diff --git a/.Jules/palette.md b/.Jules/palette.md
new file mode 100644
index 000000000..8216a3484
--- /dev/null
+++ b/.Jules/palette.md
@@ -0,0 +1,3 @@
+## 2024-07-27 - Dynamic ARIA labels for icon-only toggles
+**Learning:** Icon-only toggle buttons (like show/hide password, show/hide API key) need dynamic `:aria-label` attributes that update based on their current state, so screen readers can announce the correct action rather than a static label.
+**Action:** When adding `aria-label` to toggle buttons, use a ternary operator bound to the same state used for the icon (e.g., `:aria-label="showPassword ? 'Hide password' : 'Show password'"`).
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d34fd0638..54eb42e45 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -83,16 +83,11 @@ jobs:
       - name: Install Playwright (chromium)
         run: npx playwright install --with-deps chromium
 
-      - name: Setup Supabase CLI
-        uses: supabase/setup-cli@v1
-        with:
-          version: latest
-
       - name: Boot Supabase + run two-client Realtime e2e (R1–R7)
         run: |
-          supabase start
+          npx supabase start
           ./scripts/run-e2e.sh canvas-sync-regressions.spec.ts --project=chromium --workers=2
 
       - name: Stop Supabase
         if: always()
-        run: supabase stop || true
+        run: npx supabase stop || true
diff --git a/scripts/run-e2e.sh b/scripts/run-e2e.sh
index 2911c1d1f..d3513ff23 100755
--- a/scripts/run-e2e.sh
+++ b/scripts/run-e2e.sh
@@ -6,7 +6,7 @@
 set -euo pipefail
 
 # Auto-fetch keys from local Supabase if not already set
-SUPABASE_STATUS_ENV="${SUPABASE_STATUS_ENV:-$(supabase status -o env 2>&1 || true)}"
+SUPABASE_STATUS_ENV="${SUPABASE_STATUS_ENV:-$(npx supabase status -o env 2>&1 || true)}"
 
 if [ -z "${SUPABASE_SERVICE_ROLE_KEY:-}" ]; then
   # Try new-format secret key first (Supabase v2.x uses sb_secret_* instead of HS256 JWT)
diff --git a/src/components/settings/tabs/AISettingsTab.vue b/src/components/settings/tabs/AISettingsTab.vue
index a0cbd741a..c6b57cec9 100644
--- a/src/components/settings/tabs/AISettingsTab.vue
+++ b/src/components/settings/tabs/AISettingsTab.vue
@@ -594,7 +594,7 @@ async function onClearMemories() {
             spellcheck="false"
             autocomplete="off"
           />
-          <button class="key-toggle-btn" @click="showGroqKey = !showGroqKey" :title="showGroqKey ? 'Hide' : 'Show'">
+          <button class="key-toggle-btn" @click="showGroqKey = !showGroqKey" :title="showGroqKey ? 'Hide API key' : 'Show API key'" :aria-label="showGroqKey ? 'Hide API key' : 'Show API key'">
             <EyeOff v-if="showGroqKey" :size="14" />
             <Eye v-else :size="14" />
           </button>
diff --git a/src/components/settings/tabs/AccountSettingsTab.vue b/src/components/settings/tabs/AccountSettingsTab.vue
index e709c08a5..f1087d813 100644
--- a/src/components/settings/tabs/AccountSettingsTab.vue
+++ b/src/components/settings/tabs/AccountSettingsTab.vue
@@ -342,7 +342,7 @@ const handleChangePassword = async () => {
                 class="form-input"
                 placeholder="Enter new password"
               >
-              <button class="toggle-visibility" @click="showPassword = !showPassword">
+              <button class="toggle-visibility" @click="showPassword = !showPassword" :aria-label="showPassword ? 'Hide password' : 'Show password'" :title="showPassword ? 'Hide password' : 'Show password'">
                 <Eye v-if="!showPassword" :size="16" />
                 <EyeOff v-else :size="16" />
               </button>
@@ -504,7 +504,7 @@ const handleChangePassword = async () => {
             class="form-input"
             @focus="(e) => (e.target as HTMLInputElement).select()"
           >
-          <button class="toggle-visibility" :title="localApiCopied ? 'Copied!' : 'Copy'" @click="copyLocalApiToken">
+          <button class="toggle-visibility" :title="localApiCopied ? 'Copied!' : 'Copy API token'" :aria-label="localApiCopied ? 'Copied!' : 'Copy API token'" @click="copyLocalApiToken">
             <Check v-if="localApiCopied" :size="16" />
             <Copy v-else :size="16" />
           </button>