diff --git a/backend/.sqlx/query-020c031c3de6c85577e30421ada9d39a5a47ca1b6cf3dbfd6988aa0694d7364c.json b/backend/.sqlx/query-020c031c3de6c85577e30421ada9d39a5a47ca1b6cf3dbfd6988aa0694d7364c.json
deleted file mode 100644
index e8edd87bda..0000000000
--- a/backend/.sqlx/query-020c031c3de6c85577e30421ada9d39a5a47ca1b6cf3dbfd6988aa0694d7364c.json
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT value FROM variable WHERE path = $1 AND workspace_id = $2 AND is_secret = true",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "value",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "020c031c3de6c85577e30421ada9d39a5a47ca1b6cf3dbfd6988aa0694d7364c"
-}
diff --git a/backend/.sqlx/query-7a92837ad2a1181580c1e0d059fd6bc0ece84d3c315635de52bd2b364c238a71.json b/backend/.sqlx/query-08af141e847f9bb6a4c26ccad3bd84d2a06b9e55557757d407787078af1ecad7.json
similarity index 62%
rename from backend/.sqlx/query-7a92837ad2a1181580c1e0d059fd6bc0ece84d3c315635de52bd2b364c238a71.json
rename to backend/.sqlx/query-08af141e847f9bb6a4c26ccad3bd84d2a06b9e55557757d407787078af1ecad7.json
index 331816c897..4031b62a9e 100644
--- a/backend/.sqlx/query-7a92837ad2a1181580c1e0d059fd6bc0ece84d3c315635de52bd2b364c238a71.json
+++ b/backend/.sqlx/query-08af141e847f9bb6a4c26ccad3bd84d2a06b9e55557757d407787078af1ecad7.json
@@ -1,12 +1,12 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT value, account, (now() > account.expires_at) as is_expired, is_secret, path from variable\n        LEFT JOIN account ON variable.account = account.id WHERE variable.path = $1 AND variable.workspace_id = $2",
+  "query": "SELECT value::text AS \"value!\", account, (now() > account.expires_at) as is_expired, is_secret, path from variable\n        LEFT JOIN account ON variable.account = account.id WHERE variable.path = $1 AND variable.workspace_id = $2",
   "describe": {
     "columns": [
       {
         "ordinal": 0,
-        "name": "value",
-        "type_info": "Varchar"
+        "name": "value!",
+        "type_info": "Text"
       },
       {
         "ordinal": 1,
@@ -36,12 +36,12 @@
       ]
     },
     "nullable": [
-      false,
+      null,
       true,
       null,
       false,
       false
     ]
   },
-  "hash": "7a92837ad2a1181580c1e0d059fd6bc0ece84d3c315635de52bd2b364c238a71"
+  "hash": "08af141e847f9bb6a4c26ccad3bd84d2a06b9e55557757d407787078af1ecad7"
 }
diff --git a/backend/.sqlx/query-146f0e42ada3068a5cdae0ffdbb54b63f8c06c9143b16ce399170c1b5a6b911e.json b/backend/.sqlx/query-1cf81ee935e6e820463820519e3a402d5290b494dac690c9a11f121eeefeab8e.json
similarity index 56%
rename from backend/.sqlx/query-146f0e42ada3068a5cdae0ffdbb54b63f8c06c9143b16ce399170c1b5a6b911e.json
rename to backend/.sqlx/query-1cf81ee935e6e820463820519e3a402d5290b494dac690c9a11f121eeefeab8e.json
index 9fd6daded5..da40d27d9f 100644
--- a/backend/.sqlx/query-146f0e42ada3068a5cdae0ffdbb54b63f8c06c9143b16ce399170c1b5a6b911e.json
+++ b/backend/.sqlx/query-1cf81ee935e6e820463820519e3a402d5290b494dac690c9a11f121eeefeab8e.json
@@ -1,12 +1,12 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT value, is_secret FROM variable WHERE path = $1 AND workspace_id = $2",
+  "query": "SELECT value::text AS \"value!\", is_secret FROM variable WHERE path = $1 AND workspace_id = $2",
   "describe": {
     "columns": [
       {
         "ordinal": 0,
-        "name": "value",
-        "type_info": "Varchar"
+        "name": "value!",
+        "type_info": "Text"
       },
       {
         "ordinal": 1,
@@ -21,9 +21,9 @@
       ]
     },
     "nullable": [
-      false,
+      null,
       false
     ]
   },
-  "hash": "146f0e42ada3068a5cdae0ffdbb54b63f8c06c9143b16ce399170c1b5a6b911e"
+  "hash": "1cf81ee935e6e820463820519e3a402d5290b494dac690c9a11f121eeefeab8e"
 }
diff --git a/backend/.sqlx/query-2c0ab7571e1a7c4290315bc3efccb4db9e0c9aee05596a594f81975a0cdb74d1.json b/backend/.sqlx/query-2c0ab7571e1a7c4290315bc3efccb4db9e0c9aee05596a594f81975a0cdb74d1.json
deleted file mode 100644
index 9c4b3eb842..0000000000
--- a/backend/.sqlx/query-2c0ab7571e1a7c4290315bc3efccb4db9e0c9aee05596a594f81975a0cdb74d1.json
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT value FROM variable WHERE workspace_id = $1 AND path = $2",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "value",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "2c0ab7571e1a7c4290315bc3efccb4db9e0c9aee05596a594f81975a0cdb74d1"
-}
diff --git a/backend/.sqlx/query-b656f38e5f1d6a0799767a775b8550027cf7a3bb202269e8dda92d31bc8789dd.json b/backend/.sqlx/query-3420c007c141c5d9e3748c18de03d4b51216ba05e2951ce045ff58112c1db361.json
similarity index 63%
rename from backend/.sqlx/query-b656f38e5f1d6a0799767a775b8550027cf7a3bb202269e8dda92d31bc8789dd.json
rename to backend/.sqlx/query-3420c007c141c5d9e3748c18de03d4b51216ba05e2951ce045ff58112c1db361.json
index 6ad2fc0ae1..b7b2516d40 100644
--- a/backend/.sqlx/query-b656f38e5f1d6a0799767a775b8550027cf7a3bb202269e8dda92d31bc8789dd.json
+++ b/backend/.sqlx/query-3420c007c141c5d9e3748c18de03d4b51216ba05e2951ce045ff58112c1db361.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT path, value, is_secret FROM variable WHERE workspace_id = $1",
+  "query": "SELECT path, value::text AS \"value!\", is_secret FROM variable WHERE workspace_id = $1",
   "describe": {
     "columns": [
       {
@@ -10,8 +10,8 @@
       },
       {
         "ordinal": 1,
-        "name": "value",
-        "type_info": "Varchar"
+        "name": "value!",
+        "type_info": "Text"
       },
       {
         "ordinal": 2,
@@ -26,9 +26,9 @@
     },
     "nullable": [
       false,
-      false,
+      null,
       false
     ]
   },
-  "hash": "b656f38e5f1d6a0799767a775b8550027cf7a3bb202269e8dda92d31bc8789dd"
+  "hash": "3420c007c141c5d9e3748c18de03d4b51216ba05e2951ce045ff58112c1db361"
 }
diff --git a/backend/.sqlx/query-71b410dbc6cdd0252de2f8646395903c9fa60a5435fa73c587da2b913203cf18.json b/backend/.sqlx/query-36121d10cb03d45fc14aacd08750fb944a54c1172ffa2b990ba157e676f66f51.json
similarity index 50%
rename from backend/.sqlx/query-71b410dbc6cdd0252de2f8646395903c9fa60a5435fa73c587da2b913203cf18.json
rename to backend/.sqlx/query-36121d10cb03d45fc14aacd08750fb944a54c1172ffa2b990ba157e676f66f51.json
index d74d5e6ba3..8d7e440538 100644
--- a/backend/.sqlx/query-71b410dbc6cdd0252de2f8646395903c9fa60a5435fa73c587da2b913203cf18.json
+++ b/backend/.sqlx/query-36121d10cb03d45fc14aacd08750fb944a54c1172ffa2b990ba157e676f66f51.json
@@ -1,12 +1,12 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT v.value, a.id AS account_id, a.refresh_token\n         FROM variable v\n         JOIN account a ON a.workspace_id = v.workspace_id AND a.id = v.account\n         WHERE v.workspace_id = $1 AND v.path = $2\n           AND a.client = $3 AND a.is_workspace_integration = true",
+  "query": "SELECT v.value::text AS \"value!\", a.id AS account_id, a.refresh_token\n         FROM variable v\n         JOIN account a ON a.workspace_id = v.workspace_id AND a.id = v.account\n         WHERE v.workspace_id = $1 AND v.path = $2\n           AND a.client = $3 AND a.is_workspace_integration = true",
   "describe": {
     "columns": [
       {
         "ordinal": 0,
-        "name": "value",
-        "type_info": "Varchar"
+        "name": "value!",
+        "type_info": "Text"
       },
       {
         "ordinal": 1,
@@ -27,10 +27,10 @@
       ]
     },
     "nullable": [
-      false,
+      null,
       false,
       false
     ]
   },
-  "hash": "71b410dbc6cdd0252de2f8646395903c9fa60a5435fa73c587da2b913203cf18"
+  "hash": "36121d10cb03d45fc14aacd08750fb944a54c1172ffa2b990ba157e676f66f51"
 }
diff --git a/backend/.sqlx/query-40790b7f44b40b0c64bbabd3bc6c984000e12f33bc1cea460e8f5dd55ea59eec.json b/backend/.sqlx/query-40790b7f44b40b0c64bbabd3bc6c984000e12f33bc1cea460e8f5dd55ea59eec.json
new file mode 100644
index 0000000000..ab8bc4e241
--- /dev/null
+++ b/backend/.sqlx/query-40790b7f44b40b0c64bbabd3bc6c984000e12f33bc1cea460e8f5dd55ea59eec.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT value::text AS \"value!\" FROM variable WHERE workspace_id = $1 AND path = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "value!",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "40790b7f44b40b0c64bbabd3bc6c984000e12f33bc1cea460e8f5dd55ea59eec"
+}
diff --git a/backend/.sqlx/query-2d5ff8fc102ae0c452c1f9cd5cd30fd0a3b4e6e746c659da1767edafd139d45e.json b/backend/.sqlx/query-4ff75cdf9ee681cccb4b793704c9d154f36986ee0da73725a40c860037b63310.json
similarity index 60%
rename from backend/.sqlx/query-2d5ff8fc102ae0c452c1f9cd5cd30fd0a3b4e6e746c659da1767edafd139d45e.json
rename to backend/.sqlx/query-4ff75cdf9ee681cccb4b793704c9d154f36986ee0da73725a40c860037b63310.json
index 2939d5ac88..39dabb8fbb 100644
--- a/backend/.sqlx/query-2d5ff8fc102ae0c452c1f9cd5cd30fd0a3b4e6e746c659da1767edafd139d45e.json
+++ b/backend/.sqlx/query-4ff75cdf9ee681cccb4b793704c9d154f36986ee0da73725a40c860037b63310.json
@@ -1,12 +1,12 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT value, is_secret, description\n         FROM variable\n         WHERE workspace_id = $1 AND path = $2",
+  "query": "SELECT value::text AS \"value!\", is_secret, description\n         FROM variable\n         WHERE workspace_id = $1 AND path = $2",
   "describe": {
     "columns": [
       {
         "ordinal": 0,
-        "name": "value",
-        "type_info": "Varchar"
+        "name": "value!",
+        "type_info": "Text"
       },
       {
         "ordinal": 1,
@@ -26,10 +26,10 @@
       ]
     },
     "nullable": [
-      false,
+      null,
       false,
       false
     ]
   },
-  "hash": "2d5ff8fc102ae0c452c1f9cd5cd30fd0a3b4e6e746c659da1767edafd139d45e"
+  "hash": "4ff75cdf9ee681cccb4b793704c9d154f36986ee0da73725a40c860037b63310"
 }
diff --git a/backend/.sqlx/query-1587639f13a1a3ad97bd324df38661f3e846f1992704c86ddad74dea151b0ec4.json b/backend/.sqlx/query-5d344853a65a2438c87f12124428609933e4363c11455709e1785228abd3366f.json
similarity index 61%
rename from backend/.sqlx/query-1587639f13a1a3ad97bd324df38661f3e846f1992704c86ddad74dea151b0ec4.json
rename to backend/.sqlx/query-5d344853a65a2438c87f12124428609933e4363c11455709e1785228abd3366f.json
index 0ed678d485..386435e806 100644
--- a/backend/.sqlx/query-1587639f13a1a3ad97bd324df38661f3e846f1992704c86ddad74dea151b0ec4.json
+++ b/backend/.sqlx/query-5d344853a65a2438c87f12124428609933e4363c11455709e1785228abd3366f.json
@@ -1,12 +1,12 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT value, is_secret, path from variable WHERE variable.path = $1 AND variable.workspace_id = $2",
+  "query": "SELECT value::text AS \"value!\", is_secret, path from variable WHERE variable.path = $1 AND variable.workspace_id = $2",
   "describe": {
     "columns": [
       {
         "ordinal": 0,
-        "name": "value",
-        "type_info": "Varchar"
+        "name": "value!",
+        "type_info": "Text"
       },
       {
         "ordinal": 1,
@@ -26,10 +26,10 @@
       ]
     },
     "nullable": [
-      false,
+      null,
       false,
       false
     ]
   },
-  "hash": "1587639f13a1a3ad97bd324df38661f3e846f1992704c86ddad74dea151b0ec4"
+  "hash": "5d344853a65a2438c87f12124428609933e4363c11455709e1785228abd3366f"
 }
diff --git a/backend/.sqlx/query-0c2e53960dc7786c848079b155e62994d4a861f1dbb9752c0a27428d83040e13.json b/backend/.sqlx/query-698758d7ef61b3f1de00088a36fe9f2e94c1c25b02bf324a730e4f734eb61c16.json
similarity index 57%
rename from backend/.sqlx/query-0c2e53960dc7786c848079b155e62994d4a861f1dbb9752c0a27428d83040e13.json
rename to backend/.sqlx/query-698758d7ef61b3f1de00088a36fe9f2e94c1c25b02bf324a730e4f734eb61c16.json
index 5c33539878..17e8d20bb5 100644
--- a/backend/.sqlx/query-0c2e53960dc7786c848079b155e62994d4a861f1dbb9752c0a27428d83040e13.json
+++ b/backend/.sqlx/query-698758d7ef61b3f1de00088a36fe9f2e94c1c25b02bf324a730e4f734eb61c16.json
@@ -1,12 +1,12 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT value, is_secret FROM variable WHERE path = $1",
+  "query": "SELECT value::text AS \"value!\", is_secret FROM variable WHERE path = $1",
   "describe": {
     "columns": [
       {
         "ordinal": 0,
-        "name": "value",
-        "type_info": "Varchar"
+        "name": "value!",
+        "type_info": "Text"
       },
       {
         "ordinal": 1,
@@ -20,9 +20,9 @@
       ]
     },
     "nullable": [
-      false,
+      null,
       false
     ]
   },
-  "hash": "0c2e53960dc7786c848079b155e62994d4a861f1dbb9752c0a27428d83040e13"
+  "hash": "698758d7ef61b3f1de00088a36fe9f2e94c1c25b02bf324a730e4f734eb61c16"
 }
diff --git a/backend/.sqlx/query-61f3627cbd2a50b745c4e491ed8ee71e58db22b7f53202c5360a01c92091fc08.json b/backend/.sqlx/query-a0f799d0211f0a7bd649747a6627b82cd0127581ad831089231317af587bb25a.json
similarity index 54%
rename from backend/.sqlx/query-61f3627cbd2a50b745c4e491ed8ee71e58db22b7f53202c5360a01c92091fc08.json
rename to backend/.sqlx/query-a0f799d0211f0a7bd649747a6627b82cd0127581ad831089231317af587bb25a.json
index f97d5e310a..5ac876fa73 100644
--- a/backend/.sqlx/query-61f3627cbd2a50b745c4e491ed8ee71e58db22b7f53202c5360a01c92091fc08.json
+++ b/backend/.sqlx/query-a0f799d0211f0a7bd649747a6627b82cd0127581ad831089231317af587bb25a.json
@@ -1,12 +1,12 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT value, is_secret\n         FROM variable\n         WHERE path = $1 AND workspace_id = $2",
+  "query": "SELECT value::text AS \"value!\", is_secret\n         FROM variable\n         WHERE path = $1 AND workspace_id = $2",
   "describe": {
     "columns": [
       {
         "ordinal": 0,
-        "name": "value",
-        "type_info": "Varchar"
+        "name": "value!",
+        "type_info": "Text"
       },
       {
         "ordinal": 1,
@@ -21,9 +21,9 @@
       ]
     },
     "nullable": [
-      false,
+      null,
       false
     ]
   },
-  "hash": "61f3627cbd2a50b745c4e491ed8ee71e58db22b7f53202c5360a01c92091fc08"
+  "hash": "a0f799d0211f0a7bd649747a6627b82cd0127581ad831089231317af587bb25a"
 }
diff --git a/backend/.sqlx/query-a4badf66d2ae524d15925869c9bfa6b590cb357e19233318d2a2a31555dbc515.json b/backend/.sqlx/query-a4badf66d2ae524d15925869c9bfa6b590cb357e19233318d2a2a31555dbc515.json
new file mode 100644
index 0000000000..828e5ba470
--- /dev/null
+++ b/backend/.sqlx/query-a4badf66d2ae524d15925869c9bfa6b590cb357e19233318d2a2a31555dbc515.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT value::text AS \"value!\" FROM variable WHERE path = $1 AND workspace_id = $2 AND is_secret = true",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "value!",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "a4badf66d2ae524d15925869c9bfa6b590cb357e19233318d2a2a31555dbc515"
+}
diff --git a/backend/.sqlx/query-44a12919fb154055f1142cc078ef131f8a0c9cdb37cfba6283a6718480b02a4b.json b/backend/.sqlx/query-b2c35e00474b8fa335d9485c1f98018dc033582642988ed7a3181989fef72fed.json
similarity index 63%
rename from backend/.sqlx/query-44a12919fb154055f1142cc078ef131f8a0c9cdb37cfba6283a6718480b02a4b.json
rename to backend/.sqlx/query-b2c35e00474b8fa335d9485c1f98018dc033582642988ed7a3181989fef72fed.json
index 18c572b1fb..44dcca2457 100644
--- a/backend/.sqlx/query-44a12919fb154055f1142cc078ef131f8a0c9cdb37cfba6283a6718480b02a4b.json
+++ b/backend/.sqlx/query-b2c35e00474b8fa335d9485c1f98018dc033582642988ed7a3181989fef72fed.json
@@ -1,12 +1,12 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT value, is_secret, expires_at FROM variable WHERE path = $1",
+  "query": "SELECT value::text AS \"value!\", is_secret, expires_at FROM variable WHERE path = $1",
   "describe": {
     "columns": [
       {
         "ordinal": 0,
-        "name": "value",
-        "type_info": "Varchar"
+        "name": "value!",
+        "type_info": "Text"
       },
       {
         "ordinal": 1,
@@ -25,10 +25,10 @@
       ]
     },
     "nullable": [
-      false,
+      null,
       false,
       true
     ]
   },
-  "hash": "44a12919fb154055f1142cc078ef131f8a0c9cdb37cfba6283a6718480b02a4b"
+  "hash": "b2c35e00474b8fa335d9485c1f98018dc033582642988ed7a3181989fef72fed"
 }
diff --git a/backend/.sqlx/query-ade0696ec69bec2258d2e3ff86bfba6ed3b1d573c298f9d7fe8056ba7e32ed81.json b/backend/.sqlx/query-bc004ad060664cc75fc000229af16538576b978a1083365b5a98fc4ca7ea9576.json
similarity index 58%
rename from backend/.sqlx/query-ade0696ec69bec2258d2e3ff86bfba6ed3b1d573c298f9d7fe8056ba7e32ed81.json
rename to backend/.sqlx/query-bc004ad060664cc75fc000229af16538576b978a1083365b5a98fc4ca7ea9576.json
index 3fe61f6f8e..09fa4b0b11 100644
--- a/backend/.sqlx/query-ade0696ec69bec2258d2e3ff86bfba6ed3b1d573c298f9d7fe8056ba7e32ed81.json
+++ b/backend/.sqlx/query-bc004ad060664cc75fc000229af16538576b978a1083365b5a98fc4ca7ea9576.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT workspace_id, path, value FROM variable WHERE is_secret = true AND value IS NOT NULL AND value != ''",
+  "query": "SELECT workspace_id, path, value::text AS \"value!\" FROM variable WHERE is_secret = true AND value IS NOT NULL AND value != ''",
   "describe": {
     "columns": [
       {
@@ -15,8 +15,8 @@
       },
       {
         "ordinal": 2,
-        "name": "value",
-        "type_info": "Varchar"
+        "name": "value!",
+        "type_info": "Text"
       }
     ],
     "parameters": {
@@ -25,8 +25,8 @@
     "nullable": [
       false,
       false,
-      false
+      null
     ]
   },
-  "hash": "ade0696ec69bec2258d2e3ff86bfba6ed3b1d573c298f9d7fe8056ba7e32ed81"
+  "hash": "bc004ad060664cc75fc000229af16538576b978a1083365b5a98fc4ca7ea9576"
 }
diff --git a/backend/.sqlx/query-bda9fc0c6e41d8afebee538e6997c6bad7843f93d0a5780632b02fa215aa404b.json b/backend/.sqlx/query-bda9fc0c6e41d8afebee538e6997c6bad7843f93d0a5780632b02fa215aa404b.json
deleted file mode 100644
index 02a979f32f..0000000000
--- a/backend/.sqlx/query-bda9fc0c6e41d8afebee538e6997c6bad7843f93d0a5780632b02fa215aa404b.json
+++ /dev/null
@@ -1,29 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT path, value FROM variable\n           WHERE path LIKE ('u/' || $1 || '/%')\n           AND workspace_id = $2\n           AND is_secret = true\n           AND (value LIKE '$vault:%' OR value LIKE '$azure_kv:%')",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "value",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "bda9fc0c6e41d8afebee538e6997c6bad7843f93d0a5780632b02fa215aa404b"
-}
diff --git a/backend/.sqlx/query-c0aff25f0cc3b71842b0ba9ae55b6bc5eca203bf02f46164db08580d128b860a.json b/backend/.sqlx/query-c0aff25f0cc3b71842b0ba9ae55b6bc5eca203bf02f46164db08580d128b860a.json
deleted file mode 100644
index 74a9d24135..0000000000
--- a/backend/.sqlx/query-c0aff25f0cc3b71842b0ba9ae55b6bc5eca203bf02f46164db08580d128b860a.json
+++ /dev/null
@@ -1,29 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT value, account FROM variable WHERE workspace_id = $1 AND path = $2",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "value",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "account",
-        "type_info": "Int4"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      true
-    ]
-  },
-  "hash": "c0aff25f0cc3b71842b0ba9ae55b6bc5eca203bf02f46164db08580d128b860a"
-}
diff --git a/backend/.sqlx/query-dec3b1a5a743bfcee0c6a1efdfc7398c1c11277e968af4acb9393ba2b340dd1e.json b/backend/.sqlx/query-dec3b1a5a743bfcee0c6a1efdfc7398c1c11277e968af4acb9393ba2b340dd1e.json
new file mode 100644
index 0000000000..6f1cc55c51
--- /dev/null
+++ b/backend/.sqlx/query-dec3b1a5a743bfcee0c6a1efdfc7398c1c11277e968af4acb9393ba2b340dd1e.json
@@ -0,0 +1,29 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT path, value::text AS \"value!\" FROM variable\n           WHERE path LIKE ('u/' || $1 || '/%')\n           AND workspace_id = $2\n           AND is_secret = true\n           AND (value LIKE '$vault:%' OR value LIKE '$azure_kv:%')",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "value!",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      null
+    ]
+  },
+  "hash": "dec3b1a5a743bfcee0c6a1efdfc7398c1c11277e968af4acb9393ba2b340dd1e"
+}
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 9c9efeeb1e..c7cffa7f07 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-6858e4cbd515b52713afea8dc32b23072af2248c
+16858ac4cf7326ed3d5a6fae1a97fcade5a97af7
diff --git a/backend/windmill-api-workspaces/src/datatable_clone.rs b/backend/windmill-api-workspaces/src/datatable_clone.rs
index 1e6c6b55c2..067a248aa7 100644
--- a/backend/windmill-api-workspaces/src/datatable_clone.rs
+++ b/backend/windmill-api-workspaces/src/datatable_clone.rs
@@ -104,7 +104,7 @@ pub(crate) async fn connection_snapshot(
                     continue;
                 }
                 let row: Option<(String, bool)> = sqlx::query_as(
-                    "SELECT value, is_secret FROM variable WHERE workspace_id = $1 AND path = $2",
+                    "SELECT value::text, is_secret FROM variable WHERE workspace_id = $1 AND path = $2",
                 )
                 .bind(w_id)
                 .bind(var)
diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index e2027c3e9b..4184af9779 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -6524,7 +6524,7 @@ async fn set_encryption_key(
         );
 
         let all_variables = sqlx::query!(
-            "SELECT path, value, is_secret FROM variable WHERE workspace_id = $1",
+            "SELECT path, value::text AS \"value!\", is_secret FROM variable WHERE workspace_id = $1",
             w_id
         )
         .fetch_all(&mut *tx)
@@ -14503,7 +14503,7 @@ async fn compare_two_variables(
 
     // Get variable from each workspace
     let source_variable = sqlx::query!(
-        "SELECT value, is_secret, description
+        "SELECT value::text AS \"value!\", is_secret, description
          FROM variable
          WHERE workspace_id = $1 AND path = $2",
         source_workspace_id,
@@ -14513,7 +14513,7 @@ async fn compare_two_variables(
     .await?;
 
     let target_variable = sqlx::query!(
-        "SELECT value, is_secret, description
+        "SELECT value::text AS \"value!\", is_secret, description
          FROM variable
          WHERE workspace_id = $1 AND path = $2",
         fork_workspace_id,
diff --git a/backend/windmill-api/src/offboarding.rs b/backend/windmill-api/src/offboarding.rs
index defaa05234..59305d96e3 100644
--- a/backend/windmill-api/src/offboarding.rs
+++ b/backend/windmill-api/src/offboarding.rs
@@ -1075,7 +1075,7 @@ async fn offboard_user_from_workspace<'c>(
     let new_var_prefix = format!("{}/", reassign_to);
 
     let vault_secrets: Vec<(String, String)> = sqlx::query!(
-        r#"SELECT path, value FROM variable
+        r#"SELECT path, value::text AS "value!" FROM variable
            WHERE path LIKE ('u/' || $1 || '/%')
            AND workspace_id = $2
            AND is_secret = true
diff --git a/backend/windmill-api/src/users.rs b/backend/windmill-api/src/users.rs
index 8c742b6d64..ecf77b6d5f 100644
--- a/backend/windmill-api/src/users.rs
+++ b/backend/windmill-api/src/users.rs
@@ -632,7 +632,7 @@ async fn update_username_in_workpsace<'c>(
 
     // Fetch all externally-stored secret variables under this user's path
     let vault_secrets: Vec<(String, String)> = sqlx::query!(
-        r#"SELECT path, value FROM variable
+        r#"SELECT path, value::text AS "value!" FROM variable
            WHERE path LIKE ('u/' || $1 || '/%')
            AND workspace_id = $2
            AND is_secret = true
diff --git a/backend/windmill-api/src/workspaces_export.rs b/backend/windmill-api/src/workspaces_export.rs
index 87496fed45..705c409621 100644
--- a/backend/windmill-api/src/workspaces_export.rs
+++ b/backend/windmill-api/src/workspaces_export.rs
@@ -972,9 +972,9 @@ pub(crate) async fn tarball_workspace(
         // would never match the variable it created and every sync would report it changed.
         let variables =
              sqlx::query_as::<_, ExportableListableVariable>(if !skip_secrets.unwrap_or(false) {
-                 "SELECT workspace_id, path, value, is_secret, description, extra_perms, NULL::int AS account, is_oauth, expires_at, labels FROM variable WHERE workspace_id = $1 AND expires_at IS NULL"
+                 "SELECT workspace_id, path, value::text AS value, is_secret, description, extra_perms, NULL::int AS account, is_oauth, expires_at, labels FROM variable WHERE workspace_id = $1 AND expires_at IS NULL"
              } else {
-                 "SELECT workspace_id, path, value, is_secret, description, extra_perms, NULL::int AS account, is_oauth, expires_at, labels FROM variable WHERE workspace_id = $1 AND is_secret = false AND expires_at IS NULL"
+                 "SELECT workspace_id, path, value::text AS value, is_secret, description, extra_perms, NULL::int AS account, is_oauth, expires_at, labels FROM variable WHERE workspace_id = $1 AND is_secret = false AND expires_at IS NULL"
              })
              .bind(&w_id)
              .fetch_all(&mut *tx)
diff --git a/backend/windmill-common/src/min_version.rs b/backend/windmill-common/src/min_version.rs
index 3719abd31c..9005ab834a 100644
--- a/backend/windmill-common/src/min_version.rs
+++ b/backend/windmill-common/src/min_version.rs
@@ -27,9 +27,13 @@ pub const MIN_VERSION_SUPPORTS_JOB_TOKEN_SCOPES: VC = vc(1, 822, 0, "Restricted
 // stored secret variables. Reading it ships one release earlier (1.831), so a rollback to
 // that release still reads every secret; below it, secrets written after the switch stay
 // unreadable until rolled forward. Only worker versions are seen here, not servers.
-// Also gates widening `variable.value`, which needs every process to retire the connections
-// the widening poisons (`db::retire_connections_opened_before_now`): that also ships in 1.832.
 pub const MIN_VERSION_SUPPORTS_AEAD_SECRETS: VC = vc(1, 832, 0, "AES-GCM secret encryption");
+// Gates widening `variable.value`. Every query returning that column casts it to text from
+// this release, so the widening changes no result type: before it, each statement prepared on
+// the column fails once per connection, and behind PgBouncer until its server connection
+// closes. Must name the release this ships in.
+pub const MIN_VERSION_SUPPORTS_VARIABLE_VALUE_WIDENING: VC =
+    vc(1, 848, 0, "variable.value widening");
 // A renewed license key replaces the one every process reads, and a worker that predates
 // Ed25519 support rejects an Ed25519-signed key and stops pulling jobs, so renewal only offers
 // to accept one once this is met. Only worker versions are seen here, not servers. Must name
diff --git a/backend/windmill-common/src/secret_backend/database.rs b/backend/windmill-common/src/secret_backend/database.rs
index b450cc7e15..903ea85e24 100644
--- a/backend/windmill-common/src/secret_backend/database.rs
+++ b/backend/windmill-common/src/secret_backend/database.rs
@@ -39,7 +39,7 @@ impl DatabaseBackend {
 impl SecretBackend for DatabaseBackend {
     async fn get_secret(&self, workspace_id: &str, path: &str) -> Result<String> {
         let variable = sqlx::query!(
-            "SELECT value FROM variable WHERE path = $1 AND workspace_id = $2 AND is_secret = true",
+            "SELECT value::text AS \"value!\" FROM variable WHERE path = $1 AND workspace_id = $2 AND is_secret = true",
             path,
             workspace_id
         )
diff --git a/backend/windmill-common/src/variables.rs b/backend/windmill-common/src/variables.rs
index 512bd555f0..bc015ef022 100644
--- a/backend/windmill-common/src/variables.rs
+++ b/backend/windmill-common/src/variables.rs
@@ -451,7 +451,7 @@ pub async fn get_secret_value_as_admin(
     path: &str,
 ) -> crate::error::Result<String> {
     let variable_o = sqlx::query!(
-        "SELECT value, is_secret, path from variable WHERE variable.path = $1 AND variable.workspace_id = $2", path, w_id
+        "SELECT value::text AS \"value!\", is_secret, path from variable WHERE variable.path = $1 AND variable.workspace_id = $2", path, w_id
     )
     .fetch_optional(db)
     .await?;
@@ -542,9 +542,8 @@ pub fn variable_value_widen_pending() -> bool {
 
 /// Widen `variable.value` to [`VARIABLE_VALUE_WIDTH`], or `false` when it is too early to.
 /// Not a migration: changing a column's type, even its length, fails every statement a live
-/// process prepared on it until its connection closes. It waits for v2 writes, gated on a
-/// worker version that retires such connections on the first failure, so that no process too
-/// old to recover is still running.
+/// process prepared on it until its connection closes. It waits until no process returns the
+/// column uncast. Any new query returning `variable.value` must select `value::text`.
 async fn widen_variable_value(db: &DB) -> error::Result<bool> {
     if VARIABLE_VALUE_WIDENED.load(Ordering::Relaxed) {
         return Ok(true);
@@ -556,7 +555,9 @@ async fn widen_variable_value(db: &DB) -> error::Result<bool> {
     .fetch_one(db)
     .await?;
     if typmod >= 0 && typmod - 4 < VARIABLE_VALUE_WIDTH {
-        if crate::db::process_uptime() < crate::db::PREVIOUS_RELEASE_ROLLOUT_UPTIME {
+        if !crate::min_version::MIN_VERSION_SUPPORTS_VARIABLE_VALUE_WIDENING.met_conservatively()
+            || crate::db::process_uptime() < crate::db::PREVIOUS_RELEASE_ROLLOUT_UPTIME
+        {
             return Ok(false);
         }
         tracing::info!("widening variable.value to VARCHAR({VARIABLE_VALUE_WIDTH})");
@@ -669,7 +670,7 @@ async fn upgrade_workspace_secret_variables(db: &DB, w_id: &str) -> error::Resul
         };
         let mc = crypt_from_key_with_suffix(&key, "");
         let rows: Vec<(String, String)> = sqlx::query_as(
-            "SELECT path, value FROM variable WHERE workspace_id = $1 AND is_secret AND path > $2 \
+            "SELECT path, value::text FROM variable WHERE workspace_id = $1 AND is_secret AND path > $2 \
              ORDER BY path LIMIT $3",
         )
         .bind(w_id)
@@ -1009,7 +1010,7 @@ pub async fn get_variable_or_self(
     let path = path.strip_prefix("$var:").unwrap().to_string();
 
     let record = sqlx::query!(
-        "SELECT value, is_secret
+        "SELECT value::text AS \"value!\", is_secret
          FROM variable
          WHERE path = $1 AND workspace_id = $2",
         &path,
@@ -1057,7 +1058,7 @@ pub async fn get_variable_or_self_as<T: Authable + Sync>(
     // Use an RLS-scoped transaction so the query respects row-level security
     let mut tx = user_db.clone().begin(authed).await?;
     let record = sqlx::query!(
-        "SELECT value, is_secret
+        "SELECT value::text AS \"value!\", is_secret
          FROM variable
          WHERE path = $1 AND workspace_id = $2",
         &var_path,
diff --git a/backend/windmill-common/src/workspaces.rs b/backend/windmill-common/src/workspaces.rs
index 3b5d78c5b7..9132c51950 100644
--- a/backend/windmill-common/src/workspaces.rs
+++ b/backend/windmill-common/src/workspaces.rs
@@ -3805,7 +3805,7 @@ async fn transform_json_unchecked(
         serde_json::Value::String(s) if s.starts_with("$var:") => {
             let path = &s[5..];
             let (value, is_secret): (String, bool) = sqlx::query_as(
-                "SELECT value, is_secret FROM variable WHERE workspace_id = $1 AND path = $2",
+                "SELECT value::text, is_secret FROM variable WHERE workspace_id = $1 AND path = $2",
             )
             .bind(&w_id)
             .bind(path)
diff --git a/backend/windmill-native-triggers/src/lib.rs b/backend/windmill-native-triggers/src/lib.rs
index c61a1ff335..4a8560d9f0 100644
--- a/backend/windmill-native-triggers/src/lib.rs
+++ b/backend/windmill-native-triggers/src/lib.rs
@@ -815,7 +815,7 @@ pub async fn decrypt_oauth_data<T: DeserializeOwned>(
     let mc = build_crypt(db, workspace_id).await?;
 
     let row = sqlx::query!(
-        "SELECT v.value, a.id AS account_id, a.refresh_token
+        "SELECT v.value::text AS \"value!\", a.id AS account_id, a.refresh_token
          FROM variable v
          JOIN account a ON a.workspace_id = v.workspace_id AND a.id = v.account
          WHERE v.workspace_id = $1 AND v.path = $2
diff --git a/backend/windmill-store/src/oauth_refresh_oss.rs b/backend/windmill-store/src/oauth_refresh_oss.rs
index 3d55b05167..a0d0926510 100644
--- a/backend/windmill-store/src/oauth_refresh_oss.rs
+++ b/backend/windmill-store/src/oauth_refresh_oss.rs
@@ -182,7 +182,7 @@ where
 
 async fn current_token(db: &DB, w_id: &str, path: &str) -> error::Result<String> {
     let value = sqlx::query_scalar!(
-        "SELECT value FROM variable WHERE workspace_id = $1 AND path = $2",
+        "SELECT value::text AS \"value!\" FROM variable WHERE workspace_id = $1 AND path = $2",
         w_id,
         path
     )
diff --git a/backend/windmill-store/src/resources.rs b/backend/windmill-store/src/resources.rs
index 5aa8823012..9af92361f6 100644
--- a/backend/windmill-store/src/resources.rs
+++ b/backend/windmill-store/src/resources.rs
@@ -2189,7 +2189,7 @@ async fn update_resource(
 
             // Handle Vault secret rename if the linked variable is a Vault-stored secret
             let linked_var = sqlx::query!(
-                "SELECT value, is_secret FROM variable WHERE path = $1 AND workspace_id = $2",
+                "SELECT value::text AS \"value!\", is_secret FROM variable WHERE path = $1 AND workspace_id = $2",
                 path,
                 w_id
             )
diff --git a/backend/windmill-store/src/variables.rs b/backend/windmill-store/src/variables.rs
index 352a411214..76e21908cd 100644
--- a/backend/windmill-store/src/variables.rs
+++ b/backend/windmill-store/src/variables.rs
@@ -337,7 +337,7 @@ async fn get_variable(
     let mut tx = user_db.begin(&authed).await?;
 
     let variable_o = sqlx::query_as::<_, ListableVariable>(
-        "SELECT variable.workspace_id, variable.path, variable.value, variable.is_secret,
+        "SELECT variable.workspace_id, variable.path, variable.value::text AS value, variable.is_secret,
         variable.description, variable.extra_perms, variable.account, variable.is_oauth,
         variable.expires_at, variable.labels,
         folder_labels(variable.workspace_id, variable.path) as inherited_labels,
@@ -1243,7 +1243,7 @@ async fn update_variable(
 
             // Handle Vault secret rename if the variable is a secret stored in Vault
             let current_var = sqlx::query!(
-                "SELECT value, is_secret FROM variable WHERE path = $1 AND workspace_id = $2",
+                "SELECT value::text AS \"value!\", is_secret FROM variable WHERE path = $1 AND workspace_id = $2",
                 path,
                 w_id
             )
@@ -1537,7 +1537,7 @@ pub async fn get_value_internal<'a>(
 
     let mut tx = db_with_opt_authed.begin().await?;
     let variable_o = sqlx::query!(
-        "SELECT value, account, (now() > account.expires_at) as is_expired, is_secret, path from variable
+        "SELECT value::text AS \"value!\", account, (now() > account.expires_at) as is_expired, is_secret, path from variable
         LEFT JOIN account ON variable.account = account.id WHERE variable.path = $1 AND variable.workspace_id = $2", path, w_id
     )
     .fetch_optional(&mut *tx)