diff --git a/.dockerignore b/.dockerignore
index 171519f3e..6e9108ce9 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -109,6 +109,9 @@ cython_debug/
 #----------------------------------------------------------------------
 .env
 .venv
+.venv/
+**/.venv
+**/.venv/
 env/
 venv/
 ENV/
@@ -123,6 +126,10 @@ pdm.lock
 .pdm.toml
 .pdm-python
 
+# uv
+uv.lock
+**/uv.lock
+
 #----------------------------------------------------------------------
 # 5. Package managers and dependencies
 #----------------------------------------------------------------------
diff --git a/.gitignore b/.gitignore
index bcc35cf9d..359ca3d6f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -61,7 +61,16 @@ logs/
 reports/
 corpus/
 tests/fuzz/fuzzers/results/
+
+# Virtual environments (including nested)
+.venv/
 .venv
+**/.venv/
+**/.venv
+
+# uv lock files (including nested)
+uv.lock
+**/uv.lock
 mcp.db
 public/
 ica_integrations_host.sbom.json
diff --git a/MANIFEST.in b/MANIFEST.in
index c1e0a957a..ff69c078f 100644
--- a/MANIFEST.in
+++ b/MANIFEST.in
@@ -133,11 +133,15 @@ prune .ruff_cache
 prune .mypy_cache
 prune htmlcov
 
-# Virtual environments
+# Virtual environments (including nested in plugins)
 prune venv
 prune .venv
 prune env
 prune node_modules
+prune plugins/external/opa/.venv
+prune plugins/external/llmguard/.venv
+prune plugins/external/cedar/.venv
+global-exclude **/.venv/*
 
 # Environment files (security sensitive!)
 exclude .env
@@ -150,8 +154,9 @@ exclude *.db
 exclude *.sqlite
 exclude *.log
 
-# Lock files
+# Lock files (including nested in plugins)
 exclude uv.lock
+global-exclude **/uv.lock
 
 # Coverage data
 exclude .coverage
diff --git a/mcpgateway/alembic/env.py b/mcpgateway/alembic/env.py
index 4788fa76b..00d3a9f0d 100644
--- a/mcpgateway/alembic/env.py
+++ b/mcpgateway/alembic/env.py
@@ -165,9 +165,11 @@ def _modify_metadata_for_mariadb():
 # my_important_option = config.get_main_option("my_important_option")
 # ... etc.
 
+# Escape '%' characters in URL to avoid configparser interpolation errors
+# (e.g., URL-encoded passwords like %40 for '@')
 config.set_main_option(
     "sqlalchemy.url",
-    settings.database_url,
+    settings.database_url.replace("%", "%%"),
 )
 
 
diff --git a/mcpgateway/bootstrap_db.py b/mcpgateway/bootstrap_db.py
index de58d9c61..38a4a1227 100644
--- a/mcpgateway/bootstrap_db.py
+++ b/mcpgateway/bootstrap_db.py
@@ -257,7 +257,10 @@ async def main() -> None:
 
     with engine.begin() as conn:
         cfg.attributes["connection"] = conn
-        cfg.set_main_option("sqlalchemy.url", settings.database_url)
+        # Escape '%' characters in URL to avoid configparser interpolation errors
+        # (e.g., URL-encoded passwords like %40 for '@')
+        escaped_url = settings.database_url.replace("%", "%%")
+        cfg.set_main_option("sqlalchemy.url", escaped_url)
 
         insp = inspect(conn)
 
diff --git a/plugins/external/opa/.gitignore b/plugins/external/opa/.gitignore
new file mode 100644
index 000000000..ea9213a0c
--- /dev/null
+++ b/plugins/external/opa/.gitignore
@@ -0,0 +1,20 @@
+# Virtual environment
+.venv/
+.venv
+
+# uv lock file
+uv.lock
+
+# Coverage data
+.coverage
+.coverage.*
+htmlcov/
+
+# Build artifacts
+*.egg-info/
+dist/
+build/
+
+# Python cache
+__pycache__/
+*.py[cod]