diff --git a/src/importers/debezium_cdc_importer.cpp b/src/importers/debezium_cdc_importer.cpp
index a63c75ab8e..7c70fce42c 100644
--- a/src/importers/debezium_cdc_importer.cpp
+++ b/src/importers/debezium_cdc_importer.cpp
@@ -267,6 +267,7 @@ ImportStats DebeziumCDCImporter::importData(
 ImportStats DebeziumCDCImporter::streamEvents(const ImportOptions& options,
                                                CDCEventCallback callback) {
     ImportStats stats{};
+    const auto start_time = std::chrono::steady_clock::now();
 
     const auto deadline = (options.deadline_ms > 0)
         ? std::optional<std::chrono::steady_clock::time_point>(
diff --git a/src/storage/nvme_manager.cpp b/src/storage/nvme_manager.cpp
index 146db751ee..a8df186356 100644
--- a/src/storage/nvme_manager.cpp
+++ b/src/storage/nvme_manager.cpp
@@ -520,6 +520,12 @@ bool NVMeManager::resetZone(uint64_t zone_offset) {
     if (!config_.enable_zns || config_.device_path.empty()) {
         return false;
     }
+    constexpr uint64_t SECTOR_SIZE = 512;
+    if (config_.zone_capacity_bytes == 0 || (zone_offset % SECTOR_SIZE) != 0) {
+        THEMIS_WARN("NVMeManager::resetZone: invalid zone offset={} or capacity={}",
+                    zone_offset, config_.zone_capacity_bytes);
+        return false;
+    }
     std::lock_guard<std::mutex> lock(zone_mutex_);
 #ifdef __linux__
     int fd = ::open(config_.device_path.c_str(), O_RDWR | O_CLOEXEC);
@@ -528,8 +534,6 @@ bool NVMeManager::resetZone(uint64_t zone_offset) {
                      config_.device_path, std::strerror(errno));
         return false;
     }
-    // Sector size is 512 bytes on most ZNS drives
-    constexpr uint64_t SECTOR_SIZE = 512;
     struct blk_zone_range range{};
     range.sector     = zone_offset / SECTOR_SIZE;
     range.nr_sectors = config_.zone_capacity_bytes / SECTOR_SIZE;
@@ -549,6 +553,12 @@ bool NVMeManager::finishZone(uint64_t zone_offset) {
     if (!config_.enable_zns || config_.device_path.empty()) {
         return false;
     }
+    constexpr uint64_t SECTOR_SIZE = 512;
+    if (config_.zone_capacity_bytes == 0 || (zone_offset % SECTOR_SIZE) != 0) {
+        THEMIS_WARN("NVMeManager::finishZone: invalid zone offset={} or capacity={}",
+                    zone_offset, config_.zone_capacity_bytes);
+        return false;
+    }
     std::lock_guard<std::mutex> lock(zone_mutex_);
 #ifdef __linux__
     int fd = ::open(config_.device_path.c_str(), O_RDWR | O_CLOEXEC);
@@ -557,7 +567,6 @@ bool NVMeManager::finishZone(uint64_t zone_offset) {
                      config_.device_path, std::strerror(errno));
         return false;
     }
-    constexpr uint64_t SECTOR_SIZE = 512;
     struct blk_zone_range range{};
     range.sector     = zone_offset / SECTOR_SIZE;
     range.nr_sectors = config_.zone_capacity_bytes / SECTOR_SIZE;
@@ -577,9 +586,12 @@ uint64_t NVMeManager::getZoneWritePointer(uint64_t zone_offset) const {
     if (!config_.enable_zns || config_.device_path.empty()) {
         return UINT64_MAX;
     }
+    constexpr uint64_t SECTOR_SIZE = 512;
+    if (config_.zone_capacity_bytes == 0 || (zone_offset % SECTOR_SIZE) != 0) {
+        return UINT64_MAX;
+    }
     std::lock_guard<std::mutex> lock(zone_mutex_);
 #ifdef __linux__
-    constexpr uint64_t SECTOR_SIZE = 512;
     int fd = ::open(config_.device_path.c_str(), O_RDONLY | O_CLOEXEC);
     if (fd < 0) {
         return UINT64_MAX;
diff --git a/tests/test_nvme_manager.cpp b/tests/test_nvme_manager.cpp
index 60edbd58fe..f23a1683c9 100644
--- a/tests/test_nvme_manager.cpp
+++ b/tests/test_nvme_manager.cpp
@@ -19,6 +19,7 @@
 #include <filesystem>
 #include <fstream>
 #include <cstring>
+#include <limits>
 #include <string>
 #include <thread>
 
@@ -185,6 +186,20 @@ TEST_F(NVMeBackgroundThreadsTest, AtMostSixteen) {
     EXPECT_LE(mgr.recommendedBackgroundThreads(), 16u);
 }
 
+class NVMeZoneValidationTest : public ::testing::Test {};
+
+TEST_F(NVMeZoneValidationTest, RejectsMisalignedZoneOffsets) {
+    NVMeConfig cfg;
+    cfg.enable_zns = true;
+    cfg.device_path = "/dev/nvme0n1";
+    cfg.zone_capacity_bytes = 512u * 1024u;
+
+    NVMeManager mgr(cfg);
+    EXPECT_FALSE(mgr.resetZone(7));
+    EXPECT_FALSE(mgr.finishZone(511));
+    EXPECT_EQ(mgr.getZoneWritePointer(13), std::numeric_limits<uint64_t>::max());
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // NVMeIoUringTest – io_uring disabled → isIoUringActive() == false
 // ─────────────────────────────────────────────────────────────────────────────
diff --git a/vcpkg b/vcpkg
index c5a15727ee..30ef65cad9 160000
--- a/vcpkg
+++ b/vcpkg
@@ -1 +1 @@
-Subproject commit c5a15727ee70fddf0296f0d8aafc3f58916fefac
+Subproject commit 30ef65cad98f08e7197c9a1656fbd871bcb72f2d