diff --git a/.gitattributes b/.gitattributes
index 4a9d8e8..2d1846a 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,2 +1,3 @@
 *.png filter=lfs diff=lfs merge=lfs -text
 *.gif filter=lfs diff=lfs merge=lfs -text
+*.ico filter=lfs diff=lfs merge=lfs -text
diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index 3e398c1..804b7ec 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -5,6 +5,10 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   lint:
     runs-on: ubuntu-latest
@@ -13,7 +17,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v6
         with:
-          python-version: "3.11"
+          python-version: "3.13"
       - name: Sync dependencies
         run: uv sync --all-extras
       - name: Ruff lint
diff --git a/CLAUDE.md b/CLAUDE.md
index 01dff92..26d4d4a 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -131,10 +131,10 @@ the dashboard and TUI live activity logs.
 Cron entry (installed by the app):
 
 ```bash
-0 3 * * * /usr/bin/python3 -m ssltui --renew >> ~/.local/share/ssltui/renewal.log 2>&1
+0 3 * * * /usr/bin/python3 -m ssltui renew >> ~/.local/share/ssltui/renewal.log 2>&1
 ```
 
-Renewal threshold: renew if cert expires within 30 days (configurable). The `--renew` path must be fully non-interactive and safe to run as a cron job with no TTY.
+Renewal threshold: renew if cert expires within 30 days (configurable). The `renew` command must be fully non-interactive and safe to run as a cron job with no TTY.
 
 
 ## Infrastructure Requirements
diff --git a/README.md b/README.md
index f83d674..712151f 100644
--- a/README.md
+++ b/README.md
@@ -219,6 +219,21 @@ The helper script installs the Flask extra and starts the same command:
 ./ssltui_web.sh --host 0.0.0.0 --port 8080
 ```
 
+#### Running in the background on a server
+
+`ssltui serve` (like the TUI) runs in the foreground and stops when you log out.
+To keep it running on a remote server after you disconnect, start it inside a
+[tmux](https://github.com/tmux/tmux/wiki) session:
+
+```bash
+tmux new -s ssltui          # start a session
+uv run ssltui serve --host 0.0.0.0 --port 8080
+# detach with Ctrl-b then d — the server keeps running
+```
+
+Reattach later with `tmux attach -t ssltui`. (`screen` or a systemd user
+service work equally well.)
+
 While the server runs, the TUI shows a live access log alongside historical
 issue events:
 
@@ -264,6 +279,7 @@ directory, so a request can never read files outside it.
 - `GET /api/v1/certs/<cn>/cert.pem` downloads the leaf certificate
 - `GET /api/v1/certs/<cn>/key.pem` downloads the private key
 - `GET /api/v1/certs/<cn>/chain.pem` downloads the chain bundle
+- `GET /api/v1/crl.pem` downloads the certificate revocation list
 
 Example issue request:
 
@@ -332,7 +348,8 @@ Sign in with your API token. The dashboard:
   refreshes automatically every 30 seconds
 - streams a live event log (issued / renewed / revoked, CRL regeneration)
 - lets you view and download the **certificate** and **chain** PEMs
-- provides **root CA certificate** and **CRL** download links in the status bar
+- provides **root CA certificate**, **CRL**, and **audit log** (CSV) download
+  links in the status bar (the audit log requires a signed-in session)
 
 For safety, the dashboard never modifies the CA and never serves private keys —
 key downloads are available only through the API and the TUI.
diff --git a/docs/API.md b/docs/API.md
index 0d222ee..0f5119d 100644
--- a/docs/API.md
+++ b/docs/API.md
@@ -217,6 +217,21 @@ curl -s -H "Authorization: Bearer $SSLTUI_API_TOKEN" \
   http://127.0.0.1:8080/api/v1/certs/api.test.local/chain.pem
 ```
 
+### Download the certificate revocation list (CRL)
+
+```
+GET /api/v1/crl.pem
+```
+
+Returns the CA's PEM-encoded certificate revocation list. Responds `404` if no
+certificate has been revoked yet (the CRL is generated on the first revocation).
+
+```bash
+curl -s -H "Authorization: Bearer $SSLTUI_API_TOKEN" \
+  -o ca.crl \
+  http://127.0.0.1:8080/api/v1/crl.pem
+```
+
 ## Error responses
 
 All errors return a JSON object with a single `error` field and an appropriate
diff --git a/ssltui/api.py b/ssltui/api.py
index 2066f31..02af9dc 100644
--- a/ssltui/api.py
+++ b/ssltui/api.py
@@ -12,12 +12,14 @@
   GET   /api/v1/certs/<cn>/cert.pem   download leaf cert
   GET   /api/v1/certs/<cn>/key.pem    download private key
   GET   /api/v1/certs/<cn>/chain.pem  download chain (leaf + CA)
+  GET   /api/v1/crl.pem               download certificate revocation list
 
 Wildcard CN example: GET /api/v1/certs/%2A.local/cert.pem
 """
 
 from __future__ import annotations
 
+import csv
 import hashlib
 import hmac
 import io
@@ -120,6 +122,7 @@ def since(self, after_seq: int) -> tuple[list[dict], int]:
     "revoke": ("warning", "revoked"),
     "key_download": ("warning", "key downloaded"),
     "ca_init": ("error", "CA re-initialised"),
+    "invalid_request": ("error", "invalid API request"),
 }
 
 
@@ -220,6 +223,7 @@ def _safe_version(root: Path) -> int:
 <html lang="en">
 <head><meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
+<link rel="icon" href="/favicon.ico" type="image/x-icon">
 <title>ssltui &#8212; Login</title>
 <style>
 *{box-sizing:border-box;margin:0;padding:0}
@@ -259,6 +263,7 @@ def _safe_version(root: Path) -> int:
 <html lang="en">
 <head><meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
+<link rel="icon" href="/favicon.ico" type="image/x-icon">
 <title>ssltui &#8212; Dashboard</title>
 <style>
 :root{
@@ -384,6 +389,15 @@ def _safe_version(root: Path) -> int:
   padding:22px 26px;width:400px;max-width:94vw}
 #auth-modal h3{font-size:14px;font-weight:bold;color:var(--red)}
 #auth-modal-btns{display:flex;gap:8px;align-items:center}
+/* connection-lost modal */
+#conn-modal-bg{display:none;position:fixed;inset:0;background:rgba(0,0,0,.88);
+  z-index:200;align-items:center;justify-content:center}
+#conn-modal-bg.open{display:flex}
+#conn-modal{background:var(--surf);border:1px solid var(--ylw);
+  padding:22px 26px;width:420px;max-width:94vw}
+#conn-modal h3{font-size:14px;font-weight:bold;color:var(--ylw)}
+#conn-modal-btns{display:flex;gap:8px;align-items:center}
+#conn-st{font-size:12px;color:var(--ylw)}
 /* API designer modal */
 #admodal-bg{display:none;position:fixed;inset:0;background:rgba(0,0,0,.65);
   z-index:100;align-items:center;justify-content:center}
@@ -433,10 +447,11 @@ def _safe_version(root: Path) -> int:
 </div>
 <div id="sbar">
   <span id="sdot">&#9679;</span>
-  API on <strong>{{ server_url | e }}</strong>
-  &nbsp;&middot;&nbsp; CA root: {{ ca_root | e }}
+  <span id="sbar-info">API on <strong>{{ server_url | e }}</strong>
+  &nbsp;&middot;&nbsp; CA root: {{ ca_root | e }}</span>
   &nbsp;&middot;&nbsp; <a href="#" data-dl="/dashboard/ca/ca.crt" data-name="ca.crt" class="btn ca-dl" style="padding:1px 6px;font-size:11px">&#8595; Root CA cert</a>
   &nbsp;&middot;&nbsp; <a href="#" data-dl="/dashboard/ca/crl.pem" data-name="ca.crl" class="btn ca-dl" style="padding:1px 6px;font-size:11px">&#8595; CRL</a>
+  &nbsp;&middot;&nbsp; <a href="#" data-dl="/dashboard/ca/audit.csv" data-name="ssltui-audit.csv" class="btn ca-dl" style="padding:1px 6px;font-size:11px">&#8595; Audit log</a>
 </div>
 <div id="main">
   <div id="cpanel">
@@ -520,6 +535,20 @@ def _safe_version(root: Path) -> int:
   </div>
 </div>
 
+<div id="conn-modal-bg">
+  <div id="conn-modal">
+    <h3>&#9888; Connection lost</h3>
+    <p style="font-size:12px;color:var(--mut);margin:12px 0 18px;line-height:1.6">
+      The dashboard can't reach the backend server. Sensitive information
+      &mdash; the CA path, certificate list and event log &mdash; has been
+      hidden and will be reloaded automatically once the connection returns.
+    </p>
+    <div id="conn-modal-btns">
+      <span id="conn-st">Reconnecting&#8230;</span>
+    </div>
+  </div>
+</div>
+
 <div id="admodal-bg">
   <div id="admodal">
     <button id="admodal-close" onclick="closeDesigner()">&times;</button>
@@ -577,9 +606,53 @@ def _safe_version(root: Path) -> int:
   if (_authFailed) return;
   _authFailed = true;
   if (evSrc) evSrc.close();
+  wipeSensitive();
   document.getElementById('auth-modal-bg').classList.add('open');
 }
 
+// --- Connection-loss handling ---------------------------------------------
+// If the dashboard can't reach the backend, wipe everything sensitive from the
+// page — the CA filesystem path, the CA subject, the certificate list and the
+// event log — and close any modal that could still expose the token or key/cert
+// material. A blocking overlay is shown until the connection returns, at which
+// point the static header values are restored and ALL data is re-read: the cert
+// list is reloaded and the SSE stream replays the full event buffer.
+let _connLost = false;
+const _saved = {};
+
+function wipeSensitive() {
+  const caNfo = document.getElementById('ca-nfo');
+  const sbar = document.getElementById('sbar-info');
+  // Stash the server-rendered static values once so we can restore them later.
+  if (!('caNfo' in _saved)) { _saved.caNfo = caNfo.innerHTML; _saved.sbar = sbar.innerHTML; }
+  caNfo.textContent = '';
+  sbar.textContent = '—';
+  document.getElementById('ccnt').textContent = '';
+  document.getElementById('elog').innerHTML = '';
+  document.getElementById('ctbody').innerHTML =
+    '<tr><td colspan="6" class="empty">—</td></tr>';
+  closeKeyModal(); closeIssueModal(); closePemModal(); closeDesigner();
+}
+
+function connectionLost() {
+  if (_connLost || _authFailed) return;
+  _connLost = true;
+  wipeSensitive();
+  document.getElementById('conn-modal-bg').classList.add('open');
+  document.getElementById('fst').textContent = 'Connection lost';
+}
+
+// Restore the static header/status values and drop the overlay. Callers are
+// responsible for re-reading the dynamic data (cert table + event stream).
+function connectionRestored() {
+  if (!_connLost) return;
+  _connLost = false;
+  document.getElementById('ca-nfo').innerHTML = _saved.caNfo || '';
+  document.getElementById('sbar-info').innerHTML = _saved.sbar || '';
+  document.getElementById('conn-modal-bg').classList.remove('open');
+  document.getElementById('fst').textContent = 'Reconnected ' + new Date().toLocaleTimeString();
+}
+
 async function loadCerts() {
   if (_authFailed) return;
   const tb = document.getElementById('ctbody');
@@ -591,6 +664,7 @@ def _safe_version(root: Path) -> int:
       return;
     }
     const certs = await r.json();
+    connectionRestored();  // a successful read means the backend is reachable again
     if (!Array.isArray(certs)) {
       tb.innerHTML = '<tr><td colspan="6" class="empty" style="color:var(--red)">Unexpected server response: ' + ESC(JSON.stringify(certs).slice(0, 80)) + '</td></tr>';
       return;
@@ -624,8 +698,10 @@ def _safe_version(root: Path) -> int:
     }).join('');
     document.getElementById('fst').textContent = 'Certs updated ' + new Date().toLocaleTimeString();
   } catch (e) {
-    tb.innerHTML = '<tr><td colspan="6" class="empty" style="color:var(--red)">Failed to load certificates: ' + ESC(e.message) + '</td></tr>';
+    // A network-level failure (fetch threw) means we've lost the backend —
+    // wipe sensitive data and show the connection-lost overlay.
     console.error('loadCerts', e);
+    connectionLost();
   }
 }
 
@@ -653,9 +729,15 @@ def _safe_version(root: Path) -> int:
 function connectSSE() {
   if (_authFailed) return;
   if (evSrc) evSrc.close();
+  // The stream replays the full event buffer on every connection, so clear the
+  // log first: this avoids duplicates and means a reconnect re-reads all events.
+  elog.innerHTML = '';
   evSrc = new EventSource('/dashboard/api/events/stream');
   const st = document.getElementById('sse-st');
-  evSrc.onopen = () => { st.textContent = 'live'; st.style.color = '#3fb950'; };
+  evSrc.onopen = () => {
+    st.textContent = 'live'; st.style.color = '#3fb950';
+    if (_connLost) { connectionRestored(); loadCerts(); }
+  };
   evSrc.onmessage = e => {
     const ev = JSON.parse(e.data);
     appendEv(ev);
@@ -665,12 +747,16 @@ def _safe_version(root: Path) -> int:
     evSrc.close();
     if (_authFailed) return;
     // A 401 (expired session) surfaces here as a generic error; probe the
-    // certs endpoint so we can tell "session expired" from "server restarting".
+    // certs endpoint so we can tell "session expired" from "lost connection".
     fetch('/dashboard/api/certs', {method: 'HEAD'}).then(r => {
       if (r.status === 401) { showAuthError(); return; }
+      // Backend is reachable \u2014 only the stream dropped. Recover if we'd wiped.
+      if (_connLost) { connectionRestored(); loadCerts(); }
       st.textContent = 'reconnecting\u2026'; st.style.color = '#d29922';
       setTimeout(connectSSE, 4000);
     }).catch(() => {
+      // The probe itself failed: the backend is unreachable. Wipe sensitive data.
+      connectionLost();
       st.textContent = 'reconnecting\u2026'; st.style.color = '#d29922';
       setTimeout(connectSSE, 4000);
     });
@@ -783,7 +869,8 @@ def _safe_version(root: Path) -> int:
   {id:'renew', label:'Renew a certificate',        method:'POST', path:'/api/v1/certs/{cn}/renew',     params:['cn'], body:null},
   {id:'cert',  label:'Download certificate (PEM)', method:'GET',  path:'/api/v1/certs/{cn}/cert.pem',  params:['cn'], body:null, download:'{safe}.crt'},
   {id:'key',   label:'Download private key (PEM)', method:'GET',  path:'/api/v1/certs/{cn}/key.pem',   params:['cn'], body:null, download:'{safe}.key'},
-  {id:'chain', label:'Download chain (PEM)',       method:'GET',  path:'/api/v1/certs/{cn}/chain.pem', params:['cn'], body:null, download:'{safe}-chain.pem'}
+  {id:'chain', label:'Download chain (PEM)',       method:'GET',  path:'/api/v1/certs/{cn}/chain.pem', params:['cn'], body:null, download:'{safe}-chain.pem'},
+  {id:'crl',   label:'Download CRL (PEM)',          method:'GET',  path:'/api/v1/crl.pem',              params:[],     body:null, download:'ca.crl'}
 ];
 let _adTokVis = false;
 let _adCNs = [];
@@ -1198,12 +1285,42 @@ def create_app(root: Path, token: str, event_log: EventLog | None = None) -> Fla
     def _auth():
         if request.path.startswith("/dashboard"):
             return  # dashboard uses session-based auth
+        if request.path == "/favicon.ico":
+            return  # static asset; no auth required
         auth = request.headers.get("Authorization", "")
         if not (auth.startswith("Bearer ") and hmac.compare_digest(auth[7:], token)):
+            _log_invalid("invalid token")
             abort(401)
 
+    _invalid_log_lock = threading.Lock()
+    _last_invalid_log = 0.0
+    _invalid_log_interval = 1.0  # seconds; prevents audit-log spam from probes
+
+    def _log_invalid(reason: str) -> None:
+        """Record a rejected API request in the audit log (best-effort)."""
+        nonlocal _last_invalid_log
+        now = time.monotonic()
+        with _invalid_log_lock:
+            if now - _last_invalid_log < _invalid_log_interval:
+                return
+            _last_invalid_log = now
+        try:
+            store.add_event(
+                root,
+                "invalid_request",
+                method="api",
+                detail=f"{reason}: {request.method} {request.path}",
+            )
+        except Exception:
+            pass
+
     @app.errorhandler(HTTPException)
     def _http_error(e: HTTPException):
+        # Malformed API requests (400) are logged as invalid format. Auth
+        # failures (401) are already logged as "invalid token" in _auth; other
+        # codes (404/409) are valid requests and are not treated as invalid.
+        if e.code == 400 and request.path.startswith("/api/"):
+            _log_invalid("invalid api format")
         return jsonify(error=e.description), e.code
 
     @app.errorhandler(Exception)
@@ -1309,6 +1426,15 @@ def download_chain(cn: str):
             config.cert_dir(root, cn) / "chain.crt", f"{_safe(cn)}-chain.pem"
         )
 
+    @app.get("/api/v1/crl.pem")
+    def download_crl():
+        crl = config.crl_path(root)
+        if not crl.exists():
+            abort(
+                404, description="CRL not found — no certificates have been revoked yet"
+            )
+        return _pem_response(crl, "ca.crl")
+
     # --- Dashboard auth helpers ---
 
     def _require_session(f):
@@ -1331,6 +1457,18 @@ def _w(*a, **kw):
 
     # --- Dashboard routes ---
 
+    @app.get("/favicon.ico")
+    def favicon():
+        icon = Path(__file__).resolve().parent / "images" / "favicon.ico"
+        if not icon.exists():
+            abort(404, description="favicon not found")
+        return send_file(
+            io.BytesIO(icon.read_bytes()),
+            mimetype="image/x-icon",
+            download_name="favicon.ico",
+            max_age=24 * 60 * 60,
+        )
+
     @app.get("/")
     def root_redirect():
         return redirect("/dashboard")
@@ -1444,6 +1582,35 @@ def dashboard_crl_download():
             download_name="ca.crl",
         )
 
+    # The full audit log (every issue/renew/revoke and key-download event) is
+    # sensitive operational data, so — unlike the CA cert and CRL — it requires
+    # an authenticated session. The dashboard's caDownload helper surfaces the
+    # 401 from _require_session_api as a re-login prompt.
+    @app.get("/dashboard/ca/audit.csv")
+    @_require_session_api
+    def dashboard_audit_download():
+        events = store.list_events(root, limit=None)
+        buf = io.StringIO()
+        writer = csv.writer(buf)
+        writer.writerow(["id", "timestamp", "type", "cn", "method", "detail"])
+        for ev in events:
+            writer.writerow(
+                [
+                    ev.get("id", ""),
+                    ev.get("ts") or "",
+                    ev.get("type") or "",
+                    ev.get("cn") or "",
+                    ev.get("method") or "",
+                    ev.get("detail") or "",
+                ]
+            )
+        return send_file(
+            io.BytesIO(buf.getvalue().encode("utf-8")),
+            mimetype="text/csv",
+            as_attachment=True,
+            download_name="ssltui-audit.csv",
+        )
+
     return app
 
 
diff --git a/ssltui/images/favicon.ico b/ssltui/images/favicon.ico
new file mode 100644
index 0000000..9a56702
--- /dev/null
+++ b/ssltui/images/favicon.ico
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:fb7a36b2b7e9142900dc3a801428cf50d862fae80c0fa42857066d5bc6b31b8d
+size 44780
diff --git a/ssltui/images/favicon.png b/ssltui/images/favicon.png
new file mode 100644
index 0000000..5c32d7a
--- /dev/null
+++ b/ssltui/images/favicon.png
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:2e22b9a16ebc2c467a490a6e1e1c515a66b15da28c96b9f90da4d9bb7d50f72c
+size 430568
diff --git a/ssltui/tui.py b/ssltui/tui.py
index 263db82..ff3a691 100644
--- a/ssltui/tui.py
+++ b/ssltui/tui.py
@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+import csv
+import io
 import logging
 import queue as _queue
 from datetime import datetime
@@ -64,6 +66,25 @@ def _root() -> Path:
     return config.data_dir()
 
 
+def _audit_csv(root: Path) -> str:
+    """Render the full stored event log as CSV text (matches the API export)."""
+    buf = io.StringIO()
+    writer = csv.writer(buf)
+    writer.writerow(["id", "timestamp", "type", "cn", "method", "detail"])
+    for ev in store.list_events(root, limit=None):
+        writer.writerow(
+            [
+                ev.get("id", ""),
+                ev.get("ts") or "",
+                ev.get("type") or "",
+                ev.get("cn") or "",
+                ev.get("method") or "",
+                ev.get("detail") or "",
+            ]
+        )
+    return buf.getvalue()
+
+
 def _expiry_style(days: int) -> str:
     if days < 0:
         return "bold red"
@@ -677,14 +698,17 @@ class SaveCertScreen(ModalScreen):
     SaveCertScreen #error { color: red; height: auto; }
     """
 
-    def __init__(self, pem: str, default_path: str) -> None:
+    def __init__(
+        self, pem: str, default_path: str, title: str = "Save Certificate"
+    ) -> None:
         super().__init__()
         self._pem = pem
         self._default_path = default_path
+        self._title = title
 
     def compose(self) -> ComposeResult:
         with Vertical():
-            yield Label("Save Certificate", classes="title")
+            yield Label(self._title, classes="title")
             yield Label(
                 "Edit the path below, then press Enter or Save.", classes="hint"
             )
@@ -866,6 +890,7 @@ class MainScreen(Screen):
         Binding("d", "view_cert", "View cert"),
         Binding("x", "revoke_selected", "Revoke"),
         Binding("t", "view_token", "API Token"),
+        Binding("a", "export_audit", "Export audit"),
         Binding("q", "quit", "Quit"),
     ]
 
@@ -890,6 +915,7 @@ def compose(self) -> ComposeResult:
             yield Button("Init CA [i]", id="btn-init", variant="primary")
             yield Button("New Cert [n]", id="btn-new")
             yield Button("Trusted CA [c]", id="btn-ca-cert")
+            yield Button("Export Audit [a]", id="btn-audit")
         yield DataTable(id="cert-table", cursor_type="row", zebra_stripes=True)
         yield Footer()
 
@@ -986,6 +1012,8 @@ def on_button_pressed(self, event: Button.Pressed) -> None:
             self.action_issue_cert()
         elif event.button.id == "btn-ca-cert":
             self.action_view_ca_cert()
+        elif event.button.id == "btn-audit":
+            self.action_export_audit()
 
     def on_data_table_row_selected(self, event: DataTable.RowSelected) -> None:
         cn = event.row_key.value
@@ -1092,6 +1120,26 @@ def action_view_token(self) -> None:
             lambda _: self.query_one("#cert-table", DataTable).focus(),
         )
 
+    def action_export_audit(self) -> None:
+        root = _root()
+        events = store.list_events(root, limit=None)
+        if not events:
+            self.notify("No audit events recorded yet.", severity="warning")
+            return
+        self.app.push_screen(
+            SaveCertScreen(
+                pem=_audit_csv(root),
+                default_path=str(Path.home() / "ssltui-audit.csv"),
+                title="Export Audit Log",
+            ),
+            self._on_audit_saved,
+        )
+
+    def _on_audit_saved(self, path: str | None) -> None:
+        if path:
+            self.notify(f"Audit log exported → {path}")
+        self.query_one("#cert-table", DataTable).focus()
+
     def action_refresh(self) -> None:
         self._build_table()
         self._update_ca_status()
diff --git a/tools/convert_favicon.sh b/tools/convert_favicon.sh
new file mode 100644
index 0000000..1578a5a
--- /dev/null
+++ b/tools/convert_favicon.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd -- "${SCRIPT_DIR}/.." && pwd)"
+SRC="${REPO_ROOT}/ssltui/images/favicon.png"
+DST="${REPO_ROOT}/ssltui/images/favicon.ico"
+
+if ! command -v convert >/dev/null 2>&1; then
+    echo "ImageMagick 'convert' command could not be found. Please install ImageMagick to proceed." >&2
+    exit 1
+fi
+
+convert "$SRC" -define icon:auto-resize=64,48,32,16 "$DST"