diff --git a/Containers/borgbackup/start.sh b/Containers/borgbackup/start.sh
index fa2f8e6e..0c13d414 100644
--- a/Containers/borgbackup/start.sh
+++ b/Containers/borgbackup/start.sh
@@ -4,6 +4,9 @@ if [ "$AIO_LOG_LEVEL" = 'debug' ]; then
     set -x
 fi
 
+# Defensive default: ensure AIO_LOG_LEVEL is never empty so log-level mappings below always resolve correctly
+AIO_LOG_LEVEL="${AIO_LOG_LEVEL:-warn}"
+
 if [ "$AIO_LOG_LEVEL" = "warn" ]; then
     BORG_LOG_LEVEL_FLAG="--warning"
 else
diff --git a/Containers/collabora/start.sh b/Containers/collabora/start.sh
index 3dec2f9d..34a13d79 100644
--- a/Containers/collabora/start.sh
+++ b/Containers/collabora/start.sh
@@ -4,6 +4,9 @@ if [ "$AIO_LOG_LEVEL" = 'debug' ]; then
     set -x
 fi
 
+# Defensive default: ensure AIO_LOG_LEVEL is never empty so log-level mappings below always resolve correctly
+AIO_LOG_LEVEL="${AIO_LOG_LEVEL:-warn}"
+
 if [ "$AIO_LOG_LEVEL" = "warn" ]; then
     COLLABORA_LOG_LEVEL="warning"
 elif [ "$AIO_LOG_LEVEL" = "info" ]; then
diff --git a/Containers/fulltextsearch/start.sh b/Containers/fulltextsearch/start.sh
index e38d4046..05361960 100644
--- a/Containers/fulltextsearch/start.sh
+++ b/Containers/fulltextsearch/start.sh
@@ -4,6 +4,9 @@ if [ "$AIO_LOG_LEVEL" = 'debug' ]; then
     set -x
 fi
 
+# Defensive default: ensure AIO_LOG_LEVEL is never empty so log-level mappings below always resolve correctly
+AIO_LOG_LEVEL="${AIO_LOG_LEVEL:-warn}"
+
 ELASTIC_LOG_LEVEL="$(echo "$AIO_LOG_LEVEL" | tr '[:lower:]' '[:upper:]')"
 
 exec env "logger.level=$ELASTIC_LOG_LEVEL" /usr/local/bin/docker-entrypoint.sh "$@"
diff --git a/Containers/imaginary/start.sh b/Containers/imaginary/start.sh
index 149747d3..0039a71e 100644
--- a/Containers/imaginary/start.sh
+++ b/Containers/imaginary/start.sh
@@ -4,11 +4,15 @@ if [ "$AIO_LOG_LEVEL" = 'debug' ]; then
     set -x
 fi
 
+# Defensive default: ensure AIO_LOG_LEVEL is never empty so log-level mappings below always resolve correctly
+AIO_LOG_LEVEL="${AIO_LOG_LEVEL:-warn}"
+
 GOLANG_LOG="$(case "$AIO_LOG_LEVEL" in
     debug) printf 'info' ;;
     info) printf 'info' ;;
     warn) printf 'warning' ;;
     error) printf 'error' ;;
+    *) printf 'warning' ;;
 esac)"
 export GOLANG_LOG
 if [ "$AIO_LOG_LEVEL" = "debug" ]; then
diff --git a/Containers/mastercontainer/daily-backup.sh b/Containers/mastercontainer/daily-backup.sh
index 99293b60..3cd52e94 100644
--- a/Containers/mastercontainer/daily-backup.sh
+++ b/Containers/mastercontainer/daily-backup.sh
@@ -59,6 +59,15 @@ fi
 
 # Wait for watchtower to stop
 if [ "$AUTOMATIC_UPDATES" = 1 ]; then
+    # Give Docker time to register the container as running before checking for it.
+    # Without this, there is a race condition where the check below runs before watchtower
+    # appears in `docker ps`, causing the script to skip the wait and continue with
+    # the potentially outdated mastercontainer code while watchtower is still updating it.
+    count=0
+    while ! docker ps --format "{{.Names}}" | grep -q "^nextcloud-aio-watchtower$" && [ "$count" -lt 12 ]; do
+        sleep 5
+        count=$((count + 1))
+    done
     if ! docker ps --format "{{.Names}}" | grep -q "^nextcloud-aio-watchtower$"; then
         echo "Something seems to be wrong: Watchtower should be started at this step."
     fi
diff --git a/Containers/nextcloud/entrypoint.sh b/Containers/nextcloud/entrypoint.sh
index 07e0ae24..718bd6ba 100644
--- a/Containers/nextcloud/entrypoint.sh
+++ b/Containers/nextcloud/entrypoint.sh
@@ -14,6 +14,9 @@ if [ "$AIO_LOG_LEVEL" = 'debug' ]; then
     set -x
 fi
 
+# Defensive default: ensure AIO_LOG_LEVEL is never empty so log-level mappings below always resolve correctly
+AIO_LOG_LEVEL="${AIO_LOG_LEVEL:-warn}"
+
 run_upgrade_if_needed_due_to_app_update() {
     if php /var/www/html/occ status | grep maintenance | grep -q true; then
         php /var/www/html/occ maintenance:mode --off
@@ -29,6 +32,7 @@ NEXTCLOUD_LOG_LEVEL="$(case "$AIO_LOG_LEVEL" in
     info) printf '1' ;;
     warn) printf '2' ;;
     error) printf '3' ;;
+    *) printf '2' ;;
 esac)"
 export NEXTCLOUD_LOG_LEVEL
 
diff --git a/Containers/notify-push/start.sh b/Containers/notify-push/start.sh
index 335a299d..fced1416 100644
--- a/Containers/notify-push/start.sh
+++ b/Containers/notify-push/start.sh
@@ -4,6 +4,9 @@ if [ "$AIO_LOG_LEVEL" = 'debug' ]; then
     set -x
 fi
 
+# Defensive default: ensure AIO_LOG_LEVEL is never empty so log-level mappings below always resolve correctly
+AIO_LOG_LEVEL="${AIO_LOG_LEVEL:-warn}"
+
 export RUST_LOG="$AIO_LOG_LEVEL"
 
 if [ -z "$NEXTCLOUD_HOST" ]; then
diff --git a/Containers/postgresql/start.sh b/Containers/postgresql/start.sh
index b71e448f..fed40b7a 100644
--- a/Containers/postgresql/start.sh
+++ b/Containers/postgresql/start.sh
@@ -4,11 +4,15 @@ if [ "$AIO_LOG_LEVEL" = 'debug' ]; then
     set -x
 fi
 
+# Defensive default: ensure AIO_LOG_LEVEL is never empty so log-level mappings below always resolve correctly
+AIO_LOG_LEVEL="${AIO_LOG_LEVEL:-warn}"
+
 POSTGRES_LOG_MIN_MESSAGES="$(case "$AIO_LOG_LEVEL" in
     debug) printf 'debug1' ;;
     info) printf 'info' ;;
     warn) printf 'warning' ;;
     error) printf 'error' ;;
+    *) printf 'warning' ;;
 esac)"
 export POSTGRES_LOG_MIN_MESSAGES
 
diff --git a/Containers/redis/start.sh b/Containers/redis/start.sh
index ccc3b9bb..2a2302ce 100644
--- a/Containers/redis/start.sh
+++ b/Containers/redis/start.sh
@@ -4,6 +4,9 @@ if [ "$AIO_LOG_LEVEL" = 'debug' ]; then
     set -x
 fi
 
+# Defensive default: ensure AIO_LOG_LEVEL is never empty so log-level mappings below always resolve correctly
+AIO_LOG_LEVEL="${AIO_LOG_LEVEL:-warn}"
+
 # Redis only supports [debug, verbose, notice, warning, nothing] as log level
 if [ "$AIO_LOG_LEVEL" = "warn" ] || [ "$AIO_LOG_LEVEL" = "error" ]; then
     REDIS_LOG_LEVEL="warning"
diff --git a/Containers/talk-recording/start.sh b/Containers/talk-recording/start.sh
index bb7d2ea4..88b03f88 100644
--- a/Containers/talk-recording/start.sh
+++ b/Containers/talk-recording/start.sh
@@ -4,11 +4,15 @@ if [ "$AIO_LOG_LEVEL" = 'debug' ]; then
     set -x
 fi
 
+# Defensive default: ensure AIO_LOG_LEVEL is never empty so log-level mappings below always resolve correctly
+AIO_LOG_LEVEL="${AIO_LOG_LEVEL:-warn}"
+
 TALK_RECORDING_LOG_LEVEL="$(case "$AIO_LOG_LEVEL" in
     debug) printf '10' ;;
     info) printf '20' ;;
     warn) printf '30' ;;
     error) printf '40' ;;
+    *) printf '30' ;;
 esac)"
 export TALK_RECORDING_LOG_LEVEL
 
diff --git a/Containers/talk/start.sh b/Containers/talk/start.sh
index e5bd251b..12e3fdb0 100644
--- a/Containers/talk/start.sh
+++ b/Containers/talk/start.sh
@@ -4,6 +4,9 @@ if [ "$AIO_LOG_LEVEL" = 'debug' ]; then
     set -x
 fi
 
+# Defensive default: ensure AIO_LOG_LEVEL is never empty so log-level mappings below always resolve correctly
+AIO_LOG_LEVEL="${AIO_LOG_LEVEL:-warn}"
+
 if [ "$AIO_LOG_LEVEL" = "warn" ]; then
     ETURNAL_LOG_LEVEL="warning"
 else
@@ -15,6 +18,7 @@ JANUS_LOG_LEVEL="$(case "$AIO_LOG_LEVEL" in
     info) printf '4' ;;
     warn) printf '3' ;;
     error) printf '1' ;;
+    *) printf '3' ;;
 esac)"
 export JANUS_LOG_LEVEL
 
diff --git a/Containers/watchtower/start.sh b/Containers/watchtower/start.sh
index 16e7caef..a7cc16dc 100644
--- a/Containers/watchtower/start.sh
+++ b/Containers/watchtower/start.sh
@@ -4,6 +4,9 @@ if [ "$AIO_LOG_LEVEL" = 'debug' ]; then
     set -x
 fi
 
+# Defensive default: ensure AIO_LOG_LEVEL is never empty so log-level mappings below always resolve correctly
+AIO_LOG_LEVEL="${AIO_LOG_LEVEL:-warn}"
+
 # Check if socket is available and readable
 if ! [ -e "/var/run/docker.sock" ]; then
     echo "Docker socket is not available. Cannot continue."
diff --git a/Containers/whiteboard/start.sh b/Containers/whiteboard/start.sh
index 5675a94a..1093319a 100644
--- a/Containers/whiteboard/start.sh
+++ b/Containers/whiteboard/start.sh
@@ -4,6 +4,9 @@ if [ "$AIO_LOG_LEVEL" = 'debug' ]; then
     set -x
 fi
 
+# Defensive default: ensure AIO_LOG_LEVEL is never empty so log-level mappings below always resolve correctly
+AIO_LOG_LEVEL="${AIO_LOG_LEVEL:-warn}"
+
 export LOG_LEVEL="$AIO_LOG_LEVEL"
 
 # Only start container if nextcloud is accessible