diff --git a/ct/authentik.sh b/ct/authentik.sh
index 236e2b43..0d049c47 100644
--- a/ct/authentik.sh
+++ b/ct/authentik.sh
@@ -35,7 +35,7 @@ function update_script() {
   setup_rust
 
   AUTHENTIK_VERSION="version/2026.2.2"
-  XMLSEC_VERSION="1.3.9"
+  XMLSEC_VERSION="1.3.11"
 
   if check_for_gh_release "geoipupdate" "maxmind/geoipupdate"; then
     fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary"
@@ -122,7 +122,13 @@ build_container
 
 msg_info "Attaching data storage volume"
 $STD pct stop "$CTID"
-$STD pct set "$CTID" -mp0 "${CONTAINER_STORAGE}":1,mp=/opt/authentik-data,backup=1
+if [ "${PROTECT_CT:-}" == "1" ] || [ "${PROTECT_CT:-}" == "yes" ]; then
+  $STD pct set "$CTID" --protection 0
+  $STD pct set "$CTID" -mp0 "${CONTAINER_STORAGE}":1,mp=/opt/authentik-data,backup=1
+  $STD pct set "$CTID" --protection 1
+else
+  $STD pct set "$CTID" -mp0 "${CONTAINER_STORAGE}":1,mp=/opt/authentik-data,backup=1
+fi
 $STD pct start "$CTID"
 for i in {1..10}; do
   pct status "$CTID" | grep -q "status: running" && break
diff --git a/install/authentik-install.sh b/install/authentik-install.sh
index cfc5c029..3147a7b5 100644
--- a/install/authentik-install.sh
+++ b/install/authentik-install.sh
@@ -55,7 +55,7 @@ setup_rust
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db
 
-XMLSEC_VERSION="1.3.9"
+XMLSEC_VERSION="1.3.11"
 AUTHENTIK_VERSION="version/2026.2.2"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
@@ -122,6 +122,7 @@ yq -i ".blueprints_dir = \"/opt/authentik/blueprints\"" /etc/authentik/config.ym
 yq -i ".cert_discovery_dir = \"/opt/authentik-data/certs\"" /etc/authentik/config.yml
 yq -i ".email.template_dir = \"/opt/authentik-data/templates\"" /etc/authentik/config.yml
 yq -i ".storage.file.path = \"/opt/authentik-data\"" /etc/authentik/config.yml
+yq -i ".disable_startup_analytics = \"true\"" /etc/authentik/config.yml
 $STD useradd -U -s /usr/sbin/nologin -r -M -d /opt/authentik authentik
 chown -R authentik:authentik /opt/authentik
 cat <<EOF >/etc/default/authentik