diff --git a/README.md b/README.md
index 2d0e344..8a285ce 100644
--- a/README.md
+++ b/README.md
@@ -148,8 +148,22 @@ Decide which mode fits your environment. `installAll.sh` will prompt you interac
 `installAll.sh` automatically:
 1. Creates `.env` files from `.env.setup` templates if they do not exist
 2. Prompts for Mode (A/B) and domain — or accepts them as CLI flags
-3. Injects the domain into the environment files
-4. Generates TLS certificates (Mode A: self-signed, Mode B: Let's Encrypt) and nginx config
+3. Asks whether to keep the default credentials still unchanged from `.env.setup` (see below)
+4. Injects the domain into the environment files
+5. Generates TLS certificates (Mode A: self-signed, Mode B: Let's Encrypt) and nginx config
+
+**Default credentials** — If any target key in `conf/docker/.env` still has its `.env.setup` default, `installAll.sh` asks `Keep all default values?`. Answering `n` prompts for each key (Enter keeps the default; passwords are hidden and confirmed). The default answer is `y` in dev mode and `n` in prod mode. Use `-c y|n` to skip the question; without a terminal, defaults are kept.
+
+Target keys are defined in `conf/docker/.env.setup` — no script change is needed to add or remove one:
+
+| Rule in `.env.setup` | Effect |
+|---|---|
+| Key name ends with `_PASSWORD` or `_PW` | Always a target |
+| `# @ask` on the line above a key | Adds the key (e.g. IDs, names) |
+| `# @noask` on the line above a key | Excludes the key, even a password |
+| `# @sync=<file>:<KEY>` on the line above a key | Also writes the new value to `<KEY>` in `<file>` (relative to `conf/docker`); for a `.yaml` file, `<KEY>` is a dotted path such as `services.mc-infra-manager.auth.password` |
+
+Keys with an empty default or a `${...}` reference are never targets. New values are written to `conf/docker/.env`, to `conf/docker/conf/mc-iam-manager/.env` when it has the same key, and to any `@sync` target. Databases that are already initialized keep their old credentials, so run `cleanAll.sh` before changing values on an existing setup.
 
 ```shell
 # Interactive mode — prompts for mode, domain, and run mode
@@ -166,6 +180,9 @@ Decide which mode fits your environment. `installAll.sh` will prompt you interac
 
 # Generate config files only, skip container start
 ./installAll.sh --mode dev --run skip
+
+# Skip the keep/change question and go straight to per-key credential prompts
+./installAll.sh --mode dev --run background --change-defaults y
 ```
 
 ## Step 4. Start the Platform
diff --git a/bin/installAll.sh b/bin/installAll.sh
index b6645c9..ff1beab 100755
--- a/bin/installAll.sh
+++ b/bin/installAll.sh
@@ -24,6 +24,9 @@ usage() {
     echo "                              log:        Run with real-time logs"
     echo "                              background: Run in background with status monitoring"
     echo "                              skip:       Configure only, do not start services"
+    echo "  -c, --change-defaults <y|n> Change default credentials still identical to .env.setup"
+    echo "                              y: prompt for each value   n: keep defaults (no prompt)"
+    echo "                              Omitted: ask interactively (dev: keep by default, prod: change by default)"
     echo "  -h, --help                  Display this help message"
     echo ""
     echo "Examples:"
@@ -31,6 +34,7 @@ usage() {
     echo "  $0 -m dev -d mciam.local -r background     # Scenario 1: Local PC, named domain, plain HTTP"
     echo "  $0 -m dev -d 1.2.3.4 -r background         # Scenario 2: Remote VM, public IP, self-signed HTTPS"
     echo "  $0 -m prod -d iam.example.com -r background # Scenario 3: Remote VM, domain, Let's Encrypt HTTPS"
+    echo "  $0 -m dev -r background -c n               # Keep default credentials without asking"
     echo "  $0                                         # Interactive mode"
     exit 1
 }
@@ -41,6 +45,7 @@ usage() {
 IAM_MODE=""
 IAM_DOMAIN=""
 RUN_MODE=""
+CHANGE_DEFAULTS=""
 
 while [[ $# -gt 0 ]]; do
     case $1 in
@@ -56,6 +61,10 @@ while [[ $# -gt 0 ]]; do
             RUN_MODE="$2"
             shift 2
             ;;
+        -c|--change-defaults)
+            CHANGE_DEFAULTS="$2"
+            shift 2
+            ;;
         -h|--help)
             usage
             ;;
@@ -77,6 +86,11 @@ if [ -n "$RUN_MODE" ] && [ "$RUN_MODE" != "log" ] && [ "$RUN_MODE" != "backgroun
     usage
 fi
 
+if [ -n "$CHANGE_DEFAULTS" ] && [ "$CHANGE_DEFAULTS" != "y" ] && [ "$CHANGE_DEFAULTS" != "n" ]; then
+    echo "Error: Invalid change-defaults value. Please use 'y' or 'n'."
+    usage
+fi
+
 # =============================================================================
 # Container List Definition (User Configurable)
 # =============================================================================
@@ -348,6 +362,261 @@ ensure_env_file "$PROJECT_ROOT_ABS/conf/mc-iam-manager/.env.setup"        "$PROJ
 sync_missing_env_vars "$PROJECT_ROOT_ABS/.env.setup"                      "$PROJECT_ROOT_ABS/.env"
 sync_missing_env_vars "$PROJECT_ROOT_ABS/conf/mc-iam-manager/.env.setup"  "$PROJECT_ROOT_ABS/conf/mc-iam-manager/.env"
 
+# =============================================================================
+# Default Credential Customization
+# =============================================================================
+# Which keys are offered is decided by .env.setup itself, not by this script:
+#   - keys named *_PASSWORD / *_PW are always offered
+#   - "# @ask" on the line(s) right above a key offers it too (name/id etc.)
+#   - "# @noask" right above a key excludes it (even a password)
+#   - "# @sync=<file under conf/docker>:<KEY>" right above a key copies its new
+#     value into that file's KEY as well (repeatable); for a .yaml/.yml file,
+#     KEY is a dotted path such as services.mc-infra-manager.auth.password
+# Annotations sit on their own comment line because the IAM preset scripts read
+# .env line by line and would keep an inline comment as part of the value.
+# Keys with an empty default or a ${...} reference are never offered.
+# Only keys whose .env value still equals the .env.setup default are offered.
+
+# Prints the value part of KEY=VALUE without a trailing " # comment".
+env_line_value() {
+    local value="${1#*=}"
+    value="${value%%[[:space:]]#*}"
+    value="${value%"${value##*[![:space:]]}"}"
+    printf '%s' "$value"
+}
+
+# Prints the current value of a key in an env file (empty if missing).
+read_env_value() {
+    local env_file="$1"
+    local key="$2"
+    local line
+    line=$(grep -m1 -E "^${key}=" "$env_file" 2>/dev/null) || return 0
+    env_line_value "$line"
+}
+
+# Replaces KEY's value in an env file, keeping any trailing " # comment".
+# No-op when the file or the key does not exist.
+set_env_value() {
+    local env_file="$1"
+    local key="$2"
+    local value="$3"
+    [ -f "$env_file" ] || return 0
+    grep -qE "^${key}=" "$env_file" || return 0
+
+    local tmpfile
+    tmpfile=$(mktemp)
+    awk -v key="$key" -v value="$value" '
+        index($0, key "=") == 1 {
+            rest = substr($0, length(key) + 2)
+            comment = ""
+            if (match(rest, /[ \t]+#/)) comment = substr(rest, RSTART)
+            print key "=" value comment
+            next
+        }
+        { print }
+    ' "$env_file" > "$tmpfile" && cat "$tmpfile" > "$env_file"
+    rm -f "$tmpfile"
+    echo "  ✓ ${key} updated in ${env_file##*/conf/docker/}"
+}
+
+# Replaces the scalar at a dotted path (e.g. services.mc-infra-manager.auth.password)
+# in a YAML file, single-quoted. No-op when the file or the path does not exist.
+set_yaml_value() {
+    local yaml_file="$1"
+    local path="$2"
+    local value="$3"
+    [ -f "$yaml_file" ] || return 0
+
+    local tmpfile
+    tmpfile=$(mktemp)
+    if awk -v path="$path" -v value="$value" '
+        BEGIN { depth = 0; done = 0 }
+        !done && match($0, /^ *[A-Za-z0-9_.-]+:/) {
+            keyend = RLENGTH
+            indent = match($0, /[^ ]/) - 1
+            key = substr($0, indent + 1, keyend - indent - 1)
+            while (depth > 0 && indents[depth] >= indent) depth--
+            depth++; indents[depth] = indent; keys[depth] = key
+            joined = keys[1]
+            for (i = 2; i <= depth; i++) joined = joined "." keys[i]
+            if (joined == path) {
+                printf "%" indent "s%s: '\''%s'\''\n", "", key, value
+                done = 1
+                next
+            }
+        }
+        { print }
+        END { exit done ? 0 : 1 }
+    ' "$yaml_file" > "$tmpfile"; then
+        cat "$tmpfile" > "$yaml_file"
+        echo "  ✓ ${path} updated in ${yaml_file##*/conf/docker/}"
+    fi
+    rm -f "$tmpfile"
+}
+
+CUSTOM_KEYS=()
+CUSTOM_DEFAULTS=()
+CUSTOM_SYNCS=()
+
+# Fills CUSTOM_KEYS / CUSTOM_DEFAULTS / CUSTOM_SYNCS from the annotated .env.setup.
+collect_customizable_keys() {
+    local setup_file="$1"
+    local env_file="$2"
+    local line key default ask noask syncs
+
+    ask=false; noask=false; syncs=""
+    while IFS= read -r line || [ -n "$line" ]; do
+        if [[ "$line" =~ ^[[:space:]]*#[[:space:]]*@noask ]]; then
+            noask=true; continue
+        elif [[ "$line" =~ ^[[:space:]]*#[[:space:]]*@ask ]]; then
+            ask=true; continue
+        elif [[ "$line" =~ ^[[:space:]]*#[[:space:]]*@sync=([^[:space:]]+) ]]; then
+            syncs="${syncs} ${BASH_REMATCH[1]}"; continue
+        elif [[ "$line" =~ ^[[:space:]]*# ]]; then
+            continue
+        elif [[ ! "$line" =~ ^([A-Z_][A-Z0-9_]*)= ]]; then
+            ask=false; noask=false; syncs=""
+            continue
+        fi
+
+        key="${BASH_REMATCH[1]}"
+        default=$(env_line_value "$line")
+        if ! $noask && [ -n "$default" ] && [[ "$default" != *'${'* ]] \
+            && { $ask || [[ "$key" =~ _(PASSWORD|PW)$ ]]; } \
+            && [ "$(read_env_value "$env_file" "$key")" = "$default" ]; then
+            CUSTOM_KEYS+=("$key")
+            CUSTOM_DEFAULTS+=("$default")
+            CUSTOM_SYNCS+=("$syncs")
+        fi
+        ask=false; noask=false; syncs=""
+    done < "$setup_file"
+}
+
+is_secret_key() {
+    [[ "$1" =~ _(PASSWORD|PW)$ ]]
+}
+
+# Characters that would break compose interpolation, sed/awk or comment parsing.
+is_valid_env_value() {
+    [ -n "$1" ] && [[ ! "$1" =~ [[:space:]\$\`\'\"\|#\\] ]]
+}
+
+# Reads a new value for one key into PROMPT_RESULT (empty = keep default).
+prompt_env_value() {
+    local key="$1"
+    local default="$2"
+    local value confirm
+
+    while true; do
+        if is_secret_key "$key"; then
+            read -rs -p "${key} [keep default]: " value; echo ""
+            if [ -n "$value" ]; then
+                read -rs -p "${key} (confirm): " confirm; echo ""
+                if [ "$value" != "$confirm" ]; then
+                    echo "  Values do not match. Try again."
+                    continue
+                fi
+            fi
+        else
+            read -r -p "${key} [${default}]: " value
+        fi
+
+        if [ -z "$value" ] || [ "$value" = "$default" ]; then
+            PROMPT_RESULT=""
+            return 0
+        fi
+        if is_valid_env_value "$value"; then
+            PROMPT_RESULT="$value"
+            return 0
+        fi
+        echo "  Not allowed: spaces and \$ \` ' \" | # \\. Try again."
+    done
+}
+
+customize_default_values() {
+    local setup_file="$PROJECT_ROOT_ABS/.env.setup"
+    local root_env="$PROJECT_ROOT_ABS/.env"
+    local iam_env="$PROJECT_ROOT_ABS/conf/mc-iam-manager/.env"
+
+    collect_customizable_keys "$setup_file" "$root_env"
+    [ ${#CUSTOM_KEYS[@]} -eq 0 ] && return 0
+
+    echo ""
+    echo "=========================================="
+    echo "Default Values"
+    echo "=========================================="
+    echo "These keys still use the defaults from .env.setup:"
+    local key
+    for key in "${CUSTOM_KEYS[@]}"; do
+        echo "  - $key"
+    done
+
+    local default_answer="y"
+    if [ "$IAM_MODE" = "prod" ]; then
+        default_answer="n"
+        echo ""
+        echo "⚠️  Production mode: default passwords are public. Changing them is strongly recommended."
+    fi
+    if [ -d "$PROJECT_ROOT_ABS/container-volume" ] \
+        && [ -n "$(ls -A "$PROJECT_ROOT_ABS/container-volume" 2>/dev/null)" ]; then
+        echo ""
+        echo "⚠️  container-volume already has data. New values do not apply to databases that are"
+        echo "   already initialized — run ./cleanAll.sh first if you change them."
+    fi
+
+    local keep
+    if [ "$CHANGE_DEFAULTS" = "y" ]; then
+        keep="n"
+    elif [ "$CHANGE_DEFAULTS" = "n" ]; then
+        keep="y"
+    elif [ ! -t 0 ]; then
+        keep="y"
+        echo "Non-interactive input — keeping default values (use -c y to change them)."
+    else
+        local hint="Y/n"
+        [ "$default_answer" = "n" ] && hint="y/N"
+        while true; do
+            echo ""
+            read -r -p "Keep all default values? (${hint}): " keep
+            keep="${keep:-$default_answer}"
+            case "$keep" in
+                y|Y) keep="y"; break ;;
+                n|N) keep="n"; break ;;
+                *) echo "Please enter y or n." ;;
+            esac
+        done
+    fi
+
+    if [ "$keep" = "y" ]; then
+        echo "✓ Keeping default values."
+        return 0
+    fi
+
+    echo ""
+    echo "Enter a new value for each key (press Enter to keep the default)."
+    local i sync file target changed=0
+    for i in "${!CUSTOM_KEYS[@]}"; do
+        key="${CUSTOM_KEYS[$i]}"
+        prompt_env_value "$key" "${CUSTOM_DEFAULTS[$i]}"
+        [ -z "$PROMPT_RESULT" ] && continue
+
+        set_env_value "$root_env" "$key" "$PROMPT_RESULT"
+        set_env_value "$iam_env"  "$key" "$PROMPT_RESULT"
+        for sync in ${CUSTOM_SYNCS[$i]}; do
+            file="${sync%%:*}"
+            target="${sync#*:}"
+            case "$file" in
+                *.yaml|*.yml) set_yaml_value "$PROJECT_ROOT_ABS/$file" "$target" "$PROMPT_RESULT" ;;
+                *)            set_env_value  "$PROJECT_ROOT_ABS/$file" "$target" "$PROMPT_RESULT" ;;
+            esac
+        done
+        changed=$((changed + 1))
+    done
+    echo "✓ ${changed} value(s) changed."
+}
+
+customize_default_values
+
 # =============================================================================
 # Domain Configuration
 # =============================================================================
diff --git a/conf/api.yaml b/conf/api.yaml
index d12c18a..4301a28 100644
--- a/conf/api.yaml
+++ b/conf/api.yaml
@@ -25,7 +25,7 @@ services:
       password: spider
 
   mc-web-console:
-    version: 0.7.2
+    version: 0.7.3
     baseurl: http://mc-web-console:3000
     auth:
       type: bearer
diff --git a/conf/docker/.env.setup b/conf/docker/.env.setup
index 80ebfac..26c2aab 100644
--- a/conf/docker/.env.setup
+++ b/conf/docker/.env.setup
@@ -1,3 +1,9 @@
+# installAll.sh asks whether to change values still equal to these defaults:
+#   *_PASSWORD / *_PW keys always; other keys only with "# @ask" on the line above.
+#   "# @noask" above a key excludes it; "# @sync=<file>:<KEY>" also writes the new
+#   value into another file (path relative to conf/docker; for .yaml use a dotted
+#   path as KEY, e.g. services.mc-infra-manager.auth.password). Keep annotations
+#   on their own line — never inline after a value.
 # Common Use case
 HEALTH_CHECK_INTERVAL=1m
 HEALTH_CHECK_TIMEOUT=5s
@@ -90,10 +96,14 @@ MC_WEB_CONSOLE_MENUYAML=asset/menu/webconsole_menu_resources.yaml
 MC_WEB_CONSOLE_MENU_PERMISSIONS=asset/menu/permission.yaml
 
 
+# @ask
 MC_IAM_MANAGER_PLATFORMADMIN_ID=mcmp
 MC_IAM_MANAGER_PLATFORMADMIN_PASSWORD=mcmp_password
+# @ask
 MC_IAM_MANAGER_PLATFORMADMIN_FIRSTNAME=mcmp
+# @ask
 MC_IAM_MANAGER_PLATFORMADMIN_LASTNAME=iammanager
+# @ask
 MC_IAM_MANAGER_PLATFORMADMIN_EMAIL=iammanager@cloud-barista.org
 
 MC_IAM_MANAGER_PREDEFINED_ROLE=admin,operator,viewer,billadmin,billviewer
@@ -109,9 +119,11 @@ MC_IAM_MANAGER_KEYCLOAK_OIDC_CLIENT_SECRET=mciamOidcClientSecret
  
 
 ## docker postgres setup
+# @ask
 MC_IAM_MANAGER_DATABASE_USER=mciamdbadmin
 MC_IAM_MANAGER_DATABASE_PASSWORD=mciamdbpassword
 MC_IAM_MANAGER_DATABASE_HOST=mc-iam-manager-db
+# @ask
 MC_IAM_MANAGER_DATABASE_NAME=mc_iam_manager_db
 MC_IAM_MANAGER_DATABASE_PORT=5432
 MC_IAM_MANAGER_DATABASE_RECREATE=false
@@ -128,6 +140,7 @@ MC_IAM_MANAGER_KEYCLOAK_HOST=http://${MC_IAM_MANAGER_KEYCLOAK_DOMAIN}:${MC_IAM_M
 MC_IAM_MANAGER_KEYCLOAK_DATABASE_NAME=mc_iam_keycloak_db
 MC_IAM_MANAGER_KEYCLOAK_REALM=mciam
 MC_IAM_MANAGER_KEYCLOAK_CLIENT_PATH=${MC_IAM_MANAGER_KEYCLOAK_DOMAIN}/realms/${MC_IAM_MANAGER_KEYCLOAK_REALM}
+# @ask
 MC_IAM_MANAGER_KEYCLOAK_ADMIN=admin
 MC_IAM_MANAGER_KEYCLOAK_ADMIN_PASSWORD=admin_password
 
@@ -138,22 +151,31 @@ MC_INFRA_CONNECTOR_REST_URL=http://mc-infra-connector:1024/spider
 MC_INFRA_CONNECTOR_URL=mc-infra-connector
 MC_INFRA_CONNECTOR_API_USERNAME=default
 MC_INFRA_CONNECTOR_API_PASSWORD=default
+# @ask
 MC_INFRA_CONNECTOR_POSTGRES_USER=spider
 MC_INFRA_CONNECTOR_POSTGRES_PASSWORD=spider
+# @ask
 MC_INFRA_CONNECTOR_POSTGRES_DB=spider
 
 ## mc-infra-manager
+# mc-web-console reads these credentials only from its own api.yaml
+# @sync=conf/mc-web-console/api/conf/api.yaml:services.mc-infra-manager.auth.username
 MC_INFRA_MANAGER_API_USERNAME=default
+# mc-web-console reads these credentials only from its own api.yaml
+# @sync=conf/mc-web-console/api/conf/api.yaml:services.mc-infra-manager.auth.password
 MC_INFRA_MANAGER_API_PASSWORD=default
 MC_INFRA_MANAGER_OPENBAO_VAULT_TOKEN=dev-only-token
 MC_INFRA_MANAGER_TERRARIUM_API_USERNAME=
 MC_INFRA_MANAGER_TERRARIUM_API_PASSWORD=
+# @ask
 MC_INFRA_MANAGER_POSTGRES_USER=tumblebug
 MC_INFRA_MANAGER_POSTGRES_PASSWORD=tumblebug
+# @ask
 MC_INFRA_MANAGER_POSTGRES_DB=tumblebug
 MC_INFRA_MANAGER_TUMBLEBUG_URL=http://mc-infra-manager:1323/tumblebug
 
 ## Default Workspace
+# @ask
 MC_IAM_MANAGER_DEFAULT_WORKSPACE_NAME=ws01
 
 MC_IAM_MANAGER_AWS_STS_ENDPOINT=https://sts.amazonaws.com
@@ -275,10 +297,12 @@ MC_COST_OPTIMIZER_LLM_KEY_MASTER=
 #Tumblebug
 MC_COST_OPTIMIZER_TBB_URL=http://mc-infra-manager:1323/tumblebug
 MC_COST_OPTIMIZER_TBB_USERNAME=default
-MC_COST_OPTIMIZER_TBB_PW=default
+MC_COST_OPTIMIZER_TBB_PW=${MC_INFRA_MANAGER_API_PASSWORD}
 
 # MC-APPLICATION-MANAGER
+# @ask
 MC_APPLICATION_MANAGER_POSTGRES_DB=appmgr
+# @ask
 MC_APPLICATION_MANAGER_POSTGRES_USER=application
 MC_APPLICATION_MANAGER_POSTGRES_PASSWORD=application!23
 MC_APPLICATION_MANAGER_NEXUS_INITIAL_PASSWORD=123456
@@ -288,12 +312,18 @@ MC_WORKFLOW_MANAGER_JENKINS_USERNAME=admin
 MC_WORKFLOW_MANAGER_JENKINS_PASSWORD=123456
 
 # MC-WORKFLOW-MANAGER
+# @ask
 MC_WORKFLOW_MANAGER_DB_ID=workflow
 MC_WORKFLOW_MANAGER_DB_PW=workflow!23
 
 # MC-DATA-MANAGER
+# @ask
+# @sync=conf/mc-data-manager/.env:MC_DATA_MANAGER_DATABASE_NAME
 MC_DATA_MANAGER_MYSQL_DATABASE=mcmp
+# @ask
+# @sync=conf/mc-data-manager/.env:MC_DATA_MANAGER_DATABASE_USER
 MC_DATA_MANAGER_MYSQL_USER=mcmp
+# @sync=conf/mc-data-manager/.env:MC_DATA_MANAGER_DATABASE_PASSWORD
 MC_DATA_MANAGER_MYSQL_PASSWORD=mcmp
 MC_DATA_MANAGER_MYSQL_ROOT_PASSWORD=mcmp
 # Host uid/gid used to chown the data-manager volume at init.
@@ -305,11 +335,15 @@ MC_DATA_MANAGER_GID=0
 # MC-OBSERVABILITY
 MC_OBSERVABILITY_MARIADB_ROOT_PASSWORD=qwe1212!Q
 MC_OBSERVABILITY_MARIADB_USER=mc-agent
+# Also hardcoded in docker-compose.yaml (airflow mcmp_db connection) — keep in sync manually
+# @noask
 MC_OBSERVABILITY_MARIADB_PASSWORD=mc-agent
 MC_OBSERVABILITY_MARIADB_DATABASE=mc_observability
 
 MC_OBSERVABILITY_INFLUXDB_HTTP_AUTH_ENABLED=true
 MC_OBSERVABILITY_INFLUXDB_ADMIN_USER=mc-agent
+# Also hardcoded in conf/mc-observability/grafana/provisioning — keep in sync manually
+# @noask
 MC_OBSERVABILITY_INFLUXDB_ADMIN_PASSWORD=mc-agent
 MC_OBSERVABILITY_INFLUXDB_DB=mc-observability
 
@@ -331,7 +365,9 @@ MC_OBSERVABILITY_OLLAMA_BASE_URL=http://210.207.104.224:11434
 MC_OBSERVABILITY_LLM_CREDENTIAL_KEY=
 
 # MC-WEB-CONSOLE
+# @ask
 MC_WEB_CONSOLE_POSTGRES_DB=mcwebconsoledbdev
+# @ask
 MC_WEB_CONSOLE_POSTGRES_USER=mcwebadmin
 MC_WEB_CONSOLE_POSTGRES_PASSWORD=mcwebadminpassword!
 MC_WEB_CONSOLE_POSTGRES_HOST=mc-web-console-db
diff --git a/conf/docker/api.yaml b/conf/docker/api.yaml
index d12c18a..4301a28 100644
--- a/conf/docker/api.yaml
+++ b/conf/docker/api.yaml
@@ -25,7 +25,7 @@ services:
       password: spider
 
   mc-web-console:
-    version: 0.7.2
+    version: 0.7.3
     baseurl: http://mc-web-console:3000
     auth:
       type: bearer
diff --git a/conf/docker/conf/mc-iam-manager/.env.setup b/conf/docker/conf/mc-iam-manager/.env.setup
index 89cfdbc..987ae18 100644
--- a/conf/docker/conf/mc-iam-manager/.env.setup
+++ b/conf/docker/conf/mc-iam-manager/.env.setup
@@ -55,7 +55,7 @@ MC_IAM_MANAGER_DATABASE_NAME=mc_iam_manager_db
 MC_IAM_MANAGER_DATABASE_PORT=5432
 MC_IAM_MANAGER_DATABASE_RECREATE=false
 MC_IAM_MANAGER_DATABASE_SSLMODE=disable
-MC_IAM_MANAGER_DATABASE_URL=postgres://mciamdbadmin:mciamdbpassword@mc-iam-manager-db:5432/mc_iam_manager_db?sslmode=disable
+MC_IAM_MANAGER_DATABASE_URL=postgres://${MC_IAM_MANAGER_DATABASE_USER}:${MC_IAM_MANAGER_DATABASE_PASSWORD}@${MC_IAM_MANAGER_DATABASE_HOST}:${MC_IAM_MANAGER_DATABASE_PORT}/${MC_IAM_MANAGER_DATABASE_NAME}?sslmode=disable
 
 # Keycloak server
 MC_IAM_MANAGER_KEYCLOAK_DOMAIN=mc-iam-manager-kc
diff --git a/conf/docker/conf/mc-web-console/api/conf/api.yaml b/conf/docker/conf/mc-web-console/api/conf/api.yaml
index fe169b9..32bece1 100644
--- a/conf/docker/conf/mc-web-console/api/conf/api.yaml
+++ b/conf/docker/conf/mc-web-console/api/conf/api.yaml
@@ -25,7 +25,7 @@ services:
       password: default
 
   mc-web-console:
-    version: 0.7.2
+    version: 0.7.3
     baseurl: http://mc-web-console-api:3000
     auth:
       type: bearer
@@ -1174,6 +1174,10 @@ serviceActions:
       method: get
       resourcePath: /api/groups/id/{groupId}/platform-roles
       description: 그룹의 Platform Role 목록 조회
+    getUserEffectivePlatformRoles:
+      method: get
+      resourcePath: /api/users/id/{userId}/effective-platform-roles
+      description: 사용자 유효 Platform Role 목록 (직접 + 그룹 상속, source=direct|group:<name>)
     getCompany:
       method: get
       resourcePath: /api/company
diff --git a/conf/docker/docker-compose.mini.yaml b/conf/docker/docker-compose.mini.yaml
index 70cca6f..d60eead 100644
--- a/conf/docker/docker-compose.mini.yaml
+++ b/conf/docker/docker-compose.mini.yaml
@@ -389,7 +389,7 @@ services:
             exec docker-entrypoint.sh postgres"
 
   mc-web-console-api:
-    image: cloudbaristaorg/mc-web-console-api:0.7.2
+    image: cloudbaristaorg/mc-web-console-api:0.7.3
     pull_policy: always
     container_name: mc-web-console-api
     platform: linux/amd64
@@ -438,7 +438,7 @@ services:
       <<: *default-health-check
 
   mc-web-console-front:
-    image: cloudbaristaorg/mc-web-console-front:0.7.2
+    image: cloudbaristaorg/mc-web-console-front:0.7.3
     pull_policy: always
     container_name: mc-web-console-front
     platform: linux/amd64
diff --git a/conf/docker/docker-compose.yaml b/conf/docker/docker-compose.yaml
index 5179d81..fd9e4b1 100644
--- a/conf/docker/docker-compose.yaml
+++ b/conf/docker/docker-compose.yaml
@@ -1187,7 +1187,7 @@ services:
             exec docker-entrypoint.sh postgres"
 
   mc-web-console-api:
-    image: cloudbaristaorg/mc-web-console-api:0.7.2
+    image: cloudbaristaorg/mc-web-console-api:0.7.3
     pull_policy: always
     container_name: mc-web-console-api
     platform: linux/amd64
@@ -1231,7 +1231,7 @@ services:
       <<: *default-health-check
 
   mc-web-console-front:
-    image: cloudbaristaorg/mc-web-console-front:0.7.2
+    image: cloudbaristaorg/mc-web-console-front:0.7.3
     pull_policy: always
     container_name: mc-web-console-front
     platform: linux/amd64