diff --git a/webui/src/api/calendar.ts b/webui/src/api/calendar.ts
index 33567af..a8343d9 100644
--- a/webui/src/api/calendar.ts
+++ b/webui/src/api/calendar.ts
@@ -78,7 +78,6 @@ export type CalendarSyncSource = {
   display_name?: string | null;
   auth_type: CalendarCalDavAuthType;
   username?: string | null;
-  credential_ref?: string | null;
   has_credential: boolean;
   sync_enabled: boolean;
   sync_interval_seconds: number;
@@ -114,7 +113,6 @@ export type CalendarCalDavDiscoveryPayload = {
   source_id?: string | null;
   auth_type?: CalendarCalDavAuthType | null;
   username?: string | null;
-  credential_ref?: string | null;
   password?: string | null;
   bearer_token?: string | null;
 };
@@ -128,7 +126,6 @@ export type CalendarSyncSourceCreatePayload = {
   display_name?: string | null;
   auth_type?: CalendarCalDavAuthType;
   username?: string | null;
-  credential_ref?: string | null;
   password?: string | null;
   bearer_token?: string | null;
   sync_enabled?: boolean;
diff --git a/webui/src/features/calendar/CalendarPage.tsx b/webui/src/features/calendar/CalendarPage.tsx
index 91cccc9..81dd32a 100644
--- a/webui/src/features/calendar/CalendarPage.tsx
+++ b/webui/src/features/calendar/CalendarPage.tsx
@@ -17,6 +17,7 @@ import {
   Dialog,
   DismissibleAlert,
   LoadingFrame,
+  PasswordField,
   SegmentedControl,
   TimeField,
   ToggleSwitch,
@@ -84,7 +85,6 @@ type CalendarCalDavFormPayload = {
   display_name: string;
   auth_type: CalendarCalDavAuthType;
   username: string;
-  credential_ref: string;
   password: string;
   bearer_token: string;
   sync_enabled: boolean;
@@ -1343,7 +1343,6 @@ function CalendarCollectionDialog({
   const [displayName, setDisplayName] = useState(source?.display_name ?? "");
   const [authType, setAuthType] = useState<CalendarCalDavAuthType>(source?.auth_type ?? "basic");
   const [username, setUsername] = useState(source?.username ?? "");
-  const [credentialRef, setCredentialRef] = useState(source?.credential_ref ?? "");
   const [password, setPassword] = useState("");
   const [bearerToken, setBearerToken] = useState("");
   const [syncEnabled, setSyncEnabled] = useState(source?.sync_enabled ?? true);
@@ -1361,8 +1360,8 @@ function CalendarCollectionDialog({
   const effectiveCollectionUrl = (collectionUrl || davUrl).trim();
   const effectiveAuthType = sourceMode === "graph" ? "bearer" : authType;
   const needsSourceSecret = sourceMode !== "local" && (
-  effectiveAuthType === "basic" && !source?.has_credential && !credentialRef.trim() && !password.trim() ||
-  effectiveAuthType === "bearer" && !source?.has_credential && !credentialRef.trim() && !bearerToken.trim());
+  effectiveAuthType === "basic" && !source?.has_credential && !password.trim() ||
+  effectiveAuthType === "bearer" && !source?.has_credential && !bearerToken.trim());
 
   const sourceDetailsInvalid = sourceMode !== "local" && (
   !isExistingSyncSource && !canEditSource ||
@@ -1385,7 +1384,6 @@ function CalendarCollectionDialog({
     displayName,
     authType,
     username,
-    credentialRef,
     password,
     bearerToken,
     syncEnabled,
@@ -1413,7 +1411,6 @@ function CalendarCollectionDialog({
         display_name: displayName,
         auth_type: effectiveAuthType,
         username,
-        credential_ref: credentialRef,
         password,
         bearer_token: bearerToken,
         sync_enabled: syncEnabled,
@@ -1494,8 +1491,7 @@ function CalendarCollectionDialog({
         url,
         source_id: source?.id ?? null,
         auth_type: authType,
-        username: authType === "basic" ? username.trim() || null : null,
-        credential_ref: credentialRef.trim() || null
+        username: authType === "basic" ? username.trim() || null : null
       };
       if (authType === "basic" && password.trim()) payload.password = password;
       if (authType === "bearer" && bearerToken.trim()) payload.bearer_token = bearerToken;
@@ -1613,15 +1609,15 @@ function CalendarCollectionDialog({
                     <input value={username} onChange={(item) => setUsername(item.target.value)} required={sourceMode !== "local" && effectiveAuthType === "basic"} maxLength={255} disabled={saving || !canEditSource} />
                   </label>
                   <label>
-                    <span>{source?.has_credential || credentialRef.trim() ? "i18n:govoplan-calendar.replace_password.3f912c9c" : "i18n:govoplan-calendar.password.8be3c943"}</span>
-                    <input type="password" value={password} onChange={(item) => setPassword(item.target.value)} disabled={saving || !canEditSource} autoComplete="new-password" />
+                    <span>{source?.has_credential ? "i18n:govoplan-calendar.replace_password.3f912c9c" : "i18n:govoplan-calendar.password.8be3c943"}</span>
+                    <PasswordField value={password} onValueChange={setPassword} disabled={saving || !canEditSource} autoComplete="new-password" />
                   </label>
                 </>
             }
               {effectiveAuthType === "bearer" &&
             <label>
-                  <span>{source?.has_credential || credentialRef.trim() ? "i18n:govoplan-calendar.replace_token.bbeee6a9" : "i18n:govoplan-calendar.bearer_token.ffa64bcf"}</span>
-                  <input type="password" value={bearerToken} onChange={(item) => setBearerToken(item.target.value)} disabled={saving || !canEditSource} autoComplete="new-password" />
+                  <span>{source?.has_credential ? "i18n:govoplan-calendar.replace_token.bbeee6a9" : "i18n:govoplan-calendar.bearer_token.ffa64bcf"}</span>
+                  <PasswordField value={bearerToken} onValueChange={setBearerToken} disabled={saving || !canEditSource} autoComplete="new-password" />
                 </label>
             }
               <div className={sourceMode === "caldav" ? "calendar-discovery-actions" : "calendar-discovery-actions is-readonly"}>
@@ -1653,10 +1649,6 @@ function CalendarCollectionDialog({
                   <span>i18n:govoplan-calendar.display_name.c7874aaa</span>
                   <input value={displayName} onChange={(item) => setDisplayName(item.target.value)} maxLength={255} disabled={saving || !canEditMutableSourceSettings} />
                 </label>
-                <label>
-                  <span>i18n:govoplan-calendar.credential_reference.a7e92de5</span>
-                  <input value={credentialRef} onChange={(item) => setCredentialRef(item.target.value)} placeholder="env:CALDAV_PASSWORD" maxLength={255} disabled={saving || !canEditSource} />
-                </label>
               </div>
               <div className="calendar-sync-settings">
                 <ToggleSwitch label="i18n:govoplan-calendar.automatic_sync.084644b2" checked={syncEnabled} disabled={saving || !canEditMutableSourceSettings} onChange={setSyncEnabled} />
@@ -1686,7 +1678,7 @@ function CalendarCollectionDialog({
                   <div><dt>i18n:govoplan-calendar.last_attempt.82aee111</dt><dd>{source.last_attempt_at ? dateTimeLabel(new Date(source.last_attempt_at)) : "i18n:govoplan-calendar.never.80c3052d"}</dd></div>
                   <div><dt>i18n:govoplan-calendar.last_sync.ef0ef267</dt><dd>{source.last_synced_at ? dateTimeLabel(new Date(source.last_synced_at)) : "i18n:govoplan-calendar.never.80c3052d"}</dd></div>
                   <div><dt>i18n:govoplan-calendar.next_sync.88c7af72</dt><dd>{source.next_sync_at && source.sync_enabled ? dateTimeLabel(new Date(source.next_sync_at)) : "i18n:govoplan-calendar.not_scheduled.9c367369"}</dd></div>
-                  <div><dt>i18n:govoplan-calendar.credential.8bede3ea</dt><dd>{source.has_credential || source.credential_ref ? "i18n:govoplan-calendar.configured.668c5fff" : "i18n:govoplan-calendar.not_configured.811931bb"}</dd></div>
+                  <div><dt>i18n:govoplan-calendar.credential.8bede3ea</dt><dd>{source.has_credential ? "i18n:govoplan-calendar.configured.668c5fff" : "i18n:govoplan-calendar.not_configured.811931bb"}</dd></div>
                 </dl>
                 {source.last_error && <p className="calendar-form-error">{source.last_error}</p>}
                 <div className="calendar-sync-actions">
@@ -1704,7 +1696,7 @@ function CalendarCollectionDialog({
                 </div>
               </div>
           }
-            {sourceMode !== "local" && effectiveAuthType !== "none" && !source?.has_credential && !credentialRef.trim() && <p className="calendar-form-note">i18n:govoplan-calendar.enter_a_secret_now_or_use_an_environment_referen.6db0e6ce <code>env:CALENDAR_SYNC_SECRET</code>.</p>}
+            {needsSourceSecret && <p className="calendar-form-note">i18n:govoplan-calendar.enter_a_password_or_token_for_this_source.74c09a54</p>}
           </section>
         }
       </form>
@@ -1812,10 +1804,7 @@ function CalendarCollectionDeleteDialog({
                   </select>
                 </label>
                 {calendar.is_default &&
-            <label className="calendar-checkbox-row">
-                    <input type="checkbox" checked={makeTargetDefault} onChange={(item) => setMakeTargetDefault(item.target.checked)} />
-                    <span>i18n:govoplan-calendar.make_target_calendar_the_default.10a3977b</span>
-                  </label>
+                  <ToggleSwitch label="i18n:govoplan-calendar.make_target_calendar_the_default.10a3977b" checked={makeTargetDefault} onChange={setMakeTargetDefault} />
             }
                 <p className="calendar-form-note">{calendarBulkMoveConsequence(externalAction)}</p>
               </>
@@ -2420,7 +2409,6 @@ function syncSourceCreatePayload(sourceMode: CalendarSourceMode, payload: Calend
     display_name: payload.display_name.trim() || null,
     auth_type: sourceKind === "graph" ? "bearer" : payload.auth_type,
     username: sourceKind !== "graph" && payload.auth_type === "basic" ? payload.username.trim() || null : null,
-    credential_ref: payload.credential_ref.trim() || null,
     sync_enabled: payload.sync_enabled,
     sync_interval_seconds: Math.max(60, payload.sync_interval_seconds),
     sync_direction: sourceKind === "caldav" ? payload.sync_direction : "inbound",
@@ -2436,8 +2424,7 @@ function syncSourceConnectionUpdatePayload(payload: CalendarCalDavFormPayload):
   const result: CalendarSyncSourceUpdatePayload = {
     collection_url: payload.collection_url.trim(),
     auth_type: payload.auth_type,
-    username: payload.auth_type === "basic" ? payload.username.trim() || null : null,
-    credential_ref: payload.credential_ref.trim() || null
+    username: payload.auth_type === "basic" ? payload.username.trim() || null : null
   };
   if (payload.auth_type === "basic" && payload.password.trim()) result.password = payload.password;
   if (payload.auth_type === "bearer" && payload.bearer_token.trim()) result.bearer_token = payload.bearer_token;
diff --git a/webui/src/i18n/generatedTranslations.ts b/webui/src/i18n/generatedTranslations.ts
index 222c887..199219c 100644
--- a/webui/src/i18n/generatedTranslations.ts
+++ b/webui/src/i18n/generatedTranslations.ts
@@ -39,7 +39,6 @@ export const generatedTranslations: PlatformTranslations = {
     "i18n:govoplan-calendar.confirmed.0542404a": "CONFIRMED",
     "i18n:govoplan-calendar.conflict_policy.5810e150": "Conflict policy",
     "i18n:govoplan-calendar.continuous.04f2ccda": "Continuous",
-    "i18n:govoplan-calendar.credential_reference.a7e92de5": "Credential reference",
     "i18n:govoplan-calendar.credential.8bede3ea": "Credential",
     "i18n:govoplan-calendar.dav_url.4205e180": "DAV URL",
     "i18n:govoplan-calendar.day.987b9ced": "Day",
@@ -63,7 +62,7 @@ export const generatedTranslations: PlatformTranslations = {
     "i18n:govoplan-calendar.end_date.89d10cd6": "End date",
     "i18n:govoplan-calendar.end_mode.5a06de37": "End mode",
     "i18n:govoplan-calendar.end_time.cd7800da": "End time",
-    "i18n:govoplan-calendar.enter_a_secret_now_or_use_an_environment_referen.6db0e6ce": "Enter a secret now or use an environment reference such as",
+    "i18n:govoplan-calendar.enter_a_password_or_token_for_this_source.74c09a54": "Enter a password or token for this source.",
     "i18n:govoplan-calendar.etag.11d00f6e": "ETag",
     "i18n:govoplan-calendar.event": "event",
     "i18n:govoplan-calendar.event_count_could_not_be_loaded_the_backend_will.163ff055": "Event count could not be loaded. The backend will still apply the selected delete action.",
@@ -228,7 +227,6 @@ export const generatedTranslations: PlatformTranslations = {
     "i18n:govoplan-calendar.confirmed.0542404a": "CONFIRMED",
     "i18n:govoplan-calendar.conflict_policy.5810e150": "Conflict policy",
     "i18n:govoplan-calendar.continuous.04f2ccda": "Continuous",
-    "i18n:govoplan-calendar.credential_reference.a7e92de5": "Credential reference",
     "i18n:govoplan-calendar.credential.8bede3ea": "Credential",
     "i18n:govoplan-calendar.dav_url.4205e180": "DAV URL",
     "i18n:govoplan-calendar.day.987b9ced": "Tag",
@@ -252,7 +250,7 @@ export const generatedTranslations: PlatformTranslations = {
     "i18n:govoplan-calendar.end_date.89d10cd6": "End date",
     "i18n:govoplan-calendar.end_mode.5a06de37": "End mode",
     "i18n:govoplan-calendar.end_time.cd7800da": "End time",
-    "i18n:govoplan-calendar.enter_a_secret_now_or_use_an_environment_referen.6db0e6ce": "Enter a secret now or use an environment reference such as",
+    "i18n:govoplan-calendar.enter_a_password_or_token_for_this_source.74c09a54": "Geben Sie ein Passwort oder Token für diese Quelle ein.",
     "i18n:govoplan-calendar.etag.11d00f6e": "ETag",
     "i18n:govoplan-calendar.event": "event",
     "i18n:govoplan-calendar.event_count_could_not_be_loaded_the_backend_will.163ff055": "Event count could not be loaded. The backend will still apply the selected delete action.",