diff --git a/server/internal/api/workflows.go b/server/internal/api/workflows.go
index 76f183e..a9e77e8 100644
--- a/server/internal/api/workflows.go
+++ b/server/internal/api/workflows.go
@@ -212,7 +212,10 @@ func seedDefaults(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{"created": created, "updated": updated})
 }
 
+const maxStepBodyBytes = 1 << 20 // 1 MiB
+
 func importStep(c *gin.Context) {
+	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, maxStepBodyBytes)
 	body, err := io.ReadAll(c.Request.Body)
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
@@ -230,6 +233,7 @@ func importStep(c *gin.Context) {
 // parseStep validates a step doc and returns the normalized step WITHOUT
 // persisting — used by the editor to insert an imported ad-hoc (inline) step.
 func parseStep(c *gin.Context) {
+	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, maxStepBodyBytes)
 	body, err := io.ReadAll(c.Request.Body)
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
diff --git a/web/app/workflows/[id]/page.tsx b/web/app/workflows/[id]/page.tsx
index dc0992e..3aa0db4 100644
--- a/web/app/workflows/[id]/page.tsx
+++ b/web/app/workflows/[id]/page.tsx
@@ -240,6 +240,12 @@ export default function WorkflowBuilder() {
 
     const toggleSecretRef = (ref: string) => {
         if (selectedIdxInWf === -1 || !selectedRef) return;
+        if (selectedRef.inline) {
+            const current = selectedRef.inline.secret_refs ?? [];
+            const next = current.includes(ref) ? current.filter((r) => r !== ref) : [...current, ref];
+            updateInline(selectedIdxInWf, { secret_refs: next });
+            return;
+        }
         const current = selectedRef.overrides?.secret_refs ?? [];
         const next = current.includes(ref) ? current.filter((r) => r !== ref) : [...current, ref];
         updateRef(selectedIdxInWf, { overrides: { ...selectedRef.overrides, secret_refs: next } });
@@ -282,7 +288,13 @@ export default function WorkflowBuilder() {
     const pwshSteps = filteredLibrary.filter((s) => s.interpreter === "powershell");
 
     const upstreamOutputsFor = (i: number) =>
-        Array.from(new Set(sortedSteps.slice(0, i).flatMap((r) => libById(r.step_id)?.declared_outputs ?? [])));
+        Array.from(
+            new Set(
+                sortedSteps
+                    .slice(0, i)
+                    .flatMap((r) => r.inline?.declared_outputs ?? libById(r.step_id)?.declared_outputs ?? []),
+            ),
+        );
 
     const DropZone = ({ pos }: { pos: number }) => (
         <div
@@ -580,11 +592,11 @@ export default function WorkflowBuilder() {
                                 </div>
                             )}
 
-                            {(selectedLib?.declared_inputs ?? []).length > 0 && (
+                            {(selectedRef.inline?.declared_inputs ?? selectedLib?.declared_inputs ?? []).length > 0 && (
                                 <div className="border-b border-border pb-4">
                                     <label className="mb-2 block text-xs uppercase text-text-secondary">Inputs</label>
                                     <div className="space-y-2">
-                                        {selectedLib?.declared_inputs.map((param) => (
+                                        {(selectedRef.inline?.declared_inputs ?? selectedLib?.declared_inputs ?? []).map((param) => (
                                             <div key={param.name}>
                                                 <div className="mb-1 font-mono text-xs text-text-primary">{param.name}</div>
                                                 {param.description && (
@@ -624,10 +636,10 @@ export default function WorkflowBuilder() {
                             <div className="border-b border-border pb-4">
                                 <label className="mb-2 block text-xs uppercase text-text-secondary">Outputs · to $WORKFLOW_ENV</label>
                                 <div className="flex flex-wrap gap-1">
-                                    {(selectedLib?.declared_outputs ?? []).length === 0 && (
+                                    {(selectedRef.inline?.declared_outputs ?? selectedLib?.declared_outputs ?? []).length === 0 && (
                                         <p className="text-xs text-text-secondary">No declared outputs.</p>
                                     )}
-                                    {(selectedLib?.declared_outputs ?? []).map((o) => (
+                                    {(selectedRef.inline?.declared_outputs ?? selectedLib?.declared_outputs ?? []).map((o) => (
                                         <span key={o} className="flex items-center gap-1 rounded bg-signal px-2 py-0.5 font-mono text-[11px] text-signal-ink">
                                             <span className="text-[9px] uppercase">out</span>
                                             {o}
@@ -644,7 +656,11 @@ export default function WorkflowBuilder() {
                                             <div className="font-mono text-[11px] font-semibold text-text-secondary">{g.group}</div>
                                             {(groupKeys[g.group] ?? []).map((key) => {
                                                 const ref = `${g.group}/${key}`;
-                                                const checked = (selectedRef.overrides?.secret_refs ?? []).includes(ref);
+                                                const checked = (
+                                                    selectedRef.inline
+                                                        ? (selectedRef.inline.secret_refs ?? [])
+                                                        : (selectedRef.overrides?.secret_refs ?? [])
+                                                ).includes(ref);
                                                 return (
                                                     <label key={ref} className="ml-2 flex cursor-pointer items-center gap-2 text-xs text-text-primary">
                                                         <input