diff --git a/src/Service/AcquisitionAction.php b/src/Service/AcquisitionAction.php
index 9df58b12..a155fd64 100644
--- a/src/Service/AcquisitionAction.php
+++ b/src/Service/AcquisitionAction.php
@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Actions that can result from credential acquisition attempt.
  *
diff --git a/src/Service/CredentialAcquisitionResult.php b/src/Service/CredentialAcquisitionResult.php
index e4312a6d..5ee46d07 100644
--- a/src/Service/CredentialAcquisitionResult.php
+++ b/src/Service/CredentialAcquisitionResult.php
@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Result of credential acquisition attempt.
  *
diff --git a/src/Service/CredentialProvisioningStrategy.php b/src/Service/CredentialProvisioningStrategy.php
index 64a2fd49..26597a0e 100644
--- a/src/Service/CredentialProvisioningStrategy.php
+++ b/src/Service/CredentialProvisioningStrategy.php
@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Strategy interface for credential provisioning.
  *
diff --git a/src/Service/CredentialStore.php b/src/Service/CredentialStore.php
index fe0ec23d..94019021 100644
--- a/src/Service/CredentialStore.php
+++ b/src/Service/CredentialStore.php
@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Repository interface for password credential storage.
  *
diff --git a/src/Service/CredentialType.php b/src/Service/CredentialType.php
index b721a40e..77a5f521 100644
--- a/src/Service/CredentialType.php
+++ b/src/Service/CredentialType.php
@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Credential types supported by unified manager.
  *
diff --git a/src/Service/Exception/OAuthTokenRefreshException.php b/src/Service/Exception/OAuthTokenRefreshException.php
index aef7619e..ee4d26c2 100644
--- a/src/Service/Exception/OAuthTokenRefreshException.php
+++ b/src/Service/Exception/OAuthTokenRefreshException.php
@@ -18,6 +18,7 @@
 
 use Horde\Core\Service\TokenGrant;
 use RuntimeException;
+use Throwable;
 
 /**
  * Thrown when an OAuth token refresh fails (e.g. refresh token revoked).
@@ -32,7 +33,7 @@ public function __construct(
         private readonly string $providerId,
         private readonly ?TokenGrant $grant = null,
         int $code = 0,
-        ?\Throwable $previous = null
+        ?Throwable $previous = null
     ) {
         parent::__construct($message, $code, $previous);
     }
diff --git a/src/Service/Factory/CredentialProvisioningStrategyFactory.php b/src/Service/Factory/CredentialProvisioningStrategyFactory.php
index c4d85911..240acc0c 100644
--- a/src/Service/Factory/CredentialProvisioningStrategyFactory.php
+++ b/src/Service/Factory/CredentialProvisioningStrategyFactory.php
@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Factory for CredentialProvisioningStrategy.
  *
@@ -11,11 +12,12 @@
 
 use Horde\Core\Service\CredentialProvisioningStrategy;
 use Horde\Core\Service\NullCredentialProvisioningStrategy;
+use Horde\Injector\Injector;
 use Horde_Injector;
 
 class CredentialProvisioningStrategyFactory
 {
-    public function create(Horde_Injector $injector): CredentialProvisioningStrategy
+    public function create(Horde_Injector|Injector $injector): CredentialProvisioningStrategy
     {
         return new NullCredentialProvisioningStrategy();
     }
diff --git a/src/Service/Factory/CredentialStoreFactory.php b/src/Service/Factory/CredentialStoreFactory.php
index 5eab810f..4679407c 100644
--- a/src/Service/Factory/CredentialStoreFactory.php
+++ b/src/Service/Factory/CredentialStoreFactory.php
@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Factory for CredentialStore.
  *
@@ -9,14 +10,100 @@
 
 namespace Horde\Core\Service\Factory;
 
+use Horde\Core\Config\ConfigLoader;
 use Horde\Core\Service\CredentialStore;
 use Horde\Core\Service\NullCredentialStore;
+use Horde\Injector\Injector;
 use Horde_Injector;
+use Psr\Log\LoggerInterface;
+use Psr\Log\NullLogger;
+use Throwable;
 
+/**
+ * Resolves the configured password-credential store.
+ *
+ * Core owns the {@see CredentialStore} contract but ships no concrete
+ * storage backend of its own (only {@see NullCredentialStore}). Real
+ * backends live in downstream packages — e.g. base provides an
+ * SQL-backed store. To avoid a Core -> base dependency, the concrete
+ * backend is selected by configuration rather than wired in here.
+ *
+ * `password_credentials.storage_factory` holds the fully-qualified class
+ * name of a daughter factory (any class exposing a
+ * `create(Injector): CredentialStore` method). This factory loads that
+ * class through the injector and delegates to it. When the key is empty,
+ * names a missing class, or the delegate cannot produce a store, it falls
+ * back to {@see NullCredentialStore} — warning first when a non-empty FQCN
+ * was configured but could not be used, so misconfiguration is visible.
+ */
 class CredentialStoreFactory
 {
-    public function create(Horde_Injector $injector): CredentialStore
+    public function create(Horde_Injector|Injector $injector): CredentialStore
+    {
+        $hordeConfig = $injector->get(ConfigLoader::class)->load('horde');
+        $factoryClass = (string) $hordeConfig->get(
+            'password_credentials.storage_factory',
+            '',
+        );
+
+        // Empty or explicitly disabled: No store and no warning.
+        if ($factoryClass === '' || strtolower($factoryClass) === 'null') {
+            return new NullCredentialStore();
+        }
+
+        // Guard against a config value that causes recursive recursion on this factory.
+        if (ltrim($factoryClass, '\\') === self::class) {
+            $this->logger($injector)->warning(sprintf(
+                'Config Issue: password_credentials.storage_factory points at the Core '
+                . 'resolver itself (%s). Falling back to NullCredentialStore.',
+                $factoryClass,
+            ));
+            return new NullCredentialStore();
+        }
+
+        if (!class_exists($factoryClass)) {
+            $this->logger($injector)->warning(sprintf(
+                'Config Issue: Configured password credential store factory "%s" does not '
+                . 'exist. Falling back to NullCredentialStore.',
+                $factoryClass,
+            ));
+            return new NullCredentialStore();
+        }
+
+        try {
+            $factory = $injector->get($factoryClass);
+            $store = $factory->create($injector);
+        } catch (Throwable $e) {
+            print_r($e);
+            exit;
+            $this->logger($injector)->warning(sprintf(
+                'Config Issue: Password credential store factory "%s" failed to produce a '
+                . 'store (%s). Falling back to NullCredentialStore.',
+                $factoryClass,
+                $e->getMessage(),
+            ));
+            return new NullCredentialStore();
+        }
+
+        if (!$store instanceof CredentialStore) {
+            $this->logger($injector)->warning(sprintf(
+                'Config Issue: Password credential store factory "%s" returned %s, not a '
+                . 'CredentialStore. Falling back to NullCredentialStore.',
+                $factoryClass,
+                get_debug_type($store),
+            ));
+            return new NullCredentialStore();
+        }
+
+        return $store;
+    }
+
+    private function logger(Horde_Injector|Injector $injector): LoggerInterface
     {
-        return new NullCredentialStore();
+        try {
+            return $injector->get(LoggerInterface::class);
+        } catch (Throwable) {
+            return new NullLogger();
+        }
     }
 }
diff --git a/src/Service/Factory/PasswordServiceAuthorizationServiceFactory.php b/src/Service/Factory/PasswordServiceAuthorizationServiceFactory.php
index 3432359b..b40c6544 100644
--- a/src/Service/Factory/PasswordServiceAuthorizationServiceFactory.php
+++ b/src/Service/Factory/PasswordServiceAuthorizationServiceFactory.php
@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Factory for PasswordServiceAuthorizationService.
  *
@@ -11,11 +12,12 @@
 
 use Horde\Core\Service\NullPasswordServiceAuthorizationService;
 use Horde\Core\Service\PasswordServiceAuthorizationService;
+use Horde\Injector\Injector;
 use Horde_Injector;
 
 class PasswordServiceAuthorizationServiceFactory
 {
-    public function create(Horde_Injector $injector): PasswordServiceAuthorizationService
+    public function create(Horde_Injector|Injector $injector): PasswordServiceAuthorizationService
     {
         return new NullPasswordServiceAuthorizationService();
     }
diff --git a/src/Service/Factory/ServiceCredentialManagerFactory.php b/src/Service/Factory/ServiceCredentialManagerFactory.php
index d28e5bc9..cbd7cdf7 100644
--- a/src/Service/Factory/ServiceCredentialManagerFactory.php
+++ b/src/Service/Factory/ServiceCredentialManagerFactory.php
@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Factory for ServiceCredentialManager.
  *
@@ -11,11 +12,12 @@
 
 use Horde\Core\Service\NullServiceCredentialManager;
 use Horde\Core\Service\ServiceCredentialManager;
+use Horde\Injector\Injector;
 use Horde_Injector;
 
 class ServiceCredentialManagerFactory
 {
-    public function create(Horde_Injector $injector): ServiceCredentialManager
+    public function create(Horde_Injector|Injector $injector): ServiceCredentialManager
     {
         return new NullServiceCredentialManager();
     }
diff --git a/src/Service/NullCredentialProvisioningStrategy.php b/src/Service/NullCredentialProvisioningStrategy.php
index 8f518d26..b53cd73a 100644
--- a/src/Service/NullCredentialProvisioningStrategy.php
+++ b/src/Service/NullCredentialProvisioningStrategy.php
@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Null implementation of CredentialProvisioningStrategy.
  *
diff --git a/src/Service/NullCredentialStore.php b/src/Service/NullCredentialStore.php
index 09deab2a..91612af3 100644
--- a/src/Service/NullCredentialStore.php
+++ b/src/Service/NullCredentialStore.php
@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Null implementation of CredentialStore.
  *
@@ -12,6 +13,8 @@
 
 namespace Horde\Core\Service;
 
+use RuntimeException;
+
 final class NullCredentialStore implements CredentialStore
 {
     public function find(
@@ -40,14 +43,14 @@ public function store(
         ServicePurpose $purpose,
         array|string $credential
     ): PasswordCredential {
-        throw new \RuntimeException('Password credential storage not available');
+        throw new RuntimeException('Password credential storage not available');
     }
 
     public function update(
         string $credentialId,
         array|string $credential
     ): PasswordCredential {
-        throw new \RuntimeException('Password credential storage not available');
+        throw new RuntimeException('Password credential storage not available');
     }
 
     public function delete(string $credentialId): void
diff --git a/src/Service/NullPasswordServiceAuthorizationService.php b/src/Service/NullPasswordServiceAuthorizationService.php
index 21a8ca57..da221b05 100644
--- a/src/Service/NullPasswordServiceAuthorizationService.php
+++ b/src/Service/NullPasswordServiceAuthorizationService.php
@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Null implementation of PasswordServiceAuthorizationService.
  *
@@ -12,6 +13,8 @@
 
 namespace Horde\Core\Service;
 
+use RuntimeException;
+
 final class NullPasswordServiceAuthorizationService implements PasswordServiceAuthorizationService
 {
     public function get(
@@ -36,14 +39,14 @@ public function store(
         ServicePurpose $purpose,
         array|string $credential
     ): PasswordCredential {
-        throw new \RuntimeException('Password credential service not available');
+        throw new RuntimeException('Password credential service not available');
     }
 
     public function update(
         string $credentialId,
         array|string $credential
     ): PasswordCredential {
-        throw new \RuntimeException('Password credential service not available');
+        throw new RuntimeException('Password credential service not available');
     }
 
     public function revoke(
diff --git a/src/Service/NullServiceAuthorizationService.php b/src/Service/NullServiceAuthorizationService.php
index 674ee08b..4dc7ea17 100644
--- a/src/Service/NullServiceAuthorizationService.php
+++ b/src/Service/NullServiceAuthorizationService.php
@@ -7,6 +7,7 @@
 use Horde\OAuth\Client\OAuthFlowData;
 use Horde\OAuth\Client\ScopeSet;
 use Psr\Http\Message\UriInterface;
+use RuntimeException;
 
 /** Null ServiceAuthorizationService - safe default when service authorization is not configured. */
 class NullServiceAuthorizationService implements ServiceAuthorizationService
@@ -36,7 +37,7 @@ public function initiate(
 
     public function handleCallback(string $code, OAuthFlowData $flowData): ServiceAuthorization
     {
-        throw new \RuntimeException('Service authorization not configured');
+        throw new RuntimeException('Service authorization not configured');
     }
 
     public function revoke(
diff --git a/src/Service/NullServiceCredentialManager.php b/src/Service/NullServiceCredentialManager.php
index 4515e117..52930835 100644
--- a/src/Service/NullServiceCredentialManager.php
+++ b/src/Service/NullServiceCredentialManager.php
@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Null implementation of ServiceCredentialManager.
  *
@@ -12,6 +13,8 @@
 
 namespace Horde\Core\Service;
 
+use RuntimeException;
+
 final class NullServiceCredentialManager implements ServiceCredentialManager
 {
     public function get(
@@ -19,7 +22,7 @@ public function get(
         string $providerId,
         ServicePurpose $purpose
     ): ServiceCredentialResult {
-        throw new \RuntimeException('Service credential manager not available');
+        throw new RuntimeException('Service credential manager not available');
     }
 
     public function initiate(
diff --git a/src/Service/PasswordCredential.php b/src/Service/PasswordCredential.php
index 7066da02..20b4b1d8 100644
--- a/src/Service/PasswordCredential.php
+++ b/src/Service/PasswordCredential.php
@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Password-based credential value object.
  *
diff --git a/src/Service/PasswordCredentialNotFoundException.php b/src/Service/PasswordCredentialNotFoundException.php
index d06d64f0..30fcd5a3 100644
--- a/src/Service/PasswordCredentialNotFoundException.php
+++ b/src/Service/PasswordCredentialNotFoundException.php
@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Exception thrown when password credential is not found.
  *
@@ -9,7 +10,10 @@
 
 namespace Horde\Core\Service;
 
-class PasswordCredentialNotFoundException extends \RuntimeException
+use RuntimeException;
+use Throwable;
+
+class PasswordCredentialNotFoundException extends RuntimeException
 {
     public function __construct(
         private readonly string $userId,
@@ -17,7 +21,7 @@ public function __construct(
         private readonly ServicePurpose $purpose,
         string $message = '',
         int $code = 0,
-        ?\Throwable $previous = null
+        ?Throwable $previous = null
     ) {
         if ($message === '') {
             $message = sprintf(
diff --git a/src/Service/PasswordServiceAuthorizationService.php b/src/Service/PasswordServiceAuthorizationService.php
index be18accf..4a2d7417 100644
--- a/src/Service/PasswordServiceAuthorizationService.php
+++ b/src/Service/PasswordServiceAuthorizationService.php
@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Service interface for password-based authorization.
  *
diff --git a/src/Service/ProvisioningAction.php b/src/Service/ProvisioningAction.php
index 6ddb6bda..c1913403 100644
--- a/src/Service/ProvisioningAction.php
+++ b/src/Service/ProvisioningAction.php
@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Actions that can result from provisioning attempt.
  *
diff --git a/src/Service/ProvisioningResult.php b/src/Service/ProvisioningResult.php
index f8f45d35..068ed01d 100644
--- a/src/Service/ProvisioningResult.php
+++ b/src/Service/ProvisioningResult.php
@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Result of credential provisioning attempt.
  *
diff --git a/src/Service/ServiceAuthorization.php b/src/Service/ServiceAuthorization.php
index b4984609..a6f6a441 100644
--- a/src/Service/ServiceAuthorization.php
+++ b/src/Service/ServiceAuthorization.php
@@ -1,7 +1,9 @@
 <?php
+
 declare(strict_types=1);
 
 namespace Horde\Core\Service;
+
 /**
  * Revocation is performed through `ServiceAuthorizationService` rather than through this object.
  * This avoids the object holding a self-reference to its repository.
diff --git a/src/Service/ServiceAuthorizationRepository.php b/src/Service/ServiceAuthorizationRepository.php
index 4f3f943a..04eef676 100644
--- a/src/Service/ServiceAuthorizationRepository.php
+++ b/src/Service/ServiceAuthorizationRepository.php
@@ -1,4 +1,5 @@
 <?php
+
 declare(strict_types=1);
 
 namespace Horde\Core\Service;
diff --git a/src/Service/ServiceAuthorizationService.php b/src/Service/ServiceAuthorizationService.php
index bb300c77..7a33e0e2 100644
--- a/src/Service/ServiceAuthorizationService.php
+++ b/src/Service/ServiceAuthorizationService.php
@@ -1,4 +1,5 @@
 <?php
+
 declare(strict_types=1);
 
 namespace Horde\Core\Service;
diff --git a/src/Service/ServiceCredentialManager.php b/src/Service/ServiceCredentialManager.php
index 43af23ef..b70dc163 100644
--- a/src/Service/ServiceCredentialManager.php
+++ b/src/Service/ServiceCredentialManager.php
@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Unified credential manager (Entry Point B).
  *
diff --git a/src/Service/ServiceCredentialResult.php b/src/Service/ServiceCredentialResult.php
index c113bfef..99a319d6 100644
--- a/src/Service/ServiceCredentialResult.php
+++ b/src/Service/ServiceCredentialResult.php
@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Result of unified credential retrieval.
  *
diff --git a/src/Service/ServiceNotAuthorizedException.php b/src/Service/ServiceNotAuthorizedException.php
index c4ad3a69..9ce651ae 100644
--- a/src/Service/ServiceNotAuthorizedException.php
+++ b/src/Service/ServiceNotAuthorizedException.php
@@ -5,8 +5,10 @@
 namespace Horde\Core\Service;
 
 use Horde\OAuth\Client\ScopeSet;
+use RuntimeException;
+use Throwable;
 
-final class ServiceNotAuthorizedException extends \RuntimeException
+final class ServiceNotAuthorizedException extends RuntimeException
 {
     public function __construct(
         private readonly string $userId,
@@ -15,7 +17,7 @@ public function __construct(
         private readonly ScopeSet $missingScopes,
         string $message = '',
         int $code = 0,
-        ?\Throwable $previous = null
+        ?Throwable $previous = null
     ) {
         if ($message === '') {
             $message = sprintf(
diff --git a/src/Service/ServicePurpose.php b/src/Service/ServicePurpose.php
index 006aa196..0524dc3c 100644
--- a/src/Service/ServicePurpose.php
+++ b/src/Service/ServicePurpose.php
@@ -1,4 +1,5 @@
 <?php
+
 declare(strict_types=1);
 
 namespace Horde\Core\Service;
diff --git a/src/Service/TokenGrant.php b/src/Service/TokenGrant.php
index 3d1558fe..04d8bf9a 100644
--- a/src/Service/TokenGrant.php
+++ b/src/Service/TokenGrant.php
@@ -1,4 +1,5 @@
 <?php
+
 declare(strict_types=1);
 
 namespace Horde\Core\Service;
diff --git a/src/Service/TokenGrantRepository.php b/src/Service/TokenGrantRepository.php
index 26b01525..0c2bd6b8 100644
--- a/src/Service/TokenGrantRepository.php
+++ b/src/Service/TokenGrantRepository.php
@@ -1,4 +1,5 @@
 <?php
+
 declare(strict_types=1);
 
 namespace Horde\Core\Service;
diff --git a/src/Service/UnsupportedPurposeException.php b/src/Service/UnsupportedPurposeException.php
index 091be953..3446c128 100644
--- a/src/Service/UnsupportedPurposeException.php
+++ b/src/Service/UnsupportedPurposeException.php
@@ -4,14 +4,17 @@
 
 namespace Horde\Core\Service;
 
-final class UnsupportedPurposeException extends \RuntimeException
+use RuntimeException;
+use Throwable;
+
+final class UnsupportedPurposeException extends RuntimeException
 {
     public function __construct(
         private readonly string $providerId,
         private readonly ServicePurpose $purpose,
         string $message = '',
         int $code = 0,
-        ?\Throwable $previous = null
+        ?Throwable $previous = null
     ) {
         if ($message === '') {
             $message = sprintf(