# Self-Hosted Control Plane Hardening | Changelog

Source: https://wraps.dev/changelog/self-hosted-control-plane-hardening

![Wraps Logo](https://wraps.dev/wraps-light-logo.png)![Wraps Logo](https://wraps.dev/wraps-dark-logo.png)

](https://wraps.dev/)

[](https://github.com/wraps-team/wraps)[Log in](https://app.wraps.dev/auth?mode=signin)[Sign up](https://app.wraps.dev/auth?mode=signup)

Toggle menu

[← All changes](https://wraps.dev/changelog)

CLISelf-hostedJuly 2026

### Self-Hosted Control Plane Hardening

-   Deploy and upgrade now publish the SES templates the dashboard sends by name, so signup verification, invitations and password reset work on a fresh install instead of failing on a missing template
-   `wraps selfhost env` emits `AUTH_EMAIL_FROM`, `AUTH_EMAIL_CONFIGURATION_SET` and `WRAPS_EMAIL_ROLE_ARN` — the API-only variant hosts its own dashboard, and this is where it gets that configuration
-   The auth sender address is derived from the verified SES identity rather than the dashboard domain, which is only sendable when the two happen to match
-   A self-hosted deployment gets its own `wraps-selfhost-console-access-role`, trusting your account rather than Wraps
-   `wraps selfhost connect` adds a dedicated SES event target instead of repointing the platform's, so both control planes receive events
-   Self-hosters can route errors to their own Sentry DSN instead of Wraps'
-   `--selfhosted` is replaced by the `wraps selfhost` subcommand
-   Fix: recover the API URL on SST deployments, whose resource names carry a generated suffix

CLI v2.29.0