diff --git a/.github/actions/get-backend-url/action.yml b/.github/actions/get-backend-url/action.yml
index 3dab6ed..10fd380 100644
--- a/.github/actions/get-backend-url/action.yml
+++ b/.github/actions/get-backend-url/action.yml
@@ -30,24 +30,34 @@ runs:
       run: |
         ENV="${{ inputs.environment }}"
         SERVICE_NAME="${ENV}-epitrello-backend"
+        REGION="${{ inputs.region }}"
+        PROJECT_ID="${{ inputs.project_id }}"
 
-        if [ -n "${{ inputs.project_id }}" ]; then
-          URL=$(gcloud run services describe $SERVICE_NAME \
-            --region ${{ inputs.region }} \
-            --project ${{ inputs.project_id }} \
-            --format="value(status.url)" 2>/dev/null || echo "")
+        URL=""
+        if [ -n "${PROJECT_ID}" ]; then
+          URL=$(gcloud run services describe "$SERVICE_NAME" \
+            --region "$REGION" \
+            --project "$PROJECT_ID" \
+            --format="value(status.url)" 2>&1) || true
         else
-          URL=$(gcloud run services describe $SERVICE_NAME \
-            --region ${{ inputs.region }} \
-            --format="value(status.url)" 2>/dev/null || echo "")
+          URL=$(gcloud run services describe "$SERVICE_NAME" \
+            --region "$REGION" \
+            --format="value(status.url)" 2>&1) || true
         fi
 
+        # Trim whitespace; if gcloud output contains error message, treat as empty
+        URL=$(echo "$URL" | tr -d '\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
+        case "$URL" in
+          https://*) ;;
+          *) URL="" ;;
+        esac
+
         if [ -z "$URL" ] && [ -n "${{ inputs.staging_api_url }}" ]; then
           URL="${{ inputs.staging_api_url }}"
         fi
 
         if [ -z "$URL" ]; then
-          REGION_SUFFIX="${{ inputs.region }}"
+          REGION_SUFFIX="$REGION"
           case "$REGION_SUFFIX" in
             europe-west1) REGION_SUFFIX="ew" ;;
             us-central1)  REGION_SUFFIX="uc" ;;
diff --git a/frontend/app/dashboard/page.tsx b/frontend/app/dashboard/page.tsx
index 5c28cdb..4722156 100644
--- a/frontend/app/dashboard/page.tsx
+++ b/frontend/app/dashboard/page.tsx
@@ -253,7 +253,7 @@ export default function DashboardPage() {
           <section className='mb-8'>
             <h2 className='text-lg font-medium mb-4 text-trello'>Overview</h2>
             <div className='grid grid-cols-1 md:grid-cols-2 gap-6'>
-              <div className='rounded-lg border border-accent bg-card p-4'>
+              <div className='rounded-2xl border border-accent p-4'>
                 <div className='flex items-center gap-2 mb-3'>
                   <BarChart3 className='h-5 w-5 text-muted-foreground' />
                   <span className='text-sm font-medium'>
@@ -284,7 +284,7 @@ export default function DashboardPage() {
                   </BarChart>
                 </ChartContainer>
               </div>
-              <div className='rounded-lg border border-accent bg-card p-4'>
+              <div className='rounded-2xl border border-accent p-4'>
                 <div className='flex items-center gap-2 mb-3'>
                   <PieChartIcon className='h-5 w-5 text-muted-foreground' />
                   <span className='text-sm font-medium'>
diff --git a/terraform/main.tf b/terraform/main.tf
index 859c825..56681f5 100644
--- a/terraform/main.tf
+++ b/terraform/main.tf
@@ -119,6 +119,9 @@ module "cloud_storage" {
     "http://localhost:3000" # For development
   ]
 
+  # Public read so uploaded image URLs (avatars, backgrounds) are accessible in the app
+  public_access = var.storage_public_read
+
   labels = local.common_labels
 
   depends_on = [module.service_accounts]
diff --git a/terraform/variables.tf b/terraform/variables.tf
index 0dbdfe2..2782854 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -273,6 +273,12 @@ variable "storage_location" {
   }
 }
 
+variable "storage_public_read" {
+  description = "Allow public read access on the uploads bucket so image URLs (avatars, backgrounds) work without signed URLs. Set to false to use signed URLs only."
+  type        = bool
+  default     = true
+}
+
 # ===================================
 # Cloud SQL
 # ===================================