diff --git a/lib/core/network/image_header_utils.dart b/lib/core/network/image_header_utils.dart
index b77d1e3..37d5a6d 100644
--- a/lib/core/network/image_header_utils.dart
+++ b/lib/core/network/image_header_utils.dart
@@ -1,6 +1,7 @@
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 
 import 'package:conduit/core/providers/app_providers.dart';
+import 'package:conduit/core/services/api_service.dart';
 import 'package:conduit/features/auth/providers/unified_auth_providers.dart';
 
 /// Builds HTTP headers for protected image requests.
@@ -8,14 +9,14 @@ import 'package:conduit/features/auth/providers/unified_auth_providers.dart';
 /// Includes Authorization (Bearer token or API key) and any server-configured
 /// custom headers. Returns `null` if no headers are needed.
 Map<String, String>? buildImageHeadersFromRef(Ref ref) {
-  final api = ref.read(apiServiceProvider);
-  final token = ref.read(authTokenProvider3);
+  final api = ref.watch(apiServiceProvider);
+  final token = ref.watch(authTokenProvider3);
   return _build(api, token);
 }
 
 Map<String, String>? buildImageHeadersFromWidgetRef(WidgetRef ref) {
-  final api = ref.read(apiServiceProvider);
-  final token = ref.read(authTokenProvider3);
+  final api = ref.watch(apiServiceProvider);
+  final token = ref.watch(authTokenProvider3);
   return _build(api, token);
 }
 
@@ -29,7 +30,7 @@ Map<String, String>? buildImageHeadersFromContainer(
   return _build(api, token);
 }
 
-Map<String, String>? _build(dynamic api, String? token) {
+Map<String, String>? _build(ApiService? api, String? token) {
   final headers = <String, String>{};
 
   if (token != null && token.isNotEmpty) {
@@ -39,8 +40,9 @@ Map<String, String>? _build(dynamic api, String? token) {
     headers['Authorization'] = 'Bearer ${api.serverConfig.apiKey}';
   }
 
-  if (api != null && api.serverConfig.customHeaders.isNotEmpty) {
-    headers.addAll(api.serverConfig.customHeaders);
+  final customHeaders = api?.serverConfig.customHeaders ?? {};
+  if (customHeaders.isNotEmpty) {
+    headers.addAll(customHeaders);
   }
 
   return headers.isEmpty ? null : headers;
diff --git a/lib/core/network/self_signed_image_cache_manager.dart b/lib/core/network/self_signed_image_cache_manager.dart
index f2ac8c4..b0a4745 100644
--- a/lib/core/network/self_signed_image_cache_manager.dart
+++ b/lib/core/network/self_signed_image_cache_manager.dart
@@ -14,7 +14,7 @@ import '../providers/app_providers.dart';
 /// Notes
 /// - Scoped to the configured host and (optionally) port only.
 /// - Not available on web (browsers enforce TLS validation).
-final selfSignedImageCacheManagerProvider = Provider<CacheManager?>((ref) {
+final selfSignedImageCacheManagerProvider = Provider<BaseCacheManager?>((ref) {
   final active = ref.watch(activeServerProvider);
 
   return active.maybeWhen(
@@ -26,7 +26,7 @@ final selfSignedImageCacheManagerProvider = Provider<CacheManager?>((ref) {
   );
 });
 
-CacheManager? _buildForServer(ServerConfig server) {
+BaseCacheManager? _buildForServer(ServerConfig server) {
   if (kIsWeb) return null;
   if (!server.allowSelfSignedCertificates) return null;
 
diff --git a/lib/features/chat/widgets/enhanced_image_attachment.dart b/lib/features/chat/widgets/enhanced_image_attachment.dart
index 70b46f6..a570aca 100644
--- a/lib/features/chat/widgets/enhanced_image_attachment.dart
+++ b/lib/features/chat/widgets/enhanced_image_attachment.dart
@@ -417,7 +417,7 @@ class _EnhancedImageAttachmentState
     // Get authentication headers if available
     final headers = buildImageHeadersFromWidgetRef(ref);
 
-    final cacheManager = ref.read(selfSignedImageCacheManagerProvider);
+    final cacheManager = ref.watch(selfSignedImageCacheManagerProvider);
     final imageWidget = CachedNetworkImage(
       key: ValueKey('image_${widget.attachmentId}'),
       imageUrl: _cachedImageData!,
@@ -548,7 +548,7 @@ class FullScreenImageViewer extends ConsumerWidget {
       // Get authentication headers if available
       final headers = buildImageHeadersFromWidgetRef(ref);
 
-      final cacheManager = ref.read(selfSignedImageCacheManagerProvider);
+      final cacheManager = ref.watch(selfSignedImageCacheManagerProvider);
       imageWidget = CachedNetworkImage(
         imageUrl: imageData,
         fit: BoxFit.contain,
diff --git a/lib/shared/widgets/user_avatar.dart b/lib/shared/widgets/user_avatar.dart
index 0bd8b7c..f5d5909 100644
--- a/lib/shared/widgets/user_avatar.dart
+++ b/lib/shared/widgets/user_avatar.dart
@@ -2,13 +2,13 @@ import 'dart:convert';
 import 'dart:typed_data';
 
 import 'package:cached_network_image/cached_network_image.dart';
+import 'package:conduit/core/network/image_header_utils.dart';
+import 'package:conduit/core/network/self_signed_image_cache_manager.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 
 import '../services/brand_service.dart';
 import '../theme/theme_extensions.dart';
-import 'package:conduit/core/network/self_signed_image_cache_manager.dart';
-import 'package:conduit/core/network/image_header_utils.dart';
 
 typedef AvatarWidgetBuilder =
     Widget Function(BuildContext context, double size);
@@ -59,7 +59,7 @@ class AvatarImage extends ConsumerWidget {
     // Build auth/custom headers when loading from network
     final headers = buildImageHeadersFromWidgetRef(ref);
 
-    final cacheManager = ref.read(selfSignedImageCacheManagerProvider);
+    final cacheManager = ref.watch(selfSignedImageCacheManagerProvider);
 
     return ClipRRect(
       borderRadius: _radius,