diff --git a/scripts/zwik_client.py b/scripts/zwik_client.py
index 27cb5b7..54888de 100644
--- a/scripts/zwik_client.py
+++ b/scripts/zwik_client.py
@@ -28,7 +28,7 @@
 from logging.handlers import RotatingFileHandler
 from typing import Optional
 
-__version__ = "5.16"
+__version__ = "5.17"
 min_supported_conda_version = "4.5.4"
 max_supported_conda_version = "24.3.0"
 min_supported_bootstrap_version = 7
@@ -820,16 +820,58 @@ def conda_envs_dir(self):
 
     @property
     def yaml_hash(self):
+        from conda import CondaError
+
         if not self._yaml_hash:
             import hashlib
 
             hash_md5 = hashlib.md5()
-            with open(self.yaml_path, "r") as f:
-                for line in f.readlines():
-                    hash_md5.update(line.encode("utf-8"))
+
+            if self.env_data:
+                if "channels" in self.env_data:
+                    for channel in self.env_data["channels"]:
+                        hash_md5.update(str(channel).encode("utf-8"))
+
+                if "dependencies" in self.env_data:
+                    env_deps = self.get_dependencies(additional_dependencies=[])
+
+                    # Convert the MatchSpec objects to strings and sort them.
+                    # This allows the user to reorder the yaml file and not
+                    # trigger regeneration
+                    deps_to_hash = sorted([str(spec) for spec in env_deps.specs])
+
+                    for dep in deps_to_hash:
+                        hash_md5.update(dep.encode("utf-8"))
+            else:
+                raise CondaError(
+                    "env_data could not be loaded, "
+                    "check if zwik_environment.yaml is defined."
+                )
+
             self._yaml_hash = hash_md5.hexdigest()
+
         return self._yaml_hash
 
+    def get_legacy_yaml_hash(self):
+        import hashlib
+
+        hash_md5 = hashlib.md5()
+        with open(self.yaml_path, "r") as f:
+            in_allow_unsafe_block = False
+            for line in f.readlines():
+                if line.startswith("allow_unsafe:"):
+                    in_allow_unsafe_block = True
+                    continue
+
+                elif in_allow_unsafe_block and re.match(r"^[^\s#]", line):
+                    # Reached a new root-level key, stop skipping
+                    in_allow_unsafe_block = False
+
+                if not in_allow_unsafe_block:
+                    hash_md5.update(line.encode("utf-8"))
+
+        return hash_md5.hexdigest()
+
     @property
     def env_name(self):
         return self.lockfile_hash
@@ -893,9 +935,24 @@ def read_version_lock(self):
                 raise LockfileError("lock file seems corrupt")
             with open(path, "r") as fp:
                 data = yaml.load(fp)
+
                 if "yaml_hash" not in data:
                     raise LockfileError("lock file seems incomplete")
+
+                # 1. Check against the modern hash first
+                hash_matches = False
                 if data["yaml_hash"] == self.yaml_hash:
+                    hash_matches = True
+                else:
+                    # 2. Fallback: Check if it's a legacy lock file (<= 5.16)
+                    from conda.exports import VersionOrder
+
+                    script_ver = data.get("script_version", "0")
+                    if VersionOrder(str(script_ver)) <= VersionOrder("5.16"):
+                        if data["yaml_hash"] == self.get_legacy_yaml_hash():
+                            hash_matches = True
+
+                if hash_matches:
                     channel_alias = (
                         data.get("channel_alias"),
                         data.get("channel_alias").replace("http:", "https:"),
@@ -904,12 +961,11 @@ def read_version_lock(self):
                         raise LockfileError("lock file conda alias mismatch")
                     lock_file_channels = ";".join(data.get("channels", []))
                     env_channels = ";".join(self.channels)
-                    # also compare with list of default channels
-                    #  for backwards compatibility
                     def_channels = ";".join(self.settings.default_channels)
                     if lock_file_channels not in (env_channels, def_channels):
                         raise LockfileError("lock file conda channel mismatch")
                     return data
+
                 log.info(
                     "The lock file is not aligned with the actual environment file"
                 )
@@ -917,7 +973,7 @@ def read_version_lock(self):
         log.info("No version lock file found")
         return None
 
-    def write_version_lock(self, lock_dep, obsolete_pkgs=(), unsafe_pkgs=()):
+    def write_version_lock(self, lock_dep):
         import getpass
         import hashlib
         import io
@@ -939,14 +995,6 @@ def write_version_lock(self, lock_dep, obsolete_pkgs=(), unsafe_pkgs=()):
             "dependencies": sorted(lock_dep),
         }
 
-        labels = {}
-        for p in obsolete_pkgs:
-            labels[p] = "obsolete"
-        for p in unsafe_pkgs:
-            labels[p] = "unsafe"
-        if labels:
-            data["labels"] = labels
-
         stream = io.StringIO()
         yaml.dump(data, stream)
         output = stream.getvalue()
@@ -1012,16 +1060,17 @@ def create_lockfile(self, additional_dependencies=()):
         from conda.exceptions import (
             PackagesNotFoundError,
             ResolvePackageNotFound,
+            UnavailableInvalidChannel,
             UnsatisfiableError,
         )
         from conda.exports import subdir
 
         obsolete_pkgs = set()
-        unsafe_pkgs = set()
+        unsafe_pkgs = {}
         last_exception = None
-        # First check only the original urls, then also the obsolete labels
-        #  and finally also unsafe labels
+
         for labels in ((), ("obsolete",), ("obsolete", "unsafe")):
+            log.debug("Checking labels %s", labels)
             solver = self.get_solver(dependencies, labels)
             try:
                 link_precs = solver.solve_final_state()
@@ -1030,35 +1079,37 @@ def create_lockfile(self, additional_dependencies=()):
                     for prec in link_precs:
                         split_channel = prec.channel.name.split("/")
                         if len(split_channel) > 1:
-                            # Format is <channel>/labels/<label>
-                            _, _, label = split_channel
+                            label = split_channel[-1]
                             if label == "obsolete":
                                 obsolete_pkgs.add(prec.name)
-                            else:
-                                unsafe_pkgs.add(prec.name)
-                    if unsafe_pkgs:
-                        self.handle_unsafe_pkgs(unsafe_pkgs)
+                            elif label == "unsafe":
+                                unsafe_pkgs[prec.name] = prec.version
+                if unsafe_pkgs:
+                    self.handle_unsafe_pkgs(unsafe_pkgs)
                 break
             except (
                 PackagesNotFoundError,
                 ResolvePackageNotFound,
                 UnsatisfiableError,
+                UnavailableInvalidChannel,
             ) as exception:
                 last_exception = exception
         else:
             raise last_exception
 
-        if obsolete_pkgs:
+        for pkg_name in obsolete_pkgs:
             log.warning(
-                "WARNING: These packages are marked as obsolete,"
-                " try to update or find an alternative:\n%s"
-                ", ".join(obsolete_pkgs),
+                "The package '%s' is marked as OBSOLETE. "
+                "Consider updating to a newer version.",
+                pkg_name,
             )
-        if unsafe_pkgs:
+
+        for pkg_name in unsafe_pkgs:
             log.warning(
-                "WARNING: Packages below are marked as UNSAFE."
-                " Client continues because of comment in environment file.\n%s"
-                ", ".join(unsafe_pkgs),
+                "The package '%s' is marked as UNSAFE. "
+                "Client continues because it is explicitly allowed "
+                "in the environment file.",
+                pkg_name,
             )
 
         solved_dep_list = link_precs.item_list
@@ -1077,11 +1128,7 @@ def create_lockfile(self, additional_dependencies=()):
                 "dependencies": sorted(self.env_data["dependencies"][:]),
             }
         else:
-            self.write_version_lock(
-                lockfile_deps,
-                obsolete_pkgs,
-                unsafe_pkgs,
-            )
+            self.write_version_lock(lockfile_deps)
             self.lock_data = self.read_version_lock()
             assert self.lock_data
 
@@ -1136,31 +1183,38 @@ def get_solver(self, dependencies, labels):
         )
 
     def handle_unsafe_pkgs(self, unsafe_pkgs):
+        from conda import CondaError
         from conda.exports import MatchSpec
 
-        for pkg_name in unsafe_pkgs:
-            for index, env_dep in enumerate(self.env_data["dependencies"]):
-                env_dep_spec = MatchSpec(env_dep)
-                if env_dep_spec.name == pkg_name:
-                    comment = self.get_yaml_comment(
-                        self.env_data["dependencies"],
-                        index,
-                    )
-                    if comment and comment.strip().startswith(
-                        "# CAUTION: UNSAFE PACKAGE"
-                    ):
-                        break
-            else:
-                from conda import CondaError
+        allow_unsafe_data = self.env_data.get("allow_unsafe") or {}
+        confirm_msg = allow_unsafe_data.get("confirm", "")
+        allowed_pkgs = allow_unsafe_data.get("packages") or []
 
-                raise CondaError(
-                    "ERROR: The following package is UNSAFE,"
-                    " check {}/unsafe"
-                    " for more info: {}".format(
-                        self.settings.website_url,
-                        pkg_name,
-                    )
-                )
+        allowed_pkg_names = [MatchSpec(p).name for p in allowed_pkgs]
+
+        for pkg_name, pkg_version in unsafe_pkgs.items():
+            # Check if the risk is accepted AND the package is listed
+            if (
+                confirm_msg == "Risk of unsafe packages is accepted"
+                and pkg_name in allowed_pkg_names
+            ):
+                continue
+
+            error_msg = (
+                f"\nERROR: The package '{pkg_name}' is marked as UNSAFE.\n"
+                f"To continue using this package, "
+                f"you must explicitly allow it by adding "
+                f"the 'allow_unsafe' section to your "
+                f"zwik_environment.yaml file.\n\n"
+                f"Example:\n\n"
+                f"dependencies:\n"
+                f"- {pkg_name}\n\n"
+                f"allow_unsafe:\n"
+                f'  confirm: "Risk of unsafe packages is accepted"\n'
+                f"  packages:\n"
+                f"    - {pkg_name}=={pkg_version}\n"
+            )
+            raise CondaError(error_msg)
 
     def partially_update_lockfile(self, update_list):
         from conda.exports import MatchSpec
@@ -1213,38 +1267,68 @@ def create_env(self):
         from conda import __version__ as conda_version
         from conda.api import SubdirData
         from conda.core.link import PrefixSetup, UnlinkLinkTransaction
+        from conda.exports import MatchSpec
 
         self._check_installation()
 
         specs_to_add = self.lock_data["dependencies"]
-        channels = self.settings.resolve_channels(
-            self.lock_data["channels"],
-        )
+
+        # Pre-resolve all channel variations
+        channels = self.settings.resolve_channels(self.lock_data["channels"])
         obsolete_channels = self.settings.resolve_channels(
             self.lock_data["channels"], ("obsolete",)
         )
+        unsafe_channels = self.settings.resolve_channels(
+            self.lock_data["channels"], ("unsafe",)
+        )
+
         subdirs = [self.lock_data["subdir"], "noarch"]
         link_precs = []
 
         for spec in specs_to_add:
             spec_name, _ = spec.split("=", maxsplit=1)
-            search_channels = channels
-            label = self.lock_data.get("labels", {}).get(spec_name)
-            if label:
-                search_channels = self.settings.resolve_channels(
-                    self.lock_data["channels"], ("", label)
-                )
-            result = SubdirData.query_all(spec, search_channels, subdirs)
+
+            is_obsolete = False
+            is_unsafe = False
+
+            # 1. Try Standard Channels
+            result = SubdirData.query_all(spec, channels, subdirs)
+
             if not result:
+                # 2. Try Obsolete Channels
                 result = SubdirData.query_all(spec, obsolete_channels, subdirs)
                 if result:
-                    log.warning(
-                        "The package '%s' is obsolete,"
-                        " please review the environment",
-                        spec_name,
-                    )
+                    is_obsolete = True
                 else:
-                    raise AssertionError("Package not found: {}".format(spec))
+                    # 3. Try Unsafe Channels
+                    result = SubdirData.query_all(spec, unsafe_channels, subdirs)
+                    if result:
+                        is_unsafe = True
+
+            if not result:
+                raise AssertionError(
+                    "Package not found in standard, obsolete, "
+                    "or unsafe channels: {}".format(spec)
+                )
+
+            if is_obsolete:
+                log.warning(
+                    "The package '%s' is OBSOLETE. "
+                    "Consider updating to a newer version.",
+                    spec_name,
+                )
+            elif is_unsafe:
+                log.warning(
+                    "The package '%s' is UNSAFE. "
+                    "Client continues because it "
+                    "is explicitly allowed in the environment file",
+                    spec_name,
+                )
+
+                ms = MatchSpec(spec)
+                pkg_version = str(ms.version) if ms.version else "<version>"
+                self.handle_unsafe_pkgs({ms.name: pkg_version})
+
             if self._multiple_packages_found(result):
                 log.warning("Multiple packages found for '%s'.", spec)
                 result = self._filter_package_from_default_channels(result, spec)
diff --git a/tests/test_client.py b/tests/test_client.py
index 44d948d..3cbcb52 100644
--- a/tests/test_client.py
+++ b/tests/test_client.py
@@ -114,6 +114,140 @@ def test_invalid_lock_file(self, mock_lock_path):
         env = ZwikEnvironment.from_yaml(ZwikSettings(), self.yaml_file)
         self.assertIsNone(env.lock_data)
 
+    def test_legacy_hash_fallback(self):
+        import hashlib
+        import io
+
+        from scripts.zwik_client import import_yaml
+
+        settings = ZwikSettings()
+
+        def write_mock_lock_file(lock_path, data):
+            yaml = import_yaml()
+            stream = io.StringIO()
+            yaml.dump(data, stream)
+            output = stream.getvalue()
+
+            # Reproduce the script's exact lockfile integrity hashing
+            new_hash = hashlib.md5()
+            for line in output.splitlines():
+                new_hash.update(line.strip().encode())
+            integrity_hash = new_hash.hexdigest()
+
+            os.makedirs(os.path.dirname(lock_path), exist_ok=True)
+            with open(lock_path, "w") as fp:
+                fp.write("# lockfile integrity: {}\n".format(integrity_hash))
+                fp.write(output)
+
+        # Setup base legacy yaml file
+        yaml_content = "dependencies:\n  - python\n  - foobar\n"
+        with open(self.yaml_file, "w") as fp:
+            fp.write(yaml_content)
+
+        env = ZwikEnvironment.from_yaml(settings, self.yaml_file)
+
+        # Calculate both hashes explicitly to show their difference
+        legacy_hash = env.get_legacy_yaml_hash()
+        modern_hash = env.yaml_hash
+
+        self.assertNotEqual(legacy_hash, modern_hash)
+
+        lock_data = {
+            "script_version": "5.16",  # Mark as a legacy version
+            "yaml_hash": legacy_hash,
+            "channel_alias": env.settings.channel_alias,
+            "channels": env.channels,
+            "dependencies": ["foobar=1.0=0", "python=3.9=0"],
+            "subdir": "linux-64",
+        }
+
+        write_mock_lock_file(env.version_lock_path, lock_data)
+
+        # Fallback succeeds because script <= 5.16 and legacy hashes match
+        with self.subTest("legacy lock file without allow_unsafe"):
+            env = ZwikEnvironment.from_yaml(settings, self.yaml_file)
+
+            self.assertTrue(env.has_valid_lockfile())
+            # Verify the client accepted the legacy hash over the modern one
+            self.assertEqual(env.lock_data["yaml_hash"], legacy_hash)
+
+        # Add allow_unsafe block. It should be skipped for yaml
+        # hash calculation, so legacy hash should remain identical.
+        with self.subTest("legacy lock file with allow_unsafe block"):
+            yaml_content_unsafe = (
+                "dependencies:\n"
+                "  - python\n"
+                "  - foobar\n"
+                "allow_unsafe:\n"
+                '  confirm: "Risk of unsafe packages is accepted"\n'
+                "  packages:\n"
+                "    - foobar==1.0\n"
+            )
+            with open(self.yaml_file, "w") as fp:
+                fp.write(yaml_content_unsafe)
+
+            env = ZwikEnvironment.from_yaml(settings, self.yaml_file)
+
+            # Legacy hash successfully skipped the allow_unsafe block
+            self.assertEqual(env.get_legacy_yaml_hash(), legacy_hash)
+            self.assertTrue(env.has_valid_lockfile())
+
+        # Add a new dependency. The hasher DOES NOT skip this,
+        # so the legacy hash should change.
+        with self.subTest("legacy lock file with new dependency"):
+            yaml_content_new_dep = (
+                "dependencies:\n" "  - python\n" "  - foobar\n" "  - new_pkg\n"
+            )
+            with open(self.yaml_file, "w") as fp:
+                fp.write(yaml_content_new_dep)
+
+            env = ZwikEnvironment.from_yaml(settings, self.yaml_file)
+
+            new_legacy_hash = env.get_legacy_yaml_hash()
+
+            # The legacy hash changed because a new package was added
+            self.assertNotEqual(new_legacy_hash, legacy_hash)
+
+            # Validation should fail, forcing the environment to regenerate
+            self.assertFalse(env.has_valid_lockfile())
+
+        # Modern script ignores legacy fallback completely
+        with self.subTest("modern script version with legacy hash"):
+            # Restore base yaml
+            with open(self.yaml_file, "w") as fp:
+                fp.write(yaml_content)
+
+            # Pretend this lockfile was written by v5.17,
+            # but still holds the old legacy hash
+            lock_data["script_version"] = "5.17"
+            write_mock_lock_file(env.version_lock_path, lock_data)
+
+            env = ZwikEnvironment.from_yaml(settings, self.yaml_file)
+
+            # Fails validation because version > 5.16,
+            # meaning it only accepted modern_hash
+            self.assertFalse(env.has_valid_lockfile())
+
+            # If we update the file to the modern_hash,
+            # it immediately becomes valid again
+            lock_data["yaml_hash"] = modern_hash
+            write_mock_lock_file(env.version_lock_path, lock_data)
+            env = ZwikEnvironment.from_yaml(settings, self.yaml_file)
+            self.assertTrue(env.has_valid_lockfile())
+
+    def test_yaml_hash_without_env_data(self):
+        from conda import CondaError
+
+        from scripts.zwik_client import ZwikEnvironment, ZwikSettings
+
+        env = ZwikEnvironment(ZwikSettings())
+
+        # Explicitly ensure env_data is not set
+        env.env_data = None
+
+        with self.assertRaises(CondaError):
+            _ = env.yaml_hash
+
     def test_envs_dir_override(self):
         env = ZwikEnvironment.from_prefix(ZwikSettings(), "abcde")
         self.assertEqual(
diff --git a/tests/test_labels.py b/tests/test_labels.py
index 3a3d003..aff967f 100644
--- a/tests/test_labels.py
+++ b/tests/test_labels.py
@@ -4,6 +4,7 @@
 from unittest.mock import patch
 
 import conda
+from conda import CondaError
 
 from tests.utils import DummyServerEnvironmentTest, DummyZwikServer
 
@@ -12,7 +13,7 @@ class TestChannelLabels(DummyServerEnvironmentTest):
     def test_create_lockfile(self):
         from scripts.zwik_client import ZwikEnvironment, ZwikSettings
 
-        def get_lock_data(env_settings, package_name):
+        def get_lock_data(env_settings, package_name, allow_unsafe_data=None):
             env = ZwikEnvironment(env_settings)
             env._installation_checked = True
             env.env_data = {
@@ -20,6 +21,8 @@ def get_lock_data(env_settings, package_name):
                     package_name,
                 ],
             }
+            if allow_unsafe_data:
+                env.env_data["allow_unsafe"] = allow_unsafe_data
 
             env.lock_data = None
             with tempfile.TemporaryDirectory() as tmp_dir:
@@ -39,7 +42,6 @@ def get_lock_data(env_settings, package_name):
                 "{}=1.0=0".format(self.dummy_server.dummy_name),
                 lock_data["dependencies"],
             )
-            self.assertFalse(lock_data.get("labels"))
 
         with self.subTest("obsolete package"):
             self.dummy_server.dummy_name = "dummy-package-obsolete"
@@ -50,38 +52,35 @@ def get_lock_data(env_settings, package_name):
                 "{}=1.0=0".format(self.dummy_server.dummy_name),
                 lock_data["dependencies"],
             )
-            self.assertEqual(
-                lock_data["labels"][self.dummy_server.dummy_name],
-                "obsolete",
-            )
 
         with self.subTest("unsafe package"):
             self.dummy_server.dummy_name = "dummy-package-unsafe"
             self.dummy_server.dummy_label = "unsafe"
 
+            # Should fail without allow_unsafe block
             with self.assertRaises(conda.CondaError):
                 get_lock_data(settings, self.dummy_server.dummy_name)
 
-            with patch(
-                "scripts.zwik_client.ZwikEnvironment.get_yaml_comment",
-                return_value="# CAUTION: UNSAFE PACKAGE",
-            ):
-                with self.assertLogs("zwik_client", level=logging.WARNING):
-                    lock_data = get_lock_data(settings, self.dummy_server.dummy_name)
+            # Provide the allow_unsafe block
+            allow_unsafe_data = {
+                "confirm": "Risk of unsafe packages is accepted",
+                "packages": [f"{self.dummy_server.dummy_name}==1.0.0"],
+            }
+
+            with self.assertLogs("zwik_client", level=logging.WARNING):
+                lock_data = get_lock_data(
+                    settings, self.dummy_server.dummy_name, allow_unsafe_data
+                )
             self.assertIn(
                 "{}=1.0=0".format(self.dummy_server.dummy_name),
                 lock_data["dependencies"],
             )
-            self.assertEqual(
-                lock_data["labels"][self.dummy_server.dummy_name],
-                "unsafe",
-            )
 
     @patch("conda.core.link.UnlinkLinkTransaction.execute")
     def test_create_environment(self, link_exec_mock):
         from scripts.zwik_client import ZwikEnvironment, ZwikSettings
 
-        def generate_lock_data(name, label=None):
+        def generate_lock_data(name):
             lock_data = {
                 "dependencies": [
                     "{}=1.0=0".format(name),
@@ -91,10 +90,7 @@ def generate_lock_data(name, label=None):
                 ],
                 "subdir": "linux-64",
             }
-            if label:
-                lock_data["labels"] = {
-                    name: label,
-                }
+
             return lock_data
 
         settings = ZwikSettings()
@@ -104,7 +100,6 @@ def generate_lock_data(name, label=None):
         env.override_prefix = "dummy"
 
         with self.subTest("normal package"):
-
             self.dummy_server.dummy_name = "dummy-link-pkg-normal"
             self.dummy_server.dummy_label = None
             env.lock_data = generate_lock_data(self.dummy_server.dummy_name)
@@ -120,11 +115,10 @@ def generate_lock_data(name, label=None):
             ) as cm:
                 env.lock_data = generate_lock_data(
                     self.dummy_server.dummy_name,
-                    "obsolete",
                 )
                 env.create_env()
-                # No warning expected when lock data specifies label
-                self.assertEqual(len(cm.output), 0)
+                # Verify that a warning was displayed
+                self.assertTrue("OBSOLETE" in cm.output[0])
 
                 env.lock_data = generate_lock_data(self.dummy_server.dummy_name)
                 env.create_env()
@@ -133,11 +127,26 @@ def generate_lock_data(name, label=None):
             self.dummy_server.dummy_name = "dummy-link-pkg-unsafe"
             self.dummy_server.dummy_label = "unsafe"
             env.lock_data = generate_lock_data(self.dummy_server.dummy_name)
-            with self.assertRaises(AssertionError):
+            # Fails immediately without allow_unsafe block
+            with self.assertRaises(CondaError):
                 env.create_env()
 
-            env.lock_data = generate_lock_data(self.dummy_server.dummy_name, "unsafe")
+        with self.subTest("unsafe package explicitly allowed"):
+            link_exec_mock.reset_mock()
+            self.dummy_server.dummy_name = "dummy-link-pkg-unsafe"
+            self.dummy_server.dummy_label = "unsafe"
+            env.lock_data = generate_lock_data(self.dummy_server.dummy_name)
+
+            # Simulate the user adding the allow_unsafe block to their environment yaml
+            env.env_data = {
+                "allow_unsafe": {
+                    "confirm": "Risk of unsafe packages is accepted",
+                    "packages": [f"{self.dummy_server.dummy_name}==1.0"],
+                }
+            }
+
             env.create_env()
+            link_exec_mock.assert_called_once()
 
     @patch("conda.core.link.UnlinkLinkTransaction.execute")
     def test_multiple_packages_with_default(self, link_exec_mock):