diff --git a/webui/src/api/files.ts b/webui/src/api/files.ts
index 98f45b6..e5d9259 100644
--- a/webui/src/api/files.ts
+++ b/webui/src/api/files.ts
@@ -116,8 +116,6 @@ export type FileConnectorCredentialsPayload = {
   username?: string | null;
   password?: string | null;
   token?: string | null;
-  password_env?: string | null;
-  token_env?: string | null;
   secret_ref?: string | null;
 };
 
diff --git a/webui/src/features/files/FileConnectorSettingsPanel.tsx b/webui/src/features/files/FileConnectorSettingsPanel.tsx
index aa3d2f0..2f481cb 100644
--- a/webui/src/features/files/FileConnectorSettingsPanel.tsx
+++ b/webui/src/features/files/FileConnectorSettingsPanel.tsx
@@ -15,6 +15,8 @@ import {
   LoadingFrame,
   mergeDeltaRows,
   SegmentedControl,
+  StatusBadge,
+  TableActionGroup,
   ToggleSwitch,
   useDeltaWatermarks,
   useUnsavedDraftGuard,
@@ -65,8 +67,6 @@ type ConnectorProfileDraft = {
   username: string;
   password: string;
   token: string;
-  passwordEnv: string;
-  tokenEnv: string;
   secretRef: string;
   canBrowse: boolean;
   canImport: boolean;
@@ -91,8 +91,6 @@ type ConnectorCredentialDraft = {
   username: string;
   password: string;
   token: string;
-  passwordEnv: string;
-  tokenEnv: string;
   secretRef: string;
   policyMode: PolicyMode;
   allowedPaths: string;
@@ -491,8 +489,6 @@ export default function FileConnectorSettingsPanel({
       username: cleanOrNull(credentialDraft.username),
       password: cleanOrUndefined(credentialDraft.password),
       token: cleanOrUndefined(credentialDraft.token),
-      password_env: cleanOrNull(credentialDraft.passwordEnv),
-      token_env: cleanOrNull(credentialDraft.tokenEnv),
       secret_ref: cleanOrNull(credentialDraft.secretRef)
     };
     const sharedPayload = {
@@ -633,8 +629,6 @@ export default function FileConnectorSettingsPanel({
           username: cleanOrNull(draft.username),
           password: cleanOrUndefined(draft.password),
           token: cleanOrUndefined(draft.token),
-          password_env: cleanOrNull(draft.passwordEnv),
-          token_env: cleanOrNull(draft.tokenEnv),
           secret_ref: cleanOrNull(draft.secretRef)
         },
         metadata: metadataFromDraft(draft)
@@ -680,8 +674,6 @@ export default function FileConnectorSettingsPanel({
           username: cleanOrNull(credentialDraft.username),
           password: cleanOrUndefined(credentialDraft.password),
           token: cleanOrUndefined(credentialDraft.token),
-          password_env: cleanOrNull(credentialDraft.passwordEnv),
-          token_env: cleanOrNull(credentialDraft.tokenEnv),
           secret_ref: cleanOrNull(credentialDraft.secretRef)
         },
         metadata: profile.metadata ?? {},
@@ -756,7 +748,7 @@ export default function FileConnectorSettingsPanel({
     width: "120px",
     render: (row) => {
       const enabled = row.kind === "profile" ? row.profile.enabled : row.credential.enabled;
-      return <span className={`status-badge ${enabled ? "success" : "neutral"}`}>{enabled ? "i18n:govoplan-files.enabled.df174a3f" : "i18n:govoplan-files.disabled.f4f4473d"}</span>;
+      return <StatusBadge status={enabled ? "success" : "inactive"} label={enabled ? "i18n:govoplan-files.enabled.df174a3f" : "i18n:govoplan-files.disabled.f4f4473d"} />;
     }
   }];
 
@@ -771,21 +763,19 @@ export default function FileConnectorSettingsPanel({
   function renderConnectorActions(row: ConnectorTreeRow) {
     if (row.kind === "credential") {
       const readOnly = row.credential.source_kind !== "database";
-      return (
-        <div className="admin-icon-actions">
-          <Button type="button" className="admin-icon-button" title={i18nMessage("i18n:govoplan-files.edit_value.fad75899", { value0: row.credential.label })} aria-label={i18nMessage("i18n:govoplan-files.edit_value.fad75899", { value0: row.credential.label })} onClick={() => startCredentialEdit(row.credential)} disabled={!canWrite || readOnly || saving}><Edit3 size={15} /></Button>
-          <Button type="button" variant="danger" className="admin-icon-button" title={i18nMessage("i18n:govoplan-files.disable_value.09485f7f", { value0: row.credential.label })} aria-label={i18nMessage("i18n:govoplan-files.disable_value.09485f7f", { value0: row.credential.label })} onClick={() => setPendingCredentialDeactivate(row.credential)} disabled={!canWrite || readOnly || saving || !row.credential.enabled}><Trash2 size={15} /></Button>
-        </div>);
+      return <TableActionGroup actions={[
+        { id: "edit", label: i18nMessage("i18n:govoplan-files.edit_value.fad75899", { value0: row.credential.label }), icon: <Edit3 size={15} />, disabled: !canWrite || readOnly || saving, onClick: () => startCredentialEdit(row.credential) },
+        { id: "disable", label: i18nMessage("i18n:govoplan-files.disable_value.09485f7f", { value0: row.credential.label }), icon: <Trash2 size={15} />, variant: "danger", applicable: row.credential.enabled, disabled: !canWrite || readOnly || saving, onClick: () => setPendingCredentialDeactivate(row.credential) }
+      ]} />;
 
     }
     const readOnly = row.profile.source_kind !== "database";
-    return (
-      <div className="admin-icon-actions">
-        <Button type="button" className="admin-icon-button" title={i18nMessage("i18n:govoplan-files.test_value.6a5d10a5", { value0: row.profile.label })} aria-label={i18nMessage("i18n:govoplan-files.test_value.6a5d10a5", { value0: row.profile.label })} onClick={() => void testBrowse(row.profile)} disabled={saving || testingProfileId === row.profile.id || !row.profile.enabled}><RefreshCw size={15} /></Button>
-        <Button type="button" variant="primary" className="admin-icon-button" title={i18nMessage("i18n:govoplan-files.add_credential_for_value.0fa9c1fe", { value0: row.profile.label })} aria-label={i18nMessage("i18n:govoplan-files.add_credential_for_value.0fa9c1fe", { value0: row.profile.label })} onClick={() => startCredentialCreate(row.profile)} disabled={!canWrite || saving}><UserRoundKey size={15} /></Button>
-        <Button type="button" className="admin-icon-button" title={i18nMessage("i18n:govoplan-files.edit_value.fad75899", { value0: row.profile.label })} aria-label={i18nMessage("i18n:govoplan-files.edit_value.fad75899", { value0: row.profile.label })} onClick={() => startEdit(row.profile)} disabled={!canWrite || readOnly || saving}><Edit3 size={15} /></Button>
-        <Button type="button" variant="danger" className="admin-icon-button" title={i18nMessage("i18n:govoplan-files.disable_value.09485f7f", { value0: row.profile.label })} aria-label={i18nMessage("i18n:govoplan-files.disable_value.09485f7f", { value0: row.profile.label })} onClick={() => setPendingDeactivate(row.profile)} disabled={!canWrite || readOnly || saving || !row.profile.enabled}><Trash2 size={15} /></Button>
-      </div>);
+    return <TableActionGroup actions={[
+      { id: "test", label: i18nMessage("i18n:govoplan-files.test_value.6a5d10a5", { value0: row.profile.label }), icon: <RefreshCw size={15} />, applicable: row.profile.enabled, disabled: saving || testingProfileId === row.profile.id, onClick: () => void testBrowse(row.profile) },
+      { id: "add-credential", label: i18nMessage("i18n:govoplan-files.add_credential_for_value.0fa9c1fe", { value0: row.profile.label }), icon: <UserRoundKey size={15} />, variant: "primary", disabled: !canWrite || saving, onClick: () => startCredentialCreate(row.profile) },
+      { id: "edit", label: i18nMessage("i18n:govoplan-files.edit_value.fad75899", { value0: row.profile.label }), icon: <Edit3 size={15} />, disabled: !canWrite || readOnly || saving, onClick: () => startEdit(row.profile) },
+      { id: "disable", label: i18nMessage("i18n:govoplan-files.disable_value.09485f7f", { value0: row.profile.label }), icon: <Trash2 size={15} />, variant: "danger", applicable: row.profile.enabled, disabled: !canWrite || readOnly || saving, onClick: () => setPendingDeactivate(row.profile) }
+    ]} />;
 
   }
 
@@ -865,7 +855,7 @@ export default function FileConnectorSettingsPanel({
 
         <LoadingFrame loading={loading} label="i18n:govoplan-files.loading_connector_policy.f12ab285">
           <>
-            <div className="form-grid two-column-form-grid">
+            <div className="form-grid two">
               <FormField label="i18n:govoplan-files.allowed_connection_ids.0df854c8">
                 <textarea value={policyDraft.allowedConnectors} disabled={saving || !canWrite} onChange={(event) => patchPolicyDraft({ allowedConnectors: event.target.value })} rows={3} placeholder={"tenant-webdav\nseafile-*"} />
               </FormField>
@@ -940,7 +930,7 @@ export default function FileConnectorSettingsPanel({
                 <h3>Credential</h3>
                 <p>Choose where this credential can be used and how it signs in.</p>
               </header>
-              <div className="form-grid two-column-form-grid">
+              <div className="form-grid two">
                 <FormField label="i18n:govoplan-files.credential_id.9432a6e1">
                   <input className={!editingCredentialId && !credentialDraft.id.trim() ? "field-input-missing" : undefined} aria-invalid={!editingCredentialId && !credentialDraft.id.trim() || undefined} value={credentialDraft.id} disabled={Boolean(editingCredentialId) || saving} onChange={(event) => patchCredentialDraft({ id: event.target.value })} placeholder={`${scopeType}-webdav-credentials`} />
                 </FormField>
@@ -1018,7 +1008,7 @@ export default function FileConnectorSettingsPanel({
                     onChange={patchCredentialValues}
                     disabled={saving}
                     showPassword={false} />
-                  <div className="form-grid two-column-form-grid">
+                  <div className="form-grid two">
                     <FormField label="i18n:govoplan-files.secret_reference.04ed2221">
                       <input value={credentialDraft.secretRef} disabled={saving} onChange={(event) => patchCredentialDraft({ secretRef: event.target.value })} />
                     </FormField>
@@ -1049,16 +1039,6 @@ export default function FileConnectorSettingsPanel({
                 {credentialLoginResult.message}
               </DismissibleAlert>
               }
-              <AdvancedOptionsPanel title="Environment and fallback secrets" summary="Use these only when the deployment injects secrets outside the database.">
-                <div className="form-grid two-column-form-grid">
-                  <FormField label="i18n:govoplan-files.password_environment_variable.0e77673f">
-                    <input value={credentialDraft.passwordEnv} disabled={saving} onChange={(event) => patchCredentialDraft({ passwordEnv: event.target.value })} />
-                  </FormField>
-                  <FormField label="i18n:govoplan-files.token_environment_variable.5af4a79e">
-                    <input value={credentialDraft.tokenEnv} disabled={saving} onChange={(event) => patchCredentialDraft({ tokenEnv: event.target.value })} />
-                  </FormField>
-                </div>
-              </AdvancedOptionsPanel>
             </section>
 
             <section className="adaptive-config-section">
@@ -1066,7 +1046,7 @@ export default function FileConnectorSettingsPanel({
                 <h3>Policy</h3>
                 <p>Limit where lower levels may use this credential.</p>
               </header>
-              <div className="form-grid two-column-form-grid">
+              <div className="form-grid two">
                 <FormField label="i18n:govoplan-files.policy.bb9cf141">
                   <select value={credentialDraft.policyMode} disabled={saving} onChange={(event) => patchCredentialDraft({ policyMode: event.target.value as PolicyMode })}>
                     <option value="allow-provider">i18n:govoplan-files.can_use_this_credential.f4a41971</option>
@@ -1118,7 +1098,7 @@ export default function FileConnectorSettingsPanel({
                 <h3>Connection</h3>
                 <p>Name the file server connection and choose the provider.</p>
               </header>
-              <div className="form-grid two-column-form-grid">
+              <div className="form-grid two">
                 <FormField label="i18n:govoplan-files.profile_id.25961d68">
                   <input className={!editingProfileId && !draft.id.trim() ? "field-input-missing" : undefined} aria-invalid={!editingProfileId && !draft.id.trim() || undefined} value={draft.id} disabled={Boolean(editingProfileId) || saving} onChange={(event) => patchDraft({ id: event.target.value })} placeholder={`${scopeType}-webdav`} />
                 </FormField>
@@ -1151,7 +1131,7 @@ export default function FileConnectorSettingsPanel({
                 <h3>Location and credentials</h3>
                 <p>Only fields relevant for the selected provider and credential mode are shown.</p>
               </header>
-              <div className="form-grid two-column-form-grid">
+              <div className="form-grid two">
                 <FormField label="i18n:govoplan-files.endpoint_url.65aaaa45">
                   <input value={draft.endpointUrl} disabled={saving} onChange={(event) => patchDraft({ endpointUrl: event.target.value })} placeholder={ENDPOINT_PLACEHOLDERS[draft.provider]} />
                 </FormField>
@@ -1188,7 +1168,7 @@ export default function FileConnectorSettingsPanel({
               </DismissibleAlert>
               }
               <AdvancedOptionsPanel title="Protocol and compatibility options" summary="Change these only when the provider or network requires an override.">
-                <div className="form-grid two-column-form-grid">
+                <div className="form-grid two">
                   <FormField label="i18n:govoplan-files.browse_protocol.d1f27c90">
                     <select value={draft.browseProtocol} disabled={saving} onChange={(event) => patchDraft({ browseProtocol: event.target.value })}>
                       <option value="">i18n:govoplan-files.native_default.ba32f7b6</option>
@@ -1222,7 +1202,7 @@ export default function FileConnectorSettingsPanel({
                 <ToggleSwitch label="i18n:govoplan-files.import.d6fbc9d2" checked={draft.canImport} disabled={saving} onChange={(canImport) => patchDraft({ canImport })} />
                 <ToggleSwitch label="i18n:govoplan-files.sync.905f6309" checked={draft.canSync} disabled={saving} onChange={(canSync) => patchDraft({ canSync })} />
               </div>
-              <div className="form-grid two-column-form-grid">
+              <div className="form-grid two">
                 <FormField label="i18n:govoplan-files.policy.bb9cf141">
                   <select value={draft.policyMode} disabled={saving} onChange={(event) => patchDraft({ policyMode: event.target.value as PolicyMode })}>
                     <option value="allow-provider">i18n:govoplan-files.can_use_this_connection.5091a74c</option>
@@ -1373,8 +1353,6 @@ function emptyDraft(scopeType: ConnectorScope): ConnectorProfileDraft {
     username: "",
     password: "",
     token: "",
-    passwordEnv: "",
-    tokenEnv: "",
     secretRef: "",
     canBrowse: true,
     canImport: true,
@@ -1437,8 +1415,6 @@ function emptyCredentialDraft(scopeType: ConnectorScope): ConnectorCredentialDra
     username: "",
     password: "",
     token: "",
-    passwordEnv: "",
-    tokenEnv: "",
     secretRef: "",
     policyMode: "allow-provider",
     allowedPaths: "",
diff --git a/webui/src/features/files/FilesPage.tsx b/webui/src/features/files/FilesPage.tsx
index da75439..327e1d1 100644
--- a/webui/src/features/files/FilesPage.tsx
+++ b/webui/src/features/files/FilesPage.tsx
@@ -2433,7 +2433,7 @@ export default function FilesPage({ settings, auth }: {settings: ApiSettings;aut
       {dialog === "transfer" && transferDialogState &&
       <FileDialog title={`${transferMode === "copy" ? "i18n:govoplan-files.copy.af74f7c5" : "i18n:govoplan-files.move.76cdb950"} selection`} onClose={closeDialog}>
           <p className="muted">i18n:govoplan-files.choose_a_destination_space_and_folder_folders_ar.45158643</p>
-          <div className="form-grid two-column-form-grid">
+          <div className="form-grid two">
             <FormField label="i18n:govoplan-files.destination_space.92b63970" help="i18n:govoplan-files.select_the_space_that_will_receive_the_selected_.0a8bea8f">
               <select value={transferDialogState.targetSpaceId} onChange={(event) => setTransferDialogState((current) => current ? { ...current, targetSpaceId: event.target.value, targetFolder: "" } : current)}>
                 {spaces.filter((space) => !isConnectorSpace(space)).map((space) => <option key={space.id} value={space.id}>{space.label}</option>)}
@@ -2472,7 +2472,7 @@ export default function FilesPage({ settings, auth }: {settings: ApiSettings;aut
       {dialog === "rename" &&
       <FileDialog title="i18n:govoplan-files.bulk_rename_selected_items.5e79d694" onClose={closeDialog}>
           <p className="muted">i18n:govoplan-files.bulk_rename_changes_managed_display_paths_only_i.8cf34a6b</p>
-          <div className="form-grid two-column-form-grid">
+          <div className="form-grid two">
             <FormField label="i18n:govoplan-files.mode.a7b93d21" help="i18n:govoplan-files.choose_how_the_selected_names_should_be_changed.0231854f">
               <select value={renameMode} onChange={(event) => setRenameMode(event.target.value as RenameMode)}>
                 <option value="prefix">i18n:govoplan-files.add_prefix.672452bc</option>
diff --git a/webui/src/i18n/generatedTranslations.ts b/webui/src/i18n/generatedTranslations.ts
index eedf5b1..664978d 100644
--- a/webui/src/i18n/generatedTranslations.ts
+++ b/webui/src/i18n/generatedTranslations.ts
@@ -252,7 +252,6 @@ export const generatedTranslations: PlatformTranslations = {
     "i18n:govoplan-files.overwrite.0625c54e": "Overwrite",
     "i18n:govoplan-files.owner_space.364c4b62": "Owner space",
     "i18n:govoplan-files.parent_folder.d8ed4c2a": "Parent folder",
-    "i18n:govoplan-files.password_environment_variable.0e77673f": "Password environment variable",
     "i18n:govoplan-files.password.8be3c943": "Password",
     "i18n:govoplan-files.path_limited.d32cbef0": "Path-limited",
     "i18n:govoplan-files.pattern_preview_results.56cea56c": "Pattern preview results",
@@ -318,7 +317,6 @@ export const generatedTranslations: PlatformTranslations = {
     "i18n:govoplan-files.this_file_credential.695efb90": "this file credential",
     "i18n:govoplan-files.this_folder_is_empty_upload_files_in_the_top_lev.cb6c3a1a": "This folder is empty. Upload files in the top-level Files module.",
     "i18n:govoplan-files.this_folder_is_empty_use_upload_or_create_folder.5977d784": "This folder is empty. Use Upload or Create Folder to add content.",
-    "i18n:govoplan-files.token_environment_variable.5af4a79e": "Token environment variable",
     "i18n:govoplan-files.token.a1141eb9": "Token",
     "i18n:govoplan-files.unpack_zip_uploads.256fead4": "Unpack ZIP uploads",
     "i18n:govoplan-files.unpacking_zip_archive.698095f4": "Unpacking ZIP archive",
@@ -609,7 +607,6 @@ export const generatedTranslations: PlatformTranslations = {
     "i18n:govoplan-files.overwrite.0625c54e": "Overwrite",
     "i18n:govoplan-files.owner_space.364c4b62": "Owner space",
     "i18n:govoplan-files.parent_folder.d8ed4c2a": "Parent folder",
-    "i18n:govoplan-files.password_environment_variable.0e77673f": "Password environment variable",
     "i18n:govoplan-files.password.8be3c943": "Passwort",
     "i18n:govoplan-files.path_limited.d32cbef0": "Path-limited",
     "i18n:govoplan-files.pattern_preview_results.56cea56c": "Pattern preview results",
@@ -675,7 +672,6 @@ export const generatedTranslations: PlatformTranslations = {
     "i18n:govoplan-files.this_file_credential.695efb90": "this file credential",
     "i18n:govoplan-files.this_folder_is_empty_upload_files_in_the_top_lev.cb6c3a1a": "This folder is empty. Upload files in the top-level Files module.",
     "i18n:govoplan-files.this_folder_is_empty_use_upload_or_create_folder.5977d784": "This folder is empty. Use Upload or Create Folder to add content.",
-    "i18n:govoplan-files.token_environment_variable.5af4a79e": "Token environment variable",
     "i18n:govoplan-files.token.a1141eb9": "Token",
     "i18n:govoplan-files.unpack_zip_uploads.256fead4": "Unpack ZIP uploads",
     "i18n:govoplan-files.unpacking_zip_archive.698095f4": "Unpacking ZIP archive",
diff --git a/webui/src/styles/file-manager.css b/webui/src/styles/file-manager.css
index ac1f73c..18628dd 100644
--- a/webui/src/styles/file-manager.css
+++ b/webui/src/styles/file-manager.css
@@ -960,7 +960,7 @@
   border: 1px solid transparent;
   border-radius: 9px;
   background: transparent;
-  color: var(--ink);
+  color: var(--text-strong);
   text-align: left;
   cursor: pointer;
 }
@@ -1038,7 +1038,7 @@
   border: 0;
   border-radius: 6px;
   background: transparent;
-  color: var(--ink);
+  color: var(--text-strong);
   padding: 5px 6px;
   cursor: pointer;
 }
@@ -1137,7 +1137,7 @@
 }
 
 .managed-file-entry:disabled {
-  color: var(--ink);
+  color: var(--text-strong);
   opacity: 1;
   cursor: default;
 }
@@ -1245,7 +1245,7 @@
   border-right: 0;
   border-left: 0;
   background: transparent;
-  color: var(--ink);
+  color: var(--text-strong);
   text-align: left;
   font: inherit;
   cursor: pointer;
@@ -1272,27 +1272,6 @@
   color: var(--muted);
 }
 
-.split-field-action {
-  gap: 0;
-}
-
-.split-field-action > input,
-.split-field-action > select,
-.split-field-action > textarea {
-  border-top-right-radius: 0 !important;
-  border-bottom-right-radius: 0 !important;
-}
-
-.split-field-action > button,
-.split-field-action > .button,
-.split-field-action > .btn {
-  align-self: stretch;
-  margin-left: -1px;
-  border-top-left-radius: 0;
-  border-bottom-left-radius: 0;
-  box-shadow: none;
-}
-
 @media (max-width: 850px) {
   .managed-file-entry-head,
   .managed-file-entry {