diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index bc8d4048edb1f307faff1cdba32600faedbd9f26..faa4f5158d1736274471ed2ff93cb8f5312af60d 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -9,8 +9,8 @@ variables:
   CONTAINER_GALAXY_URL: "${NDIP_DOCKER_REPOSITORY}/${CI_PROJECT_PATH}"
   CONTAINER_GALAXY_BASE_URL: "${CONTAINER_GALAXY_URL}/base"
   CONTAINER_GALAXY_COMMIT_URL: "${CONTAINER_GALAXY_URL}/commit"
-  GALAXY_VERSION_PYTHON: 24.2.dev4+ornl
-  GALAXY_VERSION_DOCKER: 24.2.dev4.ornl
+  GALAXY_VERSION_PYTHON: 24.2.dev7+ornl
+  GALAXY_VERSION_DOCKER: 24.2.dev7.ornl
 
 # This import is for the func_rse_docker_* functions
 before_script:
diff --git a/client/src/components/Masthead/Masthead.vue b/client/src/components/Masthead/Masthead.vue
index 32a0814bb2d42a1ef7926a9b17d4514e0ae96cef..1f958482b9631b6f64ef71f3be55c56a9fddcc04 100644
--- a/client/src/components/Masthead/Masthead.vue
+++ b/client/src/components/Masthead/Masthead.vue
@@ -3,7 +3,7 @@ import { BNavbar, BNavbarBrand, BNavbarNav } from "bootstrap-vue";
 import { storeToRefs } from "pinia";
 import { userLogout } from "utils/logout";
 import { withPrefix } from "utils/redirect";
-import { onMounted, ref } from "vue";
+import { computed, onMounted, ref } from "vue";
 import { useRouter } from "vue-router/composables";
 
 import { useConfig } from "@/composables/config";
@@ -45,6 +45,14 @@ const props = defineProps({
 const extensionTabs = ref([]);
 const windowToggle = ref(false);
 
+const novaUrl = computed(() => {
+    if (isConfigLoaded.value) {
+        return config.value.dashboard_url;
+    }
+
+    return "";
+});
+
 function openUrl(url, target = null) {
     if (!target) {
         router.push(url);
@@ -94,6 +102,12 @@ onMounted(() => {
             </span>
         </BNavbarNav>
         <BNavbarNav v-if="isConfigLoaded" class="mr-1">
+            <li v-if="novaUrl" class="cursor-pointer justify-content-center mx-2">
+                <a class="text-white" :href="novaUrl" target="_blank">
+                    <img :src="withPrefix('/static/nova_square.png')" alt="NOVA Square Logo" class="mr-1" width="24" />
+                    NOVA Dashboard
+                </a>
+            </li>
             <MastheadItem
                 v-if="windowTab"
                 :id="windowTab.id"
diff --git a/lib/galaxy/authnz/custos_authnz.py b/lib/galaxy/authnz/custos_authnz.py
index d8fd3a6f5ff20d9293a0b885e6f78219eb5965f4..2a9a45789bd332c70d06b274dedc43219b655ce1 100644
--- a/lib/galaxy/authnz/custos_authnz.py
+++ b/lib/galaxy/authnz/custos_authnz.py
@@ -590,7 +590,6 @@ class OIDCAuthnzBase(IdentityProvider):
 
         custos_authnz_token = self._get_custos_authnz_token(sa_session, user_id, self.config.provider)
         user = custos_authnz_token.user if custos_authnz_token else None
-        self.refresh(sa_session, custos_authnz_token, 90)
         return user, decoded_jwt
 
 
diff --git a/lib/galaxy/authnz/psa_authnz.py b/lib/galaxy/authnz/psa_authnz.py
index 70451874d32b8900be3659b137e40640f07409c3..d8bb7fac16e93bde7e3139de8dad4dd740441505 100644
--- a/lib/galaxy/authnz/psa_authnz.py
+++ b/lib/galaxy/authnz/psa_authnz.py
@@ -329,7 +329,6 @@ class PSAAuthnz(IdentityProvider):
         user_id = decoded_jwt["unique_name"]
         authnz_token = self._get_authnz_token(sa_session, user_id, self.config["provider"])
         user = authnz_token.user if authnz_token else None
-        self.refresh(sa_session, authnz_token, 90)
         return user, decoded_jwt
 
     @staticmethod
diff --git a/lib/galaxy/config/sample/galaxy.yml.sample b/lib/galaxy/config/sample/galaxy.yml.sample
index 9b88819707573067067d5f75369a37cabacb59d5..3879343a8bcc910c55c805f1f0cbac829e088ad9 100644
--- a/lib/galaxy/config/sample/galaxy.yml.sample
+++ b/lib/galaxy/config/sample/galaxy.yml.sample
@@ -1399,6 +1399,10 @@ galaxy:
   # change the default logo including the galaxy brand title.
   #display_galaxy_brand: true
 
+  # Add a link to the dashboard for managing interactive tools to the
+  # masthead.
+  #dashboard_url: ''
+
   # Format string used when showing date and time information. The
   # string may contain: - the directives used by Python time.strftime()
   # function (see
diff --git a/lib/galaxy/config/schemas/config_schema.yml b/lib/galaxy/config/schemas/config_schema.yml
index a6dbbd35a678347c6abd3d2fc2b0fe71746970cd..36c912ace6a5b1161ccf8403f366459fbf87b7b5 100644
--- a/lib/galaxy/config/schemas/config_schema.yml
+++ b/lib/galaxy/config/schemas/config_schema.yml
@@ -1656,6 +1656,13 @@ mapping:
           URL prefix for Galaxy application. If Galaxy should be served under a prefix set this to
           the desired prefix value.
 
+      dashboard_url:
+        type: str
+        default: ''
+        required: false
+        desc: |
+          URL of the dashboard for managing interactive tools.
+
       galaxy_infrastructure_url:
         type: str
         default: http://localhost:8080
@@ -4168,3 +4175,11 @@ mapping:
           Number of seconds before file source content listings are refreshed. Shorter times will result in more
           queries while browsing a file sources. Longer times will result in fewer requests to file sources but
           outdated contents might be displayed to the user. Currently only affects s3fs file sources.
+
+      external_login_redirect_cookie:
+        type: str
+        default: "galaxy-external-login-redirect"
+        required: false
+        desc: |
+          The name of a cookie to check after Galaxy has been logged into via an external third party. If present, Galaxy
+          will redirect to the url contained in the cookie.
\ No newline at end of file
diff --git a/lib/galaxy/managers/configuration.py b/lib/galaxy/managers/configuration.py
index 68f312a3dfb536a21e608f24bbffb5cde2e4c2d8..d5c8476a00c102a76ecee690b9799716397d93cd 100644
--- a/lib/galaxy/managers/configuration.py
+++ b/lib/galaxy/managers/configuration.py
@@ -124,6 +124,7 @@ class ConfigSerializer(base.ModelSerializer):
             # TODO: this is available from user data, remove
             "is_admin_user": lambda *a, **c: False,
             "brand": _use_config,
+            "dashboard_url": _use_config,
             "logo_url": _use_config,
             "logo_src": _use_config,
             "logo_src_secondary": _use_config,
@@ -233,6 +234,7 @@ class ConfigSerializer(base.ModelSerializer):
             "enable_help_forum_tool_panel_integration": _use_config,
             "disable_batch_input": _use_config,
             "llm_api_configured": lambda item, key, **context: bool(item.openai_api_key),
+            "external_login_redirect_cookie": _defaults_to("galaxy-external-login-redirect")
         }
 
 
diff --git a/lib/galaxy/tool_util/toolbox/base.py b/lib/galaxy/tool_util/toolbox/base.py
index ae7ce9a2458414c6892174bcde35046f3fe3a367..9c993eb84eab94e46ba797c455adb4d5ac445965 100644
--- a/lib/galaxy/tool_util/toolbox/base.py
+++ b/lib/galaxy/tool_util/toolbox/base.py
@@ -634,6 +634,7 @@ class AbstractToolBox(ManagesIntegratedToolPanelMixin):
                 section_dict = {
                     "id": val.id or "",
                     "name": val.name or "",
+                    "description": val.description or "",
                     "version": val.version or "",
                 }
                 section = ToolSection(section_dict)
diff --git a/lib/galaxy/tool_util/toolbox/integrated_panel.py b/lib/galaxy/tool_util/toolbox/integrated_panel.py
index 4ceb8a5ae244b73bb6b4be46d85d72b3cc83f036..f51d9b476fa0249458a28124f2ece63115a175e7 100644
--- a/lib/galaxy/tool_util/toolbox/integrated_panel.py
+++ b/lib/galaxy/tool_util/toolbox/integrated_panel.py
@@ -96,9 +96,10 @@ $INTEGRATED_TOOL_PANEL
                 elif item_type == panel_item_types.SECTION:
                     section_id = item.id or ""
                     section_name = item.name or ""
+                    section_description = item.description or ""
                     section_version = item.version or ""
                     integrated_tool_panel.append(
-                        f'    <section id="{escape(section_id)}" name="{escape(section_name)}" version="{section_version}">\n'
+                        f'    <section id="{escape(section_id)}" name="{escape(section_name)}" description="{section_description}" version="{section_version}">\n'
                     )
                     for _section_key, section_item_type, section_item in item.panel_items_iter():
                         if section_item_type == panel_item_types.TOOL:
diff --git a/lib/galaxy/webapps/galaxy/controllers/authnz.py b/lib/galaxy/webapps/galaxy/controllers/authnz.py
index 32a7ce5813a93c8e8ea3f543073cff4d108da762..a0c0274729846b2bb9c77a92e02d683e9d2b346a 100644
--- a/lib/galaxy/webapps/galaxy/controllers/authnz.py
+++ b/lib/galaxy/webapps/galaxy/controllers/authnz.py
@@ -77,7 +77,7 @@ class OIDC(JSAppLauncher):
 
     @web.json
     @web.expose
-    def login(self, trans, provider, idphint=None, next=None):
+    def login(self, trans, provider, idphint=None, next=None, external_redirect=None):
         if not trans.app.config.enable_oidc:
             msg = "Login to Galaxy using third-party identities is not enabled on this Galaxy instance."
             log.debug(msg)
@@ -91,6 +91,10 @@ class OIDC(JSAppLauncher):
             trans.set_cookie(value="/", name=LOGIN_NEXT_COOKIE_NAME)
         success, message, redirect_uri = trans.app.authnz_manager.authenticate(provider, trans, idphint)
         if success:
+            if external_redirect:
+                trans.set_cookie(value=external_redirect, name=trans.app.config.external_login_redirect_cookie)
+                return trans.response.send_redirect(url_for(redirect_uri))
+
             return {"redirect_uri": redirect_uri}
         else:
             raise exceptions.AuthenticationFailed(message)
@@ -149,6 +153,11 @@ class OIDC(JSAppLauncher):
         trans.set_cookie(value=provider, name=PROVIDER_COOKIE_NAME)
         # Clear the login next cookie back to default.
         trans.set_cookie(value="/", name=LOGIN_NEXT_COOKIE_NAME)
+
+        external_login = trans.get_cookie(trans.app.config.external_login_redirect_cookie)
+        if external_login and (external_login.find("https://") == 0 or external_login.find("http://") == 0):
+            trans.set_cookie(value="", name=trans.app.config.external_login_redirect_cookie)
+            return trans.response.send_redirect(url_for(external_login))
         return trans.response.send_redirect(url_for(redirect_url))
 
     @web.expose
diff --git a/static/nova_square.png b/static/nova_square.png
new file mode 100644
index 0000000000000000000000000000000000000000..3fe5b331843558d3ed8762b928db337b67b39ecb
Binary files /dev/null and b/static/nova_square.png differ