diff --git a/.github/workflows/build-infra-dockers.yaml b/.github/workflows/build-infra-dockers.yaml
index 85284a1a1..a5b538d7a 100644
--- a/.github/workflows/build-infra-dockers.yaml
+++ b/.github/workflows/build-infra-dockers.yaml
@@ -15,6 +15,7 @@ env:
 permissions:
   contents: read
   packages: write
+  id-token: write
 
 jobs:
   docker-syncthing:
@@ -30,11 +31,11 @@ jobs:
           - stupgrades
           - ursrv
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # was: actions/checkout@v5
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # was: actions/setup-go@v6
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
@@ -77,6 +78,7 @@ jobs:
           echo "TAGS=$tags" >> $GITHUB_ENV
 
       - name: Build and push
+        id: build
         uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         with:
           context: .
@@ -86,3 +88,11 @@ jobs:
           tags: ${{ env.TAGS }}
           labels: |
             org.opencontainers.image.revision=${{ github.sha }}
+
+      - name: Install Cosign
+        if: github.ref == 'refs/heads/infrastructure'
+        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
+
+      - name: Sign image
+        if: github.ref == 'refs/heads/infrastructure'
+        run: cosign sign --yes --recursive ghcr.io/syncthing/infra/${{ matrix.pkg }}:latest@${{ steps.build.outputs.digest }}
\ No newline at end of file
diff --git a/.github/workflows/build-syncthing.yaml b/.github/workflows/build-syncthing.yaml
index 1cc4ba6a3..286b7b339 100644
--- a/.github/workflows/build-syncthing.yaml
+++ b/.github/workflows/build-syncthing.yaml
@@ -1012,6 +1012,7 @@ jobs:
     permissions:
       contents: read
       packages: write
+      id-token: write
     needs:
       - facts
     env:
@@ -1115,6 +1116,7 @@ jobs:
           mv bin/* script ctx
 
       - name: Build and push Docker image
+        id: build
         uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: ctx
@@ -1126,6 +1128,22 @@ jobs:
             org.opencontainers.image.version=${{ env.VERSION }}
             org.opencontainers.image.revision=${{ github.sha }}
 
+      - name: Install Cosign
+        if: github.event_name == 'push'
+        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
+
+      - name: Sign image
+        if: github.event_name == 'push'
+        env:
+          DIGEST: ${{ steps.build.outputs.digest }}
+        run: |
+          IFS="," read -ra tags <<< $DOCKER_TAGS
+          images=""
+          for tag in ${tags[@]}; do
+            images+="${tag}@${DIGEST} "
+          done
+          cosign sign --yes --recursive ${images}
+
   #
   # Sync images to Docker hub. This takes the images already pushed to GHCR
   # and copies them to Docker hub. Runs for releases only.
diff --git a/cmd/infra/ursrv/serve/serve.go b/cmd/infra/ursrv/serve/serve.go
index 803b869de..c015d96a3 100644
--- a/cmd/infra/ursrv/serve/serve.go
+++ b/cmd/infra/ursrv/serve/serve.go
@@ -311,7 +311,7 @@ func (s *server) handleNewData(w http.ResponseWriter, r *http.Request) {
 	bs, _ := io.ReadAll(lr)
 	if err := json.Unmarshal(bs, &rep); err != nil {
 		log.Error("Failed to decode JSON", slogutil.Error(err))
-		http.Error(w, "JSON Decode Error", http.StatusInternalServerError)
+		http.Error(w, "JSON Decode Error", http.StatusBadRequest)
 		return
 	}
 
@@ -321,7 +321,7 @@ func (s *server) handleNewData(w http.ResponseWriter, r *http.Request) {
 
 	if err := rep.Validate(); err != nil {
 		log.Error("Failed to validate report", slogutil.Error(err))
-		http.Error(w, "Validation Error", http.StatusInternalServerError)
+		http.Error(w, "Validation Error", http.StatusBadRequest)
 		return
 	}
 
diff --git a/cmd/stdiscosrv/apisrv.go b/cmd/stdiscosrv/apisrv.go
index 565206ca1..cecfa9723 100644
--- a/cmd/stdiscosrv/apisrv.go
+++ b/cmd/stdiscosrv/apisrv.go
@@ -206,6 +206,7 @@ func (s *apiSrv) handleGET(w http.ResponseWriter, req *http.Request) {
 	rec, err := s.db.get(&deviceID)
 	if err != nil {
 		// some sort of internal error
+		slog.Warn("Failed to handle GET request", "id", reqID, "error", err)
 		lookupRequestsTotal.WithLabelValues("internal_error").Inc()
 		w.Header().Set("Retry-After", errorRetryAfterString())
 		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
@@ -284,7 +285,7 @@ func (s *apiSrv) handlePOST(remoteAddr *net.TCPAddr, w http.ResponseWriter, req
 	}
 
 	if err := s.handleAnnounce(deviceID, addresses); err != nil {
-		slog.Debug("Failed to handle request", "id", reqID, "error", err)
+		slog.Warn("Failed to handle POST request", "id", reqID, "error", err)
 		announceRequestsTotal.WithLabelValues("internal_error").Inc()
 		w.Header().Set("Retry-After", errorRetryAfterString())
 		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
diff --git a/cmd/stdiscosrv/main.go b/cmd/stdiscosrv/main.go
index 1ad4a6b96..aa1f91f04 100644
--- a/cmd/stdiscosrv/main.go
+++ b/cmd/stdiscosrv/main.go
@@ -35,10 +35,10 @@ const (
 
 	// Reannounce-After is set to reannounceAfterSeconds +
 	// random(reannounzeFuzzSeconds), similar for Retry-After
-	reannounceAfterSeconds = 3300
-	reannounzeFuzzSeconds  = 300
-	errorRetryAfterSeconds = 1500
-	errorRetryFuzzSeconds  = 300
+	reannounceAfterSeconds = 2400
+	reannounzeFuzzSeconds  = 1800
+	errorRetryAfterSeconds = 1800
+	errorRetryFuzzSeconds  = 900
 
 	// Retry for not found is notFoundRetrySeenSeconds for records we have
 	// seen an announcement for (but it's not active right now) and