diff --git a/mise.lock b/mise.lock
new file mode 100644
index 0000000..4c0f76f
--- /dev/null
+++ b/mise.lock
@@ -0,0 +1,203 @@
+# @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html
+
+lockfile_version = 1
+
+[[tools.act]]
+version = "0.2.89"
+backend = "aqua:nektos/act"
+specifiers = ["latest"]
+
+[tools.act."platforms.linux-arm64"]
+checksum = "sha256:daa8679ba9615a74d2d0cec321dc593f21948a2a11bb65862b063d8b930f4bcb"
+url = "https://github.com/nektos/act/releases/download/v0.2.89/act_Linux_arm64.tar.gz"
+url_api = "https://api.github.com/repos/nektos/act/releases/assets/434891274"
+
+[tools.act."platforms.linux-arm64-musl"]
+checksum = "sha256:daa8679ba9615a74d2d0cec321dc593f21948a2a11bb65862b063d8b930f4bcb"
+url = "https://github.com/nektos/act/releases/download/v0.2.89/act_Linux_arm64.tar.gz"
+url_api = "https://api.github.com/repos/nektos/act/releases/assets/434891274"
+
+[tools.act."platforms.linux-x64"]
+checksum = "sha256:0191d6f1f3b716b5c55820032605d05fc3c1cdbf581ebeff655019e5dd1524c0"
+url = "https://github.com/nektos/act/releases/download/v0.2.89/act_Linux_x86_64.tar.gz"
+url_api = "https://api.github.com/repos/nektos/act/releases/assets/434891246"
+
+[tools.act."platforms.linux-x64-musl"]
+checksum = "sha256:0191d6f1f3b716b5c55820032605d05fc3c1cdbf581ebeff655019e5dd1524c0"
+url = "https://github.com/nektos/act/releases/download/v0.2.89/act_Linux_x86_64.tar.gz"
+url_api = "https://api.github.com/repos/nektos/act/releases/assets/434891246"
+
+[tools.act."platforms.macos-arm64"]
+checksum = "sha256:48ae218af96725f7635a66de2b87e1e346893b02add0f16b92f560296b2151fc"
+url = "https://github.com/nektos/act/releases/download/v0.2.89/act_Darwin_arm64.tar.gz"
+url_api = "https://api.github.com/repos/nektos/act/releases/assets/434891257"
+
+[tools.act."platforms.macos-x64"]
+checksum = "sha256:41b31488e7c254baec31cce12c7dade3e35973b8a31b9486206ad43f233d814e"
+url = "https://github.com/nektos/act/releases/download/v0.2.89/act_Darwin_x86_64.tar.gz"
+url_api = "https://api.github.com/repos/nektos/act/releases/assets/434891248"
+
+[tools.act."platforms.windows-x64"]
+checksum = "sha256:0f8cf866ad7e32421a219fc551a0a0ea5d12ead464de12ebfeafd334a5973b50"
+url = "https://github.com/nektos/act/releases/download/v0.2.89/act_Windows_x86_64.zip"
+url_api = "https://api.github.com/repos/nektos/act/releases/assets/434891261"
+
+[[tools.docker-cli]]
+version = "29.8.0"
+backend = "aqua:docker/cli"
+specifiers = ["latest"]
+
+[tools.docker-cli."platforms.linux-arm64"]
+url = "https://download.docker.com/linux/static/stable/aarch64/docker-29.8.0.tgz"
+
+[tools.docker-cli."platforms.linux-arm64-musl"]
+url = "https://download.docker.com/linux/static/stable/aarch64/docker-29.8.0.tgz"
+
+[tools.docker-cli."platforms.linux-x64"]
+url = "https://download.docker.com/linux/static/stable/x86_64/docker-29.8.0.tgz"
+
+[tools.docker-cli."platforms.linux-x64-musl"]
+url = "https://download.docker.com/linux/static/stable/x86_64/docker-29.8.0.tgz"
+
+[tools.docker-cli."platforms.macos-arm64"]
+url = "https://download.docker.com/mac/static/stable/aarch64/docker-29.8.0.tgz"
+
+[tools.docker-cli."platforms.macos-x64"]
+url = "https://download.docker.com/mac/static/stable/x86_64/docker-29.8.0.tgz"
+
+[tools.docker-cli."platforms.windows-x64"]
+url = "https://download.docker.com/win/static/stable/x86_64/docker-29.8.0.zip"
+
+[[tools.jq]]
+version = "1.8.2"
+backend = "aqua:jqlang/jq"
+specifiers = ["latest"]
+
+[tools.jq."platforms.linux-arm64"]
+checksum = "sha256:8b85c817833814ddca00a144c33705546355afccf0cf39b188f3cdb48b852309"
+url = "https://github.com/jqlang/jq/releases/download/jq-1.8.2/jq-linux-arm64"
+url_api = "https://api.github.com/repos/jqlang/jq/releases/assets/453012756"
+provenance = "github-attestations"
+
+[tools.jq."platforms.linux-arm64-musl"]
+checksum = "sha256:8b85c817833814ddca00a144c33705546355afccf0cf39b188f3cdb48b852309"
+url = "https://github.com/jqlang/jq/releases/download/jq-1.8.2/jq-linux-arm64"
+url_api = "https://api.github.com/repos/jqlang/jq/releases/assets/453012756"
+provenance = "github-attestations"
+
+[tools.jq."platforms.linux-x64"]
+checksum = "sha256:b1c22172dd303f3be49e935aa56aa48a8b7a46e0bc838b4997d3bb451495870f"
+url = "https://github.com/jqlang/jq/releases/download/jq-1.8.2/jq-linux-amd64"
+url_api = "https://api.github.com/repos/jqlang/jq/releases/assets/453012752"
+provenance = "github-attestations"
+
+[tools.jq."platforms.linux-x64-musl"]
+checksum = "sha256:b1c22172dd303f3be49e935aa56aa48a8b7a46e0bc838b4997d3bb451495870f"
+url = "https://github.com/jqlang/jq/releases/download/jq-1.8.2/jq-linux-amd64"
+url_api = "https://api.github.com/repos/jqlang/jq/releases/assets/453012752"
+provenance = "github-attestations"
+
+[tools.jq."platforms.macos-arm64"]
+checksum = "sha256:2d75340ba57a4b4b4c8708a21c2dc8e958a48aaa8bba13b27f77f6e4c0eca07e"
+url = "https://github.com/jqlang/jq/releases/download/jq-1.8.2/jq-macos-arm64"
+url_api = "https://api.github.com/repos/jqlang/jq/releases/assets/453012783"
+provenance = "github-attestations"
+
+[tools.jq."platforms.macos-x64"]
+checksum = "sha256:e94b266e3c26690550006abe63152b782280f4e14374accdf04cbde844f00bc0"
+url = "https://github.com/jqlang/jq/releases/download/jq-1.8.2/jq-macos-amd64"
+url_api = "https://api.github.com/repos/jqlang/jq/releases/assets/453012782"
+provenance = "github-attestations"
+
+[tools.jq."platforms.windows-x64"]
+checksum = "sha256:a6fc67fedaf9128a3309a1e2ebb8b986aeccf70122ee46d2cb4849e423f0c627"
+url = "https://github.com/jqlang/jq/releases/download/jq-1.8.2/jq-windows-amd64.exe"
+url_api = "https://api.github.com/repos/jqlang/jq/releases/assets/453012788"
+provenance = "github-attestations"
+
+[[tools.shellcheck]]
+version = "0.11.0"
+backend = "aqua:koalaman/shellcheck"
+specifiers = ["latest"]
+
+[tools.shellcheck."platforms.linux-arm64"]
+checksum = "sha256:12b331c1d2db6b9eb13cfca64306b1b157a86eb69db83023e261eaa7e7c14588"
+url = "https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellcheck-v0.11.0.linux.aarch64.tar.xz"
+url_api = "https://api.github.com/repos/koalaman/shellcheck/releases/assets/279056934"
+
+[tools.shellcheck."platforms.linux-arm64-musl"]
+checksum = "sha256:12b331c1d2db6b9eb13cfca64306b1b157a86eb69db83023e261eaa7e7c14588"
+url = "https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellcheck-v0.11.0.linux.aarch64.tar.xz"
+url_api = "https://api.github.com/repos/koalaman/shellcheck/releases/assets/279056934"
+
+[tools.shellcheck."platforms.linux-x64"]
+checksum = "sha256:8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198"
+url = "https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellcheck-v0.11.0.linux.x86_64.tar.xz"
+url_api = "https://api.github.com/repos/koalaman/shellcheck/releases/assets/279056942"
+
+[tools.shellcheck."platforms.linux-x64-musl"]
+checksum = "sha256:8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198"
+url = "https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellcheck-v0.11.0.linux.x86_64.tar.xz"
+url_api = "https://api.github.com/repos/koalaman/shellcheck/releases/assets/279056942"
+
+[tools.shellcheck."platforms.macos-arm64"]
+checksum = "sha256:56affdd8de5527894dca6dc3d7e0a99a873b0f004d7aabc30ae407d3f48b0a79"
+url = "https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellcheck-v0.11.0.darwin.aarch64.tar.xz"
+url_api = "https://api.github.com/repos/koalaman/shellcheck/releases/assets/279056932"
+
+[tools.shellcheck."platforms.macos-x64"]
+checksum = "sha256:3c89db4edcab7cf1c27bff178882e0f6f27f7afdf54e859fa041fca10febe4c6"
+url = "https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellcheck-v0.11.0.darwin.x86_64.tar.xz"
+url_api = "https://api.github.com/repos/koalaman/shellcheck/releases/assets/279056930"
+
+[tools.shellcheck."platforms.windows-x64"]
+checksum = "sha256:8a4e35ab0b331c85d73567b12f2a444df187f483e5079ceffa6bda1faa2e740e"
+url = "https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellcheck-v0.11.0.zip"
+url_api = "https://api.github.com/repos/koalaman/shellcheck/releases/assets/279056944"
+
+[[tools.trivy]]
+version = "0.74.0"
+backend = "aqua:aquasecurity/trivy"
+specifiers = ["latest"]
+
+[tools.trivy."platforms.linux-arm64"]
+checksum = "sha256:b94ce1976bbf3c15b514b605ee88be7c6d94a29be2302847ff01cb794d47aad5"
+url = "https://github.com/aquasecurity/trivy/releases/download/v0.74.0/trivy_0.74.0_Linux-ARM64.tar.gz"
+url_api = "https://api.github.com/repos/aquasecurity/trivy/releases/assets/514339429"
+provenance = "cosign"
+
+[tools.trivy."platforms.linux-arm64-musl"]
+checksum = "sha256:b94ce1976bbf3c15b514b605ee88be7c6d94a29be2302847ff01cb794d47aad5"
+url = "https://github.com/aquasecurity/trivy/releases/download/v0.74.0/trivy_0.74.0_Linux-ARM64.tar.gz"
+url_api = "https://api.github.com/repos/aquasecurity/trivy/releases/assets/514339429"
+provenance = "cosign"
+
+[tools.trivy."platforms.linux-x64"]
+checksum = "sha256:2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a"
+url = "https://github.com/aquasecurity/trivy/releases/download/v0.74.0/trivy_0.74.0_Linux-64bit.tar.gz"
+url_api = "https://api.github.com/repos/aquasecurity/trivy/releases/assets/514339431"
+provenance = "cosign"
+
+[tools.trivy."platforms.linux-x64-musl"]
+checksum = "sha256:2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a"
+url = "https://github.com/aquasecurity/trivy/releases/download/v0.74.0/trivy_0.74.0_Linux-64bit.tar.gz"
+url_api = "https://api.github.com/repos/aquasecurity/trivy/releases/assets/514339431"
+provenance = "cosign"
+
+[tools.trivy."platforms.macos-arm64"]
+checksum = "sha256:1caada5e0e2091909357c7525d3aa76f4b660b13821bc143b190c7483e31cc11"
+url = "https://github.com/aquasecurity/trivy/releases/download/v0.74.0/trivy_0.74.0_macOS-ARM64.tar.gz"
+url_api = "https://api.github.com/repos/aquasecurity/trivy/releases/assets/514339464"
+provenance = "cosign"
+
+[tools.trivy."platforms.macos-x64"]
+checksum = "sha256:472816f6888dda689d075c30254d4210b4d1035acf365aa72332f584c2f60485"
+url = "https://github.com/aquasecurity/trivy/releases/download/v0.74.0/trivy_0.74.0_macOS-64bit.tar.gz"
+url_api = "https://api.github.com/repos/aquasecurity/trivy/releases/assets/514339388"
+provenance = "cosign"
+
+[tools.trivy."platforms.windows-x64"]
+checksum = "sha256:94c40e0696e4b907a74b7b2e1438d5d72ebaca83115817407f568a002d520842"
+url = "https://github.com/aquasecurity/trivy/releases/download/v0.74.0/trivy_0.74.0_windows-64bit.zip"
+url_api = "https://api.github.com/repos/aquasecurity/trivy/releases/assets/514339469"
+provenance = "cosign"
diff --git a/packaging/alpine/local/seaweedfs/APKBUILD b/packaging/alpine/local/seaweedfs/APKBUILD
index a96a566..f638dbd 100644
--- a/packaging/alpine/local/seaweedfs/APKBUILD
+++ b/packaging/alpine/local/seaweedfs/APKBUILD
@@ -1,12 +1,13 @@
 # Maintainer: Joachim Schlöffel <joachim.schloeffel@financial-service-plus.de>
 pkgname=seaweedfs
-pkgver=4.44
+pkgver=4.45
 pkgrel=0
 pkgdesc="Distributed storage system for object storage, file systems, and Iceberg tables"
 url="https://github.com/seaweedfs/seaweedfs"
 arch="x86_64 aarch64"
 license="Apache-2.0"
 depends="ca-certificates /bin/sh"
+makedepends="build-base cargo rust protobuf-dev"
 provides="!$pkgname-openrc cmd:weed=$pkgver-r$pkgrel"
 install="$pkgname.pre-install"
 subpackages="
@@ -20,6 +21,8 @@ subpackages="
 	$pkgname-volume-openrc:_openrc_volume:noarch
 	$pkgname-webdav-openrc:_openrc_webdav:noarch
 	$pkgname-worker-openrc:_openrc_worker:noarch
+	$pkgname-worker-lance:_worker_lance
+	$pkgname-worker-lance-openrc:_openrc_worker_lance:noarch
 	"
 options="!check !strip !tracedeps"
 
@@ -35,6 +38,9 @@ esac
 source="
 	$pkgname-$pkgver-linux-amd64.tar.gz::https://github.com/seaweedfs/seaweedfs/releases/download/$pkgver/linux_amd64.tar.gz
 	$pkgname-$pkgver-linux-arm64.tar.gz::https://github.com/seaweedfs/seaweedfs/releases/download/$pkgver/linux_arm64.tar.gz
+	$pkgname-$pkgver-src.tar.gz::https://github.com/seaweedfs/seaweedfs/archive/refs/tags/$pkgver.tar.gz
+	admin.toml
+	example-admin.toml
 	credential.toml
 	example-credential.toml
 	example-filer.toml
@@ -58,20 +64,30 @@ source="
 	seaweedfs.volume.confd
 	seaweedfs.webdav.confd
 	seaweedfs.worker.confd
+	seaweedfs.worker-lance.confd
 	weed.bash-completion
 	"
 
 builddir="$srcdir"
+_worker_builddir="$builddir/$pkgname-$pkgver/seaweed-worker"
 
 prepare() {
 	default_prepare
 	tar -xzf "$srcdir/$_archive" -C "$builddir"
+	tar -xzf "$srcdir/$pkgname-$pkgver-src.tar.gz" -C "$builddir"
+}
+
+build() {
+	cd "$_worker_builddir"
+	cargo build --locked --release -p weed-lance-worker
 }
 
 package() {
 	install -Dm755 "$srcdir"/weed "$pkgdir"/usr/bin/weed
+	install -Dm755 "${CARGO_TARGET_DIR:-$_worker_builddir/target}/release/weed-worker" \
+		"$pkgdir"/usr/bin/weed-worker
 	local _config
-	for _config in credential filer master notification replication security shell; do
+	for _config in admin credential filer master notification replication security shell; do
 		install -Dm644 "$srcdir"/$_config.toml \
 			"$pkgdir"/etc/seaweedfs/$_config.toml
 		install -Dm644 "$srcdir"/example-$_config.toml \
@@ -99,6 +115,18 @@ _openrc_volume() { _openrc_service volume; }
 _openrc_webdav() { _openrc_service webdav; }
 _openrc_worker() { _openrc_service worker; }
 
+_worker_lance() {
+	pkgdesc="SeaweedFS Lance table maintenance worker"
+	depends="$pkgname=$pkgver-r$pkgrel libgcc"
+
+	amove usr/bin/weed-worker
+}
+
+_openrc_worker_lance() {
+	_openrc_service worker-lance
+	depends="$pkgname-worker-lance=$pkgver-r$pkgrel $depends"
+}
+
 _bashcomp() {
 	pkgdesc="Bash completions for $pkgname"
 	depends=""
@@ -109,15 +137,18 @@ _bashcomp() {
 }
 
 sha512sums="
-502ed731a21668a04efa06961061ca9c061e96466e1d4cb5e1436dbb69591d9a08cdd95a39f3dda01cf2f200337d8748b5e87d6823b7c4504f26ac91e225e0cf  seaweedfs-4.44-linux-amd64.tar.gz
-df57fadf36d77504a8c5ce9b77719d180f218ec89ddd53d6a3e0e273dd1da860da39bb73569c7e239263ccdc306be10bb2e9f5840caabaddd25dc0205b04a5a9  seaweedfs-4.44-linux-arm64.tar.gz
+7307107cc6c48b37ae019bdde4a2d62408b6577d9276f3b8c94764a716aa3dea919165a7bece94c84f834bd55e0cd2861dfeeeb00c57fd37d8964e9baef29ec0  seaweedfs-4.45-linux-amd64.tar.gz
+2580ccc65fc8704d4534af40475f88dc8e69e807e035d366780ba1dba7df835c591f07ba6414323c79e8ac63565da1533b92724f88eb62096ce15b1a5447a8d9  seaweedfs-4.45-linux-arm64.tar.gz
+0ec16ea593cf154caf04b53bd81ce9a24276ecc1f6c09f0f91d82ee1218b1c12c4e8ebc79aea5ca166b988e6f8dcaffdb87ef3ff8816a99f14719c054c7fc144  seaweedfs-4.45-src.tar.gz
+4f24760848c909fdee1ae8569ef7ef7cbec2c885d891a543d7beddee492bddbf266e6789601095a86798d1b00256782c45297ea36cdb527bb6b64980dd02486a  admin.toml
+507b389f6373b5f4d8ca69f27bc806b39bda8edf7f58e4f32720958e7782ee171dd0461bdecb285e5a8bf2cf4ea3d6cbe8b62ae6ac43c2a40d0eb053d50a22f8  example-admin.toml
 b6ce09d6d83dd70e2797a185171eea3587436fb024a99b4998f714b713244d6f768ef59f67c9b7251650d4f19d414eea231eab92099763d85cd92e41cb2bdc3f  credential.toml
 7105de7053654b8c0502521ce58585915fc831c3152801e1db02b1c5214dc3c3ed31f4fc18000665d8338c7a10ffbf0d248368bef2ef3a6d37d46cd856398366  example-credential.toml
-9e6401387698832cb4aae0876ef3e237c9b70af17db7563ed641ba40c81af99f1d6c22281bafa64fff7ee8d2c89f16ccac1322ea31c9a02b545faa4e09f08549  example-filer.toml
+fe9b11f24bc10297e8a4c411ff28868aafb153d5bb98711bab0c6c0b59aa267c42057a81adbf46809a87004004dfdc403744cf1bb8bebcf0b7030dcb11ba238a  example-filer.toml
 e5753bd0bcc60dc84428c40ba556c08acae61dec083a5b76640125f637532e7c5759a72cdfd95114222a7a0901a916ec3c4d12f306853cfca0fe9a0b1857893e  example-master.toml
 2c200c28172a5d0b1c80ab28e849287e7af8d103355638fd3183b8614d3e2b1b3482132522663f7c6d844e10e13b8c6e23fb5fba0dec2cc83de45c2f17b33477  example-notification.toml
-4b507540d57799e42ec0ee84073c6fa32c577a2f4a98bf66ee7302355080c63c65d70709115185debdee3c957e9294e79a8e461347d7148af7fdd368dc548af6  example-replication.toml
-6951e1110d458238b0ef1905c4c6bb874d06f1c18b83dd8e1742534806b8db68b4410a664bf53085781e5d4d35e87941279d9c7398529ee707bb99def5055591  example-security.toml
+328cfe43d0c2ebf5092a1178af45c37b07593085135c31649754f0df9fd4c043847c13b56c3c7c45194541db8082309c4845c825d7011e4c3e503b1e6576528d  example-replication.toml
+3b45b0f5bf6c5339cfb63c3ddb489b7122e03996ce380c7a244778ef1e7f6c06b4e3e56ea695a2dc3c9c49322a58df865ff50b2904318abafee5e66b2af757f1  example-security.toml
 70069f97edf261a2cd0669dd60adad80533609a25d7429254e0c3322d7e80337f5ff69a5581bc39e6a15442098d14d610ce5f0cb14f02c461c8d3dd440b22c56  example-shell.toml
 be5771a5e1bf626c53f9dffbfa2a400d9b8f9626d55a7b61dcd853753561989427ba872a2638a5e6343f44dea6790678483bd29101d6495dbbfcd3029947b9a7  filer.toml
 2cd6c73a5e23e0395b6f099dcc3acf9280cbb3e13f54408571e91741c4e6b0dad85f6d4e5a92f23ad541bad57ce295c28bb8450fe11da35acbd4da25848f61e5  master.toml
@@ -127,12 +158,13 @@ d21981923b5964cf8365185a4f7c28a14e33ba6f60ad63e797e315544a6c22efdaa72814292824c0
 7a91ce9da79b92e5ef42d4915f56a010bceaaa6c96dcef1f7b1821ee208d381aaa88b9cf495248276132e66d3215927f589b7fabc4eae2c2cb195645f904fac7  shell.toml
 82e2793bf483ffb5b0c8fbe38e6c9df75afe01f824f8414cafd91e4bed5c79c13dae1ca659070401d4968d16ed4b26455b0c6208f777705527bceb2e5f286988  seaweedfs.admin.confd
 5ad952c37c62a770327bd70f7349fa677406606f0b9bf03fdc8f6c6804701f1e77710ab20d6153f9e0cfb549ec161d68a3316abab9c59837bbe3f91ee99e5ce0  seaweedfs.filer.confd
-6c7ebdaf8f941868051a025fda36278bdf5e5438a2d478ca1cbe35064f933e7b07bf6d56bdd2268894f01c4e232e48f69099f793baeb2d6011063ac56a132fe4  seaweedfs.initd
+077c513851bbbe53dd32d26455abc361f97006f9ace1190f96eb4b9136d16befab1a6153752eae8dac695c3a9aed084a00b411684915618cb30dd0770e608403  seaweedfs.initd
 57ba77519bb266f0117eaadae3af5ae6bc99bb653668ff526202f327df1c8d93973c0e19dae0c53a19e06389868043c04e53f16f01c851b77fe1387e92cc993b  seaweedfs.master.confd
 22a3ea6c83266a979ea7c848fc74b40fc0f2ade960b273fa11e63d4a72a1328bd688c9918be3e9234cfb19f889fd9c931388bb5c2863cea3500e534b8bd90282  seaweedfs.s3.confd
 3e9c41bc61cdd9a4c53ece64d847eca26ab7d0ce0cc98e72462c3dbb225a40de10a02201362801015a9c629d77d5c0d54c7228e9d20111fb6f478b2267d2db98  seaweedfs.sftp.confd
 262cc5132a70a43f9f154d24da16fe2f34f736c0bfdafd56cd341b7f34b48b82aa3a38a93d64206360c391e1167e2b665a3ade5c7eddfe4b322253521629f4e0  seaweedfs.volume.confd
 84a9caa8f5203a31f2f96ef812dca8e4f7597f8f06ed3f55db38daff167448b0332564a421dcb356405d761c7a9e815656208d431e84b8106951554ab7ef2142  seaweedfs.webdav.confd
 b586dfbdbcf17591366a7a62c4da6f2b13e1bd5dfb5b066beea114d01057eeb3d81172814655d812c48e02336277b3d70fa9f9550923cfe616e9dd8162661f51  seaweedfs.worker.confd
+0a06a1ea007a6e4e0110a6208830f080685b81f6e1aae8453a75941ef54e4506155e4c7be125b2eed0b971050d0743118cf1454b6e9d01cf8eec02005125b6b2  seaweedfs.worker-lance.confd
 2815330810545d17cffd993d93502c934c24af5aeff8f7096bcf0f020f895f1da50b74c356c028b67de552cbd8e4ccfa176636da2642feae99542035e4272171  weed.bash-completion
 "
diff --git a/packaging/alpine/local/seaweedfs/README.md b/packaging/alpine/local/seaweedfs/README.md
index 7f12656..deb0c18 100644
--- a/packaging/alpine/local/seaweedfs/README.md
+++ b/packaging/alpine/local/seaweedfs/README.md
@@ -54,6 +54,7 @@ seaweedfs-webdav-openrc   -> /etc/init.d/seaweedfs.webdav
 seaweedfs-sftp-openrc     -> /etc/init.d/seaweedfs.sftp
 seaweedfs-admin-openrc    -> /etc/init.d/seaweedfs.admin
 seaweedfs-worker-openrc   -> /etc/init.d/seaweedfs.worker
+seaweedfs-worker-lance-openrc -> /etc/init.d/seaweedfs.worker-lance
 ```
 
 Replace Alpine's old generic OpenRC package before installing a role split:
@@ -92,6 +93,11 @@ rc-service seaweedfs.volume start
 
 rc-update add seaweedfs.filer default
 rc-service seaweedfs.filer start
+
+# Optional: Lance table maintenance (requires a Lance namespace endpoint)
+apk add seaweedfs-worker-lance-openrc
+rc-update add seaweedfs.worker-lance default
+rc-service seaweedfs.worker-lance start
 ```
 
 Check status:
diff --git a/packaging/alpine/local/seaweedfs/admin.toml b/packaging/alpine/local/seaweedfs/admin.toml
new file mode 100644
index 0000000..36672eb
--- /dev/null
+++ b/packaging/alpine/local/seaweedfs/admin.toml
@@ -0,0 +1,8 @@
+# Configuration for `weed admin`.
+#
+# This package disables automatic maintenance by default. Enable individual
+# maintenance services deliberately after reviewing the cluster's storage and
+# replication policy. The setting is persisted in the admin data directory.
+
+[maintenance]
+enabled = false
diff --git a/packaging/alpine/local/seaweedfs/example-admin.toml b/packaging/alpine/local/seaweedfs/example-admin.toml
new file mode 100644
index 0000000..63b3252
--- /dev/null
+++ b/packaging/alpine/local/seaweedfs/example-admin.toml
@@ -0,0 +1,71 @@
+# Put this file in one of the locations, with descending priority
+#    ./admin.toml
+#    $HOME/.seaweedfs/admin.toml
+#    /etc/seaweedfs/admin.toml
+# this file is read by "weed admin"
+
+# Maintenance task settings declared here are applied every time the admin
+# server starts, overriding values saved from the admin UI under
+# <dataDir>/conf. Commented-out keys keep their saved or default values.
+# Requires -dataDir.
+# Each value can also be set via environment variable, e.g.
+#    export WEED_MAINTENANCE_VACUUM_GARBAGE_THRESHOLD=0.3
+
+[s3]
+# The address clients reach the S3 gateway at, including the scheme.
+# The file browser uses it to offer copyable object URLs; without it,
+# the copy action is hidden.
+# public_endpoint = "https://s3.example.com"
+
+[maintenance]
+# toggle the entire maintenance system (task detection and execution)
+# enabled = true
+
+[maintenance.vacuum]
+# enabled = true
+# vacuum volumes with more deleted content than this ratio
+# garbage_threshold = 0.3
+# how often to scan for volumes needing vacuum
+# scan_interval_seconds = 7200
+# max_concurrent = 2
+# only vacuum volumes older than this (rounded up to whole hours)
+# min_volume_age_seconds = 86400
+# max retry attempts for a failed vacuum job (admin runtime default)
+# retry_limit = 1
+# seconds to wait between retry attempts
+# retry_backoff_seconds = 10
+
+[maintenance.balance]
+# enabled = true
+# trigger balancing when volume distribution exceeds this ratio
+# imbalance_threshold = 0.2
+# scan_interval_seconds = 1800
+# max_concurrent = 1
+# minimum number of volume servers before balancing
+# min_server_count = 2
+# max retry attempts for a failed balance job
+# retry_limit = 1
+# seconds to wait between retry attempts
+# retry_backoff_seconds = 15
+
+[maintenance.erasure_coding]
+# enabled = true
+# only erasure code volumes this full
+# fullness_ratio = 0.95
+# only erasure code volumes not modified for this long
+# quiet_for_seconds = 3600
+# scan_interval_seconds = 3600
+# max_concurrent = 1
+# min_size_mb = 30
+# only process volumes from these collections, comma separated, "*" and "?" wildcards
+# and regex patterns allowed ("" = all collections)
+# collection_filter = ""
+# disk tags preferred for shard placement
+# preferred_tags = ["fast", "ssd"]
+# EC shard placement constraint, e.g. "020"; empty uses the master default replication
+# replica_placement = ""
+# max retry attempts for a failed erasure coding job
+# retry_limit = 1
+# seconds to wait between retry attempts
+# retry_backoff_seconds = 30
+
diff --git a/packaging/alpine/local/seaweedfs/example-filer.toml b/packaging/alpine/local/seaweedfs/example-filer.toml
index 6a19d62..8ec5b10 100644
--- a/packaging/alpine/local/seaweedfs/example-filer.toml
+++ b/packaging/alpine/local/seaweedfs/example-filer.toml
@@ -230,6 +230,23 @@ client_cert_path = ""
 client_key_path = ""
 # This changes the data layout. Only add new directories. Removing/Updating will cause data loss.
 superLargeDirectories = []
+# Connection tuning, accepted by every redis filer store section. Each key keeps the go-redis
+# default when left at 0, and a timeout cannot be turned off - a filer that never times out a read
+# is what stalls a failover. Shorter read timeouts make the filer notice a dead redis sooner, which
+# matters most for the sentinel store: every pooled connection to the old master has to time out
+# before a failover is absorbed.
+# max_retries = 0                        # 0 is three retries, -1 disables retrying
+# min_retry_backoff_millisecond = 0      # default 8
+# max_retry_backoff_millisecond = 0      # default 512
+# dial_timeout_millisecond = 0           # default 5000
+# read_timeout_millisecond = 0           # default 3000
+# write_timeout_millisecond = 0          # default 3000, follows read_timeout_millisecond
+# pool_size = 0                          # default 10 per CPU
+# pool_timeout_millisecond = 0           # default read_timeout_millisecond + 1000
+# min_idle_conns = 0
+# max_idle_conns = 0
+# conn_max_idle_time_seconds = 0         # default 1800
+# conn_max_lifetime_seconds = 0          # default unlimited
 
 [redis2_sentinel]
 enabled = false
@@ -237,6 +254,9 @@ addresses = ["172.22.12.7:26379","172.22.12.8:26379","172.22.12.9:26379"]
 masterName = "master"
 username = ""
 password = ""
+# credentials used to authenticate against the sentinel nodes themselves (if they require auth)
+sentinel_username = ""
+sentinel_password = ""
 database = 0
 # prefix for filer redis keys
 keyPrefix = ""
@@ -244,6 +264,7 @@ enable_tls = false
 ca_cert_path = ""
 client_cert_path = ""
 client_key_path = ""
+# see [redis2] for the connection tuning keys
 
 [redis_cluster2]
 enabled = false
@@ -264,7 +285,7 @@ ca_cert_path = ""
 client_cert_path = ""
 client_key_path = ""
 # allows reads from slave servers or the master, but all writes still go to the master
-readOnly = false
+useReadOnly = false
 # automatically use the closest Redis server for reads
 routeByLatency = false
 # This changes the data layout. Only add new directories. Removing/Updating will cause data loss.
diff --git a/packaging/alpine/local/seaweedfs/example-replication.toml b/packaging/alpine/local/seaweedfs/example-replication.toml
index 4df5aa9..91f97ba 100644
--- a/packaging/alpine/local/seaweedfs/example-replication.toml
+++ b/packaging/alpine/local/seaweedfs/example-replication.toml
@@ -59,7 +59,17 @@ is_incremental = false
 # experimental, let me know if it works
 enabled = false
 account_name = ""
+# leave account_key empty to authenticate with Entra ID instead of a shared key,
+# picking up a workload identity or managed identity from the environment. The
+# identity needs a data-plane role such as Storage Blob Data Contributor.
 account_key = ""
+# optional user-assigned identity, when account_key is empty. Workload identity
+# takes its tenant and token from AZURE_TENANT_ID and AZURE_FEDERATED_TOKEN_FILE,
+# which the Azure workload identity webhook projects into the pod.
+client_id = ""
+# blob service url, for accounts outside the public cloud. Empty resolves to
+# https://<account_name>.blob.core.windows.net/
+endpoint = ""
 container = "mycontainer"      # an existing container
 directory = "/"                # destination directory
 is_incremental = false
diff --git a/packaging/alpine/local/seaweedfs/example-security.toml b/packaging/alpine/local/seaweedfs/example-security.toml
index 4118c7e..6be0b7b 100644
--- a/packaging/alpine/local/seaweedfs/example-security.toml
+++ b/packaging/alpine/local/seaweedfs/example-security.toml
@@ -77,6 +77,12 @@ expires_after_seconds = 10           # seconds
 # All gRPC TLS authentications are mutual (mTLS)
 # The values for ca, cert, and key are paths to the certificate/key files
 # The host name is not checked, so the certificate files can be shared
+# Each [grpc.<component>] section also accepts optional client_cert/client_key,
+# presented when that component dials other servers. Set them when your CA
+# issues separate serverAuth-only and clientAuth-only certificates; when unset,
+# the component reuses cert/key for both directions.
+# If client and server certificates come from different issuing CAs, put both
+# CA certificates in the ca PEM file.
 [grpc]
 ca = ""
 # Set wildcard domain for enable TLS authentication by common names
@@ -87,6 +93,8 @@ allowed_wildcard_domain = "" # .mycompany.com
 [grpc.volume]
 cert = ""
 key = ""
+client_cert = ""
+client_key = ""
 allowed_commonNames = ""    # comma-separated SSL certificate common names
 
 # Master server gRPC options (server-side)
@@ -94,6 +102,8 @@ allowed_commonNames = ""    # comma-separated SSL certificate common names
 [grpc.master]
 cert = ""
 key = ""
+client_cert = ""
+client_key = ""
 allowed_commonNames = ""    # comma-separated SSL certificate common names
 
 # Filer server gRPC options (server-side)
@@ -101,6 +111,8 @@ allowed_commonNames = ""    # comma-separated SSL certificate common names
 [grpc.filer]
 cert = ""
 key = ""
+client_cert = ""
+client_key = ""
 allowed_commonNames = ""    # comma-separated SSL certificate common names
 
 # S3 server gRPC options (server-side)
@@ -108,31 +120,43 @@ allowed_commonNames = ""    # comma-separated SSL certificate common names
 [grpc.s3]
 cert = ""
 key = ""
+client_cert = ""
+client_key = ""
 allowed_commonNames = ""    # comma-separated SSL certificate common names
 
 [grpc.msg_broker]
 cert = ""
 key = ""
+client_cert = ""
+client_key = ""
 allowed_commonNames = ""    # comma-separated SSL certificate common names
 
 [grpc.msg_agent]
 cert = ""
 key = ""
+client_cert = ""
+client_key = ""
 allowed_commonNames = ""    # comma-separated SSL certificate common names
 
 [grpc.admin]
 cert = ""
 key = ""
+client_cert = ""
+client_key = ""
 allowed_commonNames = ""    # comma-separated SSL certificate common names
 
 [grpc.worker]
 cert = ""
 key = ""
+client_cert = ""
+client_key = ""
 allowed_commonNames = ""    # comma-separated SSL certificate common names
 
 [grpc.mq]
 cert = ""
 key = ""
+client_cert = ""
+client_key = ""
 allowed_commonNames = ""    # comma-separated SSL certificate common names
 
 # gRPC client configuration for outgoing gRPC connections
diff --git a/packaging/alpine/local/seaweedfs/scripts/runtime-test.sh b/packaging/alpine/local/seaweedfs/scripts/runtime-test.sh
index 83e5f59..02ec569 100755
--- a/packaging/alpine/local/seaweedfs/scripts/runtime-test.sh
+++ b/packaging/alpine/local/seaweedfs/scripts/runtime-test.sh
@@ -6,18 +6,23 @@ apk add seaweedfs \
   bash-completion \
   seaweedfs-master-openrc \
   seaweedfs-volume-openrc \
-  seaweedfs-filer-openrc
+  seaweedfs-filer-openrc \
+  seaweedfs-worker-lance-openrc
 
 test -x /usr/bin/weed
 test -d /etc/seaweedfs
 test -f /etc/seaweedfs/master.toml
 test -f /etc/seaweedfs/filer.toml
+test -f /etc/seaweedfs/admin.toml
 test -f /etc/conf.d/seaweedfs.master
 test -f /etc/conf.d/seaweedfs.volume
 test -f /etc/conf.d/seaweedfs.filer
 test -f /etc/init.d/seaweedfs.master
 test -f /etc/init.d/seaweedfs.volume
 test -f /etc/init.d/seaweedfs.filer
+test -f /etc/init.d/seaweedfs.worker-lance
+test -x /usr/bin/weed-worker
+/usr/bin/weed-worker --help >/dev/null
 test -d /usr/share/doc/seaweedfs/examples
 test -f /usr/share/doc/seaweedfs/examples/master.toml
 test -f /usr/share/bash-completion/completions/weed
diff --git a/packaging/alpine/local/seaweedfs/scripts/test-install.sh b/packaging/alpine/local/seaweedfs/scripts/test-install.sh
index 72bb5f4..44acb83 100755
--- a/packaging/alpine/local/seaweedfs/scripts/test-install.sh
+++ b/packaging/alpine/local/seaweedfs/scripts/test-install.sh
@@ -15,18 +15,23 @@ apk_test_install_run "${repo_root}" "${PACKAGE_NAME:-seaweedfs}" "${PACKAGE_VERS
     apk add seaweedfs \
       seaweedfs-master-openrc \
       seaweedfs-volume-openrc \
-      seaweedfs-filer-openrc
+      seaweedfs-filer-openrc \
+      seaweedfs-worker-lance-openrc
 
     test -x /usr/bin/weed
     test -d /etc/seaweedfs
     test -f /etc/seaweedfs/master.toml
     test -f /etc/seaweedfs/filer.toml
+    test -f /etc/seaweedfs/admin.toml
     test -f /etc/conf.d/seaweedfs.master
     test -f /etc/conf.d/seaweedfs.volume
     test -f /etc/conf.d/seaweedfs.filer
     test -f /etc/init.d/seaweedfs.master
     test -f /etc/init.d/seaweedfs.volume
     test -f /etc/init.d/seaweedfs.filer
+    test -f /etc/init.d/seaweedfs.worker-lance
+    test -x /usr/bin/weed-worker
+    /usr/bin/weed-worker --help >/dev/null
 
     weed version
 
diff --git a/packaging/alpine/local/seaweedfs/scripts/update-generated-sources.sh b/packaging/alpine/local/seaweedfs/scripts/update-generated-sources.sh
index b604d80..e41b923 100755
--- a/packaging/alpine/local/seaweedfs/scripts/update-generated-sources.sh
+++ b/packaging/alpine/local/seaweedfs/scripts/update-generated-sources.sh
@@ -2,7 +2,7 @@
 set -euo pipefail
 
 package_dir="${PACKAGE_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
-configs=(credential filer master notification replication security shell)
+configs=(admin credential filer master notification replication security shell)
 pkgver="$(
   awk -F= '$1 == "pkgver" { print $2; exit }' "${package_dir}/APKBUILD"
 )"
diff --git a/packaging/alpine/local/seaweedfs/seaweedfs.initd b/packaging/alpine/local/seaweedfs/seaweedfs.initd
index 350aa5d..20507e3 100644
--- a/packaging/alpine/local/seaweedfs/seaweedfs.initd
+++ b/packaging/alpine/local/seaweedfs/seaweedfs.initd
@@ -46,6 +46,10 @@ build_command_args() {
 			data_dir="${SEAWEEDFS_DATA_DIR:-/var/lib/seaweedfs/worker}"
 			command_args="$command_args -admin=${SEAWEEDFS_ADMIN:-localhost:23646} -workingDir=${data_dir}"
 			;;
+		worker-lance)
+			command="/usr/bin/weed-worker"
+			command_args="--admin ${SEAWEEDFS_ADMIN:-localhost:23646} --namespace ${SEAWEEDFS_LANCE_NAMESPACE:-http://localhost:9101}"
+			;;
 	esac
 
 	command_args="$command_args ${SEAWEEDFS_OPTS:-}"
@@ -62,7 +66,7 @@ depend() {
 		s3|webdav|sftp)
 			after seaweedfs.filer
 			;;
-		worker)
+		worker|worker-lance)
 			after seaweedfs.admin
 			;;
 	esac
diff --git a/packaging/alpine/local/seaweedfs/seaweedfs.worker-lance.confd b/packaging/alpine/local/seaweedfs/seaweedfs.worker-lance.confd
new file mode 100644
index 0000000..456788c
--- /dev/null
+++ b/packaging/alpine/local/seaweedfs/seaweedfs.worker-lance.confd
@@ -0,0 +1,4 @@
+# Lance maintenance worker. It is optional and requires a Lance namespace.
+SEAWEEDFS_ADMIN="localhost:23646"
+SEAWEEDFS_LANCE_NAMESPACE="http://localhost:9101"
+SEAWEEDFS_OPTS=""