diff --git a/src/MauiSherpa.Core/Interfaces.cs b/src/MauiSherpa.Core/Interfaces.cs
index c8326760..130f40df 100644
--- a/src/MauiSherpa.Core/Interfaces.cs
+++ b/src/MauiSherpa.Core/Interfaces.cs
@@ -2384,6 +2384,11 @@ Task<OperationResult> RunAsync(
     /// Whether an operation is currently running
     /// </summary>
     bool IsRunning { get; }
+
+    /// <summary>
+    /// Requests cancellation of the running operation
+    /// </summary>
+    void RequestCancellation();
     
     /// <summary>
     /// Event fired when the modal is shown
@@ -4001,6 +4006,15 @@ List<string> DestinationKeys
 public interface IPublishProfileService
 {
     Task<IReadOnlyList<PublishProfile>> GetProfilesAsync();
+    /// <summary>
+    /// Reads the profiles, reporting the merged set each time a provider finishes so the
+    /// UI can render the fast providers' profiles without waiting on the slow ones.
+    /// </summary>
+    Task<IReadOnlyList<PublishProfile>> GetProfilesAsync(
+        IProgress<IReadOnlyList<PublishProfile>>? progress);
+    /// <summary>Drops the cached profiles and re-reads them from every configured provider.</summary>
+    Task<IReadOnlyList<PublishProfile>> RefreshProfilesAsync(
+        IProgress<IReadOnlyList<PublishProfile>>? progress = null);
     Task<PublishProfile?> GetProfileAsync(string id);
     Task SaveProfileAsync(PublishProfile profile);
     Task DeleteProfileAsync(string id);
diff --git a/src/MauiSherpa.Core/Services/PublishProfileService.cs b/src/MauiSherpa.Core/Services/PublishProfileService.cs
index 72e61e11..acdf2cbc 100644
--- a/src/MauiSherpa.Core/Services/PublishProfileService.cs
+++ b/src/MauiSherpa.Core/Services/PublishProfileService.cs
@@ -9,6 +9,7 @@ namespace MauiSherpa.Core.Services;
 public class PublishProfileService : IPublishProfileService
 {
     const string CloudKeyPrefix = "sherpa-publish-profiles/";
+    const int MaxParallelSecretReads = 8;
 
     readonly ICloudSecretsService _cloudService;
     readonly ICertificateSyncService _certSync;
@@ -66,7 +67,11 @@ public PublishProfileService(
             _syncCoordinator.ItemStateChanged += OnSyncItemStateChanged;
     }
 
-    public async Task<IReadOnlyList<PublishProfile>> GetProfilesAsync()
+    public Task<IReadOnlyList<PublishProfile>> GetProfilesAsync() =>
+        GetProfilesAsync(progress: null);
+
+    public async Task<IReadOnlyList<PublishProfile>> GetProfilesAsync(
+        IProgress<IReadOnlyList<PublishProfile>>? progress)
     {
         lock (_cacheLock)
         {
@@ -84,72 +89,15 @@ public async Task<IReadOnlyList<PublishProfile>> GetProfilesAsync()
             }
 
             var generation = Interlocked.Read(ref _cacheGeneration);
-            var profiles = new Dictionary<string, PublishProfile>(StringComparer.Ordinal);
-            if (_providerRegistry is not null)
-            {
-                var providerConfigs = await _providerRegistry.GetProvidersAsync();
-                foreach (var config in providerConfigs
-                    .OrderBy(provider => provider.ProviderType == CloudSecretsProviderType.Local ? 0 : 1)
-                    .ThenBy(provider => provider.Name, StringComparer.OrdinalIgnoreCase))
-                {
-                    try
-                    {
-                        var provider = await _providerRegistry.GetProviderAsync(config.Id);
-                        if (provider is null)
-                            continue;
-
-                        var keys = await provider.ListSecretsAsync(CloudKeyPrefix);
-                        foreach (var key in keys)
-                        {
-                            var bytes = await provider.GetSecretAsync(key);
-                            if (bytes is null)
-                                continue;
-
-                            var profile = JsonSerializer.Deserialize<PublishProfile>(
-                                Encoding.UTF8.GetString(bytes),
-                                JsonOptions);
-                            if (profile is not null)
-                                profiles.TryAdd(profile.Id, profile);
-                        }
-                    }
-                    catch (Exception ex)
-                    {
-                        _logger.LogWarning($"Failed to load publish profiles from '{config.Name}': {ex.Message}");
-                    }
-                }
-            }
-            else if (_cloudService.ActiveProvider is not null)
-            {
-                var keys = await _cloudService.ListSecretsAsync(CloudKeyPrefix);
-                foreach (var key in keys)
-                {
-                    try
-                    {
-                        var bytes = await _cloudService.GetSecretAsync(key);
-                        if (bytes is null)
-                            continue;
-
-                        var profile = JsonSerializer.Deserialize<PublishProfile>(
-                            Encoding.UTF8.GetString(bytes),
-                            JsonOptions);
-                        if (profile is not null)
-                            profiles.TryAdd(profile.Id, profile);
-                    }
-                    catch (Exception ex)
-                    {
-                        _logger.LogWarning($"Failed to load publish profile '{key}': {ex.Message}");
-                    }
-                }
-            }
-
-            var loaded = profiles.Values.OrderBy(p => p.Name).ToList();
+            var loaded = await LoadProfilesFromProvidersAsync(progress);
             lock (_cacheLock)
             {
+                // If the cache was invalidated while we were reading, leave it empty so the
+                // next call refetches — but still hand back what we just read. Returning
+                // nothing here made the page render an empty grid after a sync completed.
                 if (generation == Interlocked.Read(ref _cacheGeneration))
                     _cache = loaded;
-                return _cache is not null
-                    ? _cache
-                    : Array.Empty<PublishProfile>();
+                return loaded;
             }
         }
         finally
@@ -158,6 +106,137 @@ public async Task<IReadOnlyList<PublishProfile>> GetProfilesAsync()
         }
     }
 
+    public Task<IReadOnlyList<PublishProfile>> RefreshProfilesAsync(
+        IProgress<IReadOnlyList<PublishProfile>>? progress = null)
+    {
+        InvalidateCache();
+        return GetProfilesAsync(progress);
+    }
+
+    async Task<List<PublishProfile>> LoadProfilesFromProvidersAsync(
+        IProgress<IReadOnlyList<PublishProfile>>? progress)
+    {
+        var profiles = new Dictionary<string, PublishProfile>(StringComparer.Ordinal);
+
+        if (_providerRegistry is null)
+        {
+            if (_cloudService.ActiveProvider is null)
+                return [];
+
+            var activeKeys = await _cloudService.ListSecretsAsync(CloudKeyPrefix);
+            foreach (var profile in await ReadProfilesAsync(activeKeys, key => _cloudService.GetSecretAsync(key)))
+                profiles.TryAdd(profile.Id, profile);
+            return Snapshot(profiles);
+        }
+
+        var orderedConfigs = (await _providerRegistry.GetProvidersAsync())
+            .OrderBy(provider => provider.ProviderType == CloudSecretsProviderType.Local ? 0 : 1)
+            .ThenBy(provider => provider.Name, StringComparer.OrdinalIgnoreCase)
+            .ToList();
+
+        // Every provider starts listing at once, but contents are read in priority order so
+        // a slow remote vault never holds up the profiles a fast local one already has.
+        var listings = orderedConfigs.Select(ListProfileKeysAsync).ToList();
+        var claimedIds = new HashSet<string>(StringComparer.Ordinal);
+
+        foreach (var listingTask in listings)
+        {
+            var listing = await listingTask;
+            if (listing.Provider is null)
+                continue;
+
+            // Only read the copies this provider owns outright. A key already claimed by a
+            // higher-priority provider would be deserialized and then dropped on merge, so
+            // fetching it is pure latency — and remote vaults are where that latency lives.
+            var keysToRead = listing.Keys
+                .Where(key => !TryGetComparableProfileId(key, out var id) || claimedIds.Add(id))
+                .ToList();
+
+            var loaded = await ReadProfilesAsync(keysToRead, key => listing.Provider.GetSecretAsync(key));
+            foreach (var profile in loaded)
+                profiles.TryAdd(profile.Id, profile);
+
+            _logger.LogInformation(
+                $"Provider '{listing.Config.Name}' listed {listing.Keys.Count} publish profile key(s), " +
+                $"read {keysToRead.Count}, {loaded.Count} readable");
+
+            progress?.Report(Snapshot(profiles));
+        }
+
+        return Snapshot(profiles);
+    }
+
+    static List<PublishProfile> Snapshot(Dictionary<string, PublishProfile> profiles) =>
+        profiles.Values.OrderBy(profile => profile.Name).ToList();
+
+    static bool TryGetComparableProfileId(string key, out string id)
+    {
+        if (SecretItemAdapterHelper.TryGetRelativeKey(key, CloudKeyPrefix, out var relativeKey))
+        {
+            id = SecretItemAdapterHelper.GetComparableStorageKey(relativeKey);
+            return true;
+        }
+
+        id = string.Empty;
+        return false;
+    }
+
+    async Task<ProviderListing> ListProfileKeysAsync(CloudSecretsProviderConfig config)
+    {
+        try
+        {
+            var provider = await _providerRegistry!.GetProviderAsync(config.Id);
+            if (provider is null)
+                return new ProviderListing(config, null, Array.Empty<string>());
+
+            var keys = await provider.ListSecretsAsync(CloudKeyPrefix);
+            return new ProviderListing(config, provider, keys);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning($"Failed to load publish profiles from '{config.Name}': {ex.Message}");
+            return new ProviderListing(config, null, Array.Empty<string>());
+        }
+    }
+
+    async Task<IReadOnlyList<PublishProfile>> ReadProfilesAsync(
+        IReadOnlyList<string> keys,
+        Func<string, Task<byte[]?>> readSecretAsync)
+    {
+        var loaded = new PublishProfile?[keys.Count];
+        using var throttle = new SemaphoreSlim(MaxParallelSecretReads);
+
+        await Task.WhenAll(keys.Select(async (key, index) =>
+        {
+            await throttle.WaitAsync();
+            try
+            {
+                var bytes = await readSecretAsync(key);
+                if (bytes is null)
+                    return;
+
+                loaded[index] = JsonSerializer.Deserialize<PublishProfile>(
+                    Encoding.UTF8.GetString(bytes),
+                    JsonOptions);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning($"Failed to load publish profile '{key}': {ex.Message}");
+            }
+            finally
+            {
+                throttle.Release();
+            }
+        }));
+
+        return loaded.Where(profile => profile is not null).Select(profile => profile!).ToList();
+    }
+
+    readonly record struct ProviderListing(
+        CloudSecretsProviderConfig Config,
+        ICloudSecretsProvider? Provider,
+        IReadOnlyList<string> Keys);
+
     public async Task<PublishProfile?> GetProfileAsync(string id)
     {
         var profiles = await GetProfilesAsync();
@@ -211,10 +290,15 @@ void OnSyncItemStateChanged(SecretItemRef item)
         if (item.Kind != SecretItemKind.PublishProfile)
             return;
 
+        InvalidateCache();
+        OnProfilesChanged?.Invoke();
+    }
+
+    void InvalidateCache()
+    {
         Interlocked.Increment(ref _cacheGeneration);
         lock (_cacheLock)
             _cache = null;
-        OnProfilesChanged?.Invoke();
     }
 
     public async Task<Dictionary<string, string>> ResolveSecretsAsync(
diff --git a/src/MauiSherpa.Core/Services/SecretItemAdapterHelper.cs b/src/MauiSherpa.Core/Services/SecretItemAdapterHelper.cs
index 8df1097e..be8cdad5 100644
--- a/src/MauiSherpa.Core/Services/SecretItemAdapterHelper.cs
+++ b/src/MauiSherpa.Core/Services/SecretItemAdapterHelper.cs
@@ -162,6 +162,13 @@ public static async Task<bool> DeleteArtifactsAsync(
     public static bool KeyMatchesPrefix(string key, string prefix) =>
         NormalizeStorageKey(key).StartsWith(NormalizeStorageKey(prefix), StringComparison.Ordinal);
 
+    /// <summary>
+    /// Returns a form of the key that ignores the punctuation differences providers
+    /// introduce (Azure Key Vault cannot store '/', for example), so keys from two
+    /// different providers can be compared for identity.
+    /// </summary>
+    public static string GetComparableStorageKey(string key) => NormalizeStorageKey(key);
+
     public static bool StorageKeysEqual(string left, string right) =>
         string.Equals(
             NormalizeStorageKey(left),
diff --git a/src/MauiSherpa.Core/Services/SecretsPublisherService.cs b/src/MauiSherpa.Core/Services/SecretsPublisherService.cs
index a731e8cf..342f3efe 100644
--- a/src/MauiSherpa.Core/Services/SecretsPublisherService.cs
+++ b/src/MauiSherpa.Core/Services/SecretsPublisherService.cs
@@ -224,13 +224,26 @@ public async Task DeletePublisherAsync(string id)
 
     public async Task<bool> TestConnectionAsync(string publisherId, CancellationToken cancellationToken = default)
     {
-        var publisher = GetPublisherInstance(publisherId);
+        var publisher = await ResolvePublisherInstanceAsync(publisherId);
         if (publisher == null)
             return false;
 
         return await publisher.TestConnectionAsync(cancellationToken);
     }
 
+    /// <summary>
+    /// Resolves a publisher, loading the configured publishers first when nothing has
+    /// populated the cache yet. <see cref="GetPublisherInstance"/> is synchronous and can
+    /// only see an already-loaded cache, so callers that reach it cold get nothing back.
+    /// </summary>
+    async Task<ISecretsPublisher?> ResolvePublisherInstanceAsync(string publisherId)
+    {
+        if (_cachedPublishers is null)
+            await GetPublishersAsync();
+
+        return GetPublisherInstance(publisherId);
+    }
+
     public ISecretsPublisher? GetPublisherInstance(string publisherId)
     {
         if (_publisherInstances.TryGetValue(publisherId, out var cached))
@@ -255,7 +268,7 @@ public async Task<bool> TestConnectionAsync(string publisherId, CancellationToke
 
     public async Task<IReadOnlyList<PublisherRepository>> ListRepositoriesAsync(string publisherId, string? filter = null, CancellationToken cancellationToken = default)
     {
-        var publisher = GetPublisherInstance(publisherId);
+        var publisher = await ResolvePublisherInstanceAsync(publisherId);
         if (publisher == null)
             return new List<PublisherRepository>();
 
@@ -264,7 +277,7 @@ public async Task<IReadOnlyList<PublisherRepository>> ListRepositoriesAsync(stri
 
     public async Task PublishSecretsAsync(string publisherId, string repositoryId, IReadOnlyDictionary<string, string> secrets, IProgress<string>? progress = null, CancellationToken cancellationToken = default)
     {
-        var publisher = GetPublisherInstance(publisherId);
+        var publisher = await ResolvePublisherInstanceAsync(publisherId);
         if (publisher == null)
             throw new InvalidOperationException($"Publisher not found: {publisherId}");
 
diff --git a/src/MauiSherpa.MacOS/BlazorContentPage.cs b/src/MauiSherpa.MacOS/BlazorContentPage.cs
index 9f9546a5..67003265 100644
--- a/src/MauiSherpa.MacOS/BlazorContentPage.cs
+++ b/src/MauiSherpa.MacOS/BlazorContentPage.cs
@@ -1070,6 +1070,8 @@ void FullRebuildToolbar()
                 ("create", "New Secret", "plus"),
                 ("export", "Export", "square.and.arrow.up"),
                 ("export-selected", "Export Selected", "square.and.arrow.up"),
+                ("select", "Select", "checkmark.circle"),
+                ("publish-selected", "Publish Selected", "square.and.arrow.up"),
                 ("cancel-selection", "Cancel", "xmark"),
                 ("create-folder", "New Folder", "folder.badge.plus"),
                 ("rename-folder", "Rename Folder", "pencil"),
diff --git a/src/MauiSherpa/Components/SecretProviderPicker.razor b/src/MauiSherpa/Components/SecretProviderPicker.razor
index 3c5f54e4..453d9609 100644
--- a/src/MauiSherpa/Components/SecretProviderPicker.razor
+++ b/src/MauiSherpa/Components/SecretProviderPicker.razor
@@ -39,6 +39,7 @@
     {
         <section class="provider-popover"
                  id="@_popoverId"
+                 data-popover-panel
                  role="dialog"
                  aria-modal="false"
                  aria-labelledby="@_headingId"
@@ -221,6 +222,12 @@
             await _interopModule.InvokeVoidAsync("bindPopover", _rootId, _dotNetReference);
             _interopBound = true;
         }
+        else if (_isOpen && _interopModule is not null)
+        {
+            // Provider rows change height as their sync state resolves, so re-pin the
+            // panel to the trigger after every render while it is open.
+            await _interopModule.InvokeVoidAsync("positionPopover", _rootId);
+        }
         else if (!_isOpen && _restoreFocus && _interopModule is not null)
         {
             _restoreFocus = false;
diff --git a/src/MauiSherpa/Pages/Forms/WizardFormPage.cs b/src/MauiSherpa/Pages/Forms/WizardFormPage.cs
index 2e2151a9..292c0312 100644
--- a/src/MauiSherpa/Pages/Forms/WizardFormPage.cs
+++ b/src/MauiSherpa/Pages/Forms/WizardFormPage.cs
@@ -163,6 +163,7 @@ private void BuildPage()
             CornerRadius = 5,
             Padding = new Thickness(14, 4),
             HeightRequest = 30,
+            MinimumWidthRequest = 88,
             IsEnabled = false,
         };
         _primaryButton.SetDynamicResource(Button.BackgroundColorProperty, FormTheme.AccentPrimary);
@@ -238,9 +239,20 @@ void Apply()
             if (_primaryButton != null)
             {
                 _primaryButton.IsEnabled = _bridge.CanProceed && !_bridge.IsSubmitting;
-                _primaryButton.Text = _isOnLastStep
+
+                var primaryText = _isOnLastStep
                     ? (_bridge.SubmitText ?? DefaultSubmitText)
                     : "Next →";
+                if (!string.Equals(_primaryButton.Text, primaryText, StringComparison.Ordinal))
+                {
+                    _primaryButton.Text = primaryText;
+
+                    // The native button keeps the width measured for its previous label, so a
+                    // longer one gets clipped ("Next →" → "Publish" loses its last character).
+                    // Force the button and the row that lays it out to measure again.
+                    _primaryButton.InvalidateMeasure();
+                    (_primaryButton.Parent as IView)?.InvalidateMeasure();
+                }
             }
             if (_submittingIndicator != null)
             {
diff --git a/src/MauiSherpa/Pages/Modals/BatchPublishModal.razor b/src/MauiSherpa/Pages/Modals/BatchPublishModal.razor
new file mode 100644
index 00000000..a4c8c74f
--- /dev/null
+++ b/src/MauiSherpa/Pages/Modals/BatchPublishModal.razor
@@ -0,0 +1,588 @@
+@page "/modal/batch-publish"
+@using MauiSherpa.Core.Interfaces
+@using MauiSherpa.Pages.Forms
+@inject HybridFormBridgeHolder BridgeHolder
+@inject IPublishProfileService ProfileService
+@inject ISecretsPublisherService PublisherService
+@inject ILoggingService Logger
+@implements IDisposable
+
+<div class="batch-publish">
+    @if (isPreparing)
+    {
+        <div class="centered-state">
+            <i class="fa-solid fa-spinner fa-spin" style="font-size: 24px; color: var(--accent-color, #3b82f6);"></i>
+            <h3>Loading Destinations</h3>
+            <p class="step-description">Reading the repositories configured on each profile...</p>
+        </div>
+    }
+    else if (step == 1)
+    {
+        <h3>Publish In Sequence</h3>
+        <p class="step-description">
+            Each profile's secrets are re-resolved and published to its own destinations, one profile at a time.
+        </p>
+
+        <div class="select-controls">
+            <span class="select-count">@runs.Count(run => run.Include) of @runs.Count profiles selected</span>
+            <button class="btn-text-action" @onclick="ToggleAllProfiles">
+                @(runs.Any(run => run.CanPublish) && runs.Where(run => run.CanPublish).All(run => run.Include) ? "Uncheck All" : "Check All")
+            </button>
+        </div>
+
+        <div class="profile-checklist">
+            @foreach (var run in runs)
+            {
+                <label class="check-item @(run.CanPublish ? "" : "unavailable")">
+                    <input type="checkbox" checked="@run.Include" disabled="@(!run.CanPublish)"
+                           @onchange="@(e => { run.Include = e.Value is bool on && on; UpdateWizardState(); })" />
+                    <div class="profile-info">
+                        <span class="profile-name">@run.Profile.Name</span>
+                        @if (run.CanPublish)
+                        {
+                            <span class="profile-detail">
+                                @string.Join(", ", run.Destinations.Select(destination => destination.RepositoryFullName))
+                            </span>
+                        }
+                        else
+                        {
+                            <span class="profile-detail warning">
+                                <i class="fa-solid fa-triangle-exclamation"></i>
+                                No destinations configured — open the profile to add one
+                            </span>
+                        }
+                    </div>
+                </label>
+            }
+        </div>
+    }
+    else
+    {
+        <h3>Publishing</h3>
+        <p class="step-description">
+            @if (publishComplete)
+            {
+                @:All profiles processed.
+            }
+            else
+            {
+                @:Publishing each profile in sequence...
+            }
+        </p>
+
+        <div class="run-list">
+            @foreach (var run in runs.Where(run => run.Include))
+            {
+                <div class="run-row">
+                    <div class="status-icon">
+                        <i class="@GetStatusIcon(run.Status)" style="@GetStatusStyle(run.Status)"></i>
+                    </div>
+                    <div class="run-info">
+                        <div class="run-name">@run.Profile.Name</div>
+                        <div class="run-message @(run.Status == RunStatus.Error ? "failed" : "")">@run.StatusMessage</div>
+                        @foreach (var destination in run.Destinations)
+                        {
+                            <div class="run-destination @(destination.Status == RunStatus.Error ? "failed" : "")">
+                                <i class="@GetStatusIcon(destination.Status)" style="@GetStatusStyle(destination.Status)"></i>
+                                <i class="@GetProviderIcon(destination.ProviderId)"></i>
+                                <span class="destination-repo">@destination.RepositoryFullName</span>
+                                <span class="destination-message">@destination.StatusMessage</span>
+                            </div>
+                        }
+                    </div>
+                </div>
+            }
+        </div>
+
+        @if (publishComplete)
+        {
+            <div class="publish-summary-bar">
+                @if (FailureCount == 0)
+                {
+                    <i class="fa-solid fa-circle-check" style="color: #22c55e;"></i>
+                    <span>Published @SuccessCount profile(s)</span>
+                }
+                else
+                {
+                    <i class="fa-solid fa-triangle-exclamation" style="color: #f59e0b;"></i>
+                    <span>@SuccessCount succeeded, @FailureCount failed — see the log for details</span>
+                }
+            </div>
+        }
+    }
+</div>
+
+<style>
+    .batch-publish {
+        display: flex;
+        flex-direction: column;
+        height: 100%;
+        padding: 1rem 1.25rem;
+    }
+
+    .batch-publish h3 {
+        font-size: 16px;
+        font-weight: 600;
+        margin: 0 0 2px 0;
+        color: var(--text-primary);
+    }
+
+    .centered-state {
+        display: flex;
+        flex-direction: column;
+        align-items: center;
+        justify-content: center;
+        gap: 8px;
+        padding: 40px 20px;
+        text-align: center;
+    }
+
+    .step-description {
+        font-size: 12px;
+        color: var(--text-muted);
+        margin: 0 0 12px 0;
+    }
+
+    .select-controls {
+        display: flex;
+        justify-content: space-between;
+        align-items: center;
+        margin-bottom: 8px;
+    }
+
+    .select-count {
+        font-size: 12px;
+        color: var(--text-muted);
+    }
+
+    .btn-text-action {
+        background: none;
+        border: none;
+        color: var(--accent-color, #3b82f6);
+        font-size: 13px;
+        cursor: pointer;
+        padding: 4px 0;
+    }
+
+    .btn-text-action:hover { text-decoration: underline; }
+
+    .profile-checklist, .run-list {
+        display: flex;
+        flex-direction: column;
+        overflow-y: auto;
+        max-height: 360px;
+    }
+
+    .check-item {
+        display: flex;
+        align-items: flex-start;
+        gap: 8px;
+        padding: 8px;
+        border-bottom: 1px solid var(--border-color, #e2e8f0);
+        cursor: pointer;
+    }
+
+    .check-item:last-child { border-bottom: none; }
+    .check-item.unavailable { cursor: default; opacity: 0.75; }
+
+    .check-item input[type="checkbox"] {
+        width: 16px;
+        height: 16px;
+        margin-top: 2px;
+        flex-shrink: 0;
+        accent-color: var(--accent-color, #3b82f6);
+    }
+
+    .profile-info {
+        display: flex;
+        flex-direction: column;
+        min-width: 0;
+    }
+
+    .profile-name {
+        font-size: 13px;
+        font-weight: 500;
+        color: var(--text-primary);
+    }
+
+    .profile-detail {
+        font-size: 11px;
+        color: var(--text-muted);
+    }
+
+    .profile-detail.warning { color: #b45309; }
+    .profile-detail.warning i { margin-right: 4px; }
+
+    .run-row {
+        display: flex;
+        gap: 8px;
+        padding: 8px;
+        border-bottom: 1px solid var(--border-color, #e2e8f0);
+    }
+
+    .run-row:last-child { border-bottom: none; }
+
+    .status-icon {
+        width: 16px;
+        text-align: center;
+        margin-top: 2px;
+        flex-shrink: 0;
+    }
+
+    .run-info {
+        display: flex;
+        flex-direction: column;
+        gap: 2px;
+        min-width: 0;
+    }
+
+    .run-name {
+        font-size: 13px;
+        font-weight: 500;
+        color: var(--text-primary);
+    }
+
+    .run-message {
+        font-size: 11px;
+        color: var(--text-muted);
+    }
+
+    .run-destination {
+        display: flex;
+        align-items: baseline;
+        flex-wrap: wrap;
+        gap: 6px;
+        font-size: 11px;
+        color: var(--text-muted);
+        padding-left: 4px;
+    }
+
+    .destination-repo { color: var(--text-secondary); }
+
+    /* Publisher errors carry the detail that matters, so let them wrap instead of clipping. */
+    .destination-message,
+    .run-message {
+        overflow-wrap: anywhere;
+    }
+
+    .run-destination.failed .destination-message,
+    .run-message.failed {
+        color: #b91c1c;
+    }
+
+    :global(.theme-dark) .run-destination.failed .destination-message,
+    :global(.theme-dark) .run-message.failed { color: #f87171; }
+
+    .publish-summary-bar {
+        display: flex;
+        align-items: center;
+        gap: 8px;
+        margin-top: 10px;
+        padding: 8px 12px;
+        border-radius: 6px;
+        background: var(--bg-tertiary);
+        font-size: 12px;
+        color: var(--text-secondary);
+    }
+
+    :global(.theme-dark) .profile-detail.warning { color: #fbbf24; }
+</style>
+
+@code {
+    IReadOnlyList<PublishProfile> profiles = Array.Empty<PublishProfile>();
+    List<ProfileRunVM> runs = new();
+    readonly CancellationTokenSource cancellation = new();
+    bool isPreparing = true;
+    bool isPublishing;
+    bool publishComplete;
+    int step = 1;
+
+    int SuccessCount => runs.Count(run => run.Include && run.Status == RunStatus.Success);
+    int FailureCount => runs.Count(run => run.Include && run.Status == RunStatus.Error);
+
+    protected override async Task OnInitializedAsync()
+    {
+        var bridge = BridgeHolder.Current;
+        if (bridge is null)
+            return;
+
+        if (bridge.Parameters.TryGetValue("Profiles", out var value) &&
+            value is IReadOnlyList<PublishProfile> selected)
+        {
+            profiles = selected;
+        }
+
+        bridge.SubmitRequested += OnSubmitRequested;
+        bridge.SetWizardState(showBack: false, showNext: false, showSubmit: false, canProceed: false, submitText: "Publish");
+        StateHasChanged();
+
+        runs = new List<ProfileRunVM>();
+        foreach (var profile in profiles)
+        {
+            var run = new ProfileRunVM { Profile = profile };
+            run.Destinations = await LoadDestinationsAsync(profile);
+            run.Include = run.CanPublish;
+            runs.Add(run);
+        }
+
+        isPreparing = false;
+        UpdateWizardState();
+        StateHasChanged();
+    }
+
+    async Task<List<DestinationVM>> LoadDestinationsAsync(PublishProfile profile)
+    {
+        if (profile.Publishers.Count > 0)
+        {
+            return profile.Publishers
+                .Select(publisher => new DestinationVM
+                {
+                    PublisherId = publisher.PublisherId,
+                    PublisherName = publisher.PublisherName,
+                    ProviderId = publisher.ProviderId,
+                    RepositoryFullName = publisher.RepositoryFullName
+                })
+                .ToList();
+        }
+
+        // Legacy profiles stored a single publisher + repository instead of a list.
+        if (string.IsNullOrEmpty(profile.PublisherId) || string.IsNullOrEmpty(profile.RepositoryId))
+            return new List<DestinationVM>();
+
+        try
+        {
+            var publisher = await PublisherService.GetPublisherAsync(profile.PublisherId);
+            if (publisher is null)
+                return new List<DestinationVM>();
+
+            return new List<DestinationVM>
+            {
+                new()
+                {
+                    PublisherId = publisher.Id,
+                    PublisherName = publisher.Name,
+                    ProviderId = publisher.ProviderId,
+                    RepositoryFullName = profile.RepositoryFullName ?? profile.RepositoryId
+                }
+            };
+        }
+        catch (Exception ex)
+        {
+            Logger.LogWarning($"Failed to load destinations for profile '{profile.Name}': {ex.Message}");
+            return new List<DestinationVM>();
+        }
+    }
+
+    void UpdateWizardState()
+    {
+        var bridge = BridgeHolder.Current;
+        if (bridge is null)
+            return;
+
+        bridge.SetWizardState(
+            showBack: false,
+            showNext: false,
+            showSubmit: (step == 1 && !isPublishing) || publishComplete,
+            canProceed: publishComplete || runs.Any(run => run.Include && run.CanPublish),
+            submitText: publishComplete ? "Done" : "Publish");
+    }
+
+    void ToggleAllProfiles()
+    {
+        var publishable = runs.Where(run => run.CanPublish).ToList();
+        var allChecked = publishable.All(run => run.Include);
+        foreach (var run in publishable)
+            run.Include = !allChecked;
+        UpdateWizardState();
+    }
+
+    async Task OnSubmitRequested()
+    {
+        var bridge = BridgeHolder.Current;
+
+        if (publishComplete)
+        {
+            if (bridge is not null)
+            {
+                bridge.Result = true;
+                bridge.PreventSubmitClose = false;
+            }
+            return;
+        }
+
+        if (step != 1)
+            return;
+
+        var selected = runs.Where(run => run.Include && run.CanPublish).ToList();
+        if (selected.Count == 0)
+            return;
+
+        // Hold the wizard open while the sequence runs, then let "Done" close it.
+        if (bridge is not null)
+            bridge.PreventSubmitClose = true;
+
+        step = 2;
+        isPublishing = true;
+        UpdateWizardState();
+        await InvokeAsync(StateHasChanged);
+
+        foreach (var run in selected)
+        {
+            if (cancellation.IsCancellationRequested)
+                return;
+
+            await PublishRunAsync(run);
+        }
+
+        isPublishing = false;
+        publishComplete = true;
+        UpdateWizardState();
+        await InvokeAsync(StateHasChanged);
+    }
+
+    async Task PublishRunAsync(ProfileRunVM run)
+    {
+        run.Status = RunStatus.InProgress;
+        run.StatusMessage = "Resolving secrets...";
+        await InvokeAsync(StateHasChanged);
+
+        Dictionary<string, string> secrets;
+        try
+        {
+            var progress = new Progress<string>(message =>
+            {
+                run.StatusMessage = message;
+                InvokeAsync(StateHasChanged);
+            });
+
+            secrets = await ProfileService.ResolveSecretsAsync(
+                run.Profile,
+                progress,
+                cancellation.Token);
+        }
+        catch (OperationCanceledException)
+        {
+            return;
+        }
+        catch (Exception ex)
+        {
+            run.Status = RunStatus.Error;
+            run.StatusMessage = $"Failed to resolve secrets: {ex.Message}";
+            Logger.LogError($"Failed to resolve secrets for '{run.Profile.Name}': {ex}");
+            await InvokeAsync(StateHasChanged);
+            return;
+        }
+
+        if (secrets.Count == 0)
+        {
+            run.Status = RunStatus.Error;
+            run.StatusMessage = "No secrets could be resolved from this profile.";
+            await InvokeAsync(StateHasChanged);
+            return;
+        }
+
+        run.StatusMessage = $"Publishing {secrets.Count} secret(s)...";
+        await InvokeAsync(StateHasChanged);
+
+        foreach (var destination in run.Destinations)
+        {
+            if (cancellation.IsCancellationRequested)
+                return;
+
+            destination.Status = RunStatus.InProgress;
+            destination.StatusMessage = "Publishing...";
+            await InvokeAsync(StateHasChanged);
+
+            try
+            {
+                var progress = new Progress<string>(message =>
+                {
+                    destination.StatusMessage = message;
+                    InvokeAsync(StateHasChanged);
+                });
+
+                await PublisherService.PublishSecretsAsync(
+                    destination.PublisherId,
+                    destination.RepositoryFullName,
+                    secrets,
+                    progress,
+                    cancellation.Token);
+
+                destination.Status = RunStatus.Success;
+                destination.StatusMessage = $"{secrets.Count} secret(s) published";
+            }
+            catch (Exception ex)
+            {
+                destination.Status = RunStatus.Error;
+                destination.StatusMessage = $"Error: {ex.Message}";
+                Logger.LogError($"Failed to publish '{run.Profile.Name}' to {destination.RepositoryFullName}: {ex}");
+            }
+
+            await InvokeAsync(StateHasChanged);
+        }
+
+        var failed = run.Destinations.Count(destination => destination.Status == RunStatus.Error);
+        run.Status = failed == 0 ? RunStatus.Success : RunStatus.Error;
+        run.StatusMessage = failed == 0
+            ? $"Published {secrets.Count} secret(s) to {run.Destinations.Count} destination(s)"
+            : $"{run.Destinations.Count - failed} of {run.Destinations.Count} destination(s) published";
+        await InvokeAsync(StateHasChanged);
+    }
+
+    static string GetStatusIcon(RunStatus status) => status switch
+    {
+        RunStatus.InProgress => "fa-solid fa-spinner fa-spin",
+        RunStatus.Success => "fa-solid fa-circle-check",
+        RunStatus.Error => "fa-solid fa-circle-xmark",
+        _ => "fa-solid fa-circle"
+    };
+
+    static string GetStatusStyle(RunStatus status) => status switch
+    {
+        RunStatus.InProgress => "color: var(--accent-color, #3b82f6);",
+        RunStatus.Success => "color: #22c55e;",
+        RunStatus.Error => "color: #ef4444;",
+        _ => "color: var(--text-muted); font-size: 8px;"
+    };
+
+    static string GetProviderIcon(string providerId) => providerId switch
+    {
+        "github" => "fa-brands fa-github",
+        "gitlab" => "fa-brands fa-gitlab",
+        "gitea" => "fa-solid fa-mug-hot",
+        "azuredevops" or "azure-devops" => "fa-brands fa-microsoft",
+        _ => "fa-solid fa-cloud"
+    };
+
+    public void Dispose()
+    {
+        // Only cancel — an in-flight resolve/publish still holds this token.
+        cancellation.Cancel();
+
+        var bridge = BridgeHolder.Current;
+        if (bridge is not null)
+            bridge.SubmitRequested -= OnSubmitRequested;
+    }
+
+    class ProfileRunVM
+    {
+        public PublishProfile Profile { get; init; } = default!;
+        public bool Include { get; set; }
+        public List<DestinationVM> Destinations { get; set; } = new();
+        public RunStatus Status { get; set; } = RunStatus.Pending;
+        public string StatusMessage { get; set; } = "";
+        public bool CanPublish => Destinations.Count > 0;
+    }
+
+    class DestinationVM
+    {
+        public string PublisherId { get; set; } = "";
+        public string PublisherName { get; set; } = "";
+        public string ProviderId { get; set; } = "";
+        public string RepositoryFullName { get; set; } = "";
+        public RunStatus Status { get; set; } = RunStatus.Pending;
+        public string StatusMessage { get; set; } = "";
+    }
+
+    enum RunStatus { Pending, InProgress, Success, Error }
+}
diff --git a/src/MauiSherpa/Pages/Modals/BatchPublishPage.cs b/src/MauiSherpa/Pages/Modals/BatchPublishPage.cs
new file mode 100644
index 00000000..f32fc5c6
--- /dev/null
+++ b/src/MauiSherpa/Pages/Modals/BatchPublishPage.cs
@@ -0,0 +1,38 @@
+using MauiSherpa.Core.Interfaces;
+using MauiSherpa.Pages.Forms;
+#if MACOSAPP
+using Microsoft.Maui.Platforms.MacOS.Platform;
+#endif
+#if LINUXGTK
+using Microsoft.Maui.Platforms.Linux.Gtk4.Platform;
+#endif
+
+namespace MauiSherpa.Pages.Modals;
+
+/// <summary>
+/// Publishes several publish profiles one after another, re-resolving each profile's
+/// secrets first — used when a certificate or key changed outside of the profiles.
+/// </summary>
+public class BatchPublishPage : WizardFormPage<bool>
+{
+    protected override string FormTitle => "Publish Profiles";
+    protected override string DefaultSubmitText => "Publish";
+    protected override string BlazorRoute => "/modal/batch-publish";
+
+    public BatchPublishPage(
+        HybridFormBridgeHolder bridgeHolder,
+        IReadOnlyList<PublishProfile> profiles)
+        : base(bridgeHolder)
+    {
+        Bridge.Parameters["Profiles"] = profiles;
+#if MACOSAPP
+        MacOSPage.SetModalSheetSizesToContent(this, false);
+        MacOSPage.SetModalSheetWidth(this, 650);
+        MacOSPage.SetModalSheetHeight(this, 550);
+#elif LINUXGTK
+        GtkPage.SetModalSizesToContent(this, false);
+        GtkPage.SetModalWidth(this, 600);
+        GtkPage.SetModalHeight(this, 550);
+#endif
+    }
+}
diff --git a/src/MauiSherpa/Pages/SecretsPublish.razor b/src/MauiSherpa/Pages/SecretsPublish.razor
index cfd36020..af289cdc 100644
--- a/src/MauiSherpa/Pages/SecretsPublish.razor
+++ b/src/MauiSherpa/Pages/SecretsPublish.razor
@@ -21,11 +21,11 @@
         Configure a secrets provider in <a href="settings">Settings</a> to create and manage publish profiles.
     </div>
 }
-else if (isLoading)
+else if (isLoading && profiles.Count == 0)
 {
     <div class="loading-inline"><i class="fas fa-spinner fa-spin"></i> Loading profiles...</div>
 }
-else if (!profiles.Any())
+else if (profiles.Count == 0)
 {
     <div class="empty-state">
         <div class="empty-icon"><i class="fas fa-upload"></i></div>
@@ -38,24 +38,60 @@ else if (!profiles.Any())
 }
 else
 {
+    @if (isSelectionMode)
+    {
+        <div class="selection-bar">
+            <label class="select-all-checkbox">
+                <input type="checkbox"
+                       checked="@AllProfilesSelected"
+                       @onchange="@(e => ToggleAllProfiles(e.Value is bool on && on))" />
+                <span>Select all profiles</span>
+            </label>
+            <div class="selection-actions">
+                <span class="selection-count">@selectedProfileIds.Count selected</span>
+                <button class="btn btn-primary btn-sm"
+                        disabled="@(selectedProfileIds.Count == 0)"
+                        @onclick="PublishSelectedProfiles">
+                    <i class="fa-solid fa-upload"></i>
+                    <span>Publish @selectedProfileIds.Count</span>
+                </button>
+            </div>
+        </div>
+    }
+    else if (isRefreshing)
+    {
+        <div class="loading-inline"><i class="fas fa-spinner fa-spin"></i> Refreshing profiles...</div>
+    }
+
     <div class="profile-grid">
         @foreach (var profile in profiles)
         {
-            <div class="profile-card">
+            <div class="profile-card @(isSelectionMode && selectedProfileIds.Contains(profile.Id) ? "selected" : "")">
                 <div class="profile-header">
+                    @if (isSelectionMode)
+                    {
+                        <label class="profile-select" title="Include in a sequential publish">
+                            <input type="checkbox"
+                                   checked="@selectedProfileIds.Contains(profile.Id)"
+                                   @onchange="@(e => ToggleProfileSelection(profile.Id, e.Value is bool on && on))" />
+                        </label>
+                    }
                     <div class="profile-title">@profile.Name</div>
-                    <div class="profile-actions">
-                        <MauiSherpa.Components.SecretProviderPickerHost
-                            @key="@($"publish-profile-sync-{profile.Id}")"
-                            Item="@(new SecretItemRef(SecretItemKind.PublishProfile, profile.Id, profile.Name))"
-                            EmptySelectionRequiresConfirmation="true" />
-                        <button class="btn-icon" @onclick="@(() => EditProfile(profile))" title="Edit">
-                            <i class="fa-solid fa-pen"></i>
-                        </button>
-                        <button class="btn-icon danger" @onclick="@(() => DeleteProfile(profile))" title="Delete">
-                            <i class="fa-solid fa-trash-can"></i>
-                        </button>
-                    </div>
+                    @if (!isSelectionMode)
+                    {
+                        <div class="profile-actions">
+                            <MauiSherpa.Components.SecretProviderPickerHost
+                                @key="@($"publish-profile-sync-{profile.Id}")"
+                                Item="@(new SecretItemRef(SecretItemKind.PublishProfile, profile.Id, profile.Name))"
+                                EmptySelectionRequiresConfirmation="true" />
+                            <button class="btn-icon" @onclick="@(() => EditProfile(profile))" title="Edit">
+                                <i class="fa-solid fa-pen"></i>
+                            </button>
+                            <button class="btn-icon danger" @onclick="@(() => DeleteProfile(profile))" title="Delete">
+                                <i class="fa-solid fa-trash-can"></i>
+                            </button>
+                        </div>
+                    }
                 </div>
 
                 @if (!string.IsNullOrEmpty(profile.Description))
@@ -103,35 +139,45 @@ else
                     </div>
                 }
 
-                <div class="profile-footer">
-                    <button class="btn btn-primary btn-sm" @onclick="@(() => PublishProfile(profile))"
-                            disabled="@(publishingProfileId == profile.Id)">
-                        @if (publishingProfileId == profile.Id)
-                        {
-                            <i class="fa-solid fa-spinner fa-spin"></i> <span>Publishing...</span>
-                        }
-                        else
-                        {
-                            <i class="fa-solid fa-upload"></i> <span>Publish</span>
-                        }
-                    </button>
-                </div>
+                @if (!isSelectionMode)
+                {
+                    <div class="profile-footer">
+                        <button class="btn btn-primary btn-sm" @onclick="@(() => PublishProfile(profile))"
+                                disabled="@(publishingProfileId == profile.Id)">
+                            @if (publishingProfileId == profile.Id)
+                            {
+                                <i class="fa-solid fa-spinner fa-spin"></i> <span>Publishing...</span>
+                            }
+                            else
+                            {
+                                <i class="fa-solid fa-upload"></i> <span>Publish</span>
+                            }
+                        </button>
+                    </div>
+                }
             </div>
         }
     </div>
 }
 
 @code {
+    const int RefreshDebounceMilliseconds = 250;
+
     List<PublishProfile> profiles = new();
-    bool isLoading;
+    readonly HashSet<string> selectedProfileIds = new(StringComparer.Ordinal);
+    bool isLoading = true;
+    bool isRefreshing;
+    bool isSelectionMode;
     string? publishingProfileId;
+    CancellationTokenSource? refreshDebounceCts;
+    int loadSequence;
+
+    bool AllProfilesSelected => profiles.Count > 0 &&
+        profiles.All(profile => selectedProfileIds.Contains(profile.Id));
 
     protected override async Task OnInitializedAsync()
     {
-        ToolbarService.SetItems(
-            new ToolbarAction("create", "New Profile", "plus"),
-            new ToolbarAction("refresh", "Refresh", "arrow.clockwise")
-        );
+        UpdateToolbarItems();
         ToolbarService.SetSearch(null);
         ToolbarService.SetFilters();
         ToolbarService.ToolbarItemClicked += OnToolbarItemClicked;
@@ -141,6 +187,35 @@ else
         await LoadProfilesAsync();
     }
 
+    // SetItems resets search/filters and prompts a native toolbar rebuild, so only call it
+    // when the item set actually changes — enabled state has its own cheaper path.
+    void UpdateToolbarItems()
+    {
+        if (isSelectionMode)
+        {
+            ToolbarService.SetItems(
+                new ToolbarAction("publish-selected", "Publish Selected", "square.and.arrow.up"),
+                new ToolbarAction("cancel-selection", "Cancel", "xmark", IsPrimary: false));
+        }
+        else
+        {
+            ToolbarService.SetItems(
+                new ToolbarAction("create", "New Profile", "plus"),
+                new ToolbarAction("select", "Select", "checkmark.circle"),
+                new ToolbarAction("refresh", "Refresh", "arrow.clockwise"));
+        }
+
+        UpdateToolbarEnabledState();
+    }
+
+    void UpdateToolbarEnabledState()
+    {
+        if (isSelectionMode)
+            ToolbarService.SetItemEnabled("publish-selected", selectedProfileIds.Count > 0);
+        else
+            ToolbarService.SetItemEnabled("select", profiles.Count > 0);
+    }
+
     void OnToolbarItemClicked(string actionId)
     {
         switch (actionId)
@@ -148,31 +223,84 @@ else
             case "create":
                 InvokeAsync(CreateProfile);
                 break;
+            case "select":
+                InvokeAsync(() => { EnterSelectionMode(); return Task.CompletedTask; });
+                break;
+            case "publish-selected":
+                InvokeAsync(PublishSelectedProfiles);
+                break;
+            case "cancel-selection":
+                InvokeAsync(() => { ExitSelectionMode(); return Task.CompletedTask; });
+                break;
             case "refresh":
                 ToolbarService.SetItemEnabled("refresh", false);
                 InvokeAsync(async () =>
                 {
-                    try { await LoadProfilesAsync(); }
+                    try { await LoadProfilesAsync(refreshFromProviders: true); }
                     finally { ToolbarService.SetItemEnabled("refresh", true); }
                 });
                 break;
         }
     }
 
-    void OnProfilesChanged() => InvokeAsync(async () =>
+    // Syncing an item raises one change per provider placement, so collapse the burst
+    // into a single background reload instead of thrashing the whole grid.
+    void OnProfilesChanged()
     {
-        await LoadProfilesAsync();
-        StateHasChanged();
-    });
+        var debounce = new CancellationTokenSource();
+        var previous = Interlocked.Exchange(ref refreshDebounceCts, debounce);
+        previous?.Cancel();
+        previous?.Dispose();
+
+        _ = InvokeAsync(async () =>
+        {
+            try
+            {
+                await Task.Delay(RefreshDebounceMilliseconds, debounce.Token);
+            }
+            catch (OperationCanceledException)
+            {
+                return;
+            }
+
+            await LoadProfilesAsync(background: true);
+        });
+    }
 
-    async Task LoadProfilesAsync()
+    async Task LoadProfilesAsync(bool background = false, bool refreshFromProviders = false)
     {
-        isLoading = true;
+        var sequence = ++loadSequence;
+        if (background && profiles.Count > 0)
+            isRefreshing = true;
+        else
+            isLoading = true;
         StateHasChanged();
 
         try
         {
-            profiles = (await ProfileService.GetProfilesAsync()).ToList();
+            // Providers report in as they finish, so the local vault's profiles paint
+            // immediately instead of waiting on a remote vault's round trips.
+            var progress = new Progress<IReadOnlyList<PublishProfile>>(partial =>
+                _ = InvokeAsync(() =>
+                {
+                    if (sequence != loadSequence)
+                        return;
+
+                    ApplyLoadedProfiles(partial);
+                    isLoading = false;
+                    isRefreshing = true;
+                    StateHasChanged();
+                }));
+
+            var loaded = refreshFromProviders
+                ? await ProfileService.RefreshProfilesAsync(progress)
+                : await ProfileService.GetProfilesAsync(progress);
+
+            // A newer load started while this one was in flight — let it win.
+            if (sequence != loadSequence)
+                return;
+
+            ApplyLoadedProfiles(loaded);
         }
         catch (Exception ex)
         {
@@ -180,11 +308,65 @@ else
         }
         finally
         {
-            isLoading = false;
+            if (sequence == loadSequence)
+            {
+                isLoading = false;
+                isRefreshing = false;
+            }
             StateHasChanged();
         }
     }
 
+    void ApplyLoadedProfiles(IReadOnlyList<PublishProfile> loaded)
+    {
+        profiles = loaded.ToList();
+        selectedProfileIds.IntersectWith(profiles.Select(profile => profile.Id));
+        if (isSelectionMode && profiles.Count == 0)
+        {
+            isSelectionMode = false;
+            UpdateToolbarItems();
+            return;
+        }
+
+        UpdateToolbarEnabledState();
+    }
+
+    void EnterSelectionMode()
+    {
+        isSelectionMode = true;
+        selectedProfileIds.Clear();
+        UpdateToolbarItems();
+        StateHasChanged();
+    }
+
+    void ExitSelectionMode()
+    {
+        isSelectionMode = false;
+        selectedProfileIds.Clear();
+        UpdateToolbarItems();
+        StateHasChanged();
+    }
+
+    void ToggleProfileSelection(string profileId, bool selected)
+    {
+        if (selected)
+            selectedProfileIds.Add(profileId);
+        else
+            selectedProfileIds.Remove(profileId);
+        UpdateToolbarEnabledState();
+    }
+
+    void ToggleAllProfiles(bool selected)
+    {
+        selectedProfileIds.Clear();
+        if (selected)
+        {
+            foreach (var profile in profiles)
+                selectedProfileIds.Add(profile.Id);
+        }
+        UpdateToolbarEnabledState();
+    }
+
     async Task CreateProfile()
     {
         var page = new Modals.PublishProfileEditorPage(BridgeHolder);
@@ -197,7 +379,7 @@ else
                     SecretItemKind.PublishProfile,
                     result.Id,
                     result.Name));
-            await LoadProfilesAsync();
+            await LoadProfilesAsync(background: true);
             await AlertService.ShowToastAsync($"Profile '{result.Name}' created.");
         }
     }
@@ -219,7 +401,7 @@ else
                     item with { DisplayName = result.Name },
                     CloudSecretsService.ActiveProvider.Id);
             }
-            await LoadProfilesAsync();
+            await LoadProfilesAsync(background: true);
             await AlertService.ShowToastAsync($"Profile '{result.Name}' updated.");
         }
     }
@@ -268,10 +450,40 @@ else
         }
     }
 
+    async Task PublishSelectedProfiles()
+    {
+        var selected = profiles
+            .Where(profile => selectedProfileIds.Contains(profile.Id))
+            .ToList();
+        if (selected.Count == 0)
+            return;
+
+        try
+        {
+            var page = new Modals.BatchPublishPage(BridgeHolder, selected);
+            var result = await FormModalService.ShowAsync<bool>(page);
+
+            if (result == true)
+            {
+                ExitSelectionMode();
+                await AlertService.ShowToastAsync(
+                    $"Finished publishing {selected.Count} profile(s).");
+            }
+        }
+        catch (Exception ex)
+        {
+            Logger.LogError($"Failed to publish selected profiles: {ex}");
+            await AlertService.ShowAlertAsync("Error", $"Failed to publish: {ex.Message}");
+        }
+    }
+
     public void Dispose()
     {
         ToolbarService.ToolbarItemClicked -= OnToolbarItemClicked;
         ProfileService.OnProfilesChanged -= OnProfilesChanged;
+        var debounce = Interlocked.Exchange(ref refreshDebounceCts, null);
+        debounce?.Cancel();
+        debounce?.Dispose();
     }
 }
 
@@ -345,18 +557,77 @@ else
         gap: 0.5rem;
     }
 
+    .profile-card.selected {
+        outline: 2px solid var(--accent-primary, #3b82f6);
+        outline-offset: -2px;
+    }
+
     .profile-header {
         display: flex;
         justify-content: space-between;
         align-items: flex-start;
+        gap: 0.5rem;
+    }
+
+    .profile-select {
+        display: flex;
+        align-items: center;
+        cursor: pointer;
+    }
+
+    .profile-select input {
+        width: 18px;
+        height: 18px;
+        accent-color: var(--accent-primary);
     }
 
     .profile-title {
+        flex: 1;
+        min-width: 0;
         font-size: 1rem;
         font-weight: 600;
         color: var(--text-primary);
     }
 
+    /* Selection bar */
+    .selection-bar {
+        display: flex;
+        align-items: center;
+        justify-content: space-between;
+        gap: 1rem;
+        padding: 0.75rem 1rem;
+        margin-bottom: 0.75rem;
+        background: var(--card-bg);
+        border-radius: 0.75rem;
+    }
+
+    .select-all-checkbox {
+        display: flex;
+        align-items: center;
+        gap: 0.5rem;
+        font-size: 0.875rem;
+        color: var(--text-secondary);
+        cursor: pointer;
+    }
+
+    .select-all-checkbox input {
+        width: 18px;
+        height: 18px;
+        accent-color: var(--accent-primary);
+    }
+
+    .selection-actions {
+        display: flex;
+        align-items: center;
+        gap: 0.75rem;
+    }
+
+    .selection-count {
+        font-size: 0.8125rem;
+        color: var(--text-muted);
+        white-space: nowrap;
+    }
+
     .profile-actions {
         display: flex;
         gap: 2px;
diff --git a/src/MauiSherpa/wwwroot/js/mauiSherpaPopovers.js b/src/MauiSherpa/wwwroot/js/mauiSherpaPopovers.js
index 72ed9c33..094b9e5f 100644
--- a/src/MauiSherpa/wwwroot/js/mauiSherpaPopovers.js
+++ b/src/MauiSherpa/wwwroot/js/mauiSherpaPopovers.js
@@ -1,4 +1,5 @@
 const popoverBindings = new Map();
+const POPOVER_VIEWPORT_MARGIN = 8;
 
 export function ensureStylesheet(href) {
     const absoluteHref = new URL(href, document.baseURI).href;
@@ -19,6 +20,47 @@ export function ensureStylesheets(...hrefs) {
     hrefs.flat().forEach(ensureStylesheet);
 }
 
+/**
+ * Pins an open popover panel to its trigger using viewport coordinates.
+ * The panel is right-aligned with the trigger when there is room and clamped
+ * into the viewport otherwise, so triggers near an edge stay fully visible.
+ * Fixed positioning also escapes the `overflow-x: hidden` on the page content.
+ */
+export function positionPopover(rootId) {
+    const root = document.getElementById(rootId);
+    const panel = root?.querySelector("[data-popover-panel]");
+    const trigger = root?.querySelector("[data-popover-trigger]");
+    if (!panel || !trigger) {
+        return;
+    }
+
+    panel.style.position = "fixed";
+    panel.style.inset = "auto";
+
+    const triggerRect = trigger.getBoundingClientRect();
+    const panelRect = panel.getBoundingClientRect();
+    const viewportWidth = document.documentElement.clientWidth;
+    const viewportHeight = document.documentElement.clientHeight;
+
+    const maxLeft = viewportWidth - POPOVER_VIEWPORT_MARGIN - panelRect.width;
+    const left = Math.max(
+        POPOVER_VIEWPORT_MARGIN,
+        Math.min(triggerRect.right - panelRect.width, maxLeft));
+
+    let top = triggerRect.bottom + POPOVER_VIEWPORT_MARGIN;
+    if (top + panelRect.height > viewportHeight - POPOVER_VIEWPORT_MARGIN) {
+        const above = triggerRect.top - POPOVER_VIEWPORT_MARGIN - panelRect.height;
+        top = above >= POPOVER_VIEWPORT_MARGIN
+            ? above
+            : Math.max(
+                POPOVER_VIEWPORT_MARGIN,
+                viewportHeight - POPOVER_VIEWPORT_MARGIN - panelRect.height);
+    }
+
+    panel.style.left = `${Math.round(left)}px`;
+    panel.style.top = `${Math.round(top)}px`;
+}
+
 export function bindPopover(rootId, dotNetReference) {
     unbindPopover(rootId);
 
@@ -51,9 +93,15 @@ export function bindPopover(rootId, dotNetReference) {
         close(true);
     };
 
+    const onReposition = () => positionPopover(rootId);
+
     document.addEventListener("pointerdown", onPointerDown, true);
     document.addEventListener("keydown", onKeyDown, true);
-    popoverBindings.set(rootId, { onPointerDown, onKeyDown });
+    document.addEventListener("scroll", onReposition, true);
+    window.addEventListener("resize", onReposition);
+    popoverBindings.set(rootId, { onPointerDown, onKeyDown, onReposition });
+
+    positionPopover(rootId);
 
     queueMicrotask(() => {
         const initialFocus = root.querySelector("[data-popover-initial-focus]");
@@ -70,6 +118,8 @@ export function unbindPopover(rootId) {
 
     document.removeEventListener("pointerdown", binding.onPointerDown, true);
     document.removeEventListener("keydown", binding.onKeyDown, true);
+    document.removeEventListener("scroll", binding.onReposition, true);
+    window.removeEventListener("resize", binding.onReposition);
     popoverBindings.delete(rootId);
 }
 
diff --git a/tests/MauiSherpa.Core.Tests/Services/PublishProfileServiceTests.cs b/tests/MauiSherpa.Core.Tests/Services/PublishProfileServiceTests.cs
index 12c02cc4..a22aa4cf 100644
--- a/tests/MauiSherpa.Core.Tests/Services/PublishProfileServiceTests.cs
+++ b/tests/MauiSherpa.Core.Tests/Services/PublishProfileServiceTests.cs
@@ -297,6 +297,103 @@ public void SerializeProfile_WithMultipleAppleAssets_RoundTripsSelections()
         deserialized.AppleConfigs.Single().ProvisioningProfiles.Should().Equal(config.ProvisioningProfiles);
     }
 
+    [Fact]
+    public async Task GetProfilesAsync_WhenCacheIsInvalidatedMidLoad_StillReturnsLoadedProfiles()
+    {
+        var profile = CreateProfile();
+        var syncCoordinator = new Mock<ISecretSyncCoordinator>();
+
+        _cloudService.SetupGet(x => x.ActiveProvider)
+            .Returns(new CloudSecretsProviderConfig(
+                "provider-1",
+                "Provider",
+                CloudSecretsProviderType.Local,
+                new Dictionary<string, string>()));
+        _cloudService
+            .Setup(x => x.ListSecretsAsync(It.IsAny<string>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(new[] { "sherpa-publish-profiles/" + profile.Id });
+        _cloudService
+            .Setup(x => x.GetSecretAsync(It.IsAny<string>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(() =>
+            {
+                // A provider sync completing mid-read invalidates the cache — the read
+                // that is already in flight must still hand its results back.
+                syncCoordinator.Raise(
+                    x => x.ItemStateChanged += null,
+                    new SecretItemRef(SecretItemKind.PublishProfile, profile.Id, profile.Name));
+                return JsonSerializer.SerializeToUtf8Bytes(profile, JsonOptions);
+            });
+
+        var sut = new PublishProfileService(
+            _cloudService.Object,
+            _certSync.Object,
+            _keystoreService.Object,
+            _secureStorage.Object,
+            _managedSecrets.Object,
+            _appleConnect.Object,
+            _appleIdentity.Object,
+            _identityState.Object,
+            _googleIdentity.Object,
+            _logger.Object,
+            providerRegistry: null,
+            syncCoordinator: syncCoordinator.Object);
+
+        var profiles = await sut.GetProfilesAsync();
+
+        profiles.Should().ContainSingle(loaded => loaded.Id == profile.Id);
+    }
+
+    [Fact]
+    public async Task GetProfilesAsync_DoesNotRefetchProfilesAHigherPriorityProviderAlreadyOwns()
+    {
+        var profile = CreateProfile();
+        var localKey = "sherpa-publish-profiles/" + profile.Id;
+        // Providers that cannot store '/' mangle the key, so the ids must still match.
+        var remoteKey = "sherpa-publish-profiles-" + profile.Id;
+        var payload = JsonSerializer.SerializeToUtf8Bytes(profile, JsonOptions);
+
+        var localConfig = new CloudSecretsProviderConfig(
+            "local", "Local", CloudSecretsProviderType.Local, new Dictionary<string, string>());
+        var remoteConfig = new CloudSecretsProviderConfig(
+            "remote", "Remote Vault", CloudSecretsProviderType.AzureKeyVault, new Dictionary<string, string>());
+
+        var local = new Mock<ICloudSecretsProvider>();
+        local.Setup(x => x.ListSecretsAsync(It.IsAny<string>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(new[] { localKey });
+        local.Setup(x => x.GetSecretAsync(localKey, It.IsAny<CancellationToken>()))
+            .ReturnsAsync(payload);
+
+        var remote = new Mock<ICloudSecretsProvider>();
+        remote.Setup(x => x.ListSecretsAsync(It.IsAny<string>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(new[] { remoteKey });
+
+        var registry = new Mock<ISecretsProviderRegistry>();
+        registry.Setup(x => x.GetProvidersAsync())
+            .ReturnsAsync(new[] { localConfig, remoteConfig });
+        registry.Setup(x => x.GetProviderAsync("local")).ReturnsAsync(local.Object);
+        registry.Setup(x => x.GetProviderAsync("remote")).ReturnsAsync(remote.Object);
+
+        var sut = new PublishProfileService(
+            _cloudService.Object,
+            _certSync.Object,
+            _keystoreService.Object,
+            _secureStorage.Object,
+            _managedSecrets.Object,
+            _appleConnect.Object,
+            _appleIdentity.Object,
+            _identityState.Object,
+            _googleIdentity.Object,
+            _logger.Object,
+            providerRegistry: registry.Object);
+
+        var profiles = await sut.GetProfilesAsync();
+
+        profiles.Should().ContainSingle(loaded => loaded.Id == profile.Id);
+        remote.Verify(
+            x => x.GetSecretAsync(It.IsAny<string>(), It.IsAny<CancellationToken>()),
+            Times.Never);
+    }
+
     static PublishProfile CreateProfile() => new(
         Id: "profile-1",
         Name: "Profile",
diff --git a/tests/MauiSherpa.Core.Tests/Services/SecretsPublisherServiceTests.cs b/tests/MauiSherpa.Core.Tests/Services/SecretsPublisherServiceTests.cs
new file mode 100644
index 00000000..b2689419
--- /dev/null
+++ b/tests/MauiSherpa.Core.Tests/Services/SecretsPublisherServiceTests.cs
@@ -0,0 +1,65 @@
+using System.Text.Json;
+using FluentAssertions;
+using MauiSherpa.Core.Interfaces;
+using MauiSherpa.Core.Services;
+using Moq;
+
+namespace MauiSherpa.Core.Tests.Services;
+
+public class SecretsPublisherServiceTests
+{
+    readonly Mock<ISecureStorageService> _secureStorage = new();
+    readonly Mock<ISecretsPublisherFactory> _factory = new();
+    readonly Mock<ILoggingService> _logger = new();
+    readonly Mock<ISecretsPublisher> _publisher = new();
+    readonly SecretsPublisherService _sut;
+
+    static readonly SecretsPublisherConfig Config = new(
+        Id: "publisher-1",
+        ProviderId: "github",
+        Name: "GitHub",
+        Settings: new Dictionary<string, string>());
+
+    public SecretsPublisherServiceTests()
+    {
+        _secureStorage.Setup(x => x.GetAsync("secrets_publishers"))
+            .ReturnsAsync(JsonSerializer.Serialize(new List<SecretsPublisherConfig> { Config }));
+        _factory.Setup(x => x.CreatePublisher(It.IsAny<SecretsPublisherConfig>()))
+            .Returns(_publisher.Object);
+
+        _sut = new SecretsPublisherService(
+            _secureStorage.Object,
+            _factory.Object,
+            _logger.Object);
+    }
+
+    [Fact]
+    public async Task PublishSecretsAsync_WithoutAPriorPublisherListing_StillResolvesThePublisher()
+    {
+        var secrets = new Dictionary<string, string> { ["KEY"] = "value" };
+
+        // No GetPublishersAsync() call first — a batch publish reaches this cold.
+        var publish = () => _sut.PublishSecretsAsync("publisher-1", "owner/repo", secrets);
+
+        await publish.Should().NotThrowAsync();
+        _publisher.Verify(
+            x => x.PublishSecretsAsync(
+                "owner/repo",
+                secrets,
+                It.IsAny<IProgress<string>?>(),
+                It.IsAny<CancellationToken>()),
+            Times.Once);
+    }
+
+    [Fact]
+    public async Task PublishSecretsAsync_WithAnUnknownPublisher_Throws()
+    {
+        var publish = () => _sut.PublishSecretsAsync(
+            "missing",
+            "owner/repo",
+            new Dictionary<string, string>());
+
+        await publish.Should().ThrowAsync<InvalidOperationException>()
+            .WithMessage("*missing*");
+    }
+}