diff --git a/clients/web/src/App.tsx b/clients/web/src/App.tsx
index 9e764b6b..e1685093 100644
--- a/clients/web/src/App.tsx
+++ b/clients/web/src/App.tsx
@@ -4591,21 +4591,31 @@ function App() {
         initialConfig={configModalTarget?.config}
         existingIds={existingIds}
         onClose={() => setConfigModal(null)}
-        onSubmit={onConfigSubmit}
+        // Wrapped like the settings persists: this submit carries stdio `env`
+        // values, so it can perform the pending plaintext-to-encrypted
+        // upgrade and change the descriptor the footer reports.
+        onSubmit={refreshingPersist(onConfigSubmit, refreshInitialConfig)}
+        secretStorage={secretStorage}
       />
       <ServerImportConfigModal
         opened={importConfigOpen}
         existingIds={existingIds}
         onClose={() => setImportConfigOpen(false)}
         onFetchSource={importSource}
-        onAddServer={addServerHighlighted}
-        onUpdateServer={updateServer}
+        onAddServer={refreshingPersist(
+          addServerHighlighted,
+          refreshInitialConfig,
+        )}
+        onUpdateServer={refreshingPersist(updateServer, refreshInitialConfig)}
       />
       <ServerImportJsonModal
         opened={importJsonOpen}
         existingIds={existingIds}
         onClose={() => setImportJsonOpen(false)}
-        onAddServer={addServerHighlighted}
+        onAddServer={refreshingPersist(
+          addServerHighlighted,
+          refreshInitialConfig,
+        )}
       />
       <ServerSettingsModal
         // Remount per open (and per target server) so the accordion resets to
diff --git a/clients/web/src/components/elements/SecretStorageFooter/SecretStorageFooter.tsx b/clients/web/src/components/elements/SecretStorageFooter/SecretStorageFooter.tsx
index 66415f88..97955557 100644
--- a/clients/web/src/components/elements/SecretStorageFooter/SecretStorageFooter.tsx
+++ b/clients/web/src/components/elements/SecretStorageFooter/SecretStorageFooter.tsx
@@ -226,9 +226,13 @@ function footerTooltip(info: SecretStorageInfo): string | undefined {
  * The permanent "here is where your secrets go" strip at the bottom of the
  * Client Settings and Server Settings modals (#1950).
  *
- * Those two dialogs are the only places the Inspector accepts a secret —
- * an OAuth client secret, an enterprise IdP client secret, a stdio `env:`
- * value — so they are where the answer belongs. The alternatives were
+ * It appears wherever the Inspector accepts a secret — Client Settings (the
+ * enterprise IdP client secret), Server Settings (the per-server OAuth
+ * client secret and stdio `env:` values), and Server Config (stdio `env:`
+ * values again). This comment named only the first two until review round
+ * 20, and the dialog it omitted was the one taking secrets with no
+ * disclosure at all, so the wrong count here was the bug rather than a
+ * description of it. The alternatives were
  * considered and rejected: a startup banner is seen once, by whoever
  * started the process, possibly hours before anyone types anything; a
  * toast is seen once and then gone; a dismissible banner is, by design,
diff --git a/core/auth/node/secret-store-selection.ts b/core/auth/node/secret-store-selection.ts
index 8e06ffb1..7a9a4cc8 100644
--- a/core/auth/node/secret-store-selection.ts
+++ b/core/auth/node/secret-store-selection.ts
@@ -39,6 +39,7 @@
  * stating that this directory is meant to survive.
  */
 
+import { randomUUID } from "node:crypto";
 import * as fsSync from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
@@ -555,7 +556,12 @@ export async function absorbFileSecretsIntoKeyring(
   // The staged name carries the pid so two Inspectors starting together
   // cannot claim the same destination; whichever wins the rename does the
   // migration and the loser sees ENOENT and returns.
-  const staged = `${filePath}.migrating-${process.pid}`;
+  // A per-attempt nonce, not just the pid. `recoverOrphanedSnapshots`
+  // deliberately leaves an orphan in place when a live `secrets.json` also
+  // exists — and a pid-only name is reusable across restarts (pid 1 on every
+  // container start), so the next claim would `rename` straight over that
+  // orphan and permanently discard secrets it may uniquely hold.
+  const staged = `${filePath}.migrating-${process.pid}-${randomUUID()}`;
   try {
     await fs.rename(filePath, staged);
   } catch (err) {