diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md
index 5c109af6..f302c44c 100644
--- a/CONTRIBUTORS.md
+++ b/CONTRIBUTORS.md
@@ -14,7 +14,9 @@ Thank you to everyone who has contributed to Kiji Privacy Proxy!
 - **Eddie Mattia** ([@emattia](https://github.com/emattia))
 - **Sebastien G. Claro** ([@s3bc40](https://github.com/s3bc40))
 - **GodHad** ([@GodHad](https://github.com/GodHad))
+- **Yash Dhawan** ([@ykd007](https://github.com/ykd007))
 - **Youssef Jouini** ([@yjouini](https://github.com/yjouini))
+
 ---
 
 Want to contribute? See [Contributing](README.md#-contributing) for guidelines.
diff --git a/src/backend/config/config.go b/src/backend/config/config.go
index 9115d17d..4c932120 100644
--- a/src/backend/config/config.go
+++ b/src/backend/config/config.go
@@ -14,6 +14,14 @@ import (
 	"github.com/hannes/kiji-private/src/backend/providers"
 )
 
+// DefaultForwardProxyPort is the default port for the forward proxy.
+// The leading colon is intentional — this is a net.Listen-style address (e.g. ":8080").
+const DefaultForwardProxyPort = ":8080"
+
+// DefaultTransparentProxyPort is the default port for the transparent proxy.
+// The leading colon is intentional — this is a net.Listen-style address (e.g. ":8081").
+const DefaultTransparentProxyPort = ":8081"
+
 // LoggingConfig holds logging configuration options
 type LoggingConfig struct {
 	LogRequests    bool // Log request content
@@ -242,7 +250,7 @@ func DefaultConfig() *Config {
 			MistralProviderConfig:   defaultMistralProviderConfig,
 			CustomProviderConfig:    defaultCustomProviderConfig,
 		},
-		ProxyPort:          ":8080",
+		ProxyPort:          DefaultForwardProxyPort,
 		ONNXModelPath:      "",
 		TokenizerPath:      "",
 		ModelVariant:       ModelVariantTrained,
@@ -261,7 +269,7 @@ func DefaultConfig() *Config {
 		},
 		Proxy: ProxyConfig{
 			TransparentEnabled: true,
-			ProxyPort:          ":8081",
+			ProxyPort:          DefaultTransparentProxyPort,
 			CAPath:             caPath,
 			KeyPath:            keyPath,
 			EnablePAC:          true, // Enable PAC by default for automatic proxy configuration
diff --git a/src/backend/server/server.go b/src/backend/server/server.go
index a04a72cd..9f474aaf 100644
--- a/src/backend/server/server.go
+++ b/src/backend/server/server.go
@@ -307,7 +307,7 @@ func (s *Server) Start() error {
 func (s *Server) startTransparentProxy() {
 	proxyPort := s.config.Proxy.ProxyPort
 	if proxyPort == "" {
-		proxyPort = ":8080"
+		proxyPort = config.DefaultForwardProxyPort
 	}
 
 	log.Printf("Starting transparent proxy on port %s", proxyPort)
diff --git a/src/frontend/src/components/modals/CACertSetupModal.tsx b/src/frontend/src/components/modals/CACertSetupModal.tsx
index e4932840..6c012e50 100644
--- a/src/frontend/src/components/modals/CACertSetupModal.tsx
+++ b/src/frontend/src/components/modals/CACertSetupModal.tsx
@@ -106,7 +106,9 @@ export default function CACertSetupModal({
                 className="inline-flex items-center gap-2 px-4 py-2 bg-slate-100 hover:bg-slate-200 text-slate-800 rounded-lg text-sm font-medium transition-colors border border-slate-300"
               >
                 <FolderOpen className="w-4 h-4" />
-                Reveal CA cert in Finder
+                {window.electronAPI?.platform === "darwin"
+                  ? "Reveal CA cert in Finder"
+                  : "Show CA cert in Explorer"}
               </button>
               {revealError && (
                 <p className="text-xs text-red-600 mt-2">{revealError}</p>
diff --git a/src/frontend/src/components/modals/SettingsModal.tsx b/src/frontend/src/components/modals/SettingsModal.tsx
index 1231d827..81389253 100644
--- a/src/frontend/src/components/modals/SettingsModal.tsx
+++ b/src/frontend/src/components/modals/SettingsModal.tsx
@@ -642,9 +642,11 @@ export default function SettingsModal({
               </div>
             </div>
 
-            {/* Reveal CA cert in Finder */}
+            {/* Reveal CA cert in Finder / Explorer */}
             {isElectron && window.electronAPI && (
               <div
+                role="button"
+                tabIndex={0}
                 onClick={async () => {
                   const result = await window.electronAPI!.revealCACert();
                   if (!result.success) {
@@ -656,6 +658,20 @@ export default function SettingsModal({
                     });
                   }
                 }}
+                onKeyDown={async (e) => {
+                  if (e.key === "Enter" || e.key === " ") {
+                    e.preventDefault();
+                    const result = await window.electronAPI!.revealCACert();
+                    if (!result.success) {
+                      setMessage({
+                        type: "error",
+                        text:
+                          result.error ||
+                          "Failed to open the certificate folder.",
+                      });
+                    }
+                  }
+                }}
                 className="border-2 border-slate-200 rounded-lg p-4 hover:border-slate-300 hover:bg-slate-50 transition-colors cursor-pointer"
               >
                 <div className="flex items-center justify-between">
@@ -663,7 +679,9 @@ export default function SettingsModal({
                     <FolderOpen className="w-5 h-5 text-slate-600" />
                     <div>
                       <p className="font-medium text-slate-700">
-                        Reveal CA cert in Finder
+                        {window.electronAPI.platform === "darwin"
+                          ? "Reveal CA cert in Finder"
+                          : "Show CA cert in Explorer"}
                       </p>
                       <p className="text-xs text-slate-500">
                         Open the folder containing the proxy's root certificate