From 06726303fbdde252f62bbeb857aa5299984a7eb7 Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Mon, 12 Jan 2026 23:13:15 +0100
Subject: [PATCH 01/15] add proper accessibility text for vault list

---
 .../mainwindow/VaultListCellController.java   | 32 +++++++++++++++++--
 src/main/resources/fxml/vault_list.fxml       |  2 +-
 src/main/resources/i18n/strings.properties    | 10 ++++++
 3 files changed, 40 insertions(+), 4 deletions(-)

diff --git a/src/main/java/org/cryptomator/ui/mainwindow/VaultListCellController.java b/src/main/java/org/cryptomator/ui/mainwindow/VaultListCellController.java
index 9324c8c7b..2ff9cef6b 100644
--- a/src/main/java/org/cryptomator/ui/mainwindow/VaultListCellController.java
+++ b/src/main/java/org/cryptomator/ui/mainwindow/VaultListCellController.java
@@ -16,6 +16,7 @@ import javafx.beans.value.ObservableValue;
 import javafx.fxml.FXML;
 import javafx.geometry.Insets;
 import javafx.scene.layout.HBox;
+import java.util.ResourceBundle;
 
 // unscoped because each cell needs its own controller
 public class VaultListCellController implements FxController {
@@ -23,9 +24,12 @@ public class VaultListCellController implements FxController {
 	private static final Insets COMPACT_INSETS = new Insets(6, 12, 6, 12);
 	private static final Insets DEFAULT_INSETS = new Insets(12);
 
+	private final ResourceBundle resourceBundle;
 	private final ObjectProperty<Vault> vault = new SimpleObjectProperty<>();
+	private final ObservableValue<VaultState.Value> vaultState;
 	private final ObservableValue<FontAwesome5Icon> glyph;
 	private final ObservableValue<Boolean> compactMode;
+	private final ObservableValue<String> accessibleText;
 
 	private AutoAnimator spinAnimation;
 
@@ -35,17 +39,21 @@ public class VaultListCellController implements FxController {
 	public HBox vaultListCell;
 
 	@Inject
-	VaultListCellController(Settings settings) {
-		this.glyph = vault.flatMap(Vault::stateProperty).map(this::getGlyphForVaultState);
+	VaultListCellController(Settings settings, ResourceBundle resourceBundle) {
+		this.resourceBundle = resourceBundle;
+		this.vaultState = vault.flatMap(Vault::stateProperty);
+		this.glyph = vaultState.map(this::getGlyphForVaultState);
+		this.accessibleText = vaultState.map(this::getAccessibleTextForVaultState);
 		this.compactMode = settings.compactMode;
 	}
 
 	public void initialize() {
 		this.spinAnimation = AutoAnimator.animate(Animations.createDiscrete360Rotation(vaultStateView)) //
-				.onCondition(vault.flatMap(Vault::stateProperty).map(VaultState.Value.PROCESSING::equals).orElse(false)) //
+				.onCondition(vaultState.map(VaultState.Value.PROCESSING::equals).orElse(false)) //
 				.afterStop(() -> vaultStateView.setRotate(0)) //
 				.build();
 		this.vaultListCell.paddingProperty().bind(compactMode.map(c -> c ? COMPACT_INSETS : DEFAULT_INSETS));
+		this.vaultListCell.accessibleTextProperty().bind(accessibleText);
 	}
 
 	// TODO deduplicate w/ VaultDetailController
@@ -62,6 +70,24 @@ public class VaultListCellController implements FxController {
 		}
 	}
 
+	private String getAccessibleTextForVaultState(VaultState.Value state) {
+		if (state != null) {
+			var translationKey = switch (state) {
+				case LOCKED -> "vault.state.locked";
+				case PROCESSING -> "vault.state.processing";
+				case UNLOCKED -> "vault.state.unlocked";
+				case NEEDS_MIGRATION -> "vault.state.migrationNeeded";
+				case MISSING -> "vault.state.missing";
+				case VAULT_CONFIG_MISSING, ALL_MISSING, ERROR -> "vault.state.error";
+			};
+
+			var localizedState = resourceBundle.getString(translationKey);
+			return resourceBundle.getString("main.vaultlist.listEntry").formatted(vault.get().getDisplayName(), localizedState);
+		} else {
+			return "";
+		}
+	}
+
 	/* Getter/Setter */
 
 	public ObservableValue<FontAwesome5Icon> glyphProperty() {
diff --git a/src/main/resources/fxml/vault_list.fxml b/src/main/resources/fxml/vault_list.fxml
index a05d834a3..ca30d180e 100644
--- a/src/main/resources/fxml/vault_list.fxml
+++ b/src/main/resources/fxml/vault_list.fxml
@@ -22,7 +22,7 @@
 	<VBox>
 		<StackPane VBox.vgrow="ALWAYS">
 			<VBox>
-				<ListView fx:id="vaultList" editable="true" fixedCellSize="${controller.cellSize}">
+				<ListView fx:id="vaultList" editable="true" fixedCellSize="${controller.cellSize}" accessibleText="%main.vaultlist">
 					<contextMenu>
 						<fx:include source="vault_list_contextmenu.fxml"/>
 					</contextMenu>
diff --git a/src/main/resources/i18n/strings.properties b/src/main/resources/i18n/strings.properties
index 897fbd7da..b562da01c 100644
--- a/src/main/resources/i18n/strings.properties
+++ b/src/main/resources/i18n/strings.properties
@@ -18,6 +18,14 @@ generic.button.next=Next
 generic.button.print=Print
 generic.button.remove=Remove
 
+## Vault state
+vault.state.locked=Locked
+vault.state.unlocked=Unlocked
+vault.state.missing=Missing
+vault.state.migrationNeeded=Migration required
+vault.state.processing=Processing
+vault.state.error=Error
+
 # Error
 error.message=An error occurred
 error.description=Cryptomator didn't expect this to happen. You can look up existing solutions for this error. Or if it has not been reported yet, feel free to do so.
@@ -402,6 +410,8 @@ stats.access.total=Total accesses: %d
 
 # Main Window
 ## Vault List
+main.vaultlist=Vaults
+main.vaultlist.listEntry=Vault %s. %s
 main.vaultlist.emptyList.onboardingInstruction=Click here to add a vault
 main.vaultlist.contextMenu.remove=Remove…
 main.vaultlist.contextMenu.lock=Lock

From a50e372f05255d5c42dd0fa99d94758f8c927cc8 Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Mon, 12 Jan 2026 23:14:09 +0100
Subject: [PATCH 02/15] add correct accessible role to dialogs

---
 src/main/resources/fxml/lock_forced.fxml           | 3 ++-
 src/main/resources/fxml/quit.fxml                  | 3 ++-
 src/main/resources/fxml/simple_dialog.fxml         | 3 ++-
 src/main/resources/fxml/unlock_enter_password.fxml | 3 ++-
 src/main/resources/fxml/unlock_success.fxml        | 3 ++-
 5 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/src/main/resources/fxml/lock_forced.fxml b/src/main/resources/fxml/lock_forced.fxml
index 14f801fba..66cbf4148 100644
--- a/src/main/resources/fxml/lock_forced.fxml
+++ b/src/main/resources/fxml/lock_forced.fxml
@@ -19,7 +19,8 @@
 	  maxWidth="500"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/quit.fxml b/src/main/resources/fxml/quit.fxml
index f0d6ce9b6..c8694761d 100644
--- a/src/main/resources/fxml/quit.fxml
+++ b/src/main/resources/fxml/quit.fxml
@@ -19,7 +19,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/simple_dialog.fxml b/src/main/resources/fxml/simple_dialog.fxml
index 0e9b01776..383405018 100644
--- a/src/main/resources/fxml/simple_dialog.fxml
+++ b/src/main/resources/fxml/simple_dialog.fxml
@@ -17,7 +17,8 @@
 	  minWidth="400"
 	  maxWidth="400"
 	  minHeight="145"
-	  spacing="12">
+	  spacing="12"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/unlock_enter_password.fxml b/src/main/resources/fxml/unlock_enter_password.fxml
index 5242826a2..bcf1bfa37 100644
--- a/src/main/resources/fxml/unlock_enter_password.fxml
+++ b/src/main/resources/fxml/unlock_enter_password.fxml
@@ -18,7 +18,8 @@
 	  minWidth="400"
 	  maxWidth="400"
 	  minHeight="145"
-	  spacing="12">
+	  spacing="12"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/unlock_success.fxml b/src/main/resources/fxml/unlock_success.fxml
index ae1b8185e..029bb96d3 100644
--- a/src/main/resources/fxml/unlock_success.fxml
+++ b/src/main/resources/fxml/unlock_success.fxml
@@ -21,7 +21,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>

From a06accb80f5522f0f925c1bc409168010d93ae29 Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Mon, 12 Jan 2026 23:15:40 +0100
Subject: [PATCH 03/15] add accessibletext to vault storage location

---
 src/main/resources/fxml/vault_detail.fxml  | 2 +-
 src/main/resources/i18n/strings.properties | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/main/resources/fxml/vault_detail.fxml b/src/main/resources/fxml/vault_detail.fxml
index cfae48d8b..141933b94 100644
--- a/src/main/resources/fxml/vault_detail.fxml
+++ b/src/main/resources/fxml/vault_detail.fxml
@@ -36,7 +36,7 @@
 					<Label styleClass="badge,badge-pill,badge-muted" text="…" minWidth="-Infinity" visible="${controller.vault.processing}" managed="${controller.vault.processing}"/>
 					<Label styleClass="badge,badge-pill,badge-primary" text="%main.vaultDetail.unlockedStatus" minWidth="-Infinity" visible="${controller.vault.unlocked}" managed="${controller.vault.unlocked}"/>
 				</HBox>
-				<Hyperlink styleClass="hyperlink-muted,hyperlink-hover-icon" text="${controller.vault.displayablePath}" textOverrun="CENTER_ELLIPSIS" onAction="#revealStorageLocation">
+				<Hyperlink styleClass="hyperlink-muted,hyperlink-hover-icon" text="${controller.vault.displayablePath}" textOverrun="CENTER_ELLIPSIS" onAction="#revealStorageLocation" accessibleText="%main.vaultDetail.storageLocation" accessibleRole="BUTTON">
 					<graphic>
 						<FontAwesome5IconView styleClass="glyph-icon-muted" glyph="EYE"/>
 					</graphic>
diff --git a/src/main/resources/i18n/strings.properties b/src/main/resources/i18n/strings.properties
index b562da01c..2ec835d74 100644
--- a/src/main/resources/i18n/strings.properties
+++ b/src/main/resources/i18n/strings.properties
@@ -432,6 +432,7 @@ main.notification.support=Support Cryptomator.
 ## Vault Detail
 ### Welcome
 main.vaultDetail.welcomeOnboarding=Thanks for choosing Cryptomator to protect your files. If you need any assistance, check out our getting started guides:
+main.vaultDetail.storageLocation=Vault storage location
 ### Locked
 main.vaultDetail.lockedStatus=LOCKED
 main.vaultDetail.unlockBtn=Unlock…

From 33f26bf80476032b736de1adb7eec4975b433ba8 Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Mon, 12 Jan 2026 23:31:37 +0100
Subject: [PATCH 04/15] Refactor notificationbar

* rename to InfoBar
* replace closeButton text with graphic and add accessibilityText
* use common base class for styling and use CSS lookup for variants
---
 .../{NotificationBar.java => InfoBar.java}    | 34 ++++++----
 src/main/resources/css/dark_theme.css         | 64 ++++++++++++------
 src/main/resources/css/light_theme.css        | 66 +++++++++++++------
 src/main/resources/fxml/main_window.fxml      | 14 ++--
 src/main/resources/i18n/strings.properties    |  3 +-
 5 files changed, 122 insertions(+), 59 deletions(-)
 rename src/main/java/org/cryptomator/ui/controls/{NotificationBar.java => InfoBar.java} (67%)

diff --git a/src/main/java/org/cryptomator/ui/controls/NotificationBar.java b/src/main/java/org/cryptomator/ui/controls/InfoBar.java
similarity index 67%
rename from src/main/java/org/cryptomator/ui/controls/NotificationBar.java
rename to src/main/java/org/cryptomator/ui/controls/InfoBar.java
index 64a08f220..02efa00f5 100644
--- a/src/main/java/org/cryptomator/ui/controls/NotificationBar.java
+++ b/src/main/java/org/cryptomator/ui/controls/InfoBar.java
@@ -4,24 +4,27 @@ import javafx.beans.property.BooleanProperty;
 import javafx.beans.property.SimpleBooleanProperty;
 import javafx.fxml.FXML;
 import javafx.geometry.Pos;
+import javafx.scene.AccessibleRole;
 import javafx.scene.control.Button;
+import javafx.scene.control.ContentDisplay;
 import javafx.scene.control.Label;
 import javafx.scene.layout.HBox;
 import javafx.scene.layout.Region;
 import javafx.scene.layout.VBox;
+import java.util.ResourceBundle;
 
-public class NotificationBar extends HBox {
+public class InfoBar extends HBox {
 
 	@FXML
-	private Label notificationLabel;
+	private Label infoMessage;
 
 	private final BooleanProperty dismissable = new SimpleBooleanProperty();
 	private final BooleanProperty notify = new SimpleBooleanProperty();
 
 
-	public NotificationBar() {
+	public InfoBar() {
 		setAlignment(Pos.CENTER);
-		setStyle("-fx-alignment: center;");
+		getStyleClass().addAll("info-bar");
 
 		Region spacer = new Region();
 		spacer.setMinWidth(40);
@@ -36,14 +39,21 @@ public class NotificationBar extends HBox {
 		vbox.setAlignment(Pos.CENTER);
 		HBox.setHgrow(vbox, javafx.scene.layout.Priority.ALWAYS);
 
-		notificationLabel = new Label();
-		notificationLabel.getStyleClass().add("notification-label");
-		notificationLabel.setStyle("-fx-alignment: center;");
-		vbox.getChildren().add(notificationLabel);
+		infoMessage = new Label();
+		infoMessage.setFocusTraversable(true);
+		infoMessage.setAccessibleRole(AccessibleRole.BUTTON);
+		vbox.getChildren().add(infoMessage);
 
-		Button closeButton = new Button("X");
+		var closeGraphic = new FontAwesome5IconView();
+		closeGraphic.setGlyph(FontAwesome5Icon.TIMES);
+		closeGraphic.setGlyphSize(12);
+		closeGraphic.getStyleClass().add("glyph");
+
+		Button closeButton = new Button();
+		closeButton.setGraphic(closeGraphic);
+		closeButton.setContentDisplay(ContentDisplay.GRAPHIC_ONLY);
+		closeButton.setAccessibleText(ResourceBundle.getBundle("i18n.strings").getString("main.notification.closeButton.tooltip"));
 		closeButton.setMinWidth(40);
-		closeButton.setStyle("-fx-background-color: transparent; -fx-text-fill: white; -fx-font-weight: bold;");
 		closeButton.visibleProperty().bind(dismissable);
 
 		closeButton.setOnAction(_ -> {
@@ -61,11 +71,11 @@ public class NotificationBar extends HBox {
 	}
 
 	public String getText() {
-		return notificationLabel.getText();
+		return infoMessage.getText();
 	}
 
 	public void setText(String text) {
-		notificationLabel.setText(text);
+		infoMessage.setText(text);
 	}
 
 	public void setStyleClass(String styleClass) {
diff --git a/src/main/resources/css/dark_theme.css b/src/main/resources/css/dark_theme.css
index 5b8c717c1..bb23af18c 100644
--- a/src/main/resources/css/dark_theme.css
+++ b/src/main/resources/css/dark_theme.css
@@ -50,6 +50,7 @@
 	GREEN_5: PRIMARY;
 	RED_5: #E74C3C;
 	ORANGE_5: #E67E22;
+	YELLOW_4: #C19F0E;
 	YELLOW_5: #F1C40F;
 
 	MAIN_BG: GRAY_1;
@@ -387,37 +388,62 @@
 
 /*******************************************************************************
  *                                                                             *
- * NotificationBar                                                             *
+ * InfoBar                                                                     *
  *                                                                             *
  ******************************************************************************/
+.info-bar {
+	-fx-alignment: center;
+	-fx-min-height:24px;
+	-fx-max-height:24px;
+	-fx-background-color: -bar-bg;
+}
 
-.notification-label {
-	-fx-text-fill: white;
+.info-bar--green {
+	-bar-bg: GREEN_5;
+	-button-bg: GREEN_5;
+	-button-bg-pressed: GREEN_3;
+}
+
+.info-bar--yellow {
+	-bar-bg: YELLOW_5;
+	-button-bg: YELLOW_5;
+	-button-bg-pressed: YELLOW_4;
+}
+
+.info-bar--red {
+	-bar-bg: RED_5;
+	-button-bg: RED_5;
+	-button-bg-pressed: RED_5;
+}
+
+.info-bar .label {
+	-fx-text-fill: GRAY_9;
 	-fx-font-weight: bold;
 }
 
-.notification-debug {
-	-fx-min-height:24px;
-	-fx-max-height:24px;
-	-fx-background-color: RED_5;
+.info-bar--yellow .label {
+	-fx-text-fill: GRAY_9;
+	-fx-font-weight: bold;
+	-fx-effect: dropshadow( gaussian , rgba(0,0,0,0.45) , 2 , 0 , 0 , 1 );
 }
 
-.notification-update {
-	-fx-min-height:24px;
-	-fx-max-height:24px;
-	-fx-background-color: YELLOW_5;
+.info-bar .glyph {
+	-fx-fill: GRAY_9;
 }
 
-.notification-support {
-	-fx-min-height:24px;
-	-fx-max-height:24px;
-	-fx-background-color: PRIMARY;
+.info-bar:hover .label {
+	-fx-underline:true;
 }
 
-.notification-debug:hover .notification-label,
-.notification-update:hover .notification-label,
-.notification-support:hover .notification-label {
- 	-fx-underline:true;
+.info-bar .button {
+	-fx-background-color: transparent;
+	-fx-border-color: transparent;
+	-fx-padding: 2 2 2 2;
+}
+
+.info-bar .button:armed {
+	-fx-background-color: -button-bg-pressed;
+	-fx-background-radius: 8;
 }
 
 /*******************************************************************************
diff --git a/src/main/resources/css/light_theme.css b/src/main/resources/css/light_theme.css
index 38e476923..dcbee907f 100644
--- a/src/main/resources/css/light_theme.css
+++ b/src/main/resources/css/light_theme.css
@@ -50,6 +50,7 @@
 	GREEN_5: PRIMARY;
 	RED_5: #E74C3C;
 	ORANGE_5: #E67E22;
+	YELLOW_4: #C19F0E;
 	YELLOW_5: #F1C40F;
 
 	MAIN_BG: GRAY_9;
@@ -387,39 +388,64 @@
 
 /*******************************************************************************
  *                                                                             *
- * NotificationBar                                                             *
+ * InfoBar                                                                     *
  *                                                                             *
  ******************************************************************************/
+.info-bar {
+	-fx-alignment: center;
+	-fx-min-height:24px;
+	-fx-max-height:24px;
+	-fx-background-color: -bar-bg;
+}
 
-.notification-label {
-	-fx-text-fill: white;
+.info-bar--green {
+	-bar-bg: GREEN_5;
+	-button-bg: GREEN_5;
+	-button-bg-pressed: GREEN_3;
+}
+
+.info-bar--yellow {
+	-bar-bg: YELLOW_5;
+	-button-bg: YELLOW_5;
+	-button-bg-pressed: YELLOW_4;
+}
+
+.info-bar--red {
+	-bar-bg: RED_5;
+	-button-bg: RED_5;
+	-button-bg-pressed: RED_5;
+}
+
+.info-bar .label {
+	-fx-text-fill: GRAY_9;
 	-fx-font-weight: bold;
 }
 
-.notification-debug {
-	-fx-min-height:24px;
-	-fx-max-height:24px;
-	-fx-background-color: RED_5;
+.info-bar--yellow .label {
+	-fx-text-fill: GRAY_9;
+	-fx-font-weight: bold;
+	-fx-effect: dropshadow( gaussian , rgba(0,0,0,0.45) , 2 , 0 , 0 , 1 );
 }
 
-.notification-update {
-	-fx-min-height:24px;
-	-fx-max-height:24px;
-	-fx-background-color: YELLOW_5;
+.info-bar .glyph {
+	-fx-fill: GRAY_9;
 }
 
-.notification-support {
-	-fx-min-height:24px;
-	-fx-max-height:24px;
-	-fx-background-color: PRIMARY;
-}
-
-.notification-debug:hover .notification-label,
-.notification-update:hover .notification-label,
-.notification-support:hover .notification-label {
+.info-bar:hover .label {
 	-fx-underline:true;
 }
 
+.info-bar .button {
+	-fx-background-color: transparent;
+	-fx-border-color: transparent;
+	-fx-padding: 2 2 2 2;
+}
+
+.info-bar .button:armed {
+	-fx-background-color: -button-bg-pressed;
+	-fx-background-radius: 8;
+}
+
 /*******************************************************************************
  *                                                                             *
  * ScrollBar                                                                   *
diff --git a/src/main/resources/fxml/main_window.fxml b/src/main/resources/fxml/main_window.fxml
index 327e2c470..37ab65bbb 100644
--- a/src/main/resources/fxml/main_window.fxml
+++ b/src/main/resources/fxml/main_window.fxml
@@ -3,7 +3,7 @@
 <?import javafx.scene.control.SplitPane?>
 <?import javafx.scene.layout.StackPane?>
 <?import javafx.scene.layout.VBox?>
-<?import org.cryptomator.ui.controls.NotificationBar?>
+<?import org.cryptomator.ui.controls.InfoBar?>
 
 <StackPane xmlns:fx="http://javafx.com/fxml"
 		   xmlns="http://javafx.com/javafx"
@@ -11,23 +11,23 @@
 		   fx:controller="org.cryptomator.ui.mainwindow.MainWindowController"
 		   styleClass="main-window">
 	<VBox minWidth="600">
-		<NotificationBar onMouseClicked="#showUpdatePreferences"
+		<InfoBar onMouseClicked="#showUpdatePreferences"
 						 text="%main.notification.updateAvailable"
 						 dismissable="true"
 						 notify="${controller.updateAvailable}"
-						 styleClass="notification-update"/>
-		<NotificationBar onMouseClicked="#showContributePreferences"
+						 styleClass="info-bar--yellow"/>
+		<InfoBar onMouseClicked="#showContributePreferences"
 						 text="%main.notification.support"
 						 dismissable="true"
 						 notify="${!controller.licenseValid}"
-						 styleClass="notification-support"/>
+						 styleClass="info-bar--green"/>
 		<SplitPane dividerPositions="0.33" orientation="HORIZONTAL" VBox.vgrow="ALWAYS">
 			<fx:include source="vault_list.fxml" SplitPane.resizableWithParent="false"/>
 			<fx:include source="vault_detail.fxml" SplitPane.resizableWithParent="true"/>
 		</SplitPane>
-		<NotificationBar onMouseClicked="#showGeneralPreferences"
+		<InfoBar onMouseClicked="#showGeneralPreferences"
 						 text="DEBUG MODE"
-						 styleClass="notification-debug"
+						 styleClass="info-bar--red"
 						 notify="${controller.debugModeEnabled}"/>
 	</VBox>
 </StackPane>
diff --git a/src/main/resources/i18n/strings.properties b/src/main/resources/i18n/strings.properties
index 2ec835d74..d34d900fd 100644
--- a/src/main/resources/i18n/strings.properties
+++ b/src/main/resources/i18n/strings.properties
@@ -426,9 +426,10 @@ main.vaultlist.addVaultBtn.menuItemRecover=Recover Existing Vault…
 main.vaultlist.addVaultButton.tooltip=Add Vault
 main.vaultlist.showEventsButton.tooltip=Open Event View
 main.vaultlist.showPreferencesButton.tooltip=Show Preferences
-##Notificaition
+##Notification
 main.notification.updateAvailable=Update is available.
 main.notification.support=Support Cryptomator.
+main.notification.closeButton.tooltip=Close info bar
 ## Vault Detail
 ### Welcome
 main.vaultDetail.welcomeOnboarding=Thanks for choosing Cryptomator to protect your files. If you need any assistance, check out our getting started guides:

From b3f3faf4ee46ff35160482a42fd14ef116172000 Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Tue, 13 Jan 2026 10:57:27 +0100
Subject: [PATCH 05/15] add DIALOG role to more dialogs

---
 src/main/resources/fxml/addvault_existing.fxml                | 3 ++-
 src/main/resources/fxml/addvault_new_expert_settings.fxml     | 3 ++-
 src/main/resources/fxml/addvault_new_location.fxml            | 3 ++-
 src/main/resources/fxml/addvault_new_name.fxml                | 3 ++-
 src/main/resources/fxml/addvault_new_password.fxml            | 3 ++-
 src/main/resources/fxml/addvault_new_recoverykey.fxml         | 3 ++-
 src/main/resources/fxml/addvault_success.fxml                 | 3 ++-
 src/main/resources/fxml/changepassword.fxml                   | 3 ++-
 .../resources/fxml/convertvault_hubtopassword_convert.fxml    | 3 ++-
 src/main/resources/fxml/convertvault_hubtopassword_start.fxml | 3 ++-
 .../resources/fxml/convertvault_hubtopassword_success.fxml    | 3 ++-
 src/main/resources/fxml/error.fxml                            | 3 ++-
 src/main/resources/fxml/hub_auth_flow.fxml                    | 3 ++-
 src/main/resources/fxml/hub_invalid_license.fxml              | 3 ++-
 src/main/resources/fxml/hub_legacy_register_device.fxml       | 3 ++-
 src/main/resources/fxml/hub_legacy_register_success.fxml      | 3 ++-
 src/main/resources/fxml/hub_no_keychain.fxml                  | 3 ++-
 src/main/resources/fxml/hub_receive_key.fxml                  | 3 ++-
 src/main/resources/fxml/hub_register_device.fxml              | 3 ++-
 .../resources/fxml/hub_register_device_already_exists.fxml    | 4 +++-
 src/main/resources/fxml/hub_register_failed.fxml              | 3 ++-
 src/main/resources/fxml/hub_register_success.fxml             | 3 ++-
 src/main/resources/fxml/hub_require_account_init.fxml         | 3 ++-
 src/main/resources/fxml/hub_unauthorized_device.fxml          | 3 ++-
 src/main/resources/fxml/lock_failed.fxml                      | 3 ++-
 src/main/resources/fxml/migration_capability_error.fxml       | 3 ++-
 src/main/resources/fxml/migration_impossible.fxml             | 3 ++-
 src/main/resources/fxml/migration_start.fxml                  | 3 ++-
 src/main/resources/fxml/migration_success.fxml                | 3 ++-
 src/main/resources/fxml/notification.fxml                     | 3 ++-
 src/main/resources/fxml/quit_forced.fxml                      | 3 ++-
 src/main/resources/fxml/recoverykey_create.fxml               | 3 ++-
 src/main/resources/fxml/recoverykey_display.fxml              | 3 ++-
 src/main/resources/fxml/recoverykey_expert_settings.fxml      | 3 ++-
 src/main/resources/fxml/recoverykey_onboarding.fxml           | 3 ++-
 src/main/resources/fxml/recoverykey_recover.fxml              | 3 ++-
 src/main/resources/fxml/recoverykey_reset_password.fxml       | 3 ++-
 src/main/resources/fxml/recoverykey_success.fxml              | 3 ++-
 src/main/resources/fxml/recoverykey_validate.fxml             | 3 ++-
 src/main/resources/fxml/share_vault.fxml                      | 3 ++-
 src/main/resources/fxml/unlock_invalid_mount_point.fxml       | 3 ++-
 src/main/resources/fxml/unlock_requires_restart.fxml          | 3 ++-
 src/main/resources/fxml/unlock_select_masterkeyfile.fxml      | 3 ++-
 src/main/resources/fxml/update_reminder.fxml                  | 3 ++-
 src/main/resources/fxml/wrongfilealert.fxml                   | 3 ++-
 45 files changed, 91 insertions(+), 45 deletions(-)

diff --git a/src/main/resources/fxml/addvault_existing.fxml b/src/main/resources/fxml/addvault_existing.fxml
index 200eae4f9..f3d066e85 100644
--- a/src/main/resources/fxml/addvault_existing.fxml
+++ b/src/main/resources/fxml/addvault_existing.fxml
@@ -13,7 +13,8 @@
 	  prefWidth="450"
 	  prefHeight="450"
 	  spacing="24"
-	  alignment="CENTER">
+	  alignment="CENTER"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="24"/>
 	</padding>
diff --git a/src/main/resources/fxml/addvault_new_expert_settings.fxml b/src/main/resources/fxml/addvault_new_expert_settings.fxml
index 220444f71..d351d9f1e 100644
--- a/src/main/resources/fxml/addvault_new_expert_settings.fxml
+++ b/src/main/resources/fxml/addvault_new_expert_settings.fxml
@@ -19,7 +19,8 @@
 	  prefWidth="450"
 	  prefHeight="450"
 	  spacing="12"
-	  alignment="CENTER_LEFT">
+	  alignment="CENTER_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="24"/>
 	</padding>
diff --git a/src/main/resources/fxml/addvault_new_location.fxml b/src/main/resources/fxml/addvault_new_location.fxml
index 7b3157ffb..4769cbf11 100644
--- a/src/main/resources/fxml/addvault_new_location.fxml
+++ b/src/main/resources/fxml/addvault_new_location.fxml
@@ -19,7 +19,8 @@
 	  prefWidth="450"
 	  prefHeight="450"
 	  spacing="12"
-	  alignment="CENTER_LEFT">
+	  alignment="CENTER_LEFT"
+	  accessibleRole="DIALOG">
 	<fx:define>
 		<ToggleGroup fx:id="locationPresetsToggler"/>
 		<FontAwesome5IconView fx:id="badLocation" styleClass="glyph-icon-red" glyph="TIMES"/>
diff --git a/src/main/resources/fxml/addvault_new_name.fxml b/src/main/resources/fxml/addvault_new_name.fxml
index 0b983c4a0..4c722b1ba 100644
--- a/src/main/resources/fxml/addvault_new_name.fxml
+++ b/src/main/resources/fxml/addvault_new_name.fxml
@@ -17,7 +17,8 @@
 	  prefWidth="450"
 	  prefHeight="450"
 	  spacing="12"
-	  alignment="CENTER_LEFT">
+	  alignment="CENTER_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="24"/>
 	</padding>
diff --git a/src/main/resources/fxml/addvault_new_password.fxml b/src/main/resources/fxml/addvault_new_password.fxml
index 68f0200b5..f44050cfa 100644
--- a/src/main/resources/fxml/addvault_new_password.fxml
+++ b/src/main/resources/fxml/addvault_new_password.fxml
@@ -15,7 +15,8 @@
 	  prefWidth="450"
 	  prefHeight="450"
 	  spacing="12"
-	  alignment="CENTER_LEFT">
+	  alignment="CENTER_LEFT"
+	  accessibleRole="DIALOG">
 	<fx:define>
 		<ToggleGroup fx:id="recoveryKeyChoice"/>
 	</fx:define>
diff --git a/src/main/resources/fxml/addvault_new_recoverykey.fxml b/src/main/resources/fxml/addvault_new_recoverykey.fxml
index b04677bc3..afd88e494 100644
--- a/src/main/resources/fxml/addvault_new_recoverykey.fxml
+++ b/src/main/resources/fxml/addvault_new_recoverykey.fxml
@@ -11,7 +11,8 @@
 	  prefWidth="450"
 	  prefHeight="450"
 	  spacing="12"
-	  alignment="CENTER_LEFT">
+	  alignment="CENTER_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="24"/>
 	</padding>
diff --git a/src/main/resources/fxml/addvault_success.fxml b/src/main/resources/fxml/addvault_success.fxml
index 4df28e6e3..cd6c6754a 100644
--- a/src/main/resources/fxml/addvault_success.fxml
+++ b/src/main/resources/fxml/addvault_success.fxml
@@ -16,7 +16,8 @@
 	  prefWidth="450"
 	  prefHeight="450"
 	  spacing="12"
-	  alignment="TOP_CENTER">
+	  alignment="TOP_CENTER"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="24"/>
 	</padding>
diff --git a/src/main/resources/fxml/changepassword.fxml b/src/main/resources/fxml/changepassword.fxml
index 5a4d60813..88c8e2a1b 100644
--- a/src/main/resources/fxml/changepassword.fxml
+++ b/src/main/resources/fxml/changepassword.fxml
@@ -13,7 +13,8 @@
 	  fx:controller="org.cryptomator.ui.changepassword.ChangePasswordController"
 	  minWidth="400"
 	  maxWidth="400"
-	  spacing="12">
+	  spacing="12"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/convertvault_hubtopassword_convert.fxml b/src/main/resources/fxml/convertvault_hubtopassword_convert.fxml
index 7797b41b2..25ec096d4 100644
--- a/src/main/resources/fxml/convertvault_hubtopassword_convert.fxml
+++ b/src/main/resources/fxml/convertvault_hubtopassword_convert.fxml
@@ -18,7 +18,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_CENTER">
+	  alignment="TOP_CENTER"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/convertvault_hubtopassword_start.fxml b/src/main/resources/fxml/convertvault_hubtopassword_start.fxml
index 27b6911f7..9fff40913 100644
--- a/src/main/resources/fxml/convertvault_hubtopassword_start.fxml
+++ b/src/main/resources/fxml/convertvault_hubtopassword_start.fxml
@@ -15,7 +15,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_CENTER">
+	  alignment="TOP_CENTER"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/convertvault_hubtopassword_success.fxml b/src/main/resources/fxml/convertvault_hubtopassword_success.fxml
index 74e1fc8e6..178699fe9 100644
--- a/src/main/resources/fxml/convertvault_hubtopassword_success.fxml
+++ b/src/main/resources/fxml/convertvault_hubtopassword_success.fxml
@@ -19,7 +19,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/error.fxml b/src/main/resources/fxml/error.fxml
index 5738a46c7..8426b1258 100644
--- a/src/main/resources/fxml/error.fxml
+++ b/src/main/resources/fxml/error.fxml
@@ -22,7 +22,8 @@
 	  minHeight="450"
 	  prefWidth="450"
 	  prefHeight="450"
-	  spacing="12">
+	  spacing="12"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="24"/>
 	</padding>
diff --git a/src/main/resources/fxml/hub_auth_flow.fxml b/src/main/resources/fxml/hub_auth_flow.fxml
index 40bb9986a..30a421050 100644
--- a/src/main/resources/fxml/hub_auth_flow.fxml
+++ b/src/main/resources/fxml/hub_auth_flow.fxml
@@ -21,7 +21,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/hub_invalid_license.fxml b/src/main/resources/fxml/hub_invalid_license.fxml
index e01443a3f..956d38f77 100644
--- a/src/main/resources/fxml/hub_invalid_license.fxml
+++ b/src/main/resources/fxml/hub_invalid_license.fxml
@@ -18,7 +18,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/hub_legacy_register_device.fxml b/src/main/resources/fxml/hub_legacy_register_device.fxml
index 1bdd475a7..0b4e547c7 100644
--- a/src/main/resources/fxml/hub_legacy_register_device.fxml
+++ b/src/main/resources/fxml/hub_legacy_register_device.fxml
@@ -20,7 +20,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/hub_legacy_register_success.fxml b/src/main/resources/fxml/hub_legacy_register_success.fxml
index 204f579c1..f1f405035 100644
--- a/src/main/resources/fxml/hub_legacy_register_success.fxml
+++ b/src/main/resources/fxml/hub_legacy_register_success.fxml
@@ -18,7 +18,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/hub_no_keychain.fxml b/src/main/resources/fxml/hub_no_keychain.fxml
index 031eac956..72d6c590b 100644
--- a/src/main/resources/fxml/hub_no_keychain.fxml
+++ b/src/main/resources/fxml/hub_no_keychain.fxml
@@ -20,7 +20,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/hub_receive_key.fxml b/src/main/resources/fxml/hub_receive_key.fxml
index a180c997e..7400e785e 100644
--- a/src/main/resources/fxml/hub_receive_key.fxml
+++ b/src/main/resources/fxml/hub_receive_key.fxml
@@ -18,7 +18,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/hub_register_device.fxml b/src/main/resources/fxml/hub_register_device.fxml
index e1a1e39ff..462009764 100644
--- a/src/main/resources/fxml/hub_register_device.fxml
+++ b/src/main/resources/fxml/hub_register_device.fxml
@@ -20,7 +20,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/hub_register_device_already_exists.fxml b/src/main/resources/fxml/hub_register_device_already_exists.fxml
index 9a7c1f3c7..88fe66885 100644
--- a/src/main/resources/fxml/hub_register_device_already_exists.fxml
+++ b/src/main/resources/fxml/hub_register_device_already_exists.fxml
@@ -11,6 +11,7 @@
 <?import javafx.scene.layout.StackPane?>
 <?import javafx.scene.layout.VBox?>
 <?import javafx.scene.shape.Circle?>
+<!-- TODO: simple dialog -->
 <HBox xmlns:fx="http://javafx.com/fxml"
 	  xmlns="http://javafx.com/javafx"
 	  fx:controller="org.cryptomator.ui.keyloading.hub.RegisterFailedController"
@@ -18,7 +19,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/hub_register_failed.fxml b/src/main/resources/fxml/hub_register_failed.fxml
index a088c0318..7a50b0704 100644
--- a/src/main/resources/fxml/hub_register_failed.fxml
+++ b/src/main/resources/fxml/hub_register_failed.fxml
@@ -18,7 +18,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/hub_register_success.fxml b/src/main/resources/fxml/hub_register_success.fxml
index 0211eeba8..34a6c4f21 100644
--- a/src/main/resources/fxml/hub_register_success.fxml
+++ b/src/main/resources/fxml/hub_register_success.fxml
@@ -18,7 +18,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/hub_require_account_init.fxml b/src/main/resources/fxml/hub_require_account_init.fxml
index b3ca1fb40..db3e5c75c 100644
--- a/src/main/resources/fxml/hub_require_account_init.fxml
+++ b/src/main/resources/fxml/hub_require_account_init.fxml
@@ -21,7 +21,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/hub_unauthorized_device.fxml b/src/main/resources/fxml/hub_unauthorized_device.fxml
index 085798387..07e98cc8e 100644
--- a/src/main/resources/fxml/hub_unauthorized_device.fxml
+++ b/src/main/resources/fxml/hub_unauthorized_device.fxml
@@ -18,7 +18,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/lock_failed.fxml b/src/main/resources/fxml/lock_failed.fxml
index 1c3c4345f..31faa4c4a 100644
--- a/src/main/resources/fxml/lock_failed.fxml
+++ b/src/main/resources/fxml/lock_failed.fxml
@@ -19,7 +19,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/migration_capability_error.fxml b/src/main/resources/fxml/migration_capability_error.fxml
index 239f324a3..9a9af8e40 100644
--- a/src/main/resources/fxml/migration_capability_error.fxml
+++ b/src/main/resources/fxml/migration_capability_error.fxml
@@ -16,7 +16,8 @@
 	  minWidth="400"
 	  maxWidth="400"
 	  minHeight="145"
-	  spacing="12">
+	  spacing="12"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/migration_impossible.fxml b/src/main/resources/fxml/migration_impossible.fxml
index 6897d4d4e..ae8eac897 100644
--- a/src/main/resources/fxml/migration_impossible.fxml
+++ b/src/main/resources/fxml/migration_impossible.fxml
@@ -19,7 +19,8 @@
 	  minWidth="400"
 	  maxWidth="400"
 	  minHeight="145"
-	  spacing="12">
+	  spacing="12"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/migration_start.fxml b/src/main/resources/fxml/migration_start.fxml
index 547bd7e26..62fc9ac6e 100644
--- a/src/main/resources/fxml/migration_start.fxml
+++ b/src/main/resources/fxml/migration_start.fxml
@@ -20,7 +20,8 @@
 	  fx:controller="org.cryptomator.ui.migration.MigrationStartController"
 	  prefWidth="580"
 	  prefHeight="350"
-	  spacing="12">
+	  spacing="12"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/migration_success.fxml b/src/main/resources/fxml/migration_success.fxml
index c04068a9d..e1c8e1a3b 100644
--- a/src/main/resources/fxml/migration_success.fxml
+++ b/src/main/resources/fxml/migration_success.fxml
@@ -15,7 +15,8 @@
 	  minWidth="400"
 	  maxWidth="400"
 	  minHeight="145"
-	  spacing="12">
+	  spacing="12"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/notification.fxml b/src/main/resources/fxml/notification.fxml
index 5f82f3113..74ed9b18a 100644
--- a/src/main/resources/fxml/notification.fxml
+++ b/src/main/resources/fxml/notification.fxml
@@ -16,7 +16,8 @@
 			xmlns:fx="http://javafx.com/fxml"
 			fx:controller="org.cryptomator.ui.notification.NotificationController"
 			prefHeight="200.0" prefWidth="400.0" maxHeight="200.0" maxWidth="400.0"
-			styleClass="notification-window">
+			styleClass="notification-window"
+			accessibleRole="DIALOG">
 	<padding>
 		<Insets top="12" right="12" bottom="12" left="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/quit_forced.fxml b/src/main/resources/fxml/quit_forced.fxml
index d2e831d4d..8f72c71b8 100644
--- a/src/main/resources/fxml/quit_forced.fxml
+++ b/src/main/resources/fxml/quit_forced.fxml
@@ -19,7 +19,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/recoverykey_create.fxml b/src/main/resources/fxml/recoverykey_create.fxml
index e74074f1d..f3140e2de 100644
--- a/src/main/resources/fxml/recoverykey_create.fxml
+++ b/src/main/resources/fxml/recoverykey_create.fxml
@@ -20,7 +20,8 @@
 	  maxWidth="400"
 	  minHeight="175"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/recoverykey_display.fxml b/src/main/resources/fxml/recoverykey_display.fxml
index 0d25af99c..769633cb2 100644
--- a/src/main/resources/fxml/recoverykey_display.fxml
+++ b/src/main/resources/fxml/recoverykey_display.fxml
@@ -14,7 +14,8 @@
 	  minWidth="350"
 	  minHeight="280"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<children>
 		<FormattedLabel format="%recoveryKey.display.description" arg1="${controller.vaultName}" wrapText="true" labelFor="$textarea"/>
 
diff --git a/src/main/resources/fxml/recoverykey_expert_settings.fxml b/src/main/resources/fxml/recoverykey_expert_settings.fxml
index 4204d032c..0f5ed38c4 100644
--- a/src/main/resources/fxml/recoverykey_expert_settings.fxml
+++ b/src/main/resources/fxml/recoverykey_expert_settings.fxml
@@ -22,7 +22,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_CENTER">
+	  alignment="TOP_CENTER"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/recoverykey_onboarding.fxml b/src/main/resources/fxml/recoverykey_onboarding.fxml
index b1c701a9d..98982f458 100644
--- a/src/main/resources/fxml/recoverykey_onboarding.fxml
+++ b/src/main/resources/fxml/recoverykey_onboarding.fxml
@@ -25,7 +25,8 @@
 	  prefWidth="480"
 	  minHeight="242"
 	  spacing="12"
-	  VBox.vgrow="ALWAYS">
+	  VBox.vgrow="ALWAYS"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/recoverykey_recover.fxml b/src/main/resources/fxml/recoverykey_recover.fxml
index 5a9fddbdf..dad409b35 100644
--- a/src/main/resources/fxml/recoverykey_recover.fxml
+++ b/src/main/resources/fxml/recoverykey_recover.fxml
@@ -17,7 +17,8 @@
 	  minWidth="400"
 	  maxWidth="400"
 	  minHeight="145"
-	  spacing="12">
+	  spacing="12"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/recoverykey_reset_password.fxml b/src/main/resources/fxml/recoverykey_reset_password.fxml
index 8c28a1c9f..ba1b2b621 100644
--- a/src/main/resources/fxml/recoverykey_reset_password.fxml
+++ b/src/main/resources/fxml/recoverykey_reset_password.fxml
@@ -17,7 +17,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_CENTER">
+	  alignment="TOP_CENTER"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/recoverykey_success.fxml b/src/main/resources/fxml/recoverykey_success.fxml
index 6aacb38dd..0451a7397 100644
--- a/src/main/resources/fxml/recoverykey_success.fxml
+++ b/src/main/resources/fxml/recoverykey_success.fxml
@@ -12,7 +12,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_CENTER">
+	  alignment="TOP_CENTER"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/recoverykey_validate.fxml b/src/main/resources/fxml/recoverykey_validate.fxml
index cd599db40..e6a24ec49 100644
--- a/src/main/resources/fxml/recoverykey_validate.fxml
+++ b/src/main/resources/fxml/recoverykey_validate.fxml
@@ -10,7 +10,8 @@
 	  fx:controller="org.cryptomator.ui.recoverykey.RecoveryKeyValidateController"
 	  maxWidth="400"
 	  minHeight="145"
-	  spacing="12">
+	  spacing="12"
+	  accessibleRole="DIALOG">
 	<children>
 		<FormattedLabel format="%recoveryKey.recover.prompt" arg1="${controller.vault.displayName}" wrapText="true" labelFor="$textarea"/>
 
diff --git a/src/main/resources/fxml/share_vault.fxml b/src/main/resources/fxml/share_vault.fxml
index b5466a10d..23362fdae 100644
--- a/src/main/resources/fxml/share_vault.fxml
+++ b/src/main/resources/fxml/share_vault.fxml
@@ -21,7 +21,8 @@
 	  xmlns="http://javafx.com/javafx"
 	  fx:controller="org.cryptomator.ui.sharevault.ShareVaultController"
 	  prefWidth="540"
-	  spacing="12">
+	  spacing="12"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/unlock_invalid_mount_point.fxml b/src/main/resources/fxml/unlock_invalid_mount_point.fxml
index dbf6fad05..dfcb3f68a 100644
--- a/src/main/resources/fxml/unlock_invalid_mount_point.fxml
+++ b/src/main/resources/fxml/unlock_invalid_mount_point.fxml
@@ -19,7 +19,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/unlock_requires_restart.fxml b/src/main/resources/fxml/unlock_requires_restart.fxml
index 571ea6a32..9c0ed591b 100644
--- a/src/main/resources/fxml/unlock_requires_restart.fxml
+++ b/src/main/resources/fxml/unlock_requires_restart.fxml
@@ -19,7 +19,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/unlock_select_masterkeyfile.fxml b/src/main/resources/fxml/unlock_select_masterkeyfile.fxml
index 60934cdba..6dcfd4252 100644
--- a/src/main/resources/fxml/unlock_select_masterkeyfile.fxml
+++ b/src/main/resources/fxml/unlock_select_masterkeyfile.fxml
@@ -20,7 +20,8 @@
 	  maxWidth="400"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/update_reminder.fxml b/src/main/resources/fxml/update_reminder.fxml
index 50bb80b5f..0402ad07a 100644
--- a/src/main/resources/fxml/update_reminder.fxml
+++ b/src/main/resources/fxml/update_reminder.fxml
@@ -18,7 +18,8 @@
 	  prefWidth="500"
 	  minHeight="145"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>
diff --git a/src/main/resources/fxml/wrongfilealert.fxml b/src/main/resources/fxml/wrongfilealert.fxml
index 123e84378..8032403ed 100644
--- a/src/main/resources/fxml/wrongfilealert.fxml
+++ b/src/main/resources/fxml/wrongfilealert.fxml
@@ -23,7 +23,8 @@
 	  minWidth="-Infinity"
 	  minHeight="-Infinity"
 	  spacing="12"
-	  alignment="TOP_LEFT">
+	  alignment="TOP_LEFT"
+	  accessibleRole="DIALOG">
 	<padding>
 		<Insets topRightBottomLeft="12"/>
 	</padding>

From efd73e0d3ea6d1d90260413746b76ada11577401 Mon Sep 17 00:00:00 2001
From: Jan-Peter Klein <jan-peter.klein@skymatic.de>
Date: Wed, 14 Jan 2026 17:14:23 +0100
Subject: [PATCH 06/15] move recovery IO operations to background

---
 .../RecoveryKeyCreationController.java        | 83 +++++++++++++------
 .../RecoveryKeyResetPasswordController.java   | 70 +++++++++++-----
 2 files changed, 107 insertions(+), 46 deletions(-)

diff --git a/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyCreationController.java b/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyCreationController.java
index 456de11f4..ac26fabd8 100644
--- a/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyCreationController.java
+++ b/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyCreationController.java
@@ -138,38 +138,41 @@ public class RecoveryKeyCreationController implements FxController {
 
 	@FXML
 	public void restoreWithPassword() {
+		Task<Void> task = new RestoreWithPasswordTask();
 
-		try (RecoveryDirectory recoveryDirectory = RecoveryDirectory.create(vault.getPath())) {
-			Path recoveryPath = recoveryDirectory.getRecoveryPath();
+		task.setOnScheduled(_ -> {
+			LOG.debug("Restoring vault configuration with password for {}.", vault.getDisplayablePath());
+		});
 
-			Path masterkeyFilePath = vault.getPath().resolve(MASTERKEY_FILENAME);
-
-			try (Masterkey masterkey = MasterkeyService.load(masterkeyFileAccess, masterkeyFilePath, passwordField.getCharacters())) {
-				var combo = MasterkeyService.detect(masterkey, vault.getPath())
-						.orElseThrow(() -> new IllegalStateException("Could not detect combo for vault path: " + vault.getPath()));
-
-				CryptoFsInitializer.init(recoveryPath, masterkey, shorteningThreshold.get(), combo);
+		task.setOnSucceeded(_ -> {
+			LOG.debug("Restored vault configuration for {}.", vault.getDisplayablePath());
+			try {
+				if (!vaultListManager.isAlreadyAdded(vault.getPath())) {
+					vaultListManager.add(vault.getPath());
+				}
+				window.close();
+				dialogs.prepareRecoverPasswordSuccess((Stage) window.getOwner()) //
+						.setTitleKey("recover.recoverVaultConfig.title") //
+						.setMessageKey("recoveryKey.recover.resetVaultConfigSuccess.message") //
+						.setDescriptionKey("recoveryKey.recover.resetMasterkeyFileSuccess.description")
+						.build().showAndWait();
+			} catch (IOException e) {
+				LOG.error("Failed to add vault to list.", e);
+				appWindows.showErrorWindow(e, window, null);
 			}
+		});
 
-			recoveryDirectory.moveRecoveredFile(VAULTCONFIG_FILENAME);
-
-			if (!vaultListManager.isAlreadyAdded(vault.getPath())) {
-				vaultListManager.add(vault.getPath());
+		task.setOnFailed(_ -> {
+			if (task.getException() instanceof InvalidPassphraseException e) {
+				LOG.info("Password invalid", e);
+				Animations.createShakeWindowAnimation(window).play();
+			} else {
+				LOG.error("Recovery process failed.", task.getException());
+				appWindows.showErrorWindow(task.getException(), window, null);
 			}
-			window.close();
-			dialogs.prepareRecoverPasswordSuccess((Stage)window.getOwner()) //
-					.setTitleKey("recover.recoverVaultConfig.title") //
-					.setMessageKey("recoveryKey.recover.resetVaultConfigSuccess.message") //
-					.setDescriptionKey("recoveryKey.recover.resetMasterkeyFileSuccess.description")
-					.build().showAndWait();
+		});
 
-		} catch (InvalidPassphraseException e) {
-			LOG.info("Password invalid", e);
-			Animations.createShakeWindowAnimation(window).play();
-		} catch (IOException | CryptoException | IllegalStateException e) {
-			LOG.error("Recovery process failed", e);
-			appWindows.showErrorWindow(e, window, null);
-		}
+		executor.submit(task);
 	}
 
 	@FXML
@@ -190,6 +193,34 @@ public class RecoveryKeyCreationController implements FxController {
 
 	}
 
+	private class RestoreWithPasswordTask extends Task<Void> {
+
+		private static final Logger LOG = LoggerFactory.getLogger(RestoreWithPasswordTask.class);
+
+		private RestoreWithPasswordTask() {
+			setOnFailed(_ -> LOG.error("Failed to restore vault configuration with password", getException()));
+		}
+
+		@Override
+		protected Void call() throws IOException, CryptoException {
+			try (RecoveryDirectory recoveryDirectory = RecoveryDirectory.create(vault.getPath())) {
+				Path recoveryPath = recoveryDirectory.getRecoveryPath();
+				Path masterkeyFilePath = vault.getPath().resolve(MASTERKEY_FILENAME);
+
+				try (Masterkey masterkey = MasterkeyService.load(masterkeyFileAccess, masterkeyFilePath, passwordField.getCharacters())) {
+					var combo = MasterkeyService.detect(masterkey, vault.getPath())
+							.orElseThrow(() -> new IllegalStateException("Could not detect combo for vault path: " + vault.getPath()));
+
+					CryptoFsInitializer.init(recoveryPath, masterkey, shorteningThreshold.get(), combo);
+				}
+
+				recoveryDirectory.moveRecoveredFile(VAULTCONFIG_FILENAME);
+			}
+			return null;
+		}
+
+	}
+
 	/* Getter/Setter */
 
 	public Vault getVault() {
diff --git a/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyResetPasswordController.java b/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyResetPasswordController.java
index 0c06ba9b2..d904ea707 100644
--- a/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyResetPasswordController.java
+++ b/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyResetPasswordController.java
@@ -125,30 +125,35 @@ public class RecoveryKeyResetPasswordController implements FxController {
 
 	@FXML
 	public void restorePassword() {
-		try (RecoveryDirectory recoveryDirectory = RecoveryDirectory.create(vault.getPath())) {
-			Path recoveryPath = recoveryDirectory.getRecoveryPath();
-			MasterkeyService.recoverFromRecoveryKey(recoveryKey.get(), recoveryKeyFactory, recoveryPath, newPasswordController.passwordField.getCharacters());
+		Task<Void> task = new RestorePasswordTask();
 
-			try (Masterkey masterkey = MasterkeyService.load(masterkeyFileAccess, recoveryPath.resolve(MASTERKEY_FILENAME), newPasswordController.passwordField.getCharacters())) {
-				CryptoFsInitializer.init(recoveryPath, masterkey, shorteningThreshold.get(), cipherCombo.get());
+		task.setOnScheduled(_ -> {
+			LOG.debug("Restoring vault configuration for {}.", vault.getDisplayablePath());
+		});
+
+		task.setOnSucceeded(_ -> {
+			LOG.debug("Restored vault configuration for {}.", vault.getDisplayablePath());
+			try {
+				if (!vaultListManager.isAlreadyAdded(vault.getPath())) {
+					vaultListManager.add(vault.getPath());
+				}
+				window.close();
+				dialogs.prepareRecoverPasswordSuccess((Stage) window.getOwner()) //
+						.setTitleKey("recover.recoverVaultConfig.title") //
+						.setMessageKey("recoveryKey.recover.resetVaultConfigSuccess.message") //
+						.build().showAndWait();
+			} catch (IOException e) {
+				LOG.error("Failed to add vault to list.", e);
+				appWindows.showErrorWindow(e, window, null);
 			}
+		});
 
-			recoveryDirectory.moveRecoveredFile(MASTERKEY_FILENAME);
-			recoveryDirectory.moveRecoveredFile(VAULTCONFIG_FILENAME);
+		task.setOnFailed(_ -> {
+			LOG.error("Recovery process failed.", task.getException());
+			appWindows.showErrorWindow(task.getException(), window, null);
+		});
 
-			if (!vaultListManager.isAlreadyAdded(vault.getPath())) {
-				vaultListManager.add(vault.getPath());
-			}
-			window.close();
-			dialogs.prepareRecoverPasswordSuccess((Stage)window.getOwner()) //
-					.setTitleKey("recover.recoverVaultConfig.title") //
-					.setMessageKey("recoveryKey.recover.resetVaultConfigSuccess.message") //
-					.build().showAndWait();
-
-		} catch (IOException | CryptoException e) {
-			LOG.error("Recovery process failed", e);
-			appWindows.showErrorWindow(e, window, null);
-		}
+		executor.submit(task);
 	}
 
 	@FXML
@@ -192,6 +197,31 @@ public class RecoveryKeyResetPasswordController implements FxController {
 		}
 	}
 
+	private class RestorePasswordTask extends Task<Void> {
+
+		private static final Logger LOG = LoggerFactory.getLogger(RestorePasswordTask.class);
+
+		public RestorePasswordTask() {
+			setOnFailed(_ -> LOG.error("Failed to restore vault configuration", getException()));
+		}
+
+		@Override
+		protected Void call() throws IOException, CryptoException {
+			try (RecoveryDirectory recoveryDirectory = RecoveryDirectory.create(vault.getPath())) {
+				Path recoveryPath = recoveryDirectory.getRecoveryPath();
+				MasterkeyService.recoverFromRecoveryKey(recoveryKey.get(), recoveryKeyFactory, recoveryPath, newPasswordController.passwordField.getCharacters());
+
+				try (Masterkey masterkey = MasterkeyService.load(masterkeyFileAccess, recoveryPath.resolve(MASTERKEY_FILENAME), newPasswordController.passwordField.getCharacters())) {
+					CryptoFsInitializer.init(recoveryPath, masterkey, shorteningThreshold.get(), cipherCombo.get());
+				}
+
+				recoveryDirectory.moveRecoveredFile(MASTERKEY_FILENAME);
+				recoveryDirectory.moveRecoveredFile(VAULTCONFIG_FILENAME);
+			}
+			return null;
+		}
+	}
+
 	/* Getter/Setter */
 
 	public ReadOnlyBooleanProperty passwordSufficientAndMatchingProperty() {

From ac7c9c21650ebed82fda29bff99e6cd9a202ff7b Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Wed, 14 Jan 2026 17:28:20 +0100
Subject: [PATCH 07/15] use a bracket to "describe" the vault state

---
 src/main/resources/i18n/strings.properties | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/main/resources/i18n/strings.properties b/src/main/resources/i18n/strings.properties
index d34d900fd..3780b9ef4 100644
--- a/src/main/resources/i18n/strings.properties
+++ b/src/main/resources/i18n/strings.properties
@@ -411,7 +411,7 @@ stats.access.total=Total accesses: %d
 # Main Window
 ## Vault List
 main.vaultlist=Vaults
-main.vaultlist.listEntry=Vault %s. %s
+main.vaultlist.listEntry=Vault %s (%s)
 main.vaultlist.emptyList.onboardingInstruction=Click here to add a vault
 main.vaultlist.contextMenu.remove=Remove…
 main.vaultlist.contextMenu.lock=Lock

From e2430bfb22165f2dcd9ced20b3e76dea44b0b916 Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Wed, 14 Jan 2026 17:29:56 +0100
Subject: [PATCH 08/15] add null check

---
 .../cryptomator/ui/mainwindow/VaultListCellController.java   | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/main/java/org/cryptomator/ui/mainwindow/VaultListCellController.java b/src/main/java/org/cryptomator/ui/mainwindow/VaultListCellController.java
index 2ff9cef6b..845da328f 100644
--- a/src/main/java/org/cryptomator/ui/mainwindow/VaultListCellController.java
+++ b/src/main/java/org/cryptomator/ui/mainwindow/VaultListCellController.java
@@ -71,7 +71,8 @@ public class VaultListCellController implements FxController {
 	}
 
 	private String getAccessibleTextForVaultState(VaultState.Value state) {
-		if (state != null) {
+		var v = vault.get();
+		if (state != null && v != null) {
 			var translationKey = switch (state) {
 				case LOCKED -> "vault.state.locked";
 				case PROCESSING -> "vault.state.processing";
@@ -82,7 +83,7 @@ public class VaultListCellController implements FxController {
 			};
 
 			var localizedState = resourceBundle.getString(translationKey);
-			return resourceBundle.getString("main.vaultlist.listEntry").formatted(vault.get().getDisplayName(), localizedState);
+			return resourceBundle.getString("main.vaultlist.listEntry").formatted(v.getDisplayName(), localizedState);
 		} else {
 			return "";
 		}

From 460b7e6225bb812f2ef7e6ab7fc681537e48e1b7 Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Wed, 14 Jan 2026 17:33:45 +0100
Subject: [PATCH 09/15] [skip ci] update changelog

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cc6402c4c..bf1ec42fc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,7 +15,7 @@ Changes to prior versions can be found on the [Github release page](https://gith
   * Implemented Flatpak update mechanism
 * App notifications ([#4069](https://github.com/cryptomator/cryptomator/pull/4069))
 * Mark files in-use for Hub vaults ([#4078](https://github.com/cryptomator/cryptomator/pull/4078))
-* Accessibility labels for GUI elements ([#4064](https://github.com/cryptomator/cryptomator/issues/4064), [#4066](https://github.com/cryptomator/cryptomator/pull/4066), [#4055](https://github.com/cryptomator/cryptomator/issues/4055))
+* Accessibility: Adjust app to be used with a screen reader ([#547](https://github.com/cryptomator/cryptomator/issues/547))
 * Show Archived Vault Dialog on unlock when Hub returns 410 ([#4081](https://github.com/cryptomator/cryptomator/pull/4081))
 
 ### Changed

From aa898c634f7366c931e689a2861c2d30aacbc41e Mon Sep 17 00:00:00 2001
From: Jan-Peter Klein <jan-peter.klein@skymatic.de>
Date: Fri, 23 Jan 2026 13:24:58 +0100
Subject: [PATCH 10/15] refactor recovery restore to sync logic with async task
 wrapper for testability

---
 .../RecoveryKeyCreationController.java        | 65 ++++++++++---------
 .../RecoveryKeyResetPasswordController.java   | 60 +++++++++--------
 2 files changed, 66 insertions(+), 59 deletions(-)

diff --git a/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyCreationController.java b/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyCreationController.java
index ac26fabd8..8b0e5f416 100644
--- a/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyCreationController.java
+++ b/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyCreationController.java
@@ -104,7 +104,7 @@ public class RecoveryKeyCreationController implements FxController {
 			descriptionLabel.formatProperty().set(resourceBundle.getString("recoveryKey.recover.description"));
 			cancelButton.setOnAction((_) -> back());
 			cancelButton.setText(resourceBundle.getString("generic.button.back"));
-			nextButton.setOnAction((_) -> restoreWithPassword());
+			nextButton.setOnAction((_) -> restoreWithPasswordAsync());
 		}
 	}
 
@@ -137,8 +137,8 @@ public class RecoveryKeyCreationController implements FxController {
 	}
 
 	@FXML
-	public void restoreWithPassword() {
-		Task<Void> task = new RestoreWithPasswordTask();
+	public void restoreWithPasswordAsync() {
+		Task<Void> task = createTask(this::restoreWithPassword);
 
 		task.setOnScheduled(_ -> {
 			LOG.debug("Restoring vault configuration with password for {}.", vault.getDisplayablePath());
@@ -175,11 +175,42 @@ public class RecoveryKeyCreationController implements FxController {
 		executor.submit(task);
 	}
 
+	void restoreWithPassword() throws IOException, CryptoException {
+		try (RecoveryDirectory recoveryDirectory = RecoveryDirectory.create(vault.getPath())) {
+			Path recoveryPath = recoveryDirectory.getRecoveryPath();
+			Path masterkeyFilePath = vault.getPath().resolve(MASTERKEY_FILENAME);
+
+			try (Masterkey masterkey = MasterkeyService.load(masterkeyFileAccess, masterkeyFilePath, passwordField.getCharacters())) {
+				var combo = MasterkeyService.detect(masterkey, vault.getPath())
+						.orElseThrow(() -> new IllegalStateException("Could not detect combo for vault path: " + vault.getPath()));
+
+				CryptoFsInitializer.init(recoveryPath, masterkey, shorteningThreshold.get(), combo);
+			}
+
+			recoveryDirectory.moveRecoveredFile(VAULTCONFIG_FILENAME);
+		}
+	}
+
 	@FXML
 	public void close() {
 		window.close();
 	}
 
+	@FunctionalInterface
+	private interface TaskAction {
+		void run() throws Exception;
+	}
+
+	private Task<Void> createTask(TaskAction action) {
+		return new Task<Void>() {
+			@Override
+			protected Void call() throws Exception {
+				action.run();
+				return null;
+			}
+		};
+	}
+
 	private class RecoveryKeyCreationTask extends Task<String> {
 
 		private RecoveryKeyCreationTask() {
@@ -193,34 +224,6 @@ public class RecoveryKeyCreationController implements FxController {
 
 	}
 
-	private class RestoreWithPasswordTask extends Task<Void> {
-
-		private static final Logger LOG = LoggerFactory.getLogger(RestoreWithPasswordTask.class);
-
-		private RestoreWithPasswordTask() {
-			setOnFailed(_ -> LOG.error("Failed to restore vault configuration with password", getException()));
-		}
-
-		@Override
-		protected Void call() throws IOException, CryptoException {
-			try (RecoveryDirectory recoveryDirectory = RecoveryDirectory.create(vault.getPath())) {
-				Path recoveryPath = recoveryDirectory.getRecoveryPath();
-				Path masterkeyFilePath = vault.getPath().resolve(MASTERKEY_FILENAME);
-
-				try (Masterkey masterkey = MasterkeyService.load(masterkeyFileAccess, masterkeyFilePath, passwordField.getCharacters())) {
-					var combo = MasterkeyService.detect(masterkey, vault.getPath())
-							.orElseThrow(() -> new IllegalStateException("Could not detect combo for vault path: " + vault.getPath()));
-
-					CryptoFsInitializer.init(recoveryPath, masterkey, shorteningThreshold.get(), combo);
-				}
-
-				recoveryDirectory.moveRecoveredFile(VAULTCONFIG_FILENAME);
-			}
-			return null;
-		}
-
-	}
-
 	/* Getter/Setter */
 
 	public Vault getVault() {
diff --git a/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyResetPasswordController.java b/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyResetPasswordController.java
index d904ea707..ccc7df0e3 100644
--- a/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyResetPasswordController.java
+++ b/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyResetPasswordController.java
@@ -117,15 +117,15 @@ public class RecoveryKeyResetPasswordController implements FxController {
 	@FXML
 	public void next() {
 		switch (recoverType.get()) {
-			case RESTORE_ALL -> restorePassword();
+			case RESTORE_ALL -> restorePasswordAsync();
 			case RESTORE_MASTERKEY, RESET_PASSWORD -> resetPassword();
 			default -> resetPassword(); // Fallback
 		}
 	}
 
 	@FXML
-	public void restorePassword() {
-		Task<Void> task = new RestorePasswordTask();
+	public void restorePasswordAsync() {
+		Task<Void> task = createTask(this::restorePassword);
 
 		task.setOnScheduled(_ -> {
 			LOG.debug("Restoring vault configuration for {}.", vault.getDisplayablePath());
@@ -156,6 +156,20 @@ public class RecoveryKeyResetPasswordController implements FxController {
 		executor.submit(task);
 	}
 
+	void restorePassword() throws IOException, CryptoException {
+		try (RecoveryDirectory recoveryDirectory = RecoveryDirectory.create(vault.getPath())) {
+			Path recoveryPath = recoveryDirectory.getRecoveryPath();
+			MasterkeyService.recoverFromRecoveryKey(recoveryKey.get(), recoveryKeyFactory, recoveryPath, newPasswordController.passwordField.getCharacters());
+
+			try (Masterkey masterkey = MasterkeyService.load(masterkeyFileAccess, recoveryPath.resolve(MASTERKEY_FILENAME), newPasswordController.passwordField.getCharacters())) {
+				CryptoFsInitializer.init(recoveryPath, masterkey, shorteningThreshold.get(), cipherCombo.get());
+			}
+
+			recoveryDirectory.moveRecoveredFile(MASTERKEY_FILENAME);
+			recoveryDirectory.moveRecoveredFile(VAULTCONFIG_FILENAME);
+		}
+	}
+
 	@FXML
 	public void resetPassword() {
 		Task<Void> task = new ResetPasswordTask();
@@ -182,6 +196,21 @@ public class RecoveryKeyResetPasswordController implements FxController {
 		executor.submit(task);
 	}
 
+	@FunctionalInterface
+	private interface TaskAction {
+		void run() throws Exception;
+	}
+
+	private Task<Void> createTask(TaskAction action) {
+		return new Task<Void>() {
+			@Override
+			protected Void call() throws Exception {
+				action.run();
+				return null;
+			}
+		};
+	}
+
 	private class ResetPasswordTask extends Task<Void> {
 
 		private static final Logger LOG = LoggerFactory.getLogger(ResetPasswordTask.class);
@@ -197,31 +226,6 @@ public class RecoveryKeyResetPasswordController implements FxController {
 		}
 	}
 
-	private class RestorePasswordTask extends Task<Void> {
-
-		private static final Logger LOG = LoggerFactory.getLogger(RestorePasswordTask.class);
-
-		public RestorePasswordTask() {
-			setOnFailed(_ -> LOG.error("Failed to restore vault configuration", getException()));
-		}
-
-		@Override
-		protected Void call() throws IOException, CryptoException {
-			try (RecoveryDirectory recoveryDirectory = RecoveryDirectory.create(vault.getPath())) {
-				Path recoveryPath = recoveryDirectory.getRecoveryPath();
-				MasterkeyService.recoverFromRecoveryKey(recoveryKey.get(), recoveryKeyFactory, recoveryPath, newPasswordController.passwordField.getCharacters());
-
-				try (Masterkey masterkey = MasterkeyService.load(masterkeyFileAccess, recoveryPath.resolve(MASTERKEY_FILENAME), newPasswordController.passwordField.getCharacters())) {
-					CryptoFsInitializer.init(recoveryPath, masterkey, shorteningThreshold.get(), cipherCombo.get());
-				}
-
-				recoveryDirectory.moveRecoveredFile(MASTERKEY_FILENAME);
-				recoveryDirectory.moveRecoveredFile(VAULTCONFIG_FILENAME);
-			}
-			return null;
-		}
-	}
-
 	/* Getter/Setter */
 
 	public ReadOnlyBooleanProperty passwordSufficientAndMatchingProperty() {

From 8b05ae0a542d5588adfc9faf4b82458d552224ea Mon Sep 17 00:00:00 2001
From: Jan-Peter Klein <jan-peter.klein@skymatic.de>
Date: Fri, 23 Jan 2026 16:09:06 +0100
Subject: [PATCH 11/15] dedup createTask

---
 .../RecoveryKeyCreationController.java        | 17 +------------
 .../RecoveryKeyResetPasswordController.java   | 17 +------------
 .../ui/recoverykey/RecoveryKeyTasks.java      | 25 +++++++++++++++++++
 3 files changed, 27 insertions(+), 32 deletions(-)
 create mode 100644 src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyTasks.java

diff --git a/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyCreationController.java b/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyCreationController.java
index 8b0e5f416..e67ca87c6 100644
--- a/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyCreationController.java
+++ b/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyCreationController.java
@@ -138,7 +138,7 @@ public class RecoveryKeyCreationController implements FxController {
 
 	@FXML
 	public void restoreWithPasswordAsync() {
-		Task<Void> task = createTask(this::restoreWithPassword);
+		Task<Void> task = RecoveryKeyTasks.createTask(this::restoreWithPassword);
 
 		task.setOnScheduled(_ -> {
 			LOG.debug("Restoring vault configuration with password for {}.", vault.getDisplayablePath());
@@ -196,21 +196,6 @@ public class RecoveryKeyCreationController implements FxController {
 		window.close();
 	}
 
-	@FunctionalInterface
-	private interface TaskAction {
-		void run() throws Exception;
-	}
-
-	private Task<Void> createTask(TaskAction action) {
-		return new Task<Void>() {
-			@Override
-			protected Void call() throws Exception {
-				action.run();
-				return null;
-			}
-		};
-	}
-
 	private class RecoveryKeyCreationTask extends Task<String> {
 
 		private RecoveryKeyCreationTask() {
diff --git a/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyResetPasswordController.java b/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyResetPasswordController.java
index ccc7df0e3..b57758b67 100644
--- a/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyResetPasswordController.java
+++ b/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyResetPasswordController.java
@@ -125,7 +125,7 @@ public class RecoveryKeyResetPasswordController implements FxController {
 
 	@FXML
 	public void restorePasswordAsync() {
-		Task<Void> task = createTask(this::restorePassword);
+		Task<Void> task = RecoveryKeyTasks.createTask(this::restorePassword);
 
 		task.setOnScheduled(_ -> {
 			LOG.debug("Restoring vault configuration for {}.", vault.getDisplayablePath());
@@ -196,21 +196,6 @@ public class RecoveryKeyResetPasswordController implements FxController {
 		executor.submit(task);
 	}
 
-	@FunctionalInterface
-	private interface TaskAction {
-		void run() throws Exception;
-	}
-
-	private Task<Void> createTask(TaskAction action) {
-		return new Task<Void>() {
-			@Override
-			protected Void call() throws Exception {
-				action.run();
-				return null;
-			}
-		};
-	}
-
 	private class ResetPasswordTask extends Task<Void> {
 
 		private static final Logger LOG = LoggerFactory.getLogger(ResetPasswordTask.class);
diff --git a/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyTasks.java b/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyTasks.java
new file mode 100644
index 000000000..ba6caf249
--- /dev/null
+++ b/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyTasks.java
@@ -0,0 +1,25 @@
+package org.cryptomator.ui.recoverykey;
+
+import javafx.concurrent.Task;
+
+final class RecoveryKeyTasks {
+
+	private RecoveryKeyTasks() {
+	}
+
+	@FunctionalInterface
+	interface TaskAction {
+		void run() throws Exception;
+	}
+
+	static Task<Void> createTask(TaskAction action) {
+		return new Task<Void>() {
+			@Override
+			protected Void call() throws Exception {
+				action.run();
+				return null;
+			}
+		};
+	}
+
+}

From a7b8541912adce80744eed1640abd98991c32420 Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Fri, 30 Jan 2026 15:27:31 +0100
Subject: [PATCH 12/15] Update Slack webhook URL secret in workflow

---
 .github/workflows/dependency-check.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dependency-check.yml b/.github/workflows/dependency-check.yml
index 22d2a5fc5..2f132071a 100644
--- a/.github/workflows/dependency-check.yml
+++ b/.github/workflows/dependency-check.yml
@@ -16,4 +16,4 @@ jobs:
       nvd-api-key: ${{ secrets.NVD_API_KEY }}
       ossindex-username: ${{ secrets.OSSINDEX_USERNAME }}
       ossindex-token: ${{ secrets.OSSINDEX_API_TOKEN }}
-      slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
+      slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_CRYPTOMATOR_DESKTOP }}

From 80276ee992019c2bfd095345190c566744b0ed91 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 9 Feb 2026 09:27:49 +0100
Subject: [PATCH 13/15] Bump the github-actions group across 1 directory with 8
 updates (#4124)

Bumps the github-actions group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.1` | `6.0.2` |
| [actions/setup-java](https://github.com/actions/setup-java) | `5.1.0` | `5.2.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `5.0.0` | `6.0.0` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `6.0.0` | `7.0.0` |
| [actions/cache](https://github.com/actions/cache) | `4.3.0` | `5.0.3` |
| [skymatic/workflows/.github/workflows/run-dependency-check.yml](https://github.com/skymatic/workflows) | `3.0.1` | `3.0.2` |
| [fjogeleit/http-request-action](https://github.com/fjogeleit/http-request-action) | `1.16.6` | `2.0.0` |
| [skymatic/workflows](https://github.com/skymatic/workflows) | `3.0.1` | `3.0.2` |



Updates `actions/checkout` from 6.0.1 to 6.0.2
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/8e8c483db84b4bee98b60c0593521ed34d9990e8...de0fac2e4500dabe0009e67214ff5f5447ce83dd)

Updates `actions/setup-java` from 5.1.0 to 5.2.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](https://github.com/actions/setup-java/compare/f2beeb24e141e01a676f977032f5a29d81c9e27e...be666c2fcd27ec809703dec50e508c2fdc7f6654)

Updates `actions/upload-artifact` from 5.0.0 to 6.0.0
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/330a01c490aca151604b8cf639adc76d48f6c5d4...b7c566a772e6b6bfb58ed0dc250532a479d7789f)

Updates `actions/download-artifact` from 6.0.0 to 7.0.0
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/018cc2cf5baa6db3ef3c5f8a56943fffe632ef53...37930b1c2abaa49bbe596cd826c3c89aef350131)

Updates `actions/cache` from 4.3.0 to 5.0.3
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/0057852bfaa89a56745cba8c7296529d2fc39830...cdf6c1fa76f9f475f3d7449005a359c84ca0f306)

Updates `skymatic/workflows/.github/workflows/run-dependency-check.yml` from 3.0.1 to 3.0.2
- [Release notes](https://github.com/skymatic/workflows/releases)
- [Commits](https://github.com/skymatic/workflows/compare/1074588008ae3326a2221ea451783280518f0366...2d0c27a7b04c605afe1ca85e37c0e86517defcc9)

Updates `fjogeleit/http-request-action` from 1.16.6 to 2.0.0
- [Release notes](https://github.com/fjogeleit/http-request-action/releases)
- [Changelog](https://github.com/fjogeleit/http-request-action/blob/main/RELEASE.md)
- [Commits](https://github.com/fjogeleit/http-request-action/compare/c0b95d02a088b47c1f2f4db04fd8af8bd19eee54...551353b829c3646756b2ec2b3694f819d7957495)

Updates `skymatic/workflows` from 3.0.1 to 3.0.2
- [Release notes](https://github.com/skymatic/workflows/releases)
- [Commits](https://github.com/skymatic/workflows/compare/1074588008ae3326a2221ea451783280518f0366...2d0c27a7b04c605afe1ca85e37c0e86517defcc9)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/setup-java
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/cache
  dependency-version: 5.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: skymatic/workflows/.github/workflows/run-dependency-check.yml
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: fjogeleit/http-request-action
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: skymatic/workflows
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/appimage.yml          | 10 +++++-----
 .github/workflows/aur.yml               |  2 +-
 .github/workflows/av-whitelist.yml      |  6 +++---
 .github/workflows/build.yml             |  6 +++---
 .github/workflows/check-jdk-updates.yml |  2 +-
 .github/workflows/debian.yml            |  6 +++---
 .github/workflows/dependency-check.yml  |  2 +-
 .github/workflows/dl-stats.yml          |  2 +-
 .github/workflows/flathub.yml           |  2 +-
 .github/workflows/get-version.yml       |  4 ++--
 .github/workflows/mac-dmg-x64.yml       |  6 +++---
 .github/workflows/mac-dmg.yml           |  6 +++---
 .github/workflows/pullrequest.yml       |  4 ++--
 .github/workflows/release-check.yml     |  6 +++---
 .github/workflows/win-exe.yml           | 22 +++++++++++-----------
 15 files changed, 43 insertions(+), 43 deletions(-)

diff --git a/.github/workflows/appimage.yml b/.github/workflows/appimage.yml
index 459d20749..2d4e47b08 100644
--- a/.github/workflows/appimage.yml
+++ b/.github/workflows/appimage.yml
@@ -44,9 +44,9 @@ jobs:
             openjfx-url: 'https://download2.gluonhq.com/openjfx/25/openjfx-25_linux-aarch64_bin-jmods.zip'
             openjfx-sha: '9ad4ca7b769ca4ee6419f1e99143dd6ff812f8be4fddb46a7d7cacbeea148af4'
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup Java
-        uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: ${{ env.JAVA_DIST }}
           java-version: ${{ env.JAVA_VERSION }}
@@ -175,7 +175,7 @@ jobs:
           gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --detach-sign -a cryptomator-*.AppImage
           gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --detach-sign -a cryptomator-*.AppImage.zsync
       - name: Upload artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: appimage-${{ matrix.appimage-suffix }}
           path: |
@@ -201,7 +201,7 @@ jobs:
     if: github.event_name == 'release' && needs.get-version.outputs.versionType == 'stable'
     steps:
       - name: Download AppImages
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           path: downloads/
           merge-multiple: true
@@ -212,7 +212,7 @@ jobs:
           echo "x64-sha256sum=${X64_SHA256}" >> "$GITHUB_OUTPUT"
           AARCH64_SHA256=$(sha256sum downloads/cryptomator-*-aarch64.AppImage | cut -d ' ' -f1)
           echo "aarch64-sha256sum=${AARCH64_SHA256}" >> "$GITHUB_OUTPUT"
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: 'cryptomator/aur-bin'
           token: ${{ secrets.CRYPTOBOT_PR_TOKEN }}
diff --git a/.github/workflows/aur.yml b/.github/workflows/aur.yml
index c8957c5de..303ce398c 100644
--- a/.github/workflows/aur.yml
+++ b/.github/workflows/aur.yml
@@ -48,7 +48,7 @@ jobs:
     env:
       AUR_PR_URL: tbd
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: 'cryptomator/aur'
           token: ${{ secrets.CRYPTOBOT_PR_TOKEN }}
diff --git a/.github/workflows/av-whitelist.yml b/.github/workflows/av-whitelist.yml
index 90560c87b..4a8aba9af 100644
--- a/.github/workflows/av-whitelist.yml
+++ b/.github/workflows/av-whitelist.yml
@@ -51,7 +51,7 @@ jobs:
       - name: Download file
         run: curl "${INPUT_URL}" -L -o "${{steps.extractName.outputs.fileName}}" --fail-with-body
       - name: Upload artifact
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: ${{ steps.extractName.outputs.fileName }}
           path: ${{ steps.extractName.outputs.fileName }}
@@ -63,7 +63,7 @@ jobs:
     if: inputs.kaspersky
     steps:
       - name: Download artifact
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           name: ${{ needs.download-file.outputs.fileName }}
           path: upload
@@ -83,7 +83,7 @@ jobs:
     if: inputs.avast
     steps:
       - name: Download artifact
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           name: ${{ needs.download-file.outputs.fileName }}
           path: upload
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a393ace7c..12ab0d3fe 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -22,14 +22,14 @@ jobs:
     name: Compile and Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-      - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: ${{ env.JAVA_DIST }}
           java-version: ${{ env.JAVA_VERSION }}
           cache: 'maven'
       - name: Cache SonarCloud packages
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: ~/.sonar/cache
           key: ${{ runner.os }}-sonar
diff --git a/.github/workflows/check-jdk-updates.yml b/.github/workflows/check-jdk-updates.yml
index 3613e546c..9eae6da00 100644
--- a/.github/workflows/check-jdk-updates.yml
+++ b/.github/workflows/check-jdk-updates.yml
@@ -26,7 +26,7 @@ jobs:
         run: echo 'JDK_MAJOR_VERSION=${{ env.JDK_VERSION }}'.substring(0,2) >> "$env:GITHUB_ENV"
         shell: pwsh
       - name: Checkout latest JDK ${{ env.JDK_MAJOR_VERSION }}
-        uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: ${{ env.JDK_MAJOR_VERSION}}
           distribution: ${{ env.JDK_VENDOR }}
diff --git a/.github/workflows/debian.yml b/.github/workflows/debian.yml
index 5a632ac40..141e76e66 100644
--- a/.github/workflows/debian.yml
+++ b/.github/workflows/debian.yml
@@ -43,7 +43,7 @@ jobs:
     env:
       INPUT_PPAVER: ${{ inputs.ppaver }}
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - id: deb-version
         name: Determine deb-version
         run: |
@@ -60,7 +60,7 @@ jobs:
         env:
           DEB_BUILD_DEPENDS: ${{ env.DEB_BUILD_DEPENDS }}
       - name: Setup Java
-        uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: ${{ env.JAVA_DIST }}
           java-version: ${{ env.JAVA_VERSION }}
@@ -143,7 +143,7 @@ jobs:
         run: |
           gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --detach-sign -a cryptomator_*_amd64.deb
       - name: Upload artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: linux-deb-package
           path: |
diff --git a/.github/workflows/dependency-check.yml b/.github/workflows/dependency-check.yml
index 2f132071a..4ffcb9ff1 100644
--- a/.github/workflows/dependency-check.yml
+++ b/.github/workflows/dependency-check.yml
@@ -7,7 +7,7 @@ on:
 
 jobs:
   check-dependencies:
-    uses: skymatic/workflows/.github/workflows/run-dependency-check.yml@1074588008ae3326a2221ea451783280518f0366 # v3.0.1
+    uses: skymatic/workflows/.github/workflows/run-dependency-check.yml@957d3c2c08c56855fdac41e5afb9a7aca8c30dd9 # v3.0.3
     with:
       runner-os: 'ubuntu-latest'
       java-distribution: 'temurin'
diff --git a/.github/workflows/dl-stats.yml b/.github/workflows/dl-stats.yml
index 7bca07e5d..bfc53db3c 100644
--- a/.github/workflows/dl-stats.yml
+++ b/.github/workflows/dl-stats.yml
@@ -53,7 +53,7 @@ jobs:
           INTERVAL: 900
           JSON_DATA: ${{ steps.get-stats.outputs.result }}
       - name: Upload Results
-        uses: fjogeleit/http-request-action@c0b95d02a088b47c1f2f4db04fd8af8bd19eee54 # v1.16.6
+        uses: fjogeleit/http-request-action@551353b829c3646756b2ec2b3694f819d7957495 # v2.0.0
         with:
           url: 'https://graphite-us-central1.grafana.net/metrics'
           method: 'POST'
diff --git a/.github/workflows/flathub.yml b/.github/workflows/flathub.yml
index 179f72de3..e31f4cfdc 100644
--- a/.github/workflows/flathub.yml
+++ b/.github/workflows/flathub.yml
@@ -43,7 +43,7 @@ jobs:
     env:
       FLATHUB_PR_URL: tbd
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: 'flathub/org.cryptomator.Cryptomator'
           token: ${{ secrets.CRYPTOBOT_PR_TOKEN }}
diff --git a/.github/workflows/get-version.yml b/.github/workflows/get-version.yml
index deb199794..f75b22a63 100644
--- a/.github/workflows/get-version.yml
+++ b/.github/workflows/get-version.yml
@@ -35,11 +35,11 @@ jobs:
       revNum: ${{ steps.versions.outputs.revNum }}
       type: ${{ steps.versions.outputs.type}}
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
       - name: Setup Java
-        uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: ${{ env.JAVA_DIST }}
           java-version: ${{ env.JAVA_VERSION }}
diff --git a/.github/workflows/mac-dmg-x64.yml b/.github/workflows/mac-dmg-x64.yml
index be790a063..b1677458e 100644
--- a/.github/workflows/mac-dmg-x64.yml
+++ b/.github/workflows/mac-dmg-x64.yml
@@ -47,9 +47,9 @@ jobs:
           openjfx-url: 'https://download2.gluonhq.com/openjfx/25/openjfx-25_osx-x64_bin-jmods.zip'
           openjfx-sha: '0eba73fb28a24c845175d16fa2f8c081c936ce6de1be9b79eb6119fa32e53d52'
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup Java
-        uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: ${{ env.JAVA_DIST }}
           java-version: ${{ env.JAVA_VERSION }}
@@ -283,7 +283,7 @@ jobs:
         run: security delete-keychain $RUNNER_TEMP/codesign.keychain-db
         continue-on-error: true
       - name: Upload artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: dmg-${{ matrix.output-suffix }}
           path: |
diff --git a/.github/workflows/mac-dmg.yml b/.github/workflows/mac-dmg.yml
index 4182ab180..8b341b56a 100644
--- a/.github/workflows/mac-dmg.yml
+++ b/.github/workflows/mac-dmg.yml
@@ -45,9 +45,9 @@ jobs:
           openjfx-url: 'https://download2.gluonhq.com/openjfx/25/openjfx-25_osx-aarch64_bin-jmods.zip'
           openjfx-sha: '13f8c0513c40c95881479fbcf0465a29a60217393fb0656f5e4eab78a9442fba'
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup Java
-        uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: ${{ env.JAVA_DIST }}
           java-version: ${{ env.JAVA_VERSION }}
@@ -282,7 +282,7 @@ jobs:
         run: security delete-keychain $RUNNER_TEMP/codesign.keychain-db
         continue-on-error: true
       - name: Upload artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: dmg-${{ matrix.output-suffix }}
           path: |
diff --git a/.github/workflows/pullrequest.yml b/.github/workflows/pullrequest.yml
index 3ad72f3ae..a0f6beefe 100644
--- a/.github/workflows/pullrequest.yml
+++ b/.github/workflows/pullrequest.yml
@@ -16,8 +16,8 @@ jobs:
     name: Compile and Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-      - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: ${{ env.JAVA_DIST }}
           java-version: ${{ env.JAVA_VERSION }}
diff --git a/.github/workflows/release-check.yml b/.github/workflows/release-check.yml
index ca621c580..897ff8647 100644
--- a/.github/workflows/release-check.yml
+++ b/.github/workflows/release-check.yml
@@ -19,9 +19,9 @@ jobs:
     name: Validate commits pushed to release/hotfix branch to fulfill release requirements
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup Java
-        uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: ${{ env.JAVA_DIST }}
           java-version: ${{ env.JAVA_VERSION }}
@@ -49,7 +49,7 @@ jobs:
             exit 1
           fi
       - name: Cache NVD DB
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: ~/.m2/repository/org/owasp/dependency-check-data/
           key: dependency-check-${{ github.run_id }}
diff --git a/.github/workflows/win-exe.yml b/.github/workflows/win-exe.yml
index 6b258e154..749cab0c2 100644
--- a/.github/workflows/win-exe.yml
+++ b/.github/workflows/win-exe.yml
@@ -51,9 +51,9 @@ jobs:
             java-version: '25.0.1+8'
             java-package: 'jdk'
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup Java
-        uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: ${{ matrix.java-dist }}
           java-version: ${{ matrix.java-version }}
@@ -200,7 +200,7 @@ jobs:
           client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
       - name: Sign DLLs with Actalis CodeSigner
         if: inputs.sign || github.event_name == 'release'
-        uses: skymatic/workflows/.github/actions/win-sign-action@1074588008ae3326a2221ea451783280518f0366 # no specific version
+        uses: skymatic/workflows/.github/actions/win-sign-action@957d3c2c08c56855fdac41e5afb9a7aca8c30dd9 # no specific version
         with:
           base-dir: 'appdir'
           file-extensions: 'dll,exe,ps1'
@@ -277,7 +277,7 @@ jobs:
           GPG_PRIVATE_KEY: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }}
       - name: Upload artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: msi-${{ matrix.arch }}
           path: |
@@ -299,21 +299,21 @@ jobs:
             java-version: '24.0.1+9'
             java-package: 'jdk'
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Install wix and extensions
         run: |
           dotnet tool install --global wix --version 6.0.0
           wix.exe extension add WixToolset.BootstrapperApplications.wixext/6.0.0 --global
           wix.exe extension add WixToolset.Util.wixext/6.0.0 --global
       - name: Download .msi
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           name: msi-${{ matrix.arch }}
           path: dist/win/bundle/resources
       - name: Strip version info from msi file name
         run: mv dist/win/bundle/resources/Cryptomator*.msi dist/win/bundle/resources/Cryptomator.msi
       - name: Setup Java
-        uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: ${{ matrix.java-dist }}
           java-version: ${{ matrix.java-version }}
@@ -376,7 +376,7 @@ jobs:
           client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
       - name: Sign burn engine with Actalis CodeSigner
         if: inputs.sign || github.event_name == 'release'
-        uses: skymatic/workflows/.github/actions/win-sign-action@1074588008ae3326a2221ea451783280518f0366 # no specific version
+        uses: skymatic/workflows/.github/actions/win-sign-action@957d3c2c08c56855fdac41e5afb9a7aca8c30dd9 # no specific version
         with:
           base-dir: 'tmp'
           file-extensions: 'exe'
@@ -400,7 +400,7 @@ jobs:
           client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
       - name: Sign installer with Actalis CodeSigner
         if: inputs.sign || github.event_name == 'release'
-        uses: skymatic/workflows/.github/actions/win-sign-action@1074588008ae3326a2221ea451783280518f0366 # no specific version
+        uses: skymatic/workflows/.github/actions/win-sign-action@957d3c2c08c56855fdac41e5afb9a7aca8c30dd9 # no specific version
         with:
           base-dir: 'installer'
           file-extensions: 'exe'
@@ -418,7 +418,7 @@ jobs:
           GPG_PRIVATE_KEY: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }}
       - name: Upload artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: exe-${{ matrix.executable-suffix }}
           path: |
@@ -436,7 +436,7 @@ jobs:
       download-url-exe-x64: ${{ fromJSON(steps.publish.outputs.assets)[2].browser_download_url }}
     steps:
       - name: Download installers
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           merge-multiple: true
       - name: Publish installers on GitHub Releases

From 25236099965f40588a8d96839a662bf8fd2b1eba Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Mon, 9 Feb 2026 14:49:07 +0100
Subject: [PATCH 14/15] disable loading of user defined config for windows msi
 (#4132)

---
 dist/win/contrib/disableUserConfig.bat | 12 ++++++++++++
 dist/win/contrib/disableUserConfig.ps1 | 24 ++++++++++++++++++++++++
 dist/win/resources/main.wxs            |  7 ++++++-
 3 files changed, 42 insertions(+), 1 deletion(-)
 create mode 100644 dist/win/contrib/disableUserConfig.bat
 create mode 100644 dist/win/contrib/disableUserConfig.ps1

diff --git a/dist/win/contrib/disableUserConfig.bat b/dist/win/contrib/disableUserConfig.bat
new file mode 100644
index 000000000..dd26ca402
--- /dev/null
+++ b/dist/win/contrib/disableUserConfig.bat
@@ -0,0 +1,12 @@
+@echo off
+:: Batch wrapper for PowerShell script to disable user configuration in Cryptomator
+:: This is executed as a Custom Action during MSI installation
+:: This file must be located in the INSTALLDIR
+
+:: Change to INSTALLDIR
+cd %~dp0
+:: Execute the PowerShell script
+powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy RemoteSigned -File ".\disableUserConfig.ps1"
+
+:: Return the exit code from PowerShell
+exit /b %ERRORLEVEL%
\ No newline at end of file
diff --git a/dist/win/contrib/disableUserConfig.ps1 b/dist/win/contrib/disableUserConfig.ps1
new file mode 100644
index 000000000..4ed9a5c51
--- /dev/null
+++ b/dist/win/contrib/disableUserConfig.ps1
@@ -0,0 +1,24 @@
+# PowerShell script to disable user configuration
+# This script is executed as a Custom Action during MSI installation
+# It deletes the file .package, effectively disabling user specific jpackage configuration.
+# NOTE: This file must be located in the same directory as set in the MSI property INSTALLDIR
+
+try {
+
+    # Determine  file path
+    $packageFile = Join-Path $PSScriptRoot 'app\.package'
+
+    #check if file exists
+    if (Test-Path -Path $packageFile) {
+        Write-Host "Deleting file: $packageFile"
+        Remove-Item -Path $packageFile -Force -ErrorAction Stop
+    } else {
+        Write-Host "File not found: $packageFile. Skipping deletion."
+    }
+
+    exit 0
+}
+catch {
+    Write-Error "Error deleting package file: $_"
+    exit 1
+}
\ No newline at end of file
diff --git a/dist/win/resources/main.wxs b/dist/win/resources/main.wxs
index 6310c6985..7269c29f5 100644
--- a/dist/win/resources/main.wxs
+++ b/dist/win/resources/main.wxs
@@ -132,6 +132,10 @@
     <!-- Property for controlling update check behavior (can be set via command line) -->
     <ns0:Property Id="DISABLEUPDATECHECK" Secure="yes" />
 
+    <!-- Disable user config -->
+    <ns0:SetProperty Id="DisableUserConfig" Value="&quot;[INSTALLDIR]disableUserConfig.bat&quot;" Sequence="execute" Before="DisableUserConfig" />
+    <ns0:CustomAction Id="DisableUserConfig" BinaryRef="Wix4UtilCA_$(sys.BUILDARCHSHORT)" DllEntry="WixQuietExec" Execute="deferred" Return="ignore" Impersonate="no"/>
+
     <!-- WebDAV patches -->
     <ns0:SetProperty Id="PatchWebDAV" Value="&quot;[INSTALLDIR]patchWebDAV.bat&quot; &quot;$(var.LoopbackAlias)&quot;" Sequence="execute" Before="PatchWebDAV" />
     <ns0:CustomAction Id="PatchWebDAV" BinaryRef="Wix4UtilCA_$(sys.BUILDARCHSHORT)" DllEntry="WixQuietExec" Execute="deferred" Return="ignore" Impersonate="no"/>
@@ -188,9 +192,10 @@
       <ns0:Custom Action="FailOnRunningApp" After="Wix4CloseApplications_$(sys.BUILDARCHSHORT)" Condition="FOUNDRUNNINGAPP" />
 
       <ns0:RemoveExistingProducts After="InstallValidate"/> <!-- Moved from CostInitialize, due to Wix4CloseApplications_* -->
+      <ns0:Custom Action="DisableUserConfig" After="InstallFiles" Condition="NOT (Installed AND (NOT REINSTALL) AND (NOT UPGRADINGPRODUCTCODE) AND REMOVE)"/>
       <!-- Skip action on uninstall -->
       <!-- TODO: don't skip action, but remove cryptomator alias from hosts file -->
-      <ns0:Custom Action="PatchWebDAV" After="InstallFiles" Condition="NOT (Installed AND (NOT REINSTALL) AND (NOT UPGRADINGPRODUCTCODE) AND REMOVE)"/>
+      <ns0:Custom Action="PatchWebDAV" After="DisableUserConfig" Condition="NOT (Installed AND (NOT REINSTALL) AND (NOT UPGRADINGPRODUCTCODE) AND REMOVE)"/>
       <!-- Configure update check setting if property is provided -->
       <ns0:Custom Action="PatchUpdateCheck" After="PatchWebDAV" Condition="DISABLEUPDATECHECK AND NOT (Installed AND (NOT REINSTALL) AND (NOT UPGRADINGPRODUCTCODE) AND REMOVE)"/>
     </ns0:InstallExecuteSequence>

From 4cf11cf29335acdf7c3c13f31fa7b1b0685f1c9b Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Mon, 9 Feb 2026 14:56:37 +0100
Subject: [PATCH 15/15] [skip ci] update changelog

---
 CHANGELOG.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bf1ec42fc..10f1135e8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,4 +20,5 @@ Changes to prior versions can be found on the [Github release page](https://gith
 
 ### Changed
 * Built using JDK 25 ([#4031](https://github.com/cryptomator/cryptomator/issues/4031))
-* Modernized Template for GitHub Releases
\ No newline at end of file
+* Modernized Template for GitHub Releases
+* Disable user defined app start config on Windows ([#4132](https://github.com/cryptomator/cryptomator/issues/4132))