diff --git a/package-firewall/bash/templates/js.sh b/package-firewall/bash/templates/js.sh
index b1b07bb..3519079 100644
--- a/package-firewall/bash/templates/js.sh
+++ b/package-firewall/bash/templates/js.sh
@@ -9,7 +9,7 @@
 # Block content is defined in shared/blocks/npmrc.txt, yarnrc_classic.txt, yarnrc.txt.
 # ${ENDOR_...} values in those files are env var refs — tools expand them at runtime.
 #
-# Auth note: .npmrc uses _auth, _username, _password (base64-encoded key:secret).
+# Auth note: .npmrc uses _auth, username, _password (attributed-user credentials).
 #   _authToken causes 401 for bun. _auth is verified working for all tools above.
 #
 # Yarn classic reads .npmrc for auth and .yarnrc for registry — both written here.
@@ -21,14 +21,6 @@ echo "[endor-js] ── JavaScript package managers ─────────
 # ── .npmrc ────────────────────────────────────────────────────────────────────
 # Covers: npm (all versions), pnpm (8.x–11.x), yarn classic (1.x), bun (all versions)
 
-# Swap to the attributed user (shared block stays Windows-safe). Needed for
-# bun: its last-write-wins .npmrc parsing would otherwise drop attribution.
-NPMRC_BLOCK=${NPMRC_BLOCK//'${ENDOR_API_KEY_ID}'/'${ENDOR_ATTR_USER}'}
-if [[ "$NPMRC_BLOCK" != *'${ENDOR_ATTR_USER}'* ]]; then
-  echo "[endor-js] WARNING: attribution swap did not match — shared/blocks/npmrc.txt changed?" >&2
-  _ENDOR_WARNED=1
-fi
-
 warn_if_key_conflict \
   "$USER_HOME/.npmrc" \
   "^registry=" \
@@ -65,13 +57,6 @@ echo "[endor-js]   covers: yarn classic (1.x)"
 # Uses npmAuthIdent (plain "user:secret") — confirmed working with Endor firewall.
 # Yarn berry supports ${VAR} expansion in .yarnrc.yml values (yarn 3+).
 
-# Swap to the attributed user (shared block stays Windows-safe).
-YARNRC_BLOCK=${YARNRC_BLOCK//'${ENDOR_API_KEY_ID}'/'${ENDOR_ATTR_USER}'}
-if [[ "$YARNRC_BLOCK" != *'${ENDOR_ATTR_USER}'* ]]; then
-  echo "[endor-js] WARNING: attribution swap did not match — shared/blocks/yarnrc.txt changed?" >&2
-  _ENDOR_WARNED=1
-fi
-
 warn_if_key_conflict \
   "$USER_HOME/.yarnrc.yml" \
   "^npmRegistryServer:" \
diff --git a/package-firewall/bash/templates/maven.sh b/package-firewall/bash/templates/maven.sh
index 717019b..2e4f870 100644
--- a/package-firewall/bash/templates/maven.sh
+++ b/package-firewall/bash/templates/maven.sh
@@ -12,13 +12,6 @@
 echo ""
 echo "[endor-maven] ── Maven ────────────────────────────────────────────────────────"
 
-# Swap to the attributed user (shared block stays Windows-safe).
-MAVEN_BLOCK=${MAVEN_BLOCK//'${env.ENDOR_API_KEY_ID}'/'${env.ENDOR_ATTR_USER}'}
-if [[ "$MAVEN_BLOCK" != *'${env.ENDOR_ATTR_USER}'* ]]; then
-  echo "[endor-maven] WARNING: attribution swap did not match — shared/blocks/mavensettings.txt changed?" >&2
-  _ENDOR_WARNED=1
-fi
-
 MAVEN_SETTINGS="$USER_HOME/.m2/settings.xml"
 
 # warn if the admin already defines a mirror/server outside an Endor block --
diff --git a/package-firewall/powershell/generate.ps1 b/package-firewall/powershell/generate.ps1
index 9f2fc74..46d5533 100644
--- a/package-firewall/powershell/generate.ps1
+++ b/package-firewall/powershell/generate.ps1
@@ -60,26 +60,23 @@ $ENDOR_API_KEY_ID = $env:ENDOR_API_KEY_ID
 $ENDOR_API_SECRET = $env:ENDOR_API_SECRET
 $FQDN = if ($env:ENDOR_FQDN) { $env:ENDOR_FQDN.TrimEnd('/') } else { 'https://factory.endorlabs.com' }
 
+# Reject credential characters that would corrupt generated scripts/URLs.
+if ("${ENDOR_API_KEY_ID}${ENDOR_API_SECRET}" -match '[^A-Za-z0-9+/=_.-]') {
+    Write-Error 'ENDOR_API_KEY_ID / ENDOR_API_SECRET contain unsupported characters'
+    exit 1
+}
+
 # -- Compute derived values ----------------------------------------------------
+# Credentials are NOT precomputed here. The per-machine attributed username
+# (<console-user>@<machine>) only exists on the developer's machine, so all
+# auth values are computed at install time by templates/envvars.ps1. Only
+# machine-independent values are derived here.
 $FQDN_HOST        = $FQDN -replace '^https?://', ''
 $TRUSTED_HOST     = $FQDN_HOST -replace ':.*', ''
 
 $NPM_REGISTRY_URL  = "$FQDN/v1/namespaces/$ENDOR_NAMESPACE/firewall/npm/"
 $NPM_REGISTRY_HOST = "$FQDN_HOST/v1/namespaces/$ENDOR_NAMESPACE/firewall/npm/"
-
-$_bytes          = [System.Text.Encoding]::UTF8.GetBytes("${ENDOR_API_KEY_ID}:${ENDOR_API_SECRET}")
-$NPM_AUTH_B64    = [System.Convert]::ToBase64String($_bytes)
-$_secretBytes    = [System.Text.Encoding]::UTF8.GetBytes($ENDOR_API_SECRET)
-$API_SECRET_B64  = [System.Convert]::ToBase64String($_secretBytes)
-Remove-Variable _bytes, _secretBytes
-
-$PYPI_URL      = "$FQDN/v1/namespaces/$ENDOR_NAMESPACE/firewall/pypi/simple/"
-$PIP_INDEX_URL = "https://${ENDOR_API_KEY_ID}:${ENDOR_API_SECRET}@${FQDN_HOST}/v1/namespaces/$ENDOR_NAMESPACE/firewall/pypi/simple/"
-
-$GO_PROXY_URL  = "https://${ENDOR_API_KEY_ID}:${ENDOR_API_SECRET}@${FQDN_HOST}/v1/namespaces/$ENDOR_NAMESPACE/firewall/go/,direct"
-
-# Maven keeps credentials in a <server> block via ${env.*}, so — unlike Go — no
-# credentials are baked into this URL.
+$PYPI_URL          = "$FQDN/v1/namespaces/$ENDOR_NAMESPACE/firewall/pypi/simple/"
 $MAVEN_REGISTRY_URL = "$FQDN/v1/namespaces/$ENDOR_NAMESPACE/firewall/maven/"
 
 # -- Output directory ----------------------------------------------------------
@@ -91,18 +88,18 @@ New-Item -ItemType Directory -Path $OutDir -Force | Out-Null
 function Invoke-Substitute {
     param([string]$Content)
     $r = $Content
-    $r = $r.Replace('{{NAMESPACE}}',         $ENDOR_NAMESPACE)
-    $r = $r.Replace('{{API_KEY_ID}}',        $ENDOR_API_KEY_ID)
-    $r = $r.Replace('{{API_SECRET}}',        $ENDOR_API_SECRET)
-    $r = $r.Replace('{{FQDN}}',              $FQDN)
-    $r = $r.Replace('{{NPM_REGISTRY_URL}}',  $NPM_REGISTRY_URL)
-    $r = $r.Replace('{{NPM_REGISTRY_HOST}}', $NPM_REGISTRY_HOST)
-    $r = $r.Replace('{{NPM_AUTH_B64}}',      $NPM_AUTH_B64)
-    $r = $r.Replace('{{API_SECRET_B64}}',   $API_SECRET_B64)
-    $r = $r.Replace('{{PYPI_URL}}',          $PYPI_URL)
-    $r = $r.Replace('{{PIP_INDEX_URL}}',     $PIP_INDEX_URL)
-    $r = $r.Replace('{{TRUSTED_HOST}}',      $TRUSTED_HOST)
-    $r = $r.Replace('{{GO_PROXY_URL}}',      $GO_PROXY_URL)
+    # Attribution tokens ({{PIP_INDEX_URL}}, {{ENDOR_PYPI_URL}}, {{GO_PROXY_URL}},
+    # {{NPM_AUTH_B64}}) are NOT substituted here — the generated scripts fill
+    # them at install time from the values computed in envvars.ps1.
+    $r = $r.Replace('{{NAMESPACE}}',          $ENDOR_NAMESPACE)
+    $r = $r.Replace('{{API_KEY_ID}}',         $ENDOR_API_KEY_ID)
+    $r = $r.Replace('{{API_SECRET}}',         $ENDOR_API_SECRET)
+    $r = $r.Replace('{{FQDN}}',               $FQDN)
+    $r = $r.Replace('{{FQDN_HOST}}',          $FQDN_HOST)
+    $r = $r.Replace('{{NPM_REGISTRY_URL}}',   $NPM_REGISTRY_URL)
+    $r = $r.Replace('{{NPM_REGISTRY_HOST}}',  $NPM_REGISTRY_HOST)
+    $r = $r.Replace('{{PYPI_URL}}',           $PYPI_URL)
+    $r = $r.Replace('{{TRUSTED_HOST}}',       $TRUSTED_HOST)
     $r = $r.Replace('{{MAVEN_REGISTRY_URL}}', $MAVEN_REGISTRY_URL)
     $r
 }
@@ -148,6 +145,17 @@ function Get-ScriptHeader {
     $r
 }
 
+# Warning footer appended to install scripts (MDM alert hook, mirrors bash).
+$ScriptFooter = @'
+
+# -- Exit non-zero if any warnings were emitted (MDM alert hook) --
+if ($EndorWarned) {
+    Write-Host ''
+    Write-Warning '[endor] Script completed with warnings -- review output above.'
+    exit 1
+}
+'@
+
 # Build-Script <template> <outputpath> <description>
 function Build-Script {
     param([string]$Template, [string]$OutputPath, [string]$Description)
@@ -158,7 +166,8 @@ function Build-Script {
         '# == Env vars setup =====================================================',
         (Invoke-Substitute (Get-Content (Join-Path $TmplDir 'envvars.ps1') -Raw -Encoding UTF8)),
         '',
-        (Invoke-Substitute (Get-Content $Template -Raw -Encoding UTF8))
+        (Invoke-Substitute (Get-Content $Template -Raw -Encoding UTF8)),
+        $ScriptFooter
     )
     Set-Content -Path $OutputPath -Value ($parts -join "`n") -Encoding UTF8
 }
@@ -220,7 +229,8 @@ $_allParts = @(
     (Invoke-Substitute (Get-Content (Join-Path $TmplDir 'maven.ps1') -Raw -Encoding UTF8)),
     '',
     "Write-Host ''",
-    "Write-Host '[endor] [done] All package managers configured for $ENDOR_NAMESPACE (js + python + go + maven).'"
+    "Write-Host '[endor] [done] All package managers configured for $ENDOR_NAMESPACE (js + python + go + maven).'",
+    $ScriptFooter
 )
 Set-Content -Path (Join-Path $OutDir $_allName) -Value ($_allParts -join "`n") -Encoding UTF8
 Remove-Variable -Name _allName, _allParts
diff --git a/package-firewall/powershell/lib/common.ps1 b/package-firewall/powershell/lib/common.ps1
index cc1a672..d2999cd 100644
--- a/package-firewall/powershell/lib/common.ps1
+++ b/package-firewall/powershell/lib/common.ps1
@@ -6,8 +6,6 @@
 #   Get-ConsoleUser                              — finds the logged-in user when running as SYSTEM
 #   Set-UserEnvVar        <name> <value> <sid>   — writes persistent HKCU env var via user SID
 #   Remove-UserEnvVar     <name> <sid>           — removes HKCU env var
-#   Set-ProfileEnvBlock   <profilepath> <vars>   — upserts env var block into PowerShell profile
-#   Remove-ProfileEnvBlock <profilepath>         — removes env var block from PowerShell profile
 #   Set-FileRestrictedAcl <path> <username>      — restricts file to owner only
 #   Invoke-UpsertBlock    <path> <content> ...   — idempotent sentinel-block writer
 #   Invoke-RemoveBlock    <path> ...             — strips Endor sentinel block from a file
@@ -31,6 +29,40 @@ $ENDOR_BLOCK_END   = '# ===== END ENDOR PACKAGE FIREWALL ====='
 $ENDOR_XML_BLOCK_START = '<!-- ===== BEGIN ENDOR PACKAGE FIREWALL (managed — do not edit) ===== -->'
 $ENDOR_XML_BLOCK_END   = '<!-- ===== END ENDOR PACKAGE FIREWALL ===== -->'
 
+# ── User attribution helpers ──────────────────────────────────────────────────
+# Encode <console-user>@<machine> into the Basic-auth username. The firewall
+# decodes the label, auths with the real API key, and logs it as "User".
+# Unverified telemetry only — never an authz signal.
+
+# Get-EndorAttrUsername <label> <apiKeyId>
+# Returns base64(base64("userattr:"+label)+":"+keyId) — the format
+# decodeAttributedUsername() expects in endorfactory's auth layer.
+function Get-EndorAttrUsername {
+    param([string]$Label, [string]$ApiKeyId)
+    $inner = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes("userattr:$Label"))
+    [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes("${inner}:${ApiKeyId}"))
+}
+
+# Get-EndorUrlEncB64 <b64> — percent-encode base64 chars (+ / =) for URL userinfo.
+function Get-EndorUrlEncB64 {
+    param([string]$B64)
+    $B64.Replace('+', '%2B').Replace('/', '%2F').Replace('=', '%3D')
+}
+
+# Get-EndorHostLabel — a stable, human-readable machine name for attribution.
+function Get-EndorHostLabel {
+    if ($env:COMPUTERNAME) { $env:COMPUTERNAME } else { [System.Net.Dns]::GetHostName() }
+}
+
+# Write-EndorFile <path> <lines>
+# UTF-8 WITHOUT BOM. Windows PowerShell 5.1's `-Encoding UTF8` writes a BOM,
+# which pip's configparser rejects — pip.ini would be silently ignored.
+function Write-EndorFile {
+    param([string]$FilePath, [string[]]$Lines)
+    $text = ($Lines -join [System.Environment]::NewLine) + [System.Environment]::NewLine
+    [System.IO.File]::WriteAllText($FilePath, $text, [System.Text.UTF8Encoding]::new($false))
+}
+
 # Get-ConsoleUser
 # Intune scripts run as SYSTEM by default. Detects the logged-in interactive user
 # via explorer.exe and resolves their profile path + SID for registry writes.
@@ -118,83 +150,6 @@ function Remove-UserEnvVar {
     }
 }
 
-# Set-ProfileEnvBlock <profilepath> <hashtable of name=value>
-# Upserts a sentinel-guarded block of $env:VAR = 'value' assignments into the
-# PowerShell profile so env vars are available in every new PS session immediately,
-# without requiring a full logout/login cycle (unlike HKCU:\Environment).
-function Set-ProfileEnvBlock {
-    param([string]$ProfilePath, [hashtable]$Vars, [switch]$DryRun)
-
-    $lines = $Vars.GetEnumerator() | ForEach-Object {
-        "`$env:$($_.Key) = '$($_.Value)'"
-    }
-    $block = ($lines -join "`n")
-
-    if ($DryRun) {
-        Write-Host "[dry-run]   Set-ProfileEnvBlock : $ProfilePath"
-        $lines | ForEach-Object { Write-Host "[dry-run]     $_" }
-        return
-    }
-
-    $profileDir = Split-Path $ProfilePath
-    if ($profileDir -and -not (Test-Path $profileDir)) {
-        New-Item -ItemType Directory -Path $profileDir -Force | Out-Null
-    }
-    if (-not (Test-Path $ProfilePath)) {
-        New-Item -ItemType File -Path $ProfilePath -Force | Out-Null
-    }
-
-    $raw      = Get-Content $ProfilePath -Raw -Encoding UTF8 -ErrorAction SilentlyContinue
-    $hasBlock = $raw -match [regex]::Escape($ENDOR_BLOCK_START)
-
-    if ($hasBlock) {
-        $existing = Get-Content $ProfilePath -Encoding UTF8
-        $inBlock  = $false
-        $kept     = [System.Collections.Generic.List[string]]::new()
-        foreach ($line in $existing) {
-            if ($line -eq $ENDOR_BLOCK_START) { $inBlock = $true;  continue }
-            if ($line -eq $ENDOR_BLOCK_END)   { $inBlock = $false; continue }
-            if (-not $inBlock) { $kept.Add($line) }
-        }
-        Set-Content -Path $ProfilePath -Value $kept -Encoding UTF8
-    }
-
-    $entry = "`n$ENDOR_BLOCK_START`n$block`n$ENDOR_BLOCK_END"
-    Add-Content -Path $ProfilePath -Value $entry -Encoding UTF8 -NoNewline
-}
-
-# Remove-ProfileEnvBlock <profilepath>
-# Strips the Endor sentinel block from the PowerShell profile.
-function Remove-ProfileEnvBlock {
-    param([string]$ProfilePath, [switch]$DryRun)
-
-    if (-not (Test-Path $ProfilePath)) { return }
-    $raw = Get-Content $ProfilePath -Raw -Encoding UTF8 -ErrorAction SilentlyContinue
-    if (-not ($raw -match [regex]::Escape($ENDOR_BLOCK_START))) { return }
-
-    $lines    = Get-Content $ProfilePath -Encoding UTF8
-    $inBlock  = $false
-    $kept     = [System.Collections.Generic.List[string]]::new()
-    foreach ($line in $lines) {
-        if ($line -eq $ENDOR_BLOCK_START) { $inBlock = $true;  continue }
-        if ($line -eq $ENDOR_BLOCK_END)   { $inBlock = $false; continue }
-        if (-not $inBlock) { $kept.Add($line) }
-    }
-
-    $remaining = ($kept -join '') -replace '\s', ''
-
-    if ($DryRun) {
-        Write-Host "[dry-run]   Remove-ProfileEnvBlock : $ProfilePath"
-        return
-    }
-
-    if (-not $remaining) {
-        Remove-Item $ProfilePath -Force
-    } else {
-        Set-Content -Path $ProfilePath -Value $kept -Encoding UTF8
-    }
-}
-
 # Set-FileRestrictedAcl <path> <username>
 # Disables ACL inheritance and grants Full Control to the owner only.
 function Set-FileRestrictedAcl {
@@ -219,6 +174,10 @@ function Set-FileRestrictedAcl {
 #   - File present, no block -> appends the block; existing content untouched
 #   - File present, block found -> replaces only the block; rest untouched
 #   - -DryRun                -> prints what would happen, writes nothing
+#
+# pip.ini special case: pip rejects duplicate [global] sections, so when both
+# <content> and the file declare [global], the keys are merged into the existing
+# section and conflicting keys are disabled reversibly with '#endor-bak#'.
 function Invoke-UpsertBlock {
     param(
         [string]$FilePath,
@@ -227,22 +186,44 @@ function Invoke-UpsertBlock {
         [switch]$DryRun
     )
 
-    $dir        = Split-Path $FilePath -Parent
-    $fileExists = Test-Path $FilePath
-    $raw        = if ($fileExists) { Get-Content $FilePath -Raw -Encoding UTF8 -ErrorAction SilentlyContinue } else { '' }
-    $hasBlock   = $raw -match [regex]::Escape($ENDOR_BLOCK_START)
+    $Content      = $Content.Replace("`r", '')
+    $contentLines = $Content -split "`n"
+    $dir          = Split-Path $FilePath -Parent
+    $fileExists   = Test-Path $FilePath
+    $raw          = if ($fileExists) { Get-Content $FilePath -Raw -Encoding UTF8 -ErrorAction SilentlyContinue } else { '' }
+    $hasBlock     = $raw -match [regex]::Escape($ENDOR_BLOCK_START)
+
+    # Existing lines outside the Endor block (block content excluded up front)
+    $outside = [System.Collections.Generic.List[string]]::new()
+    if ($fileExists) {
+        $inBlock = $false
+        foreach ($line in @(Get-Content $FilePath -Encoding UTF8)) {
+            if ($line -eq $ENDOR_BLOCK_START) { $inBlock = $true;  continue }
+            if ($line -eq $ENDOR_BLOCK_END)   { $inBlock = $false; continue }
+            if (-not $inBlock) { $outside.Add($line) }
+        }
+    }
+
+    # Merge only when both the content and the pre-existing file declare [global]
+    $merge = ($contentLines -contains '[global]') -and ($outside -contains '[global]')
 
     if ($DryRun) {
         if ($hasBlock) {
             Write-Host '[dry-run]   action : REPLACE existing Endor block'
+        } elseif ($merge) {
+            Write-Host '[dry-run]   action : MERGE into existing [global] (conflicting keys disabled via #endor-bak#)'
         } elseif ($fileExists) {
             Write-Host '[dry-run]   action : APPEND Endor block to existing file'
         } else {
             Write-Host '[dry-run]   action : CREATE file with Endor block'
         }
+        if ($merge) {
+            Write-Host "[dry-run]   note   : pre-existing index keys will be disabled via '#endor-bak#'"
+            Write-Host '[dry-run]            and the Endor keys merged into the existing [global]'
+        }
         Write-Host "[dry-run]   file   : $FilePath"
         Write-Host '[dry-run]   content:'
-        $Content -split "`n" | ForEach-Object { Write-Host "[dry-run]     $_" }
+        $contentLines | ForEach-Object { Write-Host "[dry-run]     $_" }
         Write-Host ''
         return
     }
@@ -251,33 +232,65 @@ function Invoke-UpsertBlock {
         New-Item -ItemType Directory -Path $dir -Force | Out-Null
     }
 
-    # Strip existing Endor block, preserve everything else
-    if ($hasBlock) {
-        $lines    = Get-Content $FilePath -Encoding UTF8
-        $inBlock  = $false
-        $newLines = [System.Collections.Generic.List[string]]::new()
-        foreach ($line in $lines) {
-            if ($line -eq $ENDOR_BLOCK_START) { $inBlock = $true;  continue }
-            if ($line -eq $ENDOR_BLOCK_END)   { $inBlock = $false; continue }
-            if (-not $inBlock) { $newLines.Add($line) }
+    if ($merge) {
+        # Disable-keys derived from the content; pip treats '-'/'_' and '='/':' alike.
+        $keys = $contentLines | ForEach-Object {
+            if ($_ -match '^([A-Za-z0-9_-]+)\s*[=:]') { $Matches[1] }
+        }
+        $keyPattern = ($keys | ForEach-Object { $_ -replace '[-_]', '[-_]' }) -join '|'
+
+        # 1. Reversibly disable pre-existing copies of those keys and their
+        #    indented continuation lines.
+        $body     = [System.Collections.Generic.List[string]]::new()
+        $cont     = $false
+        $disabled = $false
+        foreach ($line in $outside) {
+            if ($keyPattern -and $line -match "^\s*($keyPattern)\s*[=:]") {
+                $body.Add("#endor-bak#$line"); $cont = $true; $disabled = $true; continue
+            }
+            if ($cont -and $line -match '^\s+\S') {
+                $body.Add("#endor-bak#$line"); continue
+            }
+            $cont = $false
+            $body.Add($line)
+        }
+        if ($disabled) {
+            Write-Host "[endor] NOTE: existing pip index keys in $FilePath disabled with '#endor-bak#' (restored on removal)"
         }
-        Set-Content -Path $FilePath -Value $newLines -Encoding UTF8
-    }
 
-    # Append block (leading newline keeps it visually separated from prior content)
-    $block = "`n$ENDOR_BLOCK_START`n$Content`n$ENDOR_BLOCK_END"
-    Add-Content -Path $FilePath -Value $block -Encoding UTF8 -NoNewline
+        # 2. Insert the sentinel-wrapped keys (minus the [global] header) after
+        #    the first [global].
+        $keysBlock = @($ENDOR_BLOCK_START) + @($contentLines | Where-Object { $_ -ne '[global]' }) + @($ENDOR_BLOCK_END)
+        $final = [System.Collections.Generic.List[string]]::new()
+        $done  = $false
+        foreach ($line in $body) {
+            $final.Add($line)
+            if (-not $done -and $line -eq '[global]') {
+                foreach ($k in $keysBlock) { $final.Add($k) }
+                $done = $true
+            }
+        }
+        Write-EndorFile -FilePath $FilePath -Lines $final
+    } else {
+        $final = [System.Collections.Generic.List[string]]::new()
+        foreach ($line in $outside) { $final.Add($line) }
+        $final.Add('')
+        $final.Add($ENDOR_BLOCK_START)
+        foreach ($line in $contentLines) { $final.Add($line) }
+        $final.Add($ENDOR_BLOCK_END)
+        Write-EndorFile -FilePath $FilePath -Lines $final
+    }
 
     Set-FileRestrictedAcl -FilePath $FilePath -Username $Username
 }
 
 # Invoke-RemoveBlock <filepath> [-DryRun]
 #
-# Strips the Endor sentinel block from a config file.
+# Strips the Endor sentinel block and restores '#endor-bak#'-disabled keys.
 #   - File absent           -> skips silently
 #   - No Endor block found  -> skips with a notice
 #   - Block found           -> removes block; preserves everything else
-#   - File empty after removal -> deletes the file entirely
+#   - File empty after removal -> deletes it (a bare [global] counts as empty)
 function Invoke-RemoveBlock {
     param([string]$FilePath, [switch]$DryRun)
 
@@ -298,27 +311,32 @@ function Invoke-RemoveBlock {
     foreach ($line in $lines) {
         if ($line -eq $ENDOR_BLOCK_START) { $inBlock = $true;  continue }
         if ($line -eq $ENDOR_BLOCK_END)   { $inBlock = $false; continue }
-        if (-not $inBlock) { $newLines.Add($line) }
+        if (-not $inBlock) { $newLines.Add(($line -replace '^(\s*)#endor-bak#', '$1')) }
     }
 
+    # Effectively empty = whitespace only, or a bare [global] left from a pip merge
     $remaining = ($newLines -join '') -replace '\s', ''
+    $isEmpty   = (-not $remaining) -or ($remaining -eq '[global]')
 
     if ($DryRun) {
-        if (-not $remaining) {
+        if ($isEmpty) {
             Write-Host '[dry-run]   action : REMOVE block -> file would be empty -> DELETE file'
         } else {
             Write-Host '[dry-run]   action : REMOVE block, preserve remaining content'
         }
+        if ($raw -match '#endor-bak#') {
+            Write-Host "[dry-run]   restore: keys disabled with '#endor-bak#'"
+        }
         Write-Host "[dry-run]   file   : $FilePath"
         Write-Host ''
         return
     }
 
-    if (-not $remaining) {
+    if ($isEmpty) {
         Remove-Item $FilePath -Force
         Write-Host "[endor-remove] deleted (was empty) : $FilePath"
     } else {
-        Set-Content -Path $FilePath -Value $newLines -Encoding UTF8
+        Write-EndorFile -FilePath $FilePath -Lines $newLines
         Write-Host "[endor-remove] block removed       : $FilePath"
     }
 }
@@ -374,8 +392,8 @@ function Invoke-UpsertXmlBlock {
             '          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.2.0 http://maven.apache.org/xsd/settings-1.2.0.xsd">'
             $Content
             '</settings>'
-        ) -join "`n"
-        Set-Content -Path $FilePath -Value $scaffold -Encoding UTF8
+        )
+        Write-EndorFile -FilePath $FilePath -Lines $scaffold
         Set-FileRestrictedAcl -FilePath $FilePath -Username $Username
         return
     }
@@ -405,7 +423,7 @@ function Invoke-UpsertXmlBlock {
     }
     if (-not $inserted) { $out.Add($Content) }  # no closing tag found — append so it isn't lost
 
-    Set-Content -Path $FilePath -Value $out -Encoding UTF8
+    Write-EndorFile -FilePath $FilePath -Lines $out
     Set-FileRestrictedAcl -FilePath $FilePath -Username $Username
 }
 
@@ -448,7 +466,7 @@ function Remove-XmlBlock {
         Remove-Item $FilePath -Force
         Write-Host "[endor-remove] deleted (was empty) : $FilePath"
     } else {
-        Set-Content -Path $FilePath -Value $kept -Encoding UTF8
+        Write-EndorFile -FilePath $FilePath -Lines $kept
         Write-Host "[endor-remove] block removed       : $FilePath"
     }
 }
@@ -466,5 +484,6 @@ function Test-KeyConflict {
     if (Get-Content $FilePath -Encoding UTF8 | Where-Object { $_ -match $Pattern }) {
         Write-Warning "[endor] WARNING: existing '$Label' found in $FilePath."
         Write-Warning "[endor]          Endor block will be appended -- verify key precedence with your tool."
+        $script:EndorWarned = $true
     }
 }
diff --git a/package-firewall/powershell/templates/envvars.ps1 b/package-firewall/powershell/templates/envvars.ps1
index 423a74d..97c3d9d 100644
--- a/package-firewall/powershell/templates/envvars.ps1
+++ b/package-firewall/powershell/templates/envvars.ps1
@@ -1,27 +1,44 @@
 # templates/envvars.ps1
-# Writes persistent user-level environment variables to HKCU:\Environment.
-# Values are baked in at generation time by generate.ps1.
+# Computes the attributed credentials at install time, then writes them as
+# persistent user-level environment variables to HKCU:\Environment.
+#
+# The attributed username (<console-user>@<machine>) only exists on the
+# developer's machine, so it is derived here at install time from $ConsoleUser
+# (detected in the script header) and the machine name.
 #
 # On Windows, HKCU:\Environment is automatically inherited by every new process
 # the user starts — including non-interactive contexts such as Makefiles, git
-# hooks, and IDE terminal windows. This natively closes the non-interactive
-# shell gap that exists on macOS (where env vars require sourcing ~/.zshrc).
+# hooks, and IDE terminal windows.
 #
-# {{PLACEHOLDER}} values are substituted at generation time.
-# The written registry entries are plain REG_SZ strings.
+# $ENDOR_PYPI_URL / $ENDOR_GO_PROXY_URL are NOT written to HKCU (no runtime
+# reader) — they only feed the literal fills in python.ps1 / go.ps1 below.
 
 Write-Host '[endor] -- environment variables ----------------------------------------'
 
+# -- User attribution: compute the attributed username + derived credentials --
+$_secret              = '{{API_SECRET}}'
+$ENDOR_ATTR_LABEL     = "$ConsoleUser@$(Get-EndorHostLabel)"
+$ENDOR_ATTR_USER      = Get-EndorAttrUsername -Label $ENDOR_ATTR_LABEL -ApiKeyId '{{API_KEY_ID}}'
+$ENDOR_AUTH_B64       = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes("${ENDOR_ATTR_USER}:${_secret}"))
+$ENDOR_API_SECRET_B64 = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($_secret))
+
+# pip / uv / go URLs: percent-encode both userinfo halves ('/' would break the URL).
+$_attrUserEnc         = Get-EndorUrlEncB64 $ENDOR_ATTR_USER
+$_secretEnc           = Get-EndorUrlEncB64 $_secret
+$ENDOR_PYPI_URL       = "https://${_attrUserEnc}:${_secretEnc}@{{FQDN_HOST}}/v1/namespaces/{{NAMESPACE}}/firewall/pypi/simple/"
+$ENDOR_GO_PROXY_URL   = "https://${_attrUserEnc}:${_secretEnc}@{{FQDN_HOST}}/v1/namespaces/{{NAMESPACE}}/firewall/go/,direct"
+
+Write-Host "[endor] user attribution -> $ENDOR_ATTR_LABEL"
+
 $_envVars = [ordered]@{
     'ENDOR_API_KEY_ID'                          = '{{API_KEY_ID}}'
-    'ENDOR_API_SECRET'                          = '{{API_SECRET}}'
-    'ENDOR_AUTH_B64'                            = '{{NPM_AUTH_B64}}'
-    'ENDOR_API_SECRET_B64'                      = '{{API_SECRET_B64}}'
+    'ENDOR_API_SECRET'                          = $_secret
+    'ENDOR_ATTR_USER'                           = $ENDOR_ATTR_USER
+    'ENDOR_AUTH_B64'                            = $ENDOR_AUTH_B64
+    'ENDOR_API_SECRET_B64'                      = $ENDOR_API_SECRET_B64
     'ENDOR_NPM_REGISTRY_URL'                    = '{{NPM_REGISTRY_URL}}'
-    'ENDOR_PYPI_URL'                            = '{{PIP_INDEX_URL}}'
-    'ENDOR_GO_PROXY_URL'                        = '{{GO_PROXY_URL}}'
-    'POETRY_HTTP_BASIC_ENDOR_FIREWALL_USERNAME' = '{{API_KEY_ID}}'
-    'POETRY_HTTP_BASIC_ENDOR_FIREWALL_PASSWORD' = '{{API_SECRET}}'
+    'POETRY_HTTP_BASIC_ENDOR_FIREWALL_USERNAME' = $ENDOR_ATTR_USER
+    'POETRY_HTTP_BASIC_ENDOR_FIREWALL_PASSWORD' = $_secret
 }
 
 foreach ($_name in $_envVars.Keys) {
@@ -32,6 +49,6 @@ foreach ($_name in $_envVars.Keys) {
         Write-Host "[endor]   set : $_name"
     }
 }
-Remove-Variable _envVars
+Remove-Variable _envVars, _secret, _attrUserEnc, _secretEnc
 Write-Host '[endor] [done] env vars -- take effect in new terminal sessions'
 Write-Host ''
diff --git a/package-firewall/powershell/templates/go.ps1 b/package-firewall/powershell/templates/go.ps1
index 74f3396..77be15e 100644
--- a/package-firewall/powershell/templates/go.ps1
+++ b/package-firewall/powershell/templates/go.ps1
@@ -5,8 +5,8 @@
 # The path is resolved via `go env GOENV` (Windows default: %APPDATA%\go\env).
 #
 # Block content is defined in shared/blocks/goenv.txt.
-# {{GO_PROXY_URL}} is substituted at generation time — Go env files do not support
-# env var expansion, so credentials are baked into the GOPROXY value.
+# Go env files can't expand env vars, so the {{GO_PROXY_URL}} token is filled
+# here at install time with the attributed literal (from envvars.ps1).
 #
 # The go env file takes lower precedence than the GOPROXY process env var, so
 # project-level overrides (go env -w GOPROXY=... in a workspace) remain possible.
@@ -14,6 +14,9 @@
 
 Write-Host '[endor-go] -- Go package manager ----------------------------------------'
 
+# Fill the attributed GOPROXY into the block content (go env can't expand env vars).
+$GO_BLOCK = $GO_BLOCK.Replace('{{GO_PROXY_URL}}', $ENDOR_GO_PROXY_URL)
+
 # -- Resolve go env file path --
 # Run `go env GOENV` with APPDATA pointed at the user's AppData so Go's
 # os.UserConfigDir() returns the correct user-specific path.
diff --git a/package-firewall/powershell/templates/js.ps1 b/package-firewall/powershell/templates/js.ps1
index bf8058e..0eda062 100644
--- a/package-firewall/powershell/templates/js.ps1
+++ b/package-firewall/powershell/templates/js.ps1
@@ -6,7 +6,7 @@
 #   %USERPROFILE%\.yarnrc         yarn classic (1.x) registry redirect
 #   %USERPROFILE%\.yarnrc.yml     yarn 2+ / berry (does NOT read .npmrc for registry)
 #
-# Auth note: .npmrc uses _auth, _username, _password (base64-encoded key:secret).
+# Auth note: .npmrc uses _auth, username, _password (attributed-user credentials).
 #   _authToken causes 401 with bun. _auth is verified working for all tools above.
 #
 # Yarn classic reads .npmrc for auth and .yarnrc for registry -- both written here.
diff --git a/package-firewall/powershell/templates/maven.ps1 b/package-firewall/powershell/templates/maven.ps1
index 26cf150..fca779b 100644
--- a/package-firewall/powershell/templates/maven.ps1
+++ b/package-firewall/powershell/templates/maven.ps1
@@ -6,7 +6,7 @@
 #
 # Block content is defined in shared/blocks/mavensettings.txt.
 # {{MAVEN_REGISTRY_URL}} is substituted at generation time. Credentials are NOT
-# baked in -- settings.xml references ${env.ENDOR_API_KEY_ID} / ${env.ENDOR_API_SECRET},
+# baked in -- settings.xml references ${env.ENDOR_ATTR_USER} / ${env.ENDOR_API_SECRET},
 # which Maven expands at runtime from the env vars already set in HKCU:\Environment.
 
 Write-Host '[endor-maven] -- Maven ----------------------------------------------------'
@@ -29,5 +29,5 @@ Invoke-UpsertXmlBlock `
 Write-Host "[endor-maven] settings.xml  -> $mavenSettings"
 Write-Host '[endor-maven]   covers: maven (all versions), and Gradle when it reads ~/.m2'
 Write-Host '[endor-maven]   mirror: {{MAVEN_REGISTRY_URL}} (mirrorOf=*)'
-Write-Host '[endor-maven]   NOTE: credentials come from env vars (ENDOR_API_KEY_ID/SECRET).'
+Write-Host '[endor-maven]   NOTE: credentials come from env vars (ENDOR_ATTR_USER/API_SECRET).'
 Write-Host '[endor-maven] [done] Maven done'
diff --git a/package-firewall/powershell/templates/python.ps1 b/package-firewall/powershell/templates/python.ps1
index 855c984..9dbb6d8 100644
--- a/package-firewall/powershell/templates/python.ps1
+++ b/package-firewall/powershell/templates/python.ps1
@@ -6,20 +6,26 @@
 #   %APPDATA%\uv\uv.toml       uv  (does NOT read pip.ini)
 #
 # Credential approach per tool:
-#   pip    -- literal credentials in pip.ini (pip cannot expand env vars)
-#   uv     -- ${ENDOR_PYPI_URL} env var ref; resolved from HKCU:\Environment at runtime
+#   pip    -- literal index-url in pip.ini (pip cannot expand env vars)
+#   uv     -- literal index-url in uv.toml (baked at install time, like pip)
 #   poetry -- POETRY_HTTP_BASIC_ENDOR_FIREWALL_* set in HKCU:\Environment above
 #
-# pip uses [endor-firewall] named section -- avoids clobbering admin's [global].
+# pip block uses [global]; Invoke-UpsertBlock merges into a pre-existing one.
 #
 # macOS uses ~/.config/pip/pip.conf + ~/.pip/pip.conf + ~/Library/.../pip.conf.
 # Windows uses a single %APPDATA%\pip\pip.ini (no multi-path search needed).
 
 Write-Host '[endor-python] -- Python package managers --------------------------------'
 
+# Fill the attributed index-url into the block content (pip/uv can't expand env vars).
+$PIP_BLOCK = $PIP_BLOCK.Replace('{{PIP_INDEX_URL}}', $ENDOR_PYPI_URL)
+$UV_BLOCK  = $UV_BLOCK.Replace('{{ENDOR_PYPI_URL}}', $ENDOR_PYPI_URL)
+
 # -- pip.ini --
 # Windows: %APPDATA%\pip\pip.ini (equivalent of ~/.config/pip/pip.conf on macOS/Linux)
 # pip does not support env var expansion -- credentials are literal values.
+# warn alerts once when existing keys get disabled, and persistently for
+# conflicts the merge can't absorb (e.g. index-url under [install]).
 $_pipIni = Join-Path $AppData 'pip\pip.ini'
 
 Test-KeyConflict `
@@ -39,7 +45,7 @@ Remove-Variable _pipIni
 
 # -- uv.toml --
 # uv does NOT read pip.ini. %APPDATA%\uv\uv.toml is the user-level global config.
-# uv supports ${VAR} expansion -- ENDOR_PYPI_URL is resolved from HKCU:\Environment.
+# The index-url is baked as a literal at install time -- see the fill above.
 $_uvToml = Join-Path $AppData 'uv\uv.toml'
 
 Test-KeyConflict `
diff --git a/package-firewall/powershell/templates/remove.ps1 b/package-firewall/powershell/templates/remove.ps1
index 9932f45..60defb9 100644
--- a/package-firewall/powershell/templates/remove.ps1
+++ b/package-firewall/powershell/templates/remove.ps1
@@ -44,11 +44,12 @@ Write-Host '[endor-remove] -- environment variables ----------------------------
 $_removeVars = @(
     'ENDOR_API_KEY_ID'
     'ENDOR_API_SECRET'
+    'ENDOR_ATTR_USER'
     'ENDOR_AUTH_B64'
     'ENDOR_API_SECRET_B64'
     'ENDOR_NPM_REGISTRY_URL'
-    'ENDOR_PYPI_URL'
-    'ENDOR_GO_PROXY_URL'
+    'ENDOR_PYPI_URL'      # no longer written; still removed to clean older deployments
+    'ENDOR_GO_PROXY_URL'  # no longer written; still removed to clean older deployments
     'POETRY_HTTP_BASIC_ENDOR_FIREWALL_USERNAME'
     'POETRY_HTTP_BASIC_ENDOR_FIREWALL_PASSWORD'
 )
@@ -70,6 +71,37 @@ Write-Host '[endor-remove] -- JavaScript ---------------------------------------
 Invoke-RemoveBlock -FilePath (Join-Path $UserHome '.npmrc')      -DryRun:$DryRun
 Invoke-RemoveBlock -FilePath (Join-Path $UserHome '.yarnrc')     -DryRun:$DryRun
 Invoke-RemoveBlock -FilePath (Join-Path $UserHome '.yarnrc.yml') -DryRun:$DryRun
+
+# yarn 1.x rewrites .yarnrc on its own and can copy the Endor registry outside
+# the managed block. Delete only lines exactly matching our URL — they can't be
+# anyone else's config.
+$_yarnrc    = Join-Path $UserHome '.yarnrc'
+$_endorLine = 'registry "{{NPM_REGISTRY_URL}}"'
+$_outside   = @()
+if (Test-Path $_yarnrc) {
+    $_inBlock = $false
+    foreach ($_l in @(Get-Content $_yarnrc -Encoding UTF8)) {
+        if ($_l -eq $ENDOR_BLOCK_START) { $_inBlock = $true;  continue }
+        if ($_l -eq $ENDOR_BLOCK_END)   { $_inBlock = $false; continue }
+        if (-not $_inBlock) { $_outside += $_l }
+    }
+}
+if ($_outside -contains $_endorLine) {
+    if ($DryRun) {
+        Write-Host "[dry-run]   action : DELETE yarn-copied Endor registry line from $_yarnrc"
+    } else {
+        $_kept = @(Get-Content $_yarnrc -Encoding UTF8) |
+                 Where-Object { $_ -ne $_endorLine -and $_ -ne 'always-auth true' }
+        if (-not (($_kept -join '') -replace '\s', '')) {
+            Remove-Item $_yarnrc -Force
+            Write-Host "[endor-remove] deleted (was empty) : $_yarnrc"
+        } else {
+            Write-EndorFile -FilePath $_yarnrc -Lines $_kept
+            Write-Host "[endor-remove] yarn-copied line removed: $_yarnrc"
+        }
+    }
+}
+Remove-Variable _yarnrc, _endorLine, _outside -ErrorAction SilentlyContinue
 Write-Host ''
 
 # -- Python config files --
diff --git a/package-firewall/powershell/templates/script-header.ps1 b/package-firewall/powershell/templates/script-header.ps1
index c633041..9e9e6a0 100644
--- a/package-firewall/powershell/templates/script-header.ps1
+++ b/package-firewall/powershell/templates/script-header.ps1
@@ -21,6 +21,9 @@ if ($DryRun) {
     Write-Host '[endor] DRY RUN -- no files will be modified and no registry keys will be written.'
 }
 
+# Set by Test-KeyConflict / swap guards; the script footer exits 1 when true (MDM alert hook).
+$EndorWarned = $false
+
 # -- Detect console user --
 # When running as SYSTEM (Intune default), Get-ConsoleUser detects the logged-in
 # user via explorer.exe and resolves their profile path + registry SID.
diff --git a/package-firewall/shared/blocks/mavensettings.txt b/package-firewall/shared/blocks/mavensettings.txt
index 0be4809..5580f85 100644
--- a/package-firewall/shared/blocks/mavensettings.txt
+++ b/package-firewall/shared/blocks/mavensettings.txt
@@ -2,7 +2,7 @@
   <servers>
     <server>
       <id>endor-firewall</id>
-      <username>${env.ENDOR_API_KEY_ID}</username>
+      <username>${env.ENDOR_ATTR_USER}</username>
       <password>${env.ENDOR_API_SECRET}</password>
     </server>
   </servers>
diff --git a/package-firewall/shared/blocks/npmrc.txt b/package-firewall/shared/blocks/npmrc.txt
index 655b0f1..1911f50 100644
--- a/package-firewall/shared/blocks/npmrc.txt
+++ b/package-firewall/shared/blocks/npmrc.txt
@@ -1,5 +1,5 @@
 registry=${ENDOR_NPM_REGISTRY_URL}
 always-auth=true
 //{{NPM_REGISTRY_HOST}}:_auth=${ENDOR_AUTH_B64}
-//{{NPM_REGISTRY_HOST}}:username=${ENDOR_API_KEY_ID}
+//{{NPM_REGISTRY_HOST}}:username=${ENDOR_ATTR_USER}
 //{{NPM_REGISTRY_HOST}}:_password=${ENDOR_API_SECRET_B64}
diff --git a/package-firewall/shared/blocks/yarnrc.txt b/package-firewall/shared/blocks/yarnrc.txt
index 4617bc3..4345dbb 100644
--- a/package-firewall/shared/blocks/yarnrc.txt
+++ b/package-firewall/shared/blocks/yarnrc.txt
@@ -1,3 +1,3 @@
 npmRegistryServer: "${ENDOR_NPM_REGISTRY_URL}"
 npmAlwaysAuth: true
-npmAuthIdent: "${ENDOR_API_KEY_ID}:${ENDOR_API_SECRET}"
+npmAuthIdent: "${ENDOR_ATTR_USER}:${ENDOR_API_SECRET}"