diff --git a/Makefile b/Makefile
index 027b588d..89ba610b 100644
--- a/Makefile
+++ b/Makefile
@@ -27,13 +27,13 @@ migrate-prod: ## Run prod env (alembic) migrations
 lint: ## Lint the code
 	poetry run ruff format --check && \
 	poetry run ruff check && \
-	poetry run mypy .
+	poetry run mypy . && \
 	docker compose run --rm app npx prettier --check ./*.md ./docs ./.github/workflows/* ./hushline
 
 .PHONY: fix
 fix: ## Format the code
 	poetry run ruff format && \
-	poetry run ruff check --fix
+	poetry run ruff check --fix && \
 	docker compose run --rm app npx prettier --write ./*.md ./docs ./.github/workflows/* ./hushline
 
 .PHONY: revision
diff --git a/docker-compose.yaml b/docker-compose.yaml
index e9aa54a6..b5e9e4c5 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -12,7 +12,7 @@ services:
       ENCRYPTION_KEY: bi5FDwhZGKfc4urLJ_ChGtIAaOPgxd3RDOhnvct10mw=
       SECRET_KEY: cb3f4afde364bfb3956b97ca22ef4d2b593d9d980a4330686267cabcd2c0befd
       SQLALCHEMY_DATABASE_URI: postgresql://hushline:hushline@postgres:5432/hushline
-      REGISTRATION_CODES_REQUIRED: False
+      REGISTRATION_CODES_REQUIRED: 'false'
       SESSION_COOKIE_NAME: session
       NOTIFICATIONS_ADDRESS: notifications@hushline.app
     volumes:
diff --git a/hushline/__init__.py b/hushline/__init__.py
index 912a5571..3bda6329 100644
--- a/hushline/__init__.py
+++ b/hushline/__init__.py
@@ -6,12 +6,13 @@
 from flask import Flask, flash, redirect, request, session, url_for
 from flask_migrate import Migrate
 from jinja2 import StrictUndefined
+from sqlalchemy.exc import ProgrammingError
 from werkzeug.middleware.proxy_fix import ProxyFix
 from werkzeug.wrappers.response import Response
 
 from . import admin, routes, settings
 from .db import db
-from .model import User
+from .model import HostOrganization, User
 from .version import __version__
 
 
@@ -47,6 +48,9 @@ def create_app() -> Flask:
     app.config["IS_PERSONAL_SERVER"] = (
         os.environ.get("IS_PERSONAL_SERVER", "False").lower() == "true"
     )
+    app.config["REGISTRATION_CODES_REQUIRED"] = (
+        os.environ.get("REGISTRATION_CODES_REQUIRED", "true").lower() == "true"
+    )
     app.config["NOTIFICATIONS_ADDRESS"] = os.environ.get("NOTIFICATIONS_ADDRESS", None)
     app.config["SMTP_USERNAME"] = os.environ.get("SMTP_USERNAME", None)
     app.config["SMTP_SERVER"] = os.environ.get("SMTP_SERVER", None)
@@ -90,6 +94,10 @@ def inject_user() -> dict[str, Any]:
             return {"user": user}
         return {}
 
+    @app.context_processor
+    def inject_host() -> dict[str, HostOrganization]:
+        return dict(host_org=HostOrganization.fetch_or_default())
+
     @app.context_processor
     def inject_is_personal_server() -> dict[str, Any]:
         return {"is_personal_server": app.config["IS_PERSONAL_SERVER"]}
@@ -104,4 +112,17 @@ def add_onion_location_header(response: Response) -> Response:
             )
             return response
 
+    # we can't
+    if app.config.get("FLASK_ENV", None) != "development":
+        with app.app_context():
+            try:
+                host_org = HostOrganization.fetch()
+            except ProgrammingError:
+                app.logger.warning(
+                    "Could not check for existence of HostOrganization", exc_info=True
+                )
+            else:
+                if host_org is None:
+                    app.logger.warning("HostOrganization data not found in database.")
+
     return app
diff --git a/hushline/forms.py b/hushline/forms.py
index 3bc1a0ef..d5aed42c 100644
--- a/hushline/forms.py
+++ b/hushline/forms.py
@@ -1,3 +1,4 @@
+import html
 import re
 
 from flask_wtf import FlaskForm
@@ -25,5 +26,22 @@ def __call__(self, form: Form, field: Field) -> None:
             raise ValidationError(self.message)
 
 
+class HexColor:
+    # HTML input color elements only give & accept 6-hexit color codes
+    hex_color_regex: re.Pattern = re.compile(r"^#[0-9a-fA-F]{6}$")
+
+    def __call__(self, form: Form, field: Field) -> None:
+        color: str = field.data
+        if not self.hex_color_regex.match(color):
+            raise ValidationError(f"{color=} is an invalid 6-hexit color code. (eg. #7d25c1)")
+
+
+class CanonicalHTML:
+    def __call__(self, form: Form, field: Field) -> None:
+        text: str = field.data
+        if text != html.escape(text).strip():
+            raise ValidationError(f"{text=} is ambiguous or unescaped.")
+
+
 class TwoFactorForm(FlaskForm):
     verification_code = StringField("2FA Code", validators=[DataRequired(), Length(min=6, max=6)])
diff --git a/hushline/model.py b/hushline/model.py
index 124b5ca2..ddc264ef 100644
--- a/hushline/model.py
+++ b/hushline/model.py
@@ -2,7 +2,7 @@
 import secrets
 from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
-from typing import TYPE_CHECKING, Any, Generator, Optional, Sequence
+from typing import TYPE_CHECKING, Any, Generator, Optional, Self, Sequence
 
 from flask_sqlalchemy.model import Model
 from passlib.hash import scrypt
@@ -28,6 +28,46 @@ def default(cls) -> "SMTPEncryption":
         return cls.StartTLS
 
 
+class HostOrganization(Model):
+    __tablename__ = "host_organization"
+
+    _DEFAULT_ID: int = 1
+    _DEFAULT_BRAND_PRIMARY_HEX_COLOR: str = "#7d25c1"
+    _DEFAULT_BRAND_APP_NAME: str = "🤫 Hush Line"
+
+    id: Mapped[int] = mapped_column(primary_key=True)
+    brand_app_name: Mapped[str] = mapped_column(db.String(255), default=_DEFAULT_BRAND_APP_NAME)
+    brand_primary_hex_color: Mapped[str] = mapped_column(
+        db.String(7), default=_DEFAULT_BRAND_PRIMARY_HEX_COLOR
+    )
+
+    @classmethod
+    def fetch(cls) -> Self | None:
+        return db.session.get(cls, cls._DEFAULT_ID)
+
+    @classmethod
+    def fetch_or_default(cls) -> Self:
+        return cls.fetch() or cls()
+
+    def __init__(self, **kwargs: Any) -> None:
+        # never allow setting of the ID. It should only ever be `1`
+        if "id" in kwargs:
+            raise ValueError(f"Cannot manually set {self.__class__.__name__} attribute `id`")
+
+        # always initialize all values so that the object is populated for use in templates
+        # even when it's not pulled from the DB.
+        # yes, we have to do this here and not rely on `mapped_column(default='...')` because
+        # that logic doesn't trigger until insert, and we want these here pre-insert
+        if "brand_app_name" not in kwargs:
+            kwargs["brand_app_name"] = self._DEFAULT_BRAND_APP_NAME
+        if "brand_primary_hex_color" not in kwargs:
+            kwargs["brand_primary_hex_color"] = self._DEFAULT_BRAND_PRIMARY_HEX_COLOR
+        super().__init__(
+            id=self._DEFAULT_ID,  # type: ignore[call-arg]
+            **kwargs,
+        )
+
+
 @dataclass(frozen=True, repr=False, eq=False)
 class ExtraField:
     label: Optional[str]
@@ -73,9 +113,11 @@ def __init__(
         is_primary: bool,
         **kwargs: Any,
     ) -> None:
-        super().__init__(**kwargs)
-        self._username = _username
-        self.is_primary = is_primary
+        super().__init__(
+            _username=_username,  # type: ignore[call-arg]
+            is_primary=is_primary,  # type: ignore[call-arg]
+            **kwargs,
+        )
 
     @property
     def username(self) -> str:
@@ -219,7 +261,7 @@ def __init__(self, **kwargs: Any) -> None:
             if key in kwargs:
                 raise ValueError(f"Key {key!r} cannot be mannually set. Try 'password' instead.")
         pw = kwargs.pop("password", None)
-        super().__init__()
+        super().__init__(**kwargs)
         self.password_hash = pw
 
 
@@ -255,11 +297,12 @@ def __init__(
         otp_code: str | None = None,
         timecode: int | None = None,
     ) -> None:
-        super().__init__()
-        self.user_id = user_id
-        self.successful = successful
-        self.otp_code = otp_code
-        self.timecode = timecode
+        super().__init__(
+            user_id=user_id,  # type: ignore[call-arg]
+            successful=successful,  # type: ignore[call-arg]
+            otp_code=otp_code,  # type: ignore[call-arg]
+            timecode=timecode,  # type: ignore[call-arg]
+        )
 
 
 class Message(Model):
@@ -273,8 +316,10 @@ class Message(Model):
     def __init__(self, content: str, **kwargs: Any) -> None:
         if "_content" in kwargs:
             raise ValueError("Cannot set '_content' directly. Use 'content'")
-        super().__init__(**kwargs)
-        self.content = content
+        super().__init__(
+            content=content,  # type: ignore[call-arg]
+            **kwargs,
+        )
 
     @property
     def content(self) -> str | None:
@@ -297,9 +342,10 @@ class InviteCode(Model):
     expiration_date: Mapped[datetime]
 
     def __init__(self) -> None:
-        super().__init__()
-        self.code = secrets.token_urlsafe(16)
-        self.expiration_date = datetime.now(timezone.utc) + timedelta(days=365)
+        super().__init__(
+            code=secrets.token_urlsafe(16),  # type: ignore[call-arg]
+            expiration_date=datetime.now(timezone.utc) + timedelta(days=365),  # type: ignore[call-arg]
+        )
 
     def __repr__(self) -> str:
         return f"<InviteCode {self.code}>"
diff --git a/hushline/routes.py b/hushline/routes.py
index f09e2fdb..d9df24c1 100644
--- a/hushline/routes.py
+++ b/hushline/routes.py
@@ -1,5 +1,4 @@
 import logging
-import os
 import re
 import secrets
 import socket
@@ -320,7 +319,7 @@ def register() -> Response | str | tuple[Response | str, int]:
             flash("👉 You are already logged in.")
             return redirect(url_for("inbox"))
 
-        require_invite_code = os.environ.get("REGISTRATION_CODES_REQUIRED", "True") == "True"
+        require_invite_code = app.config["REGISTRATION_CODES_REQUIRED"]
         form = RegistrationForm()
         if not require_invite_code:
             del form.invite_code
diff --git a/hushline/settings/__init__.py b/hushline/settings/__init__.py
index 82487e3d..5d13508d 100644
--- a/hushline/settings/__init__.py
+++ b/hushline/settings/__init__.py
@@ -25,8 +25,12 @@
 from ..crypto import is_valid_pgp_key
 from ..db import db
 from ..forms import TwoFactorForm
-from ..model import Message, SMTPEncryption, User, Username
-from ..utils import authentication_required, create_smtp_config
+from ..model import HostOrganization, Message, SMTPEncryption, User, Username
+from ..utils import (
+    admin_authentication_required,
+    authentication_required,
+    create_smtp_config,
+)
 from .forms import (
     ChangePasswordForm,
     ChangeUsernameForm,
@@ -37,6 +41,8 @@
     PGPKeyForm,
     PGPProtonForm,
     ProfileForm,
+    UpdateBrandAppNameForm,
+    UpdateBrandPrimaryColorForm,
 )
 
 
@@ -215,6 +221,8 @@ async def index() -> str | Response:
         directory_visibility_form = DirectoryVisibilityForm()
         new_alias_form = NewAliasForm()
         profile_form = ProfileForm()
+        update_brand_primary_color_form = UpdateBrandPrimaryColorForm()
+        update_brand_app_name_form = UpdateBrandAppNameForm()
 
         if request.method == "POST":
             if "update_bio" in request.form and profile_form.validate_on_submit():
@@ -295,6 +303,8 @@ async def index() -> str | Response:
             "settings/index.html",
             user=user,
             all_users=all_users,
+            update_brand_primary_color_form=update_brand_primary_color_form,
+            update_brand_app_name_form=update_brand_app_name_form,
             email_forwarding_form=email_forwarding_form,
             change_password_form=change_password_form,
             change_username_form=change_username_form,
@@ -605,6 +615,36 @@ def update_smtp_settings() -> Response | str:
         flash("👍 SMTP settings updated successfully")
         return redirect(url_for(".index"))
 
+    @bp.route("/update-brand-primary-color", methods=["POST"])
+    @admin_authentication_required
+    def update_brand_primary_color() -> Response | str:
+        host_org = HostOrganization.fetch_or_default()
+        form = UpdateBrandPrimaryColorForm()
+        if form.validate_on_submit():
+            host_org.brand_primary_hex_color = form.brand_primary_hex_color.data
+            db.session.add(host_org)  # explicitly add because instance might be new
+            db.session.commit()
+            flash("👍 Brand primary color updated successfully.")
+            return redirect(url_for(".index"))
+
+        flash("⛔ Invalid form data. Please try again.")
+        return redirect(url_for(".index"))
+
+    @bp.route("/update-brand-app-name", methods=["POST"])
+    @admin_authentication_required
+    def update_brand_app_name() -> Response | str:
+        host_org = HostOrganization.fetch_or_default()
+        form = UpdateBrandAppNameForm()
+        if form.validate_on_submit():
+            host_org.brand_app_name = form.brand_app_name.data
+            db.session.add(host_org)  # explicitly add because instance might be new
+            db.session.commit()
+            flash("👍 Brand app name updated successfully.")
+            return redirect(url_for(".index"))
+
+        flash("⛔ Invalid form data. Please try again.")
+        return redirect(url_for(".index"))
+
     @bp.route("/delete-account", methods=["POST"])
     @authentication_required
     def delete_account() -> Response | str:
diff --git a/hushline/settings/forms.py b/hushline/settings/forms.py
index e356c20d..2f70d36f 100644
--- a/hushline/settings/forms.py
+++ b/hushline/settings/forms.py
@@ -15,7 +15,7 @@
 from wtforms.validators import DataRequired, Email, Length
 from wtforms.validators import Optional as OptionalField
 
-from ..forms import ComplexPassword
+from ..forms import CanonicalHTML, ComplexPassword, HexColor
 from ..model import SMTPEncryption
 
 
@@ -173,3 +173,13 @@ class ProfileForm(FlaskForm):
         filters=[strip_whitespace],
         validators=[OptionalField(), Length(max=4096)],
     )
+
+
+class UpdateBrandPrimaryColorForm(FlaskForm):
+    brand_primary_hex_color = StringField("Hex Color", validators=[DataRequired(), HexColor()])
+
+
+class UpdateBrandAppNameForm(FlaskForm):
+    brand_app_name = StringField(
+        "App Name", validators=[CanonicalHTML(), DataRequired(), Length(min=2, max=30)]
+    )
diff --git a/hushline/static/css/style.css b/hushline/static/css/style.css
index d5f5cbc5..5adb0415 100644
--- a/hushline/static/css/style.css
+++ b/hushline/static/css/style.css
@@ -1,20 +1,49 @@
 :root {
   --color-border: rgba(0, 0, 0, 0.18);
-  --color-border-dark: #7d7d7d;
-  --color-border-dark-1: #555;
-  --color-brand: #7d25c1;
-  --color-brand-dark: #ecdafa;
+  --color-border-dark: #787878;
+  --color-border-dark-1: #505050;
+  --color-brand: oklch(48.55% 0.222 304.47); /* #7d25c1 */
+  --color-brand-min-contrast: oklch(
+    from var(--color-brand) clamp(0.1, l, 0.6) c h
+  );
+  --color-brand-mid-contrast: oklch(
+    from var(--color-brand-min-contrast) max(l - 0.125, 0.1) calc(1.25 * c) h
+  );
+  --color-brand-max-contrast: oklch(
+    from var(--color-brand-min-contrast) max(l - 0.25, 0.1) calc(1.25 * c) h
+  );
+  --color-brand-dark-min-saturation: oklch(
+    from var(--color-brand) clamp(0.96, l + 0.425, 0.98) calc(0.5 * c) h
+  );
+  --color-brand-dark-mid-saturation: oklch(
+    from var(--color-brand) clamp(0.93, l + 0.4, 0.98) calc(0.75 * c) h
+  );
+  --color-brand-dark-max-saturation: oklch(
+    from var(--color-brand) clamp(0.8, l + 0.175, 0.94) calc(1.5 * c)
+      calc(h - 6)
+  );
   --color-text: #333;
-  --color-text-dark-alt-2: #e4e4e4;
-  --color-text-dark-alt: #c2c2c2;
-  --color-text-dark: #dadada;
+  --color-text-dark-alt-2: #e6e6e6;
+  --color-text-dark-alt: #c4c4c4;
+  --color-text-dark: #dcdcdc;
   --color-text-light: #595959;
-  --color-highlight: rgba(125, 37, 193, 0.1);
-  --color-highlight-dark: rgba(220, 198, 237, 0.2);
-  --color-brand-bg: #fbf3ff;
-  --color-dark-bg: #222;
-  --color-dark-bg-alt: #333;
-  --color-dark-bg-alt-1: #444;
+  --color-highlight: oklch(
+    /* rgba(125, 37, 193, 0.1) */ from var(--color-brand) l c h / 0.1
+  );
+  --color-highlight-dark: oklch(
+    /* rgba(220, 198, 237, 0.2) */ from var(--color-brand-dark-mid-saturation) l
+      c h / 0.2
+  );
+  --color-brand-bg: oklch(
+    /* #fbf3ff */ from var(--color-brand) clamp(0.8, l + 0.4883, 0.98)
+      min(c, 0.0179) calc(h + 10.26)
+  );
+  --color-dark-bg: oklch(
+    /* was #222 now with brand hue */ from var(--color-brand)
+      clamp(0.18, l - 0.275, 0.2) min(c, 0.01) calc(h + 10.26)
+  );
+  --color-dark-bg-alt: #272727;
+  --color-dark-bg-alt-1: #353535;
   --color-dark-bg-alt-transparent: rgba(51, 51, 51, 0.7);
 
   --border: 1px solid var(--color-border);
@@ -74,7 +103,7 @@
   }
 
   a {
-    color: var(--color-brand);
+    color: var(--color-brand-max-contrast);
   }
 
   p.meta {
@@ -145,7 +174,9 @@
   /* Change background color of tabs on hover */
   .tab:hover,
   .subtab:hover {
-    background-color: #fbf3ff;
+    background-color: oklch(
+      /* #fbf3ff */ from var(--color-brand-bg) 0.97 c h / 0.85
+    );
   }
 
   /* Create an active/current tablink class */
@@ -171,8 +202,8 @@
   button:focus,
   input[type="file"]::file-selector-button:focus,
   select:focus {
-    outline: 4px double var(--color-brand);
-    border: 1px solid var(--color-brand);
+    outline: 4px double var(--color-brand-min-contrast);
+    border: 1px solid var(--color-brand-min-contrast);
     box-shadow: none;
   }
 
@@ -181,7 +212,7 @@
   .btn,
   input[type="file"]::file-selector-button {
     border: 0px;
-    background-color: var(--color-brand);
+    background-color: var(--color-brand-mid-contrast);
     color: white;
   }
 
@@ -189,9 +220,13 @@
   .formBody button,
   .btn {
     background-color: white;
-    color: var(--color-brand);
-    border: 1px solid var(--color-brand);
-    box-shadow: 0px 2px 0px 0px rgba(125, 37, 193, 0.25);
+    color: var(--color-brand-mid-contrast);
+    border: 1px solid var(--color-brand-min-contrast);
+    box-shadow: 0px 2px 0px 0px
+      oklch(
+        /* rgba(125, 37, 193, 0.25) */ from var(--color-brand) min(l, 0.95) c h /
+          0.25
+      );
   }
 
   .formBody input[type="submit"]:hover,
@@ -206,7 +241,11 @@
   .btn:active,
   input[type="file"]::file-selector-button:active,
   select:active {
-    box-shadow: inset 0px 2px 0px 0px rgba(125, 37, 193, 0.25);
+    box-shadow: inset 0px 2px 0px 0px
+      oklch(
+        /* rgba(125, 37, 193, 0.25) */ from var(--color-brand) min(l, 0.95) c h /
+          0.25
+      );
   }
 
   .btn-danger,
@@ -217,8 +256,8 @@
 
   p.badge {
     background-color: white;
-    color: var(--color-brand);
-    border: 1px solid var(--color-brand);
+    color: var(--color-brand-mid-contrast);
+    border: 1px solid var(--color-brand-min-contrast);
   }
 
   .search-highlight {
@@ -272,7 +311,7 @@
   }
 
   .toggle-ui input[type="checkbox"]:checked ~ label .toggle {
-    background: var(--color-brand);
+    background: var(--color-brand-min-contrast);
   }
 
   .flash-messages {
@@ -314,7 +353,7 @@
   }
 
   .banner {
-    background-color: var(--color-brand);
+    background-color: var(--color-brand-min-contrast);
     color: white;
   }
 
@@ -357,7 +396,7 @@
   }
 
   a {
-    color: var(--color-brand-dark);
+    color: var(--color-brand-dark-mid-saturation);
   }
 
   p.meta {
@@ -381,6 +420,7 @@
 
   .mobileNav {
     background-image: url("../img/app/icon-menu-light.png");
+    color: var(--color-brand-dark-min-saturation);
   }
 
   .container {
@@ -433,14 +473,17 @@
   /* Change background color of tabs on hover */
   .tab:hover,
   .subtab:hover {
-    background-color: rgba(255, 255, 255, 0.1);
+    background-color: oklch(
+      /* was rgba(255, 255, 255, 0.1) now with color */ from
+        var(--color-dark-bg) 0.15 calc(12 * c) h / 0.0675
+    );
   }
 
   /* Create an active/current tablink class */
   .tab.active,
   .subtab.active {
-    box-shadow: 0 -2px 0 inset var(--color-brand-dark);
-    border-bottom: 1px solid var(--color-brand-dark);
+    box-shadow: 0 -2px 0 inset var(--color-brand-dark-min-saturation);
+    border-bottom: 1px solid var(--color-brand-dark-min-saturation);
   }
 
   .user,
@@ -460,16 +503,17 @@
   button:focus,
   input[type="file"]::file-selector-button:focus,
   select:focus {
-    outline: 4px double var(--color-brand-dark);
-    border: 1px solid var(--color-brand-dark);
+    outline: 4px double var(--color-brand-dark-min-saturation);
+    border: 1px solid var(--color-brand-dark-min-saturation);
     box-shadow: none;
   }
 
   input[type="submit"],
   button,
-  .btn {
+  .btn,
+  input[type="file"]::file-selector-button {
     border: 0px;
-    background-color: var(--color-brand-dark);
+    background-color: var(--color-brand-dark-min-saturation);
     color: var(--color-text);
   }
 
@@ -477,9 +521,13 @@
   .formBody button,
   .btn {
     background-color: var(--color-dark);
-    color: var(--color-brand-dark);
-    border: 1px solid var(--color-brand-dark);
-    box-shadow: 0px 2px 0px 0px rgba(125, 37, 193, 0.25);
+    color: var(--color-brand-dark-min-saturation);
+    border: 1px solid var(--color-brand-dark-max-saturation);
+    box-shadow: 0px 2px 0px 0px
+      oklch(
+        /* rgba(125, 37, 193, 0.25) */ from
+          var(--color-brand-dark-max-saturation) l c h / 0.25
+      );
   }
 
   .formBody input[type="submit"]:hover,
@@ -493,19 +541,22 @@
   .formBody button:active,
   .btn:active,
   input[type="file"]::file-selector-button:active {
-    box-shadow: inset 0px 2px 0px 0px rgba(125, 37, 193, 0.25);
+    box-shadow: inset 0px 2px 0px 0px
+      oklch(/* rgba(125, 37, 193, 0.25) */ from var(--color-brand) l c h / 0.25);
   }
 
   .btn-danger,
   .formBody .btn-danger {
-    color: lightpink;
-    border-color: lightpink;
+    background-color: darkred;
+    color: white;
+    border: 1px solid oklch(1 0 0 / 0.15);
+    box-shadow: 0px 4px 8px -4px oklch(1 0 0 / 0.25);
   }
 
   p.badge {
     background-color: var(--color-dark-bg-alt-1);
-    color: var(--color-brand-dark);
-    border: 1px solid var(--color-brand-dark);
+    color: var(--color-brand-dark-min-saturation);
+    border: 1px solid var(--color-brand-dark-max-saturation);
   }
 
   h2.submit + .badgeContainer p.badge {
@@ -568,7 +619,7 @@
   }
 
   .toggle-ui input[type="checkbox"]:checked ~ label .toggle {
-    background: var(--color-brand-dark);
+    background: var(--color-brand-dark-mid-saturation);
   }
 
   footer {
@@ -616,7 +667,7 @@
   }
 
   .banner {
-    background-color: #ecdafa;
+    background-color: var(--color-brand-dark-min-saturation); /* #ecdafa */
     color: #333;
   }
 
@@ -1116,6 +1167,12 @@ input[type="file"]::file-selector-button {
   border: 0;
 }
 
+input[type="color"] {
+  padding: 0.25rem;
+  width: 4rem;
+  height: 2rem;
+}
+
 header .btn {
   font-size: var(--font-size-small);
   margin-left: 1rem;
@@ -1173,7 +1230,8 @@ button,
 input[type="file"]::file-selector-button {
   cursor: pointer;
   text-decoration: none;
-  box-shadow: 0px 2px 0px 0px rgba(125, 37, 193, 0.25);
+  box-shadow: 0px 2px 0px 0px
+    oklch(/* rgba(125, 37, 193, 0.25) */ from var(--color-brand) l c h / 0.25);
 }
 
 textarea {
diff --git a/hushline/static/img/app/icon-menu-light.png b/hushline/static/img/app/icon-menu-light.png
index b111b829..9e32607c 100644
Binary files a/hushline/static/img/app/icon-menu-light.png and b/hushline/static/img/app/icon-menu-light.png differ
diff --git a/hushline/static/js/settings.js b/hushline/static/js/settings.js
index d440cd38..f3bf64d8 100644
--- a/hushline/static/js/settings.js
+++ b/hushline/static/js/settings.js
@@ -75,6 +75,26 @@ document.addEventListener("DOMContentLoaded", function () {
     });
   });
 
+  if (document.getElementById("branding")) {
+    // Update color in real-time as they're being browsed & finalized
+    const colorPicker = document.getElementById("brand-primary-color");
+
+    for (const eventName of ["input", "change"]) {
+      colorPicker.addEventListener(eventName, function (event) {
+        const brandColor = `oklch(from ${event.target.value} l c h)`;
+        const cssVariable = ["--color-brand", brandColor];
+        document.documentElement.style.setProperty(...cssVariable);
+      });
+    }
+
+    // Update app name in real-time as it's being typed
+    const appNameBox = document.getElementById("brand-app-name");
+
+    appNameBox.addEventListener("input", function (event) {
+      document.querySelector("h1").innerText = event.target.value;
+    });
+  }
+
   var forwarding_enabled = document.querySelector(
     "input[id='forwarding_enabled']",
   ).checked;
diff --git a/hushline/templates/base.html b/hushline/templates/base.html
index bac09f64..919e6f34 100644
--- a/hushline/templates/base.html
+++ b/hushline/templates/base.html
@@ -64,6 +64,12 @@
       rel="stylesheet"
       href="{{ url_for('static', filename='css/style.css') }}"
     />
+    <!-- prettier-ignore -->
+    <style>
+      :root {
+        --color-brand: oklch(from {{ host_org.brand_primary_hex_color }} l c h);
+      }
+    </style>
   </head>
 
   <body>
@@ -95,7 +101,7 @@
 
     <header>
       <!-- Navigation bar, logo, etc. -->
-      <h1>🤫 Hush Line</h1>
+      <h1>{{ host_org.brand_app_name }}</h1>
       <nav>
         <div class="navGroup">
           <a class="mobileNav btnIcon" aria-label="Navigation menu">Menu</a>
diff --git a/hushline/templates/settings/branding.html b/hushline/templates/settings/branding.html
new file mode 100644
index 00000000..e977931b
--- /dev/null
+++ b/hushline/templates/settings/branding.html
@@ -0,0 +1,42 @@
+<div
+  id="branding"
+  class="tab-content admin-only"
+  role="tabpanel"
+  aria-labelledby="branding-tab"
+  hidden
+>
+  <h3>Primary Color</h3>
+  <form
+    method="POST"
+    action="{{ url_for('settings.update_brand_primary_color') }}"
+    class="formBody"
+  >
+    {{ update_brand_primary_color_form.hidden_tag() }}
+    <label for="brand-primary-color">Choose Color</label>
+    <input
+      type="color"
+      name="brand_primary_hex_color"
+      id="brand-primary-color"
+      value="{{ host_org.brand_primary_hex_color }}"
+    />
+    <button type="submit" class="btn">Update Color</button>
+  </form>
+
+  <h3>App Name</h3>
+  <form
+    method="POST"
+    action="{{ url_for('settings.update_brand_app_name') }}"
+    class="formBody"
+  >
+    {{ update_brand_app_name_form.hidden_tag() }}
+    <label for="brand-app-name">Choose Name</label>
+    <input
+      type="text"
+      name="brand_app_name"
+      id="brand-app-name"
+      value="{{ host_org.brand_app_name }}"
+      required
+    />
+    <button type="submit" class="btn">Update Name</button>
+  </form>
+</div>
diff --git a/hushline/templates/settings/index.html b/hushline/templates/settings/index.html
index a7b6f845..258cbb10 100644
--- a/hushline/templates/settings/index.html
+++ b/hushline/templates/settings/index.html
@@ -12,6 +12,7 @@ <h2>Settings</h2>
         ('auth', 'Authentication', False),
         ('email', 'Email & Encryption', False),
         ('advanced', 'Advanced', False),
+        ('branding', 'Branding', True),
         ('admin', 'Admin', True)
       ] %}
         {% for (id, display, requires_admin) in buttons %}
@@ -41,6 +42,7 @@ <h2>Settings</h2>
     {% include "settings/email.html" %}
     {% include "settings/advanced.html" %}
     {% if user.is_admin %}
+      {% include "settings/branding.html" %}
       {% include "settings/admin.html" %}
     {% endif %}
   </div>
diff --git a/migrations/env.py b/migrations/env.py
index c4c00993..3229bdc0 100644
--- a/migrations/env.py
+++ b/migrations/env.py
@@ -15,12 +15,7 @@
 
 
 def get_engine():
-    try:
-        # this works with Flask-SQLAlchemy<3 and Alchemical
-        return current_app.extensions["migrate"].db.get_engine()
-    except (TypeError, AttributeError):
-        # this works with Flask-SQLAlchemy>=3
-        return current_app.extensions["migrate"].db.engine
+    return current_app.extensions["migrate"].db.engine
 
 
 def get_engine_url():
@@ -37,11 +32,6 @@ def get_engine_url():
 config.set_main_option("sqlalchemy.url", get_engine_url())
 target_db = current_app.extensions["migrate"].db
 
-# other values from the config, defined by the needs of env.py,
-# can be acquired:
-# my_important_option = config.get_main_option("my_important_option")
-# ... etc.
-
 
 def get_metadata():
     if hasattr(target_db, "metadatas"):
diff --git a/migrations/versions/5410668e15ad_add_host_organization_table.py b/migrations/versions/5410668e15ad_add_host_organization_table.py
new file mode 100644
index 00000000..0badc566
--- /dev/null
+++ b/migrations/versions/5410668e15ad_add_host_organization_table.py
@@ -0,0 +1,36 @@
+"""add host_organization table
+
+Revision ID: 5410668e15ad
+Revises: 5ffe5a5c8e9a
+Create Date: 2024-09-28 09:38:02.716771
+
+"""
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision = "5410668e15ad"
+down_revision = "5ffe5a5c8e9a"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "host_organization",
+        sa.Column("id", sa.Integer(), nullable=False),
+        sa.Column("brand_app_name", sa.String(length=255), nullable=False),
+        sa.Column("brand_primary_hex_color", sa.String(length=7), nullable=False),
+        sa.PrimaryKeyConstraint("id", name=op.f("pk_host_organization")),
+    )
+
+    op.execute(
+        "INSERT INTO host_organization (id, brand_app_name, brand_primary_hex_color) "
+        "VALUES (1, '🤫 Hush Line', '#7d25c1')"
+    )
+
+
+def downgrade() -> None:
+    op.drop_table("host_organization")
diff --git a/tests/conftest.py b/tests/conftest.py
index 8f4ee069..86c2d885 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -187,6 +187,28 @@ def _authenticated_user(client: FlaskClient, user: User) -> None:
         session["is_authenticated"] = True
 
 
+@pytest.fixture()
+def admin(app: Flask, user_password: str, database: str) -> User:
+    user = User(password=user_password, is_admin=True)
+    db.session.add(user)
+    db.session.flush()
+
+    uuid_ish = str(uuid4())[0:12]
+    username = Username(user_id=user.id, _username=f"test-{uuid_ish}", is_primary=True)
+    db.session.add(username)
+    db.session.commit()
+
+    return user
+
+
+@pytest.fixture()
+def _authenticated_admin(client: FlaskClient, admin: User) -> None:
+    with client.session_transaction() as session:
+        session["user_id"] = admin.id
+        session["username"] = admin.primary_username.username
+        session["is_authenticated"] = True
+
+
 @pytest.fixture()
 def _pgp_user(client: FlaskClient, user: User) -> None:
     with open("tests/test_pgp_key.txt") as f:
diff --git a/tests/test_settings.py b/tests/test_settings.py
index dfb920ea..8bed9770 100644
--- a/tests/test_settings.py
+++ b/tests/test_settings.py
@@ -2,11 +2,12 @@
 from uuid import uuid4
 
 import pytest
+from bs4 import BeautifulSoup
 from flask import url_for
 from flask.testing import FlaskClient
 
 from hushline.db import db
-from hushline.model import Message, SMTPEncryption, User, Username
+from hushline.model import HostOrganization, Message, SMTPEncryption, User, Username
 
 
 @pytest.mark.usefixtures("_authenticated_user")
@@ -478,3 +479,51 @@ def test_alias_change_directory_visibility(
     assert resp.status_code == 200
     assert "Directory visibility updated successfully" in resp.text
     assert db.session.scalar(db.select(Username.show_in_directory).filter_by(id=user_alias.id))
+
+
+@pytest.mark.usefixtures("_authenticated_admin")
+def test_update_brand_primary_color(client: FlaskClient, admin: User) -> None:
+    color = "#acab00"
+    resp = client.post(
+        url_for("settings.update_brand_primary_color"),
+        data={"brand_primary_hex_color": color},
+        follow_redirects=True,
+    )
+    assert resp.status_code == 200
+    assert "Brand primary color updated successfully" in resp.text
+
+    soup = BeautifulSoup(resp.text, "html.parser")
+    styles = soup.find_all("style")
+    assert styles  # sensibility check
+    for style in styles:
+        if f"--color-brand: oklch(from {color} l c h);" in style.string:
+            break
+    else:
+        pytest.fail("Brand color CSS not updated in response <style>")
+
+    assert (host_org := HostOrganization.fetch())
+    assert host_org.brand_primary_hex_color == color
+
+
+@pytest.mark.usefixtures("_authenticated_admin")
+def test_update_brand_app_name(client: FlaskClient, admin: User) -> None:
+    name = "h4cK3rZ"
+    resp = client.post(
+        url_for("settings.update_brand_app_name"),
+        data={"brand_app_name": name},
+        follow_redirects=True,
+    )
+    assert resp.status_code == 200
+    assert "Brand app name updated successfully" in resp.text
+
+    soup = BeautifulSoup(resp.text, "html.parser")
+    h1s = soup.select("header h1")
+    assert h1s  # sensibility check
+    for h1 in h1s:
+        if name in h1.string:
+            break
+    else:
+        pytest.fail("Brand name not updated in header <h1>")
+
+    assert (host_org := HostOrganization.fetch())
+    assert host_org.brand_app_name == name