diff --git a/.docs-test.toml b/.docs-test.toml
index 777f2aa81..0d771123c 100644
--- a/.docs-test.toml
+++ b/.docs-test.toml
@@ -48,6 +48,12 @@ versions        = ["main", "latest", "2.2.x", "1.0.x"]
 hugoWarnings = [
   "\\.Site\\.Data was deprecated",
   "'items' parameter of the 'tabs' shortcode is deprecated",
+  # FlexSearch bundle couldn't be fetched from the CDN at build time, so the
+  # theme fell back to a runtime CDN <script> tag instead of failing the build.
+  # This is a transient, network-only CI failure we don't control; the fallback
+  # keeps the site working. The warnf is allowlisted so a blip doesn't turn CI
+  # red, but it stays in the build log as a trace.
+  "FlexSearch: could not fetch .* at build time",
 ]
 
 # NOTE: agw-oss previously allowlisted two Hextra main.min.js null-dereferences
diff --git a/.github/workflows/framework-tests.yml b/.github/workflows/framework-tests.yml
index 5ac1f4b53..b04f01e34 100644
--- a/.github/workflows/framework-tests.yml
+++ b/.github/workflows/framework-tests.yml
@@ -122,6 +122,11 @@ jobs:
         env:
           DOCS_TEST_CONFIG: ${{ github.workspace }}/.docs-test.toml
         run: |
+          # pipefail required: bare `run:` steps run as `bash -e {0}` without
+          # pipefail here, so `tee`'s exit (0) would mask a failing test suite and
+          # the step would go green. The `if: always()` summary/upload steps below
+          # already assume this step can fail.
+          set -o pipefail
           # One invocation runs both projects against the single build above.
           npx playwright test --project=static --project=content --reporter=list,html 2>&1 | tee playwright-output.txt
 
diff --git a/assets/agw-docs/pages/agentgateway/llm/virtual-keys.md b/assets/agw-docs/pages/agentgateway/llm/virtual-keys.md
index 33960caae..2949ed06f 100644
--- a/assets/agw-docs/pages/agentgateway/llm/virtual-keys.md
+++ b/assets/agw-docs/pages/agentgateway/llm/virtual-keys.md
@@ -777,10 +777,8 @@ For more information on cost tracking, see the [cost tracking guide]({{< link-he
 
 Provide different budget tiers for free, standard, and premium users.
 
-1. Add tier metadata to each API key.
-
-   {{< version exclude-if="1.3.x,1.2.x,1.1.x,1.0.x,2.2.x" >}}
-   Store the keys in a ConfigMap, using the `keyHash` of each key. Generate each hash with `printf '%s' '<key>' | sha256sum | awk '{print "sha256:"$1}'`.
+{{< version exclude-if="1.3.x,1.2.x,1.1.x,1.0.x,2.2.x" >}}
+1. Add tier metadata to each API key. Store the keys in a ConfigMap, using the `keyHash` of each key. Generate each hash with `printf '%s' '<key>' | sha256sum | awk '{print "sha256:"$1}'`.
 
    ```yaml
    apiVersion: v1
@@ -808,9 +806,10 @@ Provide different budget tiers for free, standard, and premium users.
          }
        }
    ```
-   {{< /version >}}
+{{< /version >}}
+{{< version include-if="1.3.x,1.2.x,1.1.x,1.0.x,2.2.x" >}}
+1. Add tier metadata to each API key. Store the keys in a Secret, with one entry per user.
 
-   {{< version include-if="1.3.x,1.2.x,1.1.x,1.0.x,2.2.x" >}}
    ```yaml
    apiVersion: v1
    kind: Secret
@@ -836,7 +835,7 @@ Provide different budget tiers for free, standard, and premium users.
          }
        }
    ```
-   {{< /version >}}
+{{< /version >}}
 
 2. Configure rate limiting to use the tier and user_id from API key metadata.
 
diff --git a/assets/agw-docs/pages/setup/listeners/https.md b/assets/agw-docs/pages/setup/listeners/https.md
index d93b35c9d..55100e136 100644
--- a/assets/agw-docs/pages/setup/listeners/https.md
+++ b/assets/agw-docs/pages/setup/listeners/https.md
@@ -53,7 +53,6 @@ Set up an HTTPS listener on your Gateway.
 
    {{% /tab %}}
    {{% tab name="ListenerSets" %}}
-
    1. Create a Gateway that enables the attachment of ListenerSets.
 
       ```yaml
@@ -69,10 +68,10 @@ Set up an HTTPS listener on your Gateway.
         gatewayClassName: {{< reuse "agw-docs/snippets/gatewayclass.md" >}}
         allowedListeners:
           namespaces:
-            from: All        
+            from: All
         listeners:
         - protocol: HTTP
-port: 80
+          port: 80
           name: http-mock
           allowedRoutes:
             namespaces:
@@ -89,6 +88,7 @@ port: 80
       |`spec.listeners`| {{< reuse "agw-docs/snippets/generic-listener.md" >}} In this example, the generic listener is configured on port 80, which differs from port 443 in the ListenerSet that you create later. |
 
    2. Create a ListenerSet that configures an HTTPS listener for the Gateway.
+
       ```yaml
       kubectl apply -f- <<EOF
       apiVersion: gateway.networking.k8s.io/v1
diff --git a/assets/agw-docs/snippets/debug-gateway.md b/assets/agw-docs/snippets/debug-gateway.md
index cf595d1f4..cae151bde 100644
--- a/assets/agw-docs/snippets/debug-gateway.md
+++ b/assets/agw-docs/snippets/debug-gateway.md
@@ -21,61 +21,58 @@
 
 
 3. Access the debugging interface of your gateway proxy on your localhost. Configuration might be missing on the gateway or might be applied to the wrong route. For example, if you apply multiple policies to the same route by using the `targetRefs` section, only the oldest policy is applied. The newer policy configuration might be ignored and not applied to the gateway.
-   {{< conditional-text include-if="envoy" >}}
-   
-   ```sh
-   kubectl port-forward deploy/http -n {{< reuse "agw-docs/snippets/namespace.md" >}} 19000 &  
-   ```
-   
-   * [http://localhost:19000/](http://localhost:19000/)
 
-   {{< reuse-image-light src="img/gateway-admin-interface.png" caption="Figure: Debugging interface of the gateway proxy.">}}
-   {{< reuse-image-dark srcDark="img/gateway-admin-interface.png" caption="Figure: Debugging interface of the gateway proxy.">}}
-   
-   Review the following table of common endpoints that can help troubleshoot your setup further.
-   | Endpoint | Description| 
-   | -- | -- | 
-   | config_dump | Get the configuration that is available in the Envoy proxy. Any kgateway resources that you create are translated in to Envoy configuration. Depending on whether or not you enabled resource validation, you might have applied invalid configuration that is rejected Envoy. You can also use `{{< reuse "agw-docs/snippets/cli-name.md" >}} proxy dump` to get the Envoy proxy configuration. | 
-   | listeners | See the listeners that are configured on your gateway. | 
-   | logging | Review the log level that is set for each component. |  
-   | stats/prometheus | View metrics that Envoy emitted and sent to the built-in Prometheus instance. |
+{{< conditional-text include-if="envoy" >}}
+```sh
+kubectl port-forward deploy/http -n {{< reuse "agw-docs/snippets/namespace.md" >}} 19000 &
+```
 
-   {{< /conditional-text >}}
+* [http://localhost:19000/](http://localhost:19000/)
 
-   {{< conditional-text include-if="kubernetes" >}}
-   ```sh
-   kubectl port-forward deploy/agentgateway-proxy -n {{< reuse "agw-docs/snippets/namespace.md" >}} 15000 &  
-   ```
+{{< reuse-image-light src="img/gateway-admin-interface.png" caption="Figure: Debugging interface of the gateway proxy.">}}
+{{< reuse-image-dark srcDark="img/gateway-admin-interface.png" caption="Figure: Debugging interface of the gateway proxy.">}}
 
-   Open your browser to the following endpoint.
+Review the following table of common endpoints that can help troubleshoot your setup further.
 
-   | Endpoint | Description| 
-   | -- | -- | 
-   | [http://localhost:15000/config_dump](http://localhost:15000/config_dump) | Get the configuration that is available in the agentgateway proxy. Any custom resources that you create are translated in to agentgateway configuration. Depending on whether or not you enabled resource validation, you might have applied invalid configuration that is rejected in agentgateway. | 
+| Endpoint | Description|
+| -- | -- |
+| config_dump | Get the configuration that is available in the Envoy proxy. Any kgateway resources that you create are translated in to Envoy configuration. Depending on whether or not you enabled resource validation, you might have applied invalid configuration that is rejected Envoy. You can also use `{{< reuse "agw-docs/snippets/cli-name.md" >}} proxy dump` to get the Envoy proxy configuration. |
+| listeners | See the listeners that are configured on your gateway. |
+| logging | Review the log level that is set for each component. |
+| stats/prometheus | View metrics that Envoy emitted and sent to the built-in Prometheus instance. |
+{{< /conditional-text >}}
 
+{{< conditional-text include-if="kubernetes" >}}
+```sh
+kubectl port-forward deploy/agentgateway-proxy -n {{< reuse "agw-docs/snippets/namespace.md" >}} 15000 &
+```
 
-   {{< /conditional-text >}}
-   
-   {{< conditional-text include-if="agentgateway" >}}
-   ```sh
-   kubectl port-forward deploy/agentgateway-proxy -n agentgateway-system 15000 &  
-   ```
+Open your browser to the following endpoint.
 
-   Open your browser to the following endpoints.
+| Endpoint | Description|
+| -- | -- |
+| [http://localhost:15000/config_dump](http://localhost:15000/config_dump) | Get the configuration that is available in the agentgateway proxy. Any custom resources that you create are translated in to agentgateway configuration. Depending on whether or not you enabled resource validation, you might have applied invalid configuration that is rejected in agentgateway. |
+{{< /conditional-text >}}
 
-   | Endpoint | Description| 
-   | -- | -- | 
-   | [http://localhost:15000/config_dump](http://localhost:15000/config_dump) | Get the configuration that is available in the agentgateway proxy. Any custom resources that you create are translated in to agentgateway configuration. Depending on whether or not you enabled resource validation, you might have applied invalid configuration that is rejected in agentgateway. | 
-   | [http://localhost:15000/ui](http://localhost:15000/ui) | A read-only user interface to review the agentgateway resources in your environment, such as listeners, routes, backends, and policies. | 
+{{< conditional-text include-if="agentgateway" >}}
+```sh
+kubectl port-forward deploy/agentgateway-proxy -n agentgateway-system 15000 &
+```
 
-   {{< reuse-image-light src="img/agw-ui-landing.png" caption="Figure: Read-only agentgateway UI.">}}
-   {{< reuse-image-dark srcDark="img/agw-ui-landing-dark.png" caption="Figure: Read-only agentgateway UI.">}}
+Open your browser to the following endpoints.
 
-   {{< callout type="info" >}}
-   In agentgateway 1.2 and later, you can skip the `kubectl port-forward` step and use the [`agctl`]({{< link-hextra path="/operations/agctl" >}}) CLI to inspect the proxy's configuration and trace requests directly. For example, run `agctl config all gateway/agentgateway-proxy -n agentgateway-system -o yaml` to render the loaded configuration, or `agctl trace gateway/agentgateway-proxy -n agentgateway-system --port 80 -- http://<host>/<path>` to capture a per-request trace.
-   {{< /callout >}}
+| Endpoint | Description|
+| -- | -- |
+| [http://localhost:15000/config_dump](http://localhost:15000/config_dump) | Get the configuration that is available in the agentgateway proxy. Any custom resources that you create are translated in to agentgateway configuration. Depending on whether or not you enabled resource validation, you might have applied invalid configuration that is rejected in agentgateway. |
+| [http://localhost:15000/ui](http://localhost:15000/ui) | A read-only user interface to review the agentgateway resources in your environment, such as listeners, routes, backends, and policies. |
 
-   {{< /conditional-text >}}
+{{< reuse-image-light src="img/agw-ui-landing.png" caption="Figure: Read-only agentgateway UI.">}}
+{{< reuse-image-dark srcDark="img/agw-ui-landing-dark.png" caption="Figure: Read-only agentgateway UI.">}}
+
+{{< callout type="info" >}}
+In agentgateway 1.2 and later, you can skip the `kubectl port-forward` step and use the [`agctl`]({{< link-hextra path="/operations/agctl" >}}) CLI to inspect the proxy's configuration and trace requests directly. For example, run `agctl config all gateway/agentgateway-proxy -n agentgateway-system -o yaml` to render the loaded configuration, or `agctl trace gateway/agentgateway-proxy -n agentgateway-system --port 80 -- http://<host>/<path>` to capture a per-request trace.
+{{< /callout >}}
+{{< /conditional-text >}}
 
 4. Review the logs for each component. Each component logs the sync loops that it runs, such as syncing with various environment signals like the Kubernetes API. {{< conditional-text include-if="envoy" >}}You can fetch the latest logs for all the components with the following command.
 
diff --git a/assets/agw-docs/snippets/namespace.md b/assets/agw-docs/snippets/namespace.md
index 34eea3c85..6b646f576 100644
--- a/assets/agw-docs/snippets/namespace.md
+++ b/assets/agw-docs/snippets/namespace.md
@@ -1 +1 @@
-agentgateway-system
+agentgateway-system
\ No newline at end of file
diff --git a/go.mod b/go.mod
index 8942dc60e..ccb76dcbf 100644
--- a/go.mod
+++ b/go.mod
@@ -2,4 +2,4 @@ module github.com/agentgateway/website
 
 go 1.21
 
-require github.com/solo-io/docs-theme-extras v0.1.20 // indirect
+require github.com/solo-io/docs-theme-extras v0.1.21-beta.8 // indirect
diff --git a/go.sum b/go.sum
index 3f8ec0b7c..55e0bfec0 100644
--- a/go.sum
+++ b/go.sum
@@ -1,2 +1,16 @@
 github.com/solo-io/docs-theme-extras v0.1.20 h1:TAZ392elyRJ/L4td15cJKED20x8aN8L3nu/I+bYmxg4=
 github.com/solo-io/docs-theme-extras v0.1.20/go.mod h1:jjjYu/QoD+vMu30zgcpfEuTEGuJOJWs5qai/K18kltg=
+github.com/solo-io/docs-theme-extras v0.1.21-beta.2 h1:5dJHQxKx/lOED/PS1m8oPTUjpbhJTur7L5FLQOeNX1o=
+github.com/solo-io/docs-theme-extras v0.1.21-beta.2/go.mod h1:jjjYu/QoD+vMu30zgcpfEuTEGuJOJWs5qai/K18kltg=
+github.com/solo-io/docs-theme-extras v0.1.21-beta.3 h1:36UTVkElsiyMvH/XpwLqxwB2iWKs/wdXvpPJmZwUNB4=
+github.com/solo-io/docs-theme-extras v0.1.21-beta.3/go.mod h1:jjjYu/QoD+vMu30zgcpfEuTEGuJOJWs5qai/K18kltg=
+github.com/solo-io/docs-theme-extras v0.1.21-beta.4 h1:KkDMd6Po76BHfT00Aoni3zYm5+tP9xlHcvOhqH0pbMc=
+github.com/solo-io/docs-theme-extras v0.1.21-beta.4/go.mod h1:jjjYu/QoD+vMu30zgcpfEuTEGuJOJWs5qai/K18kltg=
+github.com/solo-io/docs-theme-extras v0.1.21-beta.5 h1:ZevuUOeIK1qhLPFhlHspR46TD4JDXrbDYKf0pr8T1DQ=
+github.com/solo-io/docs-theme-extras v0.1.21-beta.5/go.mod h1:jjjYu/QoD+vMu30zgcpfEuTEGuJOJWs5qai/K18kltg=
+github.com/solo-io/docs-theme-extras v0.1.21-beta.6 h1:6RFWaP/FSs9wzYWBQDHGnCNtACik+6Ht02ew30jjwxc=
+github.com/solo-io/docs-theme-extras v0.1.21-beta.6/go.mod h1:jjjYu/QoD+vMu30zgcpfEuTEGuJOJWs5qai/K18kltg=
+github.com/solo-io/docs-theme-extras v0.1.21-beta.7 h1:1JKNUkJmNIXc0jGCfu88RA0wewUDzEvU/Iev02P51tg=
+github.com/solo-io/docs-theme-extras v0.1.21-beta.7/go.mod h1:jjjYu/QoD+vMu30zgcpfEuTEGuJOJWs5qai/K18kltg=
+github.com/solo-io/docs-theme-extras v0.1.21-beta.8 h1:peo/TdLBJyG4YEBwfoi8OLtoR0cf6E4VTdg8DcKkoDQ=
+github.com/solo-io/docs-theme-extras v0.1.21-beta.8/go.mod h1:jjjYu/QoD+vMu30zgcpfEuTEGuJOJWs5qai/K18kltg=