diff --git a/.github/workflows/vulnerabilities-check.yml b/.github/workflows/vulnerabilities-check.yml
index a4c7a7e06c..d5cf9db31d 100644
--- a/.github/workflows/vulnerabilities-check.yml
+++ b/.github/workflows/vulnerabilities-check.yml
@@ -35,6 +35,8 @@ jobs:
 
       # Run OWASP dependency check plugin
       - name: Gradle Dependency Check
+        env:
+          NVD_API_KEY: ${{ secrets.NIST_APIKEY }}
         run: |
           ./gradlew dependencyCheckAggregate
 
diff --git a/build.gradle b/build.gradle
index 577f7e1596..bc6801098b 100644
--- a/build.gradle
+++ b/build.gradle
@@ -331,6 +331,8 @@ dependencyCheck {
 
     // configure a suppression file
     suppressionFile = "$projectDir/owasp-dependency-suppressions.xml"
+
+    nvd.apiKey = System.getenv("NVD_API_KEY")
 }
 
 /**********************************************************************************************************************\
diff --git a/core/src/main/java/io/kestra/core/models/Label.java b/core/src/main/java/io/kestra/core/models/Label.java
index bd2fbd8359..aa4be51534 100644
--- a/core/src/main/java/io/kestra/core/models/Label.java
+++ b/core/src/main/java/io/kestra/core/models/Label.java
@@ -9,4 +9,5 @@ public record Label(@NotNull String key, @NotNull String value) {
     public static final String CORRELATION_ID = SYSTEM_PREFIX + "correlationId";
     public static final String USERNAME = SYSTEM_PREFIX + "username";
     public static final String APP = SYSTEM_PREFIX + "app";
+    public static final String READ_ONLY = SYSTEM_PREFIX + "readOnly";
 }
diff --git a/core/src/main/java/io/kestra/core/models/executions/Execution.java b/core/src/main/java/io/kestra/core/models/executions/Execution.java
index 89407f5933..18ddade573 100644
--- a/core/src/main/java/io/kestra/core/models/executions/Execution.java
+++ b/core/src/main/java/io/kestra/core/models/executions/Execution.java
@@ -20,6 +20,7 @@
 import io.kestra.core.runners.RunContextLogger;
 import io.kestra.core.serializers.ListOrMapOfLabelDeserializer;
 import io.kestra.core.serializers.ListOrMapOfLabelSerializer;
+import io.kestra.core.services.LabelService;
 import io.kestra.core.utils.IdUtils;
 import io.kestra.core.utils.MapUtils;
 import io.micronaut.core.annotation.Nullable;
@@ -39,8 +40,6 @@
 import java.util.stream.Stream;
 import java.util.zip.CRC32;
 
-import static io.kestra.core.models.Label.SYSTEM_PREFIX;
-
 @Builder(toBuilder = true)
 @Slf4j
 @Getter
@@ -143,10 +142,7 @@ public static Execution newExecution(final Flow flow,
             .scheduleDate(scheduleDate.map(ChronoZonedDateTime::toInstant).orElse(null))
             .build();
 
-        List<Label> executionLabels = new ArrayList<>();
-        if (flow.getLabels() != null) {
-            executionLabels.addAll(flow.getLabels());
-        }
+        List<Label> executionLabels = new ArrayList<>(LabelService.labelsExcludingSystem(flow));
 
         if (labels != null) {
             executionLabels.addAll(labels);
@@ -162,6 +158,8 @@ public static Execution newExecution(final Flow flow,
         return execution;
     }
 
+
+
     public static class ExecutionBuilder {
         void prebuild() {
             this.originalId = this.id;
@@ -181,12 +179,6 @@ public Execution build() {
             this.prebuild();
             return super.build();
         }
-
-        @Override
-        public ExecutionBuilder labels(List<Label> labels) {
-            checkForSystemLabels(labels);
-            return super.labels(labels);
-        }
     }
 
     public Execution withState(State.Type state) {
@@ -212,53 +204,9 @@ public Execution withState(State.Type state) {
         );
     }
 
-    /**
-     * This method replaces labels with new ones.
-     * It refuses system labels as they must be passed via the withSystemLabels method.
-     */
     public Execution withLabels(List<Label> labels) {
-        checkForSystemLabels(labels);
-
-        return new Execution(
-            this.tenantId,
-            this.id,
-            this.namespace,
-            this.flowId,
-            this.flowRevision,
-            this.taskRunList,
-            this.inputs,
-            this.outputs,
-            labels,
-            this.variables,
-            this.state,
-            this.parentId,
-            this.originalId,
-            this.trigger,
-            this.deleted,
-            this.metadata,
-            this.scheduleDate,
-            this.error
-        );
-    }
 
-    private static void checkForSystemLabels(List<Label> labels) {
-        if (labels != null) {
-            Optional<Label> first = labels.stream().filter(label -> label.key() != null && label.key().startsWith(SYSTEM_PREFIX)).findFirst();
-            if (first.isPresent()) {
-                throw new IllegalArgumentException("System labels can only be set by Kestra itself, offending label: " + first.get().key() + "=" + first.get().value());
-            }
-        }
-    }
 
-    /**
-     * This method in <b>only to be used</b> to add system labels to an execution.
-     * It will not replace exisiting labels but add new one (possibly duplicating).
-     */
-    public Execution withSystemLabels(List<Label> labels) {
-        List<Label> newLabels = this.labels == null ? new ArrayList<>() : this.labels;
-        if (labels != null) {
-            newLabels.addAll(labels);
-        }
         return new Execution(
             this.tenantId,
             this.id,
@@ -268,7 +216,7 @@ public Execution withSystemLabels(List<Label> labels) {
             this.taskRunList,
             this.inputs,
             this.outputs,
-            newLabels,
+            labels,
             this.variables,
             this.state,
             this.parentId,
diff --git a/core/src/main/java/io/kestra/core/runners/ExecutableUtils.java b/core/src/main/java/io/kestra/core/runners/ExecutableUtils.java
index af5aaac76c..46d086ab4b 100644
--- a/core/src/main/java/io/kestra/core/runners/ExecutableUtils.java
+++ b/core/src/main/java/io/kestra/core/runners/ExecutableUtils.java
@@ -94,11 +94,14 @@ public static <T extends Task & ExecutableTask<?>> SubflowExecution<?> subflowEx
         );
 
         // propagate system labels and compute correlation ID if not already existing
-        List<Label> systemLabels = Streams.of(currentExecution.getLabels())
+        List<Label> newLabels = Streams.of(currentExecution.getLabels())
             .filter(label -> label.key().startsWith(Label.SYSTEM_PREFIX))
             .collect(Collectors.toList());
-        if (systemLabels.stream().noneMatch(label -> label.key().equals(Label.CORRELATION_ID))) {
-            systemLabels.add(new Label(Label.CORRELATION_ID, currentExecution.getId()));
+        if (newLabels.stream().noneMatch(label -> label.key().equals(Label.CORRELATION_ID))) {
+            newLabels.add(new Label(Label.CORRELATION_ID, currentExecution.getId()));
+        }
+        if (labels != null) {
+            newLabels.addAll(labels);
         }
 
         FlowInputOutput flowInputOutput = ((DefaultRunContext)runContext).getApplicationContext().getBean(FlowInputOutput.class);
@@ -107,7 +110,7 @@ public static <T extends Task & ExecutableTask<?>> SubflowExecution<?> subflowEx
             .newExecution(
                 flow,
                 (f, e) -> flowInputOutput.readExecutionInputs(f, e, inputs),
-                labels,
+                newLabels,
                 Optional.empty())
             .withTrigger(ExecutionTrigger.builder()
                 .id(currentTask.getId())
@@ -115,8 +118,7 @@ public static <T extends Task & ExecutableTask<?>> SubflowExecution<?> subflowEx
                 .variables(variables)
                 .build()
             )
-            .withScheduleDate(scheduleOnDate)
-            .withSystemLabels(systemLabels);
+            .withScheduleDate(scheduleOnDate);
         return SubflowExecution.builder()
             .parentTask(currentTask)
             .parentTaskRun(currentTaskRun.withState(State.Type.RUNNING))
diff --git a/core/src/main/java/io/kestra/core/runners/Worker.java b/core/src/main/java/io/kestra/core/runners/Worker.java
index 03c1308ab1..c3e1bb3dd7 100644
--- a/core/src/main/java/io/kestra/core/runners/Worker.java
+++ b/core/src/main/java/io/kestra/core/runners/Worker.java
@@ -19,6 +19,7 @@
 import io.kestra.core.server.ServerConfig;
 import io.kestra.core.server.Service;
 import io.kestra.core.server.ServiceStateChangeEvent;
+import io.kestra.core.services.LabelService;
 import io.kestra.core.services.LogService;
 import io.kestra.core.services.WorkerGroupService;
 import io.kestra.core.utils.Await;
@@ -361,11 +362,11 @@ private void publishTriggerExecution(WorkerTrigger workerTrigger, Optional<Execu
             );
         }
 
-        var flowLabels = workerTrigger.getConditionContext().getFlow().getLabels();
-        if (flowLabels != null) {
+        var flow = workerTrigger.getConditionContext().getFlow();
+        if (flow.getLabels() != null) {
             evaluate = evaluate.map(execution -> {
                     List<Label> executionLabels = execution.getLabels() != null ? execution.getLabels() : new ArrayList<>();
-                    executionLabels.addAll(flowLabels);
+                    executionLabels.addAll(LabelService.labelsExcludingSystem(flow));
                     return execution.withLabels(executionLabels);
                 }
             );
diff --git a/core/src/main/java/io/kestra/core/schedulers/AbstractScheduler.java b/core/src/main/java/io/kestra/core/schedulers/AbstractScheduler.java
index 73e16b2ff9..c5106e2826 100644
--- a/core/src/main/java/io/kestra/core/schedulers/AbstractScheduler.java
+++ b/core/src/main/java/io/kestra/core/schedulers/AbstractScheduler.java
@@ -564,7 +564,7 @@ private void handle() {
                             .namespace(f.getTriggerContext().getNamespace())
                             .flowId(f.getTriggerContext().getFlowId())
                             .flowRevision(f.getFlow().getRevision())
-                            .labels(f.getFlow().getLabels())
+                            .labels(LabelService.labelsExcludingSystem(f.getFlow()))
                             .state(new State().withState(State.Type.FAILED))
                             .error(ExecutionError.from(ie))
                             .build();
diff --git a/core/src/main/java/io/kestra/core/services/LabelService.java b/core/src/main/java/io/kestra/core/services/LabelService.java
new file mode 100644
index 0000000000..f47456df84
--- /dev/null
+++ b/core/src/main/java/io/kestra/core/services/LabelService.java
@@ -0,0 +1,56 @@
+package io.kestra.core.services;
+
+import io.kestra.core.exceptions.IllegalVariableEvaluationException;
+import io.kestra.core.models.Label;
+import io.kestra.core.models.flows.Flow;
+import io.kestra.core.models.triggers.AbstractTrigger;
+import io.kestra.core.runners.RunContext;
+import io.kestra.core.utils.ListUtils;
+
+import java.util.ArrayList;
+import java.util.List;
+
+public final class LabelService {
+    private LabelService() {}
+
+    /**
+     * Return flow labels excluding system labels.
+     */
+    public static List<Label> labelsExcludingSystem(Flow flow) {
+        return ListUtils.emptyOnNull(flow.getLabels()).stream().filter(label -> !label.key().startsWith(Label.SYSTEM_PREFIX)).toList();
+    }
+
+    /**
+     * Return flow labels excluding system labels concatenated with trigger labels.
+     *
+     * Trigger labels will be rendered via the run context but not flow labels.
+     * In case rendering is not possible, the label will be omitted.
+     */
+    public static List<Label> fromTrigger(RunContext runContext, Flow flow, AbstractTrigger trigger) {
+        final List<Label> labels = new ArrayList<>();
+
+        if (flow.getLabels() != null) {
+            labels.addAll(LabelService.labelsExcludingSystem(flow)); // no need for rendering
+        }
+
+        if (trigger.getLabels() != null) {
+            for (Label label : trigger.getLabels()) {
+                final var value = renderLabelValue(runContext, label);
+                if (value != null) {
+                    labels.add(new Label(label.key(), value));
+                }
+            }
+        }
+
+        return labels;
+    }
+
+    private static String renderLabelValue(RunContext runContext, Label label) {
+        try {
+            return runContext.render(label.value());
+        } catch (IllegalVariableEvaluationException e) {
+            runContext.logger().warn("Failed to render label '{}', it will be omitted", label.key(), e);
+            return null;
+        }
+    }
+}
diff --git a/core/src/main/java/io/kestra/core/validations/validator/FlowValidator.java b/core/src/main/java/io/kestra/core/validations/validator/FlowValidator.java
index c6fd1964a6..382bca0c54 100644
--- a/core/src/main/java/io/kestra/core/validations/validator/FlowValidator.java
+++ b/core/src/main/java/io/kestra/core/validations/validator/FlowValidator.java
@@ -24,6 +24,7 @@
 import java.util.Optional;
 import java.util.Set;
 
+import static io.kestra.core.models.Label.READ_ONLY;
 import static io.kestra.core.models.Label.SYSTEM_PREFIX;
 
 @Singleton
@@ -79,7 +80,7 @@ public boolean isValid(
 
         // system labels
         ListUtils.emptyOnNull(value.getLabels()).stream()
-            .filter(label -> label.key() != null && label.key().startsWith(SYSTEM_PREFIX))
+            .filter(label -> label.key() != null && label.key().startsWith(SYSTEM_PREFIX) && !label.key().equals(READ_ONLY))
             .forEach(label -> violations.add("System labels can only be set by Kestra itself, offending label: " + label.key() + "=" + label.value()));
 
         if (!violations.isEmpty()) {
diff --git a/core/src/main/java/io/kestra/plugin/core/execution/Labels.java b/core/src/main/java/io/kestra/plugin/core/execution/Labels.java
index aa0b1d50e7..7b8b866997 100644
--- a/core/src/main/java/io/kestra/plugin/core/execution/Labels.java
+++ b/core/src/main/java/io/kestra/plugin/core/execution/Labels.java
@@ -26,6 +26,7 @@
 import java.util.Optional;
 import java.util.stream.Collectors;
 
+import static io.kestra.core.models.Label.SYSTEM_PREFIX;
 import static io.kestra.core.utils.Rethrow.throwBiConsumer;
 import static io.kestra.core.utils.Rethrow.throwFunction;
 
@@ -35,7 +36,8 @@
 @Getter
 @NoArgsConstructor
 @Schema(
-    title = "Allow to add or overwrite labels for the current execution at runtime."
+    title = "Allow to add or overwrite labels for the current execution at runtime.",
+    description = "Trying to pass a system label (a label starting with `system_`) will fail the task."
 )
 @Plugin(
     examples = {
@@ -131,11 +133,17 @@ public Execution update(Execution execution, RunContext runContext) throws Excep
                 );
             }));
 
+            // check for system labels: none can be passed at runtime
+            Optional<Map.Entry<String, String>> first = newLabels.entrySet().stream().filter(entry -> entry.getKey().startsWith(SYSTEM_PREFIX)).findFirst();
+            if (first.isPresent()) {
+                throw new IllegalArgumentException("System labels can only be set by Kestra itself, offending label: " + first.get().getKey() + "=" + first.get().getValue());
+            }
+
             return execution.withLabels(newLabels.entrySet().stream()
-                    .map(throwFunction(entry -> new Label(
+                    .map(entry -> new Label(
                         entry.getKey(),
                         entry.getValue()
-                    )))
+                    ))
                     .toList());
         } else {
             throw new IllegalVariableEvaluationException("Unknown value type: " + labels.getClass());
diff --git a/core/src/main/java/io/kestra/plugin/core/trigger/Flow.java b/core/src/main/java/io/kestra/plugin/core/trigger/Flow.java
index 13c1e37ad4..63ddd0f62f 100644
--- a/core/src/main/java/io/kestra/plugin/core/trigger/Flow.java
+++ b/core/src/main/java/io/kestra/plugin/core/trigger/Flow.java
@@ -4,6 +4,7 @@
 import io.kestra.core.models.Label;
 import io.kestra.core.models.annotations.PluginProperty;
 import io.kestra.core.models.property.Property;
+import io.kestra.core.services.LabelService;
 import io.swagger.v3.oas.annotations.media.Schema;
 import java.util.ArrayList;
 import java.util.List;
@@ -60,7 +61,7 @@
                 outputs:
                   - id: last_ingested_date
                     type: STRING
-                    value: "{{ outputs.final_date.value }}"            
+                    value: "{{ outputs.final_date.value }}"
                 ```
                 Below is the `transform` flow triggered in response to the `extract` flow's successful completion.""",
             code = """
@@ -74,7 +75,7 @@
 
                 variables:
                   result: |
-                    Ingestion done in {{ trigger.executionId }}. 
+                    Ingestion done in {{ trigger.executionId }}.
                     Now transforming data up to {{ inputs.last_ingested_date }}
 
                 tasks:
@@ -144,7 +145,7 @@ public Optional<Execution> evaluate(RunContext runContext, io.kestra.core.models
             .namespace(flow.getNamespace())
             .flowId(flow.getId())
             .flowRevision(flow.getRevision())
-            .labels(generateLabels(runContext, flow))
+            .labels(LabelService.fromTrigger(runContext, flow, this))
             .state(new State())
             .trigger(ExecutionTrigger.of(
                 this,
@@ -181,34 +182,6 @@ public Optional<Execution> evaluate(RunContext runContext, io.kestra.core.models
         }
     }
 
-    private List<Label> generateLabels(RunContext runContext, io.kestra.core.models.flows.Flow flow) {
-        final List<Label> labels = new ArrayList<>();
-
-        if (flow.getLabels() != null) {
-            labels.addAll(flow.getLabels()); // no need for rendering
-        }
-
-        if (this.getLabels() != null) {
-            for (Label label : this.getLabels()) {
-                final var value = renderLabelValue(runContext, label);
-                if (value != null) {
-                    labels.add(new Label(label.key(), value));
-                }
-            }
-        }
-
-        return labels;
-    }
-
-    private String renderLabelValue(RunContext runContext, Label label) {
-        try {
-            return runContext.render(label.value());
-        } catch (IllegalVariableEvaluationException e) {
-            runContext.logger().warn("Failed to render label '{}', it will be omitted", label.key(), e);
-            return null;
-        }
-    }
-
     @Builder
     @ToString
     @EqualsAndHashCode
diff --git a/core/src/main/java/io/kestra/plugin/core/trigger/Schedule.java b/core/src/main/java/io/kestra/plugin/core/trigger/Schedule.java
index cb125ef39a..1a348e03ae 100644
--- a/core/src/main/java/io/kestra/plugin/core/trigger/Schedule.java
+++ b/core/src/main/java/io/kestra/plugin/core/trigger/Schedule.java
@@ -20,6 +20,7 @@
 import io.kestra.core.runners.DefaultRunContext;
 import io.kestra.core.runners.RunContext;
 import io.kestra.core.services.ConditionService;
+import io.kestra.core.services.LabelService;
 import io.kestra.core.utils.ListUtils;
 import io.kestra.core.validations.ScheduleValidation;
 import io.kestra.core.validations.TimezoneId;
@@ -425,11 +426,7 @@ public Cron parseCron() {
     }
 
     private List<Label> generateLabels(RunContext runContext, ConditionContext conditionContext, Backfill backfill) throws IllegalVariableEvaluationException {
-        List<Label> labels = new ArrayList<>();
-
-        if (conditionContext.getFlow().getLabels() != null) {
-            labels.addAll(conditionContext.getFlow().getLabels()); // no need for rendering
-        }
+        List<Label> labels = LabelService.fromTrigger(runContext, conditionContext.getFlow(), this);
 
         if (backfill != null && backfill.getLabels() != null) {
             for (Label label : backfill.getLabels()) {
@@ -440,15 +437,6 @@ private List<Label> generateLabels(RunContext runContext, ConditionContext condi
             }
         }
 
-        if (this.getLabels() != null) {
-            for (Label label : this.getLabels()) {
-                final var value = runContext.render(label.value());
-                if (value != null) {
-                    labels.add(new Label(label.key(), value));
-                }
-            }
-        }
-
         return labels;
     }
 
diff --git a/core/src/main/java/io/kestra/plugin/core/trigger/ScheduleOnDates.java b/core/src/main/java/io/kestra/plugin/core/trigger/ScheduleOnDates.java
index 46ae73d66f..675aa9d5ff 100644
--- a/core/src/main/java/io/kestra/plugin/core/trigger/ScheduleOnDates.java
+++ b/core/src/main/java/io/kestra/plugin/core/trigger/ScheduleOnDates.java
@@ -10,6 +10,7 @@
 import io.kestra.core.models.tasks.VoidOutput;
 import io.kestra.core.models.triggers.*;
 import io.kestra.core.runners.RunContext;
+import io.kestra.core.services.LabelService;
 import io.kestra.core.validations.TimezoneId;
 import io.swagger.v3.oas.annotations.media.Schema;
 import jakarta.validation.constraints.NotNull;
@@ -83,7 +84,7 @@ public Optional<Execution> evaluate(ConditionContext conditionContext, TriggerCo
                 this,
                 conditionContext,
                 triggerContext,
-                generateLabels(runContext, conditionContext),
+                LabelService.fromTrigger(runContext, conditionContext.getFlow(), this),
                 this.inputs != null ? runContext.render(this.inputs) : Collections.emptyMap(),
                 Collections.emptyMap(),
                 nextDate
@@ -132,23 +133,4 @@ private Optional<ZonedDateTime> nextDate(RunContext runContext, Predicate<ZonedD
             .findFirst()
             .map(date -> date.truncatedTo(ChronoUnit.SECONDS));
     }
-
-    private List<Label> generateLabels(RunContext runContext, ConditionContext conditionContext) throws IllegalVariableEvaluationException {
-        List<Label> labels = new ArrayList<>();
-
-        if (conditionContext.getFlow().getLabels() != null) {
-            labels.addAll(conditionContext.getFlow().getLabels()); // no need for rendering
-        }
-
-        if (this.getLabels() != null) {
-            for (Label label : this.getLabels()) {
-                final var value = runContext.render(label.value());
-                if (value != null) {
-                    labels.add(new Label(label.key(), value));
-                }
-            }
-        }
-
-        return labels;
-    }
 }
diff --git a/core/src/test/java/io/kestra/core/serializers/YamlFlowParserTest.java b/core/src/test/java/io/kestra/core/serializers/YamlFlowParserTest.java
index 216ed2b519..94ee3db6a2 100644
--- a/core/src/test/java/io/kestra/core/serializers/YamlFlowParserTest.java
+++ b/core/src/test/java/io/kestra/core/serializers/YamlFlowParserTest.java
@@ -167,7 +167,7 @@ void serialization() throws IOException {
         Flow flow = this.parse("flows/valids/minimal.yaml");
 
         String s = mapper.writeValueAsString(flow);
-        assertThat(s, is("{\"id\":\"minimal\",\"namespace\":\"io.kestra.tests\",\"revision\":2,\"disabled\":false,\"deleted\":false,\"tasks\":[{\"id\":\"date\",\"type\":\"io.kestra.plugin.core.debug.Return\",\"format\":\"{{taskrun.startDate}}\"}]}"));
+        assertThat(s, is("{\"id\":\"minimal\",\"namespace\":\"io.kestra.tests\",\"revision\":2,\"disabled\":false,\"deleted\":false,\"labels\":[{\"key\":\"system_readOnly\",\"value\":\"true\"}],\"tasks\":[{\"id\":\"date\",\"type\":\"io.kestra.plugin.core.debug.Return\",\"format\":\"{{taskrun.startDate}}\"}]}"));
     }
 
     @Test
diff --git a/core/src/test/java/io/kestra/core/services/LabelServiceTest.java b/core/src/test/java/io/kestra/core/services/LabelServiceTest.java
new file mode 100644
index 0000000000..cb28162e87
--- /dev/null
+++ b/core/src/test/java/io/kestra/core/services/LabelServiceTest.java
@@ -0,0 +1,68 @@
+package io.kestra.core.services;
+
+import io.kestra.core.junit.annotations.KestraTest;
+import io.kestra.core.models.Label;
+import io.kestra.core.models.flows.Flow;
+import io.kestra.core.models.triggers.AbstractTrigger;
+import io.kestra.core.runners.RunContext;
+import io.kestra.core.runners.RunContextFactory;
+import io.kestra.plugin.core.trigger.Schedule;
+import jakarta.inject.Inject;
+import org.junit.jupiter.api.Test;
+
+import java.util.List;
+import java.util.Map;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.*;
+
+@KestraTest
+class LabelServiceTest {
+
+    @Inject
+    private RunContextFactory runContextFactory;
+
+    @Test
+    void shouldFilterSystemLabels() {
+        Flow flow = Flow.builder()
+            .labels(List.of(new Label("key", "value"), new Label("system_Label", "systemValue")))
+            .build();
+
+        List<Label> labels = LabelService.labelsExcludingSystem(flow);
+
+        assertThat(labels, hasSize(1));
+        assertThat(labels.getFirst(), is(new Label("key", "value")));
+    }
+
+    @Test
+    void shouldReturnLabelsFromFlowAndTrigger() {
+        RunContext runContext = runContextFactory.of(Map.of("variable", "variableValue"));
+        Flow flow = Flow.builder()
+            .labels(List.of(new Label("key", "value"), new Label("system_Label", "systemValue")))
+            .build();
+        AbstractTrigger trigger = Schedule.builder()
+            .labels(List.of(new Label("scheduleLabel", "scheduleValue"), new Label("variable", "{{variable}}")))
+            .build();
+
+        List<Label> labels = LabelService.fromTrigger(runContext, flow, trigger);
+
+        assertThat(labels, hasSize(3));
+        assertThat(labels, hasItems(new Label("key", "value"), new Label("scheduleLabel", "scheduleValue"), new Label("variable", "variableValue")));
+    }
+
+    @Test
+    void shouldFilterNonRenderableLabels() {
+        RunContext runContext = runContextFactory.of();
+        Flow flow = Flow.builder()
+            .labels(List.of(new Label("key", "value"), new Label("system_Label", "systemValue")))
+            .build();
+        AbstractTrigger trigger = Schedule.builder()
+            .labels(List.of(new Label("scheduleLabel", "scheduleValue"), new Label("variable", "{{variable}}")))
+            .build();
+
+        List<Label> labels = LabelService.fromTrigger(runContext, flow, trigger);
+
+        assertThat(labels, hasSize(2));
+        assertThat(labels, hasItems(new Label("key", "value"), new Label("scheduleLabel", "scheduleValue")));
+    }
+}
\ No newline at end of file
diff --git a/core/src/test/java/io/kestra/core/validations/FlowValidationTest.java b/core/src/test/java/io/kestra/core/validations/FlowValidationTest.java
index 316898cfd5..b92f343f4b 100644
--- a/core/src/test/java/io/kestra/core/validations/FlowValidationTest.java
+++ b/core/src/test/java/io/kestra/core/validations/FlowValidationTest.java
@@ -43,6 +43,14 @@ void systemLabelShouldFailValidation() {
         assertThat(validate.get().getMessage(), containsString("System labels can only be set by Kestra itself, offending label: system_id=id"));
     }
 
+    @Test
+    void validFlowShouldSucceed() {
+        Flow flow = this.parse("flows/valids/minimal.yaml");
+        Optional<ConstraintViolationException> validate = modelValidator.isValid(flow);
+
+        assertThat(validate.isPresent(), is(false));
+    }
+
     private Flow parse(String path) {
         URL resource = TestsUtils.class.getClassLoader().getResource(path);
         assert resource != null;
diff --git a/core/src/test/resources/flows/valids/minimal.yaml b/core/src/test/resources/flows/valids/minimal.yaml
index 63d787f5ea..c8e99bfbf8 100644
--- a/core/src/test/resources/flows/valids/minimal.yaml
+++ b/core/src/test/resources/flows/valids/minimal.yaml
@@ -2,6 +2,9 @@ id: minimal
 namespace: io.kestra.tests
 revision: 2
 
+labels:
+  system_readOnly: "true"
+
 tasks:
 - id: date
   type: io.kestra.plugin.core.debug.Return
diff --git a/jdbc/src/main/java/io/kestra/jdbc/runner/JdbcExecutor.java b/jdbc/src/main/java/io/kestra/jdbc/runner/JdbcExecutor.java
index 167c34af3d..3f9d215a0b 100644
--- a/jdbc/src/main/java/io/kestra/jdbc/runner/JdbcExecutor.java
+++ b/jdbc/src/main/java/io/kestra/jdbc/runner/JdbcExecutor.java
@@ -258,19 +258,24 @@ public void run() {
                     flow = either.getLeft();
                 }
 
-                flowTopologyRepository.save(
-                    flow,
-                    (flow.isDeleted() ?
-                        Stream.<FlowTopology>empty() :
-                        flowTopologyService
-                            .topology(
-                                flow,
-                                this.allFlows
-                            )
-                    )
-                        .distinct()
-                        .toList()
-                );
+                try {
+                    flowTopologyRepository.save(
+                        flow,
+                        (flow.isDeleted() ?
+                            Stream.<FlowTopology>empty() :
+                            flowTopologyService
+                                .topology(
+                                    flow,
+                                    this.allFlows
+                                )
+                        )
+                            .distinct()
+                            .toList()
+                    );
+                } catch (Exception e) {
+                    log.error("Unable to save flow topology", e);
+                }
+
             }
         ));
         setState(ServiceState.RUNNING);
diff --git a/platform/build.gradle b/platform/build.gradle
index 9d23b678f6..405627f9f5 100644
--- a/platform/build.gradle
+++ b/platform/build.gradle
@@ -25,6 +25,8 @@ dependencies {
 
     // as Jackson is in the Micronaut BOM, to force it's version we need to use enforcedPlatform
     api enforcedPlatform("com.fasterxml.jackson:jackson-bom:2.18.0")
+    // needed because httpclient fails to communicate with docker socket with > v5.4 (https://github.com/docker-java/docker-java/pull/2293#issuecomment-2435455322) and opensearch-java brings that version
+    api enforcedPlatform("org.apache.httpcomponents.client5:httpclient5:5.3.1")
     api platform("io.micronaut.platform:micronaut-platform:4.6.3")
     api platform("io.qameta.allure:allure-bom:2.29.0")
 
diff --git a/ui/src/assets/documentations/basic.md b/ui/src/assets/documentations/basic.md
index bba03e2496..26b4d0e16a 100644
--- a/ui/src/assets/documentations/basic.md
+++ b/ui/src/assets/documentations/basic.md
@@ -146,7 +146,9 @@ The table below lists common Pebble expressions and functions.
 | `{{ secret('MY_SECRET') }}`                                                                        | Retrieves secret `MY_SECRET`.                                                                                                   |
 | `{{ namespace.myproject.myvariable }}`                                                             | Accesses namespace variable `myproject.myvariable`.                                                                             |
 | `{{ outputs.taskId.outputAttribute }}`                                                             | Accesses task output attribute.                                                                                                 |
-| `{{ error.taskId }}`                                                                               | In case of failure, accesses the task identifier of the task that fail.                                                         |
+| `{{ error.taskId }}`                                                                               | In case of failure, accesses the task identifier of the last task that fail.                                                    |
+| `{{ error.message }}`                                                                              | In case of failure, accesses the last error message.                                                                            |
+| `{{ error.stackTrace }}`                                                                               | In case of failure, accesses the last error stack trace.                                                                        |
 | `{{ range(0, 3) }}`                                                                                | Generates a list from 0 to 3.                                                                                                   |
 | `{{ block("post") }}`                                                                              | Renders the contents of the ["post" block](https://kestra.io/docs/concepts/expression/function#block).                          |
 | `{{ currentEachOutput(outputs.first) }}`                                                           | Retrieves the current output of a sibling task.                                                                                 |
diff --git a/ui/src/components/admin/Triggers.vue b/ui/src/components/admin/Triggers.vue
index 62a4d8439c..090cb714d1 100644
--- a/ui/src/components/admin/Triggers.vue
+++ b/ui/src/components/admin/Triggers.vue
@@ -80,12 +80,14 @@
                             </bulk-select>
                         </template>
                         <el-table-column
+                            v-if="visibleColumns.triggerId"
                             prop="triggerId"
                             sortable="custom"
                             :sort-orders="['ascending', 'descending']"
                             :label="$t('id')"
                         />
                         <el-table-column
+                            v-if="visibleColumns.flowId"
                             prop="flowId"
                             sortable="custom"
                             :sort-orders="['ascending', 'descending']"
@@ -105,6 +107,7 @@
                             </template>
                         </el-table-column>
                         <el-table-column
+                            v-if="visibleColumns.namespace"
                             prop="namespace"
                             sortable="custom"
                             :sort-orders="['ascending', 'descending']"
@@ -115,7 +118,7 @@
                             </template>
                         </el-table-column>
 
-                        <el-table-column :label="$t('current execution')">
+                        <el-table-column v-if="visibleColumns.executionId" :label="$t('current execution')">
                             <template #default="scope">
                                 <router-link
                                     v-if="scope.row.executionId"
@@ -126,7 +129,7 @@
                             </template>
                         </el-table-column>
 
-                        <el-table-column :label="$t('state')">
+                        <el-table-column v-if="visibleColumns.executionCurrentState" :label="$t('state')">
                             <template #default="scope">
                                 <status
                                     v-if="scope.row.executionCurrentState"
@@ -135,7 +138,7 @@
                                 />
                             </template>
                         </el-table-column>
-                        <el-table-column prop="workerId" :label="$t('workerId')">
+                        <el-table-column v-if="visibleColumns.workerId" prop="workerId" :label="$t('workerId')">
                             <template #default="scope">
                                 <id
                                     :value="scope.row.workerId"
@@ -143,22 +146,22 @@
                                 />
                             </template>
                         </el-table-column>
-                        <el-table-column :label="$t('date')">
+                        <el-table-column v-if="visibleColumns.date" :label="$t('date')">
                             <template #default="scope">
                                 <date-ago :inverted="true" :date="scope.row.date" />
                             </template>
                         </el-table-column>
-                        <el-table-column :label="$t('updated date')">
+                        <el-table-column v-if="visibleColumns.updatedDate" :label="$t('updated date')">
                             <template #default="scope">
                                 <date-ago :inverted="true" :date="scope.row.updatedDate" />
                             </template>
                         </el-table-column>
-                        <el-table-column :label="$t('next execution date')">
+                        <el-table-column v-if="visibleColumns.nextExecutionDate" :label="$t('next execution date')">
                             <template #default="scope">
                                 <date-ago :inverted="true" :date="scope.row.nextExecutionDate" />
                             </template>
                         </el-table-column>
-                        <el-table-column :label="$t('evaluation lock date')">
+                        <el-table-column v-if="visibleColumns.evaluateRunningDate" :label="$t('evaluation lock date')">
                             <template #default="scope">
                                 <date-ago :inverted="true" :date="scope.row.evaluateRunningDate" />
                             </template>
@@ -475,6 +478,25 @@
 
                 const disabled = this.state === "DISABLED" ? true : false;
                 return all.filter(trigger => trigger.disabled === disabled);
+            },
+            visibleColumns() {
+                const columns = [
+                    {prop: "triggerId", label: this.$t("id")},
+                    {prop: "flowId", label: this.$t("flow")},
+                    {prop: "namespace", label: this.$t("namespace")},
+                    {prop: "executionId", label: this.$t("current execution")},
+                    {prop: "executionCurrentState", label: this.$t("state")},
+                    {prop: "workerId", label: this.$t("workerId")},
+                    {prop: "date", label: this.$t("date")},
+                    {prop: "updatedDate", label: this.$t("updated date")},
+                    {prop: "nextExecutionDate", label: this.$t("next execution date")},
+                    {prop: "evaluateRunningDate", label: this.$t("evaluation lock date")},
+                ];
+
+                return columns.reduce((acc, column) => {
+                    acc[column.prop] = this.triggersMerged.some(trigger => trigger[column.prop]);
+                    return acc;
+                }, {});
             }
         }
     };
diff --git a/ui/src/components/executions/Gantt.vue b/ui/src/components/executions/Gantt.vue
index 4bead67ba9..dcb1fda32b 100644
--- a/ui/src/components/executions/Gantt.vue
+++ b/ui/src/components/executions/Gantt.vue
@@ -378,7 +378,6 @@
 
                     small {
                         margin-left: 5px;
-                        color: var(--bs-gray-600);
                         font-family: var(--bs-font-monospace);
                         font-size: var(--font-size-xs)
                     }
diff --git a/ui/src/components/executions/TaskRunLine.vue b/ui/src/components/executions/TaskRunLine.vue
index 8b3e986dca..a14a94ad98 100644
--- a/ui/src/components/executions/TaskRunLine.vue
+++ b/ui/src/components/executions/TaskRunLine.vue
@@ -366,7 +366,6 @@
         }
 
         small {
-            color: var(--bs-gray-600);
             font-family: var(--bs-font-monospace);
             font-size: var(--font-size-xs)
         }
diff --git a/ui/src/components/flows/FlowRoot.vue b/ui/src/components/flows/FlowRoot.vue
index 8ec70be30b..520bd00af0 100644
--- a/ui/src/components/flows/FlowRoot.vue
+++ b/ui/src/components/flows/FlowRoot.vue
@@ -167,7 +167,7 @@
                         containerClass: "full-container",
                         props: {
                             expandedSubflows: this.expandedSubflows,
-                            isReadOnly: this.deleted || !this.isAllowedEdit,
+                            isReadOnly: this.deleted || !this.isAllowedEdit || this.readOnlySystemLabel,
                         },
                     });
                 }
@@ -327,6 +327,13 @@
                     this.flow.namespace,
                 );
             },
+            readOnlySystemLabel() {
+                if (!this.flow) {
+                    return false;
+                }
+
+                return this.flow.labels?.system_readOnly === "true" ?? false;
+            },
             routeFlowDependencies() {
                 return this.dependenciesCount > 0 ? FlowDependencies : FlowNoDependencies;
             }
diff --git a/ui/src/components/flows/ValidationError.vue b/ui/src/components/flows/ValidationError.vue
index 62d4ce7dea..3f41b3645f 100644
--- a/ui/src/components/flows/ValidationError.vue
+++ b/ui/src/components/flows/ValidationError.vue
@@ -54,8 +54,11 @@
                             {{ $t("warning detected") }}
                         </span>
                     </el-header>
-                    <el-main>{{ warnings.join("\n") }}</el-main>
-                    <el-main v-if="infos">{{ infos.join("\n") }}</el-main>
+                    <el-main>
+                        {{ warnings.join("\n") }}
+                        <br v-if="infos">
+                        {{ infos?.join("\n") }}
+                    </el-main>
                 </el-container>
             </template>
             <el-button v-bind="$attrs" :link="link" :size="size" type="default" class="warning">
@@ -84,7 +87,7 @@
                             {{ $t("informative notice") }}
                         </span>
                     </el-header>
-                    <el-main>{{ infos.join("\n") }}</el-main>
+                    <el-main>{{ infos.join("<\n") }}</el-main>
                 </el-container>
             </template>
             <el-button v-bind="$attrs" :link="link" :size="size" type="default" class="info">
diff --git a/ui/src/components/inputs/EditorView.vue b/ui/src/components/inputs/EditorView.vue
index c8d3950bd1..8edd714f40 100644
--- a/ui/src/components/inputs/EditorView.vue
+++ b/ui/src/components/inputs/EditorView.vue
@@ -178,7 +178,8 @@
 
     const flowInfos = computed(() => {
         if (isFlow()) {
-            return props.flowValidation?.infos;
+            const infos = props.flowValidation?.infos  ?? [];
+            return infos.length === 0 ? undefined : infos;
         }
 
         return undefined;
diff --git a/ui/src/components/inputs/MonacoEditor.vue b/ui/src/components/inputs/MonacoEditor.vue
index e44a14a4be..bd3273fe15 100644
--- a/ui/src/components/inputs/MonacoEditor.vue
+++ b/ui/src/components/inputs/MonacoEditor.vue
@@ -548,7 +548,7 @@
                     autocompletions = ["id", "type"];
                     break;
                 case "error":
-                    autocompletions = ["taskId"];
+                    autocompletions = ["taskId", "message", "stackTrace"];
                     break;
                 default: {
                     let match = field.match(/^outputs\.([^.]+)$/);
diff --git a/ui/src/components/settings/BasicSettings.vue b/ui/src/components/settings/BasicSettings.vue
index 31ecfb791e..84805ae18d 100644
--- a/ui/src/components/settings/BasicSettings.vue
+++ b/ui/src/components/settings/BasicSettings.vue
@@ -6,15 +6,15 @@
             <template #content>
                 <Row>
                     <Column v-if="allowDefaultNamespace" :label="$t('settings.blocks.configuration.fields.default_namespace')">
-                        <namespace-select data-type="flow" :value="defaultNamespace" @update:model-value="onNamespaceSelect" />
+                        <namespace-select data-type="flow" :value="pendingSettings.defaultNamespace" @update:model-value="onNamespaceSelect" />
                     </Column>
 
                     <Column :label="$t('settings.blocks.configuration.fields.log_level')">
-                        <log-level-selector clearable :value="defaultLogLevel" @update:model-value="onLevelChange" />
+                        <log-level-selector clearable :value="pendingSettings.defaultLogLevel" @update:model-value="onLevelChange" />
                     </Column>
 
                     <Column :label="$t('settings.blocks.configuration.fields.log_display')">
-                        <el-select :model-value="logDisplay" @update:model-value="onLogDisplayChange">
+                        <el-select :model-value="pendingSettings.logDisplay" @update:model-value="onLogDisplayChange">
                             <el-option
                                 v-for="item in logDisplayOptions"
                                 :key="item.value"
@@ -25,7 +25,7 @@
                     </Column>
 
                     <Column :label="$t('settings.blocks.configuration.fields.execute_flow')">
-                        <el-select :model-value="executeFlowBehaviour" @update:model-value="onExecuteFlowBehaviourChange">
+                        <el-select :model-value="pendingSettings.executeFlowBehaviour" @update:model-value="onExecuteFlowBehaviourChange">
                             <el-option
                                 v-for="item in Object.values(executeFlowBehaviours)"
                                 :key="item"
@@ -42,7 +42,7 @@
             <template #content>
                 <Row>
                     <Column :label="$t('settings.blocks.theme.fields.mode')">
-                        <el-select :model-value="theme" @update:model-value="onTheme">
+                        <el-select :model-value="pendingSettings.theme" @update:model-value="onTheme">
                             <el-option
                                 v-for="item in themesOptions"
                                 :key="item.value"
@@ -53,7 +53,7 @@
                     </Column>
 
                     <Column :label="$t('settings.blocks.theme.fields.chart_color_scheme.label')">
-                        <el-select :model-value="chartColor" @update:model-value="onChartColor">
+                        <el-select :model-value="pendingSettings.chartColor" @update:model-value="onChartColor">
                             <el-option
                                 v-for="item in [
                                     {value: 'classic', text: $t('settings.blocks.theme.fields.chart_color_scheme.classic')},
@@ -69,7 +69,7 @@
 
                 <Row>
                     <Column :label="$t('settings.blocks.theme.fields.editor_theme')">
-                        <el-select :model-value="editorTheme" @update:model-value="onEditorTheme">
+                        <el-select :model-value="pendingSettings.editorTheme" @update:model-value="onEditorTheme">
                             <el-option
                                 v-for="item in editorThemesOptions"
                                 :key="item.value"
@@ -81,7 +81,7 @@
 
                     <Column :label="$t('settings.blocks.theme.fields.editor_font_size')">
                         <el-input-number
-                            :model-value="editorFontSize"
+                            :model-value="pendingSettings.editorFontSize"
                             @update:model-value="onFontSize"
                             controls-position="right"
                             :min="1"
@@ -90,7 +90,7 @@
                     </Column>
 
                     <Column :label="$t('settings.blocks.theme.fields.editor_font_family')">
-                        <el-select :model-value="editorFontFamily" @update:model-value="onFontFamily">
+                        <el-select :model-value="pendingSettings.editorFontFamily" @update:model-value="onFontFamily">
                             <el-option
                                 v-for="item in fontFamilyOptions"
                                 :key="item.value"
@@ -103,14 +103,14 @@
 
                 <Row>
                     <Column :overrides="{sm: 24, md: 24, lg: 24, xl: 24}" :label="$t('settings.blocks.theme.fields.editor_folding_stratgy')">
-                        <el-switch :aria-label="$t('Fold auto')" :model-value="autofoldTextEditor" @update:model-value="onAutofoldTextEditor" />
+                        <el-switch :aria-label="$t('Fold auto')" :model-value="pendingSettings.autofoldTextEditor" @update:model-value="onAutofoldTextEditor" />
                     </Column>
                 </Row>
 
                 <Row>
                     <Column :label="$t('settings.blocks.theme.fields.environment_name')">
                         <el-input
-                            v-model="envName"
+                            v-model="pendingSettings.envName"
                             @change="onEnvNameChange"
                             :placeholder="$t('name')"
                             clearable
@@ -119,7 +119,7 @@
 
                     <Column :label="$t('settings.blocks.theme.fields.environment_color')">
                         <el-color-picker
-                            v-model="envColor"
+                            v-model="pendingSettings.envColor"
                             @change="onEnvColorChange"
                             show-alpha
                         />
@@ -132,7 +132,7 @@
             <template #content>
                 <Row>
                     <Column :label="$t('settings.blocks.configuration.fields.language')">
-                        <el-select :model-value="lang" @update:model-value="onLang">
+                        <el-select :model-value="pendingSettings.lang" @update:model-value="onLang">
                             <el-option
                                 v-for="item in langOptions"
                                 :key="item.value"
@@ -143,7 +143,7 @@
                     </Column>
 
                     <Column :label="$t('settings.blocks.localization.fields.time_zone')">
-                        <el-select :model-value="timezone" @update:model-value="onTimezone" filterable>
+                        <el-select :model-value="pendingSettings.timezone" @update:model-value="onTimezone" filterable>
                             <el-option
                                 v-for="item in zonesWithOffset"
                                 :key="item.zone"
@@ -154,10 +154,10 @@
                     </Column>
 
                     <Column :label="$t('settings.blocks.localization.fields.date_format')">
-                        <el-select :model-value="dateFormat" @update:model-value="onDateFormat">
+                        <el-select :model-value="pendingSettings.dateFormat" @update:model-value="onDateFormat">
                             <el-option
                                 v-for="item in dateFormats"
-                                :key="timezone + item.value"
+                                :key="pendingSettings.timezone + item.value"
                                 :label="$filters.date(now, item.value)"
                                 :value="item.value"
                             />
@@ -183,6 +183,18 @@
                 </Row>
             </template>
         </Block>
+
+        <Block last>
+            <template #content>
+                <Row>
+                    <Column>
+                        <el-button @click="saveAllSettings()" class="w-60" type="primary">
+                            {{ $t("settings.blocks.save.fields.name") }}
+                        </el-button>
+                    </Column>
+                </Row>
+            </template>
+        </Block>
     </Wrapper>
 </template>
 
@@ -229,14 +241,29 @@
         },
         data() {
             return {
-                defaultNamespace: undefined,
-                defaultLogLevel: undefined,
-                lang: undefined,
-                theme: undefined,
-                editorTheme: undefined,
-                chartColor: undefined,
-                dateFormat: undefined,
-                timezone: undefined,
+                pendingSettings: {
+                    defaultNamespace: undefined,
+                    defaultLogLevel: undefined,
+                    lang: undefined,
+                    theme: undefined,
+                    editorTheme: undefined,
+                    chartColor: undefined,
+                    dateFormat: undefined,
+                    timezone: undefined,
+                    autofoldTextEditor: undefined,
+                    logDisplay: undefined,
+                    editorFontSize: undefined,
+                    editorFontFamily: undefined,
+                    executeFlowBehaviour: undefined,
+                    envName: undefined,
+                    envColor: undefined
+                },
+                settingsKeyMapping: {
+                    chartColor: "scheme",
+                    dateFormat: DATE_FORMAT_STORAGE_KEY,
+                    timezone: TIMEZONE_STORAGE_KEY,
+                    executeFlowBehaviour: storageKeys.EXECUTE_FLOW_BEHAVIOUR,
+                },
                 zonesWithOffset: this.$moment.tz.names().map((zone) => {
                     const timezoneMoment = this.$moment.tz(zone);
                     return {
@@ -245,70 +272,46 @@
                         formattedOffset: timezoneMoment.format("Z")
                     };
                 }).sort((a, b) => a.offset - b.offset),
-                autofoldTextEditor: undefined,
                 guidedTour: undefined,
-                logDisplay: undefined,
-                editorFontSize: undefined,
-                editorFontFamily: undefined,
-                executeFlowBehaviour: undefined,
-                now: this.$moment(),
-                envName: undefined,
-                envColor: undefined
+                now: this.$moment(), 
             };
         },
         created() {
             const darkTheme = document.getElementsByTagName("html")[0].className.indexOf("dark") >= 0;
             const store = useStore();
 
-            this.defaultNamespace = localStorage.getItem("defaultNamespace") || "";
-            this.defaultLogLevel = localStorage.getItem("defaultLogLevel") || "INFO";
-            this.lang = Utils.getLang();
-            this.theme = localStorage.getItem("theme") || "light";
-            this.editorTheme = localStorage.getItem("editorTheme") || (darkTheme ? "dark" : "vs");
-            this.chartColor = localStorage.getItem("scheme") || "default";
-            this.dateFormat = localStorage.getItem(DATE_FORMAT_STORAGE_KEY) || "llll";
-            this.timezone = localStorage.getItem(TIMEZONE_STORAGE_KEY) || this.$moment.tz.guess();
-            this.autofoldTextEditor = localStorage.getItem("autofoldTextEditor") === "true";
+            this.pendingSettings.defaultNamespace = localStorage.getItem("defaultNamespace") || "";
+            this.pendingSettings.defaultLogLevel = localStorage.getItem("defaultLogLevel") || "INFO";
+            this.pendingSettings.lang = Utils.getLang();
+            this.pendingSettings.theme = localStorage.getItem("theme") || "light";
+            this.pendingSettings.editorTheme = localStorage.getItem("editorTheme") || (darkTheme ? "dark" : "vs");
+            this.pendingSettings.chartColor = localStorage.getItem("scheme") || "default";
+            this.pendingSettings.dateFormat = localStorage.getItem(DATE_FORMAT_STORAGE_KEY) || "llll";
+            this.pendingSettings.timezone = localStorage.getItem(TIMEZONE_STORAGE_KEY) || this.$moment.tz.guess();
+            this.pendingSettings.autofoldTextEditor = localStorage.getItem("autofoldTextEditor") === "true";
             this.guidedTour = localStorage.getItem("tourDoneOrSkip") === "true";
-            this.logDisplay = localStorage.getItem("logDisplay") || logDisplayTypes.DEFAULT;
-            this.editorFontSize = parseInt(localStorage.getItem("editorFontSize")) || 12;
-            this.editorFontFamily = localStorage.getItem("editorFontFamily") || "'Source Code Pro', monospace";
-            this.executeFlowBehaviour = localStorage.getItem("executeFlowBehaviour") || "same tab";
-            this.envName = store.getters["layout/envName"] || this.configs?.environment?.name;
-            this.envColor = store.getters["layout/envColor"] || this.configs?.environment?.color;
+            this.pendingSettings.logDisplay = localStorage.getItem("logDisplay") || logDisplayTypes.DEFAULT;
+            this.pendingSettings.editorFontSize = parseInt(localStorage.getItem("editorFontSize")) || 12;
+            this.pendingSettings.editorFontFamily = localStorage.getItem("editorFontFamily") || "'Source Code Pro', monospace";
+            this.pendingSettings.executeFlowBehaviour = localStorage.getItem("executeFlowBehaviour") || "same tab";
+            this.pendingSettings.envName = store.getters["layout/envName"] || this.configs?.environment?.name;
+            this.pendingSettings.envColor = store.getters["layout/envColor"] || this.configs?.environment?.color;
         },
         methods: {
             onNamespaceSelect(value) {
-                this.defaultNamespace = value;
-
-                if (value) {
-                    localStorage.setItem("defaultNamespace", value)
-                } else {
-                    localStorage.removeItem("defaultNamespace")
-                }
-                this.$toast().saved(this.$t("settings.label"), undefined, {multiple: true});
+                this.pendingSettings.defaultNamespace = value;
             },
             onLevelChange(value) {
-                this.defaultLogLevel = value;
-
-                if (value) {
-                    localStorage.setItem("defaultLogLevel", value)
-                } else {
-                    localStorage.removeItem("defaultLogLevel")
-                }
-                this.$toast().saved(this.$t("settings.label"), undefined, {multiple: true});
+                this.pendingSettings.defaultLogLevel = value;
             },
             onLang(value) {
-                localStorage.setItem("lang", value);
                 this.$moment.locale(value);
                 this.$i18n.locale = value;
-                this.lang = value;
-                this.$toast().saved(this.$t("settings.label"), undefined, {multiple: true});
+                this.pendingSettings.lang = value;
             },
             onTheme(value) {
-                Utils.switchTheme(value)
-                this.theme = value;
-                this.$toast().saved(this.$t("settings.label"), undefined, {multiple: true});
+                this.pendingSettings.theme = value;
+                Utils.switchTheme(value);            
             },
             updateThemeBasedOnSystem() {
                 if (this.theme === "syncWithSystem") {
@@ -316,29 +319,19 @@
                 }
             },
             onDateFormat(value) {
-                localStorage.setItem(DATE_FORMAT_STORAGE_KEY, value);
-                this.dateFormat = value;
-                this.$toast().saved(this.$t("settings.label"), undefined, {multiple: true});
+                this.pendingSettings.dateFormat = value;
             },
             onTimezone(value) {
-                localStorage.setItem(TIMEZONE_STORAGE_KEY, value);
-                this.timezone = value;
-                this.$toast().saved(this.$t("settings.label"), undefined, {multiple: true});
+                this.pendingSettings.timezone = value;
             },
             onEditorTheme(value) {
-                localStorage.setItem("editorTheme", value);
-                this.editorTheme = value;
-                this.$toast().saved(this.$t("settings.label"), undefined, {multiple: true});
+                this.pendingSettings.editorTheme = value;
             },
             onChartColor(value) {
-                localStorage.setItem("scheme", value);
-                this.chartColor = value;
-                this.$toast().saved(this.$t("settings.label"), undefined, {multiple: true});
+                this.pendingSettings.chartColor = value;
             },
             onAutofoldTextEditor(value) {
-                localStorage.setItem("autofoldTextEditor", value);
-                this.autofoldTextEditor = value;
-                this.$toast().saved(this.$t("settings.label"), undefined, {multiple: true});
+                this.pendingSettings.autofoldTextEditor = value;
             },
             exportFlows() {
                 return this.$store
@@ -355,39 +348,58 @@
                     })
             },
             onLogDisplayChange(value) {
-                localStorage.setItem("logDisplay", value);
-                this.logDisplay = value;
-                this.$toast().saved(this.$t("settings.label"), undefined, {multiple: true});
+                this.pendingSettings.logDisplay = value;
             },
             onFontSize(value) {
-                localStorage.setItem("editorFontSize", value);
-                this.editorFontSize = value;
-                this.$toast().saved(this.$t("settings.label"), undefined, {multiple: true});
+                this.pendingSettings.editorFontSize = value;
             },
             onFontFamily(value) {
-                localStorage.setItem("editorFontFamily", value);
-                this.editorFontFamily = value;
-                this.$toast().saved(this.$t("settings.label"), undefined, {multiple: true});
+                this.pendingSettings.editorFontFamily = value;
             },
             onEnvNameChange(value) {
-                if (value !== this.configs?.environment?.name) {
-                    this.$store.commit("layout/setEnvName", value);
-                }
-
-                this.$toast().saved(this.$t("settings.label"), undefined, {multiple: true});
+                this.pendingSettings.envName = value;
             },
             onEnvColorChange(value) {
-                if (value !== this.configs?.environment?.color) {
-                    this.$store.commit("layout/setEnvColor", value);
-                }
-
-                this.$toast().saved(this.$t("settings.label"), undefined, {multiple: true});
+                this.pendingSettings.envColor = value;
             },
             onExecuteFlowBehaviourChange(value) {
-                this.executeFlowBehaviour = value;
-
-                localStorage.setItem(storageKeys.EXECUTE_FLOW_BEHAVIOUR, value);
-
+                this.pendingSettings.executeFlowBehaviour = value;
+            },
+            saveAllSettings() {
+                Object.keys(this.pendingSettings).forEach((key) => {
+                    const storedKey = this.settingsKeyMapping[key]
+                    switch(key) {
+                    case "defaultNamespace":
+                    case "defaultLogLevel":
+                        if(this.pendingSettings[key])
+                            localStorage.setItem(key, this.pendingSettings[key])
+                        else
+                            localStorage.removeItem(key)
+                        break
+                    case "envName":
+                        if (this.pendingSettings[key] !== this.configs?.environment?.name) {
+                            this.$store.commit("layout/setEnvName", this.pendingSettings[key])
+                        }
+                        break
+                    case "envColor":
+                        if (this.pendingSettings[key] !== this.configs?.environment?.color) {
+                            this.$store.commit("layout/setEnvColor", this.pendingSettings[key])
+                        }
+                        break
+                    case "autofoldTextEditor":
+                        localStorage.setItem(key, this.pendingSettings[key])
+                        break
+                    default:
+                        if (storedKey) {
+                            if(this.pendingSettings[key])
+                                localStorage.setItem(storedKey, this.pendingSettings[key])
+                        }
+                        else {
+                            if(this.pendingSettings[key])
+                                localStorage.setItem(key, this.pendingSettings[key])
+                        }
+                    }
+                })
                 this.$toast().saved(this.$t("settings.label"), undefined, {multiple: true});
             }
         },
diff --git a/ui/src/components/settings/components/block/Block.vue b/ui/src/components/settings/components/block/Block.vue
index 6009f0f667..5aa66a01f7 100644
--- a/ui/src/components/settings/components/block/Block.vue
+++ b/ui/src/components/settings/components/block/Block.vue
@@ -17,7 +17,7 @@
     import InformationOutline from "vue-material-design-icons/InformationOutline.vue";
 
     defineProps({
-        heading: {type: String, required: true},
+        heading: {type: String, default: ""},
         note: {type: String, default: undefined},
         last: {type: Boolean, default: false},
     });
diff --git a/ui/src/translations/de.json b/ui/src/translations/de.json
index 9a04ec0536..478b4a7d94 100644
--- a/ui/src/translations/de.json
+++ b/ui/src/translations/de.json
@@ -705,6 +705,12 @@
             "flows": "Alle Flows exportieren",
             "templates": "Alle Vorlagen exportieren"
           }
+        },
+        "save": {
+          "label": "Präferenzen speichern",
+          "fields": {
+            "name": "Änderungen speichern"
+          }
         }
       }
     },
diff --git a/ui/src/translations/en.json b/ui/src/translations/en.json
index c9cc7fb9cb..56be14694f 100644
--- a/ui/src/translations/en.json
+++ b/ui/src/translations/en.json
@@ -744,6 +744,12 @@
             "flows": "Export All Flows",
             "templates": "Export All Templates"
           }
+        },
+        "save": {
+          "label": "Save Preferences",
+          "fields": {
+            "name": "Save Changes"
+          }
         }
       }
     },
diff --git a/ui/src/translations/es.json b/ui/src/translations/es.json
index c031b1ef8e..32308b56cd 100644
--- a/ui/src/translations/es.json
+++ b/ui/src/translations/es.json
@@ -705,6 +705,12 @@
             "flows": "Exportar Todos los Flows",
             "templates": "Exportar Todas las Plantillas"
           }
+        },
+        "save": {
+          "label": "Guardar preferencias",
+          "fields": {
+            "name": "Guardar cambios"
+          }
         }
       }
     },
diff --git a/ui/src/translations/fr.json b/ui/src/translations/fr.json
index 9fc69b8d54..aa17c0f8f5 100644
--- a/ui/src/translations/fr.json
+++ b/ui/src/translations/fr.json
@@ -705,6 +705,12 @@
             "flows": "Exporter tous les Flux",
             "templates": "Exporter tous les modèles"
           }
+        },
+        "save": {
+          "label": "Enregistrer les préférences",
+          "fields": {
+            "name": "Enregistrer les modifications"
+          }
         }
       }
     },
diff --git a/ui/src/translations/hi.json b/ui/src/translations/hi.json
index 233f5ac33d..bfc042b870 100644
--- a/ui/src/translations/hi.json
+++ b/ui/src/translations/hi.json
@@ -705,6 +705,12 @@
             "flows": "सभी Flows निर्यात करें",
             "templates": "सभी templates निर्यात करें"
           }
+        },
+        "save": {
+          "label": "प्राथमिकताएँ सहेजें",
+          "fields": {
+            "name": "परिवर्तनों को सहेजें"
+          }
         }
       }
     },
diff --git a/ui/src/translations/it.json b/ui/src/translations/it.json
index 37b22d24c3..c6b9644bd2 100644
--- a/ui/src/translations/it.json
+++ b/ui/src/translations/it.json
@@ -705,6 +705,12 @@
             "flows": "Esporta tutti i Flows",
             "templates": "Esporta tutti i Template"
           }
+        },
+        "save": {
+          "label": "Salva Preferenze",
+          "fields": {
+            "name": "Salva modifiche"
+          }
         }
       }
     },
diff --git a/ui/src/translations/ja.json b/ui/src/translations/ja.json
index 688647d689..7f49ad1f8f 100644
--- a/ui/src/translations/ja.json
+++ b/ui/src/translations/ja.json
@@ -705,6 +705,12 @@
             "flows": "すべてのflowをエクスポート",
             "templates": "すべてのテンプレートをエクスポート"
           }
+        },
+        "save": {
+          "label": "設定を保存",
+          "fields": {
+            "name": "変更を保存"
+          }
         }
       }
     },
diff --git a/ui/src/translations/ko.json b/ui/src/translations/ko.json
index d21e607288..7a327e401b 100644
--- a/ui/src/translations/ko.json
+++ b/ui/src/translations/ko.json
@@ -705,6 +705,12 @@
             "flows": "모든 Flow 내보내기",
             "templates": "모든 템플릿 내보내기"
           }
+        },
+        "save": {
+          "label": "환경 설정 저장",
+          "fields": {
+            "name": "변경 사항 저장"
+          }
         }
       }
     },
diff --git a/ui/src/translations/pl.json b/ui/src/translations/pl.json
index 36c3f31a1f..f7103eb8c3 100644
--- a/ui/src/translations/pl.json
+++ b/ui/src/translations/pl.json
@@ -705,6 +705,12 @@
             "flows": "Eksportuj Wszystkie Flows",
             "templates": "Eksportuj Wszystkie Szablony"
           }
+        },
+        "save": {
+          "label": "Zapisz preferencje",
+          "fields": {
+            "name": "Zapisz zmiany"
+          }
         }
       }
     },
diff --git a/ui/src/translations/pt.json b/ui/src/translations/pt.json
index fec3e5dbdf..952649caa5 100644
--- a/ui/src/translations/pt.json
+++ b/ui/src/translations/pt.json
@@ -705,6 +705,12 @@
             "flows": "Exportar Todos os Flows",
             "templates": "Exportar Todos os Templates"
           }
+        },
+        "save": {
+          "label": "Salvar Preferências",
+          "fields": {
+            "name": "Salvar Alterações"
+          }
         }
       }
     },
diff --git a/ui/src/translations/ru.json b/ui/src/translations/ru.json
index 5ea5a43165..2ba83a782c 100644
--- a/ui/src/translations/ru.json
+++ b/ui/src/translations/ru.json
@@ -705,6 +705,12 @@
             "flows": "Экспортировать все flows",
             "templates": "Экспортировать все шаблоны"
           }
+        },
+        "save": {
+          "label": "Сохранить настройки",
+          "fields": {
+            "name": "Сохранить изменения"
+          }
         }
       }
     },
diff --git a/ui/src/translations/zh_CN.json b/ui/src/translations/zh_CN.json
index e5fea32767..ddd05d8c2c 100644
--- a/ui/src/translations/zh_CN.json
+++ b/ui/src/translations/zh_CN.json
@@ -705,6 +705,12 @@
             "flows": "导出所有流程",
             "templates": "导出所有模板"
           }
+        },
+        "save": {
+          "label": "保存偏好设置",
+          "fields": {
+            "name": "保存更改"
+          }
         }
       }
     },
diff --git a/ui/src/utils/submitTask.js b/ui/src/utils/submitTask.js
index ebaf196a69..4c1c5a7edd 100644
--- a/ui/src/utils/submitTask.js
+++ b/ui/src/utils/submitTask.js
@@ -11,6 +11,7 @@ const cleanInputs = (inputsList, values) => {
 
 export const inputsToFormDate = (submitor, inputsList, values) => {
     values = cleanInputs(inputsList, values);
+    if(Object.keys(values).length === 0) return;
 
     const formData = new FormData();
     for (let input of inputsList || []) {
diff --git a/webserver/src/main/java/io/kestra/webserver/controllers/api/ExecutionController.java b/webserver/src/main/java/io/kestra/webserver/controllers/api/ExecutionController.java
index 8d0ad8e299..3aa7ca76e1 100644
--- a/webserver/src/main/java/io/kestra/webserver/controllers/api/ExecutionController.java
+++ b/webserver/src/main/java/io/kestra/webserver/controllers/api/ExecutionController.java
@@ -29,10 +29,7 @@
 import io.kestra.core.runners.FlowInputOutput;
 import io.kestra.core.runners.RunContext;
 import io.kestra.core.runners.RunContextFactory;
-import io.kestra.core.services.ConditionService;
-import io.kestra.core.services.ExecutionService;
-import io.kestra.core.services.FlowService;
-import io.kestra.core.services.GraphService;
+import io.kestra.core.services.*;
 import io.kestra.core.storages.StorageContext;
 import io.kestra.core.storages.StorageInterface;
 import io.kestra.core.tenant.TenantService;
@@ -89,7 +86,6 @@
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.io.FilenameUtils;
 import org.apache.commons.lang3.exception.ExceptionUtils;
-import org.apache.commons.lang3.tuple.Pair;
 import org.reactivestreams.Publisher;
 import reactor.core.publisher.Flux;
 import reactor.core.publisher.FluxSink;
@@ -112,6 +108,8 @@
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.stream.Collectors;
 
+import static io.kestra.core.models.Label.CORRELATION_ID;
+import static io.kestra.core.models.Label.SYSTEM_PREFIX;
 import static io.kestra.core.utils.DateUtils.validateTimeline;
 import static io.kestra.core.utils.Rethrow.throwConsumer;
 import static io.kestra.core.utils.Rethrow.throwFunction;
@@ -533,7 +531,7 @@ protected HttpResponse<Execution> webhook(
 
         var result = execution.get();
         if (flow.getLabels() != null) {
-            result = result.withLabels(flow.getLabels());
+            result = result.withLabels(LabelService.labelsExcludingSystem(flow));
         }
 
         // we check conditions here as it's easier as the execution is created we have the body and headers available for the runContext
@@ -583,8 +581,8 @@ public Publisher<ApiValidateExecutionInputsResponse> validateInputsOnCreate(
         @Parameter(description = "The flow revision or latest if null") @QueryValue Optional<Integer> revision
     ) {
         Flow flow = flowService.getFlowIfExecutableOrThrow(tenantService.resolveTenant(), namespace, id, revision);
-        Pair<List<Label>, List<Label>> parsedLabels = parseLabels(labels);
-        Execution execution = Execution.newExecution(flow, parsedLabels.getLeft()).withSystemLabels(parsedLabels.getRight());
+        List<Label> parsedLabels = parseLabels(labels);
+        Execution execution = Execution.newExecution(flow, parsedLabels);
         return flowInputOutput
             .validateExecutionInputs(flow.getInputs(), execution, inputs)
             .map(values -> ApiValidateExecutionInputsResponse.of(id, namespace, values));
@@ -605,8 +603,8 @@ public Publisher<ExecutionResponse> create(
         @Parameter(description = "Schedule the flow on a specific date") @QueryValue Optional<ZonedDateTime> scheduleDate
     ) throws IOException {
         Flow flow = flowService.getFlowIfExecutableOrThrow(tenantService.resolveTenant(), namespace, id, revision);
-        Pair<List<Label>, List<Label>> parsedLabels = parseLabels(labels);
-        Execution current = Execution.newExecution(flow, null, parsedLabels.getLeft(), scheduleDate).withSystemLabels(parsedLabels.getRight());
+        List<Label> parsedLabels = parseLabels(labels);
+        Execution current = Execution.newExecution(flow, null, parsedLabels, scheduleDate);
         Mono<CompletableFuture<ExecutionResponse>> handle = flowInputOutput.readExecutionInputs(flow, current, inputs)
             .handle((executionInputs, sink) -> {
                 Execution executionWithInputs = current.withInputs(executionInputs);
@@ -669,7 +667,7 @@ public static ExecutionResponse fromExecution(Execution execution, URI url) {
                 execution.getFlowRevision(),
                 execution.getTaskRunList(),
                 execution.getInputs(),
-                execution.outputs(),
+                execution.getOutputs(),
                 execution.getLabels(),
                 execution.getVariables(),
                 execution.getState(),
@@ -685,14 +683,17 @@ public static ExecutionResponse fromExecution(Execution execution, URI url) {
         }
     }
 
-    protected Pair<List<Label>, List<Label>> parseLabels(List<String> labels) {
-        // We allow passing the correlation id from the API but only this one, other system labels will go through and fail at execution creation.
+    protected List<Label> parseLabels(List<String> labels) {
         List<Label> parsedLabels =  labels == null ? Collections.emptyList() : RequestUtils.toMap(labels).entrySet().stream()
             .map(entry -> new Label(entry.getKey(), entry.getValue()))
             .toList();
-        List<Label> standardLabels = parsedLabels.stream().filter(label -> !label.key().equals(Label.CORRELATION_ID)).toList();
-        List<Label> systemLabels = parsedLabels.stream().filter(label -> label.key().equals(Label.CORRELATION_ID)).toList();
-        return Pair.of(standardLabels, systemLabels);
+
+        // check for system labels: none can be passed at execution creation time except system_correlationId
+        Optional<Label> first = parsedLabels.stream().filter(label -> !label.key().equals(CORRELATION_ID) && label.key().startsWith(SYSTEM_PREFIX)).findFirst();
+        if (first.isPresent()) {
+            throw new IllegalArgumentException("System labels can only be set by Kestra itself, offending label: " + first.get().key() + "=" + first.get().value());
+        }
+        return parsedLabels;
     }
 
     protected <T> HttpResponse<T> validateFile(String executionId, URI path, String redirect) {
@@ -1699,6 +1700,12 @@ public HttpResponse<?> setLabels(
     }
 
     private Execution setLabels(Execution execution, List<Label> labels) {
+        // check for system labels: none can be passed at runtime
+        Optional<Label> first = labels.stream().filter(label -> label.key().startsWith(SYSTEM_PREFIX)).findFirst();
+        if (first.isPresent()) {
+            throw new IllegalArgumentException("System labels can only be set by Kestra itself, offending label: " + first.get().key() + "=" + first.get().value());
+        }
+
         Map<String, String> newLabels = labels.stream().collect(Collectors.toMap(Label::key, Label::value));
         if (execution.getLabels() != null) {
             execution.getLabels().forEach(
diff --git a/webserver/src/test/java/io/kestra/webserver/controllers/api/ExecutionControllerTest.java b/webserver/src/test/java/io/kestra/webserver/controllers/api/ExecutionControllerTest.java
index df7226217b..b2f8979111 100644
--- a/webserver/src/test/java/io/kestra/webserver/controllers/api/ExecutionControllerTest.java
+++ b/webserver/src/test/java/io/kestra/webserver/controllers/api/ExecutionControllerTest.java
@@ -1594,7 +1594,7 @@ void shouldPauseByQueryRunningFlows() throws TimeoutException, QueueException {
     }
 
     @Test
-    void shouldRefuseSystemLabels() {
+    void shouldRefuseSystemLabelsWhenCreatingAnExecution() {
         var error = assertThrows(HttpClientResponseException.class, () -> client.toBlocking().retrieve(
             HttpRequest
                 .POST("/api/v1/executions/io.kestra.tests/minimal?labels=system_label:system", null)
@@ -1604,4 +1604,19 @@ void shouldRefuseSystemLabels() {
 
         assertThat(error.getStatus(), is(HttpStatus.UNPROCESSABLE_ENTITY));
     }
+
+    @Test
+    void shouldRefuseSystemLabelsWhenUpdatingLabels() throws QueueException, TimeoutException {
+        // update label on a terminated execution
+        Execution result = runnerUtils.runOne(null, "io.kestra.tests", "minimal");
+        assertThat(result.getState().getCurrent(), is(State.Type.SUCCESS));
+
+        var error = assertThrows(HttpClientResponseException.class, () -> client.toBlocking().retrieve(
+                HttpRequest.POST("/api/v1/executions/" + result.getId() + "/labels", List.of(new Label("system_label", "value"))),
+                Execution.class
+            )
+        );
+
+        assertThat(error.getStatus(), is(HttpStatus.UNPROCESSABLE_ENTITY));
+    }
 }