diff --git a/README.md b/README.md
index b77927a..e9af9df 100644
--- a/README.md
+++ b/README.md
@@ -26,7 +26,7 @@ always blocked for containers, both directions — anti-spam, no toggle.
 Both amd64 and arm64 are supported; testing has primarily been done on amd64.
 
 ```
-git clone https://github.com/bluebluesoda/lxc-hosting.git && cd lxc-hosting
+git clone https://github.com/bluebluesoda/vpsmgr.git && cd vpsmgr
 sudo ./install.sh                  # install the stable prebuilt binary
 #sudo ./install.sh --local-build   # force a local build from source
 ```
diff --git a/README.zh-CN.md b/README.zh-CN.md
index d2e6ff3..9000ea6 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -14,7 +14,7 @@
 amd64/arm64 均可，主要在amd64上进行了测试
 
 ```
-git clone https://github.com/bluebluesoda/lxc-hosting.git && cd lxc-hosting
+git clone https://github.com/bluebluesoda/vpsmgr.git && cd vpsmgr
 sudo ./install.sh                  # 安装稳定版预编译二进制
 #sudo ./install.sh --local-build   # 强制本地编译
 ```
diff --git a/scripts/30-traefik.sh b/scripts/30-traefik.sh
index 2a810bf..0d24d29 100755
--- a/scripts/30-traefik.sh
+++ b/scripts/30-traefik.sh
@@ -51,28 +51,18 @@ fi
 
 if [[ ! -f /etc/systemd/system/traefik.service ]]; then
   # Fresh install: run Traefik as a dedicated unprivileged user that can only
-  # read /etc/traefik (config + dynamic rules) and bind ports 80/443. The panel
-  # (unprivileged 'vps') writes the dynamic files, so the two groups cross-link:
-  # vps joins traefik (to traverse /etc/traefik) and traefik joins vps (to read
-  # the dynamic dir, which vps owns). Existing installs are untouched.
+  # read /etc/traefik (config + dynamic rules) and bind ports 80/443. The
+  # dynamic dir is world-readable (traefik reads it as any other user) and
+  # owned by 'vps' once that user exists; until then root owns it, and
+  # ensureVPSUser (40-panel.sh -> vps install) chowns it to vps:vps 0755.
   if ! id -u traefik >/dev/null 2>&1; then
     useradd --system --no-create-home --home-dir /nonexistent --shell /usr/sbin/nologin traefik
     log "created unprivileged user 'traefik'"
   fi
-  if id -u vps >/dev/null 2>&1; then
-    usermod -aG traefik vps >/dev/null 2>&1 || true
-    usermod -aG vps traefik >/dev/null 2>&1 || true
-    log "cross-linked groups: vps<->traefik (panel writes dynamic, traefik reads it)"
-  fi
   chown -R root:traefik /etc/traefik
-  chmod 750 /etc/traefik
-  # The panel user 'vps' is created later by 40-panel.sh / `vps install`; when
-  # it does not exist yet, skip the chown here and let ensureVPSUser do it
-  # (it re-chowns the dynamic dir on every install).
-  if id -u vps >/dev/null 2>&1; then
-    chown vps:vps /etc/traefik/dynamic
-  fi
-  chmod 750 /etc/traefik/dynamic
+  chmod 755 /etc/traefik
+  chown root:traefik /etc/traefik/dynamic
+  chmod 755 /etc/traefik/dynamic
   chmod 640 /etc/traefik/traefik.yaml
   cp "$ROOT/configs/systemd/traefik.service" /etc/systemd/system/traefik.service
   systemctl daemon-reload
diff --git a/scripts/40-panel.sh b/scripts/40-panel.sh
index ca14e70..bc61b32 100755
--- a/scripts/40-panel.sh
+++ b/scripts/40-panel.sh
@@ -8,7 +8,7 @@ log(){ echo "[40] $*"; }
 die(){ echo "[40] error: $*" >&2; exit 1; }
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-REPO="bluebluesoda/lxc-hosting"
+REPO="bluebluesoda/vpsmgr"
 
 ensure_go(){
   # Reuse a usable go on PATH (>= 1.21, toolchain auto-switch works) when one
@@ -100,7 +100,12 @@ install_prebuilt(){
     *) log "warn: no prebuilt binary for $(uname -m), falling back to local build"; return 1 ;;
   esac
   dir="$(mktemp -d /tmp/vpsmgr-dl.XXXXXX)"
-  trap 'rm -rf "$dir"' EXIT
+  # EXIT trap for cleanup. Must NOT reference the local $dir: the trap string
+  # is evaluated when the script EXITS, after the function returned and $dir
+  # went out of scope — under `set -u` that would raise "unbound variable"
+  # (and skip the cleanup) at the very end of a successful install. Globbing
+  # the unique mktemp prefix is local-agnostic and only ever matches this dir.
+  trap 'rm -rf /tmp/vpsmgr-dl.*' EXIT
   bin_url="https://github.com/$REPO/releases/latest/download/vps-$arch"
   sum_url="https://github.com/$REPO/releases/latest/download/SHA256SUMS"
   log "downloading prebuilt vpsmgr (linux/$arch) from GitHub releases..."
diff --git a/src/internal/panel/templates/overview.html b/src/internal/panel/templates/overview.html
index 4c814f9..307b6ee 100644
--- a/src/internal/panel/templates/overview.html
+++ b/src/internal/panel/templates/overview.html
@@ -196,7 +196,7 @@ apt-get update && apt-get install -y nginx{{end}}">{{.InitScript}}</textarea>
 
 </div>
 
-<footer><a href="https://github.com/bluebluesoda/lxc-hosting" target="_blank" rel="noopener">Vpsmgr lite</a></footer>
+<footer><a href="https://github.com/bluebluesoda/vpsmgr" target="_blank" rel="noopener">Vpsmgr lite</a></footer>
 
 <div class="overlay" id="pwModal">
 <div class="modal">