diff --git a/.github/releases/v2.0.1.md b/.github/releases/v2.0.1.md
new file mode 100644
index 0000000..bf947fa
--- /dev/null
+++ b/.github/releases/v2.0.1.md
@@ -0,0 +1,30 @@
+# Blockbusterr v2.0.1
+
+This patch fixes the broken connection setup workflow in v2.0.0. I am sorry for the frustrating first experience, and thank you to the users who reported it.
+
+## Fixes
+
+- Save changes works repeatedly without reloading the page.
+- Radarr and Sonarr can load profiles and root folders using newly entered credentials before saving.
+- Saved API keys stay hidden while connections correctly show as configured. Retesting no longer requires retyping saved keys.
+- Temporary connection failures preserve selected profiles and folders, and show the actual error.
+- Changes typed while a save is in progress remain marked as unsaved.
+
+The previous empty key fields did not by themselves mean saved keys were deleted. Changes that were never successfully saved still need to be entered again.
+
+## Update from v2.0.0
+
+Keep your existing data volume. Set your image to `ghcr.io/mahcks/blockbusterr:v2.0.1`, pull it, and recreate the container. The stable `latest` tag also receives this patch.
+
+For Docker Compose, after updating the image tag:
+
+```bash
+docker compose pull
+docker compose up -d
+```
+
+Reload Settings, verify your connections, and save any unfinished setup. There is no configuration migration required from v2.0.0 and no need to delete your installation or data.
+
+New desktop and mobile browser checks cover setup from empty configuration, testing, loading options, saving twice, and returning to saved settings. The release pipeline now runs the browser suite against the candidate image before publishing it.
+
+Upgrading from v1? Follow the [v2 upgrade guide](https://blockbusterr.dev/getting-started/upgrading-to-v2/).
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index a5d73b0..3bb3afd 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -74,6 +74,11 @@ jobs:
       - name: Smoke runtime image
         run: scripts/test-container-smoke.sh blockbusterr:release-candidate
 
+      - name: Verify fresh-install settings in the release image
+        run: |
+          npx playwright install --with-deps chromium
+          BLOCKBUSTERR_BROWSER_IMAGE=blockbusterr:release-candidate npm run test:browser
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c96313f..4a4bc22 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,21 @@ All notable changes to Blockbusterr are documented here. The project follows sem
 
 ## [Unreleased]
 
+## [2.0.1] - 2026-09-12
+
+### Fixed
+
+- Settings can save successive changes without reloading the page.
+- Radarr and Sonarr profiles and root folders load with the credentials entered during setup, before saving.
+- Saved hidden credentials correctly count as configured and can be retested without re-entering keys.
+- Failed option loading preserves saved defaults and displays the server error.
+- Edits made during a save remain marked as unsaved.
+
+### Validation
+
+- Added desktop and mobile browser coverage for empty configuration, connection testing, two saves, navigation, saved credentials, and unavailable delivery services.
+- Release publication now requires the browser suite to pass against the candidate Docker image.
+
 ## [2.0.0] - 2026-09-12
 
 ### Added
diff --git a/README.md b/README.md
index 7a43732..ab821fe 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 # Blockbusterr
 
 > [!IMPORTANT]
-> **Blockbusterr v2.0.0** introduces reusable rules, preview-first jobs, and delivery safeguards. `latest` follows stable releases; `latest-beta` follows prereleases. Read the [documentation](https://blockbusterr.dev/) and [release notes](https://github.com/Mahcks/blockbusterr/releases/tag/v2.0.0). Upgrading from v1? Back up your complete data directory and follow the [upgrade guide](https://blockbusterr.dev/getting-started/upgrading-to-v2/).
+> **Blockbusterr v2.0.1** fixes connection setup and saving settings in v2. `latest` follows stable releases; `latest-beta` follows prereleases. Read the [documentation](https://blockbusterr.dev/) and [release notes](https://github.com/Mahcks/blockbusterr/releases/tag/v2.0.1). Upgrading from v1? Back up your complete data directory and follow the [upgrade guide](https://blockbusterr.dev/getting-started/upgrading-to-v2/).
 
 **Automated media discovery with rule-based decision making for self-hosted libraries.**
 
@@ -82,7 +82,7 @@ docker run -d \
   --restart unless-stopped \
   -p 9090:9090 \
   -v blockbusterr-data:/app/data \
-  ghcr.io/mahcks/blockbusterr:v2.0.0
+  ghcr.io/mahcks/blockbusterr:v2.0.1
 ```
 
 Open `http://localhost:9090`, connect one discovery provider and one delivery target, then create and preview a job.
diff --git a/docker-compose.yaml b/docker-compose.yaml
index a5a7680..7540c74 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -1,6 +1,6 @@
 services:
   blockbusterr:
-    image: ghcr.io/mahcks/blockbusterr:v2.0.0
+    image: ghcr.io/mahcks/blockbusterr:v2.0.1
     container_name: blockbusterr
     restart: unless-stopped
     ports:
diff --git a/docs/src/content/docs/getting-started/deployment-platforms.mdx b/docs/src/content/docs/getting-started/deployment-platforms.mdx
index 67c0644..b7b9ba2 100644
--- a/docs/src/content/docs/getting-started/deployment-platforms.mdx
+++ b/docs/src/content/docs/getting-started/deployment-platforms.mdx
@@ -9,8 +9,8 @@ Blockbusterr uses the same container on every compatible platform. The platform
 
 | Setting | Value |
 | --- | --- |
-| Image | `ghcr.io/mahcks/blockbusterr:v2.0.0` |
-| Pinned release tag | `ghcr.io/mahcks/blockbusterr:v2.0.0` |
+| Image | `ghcr.io/mahcks/blockbusterr:v2.0.1` |
+| Pinned release tag | `ghcr.io/mahcks/blockbusterr:v2.0.1` |
 | Container port | `9090/tcp` |
 | Persistent container path | `/app/data` |
 | Required environment variables | None |
@@ -30,7 +30,7 @@ Use this on a Linux server, Docker Desktop, or any platform that accepts a Compo
 ```yaml
 services:
   blockbusterr:
-    image: ghcr.io/mahcks/blockbusterr:v2.0.0
+    image: ghcr.io/mahcks/blockbusterr:v2.0.1
     container_name: blockbusterr
     ports:
       - "9090:9090"
@@ -55,7 +55,7 @@ Remove `BLOCKBUSTERR_DRY_RUN` after you have previewed a job and are ready to pe
 
 <Steps>
 1. Open **Docker**, select **Add Container**, and switch to the advanced view if needed.
-2. Set the name to `blockbusterr` and the repository to `ghcr.io/mahcks/blockbusterr:v2.0.0`.
+2. Set the name to `blockbusterr` and the repository to `ghcr.io/mahcks/blockbusterr:v2.0.1`.
 3. Map a free host port, normally `9090`, to container port `9090` using TCP.
 4. Map `/mnt/user/appdata/blockbusterr` on the host to `/app/data` in the container with read/write access.
 5. Add `TZ` using your IANA timezone. Add `BLOCKBUSTERR_DRY_RUN=true` while verifying your setup.
@@ -70,7 +70,7 @@ An official Community Applications template is not currently published. Adding t
 <TabItem label="TrueNAS SCALE">
 
 <Steps>
-1. Open **Apps**, choose the option to install a custom app, and use `ghcr.io/mahcks/blockbusterr:v2.0.0` as the image.
+1. Open **Apps**, choose the option to install a custom app, and use `ghcr.io/mahcks/blockbusterr:v2.0.1` as the image.
 2. Expose container port `9090` over TCP using an available host port.
 3. Add host-path storage for a dataset such as `/mnt/<pool>/apps/blockbusterr`, mounted inside the container at `/app/data` with write access.
 4. Add `TZ` and, while verifying your setup, `BLOCKBUSTERR_DRY_RUN=true` as environment variables.
diff --git a/docs/src/content/docs/getting-started/installation.mdx b/docs/src/content/docs/getting-started/installation.mdx
index 2a48dee..8f7bfaf 100644
--- a/docs/src/content/docs/getting-started/installation.mdx
+++ b/docs/src/content/docs/getting-started/installation.mdx
@@ -30,7 +30,7 @@ Configure any one supported discovery provider: TMDB, Simkl, Trakt, or MDBList.
 </Aside>
 
 <Aside type="caution" title="Installing v2">
-Pin `ghcr.io/mahcks/blockbusterr:v2.0.0` for this release. `latest` follows stable releases and can move across major versions; `latest-beta` follows prereleases. Before upgrading from v1, back up the complete data directory and follow the [upgrade guide](/getting-started/upgrading-to-v2/).
+Pin `ghcr.io/mahcks/blockbusterr:v2.0.1` for this release. `latest` follows stable releases and can move across major versions; `latest-beta` follows prereleases. Before upgrading from v1, back up the complete data directory and follow the [upgrade guide](/getting-started/upgrading-to-v2/).
 </Aside>
 
 <Aside type="tip" title="Using a NAS or container UI">
@@ -49,7 +49,7 @@ See [Deployment platforms](/getting-started/deployment-platforms/) for field-by-
 1. Pull the release image:
 
    ```bash
-   docker pull ghcr.io/mahcks/blockbusterr:v2.0.0
+   docker pull ghcr.io/mahcks/blockbusterr:v2.0.1
    ```
 
 2. Run the container:
@@ -60,7 +60,7 @@ See [Deployment platforms](/getting-started/deployment-platforms/) for field-by-
      -p 9090:9090 \
      -v blockbusterr-data:/app/data \
      -e TZ=America/New_York \
-     ghcr.io/mahcks/blockbusterr:v2.0.0
+     ghcr.io/mahcks/blockbusterr:v2.0.1
    ```
 
 3. Access the web UI at `http://localhost:9090`
@@ -83,7 +83,7 @@ Use `docker logs blockbusterr -f` to view live logs and verify startup.
    ```yaml
    services:
      blockbusterr:
-       image: ghcr.io/mahcks/blockbusterr:v2.0.0
+       image: ghcr.io/mahcks/blockbusterr:v2.0.1
        container_name: blockbusterr
        ports:
          - "9090:9090"
@@ -124,7 +124,7 @@ networks:
 
 services:
   blockbusterr:
-    image: ghcr.io/mahcks/blockbusterr:v2.0.0
+    image: ghcr.io/mahcks/blockbusterr:v2.0.1
     container_name: blockbusterr
     networks:
       - media
@@ -242,7 +242,7 @@ docker run -d \
   -e DATA_DIR=/app/data \
   -e TZ=Europe/London \
   -v $(pwd)/data:/app/data \
-  ghcr.io/mahcks/blockbusterr:v2.0.0
+  ghcr.io/mahcks/blockbusterr:v2.0.1
 ```
 
 ## Health Check
@@ -257,7 +257,7 @@ Expected response:
 
 ```json
 {
-  "version": "v2.0.0",
+  "version": "v2.0.1",
   "uptime": "1785518792000"
 }
 ```
@@ -268,7 +268,7 @@ Expected response:
 <TabItem label="Docker" icon="seti:docker">
 
 ```bash
-docker pull ghcr.io/mahcks/blockbusterr:v2.0.0
+docker pull ghcr.io/mahcks/blockbusterr:v2.0.1
 docker stop blockbusterr
 docker rm blockbusterr
 # Then run the original docker run command
@@ -277,7 +277,7 @@ docker rm blockbusterr
 </TabItem>
 <TabItem label="Docker Compose" icon="seti:yml">
 
-Update `image:` in your Compose file to the intended version before pulling. For this release, use `ghcr.io/mahcks/blockbusterr:v2.0.0`.
+Update `image:` in your Compose file to the intended version before pulling. For this release, use `ghcr.io/mahcks/blockbusterr:v2.0.1`.
 
 ```bash
 docker compose pull blockbusterr
diff --git a/docs/src/content/docs/getting-started/quickstart.mdx b/docs/src/content/docs/getting-started/quickstart.mdx
index bd9a6c7..efbfb6f 100644
--- a/docs/src/content/docs/getting-started/quickstart.mdx
+++ b/docs/src/content/docs/getting-started/quickstart.mdx
@@ -13,7 +13,7 @@ docker run -d \
   -p 9090:9090 \
   -v blockbusterr-data:/app/data \
   --restart unless-stopped \
-  ghcr.io/mahcks/blockbusterr:v2.0.0
+  ghcr.io/mahcks/blockbusterr:v2.0.1
 ```
 
 Open `http://localhost:9090`. To enable owner authentication, add `-e BLOCKBUSTERR_AUTH_TOKEN="replace-with-at-least-32-random-characters"` and sign in as `blockbusterr`.
diff --git a/internal/rest/v1/routes/connection.go b/internal/rest/v1/routes/connection.go
new file mode 100644
index 0000000..929b231
--- /dev/null
+++ b/internal/rest/v1/routes/connection.go
@@ -0,0 +1,31 @@
+package routes
+
+import (
+	"strings"
+
+	"github.com/gofiber/fiber/v2"
+)
+
+// connectionCredentials accepts draft credentials without saving them. A hidden
+// saved key may only be reused for the same server, never a replacement URL.
+func connectionCredentials(c *fiber.Ctx, savedURL, savedKey string) (string, string, error) {
+	c.Set(fiber.HeaderCacheControl, "no-store")
+	if c.Method() != fiber.MethodPost {
+		return savedURL, savedKey, nil
+	}
+	var request struct {
+		URL    string `json:"url"`
+		APIKey string `json:"api_key"`
+	}
+	if err := c.BodyParser(&request); err != nil {
+		return "", "", fiber.NewError(fiber.StatusBadRequest, "Invalid request body")
+	}
+	url, key := strings.TrimSpace(request.URL), strings.TrimSpace(request.APIKey)
+	if key == "" && url == savedURL {
+		key = savedKey
+	}
+	if url == "" || key == "" {
+		return "", "", fiber.NewError(fiber.StatusBadRequest, "Server URL and API key are required; enter a key when changing servers")
+	}
+	return url, key, nil
+}
diff --git a/internal/rest/v1/routes/connection_validation_test.go b/internal/rest/v1/routes/connection_validation_test.go
index 104e761..c5ab5e2 100644
--- a/internal/rest/v1/routes/connection_validation_test.go
+++ b/internal/rest/v1/routes/connection_validation_test.go
@@ -3,6 +3,8 @@ package routes
 import (
 	"bytes"
 	"context"
+	"encoding/json"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -44,3 +46,73 @@ func TestRadarrValidationAcceptsCredentialsInPostBody(t *testing.T) {
 		t.Fatalf("Cache-Control = %q", cache)
 	}
 }
+
+func TestConnectionOptionsUseDraftAndSavedCredentials(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("X-Api-Key") != "test-secret" || r.URL.RawQuery != "" {
+			t.Error("credentials must use the API key header")
+		}
+		w.Header().Set("Content-Type", "application/json")
+		if strings.Contains(r.URL.Path, "qualityprofile") {
+			_, _ = w.Write([]byte(`[{"id":7,"name":"HD"}]`))
+		} else if strings.Contains(r.URL.Path, "rootfolder") {
+			_, _ = w.Write([]byte(`[{"id":1,"path":"/media"}]`))
+		} else {
+			_, _ = w.Write([]byte(`{"version":"1.0.0"}`))
+		}
+	}))
+	defer upstream.Close()
+	for _, saved := range []bool{false, true} {
+		cfg := &config.Config{}
+		if saved {
+			cfg.Radarr.URL, cfg.Radarr.APIKey = upstream.URL, "test-secret"
+			cfg.Sonarr.URL, cfg.Sonarr.APIKey = upstream.URL, "test-secret"
+			cfg.Jellyseerr.URL, cfg.Jellyseerr.APIKey = upstream.URL, "test-secret"
+		}
+		gctx := global.New(context.Background(), cfg, nil, "test", "test", nil)
+		app := fiber.New()
+		routes := NewRouteGroup(gctx)
+		RegisterRadarrRoutes(routes, app.Group("/v1"))
+		RegisterSonarrRoutes(routes, app.Group("/v1"))
+		routes.RegisterJellyseerrRoutes(app.Group("/v1"))
+		for _, service := range []string{"radarr", "sonarr", "jellyseerr"} {
+			paths := []string{"validate"}
+			if service != "jellyseerr" {
+				paths = append(paths, "quality-profiles", "root-folders")
+			}
+			for _, path := range paths {
+				for _, scenario := range []struct {
+					name, url, key string
+					status         int
+				}{
+					{"draft", upstream.URL, "test-secret", 200},
+					{"hidden", upstream.URL, "", map[bool]int{true: 200, false: 400}[saved]},
+					{"different server", "http://127.0.0.1:1", "", 400},
+				} {
+					t.Run(fmt.Sprintf("%s/%s/saved=%t/%s", service, path, saved, scenario.name), func(t *testing.T) {
+						body, err := json.Marshal(map[string]string{"url": scenario.url, "api_key": scenario.key})
+						if err != nil {
+							t.Fatal(err)
+						}
+						req := httptest.NewRequest(http.MethodPost, "/v1/"+service+"/"+path, bytes.NewReader(body))
+						req.Header.Set("Content-Type", "application/json")
+						resp, err := app.Test(req, -1)
+						if err != nil {
+							t.Fatal(err)
+						}
+						defer func() { _ = resp.Body.Close() }()
+						if resp.StatusCode != scenario.status {
+							t.Fatalf("status=%d want=%d", resp.StatusCode, scenario.status)
+						}
+						if resp.Header.Get("Cache-Control") != "no-store" {
+							t.Error("missing no-store")
+						}
+					})
+				}
+			}
+		}
+		if !saved && (cfg.Radarr.APIKey != "" || cfg.Sonarr.APIKey != "" || cfg.Jellyseerr.APIKey != "") {
+			t.Error("draft request persisted credentials")
+		}
+	}
+}
diff --git a/internal/rest/v1/routes/dynamic_jobs.go b/internal/rest/v1/routes/dynamic_jobs.go
index 182a1c0..4150b96 100644
--- a/internal/rest/v1/routes/dynamic_jobs.go
+++ b/internal/rest/v1/routes/dynamic_jobs.go
@@ -26,7 +26,9 @@ func AddDynamicJobsRoutes(router fiber.Router, gctx global.Context) {
 			if err := c.BodyParser(&request); err != nil {
 				return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "Invalid request body"})
 			}
-			apiKey = request.APIKey
+			if request.APIKey != "" {
+				apiKey = request.APIKey
+			}
 		}
 		c.Set(fiber.HeaderCacheControl, "no-store")
 		if apiKey == "" {
diff --git a/internal/rest/v1/routes/jellyseerr.go b/internal/rest/v1/routes/jellyseerr.go
index 93c6e5a..4bd2c5f 100644
--- a/internal/rest/v1/routes/jellyseerr.go
+++ b/internal/rest/v1/routes/jellyseerr.go
@@ -8,32 +8,10 @@ import (
 func (rg *RouteGroup) RegisterJellyseerrRoutes(group fiber.Router) {
 	// Validate Jellyseerr connection
 	validate := func(c *fiber.Ctx) error {
-		var url, apiKey string
-		if c.Method() == fiber.MethodPost {
-			var request struct {
-				URL    string `json:"url"`
-				APIKey string `json:"api_key"`
-			}
-			if err := c.BodyParser(&request); err != nil {
-				return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "Invalid request body", "connected": false})
-			}
-			url, apiKey = request.URL, request.APIKey
-		} else {
-			// Normal mode, use saved config
-			cfg := rg.gctx.Config()
-			url = cfg.Jellyseerr.URL
-			apiKey = cfg.Jellyseerr.APIKey
-
-			if url == "" || apiKey == "" {
-				return c.Status(400).JSON(fiber.Map{
-					"connected": false,
-					"error":     "Jellyseerr URL or API key is not configured",
-				})
-			}
-		}
-		c.Set(fiber.HeaderCacheControl, "no-store")
-		if url == "" || apiKey == "" {
-			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "Jellyseerr URL and API key are required", "connected": false})
+		cfg := rg.gctx.Config()
+		url, apiKey, err := connectionCredentials(c, cfg.Jellyseerr.URL, cfg.Jellyseerr.APIKey)
+		if err != nil || url == "" || apiKey == "" {
+			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "Server URL and API key are required; enter a key when changing servers", "connected": false})
 		}
 
 		jellyseerrClient := integrations.NewJellyseerr(integrations.JellyseerrConfig{
diff --git a/internal/rest/v1/routes/radarr.go b/internal/rest/v1/routes/radarr.go
index e91f8ec..15adf64 100644
--- a/internal/rest/v1/routes/radarr.go
+++ b/internal/rest/v1/routes/radarr.go
@@ -18,9 +18,11 @@ func RegisterRadarrRoutes(rg *RouteGroup, group fiber.Router) {
 
 	// GET /v1/radarr/quality-profiles - Get quality profiles
 	radarr.Get("/quality-profiles", rg.GetRadarrQualityProfiles)
+	radarr.Post("/quality-profiles", rg.GetRadarrQualityProfiles)
 
 	// GET /v1/radarr/root-folders - Get root folders
 	radarr.Get("/root-folders", rg.GetRadarrRootFolders)
+	radarr.Post("/root-folders", rg.GetRadarrRootFolders)
 
 	// GET /v1/radarr/lookup?term=inception - Lookup movie
 	radarr.Get("/lookup", rg.LookupRadarrMovie)
@@ -31,23 +33,11 @@ func RegisterRadarrRoutes(rg *RouteGroup, group fiber.Router) {
 
 // ValidateRadarr validates the Radarr API connection
 func (rg *RouteGroup) ValidateRadarr(c *fiber.Ctx) error {
-	var url, apiKey string
-	if c.Method() == fiber.MethodPost {
-		var request struct {
-			URL    string `json:"url"`
-			APIKey string `json:"api_key"`
-		}
-		if err := c.BodyParser(&request); err != nil {
-			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "Invalid request body", "connected": false})
-		}
-		url, apiKey = request.URL, request.APIKey
-	} else {
-		// Normal mode, use saved config
-		cfg := rg.gctx.Config()
-		url = cfg.Radarr.URL
-		apiKey = cfg.Radarr.APIKey
+	cfg := rg.gctx.Config()
+	url, apiKey, err := connectionCredentials(c, cfg.Radarr.URL, cfg.Radarr.APIKey)
+	if err != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": err.Error(), "connected": false})
 	}
-	c.Set(fiber.HeaderCacheControl, "no-store")
 
 	if url == "" || apiKey == "" {
 		return c.Status(400).JSON(fiber.Map{
@@ -101,10 +91,14 @@ func (rg *RouteGroup) GetRadarrMovies(c *fiber.Ctx) error {
 // GetRadarrQualityProfiles returns quality profiles
 func (rg *RouteGroup) GetRadarrQualityProfiles(c *fiber.Ctx) error {
 	cfg := rg.gctx.Config()
+	url, apiKey, err := connectionCredentials(c, cfg.Radarr.URL, cfg.Radarr.APIKey)
+	if err != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": err.Error()})
+	}
 
 	radarrClient := integrations.NewRadarr(integrations.RadarrConfig{
-		BaseURL: cfg.Radarr.URL,
-		APIKey:  cfg.Radarr.APIKey,
+		BaseURL: url,
+		APIKey:  apiKey,
 	})
 
 	profiles, err := radarrClient.GetQualityProfiles(c.Context())
@@ -123,10 +117,14 @@ func (rg *RouteGroup) GetRadarrQualityProfiles(c *fiber.Ctx) error {
 // GetRadarrRootFolders returns root folders
 func (rg *RouteGroup) GetRadarrRootFolders(c *fiber.Ctx) error {
 	cfg := rg.gctx.Config()
+	url, apiKey, err := connectionCredentials(c, cfg.Radarr.URL, cfg.Radarr.APIKey)
+	if err != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": err.Error()})
+	}
 
 	radarrClient := integrations.NewRadarr(integrations.RadarrConfig{
-		BaseURL: cfg.Radarr.URL,
-		APIKey:  cfg.Radarr.APIKey,
+		BaseURL: url,
+		APIKey:  apiKey,
 	})
 
 	folders, err := radarrClient.GetRootFolders(c.Context())
diff --git a/internal/rest/v1/routes/sonarr.go b/internal/rest/v1/routes/sonarr.go
index d5bbb37..ac98065 100644
--- a/internal/rest/v1/routes/sonarr.go
+++ b/internal/rest/v1/routes/sonarr.go
@@ -18,9 +18,11 @@ func RegisterSonarrRoutes(rg *RouteGroup, group fiber.Router) {
 
 	// GET /v1/sonarr/quality-profiles - Get quality profiles
 	sonarr.Get("/quality-profiles", rg.GetSonarrQualityProfiles)
+	sonarr.Post("/quality-profiles", rg.GetSonarrQualityProfiles)
 
 	// GET /v1/sonarr/root-folders - Get root folders
 	sonarr.Get("/root-folders", rg.GetSonarrRootFolders)
+	sonarr.Post("/root-folders", rg.GetSonarrRootFolders)
 
 	// GET /v1/sonarr/lookup?term=breaking+bad - Lookup series
 	sonarr.Get("/lookup", rg.LookupSonarrSeries)
@@ -31,23 +33,11 @@ func RegisterSonarrRoutes(rg *RouteGroup, group fiber.Router) {
 
 // ValidateSonarr validates the Sonarr API connection
 func (rg *RouteGroup) ValidateSonarr(c *fiber.Ctx) error {
-	var url, apiKey string
-	if c.Method() == fiber.MethodPost {
-		var request struct {
-			URL    string `json:"url"`
-			APIKey string `json:"api_key"`
-		}
-		if err := c.BodyParser(&request); err != nil {
-			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "Invalid request body", "connected": false})
-		}
-		url, apiKey = request.URL, request.APIKey
-	} else {
-		// Normal mode, use saved config
-		cfg := rg.gctx.Config()
-		url = cfg.Sonarr.URL
-		apiKey = cfg.Sonarr.APIKey
+	cfg := rg.gctx.Config()
+	url, apiKey, err := connectionCredentials(c, cfg.Sonarr.URL, cfg.Sonarr.APIKey)
+	if err != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": err.Error(), "connected": false})
 	}
-	c.Set(fiber.HeaderCacheControl, "no-store")
 
 	if url == "" || apiKey == "" {
 		return c.Status(400).JSON(fiber.Map{
@@ -101,10 +91,14 @@ func (rg *RouteGroup) GetSonarrSeries(c *fiber.Ctx) error {
 // GetSonarrQualityProfiles returns quality profiles
 func (rg *RouteGroup) GetSonarrQualityProfiles(c *fiber.Ctx) error {
 	cfg := rg.gctx.Config()
+	url, apiKey, err := connectionCredentials(c, cfg.Sonarr.URL, cfg.Sonarr.APIKey)
+	if err != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": err.Error()})
+	}
 
 	sonarrClient := integrations.NewSonarr(integrations.SonarrConfig{
-		BaseURL: cfg.Sonarr.URL,
-		APIKey:  cfg.Sonarr.APIKey,
+		BaseURL: url,
+		APIKey:  apiKey,
 	})
 
 	profiles, err := sonarrClient.GetQualityProfiles(c.Context())
@@ -123,10 +117,14 @@ func (rg *RouteGroup) GetSonarrQualityProfiles(c *fiber.Ctx) error {
 // GetSonarrRootFolders returns root folders
 func (rg *RouteGroup) GetSonarrRootFolders(c *fiber.Ctx) error {
 	cfg := rg.gctx.Config()
+	url, apiKey, err := connectionCredentials(c, cfg.Sonarr.URL, cfg.Sonarr.APIKey)
+	if err != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": err.Error()})
+	}
 
 	sonarrClient := integrations.NewSonarr(integrations.SonarrConfig{
-		BaseURL: cfg.Sonarr.URL,
-		APIKey:  cfg.Sonarr.APIKey,
+		BaseURL: url,
+		APIKey:  apiKey,
 	})
 
 	folders, err := sonarrClient.GetRootFolders(c.Context())
diff --git a/internal/rest/v1/routes/trakt.go b/internal/rest/v1/routes/trakt.go
index 5b067a9..bbd57dd 100644
--- a/internal/rest/v1/routes/trakt.go
+++ b/internal/rest/v1/routes/trakt.go
@@ -179,6 +179,10 @@ func (rg *RouteGroup) ValidateTrakt(c *fiber.Ctx) error {
 			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "Invalid request body", "connected": false})
 		}
 		clientID, clientSecret = request.ClientID, request.ClientSecret
+		cfg := rg.gctx.Config()
+		if clientSecret == "" && clientID == cfg.Trakt.ClientID {
+			clientSecret = cfg.Trakt.ClientSecret
+		}
 	} else {
 		// Normal mode, use saved config
 		cfg := rg.gctx.Config()
diff --git a/tests/browser/server.mjs b/tests/browser/server.mjs
index 9eb584f..1ee9ec0 100644
--- a/tests/browser/server.mjs
+++ b/tests/browser/server.mjs
@@ -13,11 +13,18 @@ jobs:
   list: []
 `);
 
+const containerImage = process.env.BLOCKBUSTERR_BROWSER_IMAGE;
+const containerName = `blockbusterr-browser-${process.pid}`;
 const binary = join(dataDir, 'blockbusterr');
-const build = spawnSync('go', ['build', '-o', binary, './cmd/app'], { stdio: 'inherit' });
-if (build.status !== 0) process.exit(build.status ?? 1);
+if (!containerImage) {
+  const build = spawnSync('go', ['build', '-o', binary, './cmd/app'], { stdio: 'inherit' });
+  if (build.status !== 0) process.exit(build.status ?? 1);
+}
 
-const child = spawn(binary, [], {
+const child = spawn(containerImage ? 'docker' : binary, containerImage ? [
+  'run', '--rm', '--name', containerName, '--network', 'host',
+  '--tmpfs', '/app/data', '-e', 'BLOCKBUSTERR_DRY_RUN=true', containerImage,
+] : [], {
   stdio: 'inherit',
   env: {
     ...process.env,
@@ -29,7 +36,8 @@ const child = spawn(binary, [], {
 
 async function stop(signal) {
   try {
-    child.kill('SIGKILL');
+    if (containerImage) spawnSync('docker', ['stop', containerName], { stdio: 'ignore' });
+    else child.kill('SIGKILL');
   } catch (error) {
     if (error.code !== 'ESRCH') throw error;
   }
diff --git a/tests/browser/settings.spec.js b/tests/browser/settings.spec.js
new file mode 100644
index 0000000..0c1e773
--- /dev/null
+++ b/tests/browser/settings.spec.js
@@ -0,0 +1,118 @@
+import { expect, test } from '@playwright/test';
+import http from 'node:http';
+
+async function restore(request, tmdb = '') {
+  const response = await request.post('/config/restore', { multipart: { config: {
+    name: 'fixture.yaml', mimeType: 'application/yaml',
+    buffer: Buffer.from(`version: v2.0.1\ntmdb:\n  api_key: "${tmdb}"\njobs:\n  sync_interval: 24h\n  mode: direct\n  list: []\n`),
+  } } });
+  expect(response.ok(), await response.text()).toBeTruthy();
+}
+
+test('fresh settings connect, save twice, and retain hidden credentials and defaults', async ({ page, request }) => {
+  let unavailable = false;
+  const upstream = http.createServer((req, res) => {
+    res.setHeader('Content-Type', 'application/json');
+    if (req.headers['x-api-key'] !== 'browser-secret') {
+      res.writeHead(401); res.end('{}'); return;
+    }
+    if (unavailable) { res.writeHead(503); res.end('{}'); return; }
+    res.end(JSON.stringify(req.url.includes('qualityprofile')
+      ? [{ id: 7, name: 'HD' }]
+      : req.url.includes('rootfolder') ? [{ id: 1, path: '/media', freeSpace: 1000 }]
+      : { version: '1.0.0' }));
+  });
+  await new Promise(resolve => upstream.listen(0, '127.0.0.1', resolve));
+  const url = `http://127.0.0.1:${upstream.address().port}`;
+  const errors = [];
+  page.on('pageerror', error => errors.push(error.message));
+  try {
+    await restore(request);
+    await page.goto('/config');
+    await expect(page.locator('[data-service-status="tmdb"]')).toHaveText('Not configured');
+    await page.locator('#svc-tmdb').evaluate(el => { el.open = true; });
+    await page.locator('#tmdb-api-key').fill('browser-tmdb');
+    for (const service of ['radarr', 'sonarr', 'jellyseerr']) {
+      await page.locator(`#svc-${service}`).evaluate(el => { el.open = true; });
+      await page.locator(`#${service}-url`).fill(url);
+      await page.locator(`#${service}-api-key`).fill('browser-secret');
+      await page.locator(`[data-action="test-connection"][data-service="${service}"]`).click();
+      await expect(page.locator(`[data-test-result="${service}"]`)).toHaveAttribute('data-state', 'success');
+      if (service !== 'jellyseerr') {
+        await page.locator(`[data-action="reload-options"][data-service="${service}"][data-kind="profiles"]`).click();
+        await expect(page.locator(`#${service}-quality-profile option[value="7"]`)).toHaveCount(1);
+        await page.locator(`#${service}-quality-profile`).selectOption('7');
+        await page.locator(`[data-action="reload-options"][data-service="${service}"][data-kind="folders"]`).click();
+        await expect(page.locator(`#${service}-root-folder option[value="/media"]`)).toHaveCount(1);
+        await page.locator(`#${service}-root-folder`).selectOption('/media');
+      }
+    }
+    await page.locator('#save-button').click();
+    await expect(page.locator('#save-bar')).toHaveAttribute('data-visible', 'false');
+    await page.locator('#radarr-monitor').selectOption('none');
+    await expect(page.locator('#save-button')).toBeEnabled();
+    await page.locator('#save-button').click();
+    await expect(page.locator('#save-bar')).toHaveAttribute('data-visible', 'false');
+    // Keep edits made after submission dirty, and recover from a failed save.
+    let releaseSave;
+    let saveStarted;
+    const heldSave = new Promise(resolve => { releaseSave = resolve; });
+    const started = new Promise(resolve => { saveStarted = resolve; });
+    await page.route('**/config/save', async route => {
+      const response = await route.fetch();
+      saveStarted();
+      await heldSave;
+      await route.fulfill({ response });
+    }, { times: 1 });
+    await page.locator('#radarr-monitor').selectOption('movieOnly');
+    await page.locator('#save-button').click();
+    await started;
+    await page.locator('#radarr-monitor').selectOption('none');
+    releaseSave();
+    await expect(page.locator('#save-button')).toBeEnabled();
+    await expect(page.locator('#save-bar')).toHaveAttribute('data-visible', 'true');
+    await page.route('**/config/save', route => route.fulfill({
+      status: 500, contentType: 'application/json', body: '{"error":"Fixture save failure"}',
+    }), { times: 1 });
+    await page.locator('#save-button').click();
+    await expect(page.locator('[data-save-status]')).toHaveText('Fixture save failure');
+    await expect(page.locator('#save-button')).toBeEnabled();
+    await expect(page.locator('#radarr-monitor')).toHaveValue('none');
+    await page.locator('#save-button').click();
+    await expect(page.locator('#save-bar')).toHaveAttribute('data-visible', 'false');
+    await page.goto('/jobs');
+    await page.goto('/config');
+    await expect(page.locator('[data-service-status="tmdb"]')).toHaveText('Configured');
+    await expect(page.locator('#tmdb-api-key')).toHaveValue('');
+    for (const service of ['radarr', 'sonarr', 'jellyseerr']) {
+      await expect(page.locator(`[data-service-status="${service}"]`)).toHaveText('Configured');
+      await expect(page.locator(`#${service}-api-key`)).toHaveValue('');
+      await page.locator(`#svc-${service}`).evaluate(el => { el.open = true; });
+      await page.locator(`[data-action="test-connection"][data-service="${service}"]`).click();
+      await expect(page.locator(`[data-test-result="${service}"]`)).toHaveAttribute('data-state', 'success');
+      if (service !== 'jellyseerr') {
+        await expect(page.locator(`#${service}-quality-profile`)).toHaveValue('7');
+        await expect(page.locator(`#${service}-root-folder`)).toHaveValue('/media');
+      }
+    }
+    await expect(page.locator('#radarr-monitor')).toHaveValue('none');
+    // An outage must not erase saved defaults during an unrelated save.
+    unavailable = true;
+    await page.reload();
+    await page.locator('#svc-radarr').evaluate(el => { el.open = true; });
+    await page.locator('[data-action="reload-options"][data-service="radarr"][data-kind="folders"]').click();
+    await expect(page.getByText(/Failed to load folders:/)).toBeVisible();
+    await expect(page.locator('#radarr-root-folder')).toHaveValue('/media');
+    await page.locator('#radarr-monitor').selectOption('movieOnly');
+    await page.locator('#save-button').click();
+    await expect(page.locator('#save-bar')).toHaveAttribute('data-visible', 'false');
+    await page.reload();
+    await expect(page.locator('#radarr-root-folder')).toHaveValue('/media');
+    await expect(page.locator('#sonarr-root-folder')).toHaveValue('/media');
+    expect(errors).toEqual([]);
+  } finally {
+    await restore(request, 'browser-test');
+    upstream.closeAllConnections();
+    await new Promise(resolve => upstream.close(resolve));
+  }
+});
diff --git a/web/static/js/settings.js b/web/static/js/settings.js
index 8b0144a..efb4610 100644
--- a/web/static/js/settings.js
+++ b/web/static/js/settings.js
@@ -57,14 +57,13 @@ function init() {
   window.addEventListener('beforeunload', handleBeforeUnload);
 
   setupNavActiveTracking();
-  // Radarr/Sonarr may be slow or unreachable, so the dirty baseline is never
-  // gated on their response — each load patches only its own select's value
-  // into the existing baseline once it settles, instead of re-snapshotting
-  // the whole form (which would race with anything the user typed meanwhile).
+  // Saved options are rendered immediately; loading labels must not gate edits.
   autoLoadRadarrSonarrOptions();
 }
 
-function onFormChange() {
+function onFormChange(event) {
+  const service = event?.target.closest('[data-service]')?.dataset.service;
+  if (service) delete sessionTestResults[service];
   renderServiceStatuses();
   renderModeReadiness();
   updateWeightTotal();
@@ -97,6 +96,10 @@ function fieldValue(form, name) {
   return String(form.elements[name]?.value || '').trim();
 }
 
+function hasCredential(form, name) {
+  return Boolean(fieldValue(form, name) || form.elements[name]?.dataset.saved === 'true');
+}
+
 // ---- Service status -----------------------------------------------------
 
 function serviceState(service) {
@@ -110,19 +113,16 @@ function serviceState(service) {
 	}
   if (service === 'tmdb' || service === 'simkl' || service === 'mdblist') {
 	const field = service === 'tmdb' ? 'tmdb.api_key' : service === 'simkl' ? 'simkl.client_id' : 'mdblist.api_key';
-	const value = fieldValue(form, field);
+	const value = hasCredential(form, field);
     return value ? { state: 'configured', label: 'Configured' } : { state: 'not-configured', label: 'Not configured' };
   }
 
   const [firstKey, secondKey] = REQUIRED_PAIR[service];
   const first = fieldValue(form, firstKey);
-  const second = fieldValue(form, secondKey);
-  const optional = service === 'jellyseerr';
+  const second = hasCredential(form, secondKey);
 
   if (!first && !second) {
-    return optional
-      ? { state: 'not-configured', label: 'Not configured' }
-      : { state: 'not-configured', label: 'Not configured' };
+    return { state: 'not-configured', label: 'Not configured' };
   }
   if (!first || !second) {
     return { state: 'needs-attention', label: 'Needs attention' };
@@ -321,6 +321,7 @@ async function saveSettings() {
   }
 
   const saveButton = document.getElementById('save-button');
+  if (saveButton.disabled) return;
   saveButton.disabled = true;
   setSaveStatus('Saving…');
 
@@ -329,16 +330,19 @@ async function saveSettings() {
 	formData.set('jobs.selection.enabled', document.getElementById('selection-enabled')?.checked ? 'true' : 'false');
 	formData.set('letterboxd.experimental_scraping', document.getElementById('letterboxd-experimental-scraping')?.checked ? 'true' : 'false');
 
+  const submittedSnapshot = serializeForm(form);
   try {
     const response = await fetch('/config/save', { method: 'POST', body: formData });
     const result = await response.json().catch(() => ({}));
     if (!response.ok) {
       setSaveStatus(result.error || 'Save failed', 'error');
       window.showNotification?.(result.error || 'Failed to save configuration.', 'error');
-      saveButton.disabled = false;
       return;
     }
-    baselineSnapshot = serializeForm(form);
+    baselineSnapshot = submittedSnapshot;
+    form.querySelectorAll('[data-saved]').forEach((input) => {
+      if (formData.get(input.name)) input.dataset.saved = 'true';
+    });
     updateSaveBar();
     updateSelectionControls();
     setSaveStatus('Saved', 'success');
@@ -347,6 +351,7 @@ async function saveSettings() {
   } catch (err) {
     setSaveStatus('Network error', 'error');
     window.showNotification?.(`Failed to save configuration: ${err.message}`, 'error');
+  } finally {
     saveButton.disabled = false;
   }
 }
@@ -387,7 +392,7 @@ async function testConnection(service, button) {
   const second = fieldValue(form, config.second);
   const resultEl = document.querySelector(`[data-test-result="${service}"]`);
 
-  if (!first || (config.second && service !== 'trakt' && !second)) {
+  if (!hasCredential(form, config.first) || (config.second && !hasCredential(form, config.second))) {
     writeTestResult(resultEl, 'error', 'Fill in the required fields first.');
     return;
   }
@@ -405,7 +410,7 @@ async function testConnection(service, button) {
       body: JSON.stringify(params),
     });
     const data = await response.json().catch(() => ({}));
-    if (data.connected || (response.ok && data.message)) {
+    if (response.ok && (data.connected || data.message)) {
       sessionTestResults[service] = 'connected';
       writeTestResult(resultEl, 'success', data.message || 'Connected.');
     } else {
@@ -447,18 +452,25 @@ async function loadOptions(service, kind, silent) {
   const selectId = `${service}-${kind === 'profiles' ? 'quality-profile' : 'root-folder'}`;
   const select = document.getElementById(selectId);
   if (!select) return;
-  const savedValue = select.dataset.selected;
+
+  const form = document.getElementById('settings-form');
   const path = kind === 'profiles' ? `/v1/${service}/quality-profiles` : `/v1/${service}/root-folders`;
 
   try {
-    const response = await fetch(path);
+    const response = await fetch(path, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ url: fieldValue(form, `${service}.url`), api_key: fieldValue(form, `${service}.api_key`) }),
+    });
     const data = await response.json();
+    if (!response.ok) throw new Error(data.error || `Could not load ${kind}`);
     const items = data.data || [];
-    select.replaceChildren(new Option(kind === 'profiles' ? 'Select a quality profile…' : 'Select a root folder…', ''));
     if (items.length === 0) {
-      if (!silent) window.showNotification?.(`No ${kind} found. Test the connection first.`, 'error');
+      if (!silent) window.showNotification?.(`No ${kind} found on this server.`, 'error');
       return;
     }
+    const savedValue = select.value;
+    select.replaceChildren(new Option(kind === 'profiles' ? 'Select a quality profile…' : 'Select a root folder…', ''));
     items.forEach((item) => {
       const option = kind === 'profiles'
         ? new Option(item.name, String(item.id))
@@ -466,27 +478,16 @@ async function loadOptions(service, kind, silent) {
       if (savedValue && String(kind === 'profiles' ? item.id : item.path) === String(savedValue)) option.selected = true;
       select.appendChild(option);
     });
-    if (silent) refreshBaselineField(select.name, select.value);
-    else window.showNotification?.(`${kind === 'profiles' ? 'Quality profiles' : 'Root folders'} loaded.`, 'success');
+    if (savedValue && select.value !== savedValue) {
+      select.add(new Option(savedValue, savedValue, false, true));
+    }
+    updateSaveBar();
+    if (!silent) window.showNotification?.(`${kind === 'profiles' ? 'Quality profiles' : 'Root folders'} loaded.`, 'success');
   } catch (err) {
     if (!silent) window.showNotification?.(`Failed to load ${kind}: ${err.message}`, 'error');
   }
 }
 
-// Patches a single field's value into the stored baseline without
-// re-serializing the whole form, so an auto-selected option (the saved
-// profile/folder becoming available) doesn't register as an unsaved edit —
-// while anything the user typed in the meantime is left alone.
-function refreshBaselineField(name, value) {
-  if (!baselineSnapshot || !name) return;
-  const entries = JSON.parse(baselineSnapshot);
-  const match = entries.find(([key]) => key === name);
-  if (match) match[1] = value;
-  else entries.push([name, value]);
-  baselineSnapshot = JSON.stringify(entries);
-  updateSaveBar();
-}
-
 function autoLoadRadarrSonarrOptions() {
   const form = document.getElementById('settings-form');
   const pending = [];
diff --git a/web/templates/index.html b/web/templates/index.html
index 6325060..0a35562 100644
--- a/web/templates/index.html
+++ b/web/templates/index.html
@@ -66,7 +66,7 @@ <h2>Connections</h2>
                 <div class="svc-field svc-field-wide">
                   <label for="tmdb-api-key">API key<span class="optional">(optional)</span></label>
                   <div class="svc-password-field">
-                    <input type="password" id="tmdb-api-key" name="tmdb.api_key" value="" placeholder="Leave blank to keep the saved key" autocomplete="new-password">
+                    <input type="password" id="tmdb-api-key" name="tmdb.api_key" value="" data-saved="{{if .Config.TMDB.APIKey}}true{{else}}false{{end}}" placeholder="Leave blank to keep the saved key" autocomplete="new-password">
                     <button type="button" class="svc-password-toggle" data-action="toggle-password" data-target="tmdb-api-key" aria-label="Show API key" aria-pressed="false">
                       <svg class="eye-open" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 12a3 3 0 11-6 0 3 3 0 016 0z"></path><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M2.458 12C3.732 7.943 7.523 5 12 5c4.478 0 8.268 2.943 9.542 7-1.274 4.057-5.064 7-9.542 7-4.477 0-8.268-2.943-9.542-7z"></path></svg>
                       <svg class="eye-closed hidden" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13.875 18.825A10.05 10.05 0 0112 19c-4.478 0-8.268-2.943-9.543-7a9.97 9.97 0 011.563-3.029m5.858.908a3 3 0 114.243 4.243M9.878 9.878l4.242 4.242M9.88 9.88l-3.29-3.29m7.532 7.532l3.29 3.29M3 3l3.59 3.59m0 0A9.953 9.953 0 0112 5c4.478 0 8.268 2.943 9.543 7a10.025 10.025 0 01-4.132 5.411m0 0L21 21"></path></svg>
@@ -132,7 +132,7 @@ <h2>Connections</h2>
                 <div class="svc-field">
                   <label for="trakt-client-secret">Client secret<span class="optional">(optional)</span></label>
                   <div class="svc-password-field">
-                    <input type="password" id="trakt-client-secret" name="trakt.client_secret" value="" placeholder="Leave blank to keep the saved secret" autocomplete="new-password">
+                    <input type="password" id="trakt-client-secret" name="trakt.client_secret" value="" data-saved="{{if .Config.Trakt.ClientSecret}}true{{else}}false{{end}}" placeholder="Leave blank to keep the saved secret" autocomplete="new-password">
                     <button type="button" class="svc-password-toggle" data-action="toggle-password" data-target="trakt-client-secret" aria-label="Show client secret" aria-pressed="false">
                       <svg class="eye-open" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 12a3 3 0 11-6 0 3 3 0 016 0z"></path><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M2.458 12C3.732 7.943 7.523 5 12 5c4.478 0 8.268 2.943 9.542 7-1.274 4.057-5.064 7-9.542 7-4.477 0-8.268-2.943-9.542-7z"></path></svg>
                       <svg class="eye-closed hidden" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13.875 18.825A10.05 10.05 0 0112 19c-4.478 0-8.268-2.943-9.543-7a9.97 9.97 0 011.563-3.029m5.858.908a3 3 0 114.243 4.243M9.878 9.878l4.242 4.242M9.88 9.88l-3.29-3.29m7.532 7.532l3.29 3.29M3 3l3.59 3.59m0 0A9.953 9.953 0 0112 5c4.478 0 8.268 2.943 9.543 7a10.025 10.025 0 01-4.132 5.411m0 0L21 21"></path></svg>
@@ -177,7 +177,7 @@ <h2>Connections</h2>
                 <div class="svc-field svc-field-wide">
                   <label for="mdblist-api-key">API key<span class="optional">(optional)</span></label>
                   <div class="svc-password-field">
-                    <input type="password" id="mdblist-api-key" name="mdblist.api_key" value="" placeholder="Leave blank to keep the saved key" autocomplete="new-password">
+                    <input type="password" id="mdblist-api-key" name="mdblist.api_key" value="" data-saved="{{if .Config.MDBList.APIKey}}true{{else}}false{{end}}" placeholder="Leave blank to keep the saved key" autocomplete="new-password">
                     <button type="button" class="svc-password-toggle" data-action="toggle-password" data-target="mdblist-api-key" aria-label="Show API key" aria-pressed="false">
                       <svg class="eye-open" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 12a3 3 0 11-6 0 3 3 0 016 0z"></path><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M2.458 12C3.732 7.943 7.523 5 12 5c4.478 0 8.268 2.943 9.542 7-1.274 4.057-5.064 7-9.542 7-4.477 0-8.268-2.943-9.542-7z"></path></svg>
                       <svg class="eye-closed hidden" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13.875 18.825A10.05 10.05 0 0112 19c-4.478 0-8.268-2.943-9.543-7a9.97 9.97 0 011.563-3.029m5.858.908a3 3 0 114.243 4.243M9.878 9.878l4.242 4.242M9.88 9.88l-3.29-3.29m7.532 7.532l3.29 3.29M3 3l3.59 3.59m0 0A9.953 9.953 0 0112 5c4.478 0 8.268-2.943 9.543 7a10.025 10.025 0 01-4.132 5.411m0 0L21 21"></path></svg>
@@ -242,7 +242,7 @@ <h2>Connections</h2>
                 <div class="svc-field">
                   <label for="radarr-api-key">API key<span class="required">*</span></label>
                   <div class="svc-password-field">
-                    <input type="password" id="radarr-api-key" name="radarr.api_key" value="" placeholder="Leave blank to keep the saved key" autocomplete="new-password">
+                    <input type="password" id="radarr-api-key" name="radarr.api_key" value="" data-saved="{{if .Config.Radarr.APIKey}}true{{else}}false{{end}}" placeholder="Leave blank to keep the saved key" autocomplete="new-password">
                     <button type="button" class="svc-password-toggle" data-action="toggle-password" data-target="radarr-api-key" aria-label="Show API key" aria-pressed="false">
                       <svg class="eye-open" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 12a3 3 0 11-6 0 3 3 0 016 0z"></path><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M2.458 12C3.732 7.943 7.523 5 12 5c4.478 0 8.268 2.943 9.542 7-1.274 4.057-5.064 7-9.542 7-4.477 0-8.268-2.943-9.542-7z"></path></svg>
                       <svg class="eye-closed hidden" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13.875 18.825A10.05 10.05 0 0112 19c-4.478 0-8.268-2.943-9.543-7a9.97 9.97 0 011.563-3.029m5.858.908a3 3 0 114.243 4.243M9.878 9.878l4.242 4.242M9.88 9.88l-3.29-3.29m7.532 7.532l3.29 3.29M3 3l3.59 3.59m0 0A9.953 9.953 0 0112 5c4.478 0 8.268 2.943 9.543 7a10.025 10.025 0 01-4.132 5.411m0 0L21 21"></path></svg>
@@ -259,15 +259,17 @@ <h2>Connections</h2>
               <div class="svc-fields">
                 <div class="svc-field">
                   <label for="radarr-quality-profile">Quality profile</label>
-                  <select id="radarr-quality-profile" name="radarr.quality_profile" data-selected="{{.Config.Radarr.QualityProfile}}">
+                  <select id="radarr-quality-profile" name="radarr.quality_profile">
                     <option value="">Select a quality profile&hellip;</option>
+                    {{if .Config.Radarr.QualityProfile}}<option value="{{.Config.Radarr.QualityProfile}}" selected>{{.Config.Radarr.QualityProfile}}</option>{{end}}
                   </select>
                   <button type="button" class="svc-reload-link" data-action="reload-options" data-service="radarr" data-kind="profiles">Reload profiles</button>
                 </div>
                 <div class="svc-field">
                   <label for="radarr-root-folder">Root folder</label>
-                  <select id="radarr-root-folder" name="radarr.root_folder" data-selected="{{.Config.Radarr.RootFolder}}">
+                  <select id="radarr-root-folder" name="radarr.root_folder">
                     <option value="">Select a root folder&hellip;</option>
+                    {{if .Config.Radarr.RootFolder}}<option value="{{.Config.Radarr.RootFolder}}" selected>{{.Config.Radarr.RootFolder}}</option>{{end}}
                   </select>
                   <button type="button" class="svc-reload-link" data-action="reload-options" data-service="radarr" data-kind="folders">Reload root folders</button>
                 </div>
@@ -310,7 +312,7 @@ <h2>Connections</h2>
                 <div class="svc-field">
                   <label for="sonarr-api-key">API key<span class="required">*</span></label>
                   <div class="svc-password-field">
-                    <input type="password" id="sonarr-api-key" name="sonarr.api_key" value="" placeholder="Leave blank to keep the saved key" autocomplete="new-password">
+                    <input type="password" id="sonarr-api-key" name="sonarr.api_key" value="" data-saved="{{if .Config.Sonarr.APIKey}}true{{else}}false{{end}}" placeholder="Leave blank to keep the saved key" autocomplete="new-password">
                     <button type="button" class="svc-password-toggle" data-action="toggle-password" data-target="sonarr-api-key" aria-label="Show API key" aria-pressed="false">
                       <svg class="eye-open" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 12a3 3 0 11-6 0 3 3 0 016 0z"></path><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M2.458 12C3.732 7.943 7.523 5 12 5c4.478 0 8.268 2.943 9.542 7-1.274 4.057-5.064 7-9.542 7-4.477 0-8.268-2.943-9.542-7z"></path></svg>
                       <svg class="eye-closed hidden" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13.875 18.825A10.05 10.05 0 0112 19c-4.478 0-8.268-2.943-9.543-7a9.97 9.97 0 011.563-3.029m5.858.908a3 3 0 114.243 4.243M9.878 9.878l4.242 4.242M9.88 9.88l-3.29-3.29m7.532 7.532l3.29 3.29M3 3l3.59 3.59m0 0A9.953 9.953 0 0112 5c4.478 0 8.268 2.943 9.543 7a10.025 10.025 0 01-4.132 5.411m0 0L21 21"></path></svg>
@@ -327,15 +329,17 @@ <h2>Connections</h2>
               <div class="svc-fields">
                 <div class="svc-field">
                   <label for="sonarr-quality-profile">Quality profile</label>
-                  <select id="sonarr-quality-profile" name="sonarr.quality_profile" data-selected="{{.Config.Sonarr.QualityProfile}}">
+                  <select id="sonarr-quality-profile" name="sonarr.quality_profile">
                     <option value="">Select a quality profile&hellip;</option>
+                    {{if .Config.Sonarr.QualityProfile}}<option value="{{.Config.Sonarr.QualityProfile}}" selected>{{.Config.Sonarr.QualityProfile}}</option>{{end}}
                   </select>
                   <button type="button" class="svc-reload-link" data-action="reload-options" data-service="sonarr" data-kind="profiles">Reload profiles</button>
                 </div>
                 <div class="svc-field">
                   <label for="sonarr-root-folder">Root folder</label>
-                  <select id="sonarr-root-folder" name="sonarr.root_folder" data-selected="{{.Config.Sonarr.RootFolder}}">
+                  <select id="sonarr-root-folder" name="sonarr.root_folder">
                     <option value="">Select a root folder&hellip;</option>
+                    {{if .Config.Sonarr.RootFolder}}<option value="{{.Config.Sonarr.RootFolder}}" selected>{{.Config.Sonarr.RootFolder}}</option>{{end}}
                   </select>
                   <button type="button" class="svc-reload-link" data-action="reload-options" data-service="sonarr" data-kind="folders">Reload root folders</button>
                 </div>
@@ -379,7 +383,7 @@ <h2>Connections</h2>
                 <div class="svc-field">
                   <label for="jellyseerr-api-key">API key<span class="optional">(optional)</span></label>
                   <div class="svc-password-field">
-                    <input type="password" id="jellyseerr-api-key" name="jellyseerr.api_key" value="" placeholder="Leave blank to keep the saved key" autocomplete="new-password">
+                    <input type="password" id="jellyseerr-api-key" name="jellyseerr.api_key" value="" data-saved="{{if .Config.Jellyseerr.APIKey}}true{{else}}false{{end}}" placeholder="Leave blank to keep the saved key" autocomplete="new-password">
                     <button type="button" class="svc-password-toggle" data-action="toggle-password" data-target="jellyseerr-api-key" aria-label="Show API key" aria-pressed="false">
                       <svg class="eye-open" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 12a3 3 0 11-6 0 3 3 0 016 0z"></path><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M2.458 12C3.732 7.943 7.523 5 12 5c4.478 0 8.268 2.943 9.542 7-1.274 4.057-5.064 7-9.542 7-4.477 0-8.268-2.943-9.542-7z"></path></svg>
                       <svg class="eye-closed hidden" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13.875 18.825A10.05 10.05 0 0112 19c-4.478 0-8.268-2.943-9.543-7a9.97 9.97 0 011.563-3.029m5.858.908a3 3 0 114.243 4.243M9.878 9.878l4.242 4.242M9.88 9.88l-3.29-3.29m7.532 7.532l3.29 3.29M3 3l3.59 3.59m0 0A9.953 9.953 0 0112 5c4.478 0 8.268 2.943 9.543 7a10.025 10.025 0 01-4.132 5.411m0 0L21 21"></path></svg>