diff --git a/.github/workflows/proxyproto-e2e.yml b/.github/workflows/proxyproto-e2e.yml
index 88d31fc4..75653cc8 100644
--- a/.github/workflows/proxyproto-e2e.yml
+++ b/.github/workflows/proxyproto-e2e.yml
@@ -34,6 +34,24 @@ jobs:
         # time instead of at release time (see #884 / v0.47.0).
         run: GOOS=windows GOARCH=amd64 go build -o /dev/null ./cmd/containarium/
 
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: '20'
+
+      - name: Web UI build guard
+        # `make build-release` runs a full `next build` (with TypeScript
+        # type-checking) that no PR-time job exercised — the same "only
+        # caught at release time" gap as the Windows guard above, just for
+        # the web UI. A prop destructure typo (#886) and two wrong-argument
+        # client calls broke v0.48.0's release build (webui compiled fine in
+        # `next dev`/lint, only `next build`'s full type-check caught it).
+        # Same fix shape as #884/#885: run the real release build at PR time.
+        working-directory: web-ui
+        run: |
+          npm ci
+          npm run build
+
       - name: Run sentinel + app tests
         # The skipped tests are pre-existing failures on unprivileged Linux
         # runners (they pass on darwin where loopback aliases are no-ops).
diff --git a/web-ui/src/components/containers/ContainerListView.tsx b/web-ui/src/components/containers/ContainerListView.tsx
index 746180d7..68dc026e 100644
--- a/web-ui/src/components/containers/ContainerListView.tsx
+++ b/web-ui/src/components/containers/ContainerListView.tsx
@@ -75,6 +75,7 @@ function IconBtn({ title, onClick, className = '', children }: { title: string;
 export default function ContainerListView({
   containers, metricsMap, securityBadgesMap, onDelete, onStart, onStop, onTerminal,
   onEditFirewall, onEditLabels, onResize, onManageCollaborators, onToggleAutoSleep,
+  onSecurityClick,
 }: ContainerListViewProps) {
   return (
     <div className="overflow-x-auto rounded-xl border border-[var(--border-subtle)]">
diff --git a/web-ui/src/components/security/PentestView.tsx b/web-ui/src/components/security/PentestView.tsx
index 394c01a1..db6f6a01 100644
--- a/web-ui/src/components/security/PentestView.tsx
+++ b/web-ui/src/components/security/PentestView.tsx
@@ -230,7 +230,7 @@ export default function PentestView({ server }: PentestViewProps) {
         client.getPentestFindingSummary(),
         client.listPentestFindings({ ...baseParams, targetType: 'route', limit, offset: rowsPerPage === -1 ? 0 : domainPage * rowsPerPage }),
         client.listPentestFindings({ ...baseParams, targetType: 'container', limit, offset: rowsPerPage === -1 ? 0 : containerPage * rowsPerPage }),
-        client.listPentestScanRuns(10),
+        client.listPentestScanRuns(undefined, 10),
         client.getPentestConfig(),
       ]);
       setSummary(summaryResp.summary); setDomainFindings(domainResp.findings); setDomainTotalCount(domainResp.totalCount);
@@ -250,7 +250,7 @@ export default function PentestView({ server }: PentestViewProps) {
       setSnackMessage(result.message || `Scan started: ${result.scanRunId}`);
       const pollInterval = setInterval(async () => {
         try {
-          const runsResp = await client.listPentestScanRuns(5);
+          const runsResp = await client.listPentestScanRuns(undefined, 5);
           setScanRuns(runsResp.scanRuns);
           const latest = runsResp.scanRuns[0];
           if (latest && latest.id === result.scanRunId && latest.status !== 'running') { clearInterval(pollInterval); setScanning(false); loadData(); }