diff --git a/.gitignore b/.gitignore
index d31ddbe..51a1266 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,6 +6,8 @@ bin/
 configs/config.json
 configs/remnawave-api.json
 configs/account.json
+# Baked panel credentials (copied by build.bat; never commit)
+internal/remnawave/embeddedcfg/remnawave-api.json
 dist/navis-release/windows/configs/
 # Runtime-downloaded protocol cores + local packaging artifact (not release sources)
 dist/navis-release/windows/bin/
@@ -17,8 +19,11 @@ cmd/vpnapp/resource.syso
 navis-update.bat
 Navis.exe.new
 Navis-pending.exe
+EvilFox.exe.new
+EvilFox-pending.exe
 *.bak
 Navis.exe.bak
+EvilFox.exe.bak
 
 # MSIX staging / local packages
 packaging/msix/_staging/
diff --git a/README.md b/README.md
index 4a76555..683cdaa 100644
--- a/README.md
+++ b/README.md
@@ -1,12 +1,14 @@
-# Navis
+# EvilFox
 
-Клиент [NaiveProxy](https://github.com/klzgrad/naiveproxy) + [Hysteria 2](https://github.com/apernet/hysteria) + [AmneziaWG 2.0](https://docs.amnezia.org/documentation/amnezia-wg/) + [Xray](https://github.com/XTLS/Xray-core) (VLESS / VMess / Trojan) с профилями, пингом, URL-подпиской / **Remnawave API** и автообновлением.
+Клиент [NaiveProxy](https://github.com/klzgrad/naiveproxy) + [Hysteria 2](https://github.com/apernet/hysteria) + [AmneziaWG 2.0](https://docs.amnezia.org/documentation/amnezia-wg/) + [Xray](https://github.com/XTLS/Xray-core) (VLESS / VMess / Trojan) с профилями, пингом, централизованной выдачей конфигов (Remnawave) и автообновлением.
+
+> Ранее приложение называлось **Navis**. С 4.0.0 бинарник — `EvilFox.exe`. Каталог релиза `dist/navis-release/` и URL-путь сохранены, чтобы клиенты 3.x продолжали обновляться; в той же папке лежит и `Navis.exe` (копия `EvilFox.exe`) как совместимый алиас.
 
 ## Платформы
 
 | OS | Артефакты | UI |
 |----|----------|----|
-| Windows amd64 | `Navis.exe` | GUI (WebView2) |
+| Windows amd64 | `EvilFox.exe` (+ `Navis.exe` alias) | GUI (WebView2) |
 | macOS universal | `Navis.dmg` · `Navis.app.zip` | **GUI** (как Windows) |
 | macOS arm64 / amd64 | `Navis` · DMG · `Navis-cli` | GUI + CLI |
 | Android | `Navis.apk` | GUI (VpnService) |
diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 67ddd0c..f77521d 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -13,8 +13,8 @@ android {
         minSdk = 26
         targetSdk = 35
         // versionCode = major*1_000_000 + minor*10_000 + patch*100 + build
-        versionCode = 3_100_001
-        versionName = "3.10.0+1"
+        versionCode = 4_000_001
+        versionName = "4.0.0+1"
         vectorDrawables.useSupportLibrary = true
         ndk {
             abiFilters += listOf("arm64-v8a", "armeabi-v7a", "x86_64")
diff --git a/android/app/src/main/java/win/evilfox/navis/ui/NavisScreen.kt b/android/app/src/main/java/win/evilfox/navis/ui/NavisScreen.kt
index f41253a..38fb80f 100644
--- a/android/app/src/main/java/win/evilfox/navis/ui/NavisScreen.kt
+++ b/android/app/src/main/java/win/evilfox/navis/ui/NavisScreen.kt
@@ -94,7 +94,7 @@ fun NavisScreen(
             .padding(18.dp)
     ) {
         Row(verticalAlignment = Alignment.CenterVertically) {
-            Text("Navis", fontSize = 28.sp, fontWeight = FontWeight.Black, color = Ink)
+            Text("EvilFox", fontSize = 28.sp, fontWeight = FontWeight.Black, color = Ink)
             Spacer(Modifier.width(8.dp))
             Surface(color = Soft, shape = RoundedCornerShape(999.dp)) {
                 Text("2.6.1", Modifier.padding(horizontal = 8.dp, vertical = 2.dp), fontSize = 12.sp, fontWeight = FontWeight.Bold, color = AccentDeep)
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index 9ad5410..4a4120a 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
-    <string name="app_name">Navis</string>
-    <string name="vpn_notification_title">Navis VPN</string>
+    <string name="app_name">EvilFox</string>
+    <string name="vpn_notification_title">EvilFox VPN</string>
     <string name="vpn_notification_connected">Подключено</string>
     <string name="vpn_notification_channel">VPN</string>
 </resources>
diff --git a/build.bat b/build.bat
index 9af32e4..a5ee9c6 100644
--- a/build.bat
+++ b/build.bat
@@ -14,22 +14,37 @@ if errorlevel 1 (
 goversioninfo -64 -icon assets\navis.ico -manifest assets\app.manifest -o cmd\vpnapp\resource.syso versioninfo.json
 if errorlevel 1 exit /b 1
 
-echo Building Navis GUI and CLI...
-go build -ldflags="-H windowsgui -s -w" -trimpath -o Navis.exe ./cmd/vpnapp
+REM Bake Remnawave panel credentials into the binary (NordVPN-style centralized provisioning).
+REM Source of truth: configs\remnawave-api.json (gitignored). Never commit the embedded copy.
+if exist "configs\remnawave-api.json" (
+  mkdir "internal\remnawave\embeddedcfg" 2>nul
+  copy /Y "configs\remnawave-api.json" "internal\remnawave\embeddedcfg\remnawave-api.json" >nul
+  echo Embedded panel credentials from configs\remnawave-api.json
+) else (
+  echo WARNING: configs\remnawave-api.json missing — build will use external file / no auto-provision
+)
+
+echo Building EvilFox GUI and CLI...
+go build -ldflags="-H windowsgui -s -w" -trimpath -o EvilFox.exe ./cmd/vpnapp
 if errorlevel 1 exit /b 1
 
-go build -ldflags="-s -w" -trimpath -o vpnclient.exe ./cmd/vpnclient
+go build -ldflags="-s -w" -trimpath -o evilfox-cli.exe ./cmd/vpnclient
 if errorlevel 1 exit /b 1
 
 mkdir "dist\navis-release\windows" 2>nul
-copy /Y Navis.exe "dist\navis-release\windows\Navis.exe" >nul
-copy /Y vpnclient.exe "dist\navis-release\windows\vpnclient.exe" >nul
+copy /Y EvilFox.exe "dist\navis-release\windows\EvilFox.exe" >nul
+REM Keep Navis.exe path for existing 3.x clients that fetch the old feed URL.
+copy /Y EvilFox.exe "dist\navis-release\windows\Navis.exe" >nul
+copy /Y evilfox-cli.exe "dist\navis-release\windows\evilfox-cli.exe" >nul
+copy /Y evilfox-cli.exe "dist\navis-release\windows\vpnclient.exe" >nul
 
 echo.
 echo Done:
-echo   Navis.exe
-echo   vpnclient.exe
-echo   dist\navis-release\windows\Navis.exe
+echo   EvilFox.exe
+echo   evilfox-cli.exe
+echo   dist\navis-release\windows\EvilFox.exe
+echo   dist\navis-release\windows\Navis.exe  (compat alias for 3.x updater)
+echo   dist\navis-release\windows\evilfox-cli.exe
 echo   dist\navis-release\windows\vpnclient.exe
 echo   assets\navis.ico
 endlocal
diff --git a/cmd/vpnapp/main_darwin.go b/cmd/vpnapp/main_darwin.go
index 70e111f..41c7dbe 100644
--- a/cmd/vpnapp/main_darwin.go
+++ b/cmd/vpnapp/main_darwin.go
@@ -71,7 +71,7 @@ func main() {
 		log.Printf("open UI: %v — откройте вручную: %s", err, uiURL)
 		fmt.Println(uiURL)
 	} else {
-		log.Printf("Navis UI: %s", uiURL)
+		log.Printf("EvilFox UI: %s", uiURL)
 	}
 
 	sig := make(chan os.Signal, 1)
@@ -96,7 +96,7 @@ func openAppWindow(uiURL string) error {
 func fatalf(format string, args ...any) {
 	msg := fmt.Sprintf(format, args...)
 	log.Println(msg)
-	_ = exec.Command("osascript", "-e", fmt.Sprintf(`display alert "Navis" message %q`, msg)).Run()
+	_ = exec.Command("osascript", "-e", fmt.Sprintf(`display alert "EvilFox" message %q`, msg)).Run()
 	os.Exit(1)
 }
 
diff --git a/cmd/vpnapp/main_other.go b/cmd/vpnapp/main_other.go
index 66ae7be..249dc2f 100644
--- a/cmd/vpnapp/main_other.go
+++ b/cmd/vpnapp/main_other.go
@@ -8,7 +8,7 @@ import (
 )
 
 func main() {
-	fmt.Fprintln(os.Stderr, "Navis GUI supports Windows (WebView2) and macOS.")
-	fmt.Fprintln(os.Stderr, "On this OS use the CLI: ./Navis connect | install-core | check-update")
+	fmt.Fprintln(os.Stderr, "EvilFox GUI supports Windows (WebView2) and macOS.")
+	fmt.Fprintln(os.Stderr, "On this OS use the CLI: ./evilfox-cli connect | install-core | check-update")
 	os.Exit(1)
 }
diff --git a/cmd/vpnapp/main_windows.go b/cmd/vpnapp/main_windows.go
index cf49fd2..5c70b06 100644
--- a/cmd/vpnapp/main_windows.go
+++ b/cmd/vpnapp/main_windows.go
@@ -117,7 +117,7 @@ func main() {
 		AutoFocus: true,
 		DataPath:  dataPath,
 		WindowOptions: webview2.WindowOptions{
-			Title:  "Navis 2",
+			Title:  "EvilFox",
 			Width:  920,
 			Height: 680,
 			Center: true,
@@ -160,12 +160,32 @@ func main() {
 	mustBind(w, "getLogs", a.getLogs)
 
 	go a.autoCheckUpdate()
+	go a.autoProvision()
 	mgr.StartAutoRenew(6 * time.Hour)
 
 	w.SetHtml(appui.IndexHTML)
 	w.Run()
 }
 
+// autoProvision quietly issues a panel account + imports configs on first run
+// (NordVPN-style centralized provisioning — users never edit the panel).
+func (a *app) autoProvision() {
+	if !a.mgr.ProvisionConfigured() {
+		return
+	}
+	time.Sleep(2 * time.Second)
+	out, err := a.mgr.EnsureAutoProvision()
+	if err != nil {
+		fmt.Fprintf(a.logBuf, "auto-provision: %v\n", err)
+		return
+	}
+	if out.Created {
+		fmt.Fprintf(a.logBuf, "auto-provision: создан %s · серверов %d\n", out.Username, out.Imported)
+	} else if out.Imported > 0 {
+		fmt.Fprintf(a.logBuf, "auto-provision: обновлены конфиги %s · серверов %d\n", out.Username, out.Imported)
+	}
+}
+
 func mustBind(w webview2.WebView, name string, fn interface{}) {
 	if err := w.Bind(name, fn); err != nil {
 		fatalDialog("bind %s: %v", name, err)
@@ -503,12 +523,12 @@ func (a *app) applyUpdate() (string, error) {
 		return "", err
 	}
 	_ = a.mgr.Disconnect()
-	// Hard-exit so Windows unlocks Navis.exe; do not wait on webview.Terminate (can hang).
+	// Hard-exit so Windows unlocks EvilFox.exe; do not wait on webview.Terminate (can hang).
 	go func() {
 		time.Sleep(300 * time.Millisecond)
 		os.Exit(0)
 	}()
-	return "Устанавливается v" + latest + "… Navis перезапустится.", nil
+	return "Устанавливается v" + latest + "… EvilFox перезапустится.", nil
 }
 
 func (a *app) autoCheckUpdate() {
diff --git a/cmd/vpnapp/msgbox_windows.go b/cmd/vpnapp/msgbox_windows.go
index 2a77543..dfc1bac 100644
--- a/cmd/vpnapp/msgbox_windows.go
+++ b/cmd/vpnapp/msgbox_windows.go
@@ -10,7 +10,7 @@ import (
 func messageBox(text string) {
 	user32 := syscall.NewLazyDLL("user32.dll")
 	proc := user32.NewProc("MessageBoxW")
-	title, _ := syscall.UTF16PtrFromString("Navis")
+	title, _ := syscall.UTF16PtrFromString("EvilFox")
 	body, _ := syscall.UTF16PtrFromString(text)
 	proc.Call(0, uintptr(unsafe.Pointer(body)), uintptr(unsafe.Pointer(title)), 0x10) // MB_ICONERROR
 }
diff --git a/cmd/vpnclient/main.go b/cmd/vpnclient/main.go
index 8ff9b49..14f3db2 100644
--- a/cmd/vpnclient/main.go
+++ b/cmd/vpnclient/main.go
@@ -59,16 +59,16 @@ func main() {
 }
 
 func printUsage() {
-	fmt.Fprintf(os.Stderr, `Navis VPN client (Naive / Hy2 / AWG / VLESS / VMess / Trojan) — Windows / macOS
+	fmt.Fprintf(os.Stderr, `EvilFox VPN client (Naive / Hy2 / AWG / VLESS / VMess / Trojan) — Windows / macOS
 
 Usage:
-  navis init [-config configs/config.json]
-  navis install-core [-config configs/config.json]
-  navis set-proxy [-config configs/config.json] <share-or-proxy-uri>
-  navis connect [-config configs/config.json] [-profile name] [-no-sysproxy] [-probe]
-  navis probe [-config configs/config.json] [-profile name] [-url URL]
-  navis check-update
-  navis apply-update
+  evilfox-cli init [-config configs/config.json]
+  evilfox-cli install-core [-config configs/config.json]
+  evilfox-cli set-proxy [-config configs/config.json] <share-or-proxy-uri>
+  evilfox-cli connect [-config configs/config.json] [-profile name] [-no-sysproxy] [-probe]
+  evilfox-cli probe [-config configs/config.json] [-profile name] [-url URL]
+  evilfox-cli check-update
+  evilfox-cli apply-update
 
 Share links: naive+https://…  hysteria2://…  vless://…  vmess://…  trojan://…  awg .conf
 
diff --git a/dist/navis-release/update.json b/dist/navis-release/update.json
index 30e0641..86f6375 100644
--- a/dist/navis-release/update.json
+++ b/dist/navis-release/update.json
@@ -1,16 +1,16 @@
 {
-    "version":  "3.10.0",
-    "notes":  "3.10.0+2: новый интерфейс с боковым меню (Главная / Профили / Настройки / Логи / О программе), аккаунт с продлением 50 ГБ / +30 дней и автопродлением, режим VPN на Windows (TUN, весь трафик, нужны права администратора и wintun.dll). Обновления теперь с git.de4ima.uk. Windows 3.10.0.2.",
+    "version":  "4.0.0",
+    "notes":  "4.0.0+1: ребрендинг Navis → EvilFox; централизованная автовыдача конфигов (как NordVPN — панель вшита, пользователь только выбирает сервер и продлевает); из интерфейса убраны настройки Remnawave API. Windows 4.0.0.1. Клиенты 3.x обновляются по этому фиду; Navis.exe в релизе — совместимый алиас EvilFox.exe.",
     "platform":  "windows-amd64",
     "os":  "windows",
     "arch":  "amd64",
-    "url":  "https://git.de4ima.uk/Evilfox/navi/raw/branch/Windows/dist/navis-release/windows/Navis.exe",
-    "sha256":  "55ba57898ffc23ce1cb14172643513f70a2ae972c00181b2d3d889430bce1eb3",
+    "url":  "https://git.de4ima.uk/Evilfox/navi/raw/branch/Windows/dist/navis-release/windows/EvilFox.exe",
+    "sha256":  "869b37310526003143c5db8ea3ad6d4468173e9053cf585f06c162a861d5c49c",
     "mandatory":  false,
     "platforms":  {
                       "windows-amd64":  {
-                                            "url":  "https://git.de4ima.uk/Evilfox/navi/raw/branch/Windows/dist/navis-release/windows/Navis.exe",
-                                            "sha256":  "55ba57898ffc23ce1cb14172643513f70a2ae972c00181b2d3d889430bce1eb3",
+                                            "url":  "https://git.de4ima.uk/Evilfox/navi/raw/branch/Windows/dist/navis-release/windows/EvilFox.exe",
+                                            "sha256":  "869b37310526003143c5db8ea3ad6d4468173e9053cf585f06c162a861d5c49c",
                                             "os":  "windows",
                                             "arch":  "amd64"
                                         },
diff --git a/dist/navis-release/windows/EvilFox.exe b/dist/navis-release/windows/EvilFox.exe
new file mode 100644
index 0000000..53b8ade
Binary files /dev/null and b/dist/navis-release/windows/EvilFox.exe differ
diff --git a/dist/navis-release/windows/Navis.exe b/dist/navis-release/windows/Navis.exe
index bf07c02..53b8ade 100644
Binary files a/dist/navis-release/windows/Navis.exe and b/dist/navis-release/windows/Navis.exe differ
diff --git a/dist/navis-release/windows/evilfox-cli.exe b/dist/navis-release/windows/evilfox-cli.exe
new file mode 100644
index 0000000..5ef29bc
Binary files /dev/null and b/dist/navis-release/windows/evilfox-cli.exe differ
diff --git a/dist/navis-release/windows/vpnclient.exe b/dist/navis-release/windows/vpnclient.exe
index 7e545e0..5ef29bc 100644
Binary files a/dist/navis-release/windows/vpnclient.exe and b/dist/navis-release/windows/vpnclient.exe differ
diff --git a/dist/update.json b/dist/update.json
index 30e0641..86f6375 100644
--- a/dist/update.json
+++ b/dist/update.json
@@ -1,16 +1,16 @@
 {
-    "version":  "3.10.0",
-    "notes":  "3.10.0+2: новый интерфейс с боковым меню (Главная / Профили / Настройки / Логи / О программе), аккаунт с продлением 50 ГБ / +30 дней и автопродлением, режим VPN на Windows (TUN, весь трафик, нужны права администратора и wintun.dll). Обновления теперь с git.de4ima.uk. Windows 3.10.0.2.",
+    "version":  "4.0.0",
+    "notes":  "4.0.0+1: ребрендинг Navis → EvilFox; централизованная автовыдача конфигов (как NordVPN — панель вшита, пользователь только выбирает сервер и продлевает); из интерфейса убраны настройки Remnawave API. Windows 4.0.0.1. Клиенты 3.x обновляются по этому фиду; Navis.exe в релизе — совместимый алиас EvilFox.exe.",
     "platform":  "windows-amd64",
     "os":  "windows",
     "arch":  "amd64",
-    "url":  "https://git.de4ima.uk/Evilfox/navi/raw/branch/Windows/dist/navis-release/windows/Navis.exe",
-    "sha256":  "55ba57898ffc23ce1cb14172643513f70a2ae972c00181b2d3d889430bce1eb3",
+    "url":  "https://git.de4ima.uk/Evilfox/navi/raw/branch/Windows/dist/navis-release/windows/EvilFox.exe",
+    "sha256":  "869b37310526003143c5db8ea3ad6d4468173e9053cf585f06c162a861d5c49c",
     "mandatory":  false,
     "platforms":  {
                       "windows-amd64":  {
-                                            "url":  "https://git.de4ima.uk/Evilfox/navi/raw/branch/Windows/dist/navis-release/windows/Navis.exe",
-                                            "sha256":  "55ba57898ffc23ce1cb14172643513f70a2ae972c00181b2d3d889430bce1eb3",
+                                            "url":  "https://git.de4ima.uk/Evilfox/navi/raw/branch/Windows/dist/navis-release/windows/EvilFox.exe",
+                                            "sha256":  "869b37310526003143c5db8ea3ad6d4468173e9053cf585f06c162a861d5c49c",
                                             "os":  "windows",
                                             "arch":  "amd64"
                                         },
diff --git a/internal/apphost/app.go b/internal/apphost/app.go
index 4d6748e..07f5c2c 100644
--- a/internal/apphost/app.go
+++ b/internal/apphost/app.go
@@ -76,6 +76,18 @@ type PingBestResult struct {
 func New(mgr *core.Manager, cfgPath string, logBuf *bytes.Buffer) *App {
 	// Monthly plan upkeep: check at start and then periodically.
 	mgr.StartAutoRenew(6 * time.Hour)
+	// NordVPN-style: silently issue a panel account + import configs.
+	go func() {
+		time.Sleep(2 * time.Second)
+		if !mgr.ProvisionConfigured() {
+			return
+		}
+		if out, err := mgr.EnsureAutoProvision(); err != nil {
+			fmt.Fprintf(logBuf, "auto-provision: %v\n", err)
+		} else if out.Created {
+			fmt.Fprintf(logBuf, "auto-provision: создан %s · серверов %d\n", out.Username, out.Imported)
+		}
+	}()
 	return &App{
 		Mgr:     mgr,
 		CfgPath: cfgPath,
@@ -410,7 +422,7 @@ func (a *App) ApplyUpdate() (string, error) {
 			os.Exit(0)
 		}()
 	}
-	return "Устанавливается v" + latest + "… Navis перезапустится.", nil
+	return "Устанавливается v" + latest + "… EvilFox перезапустится.", nil
 }
 
 func (a *App) AutoCheckUpdate() {
diff --git a/internal/appui/index.html b/internal/appui/index.html
index 0094648..a48fbee 100644
--- a/internal/appui/index.html
+++ b/internal/appui/index.html
@@ -3,7 +3,7 @@
 <head>
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
-  <title>Navis</title>
+  <title>EvilFox</title>
   <script>
     (function () {
       try {
@@ -993,8 +993,8 @@
             <path d="M22.5 8.2l3.2-1.1-1.1 3.2-5.6 5.6 1.6 1.6 5.6-5.6 3.2-1.1-1.1 3.2" fill="#b8f0d8" opacity=".9"/>
           </svg>
         </div>
-        <h1 class="brand">Navis</h1>
-        <span class="badge-ver" id="badgeVer">3.10.0</span>
+        <h1 class="brand">EvilFox</h1>
+        <span class="badge-ver" id="badgeVer">4.0.0</span>
       </div>
 
       <button class="nav-btn active" type="button" data-page="home">
@@ -1020,7 +1020,7 @@
 
       <div class="spacer"></div>
       <div class="side-foot">
-        <span class="ver" id="verLabel">Navis</span>
+        <span class="ver" id="verLabel">EvilFox</span>
         <button type="button" class="theme-toggle" id="themeToggle" title="Тема" aria-label="Переключить тему">
           <svg class="icon-moon" viewBox="0 0 24 24" fill="none" aria-hidden="true">
             <path d="M20.5 14.2A8.2 8.2 0 0 1 9.8 3.5 8.5 8.5 0 1 0 20.5 14.2z" stroke="currentColor" stroke-width="1.8" stroke-linejoin="round"/>
@@ -1150,17 +1150,6 @@
             </div>
           </details>
 
-          <!-- Выдача доступа: скрыта, когда аккаунт уже привязан
-               (создание второго конфига отключено — платная подписка появится позже) -->
-          <div class="remna-box" id="provisionBox" hidden>
-            <div class="remna-title">Выдать доступ</div>
-            <p class="remna-hint">Создаёт пользователя в панели Remnawave (тариф из configs/remnawave-api.json, по умолчанию 50 ГБ / 30 дней), запоминает его и сразу импортирует конфиги. Повторно создать аккаунт нельзя — только продлевать.</p>
-            <div>
-              <label class="field" for="provUser">Пользователь</label>
-              <input id="provUser" type="text" placeholder="username / @telegram / email" spellcheck="false" autocomplete="off" />
-            </div>
-            <button class="action primary" id="provBtn" type="button">Выдать доступ</button>
-          </div>
         </section>
 
         <!-- ============ Настройки ============ -->
@@ -1173,7 +1162,7 @@
               <button type="button" id="modeProxyBtn">Режим прокси</button>
               <button type="button" id="modeVpnBtn">Режим VPN</button>
             </div>
-            <p class="remna-hint" id="modeHint">Прокси — трафик идёт через локальный прокси (и системный прокси Windows). VPN — весь трафик, включая игры и приложения, через TUN-адаптер; нужны права администратора и wintun.dll рядом с Navis.exe. Меняется в отключённом состоянии.</p>
+            <p class="remna-hint" id="modeHint">Прокси — трафик идёт через локальный прокси (и системный прокси Windows). VPN — весь трафик, включая игры и приложения, через TUN-адаптер; нужны права администратора и wintun.dll рядом с EvilFox.exe. Меняется в отключённом состоянии.</p>
           </div>
 
           <div class="row">
@@ -1260,33 +1249,6 @@
             <label class="check"><input id="hy2Lazy" type="checkbox" /> Lazy connect</label>
           </details>
 
-          <details class="panel" id="rwPanel">
-            <summary>Remnawave API</summary>
-            <div class="remna-box" style="margin-top:8px;border:0;padding:0;background:transparent">
-              <p class="remna-hint">Панель → short UUID пользователя. Токен API — опционально (для /api/subscriptions/… и /users/…).</p>
-              <div>
-                <label class="field" for="rwBase">URL панели</label>
-                <input id="rwBase" type="text" placeholder="https://panel.example.com" spellcheck="false" />
-              </div>
-              <div>
-                <label class="field" for="rwShort">Short UUID</label>
-                <input id="rwShort" type="text" placeholder="abc12xyz" spellcheck="false" />
-              </div>
-              <div>
-                <label class="field" for="rwToken">API token</label>
-                <input id="rwToken" type="password" placeholder="Bearer из панели → API Tokens" spellcheck="false" autocomplete="off" />
-              </div>
-              <div>
-                <label class="field" for="rwCaddy">Caddy X-Api-Key</label>
-                <input id="rwCaddy" type="password" placeholder="если стоит auth у Caddy" spellcheck="false" autocomplete="off" />
-              </div>
-              <div class="sub-bar" style="margin-top:8px">
-                <button class="action secondary" id="rwSaveBtn" type="button" style="flex:1">Сохранить</button>
-                <button class="action primary" id="rwSyncBtn" type="button" style="flex:1">Синхронизировать</button>
-              </div>
-            </div>
-          </details>
-
           <details class="panel" id="toolsBox">
             <summary>Сервис · cores, обновления</summary>
             <div class="tools">
@@ -1317,9 +1279,9 @@
                 <path d="M22.5 8.2l3.2-1.1-1.1 3.2-5.6 5.6 1.6 1.6 5.6-5.6 3.2-1.1-1.1 3.2" fill="#b8f0d8" opacity=".9"/>
               </svg>
             </div>
-            <h2>Navis</h2>
+            <h2>EvilFox</h2>
             <p id="aboutVer">версия…</p>
-            <p style="margin-top:6px">VPN/прокси-клиент: Remnawave · Naive · Hysteria 2 · AWG · Xray</p>
+            <p style="margin-top:6px">VPN/прокси-клиент: Naive · Hysteria 2 · AWG · Xray</p>
           </div>
           <div class="tools" style="margin-top:0">
             <button class="action secondary" id="aboutUpdBtn" type="button">Проверить обновление</button>
@@ -1498,15 +1460,6 @@
     }
     const subUrl = $("subUrl");
     const subBtn = $("subBtn");
-    const rwBase = $("rwBase");
-    const rwShort = $("rwShort");
-    const rwToken = $("rwToken");
-    const rwCaddy = $("rwCaddy");
-    const rwSaveBtn = $("rwSaveBtn");
-    const rwSyncBtn = $("rwSyncBtn");
-    const provisionBox = $("provisionBox");
-    const provUser = $("provUser");
-    const provBtn = $("provBtn");
     const hero = $("hero");
     const protoChip = $("protoChip");
     const heroHint = $("heroHint");
@@ -1572,7 +1525,7 @@
 
     function markDirty() { dirty = true; }
     [
-      proxy, nameInput, sysproxy, subUrl, rwBase, rwShort, rwToken, rwCaddy,
+      proxy, nameInput, sysproxy, subUrl,
       $("hy2Congestion"), $("hy2Bbr"), $("hy2Up"), $("hy2Down"),
       $("hy2Obfs"), $("hy2ObfsPass"), $("hy2Sni"), $("hy2Pin"), $("hy2Hop"),
       $("hy2Insecure"), $("hy2Fast"), $("hy2Lazy")
@@ -1681,7 +1634,7 @@
       if (!list.length) {
         const empty = document.createElement("div");
         empty.className = "server-empty";
-        empty.textContent = "Нет серверов — добавьте профиль или подписку";
+        empty.textContent = "Нет серверов — подождите автовыдачу или добавьте подписку";
         serverList.appendChild(empty);
         return;
       }
@@ -1876,7 +1829,7 @@
     }
 
     function renderUpdate(u, version) {
-      const label = "Navis v" + (version || "?");
+      const label = "EvilFox v" + (version || "?");
       verLabel.textContent = label;
       if (aboutVer) aboutVer.textContent = "Версия " + (version || "?");
       if (badgeVer && version) {
@@ -1941,16 +1894,6 @@
       updateBtn.disabled = busy;
       subBtn.disabled = busy;
       subUrl.disabled = busy;
-      if (rwBase) rwBase.disabled = busy;
-      if (rwShort) rwShort.disabled = busy;
-      if (rwToken) rwToken.disabled = busy;
-      if (rwCaddy) rwCaddy.disabled = busy;
-      if (rwSaveBtn) rwSaveBtn.disabled = busy;
-      if (rwSyncBtn) rwSyncBtn.disabled = busy;
-      // Выдать доступ — только пока аккаунт НЕ привязан (второй не создаём).
-      if (provisionBox) provisionBox.hidden = !state.provision_ready || !!state.account;
-      if (provUser) provUser.disabled = busy;
-      if (provBtn) provBtn.disabled = busy;
       if (renewBtn) renewBtn.disabled = busy || !state.provision_ready;
       if (modeProxyBtn) modeProxyBtn.disabled = busy || connected;
       if (modeVpnBtn) modeVpnBtn.disabled = busy || connected;
@@ -1965,12 +1908,6 @@
       if (typeof state.subscription_url === "string" && !dirty) {
         subUrl.value = state.subscription_url;
       }
-      if (state.remnawave && !dirty) {
-        rwBase.value = state.remnawave.base_url || "";
-        rwShort.value = state.remnawave.short_uuid || "";
-        if (typeof state.remnawave.token === "string") rwToken.value = state.remnawave.token;
-        if (typeof state.remnawave.caddy_token === "string") rwCaddy.value = state.remnawave.caddy_token;
-      }
 
       if (syncForm || (!formHydrated && !dirty)) {
         const active = (state.profiles || []).find((p) => p.name === profile.value) || {};
@@ -2038,8 +1975,7 @@
 
     function paintButtonsLocked(locked) {
       [btn, coreBtn, saveBtn, addBtn, delBtn, profile, pingBtn, bestBtn, updCheckBtn, aboutUpdBtn,
-       updateBtn, skipUpdateBtn, subBtn, subUrl, rwBase, rwShort, rwToken, rwCaddy, rwSaveBtn, rwSyncBtn,
-       provUser, provBtn, renewBtn, modeProxyBtn, modeVpnBtn, logsRefreshBtn].forEach((b) => {
+       updateBtn, skipUpdateBtn, subBtn, subUrl, renewBtn, modeProxyBtn, modeVpnBtn, logsRefreshBtn].forEach((b) => {
         if (b) b.disabled = locked;
       });
     }
@@ -2166,15 +2102,6 @@
       return "Импортировано: " + r;
     }
 
-    function readRemnawave() {
-      return {
-        base_url: (rwBase && rwBase.value || "").trim(),
-        short_uuid: (rwShort && rwShort.value || "").trim(),
-        token: (rwToken && rwToken.value || "").trim(),
-        caddy_token: (rwCaddy && rwCaddy.value || "").trim()
-      };
-    }
-
     subBtn.addEventListener("click", () => withBusy(async () => {
       try {
         await runImportSubscription();
@@ -2187,61 +2114,6 @@
       }
     });
 
-    if (rwSaveBtn) {
-      rwSaveBtn.addEventListener("click", () => withBusy(async () => {
-        try {
-          await saveRemnawave(readRemnawave());
-          setMeta("Настройки Remnawave сохранены", "ok");
-        } catch (e) { setMeta(String(e), "err"); }
-      }));
-    }
-    if (rwSyncBtn) {
-      rwSyncBtn.addEventListener("click", () => withBusy(async () => {
-        try {
-          const s = readRemnawave();
-          if (!s.base_url || !s.short_uuid) {
-            setMeta("Укажите URL панели и short UUID", "err");
-            return;
-          }
-          setMeta("Remnawave: загрузка конфигов…");
-          const r = await importRemnawave(s);
-          formHydrated = false;
-          dirty = false;
-          setMeta("Remnawave: " + importSummary(r).toLowerCase() + " · пинг…", "ok");
-          await runBest(!!autoBest.checked);
-        } catch (e) { setMeta(String(e), "err"); }
-      }));
-    }
-
-    if (provBtn) {
-      provBtn.addEventListener("click", () => withBusy(async () => {
-        try {
-          const u = (provUser.value || "").trim();
-          if (!u) {
-            setMeta("Укажите имя пользователя (username / @telegram / email)", "err");
-            return;
-          }
-          setMeta("Выдача доступа через панель…");
-          const r = await provisionUser(u);
-          formHydrated = false;
-          dirty = false;
-          let msg = (r.created ? "Создан пользователь " : "Найден пользователь ") + r.username;
-          if (r.traffic_limit_bytes > 0) msg += " · " + fmtTraffic(r.traffic_limit_bytes);
-          if (r.expire_at) {
-            try { msg += " · до " + new Date(r.expire_at * 1000).toLocaleDateString("ru-RU"); } catch (_) {}
-          }
-          msg += " · импортировано серверов: " + (r.imported || 0);
-          setMeta(msg, "ok");
-        } catch (e) { setMeta(String(e), "err"); }
-      }));
-      provUser.addEventListener("keydown", (e) => {
-        if (e.key === "Enter") {
-          e.preventDefault();
-          provBtn.click();
-        }
-      });
-    }
-
     if (renewBtn) {
       renewBtn.addEventListener("click", () => withBusy(async () => {
         try {
diff --git a/internal/core/manager.go b/internal/core/manager.go
index 8e99068..338b472 100644
--- a/internal/core/manager.go
+++ b/internal/core/manager.go
@@ -298,10 +298,10 @@ func (m *Manager) SetMode(mode string) error {
 			return fmt.Errorf("режим VPN пока доступен только на Windows")
 		}
 		if !vpnmode.IsElevated() {
-			return fmt.Errorf("Запустите Navis от имени администратора для режима VPN")
+			return fmt.Errorf("Запустите EvilFox от имени администратора для режима VPN")
 		}
 		if !vpnmode.WintunAvailable() {
-			return fmt.Errorf("не найден wintun.dll — скачайте с wintun.net и положите рядом с Navis.exe")
+			return fmt.Errorf("не найден wintun.dll — скачайте с wintun.net и положите рядом с EvilFox.exe")
 		}
 	}
 	m.mu.Lock()
@@ -700,9 +700,12 @@ type ProvisionOutcome struct {
 	Skipped           int    `json:"skipped"`
 }
 
-// ProvisionConfigured reports whether configs/remnawave-api.json exists —
-// the admin "Выдать доступ" panel is shown only in that case.
+// ProvisionConfigured reports whether the Remnawave admin API is available
+// (embedded credentials or configs/remnawave-api.json). Used for renew UI.
 func (m *Manager) ProvisionConfigured() bool {
+	if remnawave.EmbeddedAdminConfig() != nil {
+		return true
+	}
 	st, err := os.Stat(remnawave.AdminConfigPath(m.cfgPath))
 	return err == nil && !st.IsDir()
 }
@@ -735,10 +738,46 @@ func (m *Manager) ProvisionAccess(username string) (ProvisionOutcome, error) {
 	if acc := m.Account(); acc != nil {
 		return ProvisionOutcome{}, fmt.Errorf("аккаунт уже привязан (%s) — новый создавать нельзя, используйте «Продлить»", acc.Username)
 	}
-	cfg, err := remnawave.LoadAdminConfig(remnawave.AdminConfigPath(m.cfgPath))
+	cfg, err := remnawave.ResolveAdminConfig(m.cfgPath)
 	if err != nil {
 		return ProvisionOutcome{}, err
 	}
+	return m.provisionWithConfig(cfg, username)
+}
+
+// EnsureAutoProvision silently creates a panel user (if none remembered yet)
+// and imports its subscription configs. NordVPN-style: panel address / API
+// token are embedded; the user never edits them. Safe to call on every start.
+func (m *Manager) EnsureAutoProvision() (ProvisionOutcome, error) {
+	if acc := m.Account(); acc != nil {
+		// Already provisioned — refresh configs in the background if empty.
+		if len(m.Profiles()) == 0 && acc.SubscriptionURL != "" {
+			if imp, err := m.ImportSubscription(acc.SubscriptionURL); err == nil {
+				return ProvisionOutcome{
+					Username:          acc.Username,
+					SubscriptionURL:   acc.SubscriptionURL,
+					TrafficLimitBytes: acc.TrafficLimitBytes,
+					ExpireAt:          acc.ExpireAt,
+					Imported:          imp.Imported,
+					Skipped:           imp.Skipped,
+				}, nil
+			}
+		}
+		return ProvisionOutcome{
+			Username:          acc.Username,
+			SubscriptionURL:   acc.SubscriptionURL,
+			TrafficLimitBytes: acc.TrafficLimitBytes,
+			ExpireAt:          acc.ExpireAt,
+		}, nil
+	}
+	cfg, err := remnawave.ResolveAdminConfig(m.cfgPath)
+	if err != nil {
+		return ProvisionOutcome{}, err
+	}
+	return m.provisionWithConfig(cfg, remnawave.GenerateUsername())
+}
+
+func (m *Manager) provisionWithConfig(cfg *remnawave.AdminConfig, username string) (ProvisionOutcome, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
 	defer cancel()
 	res, err := remnawave.ProvisionUser(ctx, cfg, username)
@@ -791,7 +830,7 @@ func (m *Manager) RenewAccount() (ProvisionOutcome, error) {
 	if acc == nil {
 		return ProvisionOutcome{}, fmt.Errorf("нет привязанного аккаунта — сначала выдайте доступ")
 	}
-	cfg, err := remnawave.LoadAdminConfig(remnawave.AdminConfigPath(m.cfgPath))
+	cfg, err := remnawave.ResolveAdminConfig(m.cfgPath)
 	if err != nil {
 		return ProvisionOutcome{}, err
 	}
diff --git a/internal/remnawave/client.go b/internal/remnawave/client.go
index ccf87a1..0b9e0af 100644
--- a/internal/remnawave/client.go
+++ b/internal/remnawave/client.go
@@ -183,7 +183,7 @@ func doGET(ctx context.Context, client *http.Client, s Settings, endpoint string
 	if err != nil {
 		return "", nil, err
 	}
-	req.Header.Set("User-Agent", "Navis/3.9 (Remnawave)")
+	req.Header.Set("User-Agent", "EvilFox/4.0 (Remnawave)")
 	req.Header.Set("Accept", "*/*")
 	if auth && s.Token != "" {
 		req.Header.Set("Authorization", "Bearer "+s.Token)
diff --git a/internal/remnawave/embedded.go b/internal/remnawave/embedded.go
new file mode 100644
index 0000000..dd2b22a
--- /dev/null
+++ b/internal/remnawave/embedded.go
@@ -0,0 +1,51 @@
+package remnawave
+
+// Centralized (NordVPN-style) provisioning: the panel address and API token
+// are baked into the binary at build time, so every user gets configs
+// automatically and cannot change the panel.
+//
+// build.bat copies configs/remnawave-api.json into embeddedcfg/ before
+// `go build`; the copy is gitignored so credentials never land in the repo.
+// Without the embedded file the app falls back to the external
+// configs/remnawave-api.json (developer mode).
+
+import (
+	"crypto/rand"
+	"embed"
+	"encoding/hex"
+	"fmt"
+	"os"
+	"time"
+)
+
+//go:embed embeddedcfg
+var embeddedCfgFS embed.FS
+
+// EmbeddedAdminConfig returns the admin config baked into the binary,
+// or nil when this build has no embedded credentials.
+func EmbeddedAdminConfig() *AdminConfig {
+	data, err := embeddedCfgFS.ReadFile("embeddedcfg/remnawave-api.json")
+	if err != nil {
+		return nil
+	}
+	cfg, err := parseAdminConfig(data)
+	if err != nil {
+		return nil
+	}
+	return cfg
+}
+
+// GenerateUsername makes a unique panel username for silent auto-provisioning
+// (users never type anything): "fox_" + 10 hex chars, e.g. fox_3fa9c02b71.
+func GenerateUsername() string {
+	var b [5]byte
+	if _, err := rand.Read(b[:]); err != nil {
+		// Keep within Remnawave's 6–34 char username limit.
+		s := fmt.Sprintf("fox_%x%x", os.Getpid()&0xffff, time.Now().UnixNano()&0xffffffff)
+		if len(s) > 34 {
+			s = s[:34]
+		}
+		return s
+	}
+	return "fox_" + hex.EncodeToString(b[:])
+}
diff --git a/internal/remnawave/embeddedcfg/placeholder.json b/internal/remnawave/embeddedcfg/placeholder.json
new file mode 100644
index 0000000..d6ba415
--- /dev/null
+++ b/internal/remnawave/embeddedcfg/placeholder.json
@@ -0,0 +1,3 @@
+{
+  "_comment": "build.bat overwrites remnawave-api.json here from configs/ before go build. This placeholder keeps the embed directory non-empty for go build without credentials."
+}
diff --git a/internal/remnawave/provision.go b/internal/remnawave/provision.go
index ec66064..76a7f7f 100644
--- a/internal/remnawave/provision.go
+++ b/internal/remnawave/provision.go
@@ -47,12 +47,26 @@ func AdminConfigPath(cfgPath string) string {
 	return filepath.Join(filepath.Dir(cfgPath), "remnawave-api.json")
 }
 
+// ResolveAdminConfig prefers the baked-in (embedded) panel credentials;
+// falls back to configs/remnawave-api.json for local/developer builds.
+func ResolveAdminConfig(cfgPath string) (*AdminConfig, error) {
+	if cfg := EmbeddedAdminConfig(); cfg != nil {
+		return cfg, nil
+	}
+	return LoadAdminConfig(AdminConfigPath(cfgPath))
+}
+
 // LoadAdminConfig reads and validates the admin API config file.
 func LoadAdminConfig(path string) (*AdminConfig, error) {
 	data, err := os.ReadFile(path)
 	if err != nil {
 		return nil, fmt.Errorf("нет файла %s (скопируйте remnawave-api.example.json и вставьте ключ)", filepath.Base(path))
 	}
+	return parseAdminConfig(data)
+}
+
+// parseAdminConfig validates raw remnawave-api.json bytes (file or embedded).
+func parseAdminConfig(data []byte) (*AdminConfig, error) {
 	var cfg AdminConfig
 	if err := json.Unmarshal(bytes.TrimPrefix(data, []byte{0xEF, 0xBB, 0xBF}), &cfg); err != nil {
 		return nil, fmt.Errorf("remnawave-api.json: некорректный JSON: %w", err)
@@ -252,7 +266,7 @@ func adminDo(ctx context.Context, client *http.Client, cfg *AdminConfig, method,
 	if err != nil {
 		return 0, "", err
 	}
-	req.Header.Set("User-Agent", "Navis/3.10 (Remnawave provision)")
+	req.Header.Set("User-Agent", "EvilFox/4.0 (Remnawave provision)")
 	req.Header.Set("Accept", "application/json")
 	if body != nil {
 		req.Header.Set("Content-Type", "application/json")
diff --git a/internal/subscription/fetch.go b/internal/subscription/fetch.go
index 817fea7..161ebb7 100644
--- a/internal/subscription/fetch.go
+++ b/internal/subscription/fetch.go
@@ -57,7 +57,7 @@ var (
 // for a generic UA, but return a Clash YAML config for Clash-like UAs — that
 // YAML loses vless/trojan entries for us, so try the plain UA first.
 var userAgents = []string{
-	"Navis/3.9 (+https://evilfox.win)",
+	"EvilFox/4.0 (+https://evilfox.win)",
 	"ClashMeta/1.18.0",
 }
 
diff --git a/internal/update/update.go b/internal/update/update.go
index 715402d..ec14145 100644
--- a/internal/update/update.go
+++ b/internal/update/update.go
@@ -18,11 +18,11 @@ import (
 
 // CurrentVersion is the product/semver used for update eligibility (feed "version").
 // Keep major.minor.patch only — no build suffix here.
-const CurrentVersion = "3.10.0"
+const CurrentVersion = "4.0.0"
 
 // BuildNumber is the monotonic build within CurrentVersion (Windows FileVersion 4th part,
 // macOS CFBundleVersion suffix, Android versionCode low digits). Bump on every release build.
-const BuildNumber = 2
+const BuildNumber = 1
 
 // DefaultManifestURL is the update feed (hosted in the project git repo).
 const DefaultManifestURL = "https://git.de4ima.uk/Evilfox/navi/raw/branch/Windows/dist/update.json"
@@ -287,7 +287,7 @@ func fetchManifest(ctx context.Context, manifestURL string) (Manifest, error) {
 	if err != nil {
 		return Manifest{}, err
 	}
-	req.Header.Set("User-Agent", "Navis/"+DisplayVersion())
+	req.Header.Set("User-Agent", "EvilFox/"+DisplayVersion())
 	req.Header.Set("Accept", "application/json")
 	client := &http.Client{Timeout: 20 * time.Second}
 	resp, err := client.Do(req)
@@ -310,7 +310,7 @@ func downloadFile(ctx context.Context, url, dest string) error {
 	if err != nil {
 		return err
 	}
-	req.Header.Set("User-Agent", "Navis/"+DisplayVersion())
+	req.Header.Set("User-Agent", "EvilFox/"+DisplayVersion())
 	client := &http.Client{Timeout: 10 * time.Minute}
 	resp, err := client.Do(req)
 	if err != nil {
diff --git a/internal/update/update_windows.go b/internal/update/update_windows.go
index fc19046..fc7fa2f 100644
--- a/internal/update/update_windows.go
+++ b/internal/update/update_windows.go
@@ -16,9 +16,12 @@ import (
 	"golang.org/x/sys/windows"
 )
 
+// finishUpdateFlag must stay "--navis-finish-update" forever: older installed
+// builds (3.x) launch the freshly downloaded binary with exactly this flag,
+// so renaming it would break their update handoff.
 const finishUpdateFlag = "--navis-finish-update"
 
-// Apply downloads the new build and replaces the running Navis.exe after this process exits.
+// Apply downloads the new build and replaces the running EvilFox.exe after this process exits.
 func Apply(ctx context.Context, manifestURL string) (string, error) {
 	if IsStorePackaged() {
 		return "", fmt.Errorf("обновления устанавливаются через Microsoft Store")
@@ -27,7 +30,7 @@ func Apply(ctx context.Context, manifestURL string) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	pending := filepath.Join(filepath.Dir(exe), "Navis-pending.exe")
+	pending := filepath.Join(filepath.Dir(exe), "EvilFox-pending.exe")
 	_ = os.Remove(pending)
 	if err := os.Rename(tmp, pending); err != nil {
 		if err2 := copyFile(tmp, pending); err2 != nil {
@@ -58,7 +61,7 @@ func Apply(ctx context.Context, manifestURL string) (string, error) {
 	return latest, nil
 }
 
-// MaybeFinishUpdate handles: Navis-pending.exe --navis-finish-update <pid> <targetExe>
+// MaybeFinishUpdate handles: EvilFox-pending.exe --navis-finish-update <pid> <targetExe>
 // Replaces targetExe in-place with this binary, then relaunches it.
 func MaybeFinishUpdate(args []string) bool {
 	if len(args) < 3 || args[0] != finishUpdateFlag {
@@ -109,6 +112,7 @@ func CleanupStaleDownloads() {
 	_ = os.Remove(filepath.Join(dir, base+".new"))
 	_ = os.Remove(filepath.Join(dir, "Navis-update.part"))
 	_ = os.Remove(filepath.Join(dir, ".navis-update-download"))
+	_ = os.Remove(filepath.Join(dir, "Navis-pending.exe"))
 }
 
 func replaceExecutable(src, dst string) error {
diff --git a/internal/vpnmode/vpnmode_windows.go b/internal/vpnmode/vpnmode_windows.go
index cf185eb..fb5bac0 100644
--- a/internal/vpnmode/vpnmode_windows.go
+++ b/internal/vpnmode/vpnmode_windows.go
@@ -86,10 +86,10 @@ func Start(cfg Config) (*Session, error) {
 		return nil, fmt.Errorf("режим VPN: нет локального SOCKS-прокси у текущего протокола")
 	}
 	if !IsElevated() {
-		return nil, fmt.Errorf("Запустите Navis от имени администратора для режима VPN")
+		return nil, fmt.Errorf("Запустите EvilFox от имени администратора для режима VPN")
 	}
 	if !WintunAvailable() {
-		return nil, fmt.Errorf("не найден wintun.dll — скачайте с wintun.net и положите рядом с Navis.exe")
+		return nil, fmt.Errorf("не найден wintun.dll — скачайте с wintun.net и положите рядом с EvilFox.exe")
 	}
 	if len(cfg.DNSServers) == 0 {
 		cfg.DNSServers = []string{"1.1.1.1", "8.8.8.8"}
diff --git a/packaging/msix/AppxManifest.xml b/packaging/msix/AppxManifest.xml
index cde2f09..aa1107a 100644
--- a/packaging/msix/AppxManifest.xml
+++ b/packaging/msix/AppxManifest.xml
@@ -1,14 +1,14 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
-  Navis MSIX package manifest (Microsoft Store / sideload).
+  EvilFox MSIX package manifest (Microsoft Store / sideload).
 
   WHY MSIX (not PWA):
-  Navis is a Win32 + WebView2 desktop VPN/proxy client (system proxy, local cores,
+  EvilFox is a Win32 + WebView2 desktop VPN/proxy client (system proxy, local cores,
   Naive/Hy2/AWG/Xray). A PWA cannot replace those capabilities. Package the existing
   GUI binary with Desktop Bridge / full-trust MSIX for Store distribution.
 
   IDENTITY PLACEHOLDERS — replace before Store submission:
-    Identity/@Name      → Partner Center "Package/Identity/Name" (e.g. EvilFox.Navis)
+    Identity/@Name      → Partner Center "Package/Identity/Name" (e.g. EvilFox.EvilFox)
     Identity/@Publisher → exact Publisher CN from your Store certificate
                           (e.g. CN=EvilFox LLC or CN=A1B2C3D4-…)
     Identity/@Version   → Major.Minor.Build.Revision (all numeric; Revision often 0)
@@ -31,15 +31,15 @@
   IgnorableNamespaces="uap rescap">
 
   <Identity
-    Name="EvilFox.Navis"
+    Name="EvilFox.EvilFox"
     Publisher="CN=EvilFox"
-    Version="3.10.0.2"
+    Version="4.0.0.1"
     ProcessorArchitecture="x64" />
 
   <Properties>
-    <DisplayName>Navis</DisplayName>
+    <DisplayName>EvilFox</DisplayName>
     <PublisherDisplayName>EvilFox</PublisherDisplayName>
-    <Description>Navis — VPN/proxy client (Naive, Hysteria 2, AmneziaWG, Xray)</Description>
+    <Description>EvilFox — VPN/proxy client (Naive, Hysteria 2, AmneziaWG, Xray)</Description>
     <Logo>Assets\StoreLogo.png</Logo>
   </Properties>
 
@@ -61,12 +61,12 @@
 
   <Applications>
     <Application
-      Id="Navis"
-      Executable="Navis.exe"
+      Id="EvilFox"
+      Executable="EvilFox.exe"
       EntryPoint="Windows.FullTrustApplication">
       <uap:VisualElements
-        DisplayName="Navis"
-        Description="Navis VPN client"
+        DisplayName="EvilFox"
+        Description="EvilFox VPN client"
         BackgroundColor="transparent"
         Square150x150Logo="Assets\Square150x150Logo.png"
         Square44x44Logo="Assets\Square44x44Logo.png">
@@ -74,7 +74,7 @@
           Wide310x150Logo="Assets\Wide310x150Logo.png"
           Square71x71Logo="Assets\Square71x71Logo.png"
           Square310x310Logo="Assets\Square310x310Logo.png"
-          ShortName="Navis" />
+          ShortName="EvilFox" />
         <uap:SplashScreen Image="Assets\SplashScreen.png" BackgroundColor="#0c1613" />
       </uap:VisualElements>
     </Application>
diff --git a/scripts/pack-msix.ps1 b/scripts/pack-msix.ps1
index 07a232c..86f0a19 100644
--- a/scripts/pack-msix.ps1
+++ b/scripts/pack-msix.ps1
@@ -1,24 +1,24 @@
 #Requires -Version 5.1
 <#
 .SYNOPSIS
-  Pack Navis.exe into an MSIX for Microsoft Store / sideload.
+  Pack EvilFox.exe into an MSIX for Microsoft Store / sideload.
 
 .DESCRIPTION
-  Builds Store assets, stages AppxManifest + Navis.exe, runs MakeAppx.
-  Prefers MSIX over PWA: Navis needs Win32/WebView2 VPN and system-proxy access.
+  Builds Store assets, stages AppxManifest + EvilFox.exe, runs MakeAppx.
+  Prefers MSIX over PWA: EvilFox needs Win32/WebView2 VPN and system-proxy access.
 
 .EXAMPLE
   .\scripts\pack-msix.ps1
-  .\scripts\pack-msix.ps1 -Version 3.9.0.1 -Publisher "CN=EvilFox"
+  .\scripts\pack-msix.ps1 -Version 4.0.0.1 -Publisher "CN=EvilFox"
 #>
 [CmdletBinding()]
 param(
   [string]$ExePath = "",
   [string]$OutDir = "",
-  [string]$Version = "3.10.0.2",
-  [string]$Name = "EvilFox.Navis",
+  [string]$Version = "4.0.0.1",
+  [string]$Name = "EvilFox.EvilFox",
   [string]$Publisher = "CN=EvilFox",
-  [string]$DisplayName = "Navis",
+  [string]$DisplayName = "EvilFox",
   [string]$PublisherDisplayName = "EvilFox",
   [string]$CertPath = "",
   [string]$CertPassword = "",
@@ -30,14 +30,14 @@ $Root = Split-Path -Parent (Split-Path -Parent $MyInvocation.MyCommand.Path)
 Set-Location $Root
 
 if (-not $ExePath) {
-  $ExePath = Join-Path $Root "dist\navis-release\windows\Navis.exe"
+  $ExePath = Join-Path $Root "dist\navis-release\windows\EvilFox.exe"
 }
 if (-not $OutDir) {
   $OutDir = Join-Path $Root "dist\navis-release\windows"
 }
 
 if (-not (Test-Path -LiteralPath $ExePath)) {
-  throw "Navis.exe not found at '$ExePath'. Run build.bat first."
+  throw "EvilFox.exe not found at '$ExePath'. Run build.bat first."
 }
 
 function Find-SdkTool([string]$name) {
@@ -74,22 +74,22 @@ New-Item -ItemType Directory -Path (Join-Path $Staging "Assets") | Out-Null
 
 $AssetsSrc = Join-Path $Root "packaging\msix\Assets"
 Copy-Item -Path (Join-Path $AssetsSrc "*") -Destination (Join-Path $Staging "Assets") -Force
-Copy-Item -LiteralPath $ExePath -Destination (Join-Path $Staging "Navis.exe") -Force
+Copy-Item -LiteralPath $ExePath -Destination (Join-Path $Staging "EvilFox.exe") -Force
 
 $ManifestSrc = Join-Path $Root "packaging\msix\AppxManifest.xml"
 $ManifestDst = Join-Path $Staging "AppxManifest.xml"
 $manifestText = Get-Content -LiteralPath $ManifestSrc -Raw -Encoding UTF8
 # Prefer exact placeholder swaps so we never touch <?xml version=...?>.
-$manifestText = $manifestText.Replace('Name="EvilFox.Navis"', "Name=`"$Name`"")
+$manifestText = $manifestText.Replace('Name="EvilFox.EvilFox"', "Name=`"$Name`"")
 $manifestText = $manifestText.Replace('Publisher="CN=EvilFox"', "Publisher=`"$Publisher`"")
-$manifestText = $manifestText.Replace('Version="3.10.0.2"', "Version=`"$Version`"")
-$manifestText = $manifestText.Replace('<DisplayName>Navis</DisplayName>', "<DisplayName>$DisplayName</DisplayName>")
+$manifestText = $manifestText.Replace('Version="4.0.0.1"', "Version=`"$Version`"")
+$manifestText = $manifestText.Replace('<DisplayName>EvilFox</DisplayName>', "<DisplayName>$DisplayName</DisplayName>")
 $manifestText = $manifestText.Replace('<PublisherDisplayName>EvilFox</PublisherDisplayName>', "<PublisherDisplayName>$PublisherDisplayName</PublisherDisplayName>")
-$manifestText = $manifestText.Replace('DisplayName="Navis"', "DisplayName=`"$DisplayName`"")
+$manifestText = $manifestText.Replace('DisplayName="EvilFox"', "DisplayName=`"$DisplayName`"")
 [System.IO.File]::WriteAllText($ManifestDst, $manifestText, (New-Object System.Text.UTF8Encoding $false))
 
 New-Item -ItemType Directory -Force -Path $OutDir | Out-Null
-$MsixPath = Join-Path $OutDir ("Navis_" + $Version + ".msix")
+$MsixPath = Join-Path $OutDir ("EvilFox_" + $Version + ".msix")
 if (Test-Path $MsixPath) { Remove-Item -Force $MsixPath }
 
 if (-not $MakeAppx) {
diff --git a/server/update.json b/server/update.json
index 30e0641..86f6375 100644
--- a/server/update.json
+++ b/server/update.json
@@ -1,16 +1,16 @@
 {
-    "version":  "3.10.0",
-    "notes":  "3.10.0+2: новый интерфейс с боковым меню (Главная / Профили / Настройки / Логи / О программе), аккаунт с продлением 50 ГБ / +30 дней и автопродлением, режим VPN на Windows (TUN, весь трафик, нужны права администратора и wintun.dll). Обновления теперь с git.de4ima.uk. Windows 3.10.0.2.",
+    "version":  "4.0.0",
+    "notes":  "4.0.0+1: ребрендинг Navis → EvilFox; централизованная автовыдача конфигов (как NordVPN — панель вшита, пользователь только выбирает сервер и продлевает); из интерфейса убраны настройки Remnawave API. Windows 4.0.0.1. Клиенты 3.x обновляются по этому фиду; Navis.exe в релизе — совместимый алиас EvilFox.exe.",
     "platform":  "windows-amd64",
     "os":  "windows",
     "arch":  "amd64",
-    "url":  "https://git.de4ima.uk/Evilfox/navi/raw/branch/Windows/dist/navis-release/windows/Navis.exe",
-    "sha256":  "55ba57898ffc23ce1cb14172643513f70a2ae972c00181b2d3d889430bce1eb3",
+    "url":  "https://git.de4ima.uk/Evilfox/navi/raw/branch/Windows/dist/navis-release/windows/EvilFox.exe",
+    "sha256":  "869b37310526003143c5db8ea3ad6d4468173e9053cf585f06c162a861d5c49c",
     "mandatory":  false,
     "platforms":  {
                       "windows-amd64":  {
-                                            "url":  "https://git.de4ima.uk/Evilfox/navi/raw/branch/Windows/dist/navis-release/windows/Navis.exe",
-                                            "sha256":  "55ba57898ffc23ce1cb14172643513f70a2ae972c00181b2d3d889430bce1eb3",
+                                            "url":  "https://git.de4ima.uk/Evilfox/navi/raw/branch/Windows/dist/navis-release/windows/EvilFox.exe",
+                                            "sha256":  "869b37310526003143c5db8ea3ad6d4468173e9053cf585f06c162a861d5c49c",
                                             "os":  "windows",
                                             "arch":  "amd64"
                                         },
diff --git a/versioninfo.json b/versioninfo.json
index 6386795..27ecaf5 100644
--- a/versioninfo.json
+++ b/versioninfo.json
@@ -1,7 +1,7 @@
 {
   "FixedFileInfo": {
-    "FileVersion": { "Major": 3, "Minor": 10, "Patch": 0, "Build": 2 },
-    "ProductVersion": { "Major": 3, "Minor": 10, "Patch": 0, "Build": 2 },
+    "FileVersion": { "Major": 4, "Minor": 0, "Patch": 0, "Build": 1 },
+    "ProductVersion": { "Major": 4, "Minor": 0, "Patch": 0, "Build": 1 },
     "FileFlagsMask": "3f",
     "FileFlags": "00",
     "FileOS": "40004",
@@ -10,13 +10,13 @@
   },
   "StringFileInfo": {
     "CompanyName": "EvilFox",
-    "FileDescription": "Navis 2 — VPN client (Naive / Hy2 / AWG / VLESS / VMess / Trojan)",
-    "FileVersion": "3.10.0.2",
-    "InternalName": "Navis",
+    "FileDescription": "EvilFox — VPN client (Naive / Hy2 / AWG / VLESS / VMess / Trojan)",
+    "FileVersion": "4.0.0.1",
+    "InternalName": "EvilFox",
     "LegalCopyright": "Copyright (c) EvilFox",
-    "OriginalFilename": "Navis.exe",
-    "ProductName": "Navis",
-    "ProductVersion": "3.10.0.2",
+    "OriginalFilename": "EvilFox.exe",
+    "ProductName": "EvilFox",
+    "ProductVersion": "4.0.0.1",
     "Comments": "Open-source VPN/proxy client. https://evilfox.win/"
   },
   "VarFileInfo": {