Merge branch 'develop' into release/1.19.0

2026-05-16 09:41:27 +00:00 · 2026-02-18 16:25:04 +01:00
parent ad240eb18b 423752e720
commit 00a61bb187
167 changed files with 2838 additions and 617 deletions
--- a/.github/actions/win-sign-action/action.yml
+++ b/.github/actions/win-sign-action/action.yml
@@ -48,7 +48,7 @@ runs:
        echo "client-secret=${{ inputs.client-secret }}" >> "$GITHUB_OUTPUT"
      shell: bash
    - name: Sign DLLs with Azure Trusted Signing
-      uses: azure/trusted-signing-action@fc390cf8ed0f14e248a542af1d838388a47c7a7c # v0.5.10
+      uses: azure/artifact-signing-action@87c2e83e6868da99d3380aa309851b32ed9a8346 # v1.1.0
      with:
        files-folder: ${{ inputs.base-dir }}
        files-folder-filter: ${{ inputs.file-extensions }}
@@ -59,7 +59,7 @@ runs:
        azure-tenant-id: ${{ steps.set-secrets.outputs.tenant-id }}
        azure-client-id: ${{ steps.set-secrets.outputs.client-id }}
        azure-client-secret: ${{ steps.set-secrets.outputs.client-secret }}
-        trusted-signing-account-name: cryptomatorSigning
+        signing-account-name: cryptomatorSigning
        certificate-profile-name: production
        endpoint: https://weu.codesigning.azure.net/
        timestamp-rfc3161: http://timestamp.acs.microsoft.com
--- a/.github/workflows/appimage.yml
+++ b/.github/workflows/appimage.yml
@@ -19,7 +19,7 @@ on:

 env:
  JAVA_DIST: 'temurin'
-  JAVA_VERSION: '25.0.1+8.0.LTS'
+  JAVA_VERSION: '25.0.2+10.0.LTS'

 jobs:
  get-version:
@@ -37,16 +37,16 @@ jobs:
        include:
          - os: ubuntu-latest
            appimage-suffix: x86_64
-            openjfx-url: 'https://download2.gluonhq.com/openjfx/25/openjfx-25_linux-x64_bin-jmods.zip'
-            openjfx-sha: '96e520f48610d8ffb94ca30face1f11ffe8a977ddc1c4ff80b1a9e9f048bd94e'
+            openjfx-url: 'https://download2.gluonhq.com/openjfx/25.0.2/openjfx-25.0.2_linux-x64_bin-jmods.zip'
+            openjfx-sha: 'e0a9c29d8cf3af9b8b48848b43f87b5785bc107c53a951b19668ce05842bba1b'
          - os: ubuntu-24.04-arm
            appimage-suffix: aarch64
-            openjfx-url: 'https://download2.gluonhq.com/openjfx/25/openjfx-25_linux-aarch64_bin-jmods.zip'
-            openjfx-sha: '9ad4ca7b769ca4ee6419f1e99143dd6ff812f8be4fddb46a7d7cacbeea148af4'
+            openjfx-url: 'https://download2.gluonhq.com/openjfx/25.0.2/openjfx-25.0.2_linux-aarch64_bin-jmods.zip'
+            openjfx-sha: 'c3408f818693cce09e59829a8e862a82c7695fdfcd585c41cfd527f5fc3fe646'
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Setup Java
-        uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: ${{ env.JAVA_DIST }}
          java-version: ${{ env.JAVA_VERSION }}
@@ -122,8 +122,8 @@ jobs:
          --java-options "-Dcryptomator.appVersion=\"${{  needs.get-version.outputs.semVerStr }}\""
          --java-options "-Dfile.encoding=\"utf-8\""
          --java-options "-Djava.net.useSystemProxies=true"
+          --java-options "-Dcryptomator.adminConfigPath=\"/etc/cryptomator/config.properties\""
          --java-options "-Dcryptomator.logDir=\"@{userhome}/.local/share/Cryptomator/logs\""
-          --java-options "-Dcryptomator.pluginDir=\"@{userhome}/.local/share/Cryptomator/plugins\""
          --java-options "-Dcryptomator.settingsPath=\"@{userhome}/.config/Cryptomator/settings.json:@{userhome}/.Cryptomator/settings.json\""
          --java-options "-Dcryptomator.p12Path=\"@{userhome}/.config/Cryptomator/key.p12\""
          --java-options "-Dcryptomator.ipcSocketPath=\"@{userhome}/.config/Cryptomator/ipc.socket\""
@@ -175,7 +175,7 @@ jobs:
          gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --detach-sign -a cryptomator-*.AppImage
          gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --detach-sign -a cryptomator-*.AppImage.zsync
      - name: Upload artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: appimage-${{ matrix.appimage-suffix }}
          path: |
@@ -201,7 +201,7 @@ jobs:
    if: github.event_name == 'release' && needs.get-version.outputs.versionType == 'stable'
    steps:
      - name: Download AppImages
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          path: downloads/
          merge-multiple: true
@@ -212,7 +212,7 @@ jobs:
          echo "x64-sha256sum=${X64_SHA256}" >> "$GITHUB_OUTPUT"
          AARCH64_SHA256=$(sha256sum downloads/cryptomator-*-aarch64.AppImage | cut -d ' ' -f1)
          echo "aarch64-sha256sum=${AARCH64_SHA256}" >> "$GITHUB_OUTPUT"
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: 'cryptomator/aur-bin'
          token: ${{ secrets.CRYPTOBOT_PR_TOKEN }}
--- a/.github/workflows/aur.yml
+++ b/.github/workflows/aur.yml
@@ -48,7 +48,7 @@ jobs:
    env:
      AUR_PR_URL: tbd
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: 'cryptomator/aur'
          token: ${{ secrets.CRYPTOBOT_PR_TOKEN }}
--- a/.github/workflows/av-whitelist.yml
+++ b/.github/workflows/av-whitelist.yml
@@ -51,7 +51,7 @@ jobs:
      - name: Download file
        run: curl "${INPUT_URL}" -L -o "${{steps.extractName.outputs.fileName}}" --fail-with-body
      - name: Upload artifact
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: ${{ steps.extractName.outputs.fileName }}
          path: ${{ steps.extractName.outputs.fileName }}
@@ -63,7 +63,7 @@ jobs:
    if: inputs.kaspersky
    steps:
      - name: Download artifact
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          name: ${{ needs.download-file.outputs.fileName }}
          path: upload
@@ -83,7 +83,7 @@ jobs:
    if: inputs.avast
    steps:
      - name: Download artifact
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          name: ${{ needs.download-file.outputs.fileName }}
          path: upload
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -22,14 +22,14 @@ jobs:
    name: Compile and Test
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-      - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: ${{ env.JAVA_DIST }}
          java-version: ${{ env.JAVA_VERSION }}
          cache: 'maven'
      - name: Cache SonarCloud packages
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
--- a/.github/workflows/check-jdk-updates.yml
+++ b/.github/workflows/check-jdk-updates.yml
@@ -26,7 +26,7 @@ jobs:
        run: echo 'JDK_MAJOR_VERSION=${{ env.JDK_VERSION }}'.substring(0,2) >> "$env:GITHUB_ENV"
        shell: pwsh
      - name: Checkout latest JDK ${{ env.JDK_MAJOR_VERSION }}
-        uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: ${{ env.JDK_MAJOR_VERSION}}
          distribution: ${{ env.JDK_VENDOR }}
--- a/.github/workflows/debian.yml
+++ b/.github/workflows/debian.yml
@@ -23,12 +23,12 @@ on:

 env:
  JAVA_DIST: 'temurin'
-  JAVA_VERSION: '25.0.1+8.0.LTS'
+  JAVA_VERSION: '25.0.2+10.0.LTS'
  DEB_BUILD_DEPENDS: 'debhelper (>=10), openjdk-25-jdk (>= 25+36), libgtk-3-0 (>= 3.20.0), libxxf86vm1, libgl1'
-  OPENJFX_JMODS_AMD64: 'https://download2.gluonhq.com/openjfx/25/openjfx-25_linux-x64_bin-jmods.zip'
-  OPENJFX_JMODS_AMD64_HASH: '96e520f48610d8ffb94ca30face1f11ffe8a977ddc1c4ff80b1a9e9f048bd94e'
-  OPENJFX_JMODS_AARCH64: 'https://download2.gluonhq.com/openjfx/25/openjfx-25_linux-aarch64_bin-jmods.zip'
-  OPENJFX_JMODS_AARCH64_HASH: '9ad4ca7b769ca4ee6419f1e99143dd6ff812f8be4fddb46a7d7cacbeea148af4'
+  OPENJFX_JMODS_AMD64: 'https://download2.gluonhq.com/openjfx/25.0.2/openjfx-25.0.2_linux-x64_bin-jmods.zip'
+  OPENJFX_JMODS_AMD64_HASH: 'e0a9c29d8cf3af9b8b48848b43f87b5785bc107c53a951b19668ce05842bba1b'
+  OPENJFX_JMODS_AARCH64: 'https://download2.gluonhq.com/openjfx/25.0.2/openjfx-25.0.2_linux-aarch64_bin-jmods.zip'
+  OPENJFX_JMODS_AARCH64_HASH: 'c3408f818693cce09e59829a8e862a82c7695fdfcd585c41cfd527f5fc3fe646'

 jobs:
  get-version:
@@ -43,7 +43,7 @@ jobs:
    env:
      INPUT_PPAVER: ${{ inputs.ppaver }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - id: deb-version
        name: Determine deb-version
        run: |
@@ -60,7 +60,7 @@ jobs:
        env:
          DEB_BUILD_DEPENDS: ${{ env.DEB_BUILD_DEPENDS }}
      - name: Setup Java
-        uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: ${{ env.JAVA_DIST }}
          java-version: ${{ env.JAVA_VERSION }}
@@ -143,7 +143,7 @@ jobs:
        run: |
          gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --detach-sign -a cryptomator_*_amd64.deb
      - name: Upload artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: linux-deb-package
          path: |
--- a/.github/workflows/dependency-check.yml
+++ b/.github/workflows/dependency-check.yml
@@ -7,7 +7,7 @@ on:

 jobs:
  check-dependencies:
-    uses: skymatic/workflows/.github/workflows/run-dependency-check.yml@1074588008ae3326a2221ea451783280518f0366 # v3.0.1
+    uses: skymatic/workflows/.github/workflows/run-dependency-check.yml@957d3c2c08c56855fdac41e5afb9a7aca8c30dd9 # v3.0.3
    with:
      runner-os: 'ubuntu-latest'
      java-distribution: 'temurin'
@@ -16,4 +16,4 @@ jobs:
      nvd-api-key: ${{ secrets.NVD_API_KEY }}
      ossindex-username: ${{ secrets.OSSINDEX_USERNAME }}
      ossindex-token: ${{ secrets.OSSINDEX_API_TOKEN }}
-      slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
+      slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_CRYPTOMATOR_DESKTOP }}
--- a/.github/workflows/dl-stats.yml
+++ b/.github/workflows/dl-stats.yml
@@ -53,7 +53,7 @@ jobs:
          INTERVAL: 900
          JSON_DATA: ${{ steps.get-stats.outputs.result }}
      - name: Upload Results
-        uses: fjogeleit/http-request-action@c0b95d02a088b47c1f2f4db04fd8af8bd19eee54 # v1.16.6
+        uses: fjogeleit/http-request-action@551353b829c3646756b2ec2b3694f819d7957495 # v2.0.0
        with:
          url: 'https://graphite-us-central1.grafana.net/metrics'
          method: 'POST'
--- a/.github/workflows/flathub.yml
+++ b/.github/workflows/flathub.yml
@@ -43,7 +43,7 @@ jobs:
    env:
      FLATHUB_PR_URL: tbd
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: 'flathub/org.cryptomator.Cryptomator'
          token: ${{ secrets.CRYPTOBOT_PR_TOKEN }}
--- a/.github/workflows/get-version.yml
+++ b/.github/workflows/get-version.yml
@@ -35,11 +35,11 @@ jobs:
      revNum: ${{ steps.versions.outputs.revNum }}
      type: ${{ steps.versions.outputs.type}}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
      - name: Setup Java
-        uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: ${{ env.JAVA_DIST }}
          java-version: ${{ env.JAVA_VERSION }}
--- a/.github/workflows/mac-dmg-x64.yml
+++ b/.github/workflows/mac-dmg-x64.yml
@@ -24,7 +24,7 @@ on:

 env:
  JAVA_DIST: 'temurin'
-  JAVA_VERSION: '25.0.1+8.0.LTS'
+  JAVA_VERSION: '25.0.2+10.0.LTS'

 jobs:
  get-version:
@@ -44,12 +44,12 @@ jobs:
          architecture: x64
          output-suffix: x64
          fuse-lib: macFUSE
-          openjfx-url: 'https://download2.gluonhq.com/openjfx/25/openjfx-25_osx-x64_bin-jmods.zip'
-          openjfx-sha: '0eba73fb28a24c845175d16fa2f8c081c936ce6de1be9b79eb6119fa32e53d52'
+          openjfx-url: 'https://download2.gluonhq.com/openjfx/25.0.2/openjfx-25.0.2_osx-x64_bin-jmods.zip'
+          openjfx-sha: '0b4d8463f03901b7425d94628e4116b7078abb8dd540fbec415266fac20bda5c'
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Setup Java
-        uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: ${{ env.JAVA_DIST }}
          java-version: ${{ env.JAVA_VERSION }}
@@ -128,8 +128,8 @@ jobs:
          --java-options "-Dapple.awt.enableTemplateImages=true"
          --java-options "-Dsun.java2d.metal=true"
          --java-options "-Dcryptomator.appVersion=\"${{ needs.get-version.outputs.semVerStr }}\""
+          --java-options "-Dcryptomator.adminConfigPath=\"/Library/Application Support/Cryptomator/config.properties\""
          --java-options "-Dcryptomator.logDir=\"@{userhome}/Library/Logs/Cryptomator\""
-          --java-options "-Dcryptomator.pluginDir=\"@{userhome}/Library/Application Support/Cryptomator/Plugins\""
          --java-options "-Dcryptomator.settingsPath=\"@{userhome}/Library/Application Support/Cryptomator/settings.json\""
          --java-options "-Dcryptomator.p12Path=\"@{userhome}/Library/Application Support/Cryptomator/key.p12\""
          --java-options "-Dcryptomator.ipcSocketPath=\"@{userhome}/Library/Application Support/Cryptomator/ipc.socket\""
@@ -283,7 +283,7 @@ jobs:
        run: security delete-keychain $RUNNER_TEMP/codesign.keychain-db
        continue-on-error: true
      - name: Upload artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: dmg-${{ matrix.output-suffix }}
          path: |
--- a/.github/workflows/mac-dmg.yml
+++ b/.github/workflows/mac-dmg.yml
@@ -22,7 +22,7 @@ on:

 env:
  JAVA_DIST: 'temurin'
-  JAVA_VERSION: '25.0.1+8.0.LTS'
+  JAVA_VERSION: '25.0.2+10.0.LTS'

 jobs:
  get-version:
@@ -42,12 +42,12 @@ jobs:
          architecture: aarch64
          output-suffix: arm64
          fuse-lib: FUSE-T
-          openjfx-url: 'https://download2.gluonhq.com/openjfx/25/openjfx-25_osx-aarch64_bin-jmods.zip'
-          openjfx-sha: '13f8c0513c40c95881479fbcf0465a29a60217393fb0656f5e4eab78a9442fba'
+          openjfx-url: 'https://download2.gluonhq.com/openjfx/25.0.2/openjfx-25.0.2_osx-aarch64_bin-jmods.zip'
+          openjfx-sha: '4cd258001c75af7047005c5c891e2400ed11d24fbb09412324c0cbaf8b503c5a'
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Setup Java
-        uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: ${{ env.JAVA_DIST }}
          java-version: ${{ env.JAVA_VERSION }}
@@ -126,8 +126,8 @@ jobs:
          --java-options "-Dapple.awt.enableTemplateImages=true"
          --java-options "-Dsun.java2d.metal=true"
          --java-options "-Dcryptomator.appVersion=\"${{ needs.get-version.outputs.semVerStr }}\""
+          --java-options "-Dcryptomator.adminConfigPath=\"/Library/Application Support/Cryptomator/config.properties\""
          --java-options "-Dcryptomator.logDir=\"@{userhome}/Library/Logs/Cryptomator\""
-          --java-options "-Dcryptomator.pluginDir=\"@{userhome}/Library/Application Support/Cryptomator/Plugins\""
          --java-options "-Dcryptomator.settingsPath=\"@{userhome}/Library/Application Support/Cryptomator/settings.json\""
          --java-options "-Dcryptomator.p12Path=\"@{userhome}/Library/Application Support/Cryptomator/key.p12\""
          --java-options "-Dcryptomator.ipcSocketPath=\"@{userhome}/Library/Application Support/Cryptomator/ipc.socket\""
@@ -282,7 +282,7 @@ jobs:
        run: security delete-keychain $RUNNER_TEMP/codesign.keychain-db
        continue-on-error: true
      - name: Upload artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: dmg-${{ matrix.output-suffix }}
          path: |
--- a/.github/workflows/pullrequest.yml
+++ b/.github/workflows/pullrequest.yml
@@ -16,8 +16,8 @@ jobs:
    name: Compile and Test
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-      - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: ${{ env.JAVA_DIST }}
          java-version: ${{ env.JAVA_VERSION }}
--- a/.github/workflows/release-check.yml
+++ b/.github/workflows/release-check.yml
@@ -19,9 +19,9 @@ jobs:
    name: Validate commits pushed to release/hotfix branch to fulfill release requirements
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Setup Java
-        uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: ${{ env.JAVA_DIST }}
          java-version: ${{ env.JAVA_VERSION }}
@@ -49,7 +49,7 @@ jobs:
            exit 1
          fi
      - name: Cache NVD DB
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        with:
          path: ~/.m2/repository/org/owasp/dependency-check-data/
          key: dependency-check-${{ github.run_id }}
--- a/.github/workflows/win-exe.yml
+++ b/.github/workflows/win-exe.yml
@@ -22,11 +22,12 @@ on:


 env:
-  OPENJFX_JMODS_AMD64: 'https://download2.gluonhq.com/openjfx/25/openjfx-25_windows-x64_bin-jmods.zip'
-  OPENJFX_JMODS_AMD64_HASH: 'c8eb9fd039b00e0020cf6c3db8ed7876bf3ee4d27860aa697a247b83b8296ae7'
+  OPENJFX_JMODS_AMD64: 'https://download2.gluonhq.com/openjfx/25.0.2/openjfx-25.0.2_windows-x64_bin-jmods.zip'
+  OPENJFX_JMODS_AMD64_HASH: '33d878dfac85590c4d77c518ed413e512d34a8479d90132b230a7ddd173576b3'
  WINFSP_MSI: 'https://github.com/winfsp/winfsp/releases/download/v2.1/winfsp-2.1.25156.msi'
  WINFSP_MSI_HASH: '073a70e00f77423e34bed98b86e600def93393ba5822204fac57a29324db9f7a'
  WINFSP_UNINSTALLER: 'https://github.com/cryptomator/winfsp-uninstaller/releases/latest/download/winfsp-uninstaller.exe'
+  WIX_VERSION: '6.0.2'

 defaults:
  run:
@@ -51,9 +52,9 @@ jobs:
            java-version: '25.0.1+8'
            java-package: 'jdk'
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Setup Java
-        uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: ${{ matrix.java-dist }}
          java-version: ${{ matrix.java-version }}
@@ -62,9 +63,11 @@ jobs:
          cache: 'maven'
      - name: Install wix and extensions
        run: |
-          dotnet tool install --global wix --version 6.0.0
-          wix.exe extension add WixToolset.UI.wixext/6.0.0 --global
-          wix.exe extension add WixToolset.Util.wixext/6.0.0 --global
+          dotnet tool install --global wix --version ${WIX_VERSION}
+          wix.exe extension add --global WixToolset.UI.wixext/${WIX_VERSION}
+          wix.exe extension add --global WixToolset.Util.wixext/${WIX_VERSION}
+        env:
+          WIX_VERSION: ${{ env.WIX_VERSION }}
      - name: Download and extract JavaFX jmods from Gluon
        if: matrix.arch == 'x64'
        #In the last step we move all jmods files a dir level up because jmods are placed inside a directory in the zip
@@ -140,8 +143,8 @@ jobs:
          --java-options "-Dcryptomator.appVersion=\"${{ needs.get-version.outputs.semVerStr }}\""
          --java-options "-Dfile.encoding=\"utf-8\""
          --java-options "-Djava.net.useSystemProxies=true"
+          --java-options "-Dcryptomator.adminConfigPath=\"C:/ProgramData/Cryptomator/config.properties\""
          --java-options "-Dcryptomator.logDir=\"@{localappdata}/Cryptomator\""
-          --java-options "-Dcryptomator.pluginDir=\"@{appdata}/Cryptomator/Plugins\""
          --java-options "-Dcryptomator.settingsPath=\"@{appdata}/Cryptomator/settings.json;@{userhome}/AppData/Roaming/Cryptomator/settings.json\""
          --java-options "-Dcryptomator.p12Path=\"@{appdata}/Cryptomator/key.p12;@{userhome}/AppData/Roaming/Cryptomator/key.p12\""
          --java-options "-Dcryptomator.ipcSocketPath=\"@{localappdata}/Cryptomator/ipc.socket\""
@@ -200,7 +203,7 @@ jobs:
          client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
      - name: Sign DLLs with Actalis CodeSigner
        if: inputs.sign || github.event_name == 'release'
-        uses: skymatic/workflows/.github/actions/win-sign-action@1074588008ae3326a2221ea451783280518f0366 # no specific version
+        uses: skymatic/workflows/.github/actions/win-sign-action@957d3c2c08c56855fdac41e5afb9a7aca8c30dd9 # no specific version
        with:
          base-dir: 'appdir'
          file-extensions: 'dll,exe,ps1'
@@ -277,7 +280,7 @@ jobs:
          GPG_PRIVATE_KEY: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }}
          GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }}
      - name: Upload artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: msi-${{ matrix.arch }}
          path: |
@@ -299,21 +302,23 @@ jobs:
            java-version: '24.0.1+9'
            java-package: 'jdk'
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Install wix and extensions
        run: |
-          dotnet tool install --global wix --version 6.0.0
-          wix.exe extension add WixToolset.BootstrapperApplications.wixext/6.0.0 --global
-          wix.exe extension add WixToolset.Util.wixext/6.0.0 --global
+          dotnet tool install --global wix --version ${WIX_VERSION}
+          wix.exe extension add --global WixToolset.BootstrapperApplications.wixext/${WIX_VERSION}
+          wix.exe extension add --global WixToolset.Util.wixext/${WIX_VERSION}
+        env:
+          WIX_VERSION: ${{ env.WIX_VERSION }}
      - name: Download .msi
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          name: msi-${{ matrix.arch }}
          path: dist/win/bundle/resources
      - name: Strip version info from msi file name
        run: mv dist/win/bundle/resources/Cryptomator*.msi dist/win/bundle/resources/Cryptomator.msi
      - name: Setup Java
-        uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: ${{ matrix.java-dist }}
          java-version: ${{ matrix.java-version }}
@@ -376,7 +381,7 @@ jobs:
          client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
      - name: Sign burn engine with Actalis CodeSigner
        if: inputs.sign || github.event_name == 'release'
-        uses: skymatic/workflows/.github/actions/win-sign-action@1074588008ae3326a2221ea451783280518f0366 # no specific version
+        uses: skymatic/workflows/.github/actions/win-sign-action@957d3c2c08c56855fdac41e5afb9a7aca8c30dd9 # no specific version
        with:
          base-dir: 'tmp'
          file-extensions: 'exe'
@@ -400,7 +405,7 @@ jobs:
          client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
      - name: Sign installer with Actalis CodeSigner
        if: inputs.sign || github.event_name == 'release'
-        uses: skymatic/workflows/.github/actions/win-sign-action@1074588008ae3326a2221ea451783280518f0366 # no specific version
+        uses: skymatic/workflows/.github/actions/win-sign-action@957d3c2c08c56855fdac41e5afb9a7aca8c30dd9 # no specific version
        with:
          base-dir: 'installer'
          file-extensions: 'exe'
@@ -418,7 +423,7 @@ jobs:
          GPG_PRIVATE_KEY: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }}
          GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }}
      - name: Upload artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: exe-${{ matrix.executable-suffix }}
          path: |
@@ -436,7 +441,7 @@ jobs:
      download-url-exe-x64: ${{ fromJSON(steps.publish.outputs.assets)[2].browser_download_url }}
    steps:
      - name: Download installers
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          merge-multiple: true
      - name: Publish installers on GitHub Releases
--- a/.idea/compiler.xml
+++ b/.idea/compiler.xml
@@ -12,17 +12,15 @@
        <sourceTestOutputDir name="target/generated-test-sources/test-annotations" />
        <outputRelativeToContentRoot value="true" />
        <option name="dagger.fastInit" value="enabled" />
-        <option name="dagger.formatGeneratedSource" value="enabled" />
        <processorPath useClasspath="false">
-          <entry name="$MAVEN_REPOSITORY$/com/google/dagger/dagger-compiler/2.57.2/dagger-compiler-2.57.2.jar" />
-          <entry name="$MAVEN_REPOSITORY$/com/google/dagger/dagger/2.57.2/dagger-2.57.2.jar" />
+          <entry name="$MAVEN_REPOSITORY$/com/google/dagger/dagger-compiler/2.59.1/dagger-compiler-2.59.1.jar" />
+          <entry name="$MAVEN_REPOSITORY$/com/google/dagger/dagger/2.59.1/dagger-2.59.1.jar" />
          <entry name="$MAVEN_REPOSITORY$/jakarta/inject/jakarta.inject-api/2.0.1/jakarta.inject-api-2.0.1.jar" />
          <entry name="$MAVEN_REPOSITORY$/org/jspecify/jspecify/1.0.0/jspecify-1.0.0.jar" />
-          <entry name="$MAVEN_REPOSITORY$/com/google/dagger/dagger-spi/2.57.2/dagger-spi-2.57.2.jar" />
+          <entry name="$MAVEN_REPOSITORY$/com/google/dagger/dagger-spi/2.59.1/dagger-spi-2.59.1.jar" />
          <entry name="$MAVEN_REPOSITORY$/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.jar" />
-          <entry name="$MAVEN_REPOSITORY$/com/google/devtools/ksp/symbol-processing-api/2.1.21-2.0.2/symbol-processing-api-2.1.21-2.0.2.jar" />
-          <entry name="$MAVEN_REPOSITORY$/com/google/googlejavaformat/google-java-format/1.5/google-java-format-1.5.jar" />
-          <entry name="$MAVEN_REPOSITORY$/com/google/errorprone/javac-shaded/9-dev-r4023-3/javac-shaded-9-dev-r4023-3.jar" />
+          <entry name="$MAVEN_REPOSITORY$/com/google/devtools/ksp/symbol-processing-api/2.2.20-2.0.3/symbol-processing-api-2.2.20-2.0.3.jar" />
+          <entry name="$MAVEN_REPOSITORY$/com/google/googlejavaformat/google-java-format/1.33.0/google-java-format-1.33.0.jar" />
          <entry name="$MAVEN_REPOSITORY$/com/google/guava/failureaccess/1.0.2/failureaccess-1.0.2.jar" />
          <entry name="$MAVEN_REPOSITORY$/com/google/guava/guava/33.0.0-jre/guava-33.0.0-jre.jar" />
          <entry name="$MAVEN_REPOSITORY$/com/google/guava/listenablefuture/9999.0-empty-to-avoid-conflict-with-guava/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar" />
@@ -37,8 +35,33 @@
          <entry name="$MAVEN_REPOSITORY$/javax/inject/javax.inject/1/javax.inject-1.jar" />
          <entry name="$MAVEN_REPOSITORY$/net/ltgt/gradle/incap/incap/0.2/incap-0.2.jar" />
          <entry name="$MAVEN_REPOSITORY$/org/checkerframework/checker-compat-qual/2.5.3/checker-compat-qual-2.5.3.jar" />
-          <entry name="$MAVEN_REPOSITORY$/org/jetbrains/kotlin/kotlin-metadata-jvm/2.1.21/kotlin-metadata-jvm-2.1.21.jar" />
-          <entry name="$MAVEN_REPOSITORY$/org/jetbrains/kotlin/kotlin-stdlib/2.1.21/kotlin-stdlib-2.1.21.jar" />
+          <entry name="$MAVEN_REPOSITORY$/org/jetbrains/kotlin/kotlin-metadata-jvm/2.2.20/kotlin-metadata-jvm-2.2.20.jar" />
+          <entry name="$MAVEN_REPOSITORY$/org/jetbrains/kotlin/kotlin-stdlib/2.2.20/kotlin-stdlib-2.2.20.jar" />
+          <entry name="$MAVEN_REPOSITORY$/org/jetbrains/annotations/13.0/annotations-13.0.jar" />
+          <entry name="$MAVEN_REPOSITORY$/com/google/dagger/dagger-compiler/2.59.1/dagger-compiler-2.59.1.jar" />
+          <entry name="$MAVEN_REPOSITORY$/com/google/dagger/dagger/2.59.1/dagger-2.59.1.jar" />
+          <entry name="$MAVEN_REPOSITORY$/jakarta/inject/jakarta.inject-api/2.0.1/jakarta.inject-api-2.0.1.jar" />
+          <entry name="$MAVEN_REPOSITORY$/org/jspecify/jspecify/1.0.0/jspecify-1.0.0.jar" />
+          <entry name="$MAVEN_REPOSITORY$/com/google/dagger/dagger-spi/2.59.1/dagger-spi-2.59.1.jar" />
+          <entry name="$MAVEN_REPOSITORY$/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.jar" />
+          <entry name="$MAVEN_REPOSITORY$/com/google/devtools/ksp/symbol-processing-api/2.2.20-2.0.3/symbol-processing-api-2.2.20-2.0.3.jar" />
+          <entry name="$MAVEN_REPOSITORY$/com/google/googlejavaformat/google-java-format/1.33.0/google-java-format-1.33.0.jar" />
+          <entry name="$MAVEN_REPOSITORY$/com/google/guava/failureaccess/1.0.2/failureaccess-1.0.2.jar" />
+          <entry name="$MAVEN_REPOSITORY$/com/google/guava/guava/33.0.0-jre/guava-33.0.0-jre.jar" />
+          <entry name="$MAVEN_REPOSITORY$/com/google/guava/listenablefuture/9999.0-empty-to-avoid-conflict-with-guava/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar" />
+          <entry name="$MAVEN_REPOSITORY$/org/checkerframework/checker-qual/3.41.0/checker-qual-3.41.0.jar" />
+          <entry name="$MAVEN_REPOSITORY$/com/google/errorprone/error_prone_annotations/2.23.0/error_prone_annotations-2.23.0.jar" />
+          <entry name="$MAVEN_REPOSITORY$/com/google/j2objc/j2objc-annotations/2.8/j2objc-annotations-2.8.jar" />
+          <entry name="$MAVEN_REPOSITORY$/com/squareup/javapoet/1.13.0/javapoet-1.13.0.jar" />
+          <entry name="$MAVEN_REPOSITORY$/com/squareup/kotlinpoet/1.11.0/kotlinpoet-1.11.0.jar" />
+          <entry name="$MAVEN_REPOSITORY$/org/jetbrains/kotlin/kotlin-stdlib-jdk8/1.6.10/kotlin-stdlib-jdk8-1.6.10.jar" />
+          <entry name="$MAVEN_REPOSITORY$/org/jetbrains/kotlin/kotlin-stdlib-jdk7/1.6.10/kotlin-stdlib-jdk7-1.6.10.jar" />
+          <entry name="$MAVEN_REPOSITORY$/org/jetbrains/kotlin/kotlin-reflect/1.6.10/kotlin-reflect-1.6.10.jar" />
+          <entry name="$MAVEN_REPOSITORY$/javax/inject/javax.inject/1/javax.inject-1.jar" />
+          <entry name="$MAVEN_REPOSITORY$/net/ltgt/gradle/incap/incap/0.2/incap-0.2.jar" />
+          <entry name="$MAVEN_REPOSITORY$/org/checkerframework/checker-compat-qual/2.5.3/checker-compat-qual-2.5.3.jar" />
+          <entry name="$MAVEN_REPOSITORY$/org/jetbrains/kotlin/kotlin-metadata-jvm/2.2.20/kotlin-metadata-jvm-2.2.20.jar" />
+          <entry name="$MAVEN_REPOSITORY$/org/jetbrains/kotlin/kotlin-stdlib/2.2.20/kotlin-stdlib-2.2.20.jar" />
          <entry name="$MAVEN_REPOSITORY$/org/jetbrains/annotations/13.0/annotations-13.0.jar" />
        </processorPath>
        <module name="cryptomator" />
@@ -47,7 +70,7 @@
  </component>
  <component name="JavacSettings">
    <option name="ADDITIONAL_OPTIONS_OVERRIDE">
-      <module name="cryptomator" options="-Adagger.fastInit=enabled -Adagger.formatGeneratedSource=enabled" />
+      <module name="cryptomator" options="-Adagger.fastInit=enabled" />
    </option>
  </component>
 </project>
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,8 +15,36 @@ Changes to prior versions can be found on the [Github release page](https://gith
  * Implemented Flatpak update mechanism
 * App notifications ([#4069](https://github.com/cryptomator/cryptomator/pull/4069))
 * Mark files in-use for Hub vaults ([#4078](https://github.com/cryptomator/cryptomator/pull/4078))
-* Accessibility labels for GUI elements ([#4064](https://github.com/cryptomator/cryptomator/issues/4064), [#4066](https://github.com/cryptomator/cryptomator/pull/4066), [#4055](https://github.com/cryptomator/cryptomator/issues/4055))
+* Accessibility: Adjust app to be used with a screen reader ([#547](https://github.com/cryptomator/cryptomator/issues/547))
+* Show Archived Vault Dialog on unlock when Hub returns 410 ([#4081](https://github.com/cryptomator/cryptomator/pull/4081))
+* Support automatic app theme selection according to OS theme on Linux ([#4027](https://github.com/cryptomator/cryptomator/issues/4027))
+* Admin configuration: Allow overwriting certain app properties by external config file ([#4105](https://github.com/cryptomator/cryptomator/pull/4105))
+* New keychain backend using [secret service API](https://specifications.freedesktop.org/secret-service/0.2) for Linux ([#4025](https://github.com/cryptomator/cryptomator/pull/4025))
+
+### Fixed
+* Fixed password reset/show recovery possible for vaults without masterkey file ([#4120](https://github.com/cryptomator/cryptomator/pull/4120))
+* Fixed restore vault config failed due to selecting a directory instead of file ([#4141](https://github.com/cryptomator/cryptomator/issues/4141))

 ### Changed
-* Built using JDK 25 ([#4031](https://github.com/cryptomator/cryptomator/issues/4031))
-* Modernized Template for GitHub Releases
+* Disable user defined app start config on Windows ([#4132](https://github.com/cryptomator/cryptomator/issues/4132))
+* Disable plugin loading by default ([#4136](https://github.com/cryptomator/cryptomator/4136))
+* Use JDK 25 ([#4031](https://github.com/cryptomator/cryptomator/pull/4031))
+* Update JavaFX to 25.0.2 ([#4145](https://github.com/cryptomator/cryptomator/pull/4145)))
+* Updated translations
+* Updated dependencies
+  * `ch.qos.logback:*` from 1.5.19 to 1.5.31
+  * `com.fasterxml.jackson.core:jackson-databind` from 2.20.0 to 2.21.0
+  * `com.fasterxml.jackson.datatype:jackson-datatype-jsr310` from 2.20.0 to 2.21.0
+  * `com.github.ben-manes.caffeine:caffeine` from 3.2.2 to 3.2.3
+  * `com.google.dagger:*` from 2.57.2 to 2.59.1
+  * `org.apache.commons:commons-lang3` from 3.19.0 to 3.20.0
+  * `org.cryptomator:cryptofs` from 2.9.0 to 2.10.0-beta3
+  * `org.cryptomator:cryptolib` from 2.2.1 to 2.2.2
+  * `org.cryptomator:fuse-nio-adapter` from 5.1.0 to 6.0.0
+  * `org.cryptomator:integrations-api` from 1.7.0 to 1.8.0-beta1
+  * `org.cryptomator:integrations-linux` from 1.6.1 to 1.7.0-beta4
+  * `org.cryptomator:integrations-mac` from 1.4.1 to 1.5.0-beta3
+  * `org.cryptomator:integrations-win` from 1.5.1 to 1.6.0
+  * `org.cryptomator:webdav-nio-adapter` from 3.0.0 to 3.0.1
+
+
--- a/README.md
+++ b/README.md
@@ -78,7 +78,7 @@ For more information on the security details visit [cryptomator.org](https://doc

 ### Dependencies

-* JDK 24 (e.g. temurin, zulu)
+* JDK 25 (e.g. temurin, zulu)
 * Maven 3

 ### Run Maven
--- a/dist/common/cryptomator.config
+++ b/dist/common/cryptomator.config
@@ -0,0 +1,8 @@
+# This is the Cryptomator administrative configuration file.
+# It is a simple key-value pair file.
+# Lines starting with '#' are comments and will be ignored.
+# For more info, read the docs at https://docs.cryptomator.org/desktop/advanced-settings/
+#
+# Example:
+# Sets the plugin directory and enables plugin loading
+# cryptomator.pluginDir=@{userhome}/Cryptomator/Plugins
--- a/dist/linux/appimage/build.sh
+++ b/dist/linux/appimage/build.sh
@@ -23,12 +23,12 @@ mvn -B -f ../../../pom.xml clean package -Plinux -DskipTests
 cp ../../../LICENSE.txt ../../../target
 cp ../../../target/cryptomator-*.jar ../../../target/mods

-JAVAFX_VERSION=25
+JAVAFX_VERSION=25.0.2
 JAVAFX_ARCH="x64"
-JAVAFX_JMODS_SHA256='96e520f48610d8ffb94ca30face1f11ffe8a977ddc1c4ff80b1a9e9f048bd94e'
+JAVAFX_JMODS_SHA256='e0a9c29d8cf3af9b8b48848b43f87b5785bc107c53a951b19668ce05842bba1b'
 if [ "${CPU_ARCH}" = "aarch64" ]; then
    JAVAFX_ARCH="aarch64"
-    JAVAFX_JMODS_SHA256='951c52481af0ec5885b06f1ebaa8a10da7e8ea23c5e1ef3e2f6f11fa1b3a7ce1'
+    JAVAFX_JMODS_SHA256='c3408f818693cce09e59829a8e862a82c7695fdfcd585c41cfd527f5fc3fe646'
 fi

 # download javaFX jmods
@@ -88,8 +88,8 @@ ${JAVA_HOME}/bin/jpackage \
    --app-version "${VERSION}.${REVISION_NO}" \
    --java-options "-Dfile.encoding=\"utf-8\"" \
    --java-options "-Djava.net.useSystemProxies=true" \
+    --java-options "-Dcryptomator.adminConfigPath=\"/etc/cryptomator/config.properties\"" \
    --java-options "-Dcryptomator.logDir=\"@{userhome}/.local/share/Cryptomator/logs\"" \
-    --java-options "-Dcryptomator.pluginDir=\"@{userhome}/.local/share/Cryptomator/plugins\"" \
    --java-options "-Dcryptomator.settingsPath=\"@{userhome}/.config/Cryptomator/settings.json:@{userhome}/.Cryptomator/settings.json\"" \
    --java-options "-Dcryptomator.p12Path=\"@{userhome}/.config/Cryptomator/key.p12\"" \
    --java-options "-Dcryptomator.ipcSocketPath=\"@{userhome}/.config/Cryptomator/ipc.socket\"" \
--- a/dist/linux/debian/rules
+++ b/dist/linux/debian/rules
@@ -51,8 +51,8 @@ override_dh_auto_build:
 		--java-options "-Xmx256m" \
 		--java-options "-Dfile.encoding=\"utf-8\"" \
 		--java-options "-Djava.net.useSystemProxies=true" \
+		--java-options "-Dcryptomator.adminConfigPath=\"/etc/cryptomator/config.properties\"" \
 		--java-options "-Dcryptomator.logDir=\"@{userhome}/.local/share/Cryptomator/logs\"" \
-		--java-options "-Dcryptomator.pluginDir=\"@{userhome}/.local/share/Cryptomator/plugins\"" \
 		--java-options "-Dcryptomator.settingsPath=\"@{userhome}/.config/Cryptomator/settings.json:@{userhome}/.Cryptomator/settings.json\"" \
 		--java-options "-Dcryptomator.p12Path=\"@{userhome}/.config/Cryptomator/key.p12\"" \
 		--java-options "-Dcryptomator.ipcSocketPath=\"@{userhome}/.config/Cryptomator/ipc.socket\"" \
--- a/dist/mac/dmg/build.sh
+++ b/dist/mac/dmg/build.sh
@@ -32,15 +32,15 @@ REVISION_NO=`git rev-list --count HEAD`
 VERSION_NO=`mvn -f../../../pom.xml help:evaluate -Dexpression=project.version -q -DforceStdout | sed -rn 's/.*([0-9]+\.[0-9]+\.[0-9]+).*/\1/p'`
 FUSE_LIB="FUSE-T"

-JAVAFX_VERSION=25
+JAVAFX_VERSION=25.0.2
 JAVAFX_ARCH="undefined"
 JAVAFX_JMODS_SHA256="undefined"
 if [ "$(machine)" = "arm64e" ]; then
    JAVAFX_ARCH="aarch64"
-    JAVAFX_JMODS_SHA256="13f8c0513c40c95881479fbcf0465a29a60217393fb0656f5e4eab78a9442fba"
+    JAVAFX_JMODS_SHA256="4cd258001c75af7047005c5c891e2400ed11d24fbb09412324c0cbaf8b503c5a"
 else
    JAVAFX_ARCH="x64"
-    JAVAFX_JMODS_SHA256="0eba73fb28a24c845175d16fa2f8c081c936ce6de1be9b79eb6119fa32e53d52"
+    JAVAFX_JMODS_SHA256="0b4d8463f03901b7425d94628e4116b7078abb8dd540fbec415266fac20bda5c"
 fi
 JAVAFX_JMODS_URL="https://download2.gluonhq.com/openjfx/${JAVAFX_VERSION}/openjfx-${JAVAFX_VERSION}_osx-${JAVAFX_ARCH}_bin-jmods.zip"

@@ -114,9 +114,9 @@ ${JAVA_HOME}/bin/jpackage \
    --java-options "-Dapple.awt.enableTemplateImages=true" \
    --java-options "-Dsun.java2d.metal=true" \
    --java-options "-Dcryptomator.appVersion=\"${VERSION_NO}\"" \
+    --java-options "-Dcryptomator.adminConfigPath=\"/Library/Application Support/Cryptomator/config.properties\"" \
    --java-options "-Dcryptomator.logDir=\"@{userhome}/Library/Logs/${APP_NAME}\"" \
    --java-options "-XX:ErrorFile=/cryptomator/cryptomator_crash.log" \
-    --java-options "-Dcryptomator.pluginDir=\"@{userhome}/Library/Application Support/${APP_NAME}/Plugins\"" \
    --java-options "-Dcryptomator.settingsPath=\"@{userhome}/Library/Application Support/${APP_NAME}/settings.json\"" \
    --java-options "-Dcryptomator.ipcSocketPath=\"@{userhome}/Library/Application Support/${APP_NAME}/ipc.socket\"" \
    --java-options "-Dcryptomator.p12Path=\"@{userhome}/Library/Application Support/${APP_NAME}/key.p12\"" \
--- a/dist/win/build.ps1
+++ b/dist/win/build.ps1
@@ -34,20 +34,20 @@ if ((Get-Command "mvn" -ErrorAction SilentlyContinue) -eq $null)
 }
 if ((Get-Command 'wix' -ErrorAction SilentlyContinue) -eq $null)
 {
-   Write-Error 'Unable to find wix in your PATH (try: dotnet tool install --global wix --version 6.0.0)'
+   Write-Error 'Unable to find wix in your PATH (try: dotnet tool install --global wix --version 6.0.2)'
   exit 1
 }
 $wixExtensions = & wix.exe extension list --global | Out-String
 if ($wixExtensions -notmatch 'WixToolset.UI.wixext') {
-    Write-Error 'Wix UI extension missing. Please install it with: wix.exe extension add WixToolset.UI.wixext/6.0.0 --global)'
+    Write-Error 'Wix UI extension missing. Please install it with: wix.exe extension add WixToolset.UI.wixext/6.0.2 --global)'
    exit 1
 }
 if ($wixExtensions -notmatch 'WixToolset.Util.wixext') {
-    Write-Error 'Wix Util extension missing. Please install it with: wix.exe extension add WixToolset.Util.wixext/6.0.0 --global)'
+    Write-Error 'Wix Util extension missing. Please install it with: wix.exe extension add WixToolset.Util.wixext/6.0.2 --global)'
    exit 1
 }
 if ($wixExtensions -notmatch 'WixToolset.BootstrapperApplications.wixext') {
-    Write-Error 'Wix Bootstrapper extension missing. Please install it with: wix.exe extension add WixToolset.BootstrapperApplications.wixext/6.0.0 --global)'
+    Write-Error 'Wix Bootstrapper extension missing. Please install it with: wix.exe extension add WixToolset.BootstrapperApplications.wixext/6.0.2 --global)'
    exit 1
 }

@@ -93,9 +93,9 @@ switch ($archName) {
        $jmodPaths = "$Env:JAVA_HOME/jmods"
    }
    'x64' {
-		$javaFxVersion='25'
+		$javaFxVersion='25.0.2'
 		$javaFxJmodsUrl = "https://download2.gluonhq.com/openjfx/${javaFxVersion}/openjfx-${javaFxVersion}_windows-x64_bin-jmods.zip"
-		$javaFxJmodsSHA256 = 'c8eb9fd039b00e0020cf6c3db8ed7876bf3ee4d27860aa697a247b83b8296ae7'
+		$javaFxJmodsSHA256 = '33d878dfac85590c4d77c518ed413e512d34a8479d90132b230a7ddd173576b3'
 		$javaFxJmods = '.\resources\jfxJmods.zip'

 		if( !(Test-Path -Path $javaFxJmods) ) {
@@ -155,7 +155,7 @@ $javaOptions = @(
 "--java-options", "-Djava.net.useSystemProxies=true"
 "--java-options", "-Dcryptomator.logDir=`"@{localappdata}/$AppName`""
 "--java-options", "-XX:ErrorFile=`"C:/cryptomator/cryptomator_crash.log`""
-"--java-options", "-Dcryptomator.pluginDir=`"@{appdata}/$AppName/Plugins`""
+"--java-options", "-Dcryptomator.adminConfigPath=`"C:/ProgramData/$AppName/config.properties`""
 "--java-options", "-Dcryptomator.settingsPath=`"@{appdata}/$AppName/settings.json;@{userhome}/AppData/Roaming/$AppName/settings.json`""
 "--java-options", "-Dcryptomator.ipcSocketPath=`"@{localappdata}/$AppName/ipc.socket`""
 "--java-options", "-Dcryptomator.p12Path=`"@{appdata}/$AppName/key.p12;@{userhome}/AppData/Roaming/$AppName/key.p12`""
--- a/dist/win/contrib/disableUserConfig.bat
+++ b/dist/win/contrib/disableUserConfig.bat
@@ -0,0 +1,12 @@
+@echo off
+:: Batch wrapper for PowerShell script to disable user configuration in Cryptomator
+:: This is executed as a Custom Action during MSI installation
+:: This file must be located in the INSTALLDIR
+
+:: Change to INSTALLDIR
+cd %~dp0
+:: Execute the PowerShell script
+powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy RemoteSigned -File ".\disableUserConfig.ps1"
+
+:: Return the exit code from PowerShell
+exit /b %ERRORLEVEL%
--- a/dist/win/contrib/disableUserConfig.ps1
+++ b/dist/win/contrib/disableUserConfig.ps1
@@ -0,0 +1,24 @@
+# PowerShell script to disable user configuration
+# This script is executed as a Custom Action during MSI installation
+# It deletes the file .package, effectively disabling user specific jpackage configuration.
+# NOTE: This file must be located in the same directory as set in the MSI property INSTALLDIR
+
+try {
+
+    # Determine  file path
+    $packageFile = Join-Path $PSScriptRoot 'app\.package'
+
+    #check if file exists
+    if (Test-Path -Path $packageFile) {
+        Write-Host "Deleting file: $packageFile"
+        Remove-Item -Path $packageFile -Force -ErrorAction Stop
+    } else {
+        Write-Host "File not found: $packageFile. Skipping deletion."
+    }
+
+    exit 0
+}
+catch {
+    Write-Error "Error deleting package file: $_"
+    exit 1
+}
--- a/dist/win/resources/main.wxs
+++ b/dist/win/resources/main.wxs
@@ -87,7 +87,7 @@

    <!-- Non-Opening ProgID -->
    <ns0:DirectoryRef Id="INSTALLDIR">
-        <ns0:Component Bitness="always64" Id="nonStartingProgID" >
+        <ns0:Component Bitness="always64" Id="nonStartingProgID">
          <ns0:File Id="IconFileForEncryptedData" KeyPath="yes" Source="$(env.JP_WIXWIZARD_RESOURCES)\$(var.IconFileEncryptedData)" Name="$(var.IconFileEncryptedData)"/>
          <ns0:ProgId Id="$(var.JpAppName).Encrypted.1" Description="$(var.JpAppName) Encrypted Data" Icon="IconFileForEncryptedData" IconIndex="0">
            <ns0:Extension Id="c9r" Advertise="no" ContentType="$(var.ProgIdContentType)">
@@ -99,6 +99,25 @@
        </ns0:Component>
    </ns0:DirectoryRef>

+    <ns0:StandardDirectory Id="CommonAppDataFolder">
+      <ns0:Directory Id="CryptomatorDesktopProgramData" Name="Cryptomator">
+        <ns0:Component Id="AdminConfigDir" Guid="c078b7da-ba6e-4069-a5ab-5c0f0f9856a0">
+          <ns0:CreateFolder>
+            <util:PermissionEx User="SYSTEM" GenericAll="yes"/>
+            <util:PermissionEx User="Administrators" GenericAll="yes"/>
+            <util:PermissionEx User="Users" GenericRead="yes" GenericExecute="yes"/>
+          </ns0:CreateFolder>
+        </ns0:Component>
+        <ns0:Component Id="AdminConfigFile" NeverOverwrite="yes" Permanent="yes">
+          <ns0:File Id="EmptyAdminConfig" Source="$(env.JP_WIXWIZARD_RESOURCES)\..\..\common\cryptomator.config" Name="cryptomator.config" KeyPath="yes">
+            <util:PermissionEx User="SYSTEM" GenericAll="yes"/>
+            <util:PermissionEx User="Administrators" GenericAll="yes"/>
+            <util:PermissionEx User="Users" GenericRead="yes" GenericExecute="yes"/>
+          </ns0:File>
+        </ns0:Component>
+      </ns0:Directory>
+    </ns0:StandardDirectory>
+
    <!-- Standard required root -->

    <ns0:Feature Id="DefaultFeature" Title="!(loc.MainFeatureTitle)" Level="1">
@@ -106,7 +125,9 @@
      <ns0:ComponentGroupRef Id="Files"/>
      <ns0:ComponentGroupRef Id="FileAssociations"/>
      <!-- Ref to additional ProgIDs -->
-      <ns0:ComponentRef Id="nonStartingProgID" />
+      <ns0:ComponentRef Id="nonStartingProgID"/>
+      <ns0:ComponentRef Id="AdminConfigDir"/>
+      <ns0:ComponentRef Id="AdminConfigFile"/>
    </ns0:Feature>

    <ns0:CustomAction Id="JpSetARPINSTALLLOCATION" Property="ARPINSTALLLOCATION" Value="[INSTALLDIR]" />
@@ -132,6 +153,10 @@
    <!-- Property for controlling update check behavior (can be set via command line) -->
    <ns0:Property Id="DISABLEUPDATECHECK" Secure="yes" />

+    <!-- Disable user config -->
+    <ns0:SetProperty Id="DisableUserConfig" Value="&quot;[INSTALLDIR]disableUserConfig.bat&quot;" Sequence="execute" Before="DisableUserConfig" />
+    <ns0:CustomAction Id="DisableUserConfig" BinaryRef="Wix4UtilCA_$(sys.BUILDARCHSHORT)" DllEntry="WixQuietExec" Execute="deferred" Return="ignore" Impersonate="no"/>
+
    <!-- WebDAV patches -->
    <ns0:SetProperty Id="PatchWebDAV" Value="&quot;[INSTALLDIR]patchWebDAV.bat&quot; &quot;$(var.LoopbackAlias)&quot;" Sequence="execute" Before="PatchWebDAV" />
    <ns0:CustomAction Id="PatchWebDAV" BinaryRef="Wix4UtilCA_$(sys.BUILDARCHSHORT)" DllEntry="WixQuietExec" Execute="deferred" Return="ignore" Impersonate="no"/>
@@ -188,9 +213,10 @@
      <ns0:Custom Action="FailOnRunningApp" After="Wix4CloseApplications_$(sys.BUILDARCHSHORT)" Condition="FOUNDRUNNINGAPP" />

      <ns0:RemoveExistingProducts After="InstallValidate"/> <!-- Moved from CostInitialize, due to Wix4CloseApplications_* -->
+      <ns0:Custom Action="DisableUserConfig" After="InstallFiles" Condition="NOT (Installed AND (NOT REINSTALL) AND (NOT UPGRADINGPRODUCTCODE) AND REMOVE)"/>
      <!-- Skip action on uninstall -->
      <!-- TODO: don't skip action, but remove cryptomator alias from hosts file -->
-      <ns0:Custom Action="PatchWebDAV" After="InstallFiles" Condition="NOT (Installed AND (NOT REINSTALL) AND (NOT UPGRADINGPRODUCTCODE) AND REMOVE)"/>
+      <ns0:Custom Action="PatchWebDAV" After="DisableUserConfig" Condition="NOT (Installed AND (NOT REINSTALL) AND (NOT UPGRADINGPRODUCTCODE) AND REMOVE)"/>
      <!-- Configure update check setting if property is provided -->
      <ns0:Custom Action="PatchUpdateCheck" After="PatchWebDAV" Condition="DISABLEUPDATECHECK AND NOT (Installed AND (NOT REINSTALL) AND (NOT UPGRADINGPRODUCTCODE) AND REMOVE)"/>
    </ns0:InstallExecuteSequence>
--- a/pom.xml
+++ b/pom.xml
@@ -33,23 +33,25 @@
 		<nonModularGroupIds>org.ow2.asm,org.apache.jackrabbit,org.apache.httpcomponents</nonModularGroupIds>

 		<!-- cryptomator dependencies -->
-		<cryptomator.cryptofs.version>2.10.0-beta2</cryptomator.cryptofs.version>
+		<cryptomator.cryptofs.version>2.10.0-beta3</cryptomator.cryptofs.version>
+		<cryptomator.cryptolib.version>2.2.2</cryptomator.cryptolib.version>
 		<cryptomator.integrations.version>1.8.0-beta1</cryptomator.integrations.version>
-		<cryptomator.integrations.win.version>1.5.1</cryptomator.integrations.win.version>
+		<cryptomator.integrations.win.version>1.6.0</cryptomator.integrations.win.version>
 		<cryptomator.integrations.mac.version>1.5.0-beta3</cryptomator.integrations.mac.version>
-		<cryptomator.integrations.linux.version>1.7.0-beta3</cryptomator.integrations.linux.version>
-		<cryptomator.fuse.version>5.1.0</cryptomator.fuse.version>
-		<cryptomator.webdav.version>3.0.0</cryptomator.webdav.version>
+		<cryptomator.integrations.linux.version>1.7.0-beta4</cryptomator.integrations.linux.version>
+		<cryptomator.fuse.version>6.0.0</cryptomator.fuse.version>
+		<cryptomator.webdav.version>3.0.1</cryptomator.webdav.version>

 		<!-- 3rd party dependencies -->
-		<commons-lang3.version>3.19.0</commons-lang3.version>
-		<dagger.version>2.57.2</dagger.version>
+		<caffeine.version>3.2.3</caffeine.version>
+		<commons-lang3.version>3.20.0</commons-lang3.version>
+		<dagger.version>2.59.1</dagger.version>
 		<easybind.version>2.2</easybind.version>
-		<jackson.version>2.20.0</jackson.version>
-		<javafx.version>25</javafx.version>
+		<jackson.version>2.21.0</jackson.version>
+		<javafx.version>25.0.2</javafx.version>
 		<jwt.version>4.5.0</jwt.version>
 		<nimbus-jose.version>10.5</nimbus-jose.version>
-		<logback.version>1.5.19</logback.version>
+		<logback.version>1.5.31</logback.version>
 		<slf4j.version>2.0.17</slf4j.version>
 		<tinyoauth2.version>0.8.1</tinyoauth2.version>
 		<zxcvbn.version>1.9.0</zxcvbn.version>
@@ -94,7 +96,7 @@
 		<dependency>
 			<groupId>org.cryptomator</groupId>
 			<artifactId>cryptolib</artifactId>
-			<version>2.2.1</version>
+			<version>${cryptomator.cryptolib.version}</version>
 		</dependency>
 		<dependency>
 			<groupId>org.cryptomator</groupId>
@@ -228,7 +230,7 @@
 		<dependency>
 			<groupId>com.github.ben-manes.caffeine</groupId>
 			<artifactId>caffeine</artifactId>
-			<version>3.2.2</version>
+			<version>${caffeine.version}</version>
 		</dependency>
 		<!-- JUnit / Mockito / Hamcrest -->
 		<dependency>
@@ -330,7 +332,6 @@
 					</annotationProcessorPaths>
 					<compilerArgs>
 						<arg>-Adagger.fastInit=enabled</arg>
-						<arg>-Adagger.formatGeneratedSource=enabled</arg>
 					</compilerArgs>
 				</configuration>
 			</plugin>
--- a/src/main/java/module-info.java
+++ b/src/main/java/module-info.java
@@ -14,11 +14,13 @@ import org.cryptomator.common.locationpresets.OneDriveMacLocationPresetsProvider
 import org.cryptomator.common.locationpresets.OneDriveWindowsLocationPresetsProvider;
 import org.cryptomator.common.locationpresets.PCloudLocationPresetsProvider;
 import org.cryptomator.integrations.tray.TrayMenuController;
+import org.cryptomator.integrations.uiappearance.UiAppearanceProvider;
 import org.cryptomator.logging.LogbackConfiguratorFactory;
 import org.cryptomator.networking.SSLContextProvider;
 import org.cryptomator.networking.SSLContextWithMacKeychain;
 import org.cryptomator.networking.SSLContextWithPKCS12TrustStore;
 import org.cryptomator.networking.SSLContextWithWindowsCertStore;
+import org.cryptomator.ui.fxapp.JfxUiAppearanceProvider;
 import org.cryptomator.ui.traymenu.AwtTrayMenuController;

 open module org.cryptomator.desktop {
@@ -61,6 +63,7 @@ open module org.cryptomator.desktop {
 	uses SSLContextProvider;
 	uses org.cryptomator.event.NotificationHandler;

+	provides UiAppearanceProvider with JfxUiAppearanceProvider;
 	provides TrayMenuController with AwtTrayMenuController;
 	provides Configurator with LogbackConfiguratorFactory;
 	provides SSLContextProvider with SSLContextWithWindowsCertStore, SSLContextWithMacKeychain, SSLContextWithPKCS12TrustStore;
--- a/src/main/java/org/cryptomator/common/recovery/MasterkeyService.java
+++ b/src/main/java/org/cryptomator/common/recovery/MasterkeyService.java
@@ -61,6 +61,7 @@ public final class MasterkeyService {
 			Optional<Path> c9rFile = paths //
 					.filter(p -> p.toString().endsWith(".c9r")) //
 					.filter(p -> !p.endsWith("dir.c9r")) //
+					.filter(Files::isRegularFile) //
 					.findFirst();
 			if (c9rFile.isEmpty()) {
 				LOG.info("Unable to detect Crypto scheme: No *.c9r file found in {}", vaultPath);
--- a/src/main/java/org/cryptomator/common/settings/Settings.java
+++ b/src/main/java/org/cryptomator/common/settings/Settings.java
@@ -153,11 +153,6 @@ public class Settings {

 	@SuppressWarnings("deprecation")
 	private void migrateLegacySettings(SettingsJson json) {
-		// migrate renamed keychainAccess
-		if(this.keychainProvider.getValueSafe().equals("org.cryptomator.linux.keychain.SecretServiceKeychainAccess")) {
-			this.keychainProvider.setValue("org.cryptomator.linux.keychain.GnomeKeyringKeychainAccess");
-		}
-
 		// implicit migration of 1.6.x legacy setting "preferredVolumeImpl":
 		if (this.mountService.get() == null && json.preferredVolumeImpl != null) {
 			this.mountService.set(switch (json.preferredVolumeImpl) {
--- a/src/main/java/org/cryptomator/common/settings/UiTheme.java
+++ b/src/main/java/org/cryptomator/common/settings/UiTheme.java
@@ -10,14 +10,6 @@ public enum UiTheme {
 	DARK("preferences.interface.theme.dark"), //
 	AUTOMATIC("preferences.interface.theme.automatic");

-	public static UiTheme[] applicableValues() {
-		if (SystemUtils.IS_OS_MAC || SystemUtils.IS_OS_WINDOWS) {
-			return values();
-		} else {
-			return new UiTheme[]{LIGHT, DARK};
-		}
-	}
-
 	private final String displayName;

 	UiTheme(String displayName) {
--- a/src/main/java/org/cryptomator/launcher/AdminPropertiesFactory.java
+++ b/src/main/java/org/cryptomator/launcher/AdminPropertiesFactory.java
@@ -0,0 +1,97 @@
+package org.cryptomator.launcher;
+
+import org.slf4j.Logger;
+
+import java.io.IOException;
+import java.io.Reader;
+import java.nio.channels.Channels;
+import java.nio.channels.FileChannel;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.NoSuchFileException;
+import java.nio.file.Path;
+import java.nio.file.StandardOpenOption;
+import java.util.Properties;
+import java.util.Set;
+
+/**
+ * Factory to generate admin properties.
+ *
+ * <p>
+ * Admin properties are {@link Properties} using system properties as defaults, but allow overwriting a specific set of properties with an external config file.
+ * Those properties are created by calling {@link #create()}. The method first reads system property {@value #ADMIN_PROP_FILE_KEY}. If it contains a path to a valid properties file, all overridable properties from the file are loaded into the returned admin properties.
+ * <p>
+ * The overridable properties are:
+ * <ul>
+ *     <li>cryptomator.logDir</li>
+ *     <li>cryptomator.pluginDir</li>
+ *     <li>cryptomator.p12Path</li>
+ *     <li>cryptomator.mountPointsDir</li>
+ *     <li>cryptomator.disableUpdateCheck</li>
+ * </ul>
+ *
+ * @see Properties
+ * @see System#getProperties()
+ */
+class AdminPropertiesFactory {
+
+	private static final Logger LOG = EventualLogger.INSTANCE;
+	private static final long MAX_CONFIG_SIZE_BYTES = 8192;
+	private static final String ADMIN_PROP_FILE_KEY = "cryptomator.adminConfigPath";
+	private static final Set<String> ALLOWED_OVERRIDES = Set.of( //
+			"cryptomator.logDir", //
+			"cryptomator.pluginDir", //
+			"cryptomator.p12Path", //
+			"cryptomator.mountPointsDir", //
+			"cryptomator.disableUpdateCheck");
+
+
+	/**
+	 * Creates new {@link Properties} containing overridable properties from the admin config.
+	 * <p>
+	 * The returned properties object uses as default the {@link System} properties.
+	 * For a list of overridable properties, see {@link AdminPropertiesFactory}
+	 *
+	 * @return {@link Properties} containing overridable properties from the admin config and defaulting to system properties.
+	 */
+	static Properties create() {
+		var systemProps = System.getProperties();
+		var adminProps = new Properties(systemProps);
+
+		final String adminCfgPath = System.getProperty(ADMIN_PROP_FILE_KEY);
+		if (adminCfgPath == null) {
+			LOG.debug("Admin config property is not defined. Skipping.");
+			return adminProps;
+		}
+		var propsFromFile = loadPropertiesFromFile(Path.of(adminCfgPath));
+
+		for (var key : propsFromFile.stringPropertyNames()) {
+			if (ALLOWED_OVERRIDES.contains(key)) {
+				var value = propsFromFile.getProperty(key);
+				LOG.info("Overwriting {} with value {} from admin config.", key, value);
+				adminProps.setProperty(key, value);
+			} else {
+				LOG.debug("Property {} in admin config is not supported for override.", key);
+			}
+		}
+		return adminProps;
+	}
+
+	//visible for testing
+	static Properties loadPropertiesFromFile(Path adminPropertiesPath) {
+		var adminProps = new Properties();
+		try (FileChannel ch = FileChannel.open(adminPropertiesPath, StandardOpenOption.READ); //
+			 Reader reader = Channels.newReader(ch, StandardCharsets.UTF_8)) {
+			if (ch.size() > MAX_CONFIG_SIZE_BYTES) {
+				throw new IOException("Config file %s exceeds maximum size of %d".formatted(adminPropertiesPath, MAX_CONFIG_SIZE_BYTES));
+			}
+			adminProps.load(reader);
+		} catch (NoSuchFileException _) {
+			//NO-OP
+			LOG.debug("No admin properties found at {}.", adminPropertiesPath);
+		} catch (IOException | IllegalArgumentException e) {
+			LOG.warn("Failed to read administrative properties from {}. Returning empty properties.", adminPropertiesPath, e);
+		}
+		return adminProps;
+	}
+
+}
--- a/src/main/java/org/cryptomator/launcher/Cryptomator.java
+++ b/src/main/java/org/cryptomator/launcher/Cryptomator.java
@@ -11,9 +11,9 @@ import org.apache.commons.lang3.SystemUtils;
 import org.cryptomator.common.Environment;
 import org.cryptomator.common.ShutdownHook;
 import org.cryptomator.common.SubstitutingProperties;
-import org.cryptomator.networking.SSLContextProvider;
 import org.cryptomator.ipc.IpcCommunicator;
 import org.cryptomator.logging.DebugMode;
+import org.cryptomator.networking.SSLContextProvider;
 import org.cryptomator.ui.fxapp.FxApplicationComponent;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -35,7 +35,8 @@ public class Cryptomator {
 	private static final long STARTUP_TIME = System.currentTimeMillis();

 	static {
-		var lazyProcessedProps = new SubstitutingProperties(System.getProperties(), System.getenv());
+		var adminProps = AdminPropertiesFactory.create();
+		var lazyProcessedProps = new SubstitutingProperties(adminProps, System.getenv());
 		System.setProperties(lazyProcessedProps);
 		CRYPTOMATOR_COMPONENT = DaggerCryptomatorComponent.factory().create(STARTUP_TIME);
 		LOG = LoggerFactory.getLogger(Cryptomator.class);
@@ -64,6 +65,7 @@ public class Cryptomator {
 	}

 	public static void main(String[] args) {
+		EventualLogger.INSTANCE.drainTo(LOG);
 		var printVersion = Optional.ofNullable(args) //
 				.stream() //Streams either one element (the args-array) or zero elements
 				.flatMap(Arrays::stream) //
--- a/src/main/java/org/cryptomator/launcher/CryptomatorModule.java
+++ b/src/main/java/org/cryptomator/launcher/CryptomatorModule.java
@@ -4,7 +4,6 @@ import dagger.Module;
 import dagger.Provides;
 import org.cryptomator.integrations.autostart.AutoStartProvider;
 import org.cryptomator.integrations.tray.TrayIntegrationProvider;
-import org.cryptomator.integrations.uiappearance.UiAppearanceProvider;
 import org.cryptomator.ui.fxapp.FxApplicationComponent;

 import javax.inject.Named;
@@ -30,11 +29,6 @@ class CryptomatorModule {
 		return new ArrayBlockingQueue<>(10);
 	}

-	@Provides
-	@Singleton
-	static Optional<UiAppearanceProvider> provideAppearanceProvider() {
-		return UiAppearanceProvider.get();
-	}

 	@Provides
 	@Singleton
--- a/src/main/java/org/cryptomator/launcher/EventualLogger.java
+++ b/src/main/java/org/cryptomator/launcher/EventualLogger.java
@@ -0,0 +1,106 @@
+package org.cryptomator.launcher;
+
+import org.slf4j.Logger;
+import org.slf4j.Marker;
+import org.slf4j.event.DefaultLoggingEvent;
+import org.slf4j.event.Level;
+import org.slf4j.event.LoggingEvent;
+import org.slf4j.helpers.AbstractLogger;
+
+import java.util.ArrayDeque;
+import java.util.List;
+import java.util.Objects;
+import java.util.Queue;
+
+class EventualLogger extends AbstractLogger {
+
+	static final EventualLogger INSTANCE = new EventualLogger();
+
+	private final Queue<LoggingEvent> bufferedEvents = new ArrayDeque<>();
+
+	private EventualLogger() {
+	}
+
+	synchronized void drainTo(Logger gutter) {
+		for (var event : bufferedEvents) {
+			var builder = gutter.atLevel(event.getLevel()) //
+					.setCause(event.getThrowable()) //
+					.setMessage(event.getMessage());
+			Objects.requireNonNullElse(event.getArguments(), List.of()).forEach(builder::addArgument);
+			Objects.requireNonNullElse(event.getMarkers(), List.<Marker>of()).forEach(builder::addMarker);
+			builder.log();
+		}
+		bufferedEvents.clear();
+	}
+
+	@Override
+	protected synchronized void handleNormalizedLoggingCall(Level level, Marker marker, String messagePattern, Object[] arguments, Throwable throwable) {
+		var event = new DefaultLoggingEvent(level, this);
+		if (marker != null) {
+			event.addMarker(marker);
+		}
+		event.setMessage(messagePattern);
+		for (var arg : Objects.requireNonNullElse(arguments, new Object[]{})) {
+			event.addArgument(arg);
+		}
+		event.setThrowable(throwable);
+		bufferedEvents.add(event);
+	}
+
+	//Unclear, unused and undocumented method of slf4j, see also https://github.com/qos-ch/slf4j/discussions/348
+	@Override
+	protected String getFullyQualifiedCallerName() {
+		return getClass().getCanonicalName();
+	}
+
+
+	@Override
+	public boolean isTraceEnabled() {
+		return true;
+	}
+
+	@Override
+	public boolean isTraceEnabled(Marker marker) {
+		return true;
+	}
+
+	@Override
+	public boolean isDebugEnabled() {
+		return true;
+	}
+
+	@Override
+	public boolean isDebugEnabled(Marker marker) {
+		return true;
+	}
+
+	@Override
+	public boolean isInfoEnabled() {
+		return true;
+	}
+
+	@Override
+	public boolean isInfoEnabled(Marker marker) {
+		return true;
+	}
+
+	@Override
+	public boolean isWarnEnabled() {
+		return true;
+	}
+
+	@Override
+	public boolean isWarnEnabled(Marker marker) {
+		return true;
+	}
+
+	@Override
+	public boolean isErrorEnabled() {
+		return true;
+	}
+
+	@Override
+	public boolean isErrorEnabled(Marker marker) {
+		return true;
+	}
+}
--- a/src/main/java/org/cryptomator/ui/addvaultwizard/ChooseExistingVaultController.java
+++ b/src/main/java/org/cryptomator/ui/addvaultwizard/ChooseExistingVaultController.java
@@ -59,7 +59,7 @@ public class ChooseExistingVaultController implements FxController {
 		this.vault = vault;
 		this.vaultListManager = vaultListManager;
 		this.resourceBundle = resourceBundle;
-		this.screenshot = applicationStyle.appliedThemeProperty().map(this::selectScreenshot);
+		this.screenshot = applicationStyle.appliedAppThemeProperty().map(this::selectScreenshot);
 	}

 	private Image selectScreenshot(Theme theme) {
--- a/src/main/java/org/cryptomator/ui/controls/NotificationBar.java
+++ b/src/main/java/org/cryptomator/ui/controls/NotificationBar.java
@@ -4,24 +4,27 @@ import javafx.beans.property.BooleanProperty;
 import javafx.beans.property.SimpleBooleanProperty;
 import javafx.fxml.FXML;
 import javafx.geometry.Pos;
+import javafx.scene.AccessibleRole;
 import javafx.scene.control.Button;
+import javafx.scene.control.ContentDisplay;
 import javafx.scene.control.Label;
 import javafx.scene.layout.HBox;
 import javafx.scene.layout.Region;
 import javafx.scene.layout.VBox;
+import java.util.ResourceBundle;

-public class NotificationBar extends HBox {
+public class InfoBar extends HBox {

 	@FXML
-	private Label notificationLabel;
+	private Label infoMessage;

 	private final BooleanProperty dismissable = new SimpleBooleanProperty();
 	private final BooleanProperty notify = new SimpleBooleanProperty();


-	public NotificationBar() {
+	public InfoBar() {
 		setAlignment(Pos.CENTER);
-		setStyle("-fx-alignment: center;");
+		getStyleClass().addAll("info-bar");

 		Region spacer = new Region();
 		spacer.setMinWidth(40);
@@ -36,14 +39,21 @@ public class NotificationBar extends HBox {
 		vbox.setAlignment(Pos.CENTER);
 		HBox.setHgrow(vbox, javafx.scene.layout.Priority.ALWAYS);

-		notificationLabel = new Label();
-		notificationLabel.getStyleClass().add("notification-label");
-		notificationLabel.setStyle("-fx-alignment: center;");
-		vbox.getChildren().add(notificationLabel);
+		infoMessage = new Label();
+		infoMessage.setFocusTraversable(true);
+		infoMessage.setAccessibleRole(AccessibleRole.BUTTON);
+		vbox.getChildren().add(infoMessage);

-		Button closeButton = new Button("X");
+		var closeGraphic = new FontAwesome5IconView();
+		closeGraphic.setGlyph(FontAwesome5Icon.TIMES);
+		closeGraphic.setGlyphSize(12);
+		closeGraphic.getStyleClass().add("glyph");
+
+		Button closeButton = new Button();
+		closeButton.setGraphic(closeGraphic);
+		closeButton.setContentDisplay(ContentDisplay.GRAPHIC_ONLY);
+		closeButton.setAccessibleText(ResourceBundle.getBundle("i18n.strings").getString("main.notification.closeButton.tooltip"));
 		closeButton.setMinWidth(40);
-		closeButton.setStyle("-fx-background-color: transparent; -fx-text-fill: white; -fx-font-weight: bold;");
 		closeButton.visibleProperty().bind(dismissable);

 		closeButton.setOnAction(_ -> {
@@ -61,11 +71,11 @@ public class NotificationBar extends HBox {
 	}

 	public String getText() {
-		return notificationLabel.getText();
+		return infoMessage.getText();
 	}

 	public void setText(String text) {
-		notificationLabel.setText(text);
+		infoMessage.setText(text);
 	}

 	public void setStyleClass(String styleClass) {
--- a/src/main/java/org/cryptomator/ui/dialogs/Dialogs.java
+++ b/src/main/java/org/cryptomator/ui/dialogs/Dialogs.java
@@ -61,6 +61,15 @@ public class Dialogs {
 				.setOkButtonKey(BUTTON_KEY_CLOSE);
 	}

+	public SimpleDialog.Builder prepareHubVaultArchived(Stage window, Vault vault) {
+		return createDialogBuilder().setOwner(window) //
+				.setTitleKey("unlock.title", vault.getDisplayName()) //
+				.setMessageKey("hub.archived.message") //
+				.setDescriptionKey("hub.archived.description") //
+				.setIcon(FontAwesome5Icon.BAN)//
+				.setOkButtonKey(BUTTON_KEY_CLOSE);
+	}
+
 	public SimpleDialog.Builder prepareRecoveryVaultAdded(Stage window, String displayName) {
 		return createDialogBuilder().setOwner(window) //
 				.setTitleKey("recover.existing.title") //
--- a/src/main/java/org/cryptomator/ui/fxapp/FxApplicationModule.java
+++ b/src/main/java/org/cryptomator/ui/fxapp/FxApplicationModule.java
@@ -7,6 +7,7 @@ package org.cryptomator.ui.fxapp;

 import dagger.Module;
 import dagger.Provides;
+import org.cryptomator.integrations.uiappearance.UiAppearanceProvider;
 import org.cryptomator.ui.decryptname.DecryptNameComponent;
 import org.cryptomator.ui.error.ErrorComponent;
 import org.cryptomator.ui.eventview.EventViewComponent;
@@ -26,6 +27,7 @@ import org.cryptomator.ui.vaultoptions.VaultOptionsComponent;
 import javafx.scene.image.Image;
 import java.io.IOException;
 import java.io.InputStream;
+import java.util.Optional;

@Module(subcomponents = {TrayMenuComponent.class, //
 		DecryptNameComponent.class, //
@@ -41,7 +43,7 @@ import java.io.InputStream;
 		ShareVaultComponent.class, //
 		EventViewComponent.class, //
 		RecoveryKeyComponent.class, //
-		NotificationComponent.class })
+		NotificationComponent.class})
 abstract class FxApplicationModule {

 	private static Image createImageFromResource(String resourceName) throws IOException {
@@ -50,6 +52,12 @@ abstract class FxApplicationModule {
 		}
 	}

+	@Provides
+	@FxApplicationScoped
+	static Optional<UiAppearanceProvider> provideAppearanceProvider() {
+		return UiAppearanceProvider.get();
+	}
+
 	@Provides
 	@FxApplicationScoped
 	static TrayMenuComponent provideTrayMenuComponent(TrayMenuComponent.Builder builder) {
--- a/src/main/java/org/cryptomator/ui/fxapp/FxApplicationStyle.java
+++ b/src/main/java/org/cryptomator/ui/fxapp/FxApplicationStyle.java
@@ -36,82 +36,91 @@ public class FxApplicationStyle {
 	}

 	public void initialize() {
+		var uiTheme = settings.theme.get();
+		if (uiTheme == UiTheme.AUTOMATIC) {
+			registerOsThemeListener();
+		}
+		applyTheme(uiTheme);
 		settings.theme.addListener(this::appThemeChanged);
-		loadSelectedStyleSheet(settings.theme.get());
 	}

-	private void appThemeChanged(@SuppressWarnings("unused") ObservableValue<? extends UiTheme> observable, @SuppressWarnings("unused") UiTheme oldValue, UiTheme newValue) {
-		if (appearanceProvider.isPresent() && oldValue == UiTheme.AUTOMATIC && newValue != UiTheme.AUTOMATIC) {
+	private void appThemeChanged(@SuppressWarnings("unused") ObservableValue<? extends UiTheme> observable, UiTheme oldValue, UiTheme newValue) {
+		if (oldValue == newValue) {
+			// no-op
+		} else if (newValue == UiTheme.AUTOMATIC) {
+			registerOsThemeListener();
+		} else if (oldValue == UiTheme.AUTOMATIC) {
+			removeOsThemeListener();
+		}
+
+		applyTheme(newValue);
+	}
+
+	private void removeOsThemeListener() {
+		if (appearanceProvider.isPresent()) {
 			try {
 				appearanceProvider.get().removeListener(systemInterfaceThemeListener);
 			} catch (UiAppearanceException e) {
-				LOG.error("Failed to disable automatic theme switching.");
-			}
-		}
-		loadSelectedStyleSheet(newValue);
-	}
-
-	private void loadSelectedStyleSheet(UiTheme desiredTheme) {
-		UiTheme theme = licenseHolder.isValidLicense() ? desiredTheme : UiTheme.LIGHT;
-		switch (theme) {
-			case LIGHT -> applyLightTheme();
-			case DARK -> applyDarkTheme();
-			case AUTOMATIC -> {
-				appearanceProvider.ifPresent(provider -> {
-					try {
-						provider.addListener(systemInterfaceThemeListener);
-					} catch (UiAppearanceException e) {
-						LOG.error("Failed to enable automatic theme switching.");
-					}
-				});
-				applySystemTheme();
+				LOG.warn("Failed to disable automatic theme switching.", e);
 			}
+		} else {
+			LOG.debug("Unable to remove listener os theme changes: No supported UiAppearanceProvider present");
 		}
 	}

-	private void systemInterfaceThemeChanged(Theme theme) {
-		switch (theme) {
-			case LIGHT -> applyLightTheme();
-			case DARK -> applyDarkTheme();
-		}
-	}
-
-	private void applySystemTheme() {
+	private void registerOsThemeListener() {
 		if (appearanceProvider.isPresent()) {
-			systemInterfaceThemeChanged(appearanceProvider.get().getSystemTheme());
+			try {
+				appearanceProvider.get().addListener(systemInterfaceThemeListener);
+			} catch (UiAppearanceException e) {
+				LOG.warn("Failed to enable automatic theme switching.", e);
+			}
 		} else {
-			LOG.warn("No UiAppearanceProvider present, assuming LIGHT theme...");
-			applyLightTheme();
+			LOG.warn("Unable to register for os theme changes: No supported UiAppearanceProvider present");
 		}
 	}

-	private void applyLightTheme() {
-		var stylesheet = Optional //
-				.ofNullable(getClass().getResource("/css/light_theme.bss")) //
-				.orElse(getClass().getResource("/css/light_theme.css"));
+	private void applyTheme(UiTheme uiTheme) {
+		if (!licenseHolder.isValidLicense()) {
+			loadAndApplyLightTheme();
+		} else {
+			switch (uiTheme) {
+				case AUTOMATIC -> {
+					var osTheme = appearanceProvider.map(UiAppearanceProvider::getSystemTheme).orElse(Theme.LIGHT);
+					systemInterfaceThemeChanged(osTheme);
+				}
+				case LIGHT -> loadAndApplyLightTheme();
+				case DARK -> loadAndApplyDarkTheme();
+			}
+		}
+	}
+
+	private void systemInterfaceThemeChanged(Theme osTheme) {
+		switch (osTheme) {
+			case LIGHT -> loadAndApplyLightTheme();
+			case DARK -> loadAndApplyDarkTheme();
+		}
+	}
+
+	private void loadAndApplyLightTheme() {
+		loadAndApplyTheme(Theme.LIGHT, "/css/light_theme.css");
+	}
+
+	private void loadAndApplyDarkTheme() {
+		loadAndApplyTheme(Theme.DARK, "/css/dark_theme.css");
+	}
+
+	private void loadAndApplyTheme(Theme appTheme, String cssFile) {
+		var stylesheet = getClass().getResource(cssFile);
 		if (stylesheet == null) {
-			LOG.warn("Failed to load light_theme stylesheet");
-		} else {
-			Application.setUserAgentStylesheet(stylesheet.toString());
-			appearanceProvider.ifPresent(provider -> provider.adjustToTheme(Theme.LIGHT));
-			appliedTheme.set(Theme.LIGHT);
+			throw new IllegalStateException("Cannot find resource %s".formatted(cssFile));
 		}
+		Application.setUserAgentStylesheet(stylesheet.toString());
+		appearanceProvider.ifPresent(provider -> provider.adjustToTheme(appTheme));
+		appliedTheme.set(appTheme);
 	}

-	private void applyDarkTheme() {
-		var stylesheet = Optional //
-				.ofNullable(getClass().getResource("/css/dark_theme.bss")) //
-				.orElse(getClass().getResource("/css/dark_theme.css"));
-		if (stylesheet == null) {
-			LOG.warn("Failed to load dark_theme stylesheet");
-		} else {
-			Application.setUserAgentStylesheet(stylesheet.toString());
-			appearanceProvider.ifPresent(provider -> provider.adjustToTheme(Theme.DARK));
-			appliedTheme.set(Theme.DARK);
-		}
-	}
-
-	public ObjectProperty<Theme> appliedThemeProperty() {
+	public ObjectProperty<Theme> appliedAppThemeProperty() {
 		return appliedTheme;
 	}
 }
--- a/src/main/java/org/cryptomator/ui/fxapp/FxFSEventList.java
+++ b/src/main/java/org/cryptomator/ui/fxapp/FxFSEventList.java
@@ -3,6 +3,8 @@ package org.cryptomator.ui.fxapp;
 import org.cryptomator.event.FSEventBucket;
 import org.cryptomator.event.FSEventBucketContent;
 import org.cryptomator.event.FileSystemEventAggregator;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;

 import javax.inject.Inject;
 import javafx.application.Platform;
@@ -11,6 +13,7 @@ import javafx.beans.property.SimpleBooleanProperty;
 import javafx.collections.FXCollections;
 import javafx.collections.ObservableList;
 import java.util.Map;
+import java.util.concurrent.RejectedExecutionException;
 import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;

@@ -23,6 +26,8 @@ import java.util.concurrent.TimeUnit;
@FxApplicationScoped
 public class FxFSEventList {

+	private static final Logger LOG = LoggerFactory.getLogger(FxFSEventList.class);
+
 	private final ObservableList<Map.Entry<FSEventBucket, FSEventBucketContent>> events;
 	private final FileSystemEventAggregator eventAggregator;
 	private final ScheduledExecutorService scheduler;
@@ -37,7 +42,13 @@ public class FxFSEventList {
 	}

 	public void schedulePollForUpdates() {
-		scheduler.schedule(this::checkForEventUpdates, 1000, TimeUnit.MILLISECONDS);
+		try {
+			scheduler.schedule(this::checkForEventUpdates, 1000, TimeUnit.MILLISECONDS);
+		} catch ( RejectedExecutionException e) {
+			if(!scheduler.isShutdown()) {
+				LOG.warn("Failed to poll for filesystem events", e);
+			}
+		}
 	}

 	/**
--- a/src/main/java/org/cryptomator/ui/fxapp/JfxUiAppearanceProvider.java
+++ b/src/main/java/org/cryptomator/ui/fxapp/JfxUiAppearanceProvider.java
@@ -0,0 +1,68 @@
+package org.cryptomator.ui.fxapp;
+
+import org.cryptomator.integrations.common.DisplayName;
+import org.cryptomator.integrations.common.OperatingSystem;
+import org.cryptomator.integrations.common.Priority;
+import org.cryptomator.integrations.uiappearance.Theme;
+import org.cryptomator.integrations.uiappearance.UiAppearanceException;
+import org.cryptomator.integrations.uiappearance.UiAppearanceListener;
+import org.cryptomator.integrations.uiappearance.UiAppearanceProvider;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javafx.application.ColorScheme;
+import javafx.application.Platform;
+import javafx.beans.value.ChangeListener;
+import java.util.concurrent.ConcurrentHashMap;
+
+@DisplayName("JavaFX Color Scheme switcher")
+@OperatingSystem(OperatingSystem.Value.LINUX)
+@OperatingSystem(OperatingSystem.Value.WINDOWS)
+@Priority(1050)
+public class JfxUiAppearanceProvider implements UiAppearanceProvider {
+
+	private static final Logger LOG = LoggerFactory.getLogger(JfxUiAppearanceProvider.class);
+
+	private final ConcurrentHashMap<UiAppearanceListener, ChangeListener<ColorScheme>> uiAppearanceListeners = new ConcurrentHashMap<>();
+	private final Platform.Preferences preferences = Platform.getPreferences(); //Note: this service impl MUST be loaded in the fx application thread
+
+	@Override
+	public Theme getSystemTheme() {
+		return switch (preferences.getColorScheme()) {
+			case DARK -> Theme.DARK;
+			case LIGHT -> Theme.LIGHT;
+		};
+	}
+
+	@Override
+	public void adjustToTheme(Theme theme) {
+		//no-op
+	}
+
+	@Override
+	public void addListener(UiAppearanceListener uiAppearanceListener) throws UiAppearanceException {
+		var fxChangeListener = (ChangeListener<ColorScheme>) (_, _, newScheme) -> {
+			var newTheme = switch (newScheme) {
+				case DARK -> Theme.DARK;
+				case LIGHT -> Theme.LIGHT;
+			};
+			uiAppearanceListener.systemAppearanceChanged(newTheme);
+		};
+		LOG.debug("Register listener for OS theme changes");
+		uiAppearanceListeners.computeIfAbsent(uiAppearanceListener, k -> {
+			Platform.runLater(() -> preferences.colorSchemeProperty().addListener(fxChangeListener));
+			return fxChangeListener;
+		});
+	}
+
+	@Override
+	public void removeListener(UiAppearanceListener uiAppearanceListener) throws UiAppearanceException {
+		var fxChangeListener = uiAppearanceListeners.remove(uiAppearanceListener);
+		if (fxChangeListener != null) {
+			LOG.debug("Removing listener for OS theme changes");
+			Platform.runLater(() -> preferences.colorSchemeProperty().removeListener(fxChangeListener));
+		}
+	}
+}
+
+
--- a/src/main/java/org/cryptomator/ui/keyloading/hub/ReceiveKeyController.java
+++ b/src/main/java/org/cryptomator/ui/keyloading/hub/ReceiveKeyController.java
@@ -11,6 +11,7 @@ import org.cryptomator.common.vaults.Vault;
 import org.cryptomator.ui.common.FxController;
 import org.cryptomator.ui.common.FxmlFile;
 import org.cryptomator.ui.common.FxmlScene;
+import org.cryptomator.ui.dialogs.Dialogs;
 import org.cryptomator.ui.keyloading.KeyLoading;
 import org.cryptomator.ui.keyloading.KeyLoadingScoped;
 import org.slf4j.Logger;
@@ -58,6 +59,8 @@ public class ReceiveKeyController implements FxController {
 	private final Lazy<Scene> accountInitializationScene;
 	private final Lazy<Scene> invalidLicenseScene;
 	private final HttpClient httpClient;
+	private final Dialogs dialogs;
+	private final Vault vault;

 	@Inject
 	public ReceiveKeyController(@KeyLoading Vault vault, //
@@ -72,7 +75,8 @@ public class ReceiveKeyController implements FxController {
 								@FxmlScene(FxmlFile.HUB_LEGACY_REGISTER_DEVICE) Lazy<Scene> legacyRegisterDeviceScene, //
 								@FxmlScene(FxmlFile.HUB_UNAUTHORIZED_DEVICE) Lazy<Scene> unauthorizedScene, //
 								@FxmlScene(FxmlFile.HUB_REQUIRE_ACCOUNT_INIT) Lazy<Scene> accountInitializationScene, //
-								@FxmlScene(FxmlFile.HUB_INVALID_LICENSE) Lazy<Scene> invalidLicenseScene) {
+								@FxmlScene(FxmlFile.HUB_INVALID_LICENSE) Lazy<Scene> invalidLicenseScene, //
+								Dialogs dialogs) {
 		this.window = window;
 		this.hubConfig = hubConfig;
 		this.vaultId = extractVaultId(vault.getVaultConfigCache().getUnchecked().getKeyId()); // TODO: access vault config's JTI directly (requires changes in cryptofs)
@@ -87,6 +91,8 @@ public class ReceiveKeyController implements FxController {
 		this.invalidLicenseScene = invalidLicenseScene;
 		this.window.addEventHandler(WindowEvent.WINDOW_HIDING, this::windowClosed);
 		this.httpClient = HttpClient.newBuilder().version(HttpClient.Version.HTTP_1_1).executor(executor).build();
+		this.dialogs = dialogs;
+		this.vault = vault;
 	}

 	@FXML
@@ -226,7 +232,8 @@ public class ReceiveKeyController implements FxController {
 		switch (response.statusCode()) {
 			case 200 -> receivedBothEncryptedKeys(response.body(), encryptedUserKey);
 			case 402 -> licenseExceeded();
-			case 403, 410 -> accessNotGranted(); // or vault has been archived, effectively disallowing access - TODO: add specific dialog?
+			case 403 -> accessNotGranted();
+			case 410 -> accessGoneVaultArchived();
 			case 449 -> accountInitializationRequired();
 			default -> throw new IllegalStateException("Unexpected response " + response.statusCode());
 		}
@@ -270,7 +277,8 @@ public class ReceiveKeyController implements FxController {
 			switch (response.statusCode()) {
 				case 200 -> receivedLegacyAccessTokenSuccess(response.body());
 				case 402 -> licenseExceeded();
-				case 403, 410 -> accessNotGranted(); // or vault has been archived, effectively disallowing access
+				case 403 -> accessNotGranted();
+				case 410 -> accessGoneVaultArchived();
 				case 404 -> needsLegacyDeviceRegistration();
 				default -> throw new IOException("Unexpected response " + response.statusCode());
 			}
@@ -303,6 +311,11 @@ public class ReceiveKeyController implements FxController {
 		window.setScene(unauthorizedScene.get());
 	}

+	private void accessGoneVaultArchived() {
+		window.close();
+		dialogs.prepareHubVaultArchived((Stage)window.getOwner(), vault).build().showAndWait();
+	}
+
 	private void accountInitializationRequired() {
 		window.setScene(accountInitializationScene.get());
 	}
--- a/src/main/java/org/cryptomator/ui/mainwindow/VaultListCellController.java
+++ b/src/main/java/org/cryptomator/ui/mainwindow/VaultListCellController.java
@@ -16,6 +16,7 @@ import javafx.beans.value.ObservableValue;
 import javafx.fxml.FXML;
 import javafx.geometry.Insets;
 import javafx.scene.layout.HBox;
+import java.util.ResourceBundle;

 // unscoped because each cell needs its own controller
 public class VaultListCellController implements FxController {
@@ -23,9 +24,12 @@ public class VaultListCellController implements FxController {
 	private static final Insets COMPACT_INSETS = new Insets(6, 12, 6, 12);
 	private static final Insets DEFAULT_INSETS = new Insets(12);

+	private final ResourceBundle resourceBundle;
 	private final ObjectProperty<Vault> vault = new SimpleObjectProperty<>();
+	private final ObservableValue<VaultState.Value> vaultState;
 	private final ObservableValue<FontAwesome5Icon> glyph;
 	private final ObservableValue<Boolean> compactMode;
+	private final ObservableValue<String> accessibleText;

 	private AutoAnimator spinAnimation;

@@ -35,17 +39,21 @@ public class VaultListCellController implements FxController {
 	public HBox vaultListCell;

 	@Inject
-	VaultListCellController(Settings settings) {
-		this.glyph = vault.flatMap(Vault::stateProperty).map(this::getGlyphForVaultState);
+	VaultListCellController(Settings settings, ResourceBundle resourceBundle) {
+		this.resourceBundle = resourceBundle;
+		this.vaultState = vault.flatMap(Vault::stateProperty);
+		this.glyph = vaultState.map(this::getGlyphForVaultState);
+		this.accessibleText = vaultState.map(this::getAccessibleTextForVaultState);
 		this.compactMode = settings.compactMode;
 	}

 	public void initialize() {
 		this.spinAnimation = AutoAnimator.animate(Animations.createDiscrete360Rotation(vaultStateView)) //
-				.onCondition(vault.flatMap(Vault::stateProperty).map(VaultState.Value.PROCESSING::equals).orElse(false)) //
+				.onCondition(vaultState.map(VaultState.Value.PROCESSING::equals).orElse(false)) //
 				.afterStop(() -> vaultStateView.setRotate(0)) //
 				.build();
 		this.vaultListCell.paddingProperty().bind(compactMode.map(c -> c ? COMPACT_INSETS : DEFAULT_INSETS));
+		this.vaultListCell.accessibleTextProperty().bind(accessibleText);
 	}

 	// TODO deduplicate w/ VaultDetailController
@@ -62,6 +70,25 @@ public class VaultListCellController implements FxController {
 		}
 	}

+	private String getAccessibleTextForVaultState(VaultState.Value state) {
+		var v = vault.get();
+		if (state != null && v != null) {
+			var translationKey = switch (state) {
+				case LOCKED -> "vault.state.locked";
+				case PROCESSING -> "vault.state.processing";
+				case UNLOCKED -> "vault.state.unlocked";
+				case NEEDS_MIGRATION -> "vault.state.migrationNeeded";
+				case MISSING -> "vault.state.missing";
+				case VAULT_CONFIG_MISSING, ALL_MISSING, ERROR -> "vault.state.error";
+			};
+
+			var localizedState = resourceBundle.getString(translationKey);
+			return resourceBundle.getString("main.vaultlist.listEntry").formatted(v.getDisplayName(), localizedState);
+		} else {
+			return "";
+		}
+	}
+
 	/* Getter/Setter */

 	public ObservableValue<FontAwesome5Icon> glyphProperty() {
--- a/src/main/java/org/cryptomator/ui/notification/NotificationController.java
+++ b/src/main/java/org/cryptomator/ui/notification/NotificationController.java
@@ -101,15 +101,10 @@ public class NotificationController implements FxController {
 				var device = userAndDevice.length == 1 ? userAndDevice[0] : userAndDevice[1];
 				var cleartextFileName = fiiue.cleartextPath().substring(fiiue.cleartextPath().lastIndexOf('/') + 1);
 				eventTimestamp.set(localizedTimeFormatter.format(fiiue.lastUpdated()));
-				message.set("File is locked by another device");
-				fileName.set(cleartextFileName);
-				description.set("The file is opened by %s on device %s. Ask the user to close the file and sync again. Otherwise, you can ignore the lock and open it anyway.".formatted(user, device));
-				actionText.set("Ignore Lock");
-				/* TODO: Once feature is out of beta, activate translations
 				message.set(resourceBundle.getString("notification.inUse.message"));
-				description.set(resourceBundle.getString("notification.inUse.description").formatted(fiiue.cleartextPath(), user, device));
+				fileName.set(cleartextFileName);
+				description.set(resourceBundle.getString("notification.inUse.description").formatted(user, device));
 				actionText.set(resourceBundle.getString("notification.inUse.action"));
-				 */
 			}
 			default -> {
 				message.set("NO CONTENT");
--- a/src/main/java/org/cryptomator/ui/preferences/GeneralPreferencesController.java
+++ b/src/main/java/org/cryptomator/ui/preferences/GeneralPreferencesController.java
@@ -101,8 +101,9 @@ public class GeneralPreferencesController implements FxController {
 	}

 	private void migrateKeychainEntries(Observable observable, KeychainAccessProvider oldProvider, KeychainAccessProvider newProvider) {
-		//currently, we only migrate on macOS (touchID vs regular keychain)
-		if (SystemUtils.IS_OS_MAC) {
+		//currently, we migrate on macOS (touchID vs regular keychain)
+		//and on Linux (GNOME Keyring / KDE Wallet / Secret Service)
+		if (SystemUtils.IS_OS_MAC || SystemUtils.IS_OS_LINUX) {
 			var idsAndNames = settings.directories.stream().collect(Collectors.toMap(vs -> vs.id, vs -> vs.displayName.getValue()));
 			if (!idsAndNames.isEmpty()) {
 				if (LOG.isDebugEnabled()) {
--- a/src/main/java/org/cryptomator/ui/preferences/InterfacePreferencesController.java
+++ b/src/main/java/org/cryptomator/ui/preferences/InterfacePreferencesController.java
@@ -56,7 +56,7 @@ public class InterfacePreferencesController implements FxController {

 	@FXML
 	public void initialize() {
-		themeChoiceBox.getItems().addAll(UiTheme.applicableValues());
+		themeChoiceBox.getItems().addAll(UiTheme.values());
 		if (!themeChoiceBox.getItems().contains(settings.theme.get())) {
 			settings.theme.set(UiTheme.LIGHT);
 		}
--- a/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyCreationController.java
+++ b/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyCreationController.java
@@ -104,7 +104,7 @@ public class RecoveryKeyCreationController implements FxController {
 			descriptionLabel.formatProperty().set(resourceBundle.getString("recoveryKey.recover.description"));
 			cancelButton.setOnAction((_) -> back());
 			cancelButton.setText(resourceBundle.getString("generic.button.back"));
-			nextButton.setOnAction((_) -> restoreWithPassword());
+			nextButton.setOnAction((_) -> restoreWithPasswordAsync());
 		}
 	}

@@ -137,11 +137,47 @@ public class RecoveryKeyCreationController implements FxController {
 	}

 	@FXML
-	public void restoreWithPassword() {
+	public void restoreWithPasswordAsync() {
+		Task<Void> task = RecoveryKeyTasks.createTask(this::restoreWithPassword);

+		task.setOnScheduled(_ -> {
+			LOG.debug("Restoring vault configuration with password for {}.", vault.getDisplayablePath());
+		});
+
+		task.setOnSucceeded(_ -> {
+			LOG.debug("Restored vault configuration for {}.", vault.getDisplayablePath());
+			try {
+				if (!vaultListManager.isAlreadyAdded(vault.getPath())) {
+					vaultListManager.add(vault.getPath());
+				}
+				window.close();
+				dialogs.prepareRecoverPasswordSuccess((Stage) window.getOwner()) //
+						.setTitleKey("recover.recoverVaultConfig.title") //
+						.setMessageKey("recoveryKey.recover.resetVaultConfigSuccess.message") //
+						.setDescriptionKey("recoveryKey.recover.resetMasterkeyFileSuccess.description")
+						.build().showAndWait();
+			} catch (IOException e) {
+				LOG.error("Failed to add vault to list.", e);
+				appWindows.showErrorWindow(e, window, null);
+			}
+		});
+
+		task.setOnFailed(_ -> {
+			if (task.getException() instanceof InvalidPassphraseException e) {
+				LOG.info("Password invalid", e);
+				Animations.createShakeWindowAnimation(window).play();
+			} else {
+				LOG.error("Recovery process failed.", task.getException());
+				appWindows.showErrorWindow(task.getException(), window, null);
+			}
+		});
+
+		executor.submit(task);
+	}
+
+	void restoreWithPassword() throws IOException, CryptoException {
 		try (RecoveryDirectory recoveryDirectory = RecoveryDirectory.create(vault.getPath())) {
 			Path recoveryPath = recoveryDirectory.getRecoveryPath();
-
 			Path masterkeyFilePath = vault.getPath().resolve(MASTERKEY_FILENAME);

 			try (Masterkey masterkey = MasterkeyService.load(masterkeyFileAccess, masterkeyFilePath, passwordField.getCharacters())) {
@@ -152,23 +188,6 @@ public class RecoveryKeyCreationController implements FxController {
 			}

 			recoveryDirectory.moveRecoveredFile(VAULTCONFIG_FILENAME);
-
-			if (!vaultListManager.isAlreadyAdded(vault.getPath())) {
-				vaultListManager.add(vault.getPath());
-			}
-			window.close();
-			dialogs.prepareRecoverPasswordSuccess((Stage)window.getOwner()) //
-					.setTitleKey("recover.recoverVaultConfig.title") //
-					.setMessageKey("recoveryKey.recover.resetVaultConfigSuccess.message") //
-					.setDescriptionKey("recoveryKey.recover.resetMasterkeyFileSuccess.description")
-					.build().showAndWait();
-
-		} catch (InvalidPassphraseException e) {
-			LOG.info("Password invalid", e);
-			Animations.createShakeWindowAnimation(window).play();
-		} catch (IOException | CryptoException | IllegalStateException e) {
-			LOG.error("Recovery process failed", e);
-			appWindows.showErrorWindow(e, window, null);
 		}
 	}

--- a/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyResetPasswordController.java
+++ b/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyResetPasswordController.java
@@ -117,14 +117,46 @@ public class RecoveryKeyResetPasswordController implements FxController {
 	@FXML
 	public void next() {
 		switch (recoverType.get()) {
-			case RESTORE_ALL -> restorePassword();
+			case RESTORE_ALL -> restorePasswordAsync();
 			case RESTORE_MASTERKEY, RESET_PASSWORD -> resetPassword();
 			default -> resetPassword(); // Fallback
 		}
 	}

 	@FXML
-	public void restorePassword() {
+	public void restorePasswordAsync() {
+		Task<Void> task = RecoveryKeyTasks.createTask(this::restorePassword);
+
+		task.setOnScheduled(_ -> {
+			LOG.debug("Restoring vault configuration for {}.", vault.getDisplayablePath());
+		});
+
+		task.setOnSucceeded(_ -> {
+			LOG.debug("Restored vault configuration for {}.", vault.getDisplayablePath());
+			try {
+				if (!vaultListManager.isAlreadyAdded(vault.getPath())) {
+					vaultListManager.add(vault.getPath());
+				}
+				window.close();
+				dialogs.prepareRecoverPasswordSuccess((Stage) window.getOwner()) //
+						.setTitleKey("recover.recoverVaultConfig.title") //
+						.setMessageKey("recoveryKey.recover.resetVaultConfigSuccess.message") //
+						.build().showAndWait();
+			} catch (IOException e) {
+				LOG.error("Failed to add vault to list.", e);
+				appWindows.showErrorWindow(e, window, null);
+			}
+		});
+
+		task.setOnFailed(_ -> {
+			LOG.error("Recovery process failed.", task.getException());
+			appWindows.showErrorWindow(task.getException(), window, null);
+		});
+
+		executor.submit(task);
+	}
+
+	void restorePassword() throws IOException, CryptoException {
 		try (RecoveryDirectory recoveryDirectory = RecoveryDirectory.create(vault.getPath())) {
 			Path recoveryPath = recoveryDirectory.getRecoveryPath();
 			MasterkeyService.recoverFromRecoveryKey(recoveryKey.get(), recoveryKeyFactory, recoveryPath, newPasswordController.passwordField.getCharacters());
@@ -135,19 +167,6 @@ public class RecoveryKeyResetPasswordController implements FxController {

 			recoveryDirectory.moveRecoveredFile(MASTERKEY_FILENAME);
 			recoveryDirectory.moveRecoveredFile(VAULTCONFIG_FILENAME);
-
-			if (!vaultListManager.isAlreadyAdded(vault.getPath())) {
-				vaultListManager.add(vault.getPath());
-			}
-			window.close();
-			dialogs.prepareRecoverPasswordSuccess((Stage)window.getOwner()) //
-					.setTitleKey("recover.recoverVaultConfig.title") //
-					.setMessageKey("recoveryKey.recover.resetVaultConfigSuccess.message") //
-					.build().showAndWait();
-
-		} catch (IOException | CryptoException e) {
-			LOG.error("Recovery process failed", e);
-			appWindows.showErrorWindow(e, window, null);
 		}
 	}

--- a/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyTasks.java
+++ b/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyTasks.java
@@ -0,0 +1,25 @@
+package org.cryptomator.ui.recoverykey;
+
+import javafx.concurrent.Task;
+
+final class RecoveryKeyTasks {
+
+	private RecoveryKeyTasks() {
+	}
+
+	@FunctionalInterface
+	interface TaskAction {
+		void run() throws Exception;
+	}
+
+	static Task<Void> createTask(TaskAction action) {
+		return new Task<Void>() {
+			@Override
+			protected Void call() throws Exception {
+				action.run();
+				return null;
+			}
+		};
+	}
+
+}
--- a/src/main/java/org/cryptomator/ui/vaultoptions/MasterkeyOptionsController.java
+++ b/src/main/java/org/cryptomator/ui/vaultoptions/MasterkeyOptionsController.java
@@ -9,11 +9,15 @@ import org.cryptomator.ui.forgetpassword.ForgetPasswordComponent;
 import org.cryptomator.ui.recoverykey.RecoveryKeyComponent;

 import javax.inject.Inject;
+import javafx.beans.property.BooleanProperty;
 import javafx.beans.property.SimpleBooleanProperty;
 import javafx.beans.property.SimpleObjectProperty;
 import javafx.beans.value.ObservableValue;
 import javafx.fxml.FXML;
 import javafx.stage.Stage;
+import java.nio.file.Files;
+
+import static org.cryptomator.common.Constants.MASTERKEY_FILENAME;

@VaultOptionsScoped
 public class MasterkeyOptionsController implements FxController {
@@ -25,6 +29,7 @@ public class MasterkeyOptionsController implements FxController {
 	private final ForgetPasswordComponent.Builder forgetPasswordWindow;
 	private final KeychainManager keychain;
 	private final ObservableValue<Boolean> passwordSaved;
+	private final BooleanProperty masterkeyFileAvailable;


 	@Inject
@@ -40,6 +45,7 @@ public class MasterkeyOptionsController implements FxController {
 		} else {
 			this.passwordSaved = new SimpleBooleanProperty(false);
 		}
+		this.masterkeyFileAvailable = new SimpleBooleanProperty(Files.exists(vault.getPath().resolve(MASTERKEY_FILENAME)));
 	}

 	@FXML
@@ -70,4 +76,12 @@ public class MasterkeyOptionsController implements FxController {
 	public boolean isPasswordSaved() {
 		return passwordSaved.getValue();
 	}
+
+	public BooleanProperty masterkeyFileAvailableProperty() {
+		return masterkeyFileAvailable;
+	}
+
+	public boolean isMasterkeyFileAvailable() {
+		return masterkeyFileAvailable.get();
+	}
 }
--- a/src/main/resources/css/dark_theme.css
+++ b/src/main/resources/css/dark_theme.css
@@ -50,6 +50,7 @@
 	GREEN_5: PRIMARY;
 	RED_5: #E74C3C;
 	ORANGE_5: #E67E22;
+	YELLOW_4: #C19F0E;
 	YELLOW_5: #F1C40F;

 	MAIN_BG: GRAY_1;
@@ -387,37 +388,62 @@

 /*******************************************************************************
 *                                                                             *
- * NotificationBar                                                             *
+ * InfoBar                                                                     *
 *                                                                             *
 ******************************************************************************/
+.info-bar {
+	-fx-alignment: center;
+	-fx-min-height:24px;
+	-fx-max-height:24px;
+	-fx-background-color: -bar-bg;
+}

-.notification-label {
-	-fx-text-fill: white;
+.info-bar--green {
+	-bar-bg: GREEN_5;
+	-button-bg: GREEN_5;
+	-button-bg-pressed: GREEN_3;
+}
+
+.info-bar--yellow {
+	-bar-bg: YELLOW_5;
+	-button-bg: YELLOW_5;
+	-button-bg-pressed: YELLOW_4;
+}
+
+.info-bar--red {
+	-bar-bg: RED_5;
+	-button-bg: RED_5;
+	-button-bg-pressed: RED_5;
+}
+
+.info-bar .label {
+	-fx-text-fill: GRAY_9;
 	-fx-font-weight: bold;
 }

-.notification-debug {
-	-fx-min-height:24px;
-	-fx-max-height:24px;
-	-fx-background-color: RED_5;
+.info-bar--yellow .label {
+	-fx-text-fill: GRAY_9;
+	-fx-font-weight: bold;
+	-fx-effect: dropshadow( gaussian , rgba(0,0,0,0.45) , 2 , 0 , 0 , 1 );
 }

-.notification-update {
-	-fx-min-height:24px;
-	-fx-max-height:24px;
-	-fx-background-color: YELLOW_5;
+.info-bar .glyph {
+	-fx-fill: GRAY_9;
 }

-.notification-support {
-	-fx-min-height:24px;
-	-fx-max-height:24px;
-	-fx-background-color: PRIMARY;
+.info-bar:hover .label {
+	-fx-underline:true;
 }

-.notification-debug:hover .notification-label,
-.notification-update:hover .notification-label,
-.notification-support:hover .notification-label {
- 	-fx-underline:true;
+.info-bar .button {
+	-fx-background-color: transparent;
+	-fx-border-color: transparent;
+	-fx-padding: 2 2 2 2;
+}
+
+.info-bar .button:armed {
+	-fx-background-color: -button-bg-pressed;
+	-fx-background-radius: 8;
 }

 /*******************************************************************************
--- a/src/main/resources/css/light_theme.css
+++ b/src/main/resources/css/light_theme.css
@@ -50,6 +50,7 @@
 	GREEN_5: PRIMARY;
 	RED_5: #E74C3C;
 	ORANGE_5: #E67E22;
+	YELLOW_4: #C19F0E;
 	YELLOW_5: #F1C40F;

 	MAIN_BG: GRAY_9;
@@ -387,39 +388,64 @@

 /*******************************************************************************
 *                                                                             *
- * NotificationBar                                                             *
+ * InfoBar                                                                     *
 *                                                                             *
 ******************************************************************************/
+.info-bar {
+	-fx-alignment: center;
+	-fx-min-height:24px;
+	-fx-max-height:24px;
+	-fx-background-color: -bar-bg;
+}

-.notification-label {
-	-fx-text-fill: white;
+.info-bar--green {
+	-bar-bg: GREEN_5;
+	-button-bg: GREEN_5;
+	-button-bg-pressed: GREEN_3;
+}
+
+.info-bar--yellow {
+	-bar-bg: YELLOW_5;
+	-button-bg: YELLOW_5;
+	-button-bg-pressed: YELLOW_4;
+}
+
+.info-bar--red {
+	-bar-bg: RED_5;
+	-button-bg: RED_5;
+	-button-bg-pressed: RED_5;
+}
+
+.info-bar .label {
+	-fx-text-fill: GRAY_9;
 	-fx-font-weight: bold;
 }

-.notification-debug {
-	-fx-min-height:24px;
-	-fx-max-height:24px;
-	-fx-background-color: RED_5;
+.info-bar--yellow .label {
+	-fx-text-fill: GRAY_9;
+	-fx-font-weight: bold;
+	-fx-effect: dropshadow( gaussian , rgba(0,0,0,0.45) , 2 , 0 , 0 , 1 );
 }

-.notification-update {
-	-fx-min-height:24px;
-	-fx-max-height:24px;
-	-fx-background-color: YELLOW_5;
+.info-bar .glyph {
+	-fx-fill: GRAY_9;
 }

-.notification-support {
-	-fx-min-height:24px;
-	-fx-max-height:24px;
-	-fx-background-color: PRIMARY;
-}
-
-.notification-debug:hover .notification-label,
-.notification-update:hover .notification-label,
-.notification-support:hover .notification-label {
+.info-bar:hover .label {
 	-fx-underline:true;
 }

+.info-bar .button {
+	-fx-background-color: transparent;
+	-fx-border-color: transparent;
+	-fx-padding: 2 2 2 2;
+}
+
+.info-bar .button:armed {
+	-fx-background-color: -button-bg-pressed;
+	-fx-background-radius: 8;
+}
+
 /*******************************************************************************
 *                                                                             *
 * ScrollBar                                                                   *
--- a/src/main/resources/fxml/addvault_existing.fxml
+++ b/src/main/resources/fxml/addvault_existing.fxml
@@ -13,7 +13,8 @@
 	  prefWidth="450"
 	  prefHeight="450"
 	  spacing="24"
-	  alignment="CENTER">
+	  alignment="CENTER"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="24"/>
 	</padding>
--- a/src/main/resources/fxml/addvault_new_expert_settings.fxml
+++ b/src/main/resources/fxml/addvault_new_expert_settings.fxml
@@ -19,7 +19,8 @@
 	  prefWidth="450"
 	  prefHeight="450"
 	  spacing="12"
-	  alignment="CENTER_LEFT">
+	  alignment="CENTER_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="24"/>
 	</padding>
--- a/src/main/resources/fxml/addvault_new_location.fxml
+++ b/src/main/resources/fxml/addvault_new_location.fxml
@@ -19,7 +19,8 @@
 	  prefWidth="450"
 	  prefHeight="450"
 	  spacing="12"
-	  alignment="CENTER_LEFT">
+	  alignment="CENTER_LEFT"
+	  accessibleRole="DIALOG">
 	<fx:define>
 		<ToggleGroup fx:id="locationPresetsToggler"/>
 		<FontAwesome5IconView fx:id="badLocation" styleClass="glyph-icon-red" glyph="TIMES"/>
--- a/src/main/resources/fxml/addvault_new_name.fxml
+++ b/src/main/resources/fxml/addvault_new_name.fxml
@@ -17,7 +17,8 @@
 	  prefWidth="450"
 	  prefHeight="450"
 	  spacing="12"
-	  alignment="CENTER_LEFT">
+	  alignment="CENTER_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="24"/>
 	</padding>
--- a/src/main/resources/fxml/addvault_new_password.fxml
+++ b/src/main/resources/fxml/addvault_new_password.fxml
@@ -15,7 +15,8 @@
 	  prefWidth="450"
 	  prefHeight="450"
 	  spacing="12"
-	  alignment="CENTER_LEFT">
+	  alignment="CENTER_LEFT"
+	  accessibleRole="DIALOG">
 	<fx:define>
 		<ToggleGroup fx:id="recoveryKeyChoice"/>
 	</fx:define>
--- a/src/main/resources/fxml/addvault_new_recoverykey.fxml
+++ b/src/main/resources/fxml/addvault_new_recoverykey.fxml
@@ -11,7 +11,8 @@
 	  prefWidth="450"
 	  prefHeight="450"
 	  spacing="12"
-	  alignment="CENTER_LEFT">
+	  alignment="CENTER_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="24"/>
 	</padding>
--- a/src/main/resources/fxml/addvault_success.fxml
+++ b/src/main/resources/fxml/addvault_success.fxml
@@ -16,7 +16,8 @@
 	  prefWidth="450"
 	  prefHeight="450"
 	  spacing="12"
-	  alignment="TOP_CENTER">
+	  alignment="TOP_CENTER"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="24"/>
 	</padding>
--- a/src/main/resources/fxml/changepassword.fxml
+++ b/src/main/resources/fxml/changepassword.fxml
@@ -13,7 +13,8 @@
 	  fx:controller="org.cryptomator.ui.changepassword.ChangePasswordController"
 	  minWidth="400"
 	  maxWidth="400"
-	  spacing="12">
+	  spacing="12"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/convertvault_hubtopassword_convert.fxml
+++ b/src/main/resources/fxml/convertvault_hubtopassword_convert.fxml
@@ -18,7 +18,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_CENTER">
+	  alignment="TOP_CENTER"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/convertvault_hubtopassword_start.fxml
+++ b/src/main/resources/fxml/convertvault_hubtopassword_start.fxml
@@ -15,7 +15,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_CENTER">
+	  alignment="TOP_CENTER"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/convertvault_hubtopassword_success.fxml
+++ b/src/main/resources/fxml/convertvault_hubtopassword_success.fxml
@@ -19,7 +19,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/error.fxml
+++ b/src/main/resources/fxml/error.fxml
@@ -22,7 +22,8 @@
 	  minHeight="450"
 	  prefWidth="450"
 	  prefHeight="450"
-	  spacing="12">
+	  spacing="12"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="24"/>
 	</padding>
--- a/src/main/resources/fxml/hub_auth_flow.fxml
+++ b/src/main/resources/fxml/hub_auth_flow.fxml
@@ -21,7 +21,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/hub_invalid_license.fxml
+++ b/src/main/resources/fxml/hub_invalid_license.fxml
@@ -18,7 +18,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/hub_legacy_register_device.fxml
+++ b/src/main/resources/fxml/hub_legacy_register_device.fxml
@@ -20,7 +20,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/hub_legacy_register_success.fxml
+++ b/src/main/resources/fxml/hub_legacy_register_success.fxml
@@ -18,7 +18,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/hub_no_keychain.fxml
+++ b/src/main/resources/fxml/hub_no_keychain.fxml
@@ -20,7 +20,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/hub_receive_key.fxml
+++ b/src/main/resources/fxml/hub_receive_key.fxml
@@ -18,7 +18,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/hub_register_device.fxml
+++ b/src/main/resources/fxml/hub_register_device.fxml
@@ -20,7 +20,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/hub_register_device_already_exists.fxml
+++ b/src/main/resources/fxml/hub_register_device_already_exists.fxml
@@ -11,6 +11,7 @@
 <?import javafx.scene.layout.StackPane?>
 <?import javafx.scene.layout.VBox?>
 <?import javafx.scene.shape.Circle?>
+<!-- TODO: simple dialog -->
 <HBox xmlns:fx="http://javafx.com/fxml"
 	  xmlns="http://javafx.com/javafx"
 	  fx:controller="org.cryptomator.ui.keyloading.hub.RegisterFailedController"
@@ -18,7 +19,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/hub_register_failed.fxml
+++ b/src/main/resources/fxml/hub_register_failed.fxml
@@ -18,7 +18,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/hub_register_success.fxml
+++ b/src/main/resources/fxml/hub_register_success.fxml
@@ -18,7 +18,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/hub_require_account_init.fxml
+++ b/src/main/resources/fxml/hub_require_account_init.fxml
@@ -21,7 +21,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/hub_unauthorized_device.fxml
+++ b/src/main/resources/fxml/hub_unauthorized_device.fxml
@@ -18,7 +18,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/lock_failed.fxml
+++ b/src/main/resources/fxml/lock_failed.fxml
@@ -19,7 +19,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/lock_forced.fxml
+++ b/src/main/resources/fxml/lock_forced.fxml
@@ -19,7 +19,8 @@
 	  maxWidth="500"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/main_window.fxml
+++ b/src/main/resources/fxml/main_window.fxml
@@ -3,7 +3,7 @@
 <?import javafx.scene.control.SplitPane?>
 <?import javafx.scene.layout.StackPane?>
 <?import javafx.scene.layout.VBox?>
-<?import org.cryptomator.ui.controls.NotificationBar?>
+<?import org.cryptomator.ui.controls.InfoBar?>

 <StackPane xmlns:fx="http://javafx.com/fxml"
 		   xmlns="http://javafx.com/javafx"
@@ -11,23 +11,23 @@
 		   fx:controller="org.cryptomator.ui.mainwindow.MainWindowController"
 		   styleClass="main-window">
 	<VBox minWidth="600">
-		<NotificationBar onMouseClicked="#showUpdatePreferences"
+		<InfoBar onMouseClicked="#showUpdatePreferences"
 						 text="%main.notification.updateAvailable"
 						 dismissable="true"
 						 notify="${controller.updateAvailable}"
-						 styleClass="notification-update"/>
-		<NotificationBar onMouseClicked="#showContributePreferences"
+						 styleClass="info-bar--yellow"/>
+		<InfoBar onMouseClicked="#showContributePreferences"
 						 text="%main.notification.support"
 						 dismissable="true"
 						 notify="${!controller.licenseValid}"
-						 styleClass="notification-support"/>
+						 styleClass="info-bar--green"/>
 		<SplitPane dividerPositions="0.33" orientation="HORIZONTAL" VBox.vgrow="ALWAYS">
 			<fx:include source="vault_list.fxml" SplitPane.resizableWithParent="false"/>
 			<fx:include source="vault_detail.fxml" SplitPane.resizableWithParent="true"/>
 		</SplitPane>
-		<NotificationBar onMouseClicked="#showGeneralPreferences"
+		<InfoBar onMouseClicked="#showGeneralPreferences"
 						 text="DEBUG MODE"
-						 styleClass="notification-debug"
+						 styleClass="info-bar--red"
 						 notify="${controller.debugModeEnabled}"/>
 	</VBox>
 </StackPane>
--- a/src/main/resources/fxml/migration_capability_error.fxml
+++ b/src/main/resources/fxml/migration_capability_error.fxml
@@ -16,7 +16,8 @@
 	  minWidth="400"
 	  maxWidth="400"
 	  minHeight="145"
-	  spacing="12">
+	  spacing="12"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/migration_impossible.fxml
+++ b/src/main/resources/fxml/migration_impossible.fxml
@@ -19,7 +19,8 @@
 	  minWidth="400"
 	  maxWidth="400"
 	  minHeight="145"
-	  spacing="12">
+	  spacing="12"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/migration_start.fxml
+++ b/src/main/resources/fxml/migration_start.fxml
@@ -20,7 +20,8 @@
 	  fx:controller="org.cryptomator.ui.migration.MigrationStartController"
 	  prefWidth="580"
 	  prefHeight="350"
-	  spacing="12">
+	  spacing="12"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/migration_success.fxml
+++ b/src/main/resources/fxml/migration_success.fxml
@@ -15,7 +15,8 @@
 	  minWidth="400"
 	  maxWidth="400"
 	  minHeight="145"
-	  spacing="12">
+	  spacing="12"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/notification.fxml
+++ b/src/main/resources/fxml/notification.fxml
@@ -16,7 +16,8 @@
 			xmlns:fx="http://javafx.com/fxml"
 			fx:controller="org.cryptomator.ui.notification.NotificationController"
 			prefHeight="200.0" prefWidth="400.0" maxHeight="200.0" maxWidth="400.0"
-			styleClass="notification-window">
+			styleClass="notification-window"
+			accessibleRole="DIALOG">
 	<padding>
 		<Insets top="12" right="12" bottom="12" left="12"/>
 	</padding>
--- a/src/main/resources/fxml/quit.fxml
+++ b/src/main/resources/fxml/quit.fxml
@@ -19,7 +19,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/quit_forced.fxml
+++ b/src/main/resources/fxml/quit_forced.fxml
@@ -19,7 +19,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/recoverykey_create.fxml
+++ b/src/main/resources/fxml/recoverykey_create.fxml
@@ -20,7 +20,8 @@
 	  maxWidth="400"
 	  minHeight="175"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/recoverykey_display.fxml
+++ b/src/main/resources/fxml/recoverykey_display.fxml
@@ -14,7 +14,8 @@
 	  minWidth="350"
 	  minHeight="280"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<children>
 		<FormattedLabel format="%recoveryKey.display.description" arg1="${controller.vaultName}" wrapText="true" labelFor="$textarea"/>

--- a/src/main/resources/fxml/recoverykey_expert_settings.fxml
+++ b/src/main/resources/fxml/recoverykey_expert_settings.fxml
@@ -22,7 +22,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_CENTER">
+	  alignment="TOP_CENTER"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/recoverykey_onboarding.fxml
+++ b/src/main/resources/fxml/recoverykey_onboarding.fxml
@@ -25,7 +25,8 @@
 	  prefWidth="480"
 	  minHeight="242"
 	  spacing="12"
-	  VBox.vgrow="ALWAYS">
+	  VBox.vgrow="ALWAYS"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/recoverykey_recover.fxml
+++ b/src/main/resources/fxml/recoverykey_recover.fxml
@@ -17,7 +17,8 @@
 	  minWidth="400"
 	  maxWidth="400"
 	  minHeight="145"
-	  spacing="12">
+	  spacing="12"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/recoverykey_reset_password.fxml
+++ b/src/main/resources/fxml/recoverykey_reset_password.fxml
@@ -17,7 +17,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_CENTER">
+	  alignment="TOP_CENTER"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/recoverykey_success.fxml
+++ b/src/main/resources/fxml/recoverykey_success.fxml
@@ -12,7 +12,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_CENTER">
+	  alignment="TOP_CENTER"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/recoverykey_validate.fxml
+++ b/src/main/resources/fxml/recoverykey_validate.fxml
@@ -10,28 +10,29 @@
 	  fx:controller="org.cryptomator.ui.recoverykey.RecoveryKeyValidateController"
 	  maxWidth="400"
 	  minHeight="145"
-	  spacing="12">
+	  spacing="12"
+	  accessibleRole="DIALOG">
 	<children>
 		<FormattedLabel format="%recoveryKey.recover.prompt" arg1="${controller.vault.displayName}" wrapText="true" labelFor="$textarea"/>

 		<TextArea wrapText="true" prefRowCount="4" fx:id="textarea" textFormatter="${controller.recoveryKeyTextFormatter}" onKeyPressed="#onKeyPressed"/>
 		<VBox>
-			<Label text="Just some Filler" visible="false" managed="${textarea.text.empty}" graphicTextGap="6">
+			<Label text="%recoveryKey.recover.wrongKey" visible="false" managed="${textarea.text.empty}" graphicTextGap="6" wrapText="true" >
 				<graphic>
 					<FontAwesome5IconView glyph="ANCHOR"/>
 				</graphic>
 			</Label>
-			<Label text="%recoveryKey.recover.correctKey" graphicTextGap="6" visible="${(!textarea.text.empty) &amp;&amp; controller.recoveryKeyCorrect}" managed="${(!textarea.text.empty) &amp;&amp; controller.recoveryKeyCorrect}">
+			<Label text="%recoveryKey.recover.correctKey" graphicTextGap="6" wrapText="true" visible="${(!textarea.text.empty) &amp;&amp; controller.recoveryKeyCorrect}" managed="${(!textarea.text.empty) &amp;&amp; controller.recoveryKeyCorrect}">
 				<graphic>
 					<FontAwesome5IconView glyph="CHECK"/>
 				</graphic>
 			</Label>
-			<Label text="%recoveryKey.recover.wrongKey" graphicTextGap="6"  visible="${(!textarea.text.empty) &amp;&amp; controller.recoveryKeyWrong}" managed="${(!textarea.text.empty) &amp;&amp; controller.recoveryKeyWrong}">
+			<Label text="%recoveryKey.recover.wrongKey" graphicTextGap="6" wrapText="true" visible="${(!textarea.text.empty) &amp;&amp; controller.recoveryKeyWrong}" managed="${(!textarea.text.empty) &amp;&amp; controller.recoveryKeyWrong}">
 				<graphic>
 					<FontAwesome5IconView glyph="TIMES" styleClass="glyph-icon-red"/>
 				</graphic>
 			</Label>
-			<Label text="%recoveryKey.recover.invalidKey" graphicTextGap="6"  visible="${(!textarea.text.empty) &amp;&amp; controller.recoveryKeyInvalid}" managed="${(!textarea.text.empty) &amp;&amp; controller.recoveryKeyInvalid}">
+			<Label text="%recoveryKey.recover.invalidKey" graphicTextGap="6" wrapText="true" visible="${(!textarea.text.empty) &amp;&amp; controller.recoveryKeyInvalid}" managed="${(!textarea.text.empty) &amp;&amp; controller.recoveryKeyInvalid}">
 				<graphic>
 					<FontAwesome5IconView glyph="TIMES" styleClass="glyph-icon-red"/>
 				</graphic>
--- a/src/main/resources/fxml/share_vault.fxml
+++ b/src/main/resources/fxml/share_vault.fxml
@@ -21,7 +21,8 @@
 	  xmlns="http://javafx.com/javafx"
 	  fx:controller="org.cryptomator.ui.sharevault.ShareVaultController"
 	  prefWidth="540"
-	  spacing="12">
+	  spacing="12"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/simple_dialog.fxml
+++ b/src/main/resources/fxml/simple_dialog.fxml
@@ -17,7 +17,8 @@
 	  minWidth="400"
 	  maxWidth="400"
 	  minHeight="145"
-	  spacing="12">
+	  spacing="12"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/unlock_enter_password.fxml
+++ b/src/main/resources/fxml/unlock_enter_password.fxml
@@ -18,7 +18,8 @@
 	  minWidth="400"
 	  maxWidth="400"
 	  minHeight="145"
-	  spacing="12">
+	  spacing="12"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/src/main/resources/fxml/unlock_invalid_mount_point.fxml
+++ b/src/main/resources/fxml/unlock_invalid_mount_point.fxml
@@ -19,7 +19,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
--- a/Show More
+++ b/Show More