diff --git a/.woodpecker/vector-test.yaml b/.woodpecker/vector-test.yaml
deleted file mode 100644
index 5d9180d..0000000
--- a/.woodpecker/vector-test.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: vector-test
-    image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector:0.57.0-debian
-    commands:
-      # Dummy creds + writable dirs so the full topologies build; the unit tests
-      # only exercise the transforms (sources are not started).
-      - export CLICKHOUSE_USER=ci CLICKHOUSE_PASSWORD=ci
-      - export NATS_PRODUCER_PASSWORD=ci NATS_CONSUMER_PASSWORD=ci
-      - mkdir -p /vector-data-dir /etc/vault-ca
-      - cp /etc/ssl/certs/ca-certificates.crt /etc/vault-ca/ca.crt
-      # Transform tier + VM ingest: unit-tested transforms.
-      - vector test apps/base/logging/vector/aggregator.yaml apps/base/logging/vector/aggregator-tests.yaml
-      - vector test apps/base/logging/vector/vm-ingest.yaml apps/base/logging/vector/vm-ingest-tests.yaml
-      # Agent has no transforms to unit-test; validate it builds. (The archiver
-      # leg is now the logarchiver service, not a Vector pipeline.)
-      - vector validate --no-environment apps/base/logging/vector/agent.yaml
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 256Mi
-            cpu: 250m
-          limits:
-            memory: 1Gi
-            cpu: 1
diff --git a/apps/base/bind-system/deployment.yaml b/apps/base/bind-system/deployment.yaml
index 435a209..d50dc41 100644
--- a/apps/base/bind-system/deployment.yaml
+++ b/apps/base/bind-system/deployment.yaml
@@ -21,7 +21,7 @@ spec:
         runAsNonRoot: true
       containers:
         - name: operator
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/bind-operator:v0.3.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/bind-operator:v0.3.1
           args:
             - --metrics-bind-address=:8080
             - --health-probe-bind-address=:8081
diff --git a/apps/base/bind-system/kustomization.yaml b/apps/base/bind-system/kustomization.yaml
index 05d78f6..b596216 100644
--- a/apps/base/bind-system/kustomization.yaml
+++ b/apps/base/bind-system/kustomization.yaml
@@ -6,7 +6,7 @@ resources:
   - namespace.yaml
   # CRDs are pulled from the bind-operator repo at the matching tag rather than
   # vendored here, so they never drift from the operator.
-  - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.3.0/config/crd/install.yaml
+  - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.3.1/config/crd/install.yaml
   - rbac.yaml
   - agent-dns-rbac.yaml
   - deployment.yaml
diff --git a/apps/base/logging/vlogs/httproute.yaml b/apps/base/logging/vlogs/httproute.yaml
index 03debad..b97755e 100644
--- a/apps/base/logging/vlogs/httproute.yaml
+++ b/apps/base/logging/vlogs/httproute.yaml
@@ -37,6 +37,18 @@ spec:
       name: vlogs-external
       sectionName: https
   rules:
+    # Exact / outranks the PathPrefix catch-all; target needs the trailing slash
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            path:
+              type: ReplaceFullPath
+              replaceFullPath: /select/vmui/
+            statusCode: 302
+      matches:
+        - path:
+            type: Exact
+            value: /
     - backendRefs:
         - group: ""
           kind: Service