diff --git a/apps/trek/3.3.0/data.yml b/apps/trek/3.3.0/data.yml
deleted file mode 100644
index 5a3c04466..000000000
--- a/apps/trek/3.3.0/data.yml
+++ /dev/null
@@ -1,156 +0,0 @@
-additionalProperties:
-  formFields:
-    - default: 3000
-      edit: true
-      envKey: PANEL_APP_PORT_HTTP
-      labelEn: Web Port
-      labelZh: Web 访问端口
-      label:
-        en: Web Port
-        zh: Web 访问端口
-        zh-Hant: Web 存取埠
-        ja: Web ポート
-        ko: Web 포트
-        ru: Веб-порт
-        ms: Port Web
-        pt-br: Porta Web
-      required: true
-      rule: paramPort
-      type: number
-    - default: ./data
-      edit: true
-      envKey: APP_DATA_DIR
-      labelEn: Data Directory
-      labelZh: 数据目录
-      label:
-        en: Data Directory
-        zh: 数据目录
-        zh-Hant: 資料目錄
-        ja: データディレクトリ
-        ko: 데이터 디렉터리
-        ru: Каталог данных
-        ms: Direktori Data
-        pt-br: Diretório de Dados
-      required: true
-      type: text
-    - default: ./data/uploads
-      edit: true
-      envKey: APP_UPLOADS_DIR
-      labelEn: Uploads Directory
-      labelZh: 上传目录
-      label:
-        en: Uploads Directory
-        zh: 上传目录
-        zh-Hant: 上傳目錄
-        ja: アップロードディレクトリ
-        ko: 업로드 디렉터리
-        ru: Каталог загрузок
-        ms: Direktori Muat Naik
-        pt-br: Diretório de Uploads
-      required: true
-      type: text
-    - default: ''
-      edit: true
-      envKey: ENCRYPTION_KEY
-      labelEn: Encryption Key
-      labelZh: 加密密钥
-      label:
-        en: Encryption Key
-        zh: 加密密钥
-        zh-Hant: 加密密鑰
-        ja: 暗号化キー
-        ko: 암호화 키
-        ru: Ключ шифрования
-        ms: Kunci Penyulitan
-        pt-br: Chave de Criptografia
-      required: false
-      type: password
-    - default: UTC
-      edit: true
-      envKey: TZ
-      labelEn: Timezone
-      labelZh: 时区
-      label:
-        en: Timezone
-        zh: 时区
-        zh-Hant: 時區
-        ja: タイムゾーン
-        ko: 시간대
-        ru: Часовой пояс
-        ms: Zon waktu
-        pt-br: Fuso horário
-      required: true
-      type: text
-    - default: info
-      edit: true
-      envKey: LOG_LEVEL
-      labelEn: Log Level
-      labelZh: 日志级别
-      label:
-        en: Log Level
-        zh: 日志级别
-        zh-Hant: 日誌級別
-        ja: ログレベル
-        ko: 로그 레벨
-        ru: Уровень журнала
-        ms: Tahap Log
-        pt-br: Nível de Log
-      required: true
-      type: select
-      values:
-        - label: debug
-          value: debug
-        - label: info
-          value: info
-        - label: warn
-          value: warn
-        - label: error
-          value: error
-    - default: ''
-      edit: true
-      envKey: ADMIN_EMAIL
-      labelEn: Admin Email
-      labelZh: 管理员邮箱
-      label:
-        en: Admin Email
-        zh: 管理员邮箱
-        zh-Hant: 管理員郵箱
-        ja: 管理者メール
-        ko: 관리자 이메일
-        ru: Почта администратора
-        ms: Emel Pentadbir
-        pt-br: E-mail do Admin
-      required: false
-      type: text
-    - default: ''
-      edit: true
-      envKey: ADMIN_PASSWORD
-      labelEn: Admin Password
-      labelZh: 管理员密码
-      label:
-        en: Admin Password
-        zh: 管理员密码
-        zh-Hant: 管理員密碼
-        ja: 管理者パスワード
-        ko: 관리자 비밀번호
-        ru: Пароль администратора
-        ms: Kata Laluan Pentadbir
-        pt-br: Senha do Admin
-      required: false
-      type: password
-    - default: ''
-      edit: true
-      envKey: ALLOWED_ORIGINS
-      labelEn: Allowed Origins
-      labelZh: 允许来源
-      label:
-        en: Allowed Origins
-        zh: 允许来源
-        zh-Hant: 允許來源
-        ja: 許可オリジン
-        ko: 허용 출처
-        ru: Разрешенные origins
-        ms: Origin Dibenarkan
-        pt-br: Origens Permitidas
-      required: false
-      type: text
diff --git a/apps/trek/3.3.0/docker-compose.yml b/apps/trek/3.3.0/docker-compose.yml
deleted file mode 100644
index e258dd672..000000000
--- a/apps/trek/3.3.0/docker-compose.yml
+++ /dev/null
@@ -1,48 +0,0 @@
-services:
-  trek:
-    image: "mauriceboe/trek:3.3.0"
-    container_name: ${CONTAINER_NAME}
-    read_only: true
-    security_opt:
-      - no-new-privileges:true
-    cap_drop:
-      - ALL
-    cap_add:
-      - CHOWN
-      - SETUID
-      - SETGID
-    tmpfs:
-      - /tmp:noexec,nosuid,size=64m
-    ports:
-      - "${PANEL_APP_PORT_HTTP}:3000"
-    environment:
-      - NODE_ENV=production
-      - PORT=3000
-      - ENCRYPTION_KEY=${ENCRYPTION_KEY:-}
-      - TZ=${TZ}
-      - LOG_LEVEL=${LOG_LEVEL}
-      - ALLOWED_ORIGINS=${ALLOWED_ORIGINS:-}
-      - ADMIN_EMAIL=${ADMIN_EMAIL:-}
-      - ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
-    volumes:
-      - "${APP_DATA_DIR}:/app/data"
-      - "${APP_UPLOADS_DIR}:/app/uploads"
-    healthcheck:
-      test:
-        - CMD
-        - wget
-        - -qO-
-        - http://localhost:3000/api/health
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 15s
-    labels:
-      createdBy: Apps
-    networks:
-      - 1panel-network
-    restart: unless-stopped
-
-networks:
-  1panel-network:
-    external: true
diff --git a/apps/trek/3.3.0/scripts/init.sh b/apps/trek/3.3.0/scripts/init.sh
deleted file mode 100755
index d8755e2d1..000000000
--- a/apps/trek/3.3.0/scripts/init.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-DATA_DIR="${APP_DATA_DIR:-./data}"
-UPLOADS_DIR="${APP_UPLOADS_DIR:-./data/uploads}"
-mkdir -p "$DATA_DIR" "$UPLOADS_DIR"
diff --git a/apps/trek/3.3.0/scripts/upgrade.sh b/apps/trek/3.3.0/scripts/upgrade.sh
deleted file mode 100755
index d8755e2d1..000000000
--- a/apps/trek/3.3.0/scripts/upgrade.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-DATA_DIR="${APP_DATA_DIR:-./data}"
-UPLOADS_DIR="${APP_UPLOADS_DIR:-./data/uploads}"
-mkdir -p "$DATA_DIR" "$UPLOADS_DIR"
diff --git a/apps/trek/3.3.0/.env.sample b/apps/trek/4.0.0/.env.sample
similarity index 82%
rename from apps/trek/3.3.0/.env.sample
rename to apps/trek/4.0.0/.env.sample
index 14df8eb37..de6d71dd5 100644
--- a/apps/trek/3.3.0/.env.sample
+++ b/apps/trek/4.0.0/.env.sample
@@ -1,3 +1,4 @@
+CONTAINER_NAME=trek-compose-check
 PANEL_APP_PORT_HTTP=3000
 APP_DATA_DIR=./data
 APP_UPLOADS_DIR=./data/uploads
@@ -7,4 +8,3 @@ LOG_LEVEL=info
 ADMIN_EMAIL=
 ADMIN_PASSWORD=
 ALLOWED_ORIGINS=
-CONTAINER_NAME=
diff --git a/apps/trek/4.0.0/data.yml b/apps/trek/4.0.0/data.yml
new file mode 100644
index 000000000..58d0000c8
--- /dev/null
+++ b/apps/trek/4.0.0/data.yml
@@ -0,0 +1,156 @@
+additionalProperties:
+  formFields:
+  - default: 3000
+    edit: true
+    envKey: PANEL_APP_PORT_HTTP
+    labelEn: Web Port
+    labelZh: Web 访问端口
+    label:
+      en: Web Port
+      zh: Web 访问端口
+      zh-Hant: Web 存取埠
+      ja: Web ポート
+      ko: Web 포트
+      ru: Веб-порт
+      ms: Port Web
+      pt-br: Porta Web
+    required: true
+    rule: paramPort
+    type: number
+  - default: ./data
+    edit: true
+    envKey: APP_DATA_DIR
+    labelEn: Data Directory
+    labelZh: 数据目录
+    label:
+      en: Data Directory
+      zh: 数据目录
+      zh-Hant: 資料目錄
+      ja: データディレクトリ
+      ko: 데이터 디렉터리
+      ru: Каталог данных
+      ms: Direktori Data
+      pt-br: Diretório de Dados
+    required: true
+    type: text
+  - default: ./data/uploads
+    edit: true
+    envKey: APP_UPLOADS_DIR
+    labelEn: Uploads Directory
+    labelZh: 上传目录
+    label:
+      en: Uploads Directory
+      zh: 上传目录
+      zh-Hant: 上傳目錄
+      ja: アップロードディレクトリ
+      ko: 업로드 디렉터리
+      ru: Каталог загрузок
+      ms: Direktori Muat Naik
+      pt-br: Diretório de Uploads
+    required: true
+    type: text
+  - default: ''
+    edit: true
+    envKey: ENCRYPTION_KEY
+    labelEn: Encryption Key
+    labelZh: 加密密钥
+    label:
+      en: Encryption Key
+      zh: 加密密钥
+      zh-Hant: 加密密鑰
+      ja: 暗号化キー
+      ko: 암호화 키
+      ru: Ключ шифрования
+      ms: Kunci Penyulitan
+      pt-br: Chave de Criptografia
+    required: false
+    type: password
+  - default: UTC
+    edit: true
+    envKey: TZ
+    labelEn: Timezone
+    labelZh: 时区
+    label:
+      en: Timezone
+      zh: 时区
+      zh-Hant: 時區
+      ja: タイムゾーン
+      ko: 시간대
+      ru: Часовой пояс
+      ms: Zon waktu
+      pt-br: Fuso horário
+    required: true
+    type: text
+  - default: info
+    edit: true
+    envKey: LOG_LEVEL
+    labelEn: Log Level
+    labelZh: 日志级别
+    label:
+      en: Log Level
+      zh: 日志级别
+      zh-Hant: 日誌級別
+      ja: ログレベル
+      ko: 로그 레벨
+      ru: Уровень журнала
+      ms: Tahap Log
+      pt-br: Nível de Log
+    required: true
+    type: select
+    values:
+    - label: debug
+      value: debug
+    - label: info
+      value: info
+    - label: warn
+      value: warn
+    - label: error
+      value: error
+  - default: ''
+    edit: true
+    envKey: ADMIN_EMAIL
+    labelEn: Admin Email
+    labelZh: 管理员邮箱
+    label:
+      en: Admin Email
+      zh: 管理员邮箱
+      zh-Hant: 管理員郵箱
+      ja: 管理者メール
+      ko: 관리자 이메일
+      ru: Почта администратора
+      ms: Emel Pentadbir
+      pt-br: E-mail do Admin
+    required: false
+    type: text
+  - default: ''
+    edit: true
+    envKey: ADMIN_PASSWORD
+    labelEn: Admin Password
+    labelZh: 管理员密码
+    label:
+      en: Admin Password
+      zh: 管理员密码
+      zh-Hant: 管理員密碼
+      ja: 管理者パスワード
+      ko: 관리자 비밀번호
+      ru: Пароль администратора
+      ms: Kata Laluan Pentadbir
+      pt-br: Senha do Admin
+    required: false
+    type: password
+  - default: ''
+    edit: true
+    envKey: ALLOWED_ORIGINS
+    labelEn: Allowed Origins
+    labelZh: 允许来源
+    label:
+      en: Allowed Origins
+      zh: 允许来源
+      zh-Hant: 允許來源
+      ja: 許可オリジン
+      ko: 허용 출처
+      ru: Разрешенные origins
+      ms: Origin Dibenarkan
+      pt-br: Origens Permitidas
+    required: false
+    type: text
diff --git a/apps/trek/3.3.0/data/.gitkeep b/apps/trek/4.0.0/data/.gitkeep
similarity index 100%
rename from apps/trek/3.3.0/data/.gitkeep
rename to apps/trek/4.0.0/data/.gitkeep
diff --git a/apps/trek/latest/docker-compose.yml b/apps/trek/4.0.0/docker-compose.yml
similarity index 90%
rename from apps/trek/latest/docker-compose.yml
rename to apps/trek/4.0.0/docker-compose.yml
index 47467334b..08ede235a 100644
--- a/apps/trek/latest/docker-compose.yml
+++ b/apps/trek/4.0.0/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   trek:
-    image: "mauriceboe/trek:latest"
+    image: "mauriceboe/trek:4.0.0@sha256:ae64a5ce6cf510e4e3757667b4a8dc8b3951ded8a18204a819243eee8461835a"
     container_name: ${CONTAINER_NAME}
     read_only: true
     security_opt:
diff --git a/apps/trek/3.3.0/scripts/.gitkeep b/apps/trek/4.0.0/scripts/.gitkeep
similarity index 100%
rename from apps/trek/3.3.0/scripts/.gitkeep
rename to apps/trek/4.0.0/scripts/.gitkeep
diff --git a/apps/trek/4.0.0/scripts/init.sh b/apps/trek/4.0.0/scripts/init.sh
new file mode 100755
index 000000000..78af06334
--- /dev/null
+++ b/apps/trek/4.0.0/scripts/init.sh
@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+set -euo pipefail
+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+export PATH
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
+ENV_FILE="${ENV_FILE:-$ROOT_DIR/.env}"
+
+read_env_value() {
+  local key="$1"
+  [[ -f "$ENV_FILE" ]] || return 0
+  local value
+  value="$(sed -n "s/^${key}=//p" "$ENV_FILE" | tail -n 1)"
+  case "$value" in
+    \"*\") value="${value#\"}"; value="${value%\"}" ;;
+    \'*\') value="${value#\'}"; value="${value%\'}" ;;
+  esac
+  printf '%s\n' "$value"
+}
+
+configured_value() {
+  local key="$1"
+  local default_value="$2"
+  local value
+  value="${!key:-}"
+  if [[ -z "$value" ]]; then
+    value="$(read_env_value "$key")"
+  fi
+  printf '%s\n' "${value:-$default_value}"
+}
+
+resolve_app_path() {
+  local key="$1"
+  local raw="$2"
+  local clean candidate resolved current part
+  local -a parts=()
+  case "$raw" in
+    ""|/*|.|..|../*|*/../*|*/..) echo "unsafe ${key} path" >&2; return 1 ;;
+  esac
+  if [[ "$raw" =~ [[:cntrl:]] ]]; then
+    echo "unsafe ${key} path" >&2
+    return 1
+  fi
+  clean="${raw#./}"
+  [[ -n "$clean" ]] || { echo "unsafe ${key} path" >&2; return 1; }
+  command -v realpath >/dev/null 2>&1 || { echo "realpath is required" >&2; return 1; }
+  candidate="$ROOT_DIR/$clean"
+  resolved="$(realpath -m -- "$candidate")" || { echo "unsafe ${key} path" >&2; return 1; }
+  case "$resolved" in
+    "$ROOT_DIR"/*) ;;
+    *) echo "unsafe ${key} path" >&2; return 1 ;;
+  esac
+  current="$ROOT_DIR"
+  IFS='/' read -r -a parts <<< "$clean"
+  for part in "${parts[@]}"; do
+    [[ -z "$part" || "$part" == "." ]] && continue
+    current="$current/$part"
+    if [[ -L "$current" ]]; then
+      echo "unsafe ${key} path" >&2
+      return 1
+    fi
+  done
+  printf '%s\n' "$resolved"
+}
+
+resolve_direct_child() {
+  local key="$1"
+  local raw="$2"
+  local clean path
+  clean="${raw#./}"
+  if [[ -z "$clean" || "$clean" == */* ]]; then
+    echo "unsafe ${key} path: lifecycle directories must be direct children of the version root" >&2
+    return 1
+  fi
+  path="$(resolve_app_path "$key" "$raw")"
+  [[ "$path" == "$ROOT_DIR/$clean" ]] || { echo "unsafe ${key} path" >&2; return 1; }
+  printf '%s\n' "$path"
+}
+
+verify_trusted_root_chain() {
+  local current owner mode
+  [[ "$(id -u)" == "0" ]] || { echo "directory ownership initialization must run as root" >&2; return 1; }
+  command -v stat >/dev/null 2>&1 || { echo "stat is required" >&2; return 1; }
+  current="$ROOT_DIR"
+  while [[ "$current" != "/" ]]; do
+    [[ -d "$current" && ! -L "$current" ]] || { echo "unsafe version root chain: $current" >&2; return 1; }
+    IFS=':' read -r owner mode < <(stat -c '%u:%a' -- "$current")
+    [[ "$owner" == "0" ]] || { echo "unsafe version root chain owner: $current" >&2; return 1; }
+    [[ "$mode" =~ ^[0-7]{3,4}$ ]] || { echo "unsafe version root chain mode: $current" >&2; return 1; }
+    (( (8#$mode & 0022) == 0 )) || { echo "unsafe version root chain permissions: $current" >&2; return 1; }
+    current="$(dirname -- "$current")"
+  done
+}
+
+ensure_dir() {
+  local key="$1"
+  local raw
+  local path
+  raw="$(configured_value "$key" "$2")"
+  path="$(resolve_app_path "$key" "$raw")"
+  mkdir -p -- "$path"
+  [[ "$(resolve_app_path "$key" "$raw")" == "$path" ]] || { echo "unsafe ${key} path" >&2; return 1; }
+}
+
+ensure_dir "APP_DATA_DIR" "./data"
+ensure_dir "APP_UPLOADS_DIR" "./data/uploads"
diff --git a/apps/trek/3.3.0/scripts/uninstall.sh b/apps/trek/4.0.0/scripts/uninstall.sh
similarity index 100%
rename from apps/trek/3.3.0/scripts/uninstall.sh
rename to apps/trek/4.0.0/scripts/uninstall.sh
diff --git a/apps/trek/4.0.0/scripts/upgrade.sh b/apps/trek/4.0.0/scripts/upgrade.sh
new file mode 100755
index 000000000..5ec28d784
--- /dev/null
+++ b/apps/trek/4.0.0/scripts/upgrade.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+exec "$SCRIPT_DIR/init.sh"
diff --git a/apps/trek/README.md b/apps/trek/README.md
index d654b5b4b..e6984f5b1 100644
--- a/apps/trek/README.md
+++ b/apps/trek/README.md
@@ -22,6 +22,9 @@ http://服务器IP:端口
 - `APP_DATA_DIR`：持久化 `/app/data`
 - `APP_UPLOADS_DIR`：持久化 `/app/uploads`
 
+## 安全风险提示
+维护侧对候选镜像的固定 digest 扫描发现当前基础镜像层包含 Critical=10、High=78 项漏洞，部分项目暂无上游修复版本。该版本已完成真实 1Panel 安装、升级、重启和卸载实装；使用前请评估暴露面，并优先部署在可信内网，等待上游镜像更新。
+
 ## Introduction
 TREK is a travel planning and collaborative map application with itineraries, budgets, files, maps, and multi-user collaboration.
 
@@ -31,6 +34,9 @@ TREK is a travel planning and collaborative map application with itineraries, bu
 - Can auto-seed the first admin account on initial startup
 - Preserves the upstream read-only root filesystem and minimal privilege setup
 
+## Security risk notice
+The maintainer scan of the pinned candidate image found Critical=10 and High=78 vulnerabilities in the current base image layers; some findings have no upstream fix yet. The version passed a real 1Panel install, upgrade, restart, and uninstall test. Assess your exposure before use, prefer a trusted network, and follow upstream image updates.
+
 ## 参考资料
 - 源码: <https://github.com/mauriceboe/TREK>
 - 文档: <https://github.com/mauriceboe/TREK/blob/main/README.md>
diff --git a/apps/trek/data.yml b/apps/trek/data.yml
index 0729fee1e..7c98419be 100644
--- a/apps/trek/data.yml
+++ b/apps/trek/data.yml
@@ -1,15 +1,24 @@
 name: TREK
 tags:
-  - Tool
+- Tool
 title: 旅行计划与协作地图应用
 description: 旅行计划与协作地图应用
 additionalProperties:
   key: trek
   name: TREK
   tags:
-    - Tool
+  - Tool
+  type: tool
+  website: https://github.com/mauriceboe/TREK
+  document: https://github.com/mauriceboe/TREK/blob/main/README.md
+  github: https://github.com/mauriceboe/TREK
   shortDescZh: 旅行计划与协作地图应用
   shortDescEn: Travel planning and collaborative map app
+  crossVersionUpdate: true
+  limit: 0
+  architectures:
+  - amd64
+  - arm64
   description:
     en: Travel planning and collaborative map app.
     zh: 旅行计划与协作地图应用。
@@ -19,13 +28,3 @@ additionalProperties:
     ru: Приложение для планирования путешествий и совместной работы с картами.
     ms: Aplikasi perancangan perjalanan dan peta kolaboratif.
     pt-br: Aplicativo de planejamento de viagens e mapa colaborativo.
-  type: tool
-  crossVersionUpdate: true
-  limit: 0
-  recommend: 0
-  website: https://github.com/mauriceboe/TREK
-  github: https://github.com/mauriceboe/TREK
-  document: https://github.com/mauriceboe/TREK/blob/main/README.md
-  architectures:
-    - amd64
-    - arm64
diff --git a/apps/trek/latest/.env.sample b/apps/trek/latest/.env.sample
deleted file mode 100644
index 14df8eb37..000000000
--- a/apps/trek/latest/.env.sample
+++ /dev/null
@@ -1,10 +0,0 @@
-PANEL_APP_PORT_HTTP=3000
-APP_DATA_DIR=./data
-APP_UPLOADS_DIR=./data/uploads
-ENCRYPTION_KEY=
-TZ=UTC
-LOG_LEVEL=info
-ADMIN_EMAIL=
-ADMIN_PASSWORD=
-ALLOWED_ORIGINS=
-CONTAINER_NAME=
diff --git a/apps/trek/latest/data.yml b/apps/trek/latest/data.yml
deleted file mode 100644
index 5a3c04466..000000000
--- a/apps/trek/latest/data.yml
+++ /dev/null
@@ -1,156 +0,0 @@
-additionalProperties:
-  formFields:
-    - default: 3000
-      edit: true
-      envKey: PANEL_APP_PORT_HTTP
-      labelEn: Web Port
-      labelZh: Web 访问端口
-      label:
-        en: Web Port
-        zh: Web 访问端口
-        zh-Hant: Web 存取埠
-        ja: Web ポート
-        ko: Web 포트
-        ru: Веб-порт
-        ms: Port Web
-        pt-br: Porta Web
-      required: true
-      rule: paramPort
-      type: number
-    - default: ./data
-      edit: true
-      envKey: APP_DATA_DIR
-      labelEn: Data Directory
-      labelZh: 数据目录
-      label:
-        en: Data Directory
-        zh: 数据目录
-        zh-Hant: 資料目錄
-        ja: データディレクトリ
-        ko: 데이터 디렉터리
-        ru: Каталог данных
-        ms: Direktori Data
-        pt-br: Diretório de Dados
-      required: true
-      type: text
-    - default: ./data/uploads
-      edit: true
-      envKey: APP_UPLOADS_DIR
-      labelEn: Uploads Directory
-      labelZh: 上传目录
-      label:
-        en: Uploads Directory
-        zh: 上传目录
-        zh-Hant: 上傳目錄
-        ja: アップロードディレクトリ
-        ko: 업로드 디렉터리
-        ru: Каталог загрузок
-        ms: Direktori Muat Naik
-        pt-br: Diretório de Uploads
-      required: true
-      type: text
-    - default: ''
-      edit: true
-      envKey: ENCRYPTION_KEY
-      labelEn: Encryption Key
-      labelZh: 加密密钥
-      label:
-        en: Encryption Key
-        zh: 加密密钥
-        zh-Hant: 加密密鑰
-        ja: 暗号化キー
-        ko: 암호화 키
-        ru: Ключ шифрования
-        ms: Kunci Penyulitan
-        pt-br: Chave de Criptografia
-      required: false
-      type: password
-    - default: UTC
-      edit: true
-      envKey: TZ
-      labelEn: Timezone
-      labelZh: 时区
-      label:
-        en: Timezone
-        zh: 时区
-        zh-Hant: 時區
-        ja: タイムゾーン
-        ko: 시간대
-        ru: Часовой пояс
-        ms: Zon waktu
-        pt-br: Fuso horário
-      required: true
-      type: text
-    - default: info
-      edit: true
-      envKey: LOG_LEVEL
-      labelEn: Log Level
-      labelZh: 日志级别
-      label:
-        en: Log Level
-        zh: 日志级别
-        zh-Hant: 日誌級別
-        ja: ログレベル
-        ko: 로그 레벨
-        ru: Уровень журнала
-        ms: Tahap Log
-        pt-br: Nível de Log
-      required: true
-      type: select
-      values:
-        - label: debug
-          value: debug
-        - label: info
-          value: info
-        - label: warn
-          value: warn
-        - label: error
-          value: error
-    - default: ''
-      edit: true
-      envKey: ADMIN_EMAIL
-      labelEn: Admin Email
-      labelZh: 管理员邮箱
-      label:
-        en: Admin Email
-        zh: 管理员邮箱
-        zh-Hant: 管理員郵箱
-        ja: 管理者メール
-        ko: 관리자 이메일
-        ru: Почта администратора
-        ms: Emel Pentadbir
-        pt-br: E-mail do Admin
-      required: false
-      type: text
-    - default: ''
-      edit: true
-      envKey: ADMIN_PASSWORD
-      labelEn: Admin Password
-      labelZh: 管理员密码
-      label:
-        en: Admin Password
-        zh: 管理员密码
-        zh-Hant: 管理員密碼
-        ja: 管理者パスワード
-        ko: 관리자 비밀번호
-        ru: Пароль администратора
-        ms: Kata Laluan Pentadbir
-        pt-br: Senha do Admin
-      required: false
-      type: password
-    - default: ''
-      edit: true
-      envKey: ALLOWED_ORIGINS
-      labelEn: Allowed Origins
-      labelZh: 允许来源
-      label:
-        en: Allowed Origins
-        zh: 允许来源
-        zh-Hant: 允許來源
-        ja: 許可オリジン
-        ko: 허용 출처
-        ru: Разрешенные origins
-        ms: Origin Dibenarkan
-        pt-br: Origens Permitidas
-      required: false
-      type: text
diff --git a/apps/trek/latest/data/.gitkeep b/apps/trek/latest/data/.gitkeep
deleted file mode 100644
index e69de29bb..000000000
diff --git a/apps/trek/latest/scripts/.gitkeep b/apps/trek/latest/scripts/.gitkeep
deleted file mode 100644
index e69de29bb..000000000
diff --git a/apps/trek/latest/scripts/init.sh b/apps/trek/latest/scripts/init.sh
deleted file mode 100755
index d8755e2d1..000000000
--- a/apps/trek/latest/scripts/init.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-DATA_DIR="${APP_DATA_DIR:-./data}"
-UPLOADS_DIR="${APP_UPLOADS_DIR:-./data/uploads}"
-mkdir -p "$DATA_DIR" "$UPLOADS_DIR"
diff --git a/apps/trek/latest/scripts/uninstall.sh b/apps/trek/latest/scripts/uninstall.sh
deleted file mode 100755
index 024242bb3..000000000
--- a/apps/trek/latest/scripts/uninstall.sh
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-docker-compose down --volumes
diff --git a/apps/trek/latest/scripts/upgrade.sh b/apps/trek/latest/scripts/upgrade.sh
deleted file mode 100755
index d8755e2d1..000000000
--- a/apps/trek/latest/scripts/upgrade.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-DATA_DIR="${APP_DATA_DIR:-./data}"
-UPLOADS_DIR="${APP_UPLOADS_DIR:-./data/uploads}"
-mkdir -p "$DATA_DIR" "$UPLOADS_DIR"
diff --git a/apps/trek/logo.png b/apps/trek/logo.png
index 2dbd73c5b..cd3b171a6 100644
Binary files a/apps/trek/logo.png and b/apps/trek/logo.png differ