tables",
+      "schema": "public"
+    },
+    {
+      "isRlsEnabled": false,
+      "name": "relay_dpop_proofs",
+      "entityType": "tables",
+      "schema": "public"
+    },
+    {
+      "isRlsEnabled": false,
+      "name": "relay_environment_credentials",
+      "entityType": "tables",
+      "schema": "public"
+    },
+    {
+      "isRlsEnabled": false,
+      "name": "relay_environment_links",
+      "entityType": "tables",
+      "schema": "public"
+    },
+    {
+      "isRlsEnabled": false,
+      "name": "relay_live_activities",
+      "entityType": "tables",
+      "schema": "public"
+    },
+    {
+      "isRlsEnabled": false,
+      "name": "relay_managed_endpoint_allocations",
+      "entityType": "tables",
+      "schema": "public"
+    },
+    {
+      "isRlsEnabled": false,
+      "name": "relay_managed_tunnel_limits",
+      "entityType": "tables",
+      "schema": "public"
+    },
+    {
+      "isRlsEnabled": false,
+      "name": "relay_mobile_devices",
+      "entityType": "tables",
+      "schema": "public"
+    },
+    {
+      "isRlsEnabled": false,
+      "name": "relay_upstream_api_pauses",
+      "entityType": "tables",
+      "schema": "public"
+    },
+    {
+      "type": "varchar(191)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "environment_id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_agent_activity_rows"
+    },
+    {
+      "type": "text",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "environment_public_key",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_agent_activity_rows"
+    },
+    {
+      "type": "varchar(512)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "thread_id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_agent_activity_rows"
+    },
+    {
+      "type": "jsonb",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "state_json",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_agent_activity_rows"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "updated_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_agent_activity_rows"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "created_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_agent_activity_rows"
+    },
+    {
+      "type": "varchar(36)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_delivery_attempts"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "created_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_delivery_attempts"
+    },
+    {
+      "type": "varchar(255)",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "user_id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_delivery_attempts"
+    },
+    {
+      "type": "varchar(191)",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "environment_id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_delivery_attempts"
+    },
+    {
+      "type": "varchar(512)",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "thread_id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_delivery_attempts"
+    },
+    {
+      "type": "varchar(255)",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "device_id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_delivery_attempts"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "kind",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_delivery_attempts"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "source_job_id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_delivery_attempts"
+    },
+    {
+      "type": "varchar(16)",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "token_suffix",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_delivery_attempts"
+    },
+    {
+      "type": "integer",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "apns_status",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_delivery_attempts"
+    },
+    {
+      "type": "text",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "apns_reason",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_delivery_attempts"
+    },
+    {
+      "type": "varchar(128)",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "apns_id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_delivery_attempts"
+    },
+    {
+      "type": "text",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "transport_error",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_delivery_attempts"
+    },
+    {
+      "type": "varchar(128)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "thumbprint",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_dpop_proofs"
+    },
+    {
+      "type": "varchar(255)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "jti",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_dpop_proofs"
+    },
+    {
+      "type": "integer",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "iat",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_dpop_proofs"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "expires_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_dpop_proofs"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "created_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_dpop_proofs"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "credential_id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_environment_credentials"
+    },
+    {
+      "type": "varchar(191)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "environment_id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_environment_credentials"
+    },
+    {
+      "type": "text",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "environment_public_key",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_environment_credentials"
+    },
+    {
+      "type": "varchar(191)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "credential_hash",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_environment_credentials"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "revoked_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_environment_credentials"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "created_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_environment_credentials"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "updated_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_environment_credentials"
+    },
+    {
+      "type": "varchar(191)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "user_id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_environment_links"
+    },
+    {
+      "type": "varchar(191)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "environment_id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_environment_links"
+    },
+    {
+      "type": "text",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": "'T3 Environment'",
+      "generated": null,
+      "identity": null,
+      "name": "environment_label",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_environment_links"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "label_updated_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_environment_links"
+    },
+    {
+      "type": "text",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "environment_public_key",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_environment_links"
+    },
+    {
+      "type": "text",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "endpoint_http_base_url",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_environment_links"
+    },
+    {
+      "type": "text",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "endpoint_ws_base_url",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_environment_links"
+    },
+    {
+      "type": "varchar(32)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "endpoint_provider_kind",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_environment_links"
+    },
+    {
+      "type": "boolean",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": "true",
+      "generated": null,
+      "identity": null,
+      "name": "notifications_enabled",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_environment_links"
+    },
+    {
+      "type": "boolean",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": "true",
+      "generated": null,
+      "identity": null,
+      "name": "live_activities_enabled",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_environment_links"
+    },
+    {
+      "type": "boolean",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": "false",
+      "generated": null,
+      "identity": null,
+      "name": "managed_tunnels_enabled",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_environment_links"
+    },
+    {
+      "type": "boolean",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": "false",
+      "generated": null,
+      "identity": null,
+      "name": "hold_webhooks_while_offline",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_environment_links"
+    },
+    {
+      "type": "varchar(191)",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "created_by_device_id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_environment_links"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "revoked_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_environment_links"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "created_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_environment_links"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "updated_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_environment_links"
+    },
+    {
+      "type": "varchar(255)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "user_id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_live_activities"
+    },
+    {
+      "type": "varchar(255)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "device_id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_live_activities"
+    },
+    {
+      "type": "text",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "activity_push_token",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_live_activities"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "remote_start_queued_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_live_activities"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "remote_started_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_live_activities"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "ended_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_live_activities"
+    },
+    {
+      "type": "jsonb",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "last_aggregate_json",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_live_activities"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "last_live_activity_delivery_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_live_activities"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "created_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_live_activities"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "updated_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_live_activities"
+    },
+    {
+      "type": "varchar(191)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "user_id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_managed_endpoint_allocations"
+    },
+    {
+      "type": "varchar(191)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "environment_id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_managed_endpoint_allocations"
+    },
+    {
+      "type": "text",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "hostname",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_managed_endpoint_allocations"
+    },
+    {
+      "type": "varchar(191)",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "tunnel_id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_managed_endpoint_allocations"
+    },
+    {
+      "type": "text",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "tunnel_name",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_managed_endpoint_allocations"
+    },
+    {
+      "type": "varchar(191)",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "dns_record_id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_managed_endpoint_allocations"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "ready_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_managed_endpoint_allocations"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "recovery_enabled_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_managed_endpoint_allocations"
+    },
+    {
+      "type": "text",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "recovery_environment_public_key",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_managed_endpoint_allocations"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "tunnel_released_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_managed_endpoint_allocations"
+    },
+    {
+      "type": "jsonb",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "origin",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_managed_endpoint_allocations"
+    },
+    {
+      "type": "integer",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": "0",
+      "generated": null,
+      "identity": null,
+      "name": "generation",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_managed_endpoint_allocations"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "created_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_managed_endpoint_allocations"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "updated_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_managed_endpoint_allocations"
+    },
+    {
+      "type": "varchar(191)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "user_id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_managed_tunnel_limits"
+    },
+    {
+      "type": "integer",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "max_tunnels",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_managed_tunnel_limits"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "created_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_managed_tunnel_limits"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "updated_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_managed_tunnel_limits"
+    },
+    {
+      "type": "varchar(255)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "user_id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_mobile_devices"
+    },
+    {
+      "type": "varchar(255)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "device_id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_mobile_devices"
+    },
+    {
+      "type": "text",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": "'iOS device'",
+      "generated": null,
+      "identity": null,
+      "name": "label",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_mobile_devices"
+    },
+    {
+      "type": "varchar(16)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "platform",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_mobile_devices"
+    },
+    {
+      "type": "integer",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "ios_major_version",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_mobile_devices"
+    },
+    {
+      "type": "integer",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "android_api_level",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_mobile_devices"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "app_version",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_mobile_devices"
+    },
+    {
+      "type": "varchar(255)",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "bundle_id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_mobile_devices"
+    },
+    {
+      "type": "varchar(16)",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "aps_environment",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_mobile_devices"
+    },
+    {
+      "type": "text",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "push_token",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_mobile_devices"
+    },
+    {
+      "type": "text",
+      "typeSchema": null,
+      "notNull": false,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "push_to_start_token",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_mobile_devices"
+    },
+    {
+      "type": "jsonb",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "preferences_json",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_mobile_devices"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "created_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_mobile_devices"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "updated_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_mobile_devices"
+    },
+    {
+      "type": "varchar(64)",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "api",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_upstream_api_pauses"
+    },
+    {
+      "type": "bigint",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "paused_until_ms",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "relay_upstream_api_pauses"
+    },
+    {
+      "nameExplicit": true,
+      "columns": [
+        {
+          "value": "created_at",
+          "isExpression": false,
+          "asc": true,
+          "nullsFirst": false,
+          "opclass": null
+        }
+      ],
+      "isUnique": false,
+      "where": null,
+      "with": "",
+      "method": "btree",
+      "concurrently": false,
+      "name": "idx_relay_delivery_attempts_created",
+      "entityType": "indexes",
+      "schema": "public",
+      "table": "relay_delivery_attempts"
+    },
+    {
+      "nameExplicit": true,
+      "columns": [
+        {
+          "value": "source_job_id",
+          "isExpression": false,
+          "asc": true,
+          "nullsFirst": false,
+          "opclass": null
+        }
+      ],
+      "isUnique": true,
+      "where": null,
+      "with": "",
+      "method": "btree",
+      "concurrently": false,
+      "name": "idx_relay_delivery_attempts_source_job",
+      "entityType": "indexes",
+      "schema": "public",
+      "table": "relay_delivery_attempts"
+    },
+    {
+      "nameExplicit": true,
+      "columns": [
+        {
+          "value": "expires_at",
+          "isExpression": false,
+          "asc": true,
+          "nullsFirst": false,
+          "opclass": null
+        }
+      ],
+      "isUnique": false,
+      "where": null,
+      "with": "",
+      "method": "btree",
+      "concurrently": false,
+      "name": "idx_relay_dpop_proofs_expires_at",
+      "entityType": "indexes",
+      "schema": "public",
+      "table": "relay_dpop_proofs"
+    },
+    {
+      "nameExplicit": true,
+      "columns": [
+        {
+          "value": "credential_hash",
+          "isExpression": false,
+          "asc": true,
+          "nullsFirst": false,
+          "opclass": null
+        }
+      ],
+      "isUnique": true,
+      "where": null,
+      "with": "",
+      "method": "btree",
+      "concurrently": false,
+      "name": "idx_relay_environment_credentials_hash",
+      "entityType": "indexes",
+      "schema": "public",
+      "table": "relay_environment_credentials"
+    },
+    {
+      "nameExplicit": true,
+      "columns": [
+        {
+          "value": "environment_id",
+          "isExpression": false,
+          "asc": true,
+          "nullsFirst": false,
+          "opclass": null
+        },
+        {
+          "value": "environment_public_key",
+          "isExpression": false,
+          "asc": true,
+          "nullsFirst": false,
+          "opclass": null
+        },
+        {
+          "value": "revoked_at",
+          "isExpression": false,
+          "asc": true,
+          "nullsFirst": false,
+          "opclass": null
+        }
+      ],
+      "isUnique": false,
+      "where": null,
+      "with": "",
+      "method": "btree",
+      "concurrently": false,
+      "name": "idx_relay_environment_credentials_environment_key",
+      "entityType": "indexes",
+      "schema": "public",
+      "table": "relay_environment_credentials"
+    },
+    {
+      "nameExplicit": true,
+      "columns": [
+        {
+          "value": "environment_id",
+          "isExpression": false,
+          "asc": true,
+          "nullsFirst": false,
+          "opclass": null
+        },
+        {
+          "value": "revoked_at",
+          "isExpression": false,
+          "asc": true,
+          "nullsFirst": false,
+          "opclass": null
+        }
+      ],
+      "isUnique": false,
+      "where": null,
+      "with": "",
+      "method": "btree",
+      "concurrently": false,
+      "name": "idx_relay_environment_links_environment",
+      "entityType": "indexes",
+      "schema": "public",
+      "table": "relay_environment_links"
+    },
+    {
+      "nameExplicit": true,
+      "columns": [
+        {
+          "value": "activity_push_token",
+          "isExpression": false,
+          "asc": true,
+          "nullsFirst": false,
+          "opclass": null
+        }
+      ],
+      "isUnique": true,
+      "where": null,
+      "with": "",
+      "method": "btree",
+      "concurrently": false,
+      "name": "idx_relay_live_activities_activity_push_token",
+      "entityType": "indexes",
+      "schema": "public",
+      "table": "relay_live_activities"
+    },
+    {
+      "nameExplicit": true,
+      "columns": [
+        {
+          "value": "hostname",
+          "isExpression": false,
+          "asc": true,
+          "nullsFirst": false,
+          "opclass": null
+        }
+      ],
+      "isUnique": true,
+      "where": null,
+      "with": "",
+      "method": "btree",
+      "concurrently": false,
+      "name": "idx_relay_managed_endpoint_allocations_hostname",
+      "entityType": "indexes",
+      "schema": "public",
+      "table": "relay_managed_endpoint_allocations"
+    },
+    {
+      "nameExplicit": true,
+      "columns": [
+        {
+          "value": "tunnel_name",
+          "isExpression": false,
+          "asc": true,
+          "nullsFirst": false,
+          "opclass": null
+        }
+      ],
+      "isUnique": true,
+      "where": null,
+      "with": "",
+      "method": "btree",
+      "concurrently": false,
+      "name": "idx_relay_managed_endpoint_allocations_tunnel_name",
+      "entityType": "indexes",
+      "schema": "public",
+      "table": "relay_managed_endpoint_allocations"
+    },
+    {
+      "nameExplicit": true,
+      "columns": [
+        {
+          "value": "push_token",
+          "isExpression": false,
+          "asc": true,
+          "nullsFirst": false,
+          "opclass": null
+        }
+      ],
+      "isUnique": true,
+      "where": null,
+      "with": "",
+      "method": "btree",
+      "concurrently": false,
+      "name": "idx_relay_mobile_devices_push_token",
+      "entityType": "indexes",
+      "schema": "public",
+      "table": "relay_mobile_devices"
+    },
+    {
+      "nameExplicit": true,
+      "columns": [
+        {
+          "value": "push_to_start_token",
+          "isExpression": false,
+          "asc": true,
+          "nullsFirst": false,
+          "opclass": null
+        }
+      ],
+      "isUnique": true,
+      "where": null,
+      "with": "",
+      "method": "btree",
+      "concurrently": false,
+      "name": "idx_relay_mobile_devices_push_to_start_token",
+      "entityType": "indexes",
+      "schema": "public",
+      "table": "relay_mobile_devices"
+    },
+    {
+      "columns": ["environment_id", "environment_public_key", "thread_id"],
+      "nameExplicit": false,
+      "name": "relay_agent_activity_rows_pkey",
+      "entityType": "pks",
+      "schema": "public",
+      "table": "relay_agent_activity_rows"
+    },
+    {
+      "columns": ["thumbprint", "jti"],
+      "nameExplicit": false,
+      "name": "relay_dpop_proofs_pkey",
+      "entityType": "pks",
+      "schema": "public",
+      "table": "relay_dpop_proofs"
+    },
+    {
+      "columns": ["user_id", "environment_id"],
+      "nameExplicit": false,
+      "name": "relay_environment_links_pkey",
+      "entityType": "pks",
+      "schema": "public",
+      "table": "relay_environment_links"
+    },
+    {
+      "columns": ["user_id", "device_id"],
+      "nameExplicit": false,
+      "name": "relay_live_activities_pkey",
+      "entityType": "pks",
+      "schema": "public",
+      "table": "relay_live_activities"
+    },
+    {
+      "columns": ["user_id", "environment_id"],
+      "nameExplicit": false,
+      "name": "relay_managed_endpoint_allocations_pkey",
+      "entityType": "pks",
+      "schema": "public",
+      "table": "relay_managed_endpoint_allocations"
+    },
+    {
+      "columns": ["user_id", "device_id"],
+      "nameExplicit": false,
+      "name": "relay_mobile_devices_pkey",
+      "entityType": "pks",
+      "schema": "public",
+      "table": "relay_mobile_devices"
+    },
+    {
+      "columns": ["id"],
+      "nameExplicit": false,
+      "name": "relay_delivery_attempts_pkey",
+      "schema": "public",
+      "table": "relay_delivery_attempts",
+      "entityType": "pks"
+    },
+    {
+      "columns": ["credential_id"],
+      "nameExplicit": false,
+      "name": "relay_environment_credentials_pkey",
+      "schema": "public",
+      "table": "relay_environment_credentials",
+      "entityType": "pks"
+    },
+    {
+      "columns": ["user_id"],
+      "nameExplicit": false,
+      "name": "relay_managed_tunnel_limits_pkey",
+      "schema": "public",
+      "table": "relay_managed_tunnel_limits",
+      "entityType": "pks"
+    },
+    {
+      "columns": ["api"],
+      "nameExplicit": false,
+      "name": "relay_upstream_api_pauses_pkey",
+      "schema": "public",
+      "table": "relay_upstream_api_pauses",
+      "entityType": "pks"
+    }
+  ],
+  "renames": []
+}
diff --git a/infra/relay/src/agentActivity/AgentActivityPublisher.test.ts b/infra/relay/src/agentActivity/AgentActivityPublisher.test.ts
index 33f1518ec30ae..46e3a7d12084c 100644
--- a/infra/relay/src/agentActivity/AgentActivityPublisher.test.ts
+++ b/infra/relay/src/agentActivity/AgentActivityPublisher.test.ts
@@ -97,6 +97,8 @@ function makeEnvironmentLinks(
     getForUser: () => Effect.succeed(null),
     findActiveManagedForEnvironment: () => Effect.succeed([]),
     setHoldWebhooksWhileOffline: () => Effect.void,
+    updateLabel: () => Effect.void,
+    recordEnvironmentLabel: () => Effect.void,
     revokeForUser: () => Effect.succeed(false),
     ...overrides,
   };
diff --git a/infra/relay/src/agentActivity/FcmDeliveries.test.ts b/infra/relay/src/agentActivity/FcmDeliveries.test.ts
index 21df615900f30..09e3b766b83c0 100644
--- a/infra/relay/src/agentActivity/FcmDeliveries.test.ts
+++ b/infra/relay/src/agentActivity/FcmDeliveries.test.ts
@@ -155,6 +155,8 @@ function harness() {
     }),
     Layer.succeed(EnvironmentLinks.EnvironmentLinks, {
       upsert: () => Effect.void,
+      updateLabel: () => Effect.void,
+      recordEnvironmentLabel: () => Effect.void,
       listDeliveryUsersForEnvironment: (input) =>
         Effect.sync(() =>
           current.linked && !current.revokedEnvironments.includes(input.environmentId)
diff --git a/infra/relay/src/agentActivity/MobileRegistrations.test.ts b/infra/relay/src/agentActivity/MobileRegistrations.test.ts
index 6f5997c931bdb..07b0c6477bf66 100644
--- a/infra/relay/src/agentActivity/MobileRegistrations.test.ts
+++ b/infra/relay/src/agentActivity/MobileRegistrations.test.ts
@@ -118,6 +118,8 @@ function makeEnvironmentLinks(
     getForUser: () => Effect.succeed(null),
     findActiveManagedForEnvironment: () => Effect.succeed([]),
     setHoldWebhooksWhileOffline: () => Effect.void,
+    updateLabel: () => Effect.void,
+    recordEnvironmentLabel: () => Effect.void,
     revokeForUser: () => Effect.succeed(false),
     ...overrides,
   };
diff --git a/infra/relay/src/environments/EnvironmentConnector.test.ts b/infra/relay/src/environments/EnvironmentConnector.test.ts
index 5eba9de86cc0d..ac45f221c0b8e 100644
--- a/infra/relay/src/environments/EnvironmentConnector.test.ts
+++ b/infra/relay/src/environments/EnvironmentConnector.test.ts
@@ -14,13 +14,16 @@ import {
 } from "@t3tools/contracts/relay";
 import { describe, expect, it } from "@effect/vitest";
 import * as DateTime from "effect/DateTime";
+import * as Deferred from "effect/Deferred";
 import { RELAY_HEALTH_RESPONSE_TYP, RELAY_MINT_RESPONSE_TYP } from "@t3tools/shared/relayJwt";
 import * as Effect from "effect/Effect";
+import * as Fiber from "effect/Fiber";
 import * as Layer from "effect/Layer";
 import * as Redacted from "effect/Redacted";
 import * as Result from "effect/Result";
 import * as Schema from "effect/Schema";
 import * as Tracer from "effect/Tracer";
+import * as TestClock from "effect/testing/TestClock";
 import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/http";
 
 import * as EnvironmentLinks from "./EnvironmentLinks.ts";
@@ -228,6 +231,8 @@ function makeLinks(
       }),
     findActiveManagedForEnvironment: () => Effect.succeed([]),
     setHoldWebhooksWhileOffline: () => Effect.void,
+    updateLabel: () => Effect.void,
+    recordEnvironmentLabel: () => Effect.void,
     revokeForUser: () => Effect.succeed(false),
   };
 }
@@ -273,6 +278,227 @@ describe("EnvironmentConnector", () => {
     }).pipe(Effect.provide(layerConnectorTest(execute)));
   });
 
+  it.effect.each([
+    { persistenceFails: false, storedLabel: "Connector Test Environment" },
+    { persistenceFails: true, storedLabel: "Connector Test Environment" },
+    { persistenceFails: false, storedLabel: "Studio Mac" },
+    { persistenceFails: true, storedLabel: "Studio Mac" },
+  ])(
+    "records the verified label, timestamp and captured key, retaining health on persistence failure: %s",
+    ({ persistenceFails, storedLabel }) => {
+      const updates: Array<
+        Parameters<EnvironmentLinks.EnvironmentLinks["Service"]["updateLabel"]>[0]
+      > = [];
+      const execute = (request: HttpClientRequest.HttpClientRequest) =>
+        Effect.sync(() => {
+          const healthRequest = decodeHealthRequestBody(requestBodyText(request));
+          return HttpClientResponse.fromWeb(
+            request,
+            Response.json(
+              signHealthResponse(
+                healthRequest,
+                environmentKeyPair.privateKey,
+                {},
+                {
+                  descriptor: {
+                    environmentId: "env-connector-test" as never,
+                    label: "Studio Mac",
+                    platform: { os: "darwin", arch: "arm64" },
+                    serverVersion: "0.0.0-test",
+                    capabilities: { repositoryIdentity: true },
+                  },
+                },
+              ),
+              { status: 200 },
+            ),
+          );
+        });
+      const links = makeLinks({ label: storedLabel });
+
+      return Effect.gen(function* () {
+        const connector = yield* EnvironmentConnector.EnvironmentConnector;
+        const result = yield* connector.status({
+          userId: "user_123",
+          environmentId: "env-connector-test",
+        });
+
+        expect(result.descriptor?.label).toBe("Studio Mac");
+        expect(updates).toEqual([
+          {
+            userId: "user_123",
+            environmentId: "env-connector-test",
+            environmentPublicKey: environmentKeyPair.publicKey,
+            label: "Studio Mac",
+            checkedAt: expect.any(String),
+          },
+        ]);
+      }).pipe(
+        Effect.provide(
+          layerConnectorTest(execute, {
+            links: {
+              ...links,
+              updateLabel: (input) =>
+                Effect.gen(function* () {
+                  updates.push(input);
+                  if (persistenceFails) {
+                    return yield* new EnvironmentLinks.EnvironmentLinkLabelUpdatePersistenceError({
+                      environmentId: input.environmentId,
+                      cause: new Error("database unavailable"),
+                    });
+                  }
+                }),
+            },
+          }),
+        ),
+      );
+    },
+  );
+
+  it.effect("persists a verified rename using relay time when the host clock is behind", () => {
+    const relayCheckedAt = "2026-08-20T12:00:30.000Z";
+    const hostCheckedAt = "2026-08-20T12:00:00.000Z";
+    const linkedAt = "2026-08-20T12:00:20.000Z";
+    const updates: Array<
+      Parameters<EnvironmentLinks.EnvironmentLinks["Service"]["updateLabel"]>[0]
+    > = [];
+    const execute = (request: HttpClientRequest.HttpClientRequest) =>
+      Effect.sync(() => {
+        const healthRequest = decodeHealthRequestBody(requestBodyText(request));
+        const requestProof = decodeRequestProof<RelayCloudEnvironmentHealthProofPayload>(
+          healthRequest.proof,
+        );
+        const response = signHealthResponse(healthRequest);
+        return HttpClientResponse.fromWeb(
+          request,
+          Response.json(
+            signHealthResponse(
+              healthRequest,
+              environmentKeyPair.privateKey,
+              {},
+              {
+                iat: requestProof.iat - 30,
+                exp: requestProof.exp - 30,
+                checkedAt: hostCheckedAt,
+                descriptor: { ...response.descriptor, label: "Studio Mac" },
+              },
+            ),
+            { status: 200 },
+          ),
+        );
+      });
+
+    return Effect.gen(function* () {
+      yield* TestClock.setTime(Date.parse(relayCheckedAt));
+      const connector = yield* EnvironmentConnector.EnvironmentConnector;
+      const result = yield* connector.status({
+        userId: "user_123",
+        environmentId: "env-connector-test",
+      });
+      expect(result).toMatchObject({
+        status: "online",
+        checkedAt: hostCheckedAt,
+        descriptor: { label: "Studio Mac" },
+      });
+      expect(updates).toHaveLength(1);
+      expect(updates[0]?.checkedAt).toBe(relayCheckedAt);
+      expect(Date.parse(updates[0]?.checkedAt ?? "")).toBeGreaterThan(Date.parse(linkedAt));
+      expect(Date.parse(hostCheckedAt)).toBeLessThan(Date.parse(linkedAt));
+    }).pipe(
+      Effect.provide(
+        Layer.merge(
+          TestClock.layer(),
+          layerConnectorTest(execute, {
+            links: {
+              ...makeLinks({ linkedAt }),
+              updateLabel: (input) =>
+                Effect.sync(() => {
+                  updates.push(input);
+                }),
+            },
+          }),
+        ),
+      ),
+    );
+  });
+
+  it.effect("orders delayed rename and unchanged reset probes by their relay start time", () =>
+    Effect.gen(function* () {
+      const firstStarted = yield* Deferred.make<void>();
+      const releaseFirst = yield* Deferred.make<void>();
+      const updates: Array<
+        Parameters<EnvironmentLinks.EnvironmentLinks["Service"]["updateLabel"]>[0]
+      > = [];
+      let requests = 0;
+      const execute = (request: HttpClientRequest.HttpClientRequest) =>
+        Effect.gen(function* () {
+          const first = ++requests === 1;
+          const healthRequest = decodeHealthRequestBody(requestBodyText(request));
+          const requestProof = decodeRequestProof<RelayCloudEnvironmentHealthProofPayload>(
+            healthRequest.proof,
+          );
+          const response = signHealthResponse(healthRequest);
+          const checkedAt = DateTime.formatIso(
+            DateTime.makeUnsafe((requestProof.iat + (first ? 30 : -30)) * 1_000),
+          );
+          if (first) {
+            yield* Deferred.succeed(firstStarted, undefined);
+            yield* Deferred.await(releaseFirst);
+          }
+          return HttpClientResponse.fromWeb(
+            request,
+            Response.json(
+              signHealthResponse(
+                healthRequest,
+                environmentKeyPair.privateKey,
+                {},
+                {
+                  checkedAt,
+                  descriptor: {
+                    ...response.descriptor,
+                    label: first ? "Studio Mac" : "Connector Test Environment",
+                  },
+                },
+              ),
+              { status: 200 },
+            ),
+          );
+        });
+      const checks = Effect.gen(function* () {
+        yield* TestClock.setTime(Date.parse("2026-08-20T12:00:30.000Z"));
+        const connector = yield* EnvironmentConnector.EnvironmentConnector;
+        const statusInput = { userId: "user_123", environmentId: "env-connector-test" };
+        const older = yield* connector.status(statusInput).pipe(Effect.forkChild);
+        yield* Deferred.await(firstStarted);
+        yield* TestClock.adjust("5 seconds");
+        const newer = yield* connector.status(statusInput);
+        yield* Deferred.succeed(releaseFirst, undefined);
+        const olderResult = yield* Fiber.join(older);
+        // Completion order and host timestamps both disagree with relay probe order.
+        expect(Date.parse(olderResult.checkedAt)).toBeGreaterThan(Date.parse(newer.checkedAt));
+        expect(updates.map(({ label, checkedAt }) => ({ label, checkedAt }))).toEqual([
+          { label: "Connector Test Environment", checkedAt: "2026-08-20T12:00:35.000Z" },
+          { label: "Studio Mac", checkedAt: "2026-08-20T12:00:30.000Z" },
+        ]);
+      });
+      yield* checks.pipe(
+        Effect.provide(
+          Layer.merge(
+            TestClock.layer(),
+            layerConnectorTest(execute, {
+              links: {
+                ...makeLinks(),
+                updateLabel: (input) =>
+                  Effect.sync(() => {
+                    updates.push(input);
+                  }),
+              },
+            }),
+          ),
+        ),
+      );
+    }),
+  );
+
   it.effect("rejects manual endpoints before sending a health request", () => {
     let requestCount = 0;
     const execute = () =>
diff --git a/infra/relay/src/environments/EnvironmentConnector.ts b/infra/relay/src/environments/EnvironmentConnector.ts
index 09253cc2cf1fd..35a1517449f40 100644
--- a/infra/relay/src/environments/EnvironmentConnector.ts
+++ b/infra/relay/src/environments/EnvironmentConnector.ts
@@ -563,6 +563,25 @@ const make = Effect.gen(function* () {
           operation: "status",
         });
       }
+      // Order persistence by relay probe start time, matching the clock used for link writes.
+      // Record unchanged labels too so a newer reset probe blocks an older rename response.
+      yield* links
+        .updateLabel({
+          userId: input.userId,
+          environmentId: input.environmentId,
+          environmentPublicKey: link.environmentPublicKey,
+          label: decoded.descriptor.label,
+          checkedAt,
+        })
+        .pipe(
+          Effect.tapError((error) =>
+            Effect.logWarning("managed environment label persistence failed", {
+              environmentId: input.environmentId,
+              errorTag: error._tag,
+            }),
+          ),
+          Effect.ignore,
+        );
       return {
         environmentId: link.environmentId,
         endpoint,
diff --git a/infra/relay/src/environments/EnvironmentLinker.test.ts b/infra/relay/src/environments/EnvironmentLinker.test.ts
index 81fbafc55e91e..b393fa3a09c14 100644
--- a/infra/relay/src/environments/EnvironmentLinker.test.ts
+++ b/infra/relay/src/environments/EnvironmentLinker.test.ts
@@ -129,6 +129,8 @@ function layerTest(input?: {
           getForUser: () => Effect.succeed(null),
           findActiveManagedForEnvironment: () => Effect.succeed([]),
           setHoldWebhooksWhileOffline: () => Effect.void,
+          updateLabel: () => Effect.void,
+          recordEnvironmentLabel: () => Effect.void,
           revokeForUser: () => Effect.succeed(false),
         }),
         Layer.succeed(EnvironmentCredentials.EnvironmentCredentials, {
@@ -159,6 +161,7 @@ function layerTest(input?: {
 describe("EnvironmentLinker", () => {
   it.effect("uses verified JWT claims when linking an environment", () => {
     let persistedEnvironmentId: string | null = null;
+    let challengeIssuedAt: string | null = null;
     return Effect.gen(function* () {
       const { request, payload } = yield* makeRequest;
       const linker = yield* EnvironmentLinker.EnvironmentLinker;
@@ -166,12 +169,14 @@ describe("EnvironmentLinker", () => {
       expect(result.environmentId).toBe(payload.environmentId);
       expect(result.environmentCredential).toBe("t3env_credential_secret");
       expect(persistedEnvironmentId).toBe(payload.environmentId);
+      expect(challengeIssuedAt).toBe(DateTime.formatIso(yield* DateTime.now));
     }).pipe(
       Effect.provide(
         layerTest({
           upsert: (input) =>
             Effect.sync(() => {
               persistedEnvironmentId = input.proof.environmentId;
+              challengeIssuedAt = input.challengeIssuedAt;
             }),
         }),
       ),
diff --git a/infra/relay/src/environments/EnvironmentLinker.ts b/infra/relay/src/environments/EnvironmentLinker.ts
index f4789b9429080..1d2321f50876a 100644
--- a/infra/relay/src/environments/EnvironmentLinker.ts
+++ b/infra/relay/src/environments/EnvironmentLinker.ts
@@ -321,7 +321,12 @@ const make = Effect.gen(function* () {
           stage: "validate_endpoint",
         });
       }
-      yield* links.upsert({ ...input, proof: verified, endpoint });
+      yield* links.upsert({
+        ...input,
+        proof: verified,
+        endpoint,
+        challengeIssuedAt: DateTime.formatIso(DateTime.makeUnsafe(challenge.iat * 1_000)),
+      });
       const environmentCredential = yield* credentials.create({
         environmentId: verified.environmentId,
         environmentPublicKey: verified.environmentPublicKey,
diff --git a/infra/relay/src/environments/EnvironmentLinks.test.ts b/infra/relay/src/environments/EnvironmentLinks.test.ts
index 263e3bf11560c..5c7e87f306039 100644
--- a/infra/relay/src/environments/EnvironmentLinks.test.ts
+++ b/infra/relay/src/environments/EnvironmentLinks.test.ts
@@ -1,13 +1,308 @@
 import { describe, expect, it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
+import * as Deferred from "effect/Deferred";
+import * as Fiber from "effect/Fiber";
+import * as FileSystem from "effect/FileSystem";
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import { PGlite } from "@electric-sql/pglite";
+import { drizzle } from "drizzle-orm/pglite";
+import { ne } from "drizzle-orm";
 import * as Layer from "effect/Layer";
+import * as TestClock from "effect/testing/TestClock";
 import { PgDialect } from "drizzle-orm/pg-core";
 
 import * as RelayDb from "../db.ts";
-import { relayEnvironmentLinks } from "../persistence/schema.ts";
+import { relayEnvironmentLinks, relayManagedEndpointAllocations } from "../persistence/schema.ts";
 import * as EnvironmentLinks from "./EnvironmentLinks.ts";
+import * as ManagedTunnelLimits from "./ManagedTunnelLimits.ts";
 
 describe("EnvironmentLinks", () => {
+  it.effect("updates labels only for the user’s verified active link", () => {
+    const updateValues: Array<Record<string, unknown>> = [];
+    const whereConditions: Array<unknown> = [];
+    const fakeDb = {
+      update: (table: unknown) => {
+        expect(table).toBe(relayEnvironmentLinks);
+        return {
+          set: (values: Record<string, unknown>) => {
+            updateValues.push(values);
+            return {
+              where: (condition: unknown) => {
+                whereConditions.push(condition);
+                return Effect.void;
+              },
+            };
+          },
+        };
+      },
+    } as unknown as RelayDb.RelayDb["Service"];
+
+    return Effect.gen(function* () {
+      const links = yield* EnvironmentLinks.EnvironmentLinks;
+      yield* links.updateLabel({
+        userId: "user-1",
+        environmentId: "env-1",
+        environmentPublicKey: "verified-public-key",
+        label: "Studio Mac",
+        checkedAt: "2026-08-20T12:00:00.000Z",
+      });
+
+      expect(updateValues).toHaveLength(1);
+      expect(updateValues[0]?.environmentLabel).toBe("Studio Mac");
+      expect(updateValues[0]).not.toHaveProperty("updatedAt");
+      expect(updateValues[0]?.labelUpdatedAt).toBe("2026-08-20T12:00:00.000Z");
+      expect(whereConditions).toHaveLength(1);
+
+      const query = new PgDialect().sqlToQuery(whereConditions[0] as never);
+      expect(query.sql).toContain('"relay_environment_links"."user_id" = $1');
+      expect(query.sql).toContain('"relay_environment_links"."environment_id" = $2');
+      expect(query.sql).toContain('"relay_environment_links"."environment_public_key" = $3');
+      expect(query.sql).toContain('"relay_environment_links"."revoked_at" is null');
+      expect(query.sql).toContain(
+        'coalesce("relay_environment_links"."label_updated_at", "relay_environment_links"."updated_at") <= $4',
+      );
+      expect(query.params).toEqual([
+        "user-1",
+        "env-1",
+        "verified-public-key",
+        "2026-08-20T12:00:00.000Z",
+      ]);
+    }).pipe(
+      Effect.provide(
+        EnvironmentLinks.layer.pipe(Layer.provide(Layer.succeed(RelayDb.RelayDb, fakeDb))),
+      ),
+    );
+  });
+
+  it.effect("updates every user’s link to the key when the environment pushes its label", () => {
+    const whereConditions: Array<unknown> = [];
+    const fakeDb = {
+      update: () => ({
+        set: () => ({
+          where: (condition: unknown) => {
+            whereConditions.push(condition);
+            return Effect.void;
+          },
+        }),
+      }),
+    } as unknown as RelayDb.RelayDb["Service"];
+
+    return Effect.gen(function* () {
+      const links = yield* EnvironmentLinks.EnvironmentLinks;
+      yield* links.recordEnvironmentLabel({
+        environmentId: "env-1",
+        environmentPublicKey: "verified-public-key",
+        label: "Studio Mac",
+      });
+
+      // Stamped with relay time (the test clock starts at the epoch).
+      const query = new PgDialect().sqlToQuery(whereConditions[0] as never);
+      expect(query.sql).not.toContain("user_id");
+      expect(query.sql).toContain('"relay_environment_links"."environment_public_key" = $2');
+      expect(query.sql).toContain(
+        'coalesce("relay_environment_links"."label_updated_at", "relay_environment_links"."updated_at") <= $3',
+      );
+      expect(query.params).toEqual(["env-1", "verified-public-key", "1970-01-01T00:00:00.000Z"]);
+    }).pipe(
+      Effect.provide(
+        EnvironmentLinks.layer.pipe(Layer.provide(Layer.succeed(RelayDb.RelayDb, fakeDb))),
+      ),
+    );
+  });
+  it.effect(
+    "renames disabled links without withdrawing newer tunnels or accepting stale labels",
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const pg = yield* Effect.acquireRelease(
+          Effect.promise(() => PGlite.create()),
+          (client) => Effect.promise(() => client.close()),
+        );
+        const migrationsDir = new URL("../../migrations/postgres/", import.meta.url).pathname;
+        for (const name of (yield* fs.readDirectory(migrationsDir)).toSorted()) {
+          const migration = yield* fs.readFileString(`${migrationsDir}${name}/migration.sql`);
+          yield* Effect.promise(() => pg.exec(migration));
+        }
+        const at = (minute: number) => `2026-10-28T12:${minute}:00.000Z`;
+        yield* Effect.promise(() =>
+          pg.query(
+            `
+        insert into relay_environment_links
+          (user_id, environment_id, environment_public_key, endpoint_http_base_url,
+           endpoint_ws_base_url, endpoint_provider_kind, managed_tunnels_enabled, created_at, updated_at)
+          values ('user-1', 'env-1', 'key', 'https://e', 'wss://e', 'direct', false, $1, $1)
+      `,
+            [at(10)],
+          ),
+        );
+        yield* Effect.promise(() =>
+          pg.query(
+            `
+        insert into relay_managed_endpoint_allocations
+          (user_id, environment_id, hostname, tunnel_id, tunnel_name, created_at, updated_at)
+          values ('user-1', 'env-1', 'host', 'live-tunnel', 'tunnel', $1, $1)
+      `,
+            [at(20)],
+          ),
+        );
+        const database = drizzle({ client: pg });
+        const insertion = database.insert(relayEnvironmentLinks);
+        const updating = database.update(relayEnvironmentLinks);
+        const pushStarted = yield* Deferred.make<void>();
+        const releasePush = yield* Deferred.make<void>();
+        const db = {
+          insert: () => ({
+            values: (values: Parameters<typeof insertion.values>[0]) => ({
+              onConflictDoUpdate: (
+                conflict: Parameters<ReturnType<typeof insertion.values>["onConflictDoUpdate"]>[0],
+              ) =>
+                Effect.promise(() =>
+                  database
+                    .insert(relayEnvironmentLinks)
+                    .values(values)
+                    .onConflictDoUpdate(conflict),
+                ),
+            }),
+          }),
+          update: () => ({
+            set: (values: Parameters<typeof updating.set>[0]) => ({
+              where: (condition: Parameters<ReturnType<typeof updating.set>["where"]>[0]) =>
+                Effect.gen(function* () {
+                  if (values.environmentLabel === "In-flight name") {
+                    yield* Deferred.succeed(pushStarted, undefined);
+                    yield* Deferred.await(releasePush);
+                  }
+                  return yield* Effect.promise(() =>
+                    database.update(relayEnvironmentLinks).set(values).where(condition),
+                  );
+                }),
+            }),
+          }),
+        } as unknown as RelayDb.RelayDb["Service"];
+        const links = yield* EnvironmentLinks.EnvironmentLinks.pipe(
+          Effect.provide(
+            EnvironmentLinks.layer.pipe(Layer.provide(Layer.succeed(RelayDb.RelayDb, db))),
+          ),
+        );
+        for (const [minute, key, label] of [
+          [30, "key", "Latest name"],
+          [25, "key", "Stale status"],
+          [40, "wrong-key", "Unverified name"],
+        ] as const) {
+          yield* links.updateLabel({
+            userId: "user-1",
+            environmentId: "env-1",
+            environmentPublicKey: key,
+            label,
+            checkedAt: at(minute),
+          });
+        }
+        const rows = yield* Effect.promise(() => database.select().from(relayEnvironmentLinks));
+        expect(rows[0]).toMatchObject({
+          environmentLabel: "Latest name",
+          updatedAt: at(10),
+          labelUpdatedAt: at(30),
+        });
+        const counted = yield* Effect.promise(() =>
+          database
+            .select({ environmentId: relayManagedEndpointAllocations.environmentId })
+            .from(relayManagedEndpointAllocations)
+            .where(
+              ManagedTunnelLimits.countedAllocations({
+                userId: "user-1",
+                environmentId: "other",
+                pendingCutoff: at(45),
+                environment: ne,
+              }),
+            ),
+        );
+        expect(counted).toEqual([{ environmentId: "env-1" }]);
+        yield* TestClock.setTime(Date.parse(at(40)));
+        for (const [challengeAt, key, proofLabel, expectedLabel, expectedWatermark] of [
+          [20, "key", "Stale link proof", "Latest name", 30],
+          [35, "key", "Fresh link proof", "Fresh link proof", 35],
+          [15, "replacement-key", "Replacement host", "Replacement host", 15],
+        ] as const) {
+          yield* links.upsert({
+            userId: "user-1",
+            challengeIssuedAt: at(challengeAt),
+            request: {
+              notificationsEnabled: false,
+              liveActivitiesEnabled: false,
+              managedTunnelsEnabled: false,
+            } as never,
+            proof: {
+              environmentId: "env-1",
+              environmentPublicKey: key,
+              iat: Date.parse(at(55)) / 1_000,
+              descriptor: { label: proofLabel },
+            } as never,
+            endpoint: {
+              httpBaseUrl: "https://e",
+              wsBaseUrl: "wss://e",
+              providerKind: "direct",
+            } as never,
+          });
+          const [linked] = yield* Effect.promise(() =>
+            database.select().from(relayEnvironmentLinks),
+          );
+          expect(linked).toMatchObject({
+            environmentLabel: expectedLabel,
+            labelUpdatedAt: at(expectedWatermark),
+            environmentPublicKey: key,
+            updatedAt: at(40),
+          });
+        }
+        yield* Effect.promise(() =>
+          database.update(relayEnvironmentLinks).set({
+            environmentPublicKey: "key",
+            environmentLabel: "Before rename",
+            labelUpdatedAt: at(41),
+            updatedAt: at(41),
+          }),
+        );
+        yield* TestClock.setTime(Date.parse(at(45)));
+        const inFlightPush = yield* links
+          .recordEnvironmentLabel({
+            environmentId: "env-1",
+            environmentPublicKey: "key",
+            label: "In-flight name",
+          })
+          .pipe(Effect.forkChild);
+        yield* Deferred.await(pushStarted);
+        yield* TestClock.setTime(Date.parse(at(50)));
+        yield* links.upsert({
+          userId: "user-1",
+          challengeIssuedAt: at(42),
+          request: {
+            notificationsEnabled: false,
+            liveActivitiesEnabled: false,
+            managedTunnelsEnabled: false,
+          } as never,
+          proof: {
+            environmentId: "env-1",
+            environmentPublicKey: "key",
+            descriptor: { label: "Old proof" },
+          } as never,
+          endpoint: {
+            httpBaseUrl: "https://e",
+            wsBaseUrl: "wss://e",
+            providerKind: "direct",
+          } as never,
+        });
+        yield* Deferred.succeed(releasePush, undefined);
+        yield* Fiber.join(inFlightPush);
+        const [afterRace] = yield* Effect.promise(() =>
+          database.select().from(relayEnvironmentLinks),
+        );
+        expect(afterRace).toMatchObject({
+          environmentLabel: "In-flight name",
+          labelUpdatedAt: at(45),
+          updatedAt: at(50),
+        });
+      }).pipe(Effect.provide(NodeServices.layer)),
+  );
+
   it.effect("carries the webhook-hold opt-in over only from links with the same key", () => {
     const inserted: Array<Record<string, unknown>> = [];
     const fakeDb = {
@@ -23,6 +318,7 @@ describe("EnvironmentLinks", () => {
       const links = yield* EnvironmentLinks.EnvironmentLinks;
       yield* links.upsert({
         userId: "user-1",
+        challengeIssuedAt: "1970-01-01T00:00:00.000Z",
         request: {
           notificationsEnabled: false,
           liveActivitiesEnabled: false,
diff --git a/infra/relay/src/environments/EnvironmentLinks.ts b/infra/relay/src/environments/EnvironmentLinks.ts
index b7b38f202a1a5..99081af776b4b 100644
--- a/infra/relay/src/environments/EnvironmentLinks.ts
+++ b/infra/relay/src/environments/EnvironmentLinks.ts
@@ -9,7 +9,7 @@ import * as DateTime from "effect/DateTime";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Schema from "effect/Schema";
-import { and, eq, isNull, or, sql } from "drizzle-orm";
+import { and, eq, isNull, lte, or, sql } from "drizzle-orm";
 
 import * as RelayDb from "../db.ts";
 import { relayEnvironmentLinks } from "../persistence/schema.ts";
@@ -87,6 +87,18 @@ export class EnvironmentLinkEnvironmentLookupPersistenceError extends Schema.Tag
   }
 }
 
+export class EnvironmentLinkLabelUpdatePersistenceError extends Schema.TaggedError<EnvironmentLinkLabelUpdatePersistenceError>()(
+  "EnvironmentLinkLabelUpdatePersistenceError",
+  {
+    environmentId: Schema.String,
+    cause: Schema.Defect(),
+  },
+) {
+  override get message(): string {
+    return `Failed to update the label for environment '${this.environmentId}'`;
+  }
+}
+
 export class EnvironmentLinkRevokePersistenceError extends Schema.TaggedError<EnvironmentLinkRevokePersistenceError>()(
   "EnvironmentLinkRevokePersistenceError",
   {
@@ -107,6 +119,7 @@ export class EnvironmentLinks extends Context.Service<
       readonly userId: string;
       readonly request: RelayEnvironmentLinkRequest;
       readonly proof: RelayEnvironmentLinkProofPayload;
+      readonly challengeIssuedAt: string;
       readonly endpoint: RelayManagedEndpoint;
     }) => Effect.Effect<void, EnvironmentLinkUpsertPersistenceError>;
     readonly listDeliveryUsersForEnvironment: (input: {
@@ -145,6 +158,23 @@ export class EnvironmentLinks extends Context.Service<
       readonly environmentPublicKey: string;
       readonly holdWebhooksWhileOffline: boolean;
     }) => Effect.Effect<void, EnvironmentLinkEnvironmentLookupPersistenceError>;
+    readonly updateLabel: (input: {
+      readonly userId: string;
+      readonly environmentId: string;
+      readonly environmentPublicKey: string;
+      readonly label: string;
+      readonly checkedAt: string;
+    }) => Effect.Effect<void, EnvironmentLinkLabelUpdatePersistenceError>;
+    /**
+     * Stores a label the environment pushed on every active link to its
+     * verified key, stamped with relay time so an earlier status probe cannot
+     * restore the previous name.
+     */
+    readonly recordEnvironmentLabel: (input: {
+      readonly environmentId: string;
+      readonly environmentPublicKey: string;
+      readonly label: string;
+    }) => Effect.Effect<void, EnvironmentLinkLabelUpdatePersistenceError>;
     readonly revokeForUser: (input: {
       readonly userId: string;
       readonly environmentId: string;
@@ -170,6 +200,46 @@ function agentAwarenessDeliveryUserKeyCondition(input: {
 const make = Effect.gen(function* () {
   const db = yield* RelayDb.RelayDb;
 
+  const updateLinkLabels = Effect.fn("relay.environment_links.update_label")(function* (input: {
+    readonly userId?: string;
+    readonly environmentId: string;
+    readonly environmentPublicKey: string;
+    readonly label: string;
+    readonly checkedAt: string;
+  }) {
+    yield* Effect.annotateCurrentSpan({
+      "relay.environment_id": input.environmentId,
+    });
+    yield* db
+      .update(relayEnvironmentLinks)
+      .set({
+        environmentLabel: input.label,
+        // Link updatedAt also determines tunnel withdrawal; a rename must not advance it.
+        labelUpdatedAt: input.checkedAt,
+      })
+      .where(
+        and(
+          input.userId === undefined ? undefined : eq(relayEnvironmentLinks.userId, input.userId),
+          eq(relayEnvironmentLinks.environmentId, input.environmentId),
+          eq(relayEnvironmentLinks.environmentPublicKey, input.environmentPublicKey),
+          isNull(relayEnvironmentLinks.revokedAt),
+          lte(
+            sql<string>`coalesce(${relayEnvironmentLinks.labelUpdatedAt}, ${relayEnvironmentLinks.updatedAt})`,
+            input.checkedAt,
+          ),
+        ),
+      )
+      .pipe(
+        Effect.mapError(
+          (cause) =>
+            new EnvironmentLinkLabelUpdatePersistenceError({
+              environmentId: input.environmentId,
+              cause,
+            }),
+        ),
+      );
+  });
+
   return EnvironmentLinks.of({
     upsert: Effect.fn("relay.environment_links.upsert")(function* (input) {
       yield* Effect.annotateCurrentSpan({
@@ -178,6 +248,10 @@ const make = Effect.gen(function* () {
       const now = DateTime.formatIso(yield* DateTime.now);
       const { request, proof } = input;
       const environmentId = proof.environmentId;
+      // Use the relay challenge as the proof's label watermark: completing a relink must
+      // not outrank a newer push that is already in flight, or depend on the host clock.
+      const keepPushedLabel = sql<boolean>`${relayEnvironmentLinks.environmentPublicKey} = ${proof.environmentPublicKey}
+        AND ${relayEnvironmentLinks.labelUpdatedAt} >= ${input.challengeIssuedAt}`;
       // Inherit opt-in only from links proven by the same key; anyone can claim the public environment id.
       const inheritedHoldWebhooks = sql<boolean>`EXISTS (
         SELECT 1 FROM ${relayEnvironmentLinks} AS other
@@ -194,6 +268,7 @@ const make = Effect.gen(function* () {
           environmentId,
           holdWebhooksWhileOffline: inheritedHoldWebhooks,
           environmentLabel: proof.descriptor.label,
+          labelUpdatedAt: input.challengeIssuedAt,
           environmentPublicKey: proof.environmentPublicKey,
           endpointHttpBaseUrl: endpoint.httpBaseUrl,
           endpointWsBaseUrl: endpoint.wsBaseUrl,
@@ -210,7 +285,8 @@ const make = Effect.gen(function* () {
           target: [relayEnvironmentLinks.userId, relayEnvironmentLinks.environmentId],
           set: {
             environmentPublicKey: proof.environmentPublicKey,
-            environmentLabel: proof.descriptor.label,
+            environmentLabel: sql`CASE WHEN ${keepPushedLabel} THEN ${relayEnvironmentLinks.environmentLabel} ELSE ${proof.descriptor.label} END`,
+            labelUpdatedAt: sql`CASE WHEN ${keepPushedLabel} THEN ${relayEnvironmentLinks.labelUpdatedAt} ELSE ${input.challengeIssuedAt} END`,
             endpointHttpBaseUrl: endpoint.httpBaseUrl,
             endpointWsBaseUrl: endpoint.wsBaseUrl,
             endpointProviderKind: endpoint.providerKind,
@@ -445,6 +521,15 @@ const make = Effect.gen(function* () {
         );
     }),
 
+    updateLabel: updateLinkLabels,
+
+    recordEnvironmentLabel: Effect.fn("relay.environment_links.record_environment_label")(
+      function* (input) {
+        const checkedAt = DateTime.formatIso(yield* DateTime.now);
+        yield* updateLinkLabels({ ...input, checkedAt });
+      },
+    ),
+
     revokeForUser: Effect.fn("relay.environment_links.revoke_for_user")(function* (input) {
       yield* Effect.annotateCurrentSpan({
         "relay.environment_id": input.environmentId,
diff --git a/infra/relay/src/http/Api.test.ts b/infra/relay/src/http/Api.test.ts
index e6db7fc8b7aa0..f52655317e666 100644
--- a/infra/relay/src/http/Api.test.ts
+++ b/infra/relay/src/http/Api.test.ts
@@ -540,6 +540,8 @@ function layerRelayUnlinkTest(input?: {
         getForUser: input?.getForUser ?? (() => Effect.succeed(null)),
         findActiveManagedForEnvironment: () => Effect.die("unused findActiveManagedForEnvironment"),
         setHoldWebhooksWhileOffline: () => Effect.die("unused setHoldWebhooksWhileOffline"),
+        updateLabel: () => Effect.die("unused updateLabel"),
+        recordEnvironmentLabel: () => Effect.die("unused recordEnvironmentLabel"),
         revokeForUser: input?.revokeForUser ?? (() => Effect.succeed(false)),
       }),
     ),
@@ -1416,7 +1418,12 @@ describe("relay routing fallback", () => {
                 Layer.mock(ManagedEndpointProvider.ManagedEndpointProvider, {}),
               ),
             ),
-            Layer.provide([layerPublisher, layerSignatures, Layer.mock(HeldHooks.HeldHooks, {})]),
+            Layer.provide([
+              layerPublisher,
+              layerSignatures,
+              Layer.mock(HeldHooks.HeldHooks, {}),
+              Layer.mock(EnvironmentLinks.EnvironmentLinks, {}),
+            ]),
           ),
         ),
         Layer.provide(layerAuth),
@@ -1460,6 +1467,78 @@ describe("relay routing fallback", () => {
       expect(verified.map((input) => input.threadId)).toEqual(threadIds);
     }).pipe(Effect.scoped),
   );
+
+  it.effect("stores a pushed label only for the authenticated environment's key", () =>
+    Effect.gen(function* () {
+      const updates: Array<
+        Parameters<EnvironmentLinks.EnvironmentLinks["Service"]["recordEnvironmentLabel"]>[0]
+      > = [];
+      const layerAuth = Layer.succeed(RelayEnvironmentAuth, {
+        environmentBearer: (effect) =>
+          effect.pipe(
+            Effect.provideService(RelayEnvironmentPrincipal, {
+              environmentId: "environment-1",
+              environmentPublicKey: "environment-public-key",
+            }),
+          ),
+      });
+      const layerRoutes = HttpApiBuilder.layer(
+        HttpApi.make("RelayApi").add(RelayApi.groups.server),
+      ).pipe(
+        Layer.provide(
+          RelayHttpApi.layerServerApi.pipe(
+            HttpRouter.provideRequest(
+              Layer.mergeAll(
+                Layer.succeed(RelayConfiguration.RelayConfiguration, relaySettings),
+                Layer.mock(EnvironmentLinks.EnvironmentLinks, {}),
+                Layer.mock(ManagedEndpointAllocations.ManagedEndpointAllocations, {}),
+                Layer.mock(ManagedEndpointProvider.ManagedEndpointProvider, {}),
+              ),
+            ),
+            Layer.provide([
+              Layer.mock(AgentActivityPublisher.AgentActivityPublisher, {}),
+              Layer.mock(EnvironmentPublishSignatures.EnvironmentPublishSignatures, {}),
+              Layer.mock(HeldHooks.HeldHooks, {}),
+              Layer.mock(EnvironmentLinks.EnvironmentLinks, {
+                recordEnvironmentLabel: (input) => Effect.sync(() => void updates.push(input)),
+              }),
+            ]),
+          ),
+        ),
+        Layer.provide(layerAuth),
+        Layer.provide([NodeServices.layer, NodeHttpPlatform.layer, Etag.layerWeak]),
+      );
+      const httpEffect = yield* HttpRouter.toHttpEffect(layerRoutes).pipe(
+        Effect.provideService(HttpRouter.RouterConfig, RELAY_HTTP_ROUTER_CONFIG),
+      );
+      const put = (environmentId: string) =>
+        httpEffect.pipe(
+          Effect.provideService(
+            HttpServerRequest.HttpServerRequest,
+            HttpServerRequest.fromWeb(
+              new Request(`https://relay.test/v1/environments/${environmentId}/label`, {
+                method: "PUT",
+                headers: {
+                  authorization: "Bearer environment-credential",
+                  "content-type": "application/json",
+                },
+                body: '{"label":"Studio Mac"}',
+              }),
+            ),
+          ),
+        );
+
+      expect((yield* put("environment-1")).status).toBe(200);
+      expect((yield* put("environment-2")).status).toBe(401);
+      expect(updates).toEqual([
+        {
+          environmentId: "environment-1",
+          environmentPublicKey: "environment-public-key",
+          label: "Studio Mac",
+        },
+      ]);
+    }).pipe(Effect.scoped),
+  );
 });
 
 describe("relay CORS", () => {
diff --git a/infra/relay/src/http/Api.ts b/infra/relay/src/http/Api.ts
index 390f3c18f785f..3ebd746dfb0f5 100644
--- a/infra/relay/src/http/Api.ts
+++ b/infra/relay/src/http/Api.ts
@@ -1216,6 +1216,7 @@ export const layerServerApi = HttpApiBuilder.group(
     const publisher = yield* AgentActivityPublisher.AgentActivityPublisher;
     const publishSignatures = yield* EnvironmentPublishSignatures.EnvironmentPublishSignatures;
     const heldHooks = yield* HeldHooks.HeldHooks;
+    const links = yield* EnvironmentLinks.EnvironmentLinks;
     const requireOwnEnvironment =
       /* Request instrumentation already owns the span; keep this helper in that context. */
       Effect.fnUntraced(function* (environmentId: string) {
@@ -1443,6 +1444,19 @@ export const layerServerApi = HttpApiBuilder.group(
           return payload;
         }, mapRelayCommonApiErrors("not_authorized")),
       )
+      .handle(
+        "updateEnvironmentLabel",
+        Effect.fn("relay.api.server.updateEnvironmentLabel")(function* ({ params, payload }) {
+          yield* requireOwnEnvironment(params.environmentId);
+          const principal = yield* RelayEnvironmentPrincipal;
+          yield* links.recordEnvironmentLabel({
+            environmentId: params.environmentId,
+            environmentPublicKey: principal.environmentPublicKey,
+            label: payload.label,
+          });
+          return { ok: true as const };
+        }, mapRelayCommonApiErrors("not_authorized")),
+      )
       .handle(
         "wakeHeldHooks",
         Effect.fn("relay.api.server.wakeHeldHooks")(function* ({ params }) {
@@ -1497,6 +1511,7 @@ const RelayCommonPersistenceError = Schema.Union([
   LiveActivities.LiveActivityDeliveryMarkPersistenceError,
   DeliveryAttempts.DeliveryAttemptRecordPersistenceError,
   EnvironmentLinks.EnvironmentLinkEnvironmentLookupPersistenceError,
+  EnvironmentLinks.EnvironmentLinkLabelUpdatePersistenceError,
   HookInbox.HookInboxError,
 ]);
 type RelayCommonPersistenceError = typeof RelayCommonPersistenceError.Type;
diff --git a/infra/relay/src/persistence/schema.ts b/infra/relay/src/persistence/schema.ts
index 0a15473776df9..0d5f00beb8ae5 100644
--- a/infra/relay/src/persistence/schema.ts
+++ b/infra/relay/src/persistence/schema.ts
@@ -68,6 +68,7 @@ export const relayEnvironmentLinks = pgTable(
     userId: varchar("user_id", { length: 191 }).notNull(),
     environmentId: varchar("environment_id", { length: 191 }).notNull(),
     environmentLabel: text("environment_label").notNull().default("T3 Environment"),
+    labelUpdatedAt: varchar("label_updated_at", { length: 64 }),
     environmentPublicKey: text("environment_public_key").notNull(),
     endpointHttpBaseUrl: text("endpoint_http_base_url").notNull(),
     endpointWsBaseUrl: text("endpoint_ws_base_url").notNull(),
diff --git a/packages/client-runtime/src/connection/driver.ts b/packages/client-runtime/src/connection/driver.ts
index 6039f25fa99d6..a0f03fa69b5e2 100644
--- a/packages/client-runtime/src/connection/driver.ts
+++ b/packages/client-runtime/src/connection/driver.ts
@@ -133,7 +133,7 @@ export const connectOverRoutes = Effect.fn("ConnectionDriver.connectOverRoutes")
       blocked ??
       new ConnectionTransientError({
         reason: "endpoint-unavailable",
-        detail: `${entry.target.label} did not answer on any saved route.`,
+        detail: "The environment did not answer on any saved route.",
       })
   );
 });
diff --git a/packages/client-runtime/src/connection/presentation.test.ts b/packages/client-runtime/src/connection/presentation.test.ts
index 2a27148fcd613..3bb841adfb67a 100644
--- a/packages/client-runtime/src/connection/presentation.test.ts
+++ b/packages/client-runtime/src/connection/presentation.test.ts
@@ -1,4 +1,4 @@
-import { EnvironmentId } from "@t3tools/contracts";
+import { EnvironmentId, type ServerConfig } from "@t3tools/contracts";
 import { describe, expect, it } from "@effect/vitest";
 import * as Option from "effect/Option";
 
@@ -11,9 +11,15 @@ import {
   BearerConnectionTarget,
   ConnectionTransientError,
   RelayConnectionTarget,
+  PrimaryConnectionTarget,
+  SshConnectionTarget,
   type SupervisorConnectionState,
 } from "./model.ts";
-import { environmentMcpUrl, presentConnectionState } from "./presentation.ts";
+import {
+  environmentDisplayLabel,
+  environmentMcpUrl,
+  presentConnectionState,
+} from "./presentation.ts";
 
 const TARGET = new BearerConnectionTarget({
   environmentId: EnvironmentId.make("environment-1"),
@@ -50,6 +56,51 @@ function supervisorState(overrides: Partial<SupervisorConnectionState>): Supervi
 }
 
 describe("connection presentation", () => {
+  it("preserves manual aliases across live host changes and alternate relay routes", () => {
+    const config = { environment: { label: "Shared host" } } as ServerConfig;
+    const relay = new RelayConnectionTarget({
+      environmentId: TARGET.environmentId,
+      label: "Connect host",
+    });
+    const entry = {
+      ...ENTRY,
+      alternateRoutes: [
+        { target: TARGET, profile: ENTRY.profile },
+        { target: relay, profile: Option.none() },
+      ],
+    };
+    expect(environmentDisplayLabel(entry, config)).toBe("Remote environment");
+    expect(
+      environmentDisplayLabel(
+        {
+          ...ENTRY,
+          target: new SshConnectionTarget({
+            environmentId: TARGET.environmentId,
+            label: "SSH alias",
+            connectionId: "ssh",
+          }),
+        },
+        config,
+      ),
+    ).toBe("SSH alias");
+    expect(environmentDisplayLabel({ ...ENTRY, target: relay }, config)).toBe("Shared host");
+    expect(environmentDisplayLabel({ ...ENTRY, target: relay }, null)).toBe("Connect host");
+    expect(
+      environmentDisplayLabel(
+        {
+          ...ENTRY,
+          target: new PrimaryConnectionTarget({
+            environmentId: TARGET.environmentId,
+            label: "Local host",
+            httpBaseUrl: "http://localhost",
+            wsBaseUrl: "ws://localhost",
+          }),
+        },
+        config,
+      ),
+    ).toBe("Shared host");
+  });
+
   it("copies the MCP address of the route this device is connected over", () => {
     const route = (connectionId: string, httpBaseUrl: string): ConnectionRoute => {
       const target = new BearerConnectionTarget({ ...TARGET, connectionId });
diff --git a/packages/client-runtime/src/connection/presentation.ts b/packages/client-runtime/src/connection/presentation.ts
index c579f9587a3df..239688bffc56f 100644
--- a/packages/client-runtime/src/connection/presentation.ts
+++ b/packages/client-runtime/src/connection/presentation.ts
@@ -33,6 +33,8 @@ export interface EnvironmentPresentation {
   readonly serverConfig: EnvironmentServerConfig | null;
 }
 
+export { environmentDisplayLabel } from "@t3tools/shared/environmentDisplayLabel";
+
 export function presentConnectionState(
   state: SupervisorConnectionState,
 ): EnvironmentConnectionPresentation {
diff --git a/packages/client-runtime/src/connection/registry.ts b/packages/client-runtime/src/connection/registry.ts
index 12f8aa5ec505f..25d798cd223d7 100644
--- a/packages/client-runtime/src/connection/registry.ts
+++ b/packages/client-runtime/src/connection/registry.ts
@@ -553,7 +553,8 @@ export const make = Effect.gen(function* () {
     ) {
       return yield* new ConnectionBlockedError({
         reason: "configuration",
-        detail: `That address claims to be ${saved.target.label}, which is already saved. Add it as a route from that environment's settings instead.`,
+        detail:
+          "That address belongs to an environment that is already saved. Add it as a route from that environment’s settings instead.",
       });
     }
   });
diff --git a/packages/client-runtime/src/connection/supervisor.test.ts b/packages/client-runtime/src/connection/supervisor.test.ts
index 66d151043b115..1e11dc463c923 100644
--- a/packages/client-runtime/src/connection/supervisor.test.ts
+++ b/packages/client-runtime/src/connection/supervisor.test.ts
@@ -388,7 +388,7 @@ describe("EnvironmentSupervisor", () => {
         lastFailure: {
           _tag: "ConnectionTransientError",
           reason: "transport",
-          message: "Test environment connection failed unexpectedly.",
+          message: "The environment connection failed unexpectedly.",
         },
       });
 
@@ -488,7 +488,7 @@ describe("EnvironmentSupervisor", () => {
         lastFailure: {
           _tag: "ConnectionTransientError",
           reason: "timeout",
-          message: "Test environment did not respond during connection setup.",
+          message: "The environment did not respond during connection setup.",
         },
       });
       expect(yield* Ref.get(harness.prepareCount)).toBe(1);
diff --git a/packages/client-runtime/src/connection/supervisor.ts b/packages/client-runtime/src/connection/supervisor.ts
index 212381921961b..aba8a6c0af9da 100644
--- a/packages/client-runtime/src/connection/supervisor.ts
+++ b/packages/client-runtime/src/connection/supervisor.ts
@@ -216,7 +216,6 @@ function connectingState(
 }
 
 function failureFromExit<A>(
-  target: ConnectionTarget,
   exit: Exit.Exit<A, TracedAttemptFailure>,
   established: boolean,
   stable: boolean,
@@ -240,7 +239,7 @@ function failureFromExit<A>(
     failure: {
       error: new ConnectionTransientError({
         reason: "transport",
-        detail: `${target.label} connection failed unexpectedly.`,
+        detail: "The environment connection failed unexpectedly.",
       }),
       attemptSpan: Option.none(),
     },
@@ -275,7 +274,7 @@ export const make = Effect.fn("EnvironmentSupervisor.make")(function* (
   const usesRelay = connectionRoutes(entry).some(
     (route) => route.target._tag === "RelayConnectionTarget",
   );
-  const setupTimeoutDetail = `${target.label} did not respond during connection setup.${
+  const setupTimeoutDetail = `The environment did not respond during connection setup.${
     usesRelay ? ` ${NETWORK_BLOCKING_HINT}` : ""
   }`;
   yield* annotateTarget(target);
@@ -797,7 +796,7 @@ export const make = Effect.fn("EnvironmentSupervisor.make")(function* (
           if (longResume) return true;
           return yield* new ConnectionTransientError({
             reason: "timeout",
-            detail: `${target.label} did not respond to a connection health check.`,
+            detail: "The environment did not respond to a connection health check.",
           });
         }
         if (probeEvent._tag === "ProbeCompleted") {
@@ -902,7 +901,7 @@ export const make = Effect.fn("EnvironmentSupervisor.make")(function* (
       const isUnexpectedDefect =
         !Cause.hasInterruptsOnly(establishment.exit.cause) &&
         !establishment.exit.cause.reasons.some(Cause.isFailReason);
-      const outcome = failureFromExit(target, establishment.exit, false, false);
+      const outcome = failureFromExit(establishment.exit, false, false);
       if (isUnexpectedDefect) {
         const defect = establishment.exit.cause.reasons.find(Cause.isDieReason)?.defect;
         yield* Effect.logError("Connection attempt failed with an unexpected defect.").pipe(
@@ -978,12 +977,7 @@ export const make = Effect.fn("EnvironmentSupervisor.make")(function* (
         resetRetry: connectedExit.value,
       } satisfies AttemptOutcome;
     }
-    const outcome = failureFromExit(
-      target,
-      connectedExit,
-      true,
-      connectedForMs >= BACKOFF_RESET_AFTER_MS,
-    );
+    const outcome = failureFromExit(connectedExit, true, connectedForMs >= BACKOFF_RESET_AFTER_MS);
     if (outcome._tag === "Failure") {
       yield* Effect.void.pipe(
         Effect.withSpan("EnvironmentSupervisor.connectionLost", {
diff --git a/packages/client-runtime/src/linkRequest.test.ts b/packages/client-runtime/src/linkRequest.test.ts
index 25647abe5aa27..162f4073cf63e 100644
--- a/packages/client-runtime/src/linkRequest.test.ts
+++ b/packages/client-runtime/src/linkRequest.test.ts
@@ -99,6 +99,7 @@ const presentation = (
     readonly saved?: ReadonlyArray<string>;
     readonly reported?: ReadonlyArray<string>;
     readonly connected?: boolean;
+    readonly liveLabel?: string;
   } = {},
 ): EnvironmentPresentation & { readonly environmentId: EnvironmentId } => {
   const environmentId = EnvironmentId.make(id);
@@ -133,11 +134,11 @@ const presentation = (
       traceId: null,
     },
     serverConfig:
-      options.reported === undefined
+      options.reported === undefined && options.liveLabel === undefined
         ? null
         : ({
-            environment: { platform: { machine: "laptop" } },
-            directEndpoints: options.reported.map((httpBaseUrl) => ({
+            environment: { label: options.liveLabel ?? label, platform: { machine: "laptop" } },
+            directEndpoints: (options.reported ?? []).map((httpBaseUrl) => ({
               kind: "tailnet",
               httpBaseUrl,
             })),
@@ -190,6 +191,7 @@ describe("linkableMachines", () => {
     const vps = presentation("environment-vps", "VPS", {
       saved: ["https://vps.example.com", "https://vps.ts.net"],
       reported: ["https://vps.ts.net"],
+      liveLabel: "Shared host name",
     });
     const mini = presentation("environment-mini", "Mini", { connected: false });
     expect(
@@ -221,15 +223,18 @@ describe("linkableMachines", () => {
     ]);
   });
 
-  it("reaches a machine saved only over T3 Connect at its Connect address", () => {
+  it("finds a saved Connect machine by its current host name and address", () => {
     const here = presentation("environment-here", "Here", { saved: ["http://localhost:3773"] });
-    const box = presentation("environment-box", "Box");
-    const [listed] = linkableMachines({
+    const box = presentation("environment-box", "Box", { liveLabel: "Studio Mac" });
+    const machines = linkableMachines({
       environments: [here, box],
       threadEnvironmentId: here.environmentId,
       links: [],
       connect: new Map([[box.environmentId, discovered(box.environmentId, "Box")]]),
     });
+    const [listed] = machines;
+    expect(listed?.label).toBe("Studio Mac");
+    expect(linkRequestInitialMachine({ hint: "Studio Mac" }, machines)).toBe(box.environmentId);
     expect(listed?.urls).toEqual(["https://environment-box.t3.example"]);
     // Until discovery has found it, there is no address to offer.
     expect(
diff --git a/packages/client-runtime/src/linkRequest.ts b/packages/client-runtime/src/linkRequest.ts
index c5d06ae5de51d..fa0e9e7eead3c 100644
--- a/packages/client-runtime/src/linkRequest.ts
+++ b/packages/client-runtime/src/linkRequest.ts
@@ -10,7 +10,10 @@ import {
 } from "@t3tools/contracts";
 import * as Option from "effect/Option";
 
-import type { EnvironmentPresentation } from "./connection/presentation.ts";
+import {
+  environmentDisplayLabel,
+  type EnvironmentPresentation,
+} from "./connection/presentation.ts";
 import { connectionRoutes, routeHttpBaseUrl } from "./connection/routes.ts";
 import type { RelayDiscoveredEnvironment } from "./relay/discovery.ts";
 
@@ -103,7 +106,7 @@ export function linkableMachines(input: {
       const connect = input.connect.get(environment.environmentId)?.environment.endpoint;
       return {
         environmentId: environment.environmentId,
-        label: environment.entry.target.label,
+        label: environmentDisplayLabel(environment.entry, environment.serverConfig),
         machine: resolveEnvironmentMachineKind(environment.serverConfig),
         connected: environment.connection.phase === "connected",
         connectOnly: false,
diff --git a/packages/client-runtime/src/relay/discovery.test.ts b/packages/client-runtime/src/relay/discovery.test.ts
index 9332652df39b5..3dcb86fc19526 100644
--- a/packages/client-runtime/src/relay/discovery.test.ts
+++ b/packages/client-runtime/src/relay/discovery.test.ts
@@ -46,26 +46,45 @@ const environments = [
   },
 ] satisfies ReadonlyArray<RelayClientEnvironmentRecord>;
 
+function clerkTokenFor(accountId: string): string {
+  const payload = btoa(JSON.stringify({ sub: accountId })).replaceAll("=", "");
+  return `e30.${payload}.signature`;
+}
+
 function status(
   environment: RelayClientEnvironmentRecord,
   value: "online" | "offline",
+  label?: string,
 ): RelayEnvironmentStatusResponse {
   return {
     environmentId: environment.environmentId,
     endpoint: environment.endpoint,
     status: value,
     checkedAt: "2026-06-01T00:00:00.000Z",
+    ...(label
+      ? {
+          descriptor: {
+            environmentId: environment.environmentId,
+            label,
+            platform: { os: "darwin", arch: "arm64" },
+            serverVersion: "0.0.0-test",
+            capabilities: { repositoryIdentity: true },
+          },
+        }
+      : {}),
   };
 }
 
-const makeHarness = Effect.fn("RelayDiscoveryTest.makeHarness")(function* () {
+const makeHarness = Effect.fn("RelayDiscoveryTest.makeHarness")(function* (options?: {
+  readonly connectivityChanges?: boolean;
+}) {
   const networkStatus = yield* SubscriptionRef.make<NetworkStatus>("online");
   const listCalls = yield* Ref.make(0);
   const listedEnvironments =
     yield* Ref.make<ReadonlyArray<RelayClientEnvironmentRecord>>(environments);
   const listFailure = yield* Ref.make<ManagedRelay.ManagedRelayClientError | null>(null);
   const secondListCall = yield* Deferred.make<void>();
-  const clerkToken = yield* Ref.make<string | null>("clerk-token");
+  const clerkToken = yield* Ref.make<string | null>(clerkTokenFor("account-1"));
   const sessionIdentity = { accountId: "account-1" };
   const wakeups = yield* SubscriptionRef.make<{
     readonly sequence: number;
@@ -126,7 +145,10 @@ const makeHarness = Effect.fn("RelayDiscoveryTest.makeHarness")(function* () {
   } satisfies ManagedRelay.ManagedRelayClient["Service"]);
   const connectivity = Connectivity.Connectivity.of({
     status: SubscriptionRef.get(networkStatus),
-    changes: SubscriptionRef.changes(networkStatus),
+    changes:
+      options?.connectivityChanges === false
+        ? Stream.never
+        : SubscriptionRef.changes(networkStatus),
   });
   const layer = RelayEnvironmentDiscovery.layer.pipe(
     Layer.provide(
@@ -248,7 +270,7 @@ describe("RelayEnvironmentDiscovery", () => {
         const requests = yield* Ref.get(harness.statusRequests);
         yield* Deferred.succeed(
           requests.get(environments[1]!.environmentId)!,
-          status(environments[1]!, "online"),
+          status(environments[1]!, "online", "Renamed Environment"),
         );
 
         const partiallyResolved = yield* SubscriptionRef.changes(discovery.state).pipe(
@@ -262,6 +284,9 @@ describe("RelayEnvironmentDiscovery", () => {
         expect(
           partiallyResolved.environments.get(environments[0]!.environmentId)?.availability,
         ).toBe("checking");
+        expect(
+          partiallyResolved.environments.get(environments[1]!.environmentId)?.environment.label,
+        ).toBe("Renamed Environment");
 
         yield* Deferred.succeed(
           requests.get(environments[0]!.environmentId)!,
@@ -405,20 +430,29 @@ describe("RelayEnvironmentDiscovery", () => {
     }),
   );
 
-  it.effect("clears previously discovered rows when a refresh fails", () =>
+  it.effect("preserves known names throughout a same-account refresh failure", () =>
     Effect.gen(function* () {
-      const harness = yield* makeHarness();
+      const harness = yield* makeHarness({ connectivityChanges: false });
       yield* Effect.gen(function* () {
         const discovery = yield* RelayEnvironmentDiscovery.RelayEnvironmentDiscovery;
         const requests = yield* Ref.get(harness.statusRequests);
         for (const environment of environments) {
           yield* Deferred.succeed(
             requests.get(environment.environmentId)!,
-            status(environment, "online"),
+            status(environment, "online", `Renamed ${environment.environmentId}`),
           );
         }
         yield* discovery.refresh;
-        expect((yield* SubscriptionRef.get(discovery.state)).environments.size).toBe(2);
+        const known = (yield* SubscriptionRef.get(discovery.state)).environments;
+        expect(known.size).toBe(2);
+        const subscribed = yield* Deferred.make<void>();
+        const observed = yield* SubscriptionRef.changes(discovery.state).pipe(
+          Stream.tap(() => Deferred.succeed(subscribed, undefined)),
+          Stream.takeUntil((current) => Option.isSome(current.error)),
+          Stream.runCollect,
+          Effect.forkChild,
+        );
+        yield* Deferred.await(subscribed);
 
         yield* Ref.set(
           harness.listFailure,
@@ -430,7 +464,22 @@ describe("RelayEnvironmentDiscovery", () => {
         yield* discovery.refresh;
 
         const failed = yield* SubscriptionRef.get(discovery.state);
-        expect(failed.environments.size).toBe(0);
+        for (const [id, entry] of known) {
+          expect(failed.environments.get(id)?.environment).toBe(entry.environment);
+        }
+        expect(
+          [...failed.environments.values()].every(
+            (entry) => Option.isNone(entry.status) && entry.availability === "error",
+          ),
+        ).toBe(true);
+        expect(failed.environments.get(environments[0]!.environmentId)?.environment.label).toBe(
+          `Renamed ${environments[0]!.environmentId}`,
+        );
+        expect(
+          (yield* Fiber.join(observed)).every(
+            (current) => current.environments.size === known.size,
+          ),
+        ).toBe(true);
         expect(Option.isSome(failed.error)).toBe(true);
         expect(
           RelayEnvironmentDiscovery.relayEnvironmentRegistration(
@@ -473,26 +522,47 @@ describe("RelayEnvironmentDiscovery", () => {
     }),
   );
 
-  it.effect("settles to a clean empty state when refreshed while signed out", () =>
-    Effect.gen(function* () {
-      const harness = yield* makeHarness();
-      yield* Effect.gen(function* () {
-        const discovery = yield* RelayEnvironmentDiscovery.RelayEnvironmentDiscovery;
-        yield* Ref.set(harness.clerkToken, null);
-        yield* discovery.refresh;
+  it.effect.each(["signed-out", "account-changed"] as const)(
+    "clears known names at the account boundary: %s",
+    (boundary) =>
+      Effect.gen(function* () {
+        const harness = yield* makeHarness();
+        yield* Effect.gen(function* () {
+          const discovery = yield* RelayEnvironmentDiscovery.RelayEnvironmentDiscovery;
+          const requests = yield* Ref.get(harness.statusRequests);
+          for (const environment of environments) {
+            yield* Deferred.succeed(
+              requests.get(environment.environmentId)!,
+              status(environment, "online", "Private old account name"),
+            );
+          }
+          yield* discovery.refresh;
+          expect((yield* SubscriptionRef.get(discovery.state)).environments.size).toBe(2);
+          yield* Ref.set(
+            harness.listFailure,
+            new ManagedRelay.ManagedRelayRequestFailedError({
+              action: "list relay-managed environments",
+              cause: new Error("New account is unreachable."),
+            }),
+          );
+          yield* Ref.set(
+            harness.clerkToken,
+            boundary === "signed-out" ? null : clerkTokenFor("account-2"),
+          );
+          yield* discovery.refresh;
 
-        const state = yield* SubscriptionRef.get(discovery.state);
-        expect(state.environments.size).toBe(0);
-        expect(state.refreshing).toBe(false);
-        expect(Option.isNone(state.error)).toBe(true);
-        expect(
-          RelayEnvironmentDiscovery.relayEnvironmentRegistration(
-            state,
-            environments[0]!.environmentId,
-          ),
-        ).toBe("unknown");
-      }).pipe(Effect.provide(harness.layer));
-    }),
+          const state = yield* SubscriptionRef.get(discovery.state);
+          expect(state.environments.size).toBe(0);
+          expect(
+            RelayEnvironmentDiscovery.relayEnvironmentRegistration(
+              state,
+              environments[0]!.environmentId,
+            ),
+          ).toBe("unknown");
+          expect(state.refreshing).toBe(false);
+          expect(Option.isNone(state.error)).toBe(boundary === "signed-out");
+        }).pipe(Effect.provide(harness.layer));
+      }),
   );
 
   it.effect("does not republish stale rows after sign-out invalidates an in-flight refresh", () =>
diff --git a/packages/client-runtime/src/relay/discovery.ts b/packages/client-runtime/src/relay/discovery.ts
index ce5e708829d63..da2dd90b22e7c 100644
--- a/packages/client-runtime/src/relay/discovery.ts
+++ b/packages/client-runtime/src/relay/discovery.ts
@@ -57,12 +57,31 @@ export const EMPTY_RELAY_ENVIRONMENT_DISCOVERY_STATE: RelayEnvironmentDiscoveryS
   error: Option.none(),
 };
 
+function withoutStatuses(
+  environments: RelayEnvironmentDiscoveryState["environments"],
+  availability: RelayEnvironmentAvailability,
+  error: Option.Option<ConnectionAttemptError> = Option.none(),
+) {
+  return new Map(
+    [...environments].map(([id, entry]) => [
+      id,
+      {
+        ...entry,
+        availability,
+        status: Option.none<RelayEnvironmentStatusResponse>(),
+        error,
+      },
+    ]),
+  );
+}
+
 export type RelayEnvironmentRegistration = "registered" | "unregistered" | "unknown";
 
 export function relayEnvironmentRegistration(
   state: RelayEnvironmentDiscoveryState,
   environmentId: string,
 ): RelayEnvironmentRegistration {
+  if (!state.listed) return "unknown";
   if (state.environments.has(environmentId)) return "registered";
   return state.listed ? "unregistered" : "unknown";
 }
@@ -200,6 +219,12 @@ export const make = Effect.fn("RelayEnvironmentDiscovery.make")(function* () {
       }
       yield* updateEnvironment(generation, environment.environmentId, (current) => ({
         ...current,
+        environment: result.success.descriptor
+          ? {
+              ...current.environment,
+              label: result.success.descriptor.label,
+            }
+          : current.environment,
         availability: result.success.status,
         status: Option.some(result.success),
         error: Option.none(),
@@ -221,6 +246,7 @@ export const make = Effect.fn("RelayEnvironmentDiscovery.make")(function* () {
       if ((yield* connectivity.status) === "offline") {
         yield* SubscriptionRef.update(state, (current) => ({
           ...current,
+          environments: withoutStatuses(current.environments, "offline"),
           refreshing: false,
           offline: true,
         }));
@@ -229,13 +255,14 @@ export const make = Effect.fn("RelayEnvironmentDiscovery.make")(function* () {
 
       let generation = yield* Ref.get(accountGeneration);
       yield* Ref.set(refreshGeneration, generation);
-      yield* SubscriptionRef.set(state, {
-        environments: new Map(),
+      yield* SubscriptionRef.update(state, (current) => ({
+        ...current,
+        environments: withoutStatuses(current.environments, "checking"),
         listed: false,
         refreshing: true,
         offline: false,
         error: Option.none(),
-      });
+      }));
 
       // Sign-out triggers credentials-changed refreshes and must settle to an empty list.
       // Only session-level missing credentials are benign; relay-side auth failures must surface.
@@ -246,10 +273,8 @@ export const make = Effect.fn("RelayEnvironmentDiscovery.make")(function* () {
           if ((yield* Ref.get(accountGeneration)) !== generation) {
             return;
           }
-          yield* SubscriptionRef.update(state, (current) => ({
-            ...current,
-            refreshing: false,
-          }));
+          yield* Ref.set(activeAccountId, Option.none());
+          yield* SubscriptionRef.set(state, EMPTY_RELAY_ENVIRONMENT_DISCOVERY_STATE);
           return;
         }
         return yield* failure;
@@ -261,11 +286,17 @@ export const make = Effect.fn("RelayEnvironmentDiscovery.make")(function* () {
       const accountId = relayAccountId(clerkToken);
       const previousAccountId = yield* Ref.get(activeAccountId);
       if (
-        Option.isSome(previousAccountId) &&
-        (!Option.isSome(accountId) || previousAccountId.value !== accountId.value)
+        Option.isNone(previousAccountId) ||
+        Option.isNone(accountId) ||
+        previousAccountId.value !== accountId.value
       ) {
         generation = yield* Ref.updateAndGet(accountGeneration, (current) => current + 1);
         yield* Ref.set(refreshGeneration, generation);
+        yield* Ref.set(offlineReportFingerprints, new Map());
+        yield* SubscriptionRef.update(state, (current) => ({
+          ...current,
+          environments: new Map(),
+        }));
       }
       yield* Ref.set(activeAccountId, accountId);
 
@@ -314,6 +345,7 @@ export const make = Effect.fn("RelayEnvironmentDiscovery.make")(function* () {
           }
           yield* SubscriptionRef.update(state, (current) => ({
             ...current,
+            environments: withoutStatuses(current.environments, "error", Option.some(error)),
             refreshing: false,
             error: Option.some(error),
           }));
@@ -328,6 +360,7 @@ export const make = Effect.fn("RelayEnvironmentDiscovery.make")(function* () {
       networkStatus === "offline"
         ? SubscriptionRef.update(state, (current) => ({
             ...current,
+            environments: withoutStatuses(current.environments, "offline"),
             refreshing: false,
             offline: true,
           }))
diff --git a/packages/client-runtime/src/rpc/client.ts b/packages/client-runtime/src/rpc/client.ts
index 2832a4e231556..3fb1a08448465 100644
--- a/packages/client-runtime/src/rpc/client.ts
+++ b/packages/client-runtime/src/rpc/client.ts
@@ -31,7 +31,6 @@ export class EnvironmentRpcUnavailableError extends Schema.TaggedError<Environme
 
 export interface EnvironmentRpcRequestObservation {
   readonly environmentId: string;
-  readonly environmentLabel: string;
   readonly method: string;
 }
 
@@ -137,7 +136,7 @@ const currentSession = Effect.fn("EnvironmentRpc.currentSession")(function* () {
           Effect.fail(
             new EnvironmentRpcUnavailableError({
               environmentId: supervisor.target.environmentId,
-              message: `${supervisor.target.label} is not connected.`,
+              message: "This environment is not connected.",
             }),
           ),
         onSome: Effect.succeed,
@@ -202,7 +201,6 @@ export const requestGuarded = Effect.fn("EnvironmentRpc.request")(function* <
   ) => Effect.Effect<EnvironmentRpcSuccess<TTag>, EnvironmentRpcFailure<TTag>>;
   const completeObservation = yield* observer.observe({
     environmentId: supervisor.target.environmentId,
-    environmentLabel: supervisor.target.label,
     method: tag,
   });
   return yield* method(input).pipe(Effect.ensuring(completeObservation));
diff --git a/packages/client-runtime/src/state/commandPermissions.test.ts b/packages/client-runtime/src/state/commandPermissions.test.ts
index adfad46a41b89..edf40fb7e1564 100644
--- a/packages/client-runtime/src/state/commandPermissions.test.ts
+++ b/packages/client-runtime/src/state/commandPermissions.test.ts
@@ -13,11 +13,14 @@ import {
   AuthOrchestrationReadScope,
   AuthPreviewOperateScope,
   AuthSettingsWriteScope,
+  AuthProvidersManageScope,
   AuthSourceControlWriteScope,
   ThreadId,
   EnvironmentId,
   ORCHESTRATION_V2_WS_METHODS,
   ScheduledTaskId,
+  ProviderInstanceId,
+  DEFAULT_SERVER_SETTINGS,
   WS_METHODS,
   type AuthSessionState,
   type PeerLinkSummary,
@@ -96,6 +99,107 @@ describe("command permissions", () => {
     ),
   );
 
+  it("checks the destination settings grant again when renaming a host", async () => {
+    const registry = AtomRegistry.make();
+    const unmounts = [registry.mount(sessions(env)), registry.mount(sessions(other))];
+    const input = { patch: { environmentLabel: "Studio Mac" } };
+    const writes: Array<typeof input> = [];
+    const command = createEnvironmentRpcCommand(runtime, {
+      label: "test.rename-host",
+      tag: WS_METHODS.serverUpdateSettings,
+      execute: (payload) =>
+        Effect.sync(() => {
+          writes.push(payload as typeof input);
+          return DEFAULT_SERVER_SETTINGS;
+        }),
+    });
+    try {
+      registry.set(
+        sessions(env),
+        AsyncResult.success({
+          ...grant(false),
+          scopes: [AuthSettingsWriteScope],
+          permissions: [AuthSettingsWriteScope],
+        }),
+      );
+      registry.set(sessions(other), AsyncResult.success(grant(false)));
+      expect(registry.get(command.permissionAtom(env, input))).toBe(true);
+      expect(registry.get(command.permissionAtom(other, input))).toBe(false);
+      expect((await command.run(registry, { environmentId: other, input }))._tag).toBe("Failure");
+      expect(writes).toHaveLength(0);
+      expect((await command.run(registry, { environmentId: env, input }))._tag).toBe("Success");
+      expect(writes).toEqual([input]);
+      registry.set(sessions(env), AsyncResult.success(grant(false)));
+      expect(registry.get(command.permissionAtom(env, input))).toBe(false);
+      expect((await command.run(registry, { environmentId: env, input }))._tag).toBe("Failure");
+      expect(writes).toHaveLength(1);
+    } finally {
+      unmounts.forEach((unmount) => unmount());
+      registry.dispose();
+    }
+  });
+
+  it.effect(
+    "requires provider permission for provider-only settings and both grants for mixed changes",
+    () =>
+      Effect.scoped(
+        Effect.gen(function* () {
+          const registry = yield* setup;
+          const settings = createCommandPermissions(runtime, WS_METHODS.serverUpdateSettings);
+          const providerOnly = {
+            patch: {},
+            providerInstanceMutation: {
+              operation: "remove",
+              instanceId: ProviderInstanceId.make("work"),
+            },
+          };
+          const mixed = { ...providerOnly, patch: { environmentLabel: "Studio" } };
+          const providerPatch = { patch: { providerInstances: {} } };
+          registry.set(
+            sessions(env),
+            AsyncResult.success({
+              ...grant(false),
+              scopes: [AuthProvidersManageScope],
+              permissions: [AuthProvidersManageScope],
+            }),
+          );
+          expect(registry.get(settings.permissionAtom(env))).toBe(false);
+          expect(registry.get(settings.permissionAtom(env, providerOnly))).toBe(true);
+          yield* settings.authorize(registry, env, providerOnly);
+          expect(registry.get(settings.permissionAtom(env, providerPatch))).toBe(true);
+          yield* settings.authorize(registry, env, providerPatch);
+          expect(registry.get(settings.permissionAtom(env, mixed))).toBe(false);
+          expect(
+            (yield* settings.authorize(registry, env, mixed).pipe(Effect.flip)).requiredPermission,
+          ).toBe(AuthSettingsWriteScope);
+          registry.set(
+            sessions(env),
+            AsyncResult.success({
+              ...grant(false),
+              scopes: [AuthSettingsWriteScope],
+              permissions: [AuthSettingsWriteScope],
+            }),
+          );
+          expect(registry.get(settings.permissionAtom(env, providerOnly))).toBe(false);
+          expect(registry.get(settings.permissionAtom(env, providerPatch))).toBe(false);
+          expect(
+            (yield* settings.authorize(registry, env, providerOnly).pipe(Effect.flip))
+              .requiredPermission,
+          ).toBe(AuthProvidersManageScope);
+          registry.set(
+            sessions(env),
+            AsyncResult.success({
+              ...grant(false),
+              scopes: [AuthSettingsWriteScope, AuthProvidersManageScope],
+              permissions: [AuthSettingsWriteScope, AuthProvidersManageScope],
+            }),
+          );
+          expect(registry.get(settings.permissionAtom(env, mixed))).toBe(true);
+          yield* settings.authorize(registry, env, mixed);
+        }),
+      ),
+  );
+
   it.effect("requires the destination settings grant to run storage cleanup", () =>
     Effect.scoped(
       Effect.gen(function* () {
diff --git a/packages/client-runtime/src/state/presentation.test.ts b/packages/client-runtime/src/state/presentation.test.ts
index 71e9c868cd439..f389bc90e8ba6 100644
--- a/packages/client-runtime/src/state/presentation.test.ts
+++ b/packages/client-runtime/src/state/presentation.test.ts
@@ -4,12 +4,22 @@ import * as Option from "effect/Option";
 import { AsyncResult, Atom, AtomRegistry } from "effect/reactivity";
 
 import type { ConnectionCatalogEntry } from "../connection/catalog.ts";
-import { AVAILABLE_CONNECTION_STATE, PrimaryConnectionTarget } from "../connection/model.ts";
+import {
+  AVAILABLE_CONNECTION_STATE,
+  BearerConnectionTarget,
+  PrimaryConnectionTarget,
+  RelayConnectionTarget,
+} from "../connection/model.ts";
 import {
   createEnvironmentPresentationAtoms,
   createEnvironmentSummaryAtoms,
 } from "./presentation.ts";
 import type { EnvironmentCatalogState } from "./connections.ts";
+import {
+  EMPTY_RELAY_ENVIRONMENT_DISCOVERY_STATE,
+  type RelayDiscoveredEnvironment,
+  type RelayEnvironmentDiscoveryState,
+} from "../relay/discovery.ts";
 
 const FIRST = EnvironmentId.make("first");
 const SECOND = EnvironmentId.make("second");
@@ -41,19 +51,256 @@ function harness() {
   });
   const configs = Atom.family((_id: EnvironmentId) => Atom.make<ServerConfig | null>(config()));
   const state = Atom.make(AsyncResult.success(AVAILABLE_CONNECTION_STATE));
+  const discovery = Atom.make<RelayEnvironmentDiscoveryState>(
+    EMPTY_RELAY_ENVIRONMENT_DISCOVERY_STATE,
+  );
   const full = createEnvironmentPresentationAtoms({
     catalogValueAtom: catalog,
     stateAtom: () => state,
     serverConfigValueAtom: configs,
+    relayDiscoveryValueAtom: discovery,
   });
   const summaries = createEnvironmentSummaryAtoms({
     catalogValueAtom: catalog,
     presentationAtom: full.presentationAtom,
   });
-  return { catalog, configs, state, full, ...summaries, registry: AtomRegistry.make() };
+  return { catalog, configs, state, discovery, full, ...summaries, registry: AtomRegistry.make() };
 }
 
 describe("environment summary subscriptions", () => {
+  it("uses discovery names for offline Connect hosts without changing manual aliases or saved routes", () => {
+    const h = harness();
+    const relay = new RelayConnectionTarget({ environmentId: FIRST, label: "Old saved host" });
+    const manual = new BearerConnectionTarget({
+      environmentId: SECOND,
+      label: "My alias",
+      connectionId: "direct",
+    });
+    const catalog: EnvironmentCatalogState = {
+      isReady: true,
+      entries: new Map<EnvironmentId, ConnectionCatalogEntry>([
+        [FIRST, { target: relay, profile: Option.none(), enabled: true }],
+        [
+          SECOND,
+          {
+            target: manual,
+            profile: Option.none(),
+            enabled: true,
+            alternateRoutes: [
+              {
+                target: new RelayConnectionTarget({
+                  environmentId: SECOND,
+                  label: "Other shared host",
+                }),
+                profile: Option.none(),
+              },
+            ],
+          },
+        ],
+      ]),
+    };
+    const discovered = (
+      environmentId: EnvironmentId,
+      label: string,
+    ): RelayDiscoveredEnvironment => ({
+      environment: {
+        environmentId,
+        label,
+        linkedAt: "2026-10-01T00:00:00.000Z",
+        endpoint: {
+          httpBaseUrl: "https://relay.example.test",
+          wsBaseUrl: "wss://relay.example.test",
+          providerKind: "cloudflare_tunnel",
+        },
+      },
+      availability: "offline",
+      status: Option.none(),
+      error: Option.none(),
+    });
+    const publishDiscovery = (label: string) =>
+      h.registry.set(h.discovery, {
+        ...EMPTY_RELAY_ENVIRONMENT_DISCOVERY_STATE,
+        environments: new Map([
+          [FIRST, discovered(FIRST, label)],
+          [SECOND, discovered(SECOND, "New shared name")],
+        ]),
+      });
+    try {
+      h.registry.set(h.catalog, catalog);
+      h.registry.set(h.configs(FIRST), null);
+      h.registry.set(h.configs(SECOND), null);
+      expect(h.registry.get(h.identitiesAtom)[0]?.label).toBe("Old saved host");
+      const ids = h.registry.get(h.environmentIdsAtom);
+      const cachedConfig = {
+        ...config(),
+        environment: { ...config().environment, label: "Cached old name" },
+      };
+      h.registry.set(h.configs(FIRST), cachedConfig);
+      publishDiscovery("Studio Mac");
+      expect(h.registry.get(h.identitiesAtom).map(({ label }) => label)).toEqual([
+        "Studio Mac",
+        "My alias",
+      ]);
+      expect(
+        h.registry.get(h.environmentsAtom).map(({ environmentLabel }) => environmentLabel),
+      ).toEqual(["Studio Mac", "My alias"]);
+      expect(
+        h.registry.get(h.full.presentationsWithProvidersAtom).get(FIRST)?.serverConfig?.environment
+          .label,
+      ).toBe("Studio Mac");
+      expect(h.registry.get(h.catalog)).toBe(catalog);
+      expect(h.registry.get(h.environmentIdsAtom)).toBe(ids);
+      const shown = h.registry.get(h.full.presentationAtom(FIRST));
+      publishDiscovery("Studio Mac");
+      expect(h.registry.get(h.full.presentationAtom(FIRST))).toBe(shown);
+      h.registry.set(h.configs(FIRST), { ...cachedConfig, providers: [] });
+      expect(h.registry.get(h.full.presentationAtom(FIRST))).toBe(shown);
+      const withProviders = h.registry.get(h.full.presentationsWithProvidersAtom).get(FIRST);
+      expect(withProviders?.serverConfig?.providers).toBe(
+        h.registry.get(h.configs(FIRST))?.providers,
+      );
+      expect(withProviders?.serverConfig?.environment.label).toBe("Studio Mac");
+      publishDiscovery("Studio Mac");
+      expect(h.registry.get(h.full.presentationsWithProvidersAtom).get(FIRST)).toBe(withProviders);
+      h.registry.set(
+        h.state,
+        AsyncResult.success({ ...AVAILABLE_CONNECTION_STATE, phase: "connected" }),
+      );
+      h.registry.set(h.configs(FIRST), {
+        ...config(),
+        environment: { ...config().environment, label: "Live socket name" },
+      });
+      publishDiscovery("Detected Mac");
+      expect(h.registry.get(h.identitiesAtom)[0]?.label).toBe("Live socket name");
+      const connected = h.registry.get(h.full.presentationAtom(FIRST));
+      publishDiscovery("Studio Mac");
+      expect(h.registry.get(h.full.presentationAtom(FIRST))).toBe(connected);
+      const liveConfig = h.registry.get(h.configs(FIRST));
+      h.registry.set(h.state, AsyncResult.success({ ...AVAILABLE_CONNECTION_STATE }));
+      expect(h.registry.get(h.identitiesAtom)[0]?.label).toBe("Live socket name");
+      expect(h.registry.get(h.configs(FIRST))).toBe(liveConfig);
+      h.registry.set(h.configs(FIRST), null);
+      expect(h.registry.get(h.identitiesAtom)[0]?.label).toBe("Live socket name");
+      const currentDiscovery = h.registry.get(h.discovery);
+      h.registry.set(h.discovery, { ...currentDiscovery, refreshing: true });
+      expect(h.registry.get(h.identitiesAtom)[0]?.label).toBe("Live socket name");
+      // Clearing remotely can return a fresh record with the same name as the pre-rename snapshot.
+      publishDiscovery("Studio Mac");
+      expect(h.registry.get(h.identitiesAtom)[0]?.label).toBe("Studio Mac");
+      publishDiscovery("Detected Mac");
+      expect(h.registry.get(h.identitiesAtom)[0]?.label).toBe("Detected Mac");
+      // A second offline rename may return to the value seen before disconnecting.
+      publishDiscovery("Studio Mac");
+      expect(h.registry.get(h.identitiesAtom)[0]?.label).toBe("Studio Mac");
+    } finally {
+      h.registry.dispose();
+    }
+  });
+  it("renames a Connect host while leaving a manual alias and its subscribers unchanged", () => {
+    const h = harness();
+    const manualTarget = new BearerConnectionTarget({
+      environmentId: SECOND,
+      label: "My alias",
+      connectionId: "manual",
+    });
+    const relayTarget = new RelayConnectionTarget({ environmentId: SECOND, label: "Catalog host" });
+    h.registry.set(h.catalog, {
+      isReady: true,
+      entries: new Map<EnvironmentId, ConnectionCatalogEntry>([
+        [
+          FIRST,
+          {
+            ...entry(FIRST),
+            target: new RelayConnectionTarget({ environmentId: FIRST, label: "Studio" }),
+          },
+        ],
+        [
+          SECOND,
+          {
+            ...entry(SECOND),
+            target: manualTarget,
+            alternateRoutes: [
+              { target: manualTarget, profile: Option.none() },
+              { target: relayTarget, profile: Option.none() },
+            ],
+          },
+        ],
+      ]),
+    });
+    const manualAtom = Atom.make((get) =>
+      get(h.environmentsAtom).find((environment) => environment.environmentId === SECOND),
+    );
+    const manual = h.registry.get(manualAtom);
+    let manualChanges = 0;
+    const stop = h.registry.subscribe(manualAtom, () => manualChanges++);
+    try {
+      h.registry.set(h.configs(SECOND), {
+        ...config(),
+        environment: { ...config().environment, label: "Different shared name" },
+      });
+      expect(h.registry.get(manualAtom)).toBe(manual);
+      expect(h.registry.get(h.identitiesAtom)[1]?.label).toBe("My alias");
+      for (const label of ["Studio Mac", "Detected Mac"]) {
+        h.registry.set(h.configs(FIRST), {
+          ...config(),
+          environment: { ...config().environment, label },
+        });
+        expect(
+          h.registry
+            .get(h.environmentsAtom)
+            .find((environment) => environment.environmentId === FIRST)?.environmentLabel,
+        ).toBe(label);
+        expect(h.registry.get(h.identitiesAtom)[0]?.label).toBe(label);
+        expect(h.registry.get(manualAtom)).toBe(manual);
+      }
+      expect(manualChanges).toBe(0);
+    } finally {
+      stop();
+      h.registry.dispose();
+    }
+  });
+  it("updates labels from the live descriptor while keeping unrelated subscribers stable", () => {
+    const h = harness();
+    const initialIds = h.registry.get(h.environmentIdsAtom);
+    const initialConnected = h.registry.get(h.connectedEnvironmentIdsAtom);
+    const initialMachines = h.registry.get(h.machineByIdAtom);
+    const counts = { labels: 0, connections: 0, ids: 0, connected: 0, machines: 0 };
+    const stops = [
+      h.registry.subscribe(h.identitiesAtom, () => counts.labels++),
+      h.registry.subscribe(h.environmentsAtom, () => counts.connections++),
+      h.registry.subscribe(h.environmentIdsAtom, () => counts.ids++),
+      h.registry.subscribe(h.connectedEnvironmentIdsAtom, () => counts.connected++),
+      h.registry.subscribe(h.machineByIdAtom, () => counts.machines++),
+    ];
+    try {
+      const previous = config();
+      h.registry.set(h.configs(FIRST), {
+        ...previous,
+        environment: { ...previous.environment, label: "Studio Mac" },
+      });
+      expect(h.registry.get(h.identitiesAtom)[0]?.label).toBe("Studio Mac");
+      expect(h.registry.get(h.environmentsAtom)[0]?.environmentLabel).toBe("Studio Mac");
+      expect(h.registry.get(h.environmentIdsAtom)).toBe(initialIds);
+      expect(h.registry.get(h.connectedEnvironmentIdsAtom)).toBe(initialConnected);
+      expect(h.registry.get(h.machineByIdAtom)).toBe(initialMachines);
+      expect(counts).toEqual({ labels: 1, connections: 1, ids: 0, connected: 0, machines: 0 });
+
+      // Clearing the override publishes the server's detected name.
+      h.registry.set(h.configs(FIRST), {
+        ...previous,
+        environment: { ...previous.environment, label: "Detected Mac" },
+      });
+      expect(h.registry.get(h.identitiesAtom)[0]?.label).toBe("Detected Mac");
+      expect(h.registry.get(h.environmentsAtom)[0]?.environmentLabel).toBe("Detected Mac");
+      h.registry.set(h.configs(FIRST), null);
+      expect(h.registry.get(h.identitiesAtom)[0]?.label).toBe("first");
+      expect(h.registry.get(h.environmentsAtom)[0]?.environmentLabel).toBe("first");
+    } finally {
+      stops.forEach((stop) => stop());
+      h.registry.dispose();
+    }
+  });
+
   it("tracks loaded configs across environments, config loss and removal", () => {
     const h = harness();
     const stop = h.registry.subscribe(h.pullRequestsSupportedAtom, () => {});
diff --git a/packages/client-runtime/src/state/presentation.ts b/packages/client-runtime/src/state/presentation.ts
index f3ffb03b0bcfe..6f6b35084551a 100644
--- a/packages/client-runtime/src/state/presentation.ts
+++ b/packages/client-runtime/src/state/presentation.ts
@@ -8,9 +8,15 @@ import {
 import * as Option from "effect/Option";
 import { AsyncResult, Atom } from "effect/reactivity";
 
-import { AVAILABLE_CONNECTION_STATE, type SupervisorConnectionState } from "../connection/model.ts";
+import {
+  AVAILABLE_CONNECTION_STATE,
+  RelayConnectionTarget,
+  type SupervisorConnectionState,
+} from "../connection/model.ts";
+import type { ConnectionCatalogEntry } from "../connection/catalog.ts";
 import {
   connectionCatalogDisplayUrl,
+  environmentDisplayLabel,
   presentConnectionState,
   type EnvironmentConnectionPhase,
   type EnvironmentConnectionPresentation,
@@ -19,6 +25,8 @@ import {
 } from "../connection/presentation.ts";
 import { type EnvironmentCatalogState, enabledEnvironmentIds } from "./connections.ts";
 import { hasRelayRoute } from "../connection/routes.ts";
+import type { RelayEnvironmentDiscoveryState } from "../relay/discovery.ts";
+import type { RelayClientEnvironmentRecord } from "@t3tools/contracts/relay";
 
 function mapsEqual<K, V>(left: ReadonlyMap<K, V>, right: ReadonlyMap<K, V>): boolean {
   if (left.size !== right.size) {
@@ -70,11 +78,18 @@ export function createEnvironmentPresentationAtoms<E>(input: {
     environmentId: EnvironmentId,
   ) => Atom.Atom<AsyncResult.AsyncResult<SupervisorConnectionState, E>>;
   readonly serverConfigValueAtom: (environmentId: EnvironmentId) => Atom.Atom<ServerConfig | null>;
+  readonly relayDiscoveryValueAtom?: Atom.Atom<RelayEnvironmentDiscoveryState>;
 }) {
-  const presentationAtom = Atom.family((environmentId: EnvironmentId) =>
-    Atom.make((get) => {
+  const presentationAtom = Atom.family((environmentId: EnvironmentId) => {
+    let previousCatalogEntry: ConnectionCatalogEntry | undefined;
+    let previousServerConfig: EnvironmentServerConfig | null = null;
+    let lastConnectedLabel: string | undefined;
+    let lastConnectedDiscovery: RelayClientEnvironmentRecord | undefined;
+    return Atom.make((get) => {
       const entry = get(input.catalogValueAtom).entries.get(environmentId);
       if (entry === undefined) {
+        lastConnectedLabel = undefined;
+        lastConnectedDiscovery = undefined;
         return null;
       }
       const state = AsyncResult.getOrElse(
@@ -89,16 +104,60 @@ export function createEnvironmentPresentationAtoms<E>(input: {
           : state === AVAILABLE_CONNECTION_STATE && entry.enabled
             ? { phase: "connecting", error: null, traceId: null }
             : presentConnectionState(state);
+      const sourceServerConfig = withoutProviders(
+        get(input.serverConfigValueAtom(environmentId)),
+        previousServerConfig,
+      );
+      let serverConfig = sourceServerConfig;
+      let displayEntry = entry;
+      if (entry.target._tag === "RelayConnectionTarget" && input.relayDiscoveryValueAtom) {
+        const discovered = get(input.relayDiscoveryValueAtom).environments.get(
+          environmentId,
+        )?.environment;
+        if (connection.phase === "connected" && sourceServerConfig !== null) {
+          lastConnectedLabel = sourceServerConfig.environment.label;
+          lastConnectedDiscovery = discovered;
+        }
+        // An unchanged relay snapshot cannot replace a newer name received over the live socket.
+        const label =
+          connection.phase === "connected"
+            ? undefined
+            : lastConnectedLabel !== undefined &&
+                (discovered === undefined || discovered === lastConnectedDiscovery)
+              ? lastConnectedLabel
+              : discovered?.label;
+        if (label !== undefined) {
+          if (label !== entry.target.label) {
+            // Discovery can refresh a name without rebuilding saved routes or restarting their supervisor.
+            displayEntry =
+              previousCatalogEntry === entry && previous?.entry.target.label === label
+                ? previous.entry
+                : { ...entry, target: new RelayConnectionTarget({ environmentId, label }) };
+          }
+          if (sourceServerConfig !== null && sourceServerConfig.environment.label !== label) {
+            serverConfig =
+              sourceServerConfig === previousServerConfig &&
+              previous?.serverConfig?.environment.label === label
+                ? previous.serverConfig
+                : {
+                    ...sourceServerConfig,
+                    environment: { ...sourceServerConfig.environment, label },
+                  };
+          }
+        }
+      } else {
+        lastConnectedLabel = undefined;
+        lastConnectedDiscovery = undefined;
+      }
+      previousCatalogEntry = entry;
+      previousServerConfig = sourceServerConfig;
       const next = {
-        entry,
+        entry: displayEntry,
         connection:
           previous !== null && sameConnection(previous.connection, connection)
             ? previous.connection
             : connection,
-        serverConfig: withoutProviders(
-          get(input.serverConfigValueAtom(environmentId)),
-          previous?.serverConfig ?? null,
-        ),
+        serverConfig,
       } satisfies EnvironmentPresentation;
       return previous !== null &&
         previous.entry === next.entry &&
@@ -106,8 +165,8 @@ export function createEnvironmentPresentationAtoms<E>(input: {
         previous.serverConfig === next.serverConfig
         ? previous
         : next;
-    }).pipe(Atom.withLabel(`environment-presentation:${environmentId}`)),
-  );
+    }).pipe(Atom.withLabel(`environment-presentation:${environmentId}`));
+  });
 
   let previous: ReadonlyMap<EnvironmentId, EnvironmentPresentation> = new Map();
   const presentationsAtom = Atom.make((get) => {
@@ -166,8 +225,19 @@ export function createEnvironmentPresentationAtoms<E>(input: {
     for (const environmentId of enabledEnvironmentIds(get(input.catalogValueAtom))) {
       const presentation = get(presentationAtom(environmentId));
       if (presentation === null) continue;
-      const serverConfig = get(input.serverConfigValueAtom(environmentId));
+      const rawConfig = get(input.serverConfigValueAtom(environmentId));
       const prior = previous?.get(environmentId);
+      const projectedConfig = presentation.serverConfig;
+      const serverConfig =
+        rawConfig === null || projectedConfig === null
+          ? null
+          : rawConfig.environment === projectedConfig.environment
+            ? rawConfig
+            : prior?.serverConfig != null &&
+                prior.serverConfig.providers === rawConfig.providers &&
+                withoutProviders(prior.serverConfig, projectedConfig) === projectedConfig
+              ? prior.serverConfig
+              : { ...projectedConfig, providers: rawConfig.providers };
       next.set(
         environmentId,
         prior !== undefined &&
@@ -207,7 +277,7 @@ export function projectEnvironmentConnectionSummary(
 ): EnvironmentConnectionSummary {
   return {
     environmentId,
-    environmentLabel: environment.entry.target.label,
+    environmentLabel: environmentDisplayLabel(environment.entry, environment.serverConfig),
     displayUrl: connectionCatalogDisplayUrl(environment.entry) ?? "",
     isRelayManaged: hasRelayRoute(environment.entry),
     isEnabled: environment.entry.enabled,
@@ -233,10 +303,16 @@ export function createEnvironmentSummaryAtoms(input: {
       : next;
   });
   const identitiesAtom = Atom.make((get) => {
-    const next = [...get(input.catalogValueAtom).entries].map(([environmentId, entry]) => ({
-      environmentId,
-      label: entry.target.label,
-    }));
+    const next = [...get(input.catalogValueAtom).entries].map(([environmentId, entry]) => {
+      const presentation = get(input.presentationAtom(environmentId));
+      return {
+        environmentId,
+        label: environmentDisplayLabel(
+          presentation?.entry ?? entry,
+          presentation?.serverConfig ?? null,
+        ),
+      };
+    });
     const previous = Option.getOrNull(
       get.self<ReadonlyArray<{ readonly environmentId: EnvironmentId; readonly label: string }>>(),
     );
diff --git a/packages/client-runtime/src/state/server.test.ts b/packages/client-runtime/src/state/server.test.ts
index c852afdcae32e..7da0a8073c19a 100644
--- a/packages/client-runtime/src/state/server.test.ts
+++ b/packages/client-runtime/src/state/server.test.ts
@@ -806,6 +806,35 @@ describe("server state projection", () => {
     ).toBe(true);
   });
 
+  it("carries the live environment name through settings updates", () => {
+    const snapshot = applyServerConfigProjection(Option.none(), {
+      version: 1,
+      type: "snapshot",
+      config: CONFIG,
+    });
+    const settings = { ...CONFIG.settings };
+    const environment = {
+      ...CONFIG.environment,
+      label: "Renamed environment",
+    } as ServerConfig["environment"];
+    const projected = applyServerConfigProjection(snapshot, {
+      version: 1,
+      type: "settingsUpdated",
+      payload: { settings, environment },
+    });
+
+    expect(Option.getOrThrow(projected).config.environment).toBe(environment);
+
+    const legacyUpdate = Option.getOrThrow(
+      applyServerConfigProjection(projected, {
+        version: 1,
+        type: "settingsUpdated",
+        payload: { settings },
+      }),
+    );
+    expect(legacyUpdate.config.environment).toBe(environment);
+  });
+
   it("keeps published themes across a reconnect snapshot", () => {
     const themes = [
       {
diff --git a/packages/client-runtime/src/state/serverConfigProjection.ts b/packages/client-runtime/src/state/serverConfigProjection.ts
index 7d388f889a37a..95af15059c479 100644
--- a/packages/client-runtime/src/state/serverConfigProjection.ts
+++ b/packages/client-runtime/src/state/serverConfigProjection.ts
@@ -108,6 +108,7 @@ export function applyServerConfigProjection(
         config: {
           ...projection.config,
           settings: reuseUnchanged(projection.config.settings, event.payload.settings),
+          environment: event.payload.environment ?? projection.config.environment,
         },
         latestEvent: event,
         source: "live",
diff --git a/packages/client-runtime/src/state/sharedSettings.test.ts b/packages/client-runtime/src/state/sharedSettings.test.ts
index 9d8fc51f960fa..f68f54d46cfe8 100644
--- a/packages/client-runtime/src/state/sharedSettings.test.ts
+++ b/packages/client-runtime/src/state/sharedSettings.test.ts
@@ -5,7 +5,16 @@ import {
 } from "@t3tools/contracts";
 import { describe, expect, it } from "@effect/vitest";
 
-import { filterSharedServerPatch } from "./sharedSettings.ts";
+import { filterSharedServerPatch, splitSharedServerPatch } from "./sharedSettings.ts";
+
+describe("splitSharedServerPatch", () => {
+  it("keeps host names on the environment being edited", () => {
+    expect(splitSharedServerPatch({ environmentLabel: "Studio Mac" })).toEqual({
+      sharedPatch: {},
+      localPatch: { environmentLabel: "Studio Mac" },
+    });
+  });
+});
 
 describe("filterSharedServerPatch", () => {
   it("holds the restart preference until the target's config loads", () => {
diff --git a/packages/contracts/src/clientRpcPermissions.test.ts b/packages/contracts/src/clientRpcPermissions.test.ts
new file mode 100644
index 0000000000000..5cc62844ac55d
--- /dev/null
+++ b/packages/contracts/src/clientRpcPermissions.test.ts
@@ -0,0 +1,15 @@
+import { describe, expect, it } from "@effect/vitest";
+import * as Duration from "effect/Duration";
+import { AuthSettingsWriteScope } from "./auth.ts";
+import { clientRpcRequiredScopes } from "./clientRpcPermissions.ts";
+import { WS_METHODS } from "./rpc.ts";
+
+describe("clientRpcRequiredScopes", () => {
+  it("accepts decoded duration settings", () => {
+    expect(
+      clientRpcRequiredScopes(WS_METHODS.serverUpdateSettings, {
+        patch: { automaticGitFetchInterval: Duration.seconds(30) },
+      }),
+    ).toEqual([AuthSettingsWriteScope]);
+  });
+});
diff --git a/packages/contracts/src/clientRpcPermissions.ts b/packages/contracts/src/clientRpcPermissions.ts
index d3139f2eeff24..2f2d345aca2e4 100644
--- a/packages/contracts/src/clientRpcPermissions.ts
+++ b/packages/contracts/src/clientRpcPermissions.ts
@@ -6,16 +6,20 @@ import {
   AuthOrchestrationReadScope,
   AuthPreviewOperateScope,
   AuthSettingsWriteScope,
+  AuthProvidersManageScope,
   AuthSourceControlWriteScope,
   AuthTerminalOperateScope,
   type AuthEnvironmentScope,
 } from "./auth.ts";
 import { ORCHESTRATION_V2_WS_METHODS } from "./orchestrationV2.ts";
 import { WS_METHODS } from "./rpc.ts";
+import { ServerSettingsPatch, requiredScopesForServerSettingsPatch } from "./settings.ts";
+import { ProviderInstanceMutation } from "./providerInstance.ts";
 
 /** Incremental client enforcement; the server still authorizes every request. */
 export const CLIENT_GUARDED_RPC_SCOPES = {
   [WS_METHODS.previewClose]: AuthPreviewOperateScope,
+  [WS_METHODS.serverUpdateSettings]: AuthSettingsWriteScope,
   // Stopping a server signals its processes, as closing a terminal does.
   [WS_METHODS.previewStopLocalServer]: AuthTerminalOperateScope,
   [WS_METHODS.serverRunStorageCleanup]: AuthSettingsWriteScope,
@@ -73,11 +77,26 @@ export type ClientGuardedRpcTag = keyof typeof CLIENT_GUARDED_RPC_SCOPES;
 
 const decodePrepareThread = Schema.decodeUnknownSync(GitPreparePullRequestThreadInput);
 const decodeStackedAction = Schema.decodeUnknownSync(GitRunStackedActionInput);
+const decodeSettingsUpdate = Schema.decodeUnknownSync(
+  Schema.Struct({
+    patch: Schema.toType(ServerSettingsPatch),
+    providerInstanceMutation: Schema.optionalKey(Schema.toType(ProviderInstanceMutation)),
+  }),
+);
 
 export function clientRpcRequiredScopes(
   method: string,
   input: unknown,
 ): readonly AuthEnvironmentScope[] {
+  if (method === WS_METHODS.serverUpdateSettings && input !== undefined) {
+    const payload = decodeSettingsUpdate(input);
+    const scopes = requiredScopesForServerSettingsPatch(payload.patch);
+    if (payload.providerInstanceMutation === undefined) return scopes;
+    // An atomic provider mutation may also change ordinary environment settings.
+    return Object.values(payload.patch).every((value) => value === undefined)
+      ? [AuthProvidersManageScope]
+      : [...new Set([...scopes, AuthProvidersManageScope])];
+  }
   if (method === WS_METHODS.gitPreparePullRequestThread && input !== undefined) {
     const payload = decodePrepareThread(input);
     if (payload.mode === "worktree" && payload.threadId !== undefined)
diff --git a/packages/contracts/src/environment.ts b/packages/contracts/src/environment.ts
index 9d60bec43fe5c..a9bb9ed6d728d 100644
--- a/packages/contracts/src/environment.ts
+++ b/packages/contracts/src/environment.ts
@@ -140,6 +140,8 @@ export const ExecutionEnvironmentCapabilities = Schema.Struct({
   /** Server answers projects.listIgnoredFiles. */
   ignoredFileListing: Schema.optionalKey(Schema.Boolean),
   environmentIcon: Schema.optionalKey(Schema.Boolean),
+  /** Server persists a host name and streams its updated descriptor to connected clients. */
+  environmentLabel: Schema.optionalKey(Schema.Boolean),
   desktopAppUpdate: Schema.optionalKey(Schema.Boolean),
   /** The desktop app switches update tracks when a server update request names one. */
   desktopAppChannelSwitch: Schema.optionalKey(Schema.Boolean),
diff --git a/packages/contracts/src/relay.ts b/packages/contracts/src/relay.ts
index 8ebc9df23a0bb..34484b2995d2a 100644
--- a/packages/contracts/src/relay.ts
+++ b/packages/contracts/src/relay.ts
@@ -1212,6 +1212,11 @@ export const RelayEnvironmentLinkPreferencesRequest = Schema.Struct({
 export type RelayEnvironmentLinkPreferencesRequest =
   typeof RelayEnvironmentLinkPreferencesRequest.Type;
 
+export const RelayEnvironmentLabelRequest = Schema.Struct({
+  label: TrimmedNonEmptyString,
+});
+export type RelayEnvironmentLabelRequest = typeof RelayEnvironmentLabelRequest.Type;
+
 export const RelayWakeHeldHooksResponse = Schema.Struct({
   pending: Schema.Boolean,
 });
@@ -1262,6 +1267,12 @@ const RelayServerGroup = HttpApiGroup.make("server")
         error: RelayAuthAndInternalErrors,
       },
     ).annotate(OpenApi.Summary, "Update an environment's link preferences"),
+    HttpApiEndpoint.put("updateEnvironmentLabel", "/v1/environments/:environmentId/label", {
+      params: Schema.Struct({ environmentId: EnvironmentId }),
+      payload: RelayEnvironmentLabelRequest,
+      success: RelayOkResponse,
+      error: RelayAuthAndInternalErrors,
+    }).annotate(OpenApi.Summary, "Update an environment's display name"),
     HttpApiEndpoint.post("wakeHeldHooks", "/v1/environments/:environmentId/hooks/wake", {
       params: Schema.Struct({ environmentId: EnvironmentId }),
       success: RelayWakeHeldHooksResponse,
diff --git a/packages/contracts/src/server.ts b/packages/contracts/src/server.ts
index c36f724b8239e..b2bfe5967b9a4 100644
--- a/packages/contracts/src/server.ts
+++ b/packages/contracts/src/server.ts
@@ -717,6 +717,7 @@ export type ServerConfigProviderStatusesPayload = typeof ServerConfigProviderSta
 
 export const ServerConfigSettingsUpdatedPayload = Schema.Struct({
   settings: ServerSettings,
+  environment: Schema.optionalKey(ExecutionEnvironmentDescriptor),
 });
 export type ServerConfigSettingsUpdatedPayload = typeof ServerConfigSettingsUpdatedPayload.Type;
 
diff --git a/packages/contracts/src/settings.test.ts b/packages/contracts/src/settings.test.ts
index 859644a54c72f..8d65b30e97eed 100644
--- a/packages/contracts/src/settings.test.ts
+++ b/packages/contracts/src/settings.test.ts
@@ -349,6 +349,19 @@ describe("ServerSettings worktree defaults", () => {
   });
 });
 
+describe("ServerSettings environment label", () => {
+  it("uses an empty override for legacy configs", () => {
+    expect(decodeServerSettings({}).environmentLabel).toBe("");
+  });
+
+  it("trims environment label updates and allows clearing the override", () => {
+    expect(decodeServerSettingsPatch({ environmentLabel: "  Studio Mac  " }).environmentLabel).toBe(
+      "Studio Mac",
+    );
+    expect(decodeServerSettingsPatch({ environmentLabel: "   " }).environmentLabel).toBe("");
+  });
+});
+
 describe("ServerSettings.sourceControlWritingStyle", () => {
   it.each([
     { legacy: "", mode: "repo_conventions", customInstructions: "" },
diff --git a/packages/contracts/src/settings.ts b/packages/contracts/src/settings.ts
index fff25149b2e3d..5fd0ee3bc3ac0 100644
--- a/packages/contracts/src/settings.ts
+++ b/packages/contracts/src/settings.ts
@@ -1179,6 +1179,7 @@ export const StorageCleanupSettings = Schema.Struct({
 export type StorageCleanupSettings = typeof StorageCleanupSettings.Type;
 
 export const ServerSettings = Schema.Struct({
+  environmentLabel: TrimmedString.pipe(Schema.withDecodingDefault(Effect.succeed(""))),
   // Null means unmigrated; empty is authoritative and must not resurrect cleared preferences.
   favorites: Schema.NullOr(ModelFavorites).pipe(Schema.withDecodingDefault(Effect.succeed(null))),
   providerModelPreferences: Schema.NullOr(ProviderModelPreferences).pipe(
@@ -1568,6 +1569,7 @@ export const ServerSettingsPatch = Schema.Struct({
     }),
   ),
   worktreesDirectory: Schema.optionalKey(TrimmedString),
+  environmentLabel: Schema.optionalKey(TrimmedString),
   responseStreamingMode: Schema.optionalKey(ResponseStreamingMode),
   enableProviderUpdateChecks: Schema.optionalKey(Schema.Boolean),
   continueThreadsAfterServerUpdate: Schema.optionalKey(Schema.Boolean),
diff --git a/packages/shared/package.json b/packages/shared/package.json
index f17f48f1c9e6c..be4a3ffd4fa34 100644
--- a/packages/shared/package.json
+++ b/packages/shared/package.json
@@ -518,6 +518,10 @@
     "./cloneUrl": {
       "types": "./src/cloneUrl.ts",
       "import": "./src/cloneUrl.ts"
+    },
+    "./environmentDisplayLabel": {
+      "types": "./src/environmentDisplayLabel.ts",
+      "import": "./src/environmentDisplayLabel.ts"
     }
   },
   "scripts": {
diff --git a/packages/shared/src/environmentDisplayLabel.ts b/packages/shared/src/environmentDisplayLabel.ts
new file mode 100644
index 0000000000000..cee092b3e0c10
--- /dev/null
+++ b/packages/shared/src/environmentDisplayLabel.ts
@@ -0,0 +1,10 @@
+/** Manual routes keep their device-local alias; primary and Connect hosts share a live name. */
+export function environmentDisplayLabel(
+  entry: { readonly target: { readonly _tag?: string; readonly label: string } },
+  serverConfig: { readonly environment?: { readonly label: string } } | null,
+): string {
+  return entry.target._tag === "PrimaryConnectionTarget" ||
+    entry.target._tag === "RelayConnectionTarget"
+    ? (serverConfig?.environment?.label ?? entry.target.label)
+    : entry.target.label;
+}
diff --git a/packages/shared/src/usageLimits.test.ts b/packages/shared/src/usageLimits.test.ts
index 23447ae7930b0..eadbcb2b34966 100644
--- a/packages/shared/src/usageLimits.test.ts
+++ b/packages/shared/src/usageLimits.test.ts
@@ -181,6 +181,64 @@ describe("pools", () => {
   };
   const laptop = { entry: { target: { label: "Laptop" } } };
 
+  it.each(["PrimaryConnectionTarget", "RelayConnectionTarget", "BearerConnectionTarget"])(
+    "uses the displayed %s name in account details, links, and notices",
+    (kind) => {
+      const expected = kind === "BearerConnectionTarget" ? "Local alias" : "New shared name";
+      const visible = {
+        entry: { target: { _tag: kind, label: "Local alias" } },
+        serverConfig: {
+          environment: { label: "New shared name" },
+          providers: [
+            provider({
+              usageLimits: {
+                checkedAt,
+                windows: [window],
+                externalUsage: { label: "Usage", url: "https://usage.example.test" },
+              },
+            }),
+            provider({
+              instanceId: ProviderInstanceId.make("unavailable"),
+              usageLimits: { checkedAt, windows: [], unavailable: { reason: "probeFailed" } },
+            }),
+          ],
+          usageLimitSources: [
+            {
+              ...source,
+              accounts: [
+                {
+                  id: "source-account",
+                  driver: claude,
+                  email: "source@example.test",
+                  usageLimits: { checkedAt, windows: [window] },
+                },
+              ],
+              error: "Hub unavailable",
+            },
+          ],
+        },
+      };
+      const input = new Map([
+        [EnvironmentId.make("env-a"), visible],
+        [
+          EnvironmentId.make("env-b"),
+          {
+            ...visible,
+            serverConfig: { ...visible.serverConfig, providers: [], usageLimitSources: [] },
+          },
+        ],
+      ]);
+      expect(collectLimitAccounts(input)[0]?.environments).toEqual([
+        { environmentId: "env-a", label: expected },
+      ]);
+      expect(collectLimitAccounts(input)[1]?.sourceLabel).toBe(`${expected} · hub`);
+      expect(collectExternalUsageLinks(input)[0]?.accounts).toEqual([`codex on ${expected}`]);
+      expect(
+        collectLimitNotices(input).every((notice) => notice.startsWith(`${expected} · `)),
+      ).toBe(true);
+    },
+  );
+
   it("merges one account reported natively on two environments and by a hub into one entry", () => {
     const native = provider({
       driver: claude,
diff --git a/packages/shared/src/usageLimits.ts b/packages/shared/src/usageLimits.ts
index bf7dfea4e04bf..d5fb84fc86699 100644
--- a/packages/shared/src/usageLimits.ts
+++ b/packages/shared/src/usageLimits.ts
@@ -16,6 +16,7 @@ import {
 } from "@t3tools/contracts";
 
 import * as DateTime from "effect/DateTime";
+import { environmentDisplayLabel } from "./environmentDisplayLabel.ts";
 
 const MINUTE = 60_000;
 const HOUR = 60 * MINUTE;
@@ -153,9 +154,10 @@ function providersWithLimits(providers: readonly ServerProvider[]): readonly Ser
 export type LimitPresentations = ReadonlyMap<
   EnvironmentId,
   {
-    readonly entry: { readonly target: { readonly label: string } };
+    readonly entry: { readonly target: { readonly _tag?: string; readonly label: string } };
     readonly serverConfig: {
       readonly providers: readonly ServerProvider[];
+      readonly environment?: { readonly label: string };
       readonly usageLimitSources?: UsageLimitSourceSnapshots | undefined;
     } | null;
   }
@@ -175,7 +177,7 @@ export function collectExternalUsageLinks(presentations: LimitPresentations) {
     for (const provider of providersWithLimits(presentation.serverConfig?.providers ?? [])) {
       const external = provider.usageLimits?.externalUsage;
       if (external && provider.auth.status === "authenticated") {
-        const account = `${provider.displayName ?? provider.instanceId} on ${presentation.entry.target.label}`;
+        const account = `${provider.displayName ?? provider.instanceId} on ${environmentDisplayLabel(presentation.entry, presentation.serverConfig)}`;
         links.set(external.url, {
           ...external,
           message: provider.usageLimits?.unavailable?.message,
@@ -324,7 +326,7 @@ export function collectLimitAccounts(presentations: LimitPresentations): readonl
     ]),
   );
   for (const [environmentId, presentation] of presentations) {
-    const label = presentation.entry.target.label;
+    const label = environmentDisplayLabel(presentation.entry, presentation.serverConfig);
     for (const provider of providersWithLimits(presentation.serverConfig?.providers ?? [])) {
       if (!provider.usageLimits || limitsNotice(provider.usageLimits) !== null) continue;
       merge(resolveKey(nativeReport(provider)) ?? `${environmentId}:${provider.instanceId}`, {
@@ -345,7 +347,7 @@ export function collectLimitAccounts(presentations: LimitPresentations): readonl
   for (const [environmentId, presentation] of presentations) {
     for (const source of presentation.serverConfig?.usageLimitSources ?? []) {
       const sourceLabel = labelEnvironment
-        ? `${presentation.entry.target.label} · ${source.label}`
+        ? `${environmentDisplayLabel(presentation.entry, presentation.serverConfig)} · ${source.label}`
         : source.label;
       for (const account of source.accounts) {
         if (limitsNotice(account.usageLimits) !== null) continue;
@@ -382,7 +384,7 @@ export function collectLimitNotices(presentations: LimitPresentations): readonly
     presentations.size > 1 ? `${environmentLabel} · ${subject}` : subject;
   const notices: string[] = [];
   for (const presentation of presentations.values()) {
-    const environmentLabel = presentation.entry.target.label;
+    const environmentLabel = environmentDisplayLabel(presentation.entry, presentation.serverConfig);
     for (const provider of providersWithLimits(presentation.serverConfig?.providers ?? [])) {
       if (provider.usageLimits?.unavailable?.reason === "unsupported") continue;
       const notice = provider.usageLimits ? limitsNotice(provider.usageLimits) : null;