From dc88eb71d9380a7b993446f6000bbefa70173b71 Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Tue, 25 Aug 2026 10:08:58 -0700
Subject: [PATCH 01/24] Support adding custom initializers in CopyRIT

---
 frontend/package.json                         |   2 +
 .../Initializers/CustomInitializers.styles.ts |  51 +++++
 .../Initializers/CustomInitializers.tsx       | 177 ++++++++++++++++++
 .../Initializers/Initializers.test.tsx        |  59 ++++++
 .../components/Initializers/Initializers.tsx  | 135 ++++++++++---
 .../Initializers/PythonCode.styles.ts         |  95 ++++++++++
 .../components/Initializers/PythonCode.tsx    | 100 ++++++++++
 .../src/components/Sidebar/Navigation.tsx     |   1 +
 frontend/src/services/api.ts                  |  17 ++
 frontend/src/types/index.ts                   |  10 +
 pyrit/backend/main.py                         |   4 +-
 pyrit/backend/routes/initializers.py          |  17 +-
 pyrit/backend/services/initializer_service.py |  60 +++++-
 ...c8d9e0f1a_add_custom_initializers_table.py |  39 ++++
 pyrit/memory/memory_interface.py              |  37 ++++
 pyrit/memory/memory_models.py                 |  41 ++++
 pyrit/models/__init__.py                      |   2 +
 pyrit/models/custom_initializer.py            |  21 +++
 .../unit/backend/test_initializer_service.py  | 107 ++++++++++-
 tests/unit/backend/test_main.py               |  45 ++++-
 .../memory/test_custom_initializer_memory.py  |  42 +++++
 21 files changed, 1024 insertions(+), 38 deletions(-)
 create mode 100644 frontend/src/components/Initializers/CustomInitializers.styles.ts
 create mode 100644 frontend/src/components/Initializers/CustomInitializers.tsx
 create mode 100644 frontend/src/components/Initializers/PythonCode.styles.ts
 create mode 100644 frontend/src/components/Initializers/PythonCode.tsx
 create mode 100644 pyrit/memory/alembic/versions/6b7c8d9e0f1a_add_custom_initializers_table.py
 create mode 100644 pyrit/models/custom_initializer.py
 create mode 100644 tests/unit/memory/test_custom_initializer_memory.py

diff --git a/frontend/package.json b/frontend/package.json
index 2a5db9683b..2d4acaa632 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -27,6 +27,7 @@
     "@fluentui/react-components": "9.74.6",
     "@fluentui/react-icons": "2.0.335",
     "axios": "1.19.0",
+    "prismjs": "^1.30.0",
     "react": "19.2.8",
     "react-dom": "19.2.8",
     "react-error-boundary": "6.1.2",
@@ -44,6 +45,7 @@
     "@testing-library/user-event": "14.6.4",
     "@types/jest": "30.0.0",
     "@types/node": "26.2.0",
+    "@types/prismjs": "^1.26.6",
     "@types/react": "19.2.18",
     "@types/react-dom": "19.2.4",
     "@typescript-eslint/eslint-plugin": "8.67.0",
diff --git a/frontend/src/components/Initializers/CustomInitializers.styles.ts b/frontend/src/components/Initializers/CustomInitializers.styles.ts
new file mode 100644
index 0000000000..65b79bb86b
--- /dev/null
+++ b/frontend/src/components/Initializers/CustomInitializers.styles.ts
@@ -0,0 +1,51 @@
+import { makeStyles, tokens } from '@fluentui/react-components'
+
+export const useCustomInitializersStyles = makeStyles({
+  root: {
+    display: 'flex',
+    flexDirection: 'column',
+    gap: tokens.spacingVerticalM,
+    minWidth: 0,
+  },
+  header: {
+    display: 'flex',
+    alignItems: 'center',
+    justifyContent: 'space-between',
+    flexWrap: 'wrap',
+    gap: tokens.spacingVerticalM,
+  },
+  tableWrap: {
+    overflowX: 'auto',
+    border: `1px solid ${tokens.colorNeutralStroke2}`,
+    backgroundColor: tokens.colorNeutralBackground1,
+  },
+  nameCell: {
+    verticalAlign: 'top',
+  },
+  clickableRow: {
+    cursor: 'pointer',
+    '&:hover': {
+      backgroundColor: tokens.colorNeutralBackground1Hover,
+    },
+    '&:focus-within': {
+      backgroundColor: tokens.colorNeutralBackground1Hover,
+    },
+  },
+  actionCell: {
+    width: '7rem',
+    verticalAlign: 'top',
+  },
+  dialogBody: {
+    display: 'flex',
+    flexDirection: 'column',
+    gap: tokens.spacingVerticalM,
+  },
+  sourceDialog: {
+    width: 'min(60rem, 90vw)',
+    maxWidth: 'none',
+  },
+  emptyState: {
+    padding: tokens.spacingVerticalXL,
+    color: tokens.colorNeutralForeground3,
+  },
+})
\ No newline at end of file
diff --git a/frontend/src/components/Initializers/CustomInitializers.tsx b/frontend/src/components/Initializers/CustomInitializers.tsx
new file mode 100644
index 0000000000..02ae091d3f
--- /dev/null
+++ b/frontend/src/components/Initializers/CustomInitializers.tsx
@@ -0,0 +1,177 @@
+import { useState } from 'react'
+
+import {
+  Button,
+  Dialog,
+  DialogActions,
+  DialogBody,
+  DialogContent,
+  DialogSurface,
+  DialogTitle,
+  DialogTrigger,
+  Field,
+  Input,
+  Table,
+  TableBody,
+  TableCell,
+  TableHeader,
+  TableHeaderCell,
+  TableRow,
+  Text,
+} from '@fluentui/react-components'
+import { AddRegular, DeleteRegular, EyeRegular } from '@fluentui/react-icons'
+
+import type { CustomInitializer } from '@/types'
+
+import { useCustomInitializersStyles } from './CustomInitializers.styles'
+import { PythonCodeBlock, PythonCodeEditor } from './PythonCode'
+
+interface CustomInitializersProps {
+  items: CustomInitializer[]
+  registering: boolean
+  deletingName: string | null
+  onRegister: (name: string, scriptContent: string) => Promise<boolean>
+  onDelete: (name: string) => Promise<void>
+}
+
+export default function CustomInitializers({
+  items,
+  registering,
+  deletingName,
+  onRegister,
+  onDelete,
+}: CustomInitializersProps) {
+  const styles = useCustomInitializersStyles()
+  const [dialogOpen, setDialogOpen] = useState(false)
+  const [name, setName] = useState('')
+  const [scriptContent, setScriptContent] = useState('')
+  const [viewingInitializer, setViewingInitializer] = useState<CustomInitializer | null>(null)
+
+  const handleSubmit = async (event: React.FormEvent<HTMLFormElement>): Promise<void> => {
+    event.preventDefault()
+    if (await onRegister(name.trim(), scriptContent)) {
+      setDialogOpen(false)
+      setName('')
+      setScriptContent('')
+    }
+  }
+
+  return (
+    <section className={styles.root} aria-labelledby="custom-initializers-heading">
+      <div className={styles.header}>
+        <div>
+          <Text id="custom-initializers-heading" as="h2" size={500} weight="semibold">
+            Custom initializers
+          </Text>
+          <Text block>Persisted Python definitions available to startup initializer configuration.</Text>
+        </div>
+        <Dialog open={dialogOpen} onOpenChange={(_, data) => setDialogOpen(data.open)}>
+          <DialogTrigger disableButtonEnhancement>
+            <Button appearance="primary" icon={<AddRegular />}>Register initializer</Button>
+          </DialogTrigger>
+          <DialogSurface className={styles.sourceDialog}>
+            <form onSubmit={handleSubmit}>
+              <DialogBody>
+                <DialogTitle>Register custom initializer</DialogTitle>
+                <DialogContent className={styles.dialogBody}>
+                  <Field label="Initializer name" required>
+                    <Input
+                      value={name}
+                      onChange={(_, data) => setName(data.value)}
+                      disabled={registering}
+                      autoComplete="off"
+                    />
+                  </Field>
+                  <Field label="Python source" required>
+                    <PythonCodeEditor source={scriptContent} onChange={setScriptContent} disabled={registering} />
+                  </Field>
+                </DialogContent>
+                <DialogActions>
+                  <DialogTrigger disableButtonEnhancement>
+                    <Button appearance="secondary" disabled={registering}>Cancel</Button>
+                  </DialogTrigger>
+                  <Button
+                    type="submit"
+                    appearance="primary"
+                    disabled={registering || name.trim() === '' || scriptContent.trim() === ''}
+                  >
+                    {registering ? 'Registering...' : 'Register'}
+                  </Button>
+                </DialogActions>
+              </DialogBody>
+            </form>
+          </DialogSurface>
+        </Dialog>
+      </div>
+
+      {items.length === 0 ? (
+        <Text className={styles.emptyState}>No custom initializers registered.</Text>
+      ) : (
+        <div className={styles.tableWrap}>
+          <Table aria-label="Custom initializers">
+            <TableHeader>
+              <TableRow>
+                <TableHeaderCell className={styles.nameCell}>Name</TableHeaderCell>
+                <TableHeaderCell className={styles.actionCell}>Actions</TableHeaderCell>
+              </TableRow>
+            </TableHeader>
+            <TableBody>
+              {items.map((item) => (
+                <TableRow
+                  className={styles.clickableRow}
+                  key={item.initializer_name}
+                  data-testid={`custom-initializer-${item.initializer_name}`}
+                  onClick={() => setViewingInitializer(item)}
+                >
+                  <TableCell className={styles.nameCell}>
+                    <Button
+                      appearance="transparent"
+                      icon={<EyeRegular />}
+                      onClick={() => setViewingInitializer(item)}
+                    >
+                      {item.initializer_name}
+                    </Button>
+                  </TableCell>
+                  <TableCell className={styles.actionCell}>
+                    <Button
+                      appearance="subtle"
+                      icon={<DeleteRegular />}
+                      disabled={deletingName !== null}
+                      onClick={(event) => {
+                        event.stopPropagation()
+                        void onDelete(item.initializer_name)
+                      }}
+                    >
+                      {deletingName === item.initializer_name ? 'Removing...' : 'Remove'}
+                    </Button>
+                  </TableCell>
+                </TableRow>
+              ))}
+            </TableBody>
+          </Table>
+        </div>
+      )}
+
+      <Dialog
+        open={viewingInitializer !== null}
+        onOpenChange={(_, data) => {
+          if (!data.open) {
+            setViewingInitializer(null)
+          }
+        }}
+      >
+        <DialogSurface className={styles.sourceDialog}>
+          <DialogBody>
+            <DialogTitle>{viewingInitializer?.initializer_name}</DialogTitle>
+            <DialogContent>
+              <PythonCodeBlock source={viewingInitializer?.script_content ?? ''} ariaLabel="Python source" />
+            </DialogContent>
+            <DialogActions>
+              <Button appearance="primary" onClick={() => setViewingInitializer(null)}>Close</Button>
+            </DialogActions>
+          </DialogBody>
+        </DialogSurface>
+      </Dialog>
+    </section>
+  )
+}
\ No newline at end of file
diff --git a/frontend/src/components/Initializers/Initializers.test.tsx b/frontend/src/components/Initializers/Initializers.test.tsx
index 3ddc8b6954..4cc7726cae 100644
--- a/frontend/src/components/Initializers/Initializers.test.tsx
+++ b/frontend/src/components/Initializers/Initializers.test.tsx
@@ -8,6 +8,7 @@ import type {
   BaselineInitializerSetting,
   InitializerSettingsResponse,
   RegisteredInitializer,
+  CustomInitializer,
 } from '@/types'
 
 import Initializers from './Initializers'
@@ -16,6 +17,9 @@ jest.mock('@/services/api', () => ({
   initializersApi: {
     getSettings: jest.fn(),
     listRegistered: jest.fn(),
+    listCustom: jest.fn(),
+    register: jest.fn(),
+    unregister: jest.fn(),
     createAdditional: jest.fn(),
     updateAdditional: jest.fn(),
     deleteAdditional: jest.fn(),
@@ -96,6 +100,11 @@ const sampleSettings: InitializerSettingsResponse = {
   additional: [additionalItem],
 }
 
+const customInitializer: CustomInitializer = {
+  initializer_name: 'custom_target',
+  script_content: 'class CustomTargetInitializer: pass',
+}
+
 function renderInitializers(): void {
   render(
     <TestWrapper>
@@ -112,6 +121,15 @@ describe('Initializers', () => {
       items: [targetInitializer, scorerInitializer],
       pagination: { limit: 200, has_more: false },
     })
+    mockedInitializersApi.listCustom.mockResolvedValue([customInitializer])
+    mockedInitializersApi.register.mockResolvedValue({
+      initializer_name: 'new_custom',
+      initializer_type: 'NewCustomInitializer',
+      description: 'New custom initializer.',
+      required_env_vars: [],
+      supported_parameters: [],
+    })
+    mockedInitializersApi.unregister.mockResolvedValue()
     mockedInitializersApi.createAdditional.mockResolvedValue({
       id: 'additional-2',
       initializer_name: 'target',
@@ -150,6 +168,47 @@ describe('Initializers', () => {
     expect(screen.getByTestId('initializer-row-additional-1')).toHaveTextContent('scorer')
   })
 
+  it('should list and register persisted custom initializers in the custom tab', async () => {
+    const user = userEvent.setup()
+    const writeText = jest.fn().mockResolvedValue(undefined)
+    Object.defineProperty(navigator, 'clipboard', { configurable: true, value: { writeText } })
+    renderInitializers()
+
+    await user.click(await screen.findByRole('tab', { name: 'Custom' }))
+    const customRow = await screen.findByTestId('custom-initializer-custom_target')
+    expect(customRow).not.toHaveTextContent('class CustomTargetInitializer: pass')
+    fireEvent.click(within(customRow).getByRole('button', { name: /custom_target/ }))
+    const sourceDialog = await screen.findByRole('dialog')
+    const sourceBlock = within(sourceDialog).getByLabelText('Python source')
+    expect(sourceBlock).toHaveTextContent(
+      'class CustomTargetInitializer: pass',
+    )
+    expect(sourceBlock.querySelector('.token.keyword')).toHaveTextContent('class')
+    fireEvent.click(within(sourceDialog).getByRole('button', { name: 'Copy Python source', hidden: true }))
+    await waitFor(() => expect(writeText).toHaveBeenCalledWith('class CustomTargetInitializer: pass'))
+    await user.click(within(sourceDialog).getByRole('button', { name: 'Close', hidden: true }))
+
+    fireEvent.click(screen.getByRole('button', { name: 'Register initializer' }))
+    const dialog = await screen.findByRole('dialog')
+    fireEvent.change(within(dialog).getByLabelText(/Initializer name/), { target: { value: 'new_custom' } })
+    fireEvent.change(within(dialog).getByLabelText('Python source', { selector: 'textarea' }), {
+      target: { value: 'class NewCustom: pass' },
+    })
+    expect(within(dialog).getAllByRole('textbox')).toHaveLength(2)
+    expect(dialog.querySelector('pre[aria-hidden="true"] .token.keyword')).toHaveTextContent('class')
+    const form = dialog.querySelector('form')
+    expect(form).not.toBeNull()
+    fireEvent.submit(form as HTMLFormElement)
+
+    await waitFor(() => {
+      expect(mockedInitializersApi.register).toHaveBeenCalledWith({
+        name: 'new_custom',
+        script_content: 'class NewCustom: pass',
+      })
+      expect(screen.getByText('Registered new_custom.')).toBeInTheDocument()
+    })
+  })
+
   it('should refresh settings when the refresh button is clicked', async () => {
     const user = userEvent.setup()
     renderInitializers()
diff --git a/frontend/src/components/Initializers/Initializers.tsx b/frontend/src/components/Initializers/Initializers.tsx
index 55c7547d7f..7d69f15a6f 100644
--- a/frontend/src/components/Initializers/Initializers.tsx
+++ b/frontend/src/components/Initializers/Initializers.tsx
@@ -1,15 +1,22 @@
 import { useEffect, useState } from 'react'
 
-import { Button, MessageBar, MessageBarBody, Spinner, Text } from '@fluentui/react-components'
+import { Button, MessageBar, MessageBarBody, Spinner, Tab, TabList, Text } from '@fluentui/react-components'
+import type { SelectTabData, SelectTabEvent } from '@fluentui/react-components'
 import { ArrowSyncRegular } from '@fluentui/react-icons'
 
 import { initializersApi } from '@/services/api'
 import { toApiError } from '@/services/errors'
-import type { InitializerSettingsResponse, RegisteredInitializer, UpdateAdditionalInitializerRequest } from '@/types'
+import type {
+  CustomInitializer,
+  InitializerSettingsResponse,
+  RegisteredInitializer,
+  UpdateAdditionalInitializerRequest,
+} from '@/types'
 
 import AdditionalInitializers from './AdditionalInitializers'
 import AvailableInitializersDialog from './AvailableInitializersDialog'
 import BaselineInitializers from './BaselineInitializers'
+import CustomInitializers from './CustomInitializers'
 import { useInitializersStyles } from './Initializers.styles'
 
 interface StatusMessage {
@@ -17,6 +24,8 @@ interface StatusMessage {
   text: string
 }
 
+type InitializerTab = 'startup' | 'custom'
+
 const EMPTY_SETTINGS: InitializerSettingsResponse = {
   baseline: [],
   additional: [],
@@ -26,6 +35,8 @@ export default function Initializers() {
   const styles = useInitializersStyles()
   const [settings, setSettings] = useState<InitializerSettingsResponse>(EMPTY_SETTINGS)
   const [registeredInitializers, setRegisteredInitializers] = useState<RegisteredInitializer[]>([])
+  const [customInitializers, setCustomInitializers] = useState<CustomInitializer[]>([])
+  const [selectedTab, setSelectedTab] = useState<InitializerTab>('startup')
   const [loading, setLoading] = useState(true)
   const [statusMessage, setStatusMessage] = useState<StatusMessage | null>(null)
   const [refetchCount, setRefetchCount] = useState(0)
@@ -34,14 +45,17 @@ export default function Initializers() {
   const [saveErrors, setSaveErrors] = useState<Record<string, string>>({})
   const [applyingInitializerId, setApplyingInitializerId] = useState<string | null>(null)
   const [deletingInitializerId, setDeletingInitializerId] = useState<string | null>(null)
+  const [registeringCustom, setRegisteringCustom] = useState(false)
+  const [deletingCustomName, setDeletingCustomName] = useState<string | null>(null)
 
   useEffect(() => {
     let cancelled = false
 
     const loadInitializersAsync = async (): Promise<void> => {
-      const [settingsResult, registeredResult] = await Promise.allSettled([
+      const [settingsResult, registeredResult, customResult] = await Promise.allSettled([
         initializersApi.getSettings(),
         initializersApi.listRegistered(),
+        initializersApi.listCustom(),
       ])
       if (cancelled) {
         return
@@ -64,6 +78,12 @@ export default function Initializers() {
         )
       }
 
+      if (customResult.status === 'fulfilled') {
+        setCustomInitializers(customResult.value)
+      } else {
+        setStatusMessage({ intent: 'error', text: toApiError(customResult.reason).detail })
+      }
+
       setLoading(false)
     }
 
@@ -84,6 +104,49 @@ export default function Initializers() {
     setSettings(response)
   }
 
+  const refetchCustomCatalog = async (): Promise<void> => {
+    const [custom, registered] = await Promise.all([
+      initializersApi.listCustom(),
+      initializersApi.listRegistered(),
+    ])
+    setCustomInitializers(custom)
+    setRegisteredInitializers(registered.items)
+  }
+
+  const handleTabSelect = (_: SelectTabEvent, data: SelectTabData): void => {
+    if (data.value === 'startup' || data.value === 'custom') {
+      setSelectedTab(data.value)
+    }
+  }
+
+  const handleRegisterCustom = async (name: string, scriptContent: string): Promise<boolean> => {
+    setRegisteringCustom(true)
+    try {
+      await initializersApi.register({ name, script_content: scriptContent })
+      await refetchCustomCatalog()
+      setStatusMessage({ intent: 'success', text: `Registered ${name}.` })
+      return true
+    } catch (error) {
+      setStatusMessage({ intent: 'error', text: toApiError(error).detail })
+      return false
+    } finally {
+      setRegisteringCustom(false)
+    }
+  }
+
+  const handleDeleteCustom = async (name: string): Promise<void> => {
+    setDeletingCustomName(name)
+    try {
+      await initializersApi.unregister(name)
+      await refetchCustomCatalog()
+      setStatusMessage({ intent: 'success', text: `Removed ${name}.` })
+    } catch (error) {
+      setStatusMessage({ intent: 'error', text: toApiError(error).detail })
+    } finally {
+      setDeletingCustomName(null)
+    }
+  }
+
   const handleAdd = async (
     initializerName: string,
     parameters: Record<string, unknown> | null,
@@ -171,15 +234,16 @@ export default function Initializers() {
         <div className={styles.headerText}>
           <Text as="h1" size={600} weight="semibold">Initializers</Text>
           <Text size={300}>
-            Browse every registered initializer, review the read-only baseline that ran at startup, and manage
-            additional initializer invocations that run after it.
+            Manage startup initializer invocations and persisted custom initializer definitions.
           </Text>
         </div>
         <div className={styles.headerActions}>
-          <AvailableInitializersDialog
-            registeredInitializers={registeredInitializers}
-            disabled={loading}
-          />
+          {selectedTab === 'startup' && (
+            <AvailableInitializersDialog
+              registeredInitializers={registeredInitializers}
+              disabled={loading}
+            />
+          )}
           <Button
             appearance="subtle"
             icon={<ArrowSyncRegular />}
@@ -198,31 +262,46 @@ export default function Initializers() {
         </MessageBar>
       )}
 
+      <TabList selectedValue={selectedTab} onTabSelect={handleTabSelect}>
+        <Tab value="startup">Startup</Tab>
+        <Tab value="custom">Custom</Tab>
+      </TabList>
+
       {loading ? (
         <div className={styles.loadingState}>
           <Spinner label="Loading initializer settings..." />
         </div>
       ) : (
-        <>
-          <BaselineInitializers
-            items={settings.baseline}
-            registeredInitializers={registeredInitializers}
-          />
-          <AdditionalInitializers
-            items={settings.additional}
-            registeredInitializers={registeredInitializers}
-            creating={creating}
-            savingInitializerId={savingInitializerId}
-            saveErrors={saveErrors}
-            applyingInitializerId={applyingInitializerId}
-            deletingInitializerId={deletingInitializerId}
-            onAdd={handleAdd}
-            onSave={handleSave}
-            onClearSaveError={clearSaveError}
-            onApply={handleApply}
-            onRemove={handleRemove}
+        selectedTab === 'startup' ? (
+          <>
+            <BaselineInitializers
+              items={settings.baseline}
+              registeredInitializers={registeredInitializers}
+            />
+            <AdditionalInitializers
+              items={settings.additional}
+              registeredInitializers={registeredInitializers}
+              creating={creating}
+              savingInitializerId={savingInitializerId}
+              saveErrors={saveErrors}
+              applyingInitializerId={applyingInitializerId}
+              deletingInitializerId={deletingInitializerId}
+              onAdd={handleAdd}
+              onSave={handleSave}
+              onClearSaveError={clearSaveError}
+              onApply={handleApply}
+              onRemove={handleRemove}
+            />
+          </>
+        ) : (
+          <CustomInitializers
+            items={customInitializers}
+            registering={registeringCustom}
+            deletingName={deletingCustomName}
+            onRegister={handleRegisterCustom}
+            onDelete={handleDeleteCustom}
           />
-        </>
+        )
       )}
     </main>
   )
diff --git a/frontend/src/components/Initializers/PythonCode.styles.ts b/frontend/src/components/Initializers/PythonCode.styles.ts
new file mode 100644
index 0000000000..f88451c321
--- /dev/null
+++ b/frontend/src/components/Initializers/PythonCode.styles.ts
@@ -0,0 +1,95 @@
+import { makeStyles, tokens } from '@fluentui/react-components'
+
+export const usePythonCodeStyles = makeStyles({
+  codeHeader: {
+    display: 'flex',
+    alignItems: 'center',
+    justifyContent: 'space-between',
+    minHeight: '2rem',
+    padding: `${tokens.spacingVerticalXS} ${tokens.spacingHorizontalM}`,
+    border: `1px solid ${tokens.colorNeutralStroke2}`,
+    borderBottom: 0,
+    borderRadius: `${tokens.borderRadiusMedium} ${tokens.borderRadiusMedium} 0 0`,
+    backgroundColor: tokens.colorNeutralBackground3,
+    color: tokens.colorNeutralForeground2,
+    fontSize: tokens.fontSizeBase200,
+    fontWeight: tokens.fontWeightSemibold,
+  },
+  codeBlock: {
+    maxHeight: '65vh',
+    margin: 0,
+    padding: tokens.spacingHorizontalL,
+    overflow: 'auto',
+    border: `1px solid ${tokens.colorNeutralStroke2}`,
+    borderRadius: `0 0 ${tokens.borderRadiusMedium} ${tokens.borderRadiusMedium}`,
+    backgroundColor: tokens.colorNeutralBackground2,
+    color: tokens.colorNeutralForeground1,
+    whiteSpace: 'pre',
+    tabSize: 4,
+    fontFamily: 'Consolas, "Courier New", monospace',
+    fontSize: tokens.fontSizeBase300,
+    lineHeight: tokens.lineHeightBase300,
+    '& .token.comment, & .token.prolog, & .token.doctype, & .token.cdata': {
+      color: tokens.colorNeutralForeground3,
+      fontStyle: 'italic',
+    },
+    '& .token.keyword, & .token.operator': {
+      color: tokens.colorPalettePurpleForeground2,
+    },
+    '& .token.string, & .token.char, & .token.attr-value': {
+      color: tokens.colorPaletteGreenForeground1,
+    },
+    '& .token.number, & .token.boolean, & .token.constant': {
+      color: tokens.colorPaletteDarkOrangeForeground1,
+    },
+    '& .token.function, & .token.class-name, & .token.builtin': {
+      color: tokens.colorPaletteBlueForeground2,
+    },
+    '& .token.decorator, & .token.annotation, & .token.symbol': {
+      color: tokens.colorPaletteRedForeground2,
+    },
+    '& .token.punctuation': {
+      color: tokens.colorNeutralForeground2,
+    },
+  },
+  editor: {
+    position: 'relative',
+    minHeight: '22rem',
+  },
+  editorHighlight: {
+    position: 'absolute',
+    inset: 0,
+    maxHeight: 'none',
+    overflow: 'hidden',
+    pointerEvents: 'none',
+  },
+  editorInput: {
+    position: 'relative',
+    zIndex: 1,
+    display: 'block',
+    boxSizing: 'border-box',
+    width: '100%',
+    minHeight: '22rem',
+    margin: 0,
+    padding: tokens.spacingHorizontalL,
+    overflow: 'auto',
+    resize: 'vertical',
+    border: '1px solid transparent',
+    borderRadius: `0 0 ${tokens.borderRadiusMedium} ${tokens.borderRadiusMedium}`,
+    backgroundColor: 'transparent',
+    color: 'transparent',
+    caretColor: tokens.colorNeutralForeground1,
+    whiteSpace: 'pre',
+    tabSize: 4,
+    fontFamily: 'Consolas, "Courier New", monospace',
+    fontSize: tokens.fontSizeBase300,
+    lineHeight: tokens.lineHeightBase300,
+    '&:focus-visible': {
+      outline: `2px solid ${tokens.colorStrokeFocus2}`,
+      outlineOffset: '-2px',
+    },
+    '&::selection': {
+      backgroundColor: tokens.colorBrandBackground2,
+    },
+  },
+})
\ No newline at end of file
diff --git a/frontend/src/components/Initializers/PythonCode.tsx b/frontend/src/components/Initializers/PythonCode.tsx
new file mode 100644
index 0000000000..2e7dcc89df
--- /dev/null
+++ b/frontend/src/components/Initializers/PythonCode.tsx
@@ -0,0 +1,100 @@
+import { useRef, useState } from 'react'
+
+import { Button, Tooltip } from '@fluentui/react-components'
+import { CheckmarkRegular, ClipboardRegular } from '@fluentui/react-icons'
+import Prism from 'prismjs'
+import 'prismjs/components/prism-python'
+
+import { usePythonCodeStyles } from './PythonCode.styles'
+
+interface PythonCodeBlockProps {
+  source: string
+  ariaLabel: string
+}
+
+interface PythonCodeEditorProps {
+  source: string
+  disabled: boolean
+  onChange: (source: string) => void
+}
+
+interface CodeHeaderProps {
+  source: string
+}
+
+function highlightPython(source: string): string {
+  return Prism.highlight(source, Prism.languages.python, 'python')
+}
+
+function CodeHeader({ source }: CodeHeaderProps) {
+  const styles = usePythonCodeStyles()
+  const [copiedSource, setCopiedSource] = useState<string | null>(null)
+  const copied = copiedSource === source
+
+  const handleCopy = async (): Promise<void> => {
+    await navigator.clipboard.writeText(source)
+    setCopiedSource(source)
+  }
+
+  return (
+    <div className={styles.codeHeader}>
+      <span>Python</span>
+      <Tooltip content={copied ? 'Copied' : 'Copy Python source'} relationship="description">
+        <Button
+          appearance="transparent"
+          size="small"
+          icon={copied ? <CheckmarkRegular /> : <ClipboardRegular />}
+          aria-label={copied ? 'Copied' : 'Copy Python source'}
+          onClick={() => void handleCopy()}
+        />
+      </Tooltip>
+    </div>
+  )
+}
+
+export function PythonCodeBlock({ source, ariaLabel }: PythonCodeBlockProps) {
+  const styles = usePythonCodeStyles()
+
+  return (
+    <div>
+      <CodeHeader source={source} />
+      <pre className={styles.codeBlock} aria-label={ariaLabel}>
+        <code dangerouslySetInnerHTML={{ __html: highlightPython(source) }} />
+      </pre>
+    </div>
+  )
+}
+
+export function PythonCodeEditor({ source, disabled, onChange }: PythonCodeEditorProps) {
+  const styles = usePythonCodeStyles()
+  const highlightRef = useRef<HTMLPreElement>(null)
+
+  const handleScroll = (event: React.UIEvent<HTMLTextAreaElement>): void => {
+    if (highlightRef.current) {
+      highlightRef.current.scrollTop = event.currentTarget.scrollTop
+      highlightRef.current.scrollLeft = event.currentTarget.scrollLeft
+    }
+  }
+
+  return (
+    <div>
+      <CodeHeader source={source} />
+      <div className={styles.editor}>
+        <pre ref={highlightRef} className={`${styles.codeBlock} ${styles.editorHighlight}`} aria-hidden="true">
+          <code dangerouslySetInnerHTML={{ __html: highlightPython(`${source}\n`) }} />
+        </pre>
+        <textarea
+          className={styles.editorInput}
+          aria-label="Python source"
+          value={source}
+          onChange={(event) => onChange(event.target.value)}
+          onScroll={handleScroll}
+          disabled={disabled}
+          autoCapitalize="off"
+          autoCorrect="off"
+          spellCheck={false}
+        />
+      </div>
+    </div>
+  )
+}
\ No newline at end of file
diff --git a/frontend/src/components/Sidebar/Navigation.tsx b/frontend/src/components/Sidebar/Navigation.tsx
index 218635db9f..bcacc9bf33 100644
--- a/frontend/src/components/Sidebar/Navigation.tsx
+++ b/frontend/src/components/Sidebar/Navigation.tsx
@@ -115,6 +115,7 @@ export default function Navigation({ currentView, onNavigate, onOpenFeedback }:
           aria-current={currentView === 'initializers' ? 'page' : undefined}
           onClick={() => onNavigate('initializers')}
         />
+
       </nav>
 
       <div className={styles.spacer} />
diff --git a/frontend/src/services/api.ts b/frontend/src/services/api.ts
index a823d18f80..ae30142f5e 100644
--- a/frontend/src/services/api.ts
+++ b/frontend/src/services/api.ts
@@ -14,6 +14,9 @@ import type {
   CreateTargetRequest,
   InitializerSettingsResponse,
   ListRegisteredInitializersResponse,
+  RegisterInitializerRequest,
+  RegisteredInitializer,
+  CustomInitializer,
   AdditionalInitializer,
   CreateAdditionalInitializerRequest,
   UpdateAdditionalInitializerRequest,
@@ -210,6 +213,20 @@ export const initializersApi = {
     return response.data
   },
 
+  register: async (request: RegisterInitializerRequest): Promise<RegisteredInitializer> => {
+    const response = await apiClient.post('/initializers', request)
+    return response.data
+  },
+
+  listCustom: async (): Promise<CustomInitializer[]> => {
+    const response = await apiClient.get('/initializers/custom')
+    return response.data
+  },
+
+  unregister: async (initializerName: string): Promise<void> => {
+    await apiClient.delete(`/initializers/${encodeURIComponent(initializerName)}`)
+  },
+
   createAdditional: async (
     request: CreateAdditionalInitializerRequest,
   ): Promise<AdditionalInitializer> => {
diff --git a/frontend/src/types/index.ts b/frontend/src/types/index.ts
index 0852de5827..25b0281d46 100644
--- a/frontend/src/types/index.ts
+++ b/frontend/src/types/index.ts
@@ -164,6 +164,16 @@ export interface ListRegisteredInitializersResponse {
   pagination: PaginationInfo
 }
 
+export interface RegisterInitializerRequest {
+  name: string
+  script_content: string
+}
+
+export interface CustomInitializer {
+  initializer_name: string
+  script_content: string
+}
+
 export interface ApplyInitializerRequest {
   parameters?: Record<string, unknown> | null
 }
diff --git a/pyrit/backend/main.py b/pyrit/backend/main.py
index b195ae3b9c..e0ba97f9b6 100644
--- a/pyrit/backend/main.py
+++ b/pyrit/backend/main.py
@@ -69,7 +69,9 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
         )
         for order_index, initializer in enumerate(config.initializer_configs)
     ]
-    await get_initializer_service().run_additional_initializers_async()
+    initializer_service = get_initializer_service()
+    await initializer_service.register_persisted_custom_initializers_async()
+    await initializer_service.run_additional_initializers_async()
 
     # Expose config values to route handlers via app.state
     default_labels: dict[str, str] = {}
diff --git a/pyrit/backend/routes/initializers.py b/pyrit/backend/routes/initializers.py
index d4383e3572..ef0cff21ce 100644
--- a/pyrit/backend/routes/initializers.py
+++ b/pyrit/backend/routes/initializers.py
@@ -32,7 +32,7 @@
     UpdateAdditionalInitializerRequest,
 )
 from pyrit.backend.services.initializer_service import get_initializer_service
-from pyrit.models import AdditionalInitializer
+from pyrit.models import AdditionalInitializer, CustomInitializer
 from pyrit.models.catalog.initializer import RegisteredInitializer
 
 router = APIRouter(prefix="/initializers", tags=["initializers"])
@@ -249,6 +249,21 @@ async def apply_initializer(  # pyrit-async-suffix-exempt
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(exc)) from None
 
 
+@router.get(
+    "/custom",
+    response_model=list[CustomInitializer],
+)
+async def list_custom_initializers() -> list[CustomInitializer]:  # pyrit-async-suffix-exempt
+    """
+    List user-defined initializer source persisted in Central Memory.
+
+    Returns:
+        list[CustomInitializer]: Persisted custom initializer definitions.
+    """
+    service = get_initializer_service()
+    return list(await service.list_custom_initializers_async())
+
+
 @router.get(
     "/{initializer_name}",
     response_model=RegisteredInitializer,
diff --git a/pyrit/backend/services/initializer_service.py b/pyrit/backend/services/initializer_service.py
index 78f98f293a..440e99beab 100644
--- a/pyrit/backend/services/initializer_service.py
+++ b/pyrit/backend/services/initializer_service.py
@@ -25,7 +25,7 @@
     ListRegisteredInitializersResponse,
 )
 from pyrit.memory import CentralMemory
-from pyrit.models import AdditionalInitializer
+from pyrit.models import AdditionalInitializer, CustomInitializer
 from pyrit.models.catalog.initializer import RegisteredInitializer
 from pyrit.registry import InitializerMetadata, InitializerRegistry
 from pyrit.setup.pyrit_initializer import PyRITInitializer
@@ -298,13 +298,46 @@ async def register_initializer_async(
         Returns:
             RegisteredInitializer: The newly registered initializer summary.
         """
-        self._registry.register_from_content(name=name, script_content=script_content)
+        await asyncio.to_thread(
+            self._register_and_persist_initializer,
+            name=name,
+            script_content=script_content,
+        )
 
         initializer = await self.get_initializer_async(initializer_name=name)
         if not initializer:
             raise ValueError(f"Initializer '{name}' was registered but metadata could not be retrieved.")
         return initializer
 
+    async def list_custom_initializers_async(self) -> Sequence[CustomInitializer]:
+        """
+        List persisted custom initializer source definitions.
+
+        Returns:
+            Sequence[CustomInitializer]: Persisted custom initializer definitions.
+        """
+        return await asyncio.to_thread(self._memory.get_custom_initializers)
+
+    async def register_persisted_custom_initializers_async(self) -> None:
+        """Restore persisted custom initializer definitions into the runtime registry."""
+        custom_initializers = await asyncio.to_thread(self._memory.get_custom_initializers)
+        if not custom_initializers:
+            return
+
+        logger.info("Registering %d persisted custom initializer(s)...", len(custom_initializers))
+        for initializer in custom_initializers:
+            try:
+                await asyncio.to_thread(
+                    self._registry.register_from_content,
+                    name=initializer.initializer_name,
+                    script_content=initializer.script_content,
+                )
+            except Exception:
+                logger.exception(
+                    "Skipping persisted custom initializer '%s': registration failed.",
+                    initializer.initializer_name,
+                )
+
     async def unregister_initializer_async(self, *, initializer_name: str) -> None:
         """
         Remove a custom initializer from the registry.
@@ -312,9 +345,30 @@ async def unregister_initializer_async(self, *, initializer_name: str) -> None:
         Args:
             initializer_name: The registry name to remove.
         """
-        self._registry.unregister_and_cleanup(initializer_name)
+        additional_initializers = await asyncio.to_thread(self._memory.get_additional_initializers)
+        if any(initializer.initializer_name == initializer_name for initializer in additional_initializers):
+            raise ValueError(
+                f"Cannot remove initializer '{initializer_name}' while additional initializer settings reference it."
+            )
+
+        await asyncio.to_thread(self._registry.unregister_and_cleanup, initializer_name)
+        await asyncio.to_thread(
+            self._memory.delete_custom_initializer,
+            initializer_name=initializer_name,
+        )
         logger.info("Unregistered initializer: %s", initializer_name)
 
+    def _register_and_persist_initializer(self, *, name: str, script_content: str) -> None:
+        """Register custom source and persist it, rolling back runtime state on DB failure."""
+        self._registry.register_from_content(name=name, script_content=script_content)
+        try:
+            self._memory.add_custom_initializer(
+                initializer=CustomInitializer(initializer_name=name, script_content=script_content)
+            )
+        except Exception:
+            self._registry.unregister_and_cleanup(name)
+            raise
+
     def _build_and_run_initializer(
         self,
         *,
diff --git a/pyrit/memory/alembic/versions/6b7c8d9e0f1a_add_custom_initializers_table.py b/pyrit/memory/alembic/versions/6b7c8d9e0f1a_add_custom_initializers_table.py
new file mode 100644
index 0000000000..aa80597663
--- /dev/null
+++ b/pyrit/memory/alembic/versions/6b7c8d9e0f1a_add_custom_initializers_table.py
@@ -0,0 +1,39 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+"""
+Add persisted custom initializer source table.
+
+Revision ID: 6b7c8d9e0f1a
+Revises: 4c9a6e1f2b7d
+Create Date: 2026-08-24 14:30:00.000000
+"""
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "6b7c8d9e0f1a"
+down_revision: str | None = "4c9a6e1f2b7d"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    """Apply this schema upgrade."""
+    op.create_table(
+        "CustomInitializers",
+        sa.Column("initializer_name", sa.String(length=64), nullable=False),
+        sa.Column(
+            "script_content",
+            sa.UnicodeText().with_variant(sa.Text(), "sqlite"),
+            nullable=False,
+        ),
+        sa.PrimaryKeyConstraint("initializer_name"),
+    )
+
+
+def downgrade() -> None:
+    """Revert this schema upgrade."""
+    op.drop_table("CustomInitializers")
\ No newline at end of file
diff --git a/pyrit/memory/memory_interface.py b/pyrit/memory/memory_interface.py
index 4bbef89456..37b26a1c2d 100644
--- a/pyrit/memory/memory_interface.py
+++ b/pyrit/memory/memory_interface.py
@@ -34,6 +34,7 @@
     ComponentIdentifierEntry,
     ConversationEntry,
     ConverterIdentifierEntry,
+    CustomInitializerEntry,
     EmbeddingDataEntry,
     PromptConverterIdentifierEntry,
     PromptMemoryEntry,
@@ -63,6 +64,7 @@
     ConversationRetryReason,
     ConversationStats,
     ConverterIdentifier,
+    CustomInitializer,
     IdentifierFilter,
     IdentifierType,
     Message,
@@ -492,6 +494,41 @@ def delete_additional_initializer(self, *, initializer_id: str) -> None:
                 logger.exception(f"Error deleting additional initializer '{initializer_id}': {e}")
                 raise
 
+    def add_custom_initializer(self, *, initializer: CustomInitializer) -> None:
+        """Insert or replace custom initializer source, keyed by registry name."""
+        self._update_entry(CustomInitializerEntry.from_domain_model(initializer))
+
+    def get_custom_initializers(self) -> Sequence[CustomInitializer]:
+        """
+        Load persisted custom initializer definitions in registry-name order.
+
+        Returns:
+            Sequence[CustomInitializer]: Persisted custom initializer definitions.
+        """
+        entries = self._query_entries(
+            CustomInitializerEntry,
+            order_by=CustomInitializerEntry.initializer_name.asc(),
+        )
+        return [entry.to_domain_model() for entry in entries]
+
+    def delete_custom_initializer(self, *, initializer_name: str) -> None:
+        """
+        Delete persisted custom initializer source when it exists.
+
+        Raises:
+            SQLAlchemyError: If the delete operation fails.
+        """
+        with closing(self.get_session()) as session:
+            try:
+                session.query(CustomInitializerEntry).filter(
+                    CustomInitializerEntry.initializer_name == initializer_name
+                ).delete(synchronize_session=False)
+                session.commit()
+            except SQLAlchemyError as e:
+                session.rollback()
+                logger.exception(f"Error deleting custom initializer '{initializer_name}': {e}")
+                raise
+
     @abc.abstractmethod
     def _init_storage_io(self) -> None:
         """
diff --git a/pyrit/memory/memory_models.py b/pyrit/memory/memory_models.py
index 653abf8b48..4fe4ae83dc 100644
--- a/pyrit/memory/memory_models.py
+++ b/pyrit/memory/memory_models.py
@@ -21,8 +21,10 @@
     ForeignKey,
     Index,
     String,
+    Text,
     TypeDecorator,
     Unicode,
+    UnicodeText,
 )
 from sqlalchemy.dialects.sqlite import CHAR
 from sqlalchemy.orm import (
@@ -52,6 +54,7 @@
     ConversationRetry,
     ConversationType,
     ConverterIdentifier,
+    CustomInitializer,
     EvaluationIdentifier,
     MessagePiece,
     PromptDataType,
@@ -464,6 +467,44 @@ def to_domain_model(self) -> AdditionalInitializer:
         )
 
 
+class CustomInitializerEntry(DomainBackedEntry[CustomInitializer]):
+    """Persistence row for a ``CustomInitializer`` source definition."""
+
+    __tablename__ = "CustomInitializers"
+    __table_args__ = {"extend_existing": True}
+
+    initializer_name: Mapped[str] = mapped_column(String(64), primary_key=True)
+    script_content: Mapped[str] = mapped_column(
+        UnicodeText().with_variant(Text(), "sqlite"),
+        nullable=False,
+    )
+
+    @classmethod
+    def from_domain_model(cls, domain_model: CustomInitializer) -> Self:
+        """
+        Build an unsaved row from a custom initializer domain model.
+
+        Returns:
+            Self: The unsaved persistence row.
+        """
+        return cls(
+            initializer_name=domain_model.initializer_name,
+            script_content=domain_model.script_content,
+        )
+
+    def to_domain_model(self) -> CustomInitializer:
+        """
+        Convert this row back into its custom initializer domain model.
+
+        Returns:
+            CustomInitializer: The reconstructed custom initializer.
+        """
+        return CustomInitializer(
+            initializer_name=self.initializer_name,
+            script_content=self.script_content,
+        )
+
+
 T = TypeVar("T", bound=ComponentIdentifier)
 
 
diff --git a/pyrit/models/__init__.py b/pyrit/models/__init__.py
index 289187f44c..38cab68a0e 100644
--- a/pyrit/models/__init__.py
+++ b/pyrit/models/__init__.py
@@ -18,6 +18,7 @@
 
 from pyrit.models.additional_initializer import AdditionalInitializer
 from pyrit.models.conversation_stats import ConversationStats
+from pyrit.models.custom_initializer import CustomInitializer
 from pyrit.models.embeddings import EmbeddingData, EmbeddingResponse, EmbeddingSupport, EmbeddingUsageInformation
 from pyrit.models.harm_definition import HarmDefinition, ScaleDescription, get_all_harm_definitions
 from pyrit.models.identifiers import (
@@ -143,6 +144,7 @@
     "ComponentIdentifier",
     "ComponentType",
     "compute_eval_hash",
+    "CustomInitializer",
     "config_hash",
     "ConverterIdentifier",
     "Conversation",
diff --git a/pyrit/models/custom_initializer.py b/pyrit/models/custom_initializer.py
new file mode 100644
index 0000000000..2f3159c4b0
--- /dev/null
+++ b/pyrit/models/custom_initializer.py
@@ -0,0 +1,21 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+"""Persisted user-defined initializer source code."""
+
+from pydantic import BaseModel, Field, field_validator
+
+from pyrit.models.identifiers import validate_registry_name
+
+
+class CustomInitializer(BaseModel):
+    """A user-defined initializer that can be restored into the runtime registry."""
+
+    initializer_name: str = Field(..., description="Initializer registry name.")
+    script_content: str = Field(..., min_length=1, description="Python source defining a PyRITInitializer subclass.")
+
+    @field_validator("initializer_name")
+    @classmethod
+    def _validate_initializer_name(cls, value: str) -> str:
+        validate_registry_name(value)
+        return value
diff --git a/tests/unit/backend/test_initializer_service.py b/tests/unit/backend/test_initializer_service.py
index 5e9332c216..4a8b137daf 100644
--- a/tests/unit/backend/test_initializer_service.py
+++ b/tests/unit/backend/test_initializer_service.py
@@ -22,7 +22,7 @@
     RegisteredInitializer,
 )
 from pyrit.backend.services.initializer_service import InitializerService, get_initializer_service
-from pyrit.models import AdditionalInitializer, Parameter
+from pyrit.models import AdditionalInitializer, CustomInitializer, Parameter
 from pyrit.registry import InitializerMetadata
 
 
@@ -850,10 +850,14 @@ async def test_register_initializer_calls_registry(self) -> None:
                 _make_initializer_metadata(registry_name="my_custom", class_name="MyCustomInitializer")
             ]
             service._registry = mock_registry
+            service._memory = MagicMock()
 
             result = await service.register_initializer_async(name="my_custom", script_content=_SAMPLE_SCRIPT)
 
             mock_registry.register_from_content.assert_called_once_with(name="my_custom", script_content=_SAMPLE_SCRIPT)
+            service._memory.add_custom_initializer.assert_called_once_with(
+                initializer=CustomInitializer(initializer_name="my_custom", script_content=_SAMPLE_SCRIPT)
+            )
             assert result.initializer_name == "my_custom"
 
     async def test_register_initializer_propagates_value_error(self) -> None:
@@ -862,10 +866,63 @@ async def test_register_initializer_propagates_value_error(self) -> None:
             mock_registry = MagicMock()
             mock_registry.register_from_content.side_effect = ValueError("no classes found")
             service._registry = mock_registry
+            service._memory = MagicMock()
 
             with pytest.raises(ValueError):
                 await service.register_initializer_async(name="bad", script_content="x = 1")
 
+    async def test_register_initializer_rolls_back_registry_when_persistence_fails(self) -> None:
+        with patch.object(InitializerService, "__init__", lambda self: None):
+            service = InitializerService()
+            service._registry = MagicMock()
+            service._memory = MagicMock()
+            service._memory.add_custom_initializer.side_effect = RuntimeError("database unavailable")
+
+            with pytest.raises(RuntimeError, match="database unavailable"):
+                await service.register_initializer_async(name="my_custom", script_content=_SAMPLE_SCRIPT)
+
+            service._registry.unregister_and_cleanup.assert_called_once_with("my_custom")
+
+    async def test_list_custom_initializers_returns_persisted_sources(self) -> None:
+        custom = CustomInitializer(initializer_name="my_custom", script_content=_SAMPLE_SCRIPT)
+        with patch.object(InitializerService, "__init__", lambda self: None):
+            service = InitializerService()
+            service._memory = MagicMock()
+            service._memory.get_custom_initializers.return_value = [custom]
+
+            result = await service.list_custom_initializers_async()
+
+            assert result == [custom]
+
+    async def test_register_persisted_custom_initializers_restores_all_sources(self) -> None:
+        first = CustomInitializer(initializer_name="first", script_content="first source")
+        second = CustomInitializer(initializer_name="second", script_content="second source")
+        with patch.object(InitializerService, "__init__", lambda self: None):
+            service = InitializerService()
+            service._registry = MagicMock()
+            service._memory = MagicMock()
+            service._memory.get_custom_initializers.return_value = [first, second]
+
+            await service.register_persisted_custom_initializers_async()
+
+            calls = service._registry.register_from_content.call_args_list
+            assert calls[0].kwargs == {"name": "first", "script_content": "first source"}
+            assert calls[1].kwargs == {"name": "second", "script_content": "second source"}
+
+    async def test_register_persisted_custom_initializers_isolates_failures(self) -> None:
+        first = CustomInitializer(initializer_name="first", script_content="bad source")
+        second = CustomInitializer(initializer_name="second", script_content="good source")
+        with patch.object(InitializerService, "__init__", lambda self: None):
+            service = InitializerService()
+            service._registry = MagicMock()
+            service._registry.register_from_content.side_effect = [ValueError("bad source"), "second"]
+            service._memory = MagicMock()
+            service._memory.get_custom_initializers.return_value = [first, second]
+
+            await service.register_persisted_custom_initializers_async()
+
+            assert service._registry.register_from_content.call_count == 2
+
 
 class TestInitializerServiceUnregister:
     """Tests for InitializerService.unregister_initializer_async."""
@@ -875,10 +932,12 @@ async def test_unregister_initializer_calls_registry(self) -> None:
             service = InitializerService()
             mock_registry = MagicMock()
             service._registry = mock_registry
+            service._memory = MagicMock()
 
             await service.unregister_initializer_async(initializer_name="target")
 
             mock_registry.unregister_and_cleanup.assert_called_once_with("target")
+            service._memory.delete_custom_initializer.assert_called_once_with(initializer_name="target")
 
     async def test_unregister_initializer_propagates_key_error(self) -> None:
         with patch.object(InitializerService, "__init__", lambda self: None):
@@ -886,6 +945,7 @@ async def test_unregister_initializer_propagates_key_error(self) -> None:
             mock_registry = MagicMock()
             mock_registry.unregister_and_cleanup.side_effect = KeyError("not found")
             service._registry = mock_registry
+            service._memory = MagicMock()
 
             with pytest.raises(KeyError):
                 await service.unregister_initializer_async(initializer_name="nonexistent")
@@ -896,10 +956,26 @@ async def test_unregister_initializer_propagates_value_error_for_builtin(self) -
             mock_registry = MagicMock()
             mock_registry.unregister_and_cleanup.side_effect = ValueError("Cannot remove built-in")
             service._registry = mock_registry
+            service._memory = MagicMock()
 
             with pytest.raises(ValueError, match="Cannot remove built-in"):
                 await service.unregister_initializer_async(initializer_name="simple")
 
+    async def test_unregister_initializer_rejects_additional_initializer_reference(self) -> None:
+        with patch.object(InitializerService, "__init__", lambda self: None):
+            service = InitializerService()
+            service._registry = MagicMock()
+            service._memory = MagicMock()
+            service._memory.get_additional_initializers.return_value = [
+                AdditionalInitializer(initializer_name="custom", order_index=0)
+            ]
+
+            with pytest.raises(ValueError, match="additional initializer settings reference it"):
+                await service.unregister_initializer_async(initializer_name="custom")
+
+            service._registry.unregister_and_cleanup.assert_not_called()
+            service._memory.delete_custom_initializer.assert_not_called()
+
 
 # ============================================================================
 # POST / DELETE Route Tests
@@ -909,6 +985,18 @@ async def test_unregister_initializer_propagates_value_error_for_builtin(self) -
 class TestRegisterInitializerRoute:
     """Tests for POST /api/initializers route."""
 
+    def test_get_custom_initializers_returns_persisted_sources(self, client: TestClient) -> None:
+        custom = CustomInitializer(initializer_name="my_custom", script_content=_SAMPLE_SCRIPT)
+        with patch("pyrit.backend.routes.initializers.get_initializer_service") as mock_get_service:
+            mock_service = MagicMock()
+            mock_service.list_custom_initializers_async = AsyncMock(return_value=[custom])
+            mock_get_service.return_value = mock_service
+
+            response = client.get("/api/initializers/custom")
+
+            assert response.status_code == status.HTTP_200_OK
+            assert response.json() == [custom.model_dump()]
+
     def test_post_returns_403_when_custom_initializers_disabled(self, client: TestClient) -> None:
         app.state.allow_custom_initializers = False
         response = client.post("/api/initializers", json={"name": "test", "script_content": _SAMPLE_SCRIPT})
@@ -1033,3 +1121,20 @@ def test_delete_returns_400_for_builtin_initializer(
 
             assert response.status_code == status.HTTP_400_BAD_REQUEST
             assert "built-in" in response.json()["detail"].lower()
+
+    def test_delete_returns_400_when_additional_initializer_references_name(
+        self, client_with_custom_initializers_enabled: TestClient
+    ) -> None:
+        with patch("pyrit.backend.routes.initializers.get_initializer_service") as mock_get_service:
+            mock_service = MagicMock()
+            mock_service.unregister_initializer_async = AsyncMock(
+                side_effect=ValueError(
+                    "Cannot remove initializer 'custom' while additional initializer settings reference it."
+                )
+            )
+            mock_get_service.return_value = mock_service
+
+            response = client_with_custom_initializers_enabled.delete("/api/initializers/custom")
+
+            assert response.status_code == status.HTTP_400_BAD_REQUEST
+            assert "additional initializer settings reference it" in response.json()["detail"]
diff --git a/tests/unit/backend/test_main.py b/tests/unit/backend/test_main.py
index 19e1471e2a..27b68b39e0 100644
--- a/tests/unit/backend/test_main.py
+++ b/tests/unit/backend/test_main.py
@@ -32,7 +32,10 @@ async def test_lifespan_yields(self) -> None:
             patch.object(ConfigurationLoader, "initialize_pyrit_async", new=AsyncMock()) as init_mock,
             patch(
                 "pyrit.backend.main.get_initializer_service",
-                return_value=MagicMock(run_additional_initializers_async=AsyncMock()),
+                return_value=MagicMock(
+                    register_persisted_custom_initializers_async=AsyncMock(),
+                    run_additional_initializers_async=AsyncMock(),
+                ),
             ),
             patch("pyrit.backend.main.setup_frontend"),
         ):
@@ -44,6 +47,31 @@ async def test_lifespan_yields(self) -> None:
             assert app.state.max_concurrent_scenario_runs == fake_config.max_concurrent_scenario_runs
             assert app.state.allow_custom_initializers is False
 
+    async def test_lifespan_registers_custom_initializers_before_running_additional(self) -> None:
+        fake_config = ConfigurationLoader()
+        call_order: list[str] = []
+
+        async def register_custom_async() -> None:
+            call_order.append("custom")
+
+        async def run_additional_async() -> None:
+            call_order.append("additional")
+
+        service = MagicMock(
+            register_persisted_custom_initializers_async=AsyncMock(side_effect=register_custom_async),
+            run_additional_initializers_async=AsyncMock(side_effect=run_additional_async),
+        )
+        with (
+            patch.object(ConfigurationLoader, "load_with_overrides", return_value=fake_config),
+            patch.object(ConfigurationLoader, "initialize_pyrit_async", new=AsyncMock()),
+            patch("pyrit.backend.main.get_initializer_service", return_value=service),
+            patch("pyrit.backend.main.setup_frontend"),
+        ):
+            async with lifespan(app):
+                pass
+
+        assert call_order == ["custom", "additional"]
+
     async def test_lifespan_warns_when_custom_initializers_allowed(self) -> None:
         """Test that lifespan logs a warning when allow_custom_initializers is enabled."""
         fake_config = ConfigurationLoader(allow_custom_initializers=True)
@@ -52,7 +80,10 @@ async def test_lifespan_warns_when_custom_initializers_allowed(self) -> None:
             patch.object(ConfigurationLoader, "initialize_pyrit_async", new=AsyncMock()),
             patch(
                 "pyrit.backend.main.get_initializer_service",
-                return_value=MagicMock(run_additional_initializers_async=AsyncMock()),
+                return_value=MagicMock(
+                    register_persisted_custom_initializers_async=AsyncMock(),
+                    run_additional_initializers_async=AsyncMock(),
+                ),
             ),
             patch("pyrit.backend.main.setup_frontend"),
             patch.object(logging.getLogger("pyrit.backend.main"), "warning") as mock_warning,
@@ -70,7 +101,10 @@ async def test_lifespan_populates_default_labels_from_operator_and_operation(sel
             patch.object(ConfigurationLoader, "initialize_pyrit_async", new=AsyncMock()),
             patch(
                 "pyrit.backend.main.get_initializer_service",
-                return_value=MagicMock(run_additional_initializers_async=AsyncMock()),
+                return_value=MagicMock(
+                    register_persisted_custom_initializers_async=AsyncMock(),
+                    run_additional_initializers_async=AsyncMock(),
+                ),
             ),
             patch("pyrit.backend.main.setup_frontend"),
         ):
@@ -88,7 +122,10 @@ async def test_lifespan_reads_config_file_env_var(self) -> None:
             patch.object(ConfigurationLoader, "initialize_pyrit_async", new=AsyncMock()),
             patch(
                 "pyrit.backend.main.get_initializer_service",
-                return_value=MagicMock(run_additional_initializers_async=AsyncMock()),
+                return_value=MagicMock(
+                    register_persisted_custom_initializers_async=AsyncMock(),
+                    run_additional_initializers_async=AsyncMock(),
+                ),
             ),
             patch("pyrit.backend.main.setup_frontend"),
         ):
diff --git a/tests/unit/memory/test_custom_initializer_memory.py b/tests/unit/memory/test_custom_initializer_memory.py
new file mode 100644
index 0000000000..278434cfcf
--- /dev/null
+++ b/tests/unit/memory/test_custom_initializer_memory.py
@@ -0,0 +1,42 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+import pytest
+
+from pyrit.memory.memory_models import CustomInitializerEntry
+from pyrit.models import CustomInitializer
+
+
+@pytest.mark.usefixtures("patch_central_database")
+class TestCustomInitializerMemory:
+    def test_custom_initializer_round_trips_real_domain_model(self, sqlite_instance) -> None:
+        initializer = CustomInitializer(
+            initializer_name="custom_target",
+            script_content="class CustomTargetInitializer: pass",
+        )
+
+        sqlite_instance.add_custom_initializer(initializer=initializer)
+
+        entries = sqlite_instance._query_entries(CustomInitializerEntry)
+        assert len(entries) == 1
+        assert entries[0].to_domain_model() == initializer
+        assert sqlite_instance.get_custom_initializers() == [initializer]
+
+    def test_add_custom_initializer_upserts_by_name(self, sqlite_instance) -> None:
+        sqlite_instance.add_custom_initializer(
+            initializer=CustomInitializer(initializer_name="custom_target", script_content="old")
+        )
+        updated = CustomInitializer(initializer_name="custom_target", script_content="new")
+
+        sqlite_instance.add_custom_initializer(initializer=updated)
+
+        assert sqlite_instance.get_custom_initializers() == [updated]
+
+    def test_delete_custom_initializer_is_idempotent(self, sqlite_instance) -> None:
+        initializer = CustomInitializer(initializer_name="custom_target", script_content="source")
+        sqlite_instance.add_custom_initializer(initializer=initializer)
+
+        sqlite_instance.delete_custom_initializer(initializer_name="custom_target")
+        sqlite_instance.delete_custom_initializer(initializer_name="custom_target")
+
+        assert sqlite_instance.get_custom_initializers() == []

From a81a162f1bbf118eead4d14e37616d3050ab59ed Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Tue, 25 Aug 2026 12:29:07 -0700
Subject: [PATCH 02/24] FIX add missing final newlines

---
 .../src/components/Initializers/CustomInitializers.styles.ts    | 2 +-
 frontend/src/components/Initializers/CustomInitializers.tsx     | 2 +-
 frontend/src/components/Initializers/PythonCode.styles.ts       | 2 +-
 frontend/src/components/Initializers/PythonCode.tsx             | 2 +-
 .../versions/6b7c8d9e0f1a_add_custom_initializers_table.py      | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/frontend/src/components/Initializers/CustomInitializers.styles.ts b/frontend/src/components/Initializers/CustomInitializers.styles.ts
index 65b79bb86b..334f74db07 100644
--- a/frontend/src/components/Initializers/CustomInitializers.styles.ts
+++ b/frontend/src/components/Initializers/CustomInitializers.styles.ts
@@ -48,4 +48,4 @@ export const useCustomInitializersStyles = makeStyles({
     padding: tokens.spacingVerticalXL,
     color: tokens.colorNeutralForeground3,
   },
-})
\ No newline at end of file
+})
diff --git a/frontend/src/components/Initializers/CustomInitializers.tsx b/frontend/src/components/Initializers/CustomInitializers.tsx
index 02ae091d3f..fc697d50a2 100644
--- a/frontend/src/components/Initializers/CustomInitializers.tsx
+++ b/frontend/src/components/Initializers/CustomInitializers.tsx
@@ -174,4 +174,4 @@ export default function CustomInitializers({
       </Dialog>
     </section>
   )
-}
\ No newline at end of file
+}
diff --git a/frontend/src/components/Initializers/PythonCode.styles.ts b/frontend/src/components/Initializers/PythonCode.styles.ts
index f88451c321..92004ba2b0 100644
--- a/frontend/src/components/Initializers/PythonCode.styles.ts
+++ b/frontend/src/components/Initializers/PythonCode.styles.ts
@@ -92,4 +92,4 @@ export const usePythonCodeStyles = makeStyles({
       backgroundColor: tokens.colorBrandBackground2,
     },
   },
-})
\ No newline at end of file
+})
diff --git a/frontend/src/components/Initializers/PythonCode.tsx b/frontend/src/components/Initializers/PythonCode.tsx
index 2e7dcc89df..c2e3201646 100644
--- a/frontend/src/components/Initializers/PythonCode.tsx
+++ b/frontend/src/components/Initializers/PythonCode.tsx
@@ -97,4 +97,4 @@ export function PythonCodeEditor({ source, disabled, onChange }: PythonCodeEdito
       </div>
     </div>
   )
-}
\ No newline at end of file
+}
diff --git a/pyrit/memory/alembic/versions/6b7c8d9e0f1a_add_custom_initializers_table.py b/pyrit/memory/alembic/versions/6b7c8d9e0f1a_add_custom_initializers_table.py
index aa80597663..a212bc5ac4 100644
--- a/pyrit/memory/alembic/versions/6b7c8d9e0f1a_add_custom_initializers_table.py
+++ b/pyrit/memory/alembic/versions/6b7c8d9e0f1a_add_custom_initializers_table.py
@@ -36,4 +36,4 @@ def upgrade() -> None:
 
 def downgrade() -> None:
     """Revert this schema upgrade."""
-    op.drop_table("CustomInitializers")
\ No newline at end of file
+    op.drop_table("CustomInitializers")

From ed16aae76c3d6dff4d5af6266644a6cb6e423a48 Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Tue, 25 Aug 2026 12:37:28 -0700
Subject: [PATCH 03/24] package-lock

---
 frontend/package-lock.json | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 58c1cf62c6..828db28311 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -13,6 +13,7 @@
         "@fluentui/react-components": "9.74.6",
         "@fluentui/react-icons": "2.0.335",
         "axios": "1.19.0",
+        "prismjs": "^1.30.0",
         "react": "19.2.8",
         "react-dom": "19.2.8",
         "react-error-boundary": "6.1.2",
@@ -30,6 +31,7 @@
         "@testing-library/user-event": "14.6.4",
         "@types/jest": "30.0.0",
         "@types/node": "26.2.0",
+        "@types/prismjs": "^1.26.6",
         "@types/react": "19.2.18",
         "@types/react-dom": "19.2.4",
         "@typescript-eslint/eslint-plugin": "8.67.0",
@@ -4365,6 +4367,13 @@
         "undici-types": "~8.3.0"
       }
     },
+    "node_modules/@types/prismjs": {
+      "version": "1.26.6",
+      "resolved": "https://registry.npmjs.org/@types/prismjs/-/prismjs-1.26.6.tgz",
+      "integrity": "sha1-bqJ8Em1kUxmuT3BV7aY6noNcAYc=",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/react": {
       "version": "19.2.18",
       "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.18.tgz",
@@ -10158,6 +10167,15 @@
         "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
+    "node_modules/prismjs": {
+      "version": "1.30.0",
+      "resolved": "https://registry.npmjs.org/prismjs/-/prismjs-1.30.0.tgz",
+      "integrity": "sha1-2XCZadnU4WQD9vNIxjVTsZ8Jdak=",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/property-information": {
       "version": "7.2.0",
       "resolved": "https://registry.npmjs.org/property-information/-/property-information-7.2.0.tgz",

From 262ce8b66c958bb48ea7db5ef691a5d8761518c4 Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Tue, 25 Aug 2026 15:25:51 -0700
Subject: [PATCH 04/24] reuse dialog

---
 .../Initializers/CustomInitializers.test.tsx  | 51 +++++++++++++++++++
 .../Initializers/CustomInitializers.tsx       | 21 +++++++-
 2 files changed, 71 insertions(+), 1 deletion(-)
 create mode 100644 frontend/src/components/Initializers/CustomInitializers.test.tsx

diff --git a/frontend/src/components/Initializers/CustomInitializers.test.tsx b/frontend/src/components/Initializers/CustomInitializers.test.tsx
new file mode 100644
index 0000000000..117664a1b5
--- /dev/null
+++ b/frontend/src/components/Initializers/CustomInitializers.test.tsx
@@ -0,0 +1,51 @@
+import { render, screen, within } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { FluentProvider, webLightTheme } from '@fluentui/react-components'
+
+import type { CustomInitializer } from '@/types'
+
+import CustomInitializers from './CustomInitializers'
+
+const TestWrapper: React.FC<{ children: React.ReactNode }> = ({ children }) => (
+  <FluentProvider theme={webLightTheme}>{children}</FluentProvider>
+)
+
+const ITEMS: CustomInitializer[] = [
+  {
+    initializer_name: 'custom_target',
+    script_content: 'def initialize():\n    pass',
+  },
+]
+
+describe('CustomInitializers', () => {
+  const defaultProps = {
+    items: ITEMS,
+    registering: false,
+    deletingName: null,
+    onRegister: jest.fn(),
+    onDelete: jest.fn(),
+  }
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+  })
+
+  it('should require confirmation before deleting stored source', async () => {
+    const user = userEvent.setup()
+
+    render(
+      <TestWrapper>
+        <CustomInitializers {...defaultProps} />
+      </TestWrapper>,
+    )
+
+    await user.click(screen.getByRole('button', { name: 'Remove' }))
+
+    expect(defaultProps.onDelete).not.toHaveBeenCalled()
+    const dialog = screen.getByRole('dialog', { name: 'Remove custom initializer' })
+
+    await user.click(within(dialog).getByRole('button', { name: 'Remove' }))
+
+    expect(defaultProps.onDelete).toHaveBeenCalledWith('custom_target')
+  })
+})
\ No newline at end of file
diff --git a/frontend/src/components/Initializers/CustomInitializers.tsx b/frontend/src/components/Initializers/CustomInitializers.tsx
index fc697d50a2..4144152c9e 100644
--- a/frontend/src/components/Initializers/CustomInitializers.tsx
+++ b/frontend/src/components/Initializers/CustomInitializers.tsx
@@ -21,6 +21,7 @@ import {
 } from '@fluentui/react-components'
 import { AddRegular, DeleteRegular, EyeRegular } from '@fluentui/react-icons'
 
+import ConfirmDialog from '@/components/ConfirmDialog'
 import type { CustomInitializer } from '@/types'
 
 import { useCustomInitializersStyles } from './CustomInitializers.styles'
@@ -46,6 +47,7 @@ export default function CustomInitializers({
   const [name, setName] = useState('')
   const [scriptContent, setScriptContent] = useState('')
   const [viewingInitializer, setViewingInitializer] = useState<CustomInitializer | null>(null)
+  const [initializerToDelete, setInitializerToDelete] = useState<CustomInitializer | null>(null)
 
   const handleSubmit = async (event: React.FormEvent<HTMLFormElement>): Promise<void> => {
     event.preventDefault()
@@ -139,7 +141,7 @@ export default function CustomInitializers({
                       disabled={deletingName !== null}
                       onClick={(event) => {
                         event.stopPropagation()
-                        void onDelete(item.initializer_name)
+                        setInitializerToDelete(item)
                       }}
                     >
                       {deletingName === item.initializer_name ? 'Removing...' : 'Remove'}
@@ -152,6 +154,23 @@ export default function CustomInitializers({
         </div>
       )}
 
+      <ConfirmDialog
+        open={initializerToDelete !== null}
+        title="Remove custom initializer"
+        confirmLabel="Remove"
+        onConfirm={() => {
+          const initializerName = initializerToDelete?.initializer_name
+          setInitializerToDelete(null)
+          if (initializerName) {
+            void onDelete(initializerName)
+          }
+        }}
+        onCancel={() => setInitializerToDelete(null)}
+      >
+        Are you sure you want to remove the <Text weight="semibold">{initializerToDelete?.initializer_name}</Text>{' '}
+        custom initializer? Its stored Python source will be permanently deleted.
+      </ConfirmDialog>
+
       <Dialog
         open={viewingInitializer !== null}
         onOpenChange={(_, data) => {

From d75e825d0f65e52ce76c2d918503664141f074d1 Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Tue, 25 Aug 2026 15:27:04 -0700
Subject: [PATCH 05/24] respect custom initializer flag on startup

---
 pyrit/backend/main.py                         |  7 +++--
 pyrit/backend/services/initializer_service.py | 12 ++++++++-
 .../unit/backend/test_initializer_service.py  | 27 ++++++++++++++++---
 tests/unit/backend/test_main.py               | 19 ++++++-------
 4 files changed, 50 insertions(+), 15 deletions(-)

diff --git a/pyrit/backend/main.py b/pyrit/backend/main.py
index e0ba97f9b6..5e18523ca0 100644
--- a/pyrit/backend/main.py
+++ b/pyrit/backend/main.py
@@ -70,8 +70,11 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
         for order_index, initializer in enumerate(config.initializer_configs)
     ]
     initializer_service = get_initializer_service()
-    await initializer_service.register_persisted_custom_initializers_async()
-    await initializer_service.run_additional_initializers_async()
+    if config.allow_custom_initializers:
+        await initializer_service.register_persisted_custom_initializers_async()
+    await initializer_service.run_additional_initializers_async(
+        allow_custom_initializers=config.allow_custom_initializers
+    )
 
     # Expose config values to route handlers via app.state
     default_labels: dict[str, str] = {}
diff --git a/pyrit/backend/services/initializer_service.py b/pyrit/backend/services/initializer_service.py
index 440e99beab..a2f5e1d764 100644
--- a/pyrit/backend/services/initializer_service.py
+++ b/pyrit/backend/services/initializer_service.py
@@ -251,12 +251,16 @@ async def apply_initializer_async(
             applied_parameters=parameters,
         )
 
-    async def run_additional_initializers_async(self) -> None:
+    async def run_additional_initializers_async(self, *, allow_custom_initializers: bool) -> None:
         """
         Run all persisted additional initializers in stored order, after the baseline.
 
         Intended for the backend startup lifespan: the ``.pyrit_conf`` baseline runs first via
         the configuration loader, then this appends the user's additional initializers.
+        When custom initializers are disabled, only built-in initializers are run.
+
+        Args:
+            allow_custom_initializers: Whether persisted custom initializers may run.
 
         Failures are isolated per initializer: a persisted row that fails to build, validate, or
         initialize (e.g. a missing required environment variable) is logged and skipped so one bad
@@ -269,6 +273,12 @@ async def run_additional_initializers_async(self) -> None:
 
         logger.info("Running %d additional initializer(s)...", len(initializers))
         for initializer in initializers:
+            if not allow_custom_initializers and not self._registry.is_builtin(initializer.initializer_name):
+                logger.info(
+                    "Skipping custom additional initializer '%s' because custom initializers are disabled.",
+                    initializer.initializer_name,
+                )
+                continue
             try:
                 await asyncio.to_thread(
                     self._build_and_run_initializer,
diff --git a/tests/unit/backend/test_initializer_service.py b/tests/unit/backend/test_initializer_service.py
index 4a8b137daf..7a91958288 100644
--- a/tests/unit/backend/test_initializer_service.py
+++ b/tests/unit/backend/test_initializer_service.py
@@ -481,7 +481,7 @@ async def test_run_additional_initializers_runs_each_in_order(self) -> None:
                 AdditionalInitializer(id="a2", initializer_name="widget", order_index=1),
             ]
 
-            await service.run_additional_initializers_async()
+            await service.run_additional_initializers_async(allow_custom_initializers=True)
 
             assert service._registry.create_and_configure.call_args_list[0].args == ("target",)
             assert service._registry.create_and_configure.call_args_list[0].kwargs == {
@@ -498,10 +498,31 @@ async def test_run_additional_initializers_no_op_when_empty(self) -> None:
             service._memory = MagicMock()
             service._memory.get_additional_initializers.return_value = []
 
-            await service.run_additional_initializers_async()
+            await service.run_additional_initializers_async(allow_custom_initializers=True)
 
             service._registry.create_and_configure.assert_not_called()
 
+    async def test_run_additional_initializers_skips_custom_when_disabled(self) -> None:
+        builtin = MagicMock()
+        builtin.validate = MagicMock()
+        builtin.initialize_async = AsyncMock(return_value=None)
+
+        with patch.object(InitializerService, "__init__", lambda self: None):
+            service = InitializerService()
+            service._registry = MagicMock()
+            service._registry.is_builtin.side_effect = lambda name: name == "builtin"
+            service._registry.create_and_configure.return_value = builtin
+            service._memory = MagicMock()
+            service._memory.get_additional_initializers.return_value = [
+                AdditionalInitializer(id="a1", initializer_name="builtin", order_index=0),
+                AdditionalInitializer(id="a2", initializer_name="custom", order_index=1),
+            ]
+
+            await service.run_additional_initializers_async(allow_custom_initializers=False)
+
+            service._registry.create_and_configure.assert_called_once_with("builtin", initializer_params=None)
+            builtin.initialize_async.assert_awaited_once()
+
     async def test_run_additional_initializers_isolates_failures(self) -> None:
         failing = MagicMock()
         failing.supported_parameters = []
@@ -521,7 +542,7 @@ async def test_run_additional_initializers_isolates_failures(self) -> None:
                 AdditionalInitializer(id="good", initializer_name="widget", order_index=1),
             ]
 
-            await service.run_additional_initializers_async()
+            await service.run_additional_initializers_async(allow_custom_initializers=True)
 
             failing.initialize_async.assert_not_called()
             healthy.initialize_async.assert_awaited_once()
diff --git a/tests/unit/backend/test_main.py b/tests/unit/backend/test_main.py
index 27b68b39e0..6e44277002 100644
--- a/tests/unit/backend/test_main.py
+++ b/tests/unit/backend/test_main.py
@@ -27,16 +27,14 @@ class TestLifespan:
     async def test_lifespan_yields(self) -> None:
         """Test that lifespan delegates to ConfigurationLoader and yields."""
         fake_config = ConfigurationLoader()
+        service = MagicMock(
+            register_persisted_custom_initializers_async=AsyncMock(),
+            run_additional_initializers_async=AsyncMock(),
+        )
         with (
             patch.object(ConfigurationLoader, "load_with_overrides", return_value=fake_config),
             patch.object(ConfigurationLoader, "initialize_pyrit_async", new=AsyncMock()) as init_mock,
-            patch(
-                "pyrit.backend.main.get_initializer_service",
-                return_value=MagicMock(
-                    register_persisted_custom_initializers_async=AsyncMock(),
-                    run_additional_initializers_async=AsyncMock(),
-                ),
-            ),
+            patch("pyrit.backend.main.get_initializer_service", return_value=service),
             patch("pyrit.backend.main.setup_frontend"),
         ):
             async with lifespan(app):
@@ -46,15 +44,18 @@ async def test_lifespan_yields(self) -> None:
             assert app.state.default_labels == {}
             assert app.state.max_concurrent_scenario_runs == fake_config.max_concurrent_scenario_runs
             assert app.state.allow_custom_initializers is False
+            service.register_persisted_custom_initializers_async.assert_not_awaited()
+            service.run_additional_initializers_async.assert_awaited_once_with(allow_custom_initializers=False)
 
     async def test_lifespan_registers_custom_initializers_before_running_additional(self) -> None:
-        fake_config = ConfigurationLoader()
+        fake_config = ConfigurationLoader(allow_custom_initializers=True)
         call_order: list[str] = []
 
         async def register_custom_async() -> None:
             call_order.append("custom")
 
-        async def run_additional_async() -> None:
+        async def run_additional_async(*, allow_custom_initializers: bool) -> None:
+            assert allow_custom_initializers is True
             call_order.append("additional")
 
         service = MagicMock(

From 0d43a56b634cc01839ae67875e59e83d6a7e4f01 Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Wed, 26 Aug 2026 13:09:35 -0700
Subject: [PATCH 06/24] GUI config

---
 .pyrit_conf_example                           |  15 +-
 doc/getting_started/pyrit_conf.md             |  13 +-
 frontend/src/App.tsx                          |   3 +
 .../BackendConfiguration.styles.ts            | 150 +++++++++++
 .../BackendConfiguration.test.tsx             | 225 ++++++++++++++++
 .../BackendConfiguration.tsx                  | 179 +++++++++++++
 .../CustomInitializerFiles.tsx                | 126 +++++++++
 .../BackendConfiguration/DotenvEditor.tsx     |  76 ++++++
 .../BackendConfiguration/EnvironmentFiles.tsx | 204 ++++++++++++++
 .../PythonCode.styles.ts                      |  18 +-
 .../PythonCode.tsx                            |  48 +---
 .../BackendConfiguration/YamlEditor.tsx       |  56 ++++
 frontend/src/components/CodeEditorFrame.tsx   |  63 +++++
 frontend/src/components/EditorWorkspace.tsx   | 155 +++++++++++
 .../Initializers/CustomInitializers.styles.ts |  40 +--
 .../Initializers/CustomInitializers.test.tsx  |  59 ++++
 .../Initializers/CustomInitializers.tsx       | 251 +++++++++---------
 .../Initializers/Initializers.test.tsx        |  59 ----
 .../components/Initializers/Initializers.tsx  | 135 ++--------
 .../components/Sidebar/Navigation.test.tsx    |  11 +
 .../src/components/Sidebar/Navigation.tsx     |  14 +-
 frontend/src/services/api.test.ts             |  69 +++++
 frontend/src/services/api.ts                  |  47 +++-
 frontend/src/types/index.ts                   |  31 +++
 pyrit/backend/main.py                         |  25 +-
 pyrit/backend/models/configuration.py         |  41 +++
 pyrit/backend/models/initializers.py          |  27 ++
 pyrit/backend/pyrit_backend.py                |  15 +-
 pyrit/backend/routes/configuration.py         | 163 ++++++++++++
 pyrit/backend/routes/initializers.py          |  56 +++-
 .../services/configuration_file_service.py    | 180 +++++++++++++
 .../services/environment_file_service.py      | 241 +++++++++++++++++
 pyrit/backend/services/initializer_service.py | 129 ++++++---
 ...c8d9e0f1a_add_custom_initializers_table.py |  39 ---
 pyrit/memory/memory_interface.py              |  37 ---
 pyrit/memory/memory_models.py                 |  41 ---
 pyrit/models/__init__.py                      |   2 -
 pyrit/models/custom_initializer.py            |  21 --
 .../components/initializer_registry.py        | 187 ++++++++++---
 pyrit/registry/custom_initializer_storage.py  | 225 ++++++++++++++++
 pyrit/setup/configuration_loader.py           |  27 +-
 pyrit/setup/initialization.py                 |  86 +++++-
 .../test_configuration_file_service.py        |  84 ++++++
 .../unit/backend/test_configuration_routes.py | 125 +++++++++
 .../backend/test_environment_file_service.py  | 117 ++++++++
 .../unit/backend/test_initializer_service.py  | 189 ++++++++++---
 tests/unit/backend/test_main.py               |  72 ++++-
 tests/unit/backend/test_pyrit_backend.py      |  20 +-
 .../memory/test_custom_initializer_memory.py  |  42 ---
 .../test_custom_initializer_storage.py        | 150 +++++++++++
 .../registry/test_initializer_registry.py     |  99 +++++++
 tests/unit/setup/test_configuration_loader.py |  26 ++
 tests/unit/setup/test_initialization.py       |  78 ++++++
 53 files changed, 3877 insertions(+), 714 deletions(-)
 create mode 100644 frontend/src/components/BackendConfiguration/BackendConfiguration.styles.ts
 create mode 100644 frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx
 create mode 100644 frontend/src/components/BackendConfiguration/BackendConfiguration.tsx
 create mode 100644 frontend/src/components/BackendConfiguration/CustomInitializerFiles.tsx
 create mode 100644 frontend/src/components/BackendConfiguration/DotenvEditor.tsx
 create mode 100644 frontend/src/components/BackendConfiguration/EnvironmentFiles.tsx
 rename frontend/src/components/{Initializers => BackendConfiguration}/PythonCode.styles.ts (82%)
 rename frontend/src/components/{Initializers => BackendConfiguration}/PythonCode.tsx (61%)
 create mode 100644 frontend/src/components/BackendConfiguration/YamlEditor.tsx
 create mode 100644 frontend/src/components/CodeEditorFrame.tsx
 create mode 100644 frontend/src/components/EditorWorkspace.tsx
 create mode 100644 pyrit/backend/models/configuration.py
 create mode 100644 pyrit/backend/routes/configuration.py
 create mode 100644 pyrit/backend/services/configuration_file_service.py
 create mode 100644 pyrit/backend/services/environment_file_service.py
 delete mode 100644 pyrit/memory/alembic/versions/6b7c8d9e0f1a_add_custom_initializers_table.py
 delete mode 100644 pyrit/models/custom_initializer.py
 create mode 100644 pyrit/registry/custom_initializer_storage.py
 create mode 100644 tests/unit/backend/test_configuration_file_service.py
 create mode 100644 tests/unit/backend/test_configuration_routes.py
 create mode 100644 tests/unit/backend/test_environment_file_service.py
 delete mode 100644 tests/unit/memory/test_custom_initializer_memory.py
 create mode 100644 tests/unit/registry/test_custom_initializer_storage.py

diff --git a/.pyrit_conf_example b/.pyrit_conf_example
index 5f45135bfd..212aee663e 100644
--- a/.pyrit_conf_example
+++ b/.pyrit_conf_example
@@ -72,18 +72,21 @@ operation: op_trash_panda
 
 # Initialization Scripts
 # ----------------------
-# List of paths to custom Python scripts containing PyRITInitializer subclasses.
-# Paths can be absolute or relative to the current working directory.
+# List of local paths or Azure Blob URIs to Python scripts containing
+# PyRITInitializer subclasses. Local paths can be absolute or relative to the
+# current working directory. Blob URIs may include a SAS; otherwise
+# DefaultAzureCredential is used.
 #
 # Behavior:
 # - Omit this field (or set to null): No custom scripts loaded (default)
 # - Set to []: Explicitly load no scripts (same as omitting)
-# - Set to list of paths: Load the specified scripts
+# - Set to list of sources: Load the specified scripts
 #
 # Example:
 # initialization_scripts:
 #   - /path/to/my_custom_initializer.py
 #   - ./local_initializer.py
+#   - https://account.blob.core.windows.net/scripts/cloud_initializer.py
 
 # Environment Configuration
 # -------------------------
@@ -123,6 +126,12 @@ max_concurrent_scenario_runs: 3
 # Default: false
 allow_custom_initializers: false
 
+# Optional storage for custom initializer Python scripts. This may be a local
+# directory or an Azure Blob container URI with an optional blob prefix.
+# Container URIs may include a SAS; otherwise DefaultAzureCredential is used. Defaults to
+# ~/.pyrit/custom_initializers.
+# custom_initializers_source: https://account.blob.core.windows.net/container/custom_initializers
+
 # Local Backend Server
 # --------------------
 # Client settings used by pyrit_scan when connecting to or launching a backend.
diff --git a/doc/getting_started/pyrit_conf.md b/doc/getting_started/pyrit_conf.md
index 64235420ea..4f63abbf62 100644
--- a/doc/getting_started/pyrit_conf.md
+++ b/doc/getting_started/pyrit_conf.md
@@ -143,9 +143,19 @@ initializers:
 
 Full preload can take several minutes and may require network access, provider credentials, or acceptance of gated dataset licenses. When preloading during local backend startup, increase `server.startup_timeout` if the configured timeout is not long enough.
 
+### `custom_initializers_source`
+
+Stores custom initializer Python files in a local directory or Azure Blob container. An Azure URI may include a blob-name prefix, which behaves like a folder:
+
+```yaml
+custom_initializers_source: https://account.blob.core.windows.net/copyrit/custom-initializers
+```
+
+With this configuration, PyRIT reads and writes scripts directly under the `custom-initializers/` prefix in the `copyrit` container. A SAS query string may be included; otherwise, PyRIT uses `DefaultAzureCredential`. The default is `~/.pyrit/custom_initializers`.
+
 ### `initialization_scripts`
 
-Paths to custom Python scripts containing `PyRITInitializer` subclasses. Paths can be absolute or relative to the current working directory.
+Local paths or Azure Blob URIs to custom Python scripts containing `PyRITInitializer` subclasses. Local paths can be absolute or relative to the current working directory. Blob URIs may include a SAS token; URIs without one authenticate with `DefaultAzureCredential`.
 
 | Value             | Behavior                           |
 | ----------------- | ---------------------------------- |
@@ -157,6 +167,7 @@ Paths to custom Python scripts containing `PyRITInitializer` subclasses. Paths c
 initialization_scripts:
   - /path/to/my_custom_initializer.py
   - ./local_initializer.py
+  - https://account.blob.core.windows.net/scripts/cloud_initializer.py
 ```
 
 ### `env_files`
diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx
index 8e05c3af03..79c4049024 100644
--- a/frontend/src/App.tsx
+++ b/frontend/src/App.tsx
@@ -9,6 +9,7 @@ import AttackNotFound from './components/Chat/AttackNotFound'
 import Home from './components/Home/Home'
 import TargetConfig from './components/Config/TargetConfig'
 import Initializers from './components/Initializers/Initializers'
+import BackendConfiguration from './components/BackendConfiguration/BackendConfiguration'
 import AttackHistory from './components/History/AttackHistory'
 import FeedbackDialog from './components/Feedback/FeedbackDialog'
 import type { HistoryFilters } from './components/History/historyFilters'
@@ -39,6 +40,7 @@ const VIEW_PATHS: Record<ViewName, string> = {
   history: '/history',
   config: '/config',
   initializers: '/initializers',
+  backendConfig: '/backend-config',
 }
 
 /** Resolves the active view from a URL path, defaulting to home for unknown paths. */
@@ -418,6 +420,7 @@ function App() {
                 }
               />
               <Route path="/initializers" element={<Initializers />} />
+              <Route path="/backend-config" element={<BackendConfiguration />} />
               <Route
                 path="/history"
                 element={
diff --git a/frontend/src/components/BackendConfiguration/BackendConfiguration.styles.ts b/frontend/src/components/BackendConfiguration/BackendConfiguration.styles.ts
new file mode 100644
index 0000000000..ca5dd0e932
--- /dev/null
+++ b/frontend/src/components/BackendConfiguration/BackendConfiguration.styles.ts
@@ -0,0 +1,150 @@
+import { makeStyles, tokens } from '@fluentui/react-components'
+
+import {
+  MINIMUM_TOUCH_TARGET_SIZE,
+  NARROW_VIEWPORT_QUERY,
+  TOUCH_INPUT_QUERY,
+} from '@/styles/touchTargets'
+
+export const useBackendConfigurationStyles = makeStyles({
+  root: {
+    display: 'flex',
+    flexDirection: 'column',
+    boxSizing: 'border-box',
+    height: '100%',
+    width: '100%',
+    minWidth: 0,
+    maxWidth: '100%',
+    gap: tokens.spacingVerticalL,
+    padding: tokens.spacingVerticalXXL,
+    overflow: 'auto',
+    backgroundColor: tokens.colorNeutralBackground2,
+    '@media (max-width: 600px)': {
+      padding: `${tokens.spacingVerticalL} ${tokens.spacingHorizontalM}`,
+    },
+  },
+  header: {
+    display: 'flex',
+    alignItems: 'center',
+    justifyContent: 'space-between',
+    flexWrap: 'wrap',
+    gap: tokens.spacingVerticalM,
+  },
+  actions: {
+    display: 'flex',
+    alignItems: 'center',
+    gap: tokens.spacingHorizontalS,
+    [NARROW_VIEWPORT_QUERY]: {
+      width: '100%',
+    },
+  },
+  action: {
+    [NARROW_VIEWPORT_QUERY]: {
+      flex: '1 1 8rem',
+      minHeight: MINIMUM_TOUCH_TARGET_SIZE,
+    },
+    [TOUCH_INPUT_QUERY]: {
+      minHeight: MINIMUM_TOUCH_TARGET_SIZE,
+    },
+  },
+  editorField: {
+    display: 'flex',
+    flexDirection: 'column',
+    flex: 1,
+    minWidth: 0,
+    minHeight: 0,
+    maxWidth: '100%',
+  },
+  editor: {
+    position: 'relative',
+    flex: 1,
+    minHeight: '24rem',
+  },
+  editorHighlight: {
+    position: 'absolute',
+    inset: 0,
+    boxSizing: 'border-box',
+    minHeight: '24rem',
+    margin: 0,
+    padding: tokens.spacingHorizontalL,
+    overflow: 'hidden',
+    pointerEvents: 'none',
+    border: `1px solid ${tokens.colorNeutralStroke1}`,
+    borderRadius: `0 0 ${tokens.borderRadiusMedium} ${tokens.borderRadiusMedium}`,
+    backgroundColor: tokens.colorNeutralBackground1,
+    color: tokens.colorNeutralForeground1,
+    whiteSpace: 'pre',
+    tabSize: 2,
+    fontFamily: 'Consolas, "Courier New", monospace',
+    fontSize: tokens.fontSizeBase300,
+    lineHeight: tokens.lineHeightBase300,
+    '& .token.comment': {
+      color: tokens.colorNeutralForeground3,
+      fontStyle: 'italic',
+    },
+    '& .token.key, & .token.atrule, & .token.tag': {
+      color: tokens.colorPaletteBlueForeground2,
+    },
+    '& .token.string, & .token.scalar': {
+      color: tokens.colorPaletteGreenForeground1,
+    },
+    '& .token.number, & .token.boolean, & .token.null, & .token.important': {
+      color: tokens.colorPaletteDarkOrangeForeground1,
+    },
+    '& .token.anchor, & .token.alias': {
+      color: tokens.colorPalettePurpleForeground2,
+    },
+    '& .token.punctuation': {
+      color: tokens.colorNeutralForeground2,
+    },
+  },
+  editorInput: {
+    position: 'relative',
+    zIndex: 1,
+    display: 'block',
+    boxSizing: 'border-box',
+    width: '100%',
+    height: '100%',
+    minHeight: '24rem',
+    margin: 0,
+    padding: tokens.spacingHorizontalL,
+    overflow: 'auto',
+    resize: 'vertical',
+    border: '1px solid transparent',
+    borderRadius: `0 0 ${tokens.borderRadiusMedium} ${tokens.borderRadiusMedium}`,
+    backgroundColor: 'transparent',
+    color: 'transparent',
+    caretColor: tokens.colorNeutralForeground1,
+    whiteSpace: 'pre',
+    tabSize: 2,
+    fontFamily: 'Consolas, "Courier New", monospace',
+    fontSize: tokens.fontSizeBase300,
+    lineHeight: tokens.lineHeightBase300,
+    '&:focus-visible': {
+      outline: `2px solid ${tokens.colorStrokeFocus2}`,
+      outlineOffset: '-2px',
+    },
+    '&::selection': {
+      backgroundColor: tokens.colorBrandBackground2,
+    },
+  },
+  loadingState: {
+    display: 'flex',
+    flex: 1,
+    alignItems: 'center',
+    justifyContent: 'center',
+    minHeight: '16rem',
+  },
+  message: {
+    width: '100%',
+  },
+  environmentSection: {
+    display: 'flex',
+    flexDirection: 'column',
+    flex: 1,
+    minWidth: 0,
+    minHeight: 0,
+    maxWidth: '100%',
+    gap: tokens.spacingVerticalM,
+  },
+})
\ No newline at end of file
diff --git a/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx b/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx
new file mode 100644
index 0000000000..e6c60666df
--- /dev/null
+++ b/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx
@@ -0,0 +1,225 @@
+import { FluentProvider, webLightTheme } from '@fluentui/react-components'
+import { fireEvent, render, screen, waitFor, within } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+
+import { configurationApi, initializersApi } from '@/services/api'
+
+import BackendConfiguration from './BackendConfiguration'
+
+jest.mock('@/services/api', () => ({
+  configurationApi: {
+    getContent: jest.fn(),
+    updateContent: jest.fn(),
+    listEnvironmentFiles: jest.fn(),
+    getEnvironmentFile: jest.fn(),
+    updateEnvironmentFile: jest.fn(),
+  },
+  initializersApi: {
+    listCustom: jest.fn(),
+    register: jest.fn(),
+    updateCustom: jest.fn(),
+    unregister: jest.fn(),
+  },
+}))
+
+const mockedConfigurationApi = jest.mocked(configurationApi)
+const mockedInitializersApi = jest.mocked(initializersApi)
+
+function renderPage(): void {
+  render(
+    <FluentProvider theme={webLightTheme}>
+      <BackendConfiguration />
+    </FluentProvider>,
+  )
+}
+
+describe('BackendConfiguration', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+    mockedConfigurationApi.getContent.mockResolvedValue({
+      content: 'operator: alice\n',
+      source: 'C:/Users/test/.pyrit/config.yaml',
+    })
+    mockedConfigurationApi.listEnvironmentFiles.mockResolvedValue({
+      items: [
+        { id: '0', name: '.env', path: 'C:/Users/test/.pyrit/.env', content: '', exists: true },
+        { id: '1', name: '.env.local', path: 'C:/Users/test/.pyrit/.env.local', content: '', exists: false },
+      ],
+    })
+    mockedConfigurationApi.getEnvironmentFile.mockResolvedValue({
+      id: '0',
+      name: '.env',
+      path: 'C:/Users/test/.pyrit/.env',
+      content: 'API_KEY=value\n',
+      exists: true,
+    })
+    mockedInitializersApi.listCustom.mockResolvedValue({
+      source: 'C:/Users/test/.pyrit/custom_initializers',
+      items: [
+        {
+          initializer_name: 'custom_target',
+          script_content: 'class CustomTargetInitializer: pass',
+          source: 'C:/Users/test/.pyrit/custom_initializers/custom_target.py',
+        },
+      ],
+    })
+    mockedInitializersApi.register.mockResolvedValue({
+      initializer_name: 'new_custom',
+      initializer_type: 'NewCustomInitializer',
+      description: 'New custom initializer.',
+      required_env_vars: [],
+      supported_parameters: [],
+    })
+    mockedInitializersApi.updateCustom.mockResolvedValue({
+      initializer_name: 'custom_target',
+      initializer_type: 'CustomTargetInitializer',
+      description: 'Updated custom initializer.',
+      required_env_vars: [],
+      supported_parameters: [],
+    })
+    mockedInitializersApi.unregister.mockResolvedValue()
+  })
+
+  it('should load and display configuration content', async () => {
+    renderPage()
+
+    expect(await screen.findByLabelText('Configuration YAML')).toHaveValue('operator: alice\n')
+    expect(screen.getByRole('navigation', { name: 'Configuration files' })).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: /\.pyrit_conf/i })).toHaveAttribute('aria-current', 'page')
+    expect(screen.getByText('C:/Users/test/.pyrit/config.yaml')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Copy YAML source' })).toBeInTheDocument()
+    expect(screen.getByTestId('yaml-highlight').innerHTML).toContain('token key atrule')
+    expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
+  })
+
+  it('should save edited configuration content', async () => {
+    const user = userEvent.setup()
+    mockedConfigurationApi.updateContent.mockResolvedValue({
+      content: 'operator: bob\n',
+      source: 'C:/Users/test/.pyrit/config.yaml',
+    })
+    renderPage()
+
+    const editor = await screen.findByLabelText('Configuration YAML')
+    await user.clear(editor)
+    await user.type(editor, 'operator: bob\n')
+    await user.click(screen.getByRole('button', { name: 'Save' }))
+
+    expect(mockedConfigurationApi.updateContent).toHaveBeenCalledWith({ content: 'operator: bob\n' })
+    expect(await screen.findByText(/restart the backend/i)).toBeInTheDocument()
+  })
+
+  it('should show a load error', async () => {
+    mockedConfigurationApi.getContent.mockRejectedValue(new Error('Configuration unavailable'))
+    renderPage()
+
+    expect(await screen.findByText('Configuration unavailable')).toBeInTheDocument()
+  })
+
+  it('should edit and save a selected environment file with dotenv highlighting', async () => {
+    const user = userEvent.setup()
+    mockedConfigurationApi.updateEnvironmentFile.mockResolvedValue({
+      id: '0',
+      name: '.env',
+      path: 'C:/Users/test/.pyrit/.env',
+      content: 'API_KEY=updated\n',
+      exists: true,
+    })
+    renderPage()
+
+    await user.click(screen.getByRole('tab', { name: 'Environment Files' }))
+    const editor = await screen.findByLabelText('Environment file contents')
+    expect(screen.getByTitle('C:/Users/test/.pyrit/.env')).toBeInTheDocument()
+    expect(editor).toHaveValue('API_KEY=value\n')
+    expect(screen.getByTestId('dotenv-highlight').innerHTML).toContain('token key atrule')
+    expect(screen.getByRole('button', { name: 'Copy dotenv source' })).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: /\.env\.local/i })).toHaveTextContent('(new)')
+
+    await user.clear(editor)
+    await user.type(editor, 'API_KEY=updated\n')
+    await user.click(screen.getByRole('button', { name: 'Save' }))
+
+    expect(mockedConfigurationApi.updateEnvironmentFile).toHaveBeenCalledWith('0', {
+      content: 'API_KEY=updated\n',
+    })
+  })
+
+  it('should display and update an AKV environment source', async () => {
+    const user = userEvent.setup()
+    const secretUrl = 'https://vault.vault.azure.net/secrets/bootstrap'
+    mockedConfigurationApi.listEnvironmentFiles.mockResolvedValue({
+      items: [
+        { id: 'akv:0', name: 'AKV: bootstrap', path: secretUrl, content: '', exists: true },
+      ],
+    })
+    mockedConfigurationApi.getEnvironmentFile.mockResolvedValue({
+      id: 'akv:0',
+      name: 'AKV: bootstrap',
+      path: secretUrl,
+      content: 'API_KEY=before\n',
+      exists: true,
+    })
+    mockedConfigurationApi.updateEnvironmentFile.mockResolvedValue({
+      id: 'akv:0',
+      name: 'AKV: bootstrap',
+      path: secretUrl,
+      content: 'API_KEY=after\n',
+      exists: true,
+    })
+    renderPage()
+
+    await user.click(screen.getByRole('tab', { name: 'Environment Files' }))
+    expect(await screen.findByRole('button', { name: /AKV: bootstrap/i })).toBeInTheDocument()
+    expect(screen.getByTitle(secretUrl)).toBeInTheDocument()
+    const editor = await screen.findByLabelText('Environment file contents')
+    await user.clear(editor)
+    await user.type(editor, 'API_KEY=after\n')
+    await user.click(screen.getByRole('button', { name: 'Save' }))
+
+    expect(mockedConfigurationApi.updateEnvironmentFile).toHaveBeenCalledWith('akv:0', {
+      content: 'API_KEY=after\n',
+    })
+  })
+
+  it('should edit storage-backed custom initializers in its own tab', async () => {
+    const user = userEvent.setup()
+    renderPage()
+
+    await user.click(screen.getByRole('tab', { name: 'Custom Initializers' }))
+    expect(screen.getByText('C:/Users/test/.pyrit/custom_initializers/custom_target.py')).toBeInTheDocument()
+    expect(await screen.findByRole('navigation', { name: 'Custom initializer files' })).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Copy Python source' })).toBeInTheDocument()
+    fireEvent.change(screen.getByRole('textbox', { name: 'Python source' }), {
+      target: { value: 'class UpdatedCustomTargetInitializer: pass' },
+    })
+    await user.click(screen.getByRole('button', { name: 'Save' }))
+
+    await waitFor(() => {
+      expect(mockedInitializersApi.updateCustom).toHaveBeenCalledWith('custom_target', {
+        script_content: 'class UpdatedCustomTargetInitializer: pass',
+      })
+    })
+    expect(await screen.findByText('Updated custom_target.')).toBeInTheDocument()
+  })
+
+  it('should register a storage-backed custom initializer', async () => {
+    const user = userEvent.setup()
+    renderPage()
+
+    await user.click(screen.getByRole('tab', { name: 'Custom Initializers' }))
+    await user.click(screen.getByRole('button', { name: 'Register initializer' }))
+    const registerDialog = await screen.findByRole('dialog')
+    await user.type(within(registerDialog).getByRole('textbox', { name: /Initializer name/ }), 'new_custom')
+    fireEvent.change(within(registerDialog).getByRole('textbox', { name: 'Python source' }), {
+      target: { value: 'class NewCustom: pass' },
+    })
+    await user.click(within(registerDialog).getByRole('button', { name: 'Register' }))
+
+    await waitFor(() => {
+      expect(mockedInitializersApi.register).toHaveBeenCalledWith({
+        name: 'new_custom',
+        script_content: 'class NewCustom: pass',
+      })
+    })
+  })
+})
\ No newline at end of file
diff --git a/frontend/src/components/BackendConfiguration/BackendConfiguration.tsx b/frontend/src/components/BackendConfiguration/BackendConfiguration.tsx
new file mode 100644
index 0000000000..b97889f7f8
--- /dev/null
+++ b/frontend/src/components/BackendConfiguration/BackendConfiguration.tsx
@@ -0,0 +1,179 @@
+import { useEffect, useState } from 'react'
+
+import {
+  Button,
+  Field,
+  MessageBar,
+  MessageBarBody,
+  Spinner,
+  Tab,
+  TabList,
+  Text,
+} from '@fluentui/react-components'
+import type { SelectTabData, SelectTabEvent } from '@fluentui/react-components'
+import { ArrowSyncRegular, SaveRegular } from '@fluentui/react-icons'
+
+import { configurationApi } from '@/services/api'
+import { toApiError } from '@/services/errors'
+import EditorWorkspace from '@/components/EditorWorkspace'
+
+import { useBackendConfigurationStyles } from './BackendConfiguration.styles'
+import CustomInitializerFiles from './CustomInitializerFiles'
+import EnvironmentFiles from './EnvironmentFiles'
+import YamlEditor from './YamlEditor'
+
+interface StatusMessage {
+  intent: 'success' | 'error' | 'warning'
+  text: string
+}
+
+type ConfigurationTab = 'configuration' | 'environment' | 'custom-initializers'
+
+export default function BackendConfiguration() {
+  const styles = useBackendConfigurationStyles()
+  const [content, setContent] = useState('')
+  const [savedContent, setSavedContent] = useState('')
+  const [source, setSource] = useState('')
+  const [loading, setLoading] = useState(true)
+  const [saving, setSaving] = useState(false)
+  const [reloadCount, setReloadCount] = useState(0)
+  const [statusMessage, setStatusMessage] = useState<StatusMessage | null>(null)
+  const [selectedTab, setSelectedTab] = useState<ConfigurationTab>('configuration')
+
+  useEffect(() => {
+    let cancelled = false
+
+    const loadContentAsync = async (): Promise<void> => {
+      setLoading(true)
+      setStatusMessage(null)
+      try {
+        const response = await configurationApi.getContent()
+        if (!cancelled) {
+          setContent(response.content)
+          setSavedContent(response.content)
+          setSource(response.source)
+        }
+      } catch (error) {
+        if (!cancelled) {
+          setStatusMessage({ intent: 'error', text: toApiError(error).detail })
+        }
+      } finally {
+        if (!cancelled) {
+          setLoading(false)
+        }
+      }
+    }
+
+    void loadContentAsync()
+    return () => {
+      cancelled = true
+    }
+  }, [reloadCount])
+
+  const handleReload = (): void => {
+    setReloadCount((currentCount: number) => currentCount + 1)
+  }
+
+  const handleSave = async (): Promise<void> => {
+    setSaving(true)
+    setStatusMessage(null)
+    try {
+      const response = await configurationApi.updateContent({ content })
+      setContent(response.content)
+      setSavedContent(response.content)
+      setSource(response.source)
+      setStatusMessage({
+        intent: 'success',
+        text: 'Configuration saved. Restart the backend to apply these changes.',
+      })
+    } catch (error) {
+      setStatusMessage({ intent: 'error', text: toApiError(error).detail })
+    } finally {
+      setSaving(false)
+    }
+  }
+
+  const hasUnsavedChanges = content !== savedContent
+
+  const handleTabSelect = (_: SelectTabEvent, data: SelectTabData): void => {
+    if (
+      data.value === 'configuration'
+      || data.value === 'environment'
+      || data.value === 'custom-initializers'
+    ) {
+      setSelectedTab(data.value)
+    }
+  }
+
+  return (
+    <main className={styles.root}>
+      <div className={styles.header}>
+        <Text as="h1" size={600} weight="semibold">Backend Configuration</Text>
+      </div>
+
+      <TabList selectedValue={selectedTab} onTabSelect={handleTabSelect}>
+        <Tab value="configuration">Configuration</Tab>
+        <Tab value="environment">Environment Files</Tab>
+        <Tab value="custom-initializers">Custom Initializers</Tab>
+      </TabList>
+
+      {selectedTab === 'configuration' && statusMessage && (
+        <MessageBar intent={statusMessage.intent} className={styles.message}>
+          <MessageBarBody>{statusMessage.text}</MessageBarBody>
+        </MessageBar>
+      )}
+
+      {selectedTab === 'custom-initializers' ? (
+        <CustomInitializerFiles />
+      ) : selectedTab === 'environment' ? (
+        <EnvironmentFiles />
+      ) : loading ? (
+        <div className={styles.loadingState}>
+          <Spinner label="Loading backend configuration..." />
+        </div>
+      ) : (
+        <EditorWorkspace
+          items={[{ id: 'configuration', label: '.pyrit_conf', secondaryText: source }]}
+          selectedId="configuration"
+          navigationLabel="Configuration files"
+          emptyMessage="Configuration file is unavailable."
+          description="Edit YAML configuration loaded when the backend starts."
+          actions={(
+            <div className={styles.actions}>
+              <Button
+                appearance="subtle"
+                className={styles.action}
+                icon={<ArrowSyncRegular />}
+                disabled={loading || saving}
+                onClick={handleReload}
+              >
+                Reload
+              </Button>
+              <Button
+                appearance="primary"
+                className={styles.action}
+                icon={<SaveRegular />}
+                disabled={loading || saving || !hasUnsavedChanges}
+                onClick={() => void handleSave()}
+              >
+                {saving ? 'Saving...' : 'Save'}
+              </Button>
+            </div>
+          )}
+        >
+          <Field
+            className={styles.editorField}
+            label=".pyrit_conf"
+            hint={hasUnsavedChanges ? 'Unsaved changes' : 'Changes take effect after the backend restarts.'}
+          >
+            <YamlEditor
+              value={content}
+              disabled={saving}
+              onChange={setContent}
+            />
+          </Field>
+        </EditorWorkspace>
+      )}
+    </main>
+  )
+}
\ No newline at end of file
diff --git a/frontend/src/components/BackendConfiguration/CustomInitializerFiles.tsx b/frontend/src/components/BackendConfiguration/CustomInitializerFiles.tsx
new file mode 100644
index 0000000000..c795a5b4ff
--- /dev/null
+++ b/frontend/src/components/BackendConfiguration/CustomInitializerFiles.tsx
@@ -0,0 +1,126 @@
+import { useEffect, useState } from 'react'
+
+import { MessageBar, MessageBarBody, Spinner } from '@fluentui/react-components'
+
+import CustomInitializers from '@/components/Initializers/CustomInitializers'
+import { initializersApi } from '@/services/api'
+import { toApiError } from '@/services/errors'
+import type { CustomInitializer } from '@/types'
+
+import { useBackendConfigurationStyles } from './BackendConfiguration.styles'
+
+interface StatusMessage {
+  intent: 'success' | 'error'
+  text: string
+}
+
+export default function CustomInitializerFiles() {
+  const styles = useBackendConfigurationStyles()
+  const [items, setItems] = useState<CustomInitializer[]>([])
+  const [loading, setLoading] = useState(true)
+  const [registering, setRegistering] = useState(false)
+  const [updatingName, setUpdatingName] = useState<string | null>(null)
+  const [deletingName, setDeletingName] = useState<string | null>(null)
+  const [statusMessage, setStatusMessage] = useState<StatusMessage | null>(null)
+
+  useEffect(() => {
+    let cancelled = false
+
+    const loadAsync = async (): Promise<void> => {
+      setLoading(true)
+      try {
+        const response = await initializersApi.listCustom()
+        if (!cancelled) {
+          setItems(response.items)
+        }
+      } catch (error) {
+        if (!cancelled) {
+          setStatusMessage({ intent: 'error', text: toApiError(error).detail })
+        }
+      } finally {
+        if (!cancelled) {
+          setLoading(false)
+        }
+      }
+    }
+
+    void loadAsync()
+    return () => {
+      cancelled = true
+    }
+  }, [])
+
+  const reload = async (): Promise<void> => {
+    const response = await initializersApi.listCustom()
+    setItems(response.items)
+  }
+
+  const handleRegister = async (name: string, scriptContent: string): Promise<boolean> => {
+    setRegistering(true)
+    setStatusMessage(null)
+    try {
+      await initializersApi.register({ name, script_content: scriptContent })
+      await reload()
+      setStatusMessage({ intent: 'success', text: `Registered ${name}.` })
+      return true
+    } catch (error) {
+      setStatusMessage({ intent: 'error', text: toApiError(error).detail })
+      return false
+    } finally {
+      setRegistering(false)
+    }
+  }
+
+  const handleUpdate = async (name: string, scriptContent: string): Promise<boolean> => {
+    setUpdatingName(name)
+    setStatusMessage(null)
+    try {
+      await initializersApi.updateCustom(name, { script_content: scriptContent })
+      await reload()
+      setStatusMessage({ intent: 'success', text: `Updated ${name}.` })
+      return true
+    } catch (error) {
+      setStatusMessage({ intent: 'error', text: toApiError(error).detail })
+      return false
+    } finally {
+      setUpdatingName(null)
+    }
+  }
+
+  const handleDelete = async (name: string): Promise<void> => {
+    setDeletingName(name)
+    setStatusMessage(null)
+    try {
+      await initializersApi.unregister(name)
+      await reload()
+      setStatusMessage({ intent: 'success', text: `Removed ${name}.` })
+    } catch (error) {
+      setStatusMessage({ intent: 'error', text: toApiError(error).detail })
+    } finally {
+      setDeletingName(null)
+    }
+  }
+
+  if (loading) {
+    return <Spinner label="Loading custom initializers..." />
+  }
+
+  return (
+    <div className={styles.environmentSection}>
+      {statusMessage && (
+        <MessageBar intent={statusMessage.intent}>
+          <MessageBarBody>{statusMessage.text}</MessageBarBody>
+        </MessageBar>
+      )}
+      <CustomInitializers
+        items={items}
+        registering={registering}
+        updatingName={updatingName}
+        deletingName={deletingName}
+        onRegister={handleRegister}
+        onUpdate={handleUpdate}
+        onDelete={handleDelete}
+      />
+    </div>
+  )
+}
\ No newline at end of file
diff --git a/frontend/src/components/BackendConfiguration/DotenvEditor.tsx b/frontend/src/components/BackendConfiguration/DotenvEditor.tsx
new file mode 100644
index 0000000000..01b372957c
--- /dev/null
+++ b/frontend/src/components/BackendConfiguration/DotenvEditor.tsx
@@ -0,0 +1,76 @@
+import { useRef } from 'react'
+
+import Prism from 'prismjs'
+
+import CodeEditorFrame from '@/components/CodeEditorFrame'
+
+import { useBackendConfigurationStyles } from './BackendConfiguration.styles'
+
+interface DotenvEditorProps {
+  value: string
+  disabled: boolean
+  onChange: (value: string) => void
+}
+
+Prism.languages.dotenv = {
+  comment: /(^|[^\\])#.*/m,
+  key: {
+    pattern: /(^\s*(?:export\s+)?)[A-Za-z_][A-Za-z0-9_]*(?=\s*=)/m,
+    lookbehind: true,
+    alias: 'atrule',
+  },
+  interpolation: {
+    pattern: /\$\{?[A-Za-z_][A-Za-z0-9_]*\}?/,
+    alias: 'variable',
+  },
+  string: {
+    pattern: /(^\s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_]*\s*=\s*)(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*')/m,
+    lookbehind: true,
+    greedy: true,
+  },
+  boolean: /\b(?:true|false)\b/i,
+  number: /\b(?:0x[\dA-Fa-f]+|\d+(?:\.\d+)?)\b/,
+  operator: /=/,
+}
+
+function highlightDotenv(value: string): string {
+  return Prism.highlight(value, Prism.languages.dotenv, 'dotenv')
+}
+
+export default function DotenvEditor({ value, disabled, onChange }: DotenvEditorProps) {
+  const styles = useBackendConfigurationStyles()
+  const highlightRef = useRef<HTMLPreElement>(null)
+
+  const handleScroll = (event: React.UIEvent<HTMLTextAreaElement>): void => {
+    if (highlightRef.current) {
+      highlightRef.current.scrollTop = event.currentTarget.scrollTop
+      highlightRef.current.scrollLeft = event.currentTarget.scrollLeft
+    }
+  }
+
+  return (
+    <CodeEditorFrame language="dotenv" value={value}>
+      <div className={styles.editor}>
+        <pre
+          ref={highlightRef}
+          className={styles.editorHighlight}
+          aria-hidden="true"
+          data-testid="dotenv-highlight"
+        >
+          <code dangerouslySetInnerHTML={{ __html: highlightDotenv(`${value}\n`) }} />
+        </pre>
+        <textarea
+          className={styles.editorInput}
+          aria-label="Environment file contents"
+          value={value}
+          disabled={disabled}
+          autoCapitalize="off"
+          autoCorrect="off"
+          spellCheck={false}
+          onChange={(event) => onChange(event.target.value)}
+          onScroll={handleScroll}
+        />
+      </div>
+    </CodeEditorFrame>
+  )
+}
diff --git a/frontend/src/components/BackendConfiguration/EnvironmentFiles.tsx b/frontend/src/components/BackendConfiguration/EnvironmentFiles.tsx
new file mode 100644
index 0000000000..6be2b286c2
--- /dev/null
+++ b/frontend/src/components/BackendConfiguration/EnvironmentFiles.tsx
@@ -0,0 +1,204 @@
+import { useEffect, useState } from 'react'
+
+import { Button, Field, MessageBar, MessageBarBody, Spinner } from '@fluentui/react-components'
+import { ArrowSyncRegular, SaveRegular } from '@fluentui/react-icons'
+
+import { configurationApi } from '@/services/api'
+import { toApiError } from '@/services/errors'
+import type { EnvironmentFileContent } from '@/types'
+import EditorWorkspace from '@/components/EditorWorkspace'
+
+import { useBackendConfigurationStyles } from './BackendConfiguration.styles'
+import DotenvEditor from './DotenvEditor'
+
+interface StatusMessage {
+  intent: 'success' | 'error'
+  text: string
+}
+
+export default function EnvironmentFiles() {
+  const styles = useBackendConfigurationStyles()
+  const [files, setFiles] = useState<EnvironmentFileContent[]>([])
+  const [savedContents, setSavedContents] = useState<Record<string, string>>({})
+  const [loadedIds, setLoadedIds] = useState<Set<string>>(() => new Set())
+  const [selectedId, setSelectedId] = useState<string | null>(null)
+  const [loading, setLoading] = useState(true)
+  const [loadingContent, setLoadingContent] = useState(false)
+  const [saving, setSaving] = useState(false)
+  const [reloadCount, setReloadCount] = useState(0)
+  const [statusMessage, setStatusMessage] = useState<StatusMessage | null>(null)
+
+  useEffect(() => {
+    let cancelled = false
+
+    const loadFilesAsync = async (): Promise<void> => {
+      setLoading(true)
+      setStatusMessage(null)
+      try {
+        const response = await configurationApi.listEnvironmentFiles()
+        if (!cancelled) {
+          setFiles(response.items)
+          setSavedContents({})
+          setLoadedIds(new Set())
+          setSelectedId((currentId) =>
+            response.items.some((file) => file.id === currentId)
+              ? currentId
+              : response.items[0]?.id ?? null,
+          )
+        }
+      } catch (error) {
+        if (!cancelled) {
+          setStatusMessage({ intent: 'error', text: toApiError(error).detail })
+        }
+      } finally {
+        if (!cancelled) {
+          setLoading(false)
+        }
+      }
+    }
+
+    void loadFilesAsync()
+    return () => {
+      cancelled = true
+    }
+  }, [reloadCount])
+
+  useEffect(() => {
+    if (!selectedId || loadedIds.has(selectedId)) return
+    let cancelled = false
+
+    const loadContentAsync = async (): Promise<void> => {
+      setLoadingContent(true)
+      setStatusMessage(null)
+      try {
+        const loadedFile = await configurationApi.getEnvironmentFile(selectedId)
+        if (!cancelled) {
+          setFiles((currentFiles) =>
+            currentFiles.map((file) => file.id === loadedFile.id ? loadedFile : file),
+          )
+          setSavedContents((currentContents) => ({ ...currentContents, [loadedFile.id]: loadedFile.content }))
+          setLoadedIds((currentIds) => new Set(currentIds).add(loadedFile.id))
+        }
+      } catch (error) {
+        if (!cancelled) {
+          setStatusMessage({ intent: 'error', text: toApiError(error).detail })
+        }
+      } finally {
+        if (!cancelled) setLoadingContent(false)
+      }
+    }
+
+    void loadContentAsync()
+    return () => {
+      cancelled = true
+    }
+  }, [loadedIds, selectedId])
+
+  const selectedFile = files.find((file) => file.id === selectedId) ?? null
+  const selectedFileIsLoaded = selectedFile ? loadedIds.has(selectedFile.id) : false
+  const hasUnsavedChanges = selectedFile && selectedFileIsLoaded
+    ? selectedFile.content !== savedContents[selectedFile.id]
+    : false
+
+  const handleContentChange = (content: string): void => {
+    if (!selectedId) return
+    setFiles((currentFiles) =>
+      currentFiles.map((file) => file.id === selectedId ? { ...file, content } : file),
+    )
+  }
+
+  const handleSave = async (): Promise<void> => {
+    if (!selectedFile) return
+    setSaving(true)
+    setStatusMessage(null)
+    try {
+      const updated = await configurationApi.updateEnvironmentFile(selectedFile.id, {
+        content: selectedFile.content,
+      })
+      setFiles((currentFiles) =>
+        currentFiles.map((file) => file.id === updated.id ? updated : file),
+      )
+      setSavedContents((currentContents) => ({ ...currentContents, [updated.id]: updated.content }))
+      setStatusMessage({
+        intent: 'success',
+        text: `${updated.name} saved. Restart the backend to apply these changes.`,
+      })
+    } catch (error) {
+      setStatusMessage({ intent: 'error', text: toApiError(error).detail })
+    } finally {
+      setSaving(false)
+    }
+  }
+
+  if (loading) {
+    return (
+      <div className={styles.loadingState}>
+        <Spinner label="Loading environment files..." />
+      </div>
+    )
+  }
+
+  return (
+    <div className={styles.environmentSection}>
+      {statusMessage && (
+        <MessageBar intent={statusMessage.intent} className={styles.message}>
+          <MessageBarBody>{statusMessage.text}</MessageBarBody>
+        </MessageBar>
+      )}
+
+      <EditorWorkspace
+        items={files.map((file) => ({
+          id: file.id,
+          label: file.name,
+          secondaryText: file.exists ? file.path : `${file.path} (new)`,
+        }))}
+        selectedId={selectedId}
+        navigationLabel="Environment files"
+        emptyMessage="No environment sources are enabled by the configuration."
+        description="Edit dotenv sources loaded when the backend starts."
+        actions={(
+          <div className={styles.actions}>
+            <Button
+              appearance="subtle"
+              className={styles.action}
+              icon={<ArrowSyncRegular />}
+              disabled={saving || loadingContent}
+              onClick={() => setReloadCount((count) => count + 1)}
+            >
+              Reload
+            </Button>
+            <Button
+              appearance="primary"
+              className={styles.action}
+              icon={<SaveRegular />}
+              disabled={saving || loadingContent || !hasUnsavedChanges}
+              onClick={() => void handleSave()}
+            >
+              {saving ? 'Saving...' : 'Save'}
+            </Button>
+          </div>
+        )}
+        onSelect={setSelectedId}
+      >
+          {selectedFile && !selectedFileIsLoaded && (
+            <div className={styles.loadingState}>
+              <Spinner label={`Loading ${selectedFile.name}...`} />
+            </div>
+          )}
+          {selectedFile && selectedFileIsLoaded && (
+            <Field
+              className={styles.editorField}
+              label={selectedFile.name}
+              hint={hasUnsavedChanges ? 'Unsaved changes' : 'No unsaved changes'}
+            >
+              <DotenvEditor
+                value={selectedFile.content}
+                disabled={saving}
+                onChange={handleContentChange}
+              />
+            </Field>
+          )}
+      </EditorWorkspace>
+    </div>
+  )
+}
diff --git a/frontend/src/components/Initializers/PythonCode.styles.ts b/frontend/src/components/BackendConfiguration/PythonCode.styles.ts
similarity index 82%
rename from frontend/src/components/Initializers/PythonCode.styles.ts
rename to frontend/src/components/BackendConfiguration/PythonCode.styles.ts
index 92004ba2b0..033021a82d 100644
--- a/frontend/src/components/Initializers/PythonCode.styles.ts
+++ b/frontend/src/components/BackendConfiguration/PythonCode.styles.ts
@@ -1,20 +1,6 @@
 import { makeStyles, tokens } from '@fluentui/react-components'
 
 export const usePythonCodeStyles = makeStyles({
-  codeHeader: {
-    display: 'flex',
-    alignItems: 'center',
-    justifyContent: 'space-between',
-    minHeight: '2rem',
-    padding: `${tokens.spacingVerticalXS} ${tokens.spacingHorizontalM}`,
-    border: `1px solid ${tokens.colorNeutralStroke2}`,
-    borderBottom: 0,
-    borderRadius: `${tokens.borderRadiusMedium} ${tokens.borderRadiusMedium} 0 0`,
-    backgroundColor: tokens.colorNeutralBackground3,
-    color: tokens.colorNeutralForeground2,
-    fontSize: tokens.fontSizeBase200,
-    fontWeight: tokens.fontWeightSemibold,
-  },
   codeBlock: {
     maxHeight: '65vh',
     margin: 0,
@@ -54,6 +40,7 @@ export const usePythonCodeStyles = makeStyles({
   },
   editor: {
     position: 'relative',
+    flex: 1,
     minHeight: '22rem',
   },
   editorHighlight: {
@@ -69,6 +56,7 @@ export const usePythonCodeStyles = makeStyles({
     display: 'block',
     boxSizing: 'border-box',
     width: '100%',
+    height: '100%',
     minHeight: '22rem',
     margin: 0,
     padding: tokens.spacingHorizontalL,
@@ -92,4 +80,4 @@ export const usePythonCodeStyles = makeStyles({
       backgroundColor: tokens.colorBrandBackground2,
     },
   },
-})
+})
\ No newline at end of file
diff --git a/frontend/src/components/Initializers/PythonCode.tsx b/frontend/src/components/BackendConfiguration/PythonCode.tsx
similarity index 61%
rename from frontend/src/components/Initializers/PythonCode.tsx
rename to frontend/src/components/BackendConfiguration/PythonCode.tsx
index c2e3201646..415dbdd3c2 100644
--- a/frontend/src/components/Initializers/PythonCode.tsx
+++ b/frontend/src/components/BackendConfiguration/PythonCode.tsx
@@ -1,10 +1,10 @@
-import { useRef, useState } from 'react'
+import { useRef } from 'react'
 
-import { Button, Tooltip } from '@fluentui/react-components'
-import { CheckmarkRegular, ClipboardRegular } from '@fluentui/react-icons'
 import Prism from 'prismjs'
 import 'prismjs/components/prism-python'
 
+import CodeEditorFrame from '@/components/CodeEditorFrame'
+
 import { usePythonCodeStyles } from './PythonCode.styles'
 
 interface PythonCodeBlockProps {
@@ -18,50 +18,19 @@ interface PythonCodeEditorProps {
   onChange: (source: string) => void
 }
 
-interface CodeHeaderProps {
-  source: string
-}
-
 function highlightPython(source: string): string {
   return Prism.highlight(source, Prism.languages.python, 'python')
 }
 
-function CodeHeader({ source }: CodeHeaderProps) {
-  const styles = usePythonCodeStyles()
-  const [copiedSource, setCopiedSource] = useState<string | null>(null)
-  const copied = copiedSource === source
-
-  const handleCopy = async (): Promise<void> => {
-    await navigator.clipboard.writeText(source)
-    setCopiedSource(source)
-  }
-
-  return (
-    <div className={styles.codeHeader}>
-      <span>Python</span>
-      <Tooltip content={copied ? 'Copied' : 'Copy Python source'} relationship="description">
-        <Button
-          appearance="transparent"
-          size="small"
-          icon={copied ? <CheckmarkRegular /> : <ClipboardRegular />}
-          aria-label={copied ? 'Copied' : 'Copy Python source'}
-          onClick={() => void handleCopy()}
-        />
-      </Tooltip>
-    </div>
-  )
-}
-
 export function PythonCodeBlock({ source, ariaLabel }: PythonCodeBlockProps) {
   const styles = usePythonCodeStyles()
 
   return (
-    <div>
-      <CodeHeader source={source} />
+    <CodeEditorFrame language="Python" value={source}>
       <pre className={styles.codeBlock} aria-label={ariaLabel}>
         <code dangerouslySetInnerHTML={{ __html: highlightPython(source) }} />
       </pre>
-    </div>
+    </CodeEditorFrame>
   )
 }
 
@@ -77,8 +46,7 @@ export function PythonCodeEditor({ source, disabled, onChange }: PythonCodeEdito
   }
 
   return (
-    <div>
-      <CodeHeader source={source} />
+    <CodeEditorFrame language="Python" value={source}>
       <div className={styles.editor}>
         <pre ref={highlightRef} className={`${styles.codeBlock} ${styles.editorHighlight}`} aria-hidden="true">
           <code dangerouslySetInnerHTML={{ __html: highlightPython(`${source}\n`) }} />
@@ -95,6 +63,6 @@ export function PythonCodeEditor({ source, disabled, onChange }: PythonCodeEdito
           spellCheck={false}
         />
       </div>
-    </div>
+    </CodeEditorFrame>
   )
-}
+}
\ No newline at end of file
diff --git a/frontend/src/components/BackendConfiguration/YamlEditor.tsx b/frontend/src/components/BackendConfiguration/YamlEditor.tsx
new file mode 100644
index 0000000000..bf9e54a3e2
--- /dev/null
+++ b/frontend/src/components/BackendConfiguration/YamlEditor.tsx
@@ -0,0 +1,56 @@
+import { useRef } from 'react'
+
+import Prism from 'prismjs'
+import 'prismjs/components/prism-yaml'
+
+import CodeEditorFrame from '@/components/CodeEditorFrame'
+
+import { useBackendConfigurationStyles } from './BackendConfiguration.styles'
+
+interface YamlEditorProps {
+  value: string
+  disabled: boolean
+  onChange: (value: string) => void
+}
+
+function highlightYaml(value: string): string {
+  return Prism.highlight(value, Prism.languages.yaml, 'yaml')
+}
+
+export default function YamlEditor({ value, disabled, onChange }: YamlEditorProps) {
+  const styles = useBackendConfigurationStyles()
+  const highlightRef = useRef<HTMLPreElement>(null)
+
+  const handleScroll = (event: React.UIEvent<HTMLTextAreaElement>): void => {
+    if (highlightRef.current) {
+      highlightRef.current.scrollTop = event.currentTarget.scrollTop
+      highlightRef.current.scrollLeft = event.currentTarget.scrollLeft
+    }
+  }
+
+  return (
+    <CodeEditorFrame language="YAML" value={value}>
+      <div className={styles.editor}>
+        <pre
+          ref={highlightRef}
+          className={styles.editorHighlight}
+          aria-hidden="true"
+          data-testid="yaml-highlight"
+        >
+          <code dangerouslySetInnerHTML={{ __html: highlightYaml(`${value}\n`) }} />
+        </pre>
+        <textarea
+          className={styles.editorInput}
+          aria-label="Configuration YAML"
+          value={value}
+          disabled={disabled}
+          autoCapitalize="off"
+          autoCorrect="off"
+          spellCheck={false}
+          onChange={(event) => onChange(event.target.value)}
+          onScroll={handleScroll}
+        />
+      </div>
+    </CodeEditorFrame>
+  )
+}
\ No newline at end of file
diff --git a/frontend/src/components/CodeEditorFrame.tsx b/frontend/src/components/CodeEditorFrame.tsx
new file mode 100644
index 0000000000..10d54d50a4
--- /dev/null
+++ b/frontend/src/components/CodeEditorFrame.tsx
@@ -0,0 +1,63 @@
+import { useState } from 'react'
+import type { ReactNode } from 'react'
+
+import { Button, makeStyles, Tooltip, tokens } from '@fluentui/react-components'
+import { CheckmarkRegular, ClipboardRegular } from '@fluentui/react-icons'
+
+interface CodeEditorFrameProps {
+  language: string
+  value: string
+  children: ReactNode
+}
+
+const useStyles = makeStyles({
+  root: {
+    display: 'flex',
+    flexDirection: 'column',
+    flex: 1,
+    minHeight: 0,
+  },
+  header: {
+    display: 'flex',
+    alignItems: 'center',
+    justifyContent: 'space-between',
+    minHeight: '2rem',
+    padding: `${tokens.spacingVerticalXS} ${tokens.spacingHorizontalM}`,
+    border: `1px solid ${tokens.colorNeutralStroke2}`,
+    borderBottom: 0,
+    borderRadius: `${tokens.borderRadiusMedium} ${tokens.borderRadiusMedium} 0 0`,
+    backgroundColor: tokens.colorNeutralBackground3,
+    color: tokens.colorNeutralForeground2,
+    fontSize: tokens.fontSizeBase200,
+    fontWeight: tokens.fontWeightSemibold,
+  },
+})
+
+export default function CodeEditorFrame({ language, value, children }: CodeEditorFrameProps) {
+  const styles = useStyles()
+  const [copiedValue, setCopiedValue] = useState<string | null>(null)
+  const copied = copiedValue === value
+
+  const handleCopy = async (): Promise<void> => {
+    await navigator.clipboard.writeText(value)
+    setCopiedValue(value)
+  }
+
+  return (
+    <div className={styles.root}>
+      <div className={styles.header}>
+        <span>{language}</span>
+        <Tooltip content={copied ? 'Copied' : `Copy ${language} source`} relationship="description">
+          <Button
+            appearance="transparent"
+            size="small"
+            icon={copied ? <CheckmarkRegular /> : <ClipboardRegular />}
+            aria-label={copied ? 'Copied' : `Copy ${language} source`}
+            onClick={() => void handleCopy()}
+          />
+        </Tooltip>
+      </div>
+      {children}
+    </div>
+  )
+}
\ No newline at end of file
diff --git a/frontend/src/components/EditorWorkspace.tsx b/frontend/src/components/EditorWorkspace.tsx
new file mode 100644
index 0000000000..757d1a6684
--- /dev/null
+++ b/frontend/src/components/EditorWorkspace.tsx
@@ -0,0 +1,155 @@
+import type { ReactNode } from 'react'
+
+import { Button, makeStyles, Text, tokens } from '@fluentui/react-components'
+
+import {
+  MINIMUM_TOUCH_TARGET_SIZE,
+  NARROW_VIEWPORT_QUERY,
+} from '@/styles/touchTargets'
+
+export interface EditorWorkspaceItem {
+  id: string
+  label: string
+  secondaryText?: string
+}
+
+interface EditorWorkspaceProps {
+  items: EditorWorkspaceItem[]
+  selectedId: string | null
+  navigationLabel: string
+  emptyMessage: string
+  description: string
+  actions?: ReactNode
+  children: ReactNode
+  onSelect?: (id: string) => void
+}
+
+const useStyles = makeStyles({
+  root: {
+    display: 'flex',
+    flexDirection: 'column',
+    flex: 1,
+    minWidth: 0,
+    minHeight: 0,
+    gap: tokens.spacingVerticalM,
+  },
+  header: {
+    display: 'flex',
+    alignItems: 'center',
+    justifyContent: 'space-between',
+    flexWrap: 'wrap',
+    gap: tokens.spacingVerticalM,
+  },
+  workspace: {
+    display: 'grid',
+    gridTemplateColumns: 'minmax(12rem, 16rem) minmax(0, 1fr)',
+    flex: 1,
+    minWidth: 0,
+    minHeight: 0,
+    maxWidth: '100%',
+    gap: tokens.spacingHorizontalL,
+    [NARROW_VIEWPORT_QUERY]: {
+      gridTemplateColumns: '1fr',
+      gridTemplateRows: 'auto minmax(24rem, 1fr)',
+    },
+  },
+  navigation: {
+    display: 'flex',
+    flexDirection: 'column',
+    minWidth: 0,
+    maxWidth: '100%',
+    gap: tokens.spacingVerticalXS,
+    [NARROW_VIEWPORT_QUERY]: {
+      flexDirection: 'row',
+      alignItems: 'flex-start',
+      overflowX: 'auto',
+    },
+  },
+  navigationButton: {
+    width: '100%',
+    height: 'auto',
+    minHeight: MINIMUM_TOUCH_TARGET_SIZE,
+    justifyContent: 'flex-start',
+    padding: `${tokens.spacingVerticalS} ${tokens.spacingHorizontalM}`,
+    [NARROW_VIEWPORT_QUERY]: {
+      width: 'auto',
+      minWidth: '10rem',
+    },
+  },
+  navigationContent: {
+    display: 'flex',
+    flexDirection: 'column',
+    alignItems: 'flex-start',
+    minWidth: 0,
+    textAlign: 'left',
+  },
+  secondaryText: {
+    display: 'block',
+    maxWidth: '100%',
+    overflow: 'hidden',
+    color: tokens.colorNeutralForeground3,
+    fontSize: tokens.fontSizeBase100,
+    textOverflow: 'ellipsis',
+    whiteSpace: 'nowrap',
+  },
+  editorPane: {
+    display: 'flex',
+    flexDirection: 'column',
+    flex: 1,
+    minWidth: 0,
+    minHeight: 0,
+    gap: tokens.spacingVerticalM,
+  },
+  emptyState: {
+    padding: tokens.spacingVerticalXL,
+    color: tokens.colorNeutralForeground3,
+  },
+})
+
+export default function EditorWorkspace({
+  items,
+  selectedId,
+  navigationLabel,
+  emptyMessage,
+  description,
+  actions,
+  children,
+  onSelect,
+}: EditorWorkspaceProps) {
+  const styles = useStyles()
+
+  return (
+    <div className={styles.root}>
+      <div className={styles.header}>
+        <Text size={300}>{description}</Text>
+        {actions}
+      </div>
+      {items.length === 0 ? (
+        <div className={styles.emptyState}>{emptyMessage}</div>
+      ) : (
+        <div className={styles.workspace}>
+          <nav className={styles.navigation} aria-label={navigationLabel}>
+            {items.map((item) => (
+              <Button
+                key={item.id}
+                className={styles.navigationButton}
+                appearance={item.id === selectedId ? 'primary' : 'subtle'}
+                aria-label={item.label}
+                aria-current={item.id === selectedId ? 'page' : undefined}
+                onClick={onSelect ? () => onSelect(item.id) : undefined}
+              >
+                <span className={styles.navigationContent}>
+                  <span>{item.label}</span>
+                  {item.secondaryText && (
+                    <span className={styles.secondaryText} title={item.secondaryText}>{item.secondaryText}</span>
+                  )}
+                </span>
+              </Button>
+            ))}
+          </nav>
+          <div className={styles.editorPane}>{children}</div>
+        </div>
+      )}
+    </div>
+  )
+}
diff --git a/frontend/src/components/Initializers/CustomInitializers.styles.ts b/frontend/src/components/Initializers/CustomInitializers.styles.ts
index 334f74db07..a3b59e3d0a 100644
--- a/frontend/src/components/Initializers/CustomInitializers.styles.ts
+++ b/frontend/src/components/Initializers/CustomInitializers.styles.ts
@@ -4,36 +4,22 @@ export const useCustomInitializersStyles = makeStyles({
   root: {
     display: 'flex',
     flexDirection: 'column',
+    flex: 1,
     gap: tokens.spacingVerticalM,
     minWidth: 0,
+    minHeight: 0,
   },
-  header: {
+  editorField: {
     display: 'flex',
-    alignItems: 'center',
-    justifyContent: 'space-between',
-    flexWrap: 'wrap',
-    gap: tokens.spacingVerticalM,
-  },
-  tableWrap: {
-    overflowX: 'auto',
-    border: `1px solid ${tokens.colorNeutralStroke2}`,
-    backgroundColor: tokens.colorNeutralBackground1,
-  },
-  nameCell: {
-    verticalAlign: 'top',
-  },
-  clickableRow: {
-    cursor: 'pointer',
-    '&:hover': {
-      backgroundColor: tokens.colorNeutralBackground1Hover,
-    },
-    '&:focus-within': {
-      backgroundColor: tokens.colorNeutralBackground1Hover,
-    },
+    flexDirection: 'column',
+    flex: 1,
+    minWidth: 0,
+    minHeight: 0,
   },
-  actionCell: {
-    width: '7rem',
-    verticalAlign: 'top',
+  editorActions: {
+    display: 'flex',
+    justifyContent: 'flex-end',
+    gap: tokens.spacingHorizontalS,
   },
   dialogBody: {
     display: 'flex',
@@ -44,8 +30,4 @@ export const useCustomInitializersStyles = makeStyles({
     width: 'min(60rem, 90vw)',
     maxWidth: 'none',
   },
-  emptyState: {
-    padding: tokens.spacingVerticalXL,
-    color: tokens.colorNeutralForeground3,
-  },
 })
diff --git a/frontend/src/components/Initializers/CustomInitializers.test.tsx b/frontend/src/components/Initializers/CustomInitializers.test.tsx
index 117664a1b5..1fd452faf3 100644
--- a/frontend/src/components/Initializers/CustomInitializers.test.tsx
+++ b/frontend/src/components/Initializers/CustomInitializers.test.tsx
@@ -14,6 +14,12 @@ const ITEMS: CustomInitializer[] = [
   {
     initializer_name: 'custom_target',
     script_content: 'def initialize():\n    pass',
+    source: 'https://account.blob.core.windows.net/copyrit/custom-initializers/custom_target.py',
+  },
+  {
+    initializer_name: 'second_target',
+    script_content: 'def initialize_second():\n    pass',
+    source: 'https://account.blob.core.windows.net/copyrit/custom-initializers/second_target.py',
   },
 ]
 
@@ -21,8 +27,10 @@ describe('CustomInitializers', () => {
   const defaultProps = {
     items: ITEMS,
     registering: false,
+    updatingName: null,
     deletingName: null,
     onRegister: jest.fn(),
+    onUpdate: jest.fn(),
     onDelete: jest.fn(),
   }
 
@@ -47,5 +55,56 @@ describe('CustomInitializers', () => {
     await user.click(within(dialog).getByRole('button', { name: 'Remove' }))
 
     expect(defaultProps.onDelete).toHaveBeenCalledWith('custom_target')
+    expect(screen.getByRole('button', { name: 'second_target' })).toHaveAttribute('aria-current', 'page')
+  })
+
+  it('should edit and save stored source', async () => {
+    const user = userEvent.setup()
+    defaultProps.onUpdate.mockResolvedValue(true)
+    render(
+      <TestWrapper>
+        <CustomInitializers {...defaultProps} />
+      </TestWrapper>,
+    )
+
+    const editor = screen.getByLabelText('Python source')
+    await user.clear(editor)
+    await user.type(editor, 'def updated():\n    pass')
+    await user.click(screen.getByRole('button', { name: 'Save' }))
+
+    expect(defaultProps.onUpdate).toHaveBeenCalledWith('custom_target', 'def updated():\n    pass')
+  })
+
+  it('should select a custom initializer from the file navigation', async () => {
+    const user = userEvent.setup()
+    render(
+      <TestWrapper>
+        <CustomInitializers {...defaultProps} />
+      </TestWrapper>,
+    )
+
+    await user.click(screen.getByRole('button', { name: 'second_target' }))
+
+    expect(screen.getByLabelText('Python source')).toHaveValue('def initialize_second():\n    pass')
+    expect(screen.getByText(ITEMS[1].source)).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'second_target' })).toHaveAttribute('aria-current', 'page')
+  })
+
+  it('should register a custom initializer', async () => {
+    const user = userEvent.setup()
+    defaultProps.onRegister.mockResolvedValue(true)
+    render(
+      <TestWrapper>
+        <CustomInitializers {...defaultProps} />
+      </TestWrapper>,
+    )
+
+    await user.click(screen.getByRole('button', { name: 'Register initializer' }))
+    const dialog = screen.getByRole('dialog', { name: 'Register custom initializer' })
+    await user.type(within(dialog).getByRole('textbox', { name: /Initializer name/ }), 'new_custom')
+    await user.type(within(dialog).getByRole('textbox', { name: 'Python source' }), 'class NewCustom: pass')
+    await user.click(within(dialog).getByRole('button', { name: 'Register' }))
+
+    expect(defaultProps.onRegister).toHaveBeenCalledWith('new_custom', 'class NewCustom: pass')
   })
 })
\ No newline at end of file
diff --git a/frontend/src/components/Initializers/CustomInitializers.tsx b/frontend/src/components/Initializers/CustomInitializers.tsx
index 4144152c9e..3e871cc220 100644
--- a/frontend/src/components/Initializers/CustomInitializers.tsx
+++ b/frontend/src/components/Initializers/CustomInitializers.tsx
@@ -8,45 +8,45 @@ import {
   DialogContent,
   DialogSurface,
   DialogTitle,
-  DialogTrigger,
   Field,
   Input,
-  Table,
-  TableBody,
-  TableCell,
-  TableHeader,
-  TableHeaderCell,
-  TableRow,
   Text,
 } from '@fluentui/react-components'
-import { AddRegular, DeleteRegular, EyeRegular } from '@fluentui/react-icons'
+import { AddRegular, DeleteRegular, SaveRegular } from '@fluentui/react-icons'
 
 import ConfirmDialog from '@/components/ConfirmDialog'
+import EditorWorkspace from '@/components/EditorWorkspace'
+import { PythonCodeEditor } from '@/components/BackendConfiguration/PythonCode'
 import type { CustomInitializer } from '@/types'
 
 import { useCustomInitializersStyles } from './CustomInitializers.styles'
-import { PythonCodeBlock, PythonCodeEditor } from './PythonCode'
 
 interface CustomInitializersProps {
   items: CustomInitializer[]
   registering: boolean
+  updatingName: string | null
   deletingName: string | null
   onRegister: (name: string, scriptContent: string) => Promise<boolean>
+  onUpdate: (name: string, scriptContent: string) => Promise<boolean>
   onDelete: (name: string) => Promise<void>
 }
 
 export default function CustomInitializers({
   items,
   registering,
+  updatingName,
   deletingName,
   onRegister,
+  onUpdate,
   onDelete,
 }: CustomInitializersProps) {
   const styles = useCustomInitializersStyles()
   const [dialogOpen, setDialogOpen] = useState(false)
   const [name, setName] = useState('')
   const [scriptContent, setScriptContent] = useState('')
-  const [viewingInitializer, setViewingInitializer] = useState<CustomInitializer | null>(null)
+  const [selectedName, setSelectedName] = useState<string | null>(items[0]?.initializer_name ?? null)
+  const selectedInitializer = items.find((item) => item.initializer_name === selectedName) ?? items[0] ?? null
+  const [editedSource, setEditedSource] = useState(selectedInitializer?.script_content ?? '')
   const [initializerToDelete, setInitializerToDelete] = useState<CustomInitializer | null>(null)
 
   const handleSubmit = async (event: React.FormEvent<HTMLFormElement>): Promise<void> => {
@@ -58,111 +58,130 @@ export default function CustomInitializers({
     }
   }
 
+  const selectInitializer = (initializer: CustomInitializer): void => {
+    setSelectedName(initializer.initializer_name)
+    setEditedSource(initializer.script_content)
+  }
+
+  const handleUpdate = async (): Promise<void> => {
+    if (selectedInitializer) {
+      await onUpdate(selectedInitializer.initializer_name, editedSource)
+    }
+  }
+
+  const handleDelete = async (initializer: CustomInitializer): Promise<void> => {
+    const nextInitializer = items.find((item) => item.initializer_name !== initializer.initializer_name) ?? null
+    setInitializerToDelete(null)
+    await onDelete(initializer.initializer_name)
+    setSelectedName(nextInitializer?.initializer_name ?? null)
+    setEditedSource(nextInitializer?.script_content ?? '')
+  }
+
   return (
-    <section className={styles.root} aria-labelledby="custom-initializers-heading">
-      <div className={styles.header}>
-        <div>
-          <Text id="custom-initializers-heading" as="h2" size={500} weight="semibold">
-            Custom initializers
-          </Text>
-          <Text block>Persisted Python definitions available to startup initializer configuration.</Text>
-        </div>
-        <Dialog open={dialogOpen} onOpenChange={(_, data) => setDialogOpen(data.open)}>
-          <DialogTrigger disableButtonEnhancement>
-            <Button appearance="primary" icon={<AddRegular />}>Register initializer</Button>
-          </DialogTrigger>
-          <DialogSurface className={styles.sourceDialog}>
-            <form onSubmit={handleSubmit}>
-              <DialogBody>
-                <DialogTitle>Register custom initializer</DialogTitle>
-                <DialogContent className={styles.dialogBody}>
-                  <Field label="Initializer name" required>
-                    <Input
-                      value={name}
-                      onChange={(_, data) => setName(data.value)}
-                      disabled={registering}
-                      autoComplete="off"
-                    />
-                  </Field>
-                  <Field label="Python source" required>
-                    <PythonCodeEditor source={scriptContent} onChange={setScriptContent} disabled={registering} />
-                  </Field>
-                </DialogContent>
-                <DialogActions>
-                  <DialogTrigger disableButtonEnhancement>
-                    <Button appearance="secondary" disabled={registering}>Cancel</Button>
-                  </DialogTrigger>
-                  <Button
-                    type="submit"
-                    appearance="primary"
-                    disabled={registering || name.trim() === '' || scriptContent.trim() === ''}
-                  >
-                    {registering ? 'Registering...' : 'Register'}
-                  </Button>
-                </DialogActions>
-              </DialogBody>
-            </form>
-          </DialogSurface>
-        </Dialog>
-      </div>
+    <section className={styles.root} aria-label="Custom initializers">
+      <EditorWorkspace
+        items={items.map((item) => ({
+          id: item.initializer_name,
+          label: item.initializer_name,
+          secondaryText: item.source,
+        }))}
+        selectedId={selectedInitializer?.initializer_name ?? null}
+        navigationLabel="Custom initializer files"
+        emptyMessage="No custom initializers registered."
+        description="Edit Python initializers loaded when the backend starts."
+        actions={(
+          <div className={styles.editorActions}>
+            <Button appearance="subtle" icon={<AddRegular />} onClick={() => setDialogOpen(true)}>
+              Register initializer
+            </Button>
+            <Button
+              appearance="subtle"
+              icon={<DeleteRegular />}
+              disabled={!selectedInitializer || deletingName !== null || updatingName !== null}
+              onClick={() => selectedInitializer && setInitializerToDelete(selectedInitializer)}
+            >
+              {deletingName === selectedInitializer?.initializer_name ? 'Removing...' : 'Remove'}
+            </Button>
+            <Button
+              appearance="primary"
+              icon={<SaveRegular />}
+              disabled={
+                !selectedInitializer
+                || updatingName !== null
+                || deletingName !== null
+                || editedSource.trim() === ''
+                || editedSource === selectedInitializer.script_content
+              }
+              onClick={() => void handleUpdate()}
+            >
+              {updatingName === selectedInitializer?.initializer_name ? 'Saving...' : 'Save'}
+            </Button>
+          </div>
+        )}
+        onSelect={(initializerName) => {
+          const initializer = items.find((item) => item.initializer_name === initializerName)
+          if (initializer) selectInitializer(initializer)
+        }}
+      >
+        {selectedInitializer && (
+          <>
+            <Field
+              className={styles.editorField}
+              label={selectedInitializer.initializer_name}
+              hint={editedSource === selectedInitializer.script_content ? 'No unsaved changes' : 'Unsaved changes'}
+            >
+              <PythonCodeEditor
+                source={editedSource}
+                disabled={updatingName !== null || deletingName !== null}
+                onChange={setEditedSource}
+              />
+            </Field>
+          </>
+        )}
+      </EditorWorkspace>
 
-      {items.length === 0 ? (
-        <Text className={styles.emptyState}>No custom initializers registered.</Text>
-      ) : (
-        <div className={styles.tableWrap}>
-          <Table aria-label="Custom initializers">
-            <TableHeader>
-              <TableRow>
-                <TableHeaderCell className={styles.nameCell}>Name</TableHeaderCell>
-                <TableHeaderCell className={styles.actionCell}>Actions</TableHeaderCell>
-              </TableRow>
-            </TableHeader>
-            <TableBody>
-              {items.map((item) => (
-                <TableRow
-                  className={styles.clickableRow}
-                  key={item.initializer_name}
-                  data-testid={`custom-initializer-${item.initializer_name}`}
-                  onClick={() => setViewingInitializer(item)}
+      <Dialog open={dialogOpen} onOpenChange={(_, data) => setDialogOpen(data.open)}>
+        <DialogSurface className={styles.sourceDialog}>
+          <form onSubmit={handleSubmit}>
+            <DialogBody>
+              <DialogTitle>Register custom initializer</DialogTitle>
+              <DialogContent className={styles.dialogBody}>
+                <Field label="Initializer name" required>
+                  <Input
+                    value={name}
+                    onChange={(_, data) => setName(data.value)}
+                    disabled={registering}
+                    autoComplete="off"
+                  />
+                </Field>
+                <Field label="Python source" required>
+                  <PythonCodeEditor source={scriptContent} onChange={setScriptContent} disabled={registering} />
+                </Field>
+              </DialogContent>
+              <DialogActions>
+                <Button appearance="secondary" disabled={registering} onClick={() => setDialogOpen(false)}>
+                  Cancel
+                </Button>
+                <Button
+                  type="submit"
+                  appearance="primary"
+                  disabled={registering || name.trim() === '' || scriptContent.trim() === ''}
                 >
-                  <TableCell className={styles.nameCell}>
-                    <Button
-                      appearance="transparent"
-                      icon={<EyeRegular />}
-                      onClick={() => setViewingInitializer(item)}
-                    >
-                      {item.initializer_name}
-                    </Button>
-                  </TableCell>
-                  <TableCell className={styles.actionCell}>
-                    <Button
-                      appearance="subtle"
-                      icon={<DeleteRegular />}
-                      disabled={deletingName !== null}
-                      onClick={(event) => {
-                        event.stopPropagation()
-                        setInitializerToDelete(item)
-                      }}
-                    >
-                      {deletingName === item.initializer_name ? 'Removing...' : 'Remove'}
-                    </Button>
-                  </TableCell>
-                </TableRow>
-              ))}
-            </TableBody>
-          </Table>
-        </div>
-      )}
+                  {registering ? 'Registering...' : 'Register'}
+                </Button>
+              </DialogActions>
+            </DialogBody>
+          </form>
+        </DialogSurface>
+      </Dialog>
 
       <ConfirmDialog
         open={initializerToDelete !== null}
         title="Remove custom initializer"
         confirmLabel="Remove"
         onConfirm={() => {
-          const initializerName = initializerToDelete?.initializer_name
-          setInitializerToDelete(null)
-          if (initializerName) {
-            void onDelete(initializerName)
+          if (initializerToDelete) {
+            void handleDelete(initializerToDelete)
           }
         }}
         onCancel={() => setInitializerToDelete(null)}
@@ -171,26 +190,6 @@ export default function CustomInitializers({
         custom initializer? Its stored Python source will be permanently deleted.
       </ConfirmDialog>
 
-      <Dialog
-        open={viewingInitializer !== null}
-        onOpenChange={(_, data) => {
-          if (!data.open) {
-            setViewingInitializer(null)
-          }
-        }}
-      >
-        <DialogSurface className={styles.sourceDialog}>
-          <DialogBody>
-            <DialogTitle>{viewingInitializer?.initializer_name}</DialogTitle>
-            <DialogContent>
-              <PythonCodeBlock source={viewingInitializer?.script_content ?? ''} ariaLabel="Python source" />
-            </DialogContent>
-            <DialogActions>
-              <Button appearance="primary" onClick={() => setViewingInitializer(null)}>Close</Button>
-            </DialogActions>
-          </DialogBody>
-        </DialogSurface>
-      </Dialog>
     </section>
   )
 }
diff --git a/frontend/src/components/Initializers/Initializers.test.tsx b/frontend/src/components/Initializers/Initializers.test.tsx
index 4cc7726cae..3ddc8b6954 100644
--- a/frontend/src/components/Initializers/Initializers.test.tsx
+++ b/frontend/src/components/Initializers/Initializers.test.tsx
@@ -8,7 +8,6 @@ import type {
   BaselineInitializerSetting,
   InitializerSettingsResponse,
   RegisteredInitializer,
-  CustomInitializer,
 } from '@/types'
 
 import Initializers from './Initializers'
@@ -17,9 +16,6 @@ jest.mock('@/services/api', () => ({
   initializersApi: {
     getSettings: jest.fn(),
     listRegistered: jest.fn(),
-    listCustom: jest.fn(),
-    register: jest.fn(),
-    unregister: jest.fn(),
     createAdditional: jest.fn(),
     updateAdditional: jest.fn(),
     deleteAdditional: jest.fn(),
@@ -100,11 +96,6 @@ const sampleSettings: InitializerSettingsResponse = {
   additional: [additionalItem],
 }
 
-const customInitializer: CustomInitializer = {
-  initializer_name: 'custom_target',
-  script_content: 'class CustomTargetInitializer: pass',
-}
-
 function renderInitializers(): void {
   render(
     <TestWrapper>
@@ -121,15 +112,6 @@ describe('Initializers', () => {
       items: [targetInitializer, scorerInitializer],
       pagination: { limit: 200, has_more: false },
     })
-    mockedInitializersApi.listCustom.mockResolvedValue([customInitializer])
-    mockedInitializersApi.register.mockResolvedValue({
-      initializer_name: 'new_custom',
-      initializer_type: 'NewCustomInitializer',
-      description: 'New custom initializer.',
-      required_env_vars: [],
-      supported_parameters: [],
-    })
-    mockedInitializersApi.unregister.mockResolvedValue()
     mockedInitializersApi.createAdditional.mockResolvedValue({
       id: 'additional-2',
       initializer_name: 'target',
@@ -168,47 +150,6 @@ describe('Initializers', () => {
     expect(screen.getByTestId('initializer-row-additional-1')).toHaveTextContent('scorer')
   })
 
-  it('should list and register persisted custom initializers in the custom tab', async () => {
-    const user = userEvent.setup()
-    const writeText = jest.fn().mockResolvedValue(undefined)
-    Object.defineProperty(navigator, 'clipboard', { configurable: true, value: { writeText } })
-    renderInitializers()
-
-    await user.click(await screen.findByRole('tab', { name: 'Custom' }))
-    const customRow = await screen.findByTestId('custom-initializer-custom_target')
-    expect(customRow).not.toHaveTextContent('class CustomTargetInitializer: pass')
-    fireEvent.click(within(customRow).getByRole('button', { name: /custom_target/ }))
-    const sourceDialog = await screen.findByRole('dialog')
-    const sourceBlock = within(sourceDialog).getByLabelText('Python source')
-    expect(sourceBlock).toHaveTextContent(
-      'class CustomTargetInitializer: pass',
-    )
-    expect(sourceBlock.querySelector('.token.keyword')).toHaveTextContent('class')
-    fireEvent.click(within(sourceDialog).getByRole('button', { name: 'Copy Python source', hidden: true }))
-    await waitFor(() => expect(writeText).toHaveBeenCalledWith('class CustomTargetInitializer: pass'))
-    await user.click(within(sourceDialog).getByRole('button', { name: 'Close', hidden: true }))
-
-    fireEvent.click(screen.getByRole('button', { name: 'Register initializer' }))
-    const dialog = await screen.findByRole('dialog')
-    fireEvent.change(within(dialog).getByLabelText(/Initializer name/), { target: { value: 'new_custom' } })
-    fireEvent.change(within(dialog).getByLabelText('Python source', { selector: 'textarea' }), {
-      target: { value: 'class NewCustom: pass' },
-    })
-    expect(within(dialog).getAllByRole('textbox')).toHaveLength(2)
-    expect(dialog.querySelector('pre[aria-hidden="true"] .token.keyword')).toHaveTextContent('class')
-    const form = dialog.querySelector('form')
-    expect(form).not.toBeNull()
-    fireEvent.submit(form as HTMLFormElement)
-
-    await waitFor(() => {
-      expect(mockedInitializersApi.register).toHaveBeenCalledWith({
-        name: 'new_custom',
-        script_content: 'class NewCustom: pass',
-      })
-      expect(screen.getByText('Registered new_custom.')).toBeInTheDocument()
-    })
-  })
-
   it('should refresh settings when the refresh button is clicked', async () => {
     const user = userEvent.setup()
     renderInitializers()
diff --git a/frontend/src/components/Initializers/Initializers.tsx b/frontend/src/components/Initializers/Initializers.tsx
index 7d69f15a6f..55c7547d7f 100644
--- a/frontend/src/components/Initializers/Initializers.tsx
+++ b/frontend/src/components/Initializers/Initializers.tsx
@@ -1,22 +1,15 @@
 import { useEffect, useState } from 'react'
 
-import { Button, MessageBar, MessageBarBody, Spinner, Tab, TabList, Text } from '@fluentui/react-components'
-import type { SelectTabData, SelectTabEvent } from '@fluentui/react-components'
+import { Button, MessageBar, MessageBarBody, Spinner, Text } from '@fluentui/react-components'
 import { ArrowSyncRegular } from '@fluentui/react-icons'
 
 import { initializersApi } from '@/services/api'
 import { toApiError } from '@/services/errors'
-import type {
-  CustomInitializer,
-  InitializerSettingsResponse,
-  RegisteredInitializer,
-  UpdateAdditionalInitializerRequest,
-} from '@/types'
+import type { InitializerSettingsResponse, RegisteredInitializer, UpdateAdditionalInitializerRequest } from '@/types'
 
 import AdditionalInitializers from './AdditionalInitializers'
 import AvailableInitializersDialog from './AvailableInitializersDialog'
 import BaselineInitializers from './BaselineInitializers'
-import CustomInitializers from './CustomInitializers'
 import { useInitializersStyles } from './Initializers.styles'
 
 interface StatusMessage {
@@ -24,8 +17,6 @@ interface StatusMessage {
   text: string
 }
 
-type InitializerTab = 'startup' | 'custom'
-
 const EMPTY_SETTINGS: InitializerSettingsResponse = {
   baseline: [],
   additional: [],
@@ -35,8 +26,6 @@ export default function Initializers() {
   const styles = useInitializersStyles()
   const [settings, setSettings] = useState<InitializerSettingsResponse>(EMPTY_SETTINGS)
   const [registeredInitializers, setRegisteredInitializers] = useState<RegisteredInitializer[]>([])
-  const [customInitializers, setCustomInitializers] = useState<CustomInitializer[]>([])
-  const [selectedTab, setSelectedTab] = useState<InitializerTab>('startup')
   const [loading, setLoading] = useState(true)
   const [statusMessage, setStatusMessage] = useState<StatusMessage | null>(null)
   const [refetchCount, setRefetchCount] = useState(0)
@@ -45,17 +34,14 @@ export default function Initializers() {
   const [saveErrors, setSaveErrors] = useState<Record<string, string>>({})
   const [applyingInitializerId, setApplyingInitializerId] = useState<string | null>(null)
   const [deletingInitializerId, setDeletingInitializerId] = useState<string | null>(null)
-  const [registeringCustom, setRegisteringCustom] = useState(false)
-  const [deletingCustomName, setDeletingCustomName] = useState<string | null>(null)
 
   useEffect(() => {
     let cancelled = false
 
     const loadInitializersAsync = async (): Promise<void> => {
-      const [settingsResult, registeredResult, customResult] = await Promise.allSettled([
+      const [settingsResult, registeredResult] = await Promise.allSettled([
         initializersApi.getSettings(),
         initializersApi.listRegistered(),
-        initializersApi.listCustom(),
       ])
       if (cancelled) {
         return
@@ -78,12 +64,6 @@ export default function Initializers() {
         )
       }
 
-      if (customResult.status === 'fulfilled') {
-        setCustomInitializers(customResult.value)
-      } else {
-        setStatusMessage({ intent: 'error', text: toApiError(customResult.reason).detail })
-      }
-
       setLoading(false)
     }
 
@@ -104,49 +84,6 @@ export default function Initializers() {
     setSettings(response)
   }
 
-  const refetchCustomCatalog = async (): Promise<void> => {
-    const [custom, registered] = await Promise.all([
-      initializersApi.listCustom(),
-      initializersApi.listRegistered(),
-    ])
-    setCustomInitializers(custom)
-    setRegisteredInitializers(registered.items)
-  }
-
-  const handleTabSelect = (_: SelectTabEvent, data: SelectTabData): void => {
-    if (data.value === 'startup' || data.value === 'custom') {
-      setSelectedTab(data.value)
-    }
-  }
-
-  const handleRegisterCustom = async (name: string, scriptContent: string): Promise<boolean> => {
-    setRegisteringCustom(true)
-    try {
-      await initializersApi.register({ name, script_content: scriptContent })
-      await refetchCustomCatalog()
-      setStatusMessage({ intent: 'success', text: `Registered ${name}.` })
-      return true
-    } catch (error) {
-      setStatusMessage({ intent: 'error', text: toApiError(error).detail })
-      return false
-    } finally {
-      setRegisteringCustom(false)
-    }
-  }
-
-  const handleDeleteCustom = async (name: string): Promise<void> => {
-    setDeletingCustomName(name)
-    try {
-      await initializersApi.unregister(name)
-      await refetchCustomCatalog()
-      setStatusMessage({ intent: 'success', text: `Removed ${name}.` })
-    } catch (error) {
-      setStatusMessage({ intent: 'error', text: toApiError(error).detail })
-    } finally {
-      setDeletingCustomName(null)
-    }
-  }
-
   const handleAdd = async (
     initializerName: string,
     parameters: Record<string, unknown> | null,
@@ -234,16 +171,15 @@ export default function Initializers() {
         <div className={styles.headerText}>
           <Text as="h1" size={600} weight="semibold">Initializers</Text>
           <Text size={300}>
-            Manage startup initializer invocations and persisted custom initializer definitions.
+            Browse every registered initializer, review the read-only baseline that ran at startup, and manage
+            additional initializer invocations that run after it.
           </Text>
         </div>
         <div className={styles.headerActions}>
-          {selectedTab === 'startup' && (
-            <AvailableInitializersDialog
-              registeredInitializers={registeredInitializers}
-              disabled={loading}
-            />
-          )}
+          <AvailableInitializersDialog
+            registeredInitializers={registeredInitializers}
+            disabled={loading}
+          />
           <Button
             appearance="subtle"
             icon={<ArrowSyncRegular />}
@@ -262,46 +198,31 @@ export default function Initializers() {
         </MessageBar>
       )}
 
-      <TabList selectedValue={selectedTab} onTabSelect={handleTabSelect}>
-        <Tab value="startup">Startup</Tab>
-        <Tab value="custom">Custom</Tab>
-      </TabList>
-
       {loading ? (
         <div className={styles.loadingState}>
           <Spinner label="Loading initializer settings..." />
         </div>
       ) : (
-        selectedTab === 'startup' ? (
-          <>
-            <BaselineInitializers
-              items={settings.baseline}
-              registeredInitializers={registeredInitializers}
-            />
-            <AdditionalInitializers
-              items={settings.additional}
-              registeredInitializers={registeredInitializers}
-              creating={creating}
-              savingInitializerId={savingInitializerId}
-              saveErrors={saveErrors}
-              applyingInitializerId={applyingInitializerId}
-              deletingInitializerId={deletingInitializerId}
-              onAdd={handleAdd}
-              onSave={handleSave}
-              onClearSaveError={clearSaveError}
-              onApply={handleApply}
-              onRemove={handleRemove}
-            />
-          </>
-        ) : (
-          <CustomInitializers
-            items={customInitializers}
-            registering={registeringCustom}
-            deletingName={deletingCustomName}
-            onRegister={handleRegisterCustom}
-            onDelete={handleDeleteCustom}
+        <>
+          <BaselineInitializers
+            items={settings.baseline}
+            registeredInitializers={registeredInitializers}
           />
-        )
+          <AdditionalInitializers
+            items={settings.additional}
+            registeredInitializers={registeredInitializers}
+            creating={creating}
+            savingInitializerId={savingInitializerId}
+            saveErrors={saveErrors}
+            applyingInitializerId={applyingInitializerId}
+            deletingInitializerId={deletingInitializerId}
+            onAdd={handleAdd}
+            onSave={handleSave}
+            onClearSaveError={clearSaveError}
+            onApply={handleApply}
+            onRemove={handleRemove}
+          />
+        </>
       )}
     </main>
   )
diff --git a/frontend/src/components/Sidebar/Navigation.test.tsx b/frontend/src/components/Sidebar/Navigation.test.tsx
index 17b83621a0..a0397a8c8d 100644
--- a/frontend/src/components/Sidebar/Navigation.test.tsx
+++ b/frontend/src/components/Sidebar/Navigation.test.tsx
@@ -90,6 +90,17 @@ describe("Navigation", () => {
     expect(onNavigate).toHaveBeenCalledWith("config");
   });
 
+  it("navigates to backend configuration", async () => {
+    const user = userEvent.setup();
+    const onNavigate = jest.fn();
+    renderWithProvider(
+      <Navigation {...defaultProps} onNavigate={onNavigate} />
+    );
+
+    await user.click(screen.getByRole("button", { name: "Backend Configuration" }));
+    expect(onNavigate).toHaveBeenCalledWith("backendConfig");
+  });
+
   it("renders the attack history button", () => {
     renderWithProvider(<Navigation {...defaultProps} />);
     expect(
diff --git a/frontend/src/components/Sidebar/Navigation.tsx b/frontend/src/components/Sidebar/Navigation.tsx
index bcacc9bf33..24eeeaca17 100644
--- a/frontend/src/components/Sidebar/Navigation.tsx
+++ b/frontend/src/components/Sidebar/Navigation.tsx
@@ -18,12 +18,13 @@ import {
   OpenRegular,
   WeatherMoonRegular,
   WeatherSunnyRegular,
+  DocumentSettingsRegular,
 } from '@fluentui/react-icons'
 import { useTheme } from '../../hooks/useTheme'
 import type { ThemeMode } from '../../hooks/useTheme'
 import { useNavigationStyles } from './Navigation.styles'
 
-export type ViewName = 'home' | 'chat' | 'history' | 'config' | 'initializers'
+export type ViewName = 'home' | 'chat' | 'history' | 'config' | 'initializers' | 'backendConfig'
 
 interface NavigationProps {
   currentView: ViewName
@@ -116,6 +117,17 @@ export default function Navigation({ currentView, onNavigate, onOpenFeedback }:
           onClick={() => onNavigate('initializers')}
         />
 
+        <Button
+          className={styles.navButton}
+          data-active={currentView === 'backendConfig'}
+          appearance="subtle"
+          icon={<DocumentSettingsRegular />}
+          title="Backend Configuration"
+          aria-label="Backend Configuration"
+          aria-current={currentView === 'backendConfig' ? 'page' : undefined}
+          onClick={() => onNavigate('backendConfig')}
+        />
+
       </nav>
 
       <div className={styles.spacer} />
diff --git a/frontend/src/services/api.test.ts b/frontend/src/services/api.test.ts
index a2297c25a3..4a6e173915 100644
--- a/frontend/src/services/api.test.ts
+++ b/frontend/src/services/api.test.ts
@@ -16,6 +16,8 @@ import {
   apiClient,
   healthApi,
   versionApi,
+  configurationApi,
+  initializersApi,
   targetsApi,
   attacksApi,
 } from "./api";
@@ -147,6 +149,73 @@ describe("api service", () => {
     });
   });
 
+  describe("initializersApi", () => {
+    it("should update custom initializer source", async () => {
+      const request = { script_content: "class UpdatedInitializer: pass\n" };
+      const response = { data: { initializer_name: "custom/name" } };
+      (apiClient.put as jest.Mock).mockResolvedValueOnce(response);
+
+      await expect(initializersApi.updateCustom("custom/name", request)).resolves.toEqual(response.data);
+      expect(apiClient.put).toHaveBeenCalledWith("/initializers/custom%2Fname", request);
+    });
+  });
+
+  describe("configurationApi", () => {
+    it("should read configuration content", async () => {
+      const response = {
+        data: { content: "operator: alice\n", source: "C:/Users/test/.pyrit/config.yaml" },
+      };
+      (apiClient.get as jest.Mock).mockResolvedValueOnce(response);
+
+      await expect(configurationApi.getContent()).resolves.toEqual(response.data);
+      expect(apiClient.get).toHaveBeenCalledWith("/config");
+    });
+
+    it("should update configuration content", async () => {
+      const request = { content: "operator: bob\n" };
+      const response = {
+        data: { ...request, source: "https://account.blob.core.windows.net/config/config.yaml" },
+      };
+      (apiClient.put as jest.Mock).mockResolvedValueOnce(response);
+
+      await expect(configurationApi.updateContent(request)).resolves.toEqual(response.data);
+      expect(apiClient.put).toHaveBeenCalledWith("/config", request);
+    });
+
+    it("should list environment files", async () => {
+      const response = { data: { items: [] } };
+      (apiClient.get as jest.Mock).mockResolvedValueOnce(response);
+
+      await expect(configurationApi.listEnvironmentFiles()).resolves.toEqual(response.data);
+      expect(apiClient.get).toHaveBeenCalledWith("/config/env-files");
+    });
+
+    it("should get an environment file", async () => {
+      const response = { data: { id: "akv:0", content: "KEY=value\n" } };
+      (apiClient.get as jest.Mock).mockResolvedValueOnce(response);
+
+      await expect(configurationApi.getEnvironmentFile("akv:0")).resolves.toEqual(response.data);
+      expect(apiClient.get).toHaveBeenCalledWith("/config/env-files/akv%3A0");
+    });
+
+    it("should update an environment file", async () => {
+      const request = { content: "KEY=value\n" };
+      const response = {
+        data: {
+          id: "akv:0",
+          name: "AKV: bootstrap",
+          path: "https://vault.vault.azure.net/secrets/bootstrap",
+          exists: true,
+          ...request,
+        },
+      };
+      (apiClient.put as jest.Mock).mockResolvedValueOnce(response);
+
+      await expect(configurationApi.updateEnvironmentFile("akv:0", request)).resolves.toEqual(response.data);
+      expect(apiClient.put).toHaveBeenCalledWith("/config/env-files/akv%3A0", request);
+    });
+  });
+
   describe("targetsApi", () => {
     it("should list targets with default params", async () => {
       const mockResponse = {
diff --git a/frontend/src/services/api.ts b/frontend/src/services/api.ts
index ae30142f5e..4d98938295 100644
--- a/frontend/src/services/api.ts
+++ b/frontend/src/services/api.ts
@@ -16,7 +16,7 @@ import type {
   ListRegisteredInitializersResponse,
   RegisterInitializerRequest,
   RegisteredInitializer,
-  CustomInitializer,
+  CustomInitializerListResponse,
   AdditionalInitializer,
   CreateAdditionalInitializerRequest,
   UpdateAdditionalInitializerRequest,
@@ -31,6 +31,11 @@ import type {
   CreateConversationRequest,
   CreateConversationResponse,
   ChangeMainConversationResponse,
+  ConfigurationFileContent,
+  EnvironmentFileContent,
+  EnvironmentFileListResponse,
+  UpdateConfigurationFileRequest,
+  UpdateCustomInitializerRequest,
 } from '../types'
 
 const API_BASE_URL = import.meta.env.VITE_API_URL || '/api'
@@ -151,6 +156,36 @@ export const versionApi = {
   },
 }
 
+export const configurationApi = {
+  getContent: async (): Promise<ConfigurationFileContent> => {
+    const response = await apiClient.get('/config')
+    return response.data
+  },
+
+  updateContent: async (request: UpdateConfigurationFileRequest): Promise<ConfigurationFileContent> => {
+    const response = await apiClient.put('/config', request)
+    return response.data
+  },
+
+  listEnvironmentFiles: async (): Promise<EnvironmentFileListResponse> => {
+    const response = await apiClient.get('/config/env-files')
+    return response.data
+  },
+
+  getEnvironmentFile: async (fileId: string): Promise<EnvironmentFileContent> => {
+    const response = await apiClient.get(`/config/env-files/${encodeURIComponent(fileId)}`)
+    return response.data
+  },
+
+  updateEnvironmentFile: async (
+    fileId: string,
+    request: UpdateConfigurationFileRequest,
+  ): Promise<EnvironmentFileContent> => {
+    const response = await apiClient.put(`/config/env-files/${encodeURIComponent(fileId)}`, request)
+    return response.data
+  },
+}
+
 export const targetsApi = {
   listTargetCatalog: async (): Promise<TargetCatalogResponse> => {
     const response = await apiClient.get('/targets/catalog')
@@ -218,11 +253,19 @@ export const initializersApi = {
     return response.data
   },
 
-  listCustom: async (): Promise<CustomInitializer[]> => {
+  listCustom: async (): Promise<CustomInitializerListResponse> => {
     const response = await apiClient.get('/initializers/custom')
     return response.data
   },
 
+  updateCustom: async (
+    initializerName: string,
+    request: UpdateCustomInitializerRequest,
+  ): Promise<RegisteredInitializer> => {
+    const response = await apiClient.put(`/initializers/${encodeURIComponent(initializerName)}`, request)
+    return response.data
+  },
+
   unregister: async (initializerName: string): Promise<void> => {
     await apiClient.delete(`/initializers/${encodeURIComponent(initializerName)}`)
   },
diff --git a/frontend/src/types/index.ts b/frontend/src/types/index.ts
index 25b0281d46..6b5d520bae 100644
--- a/frontend/src/types/index.ts
+++ b/frontend/src/types/index.ts
@@ -56,6 +56,27 @@ export interface PaginationInfo {
   prev_cursor?: string | null
 }
 
+export interface ConfigurationFileContent {
+  content: string
+  source: string
+}
+
+export interface UpdateConfigurationFileRequest {
+  content: string
+}
+
+export interface EnvironmentFileContent {
+  id: string
+  name: string
+  path: string
+  content: string
+  exists: boolean
+}
+
+export interface EnvironmentFileListResponse {
+  items: EnvironmentFileContent[]
+}
+
 // --- Targets ---
 
 export interface TargetCapabilities {
@@ -169,9 +190,19 @@ export interface RegisterInitializerRequest {
   script_content: string
 }
 
+export interface UpdateCustomInitializerRequest {
+  script_content: string
+}
+
 export interface CustomInitializer {
   initializer_name: string
   script_content: string
+  source: string
+}
+
+export interface CustomInitializerListResponse {
+  source: string
+  items: CustomInitializer[]
 }
 
 export interface ApplyInitializerRequest {
diff --git a/pyrit/backend/main.py b/pyrit/backend/main.py
index 5e18523ca0..570fb841cd 100644
--- a/pyrit/backend/main.py
+++ b/pyrit/backend/main.py
@@ -25,6 +25,7 @@
 from pyrit.backend.routes import (
     attacks,
     auth,
+    configuration,
     converters,
     datasets,
     health,
@@ -35,7 +36,10 @@
     targets,
     version,
 )
+from pyrit.backend.services.configuration_file_service import ConfigurationFileService
+from pyrit.backend.services.environment_file_service import EnvironmentFileService
 from pyrit.backend.services.initializer_service import get_initializer_service
+from pyrit.registry import InitializerRegistry
 from pyrit.setup.configuration_loader import ConfigurationLoader
 
 # Check for development mode from environment variable
@@ -50,14 +54,22 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
     Initialize PyRIT on startup using the config file, then yield.
 
     Config resolution order:
-    1. ``PYRIT_CONFIG_FILE`` env var (if set)
+    1. ``PYRIT_CONFIG_FILE`` local path or Azure Blob URI (if set)
     2. ``~/.pyrit/.pyrit_conf`` (if it exists)
     3. Built-in defaults (SQLite, no initializers)
     """
-    config_file_env = os.getenv("PYRIT_CONFIG_FILE")
-    config_file = Path(config_file_env) if config_file_env else None
-
-    config = ConfigurationLoader.load_with_overrides(config_file=config_file)
+    configuration_file_service = ConfigurationFileService(config_file_value=os.getenv("PYRIT_CONFIG_FILE"))
+    app.state.configuration_file_service = configuration_file_service
+    async with configuration_file_service.resolve_async() as config_file:
+        config = ConfigurationLoader.load_with_overrides(config_file=config_file)
+    resolved_env_files = config.resolve_env_files()
+    app.state.environment_file_service = EnvironmentFileService(
+        resolved_env_files=list(resolved_env_files) if resolved_env_files is not None else None,
+        env_akv_ref=config.resolve_env_akv_ref(),
+        env_akv_strict=config.env_akv_strict,
+    )
+    initializer_registry = InitializerRegistry.get_registry_singleton()
+    initializer_registry.configure_custom_scripts_source(config.custom_initializers_source)
     await config.initialize_pyrit_async()
 
     # Persisted additional initializers run after the .pyrit_conf baseline, in stored order.
@@ -71,7 +83,7 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
     ]
     initializer_service = get_initializer_service()
     if config.allow_custom_initializers:
-        await initializer_service.register_persisted_custom_initializers_async()
+        await initializer_service.restore_custom_initializers_async()
     await initializer_service.run_additional_initializers_async(
         allow_custom_initializers=config.allow_custom_initializers
     )
@@ -137,6 +149,7 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
 
 # Include API routes
 app.include_router(attacks.router, prefix="/api", tags=["attacks"])
+app.include_router(configuration.router, prefix="/api", tags=["config"])
 app.include_router(targets.router, prefix="/api", tags=["targets"])
 app.include_router(converters.router, prefix="/api", tags=["converters"])
 app.include_router(datasets.router, prefix="/api", tags=["datasets"])
diff --git a/pyrit/backend/models/configuration.py b/pyrit/backend/models/configuration.py
new file mode 100644
index 0000000000..905448c008
--- /dev/null
+++ b/pyrit/backend/models/configuration.py
@@ -0,0 +1,41 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+"""Configuration file API models."""
+
+from pydantic import BaseModel, Field
+
+
+class ConfigurationFileContent(BaseModel):
+    """Raw UTF-8 contents of the backend configuration file."""
+
+    content: str = Field(..., description="Raw YAML configuration file contents")
+    source: str = Field(..., description="Configuration file path or credential-free blob URI")
+
+
+class UpdateConfigurationFileRequest(BaseModel):
+    """Replacement contents for the backend configuration file."""
+
+    content: str = Field(..., description="Raw YAML configuration file contents")
+
+
+class EnvironmentFileContent(BaseModel):
+    """An environment file available to the backend."""
+
+    id: str = Field(..., description="Stable identifier used to update this file")
+    name: str = Field(..., description="Environment file name")
+    path: str = Field(..., description="Resolved environment file path")
+    content: str = Field(..., description="Raw dotenv file contents")
+    exists: bool = Field(..., description="Whether the environment file currently exists")
+
+
+class EnvironmentFileListResponse(BaseModel):
+    """Environment files configured for the backend."""
+
+    items: list[EnvironmentFileContent] = Field(..., description="Environment files in load order")
+
+
+class UpdateEnvironmentFileRequest(BaseModel):
+    """Replacement contents for an environment file."""
+
+    content: str = Field(..., description="Raw dotenv file contents")
diff --git a/pyrit/backend/models/initializers.py b/pyrit/backend/models/initializers.py
index f1a304b1c8..707148a18a 100644
--- a/pyrit/backend/models/initializers.py
+++ b/pyrit/backend/models/initializers.py
@@ -23,10 +23,13 @@
     "ApplyInitializerResponse",
     "BaselineInitializerSetting",
     "CreateAdditionalInitializerRequest",
+    "CustomInitializerListResponse",
+    "CustomInitializerResponse",
     "InitializerSettingsResponse",
     "ListRegisteredInitializersResponse",
     "RegisterInitializerRequest",
     "UpdateAdditionalInitializerRequest",
+    "UpdateCustomInitializerRequest",
 ]
 
 
@@ -48,6 +51,30 @@ class RegisterInitializerRequest(BaseModel):
     script_content: str = Field(..., description="Python source code containing a PyRITInitializer subclass")
 
 
+class UpdateCustomInitializerRequest(BaseModel):
+    """Request body for replacing a custom initializer's Python source."""
+
+    script_content: str = Field(..., description="Replacement Python source containing a PyRITInitializer subclass")
+
+
+class CustomInitializerResponse(BaseModel):
+    """Stored custom initializer source returned by the backend API."""
+
+    initializer_name: str = Field(..., description="Initializer registry name.")
+    script_content: str = Field(..., description="Stored Python source code.")
+    source: str = Field(..., description="Credential-free local file path or Azure Blob URI.")
+
+
+class CustomInitializerListResponse(BaseModel):
+    """Custom initializer storage source and its Python definitions."""
+
+    source: str = Field(
+        ...,
+        description="Credential-free local directory or Azure Blob container URI with an optional blob prefix.",
+    )
+    items: list[CustomInitializerResponse] = Field(..., description="Stored custom initializer definitions.")
+
+
 class BaselineInitializerSetting(BaseModel):
     """A read-only baseline initializer entry, referencing its registry definition by name."""
 
diff --git a/pyrit/backend/pyrit_backend.py b/pyrit/backend/pyrit_backend.py
index 6c792f383d..43935e648f 100644
--- a/pyrit/backend/pyrit_backend.py
+++ b/pyrit/backend/pyrit_backend.py
@@ -8,7 +8,7 @@
 handled by the FastAPI lifespan in ``pyrit.backend.main``.  This CLI simply
 parses host/port/config-file/log-level/reload and starts uvicorn.
 
-The config file path is forwarded to the app via the ``PYRIT_CONFIG_FILE``
+The config file source is forwarded to the app via the ``PYRIT_CONFIG_FILE``
 environment variable.
 """
 
@@ -16,10 +16,14 @@
 import os
 import sys
 from argparse import ArgumentParser, Namespace, RawDescriptionHelpFormatter
-from pathlib import Path
 
 from pyrit.common.cli_helpers import CONFIG_FILE_HELP, validate_log_level_argparse
 
+_BACKEND_CONFIG_FILE_HELP = CONFIG_FILE_HELP.replace(
+    "Path to a YAML configuration file.",
+    "Local path or Azure Blob URI for a YAML configuration file.",
+)
+
 
 def parse_args(*, args: list[str] | None = None) -> Namespace:
     """
@@ -42,6 +46,9 @@ def parse_args(*, args: list[str] | None = None) -> Namespace:
   # Start with a custom config file
   pyrit_backend --config-file ./my_config.yaml
 
+    # Start with a config file stored in Azure Blob Storage
+    pyrit_backend --config-file https://account.blob.core.windows.net/config/.pyrit_conf
+
   # Start with custom port and host
   pyrit_backend --host 0.0.0.0 --port 8080
 
@@ -67,8 +74,8 @@ def parse_args(*, args: list[str] | None = None) -> Namespace:
 
     parser.add_argument(
         "--config-file",
-        type=Path,
-        help=CONFIG_FILE_HELP,
+        type=str,
+        help=_BACKEND_CONFIG_FILE_HELP,
     )
 
     parser.add_argument(
diff --git a/pyrit/backend/routes/configuration.py b/pyrit/backend/routes/configuration.py
new file mode 100644
index 0000000000..3606870c53
--- /dev/null
+++ b/pyrit/backend/routes/configuration.py
@@ -0,0 +1,163 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+"""Backend configuration file API routes."""
+
+import os
+
+from azure.core.exceptions import ResourceNotFoundError
+from fastapi import APIRouter, HTTPException, Request, status
+
+from pyrit.backend.models.common import ProblemDetail
+from pyrit.backend.models.configuration import (
+    ConfigurationFileContent,
+    EnvironmentFileContent,
+    EnvironmentFileListResponse,
+    UpdateConfigurationFileRequest,
+    UpdateEnvironmentFileRequest,
+)
+from pyrit.backend.services.configuration_file_service import ConfigurationFileService
+from pyrit.backend.services.environment_file_service import EnvironmentFileService
+
+router = APIRouter(prefix="/config", tags=["config"])
+
+
+def _get_configuration_file_service(request: Request) -> ConfigurationFileService:
+    """
+    Get the configuration file service associated with backend startup.
+
+    Returns:
+        ConfigurationFileService: The active configuration file service.
+    """
+    service = getattr(request.app.state, "configuration_file_service", None)
+    if isinstance(service, ConfigurationFileService):
+        return service
+    return ConfigurationFileService(config_file_value=os.getenv("PYRIT_CONFIG_FILE"))
+
+
+def _get_environment_file_service(request: Request) -> EnvironmentFileService:
+    """
+    Get the environment file service created during backend startup.
+
+    Returns:
+        EnvironmentFileService: The active environment file service.
+
+    Raises:
+        HTTPException: If backend startup did not initialize the service.
+    """
+    service = getattr(request.app.state, "environment_file_service", None)
+    if not isinstance(service, EnvironmentFileService):
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="Environment file configuration is unavailable",
+        )
+    return service
+
+
+@router.get(
+    "",
+    response_model=ConfigurationFileContent,
+    responses={404: {"model": ProblemDetail, "description": "Configuration file not found"}},
+)
+async def get_configuration_file(  # pyrit-async-suffix-exempt
+    request: Request,
+) -> ConfigurationFileContent:
+    """
+    Read the backend configuration file or blob.
+
+    Returns:
+        ConfigurationFileContent: The raw YAML configuration contents.
+    """
+    service = _get_configuration_file_service(request)
+    try:
+        content = await service.read_async()
+    except (FileNotFoundError, ResourceNotFoundError) as exc:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Configuration file not found") from exc
+    return ConfigurationFileContent(content=content, source=service.source)
+
+
+@router.put(
+    "",
+    response_model=ConfigurationFileContent,
+    responses={404: {"model": ProblemDetail, "description": "Configuration file not found"}},
+)
+async def update_configuration_file(  # pyrit-async-suffix-exempt
+    body: UpdateConfigurationFileRequest,
+    request: Request,
+) -> ConfigurationFileContent:
+    """
+    Replace the backend configuration file or blob contents.
+
+    Changes take effect the next time the backend starts.
+
+    Returns:
+        ConfigurationFileContent: The persisted YAML configuration contents.
+    """
+    service = _get_configuration_file_service(request)
+    try:
+        await service.read_async()
+        await service.update_async(body.content)
+    except (FileNotFoundError, ResourceNotFoundError) as exc:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Configuration file not found") from exc
+    return ConfigurationFileContent(content=body.content, source=service.source)
+
+
+@router.get("/env-files", response_model=EnvironmentFileListResponse)
+async def list_environment_files(  # pyrit-async-suffix-exempt
+    request: Request,
+) -> EnvironmentFileListResponse:
+    """
+    Read environment files selected by the active backend configuration.
+
+    Returns:
+        EnvironmentFileListResponse: Environment files in effective load order.
+    """
+    items = await _get_environment_file_service(request).list_async()
+    return EnvironmentFileListResponse(items=items)
+
+
+@router.get(
+    "/env-files/{file_id}",
+    response_model=EnvironmentFileContent,
+    responses={404: {"model": ProblemDetail, "description": "Environment file not found"}},
+)
+async def get_environment_file(  # pyrit-async-suffix-exempt
+    file_id: str,
+    request: Request,
+) -> EnvironmentFileContent:
+    """
+    Read one environment source selected by backend configuration.
+
+    Returns:
+        EnvironmentFileContent: The selected environment source and its contents.
+    """
+    try:
+        return await _get_environment_file_service(request).read_async(file_id=file_id)
+    except KeyError as exc:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Environment file not found") from exc
+
+
+@router.put(
+    "/env-files/{file_id}",
+    response_model=EnvironmentFileContent,
+    responses={404: {"model": ProblemDetail, "description": "Environment file not found"}},
+)
+async def update_environment_file(  # pyrit-async-suffix-exempt
+    file_id: str,
+    body: UpdateEnvironmentFileRequest,
+    request: Request,
+) -> EnvironmentFileContent:
+    """
+    Replace one environment file selected by backend configuration.
+
+    Changes take effect the next time the backend starts.
+
+    Returns:
+        EnvironmentFileContent: The persisted environment file.
+    """
+    try:
+        return await _get_environment_file_service(request).update_async(file_id=file_id, content=body.content)
+    except KeyError as exc:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Environment file not found") from exc
+    except ValueError as exc:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(exc)) from exc
diff --git a/pyrit/backend/routes/initializers.py b/pyrit/backend/routes/initializers.py
index ef0cff21ce..b34850ea40 100644
--- a/pyrit/backend/routes/initializers.py
+++ b/pyrit/backend/routes/initializers.py
@@ -26,13 +26,15 @@
     ApplyInitializerResponse,
     BaselineInitializerSetting,
     CreateAdditionalInitializerRequest,
+    CustomInitializerListResponse,
     InitializerSettingsResponse,
     ListRegisteredInitializersResponse,
     RegisterInitializerRequest,
     UpdateAdditionalInitializerRequest,
+    UpdateCustomInitializerRequest,
 )
 from pyrit.backend.services.initializer_service import get_initializer_service
-from pyrit.models import AdditionalInitializer, CustomInitializer
+from pyrit.models import AdditionalInitializer
 from pyrit.models.catalog.initializer import RegisteredInitializer
 
 router = APIRouter(prefix="/initializers", tags=["initializers"])
@@ -251,17 +253,21 @@ async def apply_initializer(  # pyrit-async-suffix-exempt
 
 @router.get(
     "/custom",
-    response_model=list[CustomInitializer],
+    response_model=CustomInitializerListResponse,
 )
-async def list_custom_initializers() -> list[CustomInitializer]:  # pyrit-async-suffix-exempt
+async def list_custom_initializers(request: Request) -> CustomInitializerListResponse:  # pyrit-async-suffix-exempt
     """
-    List user-defined initializer source persisted in Central Memory.
+    List user-defined initializer source from configured script storage.
+
+    Args:
+        request: The incoming FastAPI request.
 
     Returns:
-        list[CustomInitializer]: Persisted custom initializer definitions.
+        CustomInitializerListResponse: Storage source and stored custom initializer definitions.
     """
+    _check_custom_initializers_allowed(request)
     service = get_initializer_service()
-    return list(await service.list_custom_initializers_async())
+    return await service.list_custom_initializers_async()
 
 
 @router.get(
@@ -331,6 +337,44 @@ async def register_initializer(  # pyrit-async-suffix-exempt
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=detail) from None
 
 
+@router.put(
+    "/{initializer_name}",
+    response_model=RegisteredInitializer,
+    responses={
+        400: {"model": ProblemDetail, "description": "Invalid initializer source"},
+        403: {"model": ProblemDetail, "description": "Custom initializer operations disabled"},
+        404: {"model": ProblemDetail, "description": "Initializer not found"},
+    },
+)
+async def update_initializer(  # pyrit-async-suffix-exempt
+    request: Request,
+    initializer_name: str,
+    body: UpdateCustomInitializerRequest,
+) -> RegisteredInitializer:
+    """
+    Replace a custom initializer's stored Python source.
+
+    Args:
+        request: The incoming FastAPI request.
+        initializer_name: Registry name of the custom initializer.
+        body: Replacement Python source.
+
+    Returns:
+        RegisteredInitializer: Updated initializer metadata.
+    """
+    _check_custom_initializers_allowed(request)
+    service = get_initializer_service()
+    try:
+        return await service.update_initializer_async(name=initializer_name, script_content=body.script_content)
+    except KeyError:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail=f"Initializer '{initializer_name}' not found",
+        ) from None
+    except ValueError as error:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(error)) from None
+
+
 @router.delete(
     "/{initializer_name}",
     status_code=status.HTTP_204_NO_CONTENT,
diff --git a/pyrit/backend/services/configuration_file_service.py b/pyrit/backend/services/configuration_file_service.py
new file mode 100644
index 0000000000..edcb78395a
--- /dev/null
+++ b/pyrit/backend/services/configuration_file_service.py
@@ -0,0 +1,180 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+"""Read, update, and locally materialize the backend configuration file."""
+
+import asyncio
+import logging
+import tempfile
+import time
+from collections.abc import AsyncGenerator
+from contextlib import asynccontextmanager
+from pathlib import Path
+from urllib.parse import parse_qs, urlparse
+
+import aiofiles
+
+from pyrit.setup.configuration_loader import ConfigurationLoader
+
+_CACHE_TTL_SECONDS = 10.0
+logger = logging.getLogger(__name__)
+
+
+def _is_azure_blob_uri(value: str) -> bool:
+    """Return whether a value is an Azure Blob Storage HTTPS URI."""
+    parsed_uri = urlparse(value)
+    return (
+        parsed_uri.scheme == "https"
+        and parsed_uri.hostname is not None
+        and ".blob." in parsed_uri.hostname
+        and len(parsed_uri.path.strip("/").split("/")) >= 2
+    )
+
+
+async def _download_blob_config_async(blob_uri: str) -> bytes:
+    """
+    Download configuration content from an Azure Blob Storage URI.
+
+    Returns:
+        bytes: The downloaded configuration content.
+    """
+    from azure.identity.aio import DefaultAzureCredential
+    from azure.storage.blob.aio import BlobClient
+
+    parsed_uri = urlparse(blob_uri)
+    if "sig" in parse_qs(parsed_uri.query):
+        async with BlobClient.from_blob_url(blob_url=blob_uri) as blob_client:
+            blob_stream = await blob_client.download_blob()
+            return bytes(await blob_stream.readall())
+
+    async with DefaultAzureCredential() as credential:
+        async with BlobClient.from_blob_url(blob_url=blob_uri, credential=credential) as blob_client:
+            blob_stream = await blob_client.download_blob()
+            return bytes(await blob_stream.readall())
+
+
+async def _upload_blob_config_async(*, blob_uri: str, content: bytes) -> None:
+    """Upload configuration content to an Azure Blob Storage URI."""
+    from azure.identity.aio import DefaultAzureCredential
+    from azure.storage.blob.aio import BlobClient
+
+    parsed_uri = urlparse(blob_uri)
+    if "sig" in parse_qs(parsed_uri.query):
+        async with BlobClient.from_blob_url(blob_url=blob_uri) as blob_client:
+            await blob_client.upload_blob(content, overwrite=True)
+        return
+
+    async with DefaultAzureCredential() as credential:
+        async with BlobClient.from_blob_url(blob_url=blob_uri, credential=credential) as blob_client:
+            await blob_client.upload_blob(content, overwrite=True)
+
+
+def _write_temporary_config_file(*, content: bytes, suffix: str) -> Path:
+    """
+    Write configuration content to a temporary file.
+
+    Returns:
+        Path: The path to the temporary file.
+    """
+    with tempfile.NamedTemporaryFile(delete=False, suffix=suffix) as temporary_file:
+        temporary_file.write(content)
+        return Path(temporary_file.name)
+
+
+class ConfigurationFileService:
+    """Manage the configuration source used by the backend."""
+
+    def __init__(self, *, config_file_value: str | None) -> None:
+        """Initialize the service with an explicit source or the default configuration path."""
+        self._config_file_value = config_file_value
+        self._source = config_file_value or str(ConfigurationLoader.get_default_config_path())
+        self._cached_content: str | None = None
+        self._cache_expires_at = 0.0
+        self._cache_lock = asyncio.Lock()
+        self._refresh_task: asyncio.Task[None] | None = None
+
+    @property
+    def source(self) -> str:
+        """Configuration source without blob credentials."""
+        if _is_azure_blob_uri(self._source):
+            parsed_uri = urlparse(self._source)
+            return parsed_uri._replace(query="", fragment="").geturl()
+        return self._source
+
+    async def read_async(self) -> str:
+        """
+        Read the current configuration contents.
+
+        Returns:
+            str: The UTF-8 configuration contents.
+        """
+        if self._cached_content is not None:
+            if time.monotonic() >= self._cache_expires_at and (self._refresh_task is None or self._refresh_task.done()):
+                self._refresh_task = asyncio.create_task(self._refresh_in_background_async())
+            return self._cached_content
+
+        return await self._refresh_cache_async(force=False)
+
+    async def _refresh_cache_async(self, *, force: bool) -> str:
+        """
+        Read the source and replace the cached content.
+
+        Returns:
+            str: The current configuration contents.
+        """
+        async with self._cache_lock:
+            if not force and self._cached_content is not None:
+                return self._cached_content
+
+            if _is_azure_blob_uri(self._source):
+                content = (await _download_blob_config_async(self._source)).decode("utf-8")
+            else:
+                async with aiofiles.open(self._source, encoding="utf-8") as config_file:
+                    content = await config_file.read()
+
+            self._cached_content = content
+            self._cache_expires_at = time.monotonic() + _CACHE_TTL_SECONDS
+            return content
+
+    async def _refresh_in_background_async(self) -> None:
+        """Refresh an expired cache without delaying the current request."""
+        try:
+            await self._refresh_cache_async(force=True)
+        except Exception:
+            logger.warning("Failed to refresh configuration file cache", exc_info=True)
+
+    async def update_async(self, content: str) -> None:
+        """Replace the current configuration contents."""
+        async with self._cache_lock:
+            if _is_azure_blob_uri(self._source):
+                await _upload_blob_config_async(blob_uri=self._source, content=content.encode("utf-8"))
+            else:
+                async with aiofiles.open(self._source, mode="w", encoding="utf-8") as config_file:
+                    await config_file.write(content)
+
+            self._cached_content = content
+            self._cache_expires_at = time.monotonic() + _CACHE_TTL_SECONDS
+
+    @asynccontextmanager
+    async def resolve_async(self) -> AsyncGenerator[Path | None, None]:
+        """
+        Resolve the configuration source to a local path.
+
+        Yields:
+            Path | None: The explicit local configuration path, or None to use loader defaults.
+        """
+        if self._config_file_value is None:
+            yield None
+            return
+
+        if not _is_azure_blob_uri(self._source):
+            yield Path(self._source)
+            return
+
+        content = (await self.read_async()).encode("utf-8")
+        suffix = Path(urlparse(self._source).path).suffix
+        temporary_path = await asyncio.to_thread(_write_temporary_config_file, content=content, suffix=suffix)
+        try:
+            yield temporary_path
+        finally:
+            await asyncio.to_thread(temporary_path.unlink, missing_ok=True)
diff --git a/pyrit/backend/services/environment_file_service.py b/pyrit/backend/services/environment_file_service.py
new file mode 100644
index 0000000000..c9b0cd3aee
--- /dev/null
+++ b/pyrit/backend/services/environment_file_service.py
@@ -0,0 +1,241 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+"""Read and update environment files selected by backend configuration."""
+
+import asyncio
+import logging
+import time
+from pathlib import Path
+
+import aiofiles
+
+from pyrit.backend.models.configuration import EnvironmentFileContent
+from pyrit.common.path import CONFIGURATION_DIRECTORY_PATH
+from pyrit.setup.environment_loading import (
+    _create_akv_secret_client,
+    _fetch_akv_document_async,
+    _parse_akv_secret_url,
+    _validate_dotenv_document,
+)
+
+_CACHE_TTL_SECONDS = 10.0
+logger = logging.getLogger(__name__)
+
+
+async def _update_akv_document_async(*, secret_url: str, content: str, strict: bool) -> str:
+    """
+    Create a new current version of an AKV bootstrap dotenv secret.
+
+    Returns:
+        str: The validated content persisted to Key Vault.
+    """
+    from azure.identity.aio import DefaultAzureCredential
+
+    vault_url, secret_name, secret_version = _parse_akv_secret_url(secret_url)
+    if secret_version is not None:
+        raise ValueError("Versioned Azure Key Vault environment sources are read-only")
+
+    validated_content = _validate_dotenv_document(content, strict=strict, silent=True)
+    async with DefaultAzureCredential() as credential:
+        async with _create_akv_secret_client(vault_url=vault_url, credential=credential) as client:
+            await client.set_secret(secret_name, validated_content)
+    return validated_content
+
+
+class EnvironmentFileService:
+    """Manage environment files using PyRIT's resolved loading semantics."""
+
+    def __init__(
+        self,
+        *,
+        resolved_env_files: list[Path] | None,
+        env_akv_ref: list[str] | None = None,
+        env_akv_strict: bool = True,
+    ) -> None:
+        """Initialize from ``ConfigurationLoader.resolve_env_files()`` output."""
+        self._akv_refs = env_akv_ref or []
+        self._env_akv_strict = env_akv_strict
+        self._paths = (
+            [CONFIGURATION_DIRECTORY_PATH / ".env", CONFIGURATION_DIRECTORY_PATH / ".env.local"]
+            if resolved_env_files is None
+            else resolved_env_files
+        )
+        self._content_cache: dict[str, tuple[float, EnvironmentFileContent]] = {}
+        self._cache_lock = asyncio.Lock()
+        self._refresh_tasks: dict[str, asyncio.Task[None]] = {}
+
+    async def list_async(self) -> list[EnvironmentFileContent]:
+        """
+        List configured environment sources in load order without reading contents.
+
+        Returns:
+            list[EnvironmentFileContent]: Configured environment source metadata.
+        """
+        items: list[EnvironmentFileContent] = []
+        for index, secret_url in enumerate(self._akv_refs):
+            _, secret_name, _ = _parse_akv_secret_url(secret_url)
+            items.append(
+                EnvironmentFileContent(
+                    id=f"akv:{index}",
+                    name=f"AKV: {secret_name}",
+                    path=secret_url,
+                    content="",
+                    exists=True,
+                )
+            )
+
+        exists_values = await asyncio.gather(*(asyncio.to_thread(path.exists) for path in self._paths))
+        for index, (path, exists) in enumerate(zip(self._paths, exists_values, strict=True)):
+            items.append(
+                EnvironmentFileContent(
+                    id=str(index),
+                    name=path.name,
+                    path=str(path),
+                    content="",
+                    exists=exists,
+                )
+            )
+        return items
+
+    async def read_async(self, *, file_id: str) -> EnvironmentFileContent:
+        """
+        Read one configured environment source.
+
+        Returns:
+            EnvironmentFileContent: The selected source and its current contents.
+
+        Raises:
+            KeyError: If the identifier does not name a configured environment source.
+        """
+        cached = self._content_cache.get(file_id)
+        if cached is not None:
+            if time.monotonic() >= cached[0] and file_id not in self._refresh_tasks:
+                self._refresh_tasks[file_id] = asyncio.create_task(self._refresh_in_background_async(file_id=file_id))
+            return cached[1].model_copy()
+
+        return await self._refresh_cache_async(file_id=file_id, force=False)
+
+    async def _refresh_cache_async(self, *, file_id: str, force: bool) -> EnvironmentFileContent:
+        """
+        Read one source and replace its cached content.
+
+        Returns:
+            EnvironmentFileContent: The selected source and its current contents.
+        """
+        async with self._cache_lock:
+            cached = self._content_cache.get(file_id)
+            if not force and cached is not None:
+                return cached[1].model_copy()
+
+            if file_id.startswith("akv:"):
+                try:
+                    index = int(file_id.removeprefix("akv:"))
+                    secret_url = self._akv_refs[index]
+                except (ValueError, IndexError):
+                    raise KeyError(file_id) from None
+                if index < 0:
+                    raise KeyError(file_id)
+
+                content, _ = await _fetch_akv_document_async(
+                    secret_url=secret_url,
+                    strict=self._env_akv_strict,
+                    silent=True,
+                )
+                _, secret_name, _ = _parse_akv_secret_url(secret_url)
+                item = EnvironmentFileContent(
+                    id=file_id,
+                    name=f"AKV: {secret_name}",
+                    path=secret_url,
+                    content=content,
+                    exists=True,
+                )
+            else:
+                try:
+                    index = int(file_id)
+                    path = self._paths[index]
+                except (ValueError, IndexError):
+                    raise KeyError(file_id) from None
+                if index < 0:
+                    raise KeyError(file_id)
+
+                exists = await asyncio.to_thread(path.exists)
+                content = ""
+                if exists:
+                    async with aiofiles.open(path, encoding="utf-8") as environment_file:
+                        content = await environment_file.read()
+                item = EnvironmentFileContent(
+                    id=file_id,
+                    name=path.name,
+                    path=str(path),
+                    content=content,
+                    exists=exists,
+                )
+
+            self._content_cache[file_id] = (time.monotonic() + _CACHE_TTL_SECONDS, item)
+            return item.model_copy()
+
+    async def _refresh_in_background_async(self, *, file_id: str) -> None:
+        """Refresh an expired source without delaying the current request."""
+        try:
+            await self._refresh_cache_async(file_id=file_id, force=True)
+        except Exception:
+            logger.warning("Failed to refresh environment source %s", file_id, exc_info=True)
+        finally:
+            self._refresh_tasks.pop(file_id, None)
+
+    async def update_async(self, *, file_id: str, content: str) -> EnvironmentFileContent:
+        """
+        Replace one configured environment file by its stable identifier.
+
+        Returns:
+            EnvironmentFileContent: The updated environment file.
+
+        Raises:
+            KeyError: If the identifier does not name a configured environment file.
+        """
+        async with self._cache_lock:
+            if file_id.startswith("akv:"):
+                try:
+                    index = int(file_id.removeprefix("akv:"))
+                    secret_url = self._akv_refs[index]
+                except (ValueError, IndexError):
+                    raise KeyError(file_id) from None
+                if index < 0:
+                    raise KeyError(file_id)
+
+                persisted_content = await _update_akv_document_async(
+                    secret_url=secret_url,
+                    content=content,
+                    strict=self._env_akv_strict,
+                )
+                _, secret_name, _ = _parse_akv_secret_url(secret_url)
+                item = EnvironmentFileContent(
+                    id=file_id,
+                    name=f"AKV: {secret_name}",
+                    path=secret_url,
+                    content=persisted_content,
+                    exists=True,
+                )
+            else:
+                try:
+                    index = int(file_id)
+                    path = self._paths[index]
+                except (ValueError, IndexError):
+                    raise KeyError(file_id) from None
+                if index < 0:
+                    raise KeyError(file_id)
+
+                await asyncio.to_thread(path.parent.mkdir, parents=True, exist_ok=True)
+                async with aiofiles.open(path, mode="w", encoding="utf-8") as environment_file:
+                    await environment_file.write(content)
+                item = EnvironmentFileContent(
+                    id=file_id,
+                    name=path.name,
+                    path=str(path),
+                    content=content,
+                    exists=True,
+                )
+
+            self._content_cache[file_id] = (time.monotonic() + _CACHE_TTL_SECONDS, item)
+            return item.model_copy()
diff --git a/pyrit/backend/services/initializer_service.py b/pyrit/backend/services/initializer_service.py
index a2f5e1d764..d9f762abed 100644
--- a/pyrit/backend/services/initializer_service.py
+++ b/pyrit/backend/services/initializer_service.py
@@ -12,6 +12,7 @@
 
 import asyncio
 import logging
+import time
 from collections.abc import Sequence
 from functools import lru_cache
 from typing import Any
@@ -21,16 +22,19 @@
     AdditionalInitializerSetting,
     ApplyInitializerResponse,
     BaselineInitializerSetting,
+    CustomInitializerListResponse,
+    CustomInitializerResponse,
     InitializerSettingsResponse,
     ListRegisteredInitializersResponse,
 )
 from pyrit.memory import CentralMemory
-from pyrit.models import AdditionalInitializer, CustomInitializer
+from pyrit.models import AdditionalInitializer
 from pyrit.models.catalog.initializer import RegisteredInitializer
 from pyrit.registry import InitializerMetadata, InitializerRegistry
 from pyrit.setup.pyrit_initializer import PyRITInitializer
 
 logger = logging.getLogger(__name__)
+_CUSTOM_CACHE_TTL_SECONDS = 10.0
 
 
 def _metadata_to_registered_initializer(metadata: InitializerMetadata) -> RegisteredInitializer:
@@ -64,6 +68,10 @@ def __init__(self) -> None:
         """Initialize the initializer service."""
         self._registry = InitializerRegistry.get_registry_singleton()
         self._memory = CentralMemory.get_memory_instance()
+        self._custom_initializers_cache: CustomInitializerListResponse | None = None
+        self._custom_cache_expires_at = 0.0
+        self._custom_cache_lock = asyncio.Lock()
+        self._custom_refresh_task: asyncio.Task[None] | None = None
 
     async def list_initializers_async(
         self,
@@ -260,7 +268,7 @@ async def run_additional_initializers_async(self, *, allow_custom_initializers:
         When custom initializers are disabled, only built-in initializers are run.
 
         Args:
-            allow_custom_initializers: Whether persisted custom initializers may run.
+            allow_custom_initializers: Whether stored custom initializers may run.
 
         Failures are isolated per initializer: a persisted row that fails to build, validate, or
         initialize (e.g. a missing required environment variable) is logged and skipped so one bad
@@ -309,44 +317,99 @@ async def register_initializer_async(
             RegisteredInitializer: The newly registered initializer summary.
         """
         await asyncio.to_thread(
-            self._register_and_persist_initializer,
+            self._registry.register_from_content,
             name=name,
             script_content=script_content,
         )
+        self._invalidate_custom_initializers_cache()
 
         initializer = await self.get_initializer_async(initializer_name=name)
         if not initializer:
             raise ValueError(f"Initializer '{name}' was registered but metadata could not be retrieved.")
         return initializer
 
-    async def list_custom_initializers_async(self) -> Sequence[CustomInitializer]:
+    async def update_initializer_async(
+        self,
+        *,
+        name: str,
+        script_content: str,
+    ) -> RegisteredInitializer:
         """
-        List persisted custom initializer source definitions.
+        Validate and replace a stored custom initializer definition.
+
+        Args:
+            name: Registry name of the custom initializer.
+            script_content: Replacement Python source code.
 
         Returns:
-            Sequence[CustomInitializer]: Persisted custom initializer definitions.
+            RegisteredInitializer: Updated initializer metadata.
         """
-        return await asyncio.to_thread(self._memory.get_custom_initializers)
+        await asyncio.to_thread(self._registry.update_from_content, name=name, script_content=script_content)
+        self._invalidate_custom_initializers_cache()
+        initializer = await self.get_initializer_async(initializer_name=name)
+        if not initializer:
+            raise ValueError(f"Initializer '{name}' was updated but metadata could not be retrieved.")
+        return initializer
 
-    async def register_persisted_custom_initializers_async(self) -> None:
-        """Restore persisted custom initializer definitions into the runtime registry."""
-        custom_initializers = await asyncio.to_thread(self._memory.get_custom_initializers)
-        if not custom_initializers:
-            return
+    async def list_custom_initializers_async(self) -> CustomInitializerListResponse:
+        """
+        List stored custom initializer source definitions and their storage source.
 
-        logger.info("Registering %d persisted custom initializer(s)...", len(custom_initializers))
-        for initializer in custom_initializers:
-            try:
-                await asyncio.to_thread(
-                    self._registry.register_from_content,
-                    name=initializer.initializer_name,
-                    script_content=initializer.script_content,
-                )
-            except Exception:
-                logger.exception(
-                    "Skipping persisted custom initializer '%s': registration failed.",
-                    initializer.initializer_name,
-                )
+        Returns:
+            CustomInitializerListResponse: Credential-free source and stored definitions.
+        """
+        if self._custom_initializers_cache is not None:
+            if time.monotonic() >= self._custom_cache_expires_at and (
+                self._custom_refresh_task is None or self._custom_refresh_task.done()
+            ):
+                self._custom_refresh_task = asyncio.create_task(self._refresh_custom_cache_in_background_async())
+            return self._custom_initializers_cache.model_copy(deep=True)
+
+        return await self._refresh_custom_cache_async(force=False)
+
+    async def _refresh_custom_cache_async(self, *, force: bool) -> CustomInitializerListResponse:
+        """
+        Read custom initializer storage and replace the cached response.
+
+        Returns:
+            CustomInitializerListResponse: The current stored custom initializers.
+        """
+        async with self._custom_cache_lock:
+            if not force and self._custom_initializers_cache is not None:
+                return self._custom_initializers_cache.model_copy(deep=True)
+
+            sources = await asyncio.to_thread(self._registry.list_custom_initializer_sources)
+            response = CustomInitializerListResponse(
+                source=self._registry.custom_scripts_source,
+                items=[
+                    CustomInitializerResponse(
+                        initializer_name=name,
+                        script_content=script_content,
+                        source=self._registry.get_custom_initializer_source(name),
+                    )
+                    for name, script_content in sources.items()
+                ],
+            )
+            self._custom_initializers_cache = response
+            self._custom_cache_expires_at = time.monotonic() + _CUSTOM_CACHE_TTL_SECONDS
+            return response.model_copy(deep=True)
+
+    async def _refresh_custom_cache_in_background_async(self) -> None:
+        """Refresh expired custom initializer data without delaying the request."""
+        try:
+            await self._refresh_custom_cache_async(force=True)
+        except Exception:
+            logger.warning("Failed to refresh custom initializer cache", exc_info=True)
+
+    def _invalidate_custom_initializers_cache(self) -> None:
+        """Invalidate custom initializer data after a successful mutation."""
+        self._custom_initializers_cache = None
+        self._custom_cache_expires_at = 0.0
+
+    async def restore_custom_initializers_async(self) -> None:
+        """Restore stored custom initializer definitions into the runtime registry."""
+        await self._refresh_custom_cache_async(force=True)
+        await asyncio.to_thread(self._registry.restore_custom_initializers)
 
     async def unregister_initializer_async(self, *, initializer_name: str) -> None:
         """
@@ -362,23 +425,9 @@ async def unregister_initializer_async(self, *, initializer_name: str) -> None:
             )
 
         await asyncio.to_thread(self._registry.unregister_and_cleanup, initializer_name)
-        await asyncio.to_thread(
-            self._memory.delete_custom_initializer,
-            initializer_name=initializer_name,
-        )
+        self._invalidate_custom_initializers_cache()
         logger.info("Unregistered initializer: %s", initializer_name)
 
-    def _register_and_persist_initializer(self, *, name: str, script_content: str) -> None:
-        """Register custom source and persist it, rolling back runtime state on DB failure."""
-        self._registry.register_from_content(name=name, script_content=script_content)
-        try:
-            self._memory.add_custom_initializer(
-                initializer=CustomInitializer(initializer_name=name, script_content=script_content)
-            )
-        except Exception:
-            self._registry.unregister_and_cleanup(name)
-            raise
-
     def _build_and_run_initializer(
         self,
         *,
diff --git a/pyrit/memory/alembic/versions/6b7c8d9e0f1a_add_custom_initializers_table.py b/pyrit/memory/alembic/versions/6b7c8d9e0f1a_add_custom_initializers_table.py
deleted file mode 100644
index a212bc5ac4..0000000000
--- a/pyrit/memory/alembic/versions/6b7c8d9e0f1a_add_custom_initializers_table.py
+++ /dev/null
@@ -1,39 +0,0 @@
-# Copyright (c) Microsoft Corporation.
-# Licensed under the MIT license.
-
-"""
-Add persisted custom initializer source table.
-
-Revision ID: 6b7c8d9e0f1a
-Revises: 4c9a6e1f2b7d
-Create Date: 2026-08-24 14:30:00.000000
-"""
-
-from collections.abc import Sequence
-
-import sqlalchemy as sa
-from alembic import op
-
-revision: str = "6b7c8d9e0f1a"
-down_revision: str | None = "4c9a6e1f2b7d"
-branch_labels: str | Sequence[str] | None = None
-depends_on: str | Sequence[str] | None = None
-
-
-def upgrade() -> None:
-    """Apply this schema upgrade."""
-    op.create_table(
-        "CustomInitializers",
-        sa.Column("initializer_name", sa.String(length=64), nullable=False),
-        sa.Column(
-            "script_content",
-            sa.UnicodeText().with_variant(sa.Text(), "sqlite"),
-            nullable=False,
-        ),
-        sa.PrimaryKeyConstraint("initializer_name"),
-    )
-
-
-def downgrade() -> None:
-    """Revert this schema upgrade."""
-    op.drop_table("CustomInitializers")
diff --git a/pyrit/memory/memory_interface.py b/pyrit/memory/memory_interface.py
index c858ca5b5f..d698593a5b 100644
--- a/pyrit/memory/memory_interface.py
+++ b/pyrit/memory/memory_interface.py
@@ -34,7 +34,6 @@
     ComponentIdentifierEntry,
     ConversationEntry,
     ConverterIdentifierEntry,
-    CustomInitializerEntry,
     EmbeddingDataEntry,
     PromptConverterIdentifierEntry,
     PromptMemoryEntry,
@@ -64,7 +63,6 @@
     ConversationRetryReason,
     ConversationStats,
     ConverterIdentifier,
-    CustomInitializer,
     IdentifierFilter,
     IdentifierType,
     Message,
@@ -494,41 +492,6 @@ def delete_additional_initializer(self, *, initializer_id: str) -> None:
                 logger.exception(f"Error deleting additional initializer '{initializer_id}': {e}")
                 raise
 
-    def add_custom_initializer(self, *, initializer: CustomInitializer) -> None:
-        """Insert or replace custom initializer source, keyed by registry name."""
-        self._update_entry(CustomInitializerEntry.from_domain_model(initializer))
-
-    def get_custom_initializers(self) -> Sequence[CustomInitializer]:
-        """
-        Load persisted custom initializer definitions in registry-name order.
-
-        Returns:
-            Sequence[CustomInitializer]: Persisted custom initializer definitions.
-        """
-        entries = self._query_entries(
-            CustomInitializerEntry,
-            order_by=CustomInitializerEntry.initializer_name.asc(),
-        )
-        return [entry.to_domain_model() for entry in entries]
-
-    def delete_custom_initializer(self, *, initializer_name: str) -> None:
-        """
-        Delete persisted custom initializer source when it exists.
-
-        Raises:
-            SQLAlchemyError: If the delete operation fails.
-        """
-        with closing(self.get_session()) as session:
-            try:
-                session.query(CustomInitializerEntry).filter(
-                    CustomInitializerEntry.initializer_name == initializer_name
-                ).delete(synchronize_session=False)
-                session.commit()
-            except SQLAlchemyError as e:
-                session.rollback()
-                logger.exception(f"Error deleting custom initializer '{initializer_name}': {e}")
-                raise
-
     @abc.abstractmethod
     def _init_storage_io(self) -> None:
         """
diff --git a/pyrit/memory/memory_models.py b/pyrit/memory/memory_models.py
index eb79f58bb7..2cc9ef0dc7 100644
--- a/pyrit/memory/memory_models.py
+++ b/pyrit/memory/memory_models.py
@@ -21,10 +21,8 @@
     ForeignKey,
     Index,
     String,
-    Text,
     TypeDecorator,
     Unicode,
-    UnicodeText,
 )
 from sqlalchemy.dialects.sqlite import CHAR
 from sqlalchemy.orm import (
@@ -54,7 +52,6 @@
     ConversationRetry,
     ConversationType,
     ConverterIdentifier,
-    CustomInitializer,
     EvaluationIdentifier,
     MessagePiece,
     PromptDataType,
@@ -467,44 +464,6 @@ def to_domain_model(self) -> AdditionalInitializer:
         )
 
 
-class CustomInitializerEntry(DomainBackedEntry[CustomInitializer]):
-    """Persistence row for a ``CustomInitializer`` source definition."""
-
-    __tablename__ = "CustomInitializers"
-    __table_args__ = {"extend_existing": True}
-
-    initializer_name: Mapped[str] = mapped_column(String(64), primary_key=True)
-    script_content: Mapped[str] = mapped_column(
-        UnicodeText().with_variant(Text(), "sqlite"),
-        nullable=False,
-    )
-
-    @classmethod
-    def from_domain_model(cls, domain_model: CustomInitializer) -> Self:
-        """
-        Build an unsaved row from a custom initializer domain model.
-
-        Returns:
-            Self: The unsaved persistence row.
-        """
-        return cls(
-            initializer_name=domain_model.initializer_name,
-            script_content=domain_model.script_content,
-        )
-
-    def to_domain_model(self) -> CustomInitializer:
-        """
-        Convert this row back into its custom initializer domain model.
-
-        Returns:
-            CustomInitializer: The reconstructed custom initializer.
-        """
-        return CustomInitializer(
-            initializer_name=self.initializer_name,
-            script_content=self.script_content,
-        )
-
-
 T = TypeVar("T", bound=ComponentIdentifier)
 
 
diff --git a/pyrit/models/__init__.py b/pyrit/models/__init__.py
index d05cbf3ed0..4a6dfc36ca 100644
--- a/pyrit/models/__init__.py
+++ b/pyrit/models/__init__.py
@@ -24,7 +24,6 @@
 if TYPE_CHECKING:
     from pyrit.models.additional_initializer import AdditionalInitializer
     from pyrit.models.conversation_stats import ConversationStats
-    from pyrit.models.custom_initializer import CustomInitializer
     from pyrit.models.embeddings import EmbeddingData, EmbeddingResponse, EmbeddingSupport, EmbeddingUsageInformation
     from pyrit.models.harm_definition import HarmDefinition, ScaleDescription, get_all_harm_definitions
     from pyrit.models.identifiers import (
@@ -167,7 +166,6 @@
     "ConversationStats": "pyrit.models.conversation_stats",
     "ConversationType": "pyrit.models.messages.conversation_reference",
     "ContentScorable": "pyrit.models.score",
-    "CustomInitializer": "pyrit.models.custom_initializer",
     "construct_response_from_request": "pyrit.models.messages.conversations",
     "display_choices": "pyrit.models.parameter",
     "EmbeddingData": "pyrit.models.embeddings",
diff --git a/pyrit/models/custom_initializer.py b/pyrit/models/custom_initializer.py
deleted file mode 100644
index 2f3159c4b0..0000000000
--- a/pyrit/models/custom_initializer.py
+++ /dev/null
@@ -1,21 +0,0 @@
-# Copyright (c) Microsoft Corporation.
-# Licensed under the MIT license.
-
-"""Persisted user-defined initializer source code."""
-
-from pydantic import BaseModel, Field, field_validator
-
-from pyrit.models.identifiers import validate_registry_name
-
-
-class CustomInitializer(BaseModel):
-    """A user-defined initializer that can be restored into the runtime registry."""
-
-    initializer_name: str = Field(..., description="Initializer registry name.")
-    script_content: str = Field(..., min_length=1, description="Python source defining a PyRITInitializer subclass.")
-
-    @field_validator("initializer_name")
-    @classmethod
-    def _validate_initializer_name(cls, value: str) -> str:
-        validate_registry_name(value)
-        return value
diff --git a/pyrit/registry/components/initializer_registry.py b/pyrit/registry/components/initializer_registry.py
index 27fee84a99..637905d021 100644
--- a/pyrit/registry/components/initializer_registry.py
+++ b/pyrit/registry/components/initializer_registry.py
@@ -20,11 +20,13 @@
 import importlib.util
 import inspect
 import logging
+import tempfile
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import TYPE_CHECKING, Any
 
 from pyrit.models import class_name_to_snake_case, validate_registry_name
+from pyrit.registry.custom_initializer_storage import CustomInitializerStorage
 from pyrit.registry.discovery import discover_in_directory
 from pyrit.registry.registry import ParamBagRegistry
 from pyrit.registry.registry_metadata import RegistryMetadata
@@ -71,7 +73,13 @@ class InitializerRegistry(ParamBagRegistry["PyRITInitializer", InitializerMetada
     directory structure is used for organization but not exposed to users.
     """
 
-    def __init__(self, *, discovery_path: Path | None = None, lazy_discovery: bool = False) -> None:
+    def __init__(
+        self,
+        *,
+        discovery_path: Path | None = None,
+        lazy_discovery: bool = False,
+        custom_scripts_source: str | None = None,
+    ) -> None:
         """
         Initialize the initializer registry.
 
@@ -80,14 +88,29 @@ def __init__(self, *, discovery_path: Path | None = None, lazy_discovery: bool =
                 If None, defaults to pyrit/setup/initializers (discovers all).
             lazy_discovery: If True, discovery is deferred until first access.
                 Defaults to False for backwards compatibility.
+            custom_scripts_source: Local directory or Azure Blob container URI with an
+                optional blob prefix for stored custom initializer scripts. Defaults to
+                ``~/.pyrit/custom_initializers``.
         """
         self._discovery_path: Path = (
             discovery_path if discovery_path is not None else Path(PYRIT_PATH) / "setup" / "initializers"
         )
 
         self._builtin_names: set[str] = set()
+        self._custom_scripts_source = custom_scripts_source
+        self._custom_storage: CustomInitializerStorage | None = None
         super().__init__(lazy_discovery=lazy_discovery)
 
+    def configure_custom_scripts_source(self, source: str | None) -> None:
+        """Configure a local directory or Azure Blob source for custom scripts."""
+        self._custom_scripts_source = source
+        self._custom_storage = None
+
+    @property
+    def custom_scripts_source(self) -> str:
+        """Credential-free custom initializer storage source."""
+        return self._get_custom_storage().display_source
+
     def _metadata_class(self) -> type[InitializerMetadata]:
         """Return the concrete metadata dataclass this registry builds."""
         return InitializerMetadata
@@ -390,41 +413,82 @@ def register_from_content(self, *, name: str, script_content: str) -> str:
                 with an existing entry.
         """
         self._ensure_discovered()
+        with self._catalog_lock:
+            validate_registry_name(name)
 
-        validate_registry_name(name)
-
-        if name in self._classes:
-            raise ValueError(f"Initializer '{name}' is already registered. Unregister it first to replace it.")
+            if name in self._classes:
+                raise ValueError(f"Initializer '{name}' is already registered. Unregister it first to replace it.")
 
-        # Deferred: importing pyrit.setup triggers heavy __init__.py chain
-        from pyrit.setup.pyrit_initializer import PyRITInitializer
+            discovered = self._load_custom_initializer_class(name=name, script_content=script_content)
+            storage = self._get_custom_storage()
+            storage.save_script(name=name, content=script_content)
+            try:
+                self.register_class(discovered, name=name)
+            except Exception:
+                storage.delete_script(name)
+                raise
+        logger.info(f"Registered custom initializer: {name} ({discovered.__name__})")
+        return name
 
-        # Write to a managed directory so importlib can load it
-        managed_dir = self._get_custom_scripts_dir()
-        script_path = managed_dir / f"{name}.py"
-        try:
-            script_path.write_text(script_content, encoding="utf-8")
-        except OSError as e:
-            raise ValueError(f"Failed to write initializer script: {e}") from e
+    def update_from_content(self, *, name: str, script_content: str) -> str:
+        """
+        Replace a registered custom initializer and its stored source.
 
-        try:
-            module = self._load_module_from_path(file_path=script_path, module_name=f"custom_initializer.{name}")
-
-            discovered_classes = self._module_defined_initializers(module=module, base_class=PyRITInitializer)
-            if not discovered_classes:
-                raise ValueError(f"Uploaded script for '{name}' does not contain a concrete PyRITInitializer subclass.")
-            discovered = discovered_classes[0]
-        except ValueError:
-            script_path.unlink(missing_ok=True)
-            raise
-        except Exception as e:
-            script_path.unlink(missing_ok=True)
-            raise ValueError(f"Failed to load initializer script '{name}': {e}") from e
+        Returns:
+            str: The updated registry name.
 
-        self.register_class(discovered, name=name)
-        logger.info(f"Registered custom initializer: {name} ({discovered.__name__})")
+        Raises:
+            KeyError: If the initializer is not registered.
+            ValueError: If the initializer is built-in or the source is invalid.
+        """
+        self._ensure_discovered()
+        with self._catalog_lock:
+            if name in self._builtin_names:
+                raise ValueError(f"Cannot update built-in initializer '{name}'.")
+            if name not in self._classes:
+                raise KeyError(name)
+
+            discovered = self._load_custom_initializer_class(name=name, script_content=script_content)
+            self._get_custom_storage().save_script(name=name, content=script_content)
+            self._classes[name] = discovered
+            self._metadata_cache = None
+            self._catalog_version += 1
+        logger.info(f"Updated custom initializer: {name} ({discovered.__name__})")
         return name
 
+    def list_custom_initializer_sources(self) -> dict[str, str]:
+        """
+        List stored custom initializer source definitions.
+
+        Returns:
+            dict[str, str]: Script content keyed by registry name.
+        """
+        with self._catalog_lock:
+            return self._get_custom_storage().list_scripts()
+
+    def get_custom_initializer_source(self, name: str) -> str:
+        """
+        Get the credential-free storage location for a custom initializer.
+
+        Returns:
+            str: Local file path or Azure Blob URI for the script.
+        """
+        return self._get_custom_storage().get_script_source(name)
+
+    def restore_custom_initializers(self) -> None:
+        """Load all stored custom initializer scripts into the runtime registry."""
+        self._ensure_discovered()
+        with self._catalog_lock:
+            for name, script_content in self.list_custom_initializer_sources().items():
+                try:
+                    if name in self._classes:
+                        logger.warning(f"Skipping stored custom initializer '{name}': name is already registered.")
+                        continue
+                    discovered = self._load_custom_initializer_class(name=name, script_content=script_content)
+                    self.register_class(discovered, name=name)
+                except Exception:
+                    logger.exception(f"Skipping stored custom initializer '{name}': registration failed.")
+
     def unregister_and_cleanup(self, name: str) -> None:
         """
         Unregister a custom initializer and clean up its script file.
@@ -441,16 +505,61 @@ def unregister_and_cleanup(self, name: str) -> None:
             ValueError: If the name refers to a built-in initializer.
         """
         self._ensure_discovered()
-        if name in self._builtin_names:
-            raise ValueError(f"Cannot remove built-in initializer '{name}'.")
-        if name not in self._classes:
-            available = ", ".join(self.get_class_names())
-            raise KeyError(f"'{name}' not found in registry. Available: {available}")
-        del self._classes[name]
-        self._metadata_cache = None
-
-        script_path = self._get_custom_scripts_dir() / f"{name}.py"
-        script_path.unlink(missing_ok=True)
+        with self._catalog_lock:
+            if name in self._builtin_names:
+                raise ValueError(f"Cannot remove built-in initializer '{name}'.")
+            if name not in self._classes:
+                available = ", ".join(self.get_class_names())
+                raise KeyError(f"'{name}' not found in registry. Available: {available}")
+            self._get_custom_storage().delete_script(name)
+            del self._classes[name]
+            self._metadata_cache = None
+            self._catalog_version += 1
+
+    def _load_custom_initializer_class(
+        self,
+        *,
+        name: str,
+        script_content: str,
+    ) -> type[PyRITInitializer]:
+        """
+        Validate custom source and return its first initializer class.
+
+        Returns:
+            type[PyRITInitializer]: The first concrete initializer class in the source.
+
+        Raises:
+            ValueError: If the source cannot be loaded or has no initializer class.
+        """
+        from pyrit.setup.pyrit_initializer import PyRITInitializer
+
+        with tempfile.TemporaryDirectory() as temporary_directory:
+            script_path = Path(temporary_directory) / f"{name}.py"
+            try:
+                script_path.write_text(script_content, encoding="utf-8")
+            except OSError as error:
+                raise ValueError(f"Failed to write initializer script: {error}") from error
+            try:
+                module = self._load_module_from_path(file_path=script_path, module_name=f"custom_initializer.{name}")
+                discovered_classes = self._module_defined_initializers(module=module, base_class=PyRITInitializer)
+            except Exception as error:
+                raise ValueError(f"Failed to load initializer script '{name}': {error}") from error
+
+        if not discovered_classes:
+            raise ValueError(f"Uploaded script for '{name}' does not contain a concrete PyRITInitializer subclass.")
+        return discovered_classes[0]
+
+    def _get_custom_storage(self) -> CustomInitializerStorage:
+        """
+        Create storage for the configured custom initializer source.
+
+        Returns:
+            CustomInitializerStorage: Configured script storage.
+        """
+        if self._custom_storage is None:
+            source = self._custom_scripts_source or str(self._get_custom_scripts_dir())
+            self._custom_storage = CustomInitializerStorage(source=source)
+        return self._custom_storage
 
     @staticmethod
     def _get_custom_scripts_dir() -> Path:
diff --git a/pyrit/registry/custom_initializer_storage.py b/pyrit/registry/custom_initializer_storage.py
new file mode 100644
index 0000000000..a810fb1953
--- /dev/null
+++ b/pyrit/registry/custom_initializer_storage.py
@@ -0,0 +1,225 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+"""Storage backends for custom initializer Python source."""
+
+from __future__ import annotations
+
+import time
+from contextlib import contextmanager, suppress
+from pathlib import Path, PurePosixPath
+from typing import TYPE_CHECKING
+from urllib.parse import parse_qs, unquote, urlparse
+
+if TYPE_CHECKING:
+    from collections.abc import Generator
+
+    from azure.storage.blob import ContainerClient
+
+_AZURE_BLOB_HOST_SUFFIXES = (
+    ".blob.core.windows.net",
+    ".blob.core.chinacloudapi.cn",
+    ".blob.core.usgovcloudapi.net",
+    ".blob.core.cloudapi.de",
+)
+_CACHE_TTL_SECONDS = 10.0
+
+
+def is_azure_blob_source_uri(value: str) -> bool:
+    """Return whether a value is an Azure Blob container URI with an optional blob prefix."""
+    parsed_uri = urlparse(value)
+    hostname = parsed_uri.hostname or ""
+    return (
+        parsed_uri.scheme == "https"
+        and any(hostname.endswith(suffix) and hostname != suffix[1:] for suffix in _AZURE_BLOB_HOST_SUFFIXES)
+        and parsed_uri.username is None
+        and parsed_uri.password is None
+        and parsed_uri.port is None
+        and bool(parsed_uri.path.strip("/"))
+    )
+
+
+class CustomInitializerStorage:
+    """Read and write custom initializer scripts in a directory or blob container."""
+
+    def __init__(self, *, source: str) -> None:
+        """
+        Initialize storage from a local directory or Azure Blob source URI.
+
+        Raises:
+            ValueError: If the source has an unsupported URI scheme.
+        """
+        self._source = source
+        self._is_blob = is_azure_blob_source_uri(source)
+        if not self._is_blob and urlparse(source).scheme and not Path(source).drive:
+            raise ValueError(
+                "Custom initializer source must be a local directory or Azure Blob container URI "
+                "with an optional blob prefix"
+            )
+        self._container_url, self._blob_prefix = self._parse_blob_source() if self._is_blob else (None, "")
+        self._cached_scripts: dict[str, str] | None = None
+        self._cache_expires_at = 0.0
+
+    @property
+    def display_source(self) -> str:
+        """Storage source without Azure Blob credentials."""
+        if not self._is_blob:
+            return self._source
+        parsed_uri = urlparse(self._source)
+        return parsed_uri._replace(query="", fragment="").geturl()
+
+    def get_script_source(self, name: str) -> str:
+        """
+        Get the credential-free location of a custom initializer script.
+
+        Returns:
+            str: Local file path or Azure Blob URI for the script.
+        """
+        if self._is_blob:
+            return f"{self.display_source.rstrip('/')}/{name}.py"
+        return str(Path(self._source).expanduser() / f"{name}.py")
+
+    def list_scripts(self) -> dict[str, str]:
+        """
+        List stored Python scripts by registry name.
+
+        Returns:
+            dict[str, str]: Script content keyed by registry name.
+        """
+        if self._cached_scripts is not None and time.monotonic() < self._cache_expires_at:
+            return dict(self._cached_scripts)
+
+        if self._is_blob:
+            scripts = self._list_blob_scripts()
+        else:
+            directory = Path(self._source).expanduser()
+            directory.mkdir(parents=True, exist_ok=True)
+            scripts = {path.stem: path.read_text(encoding="utf-8") for path in sorted(directory.glob("*.py"))}
+
+        self._cached_scripts = scripts
+        self._cache_expires_at = time.monotonic() + _CACHE_TTL_SECONDS
+        return dict(scripts)
+
+    def save_script(self, *, name: str, content: str) -> None:
+        """Persist one custom initializer script."""
+        if self._is_blob:
+            with self._open_container_client() as client:
+                client.upload_blob(name=self._get_blob_name(name), data=content.encode("utf-8"), overwrite=True)
+        else:
+            directory = Path(self._source).expanduser()
+            directory.mkdir(parents=True, exist_ok=True)
+            (directory / f"{name}.py").write_text(content, encoding="utf-8")
+
+        self._update_cached_script(name=name, content=content)
+
+    def delete_script(self, name: str) -> None:
+        """Delete one custom initializer script if it exists."""
+        if self._is_blob:
+            from azure.core.exceptions import ResourceNotFoundError
+
+            with self._open_container_client() as client:
+                with suppress(ResourceNotFoundError):
+                    client.delete_blob(self._get_blob_name(name))
+        else:
+            (Path(self._source).expanduser() / f"{name}.py").unlink(missing_ok=True)
+
+        self._delete_cached_script(name)
+
+    def _update_cached_script(self, *, name: str, content: str) -> None:
+        """Update a fresh cache after a successful write, or invalidate a stale cache."""
+        now = time.monotonic()
+        if self._cached_scripts is None or now >= self._cache_expires_at:
+            self._cached_scripts = None
+            self._cache_expires_at = 0.0
+            return
+        self._cached_scripts[name] = content
+        self._cache_expires_at = now + _CACHE_TTL_SECONDS
+
+    def _delete_cached_script(self, name: str) -> None:
+        """Update a fresh cache after a successful delete, or invalidate a stale cache."""
+        now = time.monotonic()
+        if self._cached_scripts is None or now >= self._cache_expires_at:
+            self._cached_scripts = None
+            self._cache_expires_at = 0.0
+            return
+        self._cached_scripts.pop(name, None)
+        self._cache_expires_at = now + _CACHE_TTL_SECONDS
+
+    def _list_blob_scripts(self) -> dict[str, str]:
+        """
+        Read Python scripts from the configured Azure Blob container.
+
+        Returns:
+            dict[str, str]: Script content keyed by blob stem.
+        """
+        scripts: dict[str, str] = {}
+        with self._open_container_client() as client:
+            prefix = f"{self._blob_prefix}/" if self._blob_prefix else None
+            blobs = client.list_blobs(name_starts_with=prefix) if prefix else client.list_blobs()
+            blob_names = sorted(
+                blob.name for blob in blobs if self._is_direct_python_blob(blob_name=blob.name, prefix=prefix)
+            )
+            for blob_name in blob_names:
+                relative_name = blob_name.removeprefix(prefix or "")
+                scripts[PurePosixPath(relative_name).stem] = client.download_blob(blob_name).readall().decode("utf-8")
+        return scripts
+
+    def _parse_blob_source(self) -> tuple[str, str]:
+        """
+        Split the configured source into a container URL and blob prefix.
+
+        Returns:
+            tuple[str, str]: The container URL and decoded blob prefix.
+        """
+        parsed_uri = urlparse(self._source)
+        container_path, _, prefix = parsed_uri.path.strip("/").partition("/")
+        container_url = parsed_uri._replace(path=f"/{container_path}", fragment="").geturl()
+        return container_url, unquote(prefix).strip("/")
+
+    def _get_blob_name(self, name: str) -> str:
+        """
+        Build the blob name for a registry entry.
+
+        Returns:
+            str: The prefixed Python blob name.
+        """
+        file_name = f"{name}.py"
+        return f"{self._blob_prefix}/{file_name}" if self._blob_prefix else file_name
+
+    @staticmethod
+    def _is_direct_python_blob(*, blob_name: str, prefix: str | None) -> bool:
+        """Return whether a blob is a direct Python child of the configured prefix."""
+        if prefix and not blob_name.startswith(prefix):
+            return False
+        relative_name = blob_name.removeprefix(prefix or "")
+        return "/" not in relative_name and PurePosixPath(relative_name).suffix == ".py"
+
+    @contextmanager
+    def _open_container_client(self) -> Generator[ContainerClient, None, None]:
+        """
+        Yield an Azure Blob container client and close its credential.
+
+        Yields:
+            ContainerClient: A client scoped to the configured container.
+
+        Raises:
+            RuntimeError: If called for a non-Blob source.
+        """
+        from azure.identity import DefaultAzureCredential
+        from azure.storage.blob import ContainerClient
+
+        if self._container_url is None:
+            raise RuntimeError("Azure Blob container URL is not configured")
+
+        parsed_uri = urlparse(self._container_url)
+        if "sig" in parse_qs(parsed_uri.query):
+            with ContainerClient.from_container_url(container_url=self._container_url) as client:
+                yield client
+            return
+
+        with DefaultAzureCredential() as credential:
+            with ContainerClient.from_container_url(
+                container_url=self._container_url,
+                credential=credential,
+            ) as client:
+                yield client
diff --git a/pyrit/setup/configuration_loader.py b/pyrit/setup/configuration_loader.py
index f3d601528d..8052782993 100644
--- a/pyrit/setup/configuration_loader.py
+++ b/pyrit/setup/configuration_loader.py
@@ -27,6 +27,7 @@
     IN_MEMORY,
     SQLITE,
     initialize_pyrit_async,
+    is_azure_blob_script_uri,
 )
 
 if TYPE_CHECKING:
@@ -101,6 +102,8 @@ class ConfigurationLoader(YamlLoadable):
         env_akv_ref: List containing at most one Key Vault bootstrap secret URL.
         env_akv_strict: Whether malformed or valueless entries in a Key Vault
             bootstrap document should fail initialization.
+        custom_initializers_source: Local directory or Azure Blob container URI,
+            optionally followed by a blob prefix, used to persist custom initializer Python scripts.
         silent: Whether to suppress initialization messages.
         seed: Optional root seed for deterministic converter operations.
         operator: Name for the current operator, e.g. a team or username.
@@ -148,6 +151,7 @@ class ConfigurationLoader(YamlLoadable):
     operation: str | None = None
     max_concurrent_scenario_runs: int = 3
     allow_custom_initializers: bool = False
+    custom_initializers_source: str | None = None
     server: dict[str, Any] | None = None
     extensions: dict[str, Any] = field(default_factory=dict)
 
@@ -157,8 +161,21 @@ def __post_init__(self) -> None:
         self._normalize_memory_db_type()
         self._normalize_initializers()
         self._validate_env_akv_ref()
+        self._validate_custom_initializers_source()
         self._normalize_server()
 
+    def _validate_custom_initializers_source(self) -> None:
+        """
+        Validate the optional custom initializer storage source.
+
+        Raises:
+            ValueError: If the source is not a non-empty string.
+        """
+        if self.custom_initializers_source is not None and (
+            not isinstance(self.custom_initializers_source, str) or not self.custom_initializers_source.strip()
+        ):
+            raise ValueError("custom_initializers_source must be a non-empty local directory or container URI.")
+
     def _validate_env_akv_ref(self) -> None:
         """
         Validate the Key Vault bootstrap secret reference.
@@ -563,13 +580,13 @@ def resolve_initializers(self) -> Sequence["PyRITInitializer"]:
 
         return resolved
 
-    def resolve_initialization_scripts(self) -> Sequence[pathlib.Path] | None:
+    def resolve_initialization_scripts(self) -> Sequence[str | pathlib.Path] | None:
         """
         Resolve initialization script paths.
 
         Returns:
             None if field is None (use defaults), empty list if field is [],
-            or Sequence of resolved Path objects if paths are specified.
+            or a sequence of resolved Path objects and preserved Azure Blob URIs.
         """
         # None means "use defaults" - return None to signal this
         if self.initialization_scripts is None:
@@ -579,8 +596,12 @@ def resolve_initialization_scripts(self) -> Sequence[pathlib.Path] | None:
         if len(self.initialization_scripts) == 0:
             return list[pathlib.Path]()
 
-        resolved: list[pathlib.Path] = []
+        resolved: list[str | pathlib.Path] = []
         for script_str in self.initialization_scripts:
+            if is_azure_blob_script_uri(script_str):
+                resolved.append(script_str)
+                continue
+
             script_path = pathlib.Path(script_str)
             if not script_path.is_absolute():
                 script_path = pathlib.Path.cwd() / script_path
diff --git a/pyrit/setup/initialization.py b/pyrit/setup/initialization.py
index 23c1072aaa..202eb16916 100644
--- a/pyrit/setup/initialization.py
+++ b/pyrit/setup/initialization.py
@@ -1,9 +1,12 @@
 # Copyright (c) Microsoft Corporation.
 # Licensed under the MIT license.
+import asyncio
 import logging
 import pathlib
+import tempfile
 from collections.abc import Sequence
 from typing import TYPE_CHECKING, Any, Literal, get_args
+from urllib.parse import parse_qs, urlparse
 
 from pyrit.common.apply_defaults import reset_default_values
 from pyrit.common.random_context import configure_random_seed
@@ -24,9 +27,78 @@
 AZURE_SQL = "AzureSQL"
 MemoryDatabaseType = Literal["InMemory", "SQLite", "AzureSQL"]
 
+_AZURE_BLOB_HOST_SUFFIXES = (
+    ".blob.core.windows.net",
+    ".blob.core.chinacloudapi.cn",
+    ".blob.core.usgovcloudapi.net",
+    ".blob.core.cloudapi.de",
+)
+
 _load_environment_files = load_environment_files
 
 
+def is_azure_blob_script_uri(value: str) -> bool:
+    """Return whether a value identifies an Azure Blob Storage object."""
+    parsed_uri = urlparse(value)
+    hostname = parsed_uri.hostname or ""
+    return (
+        parsed_uri.scheme == "https"
+        and any(hostname.endswith(suffix) and hostname != suffix[1:] for suffix in _AZURE_BLOB_HOST_SUFFIXES)
+        and parsed_uri.username is None
+        and parsed_uri.password is None
+        and parsed_uri.port is None
+        and len(parsed_uri.path.strip("/").split("/")) >= 2
+    )
+
+
+def _download_initialization_script(*, source: str, destination: pathlib.Path) -> None:
+    """
+    Download an Azure Blob initialization script to a temporary path.
+
+    Raises:
+        ValueError: If the Blob URI does not identify a Python file.
+    """
+    from azure.identity import DefaultAzureCredential
+    from azure.storage.blob import BlobClient
+
+    parsed_uri = urlparse(source)
+    if pathlib.PurePosixPath(parsed_uri.path).suffix != ".py":
+        raise ValueError(f"Initialization script must be a Python file (.py): {parsed_uri.path}")
+
+    if "sig" in parse_qs(parsed_uri.query):
+        with BlobClient.from_blob_url(blob_url=source) as client:
+            destination.write_bytes(client.download_blob().readall())
+        return
+
+    with DefaultAzureCredential() as credential:
+        with BlobClient.from_blob_url(blob_url=source, credential=credential) as client:
+            destination.write_bytes(client.download_blob().readall())
+
+
+async def _materialize_initialization_scripts_async(
+    *, script_sources: Sequence[str | pathlib.Path], destination: pathlib.Path
+) -> list[pathlib.Path]:
+    """
+    Resolve local paths and download Azure Blob scripts into a temporary directory.
+
+    Returns:
+        list[pathlib.Path]: Local paths suitable for registry loading.
+    """
+    resolved: list[pathlib.Path] = []
+    for index, source in enumerate(script_sources):
+        source_str = str(source)
+        if not is_azure_blob_script_uri(source_str):
+            resolved.append(pathlib.Path(source))
+            continue
+
+        blob_name = pathlib.PurePosixPath(urlparse(source_str).path).name
+        temporary_path = destination / f"{index}_{blob_name}"
+        await asyncio.to_thread(_download_initialization_script, source=source_str, destination=temporary_path)
+        resolved.append(temporary_path)
+
+    return resolved
+
+
 async def _execute_initializers_async(*, initializers: Sequence["PyRITInitializer"]) -> None:
     """
     Execute PyRITInitializer instances in the order provided.
@@ -87,9 +159,10 @@ async def initialize_pyrit_async(
     Args:
         memory_db_type (MemoryDatabaseType): The MemoryDatabaseType string literal which indicates the memory
             instance to use for central memory. Options include "InMemory", "SQLite", and "AzureSQL".
-        initialization_scripts (Sequence[str | pathlib.Path] | None): Optional sequence of Python script paths
-            that define PyRITInitializer subclasses. Every initializer subclass defined in each file is
-            loaded and executed. Loading is handled by the InitializerRegistry.
+        initialization_scripts (Sequence[str | pathlib.Path] | None): Optional sequence of local Python script paths
+            or Azure Blob URIs that define PyRITInitializer subclasses. Every initializer subclass defined in each
+            file is loaded and executed. Loading is handled by the InitializerRegistry. Blob URIs may include a SAS;
+            otherwise, authentication uses DefaultAzureCredential.
         initializers (Sequence[PyRITInitializer] | None): Optional sequence of PyRITInitializer instances
             to execute directly. These provide type-safe, validated configuration with clear documentation.
         load_defaults (bool): If True (default) AND the caller supplies neither ``initializers`` nor
@@ -163,7 +236,12 @@ async def initialize_pyrit_async(
         from pyrit.registry import InitializerRegistry
 
         registry = InitializerRegistry.get_registry_singleton()
-        script_initializers = registry.create_from_script_paths(script_paths=initialization_scripts)
+        with tempfile.TemporaryDirectory(prefix="pyrit-initializers-") as temporary_directory:
+            script_paths = await _materialize_initialization_scripts_async(
+                script_sources=initialization_scripts,
+                destination=pathlib.Path(temporary_directory),
+            )
+            script_initializers = registry.create_from_script_paths(script_paths=script_paths)
         all_initializers.extend(script_initializers)
 
     # When the caller supplies nothing, fall back to the default initializer set so a
diff --git a/tests/unit/backend/test_configuration_file_service.py b/tests/unit/backend/test_configuration_file_service.py
new file mode 100644
index 0000000000..a701fa7354
--- /dev/null
+++ b/tests/unit/backend/test_configuration_file_service.py
@@ -0,0 +1,84 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+"""Tests for backend configuration file storage."""
+
+from pathlib import Path
+from unittest.mock import AsyncMock, patch
+
+from pyrit.backend.services.configuration_file_service import ConfigurationFileService
+
+
+async def test_configuration_file_service_reads_and_updates_local_file(tmp_path: Path) -> None:
+    """Test reading and updating a local configuration file."""
+    config_path = tmp_path / "config.yaml"
+    config_path.write_text("operator: before\n", encoding="utf-8")
+    service = ConfigurationFileService(config_file_value=str(config_path))
+
+    assert await service.read_async() == "operator: before\n"
+
+    await service.update_async("operator: after\n")
+
+    assert config_path.read_text(encoding="utf-8") == "operator: after\n"
+
+
+async def test_configuration_file_service_reads_and_updates_blob() -> None:
+    """Test that blob-backed configuration delegates to blob storage helpers."""
+    blob_uri = "https://account.blob.core.windows.net/config/config.yaml"
+    service = ConfigurationFileService(config_file_value=blob_uri)
+    with (
+        patch(
+            "pyrit.backend.services.configuration_file_service._download_blob_config_async",
+            new=AsyncMock(return_value=b"operator: before\n"),
+        ) as download_mock,
+        patch(
+            "pyrit.backend.services.configuration_file_service._upload_blob_config_async",
+            new=AsyncMock(),
+        ) as upload_mock,
+    ):
+        assert await service.read_async() == "operator: before\n"
+        await service.update_async("operator: after\n")
+        assert await service.read_async() == "operator: after\n"
+
+    download_mock.assert_awaited_once_with(blob_uri)
+    upload_mock.assert_awaited_once_with(blob_uri=blob_uri, content=b"operator: after\n")
+
+
+async def test_configuration_file_service_refreshes_blob_after_cache_expires() -> None:
+    """Test that expiry returns stale content while refreshing for the next read."""
+    blob_uri = "https://account.blob.core.windows.net/config/config.yaml"
+    service = ConfigurationFileService(config_file_value=blob_uri)
+    with (
+        patch(
+            "pyrit.backend.services.configuration_file_service._download_blob_config_async",
+            new=AsyncMock(side_effect=[b"operator: before\n", b"operator: external\n"]),
+        ) as download_mock,
+        patch("pyrit.backend.services.configuration_file_service.time.monotonic", return_value=100.0) as monotonic_mock,
+    ):
+        assert await service.read_async() == "operator: before\n"
+        assert await service.read_async() == "operator: before\n"
+
+        monotonic_mock.return_value = 111.0
+        assert await service.read_async() == "operator: before\n"
+        assert service._refresh_task is not None
+        await service._refresh_task
+        assert await service.read_async() == "operator: external\n"
+
+    assert download_mock.await_count == 2
+
+
+def test_configuration_file_service_source_omits_blob_credentials() -> None:
+    """Test that the display source does not expose SAS query parameters."""
+    service = ConfigurationFileService(
+        config_file_value="https://account.blob.core.windows.net/config/config.yaml?sp=rw&sig=secret"
+    )
+
+    assert service.source == "https://account.blob.core.windows.net/config/config.yaml"
+
+
+async def test_configuration_file_service_resolves_no_explicit_source_as_none() -> None:
+    """Test that an unset environment value preserves optional loader defaults."""
+    service = ConfigurationFileService(config_file_value=None)
+
+    async with service.resolve_async() as config_path:
+        assert config_path is None
diff --git a/tests/unit/backend/test_configuration_routes.py b/tests/unit/backend/test_configuration_routes.py
new file mode 100644
index 0000000000..a158948f85
--- /dev/null
+++ b/tests/unit/backend/test_configuration_routes.py
@@ -0,0 +1,125 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+"""Tests for backend configuration file routes."""
+
+from unittest.mock import AsyncMock, MagicMock, patch
+
+import pytest
+from fastapi import status
+from fastapi.testclient import TestClient
+
+from pyrit.backend.main import app
+from pyrit.backend.services.configuration_file_service import ConfigurationFileService
+
+
+@pytest.fixture
+def client() -> TestClient:
+    """Create a test client for the FastAPI app."""
+    return TestClient(app)
+
+
+def test_get_configuration_file_returns_content(client: TestClient) -> None:
+    """Test reading configuration contents through the API."""
+    service = MagicMock(spec=ConfigurationFileService)
+    service.read_async = AsyncMock(return_value="operator: alice\n")
+    service.source = "C:/Users/test/.pyrit/config.yaml"
+    with patch("pyrit.backend.routes.configuration._get_configuration_file_service", return_value=service):
+        response = client.get("/api/config")
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.json() == {
+        "content": "operator: alice\n",
+        "source": "C:/Users/test/.pyrit/config.yaml",
+    }
+
+
+def test_update_configuration_file_persists_content(client: TestClient) -> None:
+    """Test replacing configuration contents through the API."""
+    service = MagicMock(spec=ConfigurationFileService)
+    service.read_async = AsyncMock()
+    service.update_async = AsyncMock()
+    service.source = "https://account.blob.core.windows.net/config/config.yaml"
+    with patch("pyrit.backend.routes.configuration._get_configuration_file_service", return_value=service):
+        response = client.put("/api/config", json={"content": "operator: bob\n"})
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.json() == {
+        "content": "operator: bob\n",
+        "source": "https://account.blob.core.windows.net/config/config.yaml",
+    }
+    service.update_async.assert_awaited_once_with("operator: bob\n")
+
+
+def test_get_configuration_file_returns_404_when_missing(client: TestClient) -> None:
+    """Test that a missing configuration source returns 404."""
+    service = MagicMock(read_async=AsyncMock(side_effect=FileNotFoundError))
+    with patch("pyrit.backend.routes.configuration._get_configuration_file_service", return_value=service):
+        response = client.get("/api/config")
+
+    assert response.status_code == status.HTTP_404_NOT_FOUND
+
+
+def test_list_environment_files_returns_configured_files(client: TestClient) -> None:
+    """Test listing environment files through the API."""
+    item = {
+        "id": "0",
+        "name": ".env",
+        "path": "C:/Users/test/.pyrit/.env",
+        "content": "",
+        "exists": True,
+    }
+    service = MagicMock(list_async=AsyncMock(return_value=[item]))
+    with patch("pyrit.backend.routes.configuration._get_environment_file_service", return_value=service):
+        response = client.get("/api/config/env-files")
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.json() == {"items": [item]}
+
+
+def test_get_environment_file_returns_selected_content(client: TestClient) -> None:
+    """Test reading one selected environment source through the API."""
+    item = {
+        "id": "akv:0",
+        "name": "AKV: bootstrap",
+        "path": "https://vault.vault.azure.net/secrets/bootstrap",
+        "content": "API_KEY=value\n",
+        "exists": True,
+    }
+    service = MagicMock(read_async=AsyncMock(return_value=item))
+    with patch("pyrit.backend.routes.configuration._get_environment_file_service", return_value=service):
+        response = client.get("/api/config/env-files/akv%3A0")
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.json() == item
+    service.read_async.assert_awaited_once_with(file_id="akv:0")
+
+
+def test_update_environment_file_persists_selected_file(client: TestClient) -> None:
+    """Test updating a selected environment file through the API."""
+    item = {
+        "id": "1",
+        "name": ".env.local",
+        "path": "C:/Users/test/.pyrit/.env.local",
+        "content": "API_KEY=new\n",
+        "exists": True,
+    }
+    service = MagicMock(update_async=AsyncMock(return_value=item))
+    with patch("pyrit.backend.routes.configuration._get_environment_file_service", return_value=service):
+        response = client.put("/api/config/env-files/1", json={"content": "API_KEY=new\n"})
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.json() == item
+    service.update_async.assert_awaited_once_with(file_id="1", content="API_KEY=new\n")
+
+
+def test_update_environment_file_returns_400_for_versioned_akv_source(client: TestClient) -> None:
+    """Test that immutable AKV secret versions produce an actionable client error."""
+    service = MagicMock(
+        update_async=AsyncMock(side_effect=ValueError("Versioned Azure Key Vault environment sources are read-only"))
+    )
+    with patch("pyrit.backend.routes.configuration._get_environment_file_service", return_value=service):
+        response = client.put("/api/config/env-files/akv%3A0", json={"content": "API_KEY=new\n"})
+
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+    assert response.json()["detail"] == "Versioned Azure Key Vault environment sources are read-only"
diff --git a/tests/unit/backend/test_environment_file_service.py b/tests/unit/backend/test_environment_file_service.py
new file mode 100644
index 0000000000..f077d4f54f
--- /dev/null
+++ b/tests/unit/backend/test_environment_file_service.py
@@ -0,0 +1,117 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+"""Tests for backend environment file storage."""
+
+from pathlib import Path
+from unittest.mock import AsyncMock, patch
+
+import pytest
+
+from pyrit.backend.services.environment_file_service import EnvironmentFileService, _update_akv_document_async
+
+
+async def test_environment_file_service_uses_default_candidates(tmp_path: Path) -> None:
+    """Test that None selects PyRIT's default .env and .env.local candidates."""
+    with patch("pyrit.backend.services.environment_file_service.CONFIGURATION_DIRECTORY_PATH", tmp_path):
+        service = EnvironmentFileService(resolved_env_files=None)
+
+    items = await service.list_async()
+
+    assert [item.name for item in items] == [".env", ".env.local"]
+    assert [item.exists for item in items] == [False, False]
+
+
+async def test_environment_file_service_preserves_explicit_order_and_updates(tmp_path: Path) -> None:
+    """Test explicit file ordering, lazy content reads, and updates."""
+    first = tmp_path / "first.env"
+    second = tmp_path / ".env.local"
+    first.write_text("FIRST=before\n", encoding="utf-8")
+    second.write_text("SECOND=value\n", encoding="utf-8")
+    service = EnvironmentFileService(resolved_env_files=[first, second])
+
+    items = await service.list_async()
+    loaded = await service.read_async(file_id="0")
+    updated = await service.update_async(file_id="0", content="FIRST=after\n")
+
+    assert [item.path for item in items] == [str(first), str(second)]
+    assert items[0].content == ""
+    assert loaded.content == "FIRST=before\n"
+    assert updated.content == "FIRST=after\n"
+    assert first.read_text(encoding="utf-8") == "FIRST=after\n"
+
+
+async def test_environment_file_service_empty_list_has_no_files() -> None:
+    """Test that an explicit empty list disables all environment files."""
+    service = EnvironmentFileService(resolved_env_files=[])
+
+    assert await service.list_async() == []
+
+
+async def test_environment_file_service_lists_and_updates_akv_before_files(tmp_path: Path) -> None:
+    """Test that an AKV bootstrap document is editable and precedes local files."""
+    env_file = tmp_path / ".env.local"
+    env_file.write_text("LOCAL=value\n", encoding="utf-8")
+    secret_url = "https://vault.vault.azure.net/secrets/bootstrap"
+    service = EnvironmentFileService(resolved_env_files=[env_file], env_akv_ref=[secret_url])
+
+    with (
+        patch(
+            "pyrit.backend.services.environment_file_service._fetch_akv_document_async",
+            new=AsyncMock(return_value=("AKV=before\n", "https://vault.vault.azure.net")),
+        ) as fetch_mock,
+        patch(
+            "pyrit.backend.services.environment_file_service._update_akv_document_async",
+            new=AsyncMock(return_value="AKV=after\n"),
+        ) as update_mock,
+    ):
+        items = await service.list_async()
+        fetch_mock.assert_not_awaited()
+        loaded = await service.read_async(file_id="akv:0")
+        updated = await service.update_async(file_id="akv:0", content="AKV=after\n")
+        cached_after_update = await service.read_async(file_id="akv:0")
+
+    assert [item.id for item in items] == ["akv:0", "0"]
+    assert items[0].name == "AKV: bootstrap"
+    assert items[0].path == secret_url
+    assert items[0].content == ""
+    assert loaded.content == "AKV=before\n"
+    assert cached_after_update.content == "AKV=after\n"
+    fetch_mock.assert_awaited_once_with(secret_url=secret_url, strict=True, silent=True)
+    assert updated.content == "AKV=after\n"
+    update_mock.assert_awaited_once_with(secret_url=secret_url, content="AKV=after\n", strict=True)
+
+
+async def test_environment_file_service_rejects_versioned_akv_update() -> None:
+    """Test that editing cannot silently bypass a pinned AKV secret version."""
+    with patch("azure.identity.aio.DefaultAzureCredential") as credential_mock:
+        with pytest.raises(ValueError, match="read-only"):
+            await _update_akv_document_async(
+                secret_url="https://vault.vault.azure.net/secrets/bootstrap/version-1",
+                content="AKV=after\n",
+                strict=True,
+            )
+
+    credential_mock.assert_not_called()
+
+
+async def test_environment_file_service_caches_selected_akv_source_until_expiry() -> None:
+    """Test that expiry returns stale content while refreshing for the next read."""
+    secret_url = "https://vault.vault.azure.net/secrets/bootstrap"
+    service = EnvironmentFileService(resolved_env_files=[], env_akv_ref=[secret_url])
+    with (
+        patch(
+            "pyrit.backend.services.environment_file_service._fetch_akv_document_async",
+            new=AsyncMock(side_effect=[("FIRST=1\n", "vault"), ("SECOND=2\n", "vault")]),
+        ) as fetch_mock,
+        patch("pyrit.backend.services.environment_file_service.time.monotonic", return_value=100.0) as monotonic_mock,
+    ):
+        assert (await service.read_async(file_id="akv:0")).content == "FIRST=1\n"
+        assert (await service.read_async(file_id="akv:0")).content == "FIRST=1\n"
+
+        monotonic_mock.return_value = 111.0
+        assert (await service.read_async(file_id="akv:0")).content == "FIRST=1\n"
+        await service._refresh_tasks["akv:0"]
+        assert (await service.read_async(file_id="akv:0")).content == "SECOND=2\n"
+
+    assert fetch_mock.await_count == 2
diff --git a/tests/unit/backend/test_initializer_service.py b/tests/unit/backend/test_initializer_service.py
index 7a91958288..fb3cf75520 100644
--- a/tests/unit/backend/test_initializer_service.py
+++ b/tests/unit/backend/test_initializer_service.py
@@ -5,6 +5,7 @@
 Tests for backend initializer service and routes.
 """
 
+import asyncio
 from typing import Literal
 from unittest.mock import AsyncMock, MagicMock, patch
 
@@ -17,12 +18,14 @@
 from pyrit.backend.models.initializers import (
     ApplyInitializerResponse,
     BaselineInitializerSetting,
+    CustomInitializerListResponse,
+    CustomInitializerResponse,
     InitializerSettingsResponse,
     ListRegisteredInitializersResponse,
     RegisteredInitializer,
 )
 from pyrit.backend.services.initializer_service import InitializerService, get_initializer_service
-from pyrit.models import AdditionalInitializer, CustomInitializer, Parameter
+from pyrit.models import AdditionalInitializer, Parameter
 from pyrit.registry import InitializerMetadata
 
 
@@ -876,9 +879,6 @@ async def test_register_initializer_calls_registry(self) -> None:
             result = await service.register_initializer_async(name="my_custom", script_content=_SAMPLE_SCRIPT)
 
             mock_registry.register_from_content.assert_called_once_with(name="my_custom", script_content=_SAMPLE_SCRIPT)
-            service._memory.add_custom_initializer.assert_called_once_with(
-                initializer=CustomInitializer(initializer_name="my_custom", script_content=_SAMPLE_SCRIPT)
-            )
             assert result.initializer_name == "my_custom"
 
     async def test_register_initializer_propagates_value_error(self) -> None:
@@ -892,57 +892,101 @@ async def test_register_initializer_propagates_value_error(self) -> None:
             with pytest.raises(ValueError):
                 await service.register_initializer_async(name="bad", script_content="x = 1")
 
-    async def test_register_initializer_rolls_back_registry_when_persistence_fails(self) -> None:
+    async def test_register_initializer_propagates_storage_failure(self) -> None:
         with patch.object(InitializerService, "__init__", lambda self: None):
             service = InitializerService()
             service._registry = MagicMock()
-            service._memory = MagicMock()
-            service._memory.add_custom_initializer.side_effect = RuntimeError("database unavailable")
+            service._registry.register_from_content.side_effect = RuntimeError("storage unavailable")
 
-            with pytest.raises(RuntimeError, match="database unavailable"):
+            with pytest.raises(RuntimeError, match="storage unavailable"):
                 await service.register_initializer_async(name="my_custom", script_content=_SAMPLE_SCRIPT)
 
-            service._registry.unregister_and_cleanup.assert_called_once_with("my_custom")
-
-    async def test_list_custom_initializers_returns_persisted_sources(self) -> None:
-        custom = CustomInitializer(initializer_name="my_custom", script_content=_SAMPLE_SCRIPT)
+    async def test_list_custom_initializers_returns_stored_sources(self) -> None:
         with patch.object(InitializerService, "__init__", lambda self: None):
             service = InitializerService()
-            service._memory = MagicMock()
-            service._memory.get_custom_initializers.return_value = [custom]
+            service._registry = MagicMock()
+            service._custom_initializers_cache = None
+            service._custom_cache_expires_at = 0.0
+            service._custom_cache_lock = asyncio.Lock()
+            service._custom_refresh_task = None
+            service._registry.custom_scripts_source = "C:/custom"
+            service._registry.list_custom_initializer_sources.return_value = {"my_custom": _SAMPLE_SCRIPT}
+            service._registry.get_custom_initializer_source.return_value = "C:/custom/my_custom.py"
 
             result = await service.list_custom_initializers_async()
 
-            assert result == [custom]
+            assert result.source == "C:/custom"
+            assert result.items == [
+                CustomInitializerResponse(
+                    initializer_name="my_custom",
+                    script_content=_SAMPLE_SCRIPT,
+                    source="C:/custom/my_custom.py",
+                )
+            ]
 
-    async def test_register_persisted_custom_initializers_restores_all_sources(self) -> None:
-        first = CustomInitializer(initializer_name="first", script_content="first source")
-        second = CustomInitializer(initializer_name="second", script_content="second source")
+    async def test_list_custom_initializers_refreshes_expired_cache_in_background(self) -> None:
         with patch.object(InitializerService, "__init__", lambda self: None):
             service = InitializerService()
             service._registry = MagicMock()
-            service._memory = MagicMock()
-            service._memory.get_custom_initializers.return_value = [first, second]
+            service._custom_initializers_cache = None
+            service._custom_cache_expires_at = 0.0
+            service._custom_cache_lock = asyncio.Lock()
+            service._custom_refresh_task = None
+            service._registry.custom_scripts_source = "C:/custom"
+            service._registry.list_custom_initializer_sources.side_effect = [
+                {"my_custom": "VALUE = 1\n"},
+                {"my_custom": "VALUE = 2\n"},
+            ]
+            service._registry.get_custom_initializer_source.return_value = "C:/custom/my_custom.py"
+
+            with patch(
+                "pyrit.backend.services.initializer_service.time.monotonic", return_value=100.0
+            ) as monotonic_mock:
+                first = await service.list_custom_initializers_async()
+                monotonic_mock.return_value = 111.0
+                stale = await service.list_custom_initializers_async()
+                assert service._custom_refresh_task is not None
+                await service._custom_refresh_task
+                refreshed = await service.list_custom_initializers_async()
+
+            assert first.items[0].script_content == "VALUE = 1\n"
+            assert stale.items[0].script_content == "VALUE = 1\n"
+            assert refreshed.items[0].script_content == "VALUE = 2\n"
+            assert service._registry.list_custom_initializer_sources.call_count == 2
+
+    async def test_restore_custom_initializers_delegates_to_registry(self) -> None:
+        with patch.object(InitializerService, "__init__", lambda self: None):
+            service = InitializerService()
+            service._registry = MagicMock()
+            service._registry.custom_scripts_source = "C:/custom"
+            service._registry.list_custom_initializer_sources.return_value = {"my_custom": _SAMPLE_SCRIPT}
+            service._registry.get_custom_initializer_source.return_value = "C:/custom/my_custom.py"
+            service._custom_initializers_cache = None
+            service._custom_cache_expires_at = 0.0
+            service._custom_cache_lock = asyncio.Lock()
+            service._custom_refresh_task = None
 
-            await service.register_persisted_custom_initializers_async()
+            await service.restore_custom_initializers_async()
 
-            calls = service._registry.register_from_content.call_args_list
-            assert calls[0].kwargs == {"name": "first", "script_content": "first source"}
-            assert calls[1].kwargs == {"name": "second", "script_content": "second source"}
+            service._registry.restore_custom_initializers.assert_called_once_with()
+            assert service._custom_initializers_cache is not None
+            assert service._custom_initializers_cache.items[0].script_content == _SAMPLE_SCRIPT
 
-    async def test_register_persisted_custom_initializers_isolates_failures(self) -> None:
-        first = CustomInitializer(initializer_name="first", script_content="bad source")
-        second = CustomInitializer(initializer_name="second", script_content="good source")
+    async def test_update_initializer_calls_registry(self) -> None:
         with patch.object(InitializerService, "__init__", lambda self: None):
             service = InitializerService()
             service._registry = MagicMock()
-            service._registry.register_from_content.side_effect = [ValueError("bad source"), "second"]
-            service._memory = MagicMock()
-            service._memory.get_custom_initializers.return_value = [first, second]
+            service._registry.get_all_registered_class_metadata.return_value = [
+                _make_initializer_metadata(registry_name="my_custom", class_name="UpdatedInitializer")
+            ]
 
-            await service.register_persisted_custom_initializers_async()
+            result = await service.update_initializer_async(name="my_custom", script_content=_SAMPLE_SCRIPT)
 
-            assert service._registry.register_from_content.call_count == 2
+            service._registry.update_from_content.assert_called_once_with(
+                name="my_custom",
+                script_content=_SAMPLE_SCRIPT,
+            )
+            assert result.initializer_name == "my_custom"
 
 
 class TestInitializerServiceUnregister:
@@ -958,7 +1002,6 @@ async def test_unregister_initializer_calls_registry(self) -> None:
             await service.unregister_initializer_async(initializer_name="target")
 
             mock_registry.unregister_and_cleanup.assert_called_once_with("target")
-            service._memory.delete_custom_initializer.assert_called_once_with(initializer_name="target")
 
     async def test_unregister_initializer_propagates_key_error(self) -> None:
         with patch.object(InitializerService, "__init__", lambda self: None):
@@ -995,7 +1038,6 @@ async def test_unregister_initializer_rejects_additional_initializer_reference(s
                 await service.unregister_initializer_async(initializer_name="custom")
 
             service._registry.unregister_and_cleanup.assert_not_called()
-            service._memory.delete_custom_initializer.assert_not_called()
 
 
 # ============================================================================
@@ -1006,17 +1048,31 @@ async def test_unregister_initializer_rejects_additional_initializer_reference(s
 class TestRegisterInitializerRoute:
     """Tests for POST /api/initializers route."""
 
-    def test_get_custom_initializers_returns_persisted_sources(self, client: TestClient) -> None:
-        custom = CustomInitializer(initializer_name="my_custom", script_content=_SAMPLE_SCRIPT)
+    def test_get_custom_initializers_returns_403_when_disabled(self, client: TestClient) -> None:
+        app.state.allow_custom_initializers = False
+
+        response = client.get("/api/initializers/custom")
+
+        assert response.status_code == status.HTTP_403_FORBIDDEN
+
+    def test_get_custom_initializers_returns_storage_source_and_items(
+        self, client_with_custom_initializers_enabled: TestClient
+    ) -> None:
+        custom = CustomInitializerResponse(
+            initializer_name="my_custom",
+            script_content=_SAMPLE_SCRIPT,
+            source="C:/custom/my_custom.py",
+        )
         with patch("pyrit.backend.routes.initializers.get_initializer_service") as mock_get_service:
             mock_service = MagicMock()
-            mock_service.list_custom_initializers_async = AsyncMock(return_value=[custom])
+            response_model = CustomInitializerListResponse(source="C:/custom", items=[custom])
+            mock_service.list_custom_initializers_async = AsyncMock(return_value=response_model)
             mock_get_service.return_value = mock_service
 
-            response = client.get("/api/initializers/custom")
+            response = client_with_custom_initializers_enabled.get("/api/initializers/custom")
 
             assert response.status_code == status.HTTP_200_OK
-            assert response.json() == [custom.model_dump()]
+            assert response.json() == response_model.model_dump()
 
     def test_post_returns_403_when_custom_initializers_disabled(self, client: TestClient) -> None:
         app.state.allow_custom_initializers = False
@@ -1159,3 +1215,58 @@ def test_delete_returns_400_when_additional_initializer_references_name(
 
             assert response.status_code == status.HTTP_400_BAD_REQUEST
             assert "additional initializer settings reference it" in response.json()["detail"]
+
+
+class TestUpdateInitializerRoute:
+    """Tests for PUT /api/initializers/{name} route."""
+
+    def test_put_returns_403_when_custom_initializers_disabled(self, client: TestClient) -> None:
+        app.state.allow_custom_initializers = False
+
+        response = client.put("/api/initializers/custom", json={"script_content": _SAMPLE_SCRIPT})
+
+        assert response.status_code == status.HTTP_403_FORBIDDEN
+
+    def test_put_updates_custom_initializer(self, client_with_custom_initializers_enabled: TestClient) -> None:
+        summary = RegisteredInitializer(
+            initializer_name="custom",
+            initializer_type="UpdatedInitializer",
+            description="Updated custom initializer",
+        )
+        with patch("pyrit.backend.routes.initializers.get_initializer_service") as mock_get_service:
+            mock_service = MagicMock()
+            mock_service.update_initializer_async = AsyncMock(return_value=summary)
+            mock_get_service.return_value = mock_service
+
+            response = client_with_custom_initializers_enabled.put(
+                "/api/initializers/custom",
+                json={"script_content": _SAMPLE_SCRIPT},
+            )
+
+        assert response.status_code == status.HTTP_200_OK
+        mock_service.update_initializer_async.assert_awaited_once_with(
+            name="custom",
+            script_content=_SAMPLE_SCRIPT,
+        )
+
+    @pytest.mark.parametrize(
+        ("error", "expected_status"),
+        [(KeyError("custom"), status.HTTP_404_NOT_FOUND), (ValueError("invalid source"), status.HTTP_400_BAD_REQUEST)],
+    )
+    def test_put_maps_update_errors(
+        self,
+        client_with_custom_initializers_enabled: TestClient,
+        error: Exception,
+        expected_status: int,
+    ) -> None:
+        with patch("pyrit.backend.routes.initializers.get_initializer_service") as mock_get_service:
+            mock_service = MagicMock()
+            mock_service.update_initializer_async = AsyncMock(side_effect=error)
+            mock_get_service.return_value = mock_service
+
+            response = client_with_custom_initializers_enabled.put(
+                "/api/initializers/custom",
+                json={"script_content": _SAMPLE_SCRIPT},
+            )
+
+        assert response.status_code == expected_status
diff --git a/tests/unit/backend/test_main.py b/tests/unit/backend/test_main.py
index 6e44277002..41887bed35 100644
--- a/tests/unit/backend/test_main.py
+++ b/tests/unit/backend/test_main.py
@@ -28,7 +28,7 @@ async def test_lifespan_yields(self) -> None:
         """Test that lifespan delegates to ConfigurationLoader and yields."""
         fake_config = ConfigurationLoader()
         service = MagicMock(
-            register_persisted_custom_initializers_async=AsyncMock(),
+            restore_custom_initializers_async=AsyncMock(),
             run_additional_initializers_async=AsyncMock(),
         )
         with (
@@ -44,7 +44,7 @@ async def test_lifespan_yields(self) -> None:
             assert app.state.default_labels == {}
             assert app.state.max_concurrent_scenario_runs == fake_config.max_concurrent_scenario_runs
             assert app.state.allow_custom_initializers is False
-            service.register_persisted_custom_initializers_async.assert_not_awaited()
+            service.restore_custom_initializers_async.assert_not_awaited()
             service.run_additional_initializers_async.assert_awaited_once_with(allow_custom_initializers=False)
 
     async def test_lifespan_registers_custom_initializers_before_running_additional(self) -> None:
@@ -59,7 +59,7 @@ async def run_additional_async(*, allow_custom_initializers: bool) -> None:
             call_order.append("additional")
 
         service = MagicMock(
-            register_persisted_custom_initializers_async=AsyncMock(side_effect=register_custom_async),
+            restore_custom_initializers_async=AsyncMock(side_effect=register_custom_async),
             run_additional_initializers_async=AsyncMock(side_effect=run_additional_async),
         )
         with (
@@ -82,7 +82,7 @@ async def test_lifespan_warns_when_custom_initializers_allowed(self) -> None:
             patch(
                 "pyrit.backend.main.get_initializer_service",
                 return_value=MagicMock(
-                    register_persisted_custom_initializers_async=AsyncMock(),
+                    restore_custom_initializers_async=AsyncMock(),
                     run_additional_initializers_async=AsyncMock(),
                 ),
             ),
@@ -103,7 +103,7 @@ async def test_lifespan_populates_default_labels_from_operator_and_operation(sel
             patch(
                 "pyrit.backend.main.get_initializer_service",
                 return_value=MagicMock(
-                    register_persisted_custom_initializers_async=AsyncMock(),
+                    restore_custom_initializers_async=AsyncMock(),
                     run_additional_initializers_async=AsyncMock(),
                 ),
             ),
@@ -124,7 +124,7 @@ async def test_lifespan_reads_config_file_env_var(self) -> None:
             patch(
                 "pyrit.backend.main.get_initializer_service",
                 return_value=MagicMock(
-                    register_persisted_custom_initializers_async=AsyncMock(),
+                    restore_custom_initializers_async=AsyncMock(),
                     run_additional_initializers_async=AsyncMock(),
                 ),
             ),
@@ -136,6 +136,66 @@ async def test_lifespan_reads_config_file_env_var(self) -> None:
             call_kwargs = load_mock.call_args.kwargs
             assert str(call_kwargs["config_file"]).endswith("foo.yaml")
 
+    async def test_lifespan_configures_custom_initializer_source_from_config(self) -> None:
+        """Test that YAML config determines the custom script source."""
+        fake_config = ConfigurationLoader(custom_initializers_source="C:/yaml/initializers")
+        registry = MagicMock()
+        service = MagicMock(
+            restore_custom_initializers_async=AsyncMock(),
+            run_additional_initializers_async=AsyncMock(),
+        )
+        with (
+            patch.object(ConfigurationLoader, "load_with_overrides", return_value=fake_config),
+            patch.object(ConfigurationLoader, "initialize_pyrit_async", new=AsyncMock()),
+            patch("pyrit.backend.main.InitializerRegistry.get_registry_singleton", return_value=registry),
+            patch("pyrit.backend.main.get_initializer_service", return_value=service),
+            patch("pyrit.backend.main.setup_frontend"),
+        ):
+            async with lifespan(app):
+                pass
+
+        registry.configure_custom_scripts_source.assert_called_once_with("C:/yaml/initializers")
+
+    async def test_lifespan_downloads_blob_config_to_temporary_file(self) -> None:
+        """Test that an Azure Blob config URI is materialized and removed after loading."""
+        fake_config = ConfigurationLoader()
+        config_content = b"operator: blob-user\n"
+        loaded_path: Path | None = None
+
+        def load_config(*, config_file: Path) -> ConfigurationLoader:
+            nonlocal loaded_path
+            loaded_path = config_file
+            assert config_file.suffix == ".yaml"
+            assert config_file.read_bytes() == config_content
+            return fake_config
+
+        with (
+            patch.dict(
+                os.environ,
+                {"PYRIT_CONFIG_FILE": "https://account.blob.core.windows.net/config/config.yaml"},
+                clear=False,
+            ),
+            patch(
+                "pyrit.backend.services.configuration_file_service._download_blob_config_async",
+                new=AsyncMock(return_value=config_content),
+            ),
+            patch.object(ConfigurationLoader, "load_with_overrides", side_effect=load_config),
+            patch.object(ConfigurationLoader, "initialize_pyrit_async", new=AsyncMock()),
+            patch(
+                "pyrit.backend.main.get_initializer_service",
+                return_value=MagicMock(
+                    restore_custom_initializers_async=AsyncMock(),
+                    run_additional_initializers_async=AsyncMock(),
+                ),
+            ),
+            patch("pyrit.backend.main.setup_frontend"),
+        ):
+            async with lifespan(app):
+                pass
+
+        assert loaded_path is not None
+        assert not loaded_path.exists()
+
 
 class TestSetupFrontend:
     """Tests for the setup_frontend function."""
diff --git a/tests/unit/backend/test_pyrit_backend.py b/tests/unit/backend/test_pyrit_backend.py
index f1e4a55232..4ff22c7413 100644
--- a/tests/unit/backend/test_pyrit_backend.py
+++ b/tests/unit/backend/test_pyrit_backend.py
@@ -1,7 +1,6 @@
 # Copyright (c) Microsoft Corporation.
 # Licensed under the MIT license.
 
-from pathlib import Path
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -21,7 +20,14 @@ def test_parse_args_defaults(self) -> None:
 
     def test_parse_args_accepts_config_file(self) -> None:
         args = pyrit_backend.parse_args(args=["--config-file", "./custom_conf.yaml"])
-        assert args.config_file == Path("./custom_conf.yaml")
+        assert args.config_file == "./custom_conf.yaml"
+
+    def test_parse_args_preserves_blob_config_uri(self) -> None:
+        blob_uri = "https://behnamousatairtsa.blob.core.windows.net/copyrit/.pyrit_conf"
+
+        args = pyrit_backend.parse_args(args=["--config-file", blob_uri])
+
+        assert args.config_file == blob_uri
 
     def test_parse_args_accepts_host_port(self) -> None:
         args = pyrit_backend.parse_args(args=["--host", "0.0.0.0", "--port", "9000"])
@@ -52,6 +58,16 @@ def test_main_forwards_config_file_via_env(self, mock_run: MagicMock) -> None:
             assert os.environ.get("PYRIT_CONFIG_FILE") is not None
             assert "custom.yaml" in os.environ["PYRIT_CONFIG_FILE"]
 
+    @patch("uvicorn.run")
+    def test_main_forwards_blob_config_uri_via_env(self, mock_run: MagicMock) -> None:
+        import os
+
+        blob_uri = "https://behnamousatairtsa.blob.core.windows.net/copyrit/.pyrit_conf"
+        with patch.dict(os.environ, {}, clear=False):
+            pyrit_backend.main(args=["--config-file", blob_uri])
+
+            assert os.environ["PYRIT_CONFIG_FILE"] == blob_uri
+
     @patch("uvicorn.run")
     def test_main_passes_host_and_port(self, mock_run: MagicMock) -> None:
         pyrit_backend.main(args=["--host", "0.0.0.0", "--port", "9000"])
diff --git a/tests/unit/memory/test_custom_initializer_memory.py b/tests/unit/memory/test_custom_initializer_memory.py
deleted file mode 100644
index 278434cfcf..0000000000
--- a/tests/unit/memory/test_custom_initializer_memory.py
+++ /dev/null
@@ -1,42 +0,0 @@
-# Copyright (c) Microsoft Corporation.
-# Licensed under the MIT license.
-
-import pytest
-
-from pyrit.memory.memory_models import CustomInitializerEntry
-from pyrit.models import CustomInitializer
-
-
-@pytest.mark.usefixtures("patch_central_database")
-class TestCustomInitializerMemory:
-    def test_custom_initializer_round_trips_real_domain_model(self, sqlite_instance) -> None:
-        initializer = CustomInitializer(
-            initializer_name="custom_target",
-            script_content="class CustomTargetInitializer: pass",
-        )
-
-        sqlite_instance.add_custom_initializer(initializer=initializer)
-
-        entries = sqlite_instance._query_entries(CustomInitializerEntry)
-        assert len(entries) == 1
-        assert entries[0].to_domain_model() == initializer
-        assert sqlite_instance.get_custom_initializers() == [initializer]
-
-    def test_add_custom_initializer_upserts_by_name(self, sqlite_instance) -> None:
-        sqlite_instance.add_custom_initializer(
-            initializer=CustomInitializer(initializer_name="custom_target", script_content="old")
-        )
-        updated = CustomInitializer(initializer_name="custom_target", script_content="new")
-
-        sqlite_instance.add_custom_initializer(initializer=updated)
-
-        assert sqlite_instance.get_custom_initializers() == [updated]
-
-    def test_delete_custom_initializer_is_idempotent(self, sqlite_instance) -> None:
-        initializer = CustomInitializer(initializer_name="custom_target", script_content="source")
-        sqlite_instance.add_custom_initializer(initializer=initializer)
-
-        sqlite_instance.delete_custom_initializer(initializer_name="custom_target")
-        sqlite_instance.delete_custom_initializer(initializer_name="custom_target")
-
-        assert sqlite_instance.get_custom_initializers() == []
diff --git a/tests/unit/registry/test_custom_initializer_storage.py b/tests/unit/registry/test_custom_initializer_storage.py
new file mode 100644
index 0000000000..bcd3b7aa72
--- /dev/null
+++ b/tests/unit/registry/test_custom_initializer_storage.py
@@ -0,0 +1,150 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+"""Tests for custom initializer script storage."""
+
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from pyrit.registry.custom_initializer_storage import CustomInitializerStorage
+
+
+@pytest.mark.parametrize(
+    "source",
+    [
+        "https://account.blob.attacker.example/initializers",
+        "https://user@account.blob.core.windows.net/initializers",
+        "https://account.blob.core.windows.net:8443/initializers",
+        "https://blob.core.windows.net/initializers",
+    ],
+)
+def test_blob_storage_rejects_untrusted_authorities(source: str) -> None:
+    """Test rejecting Blob lookalikes before Azure credentials are acquired."""
+    with pytest.raises(ValueError, match="local directory or Azure Blob container URI"):
+        CustomInitializerStorage(source=source)
+
+
+def test_local_storage_lists_saves_and_deletes_scripts(tmp_path: Path) -> None:
+    """Test local directory storage lifecycle."""
+    storage = CustomInitializerStorage(source=str(tmp_path))
+
+    storage.save_script(name="example", content="VALUE = 1\n")
+
+    assert storage.list_scripts() == {"example": "VALUE = 1\n"}
+    storage.delete_script("example")
+    assert storage.list_scripts() == {}
+
+
+def test_blob_storage_uses_sas_and_ignores_non_python_blobs() -> None:
+    """Test container storage operations with a SAS-authenticated URI."""
+    client = MagicMock()
+    client.__enter__.return_value = client
+    client.list_blobs.return_value = [
+        SimpleNamespace(name="first.py"),
+        SimpleNamespace(name="notes.txt"),
+        SimpleNamespace(name="archive/ignored.py"),
+    ]
+    client.download_blob.return_value.readall.return_value = b"VALUE = 1\n"
+    source = "https://account.blob.core.windows.net/initializers?sp=rwd&sig=secret"
+    storage = CustomInitializerStorage(source=source)
+
+    with patch("azure.storage.blob.ContainerClient.from_container_url", return_value=client) as client_factory:
+        assert storage.list_scripts() == {"first": "VALUE = 1\n"}
+        storage.save_script(name="second", content="VALUE = 2\n")
+        storage.delete_script("second")
+
+    assert storage.display_source == "https://account.blob.core.windows.net/initializers"
+    client_factory.assert_called_with(container_url=source)
+    client.list_blobs.assert_called_once_with()
+    client.upload_blob.assert_called_once_with(name="second.py", data=b"VALUE = 2\n", overwrite=True)
+    client.delete_blob.assert_called_once_with("second.py")
+
+
+def test_blob_storage_scopes_operations_to_prefix() -> None:
+    """Test storage operations under a virtual directory prefix."""
+    client = MagicMock()
+    client.__enter__.return_value = client
+    client.list_blobs.return_value = [
+        SimpleNamespace(name="custom-initializers/first.py"),
+        SimpleNamespace(name="custom-initializers/notes.txt"),
+        SimpleNamespace(name="custom-initializers/archive/ignored.py"),
+    ]
+    client.download_blob.return_value.readall.return_value = b"VALUE = 1\n"
+    source = "https://account.blob.core.windows.net/copyrit/custom-initializers?sp=rwd&sig=secret"
+    container_url = "https://account.blob.core.windows.net/copyrit?sp=rwd&sig=secret"
+    storage = CustomInitializerStorage(source=source)
+
+    with patch("azure.storage.blob.ContainerClient.from_container_url", return_value=client) as client_factory:
+        assert storage.list_scripts() == {"first": "VALUE = 1\n"}
+        storage.save_script(name="second", content="VALUE = 2\n")
+        storage.delete_script("second")
+
+    assert storage.display_source == "https://account.blob.core.windows.net/copyrit/custom-initializers"
+    assert storage.get_script_source("first") == (
+        "https://account.blob.core.windows.net/copyrit/custom-initializers/first.py"
+    )
+    client_factory.assert_called_with(container_url=container_url)
+    client.list_blobs.assert_called_once_with(name_starts_with="custom-initializers/")
+    client.download_blob.assert_called_once_with("custom-initializers/first.py")
+    client.upload_blob.assert_called_once_with(
+        name="custom-initializers/second.py",
+        data=b"VALUE = 2\n",
+        overwrite=True,
+    )
+    client.delete_blob.assert_called_once_with("custom-initializers/second.py")
+
+
+def test_blob_storage_uses_default_credential_without_sas() -> None:
+    """Test container storage authentication without a SAS token."""
+    credential = MagicMock()
+    credential.__enter__.return_value = credential
+    client = MagicMock()
+    client.__enter__.return_value = client
+    source = "https://account.blob.core.windows.net/initializers"
+    storage = CustomInitializerStorage(source=source)
+
+    with (
+        patch("azure.identity.DefaultAzureCredential", return_value=credential) as credential_factory,
+        patch("azure.storage.blob.ContainerClient.from_container_url", return_value=client) as client_factory,
+    ):
+        storage.save_script(name="example", content="VALUE = 1\n")
+
+    credential_factory.assert_called_once_with()
+    client_factory.assert_called_once_with(container_url=source, credential=credential)
+
+
+def test_local_storage_returns_script_path(tmp_path: Path) -> None:
+    """Test resolving the displayed path for a local script."""
+    storage = CustomInitializerStorage(source=str(tmp_path))
+
+    assert storage.get_script_source("example") == str(tmp_path / "example.py")
+
+
+def test_local_storage_caches_scripts_until_expiry(tmp_path: Path) -> None:
+    """Test that external script changes become visible after the cache expires."""
+    script_path = tmp_path / "example.py"
+    script_path.write_text("VALUE = 1\n", encoding="utf-8")
+    storage = CustomInitializerStorage(source=str(tmp_path))
+
+    with patch("pyrit.registry.custom_initializer_storage.time.monotonic", return_value=100.0) as monotonic_mock:
+        assert storage.list_scripts() == {"example": "VALUE = 1\n"}
+        script_path.write_text("VALUE = 2\n", encoding="utf-8")
+        assert storage.list_scripts() == {"example": "VALUE = 1\n"}
+
+        monotonic_mock.return_value = 111.0
+        assert storage.list_scripts() == {"example": "VALUE = 2\n"}
+
+
+def test_local_storage_updates_warm_cache_after_writes(tmp_path: Path) -> None:
+    """Test that saves and deletes update an existing cache immediately."""
+    storage = CustomInitializerStorage(source=str(tmp_path))
+    assert storage.list_scripts() == {}
+
+    storage.save_script(name="example", content="VALUE = 1\n")
+    assert storage.list_scripts() == {"example": "VALUE = 1\n"}
+
+    storage.delete_script("example")
+    assert storage.list_scripts() == {}
diff --git a/tests/unit/registry/test_initializer_registry.py b/tests/unit/registry/test_initializer_registry.py
index 395e8d12b2..f88a12d897 100644
--- a/tests/unit/registry/test_initializer_registry.py
+++ b/tests/unit/registry/test_initializer_registry.py
@@ -2,7 +2,10 @@
 # Licensed under the MIT license.
 
 import tempfile
+import time
+from concurrent.futures import ThreadPoolExecutor
 from pathlib import Path
+from threading import Lock
 from unittest.mock import patch
 
 import pytest
@@ -136,6 +139,46 @@ def test_register_from_content_rejects_duplicate_name(lazy_registry):
             lazy_registry.register_from_content(name="dup", script_content=_VALID_SCRIPT)
 
 
+def test_register_from_content_serializes_concurrent_writes(tmp_path: Path) -> None:
+    """Test concurrent registration keeps storage and the runtime catalog consistent."""
+    registry = InitializerRegistry(lazy_discovery=True, custom_scripts_source=str(tmp_path))
+    registry._discovered = True
+    original_load = registry._load_custom_initializer_class
+    state_lock = Lock()
+    active_loads = 0
+    maximum_active_loads = 0
+
+    def delayed_load(*, name: str, script_content: str) -> type[PyRITInitializer]:
+        nonlocal active_loads, maximum_active_loads
+        with state_lock:
+            active_loads += 1
+            maximum_active_loads = max(maximum_active_loads, active_loads)
+        time.sleep(0.05)
+        try:
+            return original_load(name=name, script_content=script_content)
+        finally:
+            with state_lock:
+                active_loads -= 1
+
+    def register() -> str:
+        try:
+            registry.register_from_content(name="race", script_content=_VALID_SCRIPT)
+            return "registered"
+        except ValueError:
+            return "duplicate"
+
+    with (
+        patch.object(registry, "_load_custom_initializer_class", side_effect=delayed_load),
+        ThreadPoolExecutor(max_workers=2) as executor,
+    ):
+        results = list(executor.map(lambda _: register(), range(2)))
+
+    assert sorted(results) == ["duplicate", "registered"]
+    assert maximum_active_loads == 1
+    assert registry.list_custom_initializer_sources() == {"race": _VALID_SCRIPT}
+    assert registry.get_class("race").__name__ == "ScriptTestInitializer"
+
+
 def test_register_from_content_ignores_imported_classes(lazy_registry):
     """Test that imported base classes are not registered."""
     script = """
@@ -171,6 +214,62 @@ def test_unregister_and_cleanup_removes_entry_and_file(lazy_registry):
         assert not (tmp_dir / "cleanup_test.py").exists()
 
 
+def test_update_from_content_replaces_class_and_persisted_source(tmp_path: Path) -> None:
+    """Test replacing a custom initializer without changing its registry name."""
+    updated_script = _VALID_SCRIPT.replace("ScriptTestInitializer", "UpdatedInitializer")
+    registry = InitializerRegistry(lazy_discovery=True, custom_scripts_source=str(tmp_path))
+    registry._discovered = True
+    registry.register_from_content(name="custom", script_content=_VALID_SCRIPT)
+
+    registry.update_from_content(name="custom", script_content=updated_script)
+
+    assert registry.get_class("custom").__name__ == "UpdatedInitializer"
+    assert registry.list_custom_initializer_sources() == {"custom": updated_script}
+
+
+def test_restore_custom_initializers_loads_persisted_scripts(tmp_path: Path) -> None:
+    """Test loading custom initializers from the configured source at startup."""
+    (tmp_path / "restored.py").write_text(_VALID_SCRIPT, encoding="utf-8")
+    registry = InitializerRegistry(lazy_discovery=True, custom_scripts_source=str(tmp_path))
+    registry._discovered = True
+
+    registry.restore_custom_initializers()
+
+    assert registry.get_class("restored").__name__ == "ScriptTestInitializer"
+
+
+def test_custom_initializer_storage_is_reused_until_source_changes(tmp_path: Path) -> None:
+    """Test that startup and GUI reads share one cache-bearing storage instance."""
+    registry = InitializerRegistry(lazy_discovery=True, custom_scripts_source=str(tmp_path))
+
+    first_storage = registry._get_custom_storage()
+    assert registry._get_custom_storage() is first_storage
+
+    registry.configure_custom_scripts_source(str(tmp_path / "other"))
+    assert registry._get_custom_storage() is not first_storage
+
+
+def test_restore_custom_initializers_does_not_replace_lazy_builtin(tmp_path: Path) -> None:
+    """Test built-ins are discovered before stored scripts are restored."""
+
+    class BuiltinInit(PyRITInitializer):
+        async def initialize_async(self) -> None:
+            pass
+
+    (tmp_path / "builtin.py").write_text(_VALID_SCRIPT, encoding="utf-8")
+    registry = InitializerRegistry(lazy_discovery=True, custom_scripts_source=str(tmp_path))
+
+    def discover_builtin() -> None:
+        registry._classes["builtin"] = BuiltinInit
+        registry._builtin_names.add("builtin")
+
+    with patch.object(registry, "_discover", side_effect=discover_builtin) as discover:
+        registry.restore_custom_initializers()
+
+    discover.assert_called_once_with()
+    assert registry.get_class("builtin") is BuiltinInit
+
+
 def test_unregister_and_cleanup_rejects_builtin(lazy_registry):
     """Test that unregister_and_cleanup raises ValueError for built-in initializers."""
 
diff --git a/tests/unit/setup/test_configuration_loader.py b/tests/unit/setup/test_configuration_loader.py
index 51c626b4c4..9becad599c 100644
--- a/tests/unit/setup/test_configuration_loader.py
+++ b/tests/unit/setup/test_configuration_loader.py
@@ -43,8 +43,27 @@ def test_default_values(self):
         assert config.env_files is None  # None means "use defaults"
         assert config.env_akv_ref is None
         assert config.env_akv_strict is True
+        assert config.custom_initializers_source is None
         assert config.silent is False
 
+    def test_custom_initializers_source_loads_from_yaml(self, tmp_path: pathlib.Path) -> None:
+        """Test loading an Azure Blob container URI for custom initializer scripts."""
+        config_path = tmp_path / "config.yaml"
+        config_path.write_text(
+            "custom_initializers_source: https://account.blob.core.windows.net/initializers\n",
+            encoding="utf-8",
+        )
+
+        config = ConfigurationLoader.from_yaml_file(config_path)
+
+        assert config.custom_initializers_source == "https://account.blob.core.windows.net/initializers"
+
+    @pytest.mark.parametrize("invalid_value", ["", "   ", 42])
+    def test_custom_initializers_source_rejects_invalid_value(self, invalid_value: object) -> None:
+        """Test rejecting empty or non-string custom initializer sources."""
+        with pytest.raises(ValueError, match="custom_initializers_source"):
+            ConfigurationLoader(custom_initializers_source=invalid_value)  # type: ignore[arg-type]
+
     @pytest.mark.parametrize("invalid_value", ["false", "true", 0, 1, None, [], {}])
     def test_rejects_non_boolean_env_akv_strict(self, invalid_value):
         with pytest.raises(TypeError, match=r"env_akv_strict must be a bool"):
@@ -317,6 +336,13 @@ def testresolve_initialization_scripts_relative_path(self):
         # Check path ends with expected components (works on both Unix and Windows)
         assert resolved[0].parts[-2:] == ("relative", "script.py")
 
+    def testresolve_initialization_scripts_preserves_azure_blob_uri(self):
+        """Test preserving an Azure Blob URI for initialization-time download."""
+        source = "https://account.blob.core.windows.net/scripts/example.py?sp=r&sig=secret"
+        config = ConfigurationLoader(initialization_scripts=[source])
+
+        assert config.resolve_initialization_scripts() == [source]
+
     def testresolve_env_files_none_returns_none(self):
         """Test that None (default) returns None to signal 'use defaults'."""
         config = ConfigurationLoader()
diff --git a/tests/unit/setup/test_initialization.py b/tests/unit/setup/test_initialization.py
index fa283786f9..12b1347dba 100644
--- a/tests/unit/setup/test_initialization.py
+++ b/tests/unit/setup/test_initialization.py
@@ -13,6 +13,21 @@
 from pyrit.common.singleton import Singleton
 from pyrit.registry import InitializerRegistry
 from pyrit.setup import IN_MEMORY, initialize_pyrit_async
+from pyrit.setup.initialization import is_azure_blob_script_uri
+
+
+@pytest.mark.parametrize(
+    "source",
+    [
+        "https://account.blob.attacker.example/scripts/example.py",
+        "https://user@account.blob.core.windows.net/scripts/example.py",
+        "https://account.blob.core.windows.net:8443/scripts/example.py",
+        "https://blob.core.windows.net/scripts/example.py",
+    ],
+)
+def test_is_azure_blob_script_uri_rejects_untrusted_authorities(source: str) -> None:
+    """Test rejecting Blob lookalikes before Azure credentials are acquired."""
+    assert not is_azure_blob_script_uri(source)
 
 
 class TestLoadInitializersFromScripts:
@@ -179,6 +194,69 @@ async def initialize_async(self) -> None:
         finally:
             os.unlink(script_path)
 
+    @mock.patch("pyrit.memory.central_memory.CentralMemory.set_memory_instance")
+    @mock.patch("pyrit.setup.initialization.load_environment_async", new_callable=mock.AsyncMock)
+    async def test_initialize_with_azure_blob_script(self, mock_load_environment, mock_set_memory):
+        """Test downloading a SAS-authenticated initialization script for registry loading."""
+        source = "https://account.blob.core.windows.net/scripts/example.py?sp=r&sig=secret"
+        client = mock.MagicMock()
+        client.__enter__.return_value = client
+        client.download_blob.return_value.readall.return_value = b"script content"
+        captured_path: pathlib.Path | None = None
+
+        def capture_script_path(*, script_paths):
+            nonlocal captured_path
+            captured_path = pathlib.Path(script_paths[0])
+            assert captured_path.read_bytes() == b"script content"
+            return []
+
+        registry = InitializerRegistry.get_registry_singleton()
+        with (
+            mock.patch("azure.storage.blob.BlobClient.from_blob_url", return_value=client) as client_factory,
+            mock.patch.object(registry, "create_from_script_paths", side_effect=capture_script_path),
+        ):
+            await initialize_pyrit_async(
+                memory_db_type=IN_MEMORY,
+                initialization_scripts=[source],
+                load_defaults=False,
+            )
+
+        assert captured_path is not None
+        assert not captured_path.exists()
+        client_factory.assert_called_once_with(blob_url=source)
+        mock_load_environment.assert_awaited_once()
+        mock_set_memory.assert_called_once()
+
+    @mock.patch("pyrit.memory.central_memory.CentralMemory.set_memory_instance")
+    @mock.patch("pyrit.setup.initialization.load_environment_async", new_callable=mock.AsyncMock)
+    async def test_initialize_with_azure_blob_script_uses_default_credential(
+        self, mock_load_environment, mock_set_memory
+    ):
+        """Test authenticating a Blob URI without SAS using DefaultAzureCredential."""
+        source = "https://account.blob.core.windows.net/scripts/example.py"
+        credential = mock.MagicMock()
+        credential.__enter__.return_value = credential
+        client = mock.MagicMock()
+        client.__enter__.return_value = client
+        client.download_blob.return_value.readall.return_value = b"script content"
+        registry = InitializerRegistry.get_registry_singleton()
+
+        with (
+            mock.patch("azure.identity.DefaultAzureCredential", return_value=credential) as credential_factory,
+            mock.patch("azure.storage.blob.BlobClient.from_blob_url", return_value=client) as client_factory,
+            mock.patch.object(registry, "create_from_script_paths", return_value=[]),
+        ):
+            await initialize_pyrit_async(
+                memory_db_type=IN_MEMORY,
+                initialization_scripts=[source],
+                load_defaults=False,
+            )
+
+        credential_factory.assert_called_once_with()
+        client_factory.assert_called_once_with(blob_url=source, credential=credential)
+        mock_load_environment.assert_awaited_once()
+        mock_set_memory.assert_called_once()
+
     @mock.patch("pyrit.setup.initialization.load_environment_async", new_callable=mock.AsyncMock)
     async def test_invalid_memory_type_raises_error(self, mock_load_environment):
         """Test that invalid memory type raises ValueError."""

From 7c69104569295d0ba0898abc35683c1795137326 Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Wed, 26 Aug 2026 14:33:30 -0700
Subject: [PATCH 07/24] add restart and simplify cache

---
 .../BackendConfiguration.test.tsx             |  12 ++
 .../BackendConfiguration.tsx                  |  22 ++
 frontend/src/services/api.test.ts             |   7 +
 frontend/src/services/api.ts                  |   4 +
 pyrit/backend/main.py                         |  12 +-
 pyrit/backend/pyrit_backend.py                |  49 ++++-
 pyrit/backend/routes/configuration.py         |  28 ++-
 .../services/configuration_file_service.py    |  73 +++----
 .../services/environment_file_service.py      | 197 +++++++-----------
 pyrit/backend/services/initializer_service.py |  65 ++----
 .../services/stale_while_revalidate_cache.py  | 109 ++++++++++
 .../test_configuration_file_service.py        |   9 +-
 .../unit/backend/test_configuration_routes.py |  21 ++
 .../backend/test_environment_file_service.py  |   8 +-
 .../unit/backend/test_initializer_service.py  |  38 ++--
 tests/unit/backend/test_main.py               |  15 +-
 tests/unit/backend/test_pyrit_backend.py      |  87 +++++---
 .../test_stale_while_revalidate_cache.py      |  53 +++++
 18 files changed, 538 insertions(+), 271 deletions(-)
 create mode 100644 pyrit/backend/services/stale_while_revalidate_cache.py
 create mode 100644 tests/unit/backend/test_stale_while_revalidate_cache.py

diff --git a/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx b/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx
index e6c60666df..a1a8dded0e 100644
--- a/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx
+++ b/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx
@@ -9,6 +9,7 @@ import BackendConfiguration from './BackendConfiguration'
 jest.mock('@/services/api', () => ({
   configurationApi: {
     getContent: jest.fn(),
+    restart: jest.fn(),
     updateContent: jest.fn(),
     listEnvironmentFiles: jest.fn(),
     getEnvironmentFile: jest.fn(),
@@ -40,6 +41,7 @@ describe('BackendConfiguration', () => {
       content: 'operator: alice\n',
       source: 'C:/Users/test/.pyrit/config.yaml',
     })
+    mockedConfigurationApi.restart.mockResolvedValue()
     mockedConfigurationApi.listEnvironmentFiles.mockResolvedValue({
       items: [
         { id: '0', name: '.env', path: 'C:/Users/test/.pyrit/.env', content: '', exists: true },
@@ -109,6 +111,16 @@ describe('BackendConfiguration', () => {
     expect(await screen.findByText(/restart the backend/i)).toBeInTheDocument()
   })
 
+  it('should request a backend restart from the header', async () => {
+    const user = userEvent.setup()
+    renderPage()
+
+    await user.click(screen.getByRole('button', { name: 'Restart backend' }))
+
+    expect(mockedConfigurationApi.restart).toHaveBeenCalledTimes(1)
+    expect(await screen.findByText('Backend restart requested.')).toBeInTheDocument()
+  })
+
   it('should show a load error', async () => {
     mockedConfigurationApi.getContent.mockRejectedValue(new Error('Configuration unavailable'))
     renderPage()
diff --git a/frontend/src/components/BackendConfiguration/BackendConfiguration.tsx b/frontend/src/components/BackendConfiguration/BackendConfiguration.tsx
index b97889f7f8..7ac6941559 100644
--- a/frontend/src/components/BackendConfiguration/BackendConfiguration.tsx
+++ b/frontend/src/components/BackendConfiguration/BackendConfiguration.tsx
@@ -36,6 +36,7 @@ export default function BackendConfiguration() {
   const [source, setSource] = useState('')
   const [loading, setLoading] = useState(true)
   const [saving, setSaving] = useState(false)
+  const [restarting, setRestarting] = useState(false)
   const [reloadCount, setReloadCount] = useState(0)
   const [statusMessage, setStatusMessage] = useState<StatusMessage | null>(null)
   const [selectedTab, setSelectedTab] = useState<ConfigurationTab>('configuration')
@@ -93,6 +94,19 @@ export default function BackendConfiguration() {
     }
   }
 
+  const handleRestart = async (): Promise<void> => {
+    setRestarting(true)
+    setStatusMessage(null)
+    try {
+      await configurationApi.restart()
+      setStatusMessage({ intent: 'success', text: 'Backend restart requested.' })
+    } catch (error) {
+      setStatusMessage({ intent: 'error', text: toApiError(error).detail })
+    } finally {
+      setRestarting(false)
+    }
+  }
+
   const hasUnsavedChanges = content !== savedContent
 
   const handleTabSelect = (_: SelectTabEvent, data: SelectTabData): void => {
@@ -109,6 +123,14 @@ export default function BackendConfiguration() {
     <main className={styles.root}>
       <div className={styles.header}>
         <Text as="h1" size={600} weight="semibold">Backend Configuration</Text>
+        <Button
+          appearance="secondary"
+          icon={<ArrowSyncRegular />}
+          disabled={restarting || saving}
+          onClick={() => void handleRestart()}
+        >
+          {restarting ? 'Restarting...' : 'Restart backend'}
+        </Button>
       </div>
 
       <TabList selectedValue={selectedTab} onTabSelect={handleTabSelect}>
diff --git a/frontend/src/services/api.test.ts b/frontend/src/services/api.test.ts
index 4a6e173915..f3d4e2e8b7 100644
--- a/frontend/src/services/api.test.ts
+++ b/frontend/src/services/api.test.ts
@@ -161,6 +161,13 @@ describe("api service", () => {
   });
 
   describe("configurationApi", () => {
+    it("should request a backend restart", async () => {
+      (apiClient.post as jest.Mock).mockResolvedValueOnce({ status: 202 });
+
+      await expect(configurationApi.restart()).resolves.toBeUndefined();
+      expect(apiClient.post).toHaveBeenCalledWith("/config/restart");
+    });
+
     it("should read configuration content", async () => {
       const response = {
         data: { content: "operator: alice\n", source: "C:/Users/test/.pyrit/config.yaml" },
diff --git a/frontend/src/services/api.ts b/frontend/src/services/api.ts
index 4d98938295..d7f7d64423 100644
--- a/frontend/src/services/api.ts
+++ b/frontend/src/services/api.ts
@@ -162,6 +162,10 @@ export const configurationApi = {
     return response.data
   },
 
+  restart: async (): Promise<void> => {
+    await apiClient.post('/config/restart')
+  },
+
   updateContent: async (request: UpdateConfigurationFileRequest): Promise<ConfigurationFileContent> => {
     const response = await apiClient.put('/config', request)
     return response.data
diff --git a/pyrit/backend/main.py b/pyrit/backend/main.py
index 570fb841cd..90bbd94a77 100644
--- a/pyrit/backend/main.py
+++ b/pyrit/backend/main.py
@@ -54,14 +54,18 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
     Initialize PyRIT on startup using the config file, then yield.
 
     Config resolution order:
-    1. ``PYRIT_CONFIG_FILE`` local path or Azure Blob URI (if set)
-    2. ``~/.pyrit/.pyrit_conf`` (if it exists)
-    3. Built-in defaults (SQLite, no initializers)
+    1. ``PYRIT_CONFIG_FILE`` local path or Azure Blob URI, used as a self-contained config
+    2. ``~/.pyrit/.pyrit_conf`` when no explicit source is set
+    3. Built-in defaults when neither source exists
     """
     configuration_file_service = ConfigurationFileService(config_file_value=os.getenv("PYRIT_CONFIG_FILE"))
     app.state.configuration_file_service = configuration_file_service
     async with configuration_file_service.resolve_async() as config_file:
-        config = ConfigurationLoader.load_with_overrides(config_file=config_file)
+        config = (
+            ConfigurationLoader.from_yaml_file(config_file)
+            if config_file is not None
+            else ConfigurationLoader.load_with_overrides()
+        )
     resolved_env_files = config.resolve_env_files()
     app.state.environment_file_service = EnvironmentFileService(
         resolved_env_files=list(resolved_env_files) if resolved_env_files is not None else None,
diff --git a/pyrit/backend/pyrit_backend.py b/pyrit/backend/pyrit_backend.py
index 43935e648f..96a9dc9b14 100644
--- a/pyrit/backend/pyrit_backend.py
+++ b/pyrit/backend/pyrit_backend.py
@@ -12,10 +12,12 @@
 environment variable.
 """
 
+import asyncio
 import logging
 import os
 import sys
 from argparse import ArgumentParser, Namespace, RawDescriptionHelpFormatter
+from collections.abc import Callable
 
 from pyrit.common.cli_helpers import CONFIG_FILE_HELP, validate_log_level_argparse
 
@@ -94,6 +96,48 @@ def parse_args(*, args: list[str] | None = None) -> Namespace:
     return parser.parse_args(args)
 
 
+def _run_server(*, host: str, port: int, log_level: str, reload: bool) -> None:
+    """Run uvicorn, restarting when requested by the backend API."""
+    import uvicorn
+
+    if reload:
+        uvicorn.run(
+            "pyrit.backend.main:app",
+            host=host,
+            port=port,
+            log_level=log_level,
+            reload=True,
+        )
+        return
+
+    from pyrit.backend.main import app
+
+    config = uvicorn.Config(app, host=host, port=port, log_level=log_level)
+    restart_requested = True
+
+    async def serve_with_restarts_async() -> None:
+        nonlocal restart_requested
+
+        def create_restart_callback(server: uvicorn.Server) -> Callable[[], None]:
+            def request_restart() -> None:
+                nonlocal restart_requested
+                restart_requested = True
+                server.should_exit = True
+
+            return request_restart
+
+        while restart_requested:
+            restart_requested = False
+            server = uvicorn.Server(config)
+            app.state.restart_backend = create_restart_callback(server)
+            await server.serve()
+
+    try:
+        asyncio.run(serve_with_restarts_async())
+    finally:
+        del app.state.restart_backend
+
+
 def main(*, args: list[str] | None = None) -> int:
     """
     Start the PyRIT backend server.
@@ -122,10 +166,7 @@ def main(*, args: list[str] | None = None) -> int:
         )
 
     try:
-        import uvicorn
-
-        uvicorn.run(
-            "pyrit.backend.main:app",
+        _run_server(
             host=parsed_args.host,
             port=parsed_args.port,
             log_level=logging.getLevelName(parsed_args.log_level).lower()
diff --git a/pyrit/backend/routes/configuration.py b/pyrit/backend/routes/configuration.py
index 3606870c53..77d2defdcc 100644
--- a/pyrit/backend/routes/configuration.py
+++ b/pyrit/backend/routes/configuration.py
@@ -4,9 +4,10 @@
 """Backend configuration file API routes."""
 
 import os
+from collections.abc import Callable
 
 from azure.core.exceptions import ResourceNotFoundError
-from fastapi import APIRouter, HTTPException, Request, status
+from fastapi import APIRouter, BackgroundTasks, HTTPException, Request, status
 
 from pyrit.backend.models.common import ProblemDetail
 from pyrit.backend.models.configuration import (
@@ -54,6 +55,22 @@ def _get_environment_file_service(request: Request) -> EnvironmentFileService:
     return service
 
 
+def _get_restart_callback(request: Request) -> Callable[[], None]:
+    """
+    Get the restart callback installed by the managed backend server.
+
+    Returns:
+        Callable[[], None]: The managed server restart callback.
+    """
+    callback = getattr(request.app.state, "restart_backend", None)
+    if not callable(callback):
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="Backend restart is unavailable for this server process",
+        )
+    return callback
+
+
 @router.get(
     "",
     response_model=ConfigurationFileContent,
@@ -102,6 +119,15 @@ async def update_configuration_file(  # pyrit-async-suffix-exempt
     return ConfigurationFileContent(content=body.content, source=service.source)
 
 
+@router.post("/restart", status_code=status.HTTP_202_ACCEPTED)
+async def restart_backend(  # pyrit-async-suffix-exempt
+    request: Request,
+    background_tasks: BackgroundTasks,
+) -> None:
+    """Schedule a backend restart after the response is sent."""
+    background_tasks.add_task(_get_restart_callback(request))
+
+
 @router.get("/env-files", response_model=EnvironmentFileListResponse)
 async def list_environment_files(  # pyrit-async-suffix-exempt
     request: Request,
diff --git a/pyrit/backend/services/configuration_file_service.py b/pyrit/backend/services/configuration_file_service.py
index edcb78395a..a7c9195812 100644
--- a/pyrit/backend/services/configuration_file_service.py
+++ b/pyrit/backend/services/configuration_file_service.py
@@ -4,9 +4,7 @@
 """Read, update, and locally materialize the backend configuration file."""
 
 import asyncio
-import logging
 import tempfile
-import time
 from collections.abc import AsyncGenerator
 from contextlib import asynccontextmanager
 from pathlib import Path
@@ -14,10 +12,11 @@
 
 import aiofiles
 
+from pyrit.backend.services.stale_while_revalidate_cache import StaleWhileRevalidateCache
 from pyrit.setup.configuration_loader import ConfigurationLoader
 
 _CACHE_TTL_SECONDS = 10.0
-logger = logging.getLogger(__name__)
+_CONFIG_CACHE_KEY = "configuration"
 
 
 def _is_azure_blob_uri(value: str) -> bool:
@@ -88,10 +87,10 @@ def __init__(self, *, config_file_value: str | None) -> None:
         """Initialize the service with an explicit source or the default configuration path."""
         self._config_file_value = config_file_value
         self._source = config_file_value or str(ConfigurationLoader.get_default_config_path())
-        self._cached_content: str | None = None
-        self._cache_expires_at = 0.0
-        self._cache_lock = asyncio.Lock()
-        self._refresh_task: asyncio.Task[None] | None = None
+        self._cache = StaleWhileRevalidateCache[str](
+            ttl_seconds=_CACHE_TTL_SECONDS,
+            load_async=lambda _: self._read_source_async(),
+        )
 
     @property
     def source(self) -> str:
@@ -108,52 +107,40 @@ async def read_async(self) -> str:
         Returns:
             str: The UTF-8 configuration contents.
         """
-        if self._cached_content is not None:
-            if time.monotonic() >= self._cache_expires_at and (self._refresh_task is None or self._refresh_task.done()):
-                self._refresh_task = asyncio.create_task(self._refresh_in_background_async())
-            return self._cached_content
+        return await self._cache.get_async(key=_CONFIG_CACHE_KEY)
 
-        return await self._refresh_cache_async(force=False)
-
-    async def _refresh_cache_async(self, *, force: bool) -> str:
+    async def _read_source_async(self) -> str:
         """
         Read the source and replace the cached content.
 
         Returns:
             str: The current configuration contents.
         """
-        async with self._cache_lock:
-            if not force and self._cached_content is not None:
-                return self._cached_content
-
-            if _is_azure_blob_uri(self._source):
-                content = (await _download_blob_config_async(self._source)).decode("utf-8")
-            else:
-                async with aiofiles.open(self._source, encoding="utf-8") as config_file:
-                    content = await config_file.read()
-
-            self._cached_content = content
-            self._cache_expires_at = time.monotonic() + _CACHE_TTL_SECONDS
-            return content
-
-    async def _refresh_in_background_async(self) -> None:
-        """Refresh an expired cache without delaying the current request."""
-        try:
-            await self._refresh_cache_async(force=True)
-        except Exception:
-            logger.warning("Failed to refresh configuration file cache", exc_info=True)
+        if _is_azure_blob_uri(self._source):
+            return (await _download_blob_config_async(self._source)).decode("utf-8")
+        async with aiofiles.open(self._source, encoding="utf-8") as config_file:
+            return await config_file.read()
 
     async def update_async(self, content: str) -> None:
         """Replace the current configuration contents."""
-        async with self._cache_lock:
-            if _is_azure_blob_uri(self._source):
-                await _upload_blob_config_async(blob_uri=self._source, content=content.encode("utf-8"))
-            else:
-                async with aiofiles.open(self._source, mode="w", encoding="utf-8") as config_file:
-                    await config_file.write(content)
-
-            self._cached_content = content
-            self._cache_expires_at = time.monotonic() + _CACHE_TTL_SECONDS
+        await self._cache.update_async(
+            key=_CONFIG_CACHE_KEY,
+            update_async=lambda: self._write_source_async(content),
+        )
+
+    async def _write_source_async(self, content: str) -> str:
+        """
+        Persist configuration content.
+
+        Returns:
+            str: The persisted configuration content.
+        """
+        if _is_azure_blob_uri(self._source):
+            await _upload_blob_config_async(blob_uri=self._source, content=content.encode("utf-8"))
+        else:
+            async with aiofiles.open(self._source, mode="w", encoding="utf-8") as config_file:
+                await config_file.write(content)
+        return content
 
     @asynccontextmanager
     async def resolve_async(self) -> AsyncGenerator[Path | None, None]:
diff --git a/pyrit/backend/services/environment_file_service.py b/pyrit/backend/services/environment_file_service.py
index c9b0cd3aee..82a6442f40 100644
--- a/pyrit/backend/services/environment_file_service.py
+++ b/pyrit/backend/services/environment_file_service.py
@@ -4,13 +4,12 @@
 """Read and update environment files selected by backend configuration."""
 
 import asyncio
-import logging
-import time
 from pathlib import Path
 
 import aiofiles
 
 from pyrit.backend.models.configuration import EnvironmentFileContent
+from pyrit.backend.services.stale_while_revalidate_cache import StaleWhileRevalidateCache
 from pyrit.common.path import CONFIGURATION_DIRECTORY_PATH
 from pyrit.setup.environment_loading import (
     _create_akv_secret_client,
@@ -20,7 +19,6 @@
 )
 
 _CACHE_TTL_SECONDS = 10.0
-logger = logging.getLogger(__name__)
 
 
 async def _update_akv_document_async(*, secret_url: str, content: str, strict: bool) -> str:
@@ -61,9 +59,10 @@ def __init__(
             if resolved_env_files is None
             else resolved_env_files
         )
-        self._content_cache: dict[str, tuple[float, EnvironmentFileContent]] = {}
-        self._cache_lock = asyncio.Lock()
-        self._refresh_tasks: dict[str, asyncio.Task[None]] = {}
+        self._cache = StaleWhileRevalidateCache[EnvironmentFileContent](
+            ttl_seconds=_CACHE_TTL_SECONDS,
+            load_async=lambda file_id: self._read_source_async(file_id=file_id),
+        )
 
     async def list_async(self) -> list[EnvironmentFileContent]:
         """
@@ -108,81 +107,18 @@ async def read_async(self, *, file_id: str) -> EnvironmentFileContent:
         Raises:
             KeyError: If the identifier does not name a configured environment source.
         """
-        cached = self._content_cache.get(file_id)
-        if cached is not None:
-            if time.monotonic() >= cached[0] and file_id not in self._refresh_tasks:
-                self._refresh_tasks[file_id] = asyncio.create_task(self._refresh_in_background_async(file_id=file_id))
-            return cached[1].model_copy()
-
-        return await self._refresh_cache_async(file_id=file_id, force=False)
+        return await self._cache.get_async(key=file_id)
 
-    async def _refresh_cache_async(self, *, file_id: str, force: bool) -> EnvironmentFileContent:
+    async def _read_source_async(self, *, file_id: str) -> EnvironmentFileContent:
         """
         Read one source and replace its cached content.
 
         Returns:
             EnvironmentFileContent: The selected source and its current contents.
         """
-        async with self._cache_lock:
-            cached = self._content_cache.get(file_id)
-            if not force and cached is not None:
-                return cached[1].model_copy()
-
-            if file_id.startswith("akv:"):
-                try:
-                    index = int(file_id.removeprefix("akv:"))
-                    secret_url = self._akv_refs[index]
-                except (ValueError, IndexError):
-                    raise KeyError(file_id) from None
-                if index < 0:
-                    raise KeyError(file_id)
-
-                content, _ = await _fetch_akv_document_async(
-                    secret_url=secret_url,
-                    strict=self._env_akv_strict,
-                    silent=True,
-                )
-                _, secret_name, _ = _parse_akv_secret_url(secret_url)
-                item = EnvironmentFileContent(
-                    id=file_id,
-                    name=f"AKV: {secret_name}",
-                    path=secret_url,
-                    content=content,
-                    exists=True,
-                )
-            else:
-                try:
-                    index = int(file_id)
-                    path = self._paths[index]
-                except (ValueError, IndexError):
-                    raise KeyError(file_id) from None
-                if index < 0:
-                    raise KeyError(file_id)
-
-                exists = await asyncio.to_thread(path.exists)
-                content = ""
-                if exists:
-                    async with aiofiles.open(path, encoding="utf-8") as environment_file:
-                        content = await environment_file.read()
-                item = EnvironmentFileContent(
-                    id=file_id,
-                    name=path.name,
-                    path=str(path),
-                    content=content,
-                    exists=exists,
-                )
-
-            self._content_cache[file_id] = (time.monotonic() + _CACHE_TTL_SECONDS, item)
-            return item.model_copy()
-
-    async def _refresh_in_background_async(self, *, file_id: str) -> None:
-        """Refresh an expired source without delaying the current request."""
-        try:
-            await self._refresh_cache_async(file_id=file_id, force=True)
-        except Exception:
-            logger.warning("Failed to refresh environment source %s", file_id, exc_info=True)
-        finally:
-            self._refresh_tasks.pop(file_id, None)
+        if file_id.startswith("akv:"):
+            return await self._read_akv_source_async(file_id=file_id)
+        return await self._read_file_source_async(file_id=file_id)
 
     async def update_async(self, *, file_id: str, content: str) -> EnvironmentFileContent:
         """
@@ -194,48 +130,73 @@ async def update_async(self, *, file_id: str, content: str) -> EnvironmentFileCo
         Raises:
             KeyError: If the identifier does not name a configured environment file.
         """
-        async with self._cache_lock:
-            if file_id.startswith("akv:"):
-                try:
-                    index = int(file_id.removeprefix("akv:"))
-                    secret_url = self._akv_refs[index]
-                except (ValueError, IndexError):
-                    raise KeyError(file_id) from None
-                if index < 0:
-                    raise KeyError(file_id)
-
-                persisted_content = await _update_akv_document_async(
-                    secret_url=secret_url,
-                    content=content,
-                    strict=self._env_akv_strict,
-                )
-                _, secret_name, _ = _parse_akv_secret_url(secret_url)
-                item = EnvironmentFileContent(
-                    id=file_id,
-                    name=f"AKV: {secret_name}",
-                    path=secret_url,
-                    content=persisted_content,
-                    exists=True,
-                )
-            else:
-                try:
-                    index = int(file_id)
-                    path = self._paths[index]
-                except (ValueError, IndexError):
-                    raise KeyError(file_id) from None
-                if index < 0:
-                    raise KeyError(file_id)
-
-                await asyncio.to_thread(path.parent.mkdir, parents=True, exist_ok=True)
-                async with aiofiles.open(path, mode="w", encoding="utf-8") as environment_file:
-                    await environment_file.write(content)
-                item = EnvironmentFileContent(
-                    id=file_id,
-                    name=path.name,
-                    path=str(path),
-                    content=content,
-                    exists=True,
-                )
+        return await self._cache.update_async(
+            key=file_id,
+            update_async=lambda: self._write_source_async(file_id=file_id, content=content),
+        )
 
-            self._content_cache[file_id] = (time.monotonic() + _CACHE_TTL_SECONDS, item)
-            return item.model_copy()
+    async def _read_akv_source_async(self, *, file_id: str) -> EnvironmentFileContent:
+        index, secret_url = self._get_akv_source(file_id)
+        content, _ = await _fetch_akv_document_async(
+            secret_url=secret_url,
+            strict=self._env_akv_strict,
+            silent=True,
+        )
+        _, secret_name, _ = _parse_akv_secret_url(secret_url)
+        return EnvironmentFileContent(
+            id=f"akv:{index}", name=f"AKV: {secret_name}", path=secret_url, content=content, exists=True
+        )
+
+    async def _read_file_source_async(self, *, file_id: str) -> EnvironmentFileContent:
+        path = self._get_file_path(file_id)
+        exists = await asyncio.to_thread(path.exists)
+        content = ""
+        if exists:
+            async with aiofiles.open(path, encoding="utf-8") as environment_file:
+                content = await environment_file.read()
+        return EnvironmentFileContent(id=file_id, name=path.name, path=str(path), content=content, exists=exists)
+
+    async def _write_source_async(self, *, file_id: str, content: str) -> EnvironmentFileContent:
+        if file_id.startswith("akv:"):
+            return await self._write_akv_source_async(file_id=file_id, content=content)
+        path = self._get_file_path(file_id)
+        await asyncio.to_thread(path.parent.mkdir, parents=True, exist_ok=True)
+        async with aiofiles.open(path, mode="w", encoding="utf-8") as environment_file:
+            await environment_file.write(content)
+        return EnvironmentFileContent(id=file_id, name=path.name, path=str(path), content=content, exists=True)
+
+    async def _write_akv_source_async(self, *, file_id: str, content: str) -> EnvironmentFileContent:
+        index, secret_url = self._get_akv_source(file_id)
+        persisted_content = await _update_akv_document_async(
+            secret_url=secret_url,
+            content=content,
+            strict=self._env_akv_strict,
+        )
+        _, secret_name, _ = _parse_akv_secret_url(secret_url)
+        return EnvironmentFileContent(
+            id=f"akv:{index}",
+            name=f"AKV: {secret_name}",
+            path=secret_url,
+            content=persisted_content,
+            exists=True,
+        )
+
+    def _get_akv_source(self, file_id: str) -> tuple[int, str]:
+        try:
+            index = int(file_id.removeprefix("akv:"))
+            secret_url = self._akv_refs[index]
+        except (ValueError, IndexError):
+            raise KeyError(file_id) from None
+        if index < 0:
+            raise KeyError(file_id)
+        return index, secret_url
+
+    def _get_file_path(self, file_id: str) -> Path:
+        try:
+            index = int(file_id)
+            path = self._paths[index]
+        except (ValueError, IndexError):
+            raise KeyError(file_id) from None
+        if index < 0:
+            raise KeyError(file_id)
+        return path
diff --git a/pyrit/backend/services/initializer_service.py b/pyrit/backend/services/initializer_service.py
index d9f762abed..329e8c972d 100644
--- a/pyrit/backend/services/initializer_service.py
+++ b/pyrit/backend/services/initializer_service.py
@@ -12,7 +12,6 @@
 
 import asyncio
 import logging
-import time
 from collections.abc import Sequence
 from functools import lru_cache
 from typing import Any
@@ -27,6 +26,7 @@
     InitializerSettingsResponse,
     ListRegisteredInitializersResponse,
 )
+from pyrit.backend.services.stale_while_revalidate_cache import StaleWhileRevalidateCache
 from pyrit.memory import CentralMemory
 from pyrit.models import AdditionalInitializer
 from pyrit.models.catalog.initializer import RegisteredInitializer
@@ -35,6 +35,7 @@
 
 logger = logging.getLogger(__name__)
 _CUSTOM_CACHE_TTL_SECONDS = 10.0
+_CUSTOM_CACHE_KEY = "custom-initializers"
 
 
 def _metadata_to_registered_initializer(metadata: InitializerMetadata) -> RegisteredInitializer:
@@ -68,10 +69,10 @@ def __init__(self) -> None:
         """Initialize the initializer service."""
         self._registry = InitializerRegistry.get_registry_singleton()
         self._memory = CentralMemory.get_memory_instance()
-        self._custom_initializers_cache: CustomInitializerListResponse | None = None
-        self._custom_cache_expires_at = 0.0
-        self._custom_cache_lock = asyncio.Lock()
-        self._custom_refresh_task: asyncio.Task[None] | None = None
+        self._custom_cache = StaleWhileRevalidateCache[CustomInitializerListResponse](
+            ttl_seconds=_CUSTOM_CACHE_TTL_SECONDS,
+            load_async=lambda _: self._load_custom_initializers_async(),
+        )
 
     async def list_initializers_async(
         self,
@@ -358,57 +359,35 @@ async def list_custom_initializers_async(self) -> CustomInitializerListResponse:
         Returns:
             CustomInitializerListResponse: Credential-free source and stored definitions.
         """
-        if self._custom_initializers_cache is not None:
-            if time.monotonic() >= self._custom_cache_expires_at and (
-                self._custom_refresh_task is None or self._custom_refresh_task.done()
-            ):
-                self._custom_refresh_task = asyncio.create_task(self._refresh_custom_cache_in_background_async())
-            return self._custom_initializers_cache.model_copy(deep=True)
-
-        return await self._refresh_custom_cache_async(force=False)
+        return await self._custom_cache.get_async(key=_CUSTOM_CACHE_KEY)
 
-    async def _refresh_custom_cache_async(self, *, force: bool) -> CustomInitializerListResponse:
+    async def _load_custom_initializers_async(self) -> CustomInitializerListResponse:
         """
         Read custom initializer storage and replace the cached response.
 
         Returns:
             CustomInitializerListResponse: The current stored custom initializers.
         """
-        async with self._custom_cache_lock:
-            if not force and self._custom_initializers_cache is not None:
-                return self._custom_initializers_cache.model_copy(deep=True)
-
-            sources = await asyncio.to_thread(self._registry.list_custom_initializer_sources)
-            response = CustomInitializerListResponse(
-                source=self._registry.custom_scripts_source,
-                items=[
-                    CustomInitializerResponse(
-                        initializer_name=name,
-                        script_content=script_content,
-                        source=self._registry.get_custom_initializer_source(name),
-                    )
-                    for name, script_content in sources.items()
-                ],
-            )
-            self._custom_initializers_cache = response
-            self._custom_cache_expires_at = time.monotonic() + _CUSTOM_CACHE_TTL_SECONDS
-            return response.model_copy(deep=True)
-
-    async def _refresh_custom_cache_in_background_async(self) -> None:
-        """Refresh expired custom initializer data without delaying the request."""
-        try:
-            await self._refresh_custom_cache_async(force=True)
-        except Exception:
-            logger.warning("Failed to refresh custom initializer cache", exc_info=True)
+        sources = await asyncio.to_thread(self._registry.list_custom_initializer_sources)
+        return CustomInitializerListResponse(
+            source=self._registry.custom_scripts_source,
+            items=[
+                CustomInitializerResponse(
+                    initializer_name=name,
+                    script_content=script_content,
+                    source=self._registry.get_custom_initializer_source(name),
+                )
+                for name, script_content in sources.items()
+            ],
+        )
 
     def _invalidate_custom_initializers_cache(self) -> None:
         """Invalidate custom initializer data after a successful mutation."""
-        self._custom_initializers_cache = None
-        self._custom_cache_expires_at = 0.0
+        self._custom_cache.invalidate(_CUSTOM_CACHE_KEY)
 
     async def restore_custom_initializers_async(self) -> None:
         """Restore stored custom initializer definitions into the runtime registry."""
-        await self._refresh_custom_cache_async(force=True)
+        await self._custom_cache.refresh_async(key=_CUSTOM_CACHE_KEY)
         await asyncio.to_thread(self._registry.restore_custom_initializers)
 
     async def unregister_initializer_async(self, *, initializer_name: str) -> None:
diff --git a/pyrit/backend/services/stale_while_revalidate_cache.py b/pyrit/backend/services/stale_while_revalidate_cache.py
new file mode 100644
index 0000000000..be91b6b7cf
--- /dev/null
+++ b/pyrit/backend/services/stale_while_revalidate_cache.py
@@ -0,0 +1,109 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+"""Reusable asynchronous stale-while-revalidate caching."""
+
+import asyncio
+import logging
+import time
+from collections.abc import Awaitable, Callable
+from copy import deepcopy
+from typing import Generic, TypeVar
+
+_ValueT = TypeVar("_ValueT")
+
+logger = logging.getLogger(__name__)
+
+
+class StaleWhileRevalidateCache(Generic[_ValueT]):
+    """Cache keyed values while refreshing expired entries in the background."""
+
+    def __init__(self, *, ttl_seconds: float, load_async: Callable[[str], Awaitable[_ValueT]]) -> None:
+        """Initialize the cache."""
+        self._ttl_seconds = ttl_seconds
+        self._load_value_async = load_async
+        self._entries: dict[str, tuple[float, _ValueT]] = {}
+        self._locks: dict[str, asyncio.Lock] = {}
+        self._refresh_tasks: dict[str, asyncio.Task[None]] = {}
+        self._generations: dict[str, int] = {}
+
+    async def get_async(self, *, key: str) -> _ValueT:
+        """Return a cached value, loading misses and refreshing expired entries in the background."""
+        entry = self._entries.get(key)
+        if entry is None:
+            return await self._load_async(key=key, force=False)
+
+        if time.monotonic() >= entry[0] and key not in self._refresh_tasks:
+            self._refresh_tasks[key] = asyncio.create_task(self._refresh_in_background_async(key=key))
+        return deepcopy(entry[1])
+
+    async def refresh_async(self, *, key: str) -> _ValueT:
+        """
+        Load and cache a fresh value.
+
+        Returns:
+            _ValueT: A copy of the refreshed value.
+        """
+        return await self._load_async(key=key, force=True)
+
+    async def update_async(self, *, key: str, update_async: Callable[[], Awaitable[_ValueT]]) -> _ValueT:
+        """
+        Persist and cache a value while excluding loads for the same key.
+
+        Returns:
+            _ValueT: A copy of the persisted value.
+        """
+        lock = self._locks.setdefault(key, asyncio.Lock())
+        async with lock:
+            value = await update_async()
+            self.set(key=key, value=value)
+            return deepcopy(value)
+
+    def set(self, *, key: str, value: _ValueT) -> None:
+        """Store a value and supersede any in-progress load."""
+        self._advance_generation(key)
+        self._entries[key] = (time.monotonic() + self._ttl_seconds, value)
+
+    def invalidate(self, key: str) -> None:
+        """Remove a value and prevent an in-progress load from restoring it."""
+        self._advance_generation(key)
+        self._entries.pop(key, None)
+
+    def get_refresh_task(self, key: str) -> asyncio.Task[None] | None:
+        """Return the active background refresh task for a key, if any."""
+        return self._refresh_tasks.get(key)
+
+    async def _load_async(
+        self,
+        *,
+        key: str,
+        force: bool,
+    ) -> _ValueT:
+        lock = self._locks.setdefault(key, asyncio.Lock())
+        async with lock:
+            entry = self._entries.get(key)
+            if not force and entry is not None:
+                return deepcopy(entry[1])
+
+            generation = self._generations.get(key, 0)
+            value = await self._load_value_async(key)
+            if self._generations.get(key, 0) == generation:
+                self._entries[key] = (time.monotonic() + self._ttl_seconds, value)
+            return deepcopy(value)
+
+    async def _refresh_in_background_async(
+        self,
+        *,
+        key: str,
+    ) -> None:
+        task = asyncio.current_task()
+        try:
+            await self._load_async(key=key, force=True)
+        except Exception:
+            logger.warning("Failed to refresh cache entry %r", key, exc_info=True)
+        finally:
+            if self._refresh_tasks.get(key) is task:
+                self._refresh_tasks.pop(key, None)
+
+    def _advance_generation(self, key: str) -> None:
+        self._generations[key] = self._generations.get(key, 0) + 1
diff --git a/tests/unit/backend/test_configuration_file_service.py b/tests/unit/backend/test_configuration_file_service.py
index a701fa7354..3eec48badd 100644
--- a/tests/unit/backend/test_configuration_file_service.py
+++ b/tests/unit/backend/test_configuration_file_service.py
@@ -53,15 +53,18 @@ async def test_configuration_file_service_refreshes_blob_after_cache_expires() -
             "pyrit.backend.services.configuration_file_service._download_blob_config_async",
             new=AsyncMock(side_effect=[b"operator: before\n", b"operator: external\n"]),
         ) as download_mock,
-        patch("pyrit.backend.services.configuration_file_service.time.monotonic", return_value=100.0) as monotonic_mock,
+        patch(
+            "pyrit.backend.services.stale_while_revalidate_cache.time.monotonic", return_value=100.0
+        ) as monotonic_mock,
     ):
         assert await service.read_async() == "operator: before\n"
         assert await service.read_async() == "operator: before\n"
 
         monotonic_mock.return_value = 111.0
         assert await service.read_async() == "operator: before\n"
-        assert service._refresh_task is not None
-        await service._refresh_task
+        refresh_task = service._cache.get_refresh_task("configuration")
+        assert refresh_task is not None
+        await refresh_task
         assert await service.read_async() == "operator: external\n"
 
     assert download_mock.await_count == 2
diff --git a/tests/unit/backend/test_configuration_routes.py b/tests/unit/backend/test_configuration_routes.py
index a158948f85..d17e1eb5ea 100644
--- a/tests/unit/backend/test_configuration_routes.py
+++ b/tests/unit/backend/test_configuration_routes.py
@@ -51,6 +51,27 @@ def test_update_configuration_file_persists_content(client: TestClient) -> None:
     service.update_async.assert_awaited_once_with("operator: bob\n")
 
 
+def test_restart_backend_schedules_managed_restart(client: TestClient) -> None:
+    """Test scheduling a restart through the configuration API."""
+    restart_backend = MagicMock()
+    app.state.restart_backend = restart_backend
+    try:
+        response = client.post("/api/config/restart")
+    finally:
+        del app.state.restart_backend
+
+    assert response.status_code == status.HTTP_202_ACCEPTED
+    restart_backend.assert_called_once_with()
+
+
+def test_restart_backend_returns_503_without_managed_server(client: TestClient) -> None:
+    """Test restart rejection when no server callback is installed."""
+    response = client.post("/api/config/restart")
+
+    assert response.status_code == status.HTTP_503_SERVICE_UNAVAILABLE
+    assert response.json()["detail"] == "Backend restart is unavailable for this server process"
+
+
 def test_get_configuration_file_returns_404_when_missing(client: TestClient) -> None:
     """Test that a missing configuration source returns 404."""
     service = MagicMock(read_async=AsyncMock(side_effect=FileNotFoundError))
diff --git a/tests/unit/backend/test_environment_file_service.py b/tests/unit/backend/test_environment_file_service.py
index f077d4f54f..a783a80ed2 100644
--- a/tests/unit/backend/test_environment_file_service.py
+++ b/tests/unit/backend/test_environment_file_service.py
@@ -104,14 +104,18 @@ async def test_environment_file_service_caches_selected_akv_source_until_expiry(
             "pyrit.backend.services.environment_file_service._fetch_akv_document_async",
             new=AsyncMock(side_effect=[("FIRST=1\n", "vault"), ("SECOND=2\n", "vault")]),
         ) as fetch_mock,
-        patch("pyrit.backend.services.environment_file_service.time.monotonic", return_value=100.0) as monotonic_mock,
+        patch(
+            "pyrit.backend.services.stale_while_revalidate_cache.time.monotonic", return_value=100.0
+        ) as monotonic_mock,
     ):
         assert (await service.read_async(file_id="akv:0")).content == "FIRST=1\n"
         assert (await service.read_async(file_id="akv:0")).content == "FIRST=1\n"
 
         monotonic_mock.return_value = 111.0
         assert (await service.read_async(file_id="akv:0")).content == "FIRST=1\n"
-        await service._refresh_tasks["akv:0"]
+        refresh_task = service._cache.get_refresh_task("akv:0")
+        assert refresh_task is not None
+        await refresh_task
         assert (await service.read_async(file_id="akv:0")).content == "SECOND=2\n"
 
     assert fetch_mock.await_count == 2
diff --git a/tests/unit/backend/test_initializer_service.py b/tests/unit/backend/test_initializer_service.py
index fb3cf75520..b23bea3265 100644
--- a/tests/unit/backend/test_initializer_service.py
+++ b/tests/unit/backend/test_initializer_service.py
@@ -5,7 +5,6 @@
 Tests for backend initializer service and routes.
 """
 
-import asyncio
 from typing import Literal
 from unittest.mock import AsyncMock, MagicMock, patch
 
@@ -25,6 +24,7 @@
     RegisteredInitializer,
 )
 from pyrit.backend.services.initializer_service import InitializerService, get_initializer_service
+from pyrit.backend.services.stale_while_revalidate_cache import StaleWhileRevalidateCache
 from pyrit.models import AdditionalInitializer, Parameter
 from pyrit.registry import InitializerMetadata
 
@@ -862,6 +862,13 @@ async def initialize_async(self) -> None:
 """
 
 
+def _initialize_custom_cache(service: InitializerService) -> None:
+    service._custom_cache = StaleWhileRevalidateCache[CustomInitializerListResponse](
+        ttl_seconds=10.0,
+        load_async=lambda _: service._load_custom_initializers_async(),
+    )
+
+
 class TestInitializerServiceRegister:
     """Tests for InitializerService.register_initializer_async."""
 
@@ -875,6 +882,7 @@ async def test_register_initializer_calls_registry(self) -> None:
             ]
             service._registry = mock_registry
             service._memory = MagicMock()
+            _initialize_custom_cache(service)
 
             result = await service.register_initializer_async(name="my_custom", script_content=_SAMPLE_SCRIPT)
 
@@ -905,10 +913,7 @@ async def test_list_custom_initializers_returns_stored_sources(self) -> None:
         with patch.object(InitializerService, "__init__", lambda self: None):
             service = InitializerService()
             service._registry = MagicMock()
-            service._custom_initializers_cache = None
-            service._custom_cache_expires_at = 0.0
-            service._custom_cache_lock = asyncio.Lock()
-            service._custom_refresh_task = None
+            _initialize_custom_cache(service)
             service._registry.custom_scripts_source = "C:/custom"
             service._registry.list_custom_initializer_sources.return_value = {"my_custom": _SAMPLE_SCRIPT}
             service._registry.get_custom_initializer_source.return_value = "C:/custom/my_custom.py"
@@ -928,10 +933,7 @@ async def test_list_custom_initializers_refreshes_expired_cache_in_background(se
         with patch.object(InitializerService, "__init__", lambda self: None):
             service = InitializerService()
             service._registry = MagicMock()
-            service._custom_initializers_cache = None
-            service._custom_cache_expires_at = 0.0
-            service._custom_cache_lock = asyncio.Lock()
-            service._custom_refresh_task = None
+            _initialize_custom_cache(service)
             service._registry.custom_scripts_source = "C:/custom"
             service._registry.list_custom_initializer_sources.side_effect = [
                 {"my_custom": "VALUE = 1\n"},
@@ -940,13 +942,14 @@ async def test_list_custom_initializers_refreshes_expired_cache_in_background(se
             service._registry.get_custom_initializer_source.return_value = "C:/custom/my_custom.py"
 
             with patch(
-                "pyrit.backend.services.initializer_service.time.monotonic", return_value=100.0
+                "pyrit.backend.services.stale_while_revalidate_cache.time.monotonic", return_value=100.0
             ) as monotonic_mock:
                 first = await service.list_custom_initializers_async()
                 monotonic_mock.return_value = 111.0
                 stale = await service.list_custom_initializers_async()
-                assert service._custom_refresh_task is not None
-                await service._custom_refresh_task
+                refresh_task = service._custom_cache.get_refresh_task("custom-initializers")
+                assert refresh_task is not None
+                await refresh_task
                 refreshed = await service.list_custom_initializers_async()
 
             assert first.items[0].script_content == "VALUE = 1\n"
@@ -961,21 +964,19 @@ async def test_restore_custom_initializers_delegates_to_registry(self) -> None:
             service._registry.custom_scripts_source = "C:/custom"
             service._registry.list_custom_initializer_sources.return_value = {"my_custom": _SAMPLE_SCRIPT}
             service._registry.get_custom_initializer_source.return_value = "C:/custom/my_custom.py"
-            service._custom_initializers_cache = None
-            service._custom_cache_expires_at = 0.0
-            service._custom_cache_lock = asyncio.Lock()
-            service._custom_refresh_task = None
+            _initialize_custom_cache(service)
 
             await service.restore_custom_initializers_async()
 
             service._registry.restore_custom_initializers.assert_called_once_with()
-            assert service._custom_initializers_cache is not None
-            assert service._custom_initializers_cache.items[0].script_content == _SAMPLE_SCRIPT
+            cached = await service.list_custom_initializers_async()
+            assert cached.items[0].script_content == _SAMPLE_SCRIPT
 
     async def test_update_initializer_calls_registry(self) -> None:
         with patch.object(InitializerService, "__init__", lambda self: None):
             service = InitializerService()
             service._registry = MagicMock()
+            _initialize_custom_cache(service)
             service._registry.get_all_registered_class_metadata.return_value = [
                 _make_initializer_metadata(registry_name="my_custom", class_name="UpdatedInitializer")
             ]
@@ -998,6 +999,7 @@ async def test_unregister_initializer_calls_registry(self) -> None:
             mock_registry = MagicMock()
             service._registry = mock_registry
             service._memory = MagicMock()
+            _initialize_custom_cache(service)
 
             await service.unregister_initializer_async(initializer_name="target")
 
diff --git a/tests/unit/backend/test_main.py b/tests/unit/backend/test_main.py
index 41887bed35..297c4d02c8 100644
--- a/tests/unit/backend/test_main.py
+++ b/tests/unit/backend/test_main.py
@@ -114,12 +114,13 @@ async def test_lifespan_populates_default_labels_from_operator_and_operation(sel
 
             assert app.state.default_labels == {"operator": "alice", "operation": "op-42"}
 
-    async def test_lifespan_reads_config_file_env_var(self) -> None:
-        """Test that PYRIT_CONFIG_FILE is forwarded to ConfigurationLoader.load_with_overrides."""
+    async def test_lifespan_reads_explicit_config_without_default_layer(self) -> None:
+        """Test that PYRIT_CONFIG_FILE is loaded without merging the default configuration."""
         fake_config = ConfigurationLoader()
         with (
             patch.dict(os.environ, {"PYRIT_CONFIG_FILE": "/tmp/foo.yaml"}, clear=False),
-            patch.object(ConfigurationLoader, "load_with_overrides", return_value=fake_config) as load_mock,
+            patch.object(ConfigurationLoader, "from_yaml_file", return_value=fake_config) as load_mock,
+            patch.object(ConfigurationLoader, "load_with_overrides") as layered_load_mock,
             patch.object(ConfigurationLoader, "initialize_pyrit_async", new=AsyncMock()),
             patch(
                 "pyrit.backend.main.get_initializer_service",
@@ -133,8 +134,8 @@ async def test_lifespan_reads_config_file_env_var(self) -> None:
             async with lifespan(app):
                 pass
 
-            call_kwargs = load_mock.call_args.kwargs
-            assert str(call_kwargs["config_file"]).endswith("foo.yaml")
+            assert str(load_mock.call_args.args[0]).endswith("foo.yaml")
+            layered_load_mock.assert_not_called()
 
     async def test_lifespan_configures_custom_initializer_source_from_config(self) -> None:
         """Test that YAML config determines the custom script source."""
@@ -162,7 +163,7 @@ async def test_lifespan_downloads_blob_config_to_temporary_file(self) -> None:
         config_content = b"operator: blob-user\n"
         loaded_path: Path | None = None
 
-        def load_config(*, config_file: Path) -> ConfigurationLoader:
+        def load_config(config_file: Path) -> ConfigurationLoader:
             nonlocal loaded_path
             loaded_path = config_file
             assert config_file.suffix == ".yaml"
@@ -179,7 +180,7 @@ def load_config(*, config_file: Path) -> ConfigurationLoader:
                 "pyrit.backend.services.configuration_file_service._download_blob_config_async",
                 new=AsyncMock(return_value=config_content),
             ),
-            patch.object(ConfigurationLoader, "load_with_overrides", side_effect=load_config),
+            patch.object(ConfigurationLoader, "from_yaml_file", side_effect=load_config),
             patch.object(ConfigurationLoader, "initialize_pyrit_async", new=AsyncMock()),
             patch(
                 "pyrit.backend.main.get_initializer_service",
diff --git a/tests/unit/backend/test_pyrit_backend.py b/tests/unit/backend/test_pyrit_backend.py
index 4ff22c7413..b1fce5912e 100644
--- a/tests/unit/backend/test_pyrit_backend.py
+++ b/tests/unit/backend/test_pyrit_backend.py
@@ -1,11 +1,12 @@
 # Copyright (c) Microsoft Corporation.
 # Licensed under the MIT license.
 
-from unittest.mock import MagicMock, patch
+from unittest.mock import AsyncMock, MagicMock, patch
 
 import pytest
 
 from pyrit.backend import pyrit_backend
+from pyrit.backend.main import app
 
 
 class TestParseArgs:
@@ -42,15 +43,14 @@ def test_parse_args_accepts_reload(self) -> None:
 class TestMain:
     """Tests for pyrit_backend.main."""
 
-    @patch("uvicorn.run")
-    def test_main_starts_uvicorn(self, mock_run: MagicMock) -> None:
+    @patch("pyrit.backend.pyrit_backend._run_server")
+    def test_main_starts_uvicorn(self, mock_run_server: MagicMock) -> None:
         result = pyrit_backend.main(args=[])
         assert result == 0
-        mock_run.assert_called_once()
-        assert mock_run.call_args[0][0] == "pyrit.backend.main:app"
+        mock_run_server.assert_called_once()
 
-    @patch("uvicorn.run")
-    def test_main_forwards_config_file_via_env(self, mock_run: MagicMock) -> None:
+    @patch("pyrit.backend.pyrit_backend._run_server")
+    def test_main_forwards_config_file_via_env(self, mock_run_server: MagicMock) -> None:
         import os
 
         with patch.dict(os.environ, {}, clear=False):
@@ -58,8 +58,8 @@ def test_main_forwards_config_file_via_env(self, mock_run: MagicMock) -> None:
             assert os.environ.get("PYRIT_CONFIG_FILE") is not None
             assert "custom.yaml" in os.environ["PYRIT_CONFIG_FILE"]
 
-    @patch("uvicorn.run")
-    def test_main_forwards_blob_config_uri_via_env(self, mock_run: MagicMock) -> None:
+    @patch("pyrit.backend.pyrit_backend._run_server")
+    def test_main_forwards_blob_config_uri_via_env(self, mock_run_server: MagicMock) -> None:
         import os
 
         blob_uri = "https://behnamousatairtsa.blob.core.windows.net/copyrit/.pyrit_conf"
@@ -68,10 +68,10 @@ def test_main_forwards_blob_config_uri_via_env(self, mock_run: MagicMock) -> Non
 
             assert os.environ["PYRIT_CONFIG_FILE"] == blob_uri
 
-    @patch("uvicorn.run")
-    def test_main_passes_host_and_port(self, mock_run: MagicMock) -> None:
+    @patch("pyrit.backend.pyrit_backend._run_server")
+    def test_main_passes_host_and_port(self, mock_run_server: MagicMock) -> None:
         pyrit_backend.main(args=["--host", "0.0.0.0", "--port", "9000"])
-        call_kwargs = mock_run.call_args.kwargs
+        call_kwargs = mock_run_server.call_args.kwargs
         assert call_kwargs["host"] == "0.0.0.0"
         assert call_kwargs["port"] == 9000
 
@@ -79,51 +79,82 @@ def test_main_invalid_args(self) -> None:
         result = pyrit_backend.main(args=["--invalid-flag"])
         assert result == 2
 
-    @patch("uvicorn.run", side_effect=KeyboardInterrupt())
-    def test_main_keyboard_interrupt_returns_zero(self, mock_run: MagicMock, capsys) -> None:
+    @patch("pyrit.backend.pyrit_backend._run_server", side_effect=KeyboardInterrupt())
+    def test_main_keyboard_interrupt_returns_zero(self, mock_run_server: MagicMock, capsys) -> None:
         result = pyrit_backend.main(args=[])
         assert result == 0
         captured = capsys.readouterr()
         assert "Backend stopped" in captured.out
 
-    @patch("uvicorn.run", side_effect=RuntimeError("boom"))
-    def test_main_unexpected_exception_returns_one(self, mock_run: MagicMock, capsys) -> None:
+    @patch("pyrit.backend.pyrit_backend._run_server", side_effect=RuntimeError("boom"))
+    def test_main_unexpected_exception_returns_one(self, mock_run_server: MagicMock, capsys) -> None:
         result = pyrit_backend.main(args=[])
         assert result == 1
         captured = capsys.readouterr()
         assert "boom" in captured.out
 
-    @patch("uvicorn.run")
-    def test_main_forwards_log_level(self, mock_run: MagicMock) -> None:
+    @patch("pyrit.backend.pyrit_backend._run_server")
+    def test_main_forwards_log_level(self, mock_run_server: MagicMock) -> None:
         pyrit_backend.main(args=["--log-level", "DEBUG"])
-        assert mock_run.call_args.kwargs["log_level"] == "debug"
+        assert mock_run_server.call_args.kwargs["log_level"] == "debug"
 
-    @patch("uvicorn.run")
-    def test_main_forwards_reload_flag(self, mock_run: MagicMock) -> None:
+    @patch("pyrit.backend.pyrit_backend._run_server")
+    def test_main_forwards_reload_flag(self, mock_run_server: MagicMock) -> None:
         pyrit_backend.main(args=["--reload"])
-        assert mock_run.call_args.kwargs["reload"] is True
+        assert mock_run_server.call_args.kwargs["reload"] is True
 
-    @patch("uvicorn.run")
-    def test_main_warns_when_binding_non_loopback(self, mock_run: MagicMock, capsys) -> None:
+    @patch("pyrit.backend.pyrit_backend._run_server")
+    def test_main_warns_when_binding_non_loopback(self, mock_run_server: MagicMock, capsys) -> None:
         pyrit_backend.main(args=["--host", "0.0.0.0", "--port", "9000"])
         captured = capsys.readouterr()
         assert "WARNING" in captured.err
         assert "0.0.0.0" in captured.err
         assert "9000" in captured.err
 
-    @patch("uvicorn.run")
-    def test_main_no_warning_for_localhost(self, mock_run: MagicMock, capsys) -> None:
+    @patch("pyrit.backend.pyrit_backend._run_server")
+    def test_main_no_warning_for_localhost(self, mock_run_server: MagicMock, capsys) -> None:
         pyrit_backend.main(args=["--host", "localhost"])
         captured = capsys.readouterr()
         assert "WARNING" not in captured.err
 
-    @patch("uvicorn.run")
-    def test_main_no_warning_for_127_0_0_1(self, mock_run: MagicMock, capsys) -> None:
+    @patch("pyrit.backend.pyrit_backend._run_server")
+    def test_main_no_warning_for_127_0_0_1(self, mock_run_server: MagicMock, capsys) -> None:
         pyrit_backend.main(args=["--host", "127.0.0.1"])
         captured = capsys.readouterr()
         assert "WARNING" not in captured.err
 
 
+class TestRunServer:
+    """Tests for the managed uvicorn server loop."""
+
+    @patch("uvicorn.Server")
+    def test_restart_callback_starts_new_server(self, mock_server_type: MagicMock) -> None:
+        first_server = MagicMock()
+        second_server = MagicMock()
+        first_server.serve = AsyncMock(side_effect=lambda: app.state.restart_backend())
+        second_server.serve = AsyncMock()
+        mock_server_type.side_effect = [first_server, second_server]
+
+        pyrit_backend._run_server(host="localhost", port=8000, log_level="warning", reload=False)
+
+        assert mock_server_type.call_count == 2
+        assert first_server.should_exit is True
+        first_server.serve.assert_awaited_once_with()
+        second_server.serve.assert_awaited_once_with()
+
+    @patch("uvicorn.run")
+    def test_reload_uses_uvicorn_reloader(self, mock_run: MagicMock) -> None:
+        pyrit_backend._run_server(host="localhost", port=8000, log_level="warning", reload=True)
+
+        mock_run.assert_called_once_with(
+            "pyrit.backend.main:app",
+            host="localhost",
+            port=8000,
+            log_level="warning",
+            reload=True,
+        )
+
+
 class TestParseArgsDoesNotAcceptLegacyFlags:
     """
     Regression: the thin backend only takes --host/--port/--config-file/--log-level/--reload.
diff --git a/tests/unit/backend/test_stale_while_revalidate_cache.py b/tests/unit/backend/test_stale_while_revalidate_cache.py
new file mode 100644
index 0000000000..1d1c83ebf3
--- /dev/null
+++ b/tests/unit/backend/test_stale_while_revalidate_cache.py
@@ -0,0 +1,53 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+"""Tests for the asynchronous stale-while-revalidate cache."""
+
+import asyncio
+from unittest.mock import patch
+
+from pyrit.backend.services.stale_while_revalidate_cache import StaleWhileRevalidateCache
+
+
+async def test_invalidation_during_refresh_prevents_stale_repopulation() -> None:
+    """Test that an in-flight refresh cannot restore an invalidated value."""
+    refresh_started = asyncio.Event()
+    allow_refresh = asyncio.Event()
+    load_count = 0
+
+    async def load_async(_: str) -> str:
+        nonlocal load_count
+        load_count += 1
+        if load_count == 2:
+            refresh_started.set()
+            await allow_refresh.wait()
+        return f"value-{load_count}"
+
+    cache = StaleWhileRevalidateCache[str](ttl_seconds=10.0, load_async=load_async)
+    with patch("pyrit.backend.services.stale_while_revalidate_cache.time.monotonic", return_value=100.0) as clock:
+        assert await cache.get_async(key="key") == "value-1"
+
+        clock.return_value = 111.0
+        assert await cache.get_async(key="key") == "value-1"
+        refresh_task = cache.get_refresh_task("key")
+        assert refresh_task is not None
+        await refresh_started.wait()
+
+        cache.invalidate("key")
+        allow_refresh.set()
+        await refresh_task
+
+        assert await cache.get_async(key="key") == "value-3"
+
+
+async def test_cached_mutable_values_are_copied() -> None:
+    """Test that callers cannot mutate the value retained by the cache."""
+    async def load_async(_: str) -> list[str]:
+        return ["original"]
+
+    cache = StaleWhileRevalidateCache[list[str]](ttl_seconds=10.0, load_async=load_async)
+
+    first = await cache.get_async(key="key")
+    first.append("changed")
+
+    assert await cache.get_async(key="key") == ["original"]

From edf998316c1804004eaf7881f6daa41ae4a4f602 Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Wed, 26 Aug 2026 14:40:40 -0700
Subject: [PATCH 08/24] update deployment

---
 docker/start.sh               | 54 ++++++++++++++++++-----------------
 infra/README.md               | 24 ++++++++++++++--
 infra/deploy_instance.py      | 11 +++++++
 infra/main.bicep              |  9 ++++++
 infra/parameters.demo.json    |  3 ++
 infra/parameters.example.json |  3 ++
 6 files changed, 76 insertions(+), 28 deletions(-)

diff --git a/docker/start.sh b/docker/start.sh
index 9bb394865d..816903fe86 100644
--- a/docker/start.sh
+++ b/docker/start.sh
@@ -57,28 +57,33 @@ if [ "$PYRIT_MODE" = "jupyter" ]; then
     exec jupyter lab --ip=0.0.0.0 --port=8888 --no-browser --allow-root --notebook-dir=/app/notebooks
 elif [ "$PYRIT_MODE" = "gui" ]; then
     echo "Starting PyRIT GUI on port 8000..."
-    # The thin backend only takes --host/--port/--config-file/--log-level.
-    # Translate AZURE_SQL_SERVER and PYRIT_INITIALIZER into a runtime config file
-    # so the FastAPI lifespan (ConfigurationLoader) picks them up on startup.
-    RUNTIME_CONFIG=/tmp/pyrit_runtime.yaml
-    {
-        if [ -n "$AZURE_SQL_SERVER" ]; then
-            echo "Using Azure SQL database (server: $AZURE_SQL_SERVER)" >&2
-            echo "memory_db_type: AzureSQL"
-        else
-            echo "Using SQLite database (AZURE_SQL_SERVER not set)" >&2
-            echo "memory_db_type: SQLite"
-        fi
-        if [ -n "$PYRIT_INITIALIZER" ]; then
-            echo "Using initializer: $PYRIT_INITIALIZER" >&2
-            echo "initializers:"
-            # Split comma-separated initializer names into a YAML list.
-            IFS=',' read -ra INIT_NAMES <<<"$PYRIT_INITIALIZER"
-            for name in "${INIT_NAMES[@]}"; do
-                echo "  - $(echo "$name" | xargs)"
-            done
-        fi
-    } >"$RUNTIME_CONFIG"
+    BACKEND_ARGS=(--host 0.0.0.0 --port 8000)
+    if [ -n "$PYRIT_CONFIG_FILE" ]; then
+        echo "Using configured PyRIT configuration source"
+        BACKEND_ARGS+=(--config-file "$PYRIT_CONFIG_FILE")
+    else
+        # Preserve the deployment-parameter fallback when no complete config is supplied.
+        RUNTIME_CONFIG=/tmp/pyrit_runtime.yaml
+        {
+            if [ -n "$AZURE_SQL_SERVER" ]; then
+                echo "Using Azure SQL database (server: $AZURE_SQL_SERVER)" >&2
+                echo "memory_db_type: AzureSQL"
+            else
+                echo "Using SQLite database (AZURE_SQL_SERVER not set)" >&2
+                echo "memory_db_type: SQLite"
+            fi
+            if [ -n "$PYRIT_INITIALIZER" ]; then
+                echo "Using initializer: $PYRIT_INITIALIZER" >&2
+                echo "initializers:"
+                # Split comma-separated initializer names into a YAML list.
+                IFS=',' read -ra INIT_NAMES <<<"$PYRIT_INITIALIZER"
+                for name in "${INIT_NAMES[@]}"; do
+                    echo "  - $(echo "$name" | xargs)"
+                done
+            fi
+        } >"$RUNTIME_CONFIG"
+        BACKEND_ARGS+=(--config-file "$RUNTIME_CONFIG")
+    fi
 
     # Pick the launcher module. PR #1753 moved the launcher from
     # ``pyrit.cli.pyrit_backend`` to ``pyrit.backend.pyrit_backend``. The PyPI
@@ -96,10 +101,7 @@ elif [ "$PYRIT_MODE" = "gui" ]; then
         exit 1
     fi
 
-    exec python -m "$BACKEND_MODULE" \
-        --host 0.0.0.0 \
-        --port 8000 \
-        --config-file "$RUNTIME_CONFIG"
+    exec python -m "$BACKEND_MODULE" "${BACKEND_ARGS[@]}"
 else
     echo "ERROR: Invalid PYRIT_MODE '$PYRIT_MODE'. Must be 'jupyter' or 'gui'"
     exit 1
diff --git a/infra/README.md b/infra/README.md
index f4af84d426..4fca8023c9 100644
--- a/infra/README.md
+++ b/infra/README.md
@@ -410,13 +410,33 @@ that CIDR range can reach the app.
 
 ## Configuration: .pyrit_conf and .env
 
-The template replaces `.pyrit_conf` and `.env` with Bicep parameters — no files
-needed in the container.
+The backend can load `.pyrit_conf` directly from Azure Blob Storage. Set
+`pyritConfigFileUri` to a blob HTTPS URI such as
+`https://<account>.blob.core.windows.net/config/.pyrit_conf`. `start.sh` passes
+the URI to `pyrit_backend --config-file`; the backend downloads it with the
+Container App's user-assigned managed identity. Leave the parameter empty to
+generate the existing minimal config from `sqlServerFqdn` and
+`pyritInitializer` at container startup.
+
+Grant the managed identity `Storage Blob Data Contributor` on the config blob,
+container, or storage account. Contributor access is needed because the GUI's
+configuration API can update the same blob; `Storage Blob Data Reader` is
+sufficient only for read-only startup. The storage firewall must also allow the
+Container App's network path. Prefer an identity-protected URI without a SAS
+token.
+
+The template accepts an existing blob URI rather than creating or seeding a
+storage account. `infra/deploy_instance.py` already creates per-instance blob
+storage and grants storage RBAC, but its `dbdata` container is intended for
+result data. Create a separate private `config` container when reusing that
+account, upload `.pyrit_conf`, and pass its URI with
+`--pyrit-config-file-uri`.
 
 ### .pyrit_conf fields → Bicep params
 
 | .pyrit_conf field | Bicep param | Env var | Notes |
 |-------------------|-------------|---------|-------|
+| Complete file | `pyritConfigFileUri` | `PYRIT_CONFIG_FILE` | Preferred; Azure Blob URI loaded with managed identity |
 | `initializers` | `pyritInitializer` | `PYRIT_INITIALIZER` | Default `target`: `target` populates the TargetRegistry (read by the GUI);|
 | `operator` | — | Set per-user in the GUI | |
 | `operation` | — | Set per-user in the GUI | |
diff --git a/infra/deploy_instance.py b/infra/deploy_instance.py
index e038d518ab..99a730a67b 100644
--- a/infra/deploy_instance.py
+++ b/infra/deploy_instance.py
@@ -767,6 +767,7 @@ def deploy_bicep(
     kv_resource_id: str,
     acr_name: str,
     env_file_contents: str,
+    pyrit_config_file_uri: str,
     owner_tag: str = "",
 ) -> dict:
     """
@@ -792,6 +793,8 @@ def deploy_bicep(
         acr_name (str): The ACR name.
         env_file_contents (str): The prepared .env content to inject as
             the Container App's `env-file` secret.
+        pyrit_config_file_uri (str): Optional Azure Blob URI for the backend
+            configuration file.
         owner_tag (str): Value for the Owner tag on Bicep-managed resources.
 
     Returns:
@@ -811,6 +814,7 @@ def deploy_bicep(
         "acrName": {"value": acr_name},
         "enablePrivateEndpoint": {"value": False},
         "envFileContents": {"value": env_file_contents},
+        "pyritConfigFileUri": {"value": pyrit_config_file_uri},
     }
     if owner_tag:
         parameters["tags"] = {"value": {"Service": "pyrit-gui", "Owner": owner_tag}}
@@ -1091,6 +1095,11 @@ def parse_args(args: list[str] | None = None) -> argparse.Namespace:
         required=True,
         help="Container image reference (e.g., myacr.azurecr.io/pyrit:abc1234)",
     )
+    parser.add_argument(
+        "--pyrit-config-file-uri",
+        default="",
+        help="Azure Blob HTTPS URI for .pyrit_conf (optional)",
+    )
     parser.add_argument(
         "--allowed-groups",
         required=True,
@@ -1205,6 +1214,7 @@ def main(args: list[str] | None = None) -> int:
         logger.info("Allowed groups: %s", group_ids)
         logger.info("Env file: %s", env_file)
         logger.info("Container image: %s", parsed.container_image)
+        logger.info("PyRIT config file URI: %s", parsed.pyrit_config_file_uri or "(generated at startup)")
         logger.info("ACR: %s", parsed.acr_name)
         logger.info("Location: %s", parsed.location)
         logger.info("Subscription: %s", parsed.subscription)
@@ -1302,6 +1312,7 @@ def main(args: list[str] | None = None) -> int:
             kv_resource_id=kv_id,
             acr_name=parsed.acr_name,
             env_file_contents=env_content,
+            pyrit_config_file_uri=parsed.pyrit_config_file_uri,
             owner_tag=parsed.owner_tag,
         )
 
diff --git a/infra/main.bicep b/infra/main.bicep
index 367be3ea92..c1d01e0a04 100644
--- a/infra/main.bicep
+++ b/infra/main.bicep
@@ -77,6 +77,9 @@ param sqlDatabaseName string
 @description('PyRIT initializer to run. Default "target" registers target configs.')
 param pyritInitializer string = 'target'
 
+@description('Optional Azure Blob HTTPS URI for the backend .pyrit_conf. The container managed identity must have blob data access. When empty, start.sh generates config from the SQL and initializer parameters.')
+param pyritConfigFileUri string = ''
+
 @description('Key Vault secret name containing the .env file contents (all endpoints, models, and API keys). The secret is mounted as an env var and PyRIT parses it at startup.')
 param envSecretName string = 'env-global'
 
@@ -457,6 +460,12 @@ resource containerApp 'Microsoft.App/containerApps@2024-03-01' = {
               name: 'PYRIT_INITIALIZER'
               value: pyritInitializer
             }
+            // When set, start.sh passes this blob URI directly to pyrit_backend.
+            // DefaultAzureCredential uses the UAMI selected by AZURE_CLIENT_ID.
+            {
+              name: 'PYRIT_CONFIG_FILE'
+              value: pyritConfigFileUri
+            }
             // .env file contents from Key Vault — PyRIT parses this at startup
             {
               name: 'PYRIT_ENV_CONTENTS'
diff --git a/infra/parameters.demo.json b/infra/parameters.demo.json
index fd09671419..2942bab621 100644
--- a/infra/parameters.demo.json
+++ b/infra/parameters.demo.json
@@ -31,6 +31,9 @@
     "pyritInitializer": {
       "value": "target"
     },
+    "pyritConfigFileUri": {
+      "value": ""
+    },
     "envFileContents": {
       "value": "PYRIT_REPLACE_ME=set-via-secure-channel"
     },
diff --git a/infra/parameters.example.json b/infra/parameters.example.json
index 1bf9ed92d7..31536c6bf2 100644
--- a/infra/parameters.example.json
+++ b/infra/parameters.example.json
@@ -29,6 +29,9 @@
     "pyritInitializer": {
       "value": "target"
     },
+    "pyritConfigFileUri": {
+      "value": ""
+    },
     "envSecretName": {
       "value": "env-global"
     },

From cd3a27c025f9b1b671f63d350f2a92a9e5c86ed7 Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Wed, 26 Aug 2026 14:47:53 -0700
Subject: [PATCH 09/24] precommit

---
 .../BackendConfiguration/BackendConfiguration.styles.ts       | 2 +-
 .../BackendConfiguration/BackendConfiguration.test.tsx        | 2 +-
 .../components/BackendConfiguration/BackendConfiguration.tsx  | 2 +-
 .../BackendConfiguration/CustomInitializerFiles.tsx           | 2 +-
 .../src/components/BackendConfiguration/PythonCode.styles.ts  | 2 +-
 frontend/src/components/BackendConfiguration/PythonCode.tsx   | 2 +-
 frontend/src/components/BackendConfiguration/YamlEditor.tsx   | 2 +-
 frontend/src/components/CodeEditorFrame.tsx                   | 2 +-
 .../src/components/Initializers/CustomInitializers.test.tsx   | 2 +-
 pyrit/backend/routes/configuration.py                         | 3 ++-
 pyrit/backend/services/configuration_file_service.py          | 4 +++-
 tests/unit/backend/test_stale_while_revalidate_cache.py       | 1 +
 12 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/frontend/src/components/BackendConfiguration/BackendConfiguration.styles.ts b/frontend/src/components/BackendConfiguration/BackendConfiguration.styles.ts
index ca5dd0e932..aa94255f98 100644
--- a/frontend/src/components/BackendConfiguration/BackendConfiguration.styles.ts
+++ b/frontend/src/components/BackendConfiguration/BackendConfiguration.styles.ts
@@ -147,4 +147,4 @@ export const useBackendConfigurationStyles = makeStyles({
     maxWidth: '100%',
     gap: tokens.spacingVerticalM,
   },
-})
\ No newline at end of file
+})
diff --git a/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx b/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx
index a1a8dded0e..5b6ca34fc4 100644
--- a/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx
+++ b/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx
@@ -234,4 +234,4 @@ describe('BackendConfiguration', () => {
       })
     })
   })
-})
\ No newline at end of file
+})
diff --git a/frontend/src/components/BackendConfiguration/BackendConfiguration.tsx b/frontend/src/components/BackendConfiguration/BackendConfiguration.tsx
index 7ac6941559..ff7ca7d9d2 100644
--- a/frontend/src/components/BackendConfiguration/BackendConfiguration.tsx
+++ b/frontend/src/components/BackendConfiguration/BackendConfiguration.tsx
@@ -198,4 +198,4 @@ export default function BackendConfiguration() {
       )}
     </main>
   )
-}
\ No newline at end of file
+}
diff --git a/frontend/src/components/BackendConfiguration/CustomInitializerFiles.tsx b/frontend/src/components/BackendConfiguration/CustomInitializerFiles.tsx
index c795a5b4ff..d0eb2aed17 100644
--- a/frontend/src/components/BackendConfiguration/CustomInitializerFiles.tsx
+++ b/frontend/src/components/BackendConfiguration/CustomInitializerFiles.tsx
@@ -123,4 +123,4 @@ export default function CustomInitializerFiles() {
       />
     </div>
   )
-}
\ No newline at end of file
+}
diff --git a/frontend/src/components/BackendConfiguration/PythonCode.styles.ts b/frontend/src/components/BackendConfiguration/PythonCode.styles.ts
index 033021a82d..8d7fa29b7e 100644
--- a/frontend/src/components/BackendConfiguration/PythonCode.styles.ts
+++ b/frontend/src/components/BackendConfiguration/PythonCode.styles.ts
@@ -80,4 +80,4 @@ export const usePythonCodeStyles = makeStyles({
       backgroundColor: tokens.colorBrandBackground2,
     },
   },
-})
\ No newline at end of file
+})
diff --git a/frontend/src/components/BackendConfiguration/PythonCode.tsx b/frontend/src/components/BackendConfiguration/PythonCode.tsx
index 415dbdd3c2..1defbf512d 100644
--- a/frontend/src/components/BackendConfiguration/PythonCode.tsx
+++ b/frontend/src/components/BackendConfiguration/PythonCode.tsx
@@ -65,4 +65,4 @@ export function PythonCodeEditor({ source, disabled, onChange }: PythonCodeEdito
       </div>
     </CodeEditorFrame>
   )
-}
\ No newline at end of file
+}
diff --git a/frontend/src/components/BackendConfiguration/YamlEditor.tsx b/frontend/src/components/BackendConfiguration/YamlEditor.tsx
index bf9e54a3e2..2db244aee4 100644
--- a/frontend/src/components/BackendConfiguration/YamlEditor.tsx
+++ b/frontend/src/components/BackendConfiguration/YamlEditor.tsx
@@ -53,4 +53,4 @@ export default function YamlEditor({ value, disabled, onChange }: YamlEditorProp
       </div>
     </CodeEditorFrame>
   )
-}
\ No newline at end of file
+}
diff --git a/frontend/src/components/CodeEditorFrame.tsx b/frontend/src/components/CodeEditorFrame.tsx
index 10d54d50a4..627c20b235 100644
--- a/frontend/src/components/CodeEditorFrame.tsx
+++ b/frontend/src/components/CodeEditorFrame.tsx
@@ -60,4 +60,4 @@ export default function CodeEditorFrame({ language, value, children }: CodeEdito
       {children}
     </div>
   )
-}
\ No newline at end of file
+}
diff --git a/frontend/src/components/Initializers/CustomInitializers.test.tsx b/frontend/src/components/Initializers/CustomInitializers.test.tsx
index 1fd452faf3..af8b10b499 100644
--- a/frontend/src/components/Initializers/CustomInitializers.test.tsx
+++ b/frontend/src/components/Initializers/CustomInitializers.test.tsx
@@ -107,4 +107,4 @@ describe('CustomInitializers', () => {
 
     expect(defaultProps.onRegister).toHaveBeenCalledWith('new_custom', 'class NewCustom: pass')
   })
-})
\ No newline at end of file
+})
diff --git a/pyrit/backend/routes/configuration.py b/pyrit/backend/routes/configuration.py
index 77d2defdcc..42f2910d51 100644
--- a/pyrit/backend/routes/configuration.py
+++ b/pyrit/backend/routes/configuration.py
@@ -5,6 +5,7 @@
 
 import os
 from collections.abc import Callable
+from typing import cast
 
 from azure.core.exceptions import ResourceNotFoundError
 from fastapi import APIRouter, BackgroundTasks, HTTPException, Request, status
@@ -68,7 +69,7 @@ def _get_restart_callback(request: Request) -> Callable[[], None]:
             status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
             detail="Backend restart is unavailable for this server process",
         )
-    return callback
+    return cast("Callable[[], None]", callback)
 
 
 @router.get(
diff --git a/pyrit/backend/services/configuration_file_service.py b/pyrit/backend/services/configuration_file_service.py
index a7c9195812..d27e9b5b48 100644
--- a/pyrit/backend/services/configuration_file_service.py
+++ b/pyrit/backend/services/configuration_file_service.py
@@ -119,7 +119,9 @@ async def _read_source_async(self) -> str:
         if _is_azure_blob_uri(self._source):
             return (await _download_blob_config_async(self._source)).decode("utf-8")
         async with aiofiles.open(self._source, encoding="utf-8") as config_file:
-            return await config_file.read()
+            content = await config_file.read()
+        assert isinstance(content, str)
+        return content
 
     async def update_async(self, content: str) -> None:
         """Replace the current configuration contents."""
diff --git a/tests/unit/backend/test_stale_while_revalidate_cache.py b/tests/unit/backend/test_stale_while_revalidate_cache.py
index 1d1c83ebf3..a68abd247d 100644
--- a/tests/unit/backend/test_stale_while_revalidate_cache.py
+++ b/tests/unit/backend/test_stale_while_revalidate_cache.py
@@ -42,6 +42,7 @@ async def load_async(_: str) -> str:
 
 async def test_cached_mutable_values_are_copied() -> None:
     """Test that callers cannot mutate the value retained by the cache."""
+
     async def load_async(_: str) -> list[str]:
         return ["original"]
 

From a71ed7750fb9190ad2a94d3eec93ab35da8e2101 Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Thu, 27 Aug 2026 08:33:47 -0700
Subject: [PATCH 10/24] dont change old initializer paths

---
 .../BackendConfiguration.test.tsx             |  36 +--
 .../CustomInitializerFiles.tsx                |  10 +-
 .../Initializers/CustomInitializers.test.tsx  |   8 +-
 .../Initializers/CustomInitializers.tsx       |   8 +-
 frontend/src/services/api.test.ts             |   9 +-
 frontend/src/services/api.ts                  |  16 +-
 frontend/src/types/index.ts                   |   5 -
 pyrit/backend/models/__init__.py              |   5 +-
 pyrit/backend/routes/initializers.py          |  62 ++++-
 pyrit/backend/services/initializer_service.py |  55 ++--
 .../components/initializer_registry.py        |  26 ++
 .../unit/backend/test_initializer_service.py  | 234 +++++-------------
 .../registry/test_initializer_registry.py     |  27 ++
 13 files changed, 246 insertions(+), 255 deletions(-)

diff --git a/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx b/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx
index 5b6ca34fc4..c0081f8112 100644
--- a/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx
+++ b/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx
@@ -17,9 +17,8 @@ jest.mock('@/services/api', () => ({
   },
   initializersApi: {
     listCustom: jest.fn(),
-    register: jest.fn(),
     updateCustom: jest.fn(),
-    unregister: jest.fn(),
+    deleteCustom: jest.fn(),
   },
 }))
 
@@ -65,21 +64,12 @@ describe('BackendConfiguration', () => {
         },
       ],
     })
-    mockedInitializersApi.register.mockResolvedValue({
-      initializer_name: 'new_custom',
-      initializer_type: 'NewCustomInitializer',
-      description: 'New custom initializer.',
-      required_env_vars: [],
-      supported_parameters: [],
-    })
     mockedInitializersApi.updateCustom.mockResolvedValue({
       initializer_name: 'custom_target',
-      initializer_type: 'CustomTargetInitializer',
-      description: 'Updated custom initializer.',
-      required_env_vars: [],
-      supported_parameters: [],
+      script_content: 'class UpdatedCustomTargetInitializer: pass',
+      source: 'C:/Users/test/.pyrit/custom_initializers/custom_target.py',
     })
-    mockedInitializersApi.unregister.mockResolvedValue()
+    mockedInitializersApi.deleteCustom.mockResolvedValue()
   })
 
   it('should load and display configuration content', async () => {
@@ -211,27 +201,27 @@ describe('BackendConfiguration', () => {
         script_content: 'class UpdatedCustomTargetInitializer: pass',
       })
     })
-    expect(await screen.findByText('Updated custom_target.')).toBeInTheDocument()
+    expect(await screen.findByText('Updated custom_target. Restart the backend to load the change.')).toBeInTheDocument()
   })
 
-  it('should register a storage-backed custom initializer', async () => {
+  it('should add a storage-backed custom initializer', async () => {
     const user = userEvent.setup()
     renderPage()
 
     await user.click(screen.getByRole('tab', { name: 'Custom Initializers' }))
-    await user.click(screen.getByRole('button', { name: 'Register initializer' }))
-    const registerDialog = await screen.findByRole('dialog')
-    await user.type(within(registerDialog).getByRole('textbox', { name: /Initializer name/ }), 'new_custom')
-    fireEvent.change(within(registerDialog).getByRole('textbox', { name: 'Python source' }), {
+    await user.click(screen.getByRole('button', { name: 'Add initializer' }))
+    const addDialog = await screen.findByRole('dialog')
+    await user.type(within(addDialog).getByRole('textbox', { name: /Initializer name/ }), 'new_custom')
+    fireEvent.change(within(addDialog).getByRole('textbox', { name: 'Python source' }), {
       target: { value: 'class NewCustom: pass' },
     })
-    await user.click(within(registerDialog).getByRole('button', { name: 'Register' }))
+    await user.click(within(addDialog).getByRole('button', { name: 'Add' }))
 
     await waitFor(() => {
-      expect(mockedInitializersApi.register).toHaveBeenCalledWith({
-        name: 'new_custom',
+      expect(mockedInitializersApi.updateCustom).toHaveBeenCalledWith('new_custom', {
         script_content: 'class NewCustom: pass',
       })
     })
+    expect(await screen.findByText('Added new_custom. Restart the backend to load it.')).toBeInTheDocument()
   })
 })
diff --git a/frontend/src/components/BackendConfiguration/CustomInitializerFiles.tsx b/frontend/src/components/BackendConfiguration/CustomInitializerFiles.tsx
index d0eb2aed17..5ecfc11647 100644
--- a/frontend/src/components/BackendConfiguration/CustomInitializerFiles.tsx
+++ b/frontend/src/components/BackendConfiguration/CustomInitializerFiles.tsx
@@ -59,9 +59,9 @@ export default function CustomInitializerFiles() {
     setRegistering(true)
     setStatusMessage(null)
     try {
-      await initializersApi.register({ name, script_content: scriptContent })
+      await initializersApi.updateCustom(name, { script_content: scriptContent })
       await reload()
-      setStatusMessage({ intent: 'success', text: `Registered ${name}.` })
+      setStatusMessage({ intent: 'success', text: `Added ${name}. Restart the backend to load it.` })
       return true
     } catch (error) {
       setStatusMessage({ intent: 'error', text: toApiError(error).detail })
@@ -77,7 +77,7 @@ export default function CustomInitializerFiles() {
     try {
       await initializersApi.updateCustom(name, { script_content: scriptContent })
       await reload()
-      setStatusMessage({ intent: 'success', text: `Updated ${name}.` })
+      setStatusMessage({ intent: 'success', text: `Updated ${name}. Restart the backend to load the change.` })
       return true
     } catch (error) {
       setStatusMessage({ intent: 'error', text: toApiError(error).detail })
@@ -91,9 +91,9 @@ export default function CustomInitializerFiles() {
     setDeletingName(name)
     setStatusMessage(null)
     try {
-      await initializersApi.unregister(name)
+      await initializersApi.deleteCustom(name)
       await reload()
-      setStatusMessage({ intent: 'success', text: `Removed ${name}.` })
+      setStatusMessage({ intent: 'success', text: `Removed ${name}. Restart the backend to unload it.` })
     } catch (error) {
       setStatusMessage({ intent: 'error', text: toApiError(error).detail })
     } finally {
diff --git a/frontend/src/components/Initializers/CustomInitializers.test.tsx b/frontend/src/components/Initializers/CustomInitializers.test.tsx
index af8b10b499..ad8d4b6897 100644
--- a/frontend/src/components/Initializers/CustomInitializers.test.tsx
+++ b/frontend/src/components/Initializers/CustomInitializers.test.tsx
@@ -90,7 +90,7 @@ describe('CustomInitializers', () => {
     expect(screen.getByRole('button', { name: 'second_target' })).toHaveAttribute('aria-current', 'page')
   })
 
-  it('should register a custom initializer', async () => {
+  it('should add a custom initializer script', async () => {
     const user = userEvent.setup()
     defaultProps.onRegister.mockResolvedValue(true)
     render(
@@ -99,11 +99,11 @@ describe('CustomInitializers', () => {
       </TestWrapper>,
     )
 
-    await user.click(screen.getByRole('button', { name: 'Register initializer' }))
-    const dialog = screen.getByRole('dialog', { name: 'Register custom initializer' })
+    await user.click(screen.getByRole('button', { name: 'Add initializer' }))
+    const dialog = screen.getByRole('dialog', { name: 'Add custom initializer' })
     await user.type(within(dialog).getByRole('textbox', { name: /Initializer name/ }), 'new_custom')
     await user.type(within(dialog).getByRole('textbox', { name: 'Python source' }), 'class NewCustom: pass')
-    await user.click(within(dialog).getByRole('button', { name: 'Register' }))
+    await user.click(within(dialog).getByRole('button', { name: 'Add' }))
 
     expect(defaultProps.onRegister).toHaveBeenCalledWith('new_custom', 'class NewCustom: pass')
   })
diff --git a/frontend/src/components/Initializers/CustomInitializers.tsx b/frontend/src/components/Initializers/CustomInitializers.tsx
index 3e871cc220..86db64d161 100644
--- a/frontend/src/components/Initializers/CustomInitializers.tsx
+++ b/frontend/src/components/Initializers/CustomInitializers.tsx
@@ -87,12 +87,12 @@ export default function CustomInitializers({
         }))}
         selectedId={selectedInitializer?.initializer_name ?? null}
         navigationLabel="Custom initializer files"
-        emptyMessage="No custom initializers registered."
+        emptyMessage="No custom initializer scripts stored."
         description="Edit Python initializers loaded when the backend starts."
         actions={(
           <div className={styles.editorActions}>
             <Button appearance="subtle" icon={<AddRegular />} onClick={() => setDialogOpen(true)}>
-              Register initializer
+              Add initializer
             </Button>
             <Button
               appearance="subtle"
@@ -144,7 +144,7 @@ export default function CustomInitializers({
         <DialogSurface className={styles.sourceDialog}>
           <form onSubmit={handleSubmit}>
             <DialogBody>
-              <DialogTitle>Register custom initializer</DialogTitle>
+              <DialogTitle>Add custom initializer</DialogTitle>
               <DialogContent className={styles.dialogBody}>
                 <Field label="Initializer name" required>
                   <Input
@@ -167,7 +167,7 @@ export default function CustomInitializers({
                   appearance="primary"
                   disabled={registering || name.trim() === '' || scriptContent.trim() === ''}
                 >
-                  {registering ? 'Registering...' : 'Register'}
+                  {registering ? 'Adding...' : 'Add'}
                 </Button>
               </DialogActions>
             </DialogBody>
diff --git a/frontend/src/services/api.test.ts b/frontend/src/services/api.test.ts
index f3d4e2e8b7..0104ade03b 100644
--- a/frontend/src/services/api.test.ts
+++ b/frontend/src/services/api.test.ts
@@ -156,7 +156,14 @@ describe("api service", () => {
       (apiClient.put as jest.Mock).mockResolvedValueOnce(response);
 
       await expect(initializersApi.updateCustom("custom/name", request)).resolves.toEqual(response.data);
-      expect(apiClient.put).toHaveBeenCalledWith("/initializers/custom%2Fname", request);
+      expect(apiClient.put).toHaveBeenCalledWith("/initializers/custom/custom%2Fname", request);
+    });
+
+    it("should delete custom initializer source", async () => {
+      (apiClient.delete as jest.Mock).mockResolvedValueOnce({ status: 204 });
+
+      await expect(initializersApi.deleteCustom("custom/name")).resolves.toBeUndefined();
+      expect(apiClient.delete).toHaveBeenCalledWith("/initializers/custom/custom%2Fname");
     });
   });
 
diff --git a/frontend/src/services/api.ts b/frontend/src/services/api.ts
index d7f7d64423..405b02dc26 100644
--- a/frontend/src/services/api.ts
+++ b/frontend/src/services/api.ts
@@ -14,8 +14,7 @@ import type {
   CreateTargetRequest,
   InitializerSettingsResponse,
   ListRegisteredInitializersResponse,
-  RegisterInitializerRequest,
-  RegisteredInitializer,
+  CustomInitializer,
   CustomInitializerListResponse,
   AdditionalInitializer,
   CreateAdditionalInitializerRequest,
@@ -252,11 +251,6 @@ export const initializersApi = {
     return response.data
   },
 
-  register: async (request: RegisterInitializerRequest): Promise<RegisteredInitializer> => {
-    const response = await apiClient.post('/initializers', request)
-    return response.data
-  },
-
   listCustom: async (): Promise<CustomInitializerListResponse> => {
     const response = await apiClient.get('/initializers/custom')
     return response.data
@@ -265,13 +259,13 @@ export const initializersApi = {
   updateCustom: async (
     initializerName: string,
     request: UpdateCustomInitializerRequest,
-  ): Promise<RegisteredInitializer> => {
-    const response = await apiClient.put(`/initializers/${encodeURIComponent(initializerName)}`, request)
+  ): Promise<CustomInitializer> => {
+    const response = await apiClient.put(`/initializers/custom/${encodeURIComponent(initializerName)}`, request)
     return response.data
   },
 
-  unregister: async (initializerName: string): Promise<void> => {
-    await apiClient.delete(`/initializers/${encodeURIComponent(initializerName)}`)
+  deleteCustom: async (initializerName: string): Promise<void> => {
+    await apiClient.delete(`/initializers/custom/${encodeURIComponent(initializerName)}`)
   },
 
   createAdditional: async (
diff --git a/frontend/src/types/index.ts b/frontend/src/types/index.ts
index 6b5d520bae..3bcaea89c1 100644
--- a/frontend/src/types/index.ts
+++ b/frontend/src/types/index.ts
@@ -185,11 +185,6 @@ export interface ListRegisteredInitializersResponse {
   pagination: PaginationInfo
 }
 
-export interface RegisterInitializerRequest {
-  name: string
-  script_content: string
-}
-
 export interface UpdateCustomInitializerRequest {
   script_content: string
 }
diff --git a/pyrit/backend/models/__init__.py b/pyrit/backend/models/__init__.py
index c150f81a5a..e13647915d 100644
--- a/pyrit/backend/models/__init__.py
+++ b/pyrit/backend/models/__init__.py
@@ -55,7 +55,10 @@
         PreviewStep,
     )
     from pyrit.backend.models.datasets import DatasetInfo, DatasetListResponse
-    from pyrit.backend.models.initializers import ListRegisteredInitializersResponse, RegisterInitializerRequest
+    from pyrit.backend.models.initializers import (
+        ListRegisteredInitializersResponse,
+        RegisterInitializerRequest,
+    )
     from pyrit.backend.models.scenarios import ListRegisteredScenariosResponse, ScenarioRunListResponse
     from pyrit.backend.models.targets import CreateTargetRequest, TargetListResponse
 
diff --git a/pyrit/backend/routes/initializers.py b/pyrit/backend/routes/initializers.py
index b34850ea40..0026e42dbe 100644
--- a/pyrit/backend/routes/initializers.py
+++ b/pyrit/backend/routes/initializers.py
@@ -4,7 +4,7 @@
 """
 Initializer API routes.
 
-Provides endpoints for listing, registering, and removing initializers.
+Provides endpoints for listing, registering, and removing initializers, plus managing stored custom scripts.
 
 Route structure:
     GET    /api/initializers                — list all initializers
@@ -16,6 +16,9 @@
     GET    /api/initializers/{name}         — get single initializer detail
     POST   /api/initializers                — register initializer from script
     DELETE /api/initializers/{name}         — unregister an initializer
+    GET    /api/initializers/custom         — list stored custom scripts
+    PUT    /api/initializers/custom/{name}  — add or update a stored custom script
+    DELETE /api/initializers/custom/{name}  — delete a stored custom script
 """
 
 from fastapi import APIRouter, HTTPException, Query, Request, status
@@ -27,6 +30,7 @@
     BaselineInitializerSetting,
     CreateAdditionalInitializerRequest,
     CustomInitializerListResponse,
+    CustomInitializerResponse,
     InitializerSettingsResponse,
     ListRegisteredInitializersResponse,
     RegisterInitializerRequest,
@@ -338,21 +342,20 @@ async def register_initializer(  # pyrit-async-suffix-exempt
 
 
 @router.put(
-    "/{initializer_name}",
-    response_model=RegisteredInitializer,
+    "/custom/{initializer_name}",
+    response_model=CustomInitializerResponse,
     responses={
         400: {"model": ProblemDetail, "description": "Invalid initializer source"},
         403: {"model": ProblemDetail, "description": "Custom initializer operations disabled"},
-        404: {"model": ProblemDetail, "description": "Initializer not found"},
     },
 )
-async def update_initializer(  # pyrit-async-suffix-exempt
+async def update_custom_initializer(  # pyrit-async-suffix-exempt
     request: Request,
     initializer_name: str,
     body: UpdateCustomInitializerRequest,
-) -> RegisteredInitializer:
+) -> CustomInitializerResponse:
     """
-    Replace a custom initializer's stored Python source.
+    Add or replace a stored custom initializer script for the next backend startup.
 
     Args:
         request: The incoming FastAPI request.
@@ -360,19 +363,56 @@ async def update_initializer(  # pyrit-async-suffix-exempt
         body: Replacement Python source.
 
     Returns:
-        RegisteredInitializer: Updated initializer metadata.
+        CustomInitializerResponse: Updated stored custom initializer script.
     """
     _check_custom_initializers_allowed(request)
     service = get_initializer_service()
     try:
-        return await service.update_initializer_async(name=initializer_name, script_content=body.script_content)
+        return await service.save_custom_initializer_async(
+            name=initializer_name,
+            script_content=body.script_content,
+        )
+    except ValueError as error:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(error)) from None
+
+
+@router.delete(
+    "/custom/{initializer_name}",
+    status_code=status.HTTP_204_NO_CONTENT,
+    responses={
+        400: {"model": ProblemDetail, "description": "Cannot remove referenced custom initializer"},
+        403: {"model": ProblemDetail, "description": "Custom initializer operations disabled"},
+        404: {"model": ProblemDetail, "description": "Initializer not found"},
+    },
+)
+async def delete_custom_initializer(  # pyrit-async-suffix-exempt
+    request: Request,
+    initializer_name: str,
+) -> None:
+    """
+    Delete a stored custom initializer script for the next backend startup.
+
+    The current runtime registry is unchanged until restart.
+
+    Args:
+        request: The incoming FastAPI request.
+        initializer_name: Registry name of the initializer to remove.
+    """
+    _check_custom_initializers_allowed(request)
+    service = get_initializer_service()
+
+    try:
+        await service.delete_custom_initializer_async(initializer_name=initializer_name)
+    except ValueError as e:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=str(e),
+        ) from None
     except KeyError:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
             detail=f"Initializer '{initializer_name}' not found",
         ) from None
-    except ValueError as error:
-        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(error)) from None
 
 
 @router.delete(
diff --git a/pyrit/backend/services/initializer_service.py b/pyrit/backend/services/initializer_service.py
index 329e8c972d..1654617f85 100644
--- a/pyrit/backend/services/initializer_service.py
+++ b/pyrit/backend/services/initializer_service.py
@@ -317,40 +317,36 @@ async def register_initializer_async(
         Returns:
             RegisteredInitializer: The newly registered initializer summary.
         """
-        await asyncio.to_thread(
-            self._registry.register_from_content,
-            name=name,
-            script_content=script_content,
-        )
-        self._invalidate_custom_initializers_cache()
+        self._registry.register_from_content(name=name, script_content=script_content)
 
         initializer = await self.get_initializer_async(initializer_name=name)
         if not initializer:
             raise ValueError(f"Initializer '{name}' was registered but metadata could not be retrieved.")
         return initializer
 
-    async def update_initializer_async(
+    async def save_custom_initializer_async(
         self,
         *,
         name: str,
         script_content: str,
-    ) -> RegisteredInitializer:
+    ) -> CustomInitializerResponse:
         """
-        Validate and replace a stored custom initializer definition.
+        Validate and persist a custom initializer definition for the next startup.
 
         Args:
             name: Registry name of the custom initializer.
             script_content: Replacement Python source code.
 
         Returns:
-            RegisteredInitializer: Updated initializer metadata.
+            CustomInitializerResponse: The stored custom initializer script.
         """
-        await asyncio.to_thread(self._registry.update_from_content, name=name, script_content=script_content)
+        await asyncio.to_thread(
+            self._registry.save_custom_initializer_script,
+            name=name,
+            script_content=script_content,
+        )
         self._invalidate_custom_initializers_cache()
-        initializer = await self.get_initializer_async(initializer_name=name)
-        if not initializer:
-            raise ValueError(f"Initializer '{name}' was updated but metadata could not be retrieved.")
-        return initializer
+        return self._custom_initializer_response(name=name, script_content=script_content)
 
     async def list_custom_initializers_async(self) -> CustomInitializerListResponse:
         """
@@ -385,14 +381,27 @@ def _invalidate_custom_initializers_cache(self) -> None:
         """Invalidate custom initializer data after a successful mutation."""
         self._custom_cache.invalidate(_CUSTOM_CACHE_KEY)
 
+    def _custom_initializer_response(self, *, name: str, script_content: str) -> CustomInitializerResponse:
+        """
+        Build a response for one stored custom initializer script.
+
+        Returns:
+            CustomInitializerResponse: The stored script and its source location.
+        """
+        return CustomInitializerResponse(
+            initializer_name=name,
+            script_content=script_content,
+            source=self._registry.get_custom_initializer_source(name),
+        )
+
     async def restore_custom_initializers_async(self) -> None:
         """Restore stored custom initializer definitions into the runtime registry."""
         await self._custom_cache.refresh_async(key=_CUSTOM_CACHE_KEY)
         await asyncio.to_thread(self._registry.restore_custom_initializers)
 
-    async def unregister_initializer_async(self, *, initializer_name: str) -> None:
+    async def delete_custom_initializer_async(self, *, initializer_name: str) -> None:
         """
-        Remove a custom initializer from the registry.
+        Delete a stored custom initializer script for the next startup.
 
         Args:
             initializer_name: The registry name to remove.
@@ -403,8 +412,18 @@ async def unregister_initializer_async(self, *, initializer_name: str) -> None:
                 f"Cannot remove initializer '{initializer_name}' while additional initializer settings reference it."
             )
 
-        await asyncio.to_thread(self._registry.unregister_and_cleanup, initializer_name)
+        await asyncio.to_thread(self._registry.delete_custom_initializer_script, name=initializer_name)
         self._invalidate_custom_initializers_cache()
+        logger.info("Deleted custom initializer script: %s", initializer_name)
+
+    async def unregister_initializer_async(self, *, initializer_name: str) -> None:
+        """
+        Remove a custom initializer from the registry.
+
+        Args:
+            initializer_name: The registry name to remove.
+        """
+        self._registry.unregister_and_cleanup(initializer_name)
         logger.info("Unregistered initializer: %s", initializer_name)
 
     def _build_and_run_initializer(
diff --git a/pyrit/registry/components/initializer_registry.py b/pyrit/registry/components/initializer_registry.py
index 637905d021..bb87592b52 100644
--- a/pyrit/registry/components/initializer_registry.py
+++ b/pyrit/registry/components/initializer_registry.py
@@ -466,6 +466,32 @@ def list_custom_initializer_sources(self) -> dict[str, str]:
         with self._catalog_lock:
             return self._get_custom_storage().list_scripts()
 
+    def save_custom_initializer_script(self, *, name: str, script_content: str) -> None:
+        """
+        Validate and persist a custom initializer script for the next startup.
+
+        Raises:
+            ValueError: If the name or source is invalid.
+        """
+        validate_registry_name(name)
+        with self._catalog_lock:
+            self._load_custom_initializer_class(name=name, script_content=script_content)
+            self._get_custom_storage().save_script(name=name, content=script_content)
+
+    def delete_custom_initializer_script(self, *, name: str) -> None:
+        """
+        Delete a stored custom initializer script for the next startup.
+
+        Raises:
+            KeyError: If the custom initializer script does not exist.
+            ValueError: If the name is invalid.
+        """
+        validate_registry_name(name)
+        with self._catalog_lock:
+            if name not in self._get_custom_storage().list_scripts():
+                raise KeyError(name)
+            self._get_custom_storage().delete_script(name)
+
     def get_custom_initializer_source(self, name: str) -> str:
         """
         Get the credential-free storage location for a custom initializer.
diff --git a/tests/unit/backend/test_initializer_service.py b/tests/unit/backend/test_initializer_service.py
index b23bea3265..9b169e7972 100644
--- a/tests/unit/backend/test_initializer_service.py
+++ b/tests/unit/backend/test_initializer_service.py
@@ -869,45 +869,41 @@ def _initialize_custom_cache(service: InitializerService) -> None:
     )
 
 
-class TestInitializerServiceRegister:
-    """Tests for InitializerService.register_initializer_async."""
+class TestInitializerServiceCustomScripts:
+    """Tests for custom initializer script storage operations."""
 
-    async def test_register_initializer_calls_registry(self) -> None:
+    async def test_save_custom_initializer_stores_script(self) -> None:
         with patch.object(InitializerService, "__init__", lambda self: None):
             service = InitializerService()
             mock_registry = MagicMock()
-            mock_registry.register_from_content.return_value = "my_custom"
-            mock_registry.get_all_registered_class_metadata.return_value = [
-                _make_initializer_metadata(registry_name="my_custom", class_name="MyCustomInitializer")
-            ]
+            mock_registry.get_custom_initializer_source.return_value = "C:/custom/my_custom.py"
             service._registry = mock_registry
             service._memory = MagicMock()
             _initialize_custom_cache(service)
 
-            result = await service.register_initializer_async(name="my_custom", script_content=_SAMPLE_SCRIPT)
+            result = await service.save_custom_initializer_async(name="my_custom", script_content=_SAMPLE_SCRIPT)
 
-            mock_registry.register_from_content.assert_called_once_with(name="my_custom", script_content=_SAMPLE_SCRIPT)
+            mock_registry.save_custom_initializer_script.assert_called_once_with(
+                name="my_custom", script_content=_SAMPLE_SCRIPT
+            )
             assert result.initializer_name == "my_custom"
+            assert result.script_content == _SAMPLE_SCRIPT
 
-    async def test_register_initializer_propagates_value_error(self) -> None:
-        with patch.object(InitializerService, "__init__", lambda self: None):
-            service = InitializerService()
-            mock_registry = MagicMock()
-            mock_registry.register_from_content.side_effect = ValueError("no classes found")
-            service._registry = mock_registry
-            service._memory = MagicMock()
-
-            with pytest.raises(ValueError):
-                await service.register_initializer_async(name="bad", script_content="x = 1")
-
-    async def test_register_initializer_propagates_storage_failure(self) -> None:
+    async def test_register_initializer_still_updates_runtime_registry(self) -> None:
         with patch.object(InitializerService, "__init__", lambda self: None):
             service = InitializerService()
             service._registry = MagicMock()
-            service._registry.register_from_content.side_effect = RuntimeError("storage unavailable")
+            service._registry.get_all_registered_class_metadata.return_value = [
+                _make_initializer_metadata(registry_name="my_custom", class_name="MyCustomInitializer")
+            ]
 
-            with pytest.raises(RuntimeError, match="storage unavailable"):
-                await service.register_initializer_async(name="my_custom", script_content=_SAMPLE_SCRIPT)
+            result = await service.register_initializer_async(name="my_custom", script_content=_SAMPLE_SCRIPT)
+
+            service._registry.register_from_content.assert_called_once_with(
+                name="my_custom",
+                script_content=_SAMPLE_SCRIPT,
+            )
+            assert result.initializer_name == "my_custom"
 
     async def test_list_custom_initializers_returns_stored_sources(self) -> None:
         with patch.object(InitializerService, "__init__", lambda self: None):
@@ -972,28 +968,11 @@ async def test_restore_custom_initializers_delegates_to_registry(self) -> None:
             cached = await service.list_custom_initializers_async()
             assert cached.items[0].script_content == _SAMPLE_SCRIPT
 
-    async def test_update_initializer_calls_registry(self) -> None:
-        with patch.object(InitializerService, "__init__", lambda self: None):
-            service = InitializerService()
-            service._registry = MagicMock()
-            _initialize_custom_cache(service)
-            service._registry.get_all_registered_class_metadata.return_value = [
-                _make_initializer_metadata(registry_name="my_custom", class_name="UpdatedInitializer")
-            ]
-
-            result = await service.update_initializer_async(name="my_custom", script_content=_SAMPLE_SCRIPT)
-
-            service._registry.update_from_content.assert_called_once_with(
-                name="my_custom",
-                script_content=_SAMPLE_SCRIPT,
-            )
-            assert result.initializer_name == "my_custom"
-
 
-class TestInitializerServiceUnregister:
-    """Tests for InitializerService.unregister_initializer_async."""
+class TestInitializerServiceDeleteCustomScript:
+    """Tests for InitializerService.delete_custom_initializer_async."""
 
-    async def test_unregister_initializer_calls_registry(self) -> None:
+    async def test_delete_custom_initializer_calls_registry(self) -> None:
         with patch.object(InitializerService, "__init__", lambda self: None):
             service = InitializerService()
             mock_registry = MagicMock()
@@ -1001,31 +980,20 @@ async def test_unregister_initializer_calls_registry(self) -> None:
             service._memory = MagicMock()
             _initialize_custom_cache(service)
 
-            await service.unregister_initializer_async(initializer_name="target")
+            await service.delete_custom_initializer_async(initializer_name="target")
 
-            mock_registry.unregister_and_cleanup.assert_called_once_with("target")
+            mock_registry.delete_custom_initializer_script.assert_called_once_with(name="target")
 
-    async def test_unregister_initializer_propagates_key_error(self) -> None:
+    async def test_delete_custom_initializer_propagates_key_error(self) -> None:
         with patch.object(InitializerService, "__init__", lambda self: None):
             service = InitializerService()
             mock_registry = MagicMock()
-            mock_registry.unregister_and_cleanup.side_effect = KeyError("not found")
+            mock_registry.delete_custom_initializer_script.side_effect = KeyError("not found")
             service._registry = mock_registry
             service._memory = MagicMock()
 
             with pytest.raises(KeyError):
-                await service.unregister_initializer_async(initializer_name="nonexistent")
-
-    async def test_unregister_initializer_propagates_value_error_for_builtin(self) -> None:
-        with patch.object(InitializerService, "__init__", lambda self: None):
-            service = InitializerService()
-            mock_registry = MagicMock()
-            mock_registry.unregister_and_cleanup.side_effect = ValueError("Cannot remove built-in")
-            service._registry = mock_registry
-            service._memory = MagicMock()
-
-            with pytest.raises(ValueError, match="Cannot remove built-in"):
-                await service.unregister_initializer_async(initializer_name="simple")
+                await service.delete_custom_initializer_async(initializer_name="nonexistent")
 
     async def test_unregister_initializer_rejects_additional_initializer_reference(self) -> None:
         with patch.object(InitializerService, "__init__", lambda self: None):
@@ -1037,9 +1005,9 @@ async def test_unregister_initializer_rejects_additional_initializer_reference(s
             ]
 
             with pytest.raises(ValueError, match="additional initializer settings reference it"):
-                await service.unregister_initializer_async(initializer_name="custom")
+                await service.delete_custom_initializer_async(initializer_name="custom")
 
-            service._registry.unregister_and_cleanup.assert_not_called()
+            service._registry.delete_custom_initializer_script.assert_not_called()
 
 
 # ============================================================================
@@ -1047,8 +1015,8 @@ async def test_unregister_initializer_rejects_additional_initializer_reference(s
 # ============================================================================
 
 
-class TestRegisterInitializerRoute:
-    """Tests for POST /api/initializers route."""
+class TestCustomInitializerRoutes:
+    """Tests for stored custom initializer script routes."""
 
     def test_get_custom_initializers_returns_403_when_disabled(self, client: TestClient) -> None:
         app.state.allow_custom_initializers = False
@@ -1076,26 +1044,11 @@ def test_get_custom_initializers_returns_storage_source_and_items(
             assert response.status_code == status.HTTP_200_OK
             assert response.json() == response_model.model_dump()
 
-    def test_post_returns_403_when_custom_initializers_disabled(self, client: TestClient) -> None:
-        app.state.allow_custom_initializers = False
-        response = client.post("/api/initializers", json={"name": "test", "script_content": _SAMPLE_SCRIPT})
-        assert response.status_code == status.HTTP_403_FORBIDDEN
-        assert "disabled" in response.json()["detail"].lower()
-
-    @pytest.mark.parametrize("bad_name", ["../traversal", "UPPER", "has space", "1digit", ""])
-    def test_post_returns_422_for_invalid_name(
-        self, client_with_custom_initializers_enabled: TestClient, bad_name: str
-    ) -> None:
-        response = client_with_custom_initializers_enabled.post(
-            "/api/initializers", json={"name": bad_name, "script_content": _SAMPLE_SCRIPT}
-        )
-        assert response.status_code == status.HTTP_422_UNPROCESSABLE_CONTENT
-
-    def test_post_returns_201_with_registered_initializer(
+    def test_post_root_still_registers_runtime_initializer(
         self, client_with_custom_initializers_enabled: TestClient
     ) -> None:
         summary = RegisteredInitializer(
-            initializer_name="my_custom",
+            initializer_name="runtime_custom",
             initializer_type="MyCustomInitializer",
             description="Custom init",
         )
@@ -1105,170 +1058,107 @@ def test_post_returns_201_with_registered_initializer(
             mock_get_service.return_value = mock_service
 
             response = client_with_custom_initializers_enabled.post(
-                "/api/initializers", json={"name": "my_custom", "script_content": _SAMPLE_SCRIPT}
-            )
-
-            assert response.status_code == status.HTTP_201_CREATED
-            data = response.json()
-            assert data["initializer_name"] == "my_custom"
-
-    def test_post_returns_400_for_invalid_script(self, client_with_custom_initializers_enabled: TestClient) -> None:
-        with patch("pyrit.backend.routes.initializers.get_initializer_service") as mock_get_service:
-            mock_service = MagicMock()
-            mock_service.register_initializer_async = AsyncMock(side_effect=ValueError("no classes"))
-            mock_get_service.return_value = mock_service
-
-            response = client_with_custom_initializers_enabled.post(
-                "/api/initializers", json={"name": "bad", "script_content": "x = 1"}
+                "/api/initializers",
+                json={"name": "runtime_custom", "script_content": _SAMPLE_SCRIPT},
             )
 
-            assert response.status_code == status.HTTP_400_BAD_REQUEST
-
-    def test_post_forwards_name_and_content(self, client_with_custom_initializers_enabled: TestClient) -> None:
-        summary = RegisteredInitializer(
-            initializer_name="my_init",
-            initializer_type="MyInit",
-            description="desc",
+        assert response.status_code == status.HTTP_201_CREATED
+        mock_service.register_initializer_async.assert_awaited_once_with(
+            name="runtime_custom",
+            script_content=_SAMPLE_SCRIPT,
         )
-        with patch("pyrit.backend.routes.initializers.get_initializer_service") as mock_get_service:
-            mock_service = MagicMock()
-            mock_service.register_initializer_async = AsyncMock(return_value=summary)
-            mock_get_service.return_value = mock_service
 
-            client_with_custom_initializers_enabled.post(
-                "/api/initializers", json={"name": "my_init", "script_content": _SAMPLE_SCRIPT}
-            )
 
-            call_kwargs = mock_service.register_initializer_async.call_args.kwargs
-            assert call_kwargs["name"] == "my_init"
-            assert call_kwargs["script_content"] == _SAMPLE_SCRIPT
-
-    def test_post_returns_409_for_duplicate_name(self, client_with_custom_initializers_enabled: TestClient) -> None:
-        with patch("pyrit.backend.routes.initializers.get_initializer_service") as mock_get_service:
-            mock_service = MagicMock()
-            mock_service.register_initializer_async = AsyncMock(
-                side_effect=ValueError("Initializer 'dup' is already registered.")
-            )
-            mock_get_service.return_value = mock_service
-
-            response = client_with_custom_initializers_enabled.post(
-                "/api/initializers", json={"name": "dup", "script_content": _SAMPLE_SCRIPT}
-            )
-
-            assert response.status_code == status.HTTP_409_CONFLICT
-
-
-class TestUnregisterInitializerRoute:
-    """Tests for DELETE /api/initializers/{name} route."""
+class TestDeleteCustomInitializerRoute:
+    """Tests for DELETE /api/initializers/custom/{name} route."""
 
     def test_delete_returns_403_when_custom_initializers_disabled(self, client: TestClient) -> None:
         app.state.allow_custom_initializers = False
-        response = client.delete("/api/initializers/target")
+        response = client.delete("/api/initializers/custom/target")
         assert response.status_code == status.HTTP_403_FORBIDDEN
 
     def test_delete_returns_204_on_success(self, client_with_custom_initializers_enabled: TestClient) -> None:
         with patch("pyrit.backend.routes.initializers.get_initializer_service") as mock_get_service:
             mock_service = MagicMock()
-            mock_service.unregister_initializer_async = AsyncMock(return_value=None)
+            mock_service.delete_custom_initializer_async = AsyncMock(return_value=None)
             mock_get_service.return_value = mock_service
 
-            response = client_with_custom_initializers_enabled.delete("/api/initializers/target")
+            response = client_with_custom_initializers_enabled.delete("/api/initializers/custom/target")
 
             assert response.status_code == status.HTTP_204_NO_CONTENT
 
     def test_delete_returns_404_when_not_found(self, client_with_custom_initializers_enabled: TestClient) -> None:
         with patch("pyrit.backend.routes.initializers.get_initializer_service") as mock_get_service:
             mock_service = MagicMock()
-            mock_service.unregister_initializer_async = AsyncMock(side_effect=KeyError("not found"))
+            mock_service.delete_custom_initializer_async = AsyncMock(side_effect=KeyError("not found"))
             mock_get_service.return_value = mock_service
 
-            response = client_with_custom_initializers_enabled.delete("/api/initializers/nonexistent")
+            response = client_with_custom_initializers_enabled.delete("/api/initializers/custom/nonexistent")
 
             assert response.status_code == status.HTTP_404_NOT_FOUND
 
-    def test_delete_returns_400_for_builtin_initializer(
-        self, client_with_custom_initializers_enabled: TestClient
-    ) -> None:
-        with patch("pyrit.backend.routes.initializers.get_initializer_service") as mock_get_service:
-            mock_service = MagicMock()
-            mock_service.unregister_initializer_async = AsyncMock(
-                side_effect=ValueError("Cannot remove built-in initializer 'simple'.")
-            )
-            mock_get_service.return_value = mock_service
-
-            response = client_with_custom_initializers_enabled.delete("/api/initializers/simple")
-
-            assert response.status_code == status.HTTP_400_BAD_REQUEST
-            assert "built-in" in response.json()["detail"].lower()
-
     def test_delete_returns_400_when_additional_initializer_references_name(
         self, client_with_custom_initializers_enabled: TestClient
     ) -> None:
         with patch("pyrit.backend.routes.initializers.get_initializer_service") as mock_get_service:
             mock_service = MagicMock()
-            mock_service.unregister_initializer_async = AsyncMock(
+            mock_service.delete_custom_initializer_async = AsyncMock(
                 side_effect=ValueError(
                     "Cannot remove initializer 'custom' while additional initializer settings reference it."
                 )
             )
             mock_get_service.return_value = mock_service
 
-            response = client_with_custom_initializers_enabled.delete("/api/initializers/custom")
+            response = client_with_custom_initializers_enabled.delete("/api/initializers/custom/custom")
 
             assert response.status_code == status.HTTP_400_BAD_REQUEST
             assert "additional initializer settings reference it" in response.json()["detail"]
 
 
-class TestUpdateInitializerRoute:
-    """Tests for PUT /api/initializers/{name} route."""
+class TestUpdateCustomInitializerRoute:
+    """Tests for PUT /api/initializers/custom/{name} route."""
 
     def test_put_returns_403_when_custom_initializers_disabled(self, client: TestClient) -> None:
         app.state.allow_custom_initializers = False
 
-        response = client.put("/api/initializers/custom", json={"script_content": _SAMPLE_SCRIPT})
+        response = client.put("/api/initializers/custom/custom", json={"script_content": _SAMPLE_SCRIPT})
 
         assert response.status_code == status.HTTP_403_FORBIDDEN
 
     def test_put_updates_custom_initializer(self, client_with_custom_initializers_enabled: TestClient) -> None:
-        summary = RegisteredInitializer(
+        custom = CustomInitializerResponse(
             initializer_name="custom",
-            initializer_type="UpdatedInitializer",
-            description="Updated custom initializer",
+            script_content=_SAMPLE_SCRIPT,
+            source="C:/custom/custom.py",
         )
         with patch("pyrit.backend.routes.initializers.get_initializer_service") as mock_get_service:
             mock_service = MagicMock()
-            mock_service.update_initializer_async = AsyncMock(return_value=summary)
+            mock_service.save_custom_initializer_async = AsyncMock(return_value=custom)
             mock_get_service.return_value = mock_service
 
             response = client_with_custom_initializers_enabled.put(
-                "/api/initializers/custom",
+                "/api/initializers/custom/custom",
                 json={"script_content": _SAMPLE_SCRIPT},
             )
 
         assert response.status_code == status.HTTP_200_OK
-        mock_service.update_initializer_async.assert_awaited_once_with(
+        mock_service.save_custom_initializer_async.assert_awaited_once_with(
             name="custom",
             script_content=_SAMPLE_SCRIPT,
         )
 
-    @pytest.mark.parametrize(
-        ("error", "expected_status"),
-        [(KeyError("custom"), status.HTTP_404_NOT_FOUND), (ValueError("invalid source"), status.HTTP_400_BAD_REQUEST)],
-    )
-    def test_put_maps_update_errors(
+    def test_put_maps_invalid_source_error(
         self,
         client_with_custom_initializers_enabled: TestClient,
-        error: Exception,
-        expected_status: int,
     ) -> None:
         with patch("pyrit.backend.routes.initializers.get_initializer_service") as mock_get_service:
             mock_service = MagicMock()
-            mock_service.update_initializer_async = AsyncMock(side_effect=error)
+            mock_service.save_custom_initializer_async = AsyncMock(side_effect=ValueError("invalid source"))
             mock_get_service.return_value = mock_service
 
             response = client_with_custom_initializers_enabled.put(
-                "/api/initializers/custom",
+                "/api/initializers/custom/custom",
                 json={"script_content": _SAMPLE_SCRIPT},
             )
 
-        assert response.status_code == expected_status
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
diff --git a/tests/unit/registry/test_initializer_registry.py b/tests/unit/registry/test_initializer_registry.py
index f88a12d897..9e27881a69 100644
--- a/tests/unit/registry/test_initializer_registry.py
+++ b/tests/unit/registry/test_initializer_registry.py
@@ -238,6 +238,33 @@ def test_restore_custom_initializers_loads_persisted_scripts(tmp_path: Path) ->
     assert registry.get_class("restored").__name__ == "ScriptTestInitializer"
 
 
+def test_save_custom_initializer_script_upserts_without_registering(tmp_path: Path) -> None:
+    """Test adding and updating custom source does not change the runtime registry."""
+    registry = InitializerRegistry(lazy_discovery=True, custom_scripts_source=str(tmp_path))
+    registry._discovered = True
+    updated_script = _VALID_SCRIPT.replace("ScriptTestInitializer", "UpdatedInitializer")
+
+    registry.save_custom_initializer_script(name="custom", script_content=_VALID_SCRIPT)
+    registry.save_custom_initializer_script(name="custom", script_content=updated_script)
+
+    assert registry.list_custom_initializer_sources() == {"custom": updated_script}
+    with pytest.raises(KeyError):
+        registry.get_class("custom")
+
+
+def test_delete_custom_initializer_script_removes_source_without_registry_changes(tmp_path: Path) -> None:
+    """Test deleting custom source leaves the runtime registry unchanged."""
+    registry = InitializerRegistry(lazy_discovery=True, custom_scripts_source=str(tmp_path))
+    registry._discovered = True
+    registry.save_custom_initializer_script(name="custom", script_content=_VALID_SCRIPT)
+
+    registry.delete_custom_initializer_script(name="custom")
+
+    assert registry.list_custom_initializer_sources() == {}
+    with pytest.raises(KeyError):
+        registry.get_class("custom")
+
+
 def test_custom_initializer_storage_is_reused_until_source_changes(tmp_path: Path) -> None:
     """Test that startup and GUI reads share one cache-bearing storage instance."""
     registry = InitializerRegistry(lazy_discovery=True, custom_scripts_source=str(tmp_path))

From b11b65366e7f7c4b61ef06a5b46fc783588e046e Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Thu, 27 Aug 2026 09:17:30 -0700
Subject: [PATCH 11/24] simplify

---
 .../BackendConfiguration.test.tsx             |  63 ++--
 .../CustomInitializerFiles.tsx                |  27 +-
 .../Initializers/CustomInitializers.test.tsx  |  13 +-
 .../Initializers/CustomInitializers.tsx       |  40 +--
 frontend/src/services/api.test.ts             |  24 +-
 frontend/src/services/api.ts                  |  15 +-
 frontend/src/types/index.ts                   |   3 +-
 pyrit/backend/main.py                         |  10 +-
 pyrit/backend/models/initializers.py          |  12 +-
 pyrit/backend/routes/initializers.py          |  91 +-----
 .../services/configuration_file_service.py    |  15 +-
 .../services/environment_file_service.py      |  14 +-
 pyrit/backend/services/initializer_service.py | 107 +------
 .../services/stale_while_revalidate_cache.py  | 109 -------
 .../components/initializer_registry.py        | 192 ++++--------
 pyrit/registry/custom_initializer_storage.py  |  43 +--
 .../test_configuration_file_service.py        |  30 +-
 .../backend/test_environment_file_service.py  |  37 +--
 .../unit/backend/test_initializer_service.py  | 280 ++----------------
 tests/unit/backend/test_main.py               |  68 ++---
 .../test_stale_while_revalidate_cache.py      |  54 ----
 .../test_custom_initializer_storage.py        |  24 +-
 .../registry/test_initializer_registry.py     | 132 +--------
 23 files changed, 224 insertions(+), 1179 deletions(-)
 delete mode 100644 pyrit/backend/services/stale_while_revalidate_cache.py
 delete mode 100644 tests/unit/backend/test_stale_while_revalidate_cache.py

diff --git a/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx b/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx
index c0081f8112..61d83898b5 100644
--- a/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx
+++ b/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx
@@ -17,8 +17,8 @@ jest.mock('@/services/api', () => ({
   },
   initializersApi: {
     listCustom: jest.fn(),
-    updateCustom: jest.fn(),
-    deleteCustom: jest.fn(),
+    register: jest.fn(),
+    unregister: jest.fn(),
   },
 }))
 
@@ -56,20 +56,14 @@ describe('BackendConfiguration', () => {
     })
     mockedInitializersApi.listCustom.mockResolvedValue({
       source: 'C:/Users/test/.pyrit/custom_initializers',
-      items: [
-        {
-          initializer_name: 'custom_target',
-          script_content: 'class CustomTargetInitializer: pass',
-          source: 'C:/Users/test/.pyrit/custom_initializers/custom_target.py',
-        },
-      ],
-    })
-    mockedInitializersApi.updateCustom.mockResolvedValue({
-      initializer_name: 'custom_target',
-      script_content: 'class UpdatedCustomTargetInitializer: pass',
-      source: 'C:/Users/test/.pyrit/custom_initializers/custom_target.py',
-    })
-    mockedInitializersApi.deleteCustom.mockResolvedValue()
+      items: [{
+        initializer_name: 'custom_target',
+        script_content: 'class CustomTargetInitializer: pass',
+        source: 'C:/Users/test/.pyrit/custom_initializers/custom_target.py',
+      }],
+    })
+    mockedInitializersApi.register.mockResolvedValue()
+    mockedInitializersApi.unregister.mockResolvedValue()
   })
 
   it('should load and display configuration content', async () => {
@@ -183,45 +177,26 @@ describe('BackendConfiguration', () => {
     })
   })
 
-  it('should edit storage-backed custom initializers in its own tab', async () => {
-    const user = userEvent.setup()
-    renderPage()
-
-    await user.click(screen.getByRole('tab', { name: 'Custom Initializers' }))
-    expect(screen.getByText('C:/Users/test/.pyrit/custom_initializers/custom_target.py')).toBeInTheDocument()
-    expect(await screen.findByRole('navigation', { name: 'Custom initializer files' })).toBeInTheDocument()
-    expect(screen.getByRole('button', { name: 'Copy Python source' })).toBeInTheDocument()
-    fireEvent.change(screen.getByRole('textbox', { name: 'Python source' }), {
-      target: { value: 'class UpdatedCustomTargetInitializer: pass' },
-    })
-    await user.click(screen.getByRole('button', { name: 'Save' }))
-
-    await waitFor(() => {
-      expect(mockedInitializersApi.updateCustom).toHaveBeenCalledWith('custom_target', {
-        script_content: 'class UpdatedCustomTargetInitializer: pass',
-      })
-    })
-    expect(await screen.findByText('Updated custom_target. Restart the backend to load the change.')).toBeInTheDocument()
-  })
-
-  it('should add a storage-backed custom initializer', async () => {
+  it('should list and register custom initializers', async () => {
     const user = userEvent.setup()
     renderPage()
 
     await user.click(screen.getByRole('tab', { name: 'Custom Initializers' }))
+    expect(await screen.findByText('C:/Users/test/.pyrit/custom_initializers/custom_target.py')).toBeInTheDocument()
     await user.click(screen.getByRole('button', { name: 'Add initializer' }))
-    const addDialog = await screen.findByRole('dialog')
-    await user.type(within(addDialog).getByRole('textbox', { name: /Initializer name/ }), 'new_custom')
-    fireEvent.change(within(addDialog).getByRole('textbox', { name: 'Python source' }), {
+    const dialog = screen.getByRole('dialog', { name: 'Add custom initializer' })
+    await user.type(within(dialog).getByRole('textbox', { name: /Initializer name/ }), 'new_custom')
+    fireEvent.change(within(dialog).getByRole('textbox', { name: 'Python source' }), {
       target: { value: 'class NewCustom: pass' },
     })
-    await user.click(within(addDialog).getByRole('button', { name: 'Add' }))
+    await user.click(within(dialog).getByRole('button', { name: 'Add' }))
 
     await waitFor(() => {
-      expect(mockedInitializersApi.updateCustom).toHaveBeenCalledWith('new_custom', {
+      expect(mockedInitializersApi.register).toHaveBeenCalledWith({
+        name: 'new_custom',
         script_content: 'class NewCustom: pass',
       })
     })
-    expect(await screen.findByText('Added new_custom. Restart the backend to load it.')).toBeInTheDocument()
   })
+
 })
diff --git a/frontend/src/components/BackendConfiguration/CustomInitializerFiles.tsx b/frontend/src/components/BackendConfiguration/CustomInitializerFiles.tsx
index 5ecfc11647..dedd17d140 100644
--- a/frontend/src/components/BackendConfiguration/CustomInitializerFiles.tsx
+++ b/frontend/src/components/BackendConfiguration/CustomInitializerFiles.tsx
@@ -19,7 +19,6 @@ export default function CustomInitializerFiles() {
   const [items, setItems] = useState<CustomInitializer[]>([])
   const [loading, setLoading] = useState(true)
   const [registering, setRegistering] = useState(false)
-  const [updatingName, setUpdatingName] = useState<string | null>(null)
   const [deletingName, setDeletingName] = useState<string | null>(null)
   const [statusMessage, setStatusMessage] = useState<StatusMessage | null>(null)
 
@@ -59,9 +58,9 @@ export default function CustomInitializerFiles() {
     setRegistering(true)
     setStatusMessage(null)
     try {
-      await initializersApi.updateCustom(name, { script_content: scriptContent })
+      await initializersApi.register({ name, script_content: scriptContent })
       await reload()
-      setStatusMessage({ intent: 'success', text: `Added ${name}. Restart the backend to load it.` })
+      setStatusMessage({ intent: 'success', text: `Added and registered ${name}.` })
       return true
     } catch (error) {
       setStatusMessage({ intent: 'error', text: toApiError(error).detail })
@@ -71,29 +70,13 @@ export default function CustomInitializerFiles() {
     }
   }
 
-  const handleUpdate = async (name: string, scriptContent: string): Promise<boolean> => {
-    setUpdatingName(name)
-    setStatusMessage(null)
-    try {
-      await initializersApi.updateCustom(name, { script_content: scriptContent })
-      await reload()
-      setStatusMessage({ intent: 'success', text: `Updated ${name}. Restart the backend to load the change.` })
-      return true
-    } catch (error) {
-      setStatusMessage({ intent: 'error', text: toApiError(error).detail })
-      return false
-    } finally {
-      setUpdatingName(null)
-    }
-  }
-
   const handleDelete = async (name: string): Promise<void> => {
     setDeletingName(name)
     setStatusMessage(null)
     try {
-      await initializersApi.deleteCustom(name)
+      await initializersApi.unregister(name)
       await reload()
-      setStatusMessage({ intent: 'success', text: `Removed ${name}. Restart the backend to unload it.` })
+      setStatusMessage({ intent: 'success', text: `Removed ${name}.` })
     } catch (error) {
       setStatusMessage({ intent: 'error', text: toApiError(error).detail })
     } finally {
@@ -115,10 +98,8 @@ export default function CustomInitializerFiles() {
       <CustomInitializers
         items={items}
         registering={registering}
-        updatingName={updatingName}
         deletingName={deletingName}
         onRegister={handleRegister}
-        onUpdate={handleUpdate}
         onDelete={handleDelete}
       />
     </div>
diff --git a/frontend/src/components/Initializers/CustomInitializers.test.tsx b/frontend/src/components/Initializers/CustomInitializers.test.tsx
index ad8d4b6897..42badbe474 100644
--- a/frontend/src/components/Initializers/CustomInitializers.test.tsx
+++ b/frontend/src/components/Initializers/CustomInitializers.test.tsx
@@ -27,10 +27,8 @@ describe('CustomInitializers', () => {
   const defaultProps = {
     items: ITEMS,
     registering: false,
-    updatingName: null,
     deletingName: null,
     onRegister: jest.fn(),
-    onUpdate: jest.fn(),
     onDelete: jest.fn(),
   }
 
@@ -58,9 +56,7 @@ describe('CustomInitializers', () => {
     expect(screen.getByRole('button', { name: 'second_target' })).toHaveAttribute('aria-current', 'page')
   })
 
-  it('should edit and save stored source', async () => {
-    const user = userEvent.setup()
-    defaultProps.onUpdate.mockResolvedValue(true)
+  it('should display stored source as read-only', () => {
     render(
       <TestWrapper>
         <CustomInitializers {...defaultProps} />
@@ -68,11 +64,8 @@ describe('CustomInitializers', () => {
     )
 
     const editor = screen.getByLabelText('Python source')
-    await user.clear(editor)
-    await user.type(editor, 'def updated():\n    pass')
-    await user.click(screen.getByRole('button', { name: 'Save' }))
-
-    expect(defaultProps.onUpdate).toHaveBeenCalledWith('custom_target', 'def updated():\n    pass')
+    expect(editor).toBeDisabled()
+    expect(editor).toHaveValue('def initialize():\n    pass')
   })
 
   it('should select a custom initializer from the file navigation', async () => {
diff --git a/frontend/src/components/Initializers/CustomInitializers.tsx b/frontend/src/components/Initializers/CustomInitializers.tsx
index 86db64d161..a4553226c9 100644
--- a/frontend/src/components/Initializers/CustomInitializers.tsx
+++ b/frontend/src/components/Initializers/CustomInitializers.tsx
@@ -12,7 +12,7 @@ import {
   Input,
   Text,
 } from '@fluentui/react-components'
-import { AddRegular, DeleteRegular, SaveRegular } from '@fluentui/react-icons'
+import { AddRegular, DeleteRegular } from '@fluentui/react-icons'
 
 import ConfirmDialog from '@/components/ConfirmDialog'
 import EditorWorkspace from '@/components/EditorWorkspace'
@@ -24,20 +24,16 @@ import { useCustomInitializersStyles } from './CustomInitializers.styles'
 interface CustomInitializersProps {
   items: CustomInitializer[]
   registering: boolean
-  updatingName: string | null
   deletingName: string | null
   onRegister: (name: string, scriptContent: string) => Promise<boolean>
-  onUpdate: (name: string, scriptContent: string) => Promise<boolean>
   onDelete: (name: string) => Promise<void>
 }
 
 export default function CustomInitializers({
   items,
   registering,
-  updatingName,
   deletingName,
   onRegister,
-  onUpdate,
   onDelete,
 }: CustomInitializersProps) {
   const styles = useCustomInitializersStyles()
@@ -46,7 +42,6 @@ export default function CustomInitializers({
   const [scriptContent, setScriptContent] = useState('')
   const [selectedName, setSelectedName] = useState<string | null>(items[0]?.initializer_name ?? null)
   const selectedInitializer = items.find((item) => item.initializer_name === selectedName) ?? items[0] ?? null
-  const [editedSource, setEditedSource] = useState(selectedInitializer?.script_content ?? '')
   const [initializerToDelete, setInitializerToDelete] = useState<CustomInitializer | null>(null)
 
   const handleSubmit = async (event: React.FormEvent<HTMLFormElement>): Promise<void> => {
@@ -60,13 +55,6 @@ export default function CustomInitializers({
 
   const selectInitializer = (initializer: CustomInitializer): void => {
     setSelectedName(initializer.initializer_name)
-    setEditedSource(initializer.script_content)
-  }
-
-  const handleUpdate = async (): Promise<void> => {
-    if (selectedInitializer) {
-      await onUpdate(selectedInitializer.initializer_name, editedSource)
-    }
   }
 
   const handleDelete = async (initializer: CustomInitializer): Promise<void> => {
@@ -74,7 +62,6 @@ export default function CustomInitializers({
     setInitializerToDelete(null)
     await onDelete(initializer.initializer_name)
     setSelectedName(nextInitializer?.initializer_name ?? null)
-    setEditedSource(nextInitializer?.script_content ?? '')
   }
 
   return (
@@ -88,7 +75,7 @@ export default function CustomInitializers({
         selectedId={selectedInitializer?.initializer_name ?? null}
         navigationLabel="Custom initializer files"
         emptyMessage="No custom initializer scripts stored."
-        description="Edit Python initializers loaded when the backend starts."
+        description="Python initializers loaded when the backend starts."
         actions={(
           <div className={styles.editorActions}>
             <Button appearance="subtle" icon={<AddRegular />} onClick={() => setDialogOpen(true)}>
@@ -97,25 +84,11 @@ export default function CustomInitializers({
             <Button
               appearance="subtle"
               icon={<DeleteRegular />}
-              disabled={!selectedInitializer || deletingName !== null || updatingName !== null}
+              disabled={!selectedInitializer || deletingName !== null}
               onClick={() => selectedInitializer && setInitializerToDelete(selectedInitializer)}
             >
               {deletingName === selectedInitializer?.initializer_name ? 'Removing...' : 'Remove'}
             </Button>
-            <Button
-              appearance="primary"
-              icon={<SaveRegular />}
-              disabled={
-                !selectedInitializer
-                || updatingName !== null
-                || deletingName !== null
-                || editedSource.trim() === ''
-                || editedSource === selectedInitializer.script_content
-              }
-              onClick={() => void handleUpdate()}
-            >
-              {updatingName === selectedInitializer?.initializer_name ? 'Saving...' : 'Save'}
-            </Button>
           </div>
         )}
         onSelect={(initializerName) => {
@@ -128,12 +101,11 @@ export default function CustomInitializers({
             <Field
               className={styles.editorField}
               label={selectedInitializer.initializer_name}
-              hint={editedSource === selectedInitializer.script_content ? 'No unsaved changes' : 'Unsaved changes'}
             >
               <PythonCodeEditor
-                source={editedSource}
-                disabled={updatingName !== null || deletingName !== null}
-                onChange={setEditedSource}
+                source={selectedInitializer.script_content}
+                disabled
+                onChange={() => undefined}
               />
             </Field>
           </>
diff --git a/frontend/src/services/api.test.ts b/frontend/src/services/api.test.ts
index 0104ade03b..1138decf26 100644
--- a/frontend/src/services/api.test.ts
+++ b/frontend/src/services/api.test.ts
@@ -15,9 +15,9 @@ jest.mock("axios", () => ({
 import {
   apiClient,
   healthApi,
+  initializersApi,
   versionApi,
   configurationApi,
-  initializersApi,
   targetsApi,
   attacksApi,
 } from "./api";
@@ -150,20 +150,24 @@ describe("api service", () => {
   });
 
   describe("initializersApi", () => {
-    it("should update custom initializer source", async () => {
-      const request = { script_content: "class UpdatedInitializer: pass\n" };
-      const response = { data: { initializer_name: "custom/name" } };
-      (apiClient.put as jest.Mock).mockResolvedValueOnce(response);
+    it("should list stored custom initializers", async () => {
+      const response = { data: { source: "C:/custom", items: [] } };
+      (apiClient.get as jest.Mock).mockResolvedValueOnce(response);
 
-      await expect(initializersApi.updateCustom("custom/name", request)).resolves.toEqual(response.data);
-      expect(apiClient.put).toHaveBeenCalledWith("/initializers/custom/custom%2Fname", request);
+      await expect(initializersApi.listCustom()).resolves.toEqual(response.data);
+      expect(apiClient.get).toHaveBeenCalledWith("/initializers/custom");
     });
 
-    it("should delete custom initializer source", async () => {
+    it("should register and unregister through existing endpoints", async () => {
+      const request = { name: "custom", script_content: "class Custom: pass\n" };
+      (apiClient.post as jest.Mock).mockResolvedValueOnce({ status: 201 });
       (apiClient.delete as jest.Mock).mockResolvedValueOnce({ status: 204 });
 
-      await expect(initializersApi.deleteCustom("custom/name")).resolves.toBeUndefined();
-      expect(apiClient.delete).toHaveBeenCalledWith("/initializers/custom/custom%2Fname");
+      await initializersApi.register(request);
+      await initializersApi.unregister("custom/name");
+
+      expect(apiClient.post).toHaveBeenCalledWith("/initializers", request);
+      expect(apiClient.delete).toHaveBeenCalledWith("/initializers/custom%2Fname");
     });
   });
 
diff --git a/frontend/src/services/api.ts b/frontend/src/services/api.ts
index 405b02dc26..99c2e15679 100644
--- a/frontend/src/services/api.ts
+++ b/frontend/src/services/api.ts
@@ -14,8 +14,8 @@ import type {
   CreateTargetRequest,
   InitializerSettingsResponse,
   ListRegisteredInitializersResponse,
-  CustomInitializer,
   CustomInitializerListResponse,
+  RegisterInitializerRequest,
   AdditionalInitializer,
   CreateAdditionalInitializerRequest,
   UpdateAdditionalInitializerRequest,
@@ -34,7 +34,6 @@ import type {
   EnvironmentFileContent,
   EnvironmentFileListResponse,
   UpdateConfigurationFileRequest,
-  UpdateCustomInitializerRequest,
 } from '../types'
 
 const API_BASE_URL = import.meta.env.VITE_API_URL || '/api'
@@ -256,16 +255,12 @@ export const initializersApi = {
     return response.data
   },
 
-  updateCustom: async (
-    initializerName: string,
-    request: UpdateCustomInitializerRequest,
-  ): Promise<CustomInitializer> => {
-    const response = await apiClient.put(`/initializers/custom/${encodeURIComponent(initializerName)}`, request)
-    return response.data
+  register: async (request: RegisterInitializerRequest): Promise<void> => {
+    await apiClient.post('/initializers', request)
   },
 
-  deleteCustom: async (initializerName: string): Promise<void> => {
-    await apiClient.delete(`/initializers/custom/${encodeURIComponent(initializerName)}`)
+  unregister: async (initializerName: string): Promise<void> => {
+    await apiClient.delete(`/initializers/${encodeURIComponent(initializerName)}`)
   },
 
   createAdditional: async (
diff --git a/frontend/src/types/index.ts b/frontend/src/types/index.ts
index 3bcaea89c1..8f408c5bc9 100644
--- a/frontend/src/types/index.ts
+++ b/frontend/src/types/index.ts
@@ -185,7 +185,8 @@ export interface ListRegisteredInitializersResponse {
   pagination: PaginationInfo
 }
 
-export interface UpdateCustomInitializerRequest {
+export interface RegisterInitializerRequest {
+  name: string
   script_content: string
 }
 
diff --git a/pyrit/backend/main.py b/pyrit/backend/main.py
index 90bbd94a77..d39b797abb 100644
--- a/pyrit/backend/main.py
+++ b/pyrit/backend/main.py
@@ -5,6 +5,7 @@
 FastAPI application entry point for PyRIT backend.
 """
 
+import asyncio
 import logging
 import os
 from collections.abc import AsyncGenerator
@@ -74,6 +75,8 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
     )
     initializer_registry = InitializerRegistry.get_registry_singleton()
     initializer_registry.configure_custom_scripts_source(config.custom_initializers_source)
+    if config.allow_custom_initializers:
+        await asyncio.to_thread(initializer_registry.register_stored_initializers)
     await config.initialize_pyrit_async()
 
     # Persisted additional initializers run after the .pyrit_conf baseline, in stored order.
@@ -85,12 +88,7 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
         )
         for order_index, initializer in enumerate(config.initializer_configs)
     ]
-    initializer_service = get_initializer_service()
-    if config.allow_custom_initializers:
-        await initializer_service.restore_custom_initializers_async()
-    await initializer_service.run_additional_initializers_async(
-        allow_custom_initializers=config.allow_custom_initializers
-    )
+    await get_initializer_service().run_additional_initializers_async()
 
     # Expose config values to route handlers via app.state
     default_labels: dict[str, str] = {}
diff --git a/pyrit/backend/models/initializers.py b/pyrit/backend/models/initializers.py
index 707148a18a..e45c1dc1a4 100644
--- a/pyrit/backend/models/initializers.py
+++ b/pyrit/backend/models/initializers.py
@@ -29,7 +29,6 @@
     "ListRegisteredInitializersResponse",
     "RegisterInitializerRequest",
     "UpdateAdditionalInitializerRequest",
-    "UpdateCustomInitializerRequest",
 ]
 
 
@@ -51,12 +50,6 @@ class RegisterInitializerRequest(BaseModel):
     script_content: str = Field(..., description="Python source code containing a PyRITInitializer subclass")
 
 
-class UpdateCustomInitializerRequest(BaseModel):
-    """Request body for replacing a custom initializer's Python source."""
-
-    script_content: str = Field(..., description="Replacement Python source containing a PyRITInitializer subclass")
-
-
 class CustomInitializerResponse(BaseModel):
     """Stored custom initializer source returned by the backend API."""
 
@@ -68,10 +61,7 @@ class CustomInitializerResponse(BaseModel):
 class CustomInitializerListResponse(BaseModel):
     """Custom initializer storage source and its Python definitions."""
 
-    source: str = Field(
-        ...,
-        description="Credential-free local directory or Azure Blob container URI with an optional blob prefix.",
-    )
+    source: str = Field(..., description="Credential-free configured custom initializer source.")
     items: list[CustomInitializerResponse] = Field(..., description="Stored custom initializer definitions.")
 
 
diff --git a/pyrit/backend/routes/initializers.py b/pyrit/backend/routes/initializers.py
index 0026e42dbe..5f4e354e5d 100644
--- a/pyrit/backend/routes/initializers.py
+++ b/pyrit/backend/routes/initializers.py
@@ -4,7 +4,7 @@
 """
 Initializer API routes.
 
-Provides endpoints for listing, registering, and removing initializers, plus managing stored custom scripts.
+Provides endpoints for listing, registering, and removing initializers.
 
 Route structure:
     GET    /api/initializers                — list all initializers
@@ -16,9 +16,6 @@
     GET    /api/initializers/{name}         — get single initializer detail
     POST   /api/initializers                — register initializer from script
     DELETE /api/initializers/{name}         — unregister an initializer
-    GET    /api/initializers/custom         — list stored custom scripts
-    PUT    /api/initializers/custom/{name}  — add or update a stored custom script
-    DELETE /api/initializers/custom/{name}  — delete a stored custom script
 """
 
 from fastapi import APIRouter, HTTPException, Query, Request, status
@@ -30,12 +27,10 @@
     BaselineInitializerSetting,
     CreateAdditionalInitializerRequest,
     CustomInitializerListResponse,
-    CustomInitializerResponse,
     InitializerSettingsResponse,
     ListRegisteredInitializersResponse,
     RegisterInitializerRequest,
     UpdateAdditionalInitializerRequest,
-    UpdateCustomInitializerRequest,
 )
 from pyrit.backend.services.initializer_service import get_initializer_service
 from pyrit.models import AdditionalInitializer
@@ -261,17 +256,13 @@ async def apply_initializer(  # pyrit-async-suffix-exempt
 )
 async def list_custom_initializers(request: Request) -> CustomInitializerListResponse:  # pyrit-async-suffix-exempt
     """
-    List user-defined initializer source from configured script storage.
-
-    Args:
-        request: The incoming FastAPI request.
+    List custom initializer scripts from the configured storage source.
 
     Returns:
-        CustomInitializerListResponse: Storage source and stored custom initializer definitions.
+        CustomInitializerListResponse: The configured source and stored scripts.
     """
     _check_custom_initializers_allowed(request)
-    service = get_initializer_service()
-    return await service.list_custom_initializers_async()
+    return await get_initializer_service().list_custom_initializers_async()
 
 
 @router.get(
@@ -341,80 +332,6 @@ async def register_initializer(  # pyrit-async-suffix-exempt
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=detail) from None
 
 
-@router.put(
-    "/custom/{initializer_name}",
-    response_model=CustomInitializerResponse,
-    responses={
-        400: {"model": ProblemDetail, "description": "Invalid initializer source"},
-        403: {"model": ProblemDetail, "description": "Custom initializer operations disabled"},
-    },
-)
-async def update_custom_initializer(  # pyrit-async-suffix-exempt
-    request: Request,
-    initializer_name: str,
-    body: UpdateCustomInitializerRequest,
-) -> CustomInitializerResponse:
-    """
-    Add or replace a stored custom initializer script for the next backend startup.
-
-    Args:
-        request: The incoming FastAPI request.
-        initializer_name: Registry name of the custom initializer.
-        body: Replacement Python source.
-
-    Returns:
-        CustomInitializerResponse: Updated stored custom initializer script.
-    """
-    _check_custom_initializers_allowed(request)
-    service = get_initializer_service()
-    try:
-        return await service.save_custom_initializer_async(
-            name=initializer_name,
-            script_content=body.script_content,
-        )
-    except ValueError as error:
-        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(error)) from None
-
-
-@router.delete(
-    "/custom/{initializer_name}",
-    status_code=status.HTTP_204_NO_CONTENT,
-    responses={
-        400: {"model": ProblemDetail, "description": "Cannot remove referenced custom initializer"},
-        403: {"model": ProblemDetail, "description": "Custom initializer operations disabled"},
-        404: {"model": ProblemDetail, "description": "Initializer not found"},
-    },
-)
-async def delete_custom_initializer(  # pyrit-async-suffix-exempt
-    request: Request,
-    initializer_name: str,
-) -> None:
-    """
-    Delete a stored custom initializer script for the next backend startup.
-
-    The current runtime registry is unchanged until restart.
-
-    Args:
-        request: The incoming FastAPI request.
-        initializer_name: Registry name of the initializer to remove.
-    """
-    _check_custom_initializers_allowed(request)
-    service = get_initializer_service()
-
-    try:
-        await service.delete_custom_initializer_async(initializer_name=initializer_name)
-    except ValueError as e:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail=str(e),
-        ) from None
-    except KeyError:
-        raise HTTPException(
-            status_code=status.HTTP_404_NOT_FOUND,
-            detail=f"Initializer '{initializer_name}' not found",
-        ) from None
-
-
 @router.delete(
     "/{initializer_name}",
     status_code=status.HTTP_204_NO_CONTENT,
diff --git a/pyrit/backend/services/configuration_file_service.py b/pyrit/backend/services/configuration_file_service.py
index d27e9b5b48..ee287cc58b 100644
--- a/pyrit/backend/services/configuration_file_service.py
+++ b/pyrit/backend/services/configuration_file_service.py
@@ -12,12 +12,8 @@
 
 import aiofiles
 
-from pyrit.backend.services.stale_while_revalidate_cache import StaleWhileRevalidateCache
 from pyrit.setup.configuration_loader import ConfigurationLoader
 
-_CACHE_TTL_SECONDS = 10.0
-_CONFIG_CACHE_KEY = "configuration"
-
 
 def _is_azure_blob_uri(value: str) -> bool:
     """Return whether a value is an Azure Blob Storage HTTPS URI."""
@@ -87,10 +83,6 @@ def __init__(self, *, config_file_value: str | None) -> None:
         """Initialize the service with an explicit source or the default configuration path."""
         self._config_file_value = config_file_value
         self._source = config_file_value or str(ConfigurationLoader.get_default_config_path())
-        self._cache = StaleWhileRevalidateCache[str](
-            ttl_seconds=_CACHE_TTL_SECONDS,
-            load_async=lambda _: self._read_source_async(),
-        )
 
     @property
     def source(self) -> str:
@@ -107,7 +99,7 @@ async def read_async(self) -> str:
         Returns:
             str: The UTF-8 configuration contents.
         """
-        return await self._cache.get_async(key=_CONFIG_CACHE_KEY)
+        return await self._read_source_async()
 
     async def _read_source_async(self) -> str:
         """
@@ -125,10 +117,7 @@ async def _read_source_async(self) -> str:
 
     async def update_async(self, content: str) -> None:
         """Replace the current configuration contents."""
-        await self._cache.update_async(
-            key=_CONFIG_CACHE_KEY,
-            update_async=lambda: self._write_source_async(content),
-        )
+        await self._write_source_async(content)
 
     async def _write_source_async(self, content: str) -> str:
         """
diff --git a/pyrit/backend/services/environment_file_service.py b/pyrit/backend/services/environment_file_service.py
index 82a6442f40..401bf919d0 100644
--- a/pyrit/backend/services/environment_file_service.py
+++ b/pyrit/backend/services/environment_file_service.py
@@ -9,7 +9,6 @@
 import aiofiles
 
 from pyrit.backend.models.configuration import EnvironmentFileContent
-from pyrit.backend.services.stale_while_revalidate_cache import StaleWhileRevalidateCache
 from pyrit.common.path import CONFIGURATION_DIRECTORY_PATH
 from pyrit.setup.environment_loading import (
     _create_akv_secret_client,
@@ -18,8 +17,6 @@
     _validate_dotenv_document,
 )
 
-_CACHE_TTL_SECONDS = 10.0
-
 
 async def _update_akv_document_async(*, secret_url: str, content: str, strict: bool) -> str:
     """
@@ -59,10 +56,6 @@ def __init__(
             if resolved_env_files is None
             else resolved_env_files
         )
-        self._cache = StaleWhileRevalidateCache[EnvironmentFileContent](
-            ttl_seconds=_CACHE_TTL_SECONDS,
-            load_async=lambda file_id: self._read_source_async(file_id=file_id),
-        )
 
     async def list_async(self) -> list[EnvironmentFileContent]:
         """
@@ -107,7 +100,7 @@ async def read_async(self, *, file_id: str) -> EnvironmentFileContent:
         Raises:
             KeyError: If the identifier does not name a configured environment source.
         """
-        return await self._cache.get_async(key=file_id)
+        return await self._read_source_async(file_id=file_id)
 
     async def _read_source_async(self, *, file_id: str) -> EnvironmentFileContent:
         """
@@ -130,10 +123,7 @@ async def update_async(self, *, file_id: str, content: str) -> EnvironmentFileCo
         Raises:
             KeyError: If the identifier does not name a configured environment file.
         """
-        return await self._cache.update_async(
-            key=file_id,
-            update_async=lambda: self._write_source_async(file_id=file_id, content=content),
-        )
+        return await self._write_source_async(file_id=file_id, content=content)
 
     async def _read_akv_source_async(self, *, file_id: str) -> EnvironmentFileContent:
         index, secret_url = self._get_akv_source(file_id)
diff --git a/pyrit/backend/services/initializer_service.py b/pyrit/backend/services/initializer_service.py
index 1654617f85..9f3331f152 100644
--- a/pyrit/backend/services/initializer_service.py
+++ b/pyrit/backend/services/initializer_service.py
@@ -26,7 +26,6 @@
     InitializerSettingsResponse,
     ListRegisteredInitializersResponse,
 )
-from pyrit.backend.services.stale_while_revalidate_cache import StaleWhileRevalidateCache
 from pyrit.memory import CentralMemory
 from pyrit.models import AdditionalInitializer
 from pyrit.models.catalog.initializer import RegisteredInitializer
@@ -34,8 +33,6 @@
 from pyrit.setup.pyrit_initializer import PyRITInitializer
 
 logger = logging.getLogger(__name__)
-_CUSTOM_CACHE_TTL_SECONDS = 10.0
-_CUSTOM_CACHE_KEY = "custom-initializers"
 
 
 def _metadata_to_registered_initializer(metadata: InitializerMetadata) -> RegisteredInitializer:
@@ -69,10 +66,6 @@ def __init__(self) -> None:
         """Initialize the initializer service."""
         self._registry = InitializerRegistry.get_registry_singleton()
         self._memory = CentralMemory.get_memory_instance()
-        self._custom_cache = StaleWhileRevalidateCache[CustomInitializerListResponse](
-            ttl_seconds=_CUSTOM_CACHE_TTL_SECONDS,
-            load_async=lambda _: self._load_custom_initializers_async(),
-        )
 
     async def list_initializers_async(
         self,
@@ -260,16 +253,12 @@ async def apply_initializer_async(
             applied_parameters=parameters,
         )
 
-    async def run_additional_initializers_async(self, *, allow_custom_initializers: bool) -> None:
+    async def run_additional_initializers_async(self) -> None:
         """
         Run all persisted additional initializers in stored order, after the baseline.
 
         Intended for the backend startup lifespan: the ``.pyrit_conf`` baseline runs first via
         the configuration loader, then this appends the user's additional initializers.
-        When custom initializers are disabled, only built-in initializers are run.
-
-        Args:
-            allow_custom_initializers: Whether stored custom initializers may run.
 
         Failures are isolated per initializer: a persisted row that fails to build, validate, or
         initialize (e.g. a missing required environment variable) is logged and skipped so one bad
@@ -282,12 +271,6 @@ async def run_additional_initializers_async(self, *, allow_custom_initializers:
 
         logger.info("Running %d additional initializer(s)...", len(initializers))
         for initializer in initializers:
-            if not allow_custom_initializers and not self._registry.is_builtin(initializer.initializer_name):
-                logger.info(
-                    "Skipping custom additional initializer '%s' because custom initializers are disabled.",
-                    initializer.initializer_name,
-                )
-                continue
             try:
                 await asyncio.to_thread(
                     self._build_and_run_initializer,
@@ -317,105 +300,33 @@ async def register_initializer_async(
         Returns:
             RegisteredInitializer: The newly registered initializer summary.
         """
-        self._registry.register_from_content(name=name, script_content=script_content)
+        await asyncio.to_thread(self._registry.register_from_content, name=name, script_content=script_content)
 
         initializer = await self.get_initializer_async(initializer_name=name)
         if not initializer:
             raise ValueError(f"Initializer '{name}' was registered but metadata could not be retrieved.")
         return initializer
 
-    async def save_custom_initializer_async(
-        self,
-        *,
-        name: str,
-        script_content: str,
-    ) -> CustomInitializerResponse:
-        """
-        Validate and persist a custom initializer definition for the next startup.
-
-        Args:
-            name: Registry name of the custom initializer.
-            script_content: Replacement Python source code.
-
-        Returns:
-            CustomInitializerResponse: The stored custom initializer script.
-        """
-        await asyncio.to_thread(
-            self._registry.save_custom_initializer_script,
-            name=name,
-            script_content=script_content,
-        )
-        self._invalidate_custom_initializers_cache()
-        return self._custom_initializer_response(name=name, script_content=script_content)
-
     async def list_custom_initializers_async(self) -> CustomInitializerListResponse:
         """
-        List stored custom initializer source definitions and their storage source.
+        List custom initializer scripts from the registry's configured storage.
 
         Returns:
-            CustomInitializerListResponse: Credential-free source and stored definitions.
-        """
-        return await self._custom_cache.get_async(key=_CUSTOM_CACHE_KEY)
-
-    async def _load_custom_initializers_async(self) -> CustomInitializerListResponse:
+            CustomInitializerListResponse: The configured source and stored scripts.
         """
-        Read custom initializer storage and replace the cached response.
-
-        Returns:
-            CustomInitializerListResponse: The current stored custom initializers.
-        """
-        sources = await asyncio.to_thread(self._registry.list_custom_initializer_sources)
+        source, scripts = await asyncio.to_thread(self._registry.list_stored_initializer_sources)
         return CustomInitializerListResponse(
-            source=self._registry.custom_scripts_source,
+            source=source,
             items=[
                 CustomInitializerResponse(
                     initializer_name=name,
                     script_content=script_content,
-                    source=self._registry.get_custom_initializer_source(name),
+                    source=script_source,
                 )
-                for name, script_content in sources.items()
+                for name, script_content, script_source in scripts
             ],
         )
 
-    def _invalidate_custom_initializers_cache(self) -> None:
-        """Invalidate custom initializer data after a successful mutation."""
-        self._custom_cache.invalidate(_CUSTOM_CACHE_KEY)
-
-    def _custom_initializer_response(self, *, name: str, script_content: str) -> CustomInitializerResponse:
-        """
-        Build a response for one stored custom initializer script.
-
-        Returns:
-            CustomInitializerResponse: The stored script and its source location.
-        """
-        return CustomInitializerResponse(
-            initializer_name=name,
-            script_content=script_content,
-            source=self._registry.get_custom_initializer_source(name),
-        )
-
-    async def restore_custom_initializers_async(self) -> None:
-        """Restore stored custom initializer definitions into the runtime registry."""
-        await self._custom_cache.refresh_async(key=_CUSTOM_CACHE_KEY)
-        await asyncio.to_thread(self._registry.restore_custom_initializers)
-
-    async def delete_custom_initializer_async(self, *, initializer_name: str) -> None:
-        """
-        Delete a stored custom initializer script for the next startup.
-
-        Args:
-            initializer_name: The registry name to remove.
-        """
-        additional_initializers = await asyncio.to_thread(self._memory.get_additional_initializers)
-        if any(initializer.initializer_name == initializer_name for initializer in additional_initializers):
-            raise ValueError(
-                f"Cannot remove initializer '{initializer_name}' while additional initializer settings reference it."
-            )
-
-        await asyncio.to_thread(self._registry.delete_custom_initializer_script, name=initializer_name)
-        self._invalidate_custom_initializers_cache()
-        logger.info("Deleted custom initializer script: %s", initializer_name)
-
     async def unregister_initializer_async(self, *, initializer_name: str) -> None:
         """
         Remove a custom initializer from the registry.
@@ -423,7 +334,7 @@ async def unregister_initializer_async(self, *, initializer_name: str) -> None:
         Args:
             initializer_name: The registry name to remove.
         """
-        self._registry.unregister_and_cleanup(initializer_name)
+        await asyncio.to_thread(self._registry.unregister_and_cleanup, initializer_name)
         logger.info("Unregistered initializer: %s", initializer_name)
 
     def _build_and_run_initializer(
diff --git a/pyrit/backend/services/stale_while_revalidate_cache.py b/pyrit/backend/services/stale_while_revalidate_cache.py
deleted file mode 100644
index be91b6b7cf..0000000000
--- a/pyrit/backend/services/stale_while_revalidate_cache.py
+++ /dev/null
@@ -1,109 +0,0 @@
-# Copyright (c) Microsoft Corporation.
-# Licensed under the MIT license.
-
-"""Reusable asynchronous stale-while-revalidate caching."""
-
-import asyncio
-import logging
-import time
-from collections.abc import Awaitable, Callable
-from copy import deepcopy
-from typing import Generic, TypeVar
-
-_ValueT = TypeVar("_ValueT")
-
-logger = logging.getLogger(__name__)
-
-
-class StaleWhileRevalidateCache(Generic[_ValueT]):
-    """Cache keyed values while refreshing expired entries in the background."""
-
-    def __init__(self, *, ttl_seconds: float, load_async: Callable[[str], Awaitable[_ValueT]]) -> None:
-        """Initialize the cache."""
-        self._ttl_seconds = ttl_seconds
-        self._load_value_async = load_async
-        self._entries: dict[str, tuple[float, _ValueT]] = {}
-        self._locks: dict[str, asyncio.Lock] = {}
-        self._refresh_tasks: dict[str, asyncio.Task[None]] = {}
-        self._generations: dict[str, int] = {}
-
-    async def get_async(self, *, key: str) -> _ValueT:
-        """Return a cached value, loading misses and refreshing expired entries in the background."""
-        entry = self._entries.get(key)
-        if entry is None:
-            return await self._load_async(key=key, force=False)
-
-        if time.monotonic() >= entry[0] and key not in self._refresh_tasks:
-            self._refresh_tasks[key] = asyncio.create_task(self._refresh_in_background_async(key=key))
-        return deepcopy(entry[1])
-
-    async def refresh_async(self, *, key: str) -> _ValueT:
-        """
-        Load and cache a fresh value.
-
-        Returns:
-            _ValueT: A copy of the refreshed value.
-        """
-        return await self._load_async(key=key, force=True)
-
-    async def update_async(self, *, key: str, update_async: Callable[[], Awaitable[_ValueT]]) -> _ValueT:
-        """
-        Persist and cache a value while excluding loads for the same key.
-
-        Returns:
-            _ValueT: A copy of the persisted value.
-        """
-        lock = self._locks.setdefault(key, asyncio.Lock())
-        async with lock:
-            value = await update_async()
-            self.set(key=key, value=value)
-            return deepcopy(value)
-
-    def set(self, *, key: str, value: _ValueT) -> None:
-        """Store a value and supersede any in-progress load."""
-        self._advance_generation(key)
-        self._entries[key] = (time.monotonic() + self._ttl_seconds, value)
-
-    def invalidate(self, key: str) -> None:
-        """Remove a value and prevent an in-progress load from restoring it."""
-        self._advance_generation(key)
-        self._entries.pop(key, None)
-
-    def get_refresh_task(self, key: str) -> asyncio.Task[None] | None:
-        """Return the active background refresh task for a key, if any."""
-        return self._refresh_tasks.get(key)
-
-    async def _load_async(
-        self,
-        *,
-        key: str,
-        force: bool,
-    ) -> _ValueT:
-        lock = self._locks.setdefault(key, asyncio.Lock())
-        async with lock:
-            entry = self._entries.get(key)
-            if not force and entry is not None:
-                return deepcopy(entry[1])
-
-            generation = self._generations.get(key, 0)
-            value = await self._load_value_async(key)
-            if self._generations.get(key, 0) == generation:
-                self._entries[key] = (time.monotonic() + self._ttl_seconds, value)
-            return deepcopy(value)
-
-    async def _refresh_in_background_async(
-        self,
-        *,
-        key: str,
-    ) -> None:
-        task = asyncio.current_task()
-        try:
-            await self._load_async(key=key, force=True)
-        except Exception:
-            logger.warning("Failed to refresh cache entry %r", key, exc_info=True)
-        finally:
-            if self._refresh_tasks.get(key) is task:
-                self._refresh_tasks.pop(key, None)
-
-    def _advance_generation(self, key: str) -> None:
-        self._generations[key] = self._generations.get(key, 0) + 1
diff --git a/pyrit/registry/components/initializer_registry.py b/pyrit/registry/components/initializer_registry.py
index bb87592b52..8d37bed2cb 100644
--- a/pyrit/registry/components/initializer_registry.py
+++ b/pyrit/registry/components/initializer_registry.py
@@ -73,13 +73,7 @@ class InitializerRegistry(ParamBagRegistry["PyRITInitializer", InitializerMetada
     directory structure is used for organization but not exposed to users.
     """
 
-    def __init__(
-        self,
-        *,
-        discovery_path: Path | None = None,
-        lazy_discovery: bool = False,
-        custom_scripts_source: str | None = None,
-    ) -> None:
+    def __init__(self, *, discovery_path: Path | None = None, lazy_discovery: bool = False) -> None:
         """
         Initialize the initializer registry.
 
@@ -88,28 +82,19 @@ def __init__(
                 If None, defaults to pyrit/setup/initializers (discovers all).
             lazy_discovery: If True, discovery is deferred until first access.
                 Defaults to False for backwards compatibility.
-            custom_scripts_source: Local directory or Azure Blob container URI with an
-                optional blob prefix for stored custom initializer scripts. Defaults to
-                ``~/.pyrit/custom_initializers``.
         """
         self._discovery_path: Path = (
             discovery_path if discovery_path is not None else Path(PYRIT_PATH) / "setup" / "initializers"
         )
 
         self._builtin_names: set[str] = set()
-        self._custom_scripts_source = custom_scripts_source
         self._custom_storage: CustomInitializerStorage | None = None
         super().__init__(lazy_discovery=lazy_discovery)
 
     def configure_custom_scripts_source(self, source: str | None) -> None:
-        """Configure a local directory or Azure Blob source for custom scripts."""
-        self._custom_scripts_source = source
-        self._custom_storage = None
-
-    @property
-    def custom_scripts_source(self) -> str:
-        """Credential-free custom initializer storage source."""
-        return self._get_custom_storage().display_source
+        """Configure the local directory or Azure Blob source for custom initializers."""
+        custom_source = source or str(self._get_custom_scripts_dir())
+        self._custom_storage = CustomInitializerStorage(source=custom_source)
 
     def _metadata_class(self) -> type[InitializerMetadata]:
         """Return the concrete metadata dataclass this registry builds."""
@@ -394,11 +379,6 @@ def register_from_content(self, *, name: str, script_content: str) -> str:
         module, discovers the first concrete ``PyRITInitializer``
         subclass, and registers it under *name*.
 
-        Note:
-            Registrations are runtime-only and are not rediscovered on
-            server restart.  Script files persist on disk as import
-            artifacts for the current process.
-
         Args:
             name: Registry name for the new initializer.
             script_content: Python source code that defines a
@@ -413,107 +393,48 @@ def register_from_content(self, *, name: str, script_content: str) -> str:
                 with an existing entry.
         """
         self._ensure_discovered()
-        with self._catalog_lock:
-            validate_registry_name(name)
-
-            if name in self._classes:
-                raise ValueError(f"Initializer '{name}' is already registered. Unregister it first to replace it.")
-
-            discovered = self._load_custom_initializer_class(name=name, script_content=script_content)
-            storage = self._get_custom_storage()
-            storage.save_script(name=name, content=script_content)
-            try:
-                self.register_class(discovered, name=name)
-            except Exception:
-                storage.delete_script(name)
-                raise
-        logger.info(f"Registered custom initializer: {name} ({discovered.__name__})")
-        return name
-
-    def update_from_content(self, *, name: str, script_content: str) -> str:
-        """
-        Replace a registered custom initializer and its stored source.
-
-        Returns:
-            str: The updated registry name.
-
-        Raises:
-            KeyError: If the initializer is not registered.
-            ValueError: If the initializer is built-in or the source is invalid.
-        """
-        self._ensure_discovered()
-        with self._catalog_lock:
-            if name in self._builtin_names:
-                raise ValueError(f"Cannot update built-in initializer '{name}'.")
-            if name not in self._classes:
-                raise KeyError(name)
-
-            discovered = self._load_custom_initializer_class(name=name, script_content=script_content)
-            self._get_custom_storage().save_script(name=name, content=script_content)
-            self._classes[name] = discovered
-            self._metadata_cache = None
-            self._catalog_version += 1
-        logger.info(f"Updated custom initializer: {name} ({discovered.__name__})")
-        return name
-
-    def list_custom_initializer_sources(self) -> dict[str, str]:
-        """
-        List stored custom initializer source definitions.
-
-        Returns:
-            dict[str, str]: Script content keyed by registry name.
-        """
-        with self._catalog_lock:
-            return self._get_custom_storage().list_scripts()
-
-    def save_custom_initializer_script(self, *, name: str, script_content: str) -> None:
-        """
-        Validate and persist a custom initializer script for the next startup.
 
-        Raises:
-            ValueError: If the name or source is invalid.
-        """
         validate_registry_name(name)
-        with self._catalog_lock:
-            self._load_custom_initializer_class(name=name, script_content=script_content)
-            self._get_custom_storage().save_script(name=name, content=script_content)
 
-    def delete_custom_initializer_script(self, *, name: str) -> None:
-        """
-        Delete a stored custom initializer script for the next startup.
+        if name in self._classes:
+            raise ValueError(f"Initializer '{name}' is already registered. Unregister it first to replace it.")
 
-        Raises:
-            KeyError: If the custom initializer script does not exist.
-            ValueError: If the name is invalid.
-        """
-        validate_registry_name(name)
-        with self._catalog_lock:
-            if name not in self._get_custom_storage().list_scripts():
-                raise KeyError(name)
-            self._get_custom_storage().delete_script(name)
-
-    def get_custom_initializer_source(self, name: str) -> str:
-        """
-        Get the credential-free storage location for a custom initializer.
+        storage = self._get_custom_storage()
+        try:
+            storage.save_script(name=name, content=script_content)
+        except OSError as error:
+            raise ValueError(f"Failed to write initializer script: {error}") from error
+        try:
+            discovered = self._load_custom_initializer_class(name=name, script_content=script_content)
+        except Exception:
+            storage.delete_script(name)
+            raise
 
-        Returns:
-            str: Local file path or Azure Blob URI for the script.
-        """
-        return self._get_custom_storage().get_script_source(name)
+        self.register_class(discovered, name=name)
+        logger.info(f"Registered custom initializer: {name} ({discovered.__name__})")
+        return name
 
-    def restore_custom_initializers(self) -> None:
-        """Load all stored custom initializer scripts into the runtime registry."""
+    def register_stored_initializers(self) -> None:
+        """Register all valid custom initializers from the configured storage source."""
         self._ensure_discovered()
-        with self._catalog_lock:
-            for name, script_content in self.list_custom_initializer_sources().items():
-                try:
-                    if name in self._classes:
-                        logger.warning(f"Skipping stored custom initializer '{name}': name is already registered.")
-                        continue
-                    discovered = self._load_custom_initializer_class(name=name, script_content=script_content)
-                    self.register_class(discovered, name=name)
-                except Exception:
-                    logger.exception(f"Skipping stored custom initializer '{name}': registration failed.")
+        for name, script_content in self._get_custom_storage().list_scripts().items():
+            try:
+                validate_registry_name(name)
+                if name in self._classes:
+                    logger.warning(f"Skipping stored custom initializer '{name}': name is already registered.")
+                    continue
+                discovered = self._load_custom_initializer_class(name=name, script_content=script_content)
+                self.register_class(discovered, name=name)
+            except Exception:
+                logger.exception(f"Skipping stored custom initializer '{name}': registration failed.")
+
+    def list_stored_initializer_sources(self) -> tuple[str, list[tuple[str, str, str]]]:
+        """Return the configured source and its stored custom initializer scripts."""
+        storage = self._get_custom_storage()
+        scripts = storage.list_scripts()
+        return storage.display_source, [
+            (name, script_content, storage.get_script_source(name)) for name, script_content in scripts.items()
+        ]
 
     def unregister_and_cleanup(self, name: str) -> None:
         """
@@ -531,16 +452,15 @@ def unregister_and_cleanup(self, name: str) -> None:
             ValueError: If the name refers to a built-in initializer.
         """
         self._ensure_discovered()
-        with self._catalog_lock:
-            if name in self._builtin_names:
-                raise ValueError(f"Cannot remove built-in initializer '{name}'.")
-            if name not in self._classes:
-                available = ", ".join(self.get_class_names())
-                raise KeyError(f"'{name}' not found in registry. Available: {available}")
-            self._get_custom_storage().delete_script(name)
-            del self._classes[name]
-            self._metadata_cache = None
-            self._catalog_version += 1
+        if name in self._builtin_names:
+            raise ValueError(f"Cannot remove built-in initializer '{name}'.")
+        if name not in self._classes:
+            available = ", ".join(self.get_class_names())
+            raise KeyError(f"'{name}' not found in registry. Available: {available}")
+        del self._classes[name]
+        self._metadata_cache = None
+
+        self._get_custom_storage().delete_script(name)
 
     def _load_custom_initializer_class(
         self,
@@ -576,16 +496,12 @@ def _load_custom_initializer_class(
         return discovered_classes[0]
 
     def _get_custom_storage(self) -> CustomInitializerStorage:
-        """
-        Create storage for the configured custom initializer source.
-
-        Returns:
-            CustomInitializerStorage: Configured script storage.
-        """
-        if self._custom_storage is None:
-            source = self._custom_scripts_source or str(self._get_custom_scripts_dir())
-            self._custom_storage = CustomInitializerStorage(source=source)
-        return self._custom_storage
+        """Return storage for the configured custom initializer source."""
+        storage = self._custom_storage
+        if storage is None:
+            storage = CustomInitializerStorage(source=str(self._get_custom_scripts_dir()))
+            self._custom_storage = storage
+        return storage
 
     @staticmethod
     def _get_custom_scripts_dir() -> Path:
diff --git a/pyrit/registry/custom_initializer_storage.py b/pyrit/registry/custom_initializer_storage.py
index a810fb1953..4e52c5246b 100644
--- a/pyrit/registry/custom_initializer_storage.py
+++ b/pyrit/registry/custom_initializer_storage.py
@@ -5,7 +5,6 @@
 
 from __future__ import annotations
 
-import time
 from contextlib import contextmanager, suppress
 from pathlib import Path, PurePosixPath
 from typing import TYPE_CHECKING
@@ -22,7 +21,6 @@
     ".blob.core.usgovcloudapi.net",
     ".blob.core.cloudapi.de",
 )
-_CACHE_TTL_SECONDS = 10.0
 
 
 def is_azure_blob_source_uri(value: str) -> bool:
@@ -57,8 +55,6 @@ def __init__(self, *, source: str) -> None:
                 "with an optional blob prefix"
             )
         self._container_url, self._blob_prefix = self._parse_blob_source() if self._is_blob else (None, "")
-        self._cached_scripts: dict[str, str] | None = None
-        self._cache_expires_at = 0.0
 
     @property
     def display_source(self) -> str:
@@ -86,19 +82,12 @@ def list_scripts(self) -> dict[str, str]:
         Returns:
             dict[str, str]: Script content keyed by registry name.
         """
-        if self._cached_scripts is not None and time.monotonic() < self._cache_expires_at:
-            return dict(self._cached_scripts)
-
         if self._is_blob:
-            scripts = self._list_blob_scripts()
-        else:
-            directory = Path(self._source).expanduser()
-            directory.mkdir(parents=True, exist_ok=True)
-            scripts = {path.stem: path.read_text(encoding="utf-8") for path in sorted(directory.glob("*.py"))}
+            return self._list_blob_scripts()
 
-        self._cached_scripts = scripts
-        self._cache_expires_at = time.monotonic() + _CACHE_TTL_SECONDS
-        return dict(scripts)
+        directory = Path(self._source).expanduser()
+        directory.mkdir(parents=True, exist_ok=True)
+        return {path.stem: path.read_text(encoding="utf-8") for path in sorted(directory.glob("*.py"))}
 
     def save_script(self, *, name: str, content: str) -> None:
         """Persist one custom initializer script."""
@@ -110,8 +99,6 @@ def save_script(self, *, name: str, content: str) -> None:
             directory.mkdir(parents=True, exist_ok=True)
             (directory / f"{name}.py").write_text(content, encoding="utf-8")
 
-        self._update_cached_script(name=name, content=content)
-
     def delete_script(self, name: str) -> None:
         """Delete one custom initializer script if it exists."""
         if self._is_blob:
@@ -123,28 +110,6 @@ def delete_script(self, name: str) -> None:
         else:
             (Path(self._source).expanduser() / f"{name}.py").unlink(missing_ok=True)
 
-        self._delete_cached_script(name)
-
-    def _update_cached_script(self, *, name: str, content: str) -> None:
-        """Update a fresh cache after a successful write, or invalidate a stale cache."""
-        now = time.monotonic()
-        if self._cached_scripts is None or now >= self._cache_expires_at:
-            self._cached_scripts = None
-            self._cache_expires_at = 0.0
-            return
-        self._cached_scripts[name] = content
-        self._cache_expires_at = now + _CACHE_TTL_SECONDS
-
-    def _delete_cached_script(self, name: str) -> None:
-        """Update a fresh cache after a successful delete, or invalidate a stale cache."""
-        now = time.monotonic()
-        if self._cached_scripts is None or now >= self._cache_expires_at:
-            self._cached_scripts = None
-            self._cache_expires_at = 0.0
-            return
-        self._cached_scripts.pop(name, None)
-        self._cache_expires_at = now + _CACHE_TTL_SECONDS
-
     def _list_blob_scripts(self) -> dict[str, str]:
         """
         Read Python scripts from the configured Azure Blob container.
diff --git a/tests/unit/backend/test_configuration_file_service.py b/tests/unit/backend/test_configuration_file_service.py
index 3eec48badd..416712cdc9 100644
--- a/tests/unit/backend/test_configuration_file_service.py
+++ b/tests/unit/backend/test_configuration_file_service.py
@@ -29,7 +29,7 @@ async def test_configuration_file_service_reads_and_updates_blob() -> None:
     with (
         patch(
             "pyrit.backend.services.configuration_file_service._download_blob_config_async",
-            new=AsyncMock(return_value=b"operator: before\n"),
+            new=AsyncMock(side_effect=[b"operator: before\n", b"operator: after\n"]),
         ) as download_mock,
         patch(
             "pyrit.backend.services.configuration_file_service._upload_blob_config_async",
@@ -40,31 +40,21 @@ async def test_configuration_file_service_reads_and_updates_blob() -> None:
         await service.update_async("operator: after\n")
         assert await service.read_async() == "operator: after\n"
 
-    download_mock.assert_awaited_once_with(blob_uri)
+    assert download_mock.await_count == 2
+    assert download_mock.call_args_list[0].args == (blob_uri,)
+    assert download_mock.call_args_list[1].args == (blob_uri,)
     upload_mock.assert_awaited_once_with(blob_uri=blob_uri, content=b"operator: after\n")
 
 
-async def test_configuration_file_service_refreshes_blob_after_cache_expires() -> None:
-    """Test that expiry returns stale content while refreshing for the next read."""
+async def test_configuration_file_service_reads_latest_blob_content() -> None:
+    """Test that every read observes the current blob content."""
     blob_uri = "https://account.blob.core.windows.net/config/config.yaml"
     service = ConfigurationFileService(config_file_value=blob_uri)
-    with (
-        patch(
-            "pyrit.backend.services.configuration_file_service._download_blob_config_async",
-            new=AsyncMock(side_effect=[b"operator: before\n", b"operator: external\n"]),
-        ) as download_mock,
-        patch(
-            "pyrit.backend.services.stale_while_revalidate_cache.time.monotonic", return_value=100.0
-        ) as monotonic_mock,
-    ):
-        assert await service.read_async() == "operator: before\n"
-        assert await service.read_async() == "operator: before\n"
-
-        monotonic_mock.return_value = 111.0
+    with patch(
+        "pyrit.backend.services.configuration_file_service._download_blob_config_async",
+        new=AsyncMock(side_effect=[b"operator: before\n", b"operator: external\n"]),
+    ) as download_mock:
         assert await service.read_async() == "operator: before\n"
-        refresh_task = service._cache.get_refresh_task("configuration")
-        assert refresh_task is not None
-        await refresh_task
         assert await service.read_async() == "operator: external\n"
 
     assert download_mock.await_count == 2
diff --git a/tests/unit/backend/test_environment_file_service.py b/tests/unit/backend/test_environment_file_service.py
index a783a80ed2..d90edbd647 100644
--- a/tests/unit/backend/test_environment_file_service.py
+++ b/tests/unit/backend/test_environment_file_service.py
@@ -58,7 +58,12 @@ async def test_environment_file_service_lists_and_updates_akv_before_files(tmp_p
     with (
         patch(
             "pyrit.backend.services.environment_file_service._fetch_akv_document_async",
-            new=AsyncMock(return_value=("AKV=before\n", "https://vault.vault.azure.net")),
+            new=AsyncMock(
+                side_effect=[
+                    ("AKV=before\n", "https://vault.vault.azure.net"),
+                    ("AKV=after\n", "https://vault.vault.azure.net"),
+                ]
+            ),
         ) as fetch_mock,
         patch(
             "pyrit.backend.services.environment_file_service._update_akv_document_async",
@@ -69,15 +74,15 @@ async def test_environment_file_service_lists_and_updates_akv_before_files(tmp_p
         fetch_mock.assert_not_awaited()
         loaded = await service.read_async(file_id="akv:0")
         updated = await service.update_async(file_id="akv:0", content="AKV=after\n")
-        cached_after_update = await service.read_async(file_id="akv:0")
+        loaded_after_update = await service.read_async(file_id="akv:0")
 
     assert [item.id for item in items] == ["akv:0", "0"]
     assert items[0].name == "AKV: bootstrap"
     assert items[0].path == secret_url
     assert items[0].content == ""
     assert loaded.content == "AKV=before\n"
-    assert cached_after_update.content == "AKV=after\n"
-    fetch_mock.assert_awaited_once_with(secret_url=secret_url, strict=True, silent=True)
+    assert loaded_after_update.content == "AKV=after\n"
+    assert fetch_mock.await_count == 2
     assert updated.content == "AKV=after\n"
     update_mock.assert_awaited_once_with(secret_url=secret_url, content="AKV=after\n", strict=True)
 
@@ -95,27 +100,15 @@ async def test_environment_file_service_rejects_versioned_akv_update() -> None:
     credential_mock.assert_not_called()
 
 
-async def test_environment_file_service_caches_selected_akv_source_until_expiry() -> None:
-    """Test that expiry returns stale content while refreshing for the next read."""
+async def test_environment_file_service_reads_latest_akv_content() -> None:
+    """Test that every read observes the current AKV content."""
     secret_url = "https://vault.vault.azure.net/secrets/bootstrap"
     service = EnvironmentFileService(resolved_env_files=[], env_akv_ref=[secret_url])
-    with (
-        patch(
-            "pyrit.backend.services.environment_file_service._fetch_akv_document_async",
-            new=AsyncMock(side_effect=[("FIRST=1\n", "vault"), ("SECOND=2\n", "vault")]),
-        ) as fetch_mock,
-        patch(
-            "pyrit.backend.services.stale_while_revalidate_cache.time.monotonic", return_value=100.0
-        ) as monotonic_mock,
-    ):
-        assert (await service.read_async(file_id="akv:0")).content == "FIRST=1\n"
-        assert (await service.read_async(file_id="akv:0")).content == "FIRST=1\n"
-
-        monotonic_mock.return_value = 111.0
+    with patch(
+        "pyrit.backend.services.environment_file_service._fetch_akv_document_async",
+        new=AsyncMock(side_effect=[("FIRST=1\n", "vault"), ("SECOND=2\n", "vault")]),
+    ) as fetch_mock:
         assert (await service.read_async(file_id="akv:0")).content == "FIRST=1\n"
-        refresh_task = service._cache.get_refresh_task("akv:0")
-        assert refresh_task is not None
-        await refresh_task
         assert (await service.read_async(file_id="akv:0")).content == "SECOND=2\n"
 
     assert fetch_mock.await_count == 2
diff --git a/tests/unit/backend/test_initializer_service.py b/tests/unit/backend/test_initializer_service.py
index 9b169e7972..468e3e9932 100644
--- a/tests/unit/backend/test_initializer_service.py
+++ b/tests/unit/backend/test_initializer_service.py
@@ -17,14 +17,11 @@
 from pyrit.backend.models.initializers import (
     ApplyInitializerResponse,
     BaselineInitializerSetting,
-    CustomInitializerListResponse,
-    CustomInitializerResponse,
     InitializerSettingsResponse,
     ListRegisteredInitializersResponse,
     RegisteredInitializer,
 )
 from pyrit.backend.services.initializer_service import InitializerService, get_initializer_service
-from pyrit.backend.services.stale_while_revalidate_cache import StaleWhileRevalidateCache
 from pyrit.models import AdditionalInitializer, Parameter
 from pyrit.registry import InitializerMetadata
 
@@ -484,7 +481,7 @@ async def test_run_additional_initializers_runs_each_in_order(self) -> None:
                 AdditionalInitializer(id="a2", initializer_name="widget", order_index=1),
             ]
 
-            await service.run_additional_initializers_async(allow_custom_initializers=True)
+            await service.run_additional_initializers_async()
 
             assert service._registry.create_and_configure.call_args_list[0].args == ("target",)
             assert service._registry.create_and_configure.call_args_list[0].kwargs == {
@@ -501,31 +498,10 @@ async def test_run_additional_initializers_no_op_when_empty(self) -> None:
             service._memory = MagicMock()
             service._memory.get_additional_initializers.return_value = []
 
-            await service.run_additional_initializers_async(allow_custom_initializers=True)
+            await service.run_additional_initializers_async()
 
             service._registry.create_and_configure.assert_not_called()
 
-    async def test_run_additional_initializers_skips_custom_when_disabled(self) -> None:
-        builtin = MagicMock()
-        builtin.validate = MagicMock()
-        builtin.initialize_async = AsyncMock(return_value=None)
-
-        with patch.object(InitializerService, "__init__", lambda self: None):
-            service = InitializerService()
-            service._registry = MagicMock()
-            service._registry.is_builtin.side_effect = lambda name: name == "builtin"
-            service._registry.create_and_configure.return_value = builtin
-            service._memory = MagicMock()
-            service._memory.get_additional_initializers.return_value = [
-                AdditionalInitializer(id="a1", initializer_name="builtin", order_index=0),
-                AdditionalInitializer(id="a2", initializer_name="custom", order_index=1),
-            ]
-
-            await service.run_additional_initializers_async(allow_custom_initializers=False)
-
-            service._registry.create_and_configure.assert_called_once_with("builtin", initializer_params=None)
-            builtin.initialize_async.assert_awaited_once()
-
     async def test_run_additional_initializers_isolates_failures(self) -> None:
         failing = MagicMock()
         failing.supported_parameters = []
@@ -545,7 +521,7 @@ async def test_run_additional_initializers_isolates_failures(self) -> None:
                 AdditionalInitializer(id="good", initializer_name="widget", order_index=1),
             ]
 
-            await service.run_additional_initializers_async(allow_custom_initializers=True)
+            await service.run_additional_initializers_async()
 
             failing.initialize_async.assert_not_called()
             healthy.initialize_async.assert_awaited_once()
@@ -862,32 +838,8 @@ async def initialize_async(self) -> None:
 """
 
 
-def _initialize_custom_cache(service: InitializerService) -> None:
-    service._custom_cache = StaleWhileRevalidateCache[CustomInitializerListResponse](
-        ttl_seconds=10.0,
-        load_async=lambda _: service._load_custom_initializers_async(),
-    )
-
-
-class TestInitializerServiceCustomScripts:
-    """Tests for custom initializer script storage operations."""
-
-    async def test_save_custom_initializer_stores_script(self) -> None:
-        with patch.object(InitializerService, "__init__", lambda self: None):
-            service = InitializerService()
-            mock_registry = MagicMock()
-            mock_registry.get_custom_initializer_source.return_value = "C:/custom/my_custom.py"
-            service._registry = mock_registry
-            service._memory = MagicMock()
-            _initialize_custom_cache(service)
-
-            result = await service.save_custom_initializer_async(name="my_custom", script_content=_SAMPLE_SCRIPT)
-
-            mock_registry.save_custom_initializer_script.assert_called_once_with(
-                name="my_custom", script_content=_SAMPLE_SCRIPT
-            )
-            assert result.initializer_name == "my_custom"
-            assert result.script_content == _SAMPLE_SCRIPT
+class TestInitializerServiceCustomRegistration:
+    """Tests for runtime custom initializer registration."""
 
     async def test_register_initializer_still_updates_runtime_registry(self) -> None:
         with patch.object(InitializerService, "__init__", lambda self: None):
@@ -909,106 +861,16 @@ async def test_list_custom_initializers_returns_stored_sources(self) -> None:
         with patch.object(InitializerService, "__init__", lambda self: None):
             service = InitializerService()
             service._registry = MagicMock()
-            _initialize_custom_cache(service)
-            service._registry.custom_scripts_source = "C:/custom"
-            service._registry.list_custom_initializer_sources.return_value = {"my_custom": _SAMPLE_SCRIPT}
-            service._registry.get_custom_initializer_source.return_value = "C:/custom/my_custom.py"
+            service._registry.list_stored_initializer_sources.return_value = (
+                "C:/custom",
+                [("my_custom", _SAMPLE_SCRIPT, "C:/custom/my_custom.py")],
+            )
 
             result = await service.list_custom_initializers_async()
 
             assert result.source == "C:/custom"
-            assert result.items == [
-                CustomInitializerResponse(
-                    initializer_name="my_custom",
-                    script_content=_SAMPLE_SCRIPT,
-                    source="C:/custom/my_custom.py",
-                )
-            ]
-
-    async def test_list_custom_initializers_refreshes_expired_cache_in_background(self) -> None:
-        with patch.object(InitializerService, "__init__", lambda self: None):
-            service = InitializerService()
-            service._registry = MagicMock()
-            _initialize_custom_cache(service)
-            service._registry.custom_scripts_source = "C:/custom"
-            service._registry.list_custom_initializer_sources.side_effect = [
-                {"my_custom": "VALUE = 1\n"},
-                {"my_custom": "VALUE = 2\n"},
-            ]
-            service._registry.get_custom_initializer_source.return_value = "C:/custom/my_custom.py"
-
-            with patch(
-                "pyrit.backend.services.stale_while_revalidate_cache.time.monotonic", return_value=100.0
-            ) as monotonic_mock:
-                first = await service.list_custom_initializers_async()
-                monotonic_mock.return_value = 111.0
-                stale = await service.list_custom_initializers_async()
-                refresh_task = service._custom_cache.get_refresh_task("custom-initializers")
-                assert refresh_task is not None
-                await refresh_task
-                refreshed = await service.list_custom_initializers_async()
-
-            assert first.items[0].script_content == "VALUE = 1\n"
-            assert stale.items[0].script_content == "VALUE = 1\n"
-            assert refreshed.items[0].script_content == "VALUE = 2\n"
-            assert service._registry.list_custom_initializer_sources.call_count == 2
-
-    async def test_restore_custom_initializers_delegates_to_registry(self) -> None:
-        with patch.object(InitializerService, "__init__", lambda self: None):
-            service = InitializerService()
-            service._registry = MagicMock()
-            service._registry.custom_scripts_source = "C:/custom"
-            service._registry.list_custom_initializer_sources.return_value = {"my_custom": _SAMPLE_SCRIPT}
-            service._registry.get_custom_initializer_source.return_value = "C:/custom/my_custom.py"
-            _initialize_custom_cache(service)
-
-            await service.restore_custom_initializers_async()
-
-            service._registry.restore_custom_initializers.assert_called_once_with()
-            cached = await service.list_custom_initializers_async()
-            assert cached.items[0].script_content == _SAMPLE_SCRIPT
-
-
-class TestInitializerServiceDeleteCustomScript:
-    """Tests for InitializerService.delete_custom_initializer_async."""
-
-    async def test_delete_custom_initializer_calls_registry(self) -> None:
-        with patch.object(InitializerService, "__init__", lambda self: None):
-            service = InitializerService()
-            mock_registry = MagicMock()
-            service._registry = mock_registry
-            service._memory = MagicMock()
-            _initialize_custom_cache(service)
-
-            await service.delete_custom_initializer_async(initializer_name="target")
-
-            mock_registry.delete_custom_initializer_script.assert_called_once_with(name="target")
-
-    async def test_delete_custom_initializer_propagates_key_error(self) -> None:
-        with patch.object(InitializerService, "__init__", lambda self: None):
-            service = InitializerService()
-            mock_registry = MagicMock()
-            mock_registry.delete_custom_initializer_script.side_effect = KeyError("not found")
-            service._registry = mock_registry
-            service._memory = MagicMock()
-
-            with pytest.raises(KeyError):
-                await service.delete_custom_initializer_async(initializer_name="nonexistent")
-
-    async def test_unregister_initializer_rejects_additional_initializer_reference(self) -> None:
-        with patch.object(InitializerService, "__init__", lambda self: None):
-            service = InitializerService()
-            service._registry = MagicMock()
-            service._memory = MagicMock()
-            service._memory.get_additional_initializers.return_value = [
-                AdditionalInitializer(initializer_name="custom", order_index=0)
-            ]
-
-            with pytest.raises(ValueError, match="additional initializer settings reference it"):
-                await service.delete_custom_initializer_async(initializer_name="custom")
-
-            service._registry.delete_custom_initializer_script.assert_not_called()
-
+            assert result.items[0].initializer_name == "my_custom"
+            assert result.items[0].source == "C:/custom/my_custom.py"
 
 # ============================================================================
 # POST / DELETE Route Tests
@@ -1016,33 +878,22 @@ async def test_unregister_initializer_rejects_additional_initializer_reference(s
 
 
 class TestCustomInitializerRoutes:
-    """Tests for stored custom initializer script routes."""
-
-    def test_get_custom_initializers_returns_403_when_disabled(self, client: TestClient) -> None:
-        app.state.allow_custom_initializers = False
-
-        response = client.get("/api/initializers/custom")
+    """Tests for runtime custom initializer routes."""
 
-        assert response.status_code == status.HTTP_403_FORBIDDEN
-
-    def test_get_custom_initializers_returns_storage_source_and_items(
+    def test_list_custom_initializers_uses_read_only_route(
         self, client_with_custom_initializers_enabled: TestClient
     ) -> None:
-        custom = CustomInitializerResponse(
-            initializer_name="my_custom",
-            script_content=_SAMPLE_SCRIPT,
-            source="C:/custom/my_custom.py",
-        )
         with patch("pyrit.backend.routes.initializers.get_initializer_service") as mock_get_service:
             mock_service = MagicMock()
-            response_model = CustomInitializerListResponse(source="C:/custom", items=[custom])
-            mock_service.list_custom_initializers_async = AsyncMock(return_value=response_model)
+            mock_service.list_custom_initializers_async = AsyncMock(
+                return_value={"source": "C:/custom", "items": []}
+            )
             mock_get_service.return_value = mock_service
 
             response = client_with_custom_initializers_enabled.get("/api/initializers/custom")
 
-            assert response.status_code == status.HTTP_200_OK
-            assert response.json() == response_model.model_dump()
+        assert response.status_code == status.HTTP_200_OK
+        mock_service.list_custom_initializers_async.assert_awaited_once_with()
 
     def test_post_root_still_registers_runtime_initializer(
         self, client_with_custom_initializers_enabled: TestClient
@@ -1067,98 +918,3 @@ def test_post_root_still_registers_runtime_initializer(
             name="runtime_custom",
             script_content=_SAMPLE_SCRIPT,
         )
-
-
-class TestDeleteCustomInitializerRoute:
-    """Tests for DELETE /api/initializers/custom/{name} route."""
-
-    def test_delete_returns_403_when_custom_initializers_disabled(self, client: TestClient) -> None:
-        app.state.allow_custom_initializers = False
-        response = client.delete("/api/initializers/custom/target")
-        assert response.status_code == status.HTTP_403_FORBIDDEN
-
-    def test_delete_returns_204_on_success(self, client_with_custom_initializers_enabled: TestClient) -> None:
-        with patch("pyrit.backend.routes.initializers.get_initializer_service") as mock_get_service:
-            mock_service = MagicMock()
-            mock_service.delete_custom_initializer_async = AsyncMock(return_value=None)
-            mock_get_service.return_value = mock_service
-
-            response = client_with_custom_initializers_enabled.delete("/api/initializers/custom/target")
-
-            assert response.status_code == status.HTTP_204_NO_CONTENT
-
-    def test_delete_returns_404_when_not_found(self, client_with_custom_initializers_enabled: TestClient) -> None:
-        with patch("pyrit.backend.routes.initializers.get_initializer_service") as mock_get_service:
-            mock_service = MagicMock()
-            mock_service.delete_custom_initializer_async = AsyncMock(side_effect=KeyError("not found"))
-            mock_get_service.return_value = mock_service
-
-            response = client_with_custom_initializers_enabled.delete("/api/initializers/custom/nonexistent")
-
-            assert response.status_code == status.HTTP_404_NOT_FOUND
-
-    def test_delete_returns_400_when_additional_initializer_references_name(
-        self, client_with_custom_initializers_enabled: TestClient
-    ) -> None:
-        with patch("pyrit.backend.routes.initializers.get_initializer_service") as mock_get_service:
-            mock_service = MagicMock()
-            mock_service.delete_custom_initializer_async = AsyncMock(
-                side_effect=ValueError(
-                    "Cannot remove initializer 'custom' while additional initializer settings reference it."
-                )
-            )
-            mock_get_service.return_value = mock_service
-
-            response = client_with_custom_initializers_enabled.delete("/api/initializers/custom/custom")
-
-            assert response.status_code == status.HTTP_400_BAD_REQUEST
-            assert "additional initializer settings reference it" in response.json()["detail"]
-
-
-class TestUpdateCustomInitializerRoute:
-    """Tests for PUT /api/initializers/custom/{name} route."""
-
-    def test_put_returns_403_when_custom_initializers_disabled(self, client: TestClient) -> None:
-        app.state.allow_custom_initializers = False
-
-        response = client.put("/api/initializers/custom/custom", json={"script_content": _SAMPLE_SCRIPT})
-
-        assert response.status_code == status.HTTP_403_FORBIDDEN
-
-    def test_put_updates_custom_initializer(self, client_with_custom_initializers_enabled: TestClient) -> None:
-        custom = CustomInitializerResponse(
-            initializer_name="custom",
-            script_content=_SAMPLE_SCRIPT,
-            source="C:/custom/custom.py",
-        )
-        with patch("pyrit.backend.routes.initializers.get_initializer_service") as mock_get_service:
-            mock_service = MagicMock()
-            mock_service.save_custom_initializer_async = AsyncMock(return_value=custom)
-            mock_get_service.return_value = mock_service
-
-            response = client_with_custom_initializers_enabled.put(
-                "/api/initializers/custom/custom",
-                json={"script_content": _SAMPLE_SCRIPT},
-            )
-
-        assert response.status_code == status.HTTP_200_OK
-        mock_service.save_custom_initializer_async.assert_awaited_once_with(
-            name="custom",
-            script_content=_SAMPLE_SCRIPT,
-        )
-
-    def test_put_maps_invalid_source_error(
-        self,
-        client_with_custom_initializers_enabled: TestClient,
-    ) -> None:
-        with patch("pyrit.backend.routes.initializers.get_initializer_service") as mock_get_service:
-            mock_service = MagicMock()
-            mock_service.save_custom_initializer_async = AsyncMock(side_effect=ValueError("invalid source"))
-            mock_get_service.return_value = mock_service
-
-            response = client_with_custom_initializers_enabled.put(
-                "/api/initializers/custom/custom",
-                json={"script_content": _SAMPLE_SCRIPT},
-            )
-
-        assert response.status_code == status.HTTP_400_BAD_REQUEST
diff --git a/tests/unit/backend/test_main.py b/tests/unit/backend/test_main.py
index 297c4d02c8..2bf836f55c 100644
--- a/tests/unit/backend/test_main.py
+++ b/tests/unit/backend/test_main.py
@@ -27,10 +27,7 @@ class TestLifespan:
     async def test_lifespan_yields(self) -> None:
         """Test that lifespan delegates to ConfigurationLoader and yields."""
         fake_config = ConfigurationLoader()
-        service = MagicMock(
-            restore_custom_initializers_async=AsyncMock(),
-            run_additional_initializers_async=AsyncMock(),
-        )
+        service = MagicMock(run_additional_initializers_async=AsyncMock())
         with (
             patch.object(ConfigurationLoader, "load_with_overrides", return_value=fake_config),
             patch.object(ConfigurationLoader, "initialize_pyrit_async", new=AsyncMock()) as init_mock,
@@ -44,34 +41,7 @@ async def test_lifespan_yields(self) -> None:
             assert app.state.default_labels == {}
             assert app.state.max_concurrent_scenario_runs == fake_config.max_concurrent_scenario_runs
             assert app.state.allow_custom_initializers is False
-            service.restore_custom_initializers_async.assert_not_awaited()
-            service.run_additional_initializers_async.assert_awaited_once_with(allow_custom_initializers=False)
-
-    async def test_lifespan_registers_custom_initializers_before_running_additional(self) -> None:
-        fake_config = ConfigurationLoader(allow_custom_initializers=True)
-        call_order: list[str] = []
-
-        async def register_custom_async() -> None:
-            call_order.append("custom")
-
-        async def run_additional_async(*, allow_custom_initializers: bool) -> None:
-            assert allow_custom_initializers is True
-            call_order.append("additional")
-
-        service = MagicMock(
-            restore_custom_initializers_async=AsyncMock(side_effect=register_custom_async),
-            run_additional_initializers_async=AsyncMock(side_effect=run_additional_async),
-        )
-        with (
-            patch.object(ConfigurationLoader, "load_with_overrides", return_value=fake_config),
-            patch.object(ConfigurationLoader, "initialize_pyrit_async", new=AsyncMock()),
-            patch("pyrit.backend.main.get_initializer_service", return_value=service),
-            patch("pyrit.backend.main.setup_frontend"),
-        ):
-            async with lifespan(app):
-                pass
-
-        assert call_order == ["custom", "additional"]
+            service.run_additional_initializers_async.assert_awaited_once_with()
 
     async def test_lifespan_warns_when_custom_initializers_allowed(self) -> None:
         """Test that lifespan logs a warning when allow_custom_initializers is enabled."""
@@ -82,7 +52,6 @@ async def test_lifespan_warns_when_custom_initializers_allowed(self) -> None:
             patch(
                 "pyrit.backend.main.get_initializer_service",
                 return_value=MagicMock(
-                    restore_custom_initializers_async=AsyncMock(),
                     run_additional_initializers_async=AsyncMock(),
                 ),
             ),
@@ -103,7 +72,6 @@ async def test_lifespan_populates_default_labels_from_operator_and_operation(sel
             patch(
                 "pyrit.backend.main.get_initializer_service",
                 return_value=MagicMock(
-                    restore_custom_initializers_async=AsyncMock(),
                     run_additional_initializers_async=AsyncMock(),
                 ),
             ),
@@ -125,7 +93,6 @@ async def test_lifespan_reads_explicit_config_without_default_layer(self) -> Non
             patch(
                 "pyrit.backend.main.get_initializer_service",
                 return_value=MagicMock(
-                    restore_custom_initializers_async=AsyncMock(),
                     run_additional_initializers_async=AsyncMock(),
                 ),
             ),
@@ -141,10 +108,7 @@ async def test_lifespan_configures_custom_initializer_source_from_config(self) -
         """Test that YAML config determines the custom script source."""
         fake_config = ConfigurationLoader(custom_initializers_source="C:/yaml/initializers")
         registry = MagicMock()
-        service = MagicMock(
-            restore_custom_initializers_async=AsyncMock(),
-            run_additional_initializers_async=AsyncMock(),
-        )
+        service = MagicMock(run_additional_initializers_async=AsyncMock())
         with (
             patch.object(ConfigurationLoader, "load_with_overrides", return_value=fake_config),
             patch.object(ConfigurationLoader, "initialize_pyrit_async", new=AsyncMock()),
@@ -156,6 +120,31 @@ async def test_lifespan_configures_custom_initializer_source_from_config(self) -
                 pass
 
         registry.configure_custom_scripts_source.assert_called_once_with("C:/yaml/initializers")
+        registry.register_stored_initializers.assert_not_called()
+
+    async def test_lifespan_registers_stored_initializers_when_enabled(self) -> None:
+        """Test that enabled custom initializers are registered before baseline initialization."""
+        fake_config = ConfigurationLoader(allow_custom_initializers=True)
+        call_order: list[str] = []
+        registry = MagicMock()
+        registry.register_stored_initializers.side_effect = lambda: call_order.append("custom")
+        service = MagicMock(run_additional_initializers_async=AsyncMock())
+
+        async def initialize_async() -> None:
+            call_order.append("baseline")
+
+        with (
+            patch.object(ConfigurationLoader, "load_with_overrides", return_value=fake_config),
+            patch.object(ConfigurationLoader, "initialize_pyrit_async", new=AsyncMock(side_effect=initialize_async)),
+            patch("pyrit.backend.main.InitializerRegistry.get_registry_singleton", return_value=registry),
+            patch("pyrit.backend.main.get_initializer_service", return_value=service),
+            patch("pyrit.backend.main.setup_frontend"),
+        ):
+            async with lifespan(app):
+                pass
+
+        registry.register_stored_initializers.assert_called_once_with()
+        assert call_order == ["custom", "baseline"]
 
     async def test_lifespan_downloads_blob_config_to_temporary_file(self) -> None:
         """Test that an Azure Blob config URI is materialized and removed after loading."""
@@ -185,7 +174,6 @@ def load_config(config_file: Path) -> ConfigurationLoader:
             patch(
                 "pyrit.backend.main.get_initializer_service",
                 return_value=MagicMock(
-                    restore_custom_initializers_async=AsyncMock(),
                     run_additional_initializers_async=AsyncMock(),
                 ),
             ),
diff --git a/tests/unit/backend/test_stale_while_revalidate_cache.py b/tests/unit/backend/test_stale_while_revalidate_cache.py
deleted file mode 100644
index a68abd247d..0000000000
--- a/tests/unit/backend/test_stale_while_revalidate_cache.py
+++ /dev/null
@@ -1,54 +0,0 @@
-# Copyright (c) Microsoft Corporation.
-# Licensed under the MIT license.
-
-"""Tests for the asynchronous stale-while-revalidate cache."""
-
-import asyncio
-from unittest.mock import patch
-
-from pyrit.backend.services.stale_while_revalidate_cache import StaleWhileRevalidateCache
-
-
-async def test_invalidation_during_refresh_prevents_stale_repopulation() -> None:
-    """Test that an in-flight refresh cannot restore an invalidated value."""
-    refresh_started = asyncio.Event()
-    allow_refresh = asyncio.Event()
-    load_count = 0
-
-    async def load_async(_: str) -> str:
-        nonlocal load_count
-        load_count += 1
-        if load_count == 2:
-            refresh_started.set()
-            await allow_refresh.wait()
-        return f"value-{load_count}"
-
-    cache = StaleWhileRevalidateCache[str](ttl_seconds=10.0, load_async=load_async)
-    with patch("pyrit.backend.services.stale_while_revalidate_cache.time.monotonic", return_value=100.0) as clock:
-        assert await cache.get_async(key="key") == "value-1"
-
-        clock.return_value = 111.0
-        assert await cache.get_async(key="key") == "value-1"
-        refresh_task = cache.get_refresh_task("key")
-        assert refresh_task is not None
-        await refresh_started.wait()
-
-        cache.invalidate("key")
-        allow_refresh.set()
-        await refresh_task
-
-        assert await cache.get_async(key="key") == "value-3"
-
-
-async def test_cached_mutable_values_are_copied() -> None:
-    """Test that callers cannot mutate the value retained by the cache."""
-
-    async def load_async(_: str) -> list[str]:
-        return ["original"]
-
-    cache = StaleWhileRevalidateCache[list[str]](ttl_seconds=10.0, load_async=load_async)
-
-    first = await cache.get_async(key="key")
-    first.append("changed")
-
-    assert await cache.get_async(key="key") == ["original"]
diff --git a/tests/unit/registry/test_custom_initializer_storage.py b/tests/unit/registry/test_custom_initializer_storage.py
index bcd3b7aa72..3997317f06 100644
--- a/tests/unit/registry/test_custom_initializer_storage.py
+++ b/tests/unit/registry/test_custom_initializer_storage.py
@@ -123,28 +123,12 @@ def test_local_storage_returns_script_path(tmp_path: Path) -> None:
     assert storage.get_script_source("example") == str(tmp_path / "example.py")
 
 
-def test_local_storage_caches_scripts_until_expiry(tmp_path: Path) -> None:
-    """Test that external script changes become visible after the cache expires."""
+def test_local_storage_reads_latest_script_content(tmp_path: Path) -> None:
+    """Test that every listing observes current script content."""
     script_path = tmp_path / "example.py"
     script_path.write_text("VALUE = 1\n", encoding="utf-8")
     storage = CustomInitializerStorage(source=str(tmp_path))
 
-    with patch("pyrit.registry.custom_initializer_storage.time.monotonic", return_value=100.0) as monotonic_mock:
-        assert storage.list_scripts() == {"example": "VALUE = 1\n"}
-        script_path.write_text("VALUE = 2\n", encoding="utf-8")
-        assert storage.list_scripts() == {"example": "VALUE = 1\n"}
-
-        monotonic_mock.return_value = 111.0
-        assert storage.list_scripts() == {"example": "VALUE = 2\n"}
-
-
-def test_local_storage_updates_warm_cache_after_writes(tmp_path: Path) -> None:
-    """Test that saves and deletes update an existing cache immediately."""
-    storage = CustomInitializerStorage(source=str(tmp_path))
-    assert storage.list_scripts() == {}
-
-    storage.save_script(name="example", content="VALUE = 1\n")
     assert storage.list_scripts() == {"example": "VALUE = 1\n"}
-
-    storage.delete_script("example")
-    assert storage.list_scripts() == {}
+    script_path.write_text("VALUE = 2\n", encoding="utf-8")
+    assert storage.list_scripts() == {"example": "VALUE = 2\n"}
diff --git a/tests/unit/registry/test_initializer_registry.py b/tests/unit/registry/test_initializer_registry.py
index 9e27881a69..caed430ecb 100644
--- a/tests/unit/registry/test_initializer_registry.py
+++ b/tests/unit/registry/test_initializer_registry.py
@@ -2,10 +2,7 @@
 # Licensed under the MIT license.
 
 import tempfile
-import time
-from concurrent.futures import ThreadPoolExecutor
 from pathlib import Path
-from threading import Lock
 from unittest.mock import patch
 
 import pytest
@@ -139,46 +136,6 @@ def test_register_from_content_rejects_duplicate_name(lazy_registry):
             lazy_registry.register_from_content(name="dup", script_content=_VALID_SCRIPT)
 
 
-def test_register_from_content_serializes_concurrent_writes(tmp_path: Path) -> None:
-    """Test concurrent registration keeps storage and the runtime catalog consistent."""
-    registry = InitializerRegistry(lazy_discovery=True, custom_scripts_source=str(tmp_path))
-    registry._discovered = True
-    original_load = registry._load_custom_initializer_class
-    state_lock = Lock()
-    active_loads = 0
-    maximum_active_loads = 0
-
-    def delayed_load(*, name: str, script_content: str) -> type[PyRITInitializer]:
-        nonlocal active_loads, maximum_active_loads
-        with state_lock:
-            active_loads += 1
-            maximum_active_loads = max(maximum_active_loads, active_loads)
-        time.sleep(0.05)
-        try:
-            return original_load(name=name, script_content=script_content)
-        finally:
-            with state_lock:
-                active_loads -= 1
-
-    def register() -> str:
-        try:
-            registry.register_from_content(name="race", script_content=_VALID_SCRIPT)
-            return "registered"
-        except ValueError:
-            return "duplicate"
-
-    with (
-        patch.object(registry, "_load_custom_initializer_class", side_effect=delayed_load),
-        ThreadPoolExecutor(max_workers=2) as executor,
-    ):
-        results = list(executor.map(lambda _: register(), range(2)))
-
-    assert sorted(results) == ["duplicate", "registered"]
-    assert maximum_active_loads == 1
-    assert registry.list_custom_initializer_sources() == {"race": _VALID_SCRIPT}
-    assert registry.get_class("race").__name__ == "ScriptTestInitializer"
-
-
 def test_register_from_content_ignores_imported_classes(lazy_registry):
     """Test that imported base classes are not registered."""
     script = """
@@ -214,87 +171,30 @@ def test_unregister_and_cleanup_removes_entry_and_file(lazy_registry):
         assert not (tmp_dir / "cleanup_test.py").exists()
 
 
-def test_update_from_content_replaces_class_and_persisted_source(tmp_path: Path) -> None:
-    """Test replacing a custom initializer without changing its registry name."""
-    updated_script = _VALID_SCRIPT.replace("ScriptTestInitializer", "UpdatedInitializer")
-    registry = InitializerRegistry(lazy_discovery=True, custom_scripts_source=str(tmp_path))
-    registry._discovered = True
-    registry.register_from_content(name="custom", script_content=_VALID_SCRIPT)
-
-    registry.update_from_content(name="custom", script_content=updated_script)
+def test_register_from_content_uses_configured_storage(lazy_registry: InitializerRegistry, tmp_path: Path) -> None:
+    """Test runtime registration persists source in the configured directory."""
+    lazy_registry.configure_custom_scripts_source(str(tmp_path))
 
-    assert registry.get_class("custom").__name__ == "UpdatedInitializer"
-    assert registry.list_custom_initializer_sources() == {"custom": updated_script}
+    lazy_registry.register_from_content(name="custom", script_content=_VALID_SCRIPT)
 
+    assert (tmp_path / "custom.py").read_text(encoding="utf-8") == _VALID_SCRIPT
+    assert lazy_registry.get_class("custom").__name__ == "ScriptTestInitializer"
 
-def test_restore_custom_initializers_loads_persisted_scripts(tmp_path: Path) -> None:
-    """Test loading custom initializers from the configured source at startup."""
-    (tmp_path / "restored.py").write_text(_VALID_SCRIPT, encoding="utf-8")
-    registry = InitializerRegistry(lazy_discovery=True, custom_scripts_source=str(tmp_path))
-    registry._discovered = True
+    lazy_registry.unregister_and_cleanup("custom")
 
-    registry.restore_custom_initializers()
+    assert not (tmp_path / "custom.py").exists()
 
-    assert registry.get_class("restored").__name__ == "ScriptTestInitializer"
 
+def test_register_stored_initializers_loads_configured_source(
+    lazy_registry: InitializerRegistry, tmp_path: Path
+) -> None:
+    """Test startup registration loads scripts from the configured directory."""
+    (tmp_path / "restored.py").write_text(_VALID_SCRIPT, encoding="utf-8")
+    lazy_registry.configure_custom_scripts_source(str(tmp_path))
 
-def test_save_custom_initializer_script_upserts_without_registering(tmp_path: Path) -> None:
-    """Test adding and updating custom source does not change the runtime registry."""
-    registry = InitializerRegistry(lazy_discovery=True, custom_scripts_source=str(tmp_path))
-    registry._discovered = True
-    updated_script = _VALID_SCRIPT.replace("ScriptTestInitializer", "UpdatedInitializer")
-
-    registry.save_custom_initializer_script(name="custom", script_content=_VALID_SCRIPT)
-    registry.save_custom_initializer_script(name="custom", script_content=updated_script)
-
-    assert registry.list_custom_initializer_sources() == {"custom": updated_script}
-    with pytest.raises(KeyError):
-        registry.get_class("custom")
-
-
-def test_delete_custom_initializer_script_removes_source_without_registry_changes(tmp_path: Path) -> None:
-    """Test deleting custom source leaves the runtime registry unchanged."""
-    registry = InitializerRegistry(lazy_discovery=True, custom_scripts_source=str(tmp_path))
-    registry._discovered = True
-    registry.save_custom_initializer_script(name="custom", script_content=_VALID_SCRIPT)
-
-    registry.delete_custom_initializer_script(name="custom")
-
-    assert registry.list_custom_initializer_sources() == {}
-    with pytest.raises(KeyError):
-        registry.get_class("custom")
-
-
-def test_custom_initializer_storage_is_reused_until_source_changes(tmp_path: Path) -> None:
-    """Test that startup and GUI reads share one cache-bearing storage instance."""
-    registry = InitializerRegistry(lazy_discovery=True, custom_scripts_source=str(tmp_path))
-
-    first_storage = registry._get_custom_storage()
-    assert registry._get_custom_storage() is first_storage
-
-    registry.configure_custom_scripts_source(str(tmp_path / "other"))
-    assert registry._get_custom_storage() is not first_storage
-
-
-def test_restore_custom_initializers_does_not_replace_lazy_builtin(tmp_path: Path) -> None:
-    """Test built-ins are discovered before stored scripts are restored."""
-
-    class BuiltinInit(PyRITInitializer):
-        async def initialize_async(self) -> None:
-            pass
-
-    (tmp_path / "builtin.py").write_text(_VALID_SCRIPT, encoding="utf-8")
-    registry = InitializerRegistry(lazy_discovery=True, custom_scripts_source=str(tmp_path))
-
-    def discover_builtin() -> None:
-        registry._classes["builtin"] = BuiltinInit
-        registry._builtin_names.add("builtin")
-
-    with patch.object(registry, "_discover", side_effect=discover_builtin) as discover:
-        registry.restore_custom_initializers()
+    lazy_registry.register_stored_initializers()
 
-    discover.assert_called_once_with()
-    assert registry.get_class("builtin") is BuiltinInit
+    assert lazy_registry.get_class("restored").__name__ == "ScriptTestInitializer"
 
 
 def test_unregister_and_cleanup_rejects_builtin(lazy_registry):

From ae2e585598827f6d0f7ca4aa0c77378ef909d60f Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Thu, 27 Aug 2026 09:56:02 -0700
Subject: [PATCH 12/24] simplify backend configuration lifecycle

---
 doc/getting_started/pyrit_conf.md             |  3 +-
 .../BackendConfiguration.test.tsx             | 21 ++---
 .../BackendConfiguration.tsx                  | 28 +-----
 .../BackendConfiguration/EnvironmentFiles.tsx |  2 +-
 .../Initializers/CustomInitializers.test.tsx  |  3 +-
 .../Initializers/CustomInitializers.tsx       |  2 +-
 frontend/src/services/api.test.ts             |  7 --
 frontend/src/services/api.ts                  |  4 -
 pyrit/backend/pyrit_backend.py                | 47 ++--------
 pyrit/backend/routes/configuration.py         | 29 +------
 pyrit/setup/configuration_loader.py           | 20 ++---
 pyrit/setup/initialization.py                 | 85 +------------------
 .../unit/backend/test_configuration_routes.py | 21 -----
 tests/unit/backend/test_pyrit_backend.py      | 26 +++---
 tests/unit/setup/test_configuration_loader.py | 30 +++++--
 tests/unit/setup/test_initialization.py       | 78 -----------------
 16 files changed, 65 insertions(+), 341 deletions(-)

diff --git a/doc/getting_started/pyrit_conf.md b/doc/getting_started/pyrit_conf.md
index 4f63abbf62..ec0982ddcf 100644
--- a/doc/getting_started/pyrit_conf.md
+++ b/doc/getting_started/pyrit_conf.md
@@ -155,7 +155,7 @@ With this configuration, PyRIT reads and writes scripts directly under the `cust
 
 ### `initialization_scripts`
 
-Local paths or Azure Blob URIs to custom Python scripts containing `PyRITInitializer` subclasses. Local paths can be absolute or relative to the current working directory. Blob URIs may include a SAS token; URIs without one authenticate with `DefaultAzureCredential`.
+Local paths to custom Python scripts containing `PyRITInitializer` subclasses. Paths can be absolute or relative to the current working directory.
 
 | Value             | Behavior                           |
 | ----------------- | ---------------------------------- |
@@ -167,7 +167,6 @@ Local paths or Azure Blob URIs to custom Python scripts containing `PyRITInitial
 initialization_scripts:
   - /path/to/my_custom_initializer.py
   - ./local_initializer.py
-  - https://account.blob.core.windows.net/scripts/cloud_initializer.py
 ```
 
 ### `env_files`
diff --git a/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx b/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx
index 61d83898b5..1a63943df5 100644
--- a/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx
+++ b/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx
@@ -9,7 +9,6 @@ import BackendConfiguration from './BackendConfiguration'
 jest.mock('@/services/api', () => ({
   configurationApi: {
     getContent: jest.fn(),
-    restart: jest.fn(),
     updateContent: jest.fn(),
     listEnvironmentFiles: jest.fn(),
     getEnvironmentFile: jest.fn(),
@@ -40,7 +39,6 @@ describe('BackendConfiguration', () => {
       content: 'operator: alice\n',
       source: 'C:/Users/test/.pyrit/config.yaml',
     })
-    mockedConfigurationApi.restart.mockResolvedValue()
     mockedConfigurationApi.listEnvironmentFiles.mockResolvedValue({
       items: [
         { id: '0', name: '.env', path: 'C:/Users/test/.pyrit/.env', content: '', exists: true },
@@ -72,7 +70,7 @@ describe('BackendConfiguration', () => {
     expect(await screen.findByLabelText('Configuration YAML')).toHaveValue('operator: alice\n')
     expect(screen.getByRole('navigation', { name: 'Configuration files' })).toBeInTheDocument()
     expect(screen.getByRole('button', { name: /\.pyrit_conf/i })).toHaveAttribute('aria-current', 'page')
-    expect(screen.getByText('C:/Users/test/.pyrit/config.yaml')).toBeInTheDocument()
+    expect(screen.getByText('C:/Users/test/.pyrit/config.yaml', { selector: 'label' })).toBeInTheDocument()
     expect(screen.getByRole('button', { name: 'Copy YAML source' })).toBeInTheDocument()
     expect(screen.getByTestId('yaml-highlight').innerHTML).toContain('token key atrule')
     expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
@@ -95,16 +93,6 @@ describe('BackendConfiguration', () => {
     expect(await screen.findByText(/restart the backend/i)).toBeInTheDocument()
   })
 
-  it('should request a backend restart from the header', async () => {
-    const user = userEvent.setup()
-    renderPage()
-
-    await user.click(screen.getByRole('button', { name: 'Restart backend' }))
-
-    expect(mockedConfigurationApi.restart).toHaveBeenCalledTimes(1)
-    expect(await screen.findByText('Backend restart requested.')).toBeInTheDocument()
-  })
-
   it('should show a load error', async () => {
     mockedConfigurationApi.getContent.mockRejectedValue(new Error('Configuration unavailable'))
     renderPage()
@@ -125,6 +113,7 @@ describe('BackendConfiguration', () => {
 
     await user.click(screen.getByRole('tab', { name: 'Environment Files' }))
     const editor = await screen.findByLabelText('Environment file contents')
+    expect(screen.getByText('C:/Users/test/.pyrit/.env', { selector: 'label' })).toBeInTheDocument()
     expect(screen.getByTitle('C:/Users/test/.pyrit/.env')).toBeInTheDocument()
     expect(editor).toHaveValue('API_KEY=value\n')
     expect(screen.getByTestId('dotenv-highlight').innerHTML).toContain('token key atrule')
@@ -168,6 +157,7 @@ describe('BackendConfiguration', () => {
     expect(await screen.findByRole('button', { name: /AKV: bootstrap/i })).toBeInTheDocument()
     expect(screen.getByTitle(secretUrl)).toBeInTheDocument()
     const editor = await screen.findByLabelText('Environment file contents')
+    expect(screen.getByText(secretUrl, { selector: 'label' })).toBeInTheDocument()
     await user.clear(editor)
     await user.type(editor, 'API_KEY=after\n')
     await user.click(screen.getByRole('button', { name: 'Save' }))
@@ -182,7 +172,10 @@ describe('BackendConfiguration', () => {
     renderPage()
 
     await user.click(screen.getByRole('tab', { name: 'Custom Initializers' }))
-    expect(await screen.findByText('C:/Users/test/.pyrit/custom_initializers/custom_target.py')).toBeInTheDocument()
+    expect(await screen.findByText(
+      'C:/Users/test/.pyrit/custom_initializers/custom_target.py',
+      { selector: 'label' },
+    )).toBeInTheDocument()
     await user.click(screen.getByRole('button', { name: 'Add initializer' }))
     const dialog = screen.getByRole('dialog', { name: 'Add custom initializer' })
     await user.type(within(dialog).getByRole('textbox', { name: /Initializer name/ }), 'new_custom')
diff --git a/frontend/src/components/BackendConfiguration/BackendConfiguration.tsx b/frontend/src/components/BackendConfiguration/BackendConfiguration.tsx
index ff7ca7d9d2..e2cb5f93e6 100644
--- a/frontend/src/components/BackendConfiguration/BackendConfiguration.tsx
+++ b/frontend/src/components/BackendConfiguration/BackendConfiguration.tsx
@@ -36,7 +36,6 @@ export default function BackendConfiguration() {
   const [source, setSource] = useState('')
   const [loading, setLoading] = useState(true)
   const [saving, setSaving] = useState(false)
-  const [restarting, setRestarting] = useState(false)
   const [reloadCount, setReloadCount] = useState(0)
   const [statusMessage, setStatusMessage] = useState<StatusMessage | null>(null)
   const [selectedTab, setSelectedTab] = useState<ConfigurationTab>('configuration')
@@ -85,7 +84,7 @@ export default function BackendConfiguration() {
       setSource(response.source)
       setStatusMessage({
         intent: 'success',
-        text: 'Configuration saved. Restart the backend to apply these changes.',
+        text: 'Configuration saved. Restart the backend process to apply these changes.',
       })
     } catch (error) {
       setStatusMessage({ intent: 'error', text: toApiError(error).detail })
@@ -94,19 +93,6 @@ export default function BackendConfiguration() {
     }
   }
 
-  const handleRestart = async (): Promise<void> => {
-    setRestarting(true)
-    setStatusMessage(null)
-    try {
-      await configurationApi.restart()
-      setStatusMessage({ intent: 'success', text: 'Backend restart requested.' })
-    } catch (error) {
-      setStatusMessage({ intent: 'error', text: toApiError(error).detail })
-    } finally {
-      setRestarting(false)
-    }
-  }
-
   const hasUnsavedChanges = content !== savedContent
 
   const handleTabSelect = (_: SelectTabEvent, data: SelectTabData): void => {
@@ -123,14 +109,6 @@ export default function BackendConfiguration() {
     <main className={styles.root}>
       <div className={styles.header}>
         <Text as="h1" size={600} weight="semibold">Backend Configuration</Text>
-        <Button
-          appearance="secondary"
-          icon={<ArrowSyncRegular />}
-          disabled={restarting || saving}
-          onClick={() => void handleRestart()}
-        >
-          {restarting ? 'Restarting...' : 'Restart backend'}
-        </Button>
       </div>
 
       <TabList selectedValue={selectedTab} onTabSelect={handleTabSelect}>
@@ -185,8 +163,8 @@ export default function BackendConfiguration() {
         >
           <Field
             className={styles.editorField}
-            label=".pyrit_conf"
-            hint={hasUnsavedChanges ? 'Unsaved changes' : 'Changes take effect after the backend restarts.'}
+            label={source}
+            hint={hasUnsavedChanges ? 'Unsaved changes' : 'Changes take effect after the backend process restarts.'}
           >
             <YamlEditor
               value={content}
diff --git a/frontend/src/components/BackendConfiguration/EnvironmentFiles.tsx b/frontend/src/components/BackendConfiguration/EnvironmentFiles.tsx
index 6be2b286c2..f7ce45023f 100644
--- a/frontend/src/components/BackendConfiguration/EnvironmentFiles.tsx
+++ b/frontend/src/components/BackendConfiguration/EnvironmentFiles.tsx
@@ -188,7 +188,7 @@ export default function EnvironmentFiles() {
           {selectedFile && selectedFileIsLoaded && (
             <Field
               className={styles.editorField}
-              label={selectedFile.name}
+              label={selectedFile.path}
               hint={hasUnsavedChanges ? 'Unsaved changes' : 'No unsaved changes'}
             >
               <DotenvEditor
diff --git a/frontend/src/components/Initializers/CustomInitializers.test.tsx b/frontend/src/components/Initializers/CustomInitializers.test.tsx
index 42badbe474..48151b8ee4 100644
--- a/frontend/src/components/Initializers/CustomInitializers.test.tsx
+++ b/frontend/src/components/Initializers/CustomInitializers.test.tsx
@@ -66,6 +66,7 @@ describe('CustomInitializers', () => {
     const editor = screen.getByLabelText('Python source')
     expect(editor).toBeDisabled()
     expect(editor).toHaveValue('def initialize():\n    pass')
+    expect(screen.getByText(ITEMS[0].source, { selector: 'label' })).toBeInTheDocument()
   })
 
   it('should select a custom initializer from the file navigation', async () => {
@@ -79,7 +80,7 @@ describe('CustomInitializers', () => {
     await user.click(screen.getByRole('button', { name: 'second_target' }))
 
     expect(screen.getByLabelText('Python source')).toHaveValue('def initialize_second():\n    pass')
-    expect(screen.getByText(ITEMS[1].source)).toBeInTheDocument()
+  expect(screen.getByText(ITEMS[1].source, { selector: 'label' })).toBeInTheDocument()
     expect(screen.getByRole('button', { name: 'second_target' })).toHaveAttribute('aria-current', 'page')
   })
 
diff --git a/frontend/src/components/Initializers/CustomInitializers.tsx b/frontend/src/components/Initializers/CustomInitializers.tsx
index a4553226c9..ed552cdd89 100644
--- a/frontend/src/components/Initializers/CustomInitializers.tsx
+++ b/frontend/src/components/Initializers/CustomInitializers.tsx
@@ -100,7 +100,7 @@ export default function CustomInitializers({
           <>
             <Field
               className={styles.editorField}
-              label={selectedInitializer.initializer_name}
+              label={selectedInitializer.source}
             >
               <PythonCodeEditor
                 source={selectedInitializer.script_content}
diff --git a/frontend/src/services/api.test.ts b/frontend/src/services/api.test.ts
index 1138decf26..c4f7355c44 100644
--- a/frontend/src/services/api.test.ts
+++ b/frontend/src/services/api.test.ts
@@ -172,13 +172,6 @@ describe("api service", () => {
   });
 
   describe("configurationApi", () => {
-    it("should request a backend restart", async () => {
-      (apiClient.post as jest.Mock).mockResolvedValueOnce({ status: 202 });
-
-      await expect(configurationApi.restart()).resolves.toBeUndefined();
-      expect(apiClient.post).toHaveBeenCalledWith("/config/restart");
-    });
-
     it("should read configuration content", async () => {
       const response = {
         data: { content: "operator: alice\n", source: "C:/Users/test/.pyrit/config.yaml" },
diff --git a/frontend/src/services/api.ts b/frontend/src/services/api.ts
index 99c2e15679..0c4c94698f 100644
--- a/frontend/src/services/api.ts
+++ b/frontend/src/services/api.ts
@@ -160,10 +160,6 @@ export const configurationApi = {
     return response.data
   },
 
-  restart: async (): Promise<void> => {
-    await apiClient.post('/config/restart')
-  },
-
   updateContent: async (request: UpdateConfigurationFileRequest): Promise<ConfigurationFileContent> => {
     const response = await apiClient.put('/config', request)
     return response.data
diff --git a/pyrit/backend/pyrit_backend.py b/pyrit/backend/pyrit_backend.py
index 96a9dc9b14..fc77c44679 100644
--- a/pyrit/backend/pyrit_backend.py
+++ b/pyrit/backend/pyrit_backend.py
@@ -12,12 +12,10 @@
 environment variable.
 """
 
-import asyncio
 import logging
 import os
 import sys
 from argparse import ArgumentParser, Namespace, RawDescriptionHelpFormatter
-from collections.abc import Callable
 
 from pyrit.common.cli_helpers import CONFIG_FILE_HELP, validate_log_level_argparse
 
@@ -97,45 +95,16 @@ def parse_args(*, args: list[str] | None = None) -> Namespace:
 
 
 def _run_server(*, host: str, port: int, log_level: str, reload: bool) -> None:
-    """Run uvicorn, restarting when requested by the backend API."""
+    """Run the backend with uvicorn."""
     import uvicorn
 
-    if reload:
-        uvicorn.run(
-            "pyrit.backend.main:app",
-            host=host,
-            port=port,
-            log_level=log_level,
-            reload=True,
-        )
-        return
-
-    from pyrit.backend.main import app
-
-    config = uvicorn.Config(app, host=host, port=port, log_level=log_level)
-    restart_requested = True
-
-    async def serve_with_restarts_async() -> None:
-        nonlocal restart_requested
-
-        def create_restart_callback(server: uvicorn.Server) -> Callable[[], None]:
-            def request_restart() -> None:
-                nonlocal restart_requested
-                restart_requested = True
-                server.should_exit = True
-
-            return request_restart
-
-        while restart_requested:
-            restart_requested = False
-            server = uvicorn.Server(config)
-            app.state.restart_backend = create_restart_callback(server)
-            await server.serve()
-
-    try:
-        asyncio.run(serve_with_restarts_async())
-    finally:
-        del app.state.restart_backend
+    uvicorn.run(
+        "pyrit.backend.main:app",
+        host=host,
+        port=port,
+        log_level=log_level,
+        reload=reload,
+    )
 
 
 def main(*, args: list[str] | None = None) -> int:
diff --git a/pyrit/backend/routes/configuration.py b/pyrit/backend/routes/configuration.py
index 42f2910d51..3606870c53 100644
--- a/pyrit/backend/routes/configuration.py
+++ b/pyrit/backend/routes/configuration.py
@@ -4,11 +4,9 @@
 """Backend configuration file API routes."""
 
 import os
-from collections.abc import Callable
-from typing import cast
 
 from azure.core.exceptions import ResourceNotFoundError
-from fastapi import APIRouter, BackgroundTasks, HTTPException, Request, status
+from fastapi import APIRouter, HTTPException, Request, status
 
 from pyrit.backend.models.common import ProblemDetail
 from pyrit.backend.models.configuration import (
@@ -56,22 +54,6 @@ def _get_environment_file_service(request: Request) -> EnvironmentFileService:
     return service
 
 
-def _get_restart_callback(request: Request) -> Callable[[], None]:
-    """
-    Get the restart callback installed by the managed backend server.
-
-    Returns:
-        Callable[[], None]: The managed server restart callback.
-    """
-    callback = getattr(request.app.state, "restart_backend", None)
-    if not callable(callback):
-        raise HTTPException(
-            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
-            detail="Backend restart is unavailable for this server process",
-        )
-    return cast("Callable[[], None]", callback)
-
-
 @router.get(
     "",
     response_model=ConfigurationFileContent,
@@ -120,15 +102,6 @@ async def update_configuration_file(  # pyrit-async-suffix-exempt
     return ConfigurationFileContent(content=body.content, source=service.source)
 
 
-@router.post("/restart", status_code=status.HTTP_202_ACCEPTED)
-async def restart_backend(  # pyrit-async-suffix-exempt
-    request: Request,
-    background_tasks: BackgroundTasks,
-) -> None:
-    """Schedule a backend restart after the response is sent."""
-    background_tasks.add_task(_get_restart_callback(request))
-
-
 @router.get("/env-files", response_model=EnvironmentFileListResponse)
 async def list_environment_files(  # pyrit-async-suffix-exempt
     request: Request,
diff --git a/pyrit/setup/configuration_loader.py b/pyrit/setup/configuration_loader.py
index 8052782993..b2801c711d 100644
--- a/pyrit/setup/configuration_loader.py
+++ b/pyrit/setup/configuration_loader.py
@@ -22,13 +22,7 @@
 from pyrit.common.yaml_loadable import YamlLoadable
 from pyrit.models import class_name_to_snake_case
 from pyrit.setup.environment_loading import validate_env_akv_strict
-from pyrit.setup.initialization import (
-    AZURE_SQL,
-    IN_MEMORY,
-    SQLITE,
-    initialize_pyrit_async,
-    is_azure_blob_script_uri,
-)
+from pyrit.setup.initialization import AZURE_SQL, IN_MEMORY, SQLITE, initialize_pyrit_async
 
 if TYPE_CHECKING:
     from pyrit.setup.pyrit_initializer import PyRITInitializer
@@ -563,7 +557,7 @@ def resolve_initializers(self) -> Sequence["PyRITInitializer"]:
         if not configs:
             return resolved
 
-        registry = InitializerRegistry()
+        registry = InitializerRegistry.get_registry_singleton()
 
         logging.getLogger(__name__).info("Running %d initializer(s)...", len(configs))
 
@@ -580,13 +574,13 @@ def resolve_initializers(self) -> Sequence["PyRITInitializer"]:
 
         return resolved
 
-    def resolve_initialization_scripts(self) -> Sequence[str | pathlib.Path] | None:
+    def resolve_initialization_scripts(self) -> Sequence[pathlib.Path] | None:
         """
         Resolve initialization script paths.
 
         Returns:
             None if field is None (use defaults), empty list if field is [],
-            or a sequence of resolved Path objects and preserved Azure Blob URIs.
+            or a sequence of resolved Path objects.
         """
         # None means "use defaults" - return None to signal this
         if self.initialization_scripts is None:
@@ -596,12 +590,8 @@ def resolve_initialization_scripts(self) -> Sequence[str | pathlib.Path] | None:
         if len(self.initialization_scripts) == 0:
             return list[pathlib.Path]()
 
-        resolved: list[str | pathlib.Path] = []
+        resolved: list[pathlib.Path] = []
         for script_str in self.initialization_scripts:
-            if is_azure_blob_script_uri(script_str):
-                resolved.append(script_str)
-                continue
-
             script_path = pathlib.Path(script_str)
             if not script_path.is_absolute():
                 script_path = pathlib.Path.cwd() / script_path
diff --git a/pyrit/setup/initialization.py b/pyrit/setup/initialization.py
index 202eb16916..41de17704c 100644
--- a/pyrit/setup/initialization.py
+++ b/pyrit/setup/initialization.py
@@ -1,12 +1,9 @@
 # Copyright (c) Microsoft Corporation.
 # Licensed under the MIT license.
-import asyncio
 import logging
 import pathlib
-import tempfile
 from collections.abc import Sequence
 from typing import TYPE_CHECKING, Any, Literal, get_args
-from urllib.parse import parse_qs, urlparse
 
 from pyrit.common.apply_defaults import reset_default_values
 from pyrit.common.random_context import configure_random_seed
@@ -27,78 +24,9 @@
 AZURE_SQL = "AzureSQL"
 MemoryDatabaseType = Literal["InMemory", "SQLite", "AzureSQL"]
 
-_AZURE_BLOB_HOST_SUFFIXES = (
-    ".blob.core.windows.net",
-    ".blob.core.chinacloudapi.cn",
-    ".blob.core.usgovcloudapi.net",
-    ".blob.core.cloudapi.de",
-)
-
 _load_environment_files = load_environment_files
 
 
-def is_azure_blob_script_uri(value: str) -> bool:
-    """Return whether a value identifies an Azure Blob Storage object."""
-    parsed_uri = urlparse(value)
-    hostname = parsed_uri.hostname or ""
-    return (
-        parsed_uri.scheme == "https"
-        and any(hostname.endswith(suffix) and hostname != suffix[1:] for suffix in _AZURE_BLOB_HOST_SUFFIXES)
-        and parsed_uri.username is None
-        and parsed_uri.password is None
-        and parsed_uri.port is None
-        and len(parsed_uri.path.strip("/").split("/")) >= 2
-    )
-
-
-def _download_initialization_script(*, source: str, destination: pathlib.Path) -> None:
-    """
-    Download an Azure Blob initialization script to a temporary path.
-
-    Raises:
-        ValueError: If the Blob URI does not identify a Python file.
-    """
-    from azure.identity import DefaultAzureCredential
-    from azure.storage.blob import BlobClient
-
-    parsed_uri = urlparse(source)
-    if pathlib.PurePosixPath(parsed_uri.path).suffix != ".py":
-        raise ValueError(f"Initialization script must be a Python file (.py): {parsed_uri.path}")
-
-    if "sig" in parse_qs(parsed_uri.query):
-        with BlobClient.from_blob_url(blob_url=source) as client:
-            destination.write_bytes(client.download_blob().readall())
-        return
-
-    with DefaultAzureCredential() as credential:
-        with BlobClient.from_blob_url(blob_url=source, credential=credential) as client:
-            destination.write_bytes(client.download_blob().readall())
-
-
-async def _materialize_initialization_scripts_async(
-    *, script_sources: Sequence[str | pathlib.Path], destination: pathlib.Path
-) -> list[pathlib.Path]:
-    """
-    Resolve local paths and download Azure Blob scripts into a temporary directory.
-
-    Returns:
-        list[pathlib.Path]: Local paths suitable for registry loading.
-    """
-    resolved: list[pathlib.Path] = []
-    for index, source in enumerate(script_sources):
-        source_str = str(source)
-        if not is_azure_blob_script_uri(source_str):
-            resolved.append(pathlib.Path(source))
-            continue
-
-        blob_name = pathlib.PurePosixPath(urlparse(source_str).path).name
-        temporary_path = destination / f"{index}_{blob_name}"
-        await asyncio.to_thread(_download_initialization_script, source=source_str, destination=temporary_path)
-        resolved.append(temporary_path)
-
-    return resolved
-
-
 async def _execute_initializers_async(*, initializers: Sequence["PyRITInitializer"]) -> None:
     """
     Execute PyRITInitializer instances in the order provided.
@@ -160,9 +88,8 @@ async def initialize_pyrit_async(
         memory_db_type (MemoryDatabaseType): The MemoryDatabaseType string literal which indicates the memory
             instance to use for central memory. Options include "InMemory", "SQLite", and "AzureSQL".
         initialization_scripts (Sequence[str | pathlib.Path] | None): Optional sequence of local Python script paths
-            or Azure Blob URIs that define PyRITInitializer subclasses. Every initializer subclass defined in each
-            file is loaded and executed. Loading is handled by the InitializerRegistry. Blob URIs may include a SAS;
-            otherwise, authentication uses DefaultAzureCredential.
+            that define PyRITInitializer subclasses. Every initializer subclass defined in each file is loaded and
+            executed. Loading is handled by the InitializerRegistry.
         initializers (Sequence[PyRITInitializer] | None): Optional sequence of PyRITInitializer instances
             to execute directly. These provide type-safe, validated configuration with clear documentation.
         load_defaults (bool): If True (default) AND the caller supplies neither ``initializers`` nor
@@ -236,12 +163,8 @@ async def initialize_pyrit_async(
         from pyrit.registry import InitializerRegistry
 
         registry = InitializerRegistry.get_registry_singleton()
-        with tempfile.TemporaryDirectory(prefix="pyrit-initializers-") as temporary_directory:
-            script_paths = await _materialize_initialization_scripts_async(
-                script_sources=initialization_scripts,
-                destination=pathlib.Path(temporary_directory),
-            )
-            script_initializers = registry.create_from_script_paths(script_paths=script_paths)
+        script_paths = [pathlib.Path(script_path) for script_path in initialization_scripts]
+        script_initializers = registry.create_from_script_paths(script_paths=script_paths)
         all_initializers.extend(script_initializers)
 
     # When the caller supplies nothing, fall back to the default initializer set so a
diff --git a/tests/unit/backend/test_configuration_routes.py b/tests/unit/backend/test_configuration_routes.py
index d17e1eb5ea..a158948f85 100644
--- a/tests/unit/backend/test_configuration_routes.py
+++ b/tests/unit/backend/test_configuration_routes.py
@@ -51,27 +51,6 @@ def test_update_configuration_file_persists_content(client: TestClient) -> None:
     service.update_async.assert_awaited_once_with("operator: bob\n")
 
 
-def test_restart_backend_schedules_managed_restart(client: TestClient) -> None:
-    """Test scheduling a restart through the configuration API."""
-    restart_backend = MagicMock()
-    app.state.restart_backend = restart_backend
-    try:
-        response = client.post("/api/config/restart")
-    finally:
-        del app.state.restart_backend
-
-    assert response.status_code == status.HTTP_202_ACCEPTED
-    restart_backend.assert_called_once_with()
-
-
-def test_restart_backend_returns_503_without_managed_server(client: TestClient) -> None:
-    """Test restart rejection when no server callback is installed."""
-    response = client.post("/api/config/restart")
-
-    assert response.status_code == status.HTTP_503_SERVICE_UNAVAILABLE
-    assert response.json()["detail"] == "Backend restart is unavailable for this server process"
-
-
 def test_get_configuration_file_returns_404_when_missing(client: TestClient) -> None:
     """Test that a missing configuration source returns 404."""
     service = MagicMock(read_async=AsyncMock(side_effect=FileNotFoundError))
diff --git a/tests/unit/backend/test_pyrit_backend.py b/tests/unit/backend/test_pyrit_backend.py
index b1fce5912e..eac89ff301 100644
--- a/tests/unit/backend/test_pyrit_backend.py
+++ b/tests/unit/backend/test_pyrit_backend.py
@@ -1,12 +1,11 @@
 # Copyright (c) Microsoft Corporation.
 # Licensed under the MIT license.
 
-from unittest.mock import AsyncMock, MagicMock, patch
+from unittest.mock import MagicMock, patch
 
 import pytest
 
 from pyrit.backend import pyrit_backend
-from pyrit.backend.main import app
 
 
 class TestParseArgs:
@@ -125,22 +124,19 @@ def test_main_no_warning_for_127_0_0_1(self, mock_run_server: MagicMock, capsys)
 
 
 class TestRunServer:
-    """Tests for the managed uvicorn server loop."""
-
-    @patch("uvicorn.Server")
-    def test_restart_callback_starts_new_server(self, mock_server_type: MagicMock) -> None:
-        first_server = MagicMock()
-        second_server = MagicMock()
-        first_server.serve = AsyncMock(side_effect=lambda: app.state.restart_backend())
-        second_server.serve = AsyncMock()
-        mock_server_type.side_effect = [first_server, second_server]
+    """Tests for uvicorn startup."""
 
+    @patch("uvicorn.run")
+    def test_starts_uvicorn_without_reload(self, mock_run: MagicMock) -> None:
         pyrit_backend._run_server(host="localhost", port=8000, log_level="warning", reload=False)
 
-        assert mock_server_type.call_count == 2
-        assert first_server.should_exit is True
-        first_server.serve.assert_awaited_once_with()
-        second_server.serve.assert_awaited_once_with()
+        mock_run.assert_called_once_with(
+            "pyrit.backend.main:app",
+            host="localhost",
+            port=8000,
+            log_level="warning",
+            reload=False,
+        )
 
     @patch("uvicorn.run")
     def test_reload_uses_uvicorn_reloader(self, mock_run: MagicMock) -> None:
diff --git a/tests/unit/setup/test_configuration_loader.py b/tests/unit/setup/test_configuration_loader.py
index 9becad599c..68fc75bd09 100644
--- a/tests/unit/setup/test_configuration_loader.py
+++ b/tests/unit/setup/test_configuration_loader.py
@@ -7,12 +7,14 @@
 
 import pytest
 
+from pyrit.registry import InitializerRegistry
 from pyrit.setup.configuration_loader import (
     ConfigurationLoader,
     InitializerConfig,
     ServerConfig,
     initialize_from_config_async,
 )
+from pyrit.setup.pyrit_initializer import PyRITInitializer
 
 
 class TestInitializerConfig:
@@ -305,6 +307,23 @@ def test_get_default_config_path(self):
 class TestConfigurationLoaderResolvers:
     """Tests for ConfigurationLoader path resolution methods."""
 
+    def test_resolve_initializers_uses_singleton_registry(self) -> None:
+        """Test resolving a custom initializer registered during backend startup."""
+
+        class CustomInitializer(PyRITInitializer):
+            async def initialize_async(self) -> None:
+                pass
+
+        registry = InitializerRegistry(lazy_discovery=True)
+        registry.register_class(CustomInitializer, name="custom")
+        config = ConfigurationLoader(initializers=["custom"])
+
+        with mock.patch.object(InitializerRegistry, "get_registry_singleton", return_value=registry):
+            resolved = config.resolve_initializers()
+
+        assert len(resolved) == 1
+        assert isinstance(resolved[0], CustomInitializer)
+
     def testresolve_initialization_scripts_none_returns_none(self):
         """Test that None (default) returns None to signal 'use defaults'."""
         config = ConfigurationLoader()
@@ -336,13 +355,6 @@ def testresolve_initialization_scripts_relative_path(self):
         # Check path ends with expected components (works on both Unix and Windows)
         assert resolved[0].parts[-2:] == ("relative", "script.py")
 
-    def testresolve_initialization_scripts_preserves_azure_blob_uri(self):
-        """Test preserving an Azure Blob URI for initialization-time download."""
-        source = "https://account.blob.core.windows.net/scripts/example.py?sp=r&sig=secret"
-        config = ConfigurationLoader(initialization_scripts=[source])
-
-        assert config.resolve_initialization_scripts() == [source]
-
     def testresolve_env_files_none_returns_none(self):
         """Test that None (default) returns None to signal 'use defaults'."""
         config = ConfigurationLoader()
@@ -437,7 +449,7 @@ async def test_initialize_pyrit_async_with_initializers(self, mock_registry_cls,
         """Test initialization with initializers resolved from registry."""
         # Setup mock registry
         mock_registry = mock.MagicMock()
-        mock_registry_cls.return_value = mock_registry
+        mock_registry_cls.get_registry_singleton.return_value = mock_registry
 
         # Mock the configured initializer instance produced by the registry
         mock_initializer_instance = mock.MagicMock()
@@ -461,7 +473,7 @@ async def test_initialize_pyrit_async_with_initializers(self, mock_registry_cls,
     async def test_initialize_pyrit_async_unknown_initializer_raises_error(self, mock_registry_cls):
         """Test that unknown initializer name raises ValueError."""
         mock_registry = mock.MagicMock()
-        mock_registry_cls.return_value = mock_registry
+        mock_registry_cls.get_registry_singleton.return_value = mock_registry
         mock_registry.create_and_configure.side_effect = KeyError("unknown_initializer")
         mock_registry.get_class_names.return_value = ["simple", "airt"]
 
diff --git a/tests/unit/setup/test_initialization.py b/tests/unit/setup/test_initialization.py
index 12b1347dba..fa283786f9 100644
--- a/tests/unit/setup/test_initialization.py
+++ b/tests/unit/setup/test_initialization.py
@@ -13,21 +13,6 @@
 from pyrit.common.singleton import Singleton
 from pyrit.registry import InitializerRegistry
 from pyrit.setup import IN_MEMORY, initialize_pyrit_async
-from pyrit.setup.initialization import is_azure_blob_script_uri
-
-
-@pytest.mark.parametrize(
-    "source",
-    [
-        "https://account.blob.attacker.example/scripts/example.py",
-        "https://user@account.blob.core.windows.net/scripts/example.py",
-        "https://account.blob.core.windows.net:8443/scripts/example.py",
-        "https://blob.core.windows.net/scripts/example.py",
-    ],
-)
-def test_is_azure_blob_script_uri_rejects_untrusted_authorities(source: str) -> None:
-    """Test rejecting Blob lookalikes before Azure credentials are acquired."""
-    assert not is_azure_blob_script_uri(source)
 
 
 class TestLoadInitializersFromScripts:
@@ -194,69 +179,6 @@ async def initialize_async(self) -> None:
         finally:
             os.unlink(script_path)
 
-    @mock.patch("pyrit.memory.central_memory.CentralMemory.set_memory_instance")
-    @mock.patch("pyrit.setup.initialization.load_environment_async", new_callable=mock.AsyncMock)
-    async def test_initialize_with_azure_blob_script(self, mock_load_environment, mock_set_memory):
-        """Test downloading a SAS-authenticated initialization script for registry loading."""
-        source = "https://account.blob.core.windows.net/scripts/example.py?sp=r&sig=secret"
-        client = mock.MagicMock()
-        client.__enter__.return_value = client
-        client.download_blob.return_value.readall.return_value = b"script content"
-        captured_path: pathlib.Path | None = None
-
-        def capture_script_path(*, script_paths):
-            nonlocal captured_path
-            captured_path = pathlib.Path(script_paths[0])
-            assert captured_path.read_bytes() == b"script content"
-            return []
-
-        registry = InitializerRegistry.get_registry_singleton()
-        with (
-            mock.patch("azure.storage.blob.BlobClient.from_blob_url", return_value=client) as client_factory,
-            mock.patch.object(registry, "create_from_script_paths", side_effect=capture_script_path),
-        ):
-            await initialize_pyrit_async(
-                memory_db_type=IN_MEMORY,
-                initialization_scripts=[source],
-                load_defaults=False,
-            )
-
-        assert captured_path is not None
-        assert not captured_path.exists()
-        client_factory.assert_called_once_with(blob_url=source)
-        mock_load_environment.assert_awaited_once()
-        mock_set_memory.assert_called_once()
-
-    @mock.patch("pyrit.memory.central_memory.CentralMemory.set_memory_instance")
-    @mock.patch("pyrit.setup.initialization.load_environment_async", new_callable=mock.AsyncMock)
-    async def test_initialize_with_azure_blob_script_uses_default_credential(
-        self, mock_load_environment, mock_set_memory
-    ):
-        """Test authenticating a Blob URI without SAS using DefaultAzureCredential."""
-        source = "https://account.blob.core.windows.net/scripts/example.py"
-        credential = mock.MagicMock()
-        credential.__enter__.return_value = credential
-        client = mock.MagicMock()
-        client.__enter__.return_value = client
-        client.download_blob.return_value.readall.return_value = b"script content"
-        registry = InitializerRegistry.get_registry_singleton()
-
-        with (
-            mock.patch("azure.identity.DefaultAzureCredential", return_value=credential) as credential_factory,
-            mock.patch("azure.storage.blob.BlobClient.from_blob_url", return_value=client) as client_factory,
-            mock.patch.object(registry, "create_from_script_paths", return_value=[]),
-        ):
-            await initialize_pyrit_async(
-                memory_db_type=IN_MEMORY,
-                initialization_scripts=[source],
-                load_defaults=False,
-            )
-
-        credential_factory.assert_called_once_with()
-        client_factory.assert_called_once_with(blob_url=source, credential=credential)
-        mock_load_environment.assert_awaited_once()
-        mock_set_memory.assert_called_once()
-
     @mock.patch("pyrit.setup.initialization.load_environment_async", new_callable=mock.AsyncMock)
     async def test_invalid_memory_type_raises_error(self, mock_load_environment):
         """Test that invalid memory type raises ValueError."""

From 6a665e57e55210b2717b58e2a19b248227a9312d Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Thu, 27 Aug 2026 10:13:02 -0700
Subject: [PATCH 13/24] ruff

---
 tests/unit/backend/test_initializer_service.py | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/tests/unit/backend/test_initializer_service.py b/tests/unit/backend/test_initializer_service.py
index 468e3e9932..7827f263cf 100644
--- a/tests/unit/backend/test_initializer_service.py
+++ b/tests/unit/backend/test_initializer_service.py
@@ -872,6 +872,7 @@ async def test_list_custom_initializers_returns_stored_sources(self) -> None:
             assert result.items[0].initializer_name == "my_custom"
             assert result.items[0].source == "C:/custom/my_custom.py"
 
+
 # ============================================================================
 # POST / DELETE Route Tests
 # ============================================================================
@@ -885,9 +886,7 @@ def test_list_custom_initializers_uses_read_only_route(
     ) -> None:
         with patch("pyrit.backend.routes.initializers.get_initializer_service") as mock_get_service:
             mock_service = MagicMock()
-            mock_service.list_custom_initializers_async = AsyncMock(
-                return_value={"source": "C:/custom", "items": []}
-            )
+            mock_service.list_custom_initializers_async = AsyncMock(return_value={"source": "C:/custom", "items": []})
             mock_get_service.return_value = mock_service
 
             response = client_with_custom_initializers_enabled.get("/api/initializers/custom")

From 4541a976dbb0f83cc4c96d2a7b577058c98f0054 Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Thu, 27 Aug 2026 11:18:29 -0700
Subject: [PATCH 14/24] Support remote config and AKV environment refs

---
 docker/start.sh  | 63 ++++++++++++++++++++++++++----------------------
 infra/main.bicep | 35 ++++++++++++---------------
 2 files changed, 50 insertions(+), 48 deletions(-)

diff --git a/docker/start.sh b/docker/start.sh
index 816903fe86..eec57b9b33 100644
--- a/docker/start.sh
+++ b/docker/start.sh
@@ -46,7 +46,7 @@ if [ -n "$PYRIT_ENV_CONTENTS" ]; then
     echo "$PYRIT_ENV_CONTENTS" > ~/.pyrit/.env
     echo "Wrote .env file from PYRIT_ENV_CONTENTS ($(wc -l < ~/.pyrit/.env) lines)"
 else
-    echo "No PYRIT_ENV_CONTENTS set — using system environment variables only"
+    echo "No inline PYRIT_ENV_CONTENTS set — using configured environment sources"
 fi
 
 # Start the appropriate service based on PYRIT_MODE
@@ -57,33 +57,35 @@ if [ "$PYRIT_MODE" = "jupyter" ]; then
     exec jupyter lab --ip=0.0.0.0 --port=8888 --no-browser --allow-root --notebook-dir=/app/notebooks
 elif [ "$PYRIT_MODE" = "gui" ]; then
     echo "Starting PyRIT GUI on port 8000..."
-    BACKEND_ARGS=(--host 0.0.0.0 --port 8000)
-    if [ -n "$PYRIT_CONFIG_FILE" ]; then
-        echo "Using configured PyRIT configuration source"
-        BACKEND_ARGS+=(--config-file "$PYRIT_CONFIG_FILE")
-    else
-        # Preserve the deployment-parameter fallback when no complete config is supplied.
-        RUNTIME_CONFIG=/tmp/pyrit_runtime.yaml
-        {
-            if [ -n "$AZURE_SQL_SERVER" ]; then
-                echo "Using Azure SQL database (server: $AZURE_SQL_SERVER)" >&2
-                echo "memory_db_type: AzureSQL"
-            else
-                echo "Using SQLite database (AZURE_SQL_SERVER not set)" >&2
-                echo "memory_db_type: SQLite"
-            fi
-            if [ -n "$PYRIT_INITIALIZER" ]; then
-                echo "Using initializer: $PYRIT_INITIALIZER" >&2
-                echo "initializers:"
-                # Split comma-separated initializer names into a YAML list.
-                IFS=',' read -ra INIT_NAMES <<<"$PYRIT_INITIALIZER"
-                for name in "${INIT_NAMES[@]}"; do
-                    echo "  - $(echo "$name" | xargs)"
-                done
-            fi
-        } >"$RUNTIME_CONFIG"
-        BACKEND_ARGS+=(--config-file "$RUNTIME_CONFIG")
-    fi
+    # The thin backend only takes --host/--port/--config-file/--log-level.
+    # Translate deployment settings into a runtime config file so the FastAPI
+    # lifespan (ConfigurationLoader) picks them up on startup.
+    RUNTIME_CONFIG=/tmp/pyrit_runtime.yaml
+    {
+        if [ -n "$AZURE_SQL_SERVER" ]; then
+            echo "Using Azure SQL database (server: $AZURE_SQL_SERVER)" >&2
+            echo "memory_db_type: AzureSQL"
+        else
+            echo "Using SQLite database (AZURE_SQL_SERVER not set)" >&2
+            echo "memory_db_type: SQLite"
+        fi
+        if [ -n "$PYRIT_INITIALIZER" ]; then
+            echo "Using initializer: $PYRIT_INITIALIZER" >&2
+            echo "initializers:"
+            # Split comma-separated initializer names into a YAML list.
+            IFS=',' read -ra INIT_NAMES <<<"$PYRIT_INITIALIZER"
+            for name in "${INIT_NAMES[@]}"; do
+                echo "  - $(echo "$name" | xargs)"
+            done
+        fi
+        if [ -n "$PYRIT_ENV_AKV_REF" ]; then
+            echo "Using Azure Key Vault environment reference" >&2
+            echo "env_akv_ref:"
+            echo "  - $PYRIT_ENV_AKV_REF"
+        fi
+    } >"$RUNTIME_CONFIG"
+
+    CONFIG_FILE="${PYRIT_CONFIG_FILE:-$RUNTIME_CONFIG}"
 
     # Pick the launcher module. PR #1753 moved the launcher from
     # ``pyrit.cli.pyrit_backend`` to ``pyrit.backend.pyrit_backend``. The PyPI
@@ -101,7 +103,10 @@ elif [ "$PYRIT_MODE" = "gui" ]; then
         exit 1
     fi
 
-    exec python -m "$BACKEND_MODULE" "${BACKEND_ARGS[@]}"
+    exec python -m "$BACKEND_MODULE" \
+        --host 0.0.0.0 \
+        --port 8000 \
+        --config-file "$CONFIG_FILE"
 else
     echo "ERROR: Invalid PYRIT_MODE '$PYRIT_MODE'. Must be 'jupyter' or 'gui'"
     exit 1
diff --git a/infra/main.bicep b/infra/main.bicep
index c1d01e0a04..2210ec754e 100644
--- a/infra/main.bicep
+++ b/infra/main.bicep
@@ -80,7 +80,7 @@ param pyritInitializer string = 'target'
 @description('Optional Azure Blob HTTPS URI for the backend .pyrit_conf. The container managed identity must have blob data access. When empty, start.sh generates config from the SQL and initializer parameters.')
 param pyritConfigFileUri string = ''
 
-@description('Key Vault secret name containing the .env file contents (all endpoints, models, and API keys). The secret is mounted as an env var and PyRIT parses it at startup.')
+@description('Key Vault secret name containing the .env file contents. Used as env_akv_ref when envFileContents is empty.')
 param envSecretName string = 'env-global'
 
 @secure()
@@ -418,19 +418,12 @@ resource containerApp 'Microsoft.App/containerApps@2024-03-01' = {
         }
       ]
 
-      // Key Vault secret reference for the .env file contents
-      secrets: [
-        useInlineEnvFile
-          ? {
-              name: 'env-file'
-              value: envFileContents
-            }
-          : {
-              name: 'env-file'
-              keyVaultUrl: 'https://${keyVaultName}${environment().suffixes.keyvaultDns}/secrets/${envSecretName}'
-              identity: managedIdentity.id
-            }
-      ]
+      secrets: useInlineEnvFile ? [
+        {
+          name: 'env-file'
+          value: envFileContents
+        }
+      ] : []
     }
 
     template: {
@@ -466,11 +459,15 @@ resource containerApp 'Microsoft.App/containerApps@2024-03-01' = {
               name: 'PYRIT_CONFIG_FILE'
               value: pyritConfigFileUri
             }
-            // .env file contents from Key Vault — PyRIT parses this at startup
-            {
-              name: 'PYRIT_ENV_CONTENTS'
-              secretRef: 'env-file'
-            }
+            useInlineEnvFile
+              ? {
+                  name: 'PYRIT_ENV_CONTENTS'
+                  secretRef: 'env-file'
+                }
+              : {
+                  name: 'PYRIT_ENV_AKV_REF'
+                  value: 'https://${keyVaultName}${environment().suffixes.keyvaultDns}/secrets/${envSecretName}'
+                }
             // MSAL PKCE auth config — frontend uses these to authenticate users
             // Easy Auth is NOT used because the tenant blocks client secrets/certs
             // on app registrations. PKCE (public client) needs no secrets.

From 94dc8970ef1663c9bd5412573bbee8409c5b1b6a Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Thu, 27 Aug 2026 11:23:32 -0700
Subject: [PATCH 15/24] Fix initialization script config example

---
 .pyrit_conf_example | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/.pyrit_conf_example b/.pyrit_conf_example
index 212aee663e..978c8a293f 100644
--- a/.pyrit_conf_example
+++ b/.pyrit_conf_example
@@ -72,21 +72,18 @@ operation: op_trash_panda
 
 # Initialization Scripts
 # ----------------------
-# List of local paths or Azure Blob URIs to Python scripts containing
-# PyRITInitializer subclasses. Local paths can be absolute or relative to the
-# current working directory. Blob URIs may include a SAS; otherwise
-# DefaultAzureCredential is used.
+# List of local paths to Python scripts containing PyRITInitializer subclasses.
+# Paths can be absolute or relative to the current working directory.
 #
 # Behavior:
 # - Omit this field (or set to null): No custom scripts loaded (default)
 # - Set to []: Explicitly load no scripts (same as omitting)
-# - Set to list of sources: Load the specified scripts
+# - Set to list of paths: Load the specified scripts
 #
 # Example:
 # initialization_scripts:
 #   - /path/to/my_custom_initializer.py
 #   - ./local_initializer.py
-#   - https://account.blob.core.windows.net/scripts/cloud_initializer.py
 
 # Environment Configuration
 # -------------------------

From 936ae552f5f793204a569ff25b78c74251fe118d Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Thu, 27 Aug 2026 11:57:06 -0700
Subject: [PATCH 16/24] Add coverage for configuration editing

---
 .../test_configuration_file_service.py        | 55 ++++++++++++++++-
 .../unit/backend/test_configuration_routes.py | 59 ++++++++++++++++++-
 .../backend/test_environment_file_service.py  | 48 ++++++++++++++-
 .../unit/backend/test_initializer_service.py  |  9 +++
 .../test_custom_initializer_storage.py        | 17 ++++++
 .../registry/test_initializer_registry.py     | 46 ++++++++++++++-
 6 files changed, 229 insertions(+), 5 deletions(-)

diff --git a/tests/unit/backend/test_configuration_file_service.py b/tests/unit/backend/test_configuration_file_service.py
index 416712cdc9..1b85ed2990 100644
--- a/tests/unit/backend/test_configuration_file_service.py
+++ b/tests/unit/backend/test_configuration_file_service.py
@@ -4,9 +4,13 @@
 """Tests for backend configuration file storage."""
 
 from pathlib import Path
-from unittest.mock import AsyncMock, patch
+from unittest.mock import AsyncMock, MagicMock, patch
 
-from pyrit.backend.services.configuration_file_service import ConfigurationFileService
+from pyrit.backend.services.configuration_file_service import (
+    ConfigurationFileService,
+    _download_blob_config_async,
+    _upload_blob_config_async,
+)
 
 
 async def test_configuration_file_service_reads_and_updates_local_file(tmp_path: Path) -> None:
@@ -20,6 +24,53 @@ async def test_configuration_file_service_reads_and_updates_local_file(tmp_path:
     await service.update_async("operator: after\n")
 
     assert config_path.read_text(encoding="utf-8") == "operator: after\n"
+    assert service.source == str(config_path)
+
+
+async def test_blob_helpers_use_sas_authentication() -> None:
+    """Test downloading and uploading directly with a SAS-authenticated blob URI."""
+    blob_uri = "https://account.blob.core.windows.net/config/config.yaml?sig=secret"
+    blob_stream = MagicMock()
+    blob_stream.readall = AsyncMock(return_value=b"operator: alice\n")
+    blob_client = MagicMock()
+    blob_client.__aenter__ = AsyncMock(return_value=blob_client)
+    blob_client.__aexit__ = AsyncMock(return_value=None)
+    blob_client.download_blob = AsyncMock(return_value=blob_stream)
+    blob_client.upload_blob = AsyncMock()
+
+    with patch("azure.storage.blob.aio.BlobClient.from_blob_url", return_value=blob_client) as client_factory:
+        assert await _download_blob_config_async(blob_uri) == b"operator: alice\n"
+        await _upload_blob_config_async(blob_uri=blob_uri, content=b"operator: bob\n")
+
+    assert client_factory.call_count == 2
+    assert client_factory.call_args_list[0].kwargs == {"blob_url": blob_uri}
+    blob_client.upload_blob.assert_awaited_once_with(b"operator: bob\n", overwrite=True)
+
+
+async def test_blob_helpers_use_default_credential_without_sas() -> None:
+    """Test downloading and uploading with the default Azure credential."""
+    blob_uri = "https://account.blob.core.windows.net/config/config.yaml"
+    credential = MagicMock()
+    credential.__aenter__ = AsyncMock(return_value=credential)
+    credential.__aexit__ = AsyncMock(return_value=None)
+    blob_stream = MagicMock()
+    blob_stream.readall = AsyncMock(return_value=b"operator: alice\n")
+    blob_client = MagicMock()
+    blob_client.__aenter__ = AsyncMock(return_value=blob_client)
+    blob_client.__aexit__ = AsyncMock(return_value=None)
+    blob_client.download_blob = AsyncMock(return_value=blob_stream)
+    blob_client.upload_blob = AsyncMock()
+
+    with (
+        patch("azure.identity.aio.DefaultAzureCredential", return_value=credential) as credential_factory,
+        patch("azure.storage.blob.aio.BlobClient.from_blob_url", return_value=blob_client) as client_factory,
+    ):
+        assert await _download_blob_config_async(blob_uri) == b"operator: alice\n"
+        await _upload_blob_config_async(blob_uri=blob_uri, content=b"operator: bob\n")
+
+    assert credential_factory.call_count == 2
+    assert client_factory.call_args_list[0].kwargs == {"blob_url": blob_uri, "credential": credential}
+    blob_client.upload_blob.assert_awaited_once_with(b"operator: bob\n", overwrite=True)
 
 
 async def test_configuration_file_service_reads_and_updates_blob() -> None:
diff --git a/tests/unit/backend/test_configuration_routes.py b/tests/unit/backend/test_configuration_routes.py
index a158948f85..b282d2105c 100644
--- a/tests/unit/backend/test_configuration_routes.py
+++ b/tests/unit/backend/test_configuration_routes.py
@@ -6,11 +6,14 @@
 from unittest.mock import AsyncMock, MagicMock, patch
 
 import pytest
-from fastapi import status
+from azure.core.exceptions import ResourceNotFoundError
+from fastapi import HTTPException, status
 from fastapi.testclient import TestClient
 
 from pyrit.backend.main import app
+from pyrit.backend.routes.configuration import _get_configuration_file_service, _get_environment_file_service
 from pyrit.backend.services.configuration_file_service import ConfigurationFileService
+from pyrit.backend.services.environment_file_service import EnvironmentFileService
 
 
 @pytest.fixture
@@ -19,6 +22,33 @@ def client() -> TestClient:
     return TestClient(app)
 
 
+def test_configuration_services_resolve_from_application_state() -> None:
+    """Test service resolution from startup state and environment fallback."""
+    request = MagicMock()
+    configuration_service = ConfigurationFileService(config_file_value="config.yaml")
+    environment_service = EnvironmentFileService(resolved_env_files=[])
+    request.app.state.configuration_file_service = configuration_service
+    request.app.state.environment_file_service = environment_service
+
+    assert _get_configuration_file_service(request) is configuration_service
+    assert _get_environment_file_service(request) is environment_service
+
+    request.app.state.configuration_file_service = None
+    with patch.dict("os.environ", {"PYRIT_CONFIG_FILE": "fallback.yaml"}):
+        assert _get_configuration_file_service(request).source == "fallback.yaml"
+
+
+def test_get_environment_file_service_raises_when_unavailable() -> None:
+    """Test that missing startup state produces a service-unavailable response."""
+    request = MagicMock()
+    request.app.state.environment_file_service = None
+
+    with pytest.raises(HTTPException) as exc_info:
+        _get_environment_file_service(request)
+
+    assert exc_info.value.status_code == status.HTTP_503_SERVICE_UNAVAILABLE
+
+
 def test_get_configuration_file_returns_content(client: TestClient) -> None:
     """Test reading configuration contents through the API."""
     service = MagicMock(spec=ConfigurationFileService)
@@ -60,6 +90,15 @@ def test_get_configuration_file_returns_404_when_missing(client: TestClient) ->
     assert response.status_code == status.HTTP_404_NOT_FOUND
 
 
+def test_update_configuration_file_returns_404_when_blob_missing(client: TestClient) -> None:
+    """Test that updating a missing blob configuration source returns 404."""
+    service = MagicMock(read_async=AsyncMock(side_effect=ResourceNotFoundError("missing")))
+    with patch("pyrit.backend.routes.configuration._get_configuration_file_service", return_value=service):
+        response = client.put("/api/config", json={"content": "operator: bob\n"})
+
+    assert response.status_code == status.HTTP_404_NOT_FOUND
+
+
 def test_list_environment_files_returns_configured_files(client: TestClient) -> None:
     """Test listing environment files through the API."""
     item = {
@@ -95,6 +134,15 @@ def test_get_environment_file_returns_selected_content(client: TestClient) -> No
     service.read_async.assert_awaited_once_with(file_id="akv:0")
 
 
+def test_get_environment_file_returns_404_for_unknown_id(client: TestClient) -> None:
+    """Test that reading an unknown environment source returns 404."""
+    service = MagicMock(read_async=AsyncMock(side_effect=KeyError("missing")))
+    with patch("pyrit.backend.routes.configuration._get_environment_file_service", return_value=service):
+        response = client.get("/api/config/env-files/missing")
+
+    assert response.status_code == status.HTTP_404_NOT_FOUND
+
+
 def test_update_environment_file_persists_selected_file(client: TestClient) -> None:
     """Test updating a selected environment file through the API."""
     item = {
@@ -123,3 +171,12 @@ def test_update_environment_file_returns_400_for_versioned_akv_source(client: Te
 
     assert response.status_code == status.HTTP_400_BAD_REQUEST
     assert response.json()["detail"] == "Versioned Azure Key Vault environment sources are read-only"
+
+
+def test_update_environment_file_returns_404_for_unknown_id(client: TestClient) -> None:
+    """Test that updating an unknown environment source returns 404."""
+    service = MagicMock(update_async=AsyncMock(side_effect=KeyError("missing")))
+    with patch("pyrit.backend.routes.configuration._get_environment_file_service", return_value=service):
+        response = client.put("/api/config/env-files/missing", json={"content": "API_KEY=new\n"})
+
+    assert response.status_code == status.HTTP_404_NOT_FOUND
diff --git a/tests/unit/backend/test_environment_file_service.py b/tests/unit/backend/test_environment_file_service.py
index d90edbd647..b3dce09f5d 100644
--- a/tests/unit/backend/test_environment_file_service.py
+++ b/tests/unit/backend/test_environment_file_service.py
@@ -4,7 +4,7 @@
 """Tests for backend environment file storage."""
 
 from pathlib import Path
-from unittest.mock import AsyncMock, patch
+from unittest.mock import AsyncMock, MagicMock, patch
 
 import pytest
 
@@ -100,6 +100,32 @@ async def test_environment_file_service_rejects_versioned_akv_update() -> None:
     credential_mock.assert_not_called()
 
 
+async def test_environment_file_service_updates_unversioned_akv_document() -> None:
+    """Test validating and persisting an unversioned Key Vault document."""
+    secret_url = "https://vault.vault.azure.net/secrets/bootstrap"
+    credential = MagicMock()
+    credential.__aenter__ = AsyncMock(return_value=credential)
+    credential.__aexit__ = AsyncMock(return_value=None)
+    client = MagicMock()
+    client.__aenter__ = AsyncMock(return_value=client)
+    client.__aexit__ = AsyncMock(return_value=None)
+    client.set_secret = AsyncMock()
+
+    with (
+        patch("azure.identity.aio.DefaultAzureCredential", return_value=credential),
+        patch("pyrit.backend.services.environment_file_service._create_akv_secret_client", return_value=client),
+        patch(
+            "pyrit.backend.services.environment_file_service._validate_dotenv_document",
+            return_value="AKV=validated\n",
+        ) as validate_mock,
+    ):
+        result = await _update_akv_document_async(secret_url=secret_url, content="AKV=value\n", strict=False)
+
+    assert result == "AKV=validated\n"
+    validate_mock.assert_called_once_with("AKV=value\n", strict=False, silent=True)
+    client.set_secret.assert_awaited_once_with("bootstrap", "AKV=validated\n")
+
+
 async def test_environment_file_service_reads_latest_akv_content() -> None:
     """Test that every read observes the current AKV content."""
     secret_url = "https://vault.vault.azure.net/secrets/bootstrap"
@@ -112,3 +138,23 @@ async def test_environment_file_service_reads_latest_akv_content() -> None:
         assert (await service.read_async(file_id="akv:0")).content == "SECOND=2\n"
 
     assert fetch_mock.await_count == 2
+
+
+@pytest.mark.parametrize("file_id", ["akv:invalid", "akv:1", "akv:-1"])
+def test_environment_file_service_rejects_invalid_akv_id(file_id: str) -> None:
+    """Test malformed, out-of-range, and negative Key Vault identifiers."""
+    service = EnvironmentFileService(
+        resolved_env_files=[], env_akv_ref=["https://vault.vault.azure.net/secrets/bootstrap"]
+    )
+
+    with pytest.raises(KeyError, match=file_id):
+        service._get_akv_source(file_id)
+
+
+@pytest.mark.parametrize("file_id", ["invalid", "1", "-1"])
+def test_environment_file_service_rejects_invalid_file_id(file_id: str, tmp_path: Path) -> None:
+    """Test malformed, out-of-range, and negative local file identifiers."""
+    service = EnvironmentFileService(resolved_env_files=[tmp_path / ".env"])
+
+    with pytest.raises(KeyError, match=file_id):
+        service._get_file_path(file_id)
diff --git a/tests/unit/backend/test_initializer_service.py b/tests/unit/backend/test_initializer_service.py
index 7827f263cf..5a9e462d46 100644
--- a/tests/unit/backend/test_initializer_service.py
+++ b/tests/unit/backend/test_initializer_service.py
@@ -872,6 +872,15 @@ async def test_list_custom_initializers_returns_stored_sources(self) -> None:
             assert result.items[0].initializer_name == "my_custom"
             assert result.items[0].source == "C:/custom/my_custom.py"
 
+    async def test_unregister_initializer_removes_runtime_registration(self) -> None:
+        with patch.object(InitializerService, "__init__", lambda self: None):
+            service = InitializerService()
+            service._registry = MagicMock()
+
+            await service.unregister_initializer_async(initializer_name="my_custom")
+
+            service._registry.unregister_and_cleanup.assert_called_once_with("my_custom")
+
 
 # ============================================================================
 # POST / DELETE Route Tests
diff --git a/tests/unit/registry/test_custom_initializer_storage.py b/tests/unit/registry/test_custom_initializer_storage.py
index 3997317f06..f739375ff0 100644
--- a/tests/unit/registry/test_custom_initializer_storage.py
+++ b/tests/unit/registry/test_custom_initializer_storage.py
@@ -121,6 +121,7 @@ def test_local_storage_returns_script_path(tmp_path: Path) -> None:
     storage = CustomInitializerStorage(source=str(tmp_path))
 
     assert storage.get_script_source("example") == str(tmp_path / "example.py")
+    assert storage.display_source == str(tmp_path)
 
 
 def test_local_storage_reads_latest_script_content(tmp_path: Path) -> None:
@@ -132,3 +133,19 @@ def test_local_storage_reads_latest_script_content(tmp_path: Path) -> None:
     assert storage.list_scripts() == {"example": "VALUE = 1\n"}
     script_path.write_text("VALUE = 2\n", encoding="utf-8")
     assert storage.list_scripts() == {"example": "VALUE = 2\n"}
+
+
+def test_direct_python_blob_rejects_name_outside_prefix() -> None:
+    """Test that blobs outside the configured virtual directory are ignored."""
+    assert not CustomInitializerStorage._is_direct_python_blob(
+        blob_name="other/example.py", prefix="custom-initializers/"
+    )
+
+
+def test_local_storage_cannot_open_blob_client(tmp_path: Path) -> None:
+    """Test that local storage cannot create an Azure container client."""
+    storage = CustomInitializerStorage(source=str(tmp_path))
+
+    with pytest.raises(RuntimeError, match="not configured"):
+        with storage._open_container_client():
+            pass
diff --git a/tests/unit/registry/test_initializer_registry.py b/tests/unit/registry/test_initializer_registry.py
index caed430ecb..05398667c8 100644
--- a/tests/unit/registry/test_initializer_registry.py
+++ b/tests/unit/registry/test_initializer_registry.py
@@ -3,12 +3,13 @@
 
 import tempfile
 from pathlib import Path
-from unittest.mock import patch
+from unittest.mock import MagicMock, patch
 
 import pytest
 
 from pyrit.models.parameter import Parameter
 from pyrit.registry.components.initializer_registry import PYRIT_PATH, InitializerRegistry
+from pyrit.registry.custom_initializer_storage import CustomInitializerStorage
 from pyrit.setup.pyrit_initializer import PyRITInitializer
 
 
@@ -197,6 +198,34 @@ def test_register_stored_initializers_loads_configured_source(
     assert lazy_registry.get_class("restored").__name__ == "ScriptTestInitializer"
 
 
+def test_register_stored_initializers_skips_duplicate_and_invalid_names(
+    lazy_registry: InitializerRegistry,
+) -> None:
+    """Test that one bad stored script does not prevent startup registration."""
+    storage = MagicMock(spec=CustomInitializerStorage)
+    storage.list_scripts.return_value = {"duplicate": _VALID_SCRIPT, "INVALID": _VALID_SCRIPT}
+    lazy_registry._custom_storage = storage
+    lazy_registry._classes["duplicate"] = _ParamInitializer
+
+    lazy_registry.register_stored_initializers()
+
+    assert lazy_registry.get_class_names() == ["duplicate"]
+
+
+def test_list_stored_initializer_sources_includes_display_paths(lazy_registry: InitializerRegistry) -> None:
+    """Test listing stored source content with its display-safe location."""
+    storage = MagicMock(spec=CustomInitializerStorage)
+    storage.display_source = "C:/custom"
+    storage.list_scripts.return_value = {"custom": _VALID_SCRIPT}
+    storage.get_script_source.return_value = "C:/custom/custom.py"
+    lazy_registry._custom_storage = storage
+
+    assert lazy_registry.list_stored_initializer_sources() == (
+        "C:/custom",
+        [("custom", _VALID_SCRIPT, "C:/custom/custom.py")],
+    )
+
+
 def test_unregister_and_cleanup_rejects_builtin(lazy_registry):
     """Test that unregister_and_cleanup raises ValueError for built-in initializers."""
 
@@ -476,6 +505,21 @@ def test_register_from_content_write_failure_raises(lazy_registry):
                 lazy_registry.register_from_content(name="write_fail", script_content=_VALID_SCRIPT)
 
 
+def test_register_from_content_temporary_write_failure_cleans_up_storage(
+    lazy_registry: InitializerRegistry,
+) -> None:
+    """Test that failure to materialize saved source removes the stored script."""
+    storage = MagicMock(spec=CustomInitializerStorage)
+    lazy_registry._custom_storage = storage
+
+    with patch("pathlib.Path.write_text", side_effect=OSError("disk full")):
+        with pytest.raises(ValueError, match="Failed to write initializer script"):
+            lazy_registry.register_from_content(name="write_fail", script_content=_VALID_SCRIPT)
+
+    storage.save_script.assert_called_once_with(name="write_fail", content=_VALID_SCRIPT)
+    storage.delete_script.assert_called_once_with("write_fail")
+
+
 def test_unregister_and_cleanup_unknown_name_raises(lazy_registry):
     """Test that unregistering an unknown, non-built-in name raises KeyError."""
     with pytest.raises(KeyError, match="not found in registry"):

From 62e0594fffd0fdcccfdb82b37c9b7505ed5a3322 Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Thu, 27 Aug 2026 14:18:12 -0700
Subject: [PATCH 17/24] feat: restrict backend configuration routes to admins

---
 infra/DEPLOY_NEW_INSTANCE.md                  |  3 ++
 infra/README.md                               | 16 ++++++--
 infra/deploy_instance.py                      | 19 +++++++++-
 infra/main.bicep                              |  9 +++++
 infra/parameters.demo.json                    |  3 ++
 infra/parameters.example.json                 |  3 ++
 pyrit/backend/middleware/auth.py              | 32 +++++++++++++---
 pyrit/backend/routes/configuration.py         | 18 ++++++++-
 tests/unit/backend/test_auth_middleware.py    | 31 ++++++++++++++--
 .../unit/backend/test_configuration_routes.py | 37 ++++++++++++++++++-
 10 files changed, 153 insertions(+), 18 deletions(-)

diff --git a/infra/DEPLOY_NEW_INSTANCE.md b/infra/DEPLOY_NEW_INSTANCE.md
index 489f557368..2cdb672afd 100644
--- a/infra/DEPLOY_NEW_INSTANCE.md
+++ b/infra/DEPLOY_NEW_INSTANCE.md
@@ -81,6 +81,7 @@ python infra/deploy_instance.py \
     --acr-name <shared-acr-name> \
     --container-image <acr>.azurecr.io/pyrit:<commit-sha> \
     --allowed-groups "group-oid-1,group-oid-2" \
+    --admin-group "admin-group-oid" \
     --owner-tag "<your-alias>" \
     --service-management-reference "<service-tree-id>" \
     --aoai-resource-names "aoai-resource-1,aoai-resource-2"
@@ -95,6 +96,7 @@ python infra/deploy_instance.py \
 | `--acr-name` | Yes | Shared ACR name |
 | `--container-image` | Yes | Full image reference (ACR + tag) |
 | `--allowed-groups` | Yes | Comma-separated Entra group OIDs |
+| `--admin-group` | Yes | Entra group OID allowed to manage backend configuration |
 | `--owner-tag` | Conditional | `Owner` tag value applied to all per-instance resources. **Required when the target subscription enforces a "Require a tag on resources" Azure Policy** (this is the case for the AI Red Team Tooling subscription — deployments without it fail with `RequestDisallowedByPolicy`). Optional only on subscriptions without such a policy |
 | `--service-management-reference` | No | Service Tree ID (required by some tenants for Entra app creation) |
 | `--aoai-resource-names` | No | Comma-separated Cognitive Services account names for automatic AOAI RBAC. Grants `Cognitive Services OpenAI User` to the MI on each resource. Does **not** cover Content Safety — see step 3 for that. If omitted, all AOAI roles must be granted manually |
@@ -430,6 +432,7 @@ Common causes:
   echo "Expected redirect: https://$FQDN"
   ```
 - Verify the user is in one of the `allowedGroupObjectIds` groups.
+- For configuration routes, verify the user is in the `adminGroupObjectId` group.
 - Verify the security group is assigned to the enterprise app.
 
 ### Targets not appearing in the GUI
diff --git a/infra/README.md b/infra/README.md
index 4fca8023c9..0a4b2a7b6e 100644
--- a/infra/README.md
+++ b/infra/README.md
@@ -61,7 +61,8 @@ Production is opt-in via `deployToProd: true`.
   Microsoft Graph-backed middleware on the backend. The frontend sends a delegated
   Graph token, and the backend authenticates it through Graph `/me`. PKCE (public
   client) requires no client secrets or certificates.
-- **Authorization**: Entra group check via `allowedGroupObjectIds` param. Requires
+- **Authorization**: Entra group checks via `allowedGroupObjectIds` for application access
+  and `adminGroupObjectId` for backend configuration routes. Requires
   delegated Graph `User.Read`; the backend calls `/me/checkMemberGroups` and compares
   the returned transitive memberships with the configured group IDs. Each security
   group must also be assigned to the enterprise app (see Prerequisites §3). Authenticated
@@ -191,8 +192,9 @@ az rest --method PATCH \
 
 ### 3. Entra security groups (required for group-based authorization)
 
-Create one or more security groups for authorized users. Multiple groups can be
-specified as comma-separated IDs in `allowedGroupObjectIds`.
+Create one or more security groups for authorized users and a security group for
+configuration administrators. Multiple user groups can be specified as comma-separated
+IDs in `allowedGroupObjectIds`; set the admin group ID in `adminGroupObjectId`.
 
 ```bash
 # Create security group for authorized users
@@ -204,6 +206,11 @@ az ad group create --display-name "MyApp-Users" --mail-nickname myapp-users
 GROUP_ID=$(az ad group show --group "MyApp-Users" --query id -o tsv)
 echo "allowedGroupObjectIds: $GROUP_ID"
 
+# Create or retrieve the admin group Object ID (use this as adminGroupObjectId)
+az ad group create --display-name "MyApp-Admins" --mail-nickname myapp-admins
+ADMIN_GROUP_ID=$(az ad group show --group "MyApp-Admins" --query id -o tsv)
+echo "adminGroupObjectId: $ADMIN_GROUP_ID"
+
 # Add users to the group
 az ad group member add --group "MyApp-Users" --member-id <user-object-id>
 
@@ -397,7 +404,8 @@ az deployment group create \
    ```
 
 4. **Manage access** — Add or remove users via Entra security groups
-   (`allowedGroupObjectIds`). Each group must also be assigned to the enterprise app.
+  (`allowedGroupObjectIds` and `adminGroupObjectId`). Each group must also be assigned
+  to the enterprise app.
 
 ## Access the GUI
 
diff --git a/infra/deploy_instance.py b/infra/deploy_instance.py
index 99a730a67b..694ea076e1 100644
--- a/infra/deploy_instance.py
+++ b/infra/deploy_instance.py
@@ -25,7 +25,8 @@
         --location eastus2 \\
         --acr-name myacr \\
         --container-image myacr.azurecr.io/pyrit:abc1234 \\
-        --allowed-groups "group-oid-1,group-oid-2"
+        --allowed-groups "group-oid-1,group-oid-2" \
+        --admin-group "admin-group-oid"
 
 """
 
@@ -762,6 +763,7 @@ def deploy_bicep(
     tenant_id: str,
     client_id: str,
     group_ids: str,
+    admin_group_id: str,
     sql_server_fqdn: str,
     sql_database_name: str,
     kv_resource_id: str,
@@ -786,6 +788,7 @@ def deploy_bicep(
         tenant_id (str): The Entra tenant ID.
         client_id (str): The Entra app registration client ID.
         group_ids (str): Comma-separated group object IDs.
+        admin_group_id (str): Admin group object ID.
         sql_server_fqdn (str): The SQL server FQDN.
         sql_database_name (str): The SQL database name.
         kv_resource_id (str): The Key Vault resource ID (kept for the
@@ -808,6 +811,7 @@ def deploy_bicep(
         "entraTenantId": {"value": tenant_id},
         "entraClientId": {"value": client_id},
         "allowedGroupObjectIds": {"value": group_ids},
+        "adminGroupObjectId": {"value": admin_group_id},
         "sqlServerFqdn": {"value": sql_server_fqdn},
         "sqlDatabaseName": {"value": sql_database_name},
         "keyVaultResourceId": {"value": kv_resource_id},
@@ -1105,6 +1109,11 @@ def parse_args(args: list[str] | None = None) -> argparse.Namespace:
         required=True,
         help="Comma-separated Entra group object IDs to grant access",
     )
+    parser.add_argument(
+        "--admin-group",
+        required=True,
+        help="Entra group object ID allowed to manage backend configuration",
+    )
     parser.add_argument(
         "--owner-tag",
         default="",
@@ -1169,10 +1178,14 @@ def main(args: list[str] | None = None) -> int:
     storage_account_name = _storage_account_name(instance)
     entra_app_name = f"CoPyRIT GUI ({instance})"
     group_ids = [g.strip() for g in parsed.allowed_groups.split(",") if g.strip()]
+    admin_group_id = parsed.admin_group.strip()
 
     if not group_ids:
         logger.error("--allowed-groups must contain at least one Entra group object ID")
         return 1
+    if not admin_group_id:
+        logger.error("--admin-group must contain an Entra group object ID")
+        return 1
 
     # Validate Azure resource name length constraints
     if len(kv_name) > 24:
@@ -1212,6 +1225,7 @@ def main(args: list[str] | None = None) -> int:
         logger.info("Storage account: %s (container: %s)", storage_account_name, _STORAGE_CONTAINER_NAME)
         logger.info("Entra app: %s", entra_app_name)
         logger.info("Allowed groups: %s", group_ids)
+        logger.info("Admin group: %s", admin_group_id)
         logger.info("Env file: %s", env_file)
         logger.info("Container image: %s", parsed.container_image)
         logger.info("PyRIT config file URI: %s", parsed.pyrit_config_file_uri or "(generated at startup)")
@@ -1241,7 +1255,7 @@ def main(args: list[str] | None = None) -> int:
         )
 
         # Step 4: Assign groups to enterprise app
-        assign_groups_to_app(sp_id=entra["sp_id"], group_ids=group_ids)
+        assign_groups_to_app(sp_id=entra["sp_id"], group_ids=[*group_ids, admin_group_id])
 
         # Step 5: Create SQL server + database
         sql = create_sql_server_and_db(
@@ -1307,6 +1321,7 @@ def main(args: list[str] | None = None) -> int:
             tenant_id=entra["tenant_id"],
             client_id=entra["app_id"],
             group_ids=",".join(group_ids),
+            admin_group_id=admin_group_id,
             sql_server_fqdn=sql["server_fqdn"],
             sql_database_name=sql["database_name"],
             kv_resource_id=kv_id,
diff --git a/infra/main.bicep b/infra/main.bicep
index 2210ec754e..a83c7a7c07 100644
--- a/infra/main.bicep
+++ b/infra/main.bicep
@@ -24,6 +24,7 @@
 //                  entraClientId=<app-registration-client-id> \
 //                  entraTenantId=<tenant-id> \
 //                  allowedGroupObjectIds=<comma-separated-entra-group-ids> \
+//                  adminGroupObjectId=<admin-entra-group-id> \
 //                  allowedCidr='<your-corp-vpn-cidr>' \
 //                  sqlServerFqdn=<your-server>.database.windows.net \
 //                  sqlDatabaseName=<your-database> \
@@ -58,6 +59,10 @@ var normalizedAllowedGroupObjectIds = filter(
   groupId => !empty(groupId)
 )
 
+@description('Object ID of the Entra security group allowed to manage backend configuration')
+@minLength(1)
+param adminGroupObjectId string
+
 @description('CIDR range allowed to reach the app (e.g., your corp VPN CIDR). Empty = no IP restriction, all traffic allowed.')
 param allowedCidr string = ''
 
@@ -483,6 +488,10 @@ resource containerApp 'Microsoft.App/containerApps@2024-03-01' = {
               name: 'ENTRA_ALLOWED_GROUP_IDS'
               value: join(normalizedAllowedGroupObjectIds, ',')
             }
+            {
+              name: 'ENTRA_ADMIN_GROUP_ID'
+              value: trim(adminGroupObjectId)
+            }
             // OTel: point the SDK at the ACA managed agent (localhost sidecar)
             {
               name: 'OTEL_EXPORTER_OTLP_ENDPOINT'
diff --git a/infra/parameters.demo.json b/infra/parameters.demo.json
index 2942bab621..07f56bd3f6 100644
--- a/infra/parameters.demo.json
+++ b/infra/parameters.demo.json
@@ -19,6 +19,9 @@
     "allowedGroupObjectIds": {
       "value": "REPLACE_GROUP_OBJECT_IDS"
     },
+    "adminGroupObjectId": {
+      "value": "REPLACE_ADMIN_GROUP_OBJECT_ID"
+    },
     "allowedCidr": {
       "value": ""
     },
diff --git a/infra/parameters.example.json b/infra/parameters.example.json
index 31536c6bf2..960b70758c 100644
--- a/infra/parameters.example.json
+++ b/infra/parameters.example.json
@@ -17,6 +17,9 @@
     "allowedGroupObjectIds": {
       "value": "YOUR_ENTRA_GROUP_OBJECT_IDS"
     },
+    "adminGroupObjectId": {
+      "value": "YOUR_ADMIN_ENTRA_GROUP_OBJECT_ID"
+    },
     "allowedCidr": {
       "value": ""
     },
diff --git a/pyrit/backend/middleware/auth.py b/pyrit/backend/middleware/auth.py
index 8cfe0a0d4c..39f9453cd3 100644
--- a/pyrit/backend/middleware/auth.py
+++ b/pyrit/backend/middleware/auth.py
@@ -45,6 +45,7 @@ class AuthenticatedUser:
     name: str
     email: str
     groups: list[str]
+    is_admin: bool = False
 
 
 class EntraAuthMiddleware(BaseHTTPMiddleware):
@@ -70,9 +71,11 @@ def __init__(self, app: ASGIApp) -> None:
         tenant_raw = os.getenv("ENTRA_TENANT_ID", "")
         client_raw = os.getenv("ENTRA_CLIENT_ID", "")
         groups_raw = os.getenv("ENTRA_ALLOWED_GROUP_IDS", "")
+        admin_group_raw = os.getenv("ENTRA_ADMIN_GROUP_ID", "")
         self._tenant_id = tenant_raw.strip()
         self._client_id = client_raw.strip()
         self._allowed_group_ids: set[str] = {g.strip() for g in groups_raw.split(",") if g.strip()}
+        self._admin_group_id = admin_group_raw.strip()
         self._enabled = any((tenant_raw, client_raw, groups_raw))
         self._auth_cache: OrderedDict[str, tuple[float, AuthenticatedUser]] = OrderedDict()
 
@@ -173,10 +176,22 @@ def _get_cached_user(self, *, cache_key: str) -> AuthenticatedUser | None:
             return None
 
         self._auth_cache.move_to_end(cache_key)
-        return AuthenticatedUser(oid=user.oid, name=user.name, email=user.email, groups=list(user.groups))
+        return AuthenticatedUser(
+            oid=user.oid,
+            name=user.name,
+            email=user.email,
+            groups=list(user.groups),
+            is_admin=user.is_admin,
+        )
 
     def _cache_user(self, *, cache_key: str, user: AuthenticatedUser) -> None:
-        cached_user = AuthenticatedUser(oid=user.oid, name=user.name, email=user.email, groups=list(user.groups))
+        cached_user = AuthenticatedUser(
+            oid=user.oid,
+            name=user.name,
+            email=user.email,
+            groups=list(user.groups),
+            is_admin=user.is_admin,
+        )
         self._auth_cache[cache_key] = (monotonic() + self._AUTH_CACHE_TTL_SECONDS, cached_user)
         self._auth_cache.move_to_end(cache_key)
         while len(self._auth_cache) > self._AUTH_CACHE_MAX_ENTRIES:
@@ -218,6 +233,7 @@ async def _authenticate_with_graph_async(self, *, token: str) -> AuthenticatedUs
 
                 groups = await self._check_group_memberships_async(client=client, token=token)
                 user.groups = groups
+                user.is_admin = self._admin_group_id in groups
 
                 return user
         except (httpx.RequestError, ValueError) as error:
@@ -231,7 +247,9 @@ def _is_authorized(self, user: AuthenticatedUser) -> bool:
         Returns:
             True if the user's groups intersect with the allowed group IDs, False otherwise.
         """
-        return bool(self._allowed_group_ids & set(user.groups))
+        authorized_group_ids = self._allowed_group_ids | {self._admin_group_id}
+        authorized_group_ids.discard("")
+        return bool(authorized_group_ids & set(user.groups))
 
     async def _check_group_memberships_async(self, *, client: httpx.AsyncClient, token: str) -> list[str]:
         """
@@ -248,9 +266,11 @@ async def _check_group_memberships_async(self, *, client: httpx.AsyncClient, tok
             AuthenticationError: If Graph rejects or cannot complete the lookup.
         """
         matched_group_ids: list[str] = []
-        allowed_group_ids = sorted(self._allowed_group_ids)
-        for offset in range(0, len(allowed_group_ids), self._GRAPH_MAX_GROUP_IDS_PER_REQUEST):
-            group_ids = allowed_group_ids[offset : offset + self._GRAPH_MAX_GROUP_IDS_PER_REQUEST]
+        allowed_group_ids = self._allowed_group_ids | {self._admin_group_id}
+        allowed_group_ids.discard("")
+        sorted_group_ids = sorted(allowed_group_ids)
+        for offset in range(0, len(sorted_group_ids), self._GRAPH_MAX_GROUP_IDS_PER_REQUEST):
+            group_ids = sorted_group_ids[offset : offset + self._GRAPH_MAX_GROUP_IDS_PER_REQUEST]
             response = await client.post(
                 self._GRAPH_CHECK_MEMBER_GROUPS_URL,
                 headers={
diff --git a/pyrit/backend/routes/configuration.py b/pyrit/backend/routes/configuration.py
index 3606870c53..720fed1e2f 100644
--- a/pyrit/backend/routes/configuration.py
+++ b/pyrit/backend/routes/configuration.py
@@ -6,8 +6,9 @@
 import os
 
 from azure.core.exceptions import ResourceNotFoundError
-from fastapi import APIRouter, HTTPException, Request, status
+from fastapi import APIRouter, Depends, HTTPException, Request, status
 
+from pyrit.backend.middleware.auth import AuthenticatedUser
 from pyrit.backend.models.common import ProblemDetail
 from pyrit.backend.models.configuration import (
     ConfigurationFileContent,
@@ -19,7 +20,20 @@
 from pyrit.backend.services.configuration_file_service import ConfigurationFileService
 from pyrit.backend.services.environment_file_service import EnvironmentFileService
 
-router = APIRouter(prefix="/config", tags=["config"])
+
+def _require_admin(request: Request) -> None:
+    """Require an administrator when authentication is enabled."""
+    user = getattr(request.state, "user", None)
+    if user is None:
+        return
+    if not isinstance(user, AuthenticatedUser) or not user.is_admin:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Administrator access is required",
+        )
+
+
+router = APIRouter(prefix="/config", tags=["config"], dependencies=[Depends(_require_admin)])
 
 
 def _get_configuration_file_service(request: Request) -> ConfigurationFileService:
diff --git a/tests/unit/backend/test_auth_middleware.py b/tests/unit/backend/test_auth_middleware.py
index 345d37738b..380bc97745 100644
--- a/tests/unit/backend/test_auth_middleware.py
+++ b/tests/unit/backend/test_auth_middleware.py
@@ -13,11 +13,12 @@
 from pyrit.backend.middleware.auth import AuthenticatedUser, AuthenticationError, EntraAuthMiddleware
 
 
-def _make_middleware(*, allowed_group_ids: str = "allowed-group") -> EntraAuthMiddleware:
+def _make_middleware(*, allowed_group_ids: str = "allowed-group", admin_group_id: str = "") -> EntraAuthMiddleware:
     environment = {
         "ENTRA_TENANT_ID": "test-tenant",
         "ENTRA_CLIENT_ID": "test-client",
         "ENTRA_ALLOWED_GROUP_IDS": allowed_group_ids,
+        "ENTRA_ADMIN_GROUP_ID": admin_group_id,
     }
     with patch.dict("os.environ", environment, clear=False):
         return EntraAuthMiddleware(MagicMock())
@@ -86,6 +87,23 @@ async def test_authenticate_with_graph_resolves_groups_when_restricted() -> None
     assert client.post.call_args.kwargs["json"] == {"groupIds": ["group-1"]}
 
 
+async def test_authenticate_with_graph_marks_admin_membership() -> None:
+    middleware = _make_middleware(allowed_group_ids="allowed-group", admin_group_id="admin-group")
+    client = AsyncMock(spec=httpx.AsyncClient)
+    client.get.return_value = _response(
+        status_code=200,
+        data={"id": "admin-1", "displayName": "Admin User", "mail": "admin@example.com"},
+    )
+    client.post.return_value = _response(status_code=200, data={"value": ["admin-group"]})
+
+    with patch("pyrit.backend.middleware.auth.httpx.AsyncClient", return_value=_client_context(client)):
+        result = await middleware._authenticate_with_graph_async(token="graph-token")
+
+    assert result.is_admin is True
+    assert middleware._is_authorized(result) is True
+    assert client.post.call_args.kwargs["json"] == {"groupIds": ["admin-group", "allowed-group"]}
+
+
 @pytest.mark.parametrize(
     "graph_status, expected_status",
     [(401, 401), (403, 403), (429, 503), (500, 503)],
@@ -196,10 +214,16 @@ async def test_authenticate_request_denies_and_does_not_cache_unauthorized_user(
 
 
 async def test_authenticate_request_caches_successful_authorization() -> None:
-    middleware = _make_middleware()
+    middleware = _make_middleware(admin_group_id="admin-group")
     request = MagicMock()
     request.headers = {"Authorization": "bearer graph-token"}
-    user = AuthenticatedUser(oid="user-1", name="Test User", email="test@example.com", groups=["allowed-group"])
+    user = AuthenticatedUser(
+        oid="user-1",
+        name="Test User",
+        email="test@example.com",
+        groups=["allowed-group", "admin-group"],
+        is_admin=True,
+    )
 
     with patch.object(
         middleware,
@@ -212,6 +236,7 @@ async def test_authenticate_request_caches_successful_authorization() -> None:
 
     assert first_result == user
     assert second_result == user
+    assert second_result.is_admin is True
     authenticate.assert_awaited_once_with(token="graph-token")
 
 
diff --git a/tests/unit/backend/test_configuration_routes.py b/tests/unit/backend/test_configuration_routes.py
index b282d2105c..8e321aa009 100644
--- a/tests/unit/backend/test_configuration_routes.py
+++ b/tests/unit/backend/test_configuration_routes.py
@@ -11,7 +11,12 @@
 from fastapi.testclient import TestClient
 
 from pyrit.backend.main import app
-from pyrit.backend.routes.configuration import _get_configuration_file_service, _get_environment_file_service
+from pyrit.backend.middleware.auth import AuthenticatedUser
+from pyrit.backend.routes.configuration import (
+    _get_configuration_file_service,
+    _get_environment_file_service,
+    _require_admin,
+)
 from pyrit.backend.services.configuration_file_service import ConfigurationFileService
 from pyrit.backend.services.environment_file_service import EnvironmentFileService
 
@@ -49,6 +54,36 @@ def test_get_environment_file_service_raises_when_unavailable() -> None:
     assert exc_info.value.status_code == status.HTTP_503_SERVICE_UNAVAILABLE
 
 
+def test_require_admin_allows_admin_user() -> None:
+    """Test that authenticated administrators can use configuration routes."""
+    request = MagicMock()
+    request.state.user = AuthenticatedUser(
+        oid="admin-1",
+        name="Admin User",
+        email="admin@example.com",
+        groups=["admin-group"],
+        is_admin=True,
+    )
+
+    _require_admin(request)
+
+
+def test_require_admin_rejects_non_admin_user() -> None:
+    """Test that authenticated non-administrators cannot use configuration routes."""
+    request = MagicMock()
+    request.state.user = AuthenticatedUser(
+        oid="user-1",
+        name="Test User",
+        email="test@example.com",
+        groups=["allowed-group"],
+    )
+
+    with pytest.raises(HTTPException, match="Administrator access is required") as exc_info:
+        _require_admin(request)
+
+    assert exc_info.value.status_code == status.HTTP_403_FORBIDDEN
+
+
 def test_get_configuration_file_returns_content(client: TestClient) -> None:
     """Test reading configuration contents through the API."""
     service = MagicMock(spec=ConfigurationFileService)

From c9e14e64d95a48daa37b13d40235471d47f51dbc Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Thu, 27 Aug 2026 16:04:50 -0700
Subject: [PATCH 18/24] fix: address configuration review feedback

---
 frontend/e2e/accessibility.spec.ts            | 14 +++----
 frontend/e2e/chat.spec.ts                     |  8 ++--
 frontend/e2e/config.spec.ts                   |  4 +-
 frontend/e2e/converters.spec.ts               |  2 +-
 frontend/e2e/errors.spec.ts                   |  2 +-
 frontend/e2e/flows.spec.ts                    |  4 +-
 frontend/e2e/onboarding-tour.spec.ts          |  8 ++--
 frontend/e2e/touch-targets.spec.ts            |  8 ++--
 .../components/Sidebar/Navigation.test.tsx    |  8 ++--
 .../src/components/Sidebar/Navigation.tsx     |  4 +-
 frontend/src/components/Tour/tourSteps.ts     |  8 ++--
 frontend/src/hooks/useTour.test.ts            |  4 +-
 pyrit/backend/main.py                         | 12 ++----
 pyrit/backend/middleware/auth.py              | 13 ++++++
 pyrit/backend/routes/configuration.py         | 24 ++++-------
 pyrit/backend/routes/initializers.py          |  6 ++-
 .../services/configuration_file_service.py    | 40 ++++++++++++++++++-
 .../components/initializer_registry.py        |  6 +--
 .../test_configuration_file_service.py        | 26 ++++++++++++
 .../unit/backend/test_configuration_routes.py | 19 +++++++--
 .../unit/backend/test_initializer_service.py  | 31 +++++++++++++-
 tests/unit/backend/test_main.py               | 14 +++----
 .../registry/test_initializer_registry.py     |  8 ++--
 23 files changed, 187 insertions(+), 86 deletions(-)

diff --git a/frontend/e2e/accessibility.spec.ts b/frontend/e2e/accessibility.spec.ts
index b4e437eab4..6911d6409a 100644
--- a/frontend/e2e/accessibility.spec.ts
+++ b/frontend/e2e/accessibility.spec.ts
@@ -121,7 +121,7 @@ test.describe("Accessibility", () => {
     });
 
     // Navigate to config, set active, return to chat so input is enabled
-    await page.getByTitle("Configuration").click();
+    await page.getByTitle("Targets").click();
     await expect(page.getByText("Target Configuration")).toBeVisible({ timeout: 10000 });
     const setActiveBtn = page.getByRole("button", { name: /set active/i });
     await expect(setActiveBtn).toBeVisible({ timeout: 5000 });
@@ -146,8 +146,8 @@ test.describe("Accessibility", () => {
     const chatBtn = page.getByTitle("Chat");
     await expect(chatBtn).toBeVisible();
 
-    // Configuration button
-    const configBtn = page.getByTitle("Configuration");
+    // Targets button
+    const configBtn = page.getByTitle("Targets");
     await expect(configBtn).toBeVisible();
 
     // Theme toggle button (now a menu trigger with "Theme: <mode>" title)
@@ -220,7 +220,7 @@ test.describe("Accessibility", () => {
     });
 
     // Navigate to config, set active, return to chat so input is enabled
-    await page.getByTitle("Configuration").click();
+    await page.getByTitle("Targets").click();
     await expect(page.getByText("Target Configuration")).toBeVisible({ timeout: 10000 });
     const setActiveBtn = page.getByRole("button", { name: /set active/i });
     await expect(setActiveBtn).toBeVisible({ timeout: 5000 });
@@ -266,7 +266,7 @@ test.describe("Accessibility", () => {
     });
 
     // Navigate to config
-    await page.getByTitle("Configuration").click();
+    await page.getByTitle("Targets").click();
     await expect(page.getByText("Target Configuration")).toBeVisible();
 
     // Table should exist
@@ -289,7 +289,7 @@ test.describe("Accessibility", () => {
 
     const views = [
       { button: "Attack History", heading: "Attack History" },
-      { button: "Configuration", heading: "Target Configuration" },
+      { button: "Targets", heading: "Target Configuration" },
       { button: "Chat", heading: "Chat" },
     ];
 
@@ -334,7 +334,7 @@ test.describe("Accessibility", () => {
         });
       });
 
-      await page.getByRole("button", { name: "Configuration" }).click();
+      await page.getByRole("button", { name: "Targets" }).click();
       await expect(
         page.getByRole("heading", { level: 1, name: "Target Configuration" })
       ).toBeVisible();
diff --git a/frontend/e2e/chat.spec.ts b/frontend/e2e/chat.spec.ts
index 87879faeb4..569f9fb77b 100644
--- a/frontend/e2e/chat.spec.ts
+++ b/frontend/e2e/chat.spec.ts
@@ -130,8 +130,8 @@ async function mockBackendAPIs(page: Page) {
 
 /** Navigate to config, set the mock target as active, then return to chat. */
 async function activateMockTarget(page: Page) {
-  // Click Configuration button in sidebar
-  await page.getByTitle("Configuration").click();
+  // Click Targets button in sidebar
+  await page.getByTitle("Targets").click();
   await expect(page.getByText("Target Configuration")).toBeVisible({ timeout: 10000 });
 
   // Set the mock target active
@@ -853,7 +853,7 @@ test.describe("Target type scenarios", () => {
     });
 
     await page.goto("/");
-    await page.getByTitle("Configuration").click();
+    await page.getByTitle("Targets").click();
     await expect(page.getByText("Target Configuration")).toBeVisible({ timeout: 10000 });
 
     await expect(page.locator("table").getByText("OpenAIChatTarget")).toBeVisible();
@@ -878,7 +878,7 @@ test.describe("Target type scenarios", () => {
     });
 
     await page.goto("/");
-    await page.getByTitle("Configuration").click();
+    await page.getByTitle("Targets").click();
     await expect(page.getByText("dall-e-3")).toBeVisible({ timeout: 10000 });
 
     // Activate the DALL-E target (second row)
diff --git a/frontend/e2e/config.spec.ts b/frontend/e2e/config.spec.ts
index e47b071db6..a6070ee896 100644
--- a/frontend/e2e/config.spec.ts
+++ b/frontend/e2e/config.spec.ts
@@ -156,7 +156,7 @@ async function expectWithin(
 /** Navigate to the config view. */
 async function goToConfig(page: Page) {
   await page.goto("/");
-  await page.getByTitle("Configuration").click();
+  await page.getByTitle("Targets").click();
   await expect(page.getByText("Target Configuration")).toBeVisible({ timeout: 10000 });
 }
 
@@ -552,7 +552,7 @@ test.describe("Target Config ↔ Chat Navigation", () => {
     await expect(page.getByTestId("no-target-banner")).toBeVisible();
 
     // Go to config, set a target
-    await page.getByTitle("Configuration").click();
+    await page.getByTitle("Targets").click();
     await expect(page.getByText("gpt-4o")).toBeVisible({ timeout: 10000 });
     await page.getByRole("button", { name: /set active/i }).first().click();
 
diff --git a/frontend/e2e/converters.spec.ts b/frontend/e2e/converters.spec.ts
index b64ced7e7e..81111c40c2 100644
--- a/frontend/e2e/converters.spec.ts
+++ b/frontend/e2e/converters.spec.ts
@@ -409,7 +409,7 @@ async function mockBackendAPIs(page: Page) {
 
 /** Navigate to config, set the mock target as active, then return to chat. */
 async function activateMockTarget(page: Page) {
-  await page.getByTitle("Configuration").click();
+  await page.getByTitle("Targets").click();
   await expect(page.getByText("Target Configuration")).toBeVisible({ timeout: 10000 });
 
   const setActiveBtn = page.getByRole("button", { name: /set active/i });
diff --git a/frontend/e2e/errors.spec.ts b/frontend/e2e/errors.spec.ts
index 84afa9953c..54d99b7ed9 100644
--- a/frontend/e2e/errors.spec.ts
+++ b/frontend/e2e/errors.spec.ts
@@ -168,7 +168,7 @@ async function mockAllAPIs(
 
 /** Navigate to config, set mock target active, return to chat. */
 async function activateMockTarget(page: Page) {
-  await page.getByTitle("Configuration").click();
+  await page.getByTitle("Targets").click();
   await expect(page.getByText("Target Configuration")).toBeVisible({
     timeout: 10000,
   });
diff --git a/frontend/e2e/flows.spec.ts b/frontend/e2e/flows.spec.ts
index 249e9cd5cf..646fd3c402 100644
--- a/frontend/e2e/flows.spec.ts
+++ b/frontend/e2e/flows.spec.ts
@@ -196,12 +196,12 @@ async function createConversation(
   return body.conversation_id;
 }
 
-/** Activate an exact target instance via the Configuration view. */
+/** Activate an exact target instance via the Targets view. */
 async function activateTarget(
   page: Page,
   targetRegistryName: string,
 ): Promise<void> {
-  await page.getByTitle("Configuration").click();
+  await page.getByTitle("Targets").click();
   await expect(page.getByText("Target Configuration")).toBeVisible({ timeout: 10_000 });
   const row = page.getByTestId(`target-row-${targetRegistryName}`);
   await expect(row).toBeVisible({ timeout: 10_000 });
diff --git a/frontend/e2e/onboarding-tour.spec.ts b/frontend/e2e/onboarding-tour.spec.ts
index fc971ef2a1..4f0b03bf7f 100644
--- a/frontend/e2e/onboarding-tour.spec.ts
+++ b/frontend/e2e/onboarding-tour.spec.ts
@@ -14,7 +14,7 @@ test.describe("Onboarding tour", () => {
     await dialog.getByRole("button", { name: "Next", exact: true }).click();
 
     await expect(dialog).toContainText(
-      "target selection happens in Configuration"
+      "target selection happens in Targets"
     );
     await expect(dialog).toContainText("choose Configure a target");
     await expect(dialog).toContainText("use Set Active there");
@@ -29,7 +29,7 @@ test.describe("Onboarding tour", () => {
     ).toBeVisible();
     await expect(dialog).toBeVisible();
     await expect(dialog).toContainText(
-      "target selection happens in Configuration"
+      "target selection happens in Targets"
     );
 
     await dialog.getByRole("button", { name: "Back", exact: true }).click();
@@ -91,7 +91,7 @@ test.describe("Onboarding tour", () => {
 
     await page.goto("/");
     await page
-      .getByRole("button", { name: "Configuration", exact: true })
+      .getByRole("button", { name: "Targets", exact: true })
       .click();
     await expect(
       page.getByRole("heading", { name: "Target Configuration" })
@@ -106,7 +106,7 @@ test.describe("Onboarding tour", () => {
     await dialog.getByRole("button", { name: "Next", exact: true }).click();
 
     await expect(dialog).toContainText("target currently active for Chat");
-    await expect(dialog).toContainText("use Set Active in Configuration");
+    await expect(dialog).toContainText("use Set Active in Targets");
     await expect(page.locator('[data-tour="target-card"]')).toBeVisible();
 
     await page
diff --git a/frontend/e2e/touch-targets.spec.ts b/frontend/e2e/touch-targets.spec.ts
index ecc0a13a05..a6d7517b4a 100644
--- a/frontend/e2e/touch-targets.spec.ts
+++ b/frontend/e2e/touch-targets.spec.ts
@@ -343,7 +343,7 @@ async function expectNoDocumentOverflow(page: Page): Promise<void> {
 }
 
 async function startChatWithMessages(page: Page): Promise<void> {
-  await page.getByRole("button", { name: "Configuration", exact: true }).click();
+  await page.getByRole("button", { name: "Targets", exact: true }).click();
   await expect(page.getByText("gpt-4o-mobile")).toBeVisible();
   await page.getByRole("button", { name: "Set Active" }).first().click();
   await page.getByRole("button", { name: "Chat", exact: true }).click();
@@ -363,7 +363,7 @@ test.beforeEach(async ({ page }) => {
 test.describe("Mobile touch targets", () => {
   test.use({ viewport: MOBILE_VIEWPORT, hasTouch: true });
 
-  test("keeps Home, Configuration, and History controls at least 44px", async ({
+  test("keeps Home, Targets, and History controls at least 44px", async ({
     page,
   }) => {
     await page.goto("/");
@@ -385,7 +385,7 @@ test.describe("Mobile touch targets", () => {
     await expectNoDocumentOverflow(page);
 
     await page
-      .getByRole("button", { name: "Configuration", exact: true })
+      .getByRole("button", { name: "Targets", exact: true })
       .click();
     await expect(page.getByText("gpt-4o-mobile")).toBeVisible();
 
@@ -549,7 +549,7 @@ test("preserves compact desktop controls and existing sidebar dimensions", async
   );
 
   await page
-    .getByRole("button", { name: "Configuration", exact: true })
+    .getByRole("button", { name: "Targets", exact: true })
     .click();
   await expect(page.getByText("gpt-4o-mobile")).toBeVisible();
   await expectCompactDesktopTarget(
diff --git a/frontend/src/components/Sidebar/Navigation.test.tsx b/frontend/src/components/Sidebar/Navigation.test.tsx
index a0397a8c8d..4537ccf021 100644
--- a/frontend/src/components/Sidebar/Navigation.test.tsx
+++ b/frontend/src/components/Sidebar/Navigation.test.tsx
@@ -61,10 +61,10 @@ describe("Navigation", () => {
     expect(screen.getByRole("button", { name: "Chat" })).toBeInTheDocument();
   });
 
-  it("renders the configuration button", () => {
+  it("renders the targets button", () => {
     renderWithProvider(<Navigation {...defaultProps} />);
     expect(
-      screen.getByRole("button", { name: "Configuration" })
+      screen.getByRole("button", { name: "Targets" })
     ).toBeInTheDocument();
   });
 
@@ -79,14 +79,14 @@ describe("Navigation", () => {
     expect(onNavigate).toHaveBeenCalledWith("chat");
   });
 
-  it("calls onNavigate with 'config' when config button is clicked", async () => {
+  it("calls onNavigate with 'config' when targets button is clicked", async () => {
     const user = userEvent.setup();
     const onNavigate = jest.fn();
     renderWithProvider(
       <Navigation {...defaultProps} onNavigate={onNavigate} />
     );
 
-    await user.click(screen.getByRole("button", { name: "Configuration" }));
+    await user.click(screen.getByRole("button", { name: "Targets" }));
     expect(onNavigate).toHaveBeenCalledWith("config");
   });
 
diff --git a/frontend/src/components/Sidebar/Navigation.tsx b/frontend/src/components/Sidebar/Navigation.tsx
index 24eeeaca17..818786c488 100644
--- a/frontend/src/components/Sidebar/Navigation.tsx
+++ b/frontend/src/components/Sidebar/Navigation.tsx
@@ -100,8 +100,8 @@ export default function Navigation({ currentView, onNavigate, onOpenFeedback }:
           data-active={currentView === 'config'}
           appearance="subtle"
           icon={<SettingsRegular />}
-          title="Configuration"
-          aria-label="Configuration"
+          title="Targets"
+          aria-label="Targets"
           aria-current={currentView === 'config' ? 'page' : undefined}
           onClick={() => onNavigate('config')}
         />
diff --git a/frontend/src/components/Tour/tourSteps.ts b/frontend/src/components/Tour/tourSteps.ts
index ca7deea24e..eec7fe4704 100644
--- a/frontend/src/components/Tour/tourSteps.ts
+++ b/frontend/src/components/Tour/tourSteps.ts
@@ -18,7 +18,7 @@ export function createTourSteps(hasActiveTarget: boolean): TourStep[] {
       target: '[data-tour="sidebar-nav"]',
       content:
         'Ahoy! Welcome to Co-PyRIT! This is your main navigation panel. Home is your dashboard, Chat is where you send prompts, ' +
-        'History tracks past attacks, and Configuration is where you set up targets. Feel free to try clicking between these views!',
+        'History tracks past attacks, and Targets is where you set up targets. Feel free to try clicking between these views!',
       placement: 'right-start',
       skipBeacon: true,
       viewRequired: 'home',
@@ -36,9 +36,9 @@ export function createTourSteps(hasActiveTarget: boolean): TourStep[] {
       target: '[data-tour="target-card"]',
       content: hasActiveTarget
         ? 'This card shows the target currently active for Chat. To switch targets after the tour, choose Manage targets ' +
-          'and use Set Active in Configuration.'
+          'and use Set Active in Targets.'
         : 'Targets are the AI endpoints you\'re testing. This card only shows the current target; target selection happens ' +
-          'in Configuration. After the tour, choose Configure a target, then create or choose one and use Set Active there.',
+          'in Targets. After the tour, choose Configure a target, then create or choose one and use Set Active there.',
       placement: 'bottom',
       skipBeacon: true,
       viewRequired: 'home',
@@ -51,7 +51,7 @@ export function createTourSteps(hasActiveTarget: boolean): TourStep[] {
         ? 'With a target active, Chat shows the message composer. Use this Toggle converter panel button to transform text ' +
           'before sending, such as Base64 encoding or translation.'
         : 'Chat needs an active target before the message composer is available. After the tour, choose Configure a target to ' +
-          'create or activate one in Configuration, then return to Chat. The message input and converter control appear once ' +
+          'create or activate one in Targets, then return to Chat. The message input and converter control appear once ' +
           'a target is active.',
       placement: 'bottom',
       skipBeacon: true,
diff --git a/frontend/src/hooks/useTour.test.ts b/frontend/src/hooks/useTour.test.ts
index 6864076ebb..913a331137 100644
--- a/frontend/src/hooks/useTour.test.ts
+++ b/frontend/src/hooks/useTour.test.ts
@@ -66,7 +66,7 @@ describe('useTour', () => {
     const { result } = renderHook(() => useTour(onNavigate, true, 'home', false))
     const steps = result.current.tourProps.steps
 
-    expect(steps[2].content).toContain('target selection happens in Configuration')
+    expect(steps[2].content).toContain('target selection happens in Targets')
     expect(steps[2].content).toContain('choose Configure a target')
     expect(steps[2].content).toContain('use Set Active there')
     expect(steps[3].target).toBe('[data-tour="chat-prerequisite"]')
@@ -80,7 +80,7 @@ describe('useTour', () => {
 
     expect(steps[2].content).toContain('target currently active for Chat')
     expect(steps[2].content).toContain('after the tour')
-    expect(steps[2].content).toContain('use Set Active in Configuration')
+    expect(steps[2].content).toContain('use Set Active in Targets')
     expect(steps[3].target).toBe('[data-tour="converter-toggle"]')
     expect(steps[3].content).toContain('Chat shows the message composer')
     expect(steps[3].content).toContain('Toggle converter panel')
diff --git a/pyrit/backend/main.py b/pyrit/backend/main.py
index d39b797abb..31bb8a9e07 100644
--- a/pyrit/backend/main.py
+++ b/pyrit/backend/main.py
@@ -55,18 +55,14 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
     Initialize PyRIT on startup using the config file, then yield.
 
     Config resolution order:
-    1. ``PYRIT_CONFIG_FILE`` local path or Azure Blob URI, used as a self-contained config
-    2. ``~/.pyrit/.pyrit_conf`` when no explicit source is set
-    3. Built-in defaults when neither source exists
+    1. Built-in defaults
+    2. ``~/.pyrit/.pyrit_conf`` when present
+    3. ``PYRIT_CONFIG_FILE`` local path or Azure Blob URI when set
     """
     configuration_file_service = ConfigurationFileService(config_file_value=os.getenv("PYRIT_CONFIG_FILE"))
     app.state.configuration_file_service = configuration_file_service
     async with configuration_file_service.resolve_async() as config_file:
-        config = (
-            ConfigurationLoader.from_yaml_file(config_file)
-            if config_file is not None
-            else ConfigurationLoader.load_with_overrides()
-        )
+        config = ConfigurationLoader.load_with_overrides(config_file=config_file)
     resolved_env_files = config.resolve_env_files()
     app.state.environment_file_service = EnvironmentFileService(
         resolved_env_files=list(resolved_env_files) if resolved_env_files is not None else None,
diff --git a/pyrit/backend/middleware/auth.py b/pyrit/backend/middleware/auth.py
index 39f9453cd3..eedbba8f5f 100644
--- a/pyrit/backend/middleware/auth.py
+++ b/pyrit/backend/middleware/auth.py
@@ -19,6 +19,7 @@
 from typing import Any, ClassVar
 
 import httpx
+from fastapi import HTTPException, status
 from starlette.middleware.base import BaseHTTPMiddleware, RequestResponseEndpoint
 from starlette.requests import Request
 from starlette.responses import JSONResponse, Response
@@ -48,6 +49,18 @@ class AuthenticatedUser:
     is_admin: bool = False
 
 
+def require_admin(request: Request) -> None:
+    """Require an administrator when authentication is enabled."""
+    user = getattr(request.state, "user", None)
+    if user is None:
+        return
+    if not isinstance(user, AuthenticatedUser) or not user.is_admin:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Administrator access is required",
+        )
+
+
 class EntraAuthMiddleware(BaseHTTPMiddleware):
     """Authenticate API requests through Microsoft Graph."""
 
diff --git a/pyrit/backend/routes/configuration.py b/pyrit/backend/routes/configuration.py
index 720fed1e2f..7f4cd50b7d 100644
--- a/pyrit/backend/routes/configuration.py
+++ b/pyrit/backend/routes/configuration.py
@@ -8,7 +8,7 @@
 from azure.core.exceptions import ResourceNotFoundError
 from fastapi import APIRouter, Depends, HTTPException, Request, status
 
-from pyrit.backend.middleware.auth import AuthenticatedUser
+from pyrit.backend.middleware.auth import require_admin
 from pyrit.backend.models.common import ProblemDetail
 from pyrit.backend.models.configuration import (
     ConfigurationFileContent,
@@ -20,20 +20,7 @@
 from pyrit.backend.services.configuration_file_service import ConfigurationFileService
 from pyrit.backend.services.environment_file_service import EnvironmentFileService
 
-
-def _require_admin(request: Request) -> None:
-    """Require an administrator when authentication is enabled."""
-    user = getattr(request.state, "user", None)
-    if user is None:
-        return
-    if not isinstance(user, AuthenticatedUser) or not user.is_admin:
-        raise HTTPException(
-            status_code=status.HTTP_403_FORBIDDEN,
-            detail="Administrator access is required",
-        )
-
-
-router = APIRouter(prefix="/config", tags=["config"], dependencies=[Depends(_require_admin)])
+router = APIRouter(prefix="/config", tags=["config"], dependencies=[Depends(require_admin)])
 
 
 def _get_configuration_file_service(request: Request) -> ConfigurationFileService:
@@ -93,7 +80,10 @@ async def get_configuration_file(  # pyrit-async-suffix-exempt
 @router.put(
     "",
     response_model=ConfigurationFileContent,
-    responses={404: {"model": ProblemDetail, "description": "Configuration file not found"}},
+    responses={
+        400: {"model": ProblemDetail, "description": "Invalid configuration file"},
+        404: {"model": ProblemDetail, "description": "Configuration file not found"},
+    },
 )
 async def update_configuration_file(  # pyrit-async-suffix-exempt
     body: UpdateConfigurationFileRequest,
@@ -113,6 +103,8 @@ async def update_configuration_file(  # pyrit-async-suffix-exempt
         await service.update_async(body.content)
     except (FileNotFoundError, ResourceNotFoundError) as exc:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Configuration file not found") from exc
+    except ValueError as exc:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(exc)) from exc
     return ConfigurationFileContent(content=body.content, source=service.source)
 
 
diff --git a/pyrit/backend/routes/initializers.py b/pyrit/backend/routes/initializers.py
index 5f4e354e5d..bbf46a830b 100644
--- a/pyrit/backend/routes/initializers.py
+++ b/pyrit/backend/routes/initializers.py
@@ -18,8 +18,9 @@
     DELETE /api/initializers/{name}         — unregister an initializer
 """
 
-from fastapi import APIRouter, HTTPException, Query, Request, status
+from fastapi import APIRouter, Depends, HTTPException, Query, Request, status
 
+from pyrit.backend.middleware.auth import require_admin
 from pyrit.backend.models.common import ProblemDetail
 from pyrit.backend.models.initializers import (
     ApplyInitializerRequest,
@@ -253,6 +254,7 @@ async def apply_initializer(  # pyrit-async-suffix-exempt
 @router.get(
     "/custom",
     response_model=CustomInitializerListResponse,
+    dependencies=[Depends(require_admin)],
 )
 async def list_custom_initializers(request: Request) -> CustomInitializerListResponse:  # pyrit-async-suffix-exempt
     """
@@ -298,6 +300,7 @@ async def get_initializer(initializer_name: str) -> RegisteredInitializer:  # py
     "",
     response_model=RegisteredInitializer,
     status_code=status.HTTP_201_CREATED,
+    dependencies=[Depends(require_admin)],
     responses={
         403: {"model": ProblemDetail, "description": "Custom initializer operations disabled"},
         409: {"model": ProblemDetail, "description": "Initializer name already registered"},
@@ -335,6 +338,7 @@ async def register_initializer(  # pyrit-async-suffix-exempt
 @router.delete(
     "/{initializer_name}",
     status_code=status.HTTP_204_NO_CONTENT,
+    dependencies=[Depends(require_admin)],
     responses={
         400: {"model": ProblemDetail, "description": "Cannot remove built-in initializer"},
         403: {"model": ProblemDetail, "description": "Custom initializer operations disabled"},
diff --git a/pyrit/backend/services/configuration_file_service.py b/pyrit/backend/services/configuration_file_service.py
index ee287cc58b..a3a6f212e2 100644
--- a/pyrit/backend/services/configuration_file_service.py
+++ b/pyrit/backend/services/configuration_file_service.py
@@ -4,6 +4,7 @@
 """Read, update, and locally materialize the backend configuration file."""
 
 import asyncio
+import os
 import tempfile
 from collections.abc import AsyncGenerator
 from contextlib import asynccontextmanager
@@ -11,6 +12,7 @@
 from urllib.parse import parse_qs, urlparse
 
 import aiofiles
+import yaml
 
 from pyrit.setup.configuration_loader import ConfigurationLoader
 
@@ -76,6 +78,40 @@ def _write_temporary_config_file(*, content: bytes, suffix: str) -> Path:
         return Path(temporary_file.name)
 
 
+def _validate_configuration_content(content: str) -> None:
+    """Validate YAML configuration content without executing initializers."""
+    try:
+        yaml_data = yaml.safe_load(content)
+    except yaml.YAMLError as exc:
+        raise ValueError(f"Invalid YAML configuration: {exc}") from exc
+    if not isinstance(yaml_data, dict):
+        raise ValueError("Configuration content must be a non-empty YAML mapping.")
+    try:
+        ConfigurationLoader.from_dict(yaml_data)
+    except (TypeError, ValueError) as exc:
+        raise ValueError(f"Invalid configuration: {exc}") from exc
+
+
+def _replace_local_config_file(*, path: Path, content: str) -> None:
+    """Atomically replace a local configuration file."""
+    temporary_path: Path | None = None
+    try:
+        with tempfile.NamedTemporaryFile(
+            mode="w",
+            encoding="utf-8",
+            dir=path.parent,
+            prefix=f".{path.name}.",
+            suffix=".tmp",
+            delete=False,
+        ) as temporary_file:
+            temporary_file.write(content)
+            temporary_path = Path(temporary_file.name)
+        os.replace(temporary_path, path)
+    finally:
+        if temporary_path is not None:
+            temporary_path.unlink(missing_ok=True)
+
+
 class ConfigurationFileService:
     """Manage the configuration source used by the backend."""
 
@@ -117,6 +153,7 @@ async def _read_source_async(self) -> str:
 
     async def update_async(self, content: str) -> None:
         """Replace the current configuration contents."""
+        _validate_configuration_content(content)
         await self._write_source_async(content)
 
     async def _write_source_async(self, content: str) -> str:
@@ -129,8 +166,7 @@ async def _write_source_async(self, content: str) -> str:
         if _is_azure_blob_uri(self._source):
             await _upload_blob_config_async(blob_uri=self._source, content=content.encode("utf-8"))
         else:
-            async with aiofiles.open(self._source, mode="w", encoding="utf-8") as config_file:
-                await config_file.write(content)
+            await asyncio.to_thread(_replace_local_config_file, path=Path(self._source), content=content)
         return content
 
     @asynccontextmanager
diff --git a/pyrit/registry/components/initializer_registry.py b/pyrit/registry/components/initializer_registry.py
index 8d37bed2cb..733d8b9f6f 100644
--- a/pyrit/registry/components/initializer_registry.py
+++ b/pyrit/registry/components/initializer_registry.py
@@ -399,16 +399,12 @@ def register_from_content(self, *, name: str, script_content: str) -> str:
         if name in self._classes:
             raise ValueError(f"Initializer '{name}' is already registered. Unregister it first to replace it.")
 
+        discovered = self._load_custom_initializer_class(name=name, script_content=script_content)
         storage = self._get_custom_storage()
         try:
             storage.save_script(name=name, content=script_content)
         except OSError as error:
             raise ValueError(f"Failed to write initializer script: {error}") from error
-        try:
-            discovered = self._load_custom_initializer_class(name=name, script_content=script_content)
-        except Exception:
-            storage.delete_script(name)
-            raise
 
         self.register_class(discovered, name=name)
         logger.info(f"Registered custom initializer: {name} ({discovered.__name__})")
diff --git a/tests/unit/backend/test_configuration_file_service.py b/tests/unit/backend/test_configuration_file_service.py
index 1b85ed2990..b6da1ecd67 100644
--- a/tests/unit/backend/test_configuration_file_service.py
+++ b/tests/unit/backend/test_configuration_file_service.py
@@ -6,6 +6,8 @@
 from pathlib import Path
 from unittest.mock import AsyncMock, MagicMock, patch
 
+import pytest
+
 from pyrit.backend.services.configuration_file_service import (
     ConfigurationFileService,
     _download_blob_config_async,
@@ -27,6 +29,30 @@ async def test_configuration_file_service_reads_and_updates_local_file(tmp_path:
     assert service.source == str(config_path)
 
 
+async def test_configuration_file_service_rejects_invalid_content_before_write(tmp_path: Path) -> None:
+    """Test that invalid YAML does not replace the existing configuration."""
+    config_path = tmp_path / "config.yaml"
+    config_path.write_text("operator: before\n", encoding="utf-8")
+    service = ConfigurationFileService(config_file_value=str(config_path))
+
+    with pytest.raises(ValueError, match="Invalid YAML configuration"):
+        await service.update_async("operator: [unterminated\n")
+
+    assert config_path.read_text(encoding="utf-8") == "operator: before\n"
+
+
+async def test_configuration_file_service_rejects_semantically_invalid_content_before_write(tmp_path: Path) -> None:
+    """Test that loader validation failures do not replace the existing configuration."""
+    config_path = tmp_path / "config.yaml"
+    config_path.write_text("operator: before\n", encoding="utf-8")
+    service = ConfigurationFileService(config_file_value=str(config_path))
+
+    with pytest.raises(ValueError, match="env_akv_strict must be a bool"):
+        await service.update_async("env_akv_strict: invalid\n")
+
+    assert config_path.read_text(encoding="utf-8") == "operator: before\n"
+
+
 async def test_blob_helpers_use_sas_authentication() -> None:
     """Test downloading and uploading directly with a SAS-authenticated blob URI."""
     blob_uri = "https://account.blob.core.windows.net/config/config.yaml?sig=secret"
diff --git a/tests/unit/backend/test_configuration_routes.py b/tests/unit/backend/test_configuration_routes.py
index 8e321aa009..ffd4b31a6e 100644
--- a/tests/unit/backend/test_configuration_routes.py
+++ b/tests/unit/backend/test_configuration_routes.py
@@ -11,11 +11,10 @@
 from fastapi.testclient import TestClient
 
 from pyrit.backend.main import app
-from pyrit.backend.middleware.auth import AuthenticatedUser
+from pyrit.backend.middleware.auth import AuthenticatedUser, require_admin
 from pyrit.backend.routes.configuration import (
     _get_configuration_file_service,
     _get_environment_file_service,
-    _require_admin,
 )
 from pyrit.backend.services.configuration_file_service import ConfigurationFileService
 from pyrit.backend.services.environment_file_service import EnvironmentFileService
@@ -65,7 +64,7 @@ def test_require_admin_allows_admin_user() -> None:
         is_admin=True,
     )
 
-    _require_admin(request)
+    require_admin(request)
 
 
 def test_require_admin_rejects_non_admin_user() -> None:
@@ -79,7 +78,7 @@ def test_require_admin_rejects_non_admin_user() -> None:
     )
 
     with pytest.raises(HTTPException, match="Administrator access is required") as exc_info:
-        _require_admin(request)
+        require_admin(request)
 
     assert exc_info.value.status_code == status.HTTP_403_FORBIDDEN
 
@@ -134,6 +133,18 @@ def test_update_configuration_file_returns_404_when_blob_missing(client: TestCli
     assert response.status_code == status.HTTP_404_NOT_FOUND
 
 
+def test_update_configuration_file_returns_400_for_invalid_content(client: TestClient) -> None:
+    """Test that invalid configuration content produces a client error."""
+    service = MagicMock(spec=ConfigurationFileService)
+    service.read_async = AsyncMock()
+    service.update_async = AsyncMock(side_effect=ValueError("Invalid YAML configuration"))
+    with patch("pyrit.backend.routes.configuration._get_configuration_file_service", return_value=service):
+        response = client.put("/api/config", json={"content": "operator: [unterminated\n"})
+
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+    assert response.json()["detail"] == "Invalid YAML configuration"
+
+
 def test_list_environment_files_returns_configured_files(client: TestClient) -> None:
     """Test listing environment files through the API."""
     item = {
diff --git a/tests/unit/backend/test_initializer_service.py b/tests/unit/backend/test_initializer_service.py
index 5a9e462d46..5c741c1a31 100644
--- a/tests/unit/backend/test_initializer_service.py
+++ b/tests/unit/backend/test_initializer_service.py
@@ -9,10 +9,11 @@
 from unittest.mock import AsyncMock, MagicMock, patch
 
 import pytest
-from fastapi import status
+from fastapi import HTTPException, status
 from fastapi.testclient import TestClient
 
 from pyrit.backend.main import app
+from pyrit.backend.middleware.auth import require_admin
 from pyrit.backend.models.common import PaginationInfo
 from pyrit.backend.models.initializers import (
     ApplyInitializerResponse,
@@ -890,6 +891,34 @@ async def test_unregister_initializer_removes_runtime_registration(self) -> None
 class TestCustomInitializerRoutes:
     """Tests for runtime custom initializer routes."""
 
+    @pytest.mark.parametrize(
+        ("method", "path", "json_body"),
+        [
+            ("GET", "/api/initializers/custom", None),
+            ("POST", "/api/initializers", {"name": "custom", "script_content": _SAMPLE_SCRIPT}),
+            ("DELETE", "/api/initializers/custom", None),
+        ],
+    )
+    def test_custom_initializer_routes_require_admin(
+        self,
+        client_with_custom_initializers_enabled: TestClient,
+        method: str,
+        path: str,
+        json_body: dict[str, str] | None,
+    ) -> None:
+        """Test that custom script operations apply the administrator dependency."""
+
+        def reject_non_admin() -> None:
+            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Administrator access is required")
+
+        app.dependency_overrides[require_admin] = reject_non_admin
+        try:
+            response = client_with_custom_initializers_enabled.request(method, path, json=json_body)
+        finally:
+            app.dependency_overrides.pop(require_admin)
+
+        assert response.status_code == status.HTTP_403_FORBIDDEN
+
     def test_list_custom_initializers_uses_read_only_route(
         self, client_with_custom_initializers_enabled: TestClient
     ) -> None:
diff --git a/tests/unit/backend/test_main.py b/tests/unit/backend/test_main.py
index 2bf836f55c..cdf1075a57 100644
--- a/tests/unit/backend/test_main.py
+++ b/tests/unit/backend/test_main.py
@@ -82,13 +82,12 @@ async def test_lifespan_populates_default_labels_from_operator_and_operation(sel
 
             assert app.state.default_labels == {"operator": "alice", "operation": "op-42"}
 
-    async def test_lifespan_reads_explicit_config_without_default_layer(self) -> None:
-        """Test that PYRIT_CONFIG_FILE is loaded without merging the default configuration."""
+    async def test_lifespan_loads_explicit_config_as_override(self) -> None:
+        """Test that PYRIT_CONFIG_FILE overlays the default configuration."""
         fake_config = ConfigurationLoader()
         with (
             patch.dict(os.environ, {"PYRIT_CONFIG_FILE": "/tmp/foo.yaml"}, clear=False),
-            patch.object(ConfigurationLoader, "from_yaml_file", return_value=fake_config) as load_mock,
-            patch.object(ConfigurationLoader, "load_with_overrides") as layered_load_mock,
+            patch.object(ConfigurationLoader, "load_with_overrides", return_value=fake_config) as load_mock,
             patch.object(ConfigurationLoader, "initialize_pyrit_async", new=AsyncMock()),
             patch(
                 "pyrit.backend.main.get_initializer_service",
@@ -101,8 +100,7 @@ async def test_lifespan_reads_explicit_config_without_default_layer(self) -> Non
             async with lifespan(app):
                 pass
 
-            assert str(load_mock.call_args.args[0]).endswith("foo.yaml")
-            layered_load_mock.assert_not_called()
+            assert str(load_mock.call_args.kwargs["config_file"]).endswith("foo.yaml")
 
     async def test_lifespan_configures_custom_initializer_source_from_config(self) -> None:
         """Test that YAML config determines the custom script source."""
@@ -152,7 +150,7 @@ async def test_lifespan_downloads_blob_config_to_temporary_file(self) -> None:
         config_content = b"operator: blob-user\n"
         loaded_path: Path | None = None
 
-        def load_config(config_file: Path) -> ConfigurationLoader:
+        def load_config(*, config_file: Path) -> ConfigurationLoader:
             nonlocal loaded_path
             loaded_path = config_file
             assert config_file.suffix == ".yaml"
@@ -169,7 +167,7 @@ def load_config(config_file: Path) -> ConfigurationLoader:
                 "pyrit.backend.services.configuration_file_service._download_blob_config_async",
                 new=AsyncMock(return_value=config_content),
             ),
-            patch.object(ConfigurationLoader, "from_yaml_file", side_effect=load_config),
+            patch.object(ConfigurationLoader, "load_with_overrides", side_effect=load_config),
             patch.object(ConfigurationLoader, "initialize_pyrit_async", new=AsyncMock()),
             patch(
                 "pyrit.backend.main.get_initializer_service",
diff --git a/tests/unit/registry/test_initializer_registry.py b/tests/unit/registry/test_initializer_registry.py
index 05398667c8..d023c96a93 100644
--- a/tests/unit/registry/test_initializer_registry.py
+++ b/tests/unit/registry/test_initializer_registry.py
@@ -505,10 +505,10 @@ def test_register_from_content_write_failure_raises(lazy_registry):
                 lazy_registry.register_from_content(name="write_fail", script_content=_VALID_SCRIPT)
 
 
-def test_register_from_content_temporary_write_failure_cleans_up_storage(
+def test_register_from_content_temporary_write_failure_does_not_touch_storage(
     lazy_registry: InitializerRegistry,
 ) -> None:
-    """Test that failure to materialize saved source removes the stored script."""
+    """Test that failure to materialize source does not touch persistent storage."""
     storage = MagicMock(spec=CustomInitializerStorage)
     lazy_registry._custom_storage = storage
 
@@ -516,8 +516,8 @@ def test_register_from_content_temporary_write_failure_cleans_up_storage(
         with pytest.raises(ValueError, match="Failed to write initializer script"):
             lazy_registry.register_from_content(name="write_fail", script_content=_VALID_SCRIPT)
 
-    storage.save_script.assert_called_once_with(name="write_fail", content=_VALID_SCRIPT)
-    storage.delete_script.assert_called_once_with("write_fail")
+    storage.save_script.assert_not_called()
+    storage.delete_script.assert_not_called()
 
 
 def test_unregister_and_cleanup_unknown_name_raises(lazy_registry):

From 1fb2d2274fef1ce99c177b3e8d8e83cc5863f1e4 Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Thu, 27 Aug 2026 16:16:00 -0700
Subject: [PATCH 19/24] fix: rename target navigation route

---
 frontend/e2e/accessibility.spec.ts            |  8 ++--
 frontend/e2e/chat.spec.ts                     |  2 +-
 frontend/e2e/config.spec.ts                   | 30 +++++++--------
 frontend/e2e/converters.spec.ts               |  2 +-
 frontend/e2e/errors.spec.ts                   |  2 +-
 frontend/e2e/history.spec.ts                  |  2 +-
 frontend/e2e/onboarding-tour.spec.ts          |  8 ++--
 frontend/src/App.test.tsx                     | 38 ++++++++++++-------
 frontend/src/App.tsx                          |  6 ++-
 frontend/src/components/Chat/ChatWindow.tsx   |  2 +-
 .../components/History/AttackHistory.test.tsx |  2 +-
 .../src/components/History/AttackHistory.tsx  |  2 +-
 frontend/src/components/Home/Home.test.tsx    |  2 +-
 frontend/src/components/Home/Home.tsx         |  2 +-
 .../src/components/Layout/MainLayout.test.tsx |  2 +-
 .../components/Sidebar/Navigation.test.tsx    |  4 +-
 .../src/components/Sidebar/Navigation.tsx     | 14 +++----
 frontend/src/hooks/useTour.test.ts            |  6 +--
 18 files changed, 73 insertions(+), 61 deletions(-)

diff --git a/frontend/e2e/accessibility.spec.ts b/frontend/e2e/accessibility.spec.ts
index 6911d6409a..a47a16d286 100644
--- a/frontend/e2e/accessibility.spec.ts
+++ b/frontend/e2e/accessibility.spec.ts
@@ -120,7 +120,7 @@ test.describe("Accessibility", () => {
       });
     });
 
-    // Navigate to config, set active, return to chat so input is enabled
+    // Navigate to targets, set active, return to chat so input is enabled
     await page.getByTitle("Targets").click();
     await expect(page.getByText("Target Configuration")).toBeVisible({ timeout: 10000 });
     const setActiveBtn = page.getByRole("button", { name: /set active/i });
@@ -219,7 +219,7 @@ test.describe("Accessibility", () => {
       });
     });
 
-    // Navigate to config, set active, return to chat so input is enabled
+    // Navigate to targets, set active, return to chat so input is enabled
     await page.getByTitle("Targets").click();
     await expect(page.getByText("Target Configuration")).toBeVisible({ timeout: 10000 });
     const setActiveBtn = page.getByRole("button", { name: /set active/i });
@@ -239,7 +239,7 @@ test.describe("Accessibility", () => {
     await expect(input).toBeFocused();
   });
 
-  test("should have accessible target table in config view", async ({ page }) => {
+  test("should have accessible target table in targets view", async ({ page }) => {
     // Mock targets API for consistent test
     await page.route(/\/api\/targets/, async (route) => {
       await route.fulfill({
@@ -265,7 +265,7 @@ test.describe("Accessibility", () => {
       });
     });
 
-    // Navigate to config
+    // Navigate to targets
     await page.getByTitle("Targets").click();
     await expect(page.getByText("Target Configuration")).toBeVisible();
 
diff --git a/frontend/e2e/chat.spec.ts b/frontend/e2e/chat.spec.ts
index 569f9fb77b..dd1d30c303 100644
--- a/frontend/e2e/chat.spec.ts
+++ b/frontend/e2e/chat.spec.ts
@@ -128,7 +128,7 @@ async function mockBackendAPIs(page: Page) {
   });
 }
 
-/** Navigate to config, set the mock target as active, then return to chat. */
+/** Navigate to targets, set the mock target as active, then return to chat. */
 async function activateMockTarget(page: Page) {
   // Click Targets button in sidebar
   await page.getByTitle("Targets").click();
diff --git a/frontend/e2e/config.spec.ts b/frontend/e2e/config.spec.ts
index a6070ee896..6115e7ccc4 100644
--- a/frontend/e2e/config.spec.ts
+++ b/frontend/e2e/config.spec.ts
@@ -153,8 +153,8 @@ async function expectWithin(
   );
 }
 
-/** Navigate to the config view. */
-async function goToConfig(page: Page) {
+/** Navigate to the targets view. */
+async function goToTargets(page: Page) {
   await page.goto("/");
   await page.getByTitle("Targets").click();
   await expect(page.getByText("Target Configuration")).toBeVisible({ timeout: 10000 });
@@ -185,7 +185,7 @@ test.describe("Target Configuration Page", () => {
       await route.fulfill(mockTargetsList(SAMPLE_TARGETS));
     });
 
-    await goToConfig(page);
+    await goToTargets(page);
 
     // Table should appear with both targets
     await expect(page.getByText("gpt-4o")).toBeVisible({ timeout: 10000 });
@@ -199,7 +199,7 @@ test.describe("Target Configuration Page", () => {
       await route.fulfill(mockTargetsList([]));
     });
 
-    await goToConfig(page);
+    await goToTargets(page);
 
     await expect(page.getByText("No Targets Configured")).toBeVisible();
     await expect(page.getByRole("button", { name: /create first target/i })).toBeVisible();
@@ -210,7 +210,7 @@ test.describe("Target Configuration Page", () => {
       await route.fulfill({ status: 500, body: "Internal Server Error" });
     });
 
-    await goToConfig(page);
+    await goToTargets(page);
 
     await expect(page.getByText(/error/i)).toBeVisible({ timeout: 10000 });
   });
@@ -220,7 +220,7 @@ test.describe("Target Configuration Page", () => {
       await route.fulfill(mockTargetsList(SAMPLE_TARGETS));
     });
 
-    await goToConfig(page);
+    await goToTargets(page);
     await expect(page.getByText("gpt-4o")).toBeVisible({ timeout: 10000 });
 
     // Both rows should have a "Set Active" button initially
@@ -237,7 +237,7 @@ test.describe("Target Configuration Page", () => {
       await route.fulfill(mockTargetsList([]));
     });
 
-    await goToConfig(page);
+    await goToTargets(page);
 
     // Click the "New Target" button in the header
     await page.getByRole("button", { name: /new target/i }).click();
@@ -257,7 +257,7 @@ test.describe("Target Configuration Page", () => {
       await route.fulfill(mockTargetsList(items));
     });
 
-    await goToConfig(page);
+    await goToTargets(page);
     // First load shows one target
     await expect(page.getByText("gpt-4o")).toBeVisible({ timeout: 10000 });
     await expect(page.getByText("dall-e-3")).not.toBeVisible();
@@ -294,7 +294,7 @@ test.describe("Create Target Dialog", () => {
       await route.fulfill(mockTargetsList([]));
     });
 
-    await goToConfig(page);
+    await goToTargets(page);
     await page.getByRole("button", { name: /new target/i }).click();
 
     const dialog = page.getByRole("dialog");
@@ -356,7 +356,7 @@ test.describe("Create Target Dialog", () => {
       }
     });
 
-    await goToConfig(page);
+    await goToTargets(page);
 
     // Click "New Target" button
     await page.getByRole("button", { name: /new target/i }).click();
@@ -393,7 +393,7 @@ test.describe("Create Target Dialog", () => {
       await route.fulfill(mockTargetsList([]));
     });
 
-    await goToConfig(page);
+    await goToTargets(page);
 
     // Open dialog
     await page.getByRole("button", { name: /new target/i }).click();
@@ -432,7 +432,7 @@ test.describe("Responsive Target Configuration", () => {
         height: viewport.height,
       });
       await routeResponsiveTargetData(page, LONG_NAME_TARGETS);
-      await goToConfig(page);
+      await goToTargets(page);
       await expect(page.getByText("gpt-4o-responsive").first()).toBeVisible();
 
       const config = page.getByTestId("target-config");
@@ -460,7 +460,7 @@ test.describe("Responsive Target Configuration", () => {
         height: viewport.height,
       });
       await routeResponsiveTargetData(page, LONG_NAME_TARGETS);
-      await goToConfig(page);
+      await goToTargets(page);
       await expect(page.getByText("gpt-4o-responsive").first()).toBeVisible();
 
       await page.getByRole("button", { name: /new target/i }).click();
@@ -523,7 +523,7 @@ test.describe("Target Config ↔ Chat Navigation", () => {
       await route.fulfill(mockTargetsList(SAMPLE_TARGETS));
     });
 
-    await goToConfig(page);
+    await goToTargets(page);
     await expect(page.getByText("gpt-4o")).toBeVisible({ timeout: 10000 });
 
     // Set first target active
@@ -551,7 +551,7 @@ test.describe("Target Config ↔ Chat Navigation", () => {
     await page.getByTitle("Chat").click();
     await expect(page.getByTestId("no-target-banner")).toBeVisible();
 
-    // Go to config, set a target
+    // Go to targets, set a target
     await page.getByTitle("Targets").click();
     await expect(page.getByText("gpt-4o")).toBeVisible({ timeout: 10000 });
     await page.getByRole("button", { name: /set active/i }).first().click();
diff --git a/frontend/e2e/converters.spec.ts b/frontend/e2e/converters.spec.ts
index 81111c40c2..439aa483a5 100644
--- a/frontend/e2e/converters.spec.ts
+++ b/frontend/e2e/converters.spec.ts
@@ -407,7 +407,7 @@ async function mockBackendAPIs(page: Page) {
   });
 }
 
-/** Navigate to config, set the mock target as active, then return to chat. */
+/** Navigate to targets, set the mock target as active, then return to chat. */
 async function activateMockTarget(page: Page) {
   await page.getByTitle("Targets").click();
   await expect(page.getByText("Target Configuration")).toBeVisible({ timeout: 10000 });
diff --git a/frontend/e2e/errors.spec.ts b/frontend/e2e/errors.spec.ts
index 54d99b7ed9..a5e0ff87cc 100644
--- a/frontend/e2e/errors.spec.ts
+++ b/frontend/e2e/errors.spec.ts
@@ -166,7 +166,7 @@ async function mockAllAPIs(
   });
 }
 
-/** Navigate to config, set mock target active, return to chat. */
+/** Navigate to targets, set mock target active, return to chat. */
 async function activateMockTarget(page: Page) {
   await page.getByTitle("Targets").click();
   await expect(page.getByText("Target Configuration")).toBeVisible({
diff --git a/frontend/e2e/history.spec.ts b/frontend/e2e/history.spec.ts
index 18e7ef09fc..a269b2ebeb 100644
--- a/frontend/e2e/history.spec.ts
+++ b/frontend/e2e/history.spec.ts
@@ -367,7 +367,7 @@ test.describe("Attack History empty state", () => {
     await expect(configureTargetButton).toBeFocused();
     await configureTargetButton.press("Enter");
 
-    await expect(page).toHaveURL(/\/config$/);
+    await expect(page).toHaveURL(/\/targets$/);
     await expect(page.getByRole("heading", { level: 1, name: "Target Configuration" })).toBeVisible();
 
     await page.goBack();
diff --git a/frontend/e2e/onboarding-tour.spec.ts b/frontend/e2e/onboarding-tour.spec.ts
index 4f0b03bf7f..b0d3efa615 100644
--- a/frontend/e2e/onboarding-tour.spec.ts
+++ b/frontend/e2e/onboarding-tour.spec.ts
@@ -23,7 +23,7 @@ test.describe("Onboarding tour", () => {
     await page
       .getByRole("button", { name: "Configure a target", exact: true })
       .click();
-    await expect(page).toHaveURL(/\/config$/);
+    await expect(page).toHaveURL(/\/targets$/);
     await expect(
       page.getByRole("heading", { name: "Target Configuration" })
     ).toBeVisible();
@@ -42,7 +42,7 @@ test.describe("Onboarding tour", () => {
     await page
       .getByRole("button", { name: "Configure a target", exact: true })
       .click();
-    await expect(page).toHaveURL(/\/config$/);
+    await expect(page).toHaveURL(/\/targets$/);
     await expect(dialog).toBeVisible();
 
     await dialog.getByRole("button", { name: "Next", exact: true }).click();
@@ -112,7 +112,7 @@ test.describe("Onboarding tour", () => {
     await page
       .getByRole("button", { name: "Manage targets", exact: true })
       .click();
-    await expect(page).toHaveURL(/\/config$/);
+    await expect(page).toHaveURL(/\/targets$/);
     await expect(
       page.getByRole("heading", { name: "Target Configuration" })
     ).toBeVisible();
@@ -168,7 +168,7 @@ test.describe("Onboarding tour", () => {
       .getByRole("button", { name: "Configure a target", exact: true })
       .click();
 
-    await expect(page).toHaveURL(/\/config$/);
+    await expect(page).toHaveURL(/\/targets$/);
     await expect(dialog).toBeVisible();
     await page.getByRole("button", { name: "Set Active", exact: true }).click();
     await expect(page.getByText("Active", { exact: true }).first()).toBeVisible();
diff --git a/frontend/src/App.test.tsx b/frontend/src/App.test.tsx
index bb8e88b004..65a961d001 100644
--- a/frontend/src/App.test.tsx
+++ b/frontend/src/App.test.tsx
@@ -100,7 +100,7 @@ jest.mock("./components/Layout/MainLayout", () => {
         <button onClick={() => onNavigate("home")} data-testid="nav-home">
           Home
         </button>
-        <button onClick={() => onNavigate("config")} data-testid="nav-config">
+        <button onClick={() => onNavigate("targets")} data-testid="nav-config">
           Config
         </button>
         <button onClick={() => onNavigate("chat")} data-testid="nav-chat">
@@ -248,7 +248,7 @@ jest.mock("./components/History/AttackHistory", () => {
             Start attack
           </button>
         ) : (
-          <button onClick={() => onNavigate("config")} data-testid="history-configure-target">
+          <button onClick={() => onNavigate("targets")} data-testid="history-configure-target">
             Configure target
           </button>
         )}
@@ -296,7 +296,7 @@ jest.mock("./components/Home/Home", () => {
       <div data-testid="home-view">
         <span data-testid="home-has-target">{activeTarget ? "yes" : "no"}</span>
         <span data-testid="home-labels-json">{JSON.stringify(labels)}</span>
-        <button onClick={() => onNavigate("config")} data-testid="home-go-config">
+        <button onClick={() => onNavigate("targets")} data-testid="home-go-config">
           Go to config
         </button>
         <button
@@ -317,7 +317,7 @@ jest.mock("./components/Home/Home", () => {
 
 describe("App", () => {
   // App reads the active view from the URL, so every render needs a router.
-  // initialPath lets a test deep-link straight to a view (e.g. "/config").
+  // initialPath lets a test deep-link straight to a view (e.g. "/targets").
   function renderApp(initialPath = "/") {
     return render(
       <ThemeProvider>
@@ -356,11 +356,21 @@ describe("App", () => {
   });
 
   it("renders the view named by the initial URL", () => {
+    renderApp("/targets");
+
+    expect(screen.getByTestId("main-layout")).toHaveAttribute(
+      "data-current-view",
+      "targets"
+    );
+    expect(screen.getByTestId("target-config")).toBeInTheDocument();
+  });
+
+  it("redirects the legacy /config URL to targets", () => {
     renderApp("/config");
 
     expect(screen.getByTestId("main-layout")).toHaveAttribute(
       "data-current-view",
-      "config"
+      "targets"
     );
     expect(screen.getByTestId("target-config")).toBeInTheDocument();
   });
@@ -397,19 +407,19 @@ describe("App", () => {
     expect(screen.getByTestId("chat-window")).toBeInTheDocument();
   });
 
-  it("switches to config view", () => {
+  it("switches to targets view", () => {
     renderApp();
 
     fireEvent.click(screen.getByTestId("nav-config"));
 
     expect(screen.getByTestId("main-layout")).toHaveAttribute(
       "data-current-view",
-      "config"
+      "targets"
     );
     expect(screen.getByTestId("target-config")).toBeInTheDocument();
   });
 
-  it("switches back to chat from config", () => {
+  it("switches back to chat from targets", () => {
     renderApp();
 
     fireEvent.click(screen.getByTestId("nav-config"));
@@ -485,14 +495,14 @@ describe("App", () => {
     expect(screen.getByTestId("conversation-id")).toHaveTextContent("none");
   });
 
-  it("sets active target from config page and passes to chat", () => {
+  it("sets active target from targets page and passes to chat", () => {
     renderApp();
 
     // Switch to chat and confirm no target initially
     fireEvent.click(screen.getByTestId("nav-chat"));
     expect(screen.getByTestId("has-target")).toHaveTextContent("no");
 
-    // Switch to config and set target
+    // Switch to targets and set target
     fireEvent.click(screen.getByTestId("nav-config"));
     fireEvent.click(screen.getByTestId("set-target"));
 
@@ -513,13 +523,13 @@ describe("App", () => {
     expect(screen.getByTestId("attack-history")).toBeInTheDocument();
   });
 
-  it("navigates from empty history to config when no target is active", () => {
+  it("navigates from empty history to targets when no target is active", () => {
     renderApp("/history");
 
     expect(screen.getByTestId("history-has-target")).toHaveTextContent("no");
     fireEvent.click(screen.getByTestId("history-configure-target"));
 
-    expect(screen.getByTestId("main-layout")).toHaveAttribute("data-current-view", "config");
+    expect(screen.getByTestId("main-layout")).toHaveAttribute("data-current-view", "targets");
     expect(screen.getByTestId("target-config")).toBeInTheDocument();
   });
 
@@ -570,14 +580,14 @@ describe("App", () => {
     await waitFor(() => expect(screen.getByTestId("conversation-id")).toHaveTextContent("home-conv-1"));
   });
 
-  it("navigates to config from the home view", () => {
+  it("navigates to targets from the home view", () => {
     renderApp();
 
     fireEvent.click(screen.getByTestId("home-go-config"));
 
     expect(screen.getByTestId("main-layout")).toHaveAttribute(
       "data-current-view",
-      "config"
+      "targets"
     );
     expect(screen.getByTestId("target-config")).toBeInTheDocument();
   });
diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx
index 79c4049024..c0c353014d 100644
--- a/frontend/src/App.tsx
+++ b/frontend/src/App.tsx
@@ -38,13 +38,14 @@ const VIEW_PATHS: Record<ViewName, string> = {
   home: '/',
   chat: '/chat',
   history: '/history',
-  config: '/config',
+  targets: '/targets',
   initializers: '/initializers',
   backendConfig: '/backend-config',
 }
 
 /** Resolves the active view from a URL path, defaulting to home for unknown paths. */
 function viewFromPath(pathname: string): ViewName {
+  if (pathname === '/config') return 'targets'
   const match = (Object.entries(VIEW_PATHS) as [ViewName, string][]).find(
     ([, path]) => path === pathname,
   )
@@ -411,7 +412,7 @@ function App() {
                 element={chatElement}
               />
               <Route
-                path="/config"
+                path="/targets"
                 element={
                   <TargetConfig
                     activeTarget={activeTarget}
@@ -419,6 +420,7 @@ function App() {
                   />
                 }
               />
+              <Route path="/config" element={<Navigate to="/targets" replace />} />
               <Route path="/initializers" element={<Initializers />} />
               <Route path="/backend-config" element={<BackendConfiguration />} />
               <Route
diff --git a/frontend/src/components/Chat/ChatWindow.tsx b/frontend/src/components/Chat/ChatWindow.tsx
index 65369c07a7..c584e27c5e 100644
--- a/frontend/src/components/Chat/ChatWindow.tsx
+++ b/frontend/src/components/Chat/ChatWindow.tsx
@@ -852,7 +852,7 @@ export default function ChatWindow({
           onUseAsTemplate={handleUseAsTemplate}
           attackOperator={isOperatorLocked ? attackOperator ?? undefined : undefined}
           noTargetSelected={!activeTarget}
-          onConfigureTarget={() => onNavigate?.('config')}
+          onConfigureTarget={() => onNavigate?.('targets')}
           onToggleConverterPanel={() => setIsConverterPanelOpen(prev => !prev)}
           isConverterPanelOpen={isConverterPanelOpen}
           onInputChange={setChatInputText}
diff --git a/frontend/src/components/History/AttackHistory.test.tsx b/frontend/src/components/History/AttackHistory.test.tsx
index b25984b53a..b169619734 100644
--- a/frontend/src/components/History/AttackHistory.test.tsx
+++ b/frontend/src/components/History/AttackHistory.test.tsx
@@ -124,7 +124,7 @@ describe('AttackHistory', () => {
     expect(screen.queryByRole('button', { name: 'Start attack' })).not.toBeInTheDocument()
 
     await user.click(configureTargetButton)
-    expect(onNavigate).toHaveBeenCalledWith('config')
+    expect(onNavigate).toHaveBeenCalledWith('targets')
   })
 
   it('should guide users with an active target to start an attack', async () => {
diff --git a/frontend/src/components/History/AttackHistory.tsx b/frontend/src/components/History/AttackHistory.tsx
index ecaf1bf290..2b9cbb99e8 100644
--- a/frontend/src/components/History/AttackHistory.tsx
+++ b/frontend/src/components/History/AttackHistory.tsx
@@ -195,7 +195,7 @@ export default function AttackHistory({
         text: 'Configure a target before starting an attack.',
         label: 'Configure target',
         icon: <SettingsRegular />,
-        view: 'config' as const,
+        view: 'targets' as const,
       }
 
   return (
diff --git a/frontend/src/components/Home/Home.test.tsx b/frontend/src/components/Home/Home.test.tsx
index 01fd6b6583..8166a40f34 100644
--- a/frontend/src/components/Home/Home.test.tsx
+++ b/frontend/src/components/Home/Home.test.tsx
@@ -100,7 +100,7 @@ describe("Home", () => {
     const onNavigate = jest.fn();
     render(<TestWrapper><Home {...defaultProps} onNavigate={onNavigate} /></TestWrapper>);
     await user.click(screen.getByTestId("home-configure-target-btn"));
-    expect(onNavigate).toHaveBeenCalledWith("config");
+    expect(onNavigate).toHaveBeenCalledWith("targets");
   });
 
   it("shows the empty state when there are no attacks", async () => {
diff --git a/frontend/src/components/Home/Home.tsx b/frontend/src/components/Home/Home.tsx
index 6f25824c2e..2f0e4b73ab 100644
--- a/frontend/src/components/Home/Home.tsx
+++ b/frontend/src/components/Home/Home.tsx
@@ -191,7 +191,7 @@ export default function Home({
                 appearance="primary"
                 icon={<ArrowRightRegular />}
                 iconPosition="after"
-                onClick={() => onNavigate('config')}
+                onClick={() => onNavigate('targets')}
                 data-testid="home-configure-target-btn"
               >
                 {activeTarget ? 'Manage targets' : 'Configure a target'}
diff --git a/frontend/src/components/Layout/MainLayout.test.tsx b/frontend/src/components/Layout/MainLayout.test.tsx
index a3288d5c5d..80e433b848 100644
--- a/frontend/src/components/Layout/MainLayout.test.tsx
+++ b/frontend/src/components/Layout/MainLayout.test.tsx
@@ -26,7 +26,7 @@ jest.mock("../Sidebar/Navigation", () => {
   }) => {
     return (
       <div data-testid="navigation" data-current-view={currentView}>
-        <button onClick={() => onNavigate("config")}>Config</button>
+        <button onClick={() => onNavigate("targets")}>Targets</button>
       </div>
     );
   };
diff --git a/frontend/src/components/Sidebar/Navigation.test.tsx b/frontend/src/components/Sidebar/Navigation.test.tsx
index 4537ccf021..cedd798437 100644
--- a/frontend/src/components/Sidebar/Navigation.test.tsx
+++ b/frontend/src/components/Sidebar/Navigation.test.tsx
@@ -79,7 +79,7 @@ describe("Navigation", () => {
     expect(onNavigate).toHaveBeenCalledWith("chat");
   });
 
-  it("calls onNavigate with 'config' when targets button is clicked", async () => {
+  it("calls onNavigate with 'targets' when targets button is clicked", async () => {
     const user = userEvent.setup();
     const onNavigate = jest.fn();
     renderWithProvider(
@@ -87,7 +87,7 @@ describe("Navigation", () => {
     );
 
     await user.click(screen.getByRole("button", { name: "Targets" }));
-    expect(onNavigate).toHaveBeenCalledWith("config");
+    expect(onNavigate).toHaveBeenCalledWith("targets");
   });
 
   it("navigates to backend configuration", async () => {
diff --git a/frontend/src/components/Sidebar/Navigation.tsx b/frontend/src/components/Sidebar/Navigation.tsx
index 818786c488..20b1360126 100644
--- a/frontend/src/components/Sidebar/Navigation.tsx
+++ b/frontend/src/components/Sidebar/Navigation.tsx
@@ -18,13 +18,13 @@ import {
   OpenRegular,
   WeatherMoonRegular,
   WeatherSunnyRegular,
-  DocumentSettingsRegular,
+  TargetRegular,
 } from '@fluentui/react-icons'
 import { useTheme } from '../../hooks/useTheme'
 import type { ThemeMode } from '../../hooks/useTheme'
 import { useNavigationStyles } from './Navigation.styles'
 
-export type ViewName = 'home' | 'chat' | 'history' | 'config' | 'initializers' | 'backendConfig'
+export type ViewName = 'home' | 'chat' | 'history' | 'targets' | 'initializers' | 'backendConfig'
 
 interface NavigationProps {
   currentView: ViewName
@@ -97,13 +97,13 @@ export default function Navigation({ currentView, onNavigate, onOpenFeedback }:
 
         <Button
           className={styles.navButton}
-          data-active={currentView === 'config'}
+          data-active={currentView === 'targets'}
           appearance="subtle"
-          icon={<SettingsRegular />}
+          icon={<TargetRegular />}
           title="Targets"
           aria-label="Targets"
-          aria-current={currentView === 'config' ? 'page' : undefined}
-          onClick={() => onNavigate('config')}
+          aria-current={currentView === 'targets' ? 'page' : undefined}
+          onClick={() => onNavigate('targets')}
         />
 
         <Button
@@ -121,7 +121,7 @@ export default function Navigation({ currentView, onNavigate, onOpenFeedback }:
           className={styles.navButton}
           data-active={currentView === 'backendConfig'}
           appearance="subtle"
-          icon={<DocumentSettingsRegular />}
+          icon={<SettingsRegular />}
           title="Backend Configuration"
           aria-label="Backend Configuration"
           aria-current={currentView === 'backendConfig' ? 'page' : undefined}
diff --git a/frontend/src/hooks/useTour.test.ts b/frontend/src/hooks/useTour.test.ts
index 913a331137..42c9ca52a5 100644
--- a/frontend/src/hooks/useTour.test.ts
+++ b/frontend/src/hooks/useTour.test.ts
@@ -101,7 +101,7 @@ describe('useTour', () => {
     })
     expect(result.current.tourProps.stepIndex).toBe(2)
 
-    rerender({ currentView: 'config' })
+    rerender({ currentView: 'targets' })
 
     expect(result.current.tourProps.run).toBe(true)
     expect(result.current.tourProps.steps[2]).toMatchObject({
@@ -149,10 +149,10 @@ describe('useTour', () => {
       result.current.tourProps.onEvent(makeEvent({ index: 1 }))
     })
 
-    rerender({ currentView: 'config', hasActiveTarget: false })
+    rerender({ currentView: 'targets', hasActiveTarget: false })
     expect(result.current.tourProps.steps[2].content).toContain('Configure a target')
 
-    rerender({ currentView: 'config', hasActiveTarget: true })
+    rerender({ currentView: 'targets', hasActiveTarget: true })
     expect(result.current.tourProps.steps[2].target).toBe('body')
     expect(result.current.tourProps.steps[2].content).toContain('target currently active for Chat')
     expect(result.current.tourProps.steps[3].target).toBe('[data-tour="converter-toggle"]')

From 94e725f2b09c26fae76d19f7e9cf6eed2b770cb2 Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Fri, 28 Aug 2026 09:38:16 -0700
Subject: [PATCH 20/24] fix: address remaining configuration review feedback

---
 doc/getting_started/pyrit_conf.md             |  4 +-
 docker/start.sh                               | 61 +++++++-------
 .../BackendConfiguration.test.tsx             |  5 +-
 .../BackendConfiguration.tsx                  |  8 +-
 .../CustomInitializerFiles.test.tsx           | 58 +++++++++++++
 .../DotenvEditor.test.tsx                     | 33 ++++++++
 .../EnvironmentFiles.test.tsx                 | 62 ++++++++++++++
 .../BackendConfiguration/PythonCode.test.tsx  | 45 ++++++++++
 .../BackendConfiguration/YamlEditor.test.tsx  | 33 ++++++++
 .../AddCustomInitializerDialog.tsx            | 82 +++++++++++++++++++
 .../Initializers/CustomInitializers.tsx       | 59 ++-----------
 gui-deploy.yml                                |  7 +-
 infra/README.md                               | 14 ++--
 infra/main.bicep                              |  4 +-
 .../components/initializer_registry.py        |  5 +-
 pyrit/setup/configuration_loader.py           | 11 +++
 .../test_configuration_file_service.py        | 12 +++
 .../unit/backend/test_initializer_service.py  | 13 +++
 .../registry/test_initializer_registry.py     | 13 +++
 tests/unit/setup/test_configuration_loader.py |  5 ++
 20 files changed, 434 insertions(+), 100 deletions(-)
 create mode 100644 frontend/src/components/BackendConfiguration/CustomInitializerFiles.test.tsx
 create mode 100644 frontend/src/components/BackendConfiguration/DotenvEditor.test.tsx
 create mode 100644 frontend/src/components/BackendConfiguration/EnvironmentFiles.test.tsx
 create mode 100644 frontend/src/components/BackendConfiguration/PythonCode.test.tsx
 create mode 100644 frontend/src/components/BackendConfiguration/YamlEditor.test.tsx
 create mode 100644 frontend/src/components/Initializers/AddCustomInitializerDialog.tsx

diff --git a/doc/getting_started/pyrit_conf.md b/doc/getting_started/pyrit_conf.md
index ec0982ddcf..ababb8f1b8 100644
--- a/doc/getting_started/pyrit_conf.md
+++ b/doc/getting_started/pyrit_conf.md
@@ -148,10 +148,10 @@ Full preload can take several minutes and may require network access, provider c
 Stores custom initializer Python files in a local directory or Azure Blob container. An Azure URI may include a blob-name prefix, which behaves like a folder:
 
 ```yaml
-custom_initializers_source: https://account.blob.core.windows.net/copyrit/custom-initializers
+custom_initializers_source: https://account.blob.core.windows.net/pyrit-storage/custom-initializers
 ```
 
-With this configuration, PyRIT reads and writes scripts directly under the `custom-initializers/` prefix in the `copyrit` container. A SAS query string may be included; otherwise, PyRIT uses `DefaultAzureCredential`. The default is `~/.pyrit/custom_initializers`.
+With this configuration, PyRIT reads and writes scripts directly under the `custom-initializers/` prefix in the `pyrit-storage` container. A SAS query string may be included; otherwise, PyRIT uses `DefaultAzureCredential`. The default is `~/.pyrit/custom_initializers`.
 
 ### `initialization_scripts`
 
diff --git a/docker/start.sh b/docker/start.sh
index eec57b9b33..30a3bdd000 100644
--- a/docker/start.sh
+++ b/docker/start.sh
@@ -57,35 +57,38 @@ if [ "$PYRIT_MODE" = "jupyter" ]; then
     exec jupyter lab --ip=0.0.0.0 --port=8888 --no-browser --allow-root --notebook-dir=/app/notebooks
 elif [ "$PYRIT_MODE" = "gui" ]; then
     echo "Starting PyRIT GUI on port 8000..."
-    # The thin backend only takes --host/--port/--config-file/--log-level.
-    # Translate deployment settings into a runtime config file so the FastAPI
-    # lifespan (ConfigurationLoader) picks them up on startup.
-    RUNTIME_CONFIG=/tmp/pyrit_runtime.yaml
-    {
-        if [ -n "$AZURE_SQL_SERVER" ]; then
-            echo "Using Azure SQL database (server: $AZURE_SQL_SERVER)" >&2
-            echo "memory_db_type: AzureSQL"
-        else
-            echo "Using SQLite database (AZURE_SQL_SERVER not set)" >&2
-            echo "memory_db_type: SQLite"
-        fi
-        if [ -n "$PYRIT_INITIALIZER" ]; then
-            echo "Using initializer: $PYRIT_INITIALIZER" >&2
-            echo "initializers:"
-            # Split comma-separated initializer names into a YAML list.
-            IFS=',' read -ra INIT_NAMES <<<"$PYRIT_INITIALIZER"
-            for name in "${INIT_NAMES[@]}"; do
-                echo "  - $(echo "$name" | xargs)"
-            done
-        fi
-        if [ -n "$PYRIT_ENV_AKV_REF" ]; then
-            echo "Using Azure Key Vault environment reference" >&2
-            echo "env_akv_ref:"
-            echo "  - $PYRIT_ENV_AKV_REF"
-        fi
-    } >"$RUNTIME_CONFIG"
-
-    CONFIG_FILE="${PYRIT_CONFIG_FILE:-$RUNTIME_CONFIG}"
+    if [ -n "${PYRIT_CONFIG_FILE:-}" ]; then
+        CONFIG_FILE="$PYRIT_CONFIG_FILE"
+        echo "Using external PyRIT configuration: $CONFIG_FILE"
+    else
+        # Translate deployment settings into a runtime config file so the FastAPI
+        # lifespan (ConfigurationLoader) picks them up on startup.
+        RUNTIME_CONFIG=/tmp/pyrit_runtime.yaml
+        {
+            if [ -n "$AZURE_SQL_SERVER" ]; then
+                echo "Using Azure SQL database (server: $AZURE_SQL_SERVER)" >&2
+                echo "memory_db_type: AzureSQL"
+            else
+                echo "Using SQLite database (AZURE_SQL_SERVER not set)" >&2
+                echo "memory_db_type: SQLite"
+            fi
+            if [ -n "$PYRIT_INITIALIZER" ]; then
+                echo "Using initializer: $PYRIT_INITIALIZER" >&2
+                echo "initializers:"
+                # Split comma-separated initializer names into a YAML list.
+                IFS=',' read -ra INIT_NAMES <<<"$PYRIT_INITIALIZER"
+                for name in "${INIT_NAMES[@]}"; do
+                    echo "  - $(echo "$name" | xargs)"
+                done
+            fi
+            if [ -n "$PYRIT_ENV_AKV_REF" ]; then
+                echo "Using Azure Key Vault environment reference" >&2
+                echo "env_akv_ref:"
+                echo "  - $PYRIT_ENV_AKV_REF"
+            fi
+        } >"$RUNTIME_CONFIG"
+        CONFIG_FILE="$RUNTIME_CONFIG"
+    fi
 
     # Pick the launcher module. PR #1753 moved the launcher from
     # ``pyrit.cli.pyrit_backend`` to ``pyrit.backend.pyrit_backend``. The PyPI
diff --git a/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx b/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx
index 1a63943df5..b89db639af 100644
--- a/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx
+++ b/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx
@@ -67,6 +67,7 @@ describe('BackendConfiguration', () => {
   it('should load and display configuration content', async () => {
     renderPage()
 
+    expect(screen.getByRole('heading', { level: 1, name: 'Configuration' })).toBeInTheDocument()
     expect(await screen.findByLabelText('Configuration YAML')).toHaveValue('operator: alice\n')
     expect(screen.getByRole('navigation', { name: 'Configuration files' })).toBeInTheDocument()
     expect(screen.getByRole('button', { name: /\.pyrit_conf/i })).toHaveAttribute('aria-current', 'page')
@@ -111,7 +112,7 @@ describe('BackendConfiguration', () => {
     })
     renderPage()
 
-    await user.click(screen.getByRole('tab', { name: 'Environment Files' }))
+    await user.click(screen.getByRole('tab', { name: 'Environment & Secrets' }))
     const editor = await screen.findByLabelText('Environment file contents')
     expect(screen.getByText('C:/Users/test/.pyrit/.env', { selector: 'label' })).toBeInTheDocument()
     expect(screen.getByTitle('C:/Users/test/.pyrit/.env')).toBeInTheDocument()
@@ -153,7 +154,7 @@ describe('BackendConfiguration', () => {
     })
     renderPage()
 
-    await user.click(screen.getByRole('tab', { name: 'Environment Files' }))
+    await user.click(screen.getByRole('tab', { name: 'Environment & Secrets' }))
     expect(await screen.findByRole('button', { name: /AKV: bootstrap/i })).toBeInTheDocument()
     expect(screen.getByTitle(secretUrl)).toBeInTheDocument()
     const editor = await screen.findByLabelText('Environment file contents')
diff --git a/frontend/src/components/BackendConfiguration/BackendConfiguration.tsx b/frontend/src/components/BackendConfiguration/BackendConfiguration.tsx
index e2cb5f93e6..c1ebf0311f 100644
--- a/frontend/src/components/BackendConfiguration/BackendConfiguration.tsx
+++ b/frontend/src/components/BackendConfiguration/BackendConfiguration.tsx
@@ -108,12 +108,12 @@ export default function BackendConfiguration() {
   return (
     <main className={styles.root}>
       <div className={styles.header}>
-        <Text as="h1" size={600} weight="semibold">Backend Configuration</Text>
+        <Text as="h1" size={600} weight="semibold">Configuration</Text>
       </div>
 
       <TabList selectedValue={selectedTab} onTabSelect={handleTabSelect}>
-        <Tab value="configuration">Configuration</Tab>
-        <Tab value="environment">Environment Files</Tab>
+        <Tab value="configuration">PyRIT Configuration</Tab>
+        <Tab value="environment">Environment &amp; Secrets</Tab>
         <Tab value="custom-initializers">Custom Initializers</Tab>
       </TabList>
 
@@ -129,7 +129,7 @@ export default function BackendConfiguration() {
         <EnvironmentFiles />
       ) : loading ? (
         <div className={styles.loadingState}>
-          <Spinner label="Loading backend configuration..." />
+          <Spinner label="Loading PyRIT configuration..." />
         </div>
       ) : (
         <EditorWorkspace
diff --git a/frontend/src/components/BackendConfiguration/CustomInitializerFiles.test.tsx b/frontend/src/components/BackendConfiguration/CustomInitializerFiles.test.tsx
new file mode 100644
index 0000000000..7d910b25d2
--- /dev/null
+++ b/frontend/src/components/BackendConfiguration/CustomInitializerFiles.test.tsx
@@ -0,0 +1,58 @@
+import { FluentProvider, webLightTheme } from '@fluentui/react-components'
+import { render, screen, within } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+
+import { initializersApi } from '@/services/api'
+
+import CustomInitializerFiles from './CustomInitializerFiles'
+
+jest.mock('@/services/api', () => ({
+  initializersApi: {
+    listCustom: jest.fn(),
+    register: jest.fn(),
+    unregister: jest.fn(),
+  },
+}))
+
+const mockedInitializersApi = jest.mocked(initializersApi)
+const customInitializer = {
+  initializer_name: 'custom_target',
+  script_content: 'class CustomTarget: pass',
+  source: 'C:/custom/custom_target.py',
+}
+
+function renderFiles(): void {
+  render(
+    <FluentProvider theme={webLightTheme}>
+      <CustomInitializerFiles />
+    </FluentProvider>,
+  )
+}
+
+describe('CustomInitializerFiles', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+    mockedInitializersApi.listCustom.mockResolvedValue({ source: 'C:/custom', items: [customInitializer] })
+    mockedInitializersApi.unregister.mockResolvedValue()
+  })
+
+  it('should load and remove a custom initializer', async () => {
+    const user = userEvent.setup()
+    renderFiles()
+
+    expect(await screen.findByText(customInitializer.source, { selector: 'label' })).toBeInTheDocument()
+    await user.click(screen.getByRole('button', { name: 'Remove' }))
+    const dialog = screen.getByRole('dialog', { name: 'Remove custom initializer' })
+    await user.click(within(dialog).getByRole('button', { name: 'Remove' }))
+
+    expect(mockedInitializersApi.unregister).toHaveBeenCalledWith('custom_target')
+    expect(await screen.findByText('Removed custom_target.')).toBeInTheDocument()
+  })
+
+  it('should show an error when custom initializers cannot be loaded', async () => {
+    mockedInitializersApi.listCustom.mockRejectedValue(new Error('Custom initializers unavailable'))
+    renderFiles()
+
+    expect(await screen.findByText('Custom initializers unavailable')).toBeInTheDocument()
+  })
+})
\ No newline at end of file
diff --git a/frontend/src/components/BackendConfiguration/DotenvEditor.test.tsx b/frontend/src/components/BackendConfiguration/DotenvEditor.test.tsx
new file mode 100644
index 0000000000..0fb9d504e9
--- /dev/null
+++ b/frontend/src/components/BackendConfiguration/DotenvEditor.test.tsx
@@ -0,0 +1,33 @@
+import { FluentProvider, webLightTheme } from '@fluentui/react-components'
+import { render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+
+import DotenvEditor from './DotenvEditor'
+
+function renderEditor(props: React.ComponentProps<typeof DotenvEditor>): void {
+  render(
+    <FluentProvider theme={webLightTheme}>
+      <DotenvEditor {...props} />
+    </FluentProvider>,
+  )
+}
+
+describe('DotenvEditor', () => {
+  it('should highlight dotenv content and report edits', async () => {
+    const user = userEvent.setup()
+    const onChange = jest.fn()
+    renderEditor({ value: 'ENABLED=true\n', disabled: false, onChange })
+
+    expect(screen.getByTestId('dotenv-highlight').innerHTML).toContain('token key atrule')
+
+    await user.type(screen.getByRole('textbox', { name: 'Environment file contents' }), '#')
+
+    expect(onChange).toHaveBeenCalledWith('ENABLED=true\n#')
+  })
+
+  it('should disable editing when requested', () => {
+    renderEditor({ value: '', disabled: true, onChange: jest.fn() })
+
+    expect(screen.getByRole('textbox', { name: 'Environment file contents' })).toBeDisabled()
+  })
+})
\ No newline at end of file
diff --git a/frontend/src/components/BackendConfiguration/EnvironmentFiles.test.tsx b/frontend/src/components/BackendConfiguration/EnvironmentFiles.test.tsx
new file mode 100644
index 0000000000..07f8cc5a20
--- /dev/null
+++ b/frontend/src/components/BackendConfiguration/EnvironmentFiles.test.tsx
@@ -0,0 +1,62 @@
+import { FluentProvider, webLightTheme } from '@fluentui/react-components'
+import { render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+
+import { configurationApi } from '@/services/api'
+
+import EnvironmentFiles from './EnvironmentFiles'
+
+jest.mock('@/services/api', () => ({
+  configurationApi: {
+    listEnvironmentFiles: jest.fn(),
+    getEnvironmentFile: jest.fn(),
+    updateEnvironmentFile: jest.fn(),
+  },
+}))
+
+const mockedConfigurationApi = jest.mocked(configurationApi)
+
+function renderFiles(): void {
+  render(
+    <FluentProvider theme={webLightTheme}>
+      <EnvironmentFiles />
+    </FluentProvider>,
+  )
+}
+
+describe('EnvironmentFiles', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+    mockedConfigurationApi.listEnvironmentFiles.mockResolvedValue({
+      items: [{ id: '0', name: '.env', path: 'C:/config/.env', content: '', exists: true }],
+    })
+    mockedConfigurationApi.getEnvironmentFile.mockResolvedValue({
+      id: '0', name: '.env', path: 'C:/config/.env', content: 'VALUE=before\n', exists: true,
+    })
+  })
+
+  it('should load, edit, and save an environment file', async () => {
+    const user = userEvent.setup()
+    mockedConfigurationApi.updateEnvironmentFile.mockResolvedValue({
+      id: '0', name: '.env', path: 'C:/config/.env', content: 'VALUE=after\n', exists: true,
+    })
+    renderFiles()
+
+    const editor = await screen.findByRole('textbox', { name: 'Environment file contents' })
+    await user.clear(editor)
+    await user.type(editor, 'VALUE=after\n')
+    await user.click(screen.getByRole('button', { name: 'Save' }))
+
+    expect(mockedConfigurationApi.updateEnvironmentFile).toHaveBeenCalledWith('0', {
+      content: 'VALUE=after\n',
+    })
+    expect(await screen.findByText(/restart the backend/i)).toBeInTheDocument()
+  })
+
+  it('should show an error when the file list cannot be loaded', async () => {
+    mockedConfigurationApi.listEnvironmentFiles.mockRejectedValue(new Error('Environment unavailable'))
+    renderFiles()
+
+    expect(await screen.findByText('Environment unavailable')).toBeInTheDocument()
+  })
+})
\ No newline at end of file
diff --git a/frontend/src/components/BackendConfiguration/PythonCode.test.tsx b/frontend/src/components/BackendConfiguration/PythonCode.test.tsx
new file mode 100644
index 0000000000..1a7415cf77
--- /dev/null
+++ b/frontend/src/components/BackendConfiguration/PythonCode.test.tsx
@@ -0,0 +1,45 @@
+import { FluentProvider, webLightTheme } from '@fluentui/react-components'
+import { render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+
+import { PythonCodeBlock, PythonCodeEditor } from './PythonCode'
+
+function TestWrapper({ children }: { children: React.ReactNode }) {
+  return <FluentProvider theme={webLightTheme}>{children}</FluentProvider>
+}
+
+describe('PythonCode', () => {
+  it('should render highlighted read-only source', () => {
+    render(
+      <TestWrapper>
+        <PythonCodeBlock source="class Example: pass" ariaLabel="Stored Python source" />
+      </TestWrapper>,
+    )
+
+    expect(screen.getByLabelText('Stored Python source').innerHTML).toContain('token keyword')
+  })
+
+  it('should report editor changes', async () => {
+    const user = userEvent.setup()
+    const onChange = jest.fn()
+    render(
+      <TestWrapper>
+        <PythonCodeEditor source="pass" disabled={false} onChange={onChange} />
+      </TestWrapper>,
+    )
+
+    await user.type(screen.getByRole('textbox', { name: 'Python source' }), '#')
+
+    expect(onChange).toHaveBeenCalledWith('pass#')
+  })
+
+  it('should disable editing when requested', () => {
+    render(
+      <TestWrapper>
+        <PythonCodeEditor source="pass" disabled onChange={jest.fn()} />
+      </TestWrapper>,
+    )
+
+    expect(screen.getByRole('textbox', { name: 'Python source' })).toBeDisabled()
+  })
+})
\ No newline at end of file
diff --git a/frontend/src/components/BackendConfiguration/YamlEditor.test.tsx b/frontend/src/components/BackendConfiguration/YamlEditor.test.tsx
new file mode 100644
index 0000000000..a3db6703ef
--- /dev/null
+++ b/frontend/src/components/BackendConfiguration/YamlEditor.test.tsx
@@ -0,0 +1,33 @@
+import { FluentProvider, webLightTheme } from '@fluentui/react-components'
+import { render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+
+import YamlEditor from './YamlEditor'
+
+function renderEditor(props: React.ComponentProps<typeof YamlEditor>): void {
+  render(
+    <FluentProvider theme={webLightTheme}>
+      <YamlEditor {...props} />
+    </FluentProvider>,
+  )
+}
+
+describe('YamlEditor', () => {
+  it('should highlight YAML and report edits', async () => {
+    const user = userEvent.setup()
+    const onChange = jest.fn()
+    renderEditor({ value: 'enabled: true\n', disabled: false, onChange })
+
+    expect(screen.getByTestId('yaml-highlight').innerHTML).toContain('token key atrule')
+
+    await user.type(screen.getByRole('textbox', { name: 'Configuration YAML' }), '#')
+
+    expect(onChange).toHaveBeenCalledWith('enabled: true\n#')
+  })
+
+  it('should disable editing when requested', () => {
+    renderEditor({ value: '', disabled: true, onChange: jest.fn() })
+
+    expect(screen.getByRole('textbox', { name: 'Configuration YAML' })).toBeDisabled()
+  })
+})
\ No newline at end of file
diff --git a/frontend/src/components/Initializers/AddCustomInitializerDialog.tsx b/frontend/src/components/Initializers/AddCustomInitializerDialog.tsx
new file mode 100644
index 0000000000..604082e4bb
--- /dev/null
+++ b/frontend/src/components/Initializers/AddCustomInitializerDialog.tsx
@@ -0,0 +1,82 @@
+import { useState } from 'react'
+import type { FormEvent } from 'react'
+
+import {
+  Button,
+  Dialog,
+  DialogActions,
+  DialogBody,
+  DialogContent,
+  DialogSurface,
+  DialogTitle,
+  Field,
+  Input,
+} from '@fluentui/react-components'
+
+import { PythonCodeEditor } from '@/components/BackendConfiguration/PythonCode'
+
+import { useCustomInitializersStyles } from './CustomInitializers.styles'
+
+interface AddCustomInitializerDialogProps {
+  open: boolean
+  registering: boolean
+  onOpenChange: (open: boolean) => void
+  onRegister: (name: string, scriptContent: string) => Promise<boolean>
+}
+
+export default function AddCustomInitializerDialog({
+  open,
+  registering,
+  onOpenChange,
+  onRegister,
+}: AddCustomInitializerDialogProps) {
+  const styles = useCustomInitializersStyles()
+  const [name, setName] = useState('')
+  const [scriptContent, setScriptContent] = useState('')
+
+  const handleSubmit = async (event: FormEvent<HTMLFormElement>): Promise<void> => {
+    event.preventDefault()
+    if (await onRegister(name.trim(), scriptContent)) {
+      onOpenChange(false)
+      setName('')
+      setScriptContent('')
+    }
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={(_, data) => onOpenChange(data.open)}>
+      <DialogSurface className={styles.sourceDialog}>
+        <form onSubmit={handleSubmit}>
+          <DialogBody>
+            <DialogTitle>Add custom initializer</DialogTitle>
+            <DialogContent className={styles.dialogBody}>
+              <Field label="Initializer name" required>
+                <Input
+                  value={name}
+                  onChange={(_, data) => setName(data.value)}
+                  disabled={registering}
+                  autoComplete="off"
+                />
+              </Field>
+              <Field label="Python source" required>
+                <PythonCodeEditor source={scriptContent} onChange={setScriptContent} disabled={registering} />
+              </Field>
+            </DialogContent>
+            <DialogActions>
+              <Button appearance="secondary" disabled={registering} onClick={() => onOpenChange(false)}>
+                Cancel
+              </Button>
+              <Button
+                type="submit"
+                appearance="primary"
+                disabled={registering || name.trim() === '' || scriptContent.trim() === ''}
+              >
+                {registering ? 'Adding...' : 'Add'}
+              </Button>
+            </DialogActions>
+          </DialogBody>
+        </form>
+      </DialogSurface>
+    </Dialog>
+  )
+}
\ No newline at end of file
diff --git a/frontend/src/components/Initializers/CustomInitializers.tsx b/frontend/src/components/Initializers/CustomInitializers.tsx
index ed552cdd89..e39e8328c4 100644
--- a/frontend/src/components/Initializers/CustomInitializers.tsx
+++ b/frontend/src/components/Initializers/CustomInitializers.tsx
@@ -2,14 +2,7 @@ import { useState } from 'react'
 
 import {
   Button,
-  Dialog,
-  DialogActions,
-  DialogBody,
-  DialogContent,
-  DialogSurface,
-  DialogTitle,
   Field,
-  Input,
   Text,
 } from '@fluentui/react-components'
 import { AddRegular, DeleteRegular } from '@fluentui/react-icons'
@@ -19,6 +12,7 @@ import EditorWorkspace from '@/components/EditorWorkspace'
 import { PythonCodeEditor } from '@/components/BackendConfiguration/PythonCode'
 import type { CustomInitializer } from '@/types'
 
+import AddCustomInitializerDialog from './AddCustomInitializerDialog'
 import { useCustomInitializersStyles } from './CustomInitializers.styles'
 
 interface CustomInitializersProps {
@@ -38,21 +32,10 @@ export default function CustomInitializers({
 }: CustomInitializersProps) {
   const styles = useCustomInitializersStyles()
   const [dialogOpen, setDialogOpen] = useState(false)
-  const [name, setName] = useState('')
-  const [scriptContent, setScriptContent] = useState('')
   const [selectedName, setSelectedName] = useState<string | null>(items[0]?.initializer_name ?? null)
   const selectedInitializer = items.find((item) => item.initializer_name === selectedName) ?? items[0] ?? null
   const [initializerToDelete, setInitializerToDelete] = useState<CustomInitializer | null>(null)
 
-  const handleSubmit = async (event: React.FormEvent<HTMLFormElement>): Promise<void> => {
-    event.preventDefault()
-    if (await onRegister(name.trim(), scriptContent)) {
-      setDialogOpen(false)
-      setName('')
-      setScriptContent('')
-    }
-  }
-
   const selectInitializer = (initializer: CustomInitializer): void => {
     setSelectedName(initializer.initializer_name)
   }
@@ -112,40 +95,12 @@ export default function CustomInitializers({
         )}
       </EditorWorkspace>
 
-      <Dialog open={dialogOpen} onOpenChange={(_, data) => setDialogOpen(data.open)}>
-        <DialogSurface className={styles.sourceDialog}>
-          <form onSubmit={handleSubmit}>
-            <DialogBody>
-              <DialogTitle>Add custom initializer</DialogTitle>
-              <DialogContent className={styles.dialogBody}>
-                <Field label="Initializer name" required>
-                  <Input
-                    value={name}
-                    onChange={(_, data) => setName(data.value)}
-                    disabled={registering}
-                    autoComplete="off"
-                  />
-                </Field>
-                <Field label="Python source" required>
-                  <PythonCodeEditor source={scriptContent} onChange={setScriptContent} disabled={registering} />
-                </Field>
-              </DialogContent>
-              <DialogActions>
-                <Button appearance="secondary" disabled={registering} onClick={() => setDialogOpen(false)}>
-                  Cancel
-                </Button>
-                <Button
-                  type="submit"
-                  appearance="primary"
-                  disabled={registering || name.trim() === '' || scriptContent.trim() === ''}
-                >
-                  {registering ? 'Adding...' : 'Add'}
-                </Button>
-              </DialogActions>
-            </DialogBody>
-          </form>
-        </DialogSurface>
-      </Dialog>
+      <AddCustomInitializerDialog
+        open={dialogOpen}
+        registering={registering}
+        onOpenChange={setDialogOpen}
+        onRegister={onRegister}
+      />
 
       <ConfirmDialog
         open={initializerToDelete !== null}
diff --git a/gui-deploy.yml b/gui-deploy.yml
index ed12ab0cdd..46494c2f6b 100644
--- a/gui-deploy.yml
+++ b/gui-deploy.yml
@@ -9,7 +9,8 @@
 # Required variable groups:
 #   - copyrit-gui-common  (azureServiceConnection, acrName, acrLoginServer, imageName)
 #   - copyrit-gui-test    (resourceGroup, appName, entraTenantId, entraClientId,
-#                           allowedGroupObjectIds, sqlServerFqdn, sqlDatabaseName,
+#                           allowedGroupObjectIds, adminGroupObjectId, pyritConfigFileUri,
+#                           sqlServerFqdn, sqlDatabaseName,
 #                           keyVaultResourceId, acrResourceId, enablePrivateEndpoint, enableOtel)
 #   - copyrit-gui-prod    (same keys as test, with production values)
 
@@ -159,8 +160,10 @@ stages:
                         --parameters entraTenantId=$(entraTenantId) \
                         --parameters entraClientId=$(entraClientId) \
                         --parameters allowedGroupObjectIds="$(allowedGroupObjectIds)" \
+                        --parameters adminGroupObjectId=$(adminGroupObjectId) \
                         --parameters sqlServerFqdn=$(sqlServerFqdn) \
                         --parameters sqlDatabaseName=$(sqlDatabaseName) \
+                        --parameters pyritConfigFileUri=$(pyritConfigFileUri) \
                         --parameters keyVaultResourceId=$(keyVaultResourceId) \
                         --parameters acrResourceId=$(acrResourceId) \
                         --parameters enablePrivateEndpoint=$(enablePrivateEndpoint) \
@@ -242,8 +245,10 @@ stages:
                         --parameters entraTenantId=$(entraTenantId) \
                         --parameters entraClientId=$(entraClientId) \
                         --parameters allowedGroupObjectIds="$(allowedGroupObjectIds)" \
+                        --parameters adminGroupObjectId=$(adminGroupObjectId) \
                         --parameters sqlServerFqdn=$(sqlServerFqdn) \
                         --parameters sqlDatabaseName=$(sqlDatabaseName) \
+                        --parameters pyritConfigFileUri=$(pyritConfigFileUri) \
                         --parameters keyVaultResourceId=$(keyVaultResourceId) \
                         --parameters acrResourceId=$(acrResourceId) \
                         --parameters enablePrivateEndpoint=$(enablePrivateEndpoint) \
diff --git a/infra/README.md b/infra/README.md
index 0a4b2a7b6e..746d9b8238 100644
--- a/infra/README.md
+++ b/infra/README.md
@@ -376,9 +376,11 @@ az deployment group create \
    az role assignment create --assignee-object-id $MI_ID \
      --assignee-principal-type ServicePrincipal --role "AcrPull" --scope <acrResourceId>
 
-   # Note: Key Vault Secrets User is NOT required — the Container App reads
-   # its .env contents from an inline secret (envFileContents), not via a
-   # Key Vault reference.
+   # Required when envFileContents is empty. Secrets Officer permits both
+   # runtime reads and GUI updates that create a new secret version.
+   az role assignment create --assignee-object-id $MI_ID \
+     --assignee-principal-type ServicePrincipal --role "Key Vault Secrets Officer" \
+     --scope <keyVaultResourceId>
 
    # Grant based on which services you use (scope as narrowly as possible)
    az role assignment create --assignee-object-id $MI_ID \
@@ -551,9 +553,9 @@ Platform, Groq, Google Gemini) require API keys in the `.env`.
   used during deployment only, not exposed to the application.
 - **Workload profiles**: Consumption tier. Defaults to 1 replica (no auto-scale).
 - **Key Vault**: Must be an existing vault. Used for `.env` content backup/audit
-  only — the runtime secret comes from an inline ACA secret. RBAC for AcrPull is
-  still granted manually (see Post-Deployment §2); Key Vault Secrets User is no
-  longer required.
+  when `envFileContents` is provided. Otherwise, the runtime reads the configured
+  secret and the GUI can create updated versions, which requires `Key Vault Secrets
+  Officer`. RBAC roles are granted manually (see Post-Deployment §2).
 - **OpenTelemetry**: When `enableOtel=true`, configure the agent post-deploy:
   ```bash
   AI_CONN=$(az deployment group show -g <rg> -n main \
diff --git a/infra/main.bicep b/infra/main.bicep
index a83c7a7c07..cb594ed065 100644
--- a/infra/main.bicep
+++ b/infra/main.bicep
@@ -268,8 +268,8 @@ var keyVaultName = last(split(keyVaultResourceId, '/'))
 // ============================================================================
 // RBAC role assignments are NOT managed by this template.
 // Grant the following roles to the UAMI manually before first deployment:
-//   - Key Vault Secrets User  on the Key Vault
-//   - AcrPull                 on the ACR
+//   - Key Vault Secrets Officer  on the Key Vault
+//   - AcrPull                    on the ACR
 // See Post-Deployment in infra/README.md for commands.
 // ============================================================================
 
diff --git a/pyrit/registry/components/initializer_registry.py b/pyrit/registry/components/initializer_registry.py
index 733d8b9f6f..6cc23d0511 100644
--- a/pyrit/registry/components/initializer_registry.py
+++ b/pyrit/registry/components/initializer_registry.py
@@ -453,11 +453,12 @@ def unregister_and_cleanup(self, name: str) -> None:
         if name not in self._classes:
             available = ", ".join(self.get_class_names())
             raise KeyError(f"'{name}' not found in registry. Available: {available}")
-        del self._classes[name]
-        self._metadata_cache = None
 
         self._get_custom_storage().delete_script(name)
 
+        del self._classes[name]
+        self._metadata_cache = None
+
     def _load_custom_initializer_class(
         self,
         *,
diff --git a/pyrit/setup/configuration_loader.py b/pyrit/setup/configuration_loader.py
index b2801c711d..aed75bf43a 100644
--- a/pyrit/setup/configuration_loader.py
+++ b/pyrit/setup/configuration_loader.py
@@ -152,12 +152,23 @@ class ConfigurationLoader(YamlLoadable):
     def __post_init__(self) -> None:
         """Validate and normalize the configuration after loading."""
         validate_env_akv_strict(env_akv_strict=self.env_akv_strict)
+        self._validate_allow_custom_initializers()
         self._normalize_memory_db_type()
         self._normalize_initializers()
         self._validate_env_akv_ref()
         self._validate_custom_initializers_source()
         self._normalize_server()
 
+    def _validate_allow_custom_initializers(self) -> None:
+        """
+        Validate that the custom initializer kill switch is a boolean.
+
+        Raises:
+            TypeError: If allow_custom_initializers is not a boolean.
+        """
+        if not isinstance(self.allow_custom_initializers, bool):
+            raise TypeError("allow_custom_initializers must be a bool.")
+
     def _validate_custom_initializers_source(self) -> None:
         """
         Validate the optional custom initializer storage source.
diff --git a/tests/unit/backend/test_configuration_file_service.py b/tests/unit/backend/test_configuration_file_service.py
index b6da1ecd67..d692b0a136 100644
--- a/tests/unit/backend/test_configuration_file_service.py
+++ b/tests/unit/backend/test_configuration_file_service.py
@@ -53,6 +53,18 @@ async def test_configuration_file_service_rejects_semantically_invalid_content_b
     assert config_path.read_text(encoding="utf-8") == "operator: before\n"
 
 
+async def test_configuration_file_service_rejects_quoted_custom_initializer_flag(tmp_path: Path) -> None:
+    """Test that a string cannot enable custom initializers through truthiness."""
+    config_path = tmp_path / "config.yaml"
+    config_path.write_text("allow_custom_initializers: false\n", encoding="utf-8")
+    service = ConfigurationFileService(config_file_value=str(config_path))
+
+    with pytest.raises(ValueError, match="allow_custom_initializers must be a bool"):
+        await service.update_async('allow_custom_initializers: "false"\n')
+
+    assert config_path.read_text(encoding="utf-8") == "allow_custom_initializers: false\n"
+
+
 async def test_blob_helpers_use_sas_authentication() -> None:
     """Test downloading and uploading directly with a SAS-authenticated blob URI."""
     blob_uri = "https://account.blob.core.windows.net/config/config.yaml?sig=secret"
diff --git a/tests/unit/backend/test_initializer_service.py b/tests/unit/backend/test_initializer_service.py
index 5c741c1a31..3b686f7712 100644
--- a/tests/unit/backend/test_initializer_service.py
+++ b/tests/unit/backend/test_initializer_service.py
@@ -891,6 +891,19 @@ async def test_unregister_initializer_removes_runtime_registration(self) -> None
 class TestCustomInitializerRoutes:
     """Tests for runtime custom initializer routes."""
 
+    def test_post_returns_403_when_custom_initializers_disabled(self, client: TestClient) -> None:
+        response = client.post(
+            "/api/initializers",
+            json={"name": "custom", "script_content": _SAMPLE_SCRIPT},
+        )
+
+        assert response.status_code == status.HTTP_403_FORBIDDEN
+
+    def test_delete_returns_403_when_custom_initializers_disabled(self, client: TestClient) -> None:
+        response = client.delete("/api/initializers/custom")
+
+        assert response.status_code == status.HTTP_403_FORBIDDEN
+
     @pytest.mark.parametrize(
         ("method", "path", "json_body"),
         [
diff --git a/tests/unit/registry/test_initializer_registry.py b/tests/unit/registry/test_initializer_registry.py
index d023c96a93..a9301d0e27 100644
--- a/tests/unit/registry/test_initializer_registry.py
+++ b/tests/unit/registry/test_initializer_registry.py
@@ -172,6 +172,19 @@ def test_unregister_and_cleanup_removes_entry_and_file(lazy_registry):
         assert not (tmp_dir / "cleanup_test.py").exists()
 
 
+def test_unregister_and_cleanup_keeps_entry_when_storage_delete_fails(lazy_registry: InitializerRegistry) -> None:
+    """Test that failed storage cleanup leaves the runtime registration retryable."""
+    storage = MagicMock(spec=CustomInitializerStorage)
+    storage.delete_script.side_effect = OSError("storage unavailable")
+    lazy_registry._custom_storage = storage
+    lazy_registry._classes["custom"] = _ParamInitializer
+
+    with pytest.raises(OSError, match="storage unavailable"):
+        lazy_registry.unregister_and_cleanup("custom")
+
+    assert lazy_registry.get_class("custom") is _ParamInitializer
+
+
 def test_register_from_content_uses_configured_storage(lazy_registry: InitializerRegistry, tmp_path: Path) -> None:
     """Test runtime registration persists source in the configured directory."""
     lazy_registry.configure_custom_scripts_source(str(tmp_path))
diff --git a/tests/unit/setup/test_configuration_loader.py b/tests/unit/setup/test_configuration_loader.py
index 68fc75bd09..148bc62bb4 100644
--- a/tests/unit/setup/test_configuration_loader.py
+++ b/tests/unit/setup/test_configuration_loader.py
@@ -71,6 +71,11 @@ def test_rejects_non_boolean_env_akv_strict(self, invalid_value):
         with pytest.raises(TypeError, match=r"env_akv_strict must be a bool"):
             ConfigurationLoader(env_akv_strict=invalid_value)  # type: ignore[arg-type]
 
+    @pytest.mark.parametrize("invalid_value", ["false", "true", 0, 1, None, [], {}])
+    def test_rejects_non_boolean_allow_custom_initializers(self, invalid_value: object) -> None:
+        with pytest.raises(TypeError, match=r"allow_custom_initializers must be a bool"):
+            ConfigurationLoader(allow_custom_initializers=invalid_value)  # type: ignore[arg-type]
+
     def test_valid_memory_db_types_snake_case(self):
         """Test all valid memory database types in snake_case."""
         for db_type in ["in_memory", "sqlite", "azure_sql"]:

From 65411cff9d0ce78b6626259f3df54c85b220d4ea Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Fri, 28 Aug 2026 10:10:26 -0700
Subject: [PATCH 21/24] refactor: rename frontend configuration feature

---
 frontend/src/App.test.tsx                            | 11 ++++++++---
 frontend/src/App.tsx                                 |  8 +++-----
 .../Configuration.styles.ts}                         |  2 +-
 .../Configuration.test.tsx}                          |  8 ++++----
 .../Configuration.tsx}                               | 12 ++++++------
 .../CustomInitializerFiles.test.tsx                  |  0
 .../CustomInitializerFiles.tsx                       |  4 ++--
 .../DotenvEditor.test.tsx                            |  0
 .../DotenvEditor.tsx                                 |  4 ++--
 .../EnvironmentFiles.test.tsx                        |  2 +-
 .../EnvironmentFiles.tsx                             |  8 ++++----
 .../PythonCode.styles.ts                             |  0
 .../PythonCode.test.tsx                              |  0
 .../PythonCode.tsx                                   |  0
 .../YamlEditor.test.tsx                              |  0
 .../YamlEditor.tsx                                   |  4 ++--
 .../Initializers/AddCustomInitializerDialog.tsx      |  2 +-
 .../components/Initializers/CustomInitializers.tsx   |  4 ++--
 frontend/src/components/Sidebar/Navigation.test.tsx  |  6 +++---
 frontend/src/components/Sidebar/Navigation.tsx       | 12 ++++++------
 20 files changed, 45 insertions(+), 42 deletions(-)
 rename frontend/src/components/{BackendConfiguration/BackendConfiguration.styles.ts => Configuration/Configuration.styles.ts} (98%)
 rename frontend/src/components/{BackendConfiguration/BackendConfiguration.test.tsx => Configuration/Configuration.test.tsx} (97%)
 rename frontend/src/components/{BackendConfiguration/BackendConfiguration.tsx => Configuration/Configuration.tsx} (92%)
 rename frontend/src/components/{BackendConfiguration => Configuration}/CustomInitializerFiles.test.tsx (100%)
 rename frontend/src/components/{BackendConfiguration => Configuration}/CustomInitializerFiles.tsx (95%)
 rename frontend/src/components/{BackendConfiguration => Configuration}/DotenvEditor.test.tsx (100%)
 rename frontend/src/components/{BackendConfiguration => Configuration}/DotenvEditor.tsx (94%)
 rename frontend/src/components/{BackendConfiguration => Configuration}/EnvironmentFiles.test.tsx (96%)
 rename frontend/src/components/{BackendConfiguration => Configuration}/EnvironmentFiles.tsx (95%)
 rename frontend/src/components/{BackendConfiguration => Configuration}/PythonCode.styles.ts (100%)
 rename frontend/src/components/{BackendConfiguration => Configuration}/PythonCode.test.tsx (100%)
 rename frontend/src/components/{BackendConfiguration => Configuration}/PythonCode.tsx (100%)
 rename frontend/src/components/{BackendConfiguration => Configuration}/YamlEditor.test.tsx (100%)
 rename frontend/src/components/{BackendConfiguration => Configuration}/YamlEditor.tsx (92%)

diff --git a/frontend/src/App.test.tsx b/frontend/src/App.test.tsx
index 65a961d001..88ecdfdd61 100644
--- a/frontend/src/App.test.tsx
+++ b/frontend/src/App.test.tsx
@@ -225,6 +225,11 @@ jest.mock("./components/Config/TargetConfig", () => {
   };
 });
 
+jest.mock("./components/Configuration/Configuration", () => ({
+  __esModule: true,
+  default: () => <div data-testid="configuration">Configuration</div>,
+}));
+
 jest.mock("./components/History/AttackHistory", () => {
   const MockAttackHistory = ({
     onOpenAttack,
@@ -365,14 +370,14 @@ describe("App", () => {
     expect(screen.getByTestId("target-config")).toBeInTheDocument();
   });
 
-  it("redirects the legacy /config URL to targets", () => {
+  it("renders configuration at /config", () => {
     renderApp("/config");
 
     expect(screen.getByTestId("main-layout")).toHaveAttribute(
       "data-current-view",
-      "targets"
+      "configuration"
     );
-    expect(screen.getByTestId("target-config")).toBeInTheDocument();
+    expect(screen.getByTestId("configuration")).toBeInTheDocument();
   });
 
   it("renders the history view when deep-linked to /history", () => {
diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx
index c0c353014d..5ff5e78c28 100644
--- a/frontend/src/App.tsx
+++ b/frontend/src/App.tsx
@@ -9,7 +9,7 @@ import AttackNotFound from './components/Chat/AttackNotFound'
 import Home from './components/Home/Home'
 import TargetConfig from './components/Config/TargetConfig'
 import Initializers from './components/Initializers/Initializers'
-import BackendConfiguration from './components/BackendConfiguration/BackendConfiguration'
+import Configuration from './components/Configuration/Configuration'
 import AttackHistory from './components/History/AttackHistory'
 import FeedbackDialog from './components/Feedback/FeedbackDialog'
 import type { HistoryFilters } from './components/History/historyFilters'
@@ -40,12 +40,11 @@ const VIEW_PATHS: Record<ViewName, string> = {
   history: '/history',
   targets: '/targets',
   initializers: '/initializers',
-  backendConfig: '/backend-config',
+  configuration: '/config',
 }
 
 /** Resolves the active view from a URL path, defaulting to home for unknown paths. */
 function viewFromPath(pathname: string): ViewName {
-  if (pathname === '/config') return 'targets'
   const match = (Object.entries(VIEW_PATHS) as [ViewName, string][]).find(
     ([, path]) => path === pathname,
   )
@@ -420,9 +419,8 @@ function App() {
                   />
                 }
               />
-              <Route path="/config" element={<Navigate to="/targets" replace />} />
               <Route path="/initializers" element={<Initializers />} />
-              <Route path="/backend-config" element={<BackendConfiguration />} />
+              <Route path="/config" element={<Configuration />} />
               <Route
                 path="/history"
                 element={
diff --git a/frontend/src/components/BackendConfiguration/BackendConfiguration.styles.ts b/frontend/src/components/Configuration/Configuration.styles.ts
similarity index 98%
rename from frontend/src/components/BackendConfiguration/BackendConfiguration.styles.ts
rename to frontend/src/components/Configuration/Configuration.styles.ts
index aa94255f98..86bb19a95f 100644
--- a/frontend/src/components/BackendConfiguration/BackendConfiguration.styles.ts
+++ b/frontend/src/components/Configuration/Configuration.styles.ts
@@ -6,7 +6,7 @@ import {
   TOUCH_INPUT_QUERY,
 } from '@/styles/touchTargets'
 
-export const useBackendConfigurationStyles = makeStyles({
+export const useConfigurationStyles = makeStyles({
   root: {
     display: 'flex',
     flexDirection: 'column',
diff --git a/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx b/frontend/src/components/Configuration/Configuration.test.tsx
similarity index 97%
rename from frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx
rename to frontend/src/components/Configuration/Configuration.test.tsx
index b89db639af..0c36ee2528 100644
--- a/frontend/src/components/BackendConfiguration/BackendConfiguration.test.tsx
+++ b/frontend/src/components/Configuration/Configuration.test.tsx
@@ -4,7 +4,7 @@ import userEvent from '@testing-library/user-event'
 
 import { configurationApi, initializersApi } from '@/services/api'
 
-import BackendConfiguration from './BackendConfiguration'
+import Configuration from './Configuration'
 
 jest.mock('@/services/api', () => ({
   configurationApi: {
@@ -27,12 +27,12 @@ const mockedInitializersApi = jest.mocked(initializersApi)
 function renderPage(): void {
   render(
     <FluentProvider theme={webLightTheme}>
-      <BackendConfiguration />
+      <Configuration />
     </FluentProvider>,
   )
 }
 
-describe('BackendConfiguration', () => {
+describe('Configuration', () => {
   beforeEach(() => {
     jest.clearAllMocks()
     mockedConfigurationApi.getContent.mockResolvedValue({
@@ -91,7 +91,7 @@ describe('BackendConfiguration', () => {
     await user.click(screen.getByRole('button', { name: 'Save' }))
 
     expect(mockedConfigurationApi.updateContent).toHaveBeenCalledWith({ content: 'operator: bob\n' })
-    expect(await screen.findByText(/restart the backend/i)).toBeInTheDocument()
+    expect(await screen.findByText(/restart PyRIT/i)).toBeInTheDocument()
   })
 
   it('should show a load error', async () => {
diff --git a/frontend/src/components/BackendConfiguration/BackendConfiguration.tsx b/frontend/src/components/Configuration/Configuration.tsx
similarity index 92%
rename from frontend/src/components/BackendConfiguration/BackendConfiguration.tsx
rename to frontend/src/components/Configuration/Configuration.tsx
index c1ebf0311f..720b1c0451 100644
--- a/frontend/src/components/BackendConfiguration/BackendConfiguration.tsx
+++ b/frontend/src/components/Configuration/Configuration.tsx
@@ -17,7 +17,7 @@ import { configurationApi } from '@/services/api'
 import { toApiError } from '@/services/errors'
 import EditorWorkspace from '@/components/EditorWorkspace'
 
-import { useBackendConfigurationStyles } from './BackendConfiguration.styles'
+import { useConfigurationStyles } from './Configuration.styles'
 import CustomInitializerFiles from './CustomInitializerFiles'
 import EnvironmentFiles from './EnvironmentFiles'
 import YamlEditor from './YamlEditor'
@@ -29,8 +29,8 @@ interface StatusMessage {
 
 type ConfigurationTab = 'configuration' | 'environment' | 'custom-initializers'
 
-export default function BackendConfiguration() {
-  const styles = useBackendConfigurationStyles()
+export default function Configuration() {
+  const styles = useConfigurationStyles()
   const [content, setContent] = useState('')
   const [savedContent, setSavedContent] = useState('')
   const [source, setSource] = useState('')
@@ -84,7 +84,7 @@ export default function BackendConfiguration() {
       setSource(response.source)
       setStatusMessage({
         intent: 'success',
-        text: 'Configuration saved. Restart the backend process to apply these changes.',
+        text: 'Configuration saved. Restart PyRIT to apply these changes.',
       })
     } catch (error) {
       setStatusMessage({ intent: 'error', text: toApiError(error).detail })
@@ -137,7 +137,7 @@ export default function BackendConfiguration() {
           selectedId="configuration"
           navigationLabel="Configuration files"
           emptyMessage="Configuration file is unavailable."
-          description="Edit YAML configuration loaded when the backend starts."
+          description="Edit YAML configuration loaded when PyRIT starts."
           actions={(
             <div className={styles.actions}>
               <Button
@@ -164,7 +164,7 @@ export default function BackendConfiguration() {
           <Field
             className={styles.editorField}
             label={source}
-            hint={hasUnsavedChanges ? 'Unsaved changes' : 'Changes take effect after the backend process restarts.'}
+            hint={hasUnsavedChanges ? 'Unsaved changes' : 'Changes take effect after PyRIT restarts.'}
           >
             <YamlEditor
               value={content}
diff --git a/frontend/src/components/BackendConfiguration/CustomInitializerFiles.test.tsx b/frontend/src/components/Configuration/CustomInitializerFiles.test.tsx
similarity index 100%
rename from frontend/src/components/BackendConfiguration/CustomInitializerFiles.test.tsx
rename to frontend/src/components/Configuration/CustomInitializerFiles.test.tsx
diff --git a/frontend/src/components/BackendConfiguration/CustomInitializerFiles.tsx b/frontend/src/components/Configuration/CustomInitializerFiles.tsx
similarity index 95%
rename from frontend/src/components/BackendConfiguration/CustomInitializerFiles.tsx
rename to frontend/src/components/Configuration/CustomInitializerFiles.tsx
index dedd17d140..9a50c0aef0 100644
--- a/frontend/src/components/BackendConfiguration/CustomInitializerFiles.tsx
+++ b/frontend/src/components/Configuration/CustomInitializerFiles.tsx
@@ -7,7 +7,7 @@ import { initializersApi } from '@/services/api'
 import { toApiError } from '@/services/errors'
 import type { CustomInitializer } from '@/types'
 
-import { useBackendConfigurationStyles } from './BackendConfiguration.styles'
+import { useConfigurationStyles } from './Configuration.styles'
 
 interface StatusMessage {
   intent: 'success' | 'error'
@@ -15,7 +15,7 @@ interface StatusMessage {
 }
 
 export default function CustomInitializerFiles() {
-  const styles = useBackendConfigurationStyles()
+  const styles = useConfigurationStyles()
   const [items, setItems] = useState<CustomInitializer[]>([])
   const [loading, setLoading] = useState(true)
   const [registering, setRegistering] = useState(false)
diff --git a/frontend/src/components/BackendConfiguration/DotenvEditor.test.tsx b/frontend/src/components/Configuration/DotenvEditor.test.tsx
similarity index 100%
rename from frontend/src/components/BackendConfiguration/DotenvEditor.test.tsx
rename to frontend/src/components/Configuration/DotenvEditor.test.tsx
diff --git a/frontend/src/components/BackendConfiguration/DotenvEditor.tsx b/frontend/src/components/Configuration/DotenvEditor.tsx
similarity index 94%
rename from frontend/src/components/BackendConfiguration/DotenvEditor.tsx
rename to frontend/src/components/Configuration/DotenvEditor.tsx
index 01b372957c..a2a581bdcc 100644
--- a/frontend/src/components/BackendConfiguration/DotenvEditor.tsx
+++ b/frontend/src/components/Configuration/DotenvEditor.tsx
@@ -4,7 +4,7 @@ import Prism from 'prismjs'
 
 import CodeEditorFrame from '@/components/CodeEditorFrame'
 
-import { useBackendConfigurationStyles } from './BackendConfiguration.styles'
+import { useConfigurationStyles } from './Configuration.styles'
 
 interface DotenvEditorProps {
   value: string
@@ -38,7 +38,7 @@ function highlightDotenv(value: string): string {
 }
 
 export default function DotenvEditor({ value, disabled, onChange }: DotenvEditorProps) {
-  const styles = useBackendConfigurationStyles()
+  const styles = useConfigurationStyles()
   const highlightRef = useRef<HTMLPreElement>(null)
 
   const handleScroll = (event: React.UIEvent<HTMLTextAreaElement>): void => {
diff --git a/frontend/src/components/BackendConfiguration/EnvironmentFiles.test.tsx b/frontend/src/components/Configuration/EnvironmentFiles.test.tsx
similarity index 96%
rename from frontend/src/components/BackendConfiguration/EnvironmentFiles.test.tsx
rename to frontend/src/components/Configuration/EnvironmentFiles.test.tsx
index 07f8cc5a20..deb6bf174f 100644
--- a/frontend/src/components/BackendConfiguration/EnvironmentFiles.test.tsx
+++ b/frontend/src/components/Configuration/EnvironmentFiles.test.tsx
@@ -50,7 +50,7 @@ describe('EnvironmentFiles', () => {
     expect(mockedConfigurationApi.updateEnvironmentFile).toHaveBeenCalledWith('0', {
       content: 'VALUE=after\n',
     })
-    expect(await screen.findByText(/restart the backend/i)).toBeInTheDocument()
+    expect(await screen.findByText(/restart PyRIT/i)).toBeInTheDocument()
   })
 
   it('should show an error when the file list cannot be loaded', async () => {
diff --git a/frontend/src/components/BackendConfiguration/EnvironmentFiles.tsx b/frontend/src/components/Configuration/EnvironmentFiles.tsx
similarity index 95%
rename from frontend/src/components/BackendConfiguration/EnvironmentFiles.tsx
rename to frontend/src/components/Configuration/EnvironmentFiles.tsx
index f7ce45023f..6809a85c14 100644
--- a/frontend/src/components/BackendConfiguration/EnvironmentFiles.tsx
+++ b/frontend/src/components/Configuration/EnvironmentFiles.tsx
@@ -8,7 +8,7 @@ import { toApiError } from '@/services/errors'
 import type { EnvironmentFileContent } from '@/types'
 import EditorWorkspace from '@/components/EditorWorkspace'
 
-import { useBackendConfigurationStyles } from './BackendConfiguration.styles'
+import { useConfigurationStyles } from './Configuration.styles'
 import DotenvEditor from './DotenvEditor'
 
 interface StatusMessage {
@@ -17,7 +17,7 @@ interface StatusMessage {
 }
 
 export default function EnvironmentFiles() {
-  const styles = useBackendConfigurationStyles()
+  const styles = useConfigurationStyles()
   const [files, setFiles] = useState<EnvironmentFileContent[]>([])
   const [savedContents, setSavedContents] = useState<Record<string, string>>({})
   const [loadedIds, setLoadedIds] = useState<Set<string>>(() => new Set())
@@ -121,7 +121,7 @@ export default function EnvironmentFiles() {
       setSavedContents((currentContents) => ({ ...currentContents, [updated.id]: updated.content }))
       setStatusMessage({
         intent: 'success',
-        text: `${updated.name} saved. Restart the backend to apply these changes.`,
+        text: `${updated.name} saved. Restart PyRIT to apply these changes.`,
       })
     } catch (error) {
       setStatusMessage({ intent: 'error', text: toApiError(error).detail })
@@ -155,7 +155,7 @@ export default function EnvironmentFiles() {
         selectedId={selectedId}
         navigationLabel="Environment files"
         emptyMessage="No environment sources are enabled by the configuration."
-        description="Edit dotenv sources loaded when the backend starts."
+        description="Edit dotenv sources loaded when PyRIT starts."
         actions={(
           <div className={styles.actions}>
             <Button
diff --git a/frontend/src/components/BackendConfiguration/PythonCode.styles.ts b/frontend/src/components/Configuration/PythonCode.styles.ts
similarity index 100%
rename from frontend/src/components/BackendConfiguration/PythonCode.styles.ts
rename to frontend/src/components/Configuration/PythonCode.styles.ts
diff --git a/frontend/src/components/BackendConfiguration/PythonCode.test.tsx b/frontend/src/components/Configuration/PythonCode.test.tsx
similarity index 100%
rename from frontend/src/components/BackendConfiguration/PythonCode.test.tsx
rename to frontend/src/components/Configuration/PythonCode.test.tsx
diff --git a/frontend/src/components/BackendConfiguration/PythonCode.tsx b/frontend/src/components/Configuration/PythonCode.tsx
similarity index 100%
rename from frontend/src/components/BackendConfiguration/PythonCode.tsx
rename to frontend/src/components/Configuration/PythonCode.tsx
diff --git a/frontend/src/components/BackendConfiguration/YamlEditor.test.tsx b/frontend/src/components/Configuration/YamlEditor.test.tsx
similarity index 100%
rename from frontend/src/components/BackendConfiguration/YamlEditor.test.tsx
rename to frontend/src/components/Configuration/YamlEditor.test.tsx
diff --git a/frontend/src/components/BackendConfiguration/YamlEditor.tsx b/frontend/src/components/Configuration/YamlEditor.tsx
similarity index 92%
rename from frontend/src/components/BackendConfiguration/YamlEditor.tsx
rename to frontend/src/components/Configuration/YamlEditor.tsx
index 2db244aee4..48327f9a5d 100644
--- a/frontend/src/components/BackendConfiguration/YamlEditor.tsx
+++ b/frontend/src/components/Configuration/YamlEditor.tsx
@@ -5,7 +5,7 @@ import 'prismjs/components/prism-yaml'
 
 import CodeEditorFrame from '@/components/CodeEditorFrame'
 
-import { useBackendConfigurationStyles } from './BackendConfiguration.styles'
+import { useConfigurationStyles } from './Configuration.styles'
 
 interface YamlEditorProps {
   value: string
@@ -18,7 +18,7 @@ function highlightYaml(value: string): string {
 }
 
 export default function YamlEditor({ value, disabled, onChange }: YamlEditorProps) {
-  const styles = useBackendConfigurationStyles()
+  const styles = useConfigurationStyles()
   const highlightRef = useRef<HTMLPreElement>(null)
 
   const handleScroll = (event: React.UIEvent<HTMLTextAreaElement>): void => {
diff --git a/frontend/src/components/Initializers/AddCustomInitializerDialog.tsx b/frontend/src/components/Initializers/AddCustomInitializerDialog.tsx
index 604082e4bb..4a1052933e 100644
--- a/frontend/src/components/Initializers/AddCustomInitializerDialog.tsx
+++ b/frontend/src/components/Initializers/AddCustomInitializerDialog.tsx
@@ -13,7 +13,7 @@ import {
   Input,
 } from '@fluentui/react-components'
 
-import { PythonCodeEditor } from '@/components/BackendConfiguration/PythonCode'
+import { PythonCodeEditor } from '@/components/Configuration/PythonCode'
 
 import { useCustomInitializersStyles } from './CustomInitializers.styles'
 
diff --git a/frontend/src/components/Initializers/CustomInitializers.tsx b/frontend/src/components/Initializers/CustomInitializers.tsx
index e39e8328c4..6cda372e88 100644
--- a/frontend/src/components/Initializers/CustomInitializers.tsx
+++ b/frontend/src/components/Initializers/CustomInitializers.tsx
@@ -9,7 +9,7 @@ import { AddRegular, DeleteRegular } from '@fluentui/react-icons'
 
 import ConfirmDialog from '@/components/ConfirmDialog'
 import EditorWorkspace from '@/components/EditorWorkspace'
-import { PythonCodeEditor } from '@/components/BackendConfiguration/PythonCode'
+import { PythonCodeEditor } from '@/components/Configuration/PythonCode'
 import type { CustomInitializer } from '@/types'
 
 import AddCustomInitializerDialog from './AddCustomInitializerDialog'
@@ -58,7 +58,7 @@ export default function CustomInitializers({
         selectedId={selectedInitializer?.initializer_name ?? null}
         navigationLabel="Custom initializer files"
         emptyMessage="No custom initializer scripts stored."
-        description="Python initializers loaded when the backend starts."
+        description="Python initializers loaded when PyRIT starts."
         actions={(
           <div className={styles.editorActions}>
             <Button appearance="subtle" icon={<AddRegular />} onClick={() => setDialogOpen(true)}>
diff --git a/frontend/src/components/Sidebar/Navigation.test.tsx b/frontend/src/components/Sidebar/Navigation.test.tsx
index cedd798437..4043b4a3cb 100644
--- a/frontend/src/components/Sidebar/Navigation.test.tsx
+++ b/frontend/src/components/Sidebar/Navigation.test.tsx
@@ -90,15 +90,15 @@ describe("Navigation", () => {
     expect(onNavigate).toHaveBeenCalledWith("targets");
   });
 
-  it("navigates to backend configuration", async () => {
+  it("navigates to configuration", async () => {
     const user = userEvent.setup();
     const onNavigate = jest.fn();
     renderWithProvider(
       <Navigation {...defaultProps} onNavigate={onNavigate} />
     );
 
-    await user.click(screen.getByRole("button", { name: "Backend Configuration" }));
-    expect(onNavigate).toHaveBeenCalledWith("backendConfig");
+    await user.click(screen.getByRole("button", { name: "Configuration" }));
+    expect(onNavigate).toHaveBeenCalledWith("configuration");
   });
 
   it("renders the attack history button", () => {
diff --git a/frontend/src/components/Sidebar/Navigation.tsx b/frontend/src/components/Sidebar/Navigation.tsx
index 20b1360126..4c02f92e86 100644
--- a/frontend/src/components/Sidebar/Navigation.tsx
+++ b/frontend/src/components/Sidebar/Navigation.tsx
@@ -24,7 +24,7 @@ import { useTheme } from '../../hooks/useTheme'
 import type { ThemeMode } from '../../hooks/useTheme'
 import { useNavigationStyles } from './Navigation.styles'
 
-export type ViewName = 'home' | 'chat' | 'history' | 'targets' | 'initializers' | 'backendConfig'
+export type ViewName = 'home' | 'chat' | 'history' | 'targets' | 'initializers' | 'configuration'
 
 interface NavigationProps {
   currentView: ViewName
@@ -119,13 +119,13 @@ export default function Navigation({ currentView, onNavigate, onOpenFeedback }:
 
         <Button
           className={styles.navButton}
-          data-active={currentView === 'backendConfig'}
+          data-active={currentView === 'configuration'}
           appearance="subtle"
           icon={<SettingsRegular />}
-          title="Backend Configuration"
-          aria-label="Backend Configuration"
-          aria-current={currentView === 'backendConfig' ? 'page' : undefined}
-          onClick={() => onNavigate('backendConfig')}
+          title="Configuration"
+          aria-label="Configuration"
+          aria-current={currentView === 'configuration' ? 'page' : undefined}
+          onClick={() => onNavigate('configuration')}
         />
 
       </nav>

From c15beabcdbb9c68dc65671239b585e5352eb9f40 Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Fri, 28 Aug 2026 12:15:08 -0700
Subject: [PATCH 22/24] address feedback

---
 doc/gui/0_gui.md                              |  14 ++
 .../CustomInitializerFiles.test.tsx           |   2 +-
 .../Configuration/DotenvEditor.test.tsx       |   2 +-
 .../Configuration/EnvironmentFiles.test.tsx   |   7 +-
 .../Configuration/EnvironmentFiles.tsx        |   3 +-
 .../Configuration/PythonCode.test.tsx         |   2 +-
 .../Configuration/YamlEditor.test.tsx         |   2 +-
 .../AddCustomInitializerDialog.tsx            |   2 +-
 frontend/src/services/api.test.ts             |   2 +-
 frontend/src/services/api.ts                  |   3 +-
 frontend/src/types/index.ts                   |   6 +
 infra/README.md                               |   7 +-
 infra/deploy_instance.py                      |  39 ++++-
 infra/main.bicep                              |  39 +++--
 pyrit/backend/middleware/auth.py              |   8 +-
 pyrit/backend/models/configuration.py         |   2 +
 pyrit/backend/routes/configuration.py         | 154 ++++++++++++++++-
 pyrit/backend/routes/initializers.py          |   4 +
 .../services/configuration_file_service.py    |  20 +--
 .../services/environment_file_service.py      | 156 ++++++++++++------
 pyrit/common/azure_storage.py                 |  56 +++++++
 .../components/initializer_registry.py        |   7 +-
 pyrit/registry/custom_initializer_storage.py  |  33 +---
 tests/unit/backend/test_auth_middleware.py    |  30 +++-
 .../test_configuration_file_service.py        |  18 ++
 .../unit/backend/test_configuration_routes.py | 138 ++++++++++++----
 .../backend/test_environment_file_service.py  | 132 ++++++++++++---
 .../unit/backend/test_initializer_service.py  |  59 ++++++-
 tests/unit/common/test_azure_storage.py       |  58 +++++++
 tests/unit/infra/test_deploy_instance.py      |  30 ++++
 30 files changed, 849 insertions(+), 186 deletions(-)
 create mode 100644 pyrit/common/azure_storage.py
 create mode 100644 tests/unit/common/test_azure_storage.py
 create mode 100644 tests/unit/infra/test_deploy_instance.py

diff --git a/doc/gui/0_gui.md b/doc/gui/0_gui.md
index 60d96adc2f..be8ca06060 100644
--- a/doc/gui/0_gui.md
+++ b/doc/gui/0_gui.md
@@ -16,6 +16,10 @@ pyrit_backend
 
 Then open `http://localhost:8000` in your browser.
 
+Authentication-disabled local servers deny administrator operations by default. To enable configuration and initializer
+administration for a trusted local development server, set `PYRIT_ALLOW_UNAUTHENTICATED_ADMIN=true`. Never use this
+setting on a network-accessible deployment.
+
 ### Docker
 
 CoPyRIT is also available as a Docker container. See the [Docker setup](https://github.com/microsoft/PyRIT/blob/main/docker/) for details.
@@ -164,6 +168,16 @@ For `AzureMLChatTarget`, additional fields are available: **Max New Tokens**, **
 
 Targets can also be auto-populated by adding the `target` initializer to your `~/.pyrit/.pyrit_conf` file. This reads endpoints from your `.env` and `.env.local` files. See [.pyrit_conf_example](https://github.com/microsoft/PyRIT/blob/main/.pyrit_conf_example) for details.
 
+### Configuration Editor
+
+The **Configuration** page provides administrator-only editing for the files and scripts used to configure PyRIT. It has three tabs:
+
+- **PyRIT Configuration** edits the active `.pyrit_conf` YAML file. The source may be a local file or an Azure Blob URI. Saving validates the configuration before replacing it.
+- **Environment & Secrets** lists the configured local dotenv files and Azure Key Vault bootstrap secrets. Content is loaded only after selecting a source. Saves validate the dotenv document and reject the update if the source changed since it was loaded.
+- **Custom Initializers** registers or removes Python initializer scripts. This tab requires `allow_custom_initializers: true`; scripts are stored in the configured local directory or Azure Blob container and must define a concrete `PyRITInitializer` subclass.
+
+Use **Reload** to discard local edits and fetch the latest source content. Saved configuration and environment changes take effect after restarting PyRIT. Custom initializer scripts execute under the backend service identity, so only trusted administrators should manage them.
+
 ### Initializers
 
 The **Initializers** page (in the left navigation) lets you review and extend how PyRIT sets itself up at startup — for example, the `target` initializer's `tags` and `auto_group` settings.
diff --git a/frontend/src/components/Configuration/CustomInitializerFiles.test.tsx b/frontend/src/components/Configuration/CustomInitializerFiles.test.tsx
index 7d910b25d2..91e5b9e6a4 100644
--- a/frontend/src/components/Configuration/CustomInitializerFiles.test.tsx
+++ b/frontend/src/components/Configuration/CustomInitializerFiles.test.tsx
@@ -55,4 +55,4 @@ describe('CustomInitializerFiles', () => {
 
     expect(await screen.findByText('Custom initializers unavailable')).toBeInTheDocument()
   })
-})
\ No newline at end of file
+})
diff --git a/frontend/src/components/Configuration/DotenvEditor.test.tsx b/frontend/src/components/Configuration/DotenvEditor.test.tsx
index 0fb9d504e9..8c5f757f66 100644
--- a/frontend/src/components/Configuration/DotenvEditor.test.tsx
+++ b/frontend/src/components/Configuration/DotenvEditor.test.tsx
@@ -30,4 +30,4 @@ describe('DotenvEditor', () => {
 
     expect(screen.getByRole('textbox', { name: 'Environment file contents' })).toBeDisabled()
   })
-})
\ No newline at end of file
+})
diff --git a/frontend/src/components/Configuration/EnvironmentFiles.test.tsx b/frontend/src/components/Configuration/EnvironmentFiles.test.tsx
index deb6bf174f..2de12f92a8 100644
--- a/frontend/src/components/Configuration/EnvironmentFiles.test.tsx
+++ b/frontend/src/components/Configuration/EnvironmentFiles.test.tsx
@@ -31,14 +31,14 @@ describe('EnvironmentFiles', () => {
       items: [{ id: '0', name: '.env', path: 'C:/config/.env', content: '', exists: true }],
     })
     mockedConfigurationApi.getEnvironmentFile.mockResolvedValue({
-      id: '0', name: '.env', path: 'C:/config/.env', content: 'VALUE=before\n', exists: true,
+      id: '0', name: '.env', path: 'C:/config/.env', content: 'VALUE=before\n', exists: true, version: 'version-1',
     })
   })
 
   it('should load, edit, and save an environment file', async () => {
     const user = userEvent.setup()
     mockedConfigurationApi.updateEnvironmentFile.mockResolvedValue({
-      id: '0', name: '.env', path: 'C:/config/.env', content: 'VALUE=after\n', exists: true,
+      id: '0', name: '.env', path: 'C:/config/.env', content: 'VALUE=after\n', exists: true, version: 'version-2',
     })
     renderFiles()
 
@@ -49,6 +49,7 @@ describe('EnvironmentFiles', () => {
 
     expect(mockedConfigurationApi.updateEnvironmentFile).toHaveBeenCalledWith('0', {
       content: 'VALUE=after\n',
+      version: 'version-1',
     })
     expect(await screen.findByText(/restart PyRIT/i)).toBeInTheDocument()
   })
@@ -59,4 +60,4 @@ describe('EnvironmentFiles', () => {
 
     expect(await screen.findByText('Environment unavailable')).toBeInTheDocument()
   })
-})
\ No newline at end of file
+})
diff --git a/frontend/src/components/Configuration/EnvironmentFiles.tsx b/frontend/src/components/Configuration/EnvironmentFiles.tsx
index 6809a85c14..3ee6462bfd 100644
--- a/frontend/src/components/Configuration/EnvironmentFiles.tsx
+++ b/frontend/src/components/Configuration/EnvironmentFiles.tsx
@@ -108,12 +108,13 @@ export default function EnvironmentFiles() {
   }
 
   const handleSave = async (): Promise<void> => {
-    if (!selectedFile) return
+    if (!selectedFile?.version) return
     setSaving(true)
     setStatusMessage(null)
     try {
       const updated = await configurationApi.updateEnvironmentFile(selectedFile.id, {
         content: selectedFile.content,
+        version: selectedFile.version,
       })
       setFiles((currentFiles) =>
         currentFiles.map((file) => file.id === updated.id ? updated : file),
diff --git a/frontend/src/components/Configuration/PythonCode.test.tsx b/frontend/src/components/Configuration/PythonCode.test.tsx
index 1a7415cf77..44fd86ee6f 100644
--- a/frontend/src/components/Configuration/PythonCode.test.tsx
+++ b/frontend/src/components/Configuration/PythonCode.test.tsx
@@ -42,4 +42,4 @@ describe('PythonCode', () => {
 
     expect(screen.getByRole('textbox', { name: 'Python source' })).toBeDisabled()
   })
-})
\ No newline at end of file
+})
diff --git a/frontend/src/components/Configuration/YamlEditor.test.tsx b/frontend/src/components/Configuration/YamlEditor.test.tsx
index a3db6703ef..aedb5bae17 100644
--- a/frontend/src/components/Configuration/YamlEditor.test.tsx
+++ b/frontend/src/components/Configuration/YamlEditor.test.tsx
@@ -30,4 +30,4 @@ describe('YamlEditor', () => {
 
     expect(screen.getByRole('textbox', { name: 'Configuration YAML' })).toBeDisabled()
   })
-})
\ No newline at end of file
+})
diff --git a/frontend/src/components/Initializers/AddCustomInitializerDialog.tsx b/frontend/src/components/Initializers/AddCustomInitializerDialog.tsx
index 4a1052933e..b96b6afd9b 100644
--- a/frontend/src/components/Initializers/AddCustomInitializerDialog.tsx
+++ b/frontend/src/components/Initializers/AddCustomInitializerDialog.tsx
@@ -79,4 +79,4 @@ export default function AddCustomInitializerDialog({
       </DialogSurface>
     </Dialog>
   )
-}
\ No newline at end of file
+}
diff --git a/frontend/src/services/api.test.ts b/frontend/src/services/api.test.ts
index c4f7355c44..0ece4de0f0 100644
--- a/frontend/src/services/api.test.ts
+++ b/frontend/src/services/api.test.ts
@@ -210,7 +210,7 @@ describe("api service", () => {
     });
 
     it("should update an environment file", async () => {
-      const request = { content: "KEY=value\n" };
+      const request = { content: "KEY=value\n", version: "version-1" };
       const response = {
         data: {
           id: "akv:0",
diff --git a/frontend/src/services/api.ts b/frontend/src/services/api.ts
index 0c4c94698f..a6326392bf 100644
--- a/frontend/src/services/api.ts
+++ b/frontend/src/services/api.ts
@@ -32,6 +32,7 @@ import type {
   ChangeMainConversationResponse,
   ConfigurationFileContent,
   EnvironmentFileContent,
+  UpdateEnvironmentFileRequest,
   EnvironmentFileListResponse,
   UpdateConfigurationFileRequest,
 } from '../types'
@@ -177,7 +178,7 @@ export const configurationApi = {
 
   updateEnvironmentFile: async (
     fileId: string,
-    request: UpdateConfigurationFileRequest,
+    request: UpdateEnvironmentFileRequest,
   ): Promise<EnvironmentFileContent> => {
     const response = await apiClient.put(`/config/env-files/${encodeURIComponent(fileId)}`, request)
     return response.data
diff --git a/frontend/src/types/index.ts b/frontend/src/types/index.ts
index 8f408c5bc9..f4b24e74f7 100644
--- a/frontend/src/types/index.ts
+++ b/frontend/src/types/index.ts
@@ -65,12 +65,18 @@ export interface UpdateConfigurationFileRequest {
   content: string
 }
 
+export interface UpdateEnvironmentFileRequest {
+  content: string
+  version: string
+}
+
 export interface EnvironmentFileContent {
   id: string
   name: string
   path: string
   content: string
   exists: boolean
+  version?: string | null
 }
 
 export interface EnvironmentFileListResponse {
diff --git a/infra/README.md b/infra/README.md
index 746d9b8238..5c7f2dd014 100644
--- a/infra/README.md
+++ b/infra/README.md
@@ -426,14 +426,15 @@ The backend can load `.pyrit_conf` directly from Azure Blob Storage. Set
 the URI to `pyrit_backend --config-file`; the backend downloads it with the
 Container App's user-assigned managed identity. Leave the parameter empty to
 generate the existing minimal config from `sqlServerFqdn` and
-`pyritInitializer` at container startup.
+`pyritInitializer` at container startup. The deployment helper rejects SAS
+URLs and redacts the configured URI from dry-run output. The Bicep parameter is
+marked `@secure()` and reaches the container through a secret reference.
 
 Grant the managed identity `Storage Blob Data Contributor` on the config blob,
 container, or storage account. Contributor access is needed because the GUI's
 configuration API can update the same blob; `Storage Blob Data Reader` is
 sufficient only for read-only startup. The storage firewall must also allow the
-Container App's network path. Prefer an identity-protected URI without a SAS
-token.
+Container App's network path. Use an identity-protected URI without a SAS token.
 
 The template accepts an existing blob URI rather than creating or seeding a
 storage account. `infra/deploy_instance.py` already creates per-instance blob
diff --git a/infra/deploy_instance.py b/infra/deploy_instance.py
index 694ea076e1..4db53c92b5 100644
--- a/infra/deploy_instance.py
+++ b/infra/deploy_instance.py
@@ -40,6 +40,7 @@
 import tempfile
 import time
 from pathlib import Path
+from urllib.parse import urlparse
 
 logging.basicConfig(level=logging.INFO, format="%(levelname)s: %(message)s")
 logger = logging.getLogger(__name__)
@@ -48,11 +49,41 @@
 BICEP_TEMPLATE = INFRA_DIR / "main.bicep"
 _MICROSOFT_GRAPH_APP_ID = "00000003-0000-0000-c000-000000000000"
 _GRAPH_USER_READ_SCOPE_ID = "e1fe6dd8-ba31-4d61-89e7-88639da4683d"
+_AZURE_BLOB_HOST_SUFFIXES = (
+    ".blob.core.windows.net",
+    ".blob.core.chinacloudapi.cn",
+    ".blob.core.usgovcloudapi.net",
+    ".blob.core.cloudapi.de",
+)
 
 # On Windows, az CLI is a .cmd script that requires shell=True for subprocess to find it.
 _SHELL = platform.system() == "Windows"
 
 
+def _managed_identity_blob_uri(value: str) -> str:
+    """Validate a credential-free Azure Blob URI for managed-identity access."""
+    if not value:
+        return value
+
+    parsed_uri = urlparse(value)
+    hostname = parsed_uri.hostname or ""
+    valid_hostname = any(hostname.endswith(suffix) and hostname != suffix[1:] for suffix in _AZURE_BLOB_HOST_SUFFIXES)
+    if (
+        parsed_uri.scheme != "https"
+        or not valid_hostname
+        or parsed_uri.username is not None
+        or parsed_uri.password is not None
+        or parsed_uri.port is not None
+        or parsed_uri.query
+        or parsed_uri.fragment
+        or len(parsed_uri.path.strip("/").split("/")) < 2
+    ):
+        raise argparse.ArgumentTypeError(
+            "--pyrit-config-file-uri must be a credential-free Azure Blob HTTPS URI; SAS URLs are not supported"
+        )
+    return value
+
+
 def run_az(
     *,
     args: list[str],
@@ -1102,7 +1133,8 @@ def parse_args(args: list[str] | None = None) -> argparse.Namespace:
     parser.add_argument(
         "--pyrit-config-file-uri",
         default="",
-        help="Azure Blob HTTPS URI for .pyrit_conf (optional)",
+        type=_managed_identity_blob_uri,
+        help="Credential-free Azure Blob HTTPS URI for .pyrit_conf using managed identity (optional)",
     )
     parser.add_argument(
         "--allowed-groups",
@@ -1228,7 +1260,10 @@ def main(args: list[str] | None = None) -> int:
         logger.info("Admin group: %s", admin_group_id)
         logger.info("Env file: %s", env_file)
         logger.info("Container image: %s", parsed.container_image)
-        logger.info("PyRIT config file URI: %s", parsed.pyrit_config_file_uri or "(generated at startup)")
+        logger.info(
+            "PyRIT config file URI: %s",
+            "(configured; managed identity)" if parsed.pyrit_config_file_uri else "(generated at startup)",
+        )
         logger.info("ACR: %s", parsed.acr_name)
         logger.info("Location: %s", parsed.location)
         logger.info("Subscription: %s", parsed.subscription)
diff --git a/infra/main.bicep b/infra/main.bicep
index cb594ed065..e8b5c655b1 100644
--- a/infra/main.bicep
+++ b/infra/main.bicep
@@ -82,7 +82,8 @@ param sqlDatabaseName string
 @description('PyRIT initializer to run. Default "target" registers target configs.')
 param pyritInitializer string = 'target'
 
-@description('Optional Azure Blob HTTPS URI for the backend .pyrit_conf. The container managed identity must have blob data access. When empty, start.sh generates config from the SQL and initializer parameters.')
+@secure()
+@description('Optional Azure Blob HTTPS URI for the backend .pyrit_conf. The deployment helper accepts credential-free managed-identity URIs only. When empty, start.sh generates config from the SQL and initializer parameters.')
 param pyritConfigFileUri string = ''
 
 @description('Key Vault secret name containing the .env file contents. Used as env_akv_ref when envFileContents is empty.')
@@ -423,12 +424,20 @@ resource containerApp 'Microsoft.App/containerApps@2024-03-01' = {
         }
       ]
 
-      secrets: useInlineEnvFile ? [
-        {
-          name: 'env-file'
-          value: envFileContents
-        }
-      ] : []
+      secrets: concat(
+        useInlineEnvFile ? [
+          {
+            name: 'env-file'
+            value: envFileContents
+          }
+        ] : [],
+        !empty(pyritConfigFileUri) ? [
+          {
+            name: 'config-file-uri'
+            value: pyritConfigFileUri
+          }
+        ] : []
+      )
     }
 
     template: {
@@ -458,12 +467,16 @@ resource containerApp 'Microsoft.App/containerApps@2024-03-01' = {
               name: 'PYRIT_INITIALIZER'
               value: pyritInitializer
             }
-            // When set, start.sh passes this blob URI directly to pyrit_backend.
-            // DefaultAzureCredential uses the UAMI selected by AZURE_CLIENT_ID.
-            {
-              name: 'PYRIT_CONFIG_FILE'
-              value: pyritConfigFileUri
-            }
+            // Keep URI credentials out of plain Container App configuration.
+            !empty(pyritConfigFileUri)
+              ? {
+                  name: 'PYRIT_CONFIG_FILE'
+                  secretRef: 'config-file-uri'
+                }
+              : {
+                  name: 'PYRIT_CONFIG_FILE'
+                  value: ''
+                }
             useInlineEnvFile
               ? {
                   name: 'PYRIT_ENV_CONTENTS'
diff --git a/pyrit/backend/middleware/auth.py b/pyrit/backend/middleware/auth.py
index eedbba8f5f..a024612173 100644
--- a/pyrit/backend/middleware/auth.py
+++ b/pyrit/backend/middleware/auth.py
@@ -53,7 +53,9 @@ def require_admin(request: Request) -> None:
     """Require an administrator when authentication is enabled."""
     user = getattr(request.state, "user", None)
     if user is None:
-        return
+        allow_unauthenticated = os.getenv("PYRIT_ALLOW_UNAUTHENTICATED_ADMIN", "").strip().casefold() == "true"
+        if allow_unauthenticated:
+            return
     if not isinstance(user, AuthenticatedUser) or not user.is_admin:
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
@@ -104,6 +106,10 @@ def __init__(self, app: ASGIApp) -> None:
             ]
             if missing_settings:
                 raise ValueError(f"Incomplete Entra ID configuration: {', '.join(missing_settings)} must be set")
+            if not self._admin_group_id:
+                logger.warning(
+                    "ENTRA_ADMIN_GROUP_ID is not set; authenticated users cannot access administrator routes."
+                )
             logger.info("Entra ID auth middleware enabled (tenant=%s)", self._tenant_id)
         else:
             logger.warning(
diff --git a/pyrit/backend/models/configuration.py b/pyrit/backend/models/configuration.py
index 905448c008..a2e4e7037e 100644
--- a/pyrit/backend/models/configuration.py
+++ b/pyrit/backend/models/configuration.py
@@ -27,6 +27,7 @@ class EnvironmentFileContent(BaseModel):
     path: str = Field(..., description="Resolved environment file path")
     content: str = Field(..., description="Raw dotenv file contents")
     exists: bool = Field(..., description="Whether the environment file currently exists")
+    version: str | None = Field(None, description="Opaque version token for optimistic concurrency")
 
 
 class EnvironmentFileListResponse(BaseModel):
@@ -39,3 +40,4 @@ class UpdateEnvironmentFileRequest(BaseModel):
     """Replacement contents for an environment file."""
 
     content: str = Field(..., description="Raw dotenv file contents")
+    version: str = Field(..., description="Version token returned by the latest content read")
diff --git a/pyrit/backend/routes/configuration.py b/pyrit/backend/routes/configuration.py
index 7f4cd50b7d..938074a3e1 100644
--- a/pyrit/backend/routes/configuration.py
+++ b/pyrit/backend/routes/configuration.py
@@ -3,12 +3,14 @@
 
 """Backend configuration file API routes."""
 
+import logging
 import os
+from hashlib import sha256
 
-from azure.core.exceptions import ResourceNotFoundError
+from azure.core.exceptions import AzureError, ResourceNotFoundError
 from fastapi import APIRouter, Depends, HTTPException, Request, status
 
-from pyrit.backend.middleware.auth import require_admin
+from pyrit.backend.middleware.auth import AuthenticatedUser, require_admin
 from pyrit.backend.models.common import ProblemDetail
 from pyrit.backend.models.configuration import (
     ConfigurationFileContent,
@@ -18,11 +20,59 @@
     UpdateEnvironmentFileRequest,
 )
 from pyrit.backend.services.configuration_file_service import ConfigurationFileService
-from pyrit.backend.services.environment_file_service import EnvironmentFileService
+from pyrit.backend.services.environment_file_service import EnvironmentFileConflictError, EnvironmentFileService
+from pyrit.exceptions import KeyVaultInitializationException
 
+logger = logging.getLogger(__name__)
 router = APIRouter(prefix="/config", tags=["config"], dependencies=[Depends(require_admin)])
 
 
+def _content_hash(content: str) -> str:
+    """
+    Hash content for audit correlation without logging its value.
+
+    Returns:
+        str: The SHA-256 content digest.
+    """
+    return sha256(content.encode("utf-8")).hexdigest()
+
+
+def _audit_configuration_access(
+    *,
+    request: Request,
+    action: str,
+    source: str,
+    outcome: str,
+    version: str | None = None,
+) -> None:
+    """Write a secret-free audit record for a configuration operation."""
+    user = getattr(request.state, "user", None)
+    oid = user.oid if isinstance(user, AuthenticatedUser) else "local-development"
+    user_name = user.name if isinstance(user, AuthenticatedUser) else "local-development"
+    logger.info(
+        "Configuration audit oid=%s user_name=%r action=%s source=%s outcome=%s version=%s",
+        oid,
+        user_name,
+        action,
+        source,
+        outcome,
+        version or "none",
+    )
+
+
+def _storage_unavailable() -> HTTPException:
+    """
+    Create a sanitized response for an unavailable remote configuration store.
+
+    Returns:
+        HTTPException: A service-unavailable response without SDK details.
+    """
+    return HTTPException(
+        status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+        detail="Configuration storage is temporarily unavailable",
+    )
+
+
 def _get_configuration_file_service(request: Request) -> ConfigurationFileService:
     """
     Get the configuration file service associated with backend startup.
@@ -73,7 +123,18 @@ async def get_configuration_file(  # pyrit-async-suffix-exempt
     try:
         content = await service.read_async()
     except (FileNotFoundError, ResourceNotFoundError) as exc:
+        _audit_configuration_access(request=request, action="read-config", source=service.source, outcome="not-found")
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Configuration file not found") from exc
+    except AzureError as exc:
+        _audit_configuration_access(request=request, action="read-config", source=service.source, outcome="unavailable")
+        raise _storage_unavailable() from exc
+    _audit_configuration_access(
+        request=request,
+        action="read-config",
+        source=service.source,
+        outcome="success",
+        version=_content_hash(content),
+    )
     return ConfigurationFileContent(content=content, source=service.source)
 
 
@@ -102,9 +163,26 @@ async def update_configuration_file(  # pyrit-async-suffix-exempt
         await service.read_async()
         await service.update_async(body.content)
     except (FileNotFoundError, ResourceNotFoundError) as exc:
+        _audit_configuration_access(request=request, action="update-config", source=service.source, outcome="not-found")
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Configuration file not found") from exc
+    except AzureError as exc:
+        _audit_configuration_access(
+            request=request,
+            action="update-config",
+            source=service.source,
+            outcome="unavailable",
+        )
+        raise _storage_unavailable() from exc
     except ValueError as exc:
+        _audit_configuration_access(request=request, action="update-config", source=service.source, outcome="invalid")
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(exc)) from exc
+    _audit_configuration_access(
+        request=request,
+        action="update-config",
+        source=service.source,
+        outcome="success",
+        version=_content_hash(body.content),
+    )
     return ConfigurationFileContent(content=body.content, source=service.source)
 
 
@@ -118,14 +196,32 @@ async def list_environment_files(  # pyrit-async-suffix-exempt
     Returns:
         EnvironmentFileListResponse: Environment files in effective load order.
     """
-    items = await _get_environment_file_service(request).list_async()
+    try:
+        items = await _get_environment_file_service(request).list_async()
+    except (AzureError, KeyVaultInitializationException) as exc:
+        _audit_configuration_access(
+            request=request,
+            action="list-environment-sources",
+            source="environment-sources",
+            outcome="unavailable",
+        )
+        raise _storage_unavailable() from exc
+    _audit_configuration_access(
+        request=request,
+        action="list-environment-sources",
+        source="environment-sources",
+        outcome="success",
+    )
     return EnvironmentFileListResponse(items=items)
 
 
 @router.get(
     "/env-files/{file_id}",
     response_model=EnvironmentFileContent,
-    responses={404: {"model": ProblemDetail, "description": "Environment file not found"}},
+    responses={
+        404: {"model": ProblemDetail, "description": "Environment file not found"},
+        409: {"model": ProblemDetail, "description": "Environment file changed"},
+    },
 )
 async def get_environment_file(  # pyrit-async-suffix-exempt
     file_id: str,
@@ -138,9 +234,21 @@ async def get_environment_file(  # pyrit-async-suffix-exempt
         EnvironmentFileContent: The selected environment source and its contents.
     """
     try:
-        return await _get_environment_file_service(request).read_async(file_id=file_id)
+        item = await _get_environment_file_service(request).read_async(file_id=file_id)
     except KeyError as exc:
+        _audit_configuration_access(request=request, action="read-environment", source=file_id, outcome="not-found")
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Environment file not found") from exc
+    except (AzureError, KeyVaultInitializationException) as exc:
+        _audit_configuration_access(request=request, action="read-environment", source=file_id, outcome="unavailable")
+        raise _storage_unavailable() from exc
+    _audit_configuration_access(
+        request=request,
+        action="read-environment",
+        source=item.path,
+        outcome="success",
+        version=item.version,
+    )
+    return item
 
 
 @router.put(
@@ -162,8 +270,40 @@ async def update_environment_file(  # pyrit-async-suffix-exempt
         EnvironmentFileContent: The persisted environment file.
     """
     try:
-        return await _get_environment_file_service(request).update_async(file_id=file_id, content=body.content)
+        item = await _get_environment_file_service(request).update_async(
+            file_id=file_id,
+            content=body.content,
+            expected_version=body.version,
+        )
     except KeyError as exc:
+        _audit_configuration_access(request=request, action="update-environment", source=file_id, outcome="not-found")
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Environment file not found") from exc
+    except (AzureError, KeyVaultInitializationException) as exc:
+        _audit_configuration_access(request=request, action="update-environment", source=file_id, outcome="unavailable")
+        raise _storage_unavailable() from exc
     except ValueError as exc:
+        _audit_configuration_access(
+            request=request,
+            action="update-environment",
+            source=file_id,
+            outcome="invalid",
+            version=_content_hash(body.content),
+        )
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(exc)) from exc
+    except EnvironmentFileConflictError as exc:
+        _audit_configuration_access(
+            request=request,
+            action="update-environment",
+            source=file_id,
+            outcome="conflict",
+            version=body.version,
+        )
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail=str(exc)) from exc
+    _audit_configuration_access(
+        request=request,
+        action="update-environment",
+        source=item.path,
+        outcome="success",
+        version=item.version,
+    )
+    return item
diff --git a/pyrit/backend/routes/initializers.py b/pyrit/backend/routes/initializers.py
index bbf46a830b..230c10247a 100644
--- a/pyrit/backend/routes/initializers.py
+++ b/pyrit/backend/routes/initializers.py
@@ -126,6 +126,7 @@ async def get_initializer_settings(  # pyrit-async-suffix-exempt
     "/settings",
     response_model=AdditionalInitializer,
     status_code=status.HTTP_201_CREATED,
+    dependencies=[Depends(require_admin)],
     responses={
         400: {"model": ProblemDetail, "description": "Invalid initializer settings"},
         404: {"model": ProblemDetail, "description": "Initializer not found"},
@@ -162,6 +163,7 @@ async def create_additional_initializer(  # pyrit-async-suffix-exempt
 @router.put(
     "/settings/{additional_initializer_id}",
     response_model=AdditionalInitializer,
+    dependencies=[Depends(require_admin)],
     responses={
         400: {"model": ProblemDetail, "description": "Invalid initializer settings"},
         404: {"model": ProblemDetail, "description": "Additional initializer not found"},
@@ -200,6 +202,7 @@ async def update_additional_initializer(  # pyrit-async-suffix-exempt
 @router.delete(
     "/settings/{additional_initializer_id}",
     status_code=status.HTTP_204_NO_CONTENT,
+    dependencies=[Depends(require_admin)],
 )
 async def delete_additional_initializer(  # pyrit-async-suffix-exempt
     additional_initializer_id: str,
@@ -217,6 +220,7 @@ async def delete_additional_initializer(  # pyrit-async-suffix-exempt
 @router.post(
     "/{initializer_name}/apply",
     response_model=ApplyInitializerResponse,
+    dependencies=[Depends(require_admin)],
     responses={
         400: {"model": ProblemDetail, "description": "Initializer apply failed"},
         404: {"model": ProblemDetail, "description": "Initializer not found"},
diff --git a/pyrit/backend/services/configuration_file_service.py b/pyrit/backend/services/configuration_file_service.py
index a3a6f212e2..7fe4adcf28 100644
--- a/pyrit/backend/services/configuration_file_service.py
+++ b/pyrit/backend/services/configuration_file_service.py
@@ -9,23 +9,18 @@
 from collections.abc import AsyncGenerator
 from contextlib import asynccontextmanager
 from pathlib import Path
-from urllib.parse import parse_qs, urlparse
+from urllib.parse import urlparse
 
 import aiofiles
 import yaml
 
+from pyrit.common.azure_storage import has_sas_signature, is_azure_blob_uri, redact_url_credentials
 from pyrit.setup.configuration_loader import ConfigurationLoader
 
 
 def _is_azure_blob_uri(value: str) -> bool:
     """Return whether a value is an Azure Blob Storage HTTPS URI."""
-    parsed_uri = urlparse(value)
-    return (
-        parsed_uri.scheme == "https"
-        and parsed_uri.hostname is not None
-        and ".blob." in parsed_uri.hostname
-        and len(parsed_uri.path.strip("/").split("/")) >= 2
-    )
+    return is_azure_blob_uri(value, min_path_segments=2)
 
 
 async def _download_blob_config_async(blob_uri: str) -> bytes:
@@ -38,8 +33,7 @@ async def _download_blob_config_async(blob_uri: str) -> bytes:
     from azure.identity.aio import DefaultAzureCredential
     from azure.storage.blob.aio import BlobClient
 
-    parsed_uri = urlparse(blob_uri)
-    if "sig" in parse_qs(parsed_uri.query):
+    if has_sas_signature(blob_uri):
         async with BlobClient.from_blob_url(blob_url=blob_uri) as blob_client:
             blob_stream = await blob_client.download_blob()
             return bytes(await blob_stream.readall())
@@ -55,8 +49,7 @@ async def _upload_blob_config_async(*, blob_uri: str, content: bytes) -> None:
     from azure.identity.aio import DefaultAzureCredential
     from azure.storage.blob.aio import BlobClient
 
-    parsed_uri = urlparse(blob_uri)
-    if "sig" in parse_qs(parsed_uri.query):
+    if has_sas_signature(blob_uri):
         async with BlobClient.from_blob_url(blob_url=blob_uri) as blob_client:
             await blob_client.upload_blob(content, overwrite=True)
         return
@@ -124,8 +117,7 @@ def __init__(self, *, config_file_value: str | None) -> None:
     def source(self) -> str:
         """Configuration source without blob credentials."""
         if _is_azure_blob_uri(self._source):
-            parsed_uri = urlparse(self._source)
-            return parsed_uri._replace(query="", fragment="").geturl()
+            return redact_url_credentials(self._source)
         return self._source
 
     async def read_async(self) -> str:
diff --git a/pyrit/backend/services/environment_file_service.py b/pyrit/backend/services/environment_file_service.py
index 401bf919d0..dbf400dcc8 100644
--- a/pyrit/backend/services/environment_file_service.py
+++ b/pyrit/backend/services/environment_file_service.py
@@ -4,6 +4,9 @@
 """Read and update environment files selected by backend configuration."""
 
 import asyncio
+import os
+import tempfile
+from hashlib import sha256
 from pathlib import Path
 
 import aiofiles
@@ -18,12 +21,55 @@
 )
 
 
-async def _update_akv_document_async(*, secret_url: str, content: str, strict: bool) -> str:
+class EnvironmentFileConflictError(Exception):
+    """The environment source changed after it was read."""
+
+
+def _source_id(*, kind: str, source: str) -> str:
     """
-    Create a new current version of an AKV bootstrap dotenv secret.
+    Create a stable opaque identifier from an environment source.
 
     Returns:
-        str: The validated content persisted to Key Vault.
+        str: The prefixed source digest.
+    """
+    return f"{kind}-{sha256(source.encode('utf-8')).hexdigest()}"
+
+
+def _content_version(*, content: str, exists: bool = True) -> str:
+    """
+    Create an opaque version token from source state without exposing content.
+
+    Returns:
+        str: The source-state digest.
+    """
+    state = f"{int(exists)}\0{content}".encode()
+    return sha256(state).hexdigest()
+
+
+def _replace_file(*, path: Path, content: str) -> None:
+    """Atomically replace a local secret file with owner-only permissions where supported."""
+    descriptor, temporary_name = tempfile.mkstemp(dir=path.parent, prefix=f".{path.name}.")
+    temporary_path = Path(temporary_name)
+    try:
+        os.chmod(temporary_path, 0o600)
+        with os.fdopen(descriptor, mode="w", encoding="utf-8", newline="") as environment_file:
+            descriptor = -1
+            environment_file.write(content)
+            environment_file.flush()
+            os.fsync(environment_file.fileno())
+        os.replace(temporary_path, path)
+    finally:
+        if descriptor >= 0:
+            os.close(descriptor)
+        temporary_path.unlink(missing_ok=True)
+
+
+async def _update_akv_document_async(*, secret_url: str, content: str) -> str:
+    """
+    Persist a new current version of an AKV bootstrap dotenv secret.
+
+    Returns:
+        str: The content persisted to Key Vault.
     """
     from azure.identity.aio import DefaultAzureCredential
 
@@ -31,11 +77,10 @@ async def _update_akv_document_async(*, secret_url: str, content: str, strict: b
     if secret_version is not None:
         raise ValueError("Versioned Azure Key Vault environment sources are read-only")
 
-    validated_content = _validate_dotenv_document(content, strict=strict, silent=True)
     async with DefaultAzureCredential() as credential:
         async with _create_akv_secret_client(vault_url=vault_url, credential=credential) as client:
-            await client.set_secret(secret_name, validated_content)
-    return validated_content
+            await client.set_secret(secret_name, content)
+    return content
 
 
 class EnvironmentFileService:
@@ -49,13 +94,15 @@ def __init__(
         env_akv_strict: bool = True,
     ) -> None:
         """Initialize from ``ConfigurationLoader.resolve_env_files()`` output."""
-        self._akv_refs = env_akv_ref or []
         self._env_akv_strict = env_akv_strict
-        self._paths = (
+        paths = (
             [CONFIGURATION_DIRECTORY_PATH / ".env", CONFIGURATION_DIRECTORY_PATH / ".env.local"]
             if resolved_env_files is None
             else resolved_env_files
         )
+        self._akv_sources = {_source_id(kind="akv", source=secret_url): secret_url for secret_url in env_akv_ref or []}
+        self._file_sources = {_source_id(kind="file", source=str(path)): path for path in paths}
+        self._update_locks: dict[str, asyncio.Lock] = {}
 
     async def list_async(self) -> list[EnvironmentFileContent]:
         """
@@ -65,11 +112,11 @@ async def list_async(self) -> list[EnvironmentFileContent]:
             list[EnvironmentFileContent]: Configured environment source metadata.
         """
         items: list[EnvironmentFileContent] = []
-        for index, secret_url in enumerate(self._akv_refs):
+        for file_id, secret_url in self._akv_sources.items():
             _, secret_name, _ = _parse_akv_secret_url(secret_url)
             items.append(
                 EnvironmentFileContent(
-                    id=f"akv:{index}",
+                    id=file_id,
                     name=f"AKV: {secret_name}",
                     path=secret_url,
                     content="",
@@ -77,11 +124,11 @@ async def list_async(self) -> list[EnvironmentFileContent]:
                 )
             )
 
-        exists_values = await asyncio.gather(*(asyncio.to_thread(path.exists) for path in self._paths))
-        for index, (path, exists) in enumerate(zip(self._paths, exists_values, strict=True)):
+        exists_values = await asyncio.gather(*(asyncio.to_thread(path.exists) for path in self._file_sources.values()))
+        for (file_id, path), exists in zip(self._file_sources.items(), exists_values, strict=True):
             items.append(
                 EnvironmentFileContent(
-                    id=str(index),
+                    id=file_id,
                     name=path.name,
                     path=str(path),
                     content="",
@@ -100,20 +147,11 @@ async def read_async(self, *, file_id: str) -> EnvironmentFileContent:
         Raises:
             KeyError: If the identifier does not name a configured environment source.
         """
-        return await self._read_source_async(file_id=file_id)
-
-    async def _read_source_async(self, *, file_id: str) -> EnvironmentFileContent:
-        """
-        Read one source and replace its cached content.
-
-        Returns:
-            EnvironmentFileContent: The selected source and its current contents.
-        """
-        if file_id.startswith("akv:"):
+        if file_id in self._akv_sources:
             return await self._read_akv_source_async(file_id=file_id)
         return await self._read_file_source_async(file_id=file_id)
 
-    async def update_async(self, *, file_id: str, content: str) -> EnvironmentFileContent:
+    async def update_async(self, *, file_id: str, content: str, expected_version: str) -> EnvironmentFileContent:
         """
         Replace one configured environment file by its stable identifier.
 
@@ -123,10 +161,18 @@ async def update_async(self, *, file_id: str, content: str) -> EnvironmentFileCo
         Raises:
             KeyError: If the identifier does not name a configured environment file.
         """
-        return await self._write_source_async(file_id=file_id, content=content)
+        if file_id not in self._akv_sources and file_id not in self._file_sources:
+            raise KeyError(file_id)
+
+        lock = self._update_locks.setdefault(file_id, asyncio.Lock())
+        async with lock:
+            current = await self.read_async(file_id=file_id)
+            if current.version != expected_version:
+                raise EnvironmentFileConflictError("Environment source changed; reload it before saving")
+            return await self._write_source_async(file_id=file_id, content=content)
 
     async def _read_akv_source_async(self, *, file_id: str) -> EnvironmentFileContent:
-        index, secret_url = self._get_akv_source(file_id)
+        secret_url = self._get_akv_source(file_id)
         content, _ = await _fetch_akv_document_async(
             secret_url=secret_url,
             strict=self._env_akv_strict,
@@ -134,7 +180,12 @@ async def _read_akv_source_async(self, *, file_id: str) -> EnvironmentFileConten
         )
         _, secret_name, _ = _parse_akv_secret_url(secret_url)
         return EnvironmentFileContent(
-            id=f"akv:{index}", name=f"AKV: {secret_name}", path=secret_url, content=content, exists=True
+            id=file_id,
+            name=f"AKV: {secret_name}",
+            path=secret_url,
+            content=content,
+            exists=True,
+            version=_content_version(content=content),
         )
 
     async def _read_file_source_async(self, *, file_id: str) -> EnvironmentFileContent:
@@ -144,49 +195,56 @@ async def _read_file_source_async(self, *, file_id: str) -> EnvironmentFileConte
         if exists:
             async with aiofiles.open(path, encoding="utf-8") as environment_file:
                 content = await environment_file.read()
-        return EnvironmentFileContent(id=file_id, name=path.name, path=str(path), content=content, exists=exists)
+        return EnvironmentFileContent(
+            id=file_id,
+            name=path.name,
+            path=str(path),
+            content=content,
+            exists=exists,
+            version=_content_version(content=content, exists=exists),
+        )
 
     async def _write_source_async(self, *, file_id: str, content: str) -> EnvironmentFileContent:
-        if file_id.startswith("akv:"):
-            return await self._write_akv_source_async(file_id=file_id, content=content)
+        strict = self._env_akv_strict if file_id in self._akv_sources else True
+        validated_content = _validate_dotenv_document(content, strict=strict, silent=True)
+        if file_id in self._akv_sources:
+            return await self._write_akv_source_async(file_id=file_id, content=validated_content)
         path = self._get_file_path(file_id)
         await asyncio.to_thread(path.parent.mkdir, parents=True, exist_ok=True)
-        async with aiofiles.open(path, mode="w", encoding="utf-8") as environment_file:
-            await environment_file.write(content)
-        return EnvironmentFileContent(id=file_id, name=path.name, path=str(path), content=content, exists=True)
+        await asyncio.to_thread(_replace_file, path=path, content=validated_content)
+        return EnvironmentFileContent(
+            id=file_id,
+            name=path.name,
+            path=str(path),
+            content=validated_content,
+            exists=True,
+            version=_content_version(content=validated_content),
+        )
 
     async def _write_akv_source_async(self, *, file_id: str, content: str) -> EnvironmentFileContent:
-        index, secret_url = self._get_akv_source(file_id)
+        secret_url = self._get_akv_source(file_id)
         persisted_content = await _update_akv_document_async(
             secret_url=secret_url,
             content=content,
-            strict=self._env_akv_strict,
         )
         _, secret_name, _ = _parse_akv_secret_url(secret_url)
         return EnvironmentFileContent(
-            id=f"akv:{index}",
+            id=file_id,
             name=f"AKV: {secret_name}",
             path=secret_url,
             content=persisted_content,
             exists=True,
+            version=_content_version(content=persisted_content),
         )
 
-    def _get_akv_source(self, file_id: str) -> tuple[int, str]:
+    def _get_akv_source(self, file_id: str) -> str:
         try:
-            index = int(file_id.removeprefix("akv:"))
-            secret_url = self._akv_refs[index]
-        except (ValueError, IndexError):
+            return self._akv_sources[file_id]
+        except KeyError:
             raise KeyError(file_id) from None
-        if index < 0:
-            raise KeyError(file_id)
-        return index, secret_url
 
     def _get_file_path(self, file_id: str) -> Path:
         try:
-            index = int(file_id)
-            path = self._paths[index]
-        except (ValueError, IndexError):
+            return self._file_sources[file_id]
+        except KeyError:
             raise KeyError(file_id) from None
-        if index < 0:
-            raise KeyError(file_id)
-        return path
diff --git a/pyrit/common/azure_storage.py b/pyrit/common/azure_storage.py
new file mode 100644
index 0000000000..d3ed6eeb4f
--- /dev/null
+++ b/pyrit/common/azure_storage.py
@@ -0,0 +1,56 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+"""Lightweight Azure Storage URI helpers."""
+
+from urllib.parse import parse_qs, urlparse
+
+
+def is_azure_blob_uri(value: str, *, min_path_segments: int = 1) -> bool:
+    """
+    Return whether a value is a trusted Azure Blob Storage HTTPS URI.
+
+    Args:
+        value (str): URI to validate.
+        min_path_segments (int): Minimum number of non-empty path segments. Defaults to 1.
+
+    Returns:
+        bool: True when the URI uses a known Azure Blob authority and has the required path.
+    """
+    parsed_uri = urlparse(value)
+    hostname = parsed_uri.hostname or ""
+    azure_blob_host_suffixes = (
+        ".blob.core.windows.net",
+        ".blob.core.chinacloudapi.cn",
+        ".blob.core.usgovcloudapi.net",
+        ".blob.core.cloudapi.de",
+    )
+    path_segments = [segment for segment in parsed_uri.path.split("/") if segment]
+    return (
+        parsed_uri.scheme == "https"
+        and any(hostname.endswith(suffix) and hostname != suffix[1:] for suffix in azure_blob_host_suffixes)
+        and parsed_uri.username is None
+        and parsed_uri.password is None
+        and parsed_uri.port is None
+        and len(path_segments) >= min_path_segments
+    )
+
+
+def has_sas_signature(value: str) -> bool:
+    """
+    Return whether a URI contains an Azure SAS signature parameter.
+
+    Returns:
+        bool: True when the query contains a non-empty ``sig`` parameter.
+    """
+    return bool(parse_qs(urlparse(value).query).get("sig"))
+
+
+def redact_url_credentials(value: str) -> str:
+    """
+    Remove query parameters and fragments from a URL for display or logging.
+
+    Returns:
+        str: The URL without query parameters or a fragment.
+    """
+    return urlparse(value)._replace(query="", fragment="").geturl()
diff --git a/pyrit/registry/components/initializer_registry.py b/pyrit/registry/components/initializer_registry.py
index 6cc23d0511..e53919397c 100644
--- a/pyrit/registry/components/initializer_registry.py
+++ b/pyrit/registry/components/initializer_registry.py
@@ -333,7 +333,8 @@ def create_from_script_paths(self, *, script_paths: Sequence[str | Path]) -> lis
 
         Raises:
             FileNotFoundError: If a script path does not exist.
-            ValueError: If a path is not a ``.py`` file or defines no initializer.
+            ValueError: If a path is not a ``.py`` file or does not define a concrete
+                ``PyRITInitializer`` subclass.
         """
         from pyrit.setup.pyrit_initializer import PyRITInitializer
 
@@ -389,8 +390,8 @@ def register_from_content(self, *, name: str, script_content: str) -> str:
 
         Raises:
             ValueError: If the source cannot be compiled, does not
-                contain a valid initializer class, or *name* collides
-                with an existing entry.
+                define a concrete ``PyRITInitializer`` subclass, or
+                *name* collides with an existing entry.
         """
         self._ensure_discovered()
 
diff --git a/pyrit/registry/custom_initializer_storage.py b/pyrit/registry/custom_initializer_storage.py
index 4e52c5246b..90e63ed7a0 100644
--- a/pyrit/registry/custom_initializer_storage.py
+++ b/pyrit/registry/custom_initializer_storage.py
@@ -8,34 +8,15 @@
 from contextlib import contextmanager, suppress
 from pathlib import Path, PurePosixPath
 from typing import TYPE_CHECKING
-from urllib.parse import parse_qs, unquote, urlparse
+from urllib.parse import unquote, urlparse
+
+from pyrit.common.azure_storage import has_sas_signature, is_azure_blob_uri, redact_url_credentials
 
 if TYPE_CHECKING:
     from collections.abc import Generator
 
     from azure.storage.blob import ContainerClient
 
-_AZURE_BLOB_HOST_SUFFIXES = (
-    ".blob.core.windows.net",
-    ".blob.core.chinacloudapi.cn",
-    ".blob.core.usgovcloudapi.net",
-    ".blob.core.cloudapi.de",
-)
-
-
-def is_azure_blob_source_uri(value: str) -> bool:
-    """Return whether a value is an Azure Blob container URI with an optional blob prefix."""
-    parsed_uri = urlparse(value)
-    hostname = parsed_uri.hostname or ""
-    return (
-        parsed_uri.scheme == "https"
-        and any(hostname.endswith(suffix) and hostname != suffix[1:] for suffix in _AZURE_BLOB_HOST_SUFFIXES)
-        and parsed_uri.username is None
-        and parsed_uri.password is None
-        and parsed_uri.port is None
-        and bool(parsed_uri.path.strip("/"))
-    )
-
 
 class CustomInitializerStorage:
     """Read and write custom initializer scripts in a directory or blob container."""
@@ -48,7 +29,7 @@ def __init__(self, *, source: str) -> None:
             ValueError: If the source has an unsupported URI scheme.
         """
         self._source = source
-        self._is_blob = is_azure_blob_source_uri(source)
+        self._is_blob = is_azure_blob_uri(source)
         if not self._is_blob and urlparse(source).scheme and not Path(source).drive:
             raise ValueError(
                 "Custom initializer source must be a local directory or Azure Blob container URI "
@@ -61,8 +42,7 @@ def display_source(self) -> str:
         """Storage source without Azure Blob credentials."""
         if not self._is_blob:
             return self._source
-        parsed_uri = urlparse(self._source)
-        return parsed_uri._replace(query="", fragment="").geturl()
+        return redact_url_credentials(self._source)
 
     def get_script_source(self, name: str) -> str:
         """
@@ -176,8 +156,7 @@ def _open_container_client(self) -> Generator[ContainerClient, None, None]:
         if self._container_url is None:
             raise RuntimeError("Azure Blob container URL is not configured")
 
-        parsed_uri = urlparse(self._container_url)
-        if "sig" in parse_qs(parsed_uri.query):
+        if has_sas_signature(self._container_url):
             with ContainerClient.from_container_url(container_url=self._container_url) as client:
                 yield client
             return
diff --git a/tests/unit/backend/test_auth_middleware.py b/tests/unit/backend/test_auth_middleware.py
index 380bc97745..b89e8af3a3 100644
--- a/tests/unit/backend/test_auth_middleware.py
+++ b/tests/unit/backend/test_auth_middleware.py
@@ -8,9 +8,11 @@
 
 import httpx
 import pytest
+from fastapi import HTTPException
+from starlette.requests import Request
 from starlette.responses import JSONResponse
 
-from pyrit.backend.middleware.auth import AuthenticatedUser, AuthenticationError, EntraAuthMiddleware
+from pyrit.backend.middleware.auth import AuthenticatedUser, AuthenticationError, EntraAuthMiddleware, require_admin
 
 
 def _make_middleware(*, allowed_group_ids: str = "allowed-group", admin_group_id: str = "") -> EntraAuthMiddleware:
@@ -63,6 +65,32 @@ def test_init_allows_auth_disabled_when_configuration_is_absent() -> None:
     assert middleware._enabled is False
 
 
+def test_init_warns_when_admin_group_is_missing(caplog: pytest.LogCaptureFixture) -> None:
+    with caplog.at_level("WARNING"), patch.dict("os.environ", {"ENTRA_ADMIN_GROUP_ID": ""}, clear=False):
+        _make_middleware()
+
+    assert "ENTRA_ADMIN_GROUP_ID is not set" in caplog.text
+
+
+def test_require_admin_rejects_anonymous_request_by_default() -> None:
+    request = MagicMock(spec=Request)
+    request.state.user = None
+
+    with patch.dict("os.environ", {"PYRIT_ALLOW_UNAUTHENTICATED_ADMIN": ""}, clear=False):
+        with pytest.raises(HTTPException) as error:
+            require_admin(request)
+
+    assert error.value.status_code == 403
+
+
+def test_require_admin_allows_explicit_local_development_override() -> None:
+    request = MagicMock(spec=Request)
+    request.state.user = None
+
+    with patch.dict("os.environ", {"PYRIT_ALLOW_UNAUTHENTICATED_ADMIN": "true"}, clear=False):
+        require_admin(request)
+
+
 async def test_authenticate_with_graph_resolves_groups_when_restricted() -> None:
     middleware = _make_middleware(allowed_group_ids="group-1")
     client = AsyncMock(spec=httpx.AsyncClient)
diff --git a/tests/unit/backend/test_configuration_file_service.py b/tests/unit/backend/test_configuration_file_service.py
index d692b0a136..9ca61dc116 100644
--- a/tests/unit/backend/test_configuration_file_service.py
+++ b/tests/unit/backend/test_configuration_file_service.py
@@ -11,6 +11,7 @@
 from pyrit.backend.services.configuration_file_service import (
     ConfigurationFileService,
     _download_blob_config_async,
+    _is_azure_blob_uri,
     _upload_blob_config_async,
 )
 
@@ -29,6 +30,23 @@ async def test_configuration_file_service_reads_and_updates_local_file(tmp_path:
     assert service.source == str(config_path)
 
 
+@pytest.mark.parametrize(
+    "blob_uri",
+    [
+        "https://attacker.blob.example.com/config/config.yaml",
+        "https://blob.core.windows.net/config/config.yaml",
+        "https://account.blob.core.windows.net/config",
+        "http://account.blob.core.windows.net/config/config.yaml",
+    ],
+)
+def test_configuration_file_service_rejects_untrusted_blob_uri(blob_uri: str) -> None:
+    assert _is_azure_blob_uri(blob_uri) is False
+
+
+def test_configuration_file_service_accepts_known_azure_blob_host() -> None:
+    assert _is_azure_blob_uri("https://account.blob.core.windows.net/config/config.yaml") is True
+
+
 async def test_configuration_file_service_rejects_invalid_content_before_write(tmp_path: Path) -> None:
     """Test that invalid YAML does not replace the existing configuration."""
     config_path = tmp_path / "config.yaml"
diff --git a/tests/unit/backend/test_configuration_routes.py b/tests/unit/backend/test_configuration_routes.py
index ffd4b31a6e..a9ce088ca3 100644
--- a/tests/unit/backend/test_configuration_routes.py
+++ b/tests/unit/backend/test_configuration_routes.py
@@ -6,13 +6,15 @@
 from unittest.mock import AsyncMock, MagicMock, patch
 
 import pytest
-from azure.core.exceptions import ResourceNotFoundError
+from azure.core.exceptions import AzureError, ResourceNotFoundError
 from fastapi import HTTPException, status
 from fastapi.testclient import TestClient
 
 from pyrit.backend.main import app
 from pyrit.backend.middleware.auth import AuthenticatedUser, require_admin
+from pyrit.backend.models.configuration import EnvironmentFileContent
 from pyrit.backend.routes.configuration import (
+    _audit_configuration_access,
     _get_configuration_file_service,
     _get_environment_file_service,
 )
@@ -23,7 +25,11 @@
 @pytest.fixture
 def client() -> TestClient:
     """Create a test client for the FastAPI app."""
-    return TestClient(app)
+    app.dependency_overrides[require_admin] = lambda: None
+    try:
+        yield TestClient(app)
+    finally:
+        app.dependency_overrides.pop(require_admin, None)
 
 
 def test_configuration_services_resolve_from_application_state() -> None:
@@ -147,36 +153,37 @@ def test_update_configuration_file_returns_400_for_invalid_content(client: TestC
 
 def test_list_environment_files_returns_configured_files(client: TestClient) -> None:
     """Test listing environment files through the API."""
-    item = {
-        "id": "0",
-        "name": ".env",
-        "path": "C:/Users/test/.pyrit/.env",
-        "content": "",
-        "exists": True,
-    }
+    item = EnvironmentFileContent(
+        id="0",
+        name=".env",
+        path="C:/Users/test/.pyrit/.env",
+        content="",
+        exists=True,
+    )
     service = MagicMock(list_async=AsyncMock(return_value=[item]))
     with patch("pyrit.backend.routes.configuration._get_environment_file_service", return_value=service):
         response = client.get("/api/config/env-files")
 
     assert response.status_code == status.HTTP_200_OK
-    assert response.json() == {"items": [item]}
+    assert response.json() == {"items": [item.model_dump()]}
 
 
 def test_get_environment_file_returns_selected_content(client: TestClient) -> None:
     """Test reading one selected environment source through the API."""
-    item = {
-        "id": "akv:0",
-        "name": "AKV: bootstrap",
-        "path": "https://vault.vault.azure.net/secrets/bootstrap",
-        "content": "API_KEY=value\n",
-        "exists": True,
-    }
+    item = EnvironmentFileContent(
+        id="akv:0",
+        name="AKV: bootstrap",
+        path="https://vault.vault.azure.net/secrets/bootstrap",
+        content="API_KEY=value\n",
+        exists=True,
+        version="version-1",
+    )
     service = MagicMock(read_async=AsyncMock(return_value=item))
     with patch("pyrit.backend.routes.configuration._get_environment_file_service", return_value=service):
         response = client.get("/api/config/env-files/akv%3A0")
 
     assert response.status_code == status.HTTP_200_OK
-    assert response.json() == item
+    assert response.json() == item.model_dump()
     service.read_async.assert_awaited_once_with(file_id="akv:0")
 
 
@@ -191,20 +198,28 @@ def test_get_environment_file_returns_404_for_unknown_id(client: TestClient) ->
 
 def test_update_environment_file_persists_selected_file(client: TestClient) -> None:
     """Test updating a selected environment file through the API."""
-    item = {
-        "id": "1",
-        "name": ".env.local",
-        "path": "C:/Users/test/.pyrit/.env.local",
-        "content": "API_KEY=new\n",
-        "exists": True,
-    }
+    item = EnvironmentFileContent(
+        id="1",
+        name=".env.local",
+        path="C:/Users/test/.pyrit/.env.local",
+        content="API_KEY=new\n",
+        exists=True,
+        version="version-2",
+    )
     service = MagicMock(update_async=AsyncMock(return_value=item))
     with patch("pyrit.backend.routes.configuration._get_environment_file_service", return_value=service):
-        response = client.put("/api/config/env-files/1", json={"content": "API_KEY=new\n"})
+        response = client.put(
+            "/api/config/env-files/1",
+            json={"content": "API_KEY=new\n", "version": "version-1"},
+        )
 
     assert response.status_code == status.HTTP_200_OK
-    assert response.json() == item
-    service.update_async.assert_awaited_once_with(file_id="1", content="API_KEY=new\n")
+    assert response.json() == item.model_dump()
+    service.update_async.assert_awaited_once_with(
+        file_id="1",
+        content="API_KEY=new\n",
+        expected_version="version-1",
+    )
 
 
 def test_update_environment_file_returns_400_for_versioned_akv_source(client: TestClient) -> None:
@@ -213,7 +228,10 @@ def test_update_environment_file_returns_400_for_versioned_akv_source(client: Te
         update_async=AsyncMock(side_effect=ValueError("Versioned Azure Key Vault environment sources are read-only"))
     )
     with patch("pyrit.backend.routes.configuration._get_environment_file_service", return_value=service):
-        response = client.put("/api/config/env-files/akv%3A0", json={"content": "API_KEY=new\n"})
+        response = client.put(
+            "/api/config/env-files/akv%3A0",
+            json={"content": "API_KEY=new\n", "version": "version-1"},
+        )
 
     assert response.status_code == status.HTTP_400_BAD_REQUEST
     assert response.json()["detail"] == "Versioned Azure Key Vault environment sources are read-only"
@@ -223,6 +241,66 @@ def test_update_environment_file_returns_404_for_unknown_id(client: TestClient)
     """Test that updating an unknown environment source returns 404."""
     service = MagicMock(update_async=AsyncMock(side_effect=KeyError("missing")))
     with patch("pyrit.backend.routes.configuration._get_environment_file_service", return_value=service):
-        response = client.put("/api/config/env-files/missing", json={"content": "API_KEY=new\n"})
+        response = client.put(
+            "/api/config/env-files/missing",
+            json={"content": "API_KEY=new\n", "version": "version-1"},
+        )
 
     assert response.status_code == status.HTTP_404_NOT_FOUND
+
+
+def test_get_configuration_file_maps_azure_error_to_503(client: TestClient) -> None:
+    service = MagicMock(spec=ConfigurationFileService)
+    service.read_async = AsyncMock(side_effect=AzureError("credential details"))
+    service.source = "https://account.blob.core.windows.net/config/config.yaml"
+
+    with patch("pyrit.backend.routes.configuration._get_configuration_file_service", return_value=service):
+        response = client.get("/api/config")
+
+    assert response.status_code == status.HTTP_503_SERVICE_UNAVAILABLE
+    assert response.json()["detail"] == "Configuration storage is temporarily unavailable"
+    assert "credential details" not in response.text
+
+
+def test_configuration_read_writes_secret_free_audit_record(
+    client: TestClient,
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    service = MagicMock(spec=ConfigurationFileService)
+    service.read_async = AsyncMock(return_value="SECRET=value\n")
+    service.source = "C:/config/.pyrit_conf"
+
+    with (
+        caplog.at_level("INFO", logger="pyrit.backend.routes.configuration"),
+        patch("pyrit.backend.routes.configuration._get_configuration_file_service", return_value=service),
+    ):
+        response = client.get("/api/config")
+
+    assert response.status_code == status.HTTP_200_OK
+    assert "oid=local-development" in caplog.text
+    assert "action=read-config" in caplog.text
+    assert "outcome=success" in caplog.text
+    assert "SECRET=value" not in caplog.text
+
+
+def test_configuration_audit_includes_authenticated_user_name(caplog: pytest.LogCaptureFixture) -> None:
+    request = MagicMock()
+    request.state.user = AuthenticatedUser(
+        oid="admin-1",
+        name="Admin User\nInjected",
+        email="admin@example.com",
+        groups=["admin-group"],
+        is_admin=True,
+    )
+
+    with caplog.at_level("INFO", logger="pyrit.backend.routes.configuration"):
+        _audit_configuration_access(
+            request=request,
+            action="read-config",
+            source="C:/config/.pyrit_conf",
+            outcome="success",
+        )
+
+    assert "oid=admin-1" in caplog.text
+    assert "user_name='Admin User\\nInjected'" in caplog.text
+    assert "Admin User\nInjected" not in caplog.text
diff --git a/tests/unit/backend/test_environment_file_service.py b/tests/unit/backend/test_environment_file_service.py
index b3dce09f5d..ba795a41bb 100644
--- a/tests/unit/backend/test_environment_file_service.py
+++ b/tests/unit/backend/test_environment_file_service.py
@@ -8,7 +8,11 @@
 
 import pytest
 
-from pyrit.backend.services.environment_file_service import EnvironmentFileService, _update_akv_document_async
+from pyrit.backend.services.environment_file_service import (
+    EnvironmentFileConflictError,
+    EnvironmentFileService,
+    _update_akv_document_async,
+)
 
 
 async def test_environment_file_service_uses_default_candidates(tmp_path: Path) -> None:
@@ -31,8 +35,13 @@ async def test_environment_file_service_preserves_explicit_order_and_updates(tmp
     service = EnvironmentFileService(resolved_env_files=[first, second])
 
     items = await service.list_async()
-    loaded = await service.read_async(file_id="0")
-    updated = await service.update_async(file_id="0", content="FIRST=after\n")
+    first_id = items[0].id
+    loaded = await service.read_async(file_id=first_id)
+    updated = await service.update_async(
+        file_id=first_id,
+        content="FIRST=after\n",
+        expected_version=loaded.version or "",
+    )
 
     assert [item.path for item in items] == [str(first), str(second)]
     assert items[0].content == ""
@@ -40,6 +49,27 @@ async def test_environment_file_service_preserves_explicit_order_and_updates(tmp
     assert updated.content == "FIRST=after\n"
     assert first.read_text(encoding="utf-8") == "FIRST=after\n"
 
+    reordered = EnvironmentFileService(resolved_env_files=[second, first])
+    reordered_items = await reordered.list_async()
+    assert next(item.id for item in reordered_items if item.path == str(first)) == first_id
+
+
+async def test_environment_file_service_deduplicates_sources_in_order(tmp_path: Path) -> None:
+    """Test repeated source configuration produces one stable list entry."""
+    first = tmp_path / "first.env"
+    second = tmp_path / "second.env"
+    first_secret = "https://vault.vault.azure.net/secrets/first"
+    second_secret = "https://vault.vault.azure.net/secrets/second"
+    service = EnvironmentFileService(
+        resolved_env_files=[first, first, second],
+        env_akv_ref=[first_secret, first_secret, second_secret],
+    )
+
+    items = await service.list_async()
+
+    assert [item.path for item in items] == [first_secret, second_secret, str(first), str(second)]
+    assert len({item.id for item in items}) == 4
+
 
 async def test_environment_file_service_empty_list_has_no_files() -> None:
     """Test that an explicit empty list disables all environment files."""
@@ -60,6 +90,7 @@ async def test_environment_file_service_lists_and_updates_akv_before_files(tmp_p
             "pyrit.backend.services.environment_file_service._fetch_akv_document_async",
             new=AsyncMock(
                 side_effect=[
+                    ("AKV=before\n", "https://vault.vault.azure.net"),
                     ("AKV=before\n", "https://vault.vault.azure.net"),
                     ("AKV=after\n", "https://vault.vault.azure.net"),
                 ]
@@ -69,22 +100,33 @@ async def test_environment_file_service_lists_and_updates_akv_before_files(tmp_p
             "pyrit.backend.services.environment_file_service._update_akv_document_async",
             new=AsyncMock(return_value="AKV=after\n"),
         ) as update_mock,
+        patch(
+            "pyrit.backend.services.environment_file_service._validate_dotenv_document",
+            return_value="AKV=after\n",
+        ) as validate_mock,
     ):
         items = await service.list_async()
         fetch_mock.assert_not_awaited()
-        loaded = await service.read_async(file_id="akv:0")
-        updated = await service.update_async(file_id="akv:0", content="AKV=after\n")
-        loaded_after_update = await service.read_async(file_id="akv:0")
-
-    assert [item.id for item in items] == ["akv:0", "0"]
+        akv_id = items[0].id
+        loaded = await service.read_async(file_id=akv_id)
+        updated = await service.update_async(
+            file_id=akv_id,
+            content="AKV=after\n",
+            expected_version=loaded.version or "",
+        )
+        loaded_after_update = await service.read_async(file_id=akv_id)
+
+    assert items[0].id.startswith("akv-")
+    assert items[1].id.startswith("file-")
     assert items[0].name == "AKV: bootstrap"
     assert items[0].path == secret_url
     assert items[0].content == ""
     assert loaded.content == "AKV=before\n"
     assert loaded_after_update.content == "AKV=after\n"
-    assert fetch_mock.await_count == 2
+    assert fetch_mock.await_count == 3
     assert updated.content == "AKV=after\n"
-    update_mock.assert_awaited_once_with(secret_url=secret_url, content="AKV=after\n", strict=True)
+    validate_mock.assert_called_once_with("AKV=after\n", strict=True, silent=True)
+    update_mock.assert_awaited_once_with(secret_url=secret_url, content="AKV=after\n")
 
 
 async def test_environment_file_service_rejects_versioned_akv_update() -> None:
@@ -94,14 +136,13 @@ async def test_environment_file_service_rejects_versioned_akv_update() -> None:
             await _update_akv_document_async(
                 secret_url="https://vault.vault.azure.net/secrets/bootstrap/version-1",
                 content="AKV=after\n",
-                strict=True,
             )
 
     credential_mock.assert_not_called()
 
 
 async def test_environment_file_service_updates_unversioned_akv_document() -> None:
-    """Test validating and persisting an unversioned Key Vault document."""
+    """Test persisting an unversioned Key Vault document."""
     secret_url = "https://vault.vault.azure.net/secrets/bootstrap"
     credential = MagicMock()
     credential.__aenter__ = AsyncMock(return_value=credential)
@@ -114,33 +155,45 @@ async def test_environment_file_service_updates_unversioned_akv_document() -> No
     with (
         patch("azure.identity.aio.DefaultAzureCredential", return_value=credential),
         patch("pyrit.backend.services.environment_file_service._create_akv_secret_client", return_value=client),
-        patch(
-            "pyrit.backend.services.environment_file_service._validate_dotenv_document",
-            return_value="AKV=validated\n",
-        ) as validate_mock,
     ):
-        result = await _update_akv_document_async(secret_url=secret_url, content="AKV=value\n", strict=False)
+        result = await _update_akv_document_async(secret_url=secret_url, content="AKV=validated\n")
 
     assert result == "AKV=validated\n"
-    validate_mock.assert_called_once_with("AKV=value\n", strict=False, silent=True)
     client.set_secret.assert_awaited_once_with("bootstrap", "AKV=validated\n")
 
 
+async def test_environment_file_service_sanitizes_akv_content_before_write() -> None:
+    """Test non-strict AKV validation occurs before persistence."""
+    secret_url = "https://vault.vault.azure.net/secrets/bootstrap"
+    service = EnvironmentFileService(resolved_env_files=[], env_akv_ref=[secret_url], env_akv_strict=False)
+    file_id = (await service.list_async())[0].id
+
+    with patch(
+        "pyrit.backend.services.environment_file_service._update_akv_document_async",
+        new=AsyncMock(return_value="VALID=value\n"),
+    ) as update_mock:
+        result = await service._write_source_async(file_id=file_id, content="INVALID\nVALID=value\n")
+
+    assert result.content == "VALID=value\n"
+    update_mock.assert_awaited_once_with(secret_url=secret_url, content="VALID=value\n")
+
+
 async def test_environment_file_service_reads_latest_akv_content() -> None:
     """Test that every read observes the current AKV content."""
     secret_url = "https://vault.vault.azure.net/secrets/bootstrap"
     service = EnvironmentFileService(resolved_env_files=[], env_akv_ref=[secret_url])
+    file_id = (await service.list_async())[0].id
     with patch(
         "pyrit.backend.services.environment_file_service._fetch_akv_document_async",
         new=AsyncMock(side_effect=[("FIRST=1\n", "vault"), ("SECOND=2\n", "vault")]),
     ) as fetch_mock:
-        assert (await service.read_async(file_id="akv:0")).content == "FIRST=1\n"
-        assert (await service.read_async(file_id="akv:0")).content == "SECOND=2\n"
+        assert (await service.read_async(file_id=file_id)).content == "FIRST=1\n"
+        assert (await service.read_async(file_id=file_id)).content == "SECOND=2\n"
 
     assert fetch_mock.await_count == 2
 
 
-@pytest.mark.parametrize("file_id", ["akv:invalid", "akv:1", "akv:-1"])
+@pytest.mark.parametrize("file_id", ["akv-invalid", "akv-missing", "file-unknown"])
 def test_environment_file_service_rejects_invalid_akv_id(file_id: str) -> None:
     """Test malformed, out-of-range, and negative Key Vault identifiers."""
     service = EnvironmentFileService(
@@ -151,10 +204,45 @@ def test_environment_file_service_rejects_invalid_akv_id(file_id: str) -> None:
         service._get_akv_source(file_id)
 
 
-@pytest.mark.parametrize("file_id", ["invalid", "1", "-1"])
+@pytest.mark.parametrize("file_id", ["invalid", "file-missing", "akv-unknown"])
 def test_environment_file_service_rejects_invalid_file_id(file_id: str, tmp_path: Path) -> None:
     """Test malformed, out-of-range, and negative local file identifiers."""
     service = EnvironmentFileService(resolved_env_files=[tmp_path / ".env"])
 
     with pytest.raises(KeyError, match=file_id):
         service._get_file_path(file_id)
+
+
+async def test_environment_file_service_rejects_stale_update(tmp_path: Path) -> None:
+    env_file = tmp_path / ".env"
+    env_file.write_text("VALUE=before\n", encoding="utf-8")
+    service = EnvironmentFileService(resolved_env_files=[env_file])
+    file_id = (await service.list_async())[0].id
+    loaded = await service.read_async(file_id=file_id)
+    env_file.write_text("VALUE=external\n", encoding="utf-8")
+
+    with pytest.raises(EnvironmentFileConflictError, match="reload"):
+        await service.update_async(
+            file_id=file_id,
+            content="VALUE=after\n",
+            expected_version=loaded.version or "",
+        )
+
+    assert env_file.read_text(encoding="utf-8") == "VALUE=external\n"
+
+
+async def test_environment_file_service_validates_before_replacing_file(tmp_path: Path) -> None:
+    env_file = tmp_path / ".env"
+    env_file.write_text("VALUE=before\n", encoding="utf-8")
+    service = EnvironmentFileService(resolved_env_files=[env_file])
+    file_id = (await service.list_async())[0].id
+    loaded = await service.read_async(file_id=file_id)
+
+    with pytest.raises(ValueError):
+        await service.update_async(
+            file_id=file_id,
+            content="INVALID ENTRY\n",
+            expected_version=loaded.version or "",
+        )
+
+    assert env_file.read_text(encoding="utf-8") == "VALUE=before\n"
diff --git a/tests/unit/backend/test_initializer_service.py b/tests/unit/backend/test_initializer_service.py
index 3b686f7712..10312def40 100644
--- a/tests/unit/backend/test_initializer_service.py
+++ b/tests/unit/backend/test_initializer_service.py
@@ -30,15 +30,23 @@
 @pytest.fixture
 def client() -> TestClient:
     """Create a test client for the FastAPI app."""
-    return TestClient(app)
+    app.dependency_overrides[require_admin] = lambda: None
+    try:
+        yield TestClient(app)
+    finally:
+        app.dependency_overrides.pop(require_admin, None)
 
 
 @pytest.fixture
 def client_with_custom_initializers_enabled():
     """Create a test client with allow_custom_initializers enabled."""
     app.state.allow_custom_initializers = True
-    yield TestClient(app)
-    app.state.allow_custom_initializers = False
+    app.dependency_overrides[require_admin] = lambda: None
+    try:
+        yield TestClient(app)
+    finally:
+        app.state.allow_custom_initializers = False
+        app.dependency_overrides.pop(require_admin, None)
 
 
 @pytest.fixture(autouse=True)
@@ -822,6 +830,31 @@ def test_post_apply_initializer_returns_400_for_invalid_parameters(self, client:
 
             assert response.status_code == status.HTTP_400_BAD_REQUEST
 
+    @pytest.mark.parametrize(
+        ("method", "path", "json_body"),
+        [
+            ("POST", "/api/initializers/settings", {"initializer_name": "target"}),
+            ("PUT", "/api/initializers/settings/a1", {}),
+            ("DELETE", "/api/initializers/settings/a1", None),
+            ("POST", "/api/initializers/target/apply", None),
+        ],
+    )
+    def test_initializer_execution_routes_require_admin(
+        self,
+        client: TestClient,
+        method: str,
+        path: str,
+        json_body: dict[str, str] | None,
+    ) -> None:
+        def reject_non_admin() -> None:
+            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Administrator access is required")
+
+        app.dependency_overrides[require_admin] = reject_non_admin
+
+        response = client.request(method, path, json=json_body)
+
+        assert response.status_code == status.HTTP_403_FORBIDDEN
+
 
 # ============================================================================
 # Service Register/Unregister Tests
@@ -968,3 +1001,23 @@ def test_post_root_still_registers_runtime_initializer(
             name="runtime_custom",
             script_content=_SAMPLE_SCRIPT,
         )
+
+    def test_post_rejects_script_without_initializer_subclass(
+        self, client_with_custom_initializers_enabled: TestClient
+    ) -> None:
+        with patch("pyrit.backend.routes.initializers.get_initializer_service") as mock_get_service:
+            mock_service = MagicMock()
+            mock_service.register_initializer_async = AsyncMock(
+                side_effect=ValueError(
+                    "Uploaded script for 'not_an_initializer' does not contain a concrete PyRITInitializer subclass."
+                )
+            )
+            mock_get_service.return_value = mock_service
+
+            response = client_with_custom_initializers_enabled.post(
+                "/api/initializers",
+                json={"name": "not_an_initializer", "script_content": "VALUE = 1\n"},
+            )
+
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+        assert "does not contain a concrete PyRITInitializer subclass" in response.json()["detail"]
diff --git a/tests/unit/common/test_azure_storage.py b/tests/unit/common/test_azure_storage.py
new file mode 100644
index 0000000000..300ca706dc
--- /dev/null
+++ b/tests/unit/common/test_azure_storage.py
@@ -0,0 +1,58 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+"""Tests for shared Azure Storage URI helpers."""
+
+import pytest
+
+from pyrit.common.azure_storage import has_sas_signature, is_azure_blob_uri, redact_url_credentials
+
+
+@pytest.mark.parametrize(
+    "uri",
+    [
+        "https://account.blob.core.windows.net/container",
+        "https://account.blob.core.chinacloudapi.cn/container/blob",
+        "https://account.blob.core.usgovcloudapi.net/container",
+        "https://account.blob.core.cloudapi.de/container",
+    ],
+)
+def test_is_azure_blob_uri_accepts_known_azure_authorities(uri: str) -> None:
+    assert is_azure_blob_uri(uri)
+
+
+@pytest.mark.parametrize(
+    "uri",
+    [
+        "https://attacker.blob.example.com/container",
+        "https://blob.core.windows.net/container",
+        "https://user@account.blob.core.windows.net/container",
+        "https://account.blob.core.windows.net:8443/container",
+        "http://account.blob.core.windows.net/container",
+        "https://account.blob.core.windows.net",
+    ],
+)
+def test_is_azure_blob_uri_rejects_untrusted_or_incomplete_uri(uri: str) -> None:
+    assert not is_azure_blob_uri(uri)
+
+
+def test_is_azure_blob_uri_enforces_path_depth() -> None:
+    assert not is_azure_blob_uri(
+        "https://account.blob.core.windows.net/container",
+        min_path_segments=2,
+    )
+    assert is_azure_blob_uri(
+        "https://account.blob.core.windows.net/container/blob.yaml",
+        min_path_segments=2,
+    )
+
+
+def test_has_sas_signature_requires_non_empty_signature() -> None:
+    assert has_sas_signature("https://account.blob.core.windows.net/container?sp=rw&sig=secret")
+    assert not has_sas_signature("https://account.blob.core.windows.net/container?sp=rw&sig=")
+
+
+def test_redact_url_credentials_removes_query_and_fragment() -> None:
+    uri = "https://account.blob.core.windows.net/container/blob.yaml?sp=rw&sig=secret#fragment"
+
+    assert redact_url_credentials(uri) == "https://account.blob.core.windows.net/container/blob.yaml"
diff --git a/tests/unit/infra/test_deploy_instance.py b/tests/unit/infra/test_deploy_instance.py
new file mode 100644
index 0000000000..c7704a0054
--- /dev/null
+++ b/tests/unit/infra/test_deploy_instance.py
@@ -0,0 +1,30 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+"""Tests for deployment argument validation."""
+
+import argparse
+
+import pytest
+
+from infra.deploy_instance import _managed_identity_blob_uri
+
+
+def test_managed_identity_blob_uri_accepts_credential_free_azure_uri() -> None:
+    uri = "https://account.blob.core.windows.net/config/config.yaml"
+
+    assert _managed_identity_blob_uri(uri) == uri
+
+
+@pytest.mark.parametrize(
+    "uri",
+    [
+        "https://account.blob.core.windows.net/config/config.yaml?sig=secret",
+        "https://account.blob.core.windows.net/config/config.yaml#fragment",
+        "https://attacker.blob.example.com/config/config.yaml",
+        "http://account.blob.core.windows.net/config/config.yaml",
+    ],
+)
+def test_managed_identity_blob_uri_rejects_credentialed_or_untrusted_uri(uri: str) -> None:
+    with pytest.raises(argparse.ArgumentTypeError, match="credential-free"):
+        _managed_identity_blob_uri(uri)

From 0b99752b85f5fe59f929c4578b69859011c96818 Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Fri, 28 Aug 2026 12:42:16 -0700
Subject: [PATCH 23/24] fix: keep external config environment sources
 authoritative

---
 docker/start.sh                 |  3 +++
 pyrit/backend/main.py           |  6 +-----
 tests/unit/backend/test_main.py | 29 -----------------------------
 3 files changed, 4 insertions(+), 34 deletions(-)

diff --git a/docker/start.sh b/docker/start.sh
index 1e76feefb7..728c190475 100644
--- a/docker/start.sh
+++ b/docker/start.sh
@@ -59,6 +59,9 @@ elif [ "$PYRIT_MODE" = "gui" ]; then
     if [ -n "${PYRIT_CONFIG_FILE:-}" ]; then
         CONFIG_FILE="$PYRIT_CONFIG_FILE"
         echo "Using external PyRIT configuration"
+        if [ -n "${PYRIT_ENV_AKV_REF:-}" ]; then
+            echo "WARNING: Ignoring PYRIT_ENV_AKV_REF because the external PyRIT configuration controls environment sources" >&2
+        fi
     else
         # Translate deployment settings into a runtime config file so the FastAPI
         # lifespan (ConfigurationLoader) picks them up on startup.
diff --git a/pyrit/backend/main.py b/pyrit/backend/main.py
index cedeb15d67..31bb8a9e07 100644
--- a/pyrit/backend/main.py
+++ b/pyrit/backend/main.py
@@ -62,11 +62,7 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
     configuration_file_service = ConfigurationFileService(config_file_value=os.getenv("PYRIT_CONFIG_FILE"))
     app.state.configuration_file_service = configuration_file_service
     async with configuration_file_service.resolve_async() as config_file:
-        env_akv_ref = os.getenv("PYRIT_ENV_AKV_REF", "").strip()
-        config = ConfigurationLoader.load_with_overrides(
-            config_file=config_file,
-            env_akv_ref=[env_akv_ref] if env_akv_ref else None,
-        )
+        config = ConfigurationLoader.load_with_overrides(config_file=config_file)
     resolved_env_files = config.resolve_env_files()
     app.state.environment_file_service = EnvironmentFileService(
         resolved_env_files=list(resolved_env_files) if resolved_env_files is not None else None,
diff --git a/tests/unit/backend/test_main.py b/tests/unit/backend/test_main.py
index 3ebb051bcd..b2d36cb501 100644
--- a/tests/unit/backend/test_main.py
+++ b/tests/unit/backend/test_main.py
@@ -102,35 +102,6 @@ async def test_lifespan_loads_explicit_config_as_override(self) -> None:
 
             assert str(load_mock.call_args.kwargs["config_file"]).endswith("foo.yaml")
 
-    async def test_lifespan_applies_key_vault_override_with_explicit_config(self) -> None:
-        """Test that the deployment Key Vault source overlays a blob config."""
-        fake_config = ConfigurationLoader()
-        secret_url = "https://example.vault.azure.net/secrets/env-global"
-        config_uri = "https://account.blob.core.windows.net/config/config.yaml"
-        with (
-            patch.dict(
-                os.environ,
-                {"PYRIT_CONFIG_FILE": config_uri, "PYRIT_ENV_AKV_REF": secret_url},
-                clear=False,
-            ),
-            patch(
-                "pyrit.backend.services.configuration_file_service._download_blob_config_async",
-                new=AsyncMock(return_value=b"operator: blob-user\n"),
-            ),
-            patch.object(ConfigurationLoader, "load_with_overrides", return_value=fake_config) as load_mock,
-            patch.object(ConfigurationLoader, "initialize_pyrit_async", new=AsyncMock()),
-            patch(
-                "pyrit.backend.main.get_initializer_service",
-                return_value=MagicMock(run_additional_initializers_async=AsyncMock()),
-            ),
-            patch("pyrit.backend.main.setup_frontend"),
-        ):
-            async with lifespan(app):
-                pass
-
-        assert load_mock.call_args.kwargs["env_akv_ref"] == [secret_url]
-        assert isinstance(load_mock.call_args.kwargs["config_file"], Path)
-
     async def test_lifespan_configures_custom_initializer_source_from_config(self) -> None:
         """Test that YAML config determines the custom script source."""
         fake_config = ConfigurationLoader(custom_initializers_source="C:/yaml/initializers")

From 7accd1dca03a3e6b5437a9c116bbed8bb4f87206 Mon Sep 17 00:00:00 2001
From: Behnam Ousat <behnamousat@microsoft.com>
Date: Fri, 28 Aug 2026 13:07:31 -0700
Subject: [PATCH 24/24] FIX frontend configuration checks

---
 frontend/e2e/touch-targets.spec.ts                   |  2 +-
 .../components/Configuration/Configuration.test.tsx  | 12 +++++++++---
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/frontend/e2e/touch-targets.spec.ts b/frontend/e2e/touch-targets.spec.ts
index bf9e513ffa..5975483d78 100644
--- a/frontend/e2e/touch-targets.spec.ts
+++ b/frontend/e2e/touch-targets.spec.ts
@@ -476,7 +476,7 @@ test.describe("Mobile touch targets", () => {
       page.getByTestId("toggle-objective-header-btn")
     ).toBeVisible();
 
-    await page.getByRole("button", { name: "Configuration", exact: true }).click();
+    await page.getByRole("button", { name: "Targets", exact: true }).click();
     await expect(page.getByText("gpt-4o-mobile")).toBeVisible();
     await page.getByRole("button", { name: "Set Active" }).first().click();
     await page.goBack();
diff --git a/frontend/src/components/Configuration/Configuration.test.tsx b/frontend/src/components/Configuration/Configuration.test.tsx
index 0c36ee2528..6f11cc7a39 100644
--- a/frontend/src/components/Configuration/Configuration.test.tsx
+++ b/frontend/src/components/Configuration/Configuration.test.tsx
@@ -41,8 +41,8 @@ describe('Configuration', () => {
     })
     mockedConfigurationApi.listEnvironmentFiles.mockResolvedValue({
       items: [
-        { id: '0', name: '.env', path: 'C:/Users/test/.pyrit/.env', content: '', exists: true },
-        { id: '1', name: '.env.local', path: 'C:/Users/test/.pyrit/.env.local', content: '', exists: false },
+        { id: '0', name: '.env', path: 'C:/Users/test/.pyrit/.env', content: '', exists: true, version: 'v1' },
+        { id: '1', name: '.env.local', path: 'C:/Users/test/.pyrit/.env.local', content: '', exists: false, version: 'v1' },
       ],
     })
     mockedConfigurationApi.getEnvironmentFile.mockResolvedValue({
@@ -51,6 +51,7 @@ describe('Configuration', () => {
       path: 'C:/Users/test/.pyrit/.env',
       content: 'API_KEY=value\n',
       exists: true,
+      version: 'v1',
     })
     mockedInitializersApi.listCustom.mockResolvedValue({
       source: 'C:/Users/test/.pyrit/custom_initializers',
@@ -109,6 +110,7 @@ describe('Configuration', () => {
       path: 'C:/Users/test/.pyrit/.env',
       content: 'API_KEY=updated\n',
       exists: true,
+      version: 'v2',
     })
     renderPage()
 
@@ -127,6 +129,7 @@ describe('Configuration', () => {
 
     expect(mockedConfigurationApi.updateEnvironmentFile).toHaveBeenCalledWith('0', {
       content: 'API_KEY=updated\n',
+      version: 'v1',
     })
   })
 
@@ -135,7 +138,7 @@ describe('Configuration', () => {
     const secretUrl = 'https://vault.vault.azure.net/secrets/bootstrap'
     mockedConfigurationApi.listEnvironmentFiles.mockResolvedValue({
       items: [
-        { id: 'akv:0', name: 'AKV: bootstrap', path: secretUrl, content: '', exists: true },
+        { id: 'akv:0', name: 'AKV: bootstrap', path: secretUrl, content: '', exists: true, version: 'v1' },
       ],
     })
     mockedConfigurationApi.getEnvironmentFile.mockResolvedValue({
@@ -144,6 +147,7 @@ describe('Configuration', () => {
       path: secretUrl,
       content: 'API_KEY=before\n',
       exists: true,
+      version: 'v1',
     })
     mockedConfigurationApi.updateEnvironmentFile.mockResolvedValue({
       id: 'akv:0',
@@ -151,6 +155,7 @@ describe('Configuration', () => {
       path: secretUrl,
       content: 'API_KEY=after\n',
       exists: true,
+      version: 'v2',
     })
     renderPage()
 
@@ -165,6 +170,7 @@ describe('Configuration', () => {
 
     expect(mockedConfigurationApi.updateEnvironmentFile).toHaveBeenCalledWith('akv:0', {
       content: 'API_KEY=after\n',
+      version: 'v1',
     })
   })