diff --git a/luci-app-daede/Makefile b/luci-app-daede/Makefile
index 6559501f6..332a12f80 100644
--- a/luci-app-daede/Makefile
+++ b/luci-app-daede/Makefile
@@ -6,7 +6,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-daede
 PKG_VERSION:=1.13.0
-PKG_RELEASE:=15
+PKG_RELEASE:=16
 PKG_MAINTAINER:=kenzok8
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)
 
@@ -77,9 +77,13 @@ define Package/$(PKG_NAME)/install
 	$(INSTALL_BIN) ./root/usr/share/luci-app-daede/gen-dae-config.sh $(1)/usr/share/luci-app-daede/gen-dae-config.sh
 	$(INSTALL_BIN) ./root/usr/share/luci-app-daede/proxy-check.sh $(1)/usr/share/luci-app-daede/proxy-check.sh
 	$(INSTALL_BIN) ./root/usr/share/luci-app-daede/fetch-clash-yaml.sh $(1)/usr/share/luci-app-daede/fetch-clash-yaml.sh
+	$(INSTALL_BIN) ./root/usr/share/luci-app-daede/refresh-index.sh $(1)/usr/share/luci-app-daede/refresh-index.sh
+	$(INSTALL_BIN) ./root/usr/share/luci-app-daede/config-backup.sh $(1)/usr/share/luci-app-daede/config-backup.sh
+	$(INSTALL_BIN) ./root/usr/share/luci-app-daede/geo-cron.sh $(1)/usr/share/luci-app-daede/geo-cron.sh
 
 	$(INSTALL_DIR) $(1)/www/cgi-bin
 	$(INSTALL_BIN) ./root/www/cgi-bin/daede-sub $(1)/www/cgi-bin/daede-sub
+	$(INSTALL_BIN) ./root/www/cgi-bin/daede-graphql $(1)/www/cgi-bin/daede-graphql
 
 	$(INSTALL_DIR) $(1)/www/luci-static/resources/view/daede
 	$(INSTALL_DATA) ./htdocs/luci-static/resources/view/daede/*.js $(1)/www/luci-static/resources/view/daede/
diff --git a/luci-app-daede/htdocs/luci-static/resources/view/daede/converter.js b/luci-app-daede/htdocs/luci-static/resources/view/daede/converter.js
index b8472dfe5..8577594da 100644
--- a/luci-app-daede/htdocs/luci-static/resources/view/daede/converter.js
+++ b/luci-app-daede/htdocs/luci-static/resources/view/daede/converter.js
@@ -73,6 +73,10 @@ function loadYamlParser() {
 }
 
 function daedEndpoint() {
+	// HTTPS page: browser blocks the plain-HTTP :2023 fetch as mixed
+	// content, so relay via a same-origin CGI. HTTP: hit daed direct. #11
+	if (window.location.protocol === 'https:')
+		return '/cgi-bin/daede-graphql';
 	const listen = uci.get('daed', 'config', 'listen_addr') || '0.0.0.0:2023';
 	const match = String(listen).match(/:(\d+)$/);
 	const port = match ? match[1] : '2023';
diff --git a/luci-app-daede/htdocs/luci-static/resources/view/daede/updates.js b/luci-app-daede/htdocs/luci-static/resources/view/daede/updates.js
index 9f5bc80f0..a8eb2a7c2 100644
--- a/luci-app-daede/htdocs/luci-static/resources/view/daede/updates.js
+++ b/luci-app-daede/htdocs/luci-static/resources/view/daede/updates.js
@@ -131,8 +131,6 @@ function stamp() {
 
 return view.extend({
 	load: function() {
-		// background apk update so new versions show on next poll
-		fs.exec('/usr/share/luci-app-daede/refresh-index.sh', []).catch(function() {});
 		return Promise.all([
 			backend.detectBackend(),
 			uci.load('daed').catch(function() {}),
@@ -379,6 +377,10 @@ return view.extend({
 
 		poll.add(refresh);
 		refresh();
+		// First paint reads the cached index (fast). Refresh the index, then
+		// re-probe once it's current so a freshly published version shows
+		// without waiting for a poll tick. refresh-index.sh self-throttles.
+		fs.exec('/usr/share/luci-app-daede/refresh-index.sh', []).then(refresh).catch(function() {});
 
 		// === Geo data source (preset / custom URL + auto-update) ===
 		const geoSettings = (function() {
diff --git a/luci-app-daede/root/usr/share/luci-app-daede/refresh-index.sh b/luci-app-daede/root/usr/share/luci-app-daede/refresh-index.sh
index cf6c26cc1..a20952e7f 100755
--- a/luci-app-daede/root/usr/share/luci-app-daede/refresh-index.sh
+++ b/luci-app-daede/root/usr/share/luci-app-daede/refresh-index.sh
@@ -1,5 +1,6 @@
 #!/bin/sh
-# Background apk/opkg update for the Updates view. Returns at once; throttled.
+# Refresh the apk/opkg index for the Updates view. Runs in the FOREGROUND so
+# the caller can re-probe once the index is current; throttled to 90s.
 
 LOCK=/tmp/luci-app-daede.idx.lock
 
@@ -9,13 +10,11 @@ if [ -f "$LOCK" ]; then
 fi
 : > "$LOCK"
 
-(
-	# -n: skip if a package op holds the shared apk lock (no need to refresh then)
-	if command -v apk >/dev/null 2>&1; then
-		flock -n /tmp/luci-app-daede.apk.lock apk update
-	elif command -v opkg >/dev/null 2>&1; then
-		opkg update
-	fi
-) >/dev/null 2>&1 </dev/null &
+# -n: skip if a package op holds the shared apk lock (no need to refresh then)
+if command -v apk >/dev/null 2>&1; then
+	flock -n /tmp/luci-app-daede.apk.lock apk update
+elif command -v opkg >/dev/null 2>&1; then
+	opkg update
+fi >/dev/null 2>&1
 
 exit 0
diff --git a/luci-app-daede/root/www/cgi-bin/daede-graphql b/luci-app-daede/root/www/cgi-bin/daede-graphql
new file mode 100644
index 000000000..6ebf3da94
--- /dev/null
+++ b/luci-app-daede/root/www/cgi-bin/daede-graphql
@@ -0,0 +1,39 @@
+#!/bin/sh
+# daede-graphql - same-origin GraphQL relay to local daed.
+#
+# HTTPS LuCI pages can't fetch daed's plain-HTTP :2023 (mixed content),
+# so the converter posts here and we relay to 127.0.0.1 over loopback.
+# daed still checks its own bearer token; no extra exposure. See #11.
+
+reply() { printf 'Status: %s\r\nContent-Type: application/json\r\n\r\n%s\n' "$1" "$2"; exit 0; }
+fail() { reply '502 Bad Gateway' '{"errors":[{"message":"daed relay failed"}]}'; }
+
+[ "$REQUEST_METHOD" = "POST" ] || reply '405 Method Not Allowed' '{"errors":[{"message":"POST only"}]}'
+
+# daed listen port from uci, default 2023
+port=$(uci -q get daed.config.listen_addr | sed -n 's/.*:\([0-9]\{1,5\}\)$/\1/p')
+[ -n "$port" ] || port=2023
+
+len=${CONTENT_LENGTH:-0}
+[ "$len" -gt 0 ] 2>/dev/null || fail
+
+body=$(mktemp /tmp/daede-gql.XXXXXX) || fail
+head -c "$len" > "$body"
+
+if [ -n "$HTTP_AUTHORIZATION" ]; then
+	resp=$(uclient-fetch -q -O - \
+		--header="Content-Type: ${CONTENT_TYPE:-application/json}" \
+		--header="Authorization: $HTTP_AUTHORIZATION" \
+		--post-file="$body" \
+		"http://127.0.0.1:$port/graphql" 2>/dev/null)
+else
+	resp=$(uclient-fetch -q -O - \
+		--header="Content-Type: ${CONTENT_TYPE:-application/json}" \
+		--post-file="$body" \
+		"http://127.0.0.1:$port/graphql" 2>/dev/null)
+fi
+rc=$?
+rm -f "$body"
+
+[ "$rc" = 0 ] || fail
+reply '200 OK' "$resp"