diff --git a/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/HTTP/HTTPRequest.cpp b/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/HTTP/HTTPRequest.cpp
index 9e41910c504..02786d7f3d9 100644
--- a/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/HTTP/HTTPRequest.cpp
+++ b/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/HTTP/HTTPRequest.cpp
@@ -216,9 +216,10 @@ void HTTPRequest::Threaded_SetComplete(CURLcode result)
 		seedPos = valueStart;
 	}
 
-	std::transform(strResponse.begin(), strResponse.end(), strResponse.begin(),
+	std::string strResponseLower = strResponse;
+	std::transform(strResponseLower.begin(), strResponseLower.end(), strResponseLower.begin(),
 		[](unsigned char c) { return std::tolower(c); });
-	if (strResponse.find("token") != std::string::npos)
+	if (strResponseLower.find("token") != std::string::npos)
 	{
 		strResponse = "<redacted>";
 	}
diff --git a/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/NetworkMesh.cpp b/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/NetworkMesh.cpp
index 8d4c474857c..ee01a428169 100644
--- a/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/NetworkMesh.cpp
+++ b/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/NetworkMesh.cpp
@@ -112,9 +112,9 @@ void OnSteamNetConnectionStatusChanged(SteamNetConnectionStatusChangedCallback_t
 			NGMP_OnlineServices_LobbyInterface* pJoinOrderLobby = NGMP_OnlineServicesManager::GetInterface<NGMP_OnlineServices_LobbyInterface>();
 			const bool bWeJoinedLater = pJoinOrderLobby == nullptr || !pJoinOrderLobby->IsJoinOrderKnown() || pJoinOrderLobby->JoinedAfter(userID);
 			const bool bPeerLeft = pJoinOrderLobby != nullptr && pJoinOrderLobby->IsJoinOrderKnown() && !pJoinOrderLobby->IsLobbyMember(userID);
-			// a match can't leave its lobby, so keep repairing the link until the game drops the player
+			// a match can't leave its lobby, so keep repairing the link until the service drops the player
 			const bool bInMatch = TheGameLogic != nullptr && TheGameLogic->isInInternetGame();
-			bool bShouldRetry = serviceConf.retry_signalling && (bInMatch || (!bWeJoinedLater && !bPeerLeft) || signallingAttemptsBeforeDisconnect < numSignallingAttempts);
+			bool bShouldRetry = serviceConf.retry_signalling && ((bInMatch && !bPeerLeft) || (!bWeJoinedLater && !bPeerLeft) || signallingAttemptsBeforeDisconnect < numSignallingAttempts);
 
 			bool bWasError = pInfo->m_info.m_eState == k_ESteamNetworkingConnectionState_ProblemDetectedLocally || pInfo->m_info.m_eEndReason != k_ESteamNetConnectionEnd_App_Generic;
 			plrConnection.SetDisconnected(bWasError, pMesh, bShouldRetry && bWasError);
diff --git a/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/OnlineServices_Auth.cpp b/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/OnlineServices_Auth.cpp
index e72240f63f7..4bdfb583a4b 100644
--- a/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/OnlineServices_Auth.cpp
+++ b/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/OnlineServices_Auth.cpp
@@ -173,9 +173,12 @@ void NGMP_OnlineServices_AuthInterface::SendMiddlewareToken(std::string strMWTok
 
 void NGMP_OnlineServices_AuthInterface::OnRefreshTokenFailed(const char* szReason, const std::string& strBody)
 {
-	// log the raw response so refresh failures are actually diagnosable
-	std::string strBodySnippet = strBody.substr(0, 512);
-	NetworkLog(ELogVerbosity::LOG_RELEASE, "[AUTH]: Refresh response body: %s", strBodySnippet.c_str());
+	// the body can hold a rotated refresh token, so release builds log only its size
+#if _DEBUG
+	NetworkLog(ELogVerbosity::LOG_RELEASE, "[AUTH]: Refresh response body: %s", strBody.c_str());
+#else
+	NetworkLog(ELogVerbosity::LOG_RELEASE, "[AUTH]: Refresh response body was %zu bytes", strBody.size());
+#endif
 
 	if (m_currentRefreshAttempt < m_maxRefreshAttempts)
 	{
@@ -431,9 +434,9 @@ void NGMP_OnlineServices_AuthInterface::DoFullLoginFlow()
 						NetworkLog(ELogVerbosity::LOG_DEBUG, "Login Code is %s", m_strCode.c_str());
 
 #if defined(USE_TEST_ENV)
-                        std::string strURI = std::format("http://www.playgenerals.online/login/?gamecode={}&env=test", m_strCode.c_str());
+                        std::string strURI = std::format("https://www.playgenerals.online/login/?gamecode={}&env=test", m_strCode.c_str());
 #else
-                        std::string strURI = std::format("http://www.playgenerals.online/login/?gamecode={}", m_strCode.c_str());
+                        std::string strURI = std::format("https://www.playgenerals.online/login/?gamecode={}", m_strCode.c_str());
 #endif
 
                         ClearGSMessageBoxes();
@@ -533,7 +536,9 @@ void NGMP_OnlineServices_AuthInterface::Tick()
 						nlohmann::json jsonObject = nlohmann::json::parse(strBody);
 						AuthResponse authResp = jsonObject.get<AuthResponse>();
 
+#if _DEBUG
 						NetworkLog(ELogVerbosity::LOG_RELEASE, "PageBody: %s", strBody.c_str());
+#endif
 						if (authResp.result == EAuthResponseResult::CODE_INVALID)
 						{
 							NetworkLog(ELogVerbosity::LOG_RELEASE, "LOGIN: Code didnt exist, trying again soon");
diff --git a/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/OnlineServices_Init.cpp b/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/OnlineServices_Init.cpp
index 47b7bd8318e..cfe0835efd4 100644
--- a/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/OnlineServices_Init.cpp
+++ b/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/OnlineServices_Init.cpp
@@ -423,6 +423,15 @@ void NGMP_OnlineServicesManager::StartVersionCheck(std::function<void(bool bSucc
 				{
 					NetworkLog(ELogVerbosity::LOG_RELEASE, "VERSION CHECK: Needs Update");
 
+					// the name becomes a local path, so it must be a bare file name
+					const std::string& strName = authResp.patcher_name;
+					if (strName.empty() || strName.find_first_of("/\\:") != std::string::npos || strName.find("..") != std::string::npos)
+					{
+						NetworkLog(ELogVerbosity::LOG_RELEASE, "VERSION CHECK: Rejected invalid patcher name");
+						fnCallback(false, false);
+						return;
+					}
+
 					// cache the data
 					m_patcher_name = authResp.patcher_name;
 					m_patcher_path = authResp.patcher_path;
@@ -493,9 +502,8 @@ void NGMP_OnlineServicesManager::ContinueUpdate()
 					if (strPatchDir.empty())
 						return;
 
-					// Extract the filename with extension from strDownloadPath  
-					std::string strFileName = strDownloadPath.substr(strDownloadPath.find_last_of('/') + 1);
-					std::string strOutPath = std::format("{}/{}", strPatchDir, strFileName.c_str());
+					// save under the validated patcher name so LaunchPatcher runs this exact file
+					std::string strOutPath = std::format("{}/{}", strPatchDir, m_patcher_name);
 
 					std::vector<uint8_t> vecBuffer = pReq->GetBuffer();
 					size_t bufSize = pReq->GetBufferSize();
@@ -536,7 +544,8 @@ void NGMP_OnlineServicesManager::ContinueUpdate()
 				{
 					TheDownloadManager->OnProgressUpdate(bytesReceived, downloadSize, -1, -1);
 				}
-			}
+			},
+			30 * 60 * 1000 // the 5s default aborts any real download
 			);
 	}
 	else if (m_vecFilesToDownload.size() == 0 && m_vecFilesDownloaded.size() > 0) // nothing left but we did download something
diff --git a/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/OnlineServices_LobbyInterface.cpp b/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/OnlineServices_LobbyInterface.cpp
index 106d2f9621b..4b5b9da9cbc 100644
--- a/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/OnlineServices_LobbyInterface.cpp
+++ b/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/OnlineServices_LobbyInterface.cpp
@@ -905,7 +905,7 @@ void NGMP_OnlineServices_LobbyInterface::UpdateRoomDataCache(std::function<void(
 						nlohmann::json jsonObjectRoot = nlohmann::json::parse(strBody);
 
 						NetworkLog(ELogVerbosity::LOG_DEBUG, "LOBBY JSON");
-						NetworkLog(ELogVerbosity::LOG_DEBUG, strBody.c_str());
+						NetworkLog(ELogVerbosity::LOG_DEBUG, "%s", strBody.c_str());
 
 						auto lobbyEntryIter = jsonObjectRoot["lobby"];
 
diff --git a/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/PluginInterfaces.cpp b/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/PluginInterfaces.cpp
index 92c578d7f0b..f914ae6ef25 100644
--- a/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/PluginInterfaces.cpp
+++ b/GeneralsMD/Code/GameEngine/Source/GameNetwork/GeneralsOnline/PluginInterfaces.cpp
@@ -423,7 +423,11 @@ void AnticheatPlugInterface::Authenticate()
                         // don't trust the plugin to terminate the buffer
                         buf[sizeof(buf) - 1] = '\0';
 
+#if _DEBUG
                         NetworkLog(ELogVerbosity::LOG_RELEASE, "[AC] Got MW token: %s", buf);
+#else
+                        NetworkLog(ELogVerbosity::LOG_RELEASE, "[AC] Got MW token (%zu chars)", strlen(buf));
+#endif
 
                         // Now we can begin login
                         NGMP_OnlineServices_AuthInterface* pAuthInterface = NGMP_OnlineServicesManager::GetInterface<NGMP_OnlineServices_AuthInterface>();
diff --git a/GeneralsMD/Code/Main/WinMain.cpp b/GeneralsMD/Code/Main/WinMain.cpp
index d7a7bb6acc1..d68a5c5d989 100644
--- a/GeneralsMD/Code/Main/WinMain.cpp
+++ b/GeneralsMD/Code/Main/WinMain.cpp
@@ -291,6 +291,21 @@ static const char* messageToString(unsigned int message)
 }
 #endif
 
+static void setWinMainActive(Bool active)
+{
+	isWinMainActive = active;
+
+	if (TheGameEngine)
+		TheGameEngine->setIsActive(isWinMainActive);
+
+	if (isWinMainActive)
+	{
+		//restore mouse cursor to our custom version.
+		if (TheWin32Mouse)
+			TheWin32Mouse->setCursor(TheWin32Mouse->getMouseCursor());
+	}
+}
+
 // WndProc ====================================================================
 /** Window Procedure */
 //=============================================================================
@@ -471,17 +486,7 @@ LRESULT CALLBACK WndProc(HWND hWnd, UINT message,
 				// of TestCooperativeLevel() == D3DERR_DEVICENOTRESET is not a requirement. There are other code
 				// paths that take care of that.
 
-				isWinMainActive = (BOOL)wParam;
-
-				if (TheGameEngine)
-					TheGameEngine->setIsActive(isWinMainActive);
-
-				if (isWinMainActive)
-				{
-					//restore mouse cursor to our custom version.
-					if (TheWin32Mouse)
-						TheWin32Mouse->setCursor(TheWin32Mouse->getMouseCursor());
-				}
+				setWinMainActive((BOOL)wParam);
 			}
 			return 0;
 		}
@@ -501,6 +506,10 @@ LRESULT CALLBACK WndProc(HWND hWnd, UINT message,
 				if (TheAudio)
 					TheAudio->unmuteAudio(AudioManager::MuteAudioReason_WindowFocus);
 
+				// taking over from the splash stays within the app, so no WM_ACTIVATEAPP arrives
+				if (!isWinMainActive)
+					setWinMainActive(TRUE);
+
 				// Cursor can only be captured after one of the activation events.
 				if (TheMouse)
 					TheMouse->refreshCursorCapture();