diff --git a/front/internal.css.php b/front/internal.css.php
index 00f1121..e7c7224 100644
--- a/front/internal.css.php
+++ b/front/internal.css.php
@@ -1,10 +1,7 @@
 <?php
 
-$_GET["donotcheckversion"] = true;
-$dont_check_maintenance_mode = true;
-
-define('GLPI_AJAX', true);
-include('../../../inc/includes.php');
+// GLPI 11: o core já foi bootado pelo LegacyFileLoadController antes deste
+// arquivo executar — não incluir inc/includes.php (KB-PLUGIN-028)
 
 // FIX: Prevent this script from being stored as the "Return URL" after login
 if (isset($_SESSION['glpi_currentpage']) && strpos($_SESSION['glpi_currentpage'], basename(__FILE__)) !== false) {
diff --git a/front/internal.js.php b/front/internal.js.php
index 5dbd137..8874598 100644
--- a/front/internal.js.php
+++ b/front/internal.js.php
@@ -1,10 +1,7 @@
 <?php
 
-$_GET["donotcheckversion"] = true;
-$dont_check_maintenance_mode = true;
-
-define('GLPI_AJAX', true);
-include('../../../inc/includes.php');
+// GLPI 11: o core já foi bootado pelo LegacyFileLoadController antes deste
+// arquivo executar — não incluir inc/includes.php (KB-PLUGIN-028)
 
 // FIX: Prevent this script from being stored as the "Return URL" after login
 if (isset($_SESSION['glpi_currentpage']) && strpos($_SESSION['glpi_currentpage'], basename(__FILE__)) !== false) {
@@ -56,14 +53,14 @@ if (false) {
       ?>
       var $icon = $('link[rel*=icon]');
       $icon.attr('type', null);
-      $icon.attr('href', <?php echo json_encode($faviconUrl) ?>);
+      $icon.attr('href', <?php echo json_encode($faviconUrl, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP) ?>);
       <?php
    endif;
    $pageTitle = PluginButterflyConfig::getConfig('page_title');
    if ($pageTitle):
       ?>
       var $title = $('title');
-      var newTitle = $title.text().replace('GLPI', <?php echo json_encode($pageTitle) ?>);
+      var newTitle = $title.text().replace('GLPI', <?php echo json_encode($pageTitle, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP) ?>);
       $title.text(newTitle);
       <?php
    endif;
@@ -78,7 +75,7 @@ if (false) {
    if ($footerDisplay === 'custom'):
       $footerText = \Glpi\RichText\RichText::getEnhancedHtml($footerText);
       ?>
-      $('div[id^=about_modal_] .copyright').parent().parent().html(<?php echo json_encode($footerText) ?>);
+      $('div[id^=about_modal_] .copyright').parent().parent().html(<?php echo json_encode($footerText, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP) ?>);
       <?php
    endif;
 
diff --git a/front/login.css.php b/front/login.css.php
deleted file mode 100644
index 5ebc642..0000000
--- a/front/login.css.php
+++ /dev/null
@@ -1,8 +0,0 @@
-<?php
-// Deprecated endpoint kept for backward compatibility.
-// All login styles are now injected inline from the display_login hook.
-
-header('Content-Type: text/css');
-header('Cache-Control: public, max-age=60');
-
-echo "/* Butterfly plugin: login.css.php is deprecated. */\n";
diff --git a/front/picture.send.php b/front/picture.send.php
index cf137ee..51a8cdb 100644
--- a/front/picture.send.php
+++ b/front/picture.send.php
@@ -4,10 +4,8 @@
  * Works without authentication and is compatible with GLPI 11 routing.
  */
 
-$_GET['donotcheckversion'] = true;
-$dont_check_maintenance_mode = true;
-
-require_once '../../../inc/includes.php';
+// GLPI 11: o core já foi bootado pelo LegacyFileLoadController antes deste
+// arquivo executar — não incluir inc/includes.php (KB-PLUGIN-028)
 
 $rawPath = $_GET['path'] ?? '';
 if ($rawPath === '') {
diff --git a/hook.php b/hook.php
index 0cacf07..1a44ff1 100644
--- a/hook.php
+++ b/hook.php
@@ -50,12 +50,12 @@ function plugin_butterfly_display_login() {
       $(function() {
          var $loginInputs = $('#login_name, #inputUsername');
          if ($loginInputs.length) {
-            $loginInputs.attr('placeholder', <?php echo json_encode(__('Login')) ?>);
+            $loginInputs.attr('placeholder', <?php echo json_encode(__('Login'), JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP) ?>);
          }
 
          var $passwordInputs = $('input[type=password], input[name=password]');
          if ($passwordInputs.length) {
-            $passwordInputs.attr('placeholder', <?php echo json_encode(__('Password')) ?>);
+            $passwordInputs.attr('placeholder', <?php echo json_encode(__('Password'), JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP) ?>);
             $passwordInputs.each(function() {
                var $input = $(this);
                var $description = $input.siblings('.form-label-description').first();
@@ -71,14 +71,14 @@ function plugin_butterfly_display_login() {
       ?>
          var $icon = $('link[rel*=icon]');
          $icon.attr('type', null);
-         $icon.attr('href', <?php echo json_encode($faviconUrl) ?>);
+         $icon.attr('href', <?php echo json_encode($faviconUrl, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP) ?>);
       <?php
       endif;
    $pageTitle = PluginButterflyConfig::getConfig('page_title');
    if ($pageTitle) :
       ?>
          var $title = $('title');
-         var newTitle = $title.text().replace('GLPI', <?php echo json_encode($pageTitle) ?>);
+         var newTitle = $title.text().replace('GLPI', <?php echo json_encode($pageTitle, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP) ?>);
          $title.text(newTitle);
       <?php
       endif;
@@ -94,17 +94,17 @@ function plugin_butterfly_display_login() {
       ?>
          var $footerTarget = $('#footer-login, .login-footer').first();
          if ($footerTarget.length) {
-            $footerTarget.html(<?php echo json_encode($footerText) ?>);
+            $footerTarget.html(<?php echo json_encode($footerText, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP) ?>);
          } else {
-            $('a.copyright').parent().html(<?php echo json_encode($footerText) ?>);
+            $('a.copyright').parent().html(<?php echo json_encode($footerText, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP) ?>);
          }
       <?php
       endif;
    if ($loginPicture) :
       ?>
-         var pictureUrl = <?php echo json_encode($pictureUrl); ?>;
-         var maxWidth = <?php echo json_encode($maxWidth); ?>;
-         var maxHeight = <?php echo json_encode($maxHeight); ?>;
+         var pictureUrl = <?php echo json_encode($pictureUrl, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP); ?>;
+         var maxWidth = <?php echo json_encode($maxWidth, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP); ?>;
+         var maxHeight = <?php echo json_encode($maxHeight, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP); ?>;
 
          $('.page-anonymous .glpi-logo').css({
             'background-image': 'url(' + pictureUrl + ')',
diff --git a/logo.png b/logo.png
new file mode 100644
index 0000000..faeb566
Binary files /dev/null and b/logo.png differ
diff --git a/setup.php b/setup.php
index ae7b207..de931ea 100644
--- a/setup.php
+++ b/setup.php
@@ -29,11 +29,6 @@ function plugin_init_butterfly()
          '#^/front/picture\.send\.php$#',
          \Glpi\Http\Firewall::STRATEGY_NO_CHECK
       );
-      \Glpi\Http\Firewall::addPluginStrategyForLegacyScripts(
-         'butterfly',
-         '#^/front/login\.css\.php$#',
-         \Glpi\Http\Firewall::STRATEGY_NO_CHECK
-      );
       \Glpi\Http\Firewall::addPluginStrategyForLegacyScripts(
          'butterfly',
          '#^/front/internal\.css\.php$#',